@sema-agent/server 7.141.0 → 7.143.0

package/dist/boot/governance-seams.d.ts

@@ -29,15 +29,22 @@
  * 补偿是这条 env 旋钮本身:要档位的部署显式写下它。将来 center 真有了档位下发面,「多租户必须能解析出
  * 档位」才是一条有对象可指的判据,那时再立。
  *
- * ## 件C 的两条**装配相容性**判据(本仓特有,见 {@link assertLockAssemblable})
+ * ## 装配相容性:一条判据、一个时点(见 {@link assertGovernanceAssemblable})
  *
- * core 的锁按「spec 是否占了这个字段」判,而本仓是**部署自己**在铸那两个 spec 字段:
- *  · `spec.toolPolicy` —— 治理拍(`applyRuntimeGovernance`)在**任何**客户端表态下都会铸出它(敏感路径
- *    守卫集默认非空);于是 `toolPolicy` 锁会让 core 的 preflight **整拒每一条腿**。
- *  · `spec.mcp` —— 部署自带的 MCP 基线(场景/center 下发)同样经 `spec.mcp` 进 core;部署配了 MCP 又锁
- *    `mcp`,同样是每条腿必拒。
- * 两者都在**启动期**拒(安全控件不得半开 §3.4 C 行),而不是让运维在每条任务腿上各撞一次
- * `config.locked_key` 去猜。
+ * core 的锁按「spec 是否占了这个字段」判、合规否决按「被禁能力是否已在 spec 上」判 —— 占了 / 在场都是**整拒 prepare**
+ * (`config.locked_key` / `config.compliance_denied`),不是「不挂载」。而本仓有几张 spec 面是**部署自己**在铸:
+ *  · `spec.toolPolicy` —— 治理拍(`applyRuntimeGovernance`)在**任何**客户端表态下都铸(敏感路径守卫集默认非空)⇒ 恒在;
+ *  · `spec.mcp` / `spec.a2a` —— 部署自带的 MCP 服务器 / A2A 对端(config.d 或中心下发)经同一字段进 core(引擎没有部署级的服务器 / 对端席)⇒ 配了就在;
+ *  · WebFetch 工具面 —— 单用户花名册恒挂(多租户 roster 才摘)。
+ * 判据只有一条:**锁住的键 / 否决的能力所守的面 ∩ 本部署装配的面 ≠ ∅ ⇒ 起服拒**(安全控件不得半开 §3.4 C 行)—— 那不是「配得比较严」,
+ * 是这台部署的每条腿(或某场景的每条腿)必失败,而运维手里没有任何线索指向那把锁 / 那条否决。两张对照表是 core 两个闭集的 `Record`:
+ * 引擎加一个锁键或合规能力 ⇒ 这里缺行 ⇒ tsc 红,逼人当场判它守不守本部署铸的面(修前是两只 `has()` 判据,引擎后加的 `a2a` 锁与
+ * `a2a_peers` 否决静默不判)。
+ *
+ * **时点**:部署 MCP / A2A 基线在能力层才物化(server = 第 7 段的 `applyCenterCapabilities`;run-local = 候选采纳段的同一行),所以这道门
+ * 在**物化之后**由每个起服入口调恰好一次,出口只有一个:抛 ⇒ 起服拒(退出码 1)。座席铸点 {@link createGovernanceSeams}(第 6 段)**不判**:
+ * 那一刻两格基线恒空(修前判据就跑在那里,于是 `mcp` 锁 / `mcp_servers` 否决对 config.d 与中心声明的服务器从不拒启,任务腿各自在引擎门口
+ * 撞拒);它的 config 窄口里也就没有那两格 —— 「物化之前判」这一形在编译期就写不出来。没有运行期补判:不留每腿 400 臂、不留静默卸臂。
  *
  * ## 件D 的边界(成文,别读成「数据会被删」)
  *
@@ -62,7 +69,8 @@ export interface GovernanceSeams {
 }
 /** 依赖收窄到真实消费面(接口隔离 —— 测试用真形字面量,零铸形)。 */
 export interface GovernanceSeamsCtx {
-    config: Pick<ServiceConfig, "compliancePosture" | "lockedConfigKeys" | "retentionPolicy" | "retentionSweep" | "mcpServers" | "requirePrincipal">;
+    /** 没有 `mcpServers` / `a2aPeers`:座席铸在部署基线物化之前,装配相容性判据不在这里(见文件头「时点」)。 */
+    config: Pick<ServiceConfig, "compliancePosture" | "lockedConfigKeys" | "retentionPolicy" | "retentionSweep">;
     logger: Pick<Logger, "info" | "warn">;
     /**
      * core 留存能力校验的对象集(名字进拒启文案)。喂的是**装配现场的真店**,不是「我以为装了什么」——
@@ -79,41 +87,18 @@ export interface GovernanceSeamsCtx {
      */
     retentionExecutor: ManagedRetentionCapability | null;
 }
+/** 装配相容性门的输入 = **装配完成后**的部署事实(部署 MCP / A2A 基线物化之后读;见文件头「时点」)。 */
+export type GovernanceAssemblyFacts = Pick<ServiceConfig, "lockedConfigKeys" | "compliancePosture" | "mcpServers" | "a2aPeers" | "requirePrincipal">;
 /**
- * 件C 的装配相容性判据(纯,可单测)——见文件头「两条判据」。
- *
- * 🔴 失败方向朝**拒启**:一把在本部署上必然把每条腿都拒掉的锁,不是「配得比较严」,是配错了;继续启动
- * 只会让服务对每一个请求说 `config.locked_key`,而运维手里没有任何线索指向那把锁。
+ * **装配相容性门**(见文件头「一条判据、一个时点」):锁住的键 / 否决的能力所守的面撞上本部署装配的面 ⇒ 抛(起服拒)。
+ * 🔴 时点即契约:调用方必须在部署 MCP / A2A 基线**物化之后**调它(server 第 7 段紧跟 `applyCenterCapabilities`;run-local 在候选采纳段之后),
+ * 每个起服入口恰好一次。中心侧后来加了 MCP 服务器 / A2A 对端:那一族是 restart-to-apply 面,变更翻 `restartRequired` 让编排器滚动重启 ——
+ * 重启就撞上这道门,所以没有第二条热路径判据。
  */
-export declare function assertLockAssemblable(input: {
-    lockedKeys: ReadonlySet<LockedKey>;
-    deploymentMcpConfigured: boolean;
-}): void;
-/**
- * 治理面的**装配相容性**总判据(codex 交叉复审 R2-F2 起扩面)——锁与合规档位在这条轴上是同一件事:
- * 两者都可能把「本部署自己的装配」判成 core 门口的违规,而那不是「配得更严」,是**这台从此每条腿必失败**。
- *
- * 合规半场的判据来自亲核 core 的 prepare 门(`prepare-task` 的 compliance 段):被否决的能力若**已在
- * spec 上**,core 是**整拒 prepare**(`config.compliance_denied`),不是「不挂载」。于是:
- *  · `mcp_servers` 被禁 ∧ 部署自带 MCP 基线 ⇒ 每条腿的 `spec.mcp` 都在 ⇒ 必拒;
- *  · `web_fetch` 被禁 ∧ 花名册挂了 WebFetch ⇒ 必拒。⚠️ `hipaa` 的**内建 floor 就含 `web_fetch`**,而本仓
- *    的单用户花名册**恒挂** WebFetch(`capabilities/scenarios.ts` 的 roster 过滤只在多租户下摘它)——
- *    也就是说「单用户 + hipaa」在本仓是一个每条腿必失败的组合。这条判据的全部价值就在这儿:让它在
- *    启动期说出来,而不是让运维看着一台"启动成功、任务全失败"的 worker 猜。
- *  · `workflows` 被禁只在 `spec.selfOrchestration === true` 的腿上拒(per-task,不是部署恒真)⇒ 不在本
- *    判据内,由那条腿自己响亮拒;`org_memory_mount` 走件A 的准入面。**成文定界,不留白。**
- */
-export declare function assertGovernanceAssemblable(input: {
-    lockedKeys: ReadonlySet<LockedKey>;
-    /** 已解析的合规否决集(空集 = 无档位)。 */
-    complianceDenies: ReadonlySet<string>;
-    deploymentMcpConfigured: boolean;
-    /** 本部署的花名册是否会挂 WebFetch(= 单用户形;多租户下 roster 过滤掉它)。 */
-    webFetchMounted: boolean;
-}): void;
+export declare function assertGovernanceAssemblable(facts: GovernanceAssemblyFacts): void;
 /**
- * 装配三座席。**拒启口即装配口**:相容性判据与 core 的留存能力校验都在这里跑,调用方不必记得再调一次
- * (件A 的 C12 探测同姿势)。
+ * 装配三座席(件B/C/D)与 core 的留存能力校验 —— **不**判装配相容性:座席铸在部署 MCP / A2A 基线物化之前,那道门由起服入口在物化之后调
+ * {@link assertGovernanceAssemblable}(见文件头「时点」)。
  */
 export declare function createGovernanceSeams(ctx: GovernanceSeamsCtx): GovernanceSeams;
 //# sourceMappingURL=governance-seams.d.ts.map

package/dist/boot/governance-seams.js

@@ -1,44 +1,77 @@
 import { assertRetentionCapability, resolveComplianceDenies, resolveLockedKeys } from "@sema-agent/core";
-export function assertLockAssemblable(input) {
-    if (input.lockedKeys.has("toolPolicy")) {
-        throw new Error('LOCKED_CONFIG_KEYS contains "toolPolicy", which this server cannot arm: it COMPOSES the effective tool policy itself on ' +
+import { DEPLOYMENT_SHAPE_PREDICATES } from "../deployment-shape.js";
+const FACE_ASSEMBLED = {
+    toolPolicy: () => true,
+    mcp: (facts) => (facts.mcpServers?.servers.length ?? 0) > 0,
+    a2a: (facts) => (facts.a2aPeers?.length ?? 0) > 0,
+    webFetch: (facts) => !DEPLOYMENT_SHAPE_PREDICATES.multiTenant.holds(facts),
+};
+const LOCK_CONFLICTS = {
+    toolPolicy: {
+        face: "toolPolicy",
+        refusal: 'LOCKED_CONFIG_KEYS contains "toolPolicy", which this server cannot arm: it COMPOSES the effective tool policy itself on ' +
             "every leg (deployment approval baseline + the tighten-only governance pass over the sensitive-path guard set), so " +
             "`TaskSpec.toolPolicy` is always present at the engine's prepare door and the lock would refuse EVERY task with " +
             "config.locked_key. The policy is already deployment-owned and no request can loosen it (the fold is deny-wins), so " +
-            "this lock has nothing to guard here — remove it from LOCKED_CONFIG_KEYS.");
-    }
-    if (input.lockedKeys.has("mcp") && input.deploymentMcpConfigured) {
-        throw new Error('LOCKED_CONFIG_KEYS contains "mcp" while this deployment configures MCP servers of its own (scenario/center MCP): the ' +
+            "this lock has nothing to guard here — remove it from LOCKED_CONFIG_KEYS.",
+    },
+    mcp: {
+        face: "mcp",
+        refusal: 'LOCKED_CONFIG_KEYS contains "mcp" while this deployment configures MCP servers of its own (config.d/mcp.json or the center\'s mcp domain): the ' +
             "deployment's servers ride the SAME `TaskSpec.mcp` field the lock guards (the engine has no deployment-level MCP seat), " +
             "so every task would be refused at prepare with config.locked_key. Either drop the `mcp` lock, or remove the configured " +
-            "MCP servers — a locked deployment mounts no MCP at all.");
-    }
-}
-export function assertGovernanceAssemblable(input) {
-    assertLockAssemblable({ lockedKeys: input.lockedKeys, deploymentMcpConfigured: input.deploymentMcpConfigured });
-    if (input.complianceDenies.has("mcp_servers") && input.deploymentMcpConfigured) {
-        throw new Error('the compliance posture denies "mcp_servers" while this deployment configures MCP servers of its own: the engine REFUSES ' +
+            "MCP servers — a locked deployment mounts no MCP at all.",
+    },
+    a2a: {
+        face: "a2a",
+        refusal: 'LOCKED_CONFIG_KEYS contains "a2a" while this deployment configures A2A peers of its own (the center\'s a2a domain): the ' +
+            "deployment's peers ride the SAME `TaskSpec.a2a` field the lock guards (the engine has no deployment-level A2A peer seat), " +
+            "so every task would be refused at prepare with config.locked_key. Either drop the `a2a` lock, or remove the configured " +
+            "A2A peers — a locked deployment dials no A2A peer at all.",
+    },
+    compliancePosture: null,
+    retentionPolicy: null,
+};
+const DENY_CONFLICTS = {
+    mcp_servers: {
+        face: "mcp",
+        refusal: 'the compliance posture denies "mcp_servers" while this deployment configures MCP servers of its own: the engine REFUSES ' +
             "(not silently narrows) every prepare whose TaskSpec.mcp is non-empty, so every task would fail with config.compliance_denied. " +
-            "Remove the configured MCP servers, or drop mcp_servers from the posture.");
-    }
-    if (input.complianceDenies.has("web_fetch") && input.webFetchMounted) {
-        throw new Error('the compliance posture denies "web_fetch" while this deployment mounts the WebFetch tool: the engine REFUSES every prepare ' +
+            "Remove the configured MCP servers, or drop mcp_servers from the posture.",
+    },
+    a2a_peers: {
+        face: "a2a",
+        refusal: 'the compliance posture denies "a2a_peers" while this deployment configures A2A peers of its own: the engine REFUSES ' +
+            "(not silently narrows) every prepare whose TaskSpec.a2a is non-empty, so every task would fail with config.compliance_denied. " +
+            "Remove the configured A2A peers, or drop a2a_peers from the posture.",
+    },
+    web_fetch: {
+        face: "webFetch",
+        refusal: 'the compliance posture denies "web_fetch" while this deployment mounts the WebFetch tool: the engine REFUSES every prepare ' +
             "whose roster carries it, so every task on the default roster would fail with config.compliance_denied. This server drops " +
             "WebFetch from the roster only on a MULTI-TENANT deployment (REQUIRE_PRINCIPAL=true) — a single-user deployment cannot " +
-            "currently honor a web_fetch denial. Run the posture multi-tenant, or drop the profile/deny.");
-    }
+            "currently honor a web_fetch denial. Run the posture multi-tenant, or drop the profile/deny.",
+    },
+    workflows: null,
+    org_memory_mount: null,
+};
+function resolveGovernanceDeclarations(config) {
+    return {
+        lockedKeys: resolveLockedKeys(config.lockedConfigKeys !== undefined ? { keys: config.lockedConfigKeys } : undefined),
+        complianceDenies: config.compliancePosture !== undefined ? resolveComplianceDenies(config.compliancePosture) : new Set(),
+    };
+}
+export function assertGovernanceAssemblable(facts) {
+    const { lockedKeys, complianceDenies } = resolveGovernanceDeclarations(facts);
+    const conflicts = [...[...lockedKeys].map((key) => LOCK_CONFLICTS[key]), ...[...complianceDenies].map((cap) => DENY_CONFLICTS[cap])];
+    for (const conflict of conflicts)
+        if (conflict !== null && FACE_ASSEMBLED[conflict.face](facts))
+            throw new Error(conflict.refusal);
 }
 export function createGovernanceSeams(ctx) {
     const { config, logger, retentionStores } = ctx;
-    const lockedKeys = resolveLockedKeys(config.lockedConfigKeys !== undefined ? { keys: config.lockedConfigKeys } : undefined);
+    const { lockedKeys, complianceDenies } = resolveGovernanceDeclarations(config);
     const posture = config.compliancePosture;
-    const complianceDenies = posture !== undefined ? resolveComplianceDenies(posture) : new Set();
-    assertGovernanceAssemblable({
-        lockedKeys,
-        complianceDenies,
-        deploymentMcpConfigured: (config.mcpServers?.servers.length ?? 0) > 0,
-        webFetchMounted: config.requirePrincipal !== true,
-    });
     const lockedConfig = config.lockedConfigKeys !== undefined && config.lockedConfigKeys.length > 0 ? { keys: config.lockedConfigKeys } : undefined;
     if (lockedConfig)
         logger.info("locked_config_enabled", { keys: [...lockedKeys].sort() });

package/dist/boot/late-binds.d.ts

@@ -1,5 +1,5 @@
 /**
- * 晚绑席([ref] 十段切分的**唯一**跨段可变面)—— 四只 cell,读点在前段、写点在后段。
+ * 晚绑席([ref] 十段切分的**唯一**跨段可变面)—— 五只 cell,读点在前段、写点在后段。
  *
  * 为什么是模块级 live binding 而不是 ctx 字段:读点的原文是**裸标识符**(`() => runStore`、
  * `() => parkedAskRedeem`),而 ctx 字段是**快照** —— 把读点改成 `ctx.runStore` 就是正文改写,
@@ -8,9 +8,10 @@
  *  · `runStore` / `rateLimiter` —— 声明行留在第 7 段原位,紧随一行 `bindX(...)` 把值交过来;
  *  · `parkedAskRedeem` / `runDenySweep` —— 它们的**声明行本身**就是 `let`(逐字搬进本文件,含缩进),
  *    赋值点(server 造出来之后那两处)也随之搬进 `bindServerLateSeats` —— 跨模块给 import 赋值是非法的,
- *    所以 cell 与它的写点必须同居一个模块。
+ *    所以 cell 与它的写点必须同居一个模块;
+ *  · `sessionNotifyDoor` —— 同上一形(server 的产物,写点在 `bindServerLateSeats`)。
  *
- * 时序与修前逐字相同:四只 cell 的读点全是 `() => x` 取值闭包(boot 期不求值,最早的求值发生在
+ * 时序与修前逐字相同:五只 cell 的读点全是 `() => x` 取值闭包(boot 期不求值,最早的求值发生在
  * listen 之后的请求/tick 上),写点仍在各自原来的那一拍。未绑窗内取值得到 `undefined` —— 这正是
  * 各消费座既有的 fail-closed 臂(device 限速座:`gate()` 取不到就抛,见 boot/device-lane.ts:68)。
  */
@@ -20,11 +21,13 @@ import type { RateGate } from "../observability/rate-limit.js";
 import type { ServiceConfig } from "../config.js";
 import type { StoreBackend } from "../plugins/store-backend.js";
 import type { createHttpServer } from "../http/server.js";
+import type { SessionNotifyDoor } from "../session-notify-door.js";
 declare let runStore: ReturnType<StoreBackend["run"]> | undefined;
 declare let rateLimiter: RateGate | undefined;
 declare let parkedAskRedeem: ParkedAskRedeem | undefined;
 declare let runDenySweep: ((now: number) => Promise<void>) | undefined;
-export { runStore, rateLimiter, parkedAskRedeem, runDenySweep };
+declare let sessionNotifyDoor: SessionNotifyDoor | undefined;
+export { runStore, rateLimiter, parkedAskRedeem, runDenySweep, sessionNotifyDoor };
 export declare function bindRunStore(v: ReturnType<StoreBackend["run"]> | undefined): void;
 export declare function bindRateLimiter(v: RateGate): void;
 export declare function bindServerLateSeats(ctx: {

package/dist/boot/late-binds.js

@@ -2,7 +2,8 @@ let runStore;
 let rateLimiter;
 let parkedAskRedeem;
 let runDenySweep;
-export { runStore, rateLimiter, parkedAskRedeem, runDenySweep };
+let sessionNotifyDoor;
+export { runStore, rateLimiter, parkedAskRedeem, runDenySweep, sessionNotifyDoor };
 export function bindRunStore(v) {
     runStore = v;
 }
@@ -12,6 +13,7 @@ export function bindRateLimiter(v) {
 export function bindServerLateSeats(ctx) {
     const { config, logger, server } = ctx;
     runDenySweep = server.denyExpiredApprovals;
+    sessionNotifyDoor = server.sessionNotifyDoor;
     if (!config.directDoorActive)
         parkedAskRedeem = server.redeemParkedAsk;
     else

package/dist/boot/leader.js

@@ -45,7 +45,7 @@ export function createLeaderFace(ctx) {
             (leaderProvider === "k8s" && "s3" in leaderMinio && executionEnvFactory) ||
             (leaderProvider === "host" && executionEnvFactory))
         ? createLeaderEndpoint(createLeaderRunner({
-            brain, models: config.models, roles: config.roles, pricing, logger,
+            brain, models: config.models, roles: config.roles, tiers: config.tiers, pricing, logger,
             governance: {
                 compliancePostureResolver: governanceSeams.compliancePostureResolver,
                 lockedConfig: governanceSeams.lockedConfig,
@@ -61,9 +61,7 @@ export function createLeaderFace(ctx) {
             ...(ctx.onError ? { onError: ctx.onError } : {}),
             mods: ctx.deploymentMods,
             fanoutEnabled: config.leaderFanoutEnabled,
-            ...((process.env.MODEL_ROUTER_ID || process.env.MODEL_CHEAP_ID)
-                ? { routerModel: (process.env.MODEL_ROUTER_ID || process.env.MODEL_CHEAP_ID) }
-                : {}),
+            ...(process.env.MODEL_ROUTER_ID ? { routerModel: process.env.MODEL_ROUTER_ID } : {}),
             ...(leaderProvider === "e2b" ? { e2bApiKey: config.remoteExec.apiKey } : {}),
             ...(executionEnvFactory ? { envFactory: executionEnvFactory } : {}),
             ...leaderMinio,

package/dist/boot/memory-consolidation.d.ts

@@ -1,6 +1,5 @@
 import { type LaneHomeDeployment } from "../execution-lane-caps.js";
 import { type MemoryScopeStores } from "../memory-scope-stores.js";
-import type { SessionCaptureRecordSource } from "../plugins/store-backend.js";
 import type { RestartSliceCtx } from "../web-admin-client/restart-signal.js";
 import type { MemoryConsolidationDriverConfig, ServiceConfig } from "../config-types.js";
 import { resolveMemoryConsolidationDriver, type ConsolidationWriteJudge, type ConsolidationWriteJudgeInput, type EngineNotice, type ConsolidationDriverRunRow, type ConsolidationRunReceipt, type MemoryConsolidationDriverDeps, type PermissionRuleStoreProvider } from "@sema-agent/core";
@@ -500,13 +499,6 @@ export declare function createMemoryConsolidationFaces(stores: MemoryScopeStores
     /** 停因自由文本的**运维日志**座(缺席 = 没人听,不影响任何行为)。载荷由 {@link buildStopDetailAudit}
      *  铸,调用点在单飞回调**之内** ⇒ 一轮真 run 一行,并入的等待者不各落一行。 */
     onStopDetail?: (audit: ReturnType<typeof buildStopDetailAudit>) => void;
-    /** [ref]②(383 §2.1b):capture opt-out 记录的按平面取用源(main.ts 取一次,与 Runner 同源;每只引擎按它那只店的控制面取)。
-     *  🔴 这只引擎是四只 operator 面里**真读名册**的那只:`consolidationEligibility` 第四臂
-     *  (engine.js `listCaptureOptOutSessions`)拿它筛掉 opt-out 会话的贡献条目 —— SQL 部署上漏喂
-     *  = 驱动器读文件空名册 ⇒ 蒸馏器放大用户明说不要记的内容(S-5 真实失效形;全站同批注入律,
-     *  机器钉 capture-optout-lane ②)。[ref] 起 local 车道在引擎接线时也供(core 文件三腿,同一只控制面);
-     *  缺席 ⇒ 记忆面暗(引擎未接线),与 Runner 同本。 */
-    captureRecords?: SessionCaptureRecordSource;
     /** core 7.50.0:整理跑的**写判官座**(必填 —— 缺席不是「没有规则」,core 也拒)。操作面不判任何东西,只把它原样递给驱动动词:
      *  早问库目录一次、应用时问每个产物文件,答 `no_objection` 以外一律拒写。装配层给哪一只见 {@link createOperatorValveWriteJudge}。 */
     writeJudge: ConsolidationWriteJudge;

package/dist/boot/memory-consolidation.js

@@ -4,9 +4,10 @@ import { buildOperatorRosterWayOut } from "../http/principal-gate.js";
 import { memoryMountRootOf } from "../memory-scope.js";
 import { executionLaneHomeDir } from "../execution-lane-caps.js";
 import { DEFAULT_MODEL_REF, resolveMainModel } from "../model-select.js";
-import { backendOwnsControlPlane, captureRecordStoreOf } from "../memory-operator-faces.js";
-import { memoryStoreForRequest } from "../memory-scope-stores.js";
+import { captureRecordStoreOf } from "../memory-operator-faces.js";
+import { backendOwnsControlPlane, memoryStoreForRequest } from "../memory-scope-stores.js";
 import { createConsolidationWriteJudge, deliverWriteRefusal, expandTiers, MemoryEngine, modelOriginOf, readConsolidationDriverRun, resolveMemoryConsolidationDriver, runMemoryConsolidationDriver, } from "@sema-agent/core";
+import { seatText } from "../trace/exit-seat.js";
 export function resolveConsolidationDriverSeat(deps) {
     let options;
     try {
@@ -238,7 +239,7 @@ function decideConsolidationValve(input) {
                 return { valve: { enabled: true, source: "derived", catalogDependent: true } };
             const seatFact = billing.kind === "main-model"
                 ? `Here the seat resolves to the main model "${billing.mainModel}" (no MODEL_CHEAP_ID naming another model, and no catalog roles.consolidate / roles.summarize / "flash" tier binding to another model)`
-                : `Here no consolidation seat resolves at all (${billing.fault})`;
+                : `Here no consolidation seat resolves at all (${seatText("operator-log-text", billing.fault)})`;
             return {
                 valve: {
                     enabled: false,
@@ -341,7 +342,7 @@ export function createMemoryConsolidationFaces(stores, input) {
         const known = engines.get(store);
         if (known !== undefined)
             return known;
-        const records = captureRecordStoreOf(input.captureRecords, store);
+        const records = captureRecordStoreOf(stores.captureRecords, store);
         const engine = new MemoryEngine({
             backend: store,
             memoryDir: memoryMountRootOf(store, stores.root),

package/dist/boot/parked-revive-gate.js

@@ -8,6 +8,7 @@ import { DeferredSandboxPathEnv, sandboxPathEnvSlots } from "./deferred-sandbox-
 import { DEPLOYMENT_SHAPE_PREDICATES } from "../deployment-shape.js";
 import { executionLaneHomeDir } from "../execution-lane-caps.js";
 import { createDeploymentListExemption } from "../approval.js";
+import { seatText } from "../trace/exit-seat.js";
 function hostGateCwd(config, localRoot) {
     return join(config.localDataRoot ?? localRoot, "parked-revive-unrooted");
 }
@@ -63,7 +64,7 @@ async function resolveCapsFor(deps, identity) {
         return await deps.resolveRuntimeCaps(identity.principal);
     }
     catch (err) {
-        deps.logger.warn("parked_revive_caps_unresolved", { principal: identity.principal ?? null, err: err instanceof Error ? err.message : String(err) });
+        deps.logger.warn("parked_revive_caps_unresolved", { principal: identity.principal ?? null, err: seatText("operator-log-text", err instanceof Error ? err.message : String(err)) });
         return undefined;
     }
 }

package/dist/boot/permission-rules-audit.d.ts

@@ -1,31 +1,3 @@
-/**
- * [ref] §3([ref] v2 §6 F4 的**残余采纳**)—— 默认 ON 的**休眠行审计**。
- *
- * 🔴 这条审计存在的唯一理由:`PERMISSION_RULES_ENABLED` 的默认值在本车从 OFF 翻成 ON,而**旋钮翻转
- * 与规则行的寿命是两条独立的时间线**。三张表自 [ref] 车二起就随中央 `ensureSchema` 建、并且从来没有被
- * 清过,所以下面这两类部署在升级的那一刻会突然带着**既有**规则行开始放行:
- *   · 曾经把旋钮开过一段时间又关掉的部署(行留在库里,只是没人读);
- *   · 从旧库恢复/克隆出来的部署(行跟着数据一起来的)。
- * 对运维来说,这是「我什么都没改,worker 却开始少问我了」——一次**放宽面**上的静默变化。审计做的事
- * 很小但是承重:在启动日志里把它说出来,让「少问」是一条能被读到的因果,而不是一次玄学。
- *
- * ── 三条判据,逐条有理由 ────────────────────────────────────────────────────────────────────────
- *  ① **店缺席 ⇒ 整条不上场**(零 I/O、零行)。店缺席包括:显式关旋钮、`local` 车道没接 File 店的旧
- *     部署、以及压根没有 backend 的 env-only worker。没有店就没有行,谈不上唤醒。
- *  ② **零桶 ⇒ 不打行**。一条「0 条既有规则随默认 ON 激活」的行是纯噪音:它对读日志的人不传递任何
- *     可行动的信息,却让真正有东西被唤醒的那一行变得不显眼。
- *  ③ **运维**显式**表过态(`PERMISSION_RULES_ENABLED` 被设成 true 或 false)⇒ 不打行**。那些行本来
- *     就是活的(或者旋钮被显式关着、店根本没装配),默认值翻不翻转对它们零影响 —— 说「随默认 ON
- *     激活」是**假话**,而在启动日志里说假话比不说更坏。判据用 `permissionRulesEnabledExplicit`
- *     (config.ts 与 `dbBackendExplicit` 同姿势),不是猜。
- *
- * ── 失败方向 ────────────────────────────────────────────────────────────────────────────────────
- * 数不出来(库抖动 / 文件读不了)⇒ **不拒启、也不编一个 0 出来**:返回 `undefined` + 一条 warn。
- * 这是一条纯诊断面(它不参与任何放行/拒绝判决),所以它的降级方向是「安静地不知道」而不是「谎报
- * 零」——`{ buckets: 0 }` 会被下游读成「确认没有休眠行」,那是把一次读失败伪装成一个结论。
- * 因为它零判决,这条 fail-open 不属于 `docs/FAIL-OPEN-CENSUS.md` 的安全轴 P 类,故不占 `recordFailOpen`
- * 的标签;它的可见性由那条 warn 承担。
- */
 /** 审计只需要一只桶计数口——**刻意**不吃整个 `PermissionRuleStoreBundle`:诊断面对店的其余能力
  *  一无所知也不该知道,窄口让测试能用四行 fixture 驱动真实现同一段代码。 */
 export interface DormantRuleCounter {

package/dist/boot/permission-rules-audit.js

@@ -1,3 +1,4 @@
+import { seatText } from "../trace/exit-seat.js";
 export async function auditDormantPermissionRules(ctx) {
     if (ctx.stores === undefined)
         return undefined;
@@ -7,7 +8,7 @@ export async function auditDormantPermissionRules(ctx) {
     }
     catch (err) {
         ctx.logger.warn?.("permission_rules_dormant_audit_failed", {
-            error: err instanceof Error ? err.message : String(err),
+            error: seatText("operator-log-text", err instanceof Error ? err.message : String(err)),
             note: "the boot audit could not count pre-existing permission-rule buckets; the lane itself is unaffected",
         });
         return undefined;

package/dist/boot/read-deny-anchor-audit.js

@@ -1,5 +1,6 @@
 import { compileReadDeny, readDenyRowAnchor } from "@sema-agent/core";
 import { echoCallerText } from "../caller-text-echo.js";
+import { seatText } from "../trace/exit-seat.js";
 export const READ_DENY_AUDIT_MAX_NAMED_ROWS = 20;
 const NAMED_ROW_ECHO_CHARS = 200;
 function isAnchoredCanonicalRow(canonical) {
@@ -14,7 +15,7 @@ export function auditReadDenyAnchoring(ctx) {
     }
     catch (err) {
         ctx.logger.warn("read_deny_anchor_audit_failed", {
-            error: echoCallerText(err instanceof Error ? err.message : String(err), { maxChars: 400 }),
+            error: seatText("operator-log-text", err instanceof Error ? err.message : String(err)),
             note: "the boot audit could not read the deployment read-deny rows, so it names none and changes nothing; the engine itself refuses a row it cannot read when the Runner is built",
         });
         return [];

package/dist/boot/reapers.js

@@ -6,6 +6,7 @@ import { createApprovalReconciler } from "../approval-reconciler.js";
 import { createE2bOrphanSandboxProvider, reclaimOrphanE2bSandboxes, E2B_ORPHAN_GRACE_MS } from "../plugins/e2b-orphan-reclaim.js";
 import { SANDBOX_POD_REAP_PERIOD_MS } from "../plugins/k8s-pod-reaper.js";
 import { APPROVAL_ASK_RETENTION_PASS_MS, runApprovalAskRetentionPass } from "../approval-ask-retention.js";
+import { seatText } from "../trace/exit-seat.js";
 export const REAPER_FAILURE_WARN_THRESHOLD = 5;
 export function createThrottledReaperCatch(name, logger, threshold = REAPER_FAILURE_WARN_THRESHOLD) {
     let streak = 0;
@@ -21,7 +22,7 @@ export function createThrottledReaperCatch(name, logger, threshold = REAPER_FAIL
                 logger.warn("reaper_leg_repeated_failure", {
                     reaper: name,
                     consecutiveFailures: streak,
-                    lastError: err instanceof Error ? err.message : String(err),
+                    lastError: seatText("operator-log-text", err instanceof Error ? err.message : String(err)),
                 });
             }
             catch {
@@ -90,7 +91,7 @@ export function startReapers(ctx) {
     const runDenySweepGuard = createThrottledReaperCatch("run_deny_sweep", logger);
     const runsReapSuspendedGuard = createThrottledReaperCatch("runs_reap_suspended", logger);
     const checkpointReapCtxGuard = createThrottledReaperCatch("checkpoint_reap_ctx", logger);
-    const toolResultReapOlderThanGuard = createThrottledReaperCatch("tool_result_reap_older_than", logger);
+    const toolResultReapGuard = createThrottledReaperCatch("tool_result_reap", logger);
     const fileHistorySweepOrphanBlobsGuard = createThrottledReaperCatch("file_history_sweep_orphan_blobs", logger);
     const legacySnapshotBlobSweepGuard = createThrottledReaperCatch("legacy_snapshot_blob_sweep", logger);
     const attachmentReapUnboundGuard = createThrottledReaperCatch("attachment_reap_unbound", logger);
@@ -169,7 +170,7 @@ export function startReapers(ctx) {
                 catch (err) {
                     failedScopes++;
                     try {
-                        logger.warn("bg_agent_reap_scope_failed", { scope, err: err instanceof Error ? err.message : String(err) });
+                        logger.warn("bg_agent_reap_scope_failed", { scope, err: seatText("operator-log-text", err instanceof Error ? err.message : String(err)) });
                     }
                     catch {
                     }
@@ -243,9 +244,10 @@ export function startReapers(ctx) {
         rateLimiter?.sweep();
         if (costQuota instanceof CostQuota)
             costQuota.reap();
-        leg(toolResultStore
-            ?.reapOlderThan?.(Date.now() - config.toolResultTtlSec * 1000)
-            ?.then(() => toolResultReapOlderThanGuard.onSuccess(), toolResultReapOlderThanGuard.onError));
+        const reapToolResults = toolResultStore?.reap?.bind(toolResultStore);
+        leg(reapToolResults && Promise.resolve()
+            .then(() => reapToolResults(Date.now(), { maxAgeMs: config.toolResultTtlSec * 1000 }))
+            .then(() => toolResultReapGuard.onSuccess(), toolResultReapGuard.onError));
         leg(fileHistoryErasure
             ?.sweepOrphanBlobs?.()
             .then(() => fileHistorySweepOrphanBlobsGuard.onSuccess(), fileHistorySweepOrphanBlobsGuard.onError));
@@ -266,7 +268,7 @@ export function startReapers(ctx) {
             } })
                 .catch((err) => {
                 try {
-                    logger.warn("attachment_orphan_sweep_failed", { err: err instanceof Error ? err.message : String(err) });
+                    logger.warn("attachment_orphan_sweep_failed", { err: seatText("operator-log-text", err instanceof Error ? err.message : String(err)) });
                 }
                 catch {
                 }

package/dist/boot/resolve-spec.d.ts

@@ -1,7 +1,7 @@
 import { SessionEnvironmentSelection, selectEnvironmentTool } from "../capabilities/select-environment-tool.js";
 import { sendUserFileTool } from "../capabilities/send-user-file-tool.js";
 import { selectScenario } from "../capabilities/scenarios.js";
-import { type LoadedSkill } from "../capabilities/skills.js";
+import type { LoadedSkill } from "../capabilities/skills.js";
 import type { ServiceConfig } from "../config.js";
 import { type LiveQuestionFace } from "../deployment-governance.js";
 import { FleetEventBus } from "../fleet/fleet-bus.js";

package/dist/boot/resolve-spec.js

@@ -6,8 +6,8 @@ import { recordFailOpen } from "../observability/fail-open.js";
 import { SessionEnvironmentSelection, selectEnvironmentTool } from "../capabilities/select-environment-tool.js";
 import { sendUserFileTool } from "../capabilities/send-user-file-tool.js";
 import { buildExcludeToolsSeat, buildPromptSeats, buildRunSkills, createScenarioGate, selectScenario } from "../capabilities/scenarios.js";
-import { stampRunSkills } from "../capabilities/skills.js";
-import { stampHandsLane, toolPolicyForHands } from "../capabilities/hands-lane.js";
+import { toolPolicyForHands } from "../capabilities/hands-lane.js";
+import { mintLegFacts } from "../leg-facts.js";
 import { applyLongtailDefer } from "../capabilities/tool-defer.js";
 import { assertGuardPatternsUsable, buildApprovalGrantNotice, buildOnlySensitiveBaselineWarning, createApprovalBaselinePolicy, createDeploymentGovernanceInputs } from "../deployment-governance.js";
 import { createDeploymentListExemption, gateIntentUnserviceableReason, singleUserAutoAcceptBaselineApplies } from "../approval.js";
@@ -21,14 +21,14 @@ import { isAtMentionable, matchCatalogModel, refusedCatalogEntry, resolveTaskMod
 import { echoModelRef, modelUnavailableMessage } from "../model-entry-refusal.js";
 import { PerTaskImageRegistry, resolveSandboxImageRef } from "../per-task-image.js";
 import { remoteScratchpadDirFor } from "../plugins/remote-scratchpad.js";
-import { bindAttachmentsForTask } from "../plugins/task-attachment-store.js";
+import { attachmentBindRefusalAnswer, bindAttachmentsForTask } from "../plugins/task-attachment-store.js";
 import { resourceSuspendOptIn } from "../resource-suspend.js";
 import { routeServiceTask, supPostureOverrides } from "../router/route-orchestration.js";
 import { tightenGoverned } from "../governance-overrides.js";
 import { applyRuntimeGovernance } from "../runtime-governance.js";
 import { HttpError, createCodedHttpError, encodeCheckpointScope } from "../security.js";
 import { headReadOf, sessionFaceOfHead } from "../session-incarnation.js";
-import { legProjectIdOf, sessionWorkspaceStoreOf, stampLegSessionWitness } from "../session-workspace.js";
+import { legProjectIdOf, sessionWorkspaceStoreOf } from "../session-workspace.js";
 import { memorySpecForRequest } from "../memory-scope.js";
 import { createMemoryProjectLayers } from "../memory-project-layer.js";
 import { inheritEnvFacts, inheritEnvFieldIssue, singleMemberOffFieldIssue } from "../request-value-closure.js";
@@ -50,7 +50,7 @@ import { inertToolListEntryOf } from "../rule-entry-list.js";
 import { TENANCY_WALL_CLOCK_BASE_SEC, enableForkFromBody, normalizeRetainSubagentSessions, selfOrchestrationFromBody } from "../task-workflow.js";
 import { redactSecrets } from "../trace/redact.js";
 import { DeferredSandboxPathEnv, sandboxPathEnvSlots } from "./deferred-sandbox-path-env.js";
-import { executionLaneHomeDir, executionLaneOf, laneWiresExecutionEnv } from "../execution-lane-caps.js";
+import { executionLaneHomeDir, executionLaneOf, laneIsolated, laneWiresExecutionEnv } from "../execution-lane-caps.js";
 import { executionConfigRootOf } from "../execution-config-root.js";
 import { withUnattendedLeg } from "../unattended-permission-mode.js";
 import { fieldConflictFacts } from "../field-conflict.js";
@@ -177,13 +177,13 @@ export function createResolveSpec(ctx) {
             scratchpadDir: folded.scratchpadDir,
             hostSemanticsLane: folded.hostSemanticsLane,
         });
-        const stamped = stampHandsLane(final, gated.hands);
-        return stampLegSessionWitness(stampRunSkills(stamped, runSkills.roster), gated.sessionWitness);
+        return { spec: final, facts: { hands: gated.hands, skills: runSkills.roster, sessionWitness: gated.sessionWitness } };
     };
     const gateScenarioAndAppend = async (body, auth, opts) => {
         const scenarioName = await scenarioGate(auth?.principal, body.scenario);
         const root = opts.execution.root;
-        const sessionWitness = { sessionId: root, incarnation: (sessionHeadOf === undefined ? undefined : sessionFaceOfHead(root, await sessionHeadOf(root)))?.incarnation ?? null };
+        const rootFace = sessionHeadOf === undefined ? undefined : sessionFaceOfHead(root, await sessionHeadOf(root));
+        const sessionWitness = { sessionId: root, owner: rootFace?.owner ?? null, incarnation: rootFace?.incarnation ?? null };
         const cap = selectScenario(scenarios, scenarioName)(body, auth?.principal, { sessionId: sessionWitness.sessionId, delegationRoot: sessionWitness });
         const acceptedAppend = acceptAppendSystemPrompt(body.appendSystemPrompt, (detail) => logger.warn("append_system_prompt_dropped", { detail, sessionId: auth?.sessionId ?? null }));
         const objective = typeof body.objective === "string" ? body.objective : "";
@@ -217,11 +217,13 @@ export function createResolveSpec(ctx) {
                     if (!auth?.sessionId)
                         throw new HttpError(400, "`attachmentIds` requires a session-resolving deployment (no authorizer session)");
                     const sid = auth.sessionId;
+                    const lane = opts.execution.lane;
                     const r = await bindAttachmentsForTask({
                         store: taskAttachmentStore,
                         owner: auth?.principal ?? "default",
                         ids: reqAtt,
                         sessionId: sid,
+                        lane: { word: lane, isolated: laneIsolated(lane) },
                         leg: opts?.leg === "fresh" ? "fresh" : "resume",
                         nowMs: Date.now(),
                         onMissing: (id) => {
@@ -229,6 +231,12 @@ export function createResolveSpec(ctx) {
                                 throw new HttpError(400, `attachment not found: ${id}`);
                             logger.warn("attachment_missing_on_resume", { sessionId: sid, id });
                         },
+                        onRefused: (refusal) => {
+                            const answer = attachmentBindRefusalAnswer(refusal);
+                            if (opts?.leg === "fresh")
+                                throw createCodedHttpError(answer.status, answer.errorCode, answer.message, answer.extra);
+                            logger.warn("attachment_refused_on_resume", { sessionId: sid, errorCode: answer.errorCode, ...answer.extra });
+                        },
                     });
                     attachmentNotice = r.notice;
                 }
@@ -277,6 +285,7 @@ export function createResolveSpec(ctx) {
                 sessionId: auth?.sessionId ?? "",
                 cwd: (auth?.sessionId ? perSessionCwd.get(auth.sessionId) : undefined) ?? process.cwd(),
                 ...(parsedSettings.settings?.shellEnv ? { shellEnv: parsedSettings.settings.shellEnv } : {}),
+                httpHookAllowlistLayers: parsedSettings.settings?.httpHookAllowlist !== undefined ? [parsedSettings.settings.httpHookAllowlist] : [],
                 hookLlm,
                 hookAgent,
                 onHookNotice: (n) => fleetBus.publishHookNotice({
@@ -671,8 +680,8 @@ export function createResolveSpec(ctx) {
         return governed;
     };
     const resolveSpecForLeg = async (body, req, auth, opts) => {
-        const spec = await resolveSpec(body, req, auth, opts);
-        return unrooted(opts.unattendedLeg !== true ? spec : withUnattendedLeg(spec));
+        const { spec, facts } = await resolveSpec(body, req, auth, opts);
+        return mintLegFacts(unrooted(opts.unattendedLeg !== true ? spec : withUnattendedLeg(spec)), facts);
     };
     return resolveSpecForLeg;
 }

package/dist/boot/retention-lane.js

@@ -1,4 +1,5 @@
 import { recordFailOpen } from "../observability/fail-open.js";
+import { seatText } from "../trace/exit-seat.js";
 export const RETENTION_SWEEP_STUCK_THRESHOLD = 5;
 export const RETENTION_LEASE_TTL_FACTOR = 2;
 const DAY_MS = 86_400_000;
@@ -137,15 +138,16 @@ async function recordDomainFailure(ctx, d) {
     }
     const streaks = ctx.streaks;
     const streak = (streaks?.get(d.domain) ?? 0) + 1;
+    const shown = seatText("operator-log-text", message);
     streaks?.set(d.domain, streak);
     try {
-        ctx.logger.warn("retention_sweep_domain_failed", { domain: d.domain, fencingToken: d.fencingToken, consecutiveFailures: streak, auditRowWritten, err: message });
+        ctx.logger.warn("retention_sweep_domain_failed", { domain: d.domain, fencingToken: d.fencingToken, consecutiveFailures: streak, auditRowWritten, err: shown });
         if (streak >= RETENTION_SWEEP_STUCK_THRESHOLD) {
             ctx.metrics.inc("retention_sweep_stuck", {}, 1);
             ctx.logger.warn("retention_sweep_stuck", {
                 domain: d.domain,
                 consecutiveFailures: streak,
-                lastError: message,
+                lastError: shown,
                 note: "this retention domain has failed its sweep for RETENTION_SWEEP_STUCK_THRESHOLD consecutive rounds — its data is NOT being retained per policy. Check retention_audit rows with action='failed' for this domain.",
             });
             streaks?.set(d.domain, 0);
@@ -168,7 +170,7 @@ export function startRetentionLane(ctx) {
             .then(() => undefined)
             .catch((err) => {
             try {
-                ctx.logger.warn("retention_sweep_round_failed", { err: err instanceof Error ? err.message : String(err) });
+                ctx.logger.warn("retention_sweep_round_failed", { err: seatText("operator-log-text", err instanceof Error ? err.message : String(err)) });
             }
             catch {
                 recordFailOpen("server.retention.sweep-report-dropped", "round");