@sema-agent/server 7.137.0 → 7.139.0

package/dist/http/server.d.ts

@@ -1,11 +1,15 @@
 import http from "node:http";
+import type { MemoryComplianceFaces } from "../memory-operator-faces.js";
+import type { SideQueryAccounting } from "../budget.js";
 import type { IncomingMessage } from "node:http";
-import { type Runner, type TaskSpec, type TaskResult, type WorkflowRunStore, type MemoryEntry, type MemoryExportBundle, type MemoryImportReport, type EntryProvenanceAccount, type MemoryErasureAttestation, type MemoryEntryOrigin, type OriginClearanceRow, type SessionMemoryStatus, type ConsolidationRunReceipt, type ConsolidationDriverRunRow, type SideQuerySpec, type SideQueryResult, type Brain, type EngineNotice } from "@sema-agent/core";
+import { type Runner, type TaskSpec, type TaskResult, type WorkflowRunStore, type MemoryEntry, type MemoryExportBundle, type MemoryImportReport, type EntryProvenanceAccount, type MemoryEntryOrigin, type OriginClearanceRow, type SessionMemoryStatus, type ConsolidationRunReceipt, type ConsolidationDriverRunRow, type SideQuerySpec, type SideQueryResult, type Brain, type EngineNotice } from "@sema-agent/core";
 import type { TaskRequestBody } from "./wire-types.js";
 import type { ServiceConfig } from "../config-types.js";
 import { type SessionMirrorRuling } from "../web-admin-client/facade.js";
 import type { RestartSignal } from "@sema-agent/settings-schema/fleet";
 import { type OwnerAwareSessionStore } from "../security.js";
+import type { PeerDesk, PeerLease } from "../peer-seat.js";
+import type { ExecutionRoot, ResolvedTaskSpec } from "./execution-context.js";
 import type { RunStore, ImageIndex, ImageBake, CheckpointStoreFull, ResumeAnchorStore, ApprovalExemptionStore, ApprovalNonceStore, ServiceSessionPolicyStore, ServiceFileHistoryStore, ToolResultStoreFull, StoreBackend } from "../plugins/store-backend.js";
 import type { RuleConsentLane } from "../rules-consent.js";
 import { type MemorySyncRequest, type MemorySyncResponse } from "../memory-sync.js";
@@ -49,6 +53,8 @@ export interface RequestAuth {
      *  defaultScopes(memory.scopes 种子)。resume 腿(checkpoint 重建 auth)缺席 — 回落持久化的
      *  body.projectId(原始提交已验形),那条回落腿自己再折一次小写,两腿查同一个键。 */
     resolvedProjectId?: string;
+    /** authorizer 判过的头(`security.ts` `createAuthorizer` 交出;语义见 `AuthContext.head`)⇒ fresh 执行上下文的 `judged`。自建 authorizer 不给 = 解析器不比住客。 */
+    head?: import("@sema-agent/core").SessionHead;
 }
 /**
  * [ref] A8 —— ServiceDeps 的**分组窄接口**。
@@ -57,7 +63,7 @@ export interface RequestAuth {
  * 平铺形的直接后果 = main.ts 一个上千行的装配字面量,键与键之间没有任何「属于同一件事」的编译期表达,
  * 键落错家/从未接线只能靠源码钉逐个盯(1.300/1.301/1.304/1.307/1.310 五起真缺陷都是这个病族)。
  *
- * 药:七个**窄**接口 + 顶层必填五件。装配点按组构造(每组一个带类型标注的中间 const ⇒ 受 TS 多余
+ * 药:七个**窄**接口 + 顶层必填八件。装配点按组构造(每组一个带类型标注的中间 const ⇒ 受 TS 多余
  * 属性检查保护),键放错组当场编译红。
  *
  * 兼容形(本批**不动消费点**):`ServiceDeps` = 平铺视图 ∩ 组槽。旧的平铺构造(96 个测试文件 +
@@ -65,8 +71,8 @@ export interface RequestAuth {
  * 入口摊平回平铺视图,server.ts 内的 ~700 处 `deps.x` 消费点原样保留。消费点迁移是后批的事——
  * 一步到位需要同批改 ~700 处 src + ~800 处 test 键位,与「先立形、后搬家」相比没有额外收益。
  */
-/** createHttpServer 的**必填五件**——引擎、部署配置、请求→TaskSpec 的映射、side-query 执行席、读口场景门。
- *  五者恒在场,故留在顶层(不进任何可选组):没有它们 server 根本起不来,包一层可选组只会把编译期
+/** createHttpServer 的**必填八件**——引擎、部署配置、提交的身份与根会话(authorizer)、请求→TaskSpec 的映射、选路席、side-query 执行席、读口场景门、对端座的 desk。
+ *  八者恒在场,故留在顶层(不进任何可选组):没有它们 server 根本起不来,包一层可选组只会把编译期
  *  错误推迟到运行期(本仓 E-HIGH-1 病族的成因就是「可选键从未接线、编译期无声」)。 */
 export interface ServiceCoreDeps {
     runner: Runner;
@@ -80,9 +86,22 @@ export interface ServiceCoreDeps {
     sideQuery: (spec: SideQuerySpec) => Promise<SideQueryResult>;
     config: ServiceConfig;
     /**
-     * Map an inbound request body + resolved auth to a full TaskSpec. The SERVICE/deployment owns model
-     * + tools + mcp here (callers only supply content). `auth` carries the ownership-checked sessionId
-     * and the principal-derived memory scope — prefer them over anything in the body.
+     * Resolve identity + the owned root session BEFORE the spec is built (S6). Throw `HttpError` to reject.
+     * 🔴 **必填**:它是一次提交的根会话**唯一**的来源与铸点(体里的 `sessionId` 只由它消费:有属主读的店判属主,单用户嵌入原样采用,
+     * 不带 ⇒ 现铸并登记)。省掉是编译错;绕过类型造的 deps 在 {@link createHttpServer} 入口拒启。单用户嵌入传
+     * `createAuthorizer(config, runner.sessions)`(包根导出)—— 店没有属主读时它退化为只派 principal 与会话 id。
+     */
+    authorize: (ctx: {
+        req: IncomingMessage;
+        body: TaskRequestBody;
+    }) => Promise<RequestAuth>;
+    /**
+     * Map an inbound request body + resolved auth to a TaskSpec. The SERVICE/deployment owns model
+     * + tools + mcp here (callers only supply content). `auth` carries the principal-derived memory scope —
+     * prefer it over anything in the body.
+     * The root session is NOT the resolver's to write: the return type carries no `sessionId`
+     * (`ResolvedTaskSpec`); the server stamps the root the authorizer resolved onto every spec it executes
+     * (`http/execution-context.ts` `stampSpecRoot`). A resolver that needs the root reads `opts.execution.root`.
      */
     /** `opts.leg` (codex R4, appendSystemPrompt 案): "fresh" ⇒ a NEW submit — resolveSpec may fail-loud 400 on
      *  combos that would silently discard caller payload (append rider / outputStyle on an append-less pack).
@@ -105,12 +124,19 @@ export interface ServiceCoreDeps {
      *  `opts.unattendedLeg`([ref] 候裁 18,codex r3 F1;[ref] ① 改形):续跑家族在 ctx 带无人值守标(`CheckpointCtx.unattendedLeg`)时递 `true` ——
      *  装配器在**全部折叠之后**经首跑同一只合并口 `withUnattendedLeg` 重挂那条腿(`default` + 按类作答的 onAsk)。只由续跑腿
      *  按服务端写的 ctx 位递,绝不从请求体读。 */
-    resolveSpec: (body: TaskRequestBody, req: IncomingMessage | undefined, auth?: RequestAuth, opts?: {
+    /** `opts.execution`(必填):这条腿的执行上下文(`http/execution-context.ts`;只 `fresh` / `continuation` 两形,`root` 恒在)。装配器要用这条腿的根会话
+     *  (场景设施的分区键、受理见证)读 `opts.execution.root` —— 它与 server 随后盖进 spec 的根是同一个值,装配器自己不写根。 */
+    /** `opts.lease`(必填):这条腿的**宿主租约** —— 装配在它之下登记本腿交给引擎的对端声明(`peerDesk.declare(草稿, opts.lease)`)。
+     *  租约由两只漏斗(受理 `prepareSpec` / 续跑 `resolveResumeSpecOrBlocked`)在调用本函数**之前**开、由漏斗的失败出口或拿到产物的那段作用域放;
+     *  装配只借用,不放、不留。实现方自铸的声明归自己的 desk 时可以不理它。 */
+    resolveSpec: (body: TaskRequestBody, req: IncomingMessage | undefined, auth: RequestAuth | undefined, opts: {
         leg?: "fresh" | "resume";
         liveStream?: boolean;
         onNotice?: (notice: EngineNotice) => void;
         unattendedLeg?: true;
-    }) => TaskSpec | Promise<TaskSpec>;
+        lease: PeerLease;
+        execution: ExecutionRoot;
+    }) => ResolvedTaskSpec | Promise<ResolvedTaskSpec>;
     /**
      * [ref] 场景 hands lane 选路:按 `resolveSpec` 刚产出的 TaskSpec 取本任务的执行 Runner。
      * 装配点(`boot/stage-10-http-server.ts`)传的是 `createHandsRunnerSelector` —— 选路规则只有那一份实现,
@@ -134,6 +160,16 @@ export interface ServiceCoreDeps {
      * `createScenarioGate` / `ScenarioGate` / `ScenarioGateLeg` / `ScenarioGateSources`)。
      */
     scenarioGate: import("../capabilities/scenarios.js").ScenarioGate;
+    /**
+     * 对端座的 desk(`peer-seat.ts`):MCP http 请求的凭据头 / stdio 子进程的环境 / A2A 发送的头,发送时只有它一只作答者;登记一条活到它的 holder 都空。
+     * 本层用它开**宿主租约**:受理与续跑两只漏斗在装配之前各开一只(`lease("fresh")` / `lease("resume")`),经 `resolveSpec` 的 `opts.lease` 交给装配,
+     * 随产物(`PreparedTaskSubmission.peerLease` / 续跑结果)交给拿到它的那段作用域,在那段作用域的 `finally` 放;活过那段作用域的驱动经 `heldFor` 自持一只。
+     * 这只 desk 另有三处用法,不止这两只漏斗:① 探测口 `POST /v1/capabilities/mcp/probe` 的调用方臂在走查里开一只 `probe` 租约(三道前置拒之后开,拨号落地才放);
+     * ② 两张会话面板(`GET /v1/sessions/:id/mcp` · `…/a2a`)与探测走查拨名册声明时递它的座(`desk.seat`),不开租约;③ 名册声明在起服时登记在一只进程寿命的 `roster` 租约下
+     * (stage-07 / run-local 开,从不放),并且每只 Runner 的 `peerSeat` 是它的座。登记表的两个读数是 `/metrics` 的 `peer_registry_entries` / `peer_registry_holders`。
+     * 🔴 **必填**:没有 MCP / A2A 凭据的嵌入也给一只 `createPeerDesk()`(零 IO)—— 一个部署只有一张登记表,缺席不是「没有座」的另一种读法。
+     */
+    peerDesk: PeerDesk;
 }
 /** **durable 持久面**:每个键 present ⇔ 对应路由/能力位在场,absent ⇒ 501(诚实缺席),
  *  绝不静默降级。装配点 = main.ts 的 store backend 开箱段。 */
@@ -354,7 +390,7 @@ export interface ServiceSeamDeps {
     deviceStore?: import("../device-store.js").DeviceStore;
     /**
      * [ref](车C 余件):device lane 的**准入链**(`createDeviceEnrollment`)—— 管理面三个写动词
-     * (签发 / 注册 / 吊销)与首绑写协议(`commitPlacement`)的**唯一**判据属主。
+     * (签发 / 注册 / 吊销)与首绑写协议(`commitExecutionContext` 的设备那一支)的**唯一**判据属主。
      *
      * 🔴 为什么路由拿的是它而不是 {@link deviceStore}:enrollment 那一层持着两件路由造不出来的东西 ——
      * ①跨副本限速座(`DeviceEnrollRateLimiter`,§7-T5 ⑤:端点车**必须**传一个,而它由 boot 从既有
@@ -471,12 +507,7 @@ export interface ServiceSeamDeps {
      *  🔴 `erase` 的入参是 `unknown` 而不是 `EraseMemoryEntriesInput`:HTTP 层拿到的是一个**未校验**的对象,
      *  三选一选择子的整体判决是 core 的单一属主面(`erasureRequestInvalid`)。写成具体类型就得在路由里断言
      *  一次「它是合法输入」——那句断言是假的,而且正好把类型检查关灯。 */
-    memoryCompliance?: {
-        provenanceOf: (entryId: string) => Promise<EntryProvenanceAccount>;
-        erase: (input: unknown, opts?: {
-            allowedScopes?: readonly string[];
-        }) => Promise<MemoryErasureAttestation>;
-    };
+    memoryCompliance?: MemoryComplianceFaces;
     /** [ref] seam①([ref] §S-7,core 7.0.2 [ref] 件1):**会话记忆状态读面**。启用
      *  `GET /v1/sessions/:id/memory-status`(owner 门,tenant 自助读 —— 不是 operator 面)。
      *  main.ts 把它接到 `createSessionMemoryStatusFace` 的产物上(单实例引擎,SQL capture 店同座喂入)。
@@ -586,27 +617,20 @@ export interface ServiceSeamDeps {
      *  per-principal 查询走 caps client 的 executionRuling 同车(零额外 RTT);absent = 无 center(单用户/
      *  dry-run)⇒ 观测面不接线,零行为差。fail-open:观测失败绝不影响 sync 面本身。 */
     sessionMirrorRuling?: (principal: string | undefined) => Promise<SessionMirrorRuling | undefined>;
+    /** 主体的执行车道裁定(caps client 的 `executionRuling`,与场景裁定同车零额外 RTT)—— 执行上下文解析器步 ③ 的唯一输入(`http/execution-context.ts`,
+     *  判据 `runtime-caps-resolver.ts` `gateExecutionLane`)。缺席 = 无中心(单用户 / dry-run / 嵌入方)⇒ 不判,与已发同。 */
+    executionRuling?: (principal: string | undefined) => Promise<import("../web-admin-client/facade.js").ExecutionRuling | undefined>;
     /** Degenerate-output a/b instrument: on errorCode=output.degenerate, inspect the session's turns to
      *  classify where the salvageable answer was (counter + log). Fire-and-forget; no-op otherwise. */
     instrumentDegenerate?: (result: TaskResult) => void;
     /** [ref] side-query 记账 seam(budget.ts createSideQueryAccountant——与 createTracer 同一装配点、
      *  同一组 sink 实例:costQuota/model_cost 指标/fleetUsage/fleetLease,四路同语义)。缺席=零记账
      *  (手搭测试 deps;生产 main.ts 恒传)。 */
-    sideQueryAccounting?: (principal: string | undefined, r: {
-        model: string;
-        family?: "input-includes-cached" | "input-excludes-cached";
-        usage?: {
-            input?: number;
-            output?: number;
-            cacheRead?: number;
-            cacheWrite?: number;
-            cost?: {
-                total?: number;
-            };
-        };
-    }) => void;
+    sideQueryAccounting?: SideQueryAccounting;
     /** [ref](core 7.32.0):parked 赎回面工厂(按行解析驱动哪只 Agent 工具 + 同出一张列表的继承座;属主 `parked-revive-surface.ts`)。
-     *  缺席 = 这台部署没有 park 底座(checkpointStore / backgroundAgentStore 任一缺席),bg 赎回臂不接线。 */
+     *  缺席 = 这台部署没有 park 底座(checkpointStore / backgroundAgentStore 任一缺席),bg 赎回臂不接线。
+     *  🔴 **在场 ⇒ `sessionStorage` 必须带执行席 `executionPlacement`**:认领之后对根会话住客的唯一判官是执行席上的写口;缺 ⇒ `createHttpServer` 拒启
+     *  (句子 = `PARKED_REVIVE_EXECUTION_SEAT_REQUIRED`)。 */
     parkedReviveSurface?: import("../parked-revive-surface.js").ParkedReviveSurfaceFactory;
     /** 可选第三件:revive args 的 `subagent_type` roster 成员集([ref] Q1 成员性规则)。当前生产装配
      *  **恒缺席**(boot 内建 default 无自定义 agents roster,per-request 的 spec.agents 不进 boot 工具)
@@ -641,14 +665,6 @@ export interface ServiceObservabilityDeps {
 /** **准入/治理面**:身份解析与配额/限流/租约。每一件都是**拒绝**的权力(400/403/429),
  *  缺席 = 该道门不存在(不是「默认放行的门」——两者在事故复盘里语义完全不同)。 */
 export interface ServiceGovernanceDeps {
-    /**
-     * Resolve identity + the owned session BEFORE the spec is built (S6). Throw `HttpError` to reject.
-     * Optional: when omitted, no principal/ownership enforcement (the body's sessionId is used as-is).
-     */
-    authorize?: (ctx: {
-        req: IncomingMessage;
-        body: TaskRequestBody;
-    }) => Promise<RequestAuth>;
     /** 鉴权桥(registry-core api/auth-bridge):registry 用户 JWT → principal。缺席=分支不存在
      *  (bearer 只认 SERVICE_AUTH_TOKEN(S),现状不变)。 */
     webAdminJwtVerifier?: {
@@ -699,6 +715,12 @@ export interface ServiceDeploymentDeps {
      *  seat answer + the static patch judge). Caps `credentialPlane.sandboxGit` projects it as is. Absent = not built by the composition root
      *  (a fixture) ⇒ the same judge on config alone, the seat counted as not asked. */
     sandboxGitPlane?: import("../sandbox-git-plane.js").SandboxGitPlane;
+    /**
+     * 本进程起服装上的**运维声明** mod 包数(部署座装配口 `assembleDeploymentMods` 的 `loaded.length`;本服务自铸的注册不算)。一个事实两个出口,同读这一格:
+     * `/health` 的 `mods: { deploymentPackages }` 与 `/v1/capabilities` 的 `modsDeploymentPackages: true` —— 都只在 > 0 时在场;0 / 缺席(没声明,或不是由
+     * composition root 装起来的夹具)⇒ 两键都缺席,两面与没有声明的部署逐字节同。
+     */
+    deploymentModPackages?: number;
     /**
      * Graceful drain — shared mutable state between main.ts (flips `draining` on SIGTERM) and this server:
      *  • while `draining`, NEW model-running submissions (the billable submit paths) get 503 + Retry-After, so an
@@ -861,7 +883,7 @@ export interface ServiceDepGroups {
     deployment?: ServiceDeploymentDeps;
     knobs?: ServiceKnobDeps;
 }
-/** 平铺视图 = 必填五件 + 其余七组的全可选并集。**派生**自组接口,故与分组形永不漂。 */
+/** 平铺视图 = 必填八件 + 其余七组的全可选并集。**派生**自组接口,故与分组形永不漂。 */
 export type FlatServiceDeps = ServiceCoreDeps & Partial<ServiceStoreDeps & ServiceCoordinatorDeps & ServiceSeamDeps & ServiceObservabilityDeps & ServiceGovernanceDeps & ServiceDeploymentDeps & ServiceKnobDeps>;
 /** createHttpServer 的入参:两形皆可(平铺=存量,分组=推荐)。同名键两形都给时,**顶层显式键赢**
  *  (含显式 `undefined`)——一处装配点只该用一形,混用时以肉眼最近的那个为准。 */

package/dist/http/server.js

@@ -4,6 +4,7 @@ import { validatePendingSteer } from "@sema-agent/core";
 import {} from "../web-admin-client/facade.js";
 import { describeValueShape } from "@sema-agent/settings-schema";
 import { HttpError } from "../security.js";
+import { SessionForkInProgressError } from "../execution-placement.js";
 import {} from "../memory-sync.js";
 import {} from "../orchestration/workflow-agent-steer.js";
 import {} from "../orchestration/workflow-completion-inbox.js";
@@ -22,6 +23,7 @@ import { createRequestGuards } from "./request-guards.js";
 import { sqlEngineSeatIssue } from "../sql-engine-posture.js";
 import { parkDecisionStoreRefusal } from "../orchestration/workflow-park-decision.js";
 import { CHECKPOINT_CTX_SEALING_REQUIRED } from "./checkpoint-ctx.js";
+import { PARKED_REVIVE_EXECUTION_SEAT_REQUIRED } from "../parked-decide.js";
 import { retiredServiceDepsRefusal } from "./retired-service-deps.js";
 import { createAdmission, MAX_SKILL_CONTENT_CHARS, MAX_SYSTEM_PROMPT_CHARS, MAX_OUTPUT_SCHEMA_CHARS, validateUserSkills } from "./admission.js";
 import { createResumeLegs } from "./resume-legs.js";
@@ -61,6 +63,9 @@ export function createHttpServer(rawDeps) {
     if (typeof deps.runnerFor !== "function") {
         throw new Error("createHttpServer: the runnerFor seat is required (it picks each task's Runner from its execution lane) — pass the hands-lane selector, or `runnerFor: () => runner` for a single-Runner embedding; refusing to start rather than run every task on the widest Runner");
     }
+    if (typeof deps.authorize !== "function") {
+        throw new Error("createHttpServer: the authorize seat is required — it is the only resolver of a submission's root session; pass `createAuthorizer(config, runner.sessions)` for a single-user embedding; refusing to start rather than run submissions on a root nobody attested");
+    }
     {
         const retired = retiredServiceDepsRefusal(deps);
         if (retired !== undefined)
@@ -88,6 +93,8 @@ export function createHttpServer(rawDeps) {
     }
     if (deps.checkpointStore !== undefined && deps.checkpointCtxSealing === undefined)
         throw new Error(`createHttpServer: ${CHECKPOINT_CTX_SEALING_REQUIRED}`);
+    if (deps.parkedReviveSurface !== undefined && deps.sessionStorage?.executionPlacement === undefined)
+        throw new Error(`createHttpServer: ${PARKED_REVIVE_EXECUTION_SEAT_REQUIRED}`);
     const idemCache = new IdempotencyCache();
     const inflightRuns = new Map();
     const preemptableRuns = new DrainYieldingPreemptBook(() => deps.drainState?.draining === true);
@@ -164,6 +171,10 @@ export function createHttpServer(rawDeps) {
             }
             if (sendSessionError(res, err, "open"))
                 return;
+            if (err instanceof SessionForkInProgressError) {
+                sendError(res, 409, err.code, err.message);
+                return;
+            }
             sendError(res, 500, "internal.error", "internal error");
         });
     });

package/dist/http/session-inherit-env.d.ts

@@ -1,7 +1,7 @@
 /**
  * [ref] × 7.106.0 合并复审 X1(gpt-6 腿 A F1 [high],验证腿 B verified)—— 请求键 `inheritEnv` 的**会话绑定唯一提交点**。
  *
- * ── 分界(与 `device-placement.ts` 的首绑写协议同一句判据)──────────────────────────────────────────────────
+ * ── 分界(与 `execution-context.ts` 认领之后的执行放置提交同一句判据)──────────────────────────────────────────────────
  * 凡需要「这条会话此刻归我这条 run」才成立的事,排在 run 认领之后;其余全排在建任何东西之前。`inheritEnv` 的三道判
  * (值形 / 车道 / 射程)是**读**,住在 `resolveSpec`(两腿同判,任何副作用之前);而「本会话的 host 工厂下一次造环境按哪个词」
  * 是**写**,它只属于一条**被受理**的 run —— 修前它写在 `resolveSpec` 的最后一步,仍先于路由层的拒(`/v1/tasks/stream` 的
@@ -28,10 +28,9 @@ export interface SessionInheritEnvCommitCtx {
     bindSessionInheritEnv?: ((sessionId: string, policy: TaskInheritEnv | undefined) => void) | undefined;
 }
 /**
- * 在 run 认领之后调用:把受理的那条请求的 `inheritEnv`(缺席 = 清)写进本会话的绑定。`sessionId` 缺席(不接 authorizer 的嵌入形)⇒
- * 不写 —— `"all"` 在那一形已被 `resolveSpec` 响亮拒,`"scrub"` / 缺席与工厂缺省同形。
+ * 在 run 认领之后调用:把受理的那条请求的 `inheritEnv`(缺席 = 清)写进本会话(这条 run 的根会话)的绑定。
  */
-export declare function commitSessionInheritEnv(ctx: SessionInheritEnvCommitCtx, sessionId: string | undefined, body: {
+export declare function commitSessionInheritEnv(ctx: SessionInheritEnvCommitCtx, sessionId: string, body: {
     readonly inheritEnv?: TaskInheritEnv | undefined;
 }): void;
 //# sourceMappingURL=session-inherit-env.d.ts.map

package/dist/http/session-inherit-env.js

@@ -1,5 +1,5 @@
 export function commitSessionInheritEnv(ctx, sessionId, body) {
-    if (sessionId === undefined || ctx.bindSessionInheritEnv === undefined)
+    if (ctx.bindSessionInheritEnv === undefined)
         return;
     ctx.bindSessionInheritEnv(sessionId, body.inheritEnv);
 }

package/dist/http/wire-types.d.ts

@@ -6,8 +6,9 @@
  * cut: ONLY TaskRequestBody (its field types are inline or core imports — no other server.ts-local satellites);
  * sibling request/response shapes can migrate here later on the same pattern.
  */
-import type { A2aServerSpec, AgentDefinition, ApprovalReach, PermissionMode, SkillSpec, TaskSpec } from "@sema-agent/core";
+import type { AgentDefinition, ApprovalReach, PermissionMode, SkillSpec, TaskSpec } from "@sema-agent/core";
 import type { RequestMcpServerSpec } from "../mcp-assertion-header.js";
+import type { RequestA2aPeer } from "../task-a2a.js";
 import type { wiringManifestFaceEventData } from "../trace/project.js";
 import type { buildSyncSubmitBody } from "./sync-submit-body.js";
 import type { EntryProblem } from "../entry-problems.js";
@@ -194,7 +195,7 @@ export interface TaskRequestBody {
      *  after it"). core enforces the "before" edges and the service passes its rejection codes through UNCHANGED for the
      *  shell to render: `resume_at.before_target_not_user` (only plain user-message targets),
      *  `resume_at.before_root_unsupported` (can't rewind past the session root — start a new session),
-     *  `rewind_snapshot.unresolvable` (rewindFiles: no snapshot at/above the "before" branch point). Only meaningful
+     *  `rewind_snapshot.unresolvable` (restoreFiles: no snapshot at/above the "before" branch point). Only meaningful
      *  WITH `resumeAt` — sent alone it's a 400 (fail-loud, not a silent no-op). */
     resumeAtMode?: string;
     /** [ref] Phase3 (reuse-path warm-resume): require the `sessionId` to ALREADY exist. When `true` and the session
@@ -220,11 +221,6 @@ export interface TaskRequestBody {
     /** DV-15: opt-in tolerance for a PARTIAL file restore (default = loud terminal failure carrying the per-file
      *  ledger; `true` = keep going and disclose the same ledger on the result's rewindNotes). */
     acceptPartialRestore?: boolean;
-    /** RETIRED spelling (whole-tree epoch). Still accepted on the wire: its capture sense (true, no resumeAt) is
-     *  a tolerated no-op with a deprecation disclosure; its restore sense (true + resumeAt) is a typed rejection
-     *  naming `restoreFiles` — the restore semantics genuinely changed (whole tree ⇒ tracked set), so that
-     *  migration is explicit by design (core adjudicates; the server never remaps it silently). */
-    rewindFiles?: boolean;
     /** R8 code-only rewind (CC "Restore code" mode): converge the TRACKED set to the history boundary at a prior
      *  USER message WITHOUT forking the conversation (the session leaf is untouched — only the files move). The
      *  value is the same handle as `resumeAt` (the prompt's taskId); the service resolves it → the entry id. Honored ONLY
@@ -234,7 +230,7 @@ export interface TaskRequestBody {
      *  与 `checkpointStore` 同;没有 `"enabled"` —— 缺席就是「部署说了算」的唯一形,声明只能单向收紧)。`"disabled"` ⇒
      *  这条 run 零历史店调用:编辑照常落盘,但不做首次触碰备份、不铸回合边界、不做 fork 携带;委派出去的子代继承
      *  (core `ParentSpecSeat` 从本位铸,本仓零接线)。`wiring_manifest.fileHistory` 报 `"disabled"`。
-     *  同一个提交里再要还原(`restoreFiles` / `rewindFilesTo` / 退役 `rewindFiles`)= 体内矛盾 ⇒ **受理时** 400
+     *  同一个提交里再要还原(`restoreFiles` / `rewindFilesTo`)= 体内矛盾 ⇒ **受理时** 400
      *  `request.field_conflict`(`request-value-closure.ts` 的 `FILE_HISTORY_DISABLED_NO_RESTORE`):立门时 core 的 `rewind.capture_disabled`
      *  落在会话按 `resumeAt` 分叉之后、拒后不回滚,所以本层在副作用之前拒([ref] / core 7.35.0 [ref] 起 core 在分叉**之前**拒,
      *  本层 400 照旧有效)。续跑腿不过这道门。
@@ -471,7 +467,7 @@ export interface TaskRequestBody {
      *  · 仅 `REMOTE_EXEC=device` 的部署接受;其它车道收到它 = **400 响亮拒**(不静默忽略 —— 调用方会
      *    以为自己指定了执行设备,而那条声明从未存在);
      *  · 仅**根任务**提交携带(子代无条件继承根绑定,core 为 subagent/cascade/verify 另铸 sessionId);
-     *  · 首绑 = INSERT-if-absent CAS(并发单赢家);后续根提交:缺席 = 沿用绑定 / 携且同 = 幂等 /
+     *  · 首绑 = 根会话行执行格的 absent → writer(device, D)(按受理那一读的住客定址,并发单赢家);后续根提交:缺席 = 沿用绑定 / 携且同 = 幂等 /
      *    携且异 = 403 `device.identity_mismatch`(**v1 无隐式重绑**,换设备走
      *    `POST /v1/devices/sessions/:rootSessionId/rebind`);
      *  · resume 家族(`/decide` / `/answer` / `/plan_review` / `/wake`)**不收**这个键:车道随树固定。
@@ -490,10 +486,11 @@ export interface TaskRequestBody {
     /** [ref]⑧/[ref]/[ref] (core 5.23.0 `TaskSpec.oneShot`): this SUBMISSION is one-shot — no later turn exists
      *  in which an async background notification could land (the archetypal case is a headless `sema -p` whose
      *  process exits when the turn ends). PER-REQUEST on purpose: "does this submission expect to be continued" is
-     *  a property of the submission, not of the connection it arrived on. core consumes it as GUIDANCE ONLY (the
-     *  `RunWorkflow` / delegation receipts tell the model to block-wait via `TaskOutput({block:true})` instead of
-     *  "end your turn, you will be notified" — the latter is actively wrong here and loses background results); it
-     *  grants nothing, so there is no tenancy gate. Sibling of `interactiveTools` (the same `-p` posture) and passed
+     *  a property of the submission, not of the connection it arrived on. Since core 7.60.0 it changes when the
+     *  submission ends: where a one-shot run would end, the engine waits for the background agents and workflow runs
+     *  it started (a background command or Monitor watch is never waited for), bounded by the run's walltime, a cancel
+     *  and a 600 s ceiling; a sync submission therefore returns after that background work. It grants nothing, so
+     *  there is no tenancy gate. Sibling of `interactiveTools` (the same `-p` posture) and passed
      *  through the same way: a boolean rides, absent/garbage ⇒ key omitted (core's default = interactive). Rides the
      *  persisted body onto resume legs. */
     oneShot?: boolean;
@@ -554,22 +551,29 @@ export interface TaskRequestBody {
      *  与 `principalHeader` **互斥**:同设 ⇒ 新提交腿同步 400 `request.body_shape`(拒句与契约包解析期那一句逐字相同);值不是字符串 ⇒ 400
      *  `request.field_invalid`。耐久 resume 腿不拒(重放存量 body),也**不摘 server**(摘了,park 在它工具审批上的任务批准后撞 `resume.tool_unavailable`
      *  且每次重试重放同一份 body):降级到升级前的读法 —— server 照挂、`principalHeader` 胜、`assertionHeader` 不生效,一行 warn `mcp_assertion_header_ignored`。
-     *  ⚠️ 本版**只承载、不发送**:引擎的 http 传输尚无断言头座,
-     *  声明被接收、server 照常挂载但不带断言头,并有一行运维 info `mcp_assertion_header_not_sent { server }`;发送随引擎座。 */
+     *  ⚠️ **只承载、不发送**:引擎的断言头是固定的名、值由部署的对端座作答,本部署没有断言来源 ——
+     *  声明被接收、server 照常挂载但不带断言头,并有一行运维 info `mcp_assertion_header_not_sent { server }`。
+     *
+     *  `transport.env`(stdio)/ `transport.headers`(http)是这台 server 的**件**:server 交给引擎的声明里不带它们,件由部署的对端座在起子进程 / 发请求时按原字节作答
+     *  (只对胜出部署同名判的条目登记;件的名与值由引擎在每次发送时判,不合 ⇒ 那一台不连、兄弟照挂)。 */
     mcpServers?: RequestMcpServerSpec[];
     /** [DESIGN-269 车1] Caller-supplied per-request A2A peers (remote agents this task may call), aligned to
      *  core `A2aServerSpec`. 🔒 honored on a SINGLE-USER deployment (task-a2a.ts `a2aInjectionHonored`, the same
      *  predicate `capabilities.a2aInjection` advertises) — the requester is the super-admin of their OWN worker,
      *  on ANY execution lane (an A2A call is a plain outbound HTTPS request from the worker, so the lane where
      *  tool calls run is irrelevant); IGNORED on multi-tenant (a tenant can't point the shared worker at an
-     *  agent of their choosing). A2A has no operator lock and no compliance capability today. A new submission
+     *  agent of their choosing). The gate also closes under the operator lock `a2a` and under a compliance posture that denies `a2a_peers`
+     *  (the engine refuses a task that declares a peer under either): under the lock a request that carries `a2aPeers` is refused
+     *  400 `config.locked_key` at the head of the request (the same code and status table as the MCP lock); on a multi-tenant
+     *  deployment or under a compliance denial the list is ignored and said (`a2a_injection_ignored`). A new submission
      *  with a malformed list or entry is refused 400 (`assertRequestA2aEntries`: not an array / over the 32-entry
      *  cap / an entry that is not an object / a key outside {@link A2A_PEER_ENTRY_KEYS} / a key whose value is
      *  unusable / a url or cardUrl carrying a credential) — the same refusal shape as `mcpServers`, whatever the lane.
      *  🔴 Every skill a peer advertises mounts `egress:true` + `effect:"write"` (core's ruling) — declaring a
      *  peer is declaring an outbound WRITE channel, not a data source. Validated + gated downstream; the
-     *  center/config baseline wins on a name clash (the peer name IS the tool namespace). */
-    a2aPeers?: A2aServerSpec[];
+     *  center/config baseline wins on a name clash (the peer name IS the tool namespace). `headers` are the peer's PIECES: the declaration the
+     *  server hands the engine carries none of them — the deployment's peer seat answers them, as written, at each send to the declared origins. */
+    a2aPeers?: RequestA2aPeer[];
     /** CC parity (Workflow super-set): per-task activation of the LLM-authored workflow engine (core `run_workflow`).
      *  `true` → `spec.selfOrchestration` (the engine mounts run_workflow), gated on the deployment's `selfOrchestrationEnabled`
      *  (else a harmless no-op) + core's `allowWorkflows` per-principal entitlement on multi-tenant (single-user honors

package/dist/identity-source.d.ts

@@ -13,7 +13,7 @@
  *    `ALLOW_UNAUTHED_WRITES`)、以及别人替属主按下的那一跑(受理请求验过的主体不是这一行的属主:唤醒 / 决定投递铸的新一跑)。读者一律按「不合格」处置
  *    (fail-closed),不分辨三种成因;存量行不回填(没有事实可回填)。
  *
- * 化身号 `principalInc`:令牌 `sub_inc` 声明原样,经契约包 `VerifiedIdentity.principalInc` 读(settings-schema 14.7.0 加的可选字段);本版契约包还没有这一位 ⇒ 恒 `null`,
+ * 化身号 `principalInc`:令牌 `sub_inc` 声明原样,经契约包 `VerifiedIdentity.principalInc` 读(settings-schema 14.7.0 加的可选字段,已提货:验证腿随身份带出);本版接线未做 ⇒ 恒 `null`,
  * 接线点在 `admitRunIdentity` 的 `sso` 臂(不在本仓另定一份读法)。
  */
 /** 验过的身份来源的**闭集**(序 = 判定次序 = `/health.auth.kinds` 的出现序;加一个来源 = 加一个词,读它的各只穷举 `switch` 不接就编译红)。 */

package/dist/index.d.ts

@@ -26,6 +26,9 @@ export type { TaskRequestBody } from "./http/wire-types.js";
 export { ensureCheckpointCtxSealing } from "./sealed-key.js";
 export type { CheckpointCtxSealing } from "./http/checkpoint-ctx.js";
 export { createHttpServer, type ServiceDeps, type RequestAuth, type FlatServiceDeps, type ServiceDepGroups, type ServiceCoreDeps, type ServiceStoreDeps, type ServiceCoordinatorDeps, type ServiceSeamDeps, type ServiceObservabilityDeps, type ServiceGovernanceDeps, type ServiceDeploymentDeps, type ServiceKnobDeps, } from "./http/server.js";
+export type { ExecutionContext, ResolvedTaskSpec, RootedTaskSpec } from "./http/execution-context.js";
+export { createPeerDesk } from "./peer-seat.js";
+export type { PeerDesk, PeerLease, McpDraft, A2aDraft } from "./peer-seat.js";
 export { createSideQueryLane, type KeyResolver, type SideQueryLane, type SideQueryLaneCtx } from "./boot/side-query-lane.js";
 export { createKeyResolver, resolveModelApiKey, type ModelKeyRef } from "./key-resolver.js";
 export { isModelKeyPoison, ModelKeyPoisonedError, type ModelKeyPoison, type ModelKeyPoisonReason } from "./key-resolver.js";

package/dist/index.js

@@ -22,6 +22,7 @@ export { createAuthorizer, principalFrom, HttpError, } from "./security.js";
 export { memoryScopeFor, memoryEngineBackendFor } from "./memory-scope.js";
 export { ensureCheckpointCtxSealing } from "./sealed-key.js";
 export { createHttpServer, } from "./http/server.js";
+export { createPeerDesk } from "./peer-seat.js";
 export { createSideQueryLane } from "./boot/side-query-lane.js";
 export { createKeyResolver, resolveModelApiKey } from "./key-resolver.js";
 export { isModelKeyPoison, ModelKeyPoisonedError } from "./key-resolver.js";

package/dist/leader/wire.d.ts

@@ -91,6 +91,13 @@ export interface LeaderWireConfig {
      * 分租户,只补席不包裹 = 归因恒 undefined = 假绿。缺席 ⇒ 展开空对象(与接线前逐字相同)。
      */
     tracer?: RunnerDeps["tracer"];
+    /**
+     * **部署座**(`RunnerDeps.mods`),原样递给本车道的每一只 Runner。唯一铸点 = 起服第 5 段的装配口 `assembleDeploymentMods`(本服务自铸的注册在前、
+     * 运维声明的 mod 包在后、整列过引擎准入);主 / 无手 / hook 代理 / 子代经共享基座吃的就是它,`boot/leader.ts` 搬的是**同一份**。
+     * leader 不自铸、不自己装配(一个进程两份部署注册 = 主车道与 leader 车道各按一套扩展跑)。缺失时整个部署座在这条车道上缺席:运维声明的守卫包
+     * 管不到 leader 派出的腿,拒绝计量 / 工具追踪也漏这条腿。缺席 ⇒ 展开空对象。
+     */
+    mods?: RunnerDeps["mods"];
     /**
      * [ref]([ref],[ref]-T1)—— **部署级 token 治理窗**两键,**成对**递给本车道的每一只 Runner。
      * 属主 = `config.usageWindows`(声明)+ `boot/stores.ts` 造的账本店(两者同真同假,与

package/dist/leader/wire.js

@@ -166,6 +166,7 @@ export function createLeaderRunner(cfg) {
     const governanceSeat = cfg.governance ?? {};
     const deploymentPostureSeat = () => cfg.deploymentPosture?.() ?? {};
     const tracerSeat = cfg.tracer ? { tracer: cfg.tracer } : {};
+    const modsSeat = cfg.mods ? { mods: cfg.mods } : {};
     const usageWindowSeat = cfg.usageWindows && cfg.usageWindowStore ? { usageWindows: cfg.usageWindows, usageWindowStore: cfg.usageWindowStore } : {};
     const promptSourceSeat = cfg.promptSource ? { promptSource: cfg.promptSource } : {};
     const onErrorSeat = cfg.onError ? { onError: cfg.onError } : {};
@@ -186,7 +187,7 @@ export function createLeaderRunner(cfg) {
                         throw new Error(`oracle still present after remove (${f.path}) — refusing repair (measurement integrity)`);
                 }
                 try {
-                    const runner = new Runner({ brain: cfg.brain, models: cfg.models, roles: cfg.roles, pricing: cfg.pricing, ...onNoticeSeat, ...governanceSeat, ...deploymentPostureSeat(), ...tracerSeat, ...usageWindowSeat, ...promptSourceSeat, ...onErrorSeat, executionEnv: rawEnv, rootPath: repoDir });
+                    const runner = new Runner({ brain: cfg.brain, models: cfg.models, roles: cfg.roles, pricing: cfg.pricing, ...onNoticeSeat, ...governanceSeat, ...deploymentPostureSeat(), ...tracerSeat, ...usageWindowSeat, ...promptSourceSeat, ...onErrorSeat, ...modsSeat, executionEnv: rawEnv, rootPath: repoDir });
                     const objective = [
                         `The integrated project at ${repoDir} fails its build/test. Make the MINIMAL change to the working tree so this command exits 0 (cd into the repo and run it yourself to confirm):`,
                         `  ${testCmd}`,
@@ -253,7 +254,7 @@ export function createLeaderRunner(cfg) {
             if (Array.isArray(body.subtasks) && body.subtasks.length > 0) {
                 return validateSubtasks(body.subtasks);
             }
-            const planRunner = new Runner({ brain: cfg.brain, models: cfg.models, roles: cfg.roles, pricing: cfg.pricing, ...onNoticeSeat, ...governanceSeat, ...deploymentPostureSeat(), ...tracerSeat, ...usageWindowSeat, ...promptSourceSeat, ...onErrorSeat });
+            const planRunner = new Runner({ brain: cfg.brain, models: cfg.models, roles: cfg.roles, pricing: cfg.pricing, ...onNoticeSeat, ...governanceSeat, ...deploymentPostureSeat(), ...tracerSeat, ...usageWindowSeat, ...promptSourceSeat, ...onErrorSeat, ...modsSeat });
             const runRoute = async (prompt) => {
                 const res = await planRunner.runTaskStream({
                     objective: prompt,
@@ -347,7 +348,7 @@ export function createLeaderRunner(cfg) {
                     workerId: sub.workerId, sessionId, branch: sub.branch,
                     baseSha,
                     runner: keepCtxWarm(new Runner({
-                        brain: cfg.brain, models: cfg.models, roles: cfg.roles, pricing: cfg.pricing, ...onNoticeSeat, ...governanceSeat, ...deploymentPostureSeat(), ...tracerSeat, ...usageWindowSeat, ...promptSourceSeat, ...onErrorSeat,
+                        brain: cfg.brain, models: cfg.models, roles: cfg.roles, pricing: cfg.pricing, ...onNoticeSeat, ...governanceSeat, ...deploymentPostureSeat(), ...tracerSeat, ...usageWindowSeat, ...promptSourceSeat, ...onErrorSeat, ...modsSeat,
                         ...(cfg.toolResultStore ? { toolResultStore: cfg.toolResultStore } : {}),
                         ...(cfg.sessionStore ? { sessionStore: cfg.sessionStore } : {}),
                         executionEnvFactory: async (ctx) => {
@@ -372,7 +373,7 @@ export function createLeaderRunner(cfg) {
             const baseSha = await sh(env)(`cd ${repo} && git rev-parse HEAD`);
             return {
                 workerId: sub.workerId, sessionId, branch: sub.branch, baseSha,
-                runner: keepCtxWarm(new Runner({ brain: cfg.brain, models: cfg.models, roles: cfg.roles, pricing: cfg.pricing, ...onNoticeSeat, ...governanceSeat, ...deploymentPostureSeat(), ...tracerSeat, ...usageWindowSeat, ...promptSourceSeat, ...onErrorSeat, ...(cfg.toolResultStore ? { toolResultStore: cfg.toolResultStore } : {}), ...(cfg.sessionStore ? { sessionStore: cfg.sessionStore } : {}), executionEnv: env })),
+                runner: keepCtxWarm(new Runner({ brain: cfg.brain, models: cfg.models, roles: cfg.roles, pricing: cfg.pricing, ...onNoticeSeat, ...governanceSeat, ...deploymentPostureSeat(), ...tracerSeat, ...usageWindowSeat, ...promptSourceSeat, ...onErrorSeat, ...modsSeat, ...(cfg.toolResultStore ? { toolResultStore: cfg.toolResultStore } : {}), ...(cfg.sessionStore ? { sessionStore: cfg.sessionStore } : {}), executionEnv: env })),
                 diffEnv: env,
                 destroy: () => env.destroy().then(() => { }),
                 spec: withLeaderLeg({ ...workerLimits, ...sub.spec, ...durableSpec, ...resourceSpec, ...principalSpec() }, resumeBody),