@sema-agent/server 7.137.0 → 7.139.0

package/deploy/sema-up/lib/lanes.json

@@ -30,10 +30,11 @@
       "env": {
         "REMOTE_EXEC": "k8s",
         "REQUIRE_EXECUTION_LANE": "true",
-        "K8S_SANDBOX_IMAGE": null
+        "K8S_SANDBOX_IMAGE": null,
+        "K8S_NAMESPACE": null
       },
       "isolation": "supported",
-      "note": "kube 路径**不选词**:runtime 由 kube-up.sh 按 runtimeClass `kata-qemu` 在不在自动定(在 ⇒ kata VM,不在 ⇒ runc 容器),沙箱镜像由 chart/清单给。本行只为对表(能力表 / 必需键 / REQUIRE_EXECUTION_LANE 三面),不进 --sandbox 词表。"
+      "note": "kube 路径**不选词**:runtime 由 kube-up.sh 按 runtimeClass `kata-qemu` 在不在自动定(在 ⇒ kata VM,不在 ⇒ runc 容器),沙箱镜像与沙箱命名空间由 chart/清单给。本行只为对表(能力表 / 必需键 / REQUIRE_EXECUTION_LANE 三面),不进 --sandbox 词表。"
     }
   ],
   "retired": [

package/dist/adoption/wire.d.ts

@@ -71,10 +71,10 @@ export declare const NOT_MIGRATED_FACES: readonly ["usage-window", "cost-quota",
 export type NotMigratedFace = (typeof NOT_MIGRATED_FACES)[number];
 export declare const AdoptionNotMigratedSchema: z.ZodObject<{
     face: z.ZodEnum<{
+        "org-delivery-quota": "org-delivery-quota";
         "usage-window": "usage-window";
         "cost-quota": "cost-quota";
         "rate-limit": "rate-limit";
-        "org-delivery-quota": "org-delivery-quota";
         "approval-exemption-grantor": "approval-exemption-grantor";
         "approval-ask-decision-actor": "approval-ask-decision-actor";
         "image-bake-requested-by": "image-bake-requested-by";
@@ -120,10 +120,10 @@ export declare const AdoptionReportSchema: z.ZodObject<{
     }, z.core.$strict>>;
     notMigratedByDesign: z.ZodArray<z.ZodObject<{
         face: z.ZodEnum<{
+            "org-delivery-quota": "org-delivery-quota";
             "usage-window": "usage-window";
             "cost-quota": "cost-quota";
             "rate-limit": "rate-limit";
-            "org-delivery-quota": "org-delivery-quota";
             "approval-exemption-grantor": "approval-exemption-grantor";
             "approval-ask-decision-actor": "approval-ask-decision-actor";
             "image-bake-requested-by": "image-bake-requested-by";
@@ -182,10 +182,10 @@ export declare const AdoptionReceiptSchema: z.ZodObject<{
         }, z.core.$strict>>;
         notMigratedByDesign: z.ZodArray<z.ZodObject<{
             face: z.ZodEnum<{
+                "org-delivery-quota": "org-delivery-quota";
                 "usage-window": "usage-window";
                 "cost-quota": "cost-quota";
                 "rate-limit": "rate-limit";
-                "org-delivery-quota": "org-delivery-quota";
                 "approval-exemption-grantor": "approval-exemption-grantor";
                 "approval-ask-decision-actor": "approval-ask-decision-actor";
                 "image-bake-requested-by": "image-bake-requested-by";

package/dist/approval-card.d.ts

@@ -83,9 +83,10 @@ export declare const RuleOfferSchema: z.ZodUnion<readonly [z.ZodObject<{
     kind: z.ZodLiteral<"single">;
     rule: z.ZodString;
     match: z.ZodEnum<{
-        name: "name";
         host: "host";
+        name: "name";
         path: "path";
+        tool: "tool";
         exact: "exact";
         pattern: "pattern";
         prefix: "prefix";
@@ -101,9 +102,10 @@ export declare const RuleOfferSchema: z.ZodUnion<readonly [z.ZodObject<{
         kind: z.ZodLiteral<"command">;
         rule: z.ZodString;
         match: z.ZodEnum<{
-            name: "name";
             host: "host";
+            name: "name";
             path: "path";
+            tool: "tool";
             exact: "exact";
             pattern: "pattern";
             prefix: "prefix";
@@ -556,10 +558,10 @@ export declare const ApprovalCardSchema: z.ZodObject<{
         skill: "skill";
         shell: "shell";
         workflow: "workflow";
-        "file-edit": "file-edit";
+        fetch: "fetch";
         "file-write": "file-write";
+        "file-edit": "file-edit";
         "notebook-edit": "notebook-edit";
-        fetch: "fetch";
         generic: "generic";
     }>>;
     inputHasBidi: z.ZodOptional<z.ZodLiteral<true>>;
@@ -578,9 +580,10 @@ export declare const ApprovalCardSchema: z.ZodObject<{
         kind: z.ZodLiteral<"single">;
         rule: z.ZodString;
         match: z.ZodEnum<{
-            name: "name";
             host: "host";
+            name: "name";
             path: "path";
+            tool: "tool";
             exact: "exact";
             pattern: "pattern";
             prefix: "prefix";
@@ -596,9 +599,10 @@ export declare const ApprovalCardSchema: z.ZodObject<{
             kind: z.ZodLiteral<"command">;
             rule: z.ZodString;
             match: z.ZodEnum<{
-                name: "name";
                 host: "host";
+                name: "name";
                 path: "path";
+                tool: "tool";
                 exact: "exact";
                 pattern: "pattern";
                 prefix: "prefix";
@@ -665,8 +669,8 @@ export declare const ApprovalCardSchema: z.ZodObject<{
         }, z.core.$strict>>>;
         personalRuleDotsAbsent: z.ZodOptional<z.ZodCustom<AskEvidenceAbsence, AskEvidenceAbsence>>;
     }, z.core.$strict>>;
-    askClass: z.ZodOptional<z.ZodCustom<"mode" | "hook" | "org_rule" | "write_protection" | "target_unresolved" | "content_question" | "ask_rule" | "denial_limit_fallback" | "ancestor" | "dangerous_delete" | "unverifiable_delete" | "unverifiable_shell_text" | "transcript_write" | "rule_unreadable" | "classifier_no_ruling" | "requires_user_interaction" | "cross_boundary" | "operator_forced" | "shell_floor" | "probe" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "unstated" | "ordinary", "mode" | "hook" | "org_rule" | "write_protection" | "target_unresolved" | "content_question" | "ask_rule" | "denial_limit_fallback" | "ancestor" | "dangerous_delete" | "unverifiable_delete" | "unverifiable_shell_text" | "transcript_write" | "rule_unreadable" | "classifier_no_ruling" | "requires_user_interaction" | "cross_boundary" | "operator_forced" | "shell_floor" | "probe" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "unstated" | "ordinary">>;
-    classes: z.ZodOptional<z.ZodArray<z.ZodCustom<"mode" | "hook" | "org_rule" | "write_protection" | "target_unresolved" | "content_question" | "ask_rule" | "denial_limit_fallback" | "ancestor" | "dangerous_delete" | "unverifiable_delete" | "unverifiable_shell_text" | "transcript_write" | "rule_unreadable" | "classifier_no_ruling" | "requires_user_interaction" | "cross_boundary" | "operator_forced" | "shell_floor" | "probe" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "unstated" | "ordinary", "mode" | "hook" | "org_rule" | "write_protection" | "target_unresolved" | "content_question" | "ask_rule" | "denial_limit_fallback" | "ancestor" | "dangerous_delete" | "unverifiable_delete" | "unverifiable_shell_text" | "transcript_write" | "rule_unreadable" | "classifier_no_ruling" | "requires_user_interaction" | "cross_boundary" | "operator_forced" | "shell_floor" | "probe" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "unstated" | "ordinary">>>;
+    askClass: z.ZodOptional<z.ZodCustom<"mode" | "hook" | "org_rule" | "write_protection" | "target_unresolved" | "content_question" | "ask_rule" | "denial_limit_fallback" | "ancestor" | "dangerous_delete" | "unverifiable_delete" | "unverifiable_shell_text" | "transcript_write" | "rule_unreadable" | "classifier_no_ruling" | "requires_user_interaction" | "cross_boundary" | "operator_forced" | "shell_floor" | "probe" | "write_protection_on_disk" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "unstated" | "ordinary", "mode" | "hook" | "org_rule" | "write_protection" | "target_unresolved" | "content_question" | "ask_rule" | "denial_limit_fallback" | "ancestor" | "dangerous_delete" | "unverifiable_delete" | "unverifiable_shell_text" | "transcript_write" | "rule_unreadable" | "classifier_no_ruling" | "requires_user_interaction" | "cross_boundary" | "operator_forced" | "shell_floor" | "probe" | "write_protection_on_disk" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "unstated" | "ordinary">>;
+    classes: z.ZodOptional<z.ZodArray<z.ZodCustom<"mode" | "hook" | "org_rule" | "write_protection" | "target_unresolved" | "content_question" | "ask_rule" | "denial_limit_fallback" | "ancestor" | "dangerous_delete" | "unverifiable_delete" | "unverifiable_shell_text" | "transcript_write" | "rule_unreadable" | "classifier_no_ruling" | "requires_user_interaction" | "cross_boundary" | "operator_forced" | "shell_floor" | "probe" | "write_protection_on_disk" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "unstated" | "ordinary", "mode" | "hook" | "org_rule" | "write_protection" | "target_unresolved" | "content_question" | "ask_rule" | "denial_limit_fallback" | "ancestor" | "dangerous_delete" | "unverifiable_delete" | "unverifiable_shell_text" | "transcript_write" | "rule_unreadable" | "classifier_no_ruling" | "requires_user_interaction" | "cross_boundary" | "operator_forced" | "shell_floor" | "probe" | "write_protection_on_disk" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "unstated" | "ordinary">>>;
     fromSubagent: z.ZodOptional<z.ZodLiteral<true>>;
     sourceTaskId: z.ZodOptional<z.ZodString>;
     sourceAgentName: z.ZodOptional<z.ZodString>;
@@ -708,10 +712,10 @@ export declare const ApprovalCardEnvelopeSchema: z.ZodObject<{
             skill: "skill";
             shell: "shell";
             workflow: "workflow";
-            "file-edit": "file-edit";
+            fetch: "fetch";
             "file-write": "file-write";
+            "file-edit": "file-edit";
             "notebook-edit": "notebook-edit";
-            fetch: "fetch";
             generic: "generic";
         }>>;
         inputHasBidi: z.ZodOptional<z.ZodLiteral<true>>;
@@ -730,9 +734,10 @@ export declare const ApprovalCardEnvelopeSchema: z.ZodObject<{
             kind: z.ZodLiteral<"single">;
             rule: z.ZodString;
             match: z.ZodEnum<{
-                name: "name";
                 host: "host";
+                name: "name";
                 path: "path";
+                tool: "tool";
                 exact: "exact";
                 pattern: "pattern";
                 prefix: "prefix";
@@ -748,9 +753,10 @@ export declare const ApprovalCardEnvelopeSchema: z.ZodObject<{
                 kind: z.ZodLiteral<"command">;
                 rule: z.ZodString;
                 match: z.ZodEnum<{
-                    name: "name";
                     host: "host";
+                    name: "name";
                     path: "path";
+                    tool: "tool";
                     exact: "exact";
                     pattern: "pattern";
                     prefix: "prefix";
@@ -817,8 +823,8 @@ export declare const ApprovalCardEnvelopeSchema: z.ZodObject<{
             }, z.core.$strict>>>;
             personalRuleDotsAbsent: z.ZodOptional<z.ZodCustom<AskEvidenceAbsence, AskEvidenceAbsence>>;
         }, z.core.$strict>>;
-        askClass: z.ZodOptional<z.ZodCustom<"mode" | "hook" | "org_rule" | "write_protection" | "target_unresolved" | "content_question" | "ask_rule" | "denial_limit_fallback" | "ancestor" | "dangerous_delete" | "unverifiable_delete" | "unverifiable_shell_text" | "transcript_write" | "rule_unreadable" | "classifier_no_ruling" | "requires_user_interaction" | "cross_boundary" | "operator_forced" | "shell_floor" | "probe" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "unstated" | "ordinary", "mode" | "hook" | "org_rule" | "write_protection" | "target_unresolved" | "content_question" | "ask_rule" | "denial_limit_fallback" | "ancestor" | "dangerous_delete" | "unverifiable_delete" | "unverifiable_shell_text" | "transcript_write" | "rule_unreadable" | "classifier_no_ruling" | "requires_user_interaction" | "cross_boundary" | "operator_forced" | "shell_floor" | "probe" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "unstated" | "ordinary">>;
-        classes: z.ZodOptional<z.ZodArray<z.ZodCustom<"mode" | "hook" | "org_rule" | "write_protection" | "target_unresolved" | "content_question" | "ask_rule" | "denial_limit_fallback" | "ancestor" | "dangerous_delete" | "unverifiable_delete" | "unverifiable_shell_text" | "transcript_write" | "rule_unreadable" | "classifier_no_ruling" | "requires_user_interaction" | "cross_boundary" | "operator_forced" | "shell_floor" | "probe" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "unstated" | "ordinary", "mode" | "hook" | "org_rule" | "write_protection" | "target_unresolved" | "content_question" | "ask_rule" | "denial_limit_fallback" | "ancestor" | "dangerous_delete" | "unverifiable_delete" | "unverifiable_shell_text" | "transcript_write" | "rule_unreadable" | "classifier_no_ruling" | "requires_user_interaction" | "cross_boundary" | "operator_forced" | "shell_floor" | "probe" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "unstated" | "ordinary">>>;
+        askClass: z.ZodOptional<z.ZodCustom<"mode" | "hook" | "org_rule" | "write_protection" | "target_unresolved" | "content_question" | "ask_rule" | "denial_limit_fallback" | "ancestor" | "dangerous_delete" | "unverifiable_delete" | "unverifiable_shell_text" | "transcript_write" | "rule_unreadable" | "classifier_no_ruling" | "requires_user_interaction" | "cross_boundary" | "operator_forced" | "shell_floor" | "probe" | "write_protection_on_disk" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "unstated" | "ordinary", "mode" | "hook" | "org_rule" | "write_protection" | "target_unresolved" | "content_question" | "ask_rule" | "denial_limit_fallback" | "ancestor" | "dangerous_delete" | "unverifiable_delete" | "unverifiable_shell_text" | "transcript_write" | "rule_unreadable" | "classifier_no_ruling" | "requires_user_interaction" | "cross_boundary" | "operator_forced" | "shell_floor" | "probe" | "write_protection_on_disk" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "unstated" | "ordinary">>;
+        classes: z.ZodOptional<z.ZodArray<z.ZodCustom<"mode" | "hook" | "org_rule" | "write_protection" | "target_unresolved" | "content_question" | "ask_rule" | "denial_limit_fallback" | "ancestor" | "dangerous_delete" | "unverifiable_delete" | "unverifiable_shell_text" | "transcript_write" | "rule_unreadable" | "classifier_no_ruling" | "requires_user_interaction" | "cross_boundary" | "operator_forced" | "shell_floor" | "probe" | "write_protection_on_disk" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "unstated" | "ordinary", "mode" | "hook" | "org_rule" | "write_protection" | "target_unresolved" | "content_question" | "ask_rule" | "denial_limit_fallback" | "ancestor" | "dangerous_delete" | "unverifiable_delete" | "unverifiable_shell_text" | "transcript_write" | "rule_unreadable" | "classifier_no_ruling" | "requires_user_interaction" | "cross_boundary" | "operator_forced" | "shell_floor" | "probe" | "write_protection_on_disk" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "unstated" | "ordinary">>>;
         fromSubagent: z.ZodOptional<z.ZodLiteral<true>>;
         sourceTaskId: z.ZodOptional<z.ZodString>;
         sourceAgentName: z.ZodOptional<z.ZodString>;
@@ -933,7 +939,8 @@ export declare function buildApprovalRequestFrame(input: {
 /**
  * 🔴 **呈卡帧的活面事实座**(呈卡腿上旧族退役之后,开卡帧的全部事实都由本族承载)。
  *
- * 这十个座是活卡帧 `tool_approval` 上有、而卡(`ApprovalCardSchema`,`card_json` 的耐久信封)上**没有**的那几位(`approvalCard` 7.136.0 起也在卡上,见本注末段):
+ * 这十一个座是活卡帧 `tool_approval` 上有、而卡(`ApprovalCardSchema`,`card_json` 的耐久信封)上**没有**的那几位(`approvalCard` 7.136.0 起也在卡上,见本注末段;
+ * `requestedBy` = 扩展经 `$.tool.call` 自己发起的调用是谁要的,部署座装运维声明的 mod 包之后可达):
  * 卡外的事实此前只骑活卡帧,呈卡腿的消费方靠「两帧按 approvalId 合读」拿到它们。呈卡腿自此只发本族帧 ⇒ 它们挪到**活铸**的
  * 呈卡帧顶层,同名同型同值 —— 值取自同一只帧对象(活卡帧的那一次铸定,`tool-approval.ts` 的 `askBroadcast`),本仓不另算一遍。
  *
@@ -946,7 +953,7 @@ export declare function buildApprovalRequestFrame(input: {
  * 同一次读定、同值)。按上一句的规矩它该离表(活铸帧顶层这一份退役 —— wire BREAKING,下游 sdk 的孪生表同改),本版按 additive 交付、未退役:
  * 一个事实两处读,登记为待收的债,收法 = 离表 + 消费方改读 `card.approvalCard`,不是在这里加第三处。
  */
-export declare const APPROVAL_REQUEST_LIVE_FACT_KEYS: readonly ["mandated", "mandate", "origin", "boundGrantDigest", "boundGrants", "classifierNoRuling", "boundGrantAbsence", "approvalCard", "readRootCandidate", "probeReason"];
+export declare const APPROVAL_REQUEST_LIVE_FACT_KEYS: readonly ["mandated", "mandate", "origin", "boundGrantDigest", "boundGrants", "classifierNoRuling", "boundGrantAbsence", "approvalCard", "readRootCandidate", "probeReason", "requestedBy"];
 /** 呈卡帧活面事实座的类型面 = 活卡帧同名座的 `Pick`(同型由构造保证,不手抄)。 */
 export type ApprovalRequestLiveFacts = Pick<ToolApprovalFrame, (typeof APPROVAL_REQUEST_LIVE_FACT_KEYS)[number]>;
 /**

package/dist/approval-card.js

@@ -540,6 +540,7 @@ export const APPROVAL_REQUEST_LIVE_FACT_KEYS = [
     "approvalCard",
     "readRootCandidate",
     "probeReason",
+    "requestedBy",
 ];
 function pickApprovalRequestLiveFacts(src) {
     const out = {};

package/dist/audit.js

@@ -126,6 +126,7 @@ const MESSAGE_READ_TREATMENT = {
     user: {
         role: "verbatim", content: "verbatim", timestamp: "verbatim", enginePrefixChars: "verbatim", engineSegments: "verbatim",
         engineMinted: "verbatim", engineNoteKey: "verbatim", provenance: "verbatim", actor: "verbatim",
+        runOrigin: "verbatim",
         taskId: "verbatim",
         attachment: "verbatim",
     },

package/dist/background-agent-name.d.ts

@@ -0,0 +1,5 @@
+export declare function backgroundAgentNameOf(row: {
+    readonly name?: string;
+    readonly handle: string;
+}): string;
+//# sourceMappingURL=background-agent-name.d.ts.map

package/dist/background-agent-name.js

@@ -0,0 +1,5 @@
+import { engineAgentName } from "@sema-agent/core";
+export function backgroundAgentNameOf(row) {
+    return row.name ?? engineAgentName(row.handle);
+}
+//# sourceMappingURL=background-agent-name.js.map

package/dist/bench/s1/arms.d.ts

@@ -95,7 +95,7 @@ export declare function bindingFromCheckpoint(cp: Checkpoint | null): {
     boundInputHash: string;
 } | undefined;
 /** The non-optional C1 finance taxonomy the harness always emits (core's `CoreStatsSubset.costBreakdown` is
- *  OPTIONAL for back-compat, but the producer ALWAYS fills all four lines — this is that concrete shape). */
+ *  OPTIONAL for back-compat, but the producer ALWAYS fills its three required lines — this is that concrete shape). */
 type CostBreakdown = NonNullable<CoreStatsSubset["costBreakdown"]>;
 /** The s1.v1 `stats` the producer emits — a `CoreStatsSubset` with `costBreakdown` + `humanReview` ALWAYS present
  *  (core types them optional; the harness never omits them, so it works with concrete, non-undefined locals). */

package/dist/bench/s1/arms.js

@@ -24,7 +24,7 @@ export function bindingFromCheckpoint(cp) {
 }
 const ORACLE_UNDELIVERED = { delivered: false, hiddenTestsGreen: false, buildPassed: false, invariantsOk: false };
 function emptyCostBreakdown() {
-    return { llmRootMicroUsd: 0, nestedSubagentMicroUsd: 0, memoryConsolidationMicroUsd: 0, compactionMicroUsd: 0 };
+    return { llmRootMicroUsd: 0, nestedSubagentMicroUsd: 0, compactionMicroUsd: 0 };
 }
 export function classifyRunStatus(input) {
     if (input.status === "failed")
@@ -40,7 +40,6 @@ export function captureStats(stats) {
         costBreakdown: {
             llmRootMicroUsd: bd.llmRootMicroUsd,
             nestedSubagentMicroUsd: bd.nestedSubagentMicroUsd,
-            memoryConsolidationMicroUsd: bd.memoryConsolidationMicroUsd,
             compactionMicroUsd: bd.compactionMicroUsd,
         },
         humanReview: { count: hr.count, totalWaitMs: hr.totalWaitMs, gates: hr.gates },
@@ -55,7 +54,6 @@ export async function driveSupSuspendResume(initial, deps, implSpec, trap, advan
             return;
         c1Acc.llmRootMicroUsd += b.llmRootMicroUsd;
         c1Acc.nestedSubagentMicroUsd += b.nestedSubagentMicroUsd;
-        c1Acc.memoryConsolidationMicroUsd += b.memoryConsolidationMicroUsd;
         c1Acc.compactionMicroUsd += b.compactionMicroUsd;
     };
     let exitedViaBreak = false;

package/dist/bench/s1/run-firm.js

@@ -109,7 +109,7 @@ function infraFailedRow(cell, ctx) {
         oracle: { delivered: false, hiddenTestsGreen: false, buildPassed: false, invariantsOk: false },
         delivery: { withheld: false },
         stats: {
-            costBreakdown: { llmRootMicroUsd: 0, nestedSubagentMicroUsd: 0, memoryConsolidationMicroUsd: 0, compactionMicroUsd: 0 },
+            costBreakdown: { llmRootMicroUsd: 0, nestedSubagentMicroUsd: 0, compactionMicroUsd: 0 },
             humanReview: { count: 0, totalWaitMs: 0, gates: [] },
         },
         wallTimeSec: 0,
@@ -221,7 +221,7 @@ export function positiveIntArg(raw, def, flag) {
 function dryRunMockFactory() {
     return (trap, seed) => {
         const stats = {
-            costBreakdown: { llmRootMicroUsd: 50_000, nestedSubagentMicroUsd: 0, memoryConsolidationMicroUsd: 0, compactionMicroUsd: 0 },
+            costBreakdown: { llmRootMicroUsd: 50_000, nestedSubagentMicroUsd: 0, compactionMicroUsd: 0 },
             humanReview: { count: 0, totalWaitMs: 0, gates: [] },
         };
         const green = trap.id !== "C2-honest-bound";

package/dist/boot/budget-tracing.d.ts

@@ -28,18 +28,7 @@ export declare function createBudgetAndTracing(ctx: BudgetTracingCtx): {
     fleetUsage: import("../fleet-client.js").FleetUsageBins | undefined;
     fleetLease: import("../fleet-lease.js").FleetLeaseManager | undefined;
     tracer: import("@sema-agent/core").TracerHook;
-    sideQueryAccounting: (principal: string | undefined, r: {
-        model: string;
-        usage?: {
-            input?: number;
-            output?: number;
-            cacheRead?: number;
-            cacheWrite?: number;
-            cost?: {
-                total?: number;
-            };
-        };
-    }) => void;
+    sideQueryAccounting: import("../budget.js").SideQueryAccounting;
     toolResultStore: import("../plugins/store-backend.js").ToolResultStoreFull | undefined;
     sessionPolicyStore: import("@sema-agent/core").SessionPolicyStore | undefined;
     fileHistoryStore: import("../plugins/store-backend.js").ServiceFileHistoryStore | undefined;

package/dist/boot/deployment-mods.d.ts

@@ -1,31 +1,61 @@
+import { type EngineDollar, type ModAdmissionRecord, type ModRegistration } from "@sema-agent/core";
+import { type ModsDeclaration } from "../mods-declaration.js";
+import type { Logger } from "../observability/logger.js";
+import type { Metrics } from "../observability/metrics.js";
 /**
- * 部署座(`RunnerDeps.mods`)的注册:**铸**({@link createDeploymentMods})与**起服自证**({@link assertDeploymentModsAdmitted})都在这一处。
- *
- * 起服自证(律三:拒形只有引擎一种读法,本仓只负责「不写」与「启动时自证」):
- * 部署座上的注册是本仓自己铸的。它们坏了
- * —— 坏名、坏档、缺 `uses.calls`、`on` 越出 `uses`、只选无站的名字、`register` 抛 —— 引擎在每条腿的 prepare 里拒
- * (`config.mods_invalid`),那就是每个请求都失败。所以起服时让引擎的 admission 判一次:判官仍是引擎(`admitModChain`),
- * 本函数不判形,只把它的拒折成一句起服错误、拒启。两个起服入口(server 第五段、本地 CLI)同调这一只。
+ * 部署座注册的**出处标签**(谁供的这张注册)—— 宿主自己的词,引擎原样携带、不判;**全仓唯一写点**。
  *
- * 也拒启的两形(同一个理由:部署注册一张都不该缺席,也不该带病挂上):
- *  · admission 期的报告(引擎对坏 `budgetMs` 只报告、回落缺省,不拒)—— 部署注册不设 `budgetMs`,报告出现就是铸法坏了;
- *  · 被 `plugin.register` 判拒的注册(本部署没有这种判官;出现即装配错)。
- * 腿外 admission 只建一只总线并跑一次各注册的 `register`(本仓的 `register` 是纯函数),不碰任何腿。
+ * `wiring_manifest.mods[]` 的一行上有两个词字段,各自一张闭集、互不相交:`seat` 是引擎的座词(`MOD_SEATS`:`deployment` | `task`,这张注册站在哪一座),
+ * `provenance` 是这张表的值(这张注册是谁供的)。两个字段不共用词 —— 同一个词不在一行里指两件事。
+ *  · `minted` → `server`:本服务自己铸的(拒绝计量 / 工具追踪 / 品牌行);
+ *  · `declared` → `operator`:运维在部署声明(`MODS_ROOT` / `MODS_PACKAGES`)里点名装进来的包。词取「谁供的」:与 `server` 同一个维度(供给方),
+ *    并沿用本仓对这件事的既有称呼「运维声明」。不用 `deployment`:它是座词,同一行上同形不同义。
+ * 加一种供给方 = 在这里加一行;取到的词与座词相交 ⇒ 下面的类型门编译红。
  */
-import { type EngineDollar, type ModRegistration } from "@sema-agent/core";
-import type { Logger } from "../observability/logger.js";
-import type { Metrics } from "../observability/metrics.js";
+export declare const MOD_PROVENANCE: {
+    readonly minted: "server";
+    readonly declared: "operator";
+};
 /**
- * 部署座上的注册列表 —— 两个起服入口(server 第五段与本地 CLI)同一只铸法,哪几张、什么顺序只写在这里:
+ * 本仓自铸的部署注册 —— 哪几张、什么顺序只写在这里(装配口 {@link assembleDeploymentMods} 把它们排在声明的包之前):
  *  · 拒绝计量恒挂、在前;工具追踪(`TOOL_TRACE=true`,交 `traceLogger`)在后。两张都是 `prepend` 档的观察者,引擎按「档 → 部署先于任务 → 座内顺序」
  *    串行跑观察者、且都在链之前 ⇒ 同一次拒绝先计数、后写追踪行;
  *  · 品牌行(`brandIdentity`:品牌部署 = local / TOC)—— `prompt.compose` 上的一条部署类 overlay(`capabilities/brand-identity.ts`),与两只观察者
  *    不在同一个事件上,顺序不影响它们。部署开不开品牌只在这一个入参表态。
+ * 出处标签:自铸的每一张都带宿主标签 {@link MOD_PROVENANCE}`.minted`,声明的包由装配口给 `.declared` —— 引擎把宿主给的标签原样记进准入记录与每条腿的
+ * `wiring_manifest.mods[]`,一条腿的部署座由此分得出「本服务自铸」与「运维声明」两种来源。
  */
 export declare function createDeploymentMods(input: {
     readonly metrics: Pick<Metrics, "inc">;
     readonly traceLogger?: Logger | undefined;
     readonly brandIdentity?: boolean | undefined;
 }): readonly ModRegistration<EngineDollar>[];
-export declare function assertDeploymentModsAdmitted(mods: readonly ModRegistration<EngineDollar>[]): Promise<void>;
+/** 起服装上的一只声明包(起服日志行 `mods_package_loaded` 与 `/health` / `/v1/capabilities` 的读数都读这一份)。 */
+export interface LoadedModPackage {
+    readonly name: string;
+    /** 引擎准入记录里这只包站的档(准入判过的那一份,不是声明里写的)。 */
+    readonly tier: ModAdmissionRecord["tier"];
+    /** 读包者按相等判过的引擎契约号(包声明的 `contract` 与引擎的 `KERNEL_CONTRACT_VERSION` 相等才装得上)。 */
+    readonly contract: number;
+    /** 读包者交回的三件字节摘要(`ModPackageRegistration.digest`,按给值记)—— 认得出「装的是哪几份字节」,不是代码完整性凭据。 */
+    readonly digest: string;
+}
+/** 装配的结果:部署座的注册(自铸在前、声明在后,整列已过引擎准入)与装上的声明包(只数声明的包,自铸的不算)。 */
+export interface DeploymentModsAssembly {
+    readonly registrations: readonly ModRegistration<EngineDollar>[];
+    readonly loaded: readonly LoadedModPackage[];
+}
+/** 部署座的唯一装配口(两只起服入口同调;三段与失败见文件头注)。 */
+export declare function assembleDeploymentMods(input: {
+    readonly metrics: Pick<Metrics, "inc">;
+    readonly traceLogger?: Logger | undefined;
+    readonly brandIdentity?: boolean | undefined;
+    readonly declaration: ModsDeclaration;
+    readonly logger: Pick<Logger, "info">;
+}): Promise<DeploymentModsAssembly>;
+/**
+ * 第三段:整列交引擎准入判一次(判官是引擎;本函数不判形,只把它的拒、报告与判拒折成一句 `admission_refused`)。
+ * 过了 ⇒ 交回这一次准入的记录(每张注册一行,全部挂上了 —— 有一行被判拒就不会走到这里)。
+ */
+export declare function assertDeploymentModsAdmitted(mods: readonly ModRegistration<EngineDollar>[]): Promise<readonly ModAdmissionRecord[]>;
 //# sourceMappingURL=deployment-mods.d.ts.map

package/dist/boot/deployment-mods.js

@@ -1,26 +1,102 @@
-import { admitModChain } from "@sema-agent/core";
+import { realpathSync, statSync } from "node:fs";
+import { isAbsolute, relative, sep } from "node:path";
+import { admitModChain, KERNEL_CONTRACT_VERSION, loadModPackage } from "@sema-agent/core";
 import { createBrandIdentityRegistration } from "../capabilities/brand-identity.js";
 import { createPermissionDeniedMeter, createToolTracer } from "../observability/tool-trace.js";
+import { errorCodeOf, errorText } from "../observability/err-text.js";
+import { sanitizeWireText } from "../trace/engine-notice-wire.js";
+import { DeploymentModsRefusedError } from "../mods-declaration.js";
+export const MOD_PROVENANCE = { minted: "server", declared: "operator" };
 export function createDeploymentMods(input) {
     return [
         createPermissionDeniedMeter(input.metrics),
         ...(input.traceLogger !== undefined ? [createToolTracer(input.traceLogger)] : []),
         ...(input.brandIdentity === true ? [createBrandIdentityRegistration()] : []),
-    ];
+    ].map((registration) => ({ ...registration, provenance: MOD_PROVENANCE.minted }));
+}
+export async function assembleDeploymentMods(input) {
+    const minted = createDeploymentMods(input);
+    const resolved = resolveDeclaredPackages(input.declaration);
+    const declared = [];
+    for (const { pkg, realDir } of resolved)
+        declared.push(await loadDeclaredPackage(pkg, realDir));
+    const registrations = [...minted, ...declared];
+    const records = await assertDeploymentModsAdmitted(registrations);
+    const loaded = resolved.map(({ pkg }, i) => ({ name: pkg.name, tier: admittedRecordOf(records, pkg.name).tier, contract: KERNEL_CONTRACT_VERSION, digest: declared[i].digest }));
+    for (const row of loaded)
+        input.logger.info("mods_package_loaded", { name: sanitizeWireText(row.name), tier: row.tier, contract: row.contract, digest: row.digest });
+    return { registrations, loaded };
+}
+function fsCauseOf(e) {
+    const code = errorCodeOf(e);
+    return typeof code === "string" && /^E[A-Z0-9]{1,31}$/.test(code) ? code : "unknown";
+}
+function strictlyUnderRoot(root, child) {
+    const rel = relative(root, child);
+    return rel !== "" && rel.split(sep)[0] !== ".." && !isAbsolute(rel);
+}
+function resolveDeclaredPackages(declaration) {
+    if (declaration.packages === undefined)
+        return [];
+    let realRoot;
+    try {
+        realRoot = realpathSync(declaration.root);
+    }
+    catch (e) {
+        throw new DeploymentModsRefusedError({ word: "root_unreadable", cause: fsCauseOf(e) });
+    }
+    return declaration.packages.map((pkg, entry) => {
+        let realDir;
+        let isDirectory;
+        try {
+            realDir = realpathSync(pkg.dir);
+            isDirectory = statSync(realDir).isDirectory();
+        }
+        catch (e) {
+            throw new DeploymentModsRefusedError({ word: "dir_unreadable", entry, cause: fsCauseOf(e) });
+        }
+        if (!strictlyUnderRoot(realRoot, realDir))
+            throw new DeploymentModsRefusedError({ word: "outside_root", entry });
+        if (!isDirectory)
+            throw new DeploymentModsRefusedError({ word: "not_a_directory", entry });
+        return { pkg, realDir };
+    });
+}
+function machineCodeOf(e) {
+    const code = errorCodeOf(e);
+    return typeof code === "string" && /^[A-Za-z][A-Za-z0-9_.-]{0,63}$/.test(code) ? code : undefined;
+}
+async function loadDeclaredPackage(pkg, realDir) {
+    let registration;
+    try {
+        registration = await loadModPackage(realDir, { tier: pkg.tier, provenance: MOD_PROVENANCE.declared, ...("options" in pkg ? { options: pkg.options } : {}) });
+    }
+    catch (e) {
+        throw new DeploymentModsRefusedError({ word: "package_refused", name: pkg.name, code: machineCodeOf(e), reason: errorText(e) });
+    }
+    if (registration.name !== pkg.name)
+        throw new DeploymentModsRefusedError({ word: "name_mismatch", name: pkg.name, packageName: registration.name });
+    return registration;
 }
-const REFUSED = "deployment extension registration refused";
 export async function assertDeploymentModsAdmitted(mods) {
     const reports = [];
     let records;
     try {
-        ({ records } = await admitModChain({ deployment: mods }, (err) => void reports.push(err.message)));
+        ({ records } = await admitModChain({ deployment: mods }, (err) => void reports.push(errorText(err))));
     }
     catch (e) {
-        throw new Error(`${REFUSED}: ${e instanceof Error ? e.message : String(e)}`);
+        throw new DeploymentModsRefusedError({ word: "admission_refused", code: machineCodeOf(e), reason: errorText(e) });
     }
     const refused = records.flatMap((r) => ("refusedBy" in r ? [`"${r.name}" refused by ${r.refusedBy}: ${r.reason}`] : []));
     const problems = [...reports, ...refused];
     if (problems.length > 0)
-        throw new Error(`${REFUSED}: ${problems.join("; ")}`);
+        throw new DeploymentModsRefusedError({ word: "admission_refused", code: undefined, reason: problems.join("; ") });
+    return records;
+}
+function admittedRecordOf(records, name) {
+    const record = records.find((r) => r.seat === "deployment" && r.name === name);
+    if (record === undefined)
+        throw new DeploymentModsRefusedError({ word: "admission_refused", code: undefined, reason: `the engine's admission returned no record for ${JSON.stringify(name)}` });
+    return record;
 }
 //# sourceMappingURL=deployment-mods.js.map

package/dist/boot/device-lane.d.ts

@@ -1,7 +1,7 @@
 /**
  * [ref] A10 分段 —— **device lane 的装配件**(device-executor-lane-v2 §4.6/§4.7/§5,车A-4)。
  *
- * 一处建齐三件活对象:**店**(四表双库的 `DeviceStore`)→ **准入链**(`DeviceEnrollment`,含跨副本
+ * 一处建齐三件活对象:**店**(三表双库的 `DeviceStore`;绑定写在根会话行的执行格上)→ **准入链**(`DeviceEnrollment`,读会话店的执行席,含跨副本
  * 限速座)→ **WS 汇聚端**(`DeviceWsHub`)。三件的依赖是单向的(hub 吃 store+enrollment),所以它们
  * 必须在同一处按序建 —— 拆到三处装配点会让「hub 拿到的是不是同一只店」变成一个要读三个文件才答得出
  * 的问题(而答错的后果是 presence 与租约各写各的)。
@@ -15,6 +15,7 @@
  */
 import { type DeviceEnrollment } from "../device-enrollment.js";
 import type { DeviceStore } from "../device-store.js";
+import type { ExecutionPlacementSeat } from "../execution-placement.js";
 import { type DeviceWsHub } from "../device-ws-hub.js";
 import type { ServiceConfig } from "../config.js";
 import type { Logger } from "../observability/logger.js";
@@ -25,6 +26,8 @@ export interface DeviceLaneCtx {
     logger: Logger;
     metrics: Metrics;
     backend: StoreBackend | undefined;
+    /** 会话店的执行席(`sessionStore.executionPlacement`):根会话 ↔ 设备绑定的唯一载体与唯一读。device 车道只在 SQL 后端 ⇒ 席恒在;缺 = 装配缝 ⇒ 本函数响亮抛。 */
+    seat: ExecutionPlacementSeat | undefined;
     /** 本副本 id(写进连接租约行 —— §4.6 的跨副本排障面)。 */
     replicaId: string;
 }
@@ -32,6 +35,8 @@ export interface DeviceLane {
     store: DeviceStore;
     enrollment: DeviceEnrollment;
     hub: DeviceWsHub;
+    /** 会话店的执行席(准入链、工厂、换绑门读的同一只)。 */
+    seat: ExecutionPlacementSeat;
 }
 /**
  * 注册口(`POST /v1/devices/enroll`,pre-auth)的限速策略 —— **本车道自己的地板,不挂任何运维旋钮**。
@@ -49,7 +54,7 @@ export declare const DEVICE_ENROLL_RATE_POLICY: {
     readonly windowMs: 60000;
 };
 /**
- * 建齐 device lane 的三件。返回 `undefined` = **建不起来**(没有 SQL 后端 ⇒ 没有四表店)。
+ * 建齐 device lane 的三件。返回 `undefined` = **建不起来**(没有 SQL 后端 ⇒ 没有设备店)。
  *
  * 只在调用方判定本部署是 device 车道时调用;非 device 车道调用它是纯浪费(会白建一只 WS server)。
  */
@@ -61,7 +66,7 @@ export declare function createDeviceLane(ctx: DeviceLaneCtx): DeviceLane | undef
  * config 层的门①判的是「运维配没配 SQL 坐标」——那句话回答的是**意图**。它回答不了「这次启动**真的
  * 拿到**了店吗」:`openStoreBackendWithFallback` 曾在 `SESSION_BACKEND=auto` 下,SQL 连不上 /
  * 建表失败 ⇒ `backend=undefined` + 一条 warn 就继续启动(那条降级臂已退役:配了 DSN 的库窗内重试、到窗拒启,见 `plugins/store-open-wait.ts`;
- * 仍走得到本门的形:`DB_BACKEND=mysql|pg` 声明了 SQL 而 `SESSION_BACKEND=memory`,刻意不持久 ⇒ 不开店)。那次启动里 device lane 的四表整个不在,
+ * 仍走得到本门的形:`DB_BACKEND=mysql|pg` 声明了 SQL 而 `SESSION_BACKEND=memory`,刻意不持久 ⇒ 不开店)。那次启动里 device lane 的表整个不在,
  * 而 `boot/execution-env.ts` 的第七臂拿不到三件 ⇒ `executionEnvFactory` 落 `undefined` ⇒ core 拿
  * `StubExecutionEnv`:**一台自称在员工设备上执行的 worker 实际在自己进程里跑,而且回执同形**。
  * 那正是 [ref]「执行车道禁静默降级」点名的样板病,也正是 A-1 那条临时门当初要拦的东西 —— 换执法点,

package/dist/boot/device-lane.js

@@ -2,13 +2,18 @@ import { createDeviceEnrollment, createFixedWindowRateLimiter } from "../device-
 import { createDeviceWsHub } from "../device-ws-hub.js";
 export const DEVICE_ENROLL_RATE_POLICY = { limit: 10, windowMs: 60_000 };
 export function createDeviceLane(ctx) {
-    const { config, logger, metrics, backend, replicaId } = ctx;
+    const { config, logger, metrics, backend, replicaId, seat } = ctx;
     const store = backend?.device?.();
     if (!store)
         return undefined;
+    if (seat === undefined) {
+        throw new Error("device lane: the device store is wired but the session store carries no execution placement seat — the session↔device binding lives on the " +
+            "root session row and is read only through that seat; refusing to start a device lane that could neither bind nor read a binding (assembly bug)");
+    }
     const knobs = config.remoteExec?.provider === "device" ? config.remoteExec : undefined;
     const enrollment = createDeviceEnrollment({
         store,
+        seat,
         rateLimiter: createFixedWindowRateLimiter(DEVICE_ENROLL_RATE_POLICY),
     });
     const hub = createDeviceWsHub({
@@ -33,7 +38,7 @@ export function createDeviceLane(ctx) {
         maxPreAuthPerRemote: knobs?.maxPreAuthPerRemote ?? 8,
         enrollRateLimit: `${DEVICE_ENROLL_RATE_POLICY.limit}/${DEVICE_ENROLL_RATE_POLICY.windowMs / 1000}s per caller identity (per replica; independent of RATE_LIMIT_RPM)`,
     });
-    return { store, enrollment, hub };
+    return { store, enrollment, hub, seat };
 }
 export function assertDeviceLaneWired(isDeviceLane, lane, hasFactory) {
     if (!isDeviceLane)

package/dist/boot/execution-env.d.ts

@@ -1,11 +1,12 @@
 import { TaskEnvRegistry } from "../capabilities/sandbox-file-send.js";
 import { SessionEnvironmentSelection } from "../capabilities/select-environment-tool.js";
-import type { ServiceConfig } from "../config.js";
+import { type ServiceConfig } from "../config.js";
 import type { Logger } from "../observability/logger.js";
 import type { Metrics } from "../observability/metrics.js";
 import { PerTaskImageRegistry } from "../per-task-image.js";
 import type { DeviceEnrollment } from "../device-enrollment.js";
 import type { DeviceStore } from "../device-store.js";
+import type { ExecutionPlacementSeat } from "../execution-placement.js";
 import type { DeviceWsHub } from "../device-ws-hub.js";
 import { k8sExecutionEnvFactory, type K8sEnvConfig, type K8sEnvDeps, type SandboxSecretSeat } from "../plugins/remote-env-k8s.js";
 import { type SandboxGitPlane, type SandboxGitRunRows } from "../sandbox-git-plane.js";
@@ -117,11 +118,12 @@ export declare function assertWorkspaceSpaceReadable(space: ReturnType<typeof fa
     readonly headOf: HeadRead | undefined;
     readonly spaceCommits: (() => SpaceCommitRows | undefined) | undefined;
 }, cache: ReturnType<typeof facts.workspaceCache>, sessionStoreLabel: string): void;
-/** device lane 的三件活对象(店 / 汇聚端 / 准入链)。缺席 = 本部署没有 device 车道。 */
+/** device lane 的活对象(店 / 汇聚端 / 准入链 + 会话店的执行席 —— 绑定的唯一载体与唯一读,工厂与准入链读同一只)。缺席 = 本部署没有 device 车道。 */
 export interface DeviceLaneWiring {
     store: DeviceStore;
     hub: DeviceWsHub;
     enrollment: DeviceEnrollment;
+    seat: ExecutionPlacementSeat;
 }
 export interface ExecutionEnvCtx {
     config: ServiceConfig;