@sema-agent/server 7.136.0 → 7.138.0

package/dist/http/server.d.ts

@@ -1,11 +1,14 @@
 import http from "node:http";
+import type { MemoryComplianceFaces } from "../memory-operator-faces.js";
+import type { SideQueryAccounting } from "../budget.js";
 import type { IncomingMessage } from "node:http";
-import { type Runner, type TaskSpec, type TaskResult, type WorkflowRunStore, type MemoryEntry, type MemoryExportBundle, type MemoryImportReport, type EntryProvenanceAccount, type MemoryErasureAttestation, type MemoryEntryOrigin, type OriginClearanceRow, type SessionMemoryStatus, type ConsolidationRunReceipt, type ConsolidationDriverRunRow, type SideQuerySpec, type SideQueryResult, type Brain, type EngineNotice } from "@sema-agent/core";
+import { type Runner, type TaskSpec, type TaskResult, type WorkflowRunStore, type MemoryEntry, type MemoryExportBundle, type MemoryImportReport, type EntryProvenanceAccount, type MemoryEntryOrigin, type OriginClearanceRow, type SessionMemoryStatus, type ConsolidationRunReceipt, type ConsolidationDriverRunRow, type SideQuerySpec, type SideQueryResult, type Brain, type EngineNotice } from "@sema-agent/core";
 import type { TaskRequestBody } from "./wire-types.js";
 import type { ServiceConfig } from "../config-types.js";
 import { type SessionMirrorRuling } from "../web-admin-client/facade.js";
 import type { RestartSignal } from "@sema-agent/settings-schema/fleet";
 import { type OwnerAwareSessionStore } from "../security.js";
+import type { PeerDesk, PeerLease } from "../peer-seat.js";
 import type { RunStore, ImageIndex, ImageBake, CheckpointStoreFull, ResumeAnchorStore, ApprovalExemptionStore, ApprovalNonceStore, ServiceSessionPolicyStore, ServiceFileHistoryStore, ToolResultStoreFull, StoreBackend } from "../plugins/store-backend.js";
 import type { RuleConsentLane } from "../rules-consent.js";
 import { type MemorySyncRequest, type MemorySyncResponse } from "../memory-sync.js";
@@ -57,7 +60,7 @@ export interface RequestAuth {
  * 平铺形的直接后果 = main.ts 一个上千行的装配字面量,键与键之间没有任何「属于同一件事」的编译期表达,
  * 键落错家/从未接线只能靠源码钉逐个盯(1.300/1.301/1.304/1.307/1.310 五起真缺陷都是这个病族)。
  *
- * 药:七个**窄**接口 + 顶层必填五件。装配点按组构造(每组一个带类型标注的中间 const ⇒ 受 TS 多余
+ * 药:七个**窄**接口 + 顶层必填七件。装配点按组构造(每组一个带类型标注的中间 const ⇒ 受 TS 多余
  * 属性检查保护),键放错组当场编译红。
  *
  * 兼容形(本批**不动消费点**):`ServiceDeps` = 平铺视图 ∩ 组槽。旧的平铺构造(96 个测试文件 +
@@ -65,8 +68,8 @@ export interface RequestAuth {
  * 入口摊平回平铺视图,server.ts 内的 ~700 处 `deps.x` 消费点原样保留。消费点迁移是后批的事——
  * 一步到位需要同批改 ~700 处 src + ~800 处 test 键位,与「先立形、后搬家」相比没有额外收益。
  */
-/** createHttpServer 的**必填五件**——引擎、部署配置、请求→TaskSpec 的映射、side-query 执行席、读口场景门。
- *  五者恒在场,故留在顶层(不进任何可选组):没有它们 server 根本起不来,包一层可选组只会把编译期
+/** createHttpServer 的**必填七件**——引擎、部署配置、请求→TaskSpec 的映射、选路席、side-query 执行席、读口场景门、对端座的 desk。
+ *  七者恒在场,故留在顶层(不进任何可选组):没有它们 server 根本起不来,包一层可选组只会把编译期
  *  错误推迟到运行期(本仓 E-HIGH-1 病族的成因就是「可选键从未接线、编译期无声」)。 */
 export interface ServiceCoreDeps {
     runner: Runner;
@@ -105,11 +108,15 @@ export interface ServiceCoreDeps {
      *  `opts.unattendedLeg`([ref] 候裁 18,codex r3 F1;[ref] ① 改形):续跑家族在 ctx 带无人值守标(`CheckpointCtx.unattendedLeg`)时递 `true` ——
      *  装配器在**全部折叠之后**经首跑同一只合并口 `withUnattendedLeg` 重挂那条腿(`default` + 按类作答的 onAsk)。只由续跑腿
      *  按服务端写的 ctx 位递,绝不从请求体读。 */
-    resolveSpec: (body: TaskRequestBody, req: IncomingMessage | undefined, auth?: RequestAuth, opts?: {
+    /** `opts.lease`(必填):这条腿的**宿主租约** —— 装配在它之下登记本腿交给引擎的对端声明(`peerDesk.declare(草稿, opts.lease)`)。
+     *  租约由两只漏斗(受理 `prepareSpec` / 续跑 `resolveResumeSpecOrBlocked`)在调用本函数**之前**开、由漏斗的失败出口或拿到产物的那段作用域放;
+     *  装配只借用,不放、不留。实现方自铸的声明归自己的 desk 时可以不理它。 */
+    resolveSpec: (body: TaskRequestBody, req: IncomingMessage | undefined, auth: RequestAuth | undefined, opts: {
         leg?: "fresh" | "resume";
         liveStream?: boolean;
         onNotice?: (notice: EngineNotice) => void;
         unattendedLeg?: true;
+        lease: PeerLease;
     }) => TaskSpec | Promise<TaskSpec>;
     /**
      * [ref] 场景 hands lane 选路:按 `resolveSpec` 刚产出的 TaskSpec 取本任务的执行 Runner。
@@ -134,6 +141,16 @@ export interface ServiceCoreDeps {
      * `createScenarioGate` / `ScenarioGate` / `ScenarioGateLeg` / `ScenarioGateSources`)。
      */
     scenarioGate: import("../capabilities/scenarios.js").ScenarioGate;
+    /**
+     * 对端座的 desk(`peer-seat.ts`):MCP http 请求的凭据头 / stdio 子进程的环境 / A2A 发送的头,发送时只有它一只作答者;登记一条活到它的 holder 都空。
+     * 本层用它开**宿主租约**:受理与续跑两只漏斗在装配之前各开一只(`lease("fresh")` / `lease("resume")`),经 `resolveSpec` 的 `opts.lease` 交给装配,
+     * 随产物(`PreparedTaskSubmission.peerLease` / 续跑结果)交给拿到它的那段作用域,在那段作用域的 `finally` 放;活过那段作用域的驱动经 `heldFor` 自持一只。
+     * 这只 desk 另有三处用法,不止这两只漏斗:① 探测口 `POST /v1/capabilities/mcp/probe` 的调用方臂在走查里开一只 `probe` 租约(三道前置拒之后开,拨号落地才放);
+     * ② 两张会话面板(`GET /v1/sessions/:id/mcp` · `…/a2a`)与探测走查拨名册声明时递它的座(`desk.seat.answer`),不开租约;③ 名册声明在起服时登记在一只进程寿命的 `roster` 租约下
+     * (stage-07 / run-local 开,从不放),并且每只 Runner 的 `peerSeat` 是它的座。登记表的两个读数是 `/metrics` 的 `peer_registry_entries` / `peer_registry_holders`。
+     * 🔴 **必填**:没有 MCP / A2A 凭据的嵌入也给一只 `createPeerDesk()`(零 IO)—— 一个部署只有一张登记表,缺席不是「没有座」的另一种读法。
+     */
+    peerDesk: PeerDesk;
 }
 /** **durable 持久面**:每个键 present ⇔ 对应路由/能力位在场,absent ⇒ 501(诚实缺席),
  *  绝不静默降级。装配点 = main.ts 的 store backend 开箱段。 */
@@ -471,12 +488,7 @@ export interface ServiceSeamDeps {
      *  🔴 `erase` 的入参是 `unknown` 而不是 `EraseMemoryEntriesInput`:HTTP 层拿到的是一个**未校验**的对象,
      *  三选一选择子的整体判决是 core 的单一属主面(`erasureRequestInvalid`)。写成具体类型就得在路由里断言
      *  一次「它是合法输入」——那句断言是假的,而且正好把类型检查关灯。 */
-    memoryCompliance?: {
-        provenanceOf: (entryId: string) => Promise<EntryProvenanceAccount>;
-        erase: (input: unknown, opts?: {
-            allowedScopes?: readonly string[];
-        }) => Promise<MemoryErasureAttestation>;
-    };
+    memoryCompliance?: MemoryComplianceFaces;
     /** [ref] seam①([ref] §S-7,core 7.0.2 [ref] 件1):**会话记忆状态读面**。启用
      *  `GET /v1/sessions/:id/memory-status`(owner 门,tenant 自助读 —— 不是 operator 面)。
      *  main.ts 把它接到 `createSessionMemoryStatusFace` 的产物上(单实例引擎,SQL capture 店同座喂入)。
@@ -592,19 +604,7 @@ export interface ServiceSeamDeps {
     /** [ref] side-query 记账 seam(budget.ts createSideQueryAccountant——与 createTracer 同一装配点、
      *  同一组 sink 实例:costQuota/model_cost 指标/fleetUsage/fleetLease,四路同语义)。缺席=零记账
      *  (手搭测试 deps;生产 main.ts 恒传)。 */
-    sideQueryAccounting?: (principal: string | undefined, r: {
-        model: string;
-        family?: "input-includes-cached" | "input-excludes-cached";
-        usage?: {
-            input?: number;
-            output?: number;
-            cacheRead?: number;
-            cacheWrite?: number;
-            cost?: {
-                total?: number;
-            };
-        };
-    }) => void;
+    sideQueryAccounting?: SideQueryAccounting;
     /** [ref](core 7.32.0):parked 赎回面工厂(按行解析驱动哪只 Agent 工具 + 同出一张列表的继承座;属主 `parked-revive-surface.ts`)。
      *  缺席 = 这台部署没有 park 底座(checkpointStore / backgroundAgentStore 任一缺席),bg 赎回臂不接线。 */
     parkedReviveSurface?: import("../parked-revive-surface.js").ParkedReviveSurfaceFactory;
@@ -695,6 +695,16 @@ export interface ServiceDeploymentDeps {
     /** [ref] ②:caps `centerWiring` 的读面(`capabilities/center-wiring.ts` `createCenterWiringReader`;入参 = 请求的已验 principal)。
      *  缺席 = 没接中心(或测试夹具)⇒ 键整个缺席。 */
     centerWiring?: (principal: string | undefined) => import("../capabilities/center-wiring.js").CenterWiring;
+    /** The member git-credential plane's one reading (`sandbox-git-plane.ts`; stage 5 computes it once — config premises + the boot's secret
+     *  seat answer + the static patch judge). Caps `credentialPlane.sandboxGit` projects it as is. Absent = not built by the composition root
+     *  (a fixture) ⇒ the same judge on config alone, the seat counted as not asked. */
+    sandboxGitPlane?: import("../sandbox-git-plane.js").SandboxGitPlane;
+    /**
+     * 本进程起服装上的**运维声明** mod 包数(部署座装配口 `assembleDeploymentMods` 的 `loaded.length`;本服务自铸的注册不算)。一个事实两个出口,同读这一格:
+     * `/health` 的 `mods: { deploymentPackages }` 与 `/v1/capabilities` 的 `modsDeploymentPackages: true` —— 都只在 > 0 时在场;0 / 缺席(没声明,或不是由
+     * composition root 装起来的夹具)⇒ 两键都缺席,两面与没有声明的部署逐字节同。
+     */
+    deploymentModPackages?: number;
     /**
      * Graceful drain — shared mutable state between main.ts (flips `draining` on SIGTERM) and this server:
      *  • while `draining`, NEW model-running submissions (the billable submit paths) get 503 + Retry-After, so an
@@ -857,7 +867,7 @@ export interface ServiceDepGroups {
     deployment?: ServiceDeploymentDeps;
     knobs?: ServiceKnobDeps;
 }
-/** 平铺视图 = 必填五件 + 其余七组的全可选并集。**派生**自组接口,故与分组形永不漂。 */
+/** 平铺视图 = 必填七件 + 其余七组的全可选并集。**派生**自组接口,故与分组形永不漂。 */
 export type FlatServiceDeps = ServiceCoreDeps & Partial<ServiceStoreDeps & ServiceCoordinatorDeps & ServiceSeamDeps & ServiceObservabilityDeps & ServiceGovernanceDeps & ServiceDeploymentDeps & ServiceKnobDeps>;
 /** createHttpServer 的入参:两形皆可(平铺=存量,分组=推荐)。同名键两形都给时,**顶层显式键赢**
  *  (含显式 `undefined`)——一处装配点只该用一形,混用时以肉眼最近的那个为准。 */

package/dist/http/stored-body-replay.d.ts

@@ -1,7 +1,7 @@
 /**
- * 「这条停驻行的持久化体在本版上能否重放」—— **唯一**判据(三问一只;五个问点同调:续跑驱动段 `resume-legs.ts` `resolveResumeSpecOrBlocked`、
+ * 「这条停驻行的持久化体在本版上能否重放」—— **唯一**判据(四问一只;五个问点同调:续跑驱动段 `resume-legs.ts` `resolveResumeSpecOrBlocked`、
  * plan_review 的 prepare 段、SLA 拒扫腿的跳过臂 `approval-sweeps.ts`、终态 run 的 steer 铸唤醒卡之前 `routes/runs.ts`;`resolveSpec` 本身留作提交腿的拒点)。
- * 三问的规则、记号、拒句与删除条件的属主 = `http/checkpoint-ctx.ts` 顶注;答复 = 那里的 `storedBodyReplayAnswer`。
+ * 四问的规则、记号、拒句与删除条件的属主 = `http/checkpoint-ctx.ts` 顶注;答复 = 那里的 `storedBodyReplayAnswer`。
  *
  * 为什么判据住在这里而不是 `checkpoint-ctx.ts`:第三问要读体的**生效模式词**(`task-settings.ts` `storedBodyPermissionMode`,请求设置的解析层)与本部署此刻的
  * **入口地板**(`runtime-governance.ts` `autonomyModeFloor`)—— 这两只属主带着配置层的包外依赖;`checkpoint-ctx.ts` 被随包的本地排空脚本经编译产物 import,
@@ -28,7 +28,7 @@ export type StoredReplayDeployment = LaneHomeDeployment & {
     readonly autonomy?: Autonomy | undefined;
 };
 /**
- * 三问一只判据:不能重放 ⇒ 返回拒的那条规则;能 ⇒ `undefined`。顺序:allow 读法记号 → 请求设置里的条目表(**与拒点同序**:桶门〔形 / 空串 / 超帽〕→ 工具名清单读成空〔**只问限制方向**:放行方向的存量条目读成空,续跑照旧、只留一行运维 warn〕→ deny / ask 的名字层 + 规则文法)→ 模式词读法记号(几问同中时答先中的那一问 ——
+ * 四问一只判据:不能重放 ⇒ 返回拒的那条规则;能 ⇒ `undefined`。顺序:allow 读法记号 → 请求设置里的条目表(**与拒点同序**:桶门〔形 / 空串 / 超帽〕→ 工具名清单读成空〔**只问限制方向**:放行方向的存量条目读成空,续跑照旧、只留一行运维 warn〕→ deny / ask 的名字层 + 规则文法)→ 模式词读法记号 → 体里的退役请求键(几问同中时答先中的那一问 ——
  * 任一问中都不重放,句子只需一句)。`deployment` = 本部署**此刻**的 `config`(活 config:热改即生效):`autonomy` 的地板由它的唯一属主算,`~/` 形规则的 home 由 `executionLaneHomeDir` 算,问点都不自己算。
  */
 export declare function storedBodyReplayRefusal(ctx: CheckpointCtx, deployment: StoredReplayDeployment): StoredBodyReplayRefusal | undefined;

package/dist/http/stored-body-replay.js

@@ -4,13 +4,15 @@ import { entryProblemsFacts } from "../entry-problems.js";
 import { autonomyModeFloor, entryPermissionMode } from "../runtime-governance.js";
 import { inertToolListEntryOf, replayInertEntry } from "../rule-entry-list.js";
 import { executionLaneHomeDir } from "../execution-lane-caps.js";
-import { allowListReadingEraOf, allowListReadingUnstated, permissionModeReadingStated } from "./checkpoint-ctx.js";
+import { migrationWindowEnd } from "../plugins/one-time-migrations.js";
+import { allowListReadingEraOf, allowListReadingUnstated, permissionModeReadingStated, retiredRequestKeyOf } from "./checkpoint-ctx.js";
 export function permissionModeReadingUnstated(ctx, floor) {
     if (floor === undefined || permissionModeReadingStated(ctx))
         return undefined;
     const stored = storedBodyPermissionMode(ctx.body);
     return entryPermissionMode(stored, floor).effective === stored ? undefined : { stored, floor };
 }
+const RETIRED_KEY_REWRITE_MIGRATION = { promptProfile: "M30" };
 const BUCKET_GATE_CODE = "request.field_invalid";
 function storedPermissions(body) {
     const permissions = body?.settings?.permissions;
@@ -52,6 +54,9 @@ export function storedBodyReplayRefusal(ctx, deployment) {
     const mode = permissionModeReadingUnstated(ctx, autonomyModeFloor(deployment.autonomy));
     if (mode !== undefined)
         return { kind: "permission_mode_reading", ...mode, ...writer };
+    const retiredKey = retiredRequestKeyOf(ctx.body);
+    if (retiredKey !== undefined)
+        return { kind: "retired_request_key", key: retiredKey, rewriteWindowEnd: migrationWindowEnd(RETIRED_KEY_REWRITE_MIGRATION[retiredKey]), ...writer };
     return undefined;
 }
 //# sourceMappingURL=stored-body-replay.js.map

package/dist/http/wire-types.d.ts

@@ -6,11 +6,37 @@
  * cut: ONLY TaskRequestBody (its field types are inline or core imports — no other server.ts-local satellites);
  * sibling request/response shapes can migrate here later on the same pattern.
  */
-import type { A2aServerSpec, AgentDefinition, ApprovalReach, PermissionMode, SkillSpec, TaskSpec } from "@sema-agent/core";
+import type { AgentDefinition, ApprovalReach, PermissionMode, SkillSpec, TaskSpec } from "@sema-agent/core";
 import type { RequestMcpServerSpec } from "../mcp-assertion-header.js";
+import type { RequestA2aPeer } from "../task-a2a.js";
 import type { wiringManifestFaceEventData } from "../trace/project.js";
 import type { buildSyncSubmitBody } from "./sync-submit-body.js";
 import type { EntryProblem } from "../entry-problems.js";
+/**
+ * 请求面上的一条技能 = core 的 `SkillSpec` 去掉 `mods`(core 7.56.0 [ref] 的技能座扩展注册:带 `register` 函数的代码对象,不是 wire 数据)。
+ * 带 `mods` 的请求技能受理门 400(`http/admission.ts` 的 `validateUserSkills`);本服务不编技能 hooks(能力位 `mods.skill_seat` 恒假)。
+ * 键集仍由 core 本体派生([ref]:core 加键,本型同批跟上;删 `mods` 是唯一的一处减法)。
+ */
+export type RequestSkill = Omit<SkillSpec, "mods">;
+/**
+ * `TaskRequestBody.attachments` 的子键集。本类型是这十个键在导出类型面上的**唯一**声明处;受理门(`http/admission.ts`)与重放翻译口
+ * (`spec-fields.ts` 的 `normalizeAttachments`)读 `spec-fields.ts` 的 `ATTACHMENT_KEY_KINDS` 那一张表,表与本接口互为差集门
+ * (`_GuardAttachmentKeys*`,漏一边 ⇒ tsc 红)。加 / 删一个键:本接口、那张表、`normalizeAttachments` 的逐键赋值三处同批改。
+ */
+export interface TaskRequestAttachments {
+    todoReminder?: boolean;
+    todoReminderMode?: "baseline" | "off";
+    changedFiles?: boolean | {
+        maxFiles?: number;
+    };
+    budgetUsd?: true;
+    backgroundTasks?: boolean;
+    toolsDelta?: boolean;
+    mcpInstructions?: true;
+    agentListing?: boolean;
+    skillsListing?: boolean;
+    mcpUnavailable?: boolean;
+}
 export interface TaskRequestBody {
     objective: string;
     sessionId?: string;
@@ -114,20 +140,20 @@ export interface TaskRequestBody {
     jobId?: string;
     /** Personalization seam: the caller's OWN skills for this task, threaded into core's
      *  `TaskSpec.skills`. Merged AFTER the scenario's skills with SCENARIO-WINS on a name clash (the security
-     *  baseline can never be shadowed by user content — see mergeUserSkills). User skills are user-authored
+     *  baseline can never be shadowed by user content — see buildRunSkills). User skills are user-authored
      *  content in the user's OWN principal-isolated task (self-harm surface, not privilege widening);
      *  scenario/center skills remain the only trusted layer.
      *
      *  🔴 **类型 = core 的 `SkillSpec` 本体,不是它的手抄子集**([ref]):这里曾写死
      *  `{ name; description; content }` —— core 闭集六位里的三位,而 `manifest` / `files` / `baseDir`
-     *  三位在运行期一直是**收的**(受理门 `validateUserSkills` 不判未知键,`mergeUserSkills` 原样透传到
+     *  三位在运行期一直是**收的**(受理门 `validateUserSkills` 不判未知键,`buildRunSkills` 原样透传到
      *  `TaskSpec.skills`)。一份会漂的手抄 = 声明面比真受理面**窄**,SDK 消费方按声明写代码就以为发不了,
      *  而 core 加键(7.20.0 [ref] 的 `baseDir`)时这里连红都不会红。改成 core 本体后,闭集由 tsc 看守。
      *  ⚠️ 受理**判据**(形/尺寸)仍在 `validateUserSkills` + `spec-fields.ts` 的 `SKILL_FIELD_SHAPES`——
      *  类型说「哪些键存在」,门说「值合不合法」,两者不是一件事。
      *  (旧注里的「Caps: ≤10 skills, content ≤32KB each」两条帽早已随 [ref] / core 1.293 退役,一并纠正:
      *   今天只剩 `content ≤ 1 MiB` 这一条 core 加载门孪生。) */
-    skills?: SkillSpec[];
+    skills?: RequestSkill[];
     /** §7 P0.5 (用户按需选像): the sandbox image PROFILE this task wants (e.g.
      *  "code-full" / "code-python"). An INTENT, never a digest — the service resolves it to a published digest with
      *  the caller's principal (fail-closed visibility re-admit) and applies it per-pod. Only supported on the k8s
@@ -247,19 +273,7 @@ export interface TaskRequestBody {
      *  boolean 透传(core DEFAULT-ON,explicit false 才关);budgetUsd/mcpInstructions 只认 literal true;
      *  limits 三个 opt-out 只认 literal false(normalizer 同判)。 */
     /** core 7.39.0 [ref]:`planModeReminder` 退役(硬破坏,零别名)—— 提交即 400 点名退役;plan 姿态由引擎从 `permissionMode:"plan"` 自己陈述。 */
-    attachments?: {
-        todoReminder?: boolean;
-        todoReminderMode?: "baseline" | "off";
-        changedFiles?: boolean | {
-            maxFiles?: number;
-        };
-        budgetUsd?: true;
-        backgroundTasks?: boolean;
-        toolsDelta?: boolean;
-        mcpInstructions?: true;
-        agentListing?: boolean;
-        skillsListing?: boolean;
-    };
+    attachments?: TaskRequestAttachments;
     /** C1 (core 1.219, subagent viewing pane): opt-in — forward a delegated child's live CONTENT events
      *  (text_delta/text_end/reasoning_delta/tool_start/tool_end, each stamped `parentToolCallId`) onto this run's stream/durable
      *  log, so a shell can render the child's transcript live ("enter 看详情"). Default OFF = progress-only (prior
@@ -337,9 +351,13 @@ export interface TaskRequestBody {
     /** [ref]② (core 1.314): [ref] 延迟披露清单(占位上 wire,ToolSearch 激活)——cli「Workflow 默认开
      *  不暴露」的承载位。同 excludeTools 的校验/继承姿势。 */
     deferTools?: string[];
-    /** [ref]/[ref] (core 1.328 R2): 提示词双形轴——simple(CC 212 短形,引擎缺省)| classic(长形,可按
-     *  任务/模型试分)。纯呈现轴无租户门;枚举 fail-loud at submit;缺省不挂键。 */
-    promptProfile?: "simple" | "classic";
+    /** core 7.56.0([ref]):提示词形的**唯一**任务开关 —— `true` 加 `lean_prompt` 特征(短形)、`false` 去掉它(长的 classic 形)、
+     *  缺省 = 模型目录条目自己的声明(引擎缺省 lean)。只动这一个特征,不碰其余特征;原样透传进 `TaskSpec.promptLean`,随引擎铸的每个子代走。
+     *  纯呈现轴无租户门;非布尔 400 fail-loud at submit;缺省不挂键。
+     *  退役键 `promptProfile`(7.136.x 及以前的 `"simple" | "classic"`)整键删、零别名:fresh 提交体仍带它 ⇒ 键闭集门 400 `request.body_shape`
+     *  (`unknownKeys:["promptProfile"]`);迁移 = `"classic"` ⇒ `promptLean: false`,`"simple"` ⇒ 不带键。续跑重放不过那道门:盘上 7.136.x 体里的旧键由一次性迁移 M30 在起服时按同一张映射原地改写(`stored-request-prompt-profile-m30.ts`;M30 · 窗口见 `plugins/one-time-migrations.ts` 登记表),
+     *  改写不到的残留行续跑 409(`http/stored-body-replay.ts` 第四问)—— 续跑腿不读旧键。 */
+    promptLean?: boolean;
     /** [ref]②(core 5.14.0 座已在,`TaskSpec.toolMaterializeStrategy`):deferred 工具在**激活之后**怎么给
      *  模型供 schema。`static` = 占位符形不变(激活只改可调用性,广告的 schema 仍是空对象);`swap` = 激活
      *  后下一轮把占位符换成真 schema。
@@ -352,7 +370,7 @@ export interface TaskRequestBody {
      *  core 把 `"static"` 重新定性为「a strict explicit opt-in」)。本注上一版还写着 `?? "static"`,照它推
      *  「不挂键 ⇒ 落 static」会反。缺省词的属主是 core,本仓不复述第二份——要确认取值去读 core 的
      *  `prepare-task` 与其 CHANGELOG。
-     *  缺省不挂键(交给 core 的 env/缺省链);未知词 400 fail-loud(与 promptProfile/permissionMode 同姿势 ——
+     *  缺省不挂键(交给 core 的 env/缺省链);未知词 400 fail-loud(与 permissionMode 同姿势 ——
      *  静默折缺省会让调用方以为切了策略却没切)。 */
     toolMaterializeStrategy?: "static" | "swap";
     /** R4 (CC parity): the LIGHT top-level per-turn permission-mode intent (CC `permissionMode`). The shell sends
@@ -363,7 +381,7 @@ export interface TaskRequestBody {
      *  `deniedBy:"mode"`); none can subtract from deployment/operator policy or the request's own deny / ask rules (tightenTaskSpec
      *  deny-wins). The top-level word wins over `settings.permissions.defaultMode` (the heavier bundle) — one precedence, read in one place.
      *  [ref]-②: CLOSED enum on the wire — an unknown word 400s at submit (`request.field_invalid`, sibling of
-     *  promptProfile) instead of silently coercing to `default`; resume replay of a stored body stays lenient
+     *  toolMaterializeStrategy) instead of silently coercing to `default`; resume replay of a stored body stays lenient
      *  (coercePermissionMode).
      *  🔴 型与闭集的属主是 core 的 `PermissionMode` / `PERMISSION_MODES`(受理腿 `isPermissionMode` 与三句 400 文案同读那一份)—— 本仓不持词表。 */
     permissionMode?: PermissionMode;
@@ -432,7 +450,7 @@ export interface TaskRequestBody {
     cwd?: string;
     /**
      * [ref](7.106.0,core [ref] [ref] ②)—— 模型驱动的 host shell **继承多少用户环境**,由调用方按请求声明。
-     * 闭集两词(词表外 ⇒ 400 `request.field_invalid`,两腿同判,判据属主 `request-value-closure.ts` 的 `inheritEnvFieldIssue`):
+     * 闭集两词(词表外 ⇒ 400 `request.field_invalid` + 机读位 `field: "inheritEnv"` / `reason`〔`unknown_word` | `not_a_string`〕,两腿同判,判据与机读位的属主 `request-value-closure.ts` 的 `inheritEnvFieldIssue`):
      *  · `"all"` —— 整份用户环境**减本服务自有凭据名**(配置目录 secret 名 / 名单型旋钮名 / 模型条目 `apiKeyEnv`,起服向引擎声明一次,判在引擎;7.129.0 起,CC 交互形);只在**单用户**部署兑现,射程 = 写容纳面那一只
      *    部署形表行 `taskHostPostureDeclarations`(`deployment-shape.ts`)⇒ 托管部署(`REQUIRE_PRINCIPAL=true`)响亮拒
      *    422 `request.host_posture_refused`;
@@ -440,7 +458,7 @@ export interface TaskRequestBody {
      * **缺席 = 缺省清洗**:不带键的请求把本会话的绑定清掉(不继承上一条请求的声明 —— 这一位是「本条请求要什么」,
      * 粘到下一条上就是替一个没说话的请求放宽)。名单形(`string[]`)**不上 wire**(那是嵌入方构造执行环境的选项)。
      * 🔒 **只有 host 车道有消费点**:别的车道(e2b / k8s / local-docker / ssh / adb / device / in-process)带 `"all"` ⇒
-     * 400 `request.field_invalid`「applies to the host lane only」,不静默忽略、不映射到别的车道的 env 名单;`"scrub"` 在那些车道上照受理(无消费点,无害)。
+     * 400 `request.field_invalid`(`reason: lane_not_host`)「applies to the host lane only」,不静默忽略、不映射到别的车道的 env 名单;`"scrub"` 在那些车道上照受理(无消费点,无害)。
      * Rides the persisted body onto resume legs:重放照射程与车道重判(部署由单用户改托管后 revive ⇒ 同一只拒,
      * resume-legs 折成 `409 resume_blocked_by_policy`)。
      */
@@ -537,22 +555,29 @@ export interface TaskRequestBody {
      *  与 `principalHeader` **互斥**:同设 ⇒ 新提交腿同步 400 `request.body_shape`(拒句与契约包解析期那一句逐字相同);值不是字符串 ⇒ 400
      *  `request.field_invalid`。耐久 resume 腿不拒(重放存量 body),也**不摘 server**(摘了,park 在它工具审批上的任务批准后撞 `resume.tool_unavailable`
      *  且每次重试重放同一份 body):降级到升级前的读法 —— server 照挂、`principalHeader` 胜、`assertionHeader` 不生效,一行 warn `mcp_assertion_header_ignored`。
-     *  ⚠️ 本版**只承载、不发送**:引擎的 http 传输尚无断言头座,
-     *  声明被接收、server 照常挂载但不带断言头,并有一行运维 info `mcp_assertion_header_not_sent { server }`;发送随引擎座。 */
+     *  ⚠️ **只承载、不发送**:引擎的断言头是固定的名、值由部署的对端座作答,本部署没有断言来源 ——
+     *  声明被接收、server 照常挂载但不带断言头,并有一行运维 info `mcp_assertion_header_not_sent { server }`。
+     *
+     *  `transport.env`(stdio)/ `transport.headers`(http)是这台 server 的**件**:server 交给引擎的声明里不带它们,件由部署的对端座在起子进程 / 发请求时按原字节作答
+     *  (只对胜出部署同名判的条目登记;件的名与值由引擎在每次发送时判,不合 ⇒ 那一台不连、兄弟照挂)。 */
     mcpServers?: RequestMcpServerSpec[];
     /** [DESIGN-269 车1] Caller-supplied per-request A2A peers (remote agents this task may call), aligned to
      *  core `A2aServerSpec`. 🔒 honored on a SINGLE-USER deployment (task-a2a.ts `a2aInjectionHonored`, the same
      *  predicate `capabilities.a2aInjection` advertises) — the requester is the super-admin of their OWN worker,
      *  on ANY execution lane (an A2A call is a plain outbound HTTPS request from the worker, so the lane where
      *  tool calls run is irrelevant); IGNORED on multi-tenant (a tenant can't point the shared worker at an
-     *  agent of their choosing). A2A has no operator lock and no compliance capability today. A new submission
+     *  agent of their choosing). The gate also closes under the operator lock `a2a` and under a compliance posture that denies `a2a_peers`
+     *  (the engine refuses a task that declares a peer under either): under the lock a request that carries `a2aPeers` is refused
+     *  400 `config.locked_key` at the head of the request (the same code and status table as the MCP lock); on a multi-tenant
+     *  deployment or under a compliance denial the list is ignored and said (`a2a_injection_ignored`). A new submission
      *  with a malformed list or entry is refused 400 (`assertRequestA2aEntries`: not an array / over the 32-entry
      *  cap / an entry that is not an object / a key outside {@link A2A_PEER_ENTRY_KEYS} / a key whose value is
      *  unusable / a url or cardUrl carrying a credential) — the same refusal shape as `mcpServers`, whatever the lane.
      *  🔴 Every skill a peer advertises mounts `egress:true` + `effect:"write"` (core's ruling) — declaring a
      *  peer is declaring an outbound WRITE channel, not a data source. Validated + gated downstream; the
-     *  center/config baseline wins on a name clash (the peer name IS the tool namespace). */
-    a2aPeers?: A2aServerSpec[];
+     *  center/config baseline wins on a name clash (the peer name IS the tool namespace). `headers` are the peer's PIECES: the declaration the
+     *  server hands the engine carries none of them — the deployment's peer seat answers them, as written, at each send to the declared origins. */
+    a2aPeers?: RequestA2aPeer[];
     /** CC parity (Workflow super-set): per-task activation of the LLM-authored workflow engine (core `run_workflow`).
      *  `true` → `spec.selfOrchestration` (the engine mounts run_workflow), gated on the deployment's `selfOrchestrationEnabled`
      *  (else a harmless no-op) + core's `allowWorkflows` per-principal entitlement on multi-tenant (single-user honors
@@ -586,12 +611,20 @@ export type DecideBinding = {
      *  mints carry it verbatim when present — the engine owns what counts as written (blank = nothing) and judges it again pre-CAS. */
     feedback?: string;
 };
-/** [ref]([ref]④→[ref] 坐标轮换判定):409 `approval_stale` 拒体上的 additive 机读指路 ——
+/** 409 `approval_stale` 拒体的 additive 机读指路 `currentPending`:**本会话此刻在这道门上待决的那道门**的回显坐标 = 这道门的决断体回显的那几位
+ *  (一条规则,两道决断门各一形):`/decide` ⇒ {@link DecideStaleCurrentPending};计划审阅([ref])⇒ {@link PlanReviewStaleCurrentPending}。
+ *  🔴 恒**不含** checkpointToken(resume 凭证从不外发);只在当前门在场、属这道门的门型、且已过属主门的域内铸 —— 否则键缺席(不造键)。 */
+export type ApprovalStaleCurrentPending = DecideStaleCurrentPending | PlanReviewStaleCurrentPending;
+/** [ref]:计划审阅门的回显坐标 = 门身份 `checkpointId`(过信任边界的那个值;当前门说不出身份 ⇒ 整个 `currentPending` 缺席)。 */
+export type PlanReviewStaleCurrentPending = {
+    /** 当前待决 plan_review 门的非秘密身份 —— 壳据此重取那道门的计划给人看,再带它决。 */
+    checkpointId: string;
+};
+/** [ref]([ref]④→[ref] 坐标轮换判定):`/decide` 那一形 ——
  *  **本会话当前 pending** 的 D-1 回显坐标,让持旧坐标的壳一跳重定位(免重拉列表)。
  *  键名/键形与 GET /v1/approvals 的 pending 行逐字同名(壳复用同一解析)。
- *  🔴 恒**不含** checkpointToken(runs.ts §12-C:resume 凭证从不外发);只在当前 pending **在场**、
- *  属 tool_approval、且已过路由级 owner 门的域内铸 —— 无 pending / 非工具门 / 读失败 ⇒ 键缺席(不造键)。 */
-export type ApprovalStaleCurrentPending = {
+ *  只在当前 pending 属 tool_approval 时铸 —— 无 pending / 非工具门 / 读失败 ⇒ 键缺席(不造键)。 */
+export type DecideStaleCurrentPending = {
     /** 当前 pending 被门住的工具名(与 pending 行的 `toolName` 同源同值)。 */
     toolName: string;
     /** 当前 pending 的 `pendingAction.toolCallId` —— 壳重定位后 decide 时回显的 D-1 锚。 */

package/dist/identity-source.d.ts

@@ -0,0 +1,65 @@
+/**
+ * **身份来源闭集 + run 行身份元组** —— 叶子模块(零依赖):凭据门(`http/principal-gate.ts`)、run 店契约(`plugins/store-contracts.ts`)、
+ * 三只 run 店、中央建表语句(`plugins/tidb-pool.ts` / `plugins/pg-pool.ts`)与 `/health` 自报位读同一份。
+ *
+ * ## 律(三句;全仓只在这里写一次)
+ * 1. **一张表、一个次序**:{@link IDENTITY_SOURCES} 的序 = 凭据门的判定次序(`verifiedIdentitySource` 答表里第一个验得过的词)= `/health.auth.kinds` 的出现序。
+ *    出示了部署的 service 凭据就是 `service_token` —— 哪怕同一枚 Bearer 也被鉴权桥验成登录令牌、哪怕运维给这枚凭据起的系统名叫 `sso`;
+ *    验不过 service 凭据而鉴权桥挂了身份 ⇒ `sso`;都没有而直连门 principal 令牌验过 ⇒ `direct_door_jwt`。
+ * 2. **一只元组、受理时铸一次**:run 行的身份元组 {@link RunIdentity}(三列 `identity_source` / `identity_scope` / `identity_principal_inc`)在凭据门上随来源
+ *    一起定下(`principal-gate.ts` 的 `admitRunIdentity`,唯一调用点是凭据门),建行处原样写入,之后只读 —— 续跑认领、挂起、终局、重启都不改它,
+ *    没有任何读者按当前状态重推它。`RunRecord.source`(系统名 / `"sso"` / null)只作归因,不是认证来源。
+ * 3. **缺席一种读法**:`null` = 这一行**没有「属主在受理时验过的凭据」的记录** —— 三列存在之前写下的行、没有任何验过凭据的受理(无鉴权写面
+ *    `ALLOW_UNAUTHED_WRITES`)、以及别人替属主按下的那一跑(受理请求验过的主体不是这一行的属主:唤醒 / 决定投递铸的新一跑)。读者一律按「不合格」处置
+ *    (fail-closed),不分辨三种成因;存量行不回填(没有事实可回填)。
+ *
+ * 化身号 `principalInc`:令牌 `sub_inc` 声明原样,经契约包 `VerifiedIdentity.principalInc` 读(settings-schema 14.7.0 加的可选字段,已提货:验证腿随身份带出);本版接线未做 ⇒ 恒 `null`,
+ * 接线点在 `admitRunIdentity` 的 `sso` 臂(不在本仓另定一份读法)。
+ */
+/** 验过的身份来源的**闭集**(序 = 判定次序 = `/health.auth.kinds` 的出现序;加一个来源 = 加一个词,读它的各只穷举 `switch` 不接就编译红)。 */
+export declare const IDENTITY_SOURCES: readonly ["service_token", "sso", "direct_door_jwt"];
+export type IdentitySource = (typeof IDENTITY_SOURCES)[number];
+/**
+ * run 行身份元组(受理时铸、持久、之后只读;律见文件头)。三键恒在、与三列一一对应:`scope` / `principalInc` 只随 `sso` 有值 ——
+ * service 凭据与直连门令牌不带登录令牌的 scope / 化身号,判别联合让「`service_token` 带 scope」这种形写不出来。
+ */
+export type RunIdentity = {
+    readonly source: "sso";
+    readonly scope: string;
+    readonly principalInc: string | null;
+} | {
+    readonly source: "service_token" | "direct_door_jwt";
+    readonly scope: null;
+    readonly principalInc: null;
+};
+/** `identity_scope` 的列宽(字符;两方言 VARCHAR 同口径数码点)。与主体列同宽:scope 来自验过签名的令牌,契约的 scope id 形最长 64,读口不判形 ⇒ 留余量。 */
+export declare const RUN_IDENTITY_SCOPE_MAX_CHARS = 190;
+/** `identity_principal_inc` 的列宽(字符):化身号是签发方插入时铸的不透明随机串(与会话化身同宽)。 */
+export declare const RUN_IDENTITY_PRINCIPAL_INC_MAX_CHARS = 64;
+/**
+ * `task_run` 三列的列定义 —— 两方言各一段,**唯一属主**:中央建表语句(`tidb-pool.ts` / `pg-pool.ts` 的 `CREATE TABLE task_run`)内插这同一段;
+ * 存量库缺列时起服列册对账(`schema-consistency.ts`)拒启,拒句里的 `ALTER TABLE task_run ADD COLUMN …` 由同一份建表语句解析生成 ⇒
+ * 「新库建出来的列」与「运维按拒句 / MIGRATION 补上的列」逐字同形。三列都可空(存量行与律 3 的三种成因都是 NULL);PG 钉 `COLLATE "C"`
+ * (身份键按字节判等,与 MySQL 协议表级 `utf8mb4_bin` 同形)。
+ */
+export declare const RUN_IDENTITY_COLUMNS: {
+    readonly tidb: string;
+    readonly pg: string;
+};
+/** 元组落盘的三格(SQL 三列 / File 车道 run.json 的三键,同名同义)。 */
+export interface RunIdentityCells {
+    readonly identitySource: IdentitySource | null;
+    readonly identityScope: string | null;
+    readonly identityPrincipalInc: string | null;
+}
+/** 元组 → 三格(写口;三只 run 店同一只)。 */
+export declare function runIdentityCells(identity: RunIdentity | null): RunIdentityCells;
+/**
+ * 三格 → 元组(读口;SQL 两方言的行映射与 File 车道的 run.json 读回同一只)。读不出一只**合形**元组的三格一律读成 `null`(律 3:不合格,fail-closed),
+ * 这是运行期无法避免的缺省臂,明写在这里:
+ *  · 来源格缺席 ⇒ 没有记录(三列之前的行 / 律 3 的另两种成因);
+ *  · 来源格不是闭集里的词(更新的版本写下、回滚到本版读到的词,或手改的行)⇒ 本版认不得的来源不合格;
+ *  · `sso` 却没有 scope、化身号不是非空串,或别的来源带着 scope / 化身号 ⇒ 不是本仓写口写得出的形(手改 / 半截写),不合格。
+ */
+export declare function readRunIdentityCells(source: unknown, scope: unknown, principalInc: unknown): RunIdentity | null;
+//# sourceMappingURL=identity-source.d.ts.map

package/dist/identity-source.js

@@ -0,0 +1,45 @@
+export const IDENTITY_SOURCES = ["service_token", "sso", "direct_door_jwt"];
+export const RUN_IDENTITY_SCOPE_MAX_CHARS = 190;
+export const RUN_IDENTITY_PRINCIPAL_INC_MAX_CHARS = 64;
+export const RUN_IDENTITY_COLUMNS = {
+    tidb: [
+        "identity_source VARCHAR(32) NULL",
+        `identity_scope VARCHAR(${RUN_IDENTITY_SCOPE_MAX_CHARS}) NULL`,
+        `identity_principal_inc VARCHAR(${RUN_IDENTITY_PRINCIPAL_INC_MAX_CHARS}) NULL`,
+    ].join(",\n     "),
+    pg: [
+        `identity_source VARCHAR(32) COLLATE "C"`,
+        `identity_scope VARCHAR(${RUN_IDENTITY_SCOPE_MAX_CHARS}) COLLATE "C"`,
+        `identity_principal_inc VARCHAR(${RUN_IDENTITY_PRINCIPAL_INC_MAX_CHARS}) COLLATE "C"`,
+    ].join(",\n     "),
+};
+export function runIdentityCells(identity) {
+    return identity === null
+        ? { identitySource: null, identityScope: null, identityPrincipalInc: null }
+        : { identitySource: identity.source, identityScope: identity.scope, identityPrincipalInc: identity.principalInc };
+}
+const isNonEmptyString = (v) => typeof v === "string" && v !== "";
+const isAbsent = (v) => v === null || v === undefined;
+export function readRunIdentityCells(source, scope, principalInc) {
+    if (isAbsent(source) || typeof source !== "string")
+        return null;
+    const word = IDENTITY_SOURCES.find((w) => w === source);
+    if (word === undefined)
+        return null;
+    switch (word) {
+        case "sso":
+            if (!isNonEmptyString(scope))
+                return null;
+            if (isAbsent(principalInc))
+                return { source: word, scope, principalInc: null };
+            return isNonEmptyString(principalInc) ? { source: word, scope, principalInc } : null;
+        case "service_token":
+        case "direct_door_jwt":
+            return isAbsent(scope) && isAbsent(principalInc) ? { source: word, scope: null, principalInc: null } : null;
+        default: {
+            const unknownWord = word;
+            throw new Error(`readRunIdentityCells: identity source ${String(unknownWord)} has no reading`);
+        }
+    }
+}
+//# sourceMappingURL=identity-source.js.map

package/dist/index.d.ts

@@ -26,6 +26,8 @@ export type { TaskRequestBody } from "./http/wire-types.js";
 export { ensureCheckpointCtxSealing } from "./sealed-key.js";
 export type { CheckpointCtxSealing } from "./http/checkpoint-ctx.js";
 export { createHttpServer, type ServiceDeps, type RequestAuth, type FlatServiceDeps, type ServiceDepGroups, type ServiceCoreDeps, type ServiceStoreDeps, type ServiceCoordinatorDeps, type ServiceSeamDeps, type ServiceObservabilityDeps, type ServiceGovernanceDeps, type ServiceDeploymentDeps, type ServiceKnobDeps, } from "./http/server.js";
+export { createPeerDesk } from "./peer-seat.js";
+export type { PeerDesk, PeerLease, McpDraft, A2aDraft } from "./peer-seat.js";
 export { createSideQueryLane, type KeyResolver, type SideQueryLane, type SideQueryLaneCtx } from "./boot/side-query-lane.js";
 export { createKeyResolver, resolveModelApiKey, type ModelKeyRef } from "./key-resolver.js";
 export { isModelKeyPoison, ModelKeyPoisonedError, type ModelKeyPoison, type ModelKeyPoisonReason } from "./key-resolver.js";

package/dist/index.js

@@ -22,6 +22,7 @@ export { createAuthorizer, principalFrom, HttpError, } from "./security.js";
 export { memoryScopeFor, memoryEngineBackendFor } from "./memory-scope.js";
 export { ensureCheckpointCtxSealing } from "./sealed-key.js";
 export { createHttpServer, } from "./http/server.js";
+export { createPeerDesk } from "./peer-seat.js";
 export { createSideQueryLane } from "./boot/side-query-lane.js";
 export { createKeyResolver, resolveModelApiKey } from "./key-resolver.js";
 export { isModelKeyPoison, ModelKeyPoisonedError } from "./key-resolver.js";

package/dist/leader/wire.d.ts

@@ -91,6 +91,13 @@ export interface LeaderWireConfig {
      * 分租户,只补席不包裹 = 归因恒 undefined = 假绿。缺席 ⇒ 展开空对象(与接线前逐字相同)。
      */
     tracer?: RunnerDeps["tracer"];
+    /**
+     * **部署座**(`RunnerDeps.mods`),原样递给本车道的每一只 Runner。唯一铸点 = 起服第 5 段的装配口 `assembleDeploymentMods`(本服务自铸的注册在前、
+     * 运维声明的 mod 包在后、整列过引擎准入);主 / 无手 / hook 代理 / 子代经共享基座吃的就是它,`boot/leader.ts` 搬的是**同一份**。
+     * leader 不自铸、不自己装配(一个进程两份部署注册 = 主车道与 leader 车道各按一套扩展跑)。缺失时整个部署座在这条车道上缺席:运维声明的守卫包
+     * 管不到 leader 派出的腿,拒绝计量 / 工具追踪也漏这条腿。缺席 ⇒ 展开空对象。
+     */
+    mods?: RunnerDeps["mods"];
     /**
      * [ref]([ref],[ref]-T1)—— **部署级 token 治理窗**两键,**成对**递给本车道的每一只 Runner。
      * 属主 = `config.usageWindows`(声明)+ `boot/stores.ts` 造的账本店(两者同真同假,与

package/dist/leader/wire.js

@@ -166,6 +166,7 @@ export function createLeaderRunner(cfg) {
     const governanceSeat = cfg.governance ?? {};
     const deploymentPostureSeat = () => cfg.deploymentPosture?.() ?? {};
     const tracerSeat = cfg.tracer ? { tracer: cfg.tracer } : {};
+    const modsSeat = cfg.mods ? { mods: cfg.mods } : {};
     const usageWindowSeat = cfg.usageWindows && cfg.usageWindowStore ? { usageWindows: cfg.usageWindows, usageWindowStore: cfg.usageWindowStore } : {};
     const promptSourceSeat = cfg.promptSource ? { promptSource: cfg.promptSource } : {};
     const onErrorSeat = cfg.onError ? { onError: cfg.onError } : {};
@@ -186,7 +187,7 @@ export function createLeaderRunner(cfg) {
                         throw new Error(`oracle still present after remove (${f.path}) — refusing repair (measurement integrity)`);
                 }
                 try {
-                    const runner = new Runner({ brain: cfg.brain, models: cfg.models, roles: cfg.roles, pricing: cfg.pricing, ...onNoticeSeat, ...governanceSeat, ...deploymentPostureSeat(), ...tracerSeat, ...usageWindowSeat, ...promptSourceSeat, ...onErrorSeat, executionEnv: rawEnv, rootPath: repoDir });
+                    const runner = new Runner({ brain: cfg.brain, models: cfg.models, roles: cfg.roles, pricing: cfg.pricing, ...onNoticeSeat, ...governanceSeat, ...deploymentPostureSeat(), ...tracerSeat, ...usageWindowSeat, ...promptSourceSeat, ...onErrorSeat, ...modsSeat, executionEnv: rawEnv, rootPath: repoDir });
                     const objective = [
                         `The integrated project at ${repoDir} fails its build/test. Make the MINIMAL change to the working tree so this command exits 0 (cd into the repo and run it yourself to confirm):`,
                         `  ${testCmd}`,
@@ -253,7 +254,7 @@ export function createLeaderRunner(cfg) {
             if (Array.isArray(body.subtasks) && body.subtasks.length > 0) {
                 return validateSubtasks(body.subtasks);
             }
-            const planRunner = new Runner({ brain: cfg.brain, models: cfg.models, roles: cfg.roles, pricing: cfg.pricing, ...onNoticeSeat, ...governanceSeat, ...deploymentPostureSeat(), ...tracerSeat, ...usageWindowSeat, ...promptSourceSeat, ...onErrorSeat });
+            const planRunner = new Runner({ brain: cfg.brain, models: cfg.models, roles: cfg.roles, pricing: cfg.pricing, ...onNoticeSeat, ...governanceSeat, ...deploymentPostureSeat(), ...tracerSeat, ...usageWindowSeat, ...promptSourceSeat, ...onErrorSeat, ...modsSeat });
             const runRoute = async (prompt) => {
                 const res = await planRunner.runTaskStream({
                     objective: prompt,
@@ -347,7 +348,7 @@ export function createLeaderRunner(cfg) {
                     workerId: sub.workerId, sessionId, branch: sub.branch,
                     baseSha,
                     runner: keepCtxWarm(new Runner({
-                        brain: cfg.brain, models: cfg.models, roles: cfg.roles, pricing: cfg.pricing, ...onNoticeSeat, ...governanceSeat, ...deploymentPostureSeat(), ...tracerSeat, ...usageWindowSeat, ...promptSourceSeat, ...onErrorSeat,
+                        brain: cfg.brain, models: cfg.models, roles: cfg.roles, pricing: cfg.pricing, ...onNoticeSeat, ...governanceSeat, ...deploymentPostureSeat(), ...tracerSeat, ...usageWindowSeat, ...promptSourceSeat, ...onErrorSeat, ...modsSeat,
                         ...(cfg.toolResultStore ? { toolResultStore: cfg.toolResultStore } : {}),
                         ...(cfg.sessionStore ? { sessionStore: cfg.sessionStore } : {}),
                         executionEnvFactory: async (ctx) => {
@@ -372,7 +373,7 @@ export function createLeaderRunner(cfg) {
             const baseSha = await sh(env)(`cd ${repo} && git rev-parse HEAD`);
             return {
                 workerId: sub.workerId, sessionId, branch: sub.branch, baseSha,
-                runner: keepCtxWarm(new Runner({ brain: cfg.brain, models: cfg.models, roles: cfg.roles, pricing: cfg.pricing, ...onNoticeSeat, ...governanceSeat, ...deploymentPostureSeat(), ...tracerSeat, ...usageWindowSeat, ...promptSourceSeat, ...onErrorSeat, ...(cfg.toolResultStore ? { toolResultStore: cfg.toolResultStore } : {}), ...(cfg.sessionStore ? { sessionStore: cfg.sessionStore } : {}), executionEnv: env })),
+                runner: keepCtxWarm(new Runner({ brain: cfg.brain, models: cfg.models, roles: cfg.roles, pricing: cfg.pricing, ...onNoticeSeat, ...governanceSeat, ...deploymentPostureSeat(), ...tracerSeat, ...usageWindowSeat, ...promptSourceSeat, ...onErrorSeat, ...modsSeat, ...(cfg.toolResultStore ? { toolResultStore: cfg.toolResultStore } : {}), ...(cfg.sessionStore ? { sessionStore: cfg.sessionStore } : {}), executionEnv: env })),
                 diffEnv: env,
                 destroy: () => env.destroy().then(() => { }),
                 spec: withLeaderLeg({ ...workerLimits, ...sub.spec, ...durableSpec, ...resourceSpec, ...principalSpec() }, resumeBody),