@sema-agent/server 7.136.0 → 7.138.0

package/dist/session-workspace.js

@@ -0,0 +1,83 @@
+import { recordFailOpen } from "./observability/fail-open.js";
+import { readSessionWorkspaceCell, SESSION_WORKSPACE_DEGRADED } from "./plugins/session-workspace-cell.js";
+import { projectByTable } from "./trace/projection-table.js";
+export const SESSION_WORKSPACE_DISPOSITIONS = {
+    type: "strip",
+    cwd: "forward",
+    root: "forward",
+    entered: { nested: { dir: "forward", byPath: "forward" } },
+    project: { nested: { id: "forward", source: "forward" } },
+    remote: "forward",
+    eventId: "strip",
+    parentToolCallId: "strip",
+    sourceTaskId: "strip",
+    bgAgentId: "strip",
+};
+export function sessionWorkspaceStoreOf(store) {
+    const s = store;
+    if (typeof s?.readSessionWorkspace !== "function" || typeof s.recordSessionWorkspace !== "function")
+        return undefined;
+    return { readSessionWorkspace: s.readSessionWorkspace.bind(s), recordSessionWorkspace: s.recordSessionWorkspace.bind(s) };
+}
+export const LEG_SESSION_WITNESS_FIELD = Symbol("sema-server.legSessionWitness");
+export function stampLegSessionWitness(spec, witness) {
+    if (witness !== undefined)
+        Object.defineProperty(spec, LEG_SESSION_WITNESS_FIELD, { value: Object.freeze({ ...witness }), enumerable: true, writable: false, configurable: false });
+    return spec;
+}
+export function legSessionWitnessOf(spec) {
+    return spec[LEG_SESSION_WITNESS_FIELD];
+}
+export function sessionWorkspaceOfFrame(ev) {
+    if (ev.type !== "workspace_changed")
+        return undefined;
+    if (ev.parentToolCallId !== undefined || ev.sourceTaskId !== undefined || ev.bgAgentId !== undefined)
+        return undefined;
+    const shape = readSessionWorkspaceCell(projectByTable("session_workspace", SESSION_WORKSPACE_DISPOSITIONS, ev, ev));
+    if (shape.problem !== undefined) {
+        recordFailOpen(SESSION_WORKSPACE_DEGRADED, `op=frame problem=${shape.problem.slice(0, 200)}`);
+        return undefined;
+    }
+    return shape.value;
+}
+const SETTLED = Promise.resolve();
+const NO_RECORD = { observe: () => SETTLED };
+export function createSessionWorkspaceRecorder(store, witness) {
+    if (store === undefined || witness === undefined || witness.incarnation === null)
+        return NO_RECORD;
+    const { sessionId, incarnation } = witness;
+    return {
+        async observe(ev) {
+            const snapshot = sessionWorkspaceOfFrame(ev);
+            if (snapshot === undefined)
+                return;
+            try {
+                await store.recordSessionWorkspace(sessionId, incarnation, snapshot);
+            }
+            catch (e) {
+                recordFailOpen(SESSION_WORKSPACE_DEGRADED, `op=write session=${sessionId} ${(e instanceof Error ? e.message : String(e)).slice(0, 200)}`);
+            }
+        },
+    };
+}
+export async function legProjectIdOf(submitted, store, sessionId) {
+    if (submitted !== undefined)
+        return submitted;
+    if (store === undefined || sessionId === undefined)
+        return undefined;
+    const project = (await store.readSessionWorkspace(sessionId))?.project;
+    return project === undefined ? undefined : replayedProjectIdOf(project);
+}
+function replayedProjectIdOf(project) {
+    switch (project.source) {
+        case "declared":
+            return project.id;
+        case "marker":
+            return undefined;
+        default: {
+            const unknownSource = project.source;
+            throw new Error(`session workspace: unknown project source word ${JSON.stringify(unknownSource)} (the row reader admits only marker / declared)`);
+        }
+    }
+}
+//# sourceMappingURL=session-workspace.js.map

package/dist/spec-fields.d.ts

@@ -21,6 +21,32 @@ export declare function normalizeSuggestNextPrompts(v: unknown): TaskSpec["sugge
  * undefined (never an empty object — keeps the spec byte-identical for non-users).
  */
 export declare function normalizeResilience(v: unknown, operator: boolean): TaskSpec["resilience"];
+/**
+ * 请求体 `attachments` 的子键**只有这一张表**(键 → 受理类别)。三处读它,不再各抄一份键名:
+ *  · 导出类型 `TaskRequestAttachments`(`http/wire-types.ts`)—— 与本表互为差集门(下面两只 `_GuardAttachmentKeys*`:类型加 / 删一个键而本表没跟 ⇒ tsc 红);
+ *  · 受理门(`http/admission.ts`)—— 非对象那一句列的键、布尔类键的逐键 `must be a boolean` 检查都从这里取;
+ *  · 重放翻译口 {@link normalizeAttachments} —— 入参形与逐键赋值的键集都是本表(`parts` 记录对 {@link AttachmentKey} 穷举,少一个键 ⇒ tsc 红)。
+ * 类别只回答受理门一个问题:`boolean` = 值必须是布尔(literal-true 键与布尔透传键的差别在翻译口,不在门);`mode` = `todoReminderMode` 的枚举;
+ * `changedFiles` = 布尔或 `{ maxFiles }`。后两类各有自己的门。键的**顺序**就是受理门那一句里的顺序(句子字面另由错误文案冻结钉守)。
+ */
+export type AttachmentKeyKind = "boolean" | "mode" | "changedFiles";
+export declare const ATTACHMENT_KEY_KINDS: {
+    readonly todoReminder: "boolean";
+    readonly todoReminderMode: "mode";
+    readonly changedFiles: "changedFiles";
+    readonly budgetUsd: "boolean";
+    readonly backgroundTasks: "boolean";
+    readonly toolsDelta: "boolean";
+    readonly agentListing: "boolean";
+    readonly skillsListing: "boolean";
+    readonly mcpInstructions: "boolean";
+    readonly mcpUnavailable: "boolean";
+};
+export type AttachmentKey = keyof typeof ATTACHMENT_KEY_KINDS;
+/** 表的键,原序。 */
+export declare const ATTACHMENT_KEYS: readonly AttachmentKey[];
+/** 受理门要验「值必须是布尔」的键(= 类别 `boolean`),原序。 */
+export declare const ATTACHMENT_BOOLEAN_KEYS: readonly AttachmentKey[];
 /**
  * [ref] (core 1.251) — normalize `body.attachments` → `TaskSpec.attachments`. Core's contract is
  * literal-true unions ("关闭=删 key,勿传 false"): only `true` (or, for changedFiles, an object with a sane
@@ -82,7 +108,7 @@ export interface TaskAgentsRefusal {
  *  定义被悄悄削(一个丢掉的 isolation 就是放宽),比 400 更危险,故整条拒。`allowTools` / `denyTools` 本门只判形与条数(`toolList`),
  *  **名字归引擎一只判**(core 7.49.0 [ref] / [ref] 第二步起与根 run 的 `allowTools` / `excludeTools` 是同一只选择器,开跑前,三来源同判):core 7.51.0 [ref] 起
  *  没有任何工具答应的名字(无人挂的名、大小写孪生 / 退役名 `bash` / `BASH`)**引擎不拒 run** —— 条目原样保留、经 onError(config)告知一次(带该写的拼法);
- *  其中**写错现名的**(`denyTools:["BASH"]` 想禁的照用 = 静默放行;`allowTools:["BASH"]` 想放的什么也没放 = 静默收窄)由 `resolveSpec` 前置拒:**限制侧**(`denyTools`)四类全拒(近似名 · 退役名 · 文法读不出 · `*`),
+ *  其中**写错现名的**(`denyTools:["BASH"]` 想禁的照用 = 静默放行;`allowTools:["BASH"]` 想放的什么也没放 = 静默收窄)由 `resolveSpec` 前置拒:**限制侧**(`denyTools`)三类全拒(近似名 · 退役名 · 文法读不出);名内的 `*` 自 7.137.0 起是整名 glob、受理(孤 `*` = 每一只工具),`Tool(content)` 引擎读成整只工具、同样受理,
  *  **放行侧**(`allowTools`)只拒近似名 —— 放行侧的内容形 / 没有后继的退役名 / 文法读不出照 7.130.0 受理、交引擎既有通告(有后继的退役名〔`bash` · `Task`〕与文法读不出的放行条目引擎在子代 prepare 整 run 拒 `config.agent.unknown_tool`,根 `allowTools` 拒 `config.tool_face_control`,同步腿两码同为 400〔`runs.ts` `PREPARE_REFUSAL_HTTP_STATUS`〕;`rule-entry-list.ts` `inertToolListEntryOf`:近似名提交 400 `config.agent.unknown_tool` 点名现名、续跑按方向分流;
  *  判官仍是引擎的条目读法,不是第二个判官);
  *  **真未知名**(没有近似也没有退役对应:懒挂载的合法形)照旧只告运维、不拒。
@@ -163,21 +189,25 @@ export declare function toolNameListFromBody(raw: unknown): string[] | undefined
 export declare function allowToolsSpecFragment(raw: unknown): {
     allowTools?: string[];
 };
-/** [ref]/[ref] — body.promptProfile → `TaskSpec.promptProfile`(core 1.328 R2 主件,CC LT(model_id)
- *  同构双形轴)。语义:纯呈现轴不碰策略(simple=CC 212 短形面缺省;classic=长形面,可按任务/模型试分)
- *  ⇒ 无租户门(deferTools 同姿势);全委托树继承由 core 管。缺省不挂键(引擎缺省 simple,byte-compat)。
+/** core 7.56.0 [ref] — body.promptLean → `TaskSpec.promptLean`(提示词形的唯一任务开关:`true` 加 `lean_prompt` 特征、`false` 去掉它、
+ *  缺省 = 模型声明)。纯呈现轴不碰策略 ⇒ 无租户门(deferTools 同姿势);全委托树继承由 core 管。缺省不挂键(模型目录条目的声明说话)。
  *
- *  ⚠️ **这不是一条 defer 注**([ref] 件⑤ 对表结论,core [ref] 同判):本段说的是 `promptProfile` 这根
- *  **呈现**轴,它与 `deferMode` / `deferTools` 的延迟披露轴**无耦合** —— 上一行提 deferTools 只是在借它
- *  的「无租户门」姿势作类比。「引擎缺省 simple」这句本身在 core 5.40.0 上仍逐字为真
- *  (`core/types.d.ts`:default "simple"),本批亲验未变。
- *  真正的 defer 轴对表(core 5.40.0 起 `deferMode:"auto"` 不再 sweep 内建;7.15.0 起它不再是第二道门,
- *  只是把候选集拓宽后走同一道阈值门)记在
- *  `src/capabilities/tool-defer.ts` 的头注 —— 别把两根轴的结论写到一处。
- *  DEFENSIVE(resume 重放不过 HTTP 400 门):非法值 ⇒ undefined;提交面另有 fail-loud 400(邻居姿势)。 */
-export declare function promptProfileFromBody(raw: unknown): "simple" | "classic" | undefined;
+ *  ⚠️ **这不是一条 defer 注**:本段说的是提示词形这根**呈现**轴,它与 `deferMode` / `deferTools` 的延迟披露轴**无耦合** —— 上一行提
+ *  deferTools 只是在借它的「无租户门」姿势作类比。真正的 defer 轴对表记在 `src/capabilities/tool-defer.ts` 的头注 —— 别把两根轴的结论写到一处。
+ *  DEFENSIVE(resume 重放不过 HTTP 400 门):非布尔 ⇒ undefined;提交面另有 fail-loud 400(邻居姿势)。 */
+export declare function promptLeanFromBody(raw: unknown): boolean | undefined;
+/**
+ * `TaskSpec.promptLean` 的座位片段:体里的 `promptLean`(布尔才算,见 {@link promptLeanFromBody})是唯一读数;缺席 ⇒ 不挂键。两条腿同一读法:
+ * 退役键 `promptProfile` 不读 —— 新提交带它在键闭集门 400;7.136.x 存体里的它由一次性迁移 M30 在起服时改写成 `promptLean`(`stored-request-prompt-profile-m30.ts`),
+ * 改写不到的残留行在续跑判据上拒(`http/stored-body-replay.ts` 第四问),到不了这里。
+ */
+export declare function promptLeanSpecFragment(body: {
+    readonly promptLean?: unknown;
+}): {
+    promptLean?: boolean;
+};
 /** [ref]②(core 5.14.0 `TaskSpec.toolMaterializeStrategy`):deferred 工具激活后的 schema 供给策略。
- *  与 {@link promptProfileFromBody} 同姿势的**防御性归一**——提交面的 fail-loud 400 在 HTTP 门,这里
+ *  与 {@link promptLeanFromBody} 同姿势的**防御性归一**——提交面的 fail-loud 400 在 HTTP 门,这里
  *  只负责 resume 重放存量 body 时把不认识的值静默 DROP(回落 core 的 env/缺省链),而不是把它带上 spec。 */
 export declare function toolMaterializeStrategyFromBody(raw: unknown): "static" | "swap" | undefined;
 /** [ref]④ — 每键的运营方上限旋钮(env,缺省不设=不封顶)。 */

package/dist/spec-fields.js

@@ -25,6 +25,20 @@ export function normalizeResilience(v, operator) {
     };
     return Object.keys(out).length > 0 ? out : undefined;
 }
+export const ATTACHMENT_KEY_KINDS = {
+    todoReminder: "boolean",
+    todoReminderMode: "mode",
+    changedFiles: "changedFiles",
+    budgetUsd: "boolean",
+    backgroundTasks: "boolean",
+    toolsDelta: "boolean",
+    agentListing: "boolean",
+    skillsListing: "boolean",
+    mcpInstructions: "boolean",
+    mcpUnavailable: "boolean",
+};
+export const ATTACHMENT_KEYS = Object.keys(ATTACHMENT_KEY_KINDS);
+export const ATTACHMENT_BOOLEAN_KEYS = ATTACHMENT_KEYS.filter((k) => ATTACHMENT_KEY_KINDS[k] === "boolean");
 export function normalizeAttachments(v) {
     if (v == null || typeof v !== "object" || Array.isArray(v))
         return undefined;
@@ -37,17 +51,19 @@ export function normalizeAttachments(v) {
         changedFiles =
             typeof mf === "number" && Number.isFinite(mf) && mf >= 1 ? { maxFiles: Math.min(100, Math.floor(mf)) } : true;
     }
-    const out = {
-        ...(o.todoReminder === true ? { todoReminder: true } : {}),
-        ...(changedFiles !== undefined ? { changedFiles } : {}),
-        ...(typeof o.backgroundTasks === "boolean" ? { backgroundTasks: o.backgroundTasks } : {}),
-        ...(o.toolsDelta === true ? { toolsDelta: true } : {}),
-        ...(o.todoReminderMode === "baseline" || o.todoReminderMode === "off" ? { todoReminderMode: o.todoReminderMode } : {}),
-        ...(o.budgetUsd === true ? { budgetUsd: true } : {}),
-        ...(o.mcpInstructions === true ? { mcpInstructions: true } : {}),
-        ...(typeof o.agentListing === "boolean" ? { agentListing: o.agentListing } : {}),
-        ...(typeof o.skillsListing === "boolean" ? { skillsListing: o.skillsListing } : {}),
+    const parts = {
+        todoReminder: o.todoReminder === true ? { todoReminder: true } : {},
+        todoReminderMode: o.todoReminderMode === "baseline" || o.todoReminderMode === "off" ? { todoReminderMode: o.todoReminderMode } : {},
+        changedFiles: changedFiles !== undefined ? { changedFiles } : {},
+        budgetUsd: o.budgetUsd === true ? { budgetUsd: true } : {},
+        backgroundTasks: typeof o.backgroundTasks === "boolean" ? { backgroundTasks: o.backgroundTasks } : {},
+        toolsDelta: o.toolsDelta === true ? { toolsDelta: true } : {},
+        agentListing: typeof o.agentListing === "boolean" ? { agentListing: o.agentListing } : {},
+        skillsListing: typeof o.skillsListing === "boolean" ? { skillsListing: o.skillsListing } : {},
+        mcpInstructions: o.mcpInstructions === true ? { mcpInstructions: true } : {},
+        mcpUnavailable: typeof o.mcpUnavailable === "boolean" ? { mcpUnavailable: o.mcpUnavailable } : {},
     };
+    const out = Object.assign({}, ...ATTACHMENT_KEYS.map((k) => parts[k]));
     return Object.keys(out).length > 0 ? out : undefined;
 }
 export function normalizeResumeAtMode(v, resumeAtResolved) {
@@ -90,6 +106,7 @@ const SKILL_FIELD_SHAPES = {
     disallowedTools: { required: false, ok: skillToolListOk },
     files: { required: false, ok: skillFilesOk },
     baseDir: { required: false, ok: isAbsoluteHostPath },
+    mods: { required: false, ok: () => false },
 };
 const skillOk = (s) => {
     if (!plainObject(s))
@@ -301,8 +318,12 @@ export function toolNameListFromBody(raw) {
 export function allowToolsSpecFragment(raw) {
     return raw === undefined ? {} : { allowTools: raw };
 }
-export function promptProfileFromBody(raw) {
-    return raw === "simple" || raw === "classic" ? raw : undefined;
+export function promptLeanFromBody(raw) {
+    return typeof raw === "boolean" ? raw : undefined;
+}
+export function promptLeanSpecFragment(body) {
+    const lean = promptLeanFromBody(body.promptLean);
+    return lean !== undefined ? { promptLean: lean } : {};
 }
 export function toolMaterializeStrategyFromBody(raw) {
     return raw === "static" || raw === "swap" ? raw : undefined;

package/dist/standing-answer-grant.d.ts

@@ -1,12 +1,8 @@
-/** 卡载体:引擎铸的问 / 停驻行 / 它们的投影行(活的 `AskRequest`、停驻行的 `tool_approval` 臂、运维队列行都结构上满足)。 */
+/** 载体:引擎给一次调用盖过绑定词的任何形(活的 `AskRequest`、停驻行的 `tool_approval` 臂、运维队列行、策略层的 `ToolCallRequest` 都结构上满足)。 */
 export interface StandingAnswerCard {
     readonly boundGrantDigest?: unknown;
     readonly boundGrantAbsence?: unknown;
 }
-/** 调用载体:策略层的 `ToolCallRequest`、豁免店的行(只有工具名)。 */
-export interface StandingAnswerCall {
-    readonly toolName?: unknown;
-}
 /** 一问的授予绑定(闭集):`none` = 应答只覆盖这一次调用;`bound` = 授予、绑定可读;`unreadable` = 授予或说不清、绑定读不出。 */
 export type GrantBinding = {
     readonly kind: "none";
@@ -16,13 +12,6 @@ export type GrantBinding = {
 } | {
     readonly kind: "unreadable";
 };
-/** 卡上的授予绑定 —— 只读引擎的词(读法见文件头注):摘要是串 ⇒ bound;摘要不在且词是 `not_bindable` ⇒ none;其余 ⇒ unreadable。 */
+/** 载体上的授予绑定 —— 只读引擎的词(读法见文件头注):摘要是串 ⇒ bound;摘要不在且词是 `not_bindable` ⇒ none;其余 ⇒ unreadable。 */
 export declare function grantBindingOf(card: StandingAnswerCard): GrantBinding;
-/** 调用上的授予绑定 —— 调用上没有引擎的词,读引擎绑定工厂的那一条规则(见文件头注;🚧 引擎在调用上盖词之后退役)。 */
-export declare function callGrantBindingOf(call: StandingAnswerCall): GrantBinding;
-/**
- * 一问的授予绑定的**唯一折点**:读哪个载体由**问的属主**定 —— 名单自己的问(`deploymentListQuestion`,即 `standingAnswerHome` 的 `server_store` 家)读调用口,
- * 引擎铸的问读卡口(载体与理由见文件头注)。所有把「一张卡」折成 {@link StandingAnswerFacts} 的读者(活的问、待决条目、停驻行、运维队列行)经它取绑定,不各自选口。
- */
-export declare function questionGrantBindingOf(carrier: StandingAnswerCard & StandingAnswerCall, deploymentListQuestion: boolean): GrantBinding;
 //# sourceMappingURL=standing-answer-grant.d.ts.map

package/dist/standing-answer-grant.js

@@ -1,4 +1,3 @@
-import { SKILL_TOOL_NAME } from "@sema-agent/core";
 const NOT_BINDABLE = "not_bindable";
 export function grantBindingOf(card) {
     const digest = card.boundGrantDigest;
@@ -6,10 +5,4 @@ export function grantBindingOf(card) {
         return { kind: "bound", digest };
     return digest === undefined && card.boundGrantAbsence === NOT_BINDABLE ? { kind: "none" } : { kind: "unreadable" };
 }
-export function callGrantBindingOf(call) {
-    return call.toolName === SKILL_TOOL_NAME ? { kind: "unreadable" } : { kind: "none" };
-}
-export function questionGrantBindingOf(carrier, deploymentListQuestion) {
-    return deploymentListQuestion ? callGrantBindingOf(carrier) : grantBindingOf(carrier);
-}
 //# sourceMappingURL=standing-answer-grant.js.map

package/dist/stored-request-prompt-profile-m30.d.ts

@@ -0,0 +1,49 @@
+/**
+ * 一次性迁移 M30 —— 升级之前停驻的行(`checkpoint_ctx`)里请求体的退役键 `promptProfile`,起服**原地改写**成 `promptLean`。
+ * 🔴 M30 · 窗口见 `plugins/one-time-migrations.ts` 的 ONE_TIME_MIGRATIONS 登记表(窗、删法、删后由谁接住只写在那一行)。
+ *
+ * ## 为什么要它(持久数据面)
+ * 引擎 7.56.0 把提示词形收成一个布尔(`TaskSpec.promptLean`),双形词 `promptProfile`(`"simple" | "classic"`)整键退役;新提交带它在键闭集门 400。
+ * 7.136.x 及以前停驻的任务,`checkpoint_ctx` 存着的请求体带的是旧键 —— 续跑腿重放它,没有读者 ⇒ `"classic"`(要长形)静默回到模型声明的短形。
+ * 持久数据面 = 一次性迁移把旧表示消灭(不是续跑时按日历再读一遍:那样存体从不改,窗内续跑过一次、再停驻、窗关后再续跑,意图照样静默丢)。
+ *
+ * ## 法(一条映射,与 MIGRATION 写给调用方的同一张)
+ * 窗内每次起服扫一遍 `checkpoint_ctx`(两孪生共有的 ctx 行改写店腿 `rewriteCtxRows`,与 M28 同一只;SQL 按原文 CAS、`updated_at_ms` 不动;local 信封的 `updatedAt` 不动),
+ * 体里带自有键 `promptProfile` 的行:删掉它;`"classic"` 且体里没有布尔 `promptLean` ⇒ 写 `promptLean: false`(长形的意图);`"simple"`(当年的缺省形)/ 词表外的值 ⇒
+ * 只删键;体里已有布尔 `promptLean`(它说了算)⇒ 只删键。体的其余键、行上的读法记号与凭据位原样随行(行改写 = `http/checkpoint-ctx.ts` `rewriteStoredBodyKeys`)。
+ * 已改写 / 不带旧键的行零写;读不出的行计数、不动(留给读口的响亮臂)。读数一行 info `checkpoint_ctx_prompt_profile_rewritten`(行数,不带值),不进
+ * `OneTimeMigrationReport`(登记行 `reportKeys` 空,与 M28 同形)。窗外不扫。
+ *
+ * ## 改写不到的行(响亮拒,不是第二种读法)
+ * 续跑腿不读旧键(`resolveSpec` 只读布尔 `promptLean`)。存体里仍带 `promptProfile` 的行 —— 窗内从没起过本版的部署,或滚动升级里旧副本在本版起服扫描之后才写下的行 ——
+ * 在五个续跑问点的同一只判据上拒(`http/stored-body-replay.ts` 第四问,409 `checkpoint.unsupported_version`);窗内再起一次本版即改写它。
+ *
+ * ## 为什么不在 `one-time-migrations.ts` 的迁移段里
+ * 那一段跑在店层(起服第 3 段),checkpoint 店还没建;本条与 M28 同在起服第 6 段 checkpoint 店建成之后、任何路由装配之前调一次。
+ */
+import { type SealedCheckpointCtx } from "./http/checkpoint-ctx.js";
+import { type OneTimeMigrationWindow } from "./plugins/one-time-migrations.js";
+import type { CheckpointCtxRowsRewriter } from "./plugins/checkpoint-store-sql.js";
+/** M30 一次起服的读数(起服 info 行逐键打出;测试按它断言)。`window: "closed"` ⇒ 一行都没读(其余全 0)。`rowsLongFormKept` = 改写成 `promptLean: false` 的行。 */
+export interface PromptProfileRetireM30Report {
+    readonly window: "open" | "closed";
+    readonly rowsScanned: number;
+    readonly rowsRewritten: number;
+    readonly rowsLongFormKept: number;
+    readonly rowsUnreadable: number;
+    readonly rowsTooLarge: number;
+}
+/**
+ * 一行存量 ctx 的 M30 改写(纯函数;店腿逐行调):体里没有自有键 `promptProfile`(或体不是对象)⇒ `undefined`(不写);否则交回改写后的落盘形与改动数
+ * (写了 `promptLean: false` 记 1,只删键记 0)。导出给两孪生的真库钉(`checkpoint-ctx-credential-seal-db-integration.test.ts`)直接喂店腿。
+ */
+export declare function retirePromptProfileRowM30(stored: object): {
+    readonly ctx: SealedCheckpointCtx;
+    readonly values: number;
+} | undefined;
+/** 跑一次 M30(`today` = UTC 日历日 YYYY-MM-DD;`window` 缺省 = 登记表 M30 那一行 —— 只有测试递别的窗)。窗关 ⇒ 不扫。 */
+export declare function retirePromptProfileM30(store: CheckpointCtxRowsRewriter, opts: {
+    readonly today: string;
+    readonly window?: Pick<OneTimeMigrationWindow, "removableAfter">;
+}): Promise<PromptProfileRetireM30Report>;
+//# sourceMappingURL=stored-request-prompt-profile-m30.d.ts.map

package/dist/stored-request-prompt-profile-m30.js

@@ -0,0 +1,25 @@
+import { rewriteStoredBodyKeys } from "./http/checkpoint-ctx.js";
+import { ONE_TIME_MIGRATIONS, migrationWindowOpen } from "./plugins/one-time-migrations.js";
+const RETIRED_KEY = "promptProfile";
+export function retirePromptProfileRowM30(stored) {
+    const body = stored.body;
+    if (body === null || typeof body !== "object" || Array.isArray(body) || !Object.hasOwn(body, RETIRED_KEY))
+        return undefined;
+    const fields = body;
+    const keepsLongForm = fields[RETIRED_KEY] === "classic" && typeof fields["promptLean"] !== "boolean";
+    return { ctx: rewriteStoredBodyKeys(stored, { drop: [RETIRED_KEY], ...(keepsLongForm ? { set: { promptLean: false } } : {}) }), values: keepsLongForm ? 1 : 0 };
+}
+function m30Window() {
+    const row = ONE_TIME_MIGRATIONS.find((w) => w.id === "M30");
+    if (row === undefined)
+        throw new Error("stored-request-prompt-profile-m30: the one-time migration registry has no M30 row — this migration outlived its registry row; delete it with that row");
+    return row;
+}
+export async function retirePromptProfileM30(store, opts) {
+    if (!migrationWindowOpen(opts.window ?? m30Window(), opts.today)) {
+        return { window: "closed", rowsScanned: 0, rowsRewritten: 0, rowsLongFormKept: 0, rowsUnreadable: 0, rowsTooLarge: 0 };
+    }
+    const r = await store.rewriteCtxRows((_sessionId, ctx) => retirePromptProfileRowM30(ctx));
+    return { window: "open", rowsScanned: r.scanned, rowsRewritten: r.rewritten, rowsLongFormKept: r.valuesRewritten, rowsUnreadable: r.unreadable, rowsTooLarge: r.tooLarge };
+}
+//# sourceMappingURL=stored-request-prompt-profile-m30.js.map

package/dist/task-a2a.d.ts

@@ -1,4 +1,5 @@
-import type { A2aServerSpec } from "@sema-agent/core";
+import { type A2aServerSpec, type CompliancePosture, type LockedKey } from "@sema-agent/core";
+import { type A2aDraft, type PeerDesk, type PeerLease } from "./peer-seat.js";
 import { type DeclarationRefusal } from "./request-declaration-refusal.js";
 import type { StoredToolAxesRereadM19 } from "./stored-request-tool-axes-m19.js";
 import { type PrincipalAxisInput } from "./deployment-shape.js";
@@ -21,18 +22,42 @@ export interface A2aInjectionDrop {
     readonly reason: string;
     readonly field: string;
 }
-/** The deployment-facing shape this module reads: the principal axis only (the single-user gate). */
-export type A2aGateConfig = PrincipalAxisInput;
+/** The deployment-facing shape this module reads: the principal axis, the operator locks and the compliance posture. */
+export type A2aGateConfig = PrincipalAxisInput & {
+    readonly lockedConfigKeys?: readonly LockedKey[];
+    readonly compliancePosture?: CompliancePosture;
+};
 /**
- * Does THIS deployment honor caller-supplied per-request A2A peers? One veto — multi-tenant (deployment-shape row `multiTenant`): a tenant cannot
- * point the shared worker at an agent. The capability bit and the request leg both read this predicate, so there is exactly one place where the answer can be wrong.
+ * Does THIS deployment honor caller-supplied per-request A2A peers? The same three vetoes as `task-mcp.ts mcpInjectionHonored`, each with its own
+ * engine word: multi-tenant (deployment-shape row `multiTenant`: a tenant cannot point the shared worker at an agent), the operator lock `a2a`, and a
+ * compliance posture that denies `a2a_peers` (the engine refuses a task that declares a peer under either at prepare — advertising the bit would be
+ * "says yes, every use refused"). The capability bit and the request leg both read this predicate, so there is exactly one place where the answer can be wrong.
+ * A posture that cannot be resolved throws here (validated twice before this site; loud beats a quiet boolean, same as the MCP gate).
  */
 export declare function a2aInjectionHonored(config: A2aGateConfig): boolean;
 /**
- * 请求体 `a2aPeers[i]` 的**键闭集**(判序 = 本数组序:名 → 对端地址 → 它的 agent card 地址 → 凭据头 → 身份头 → 技能收窄 → 轴覆写)。两向钉在 core 的 `A2aServerSpec` 上:
- * 型上多一个键而表没跟 ⇒ 编译红(新键会被词表外的键门 400 掉 —— wire 上的静默回归);表里写一个型上没有的词 ⇒ 也红。于是这张表是从 core 的型**派生**出来的数据,而不是谁记得去同步的清单。
+ * 请求面一条 `a2aPeers[]` 对端在 wire 上的形(= `TaskRequestBody.a2aPeers` 的元素型):引擎的 `A2aServerSpec` 去掉凭据引用位、加上 `headers`(件)。
+ * 交给引擎之前一律经 {@link toA2aDraft} 拆成草稿 —— 引擎的声明收据对带 `headers` 的声明整条拒,件由部署的对端座在每次发送时作答。
  */
-export declare const A2A_PEER_ENTRY_KEYS: readonly ["name", "url", "cardUrl", "headers", "principalHeader", "allowSkills", "toolAxes"];
+export type RequestA2aPeer = Omit<A2aServerSpec, "credentials"> & {
+    headers?: Record<string, string>;
+};
+/**
+ * 请求体 `a2aPeers[i]` 的**处置表** —— 同时是键闭集(判序 = 书写序:名 → 对端地址 → 它的 agent card 地址 → 凭据头 → 身份头 → 技能收窄 → 轴覆写)与每个键的去处:
+ * `headers` 是件(进草稿,交给引擎的声明里不带),其余进声明。三道编译格:对请求形两向(`satisfies`:请求形多一个键而表没写 / 表里写一个请求形上没有的词 ⇒ 红);
+ * 对引擎的 `A2aServerSpec` 两道(引擎长出 / 退役一个键,或退役凭据引用位 ⇒ 红)。于是这张表是从型**派生**出来的数据,而不是谁记得去同步的清单。
+ */
+export declare const A2A_PEER_DISPOSITION: {
+    readonly name: "engine";
+    readonly url: "engine";
+    readonly cardUrl: "engine";
+    readonly headers: "seat";
+    readonly principalHeader: "engine";
+    readonly allowSkills: "engine";
+    readonly toolAxes: "engine";
+};
+/** 请求体 `a2aPeers[i]` 的键闭集 = 处置表的键(书写序即判序)。 */
+export declare const A2A_PEER_ENTRY_KEYS: readonly ("name" | "toolAxes" | "url" | "principalHeader" | "cardUrl" | "allowSkills" | "headers")[];
 /**
  * **请求入口的一次读**(`boot/resolve-spec.ts` 在腿首铸一份,受理门与读器——续跑重放腿只有读器——都吃这一份):`body.a2aPeers` 若是数组,返回同形数组
  * (每个对象条目换成它的 {@link PeerSnapshot};非对象条目原样;长度保真 —— 界外的条数仍是受理门撞帽拒与读器丢弃留声的依据,只快照界内的条目);不是数组(缺席 / `null` / 别的形)原样返回。
@@ -45,12 +70,14 @@ export declare function snapshotRequestA2a(raw: unknown, options: {
 }): unknown;
 /** 读这条对端的是哪条腿:`fresh` = 新提交;`resume` = 续跑重放升级前存下的请求体(`boot/resolve-spec.ts` 的 `opts.leg` 分流,同一个读法)。 */
 type A2aRequestLeg = "fresh" | "resume";
+/** 请求面对端 → 草稿:按 {@link A2A_PEER_DISPOSITION} 拆(`headers` 进件,其余进声明;拆法与 MCP 请求腿同一只 `splitDeclaration`)。件缺席或空 ⇒ 草稿不带件。纯函数,不登记。 */
+export declare function toA2aDraft(peer: RequestA2aPeer): A2aDraft;
 /**
  * Shape-check the raw `body.a2aPeers`. `null` → a non-array (caller error; the route may 400). Otherwise the
- * valid subset + the dropped (malformed/over-cap) entries as {@link A2aInjectionDrop} facts (peer name · reason · body coordinate).
+ * valid subset as drafts (nothing registered) + the dropped (malformed/over-cap) entries as {@link A2aInjectionDrop} facts (peer name · reason · body coordinate).
  */
 export declare function validateRequestA2a(raw: unknown): {
-    ok: A2aServerSpec[];
+    ok: A2aDraft[];
     dropped: A2aInjectionDrop[];
 } | null;
 /**
@@ -69,13 +96,14 @@ export declare function requestA2aDeclarationRefusal(list: unknown): Declaration
 /** fresh 提交腿的 `a2aPeers` 门:{@link requestA2aDeclarationRefusal} 有答案 ⇒ 同步 400(码 / 句 / `unknownKeys` / 机读位原样)。 */
 export declare function assertRequestA2aEntries(bodyA2a: unknown): void;
 /**
- * Merge GATED per-request peers OVER the deployment baseline (center/config). The baseline WINS on a name
+ * Merge GATED per-request peer drafts OVER the deployment baseline (center/config): **select first, then mint**. The baseline WINS on a name
  * clash — a caller can ADD a peer but can never SHADOW a configured one. This is load-bearing on THIS lane
  * specifically: the peer name is the tool-namespace segment (`a2a__<peer>__<skill>`), so shadowing would let
- * a caller keep the tool NAMES the model was told about while swapping the agent behind them.
+ * a caller keep the tool NAMES the model was told about while swapping the agent behind them. A draft that loses to the baseline never reaches
+ * the desk; each winner is minted once on `desk` under `lease` (`peer-seat.ts` `mintDeclaration`: the reference at the top level, zero header values).
  * Returns the baseline unchanged when there is nothing to add.
  */
-export declare function mergeRequestA2a(baseline: A2aServerSpec[] | undefined, gated: A2aServerSpec[]): A2aServerSpec[] | undefined;
+export declare function mergeRequestA2a(baseline: A2aServerSpec[] | undefined, drafts: readonly A2aDraft[], desk: Pick<PeerDesk, "declare">, lease: PeerLease): A2aServerSpec[] | undefined;
 /**
  * The single entry point the spec-builder calls: compute the effective `TaskSpec.a2a` = deployment baseline
  * (`a2aForScenario(config.a2aPeers, scenario)`) + the caller's gated per-request peers. Off the honored lane
@@ -83,7 +111,9 @@ export declare function mergeRequestA2a(baseline: A2aServerSpec[] | undefined, g
  * peers a closed gate dropped, so a shell never silently believes its declaration took effect (it also reads
  * `capabilities.a2aInjection`).
  */
-export declare function resolveRequestA2a(baseline: A2aServerSpec[] | undefined, bodyA2a: unknown, config: A2aGateConfig, logger?: {
+export declare function resolveRequestA2a(baseline: A2aServerSpec[] | undefined, bodyA2a: unknown, config: A2aGateConfig, 
+/** 对端座的 desk 与本腿的宿主租约(必填,与 MCP 请求腿同一对):胜出草稿在它下面铸成带引用的声明。 */
+desk: Pick<PeerDesk, "declare">, lease: PeerLease, logger?: {
     info?(m: string, meta?: unknown): void;
     warn(m: string, meta?: unknown): void;
 }, 

package/dist/task-a2a.js

@@ -1,18 +1,36 @@
 import { types } from "node:util";
+import { resolveComplianceDenies } from "@sema-agent/core";
 import { describeNotStringArray, describeValueShape, findUrlCredential, isStringArray } from "@sema-agent/settings-schema";
 import { errorKindOf } from "./observability/err-text.js";
-import { readPlainStringRecord } from "./plain-string-record.js";
+import { declarationKeys, readPlainStringRecord, splitDeclaration } from "./plain-string-record.js";
+import { mintDeclaration, peerSentence } from "./peer-seat.js";
 import { readRequestToolAxes } from "./request-tool-axes.js";
 import { MAX_KEY_ECHO, echoKeyName, keyClosureClause, scanKeyNames } from "./request-key-closure.js";
 import { urlCredentialHeaderExit, urlCredentialRefusalReason } from "./url-credential-refusal.js";
 import { declarationEntryNotObject, declarationIssueFacts, declarationNameIssue, declarationOverCapFacts, declaredName, judgeDeclarationKeys, requestDeclarationRefusal, throwDeclarationRefusal, } from "./request-declaration-refusal.js";
+import { principalHeaderOwnershipIssue } from "./task-mcp.js";
 import { DEPLOYMENT_SHAPE_PREDICATES } from "./deployment-shape.js";
 export const MAX_REQUEST_A2A_PEERS = 32;
 export function a2aInjectionHonored(config) {
+    if (config.lockedConfigKeys?.includes(A2A_LOCK_WORD) === true)
+        return false;
+    if (config.compliancePosture !== undefined && resolveComplianceDenies(config.compliancePosture).has(A2A_COMPLIANCE_WORD))
+        return false;
     return !DEPLOYMENT_SHAPE_PREDICATES.multiTenant.holds(config);
 }
+const A2A_LOCK_WORD = "a2a";
+const A2A_COMPLIANCE_WORD = "a2a_peers";
 const HTTP_URL_RE = /^https?:\/\//i;
-export const A2A_PEER_ENTRY_KEYS = ["name", "url", "cardUrl", "headers", "principalHeader", "allowSkills", "toolAxes"];
+export const A2A_PEER_DISPOSITION = {
+    name: "engine",
+    url: "engine",
+    cardUrl: "engine",
+    headers: "seat",
+    principalHeader: "engine",
+    allowSkills: "engine",
+    toolAxes: "engine",
+};
+export const A2A_PEER_ENTRY_KEYS = declarationKeys(A2A_PEER_DISPOSITION);
 const A2A_PEER_ENTRY_KEY_SET = new Set(A2A_PEER_ENTRY_KEYS);
 const NO_TOLERATED_KEYS = new Set();
 const A2A_SEAT = {
@@ -133,11 +151,11 @@ export function snapshotRequestA2a(raw, options) {
     return kept;
 }
 function toolAxesIssue(read) {
-    return { path: "toolAxes", reason: read.problem };
+    return { path: "toolAxes", reason: peerSentence(read.problem) };
 }
 function toolAxesNotCloneableIssue(read, clone) {
     const because = clone === undefined || clone.ok ? "unavailable" : clone.because;
-    return { path: "toolAxes", reason: `declaration not cloneable (${because}) — the one-time migration re-reads the stored declaration as plain JSON data and this one is not; ${read.problem}` };
+    return { path: "toolAxes", reason: `declaration not cloneable (${because}) — the one-time migration re-reads the stored declaration as plain JSON data and this one is not; ${peerSentence(read.problem)}` };
 }
 const A2A_PEER_KEY_JUDGES = {
     name: declarationNameIssue,
@@ -152,7 +170,11 @@ const A2A_PEER_KEY_JUDGES = {
         const reserved = read.stripped[0];
         return reserved === undefined ? undefined : { path: HEADERS_RESERVED_MEMBER_PATH, reason: reserved.fault };
     },
-    principalHeader: (o) => (o.principalHeader === undefined || typeof o.principalHeader === "string" ? undefined : { path: "principalHeader", reason: `must be a string (a header name) — got ${describeValueShape(o.principalHeader)}` }),
+    principalHeader: (o) => o.principalHeader === undefined
+        ? undefined
+        : typeof o.principalHeader !== "string"
+            ? { path: "principalHeader", reason: `must be a string (a header name) — got ${describeValueShape(o.principalHeader)}` }
+            : principalHeaderOwnershipIssue(o.principalHeader, "a2a", "principalHeader"),
     allowSkills: (o) => o.allowSkills === undefined || isStringArray(o.allowSkills)
         ? undefined
         : { path: "allowSkills", reason: `must be an array of strings (omit the key to leave the peer's skills unrestricted) — got ${describeNotStringArray(o.allowSkills)}` },
@@ -162,10 +184,10 @@ const A2A_PEER_KEY_JUDGES = {
     },
 };
 function normalizeA2aPeer(e, leg, at, storedToolAxes) {
-    const dropBecause = (issue) => ({ spec: null, because: declarationIssueFacts(at, issue) });
+    const dropBecause = (issue) => ({ draft: null, because: declarationIssueFacts(at, issue) });
     const notObject = declarationEntryNotObject(A2A_SEAT, e, at);
     if (notObject !== undefined)
-        return { spec: null, because: { field: at, reason: notObject } };
+        return { draft: null, because: { field: at, reason: notObject } };
     const o = snapshotPeer(e, storedToolAxes !== undefined);
     for (const key of A2A_PEER_ENTRY_KEYS) {
         const issue = A2A_PEER_KEY_JUDGES[key](o, at);
@@ -206,12 +228,16 @@ function normalizeA2aPeer(e, leg, at, storedToolAxes) {
                 return unread;
             if (again.toolAxes !== undefined)
                 spec.toolAxes = again.toolAxes;
-            return { spec, toolAxesReread: axes.problem, ...lost };
+            return { draft: toA2aDraft(spec), toolAxesReread: peerSentence(axes.problem), ...lost };
         }
         if (axes.toolAxes !== undefined)
             spec.toolAxes = axes.toolAxes;
     }
-    return { spec, ...lost };
+    return { draft: toA2aDraft(spec), ...lost };
+}
+export function toA2aDraft(peer) {
+    const split = splitDeclaration(peer, A2A_PEER_DISPOSITION);
+    return { spec: split.engine, ...(split.pieces === undefined ? {} : { pieces: split.pieces }) };
 }
 export function validateRequestA2a(raw) {
     const v = validateRequestA2aEntries(raw, "fresh");
@@ -228,12 +254,12 @@ function validateRequestA2aEntries(raw, leg, storedToolAxes) {
     const headersLost = [];
     for (const [i, e] of raw.slice(0, MAX_REQUEST_A2A_PEERS).entries()) {
         const read = normalizeA2aPeer(e, leg, `${A2A_SEAT.list}[${i}]`, storedToolAxes);
-        if (read.spec !== null) {
-            ok.push(read.spec);
+        if (read.draft !== null) {
+            ok.push(read.draft);
             if (read.toolAxesReread !== undefined)
-                toolAxesReread.push({ peer: read.spec.name, problem: read.toolAxesReread });
+                toolAxesReread.push({ peer: read.draft.spec.name, sentence: read.toolAxesReread });
             if (read.headersLost !== undefined)
-                headersLost.push({ peer: read.spec.name, lost: read.headersLost });
+                headersLost.push({ peer: read.draft.spec.name, lost: read.headersLost });
         }
         else
             dropped.push({ peer: declaredName(e).slice(0, 128), ...read.because });
@@ -265,14 +291,14 @@ export function requestA2aDeclarationRefusal(list) {
 export function assertRequestA2aEntries(bodyA2a) {
     throwDeclarationRefusal(requestA2aDeclarationRefusal(bodyA2a));
 }
-export function mergeRequestA2a(baseline, gated) {
-    if (gated.length === 0)
+export function mergeRequestA2a(baseline, drafts, desk, lease) {
+    if (drafts.length === 0)
         return baseline;
     const taken = new Set((baseline ?? []).map((p) => p.name));
-    const add = gated.filter((p) => !taken.has(p.name));
-    return add.length === 0 ? baseline : [...(baseline ?? []), ...add];
+    const winners = drafts.filter((d) => !taken.has(d.spec.name));
+    return winners.length === 0 ? baseline : [...(baseline ?? []), ...winners.map((d) => mintDeclaration(desk, d, lease))];
 }
-export function resolveRequestA2a(baseline, bodyA2a, config, logger, leg = "fresh", storedToolAxes) {
+export function resolveRequestA2a(baseline, bodyA2a, config, desk, lease, logger, leg = "fresh", storedToolAxes) {
     if (bodyA2a === undefined || bodyA2a === null)
         return baseline;
     if (!a2aInjectionHonored(config)) {
@@ -286,7 +312,7 @@ export function resolveRequestA2a(baseline, bodyA2a, config, logger, leg = "fres
     }
     if (v.dropped.length > 0)
         logger?.warn("a2a_injection_dropped", { dropped: v.dropped });
-    const merged = mergeRequestA2a(baseline, v.ok);
+    const merged = mergeRequestA2a(baseline, v.ok, desk, lease);
     const baselineNames = new Set((baseline ?? []).map((p) => p.name));
     for (const r of v.toolAxesReread) {
         if (baselineNames.has(r.peer))
@@ -294,7 +320,7 @@ export function resolveRequestA2a(baseline, bodyA2a, config, logger, leg = "fres
         logger?.warn("a2a_tool_axes_read_as_before_upgrade", {
             peer: r.peer,
             migration: "M19",
-            problem: r.problem,
+            problem: r.sentence,
             note: "this replayed request was stored before the upgrade and the peer's toolAxes declaration does not pass the engine's reader; while one-time migration M19 is open it is read the way the pre-upgrade reader reads it (members that do not fit are dropped) and the peer stays mounted — once the window closes the same request leaves this peer unmounted",
         });
     }