@sema-agent/server 7.141.0 → 7.143.0

package/dist/rules-consent.d.ts

@@ -219,16 +219,24 @@ export type LocalImportIndeterminateCode =
 /** 兑付走本身没走完(本层抛出/中断)⇒ 这一条连走都没走到。 */
  | "walk_failed";
 /** prepare 面的一行。判别式联合:被收下的行**没有**拒因字段可读,被拒的行**必然**带拒因 ——
- *  「admitted 却带 reason」这种矛盾态在类型上不可表达。 */
+ *  「admitted 却带 reason」这种矛盾态在类型上不可表达。
+ *  收下的**收紧**(deny / ask)在 prepare 当场经直写接缝落店,行带它的结局 `outcome`(`persisted` = 这次写了 / `no-op` = 等价规则已在店);
+ *  收下的**放行**没有 `outcome` —— 它的结局在 redeem 回执里(放行要同意,收紧不等同意;见 `prepareLocalImport`)。 */
 export type LocalImportPreviewMember = {
     key: LocalImportRuleKey;
     admitted: true;
+} | {
+    key: LocalImportRuleKey;
+    admitted: true;
+    outcome: LocalImportTighteningOutcome;
 } | {
     key: LocalImportRuleKey;
     admitted: false;
     reason: LocalImportRefusalCode;
     detail: string;
 };
+/** 一条收紧在 prepare 当场落店的结局(与兑付回执的 `persisted` / `no-op` 同词同义;直写接缝 `addPersistedRule` 的 `added` / `no-op`)。 */
+export type LocalImportTighteningOutcome = "persisted" | "no-op";
 /** 兑付回执的一行。 */
 export interface LocalImportOutcomeMember {
     key: LocalImportRuleKey;
@@ -266,6 +274,14 @@ export type LocalImportPrepared = {
     ok: false;
     reason: "batch-too-large";
     bytes: number;
+}
+/** 一条收紧写不进店(直写接缝答 `failed`)⇒ 这一批的放行全部扣下(不铸记录、不铸票)。`committed` 原样是 core 的两词闭集,
+ *  wire 上与 `POST /v1/rules` 的写失败同一码同一键;此前已落的收紧留着(收紧方向),同一批重发即幂等(已落的答 `no-op`)。 */
+ | {
+    ok: false;
+    reason: "tightening-write-failed";
+    committed: RuleWriteCommitted;
+    detail: string;
 };
 /** A7 redeem 的结果。 */
 export type LocalImportRedeemed = 
@@ -456,13 +472,20 @@ export type CardRulePersisted = {
      *  🔴 不 switch、不翻译、不折叠:词表属主是 core,本仓照转。 */
     code?: string;
 };
-/** 一层用户交上来的 settings(HTTP 载荷已 zod 校验过的形)。 */
-export interface RuleImportLayerInput {
-    layer: ImportedSettingsLayer;
+/**
+ * 一层用户交上来的 settings(HTTP 载荷已 zod 校验过的形)—— 按 `layer` 的联合,与引擎的 `CcImportLayer` 同形:
+ * 用户层**没有** `root`(它的 `/x` 在它自己的配置目录读,引擎不把它带进店;交了 root 的体在边界 400),项目层与本地层带 `root`(规则的作用域根)。
+ */
+export type RuleImportLayerInput = {
+    layer: "userSettings";
+    path: string;
+    content: string;
+} | {
+    layer: Exclude<ImportedSettingsLayer, "userSettings">;
     path: string;
     root: string;
     content: string;
-}
+};
 /**
  * scope 的 **wire 形**:`global` | `project:<root>` 的判别式串([ref] v2 §6 F5「显式成文」)。
  *

package/dist/rules-consent.js

@@ -232,25 +232,14 @@ function buildLocalImportLayers(candidates) {
     const byRoot = new Map();
     for (const c of candidates) {
         const key = c.scope.kind === "global" ? "" : c.scope.root;
-        let bucket = byRoot.get(key);
-        if (bucket === undefined) {
-            bucket = { deny: [], ask: [], allow: [] };
-            byRoot.set(key, bucket);
-        }
-        bucket[c.behavior].push(c.rule);
+        const bucket = byRoot.get(key) ?? [];
+        bucket.push(c.rule);
+        byRoot.set(key, bucket);
     }
-    return [...byRoot].map(([root, lists]) => ({
-        layer: root === "" ? "userSettings" : "projectSettings",
-        path: root === "" ? LOCAL_IMPORT_LAYER_PATH : `${LOCAL_IMPORT_LAYER_PATH}:${root}`,
-        root: root === "" ? "/" : root,
-        readFile: async () => JSON.stringify({
-            permissions: {
-                ...(lists.deny.length > 0 ? { deny: lists.deny } : {}),
-                ...(lists.ask.length > 0 ? { ask: lists.ask } : {}),
-                ...(lists.allow.length > 0 ? { allow: lists.allow } : {}),
-            },
-        }),
-    }));
+    return [...byRoot].map(([root, allow]) => {
+        const readFile = async () => JSON.stringify({ permissions: { allow } });
+        return root === "" ? { layer: "userSettings", path: LOCAL_IMPORT_LAYER_PATH, readFile } : { layer: "projectSettings", path: `${LOCAL_IMPORT_LAYER_PATH}:${root}`, root, readFile };
+    });
 }
 function buildLocalImportMembers(members) {
     return members.map((m) => {
@@ -367,12 +356,10 @@ export function createRuleConsentLane(stores, opts) {
             return { ok: true, kind: "single", rule: redeemed.rule, rev: redeemed.rev, alreadyRedeemed: redeemed.alreadyRedeemed };
         },
         async prepareImport(principal, layers) {
-            const ccLayers = layers.map((l) => ({
-                layer: l.layer,
-                path: l.path,
-                root: l.root,
-                readFile: async () => l.content,
-            }));
+            const ccLayers = layers.map((l) => {
+                const readFile = async () => l.content;
+                return l.layer === "userSettings" ? { layer: l.layer, path: l.path, readFile } : { layer: l.layer, path: l.path, root: l.root, readFile };
+            });
             const { preview, approvalId } = await prepareCcImport({ layers: ccLayers, principal, deps });
             if (approvalId === undefined) {
                 return { ok: true, preview };
@@ -494,16 +481,41 @@ export function createRuleConsentLane(stores, opts) {
                     continue;
                 }
                 seen.add(dedupKey);
+                admitted.push({ at: members.length, row: screened });
                 members.push({ key, admitted: true });
-                admitted.push(screened);
             }
-            if (admitted.length === 0)
+            const allows = [];
+            for (const { at, row: c } of admitted) {
+                const key = members[at].key;
+                const behavior = c.behavior;
+                if (!isDirectWritableRuleBehavior(behavior)) {
+                    allows.push({ ...c, behavior });
+                    continue;
+                }
+                const added = await addPersistedRule({ behavior, rule: c.rule, scope: c.scope, principal, provider: stores.provider });
+                switch (added.status) {
+                    case "added":
+                        members[at] = { key, admitted: true, outcome: "persisted" };
+                        break;
+                    case "no-op":
+                        members[at] = { key, admitted: true, outcome: "no-op" };
+                        break;
+                    case "failed":
+                        localImportLogger.warn("local_import_tightening_write_failed", { behavior, scope: key.scope, committed: added.committed, note: "a deny / ask of this batch did not land — the batch's allows are withheld (no import record, no ticket); sending the same batch again is idempotent" });
+                        return { ok: false, reason: "tightening-write-failed", committed: added.committed, detail: added.error };
+                    default: {
+                        const unknown = added;
+                        throw new Error(`unknown addPersistedRule outcome: ${JSON.stringify(unknown)}`);
+                    }
+                }
+            }
+            if (allows.length === 0)
                 return { ok: true, preview: { members } };
-            const { preview, approvalId } = await prepareCcImport({ layers: buildLocalImportLayers(admitted), principal, deps });
+            const { preview, approvalId } = await prepareCcImport({ layers: buildLocalImportLayers(allows), principal, deps });
             const engineKeys = new Set(preview.candidates.map((c) => `${c.behavior}${LOCAL_IMPORT_KEY_SEP}${serializeRuleScope(c.scope)}${LOCAL_IMPORT_KEY_SEP}${c.rule}`));
             for (let i = 0; i < members.length; i++) {
                 const m = members[i];
-                if (m === undefined || !m.admitted)
+                if (m === undefined || !m.admitted || "outcome" in m)
                     continue;
                 if (engineKeys.has(`${m.key.behavior}${LOCAL_IMPORT_KEY_SEP}${m.key.scope}${LOCAL_IMPORT_KEY_SEP}${m.key.rule}`))
                     continue;

package/dist/run-local.js

@@ -19,7 +19,7 @@ import { applyRuntimeGovernance, autonomyModeFloor, entryPermissionMode } from "
 import { ForkRoutingSessionStore } from "./plugins/fork-routing-session-store.js";
 import { taskWallClockSec } from "./task-workflow.js";
 import { applyCenterArtifact, centerSourceOnError } from "./capabilities/center-prompts.js";
-import { buildUnpricedCeilingNotice, loadConfig, logConfigDiagnostics, parseConfigProvider, parseNumOrFailNonNegative } from "./config.js";
+import { buildUnpricedCeilingNotice, isRosterGateArmed, loadConfig, logConfigDiagnostics, parseConfigProvider, parseNumOrFailNonNegative } from "./config.js";
 import { buildStoreOpenRefusalTail } from "./plugins/store-open-refusal.js";
 import { acquireLocalBackendWithWait } from "./plugins/store-lock-wait.js";
 import { configLocalRoot, createConfigProvider } from "./config-provider.js";
@@ -28,6 +28,7 @@ import { buildUnreadConfigFileFields, buildUnreadConfigKeyFields } from "./web-a
 import { composeExecutionLane, settleHostLaneShell, warnReadDenyFloorUnkept } from "./boot/execution-lane.js";
 import { judgeConsolidationValve } from "./boot/memory-consolidation.js";
 import { logConfigDirMigration, migrateLocalConfigDirectory } from "./config-d-migration.js";
+import { logEnvModelsMigration, runEnvModelsMigration } from "./config-root-migration.js";
 import { assertLocalConfigDirTrusted, ConfigDirUntrustedError } from "./config-dir-trust.js";
 import { applyEffective, applyCenterReadFace, applySkillsManifest, resolveMcpServers, mcpForScenario, resolveA2aPeers, a2aForScenario } from "./web-admin-client/facade.js";
 import { hostExecutionEnvFactory } from "./plugins/remote-env-host.js";
@@ -42,7 +43,7 @@ import { createTaskListLane } from "./boot/task-list-lane.js";
 import { pickHandsRunner, withoutHands } from "./capabilities/hands-lane.js";
 import { HttpError, sessionIdShapeIssue } from "./security.js";
 import { createMemoryEngineIncidentSink } from "./memory-incident-sink.js";
-import { fileMemoryEngineRoot, memoryEngineBackendFor, memoryLayersNamedBy, memorySpecForRequest } from "./memory-scope.js";
+import { fileMemoryEngineRoot, memoryEngineBackendFor, memorySpecForRequest } from "./memory-scope.js";
 import { createMemoryScopeStores } from "./memory-scope-stores.js";
 import { createMemoryProjectLayers } from "./memory-project-layer.js";
 import { assertProjectLayerOwnable } from "./project-identity.js";
@@ -52,7 +53,7 @@ import { startMemorySyncRunner } from "./memory-sync-client.js";
 import { buildPricing, cappedCeiling, createTracer } from "./budget.js";
 import { createSharedRunnerDeps } from "./boot/runner-deps.js";
 import { createPeerDesk } from "./peer-seat.js";
-import { createGovernanceSeams } from "./boot/governance-seams.js";
+import { assertGovernanceAssemblable, createGovernanceSeams } from "./boot/governance-seams.js";
 import { assertRetentionLaneWirable } from "./boot/retention-lane.js";
 import { createOrgMemoryAdmissionWiring } from "./boot/org-memory.js";
 import { assembleDeploymentMods } from "./boot/deployment-mods.js";
@@ -362,6 +363,8 @@ export async function runLocal(argv, deps = {}) {
         printErr(err instanceof Error ? err.message : String(err));
         return 2;
     }
+    const envModelsMigration = { root, env: process.env, envTableIsPlaceholder: isRosterGateArmed(config.webAdmin) };
+    logEnvModelsMigration(logger, envModelsMigration, await runEnvModelsMigration(envModelsMigration));
     logConfigDirMigration(logger, await migrateLocalConfigDirectory(root));
     try {
         await composeExecutionLane(config, { configSource: "local", localRoot: root, logger, drivesFromFile: ["host"] });
@@ -393,7 +396,7 @@ export async function runLocal(argv, deps = {}) {
                 for (const d of r.droppedEntries ?? [])
                     logger.warn("config_entry_dropped", { domain: d.domain, entry: d.entry, reasonCode: d.reasonCode, error: d.error, version: r.effective.version, phase: "boot", note: "this one entry failed its domain schema and was dropped on its own — the rest of the candidate applies (per-entry tolerance); fix the named entry to bring it back" });
                 applying = true;
-                applyEffective(config, r.effective, logger, { leg: "boot" });
+                applyEffective(config, r.effective, logger, { leg: "boot", catalogSource: r.catalogSource });
                 effective = r.effective;
                 candidatePrompts = verdict.prompts;
                 if (effective?.mcp)
@@ -487,7 +490,7 @@ export async function runLocal(argv, deps = {}) {
     const engineDataRoot = fileMemoryEngineRoot(config, root);
     const fileEngine = memoryEngineBackendFor(config, root, memoryEngineIncident);
     const memoryEngine = fileEngine !== undefined
-        ? createMemoryScopeStores({ backend: fileEngine.backend, root: engineDataRoot, namedLayers: () => memoryLayersNamedBy({ ...config, memoryScope: args.user ?? "local" }), onIncident: memoryEngineIncident })
+        ? createMemoryScopeStores({ backend: fileEngine.backend, root: engineDataRoot, onIncident: memoryEngineIncident })
         : undefined;
     try {
         judgeConsolidationValve({ config, memoryEngine });
@@ -582,6 +585,7 @@ export async function runLocal(argv, deps = {}) {
         ],
         retentionExecutor: null,
     });
+    assertGovernanceAssemblable(config);
     const { registrations: deploymentMods } = await assembleDeploymentMods({ metrics, brandIdentity: true, declaration: config.modsDeclaration, logger });
     const sharedRunnerDeps = createSharedRunnerDeps({
         metrics,
@@ -770,14 +774,8 @@ export async function runLocal(argv, deps = {}) {
     }
     if (result.terminal.kind !== "completed" || unfinishedStop !== undefined)
         exitCode = 1;
-    if (memorySync) {
-        try {
-            await memorySync.syncOnce("post-task");
-        }
-        catch (err) {
-            logger.warn("memory_sync_failed", { reason: "post-task", err: String(err) });
-        }
-    }
+    if (memorySync)
+        await memorySync.syncOnce("post-task");
     await settleSessionBackground();
     runner.sessions.dispose();
     subRunner.sessions.dispose();

package/dist/runs.d.ts

@@ -4,6 +4,7 @@ import { type EntryProblem } from "./entry-problems.js";
 import type { SendUserFileEmitter } from "./capabilities/send-user-file-tool.js";
 import type { RunStore } from "./plugins/store-backend.js";
 import type { Metrics } from "./observability/metrics.js";
+import type { RunSkillEntry } from "./capabilities/skills.js";
 import { type RunAbort } from "./run-cancel-context.js";
 import type { ModelUsageTracker, PromptManifestTracker } from "./budget.js";
 import type { ElicitationCoordinator } from "./elicitation.js";
@@ -39,16 +40,15 @@ import type { UserInputLedger } from "./user-input-ledger.js";
  * first-marker-wins guards live inside the seam.
  */
 /** [ref]③(b) + codex R2: the bg agent-handle OUTPUT read, kind-gated BEFORE any poll. `pollTask` is the
- *  generic registry face and polling is NOT side-effect-free for other kinds — a terminal workflow poll
- *  fires `onServedTerminal` (acknowledges the completion as served → suppresses its notification) and a
- *  bash poll advances the output cursor. `getAccessibleTask` is a pure lookup: resolve + access-check +
+ *  generic registry face and polling is NOT side-effect-free for other kinds — a bash poll advances the
+ *  output cursor (and a workflow's read face is its journal, not this one). `getAccessibleTask` is a pure lookup: resolve + access-check +
  *  type-check FIRST; only a `background_agent` row is ever polled (non-blocking). Everything else returns
  *  the registry's own not_found shape, indistinguishable from an unknown handle (the route 404s it).
  *
  *  1.250 durable arm (core 1.364, [ref] follow-up delivered): a FULL in-process miss (`!row`) falls
  *  through to `pollTask(…, { agentStore })` — core's durable arm only fires for `a*`-shaped handles
  *  (DURABLE_AGENT_HANDLE_RE) behind `canAccessAgentRecord`, and with NO in-process handle the live
- *  workflow/bash branches are unreachable, so the kind-gate's reason (onServedTerminal / cursor advance)
+ *  workflow/bash branches are unreachable, so the kind-gate's reason (cursor advance / the journal owning workflow reads)
  *  cannot trigger. Terminal rows serve the durable snapshot cross-instance/post-restart; a foreign-writer
  *  running row answers the honest "outcome unknown here"; anything else is core's own not_found (byte-same
  *  route 404 as today). A row that IS in-process but of the wrong type stays a hard 404 — the process
@@ -372,9 +372,8 @@ approval?: {
     executionLane: import("./execution-lane-caps.js").ExecutionLane;
 }, 
 /** 本腿结算用的 checkpoint 店(`deps.checkpointStore`),两件事:①[ref] park 投影腿的读口 —— 在场时 durable park 的
- *  `suspended` 事件带 `toolCallId`(graft 见 {@link parkToolCallId});②验证门结算时作废验证器自己的停驻卡
- *  ({@link voidVerifierPauseCard}:本服务兑现不了的卡不留在待决面上);③停驻没落定就以失败收场时作废手里那张卡({@link voidHeldParkCard})。
- *  缺席 ⇒ ①旧字节逐字不变;②③带凭据的停驻响亮留痕、卡由兜底收割。 */
+ *  `suspended` 事件带 `toolCallId`(graft 见 {@link parkToolCallId});②停驻没落定就以失败收场时作废手里那张卡({@link voidHeldParkCard})。
+ *  缺席 ⇒ ①旧字节逐字不变;②带凭据的停驻响亮留痕、卡由兜底收割。(验证器自己的停驻卡不经本店:结算时交本腿的 Runner 动词,见 {@link voidVerifierPauseCard}。) */
 checkpointCards?: ParkCheckpointReader & CardVoidPort, 
 /** [ref]:装配期(`prepareSpec` → `resolveSpec`)铸下的用户面通告 —— 那一刻本腿的通告口还没开,
  *  所以由本腿在 `registerEngineNoticeLeg` 那一拍连同 `pending` 一起投(投递单点仍是 `route()`)。
@@ -412,7 +411,12 @@ acceptance?: RunAcceptance,
  * 会话行的位置与项目那一格的记录座(`session-workspace.ts`;唯一写者):普通流形逐帧喂(这条腿自己的 `workspace_changed` 排一次写),
  * `done` 时等写落定再落终局。只回结果的 verify / cascade 形宿主手里没有流 ⇒ 不记。缺席 ⇒ 不记行(与本参数存在之前逐字相同)。
  */
-workspaceRecorder?: SessionWorkspaceRecorder): Promise<void>;
+workspaceRecorder?: SessionWorkspaceRecorder, 
+/**
+ * 这条 run 交给引擎的技能名册(`wiring_manifest.skills` 段;部署事实 `LegFacts.skills`,`leg-facts.ts`:受理漏斗在复制之前读出)。
+ * 缺席 = 嵌入方自带的装配器没铸 ⇒ 账本行不带技能段。
+ */
+runSkills?: readonly RunSkillEntry[]): Promise<void>;
 /** How often a running instance refreshes its run's updated_at (liveness, independent of events).
  *  Must stay strictly below `runStaleSec` (asserted at startup AND on every hot config candidate) or the
  *  reaper would race live runs. [ref]:数值的单源是 `config-invariants.ts`(那条不变量的属主),两个消费面

package/dist/runs.js

@@ -9,7 +9,6 @@ import { isSessionErrorCode, sessionErrorHttp } from "./session-error-wire.js";
 import { redactErrorMessage } from "./observability/run-terminal.js";
 import { withPrincipal } from "./observability/principal-context.js";
 import { withModelReachScope } from "./model-reach-scope.js";
-import { runSkillsOf } from "./capabilities/skills.js";
 import { createInstructionSelectionLeg } from "./instruction-selection.js";
 import { redactSecrets } from "./trace/redact.js";
 import { taskNotificationEventData, appendModelUsageDelta, appendPromptManifest, attachModelUsage } from "./trace/project.js";
@@ -18,7 +17,7 @@ import { registerEngineNoticeLeg } from "./trace/engine-notice-wire.js";
 import { recordTurnActivity } from "./turn-activity.js";
 import { buildCancelledLedgerRow, CANCELLED_CODE, createRunAbort, mintCancelledResult } from "./run-cancel-context.js";
 import { createApprovalCardEmitter, resolveApprovalLeg } from "./tool-approval.js";
-import { fleetRunResiduals, isFleetAgentTerminalNotification } from "./fleet/fleet-bus.js";
+import { fleetRunResiduals } from "./fleet/fleet-bus.js";
 import { defaultSubagentTailBus } from "./fleet/subagent-tail-bus.js";
 import { emitPendingWorkflowCompletions, taskNotificationInboxEntry, taskNotificationStreamKeyOf, NotifiedKeys } from "./orchestration/workflow-completion-inbox.js";
 import { isParkLedgerEventType } from "./trace/ledger-events.js";
@@ -93,6 +92,7 @@ const PREPARE_REFUSAL_HTTP_STATUS = {
     "config.memory_project_marker": 409,
     "config.memory_project_marker_nested": 409,
     "config.read_deny_floor_unkept": 409,
+    "config.mcp_server_name_collision": 409,
 };
 export function resumeAtHttpStatus(result) {
     const code = failureCodeOf(result.terminal);
@@ -277,7 +277,7 @@ export async function voidHeldParkCard(held, hostSessionId, cards, leg) {
         return;
     await voidPendingCard({ token: held.terminal.token, sessionId: hostSessionId }, cards, "server.park.held-card-void-failed", `leg=${leg}`);
 }
-export async function runInBackground(runner, spec, runStore, taskId, metrics, principal, verify, cascade, instrumentDegenerate, planCacheProbe, persistThinking = false, inflight, preemptable, steerable, modelUsage, elicitation, elicitOwner, captureTurnAnchor, fleetPublisher, captureUserMessageAnchor, question, workflowCompletionInbox, subagentSteer, completionDiagLog, sendUserFile, promptManifests, approval, checkpointCards, pendingEngineNotices, trustedInternals, userInputLedger, acceptance, workspaceRecorder) {
+export async function runInBackground(runner, spec, runStore, taskId, metrics, principal, verify, cascade, instrumentDegenerate, planCacheProbe, persistThinking = false, inflight, preemptable, steerable, modelUsage, elicitation, elicitOwner, captureTurnAnchor, fleetPublisher, captureUserMessageAnchor, question, workflowCompletionInbox, subagentSteer, completionDiagLog, sendUserFile, promptManifests, approval, checkpointCards, pendingEngineNotices, trustedInternals, userInputLedger, acceptance, workspaceRecorder, runSkills) {
     const startedAt = Date.now();
     metrics?.addGauge("runs_active", 1);
     fleetPublisher?.onStart();
@@ -352,7 +352,6 @@ export async function runInBackground(runner, spec, runStore, taskId, metrics, p
     const parkLeg = async (word, res) => {
         const grafted = await graftParkToolCallId(res, checkpointCards);
         await sink.appendParked(word, grafted);
-        await flushModelUsage();
         const sealed = sealResultForExit(grafted);
         reached = { kind: word, result: sealed };
         await parkRowWrite[word](sealed);
@@ -376,7 +375,7 @@ export async function runInBackground(runner, spec, runStore, taskId, metrics, p
         acceptance?.settle(safe);
     };
     const instructionLeg = createInstructionSelectionLeg();
-    const sink = createLedgerSink({ appendEvent: (seq, type, data) => runStore.appendEvent(taskId, seq, type, data), persistThinking, notifiedKeys, onActivity: (kind, statusData) => recordTurnActivity(taskId, kind, statusData), legSections: () => ({ instructions: instructionLeg.segment(), skills: runSkillsOf(spec) }) });
+    const sink = createLedgerSink({ appendEvent: (seq, type, data) => runStore.appendEvent(taskId, seq, type, data), persistThinking, notifiedKeys, onActivity: (kind, statusData) => recordTurnActivity(taskId, kind, statusData), legSections: () => ({ instructions: instructionLeg.segment(), skills: runSkills }), usage: { modelUsage, taskId } });
     const append = (type, data) => sink.append(type, data);
     const flush = () => sink.flush();
     const flushModelUsage = () => appendModelUsageDelta(append, modelUsage, taskId);
@@ -431,9 +430,8 @@ export async function runInBackground(runner, spec, runStore, taskId, metrics, p
                     if (defaultSubagentTailBus.hasSubscribers(n.task_id)) {
                         defaultSubagentTailBus.publish(n.task_id, { type: "task_settled", taskId: n.task_id, status: n.status, ...(typeof n.seq === "number" ? { seq: n.seq } : {}), ...(n.summary ? { summary: redactSecrets(n.summary) } : {}) });
                     }
-                    const hadRow = isFleetAgentTerminalNotification(n) ? (fleetPublisher?.onChildTerminal(n.sessionId ?? n.task_id, n.status, n.task_id, n.toolUseId) ?? false) : false;
                     const parked = !legLive && Boolean(workflowCompletionInbox && spec.sessionId);
-                    completionDiagLog?.("task_notification_observed", { route: "bg-run-start", taskId: n.task_id, taskType: n.task_type, status: n.status, hadFleetRow: hadRow, legLive, parkedDurable: parked });
+                    completionDiagLog?.("task_notification_observed", { route: "bg-run-start", taskId: n.task_id, taskType: n.task_type, status: n.status, legLive, parkedDurable: parked });
                     if (parked) {
                         void workflowCompletionInbox.enqueue(taskNotificationInboxEntry(spec.sessionId, elicitOwner ?? owner, n, Date.now(), taskId, opts?.priority)).catch((err) => completionDiagLog?.("park_enqueue_failed", { route: "bg-run-start", taskId: n.task_id, err: err instanceof Error ? err.message : String(err) }));
                     }
@@ -468,7 +466,7 @@ export async function runInBackground(runner, spec, runStore, taskId, metrics, p
                 const result = await compositeLeg();
                 observedDone = result;
                 causeAtDone = cancelCtrl.cause();
-                await voidVerifierPauseCard(result, checkpointCards);
+                await voidVerifierPauseCard(result, runner);
                 await flush();
                 await flushPromptManifest();
                 await settleLegResult(result);

package/dist/runtime-governance.d.ts

@@ -230,7 +230,7 @@ export interface GovernancePosture {
  * (checkpoint → ask)今天**没有读口**:两条 list 读口都硬过滤 `state='STREAM_PENDING'`,而 park 完的行是
  * `PARKED`;唯一精确的连接键是 ask 行上的 `gate_token`,要按它反查得给店加一个新读口(SQL 面 = 双库集成
  * 门)。派生 `deriveAskId(...)` 也不行:它吃 `legKey`(= 上一腿 resume token 的摘要)、`parentToolCallId` 与这一问的
- * 类集([ref]);前两维从 checkpoint 行推不出来,类集在 park 行上老行缺席、续跑不补 —— 二腿/子代/老行形上会算出一个
+ * 类集([ref])与展示的动作(工具名 + 入参摘要,7.143.0);前两维从 checkpoint 行推不出来,类集在 park 行上老行缺席、续跑不补 —— 二腿/子代/老行形上会算出一个
  * **错**的 id —— 在「等的谁」这条通道上,错 id 比缺席坏得多(`http/active-run-conflict.ts` 的 `resumeEntryForGate` 的 default 臂是同一条纪律)。故诚实缺席。
  */
 export declare function governanceOriginOf(gate: {

package/dist/sandbox-egress-policy.d.ts

@@ -52,7 +52,10 @@ export interface EgressPolicyInputs {
  * 读数 → 缺口(纯函数、全函数:不抛;顺序:读不到的表 → 策略缺席 → 逐节点逐地址 → IPv6)。一张表读不到,只跳过要它的那一判;另一张照判。
  */
 export declare function sandboxEgressGaps(inputs: EgressPolicyInputs): SandboxEgressGap[];
-/** 读数的说法:每个缺口一行 warn `sandbox_egress_policy_gap` + 一次 `recordFailOpen`(P-DEBT);零缺口一行 info `sandbox_egress_policy_checked`。 */
+/**
+ * 读数的说法:每个缺口一行 warn `sandbox_egress_policy_gap` + 一次 `recordFailOpen`(P-DEBT);零缺口一行 info `sandbox_egress_policy_checked`。
+ * `unreadable` 的 `detail` 是控制面请求的失败句(客户端异常原文)⇒ 经出口座(`operator-log-text`)出门,与起服面其余运维行里的抛出物文本同一读法。
+ */
 export declare function sayEgressPolicyReading(gaps: readonly SandboxEgressGap[], logger: {
     info(msg: string, fields?: Record<string, unknown>): void;
     warn(msg: string, fields?: Record<string, unknown>): void;

package/dist/sandbox-egress-policy.js

@@ -1,5 +1,6 @@
 import { BlockList, isIP } from "node:net";
 import { recordFailOpen } from "./observability/fail-open.js";
+import { seatText } from "./trace/exit-seat.js";
 export const SANDBOX_IPV6_WORDS = ["enabled", "disabled"];
 export const SANDBOX_IPV6_DEFAULT = "enabled";
 export function sandboxPodSysctls(ipv6) {
@@ -229,7 +230,8 @@ export function sayEgressPolicyReading(gaps, logger, namespace) {
     }
     for (const gap of gaps) {
         recordFailOpen("server.sandbox-egress.policy-gap", `kind=${gap.kind}${gap.kind === "unreadable" ? ` what=${gap.what}` : ""}`);
-        logger?.warn("sandbox_egress_policy_gap", { namespace, ...gap, effect: effectOf(gap) });
+        const shown = gap.kind === "unreadable" ? { ...gap, detail: seatText("operator-log-text", gap.detail) } : gap;
+        logger?.warn("sandbox_egress_policy_gap", { namespace, ...shown, effect: effectOf(gap) });
     }
 }
 //# sourceMappingURL=sandbox-egress-policy.js.map

package/dist/sandbox-git-plane.d.ts

@@ -38,26 +38,36 @@ export interface SandboxGitPlanePremises {
     /** The patch judge's refusal for a pod that carries the broker (`podSpecPatchBrokerRefusal`); `undefined` = the patch may land. */
     readonly patchRefusal: string | undefined;
     readonly brokerImage: string | undefined;
-    /** The routed origins (`readSandboxGitConfig`); `null` = no `sandboxGit` block. */
+    /** The routed origins — the live config's `sandboxGit` block as committed (`config.sandboxGit`); `null` = no block. */
     readonly origins: readonly string[] | null;
 }
+/** The boot's readings the judge needs besides config: the secret seat answer (asked once, by stage 5) and the static patch judge's refusal. */
+export interface SandboxGitPlaneBootReadings {
+    readonly secretSeat?: SandboxSecretSeat;
+    readonly patchRefusal?: string;
+}
 /** THE judge: the first premise that fails, in the written order; all hold ⇒ on with per-origin rows. Pure. */
 export declare function judgeSandboxGitPlane(p: SandboxGitPlanePremises): SandboxGitPlane;
 /** The secret seat is asked for the plane only when every premise before it holds (a deployment the plane is off for asks nothing for it). */
 export declare function sandboxGitPlaneAsksSecretSeat(p: Pick<SandboxGitPlanePremises, "multiTenant" | "k8sLane" | "callerCredential" | "centerUrl">): boolean;
-/** The premises read from config, plus the two boot readings (seat answer, patch refusal) when the boot has them. */
-export declare function sandboxGitPlanePremisesOf(config: ServiceConfig, readings: {
-    readonly secretSeat?: SandboxSecretSeat;
-    readonly patchRefusal?: string;
-}): SandboxGitPlanePremises;
+/** The premises read from the live config, plus the two boot readings (seat answer, patch refusal) when the boot has them. */
+export declare function sandboxGitPlanePremisesOf(config: ServiceConfig, readings: SandboxGitPlaneBootReadings): SandboxGitPlanePremises;
+/** The plane's read-time seat (see the file head): {@link SandboxGitPlaneSeat.now} judges on every call; {@link SandboxGitPlaneSeat.settle} asks the boot's IO premise. */
+export interface SandboxGitPlaneSeat {
+    /** The reading now — the judge over the boot readings settled so far and the live config. Synchronous; every reader calls it per read and keeps no copy. */
+    now(): SandboxGitPlane;
+    /** Asks the secret seat once (stage 5 awaits it), only when the four premises before it hold; a later call asks nothing. */
+    settle(): Promise<void>;
+}
 /**
- * Wiring point — the effective `sandboxGit` block (the origins this deployment routes through the broker, canonical form, ≤ 16). Its shape
- * and its canonical-form judge belong to the settings-schema contract package (`SandboxGitConfig`, 14.7.0 — picked up: the block rides the effective
- * wire verbatim); this reader is not wired to it yet ⇒ `null` (the plane stays off, `no_origins`). To be replaced by the package reader — no local copy of the shape.
+ * The plane's ONE seat. `premisesOf` = the premises over the live config (the execution env hands `(r) => sandboxGitPlanePremisesOf(config, r)` — the
+ * config object every commit of the effective configuration mutates); `boot.patchRefusal` = the static patch judge's answer (a boot reading from the start);
+ * `boot.askSecretSeat` = the lane's secret-seat review (only the k8s lane has one; absent ⇒ never asked ⇒ the seat stays unverified).
  */
-export declare function readSandboxGitConfig(_config: ServiceConfig): {
-    readonly origins: readonly string[];
-} | null;
+export declare function createSandboxGitPlaneSeat(premisesOf: (readings: SandboxGitPlaneBootReadings) => SandboxGitPlanePremises, boot: {
+    readonly patchRefusal?: string | undefined;
+    readonly askSecretSeat?: (() => Promise<SandboxSecretSeat>) | undefined;
+}): SandboxGitPlaneSeat;
 /**
  * Wiring point — does this worker hold the credential the console's vault admits on its resolve endpoint (the worker-assertion token)?
  * The server has no reader for it yet ⇒ `false` (the plane stays off, `no_caller_credential`). Replaced by the plane's vault client.
@@ -76,6 +86,15 @@ export interface SandboxGitRunRows {
  * `sandbox_broker_identity_unread` —— every miss reads as "not sso" ⇒ no broker (fail-closed), none of them throws into the pod's connect.
  */
 export declare function runIdentitySourceOf(runId: string | undefined, runs: SandboxGitRunRows | undefined, logger?: Pick<Logger, "warn">): Promise<IdentitySource | undefined>;
+/**
+ * The k8s run binding's broker-seat reader (the adapter asks it once per pod, `K8sRunEnvSeats.brokerSeatOf`): reads the plane ONCE per pod, before the
+ * run-row read — off ⇒ none and no row read at all; on ⇒ {@link sandboxBrokerSeatOf} over that one reading and the row's recorded identity source.
+ * `runs` is the late-bound run store (absent ⇒ no row ⇒ not `sso` ⇒ none).
+ */
+export declare function createSandboxBrokerSeatOf(planeNow: () => SandboxGitPlane, brokerImage: string | undefined, runs: (() => SandboxGitRunRows | undefined) | undefined, logger?: Pick<Logger, "warn">): (runId: string | undefined) => Promise<{
+    readonly image: string;
+    readonly origins: readonly string[];
+} | undefined>;
 /** The broker seat for one run's pod: the plane on ∧ the image set ∧ the run's recorded identity source `sso` ⇒ the image + every origin of the reading (http too); otherwise none. */
 export declare function sandboxBrokerSeatOf(plane: SandboxGitPlane, brokerImage: string | undefined, identitySource: IdentitySource | undefined): {
     readonly image: string;

package/dist/sandbox-git-plane.js

@@ -21,7 +21,7 @@ export const SANDBOX_GIT_PLANE_OFF_TEXT = {
     secret_seat_denied: `the sandbox Role does not allow secrets ${SANDBOX_SECRET_SEAT_VERBS.lease.join(" / ")} (the lease Secret) in the sandbox namespace`,
     pod_patch_reaches_broker: "the deployment's pod-spec patch could reach the broker container (a podSecurityContext, or a field outside the broker white-list)",
     broker_image_unset: "K8S_SANDBOX_BROKER_IMAGE is not set (the broker container's image; this engine's own image is the recommended value)",
-    no_origins: "the effective configuration routes no git origins to the plane (sandboxGit.origins)",
+    no_origins: `the effective configuration routes no git origins to the plane (sandboxGit.origins): the console projects the block only on this worker's own pull (${WEB_ADMIN_ENV.worker}), and a block that fails its contract is read as no origins (log line web_admin_sandbox_git_refused)`,
 };
 const isHttps = (url) => url !== undefined && URL.canParse(url) && new URL(url).protocol === "https:";
 export function judgeSandboxGitPlane(p) {
@@ -73,11 +73,23 @@ export function sandboxGitPlanePremisesOf(config, readings) {
         secretSeat: readings.secretSeat,
         patchRefusal: readings.patchRefusal,
         brokerImage: lane?.provider === "k8s" ? lane.brokerImage : undefined,
-        origins: readSandboxGitConfig(config)?.origins ?? null,
+        origins: config.sandboxGit?.origins.map((e) => e.origin) ?? null,
     };
 }
-export function readSandboxGitConfig(_config) {
-    return null;
+export function createSandboxGitPlaneSeat(premisesOf, boot) {
+    let readings = boot.patchRefusal !== undefined ? { patchRefusal: boot.patchRefusal } : {};
+    let settled = false;
+    return {
+        now: () => judgeSandboxGitPlane(premisesOf(readings)),
+        settle: async () => {
+            if (settled)
+                return;
+            settled = true;
+            if (boot.askSecretSeat === undefined || !sandboxGitPlaneAsksSecretSeat(premisesOf(readings)))
+                return;
+            readings = { ...readings, secretSeat: await boot.askSecretSeat() };
+        },
+    };
 }
 export function readSandboxGitCallerCredential(_config) {
     return false;
@@ -97,6 +109,14 @@ export async function runIdentitySourceOf(runId, runs, logger) {
         return undefined;
     }
 }
+export function createSandboxBrokerSeatOf(planeNow, brokerImage, runs, logger) {
+    return async (runId) => {
+        const plane = planeNow();
+        if (plane.state !== "on")
+            return undefined;
+        return sandboxBrokerSeatOf(plane, brokerImage, await runIdentitySourceOf(runId, runs?.(), logger));
+    };
+}
 export function sandboxBrokerSeatOf(plane, brokerImage, identitySource) {
     if (plane.state !== "on" || brokerImage === undefined || brokerImage === "" || identitySource !== "sso")
         return undefined;

package/dist/security.d.ts

@@ -6,6 +6,7 @@ import type { TaskRequestBody } from "./http/wire-types.js";
 import type { StagingHandle } from "./session-sync-kernel.js";
 import type { ClientSessionRowWrite, ReplaySessionRowWrite, ReplaySessionRowWriteOutcome, SessionRowPatch, SessionRowWriteOutcome } from "./session-row.js";
 import type { ExecutionPlacementSeat } from "./execution-placement.js";
+import type { SessionUnreadable } from "./session-error-wire.js";
 import type { ForkTarget, ForkToOutcome } from "./plugins/session-fork.js";
 import { type OwnerlessClaim } from "./delegated-session-owner.js";
 /** One row of the session-list projection (CC /resume picker) — the durable session abstraction's enumeration
@@ -38,6 +39,12 @@ export interface SessionListItem {
      *  primitive ∧ the row has an occupant token); additive key, passed through unprojected (`sessions-list.ts`). Same name and meaning as
      *  `SessionSummary.rowTag` in `plugins/store-contracts.ts`. */
     rowTag?: string;
+    /** The session's archive cannot be read — present-iff the session head's leaf read throws (a list row is a session ROW: its facts live on the
+     *  row and read fine; this says the CONTENT does not). `errorCode` = the code the session's own reads answer for it (`GET /v1/sessions/:id` /
+     *  `…/head` / `…/events` / `PATCH` once admitted) — one table, `openFaceFaultWire` in `session-error-wire.ts`, the only minter `sessionUnreadableOf`.
+     *  A store whose head leaf is a row column (the SQL twins) never carries it. Additive key, passed through unprojected (`sessions-list.ts`).
+     *  Same name and meaning as `SessionSummary.unreadable` in `plugins/store-contracts.ts`. */
+    unreadable?: SessionUnreadable;
 }
 /**
  * 会话店的行格写原语(规则与判序:`session-row.ts` 头注「写原语」)—— 按入口分两只重载:客户端写(PATCH)的结局闭集四员;行重放(2c 导入落定后的那一笔)
@@ -456,6 +463,8 @@ export declare function setSsoScope(req: IncomingMessage, scope: string): void;
 export declare function ssoVerifiedScope(req: IncomingMessage): string | undefined;
 export declare function setSsoRole(req: IncomingMessage, role: string): void;
 export declare function ssoVerifiedRole(req: IncomingMessage): string | undefined;
+export declare function setSsoPrincipalInc(req: IncomingMessage, principalInc: string): void;
+export declare function ssoVerifiedPrincipalInc(req: IncomingMessage): string | undefined;
 export declare function verifiedPrincipal(req: IncomingMessage, config: ServiceConfig): string | undefined;
 export {};
 //# sourceMappingURL=security.d.ts.map

package/dist/security.js

@@ -210,6 +210,14 @@ export function ssoVerifiedRole(req) {
     const v = SSO_ROLES.get(req);
     return v !== undefined && v.length > 0 ? v : undefined;
 }
+const SSO_PRINCIPAL_INCS = new WeakMap();
+export function setSsoPrincipalInc(req, principalInc) {
+    SSO_PRINCIPAL_INCS.set(req, principalInc);
+}
+export function ssoVerifiedPrincipalInc(req) {
+    const v = SSO_PRINCIPAL_INCS.get(req);
+    return v !== undefined && v.length > 0 ? v : undefined;
+}
 export function verifiedPrincipal(req, config) {
     const sso = ssoVerifiedPrincipal(req);
     if (sso) {

package/dist/server-secret-env.d.ts

@@ -76,6 +76,10 @@ export declare function serverCredentialValueSources(modelApiKeyEnv?: ModelApiKe
  *    `holdOwnCredentialValues` 同一姿势:不收 + 说一次),经留痕座结构化点名那个变量一次 —— `warn` 行 `own_credential_value_not_withheld { name, reason }`
  *    ({@link recordOwnCredentialValueNotWithheld};`reason` 是引擎拒句原文,从不回显值;起服第一步还没有 logger 时当拍经进程默认的 JSON 行日志器写 stderr,不缓冲),能力位 `inherit_env.own_credential_values_withheld`
  *    因此答 false(位真 ⇔ 值臂真扣)。引擎拒一个值时声明保持上一份,所以逐个交表的中间态都是上一份的超集。
+ *    🔴 **这一行是本服务唯一的写者**:值是网关密钥(`MODEL_API_KEY` / `ANTHROPIC_API_KEY`)时,进程输出里另有一行**引擎**的裸 `console.warn`(`a credential the engine was handed is …`)——
+ *    它写在 `createOpenAIBrain` / `createAnthropicBrain` 的收值口,那个口没有通告席(适配器配置没有 `onNotice`;`holdOwnCredentialValues` 不在 core 根导出),core 把这一形记为已知限制。
+ *    本仓不在引擎外面吞 console、也不拿声明口去抢引擎的「每进程每值说一次」账(下游不改上游座的语义);等 core 给席或让声明口的拒收记作已说。读数与翻面条件:
+ *    `test/own-credential-value-boot-lines.test.ts`(真主进程;零裸行的期望以 `it.fails` 立着,core 改形那天转红再翻成常规钉)。
  * 返回声明的名单(只名、不值)。
  */
 export declare function declareServerWithheldEnv(modelApiKeyEnv?: ModelApiKeyEnvTable): readonly string[];