@sema-agent/server 7.142.0 → 7.143.0

package/dist/approval-reconciler.d.ts

@@ -79,7 +79,7 @@ export type GateMatchOutcome =
     kind: "hash_mismatch";
     candidates: number;
 }
-/** 三元组身份就对不上(不是摘要的事):别的 sourceTaskId / 别的 callId / 早于本 ask 的 park。 */
+/** 三元组身份就对不上(不是摘要的事):别的 sourceSessionId / 别的 callId / 早于本 ask 的 park。 */
  | {
     kind: "identity_miss";
 };
@@ -91,8 +91,8 @@ export type GateMatchOutcome =
  * `delegation.parentToolCallId` 是必填字段,铸行时逐字透传进 `parent_tool_call_id` 列 ⇒ **列非 NULL
  * ⇔ delegation 在场**(不需要新列,也不需要回 `req` 里再读一次)。
  *
- * 第二维 `sourceTaskId !== sessionId` 把「根腿」摘出去:根腿的 `sourceTaskId` 恒等于会话锚(core 给
- * `AskRequest.sourceTaskId` 填的就是该腿 sessionId),它根本不在任何 fold 里,`parent_tool_call_id`
+ * 第二维 `sourceSessionId !== sessionId` 把「根腿」摘出去:根腿的 `sourceSessionId` 恒等于会话锚(core 给
+ * `AskRequest.sourceSessionId` 填的就是该腿 sessionId),它根本不在任何 fold 里,`parent_tool_call_id`
  * 为 NULL 是它的常态而不是信号。
  *
  * 命中 ⇒ 退出硬相等(判据 1 结构上不命中,行落 ②③④⑤)。实测(test AI 围栏)checkpoint 存的摘要**逐字
@@ -105,11 +105,11 @@ export declare function isAncestorFoldMint(ask: AskRow): boolean;
  * 逐条:
  *  - 祖先层 fold 中途铸点 ⇒ 直接退出(见 {@link isAncestorFoldMint});
  *  - `unparseable` 候选直接出局(读不出 ⇒ 不确定 ⇒ 不命中);
- *  - **身份三元组**:`sourceTaskId` **相等** ∧ `toolCallId` **相等** ∧ 时间维的**因果下界**
+ *  - **身份三元组**:`sourceSessionId` **相等** ∧ `toolCallId` **相等** ∧ 时间维的**因果下界**
  *    `candidate.createdAtMs >= ask.createdAtMs`(⚠️ 第三维**不是等式** —— 把它读成等式会让合法的 park
  *    几乎命不中,行随后落 ②③⑤ 被误判)—— 摘要**不是**身份([ref]③①:
  *    同 args 的两次调用摘要天然相同,只靠摘要硬相等会把第二次投递并进第一次的票);任一维在候选侧
- *    缺席(读不出的 blob 没有 `sourceTaskId`)即身份不成立;
+ *    缺席(读不出的 blob 没有 `sourceSessionId`)即身份不成立;
  *  - **hash 双等**:两侧都必须在场且相等,任一侧缺席一律不 bind;禁「能取到时才比」的可选谓词。
  *    归因分两级(顺序即代码顺序):身份这一层先判 —— 同身份候选为空**且**候选集非空 ⇒ `identity_miss`;
  *    走到 hash 这一层才把缺席记成**单铸** `single_mint`(见 {@link GateMatchOutcome})。
@@ -178,10 +178,10 @@ export interface ReconcileStats {
      *
      * 🔴 **今天恒零,而且是结构性的**(扫描P2,2026-08-12 亲读验真;登记而不假称已解):读口
      * `findCheckpointCandidatesForAsk` 按 `session_id = ask.sessionId` 查,`session_id` 列写的是
-     * `cp.sessionId`,而 core 每个 checkpoint 铸点都填 `sourceTaskId: sessionId`
+     * `cp.sessionId`,而 core 每个 checkpoint 铸点都填 `sourceSessionId: sessionId`
      * (`runner/prepare-task.js` 四处;`checkpoint-store.d.ts` 逐字「= sessionId at the mint」)⇒ 读口
-     * 返回的候选恒满足 `c.sourceTaskId === ask.sessionId`;而判据 1 命中要 `c.sourceTaskId ===
-     * ask.sourceTaskId`,祖先层否决要 `ask.sourceTaskId !== ask.sessionId` —— 两者互斥,这一臂在生产
+     * 返回的候选恒满足 `c.sourceSessionId === ask.sessionId`;而判据 1 命中要 `c.sourceSessionId ===
+     * ask.sourceSessionId`,祖先层否决要 `ask.sourceSessionId !== ask.sessionId` —— 两者互斥,这一臂在生产
      * 接线下一次也不会被返回。
      *
      * 所以**别把零读数当健康信号**(与 {@link unmatchableNoHash} 的「恒零才是健康态」正相反:那条能非零,

package/dist/approval-reconciler.js

@@ -21,7 +21,7 @@ function withDeadline(op, label, timeoutMs = RECONCILE_STORE_TIMEOUT_MS) {
     });
 }
 export function isAncestorFoldMint(ask) {
-    return ask.parentToolCallId === null && ask.sourceTaskId !== ask.sessionId;
+    return ask.parentToolCallId === null && ask.sourceSessionId !== ask.sessionId;
 }
 export function classifyGateMatch(ask, candidates) {
     const outcome = classifyGateMatchBeforeFoldVeto(ask, candidates);
@@ -30,7 +30,7 @@ export function classifyGateMatch(ask, candidates) {
     return outcome;
 }
 function classifyGateMatchBeforeFoldVeto(ask, candidates) {
-    const sameIdentity = candidates.filter((c) => c.unparseable !== true && c.sourceTaskId !== null && c.sourceTaskId === ask.sourceTaskId && c.boundCallId === ask.toolCallId && c.createdAtMs >= ask.createdAtMs);
+    const sameIdentity = candidates.filter((c) => c.unparseable !== true && c.sourceSessionId !== null && c.sourceSessionId === ask.sourceSessionId && c.boundCallId === ask.toolCallId && c.createdAtMs >= ask.createdAtMs);
     const askHash = ask.boundInputHash;
     if (sameIdentity.length === 0) {
         if (candidates.length > 0)
@@ -96,7 +96,7 @@ export async function bindParkingAskAtGate(deps, ask, nowMs, deadlineMs) {
                 taskId: ask.taskId,
                 toolCallId: ask.toolCallId,
                 candidates: gateMatch.candidates,
-                reason: "ask and checkpoint minted the same bound input under the same (sourceTaskId, toolCallId) identity but the digests differ — " +
+                reason: "ask and checkpoint minted the same bound input under the same (sourceSessionId, toolCallId) identity but the digests differ — " +
                     "the known causes are deployment-side (a hook/policy mutating an object it still holds a reference to between the two mints, " +
                     "or a stateful getter returning a fresh value per read), not out-of-band interference; this ask keeps its fail-safe route (no park, no denial)",
             });

package/dist/audit.js

@@ -129,8 +129,9 @@ const MESSAGE_READ_TREATMENT = {
         runOrigin: "verbatim",
         taskId: "verbatim",
         attachment: "verbatim",
+        rewrittenBy: "verbatim",
     },
-    custom: { role: "verbatim", customType: "verbatim", content: "verbatim", display: "verbatim", details: "verbatim", provenance: "verbatim", timestamp: "verbatim" },
+    custom: { role: "verbatim", customType: "verbatim", content: "verbatim", display: "verbatim", details: "verbatim", provenance: "verbatim", timestamp: "verbatim", rewrittenBy: "verbatim" },
     assistant: {
         role: "verbatim", content: "parts", errorMessage: "text", diagnostics: "structure", repetition: "structure",
         api: "verbatim", provider: "verbatim", model: "verbatim", responseModel: "verbatim", responseId: "verbatim", requestId: "verbatim",
@@ -139,8 +140,9 @@ const MESSAGE_READ_TREATMENT = {
         staticReasoningCut: "verbatim", timestamp: "verbatim",
         providerCondition: "verbatim", providerConditionSource: "verbatim", providerResetAtMs: "verbatim", apiErrorRoute: "verbatim",
         errorBodyIncomplete: "verbatim", modelOutputInvalid: "verbatim", finishReasonUnknown: "verbatim", streamEndIgnored: "verbatim",
+        refusedTool: "verbatim", rewrittenBy: "verbatim",
     },
-    toolResult: { role: "verbatim", toolCallId: "verbatim", toolName: "verbatim", content: "parts", details: "toolCard", isError: "verbatim", timestamp: "verbatim" },
+    toolResult: { role: "verbatim", toolCallId: "verbatim", toolName: "verbatim", content: "parts", details: "toolCard", isError: "verbatim", timestamp: "verbatim", rewrittenBy: "verbatim" },
     bashExecution: {
         role: "verbatim", command: "text", output: "text", exitCode: "verbatim", cancelled: "verbatim", truncated: "verbatim",
         fullOutputPath: "verbatim", timestamp: "verbatim", excludeFromContext: "verbatim",

package/dist/boot/budget-tracing.d.ts

@@ -45,7 +45,7 @@ export declare function createBudgetAndTracing(ctx: BudgetTracingCtx): {
     fleetLease: import("../fleet-lease.js").FleetLeaseManager | undefined;
     tracer: import("@sema-agent/core").TracerHook;
     sideQueryAccounting: import("../budget.js").SideQueryAccounting;
-    toolResultStore: import("../plugins/store-backend.js").ToolResultStoreFull | undefined;
+    toolResultStore: import("@sema-agent/core").ToolResultStore | undefined;
     sessionPolicyStore: import("@sema-agent/core").SessionPolicyStore | undefined;
     fileHistoryStore: import("../plugins/store-backend.js").ServiceFileHistoryStore | undefined;
     fileHistoryErasure: import("../file-history-capture.js").FileHistoryErasureFace | undefined;

package/dist/boot/governance-seams.d.ts

@@ -29,15 +29,22 @@
  * 补偿是这条 env 旋钮本身:要档位的部署显式写下它。将来 center 真有了档位下发面,「多租户必须能解析出
  * 档位」才是一条有对象可指的判据,那时再立。
  *
- * ## 件C 的两条**装配相容性**判据(本仓特有,见 {@link assertLockAssemblable})
+ * ## 装配相容性:一条判据、一个时点(见 {@link assertGovernanceAssemblable})
  *
- * core 的锁按「spec 是否占了这个字段」判,而本仓是**部署自己**在铸那两个 spec 字段:
- *  · `spec.toolPolicy` —— 治理拍(`applyRuntimeGovernance`)在**任何**客户端表态下都会铸出它(敏感路径
- *    守卫集默认非空);于是 `toolPolicy` 锁会让 core 的 preflight **整拒每一条腿**。
- *  · `spec.mcp` —— 部署自带的 MCP 基线(场景/center 下发)同样经 `spec.mcp` 进 core;部署配了 MCP 又锁
- *    `mcp`,同样是每条腿必拒。
- * 两者都在**启动期**拒(安全控件不得半开 §3.4 C 行),而不是让运维在每条任务腿上各撞一次
- * `config.locked_key` 去猜。
+ * core 的锁按「spec 是否占了这个字段」判、合规否决按「被禁能力是否已在 spec 上」判 —— 占了 / 在场都是**整拒 prepare**
+ * (`config.locked_key` / `config.compliance_denied`),不是「不挂载」。而本仓有几张 spec 面是**部署自己**在铸:
+ *  · `spec.toolPolicy` —— 治理拍(`applyRuntimeGovernance`)在**任何**客户端表态下都铸(敏感路径守卫集默认非空)⇒ 恒在;
+ *  · `spec.mcp` / `spec.a2a` —— 部署自带的 MCP 服务器 / A2A 对端(config.d 或中心下发)经同一字段进 core(引擎没有部署级的服务器 / 对端席)⇒ 配了就在;
+ *  · WebFetch 工具面 —— 单用户花名册恒挂(多租户 roster 才摘)。
+ * 判据只有一条:**锁住的键 / 否决的能力所守的面 ∩ 本部署装配的面 ≠ ∅ ⇒ 起服拒**(安全控件不得半开 §3.4 C 行)—— 那不是「配得比较严」,
+ * 是这台部署的每条腿(或某场景的每条腿)必失败,而运维手里没有任何线索指向那把锁 / 那条否决。两张对照表是 core 两个闭集的 `Record`:
+ * 引擎加一个锁键或合规能力 ⇒ 这里缺行 ⇒ tsc 红,逼人当场判它守不守本部署铸的面(修前是两只 `has()` 判据,引擎后加的 `a2a` 锁与
+ * `a2a_peers` 否决静默不判)。
+ *
+ * **时点**:部署 MCP / A2A 基线在能力层才物化(server = 第 7 段的 `applyCenterCapabilities`;run-local = 候选采纳段的同一行),所以这道门
+ * 在**物化之后**由每个起服入口调恰好一次,出口只有一个:抛 ⇒ 起服拒(退出码 1)。座席铸点 {@link createGovernanceSeams}(第 6 段)**不判**:
+ * 那一刻两格基线恒空(修前判据就跑在那里,于是 `mcp` 锁 / `mcp_servers` 否决对 config.d 与中心声明的服务器从不拒启,任务腿各自在引擎门口
+ * 撞拒);它的 config 窄口里也就没有那两格 —— 「物化之前判」这一形在编译期就写不出来。没有运行期补判:不留每腿 400 臂、不留静默卸臂。
  *
  * ## 件D 的边界(成文,别读成「数据会被删」)
  *
@@ -62,7 +69,8 @@ export interface GovernanceSeams {
 }
 /** 依赖收窄到真实消费面(接口隔离 —— 测试用真形字面量,零铸形)。 */
 export interface GovernanceSeamsCtx {
-    config: Pick<ServiceConfig, "compliancePosture" | "lockedConfigKeys" | "retentionPolicy" | "retentionSweep" | "mcpServers" | "requirePrincipal">;
+    /** 没有 `mcpServers` / `a2aPeers`:座席铸在部署基线物化之前,装配相容性判据不在这里(见文件头「时点」)。 */
+    config: Pick<ServiceConfig, "compliancePosture" | "lockedConfigKeys" | "retentionPolicy" | "retentionSweep">;
     logger: Pick<Logger, "info" | "warn">;
     /**
      * core 留存能力校验的对象集(名字进拒启文案)。喂的是**装配现场的真店**,不是「我以为装了什么」——
@@ -79,41 +87,18 @@ export interface GovernanceSeamsCtx {
      */
     retentionExecutor: ManagedRetentionCapability | null;
 }
+/** 装配相容性门的输入 = **装配完成后**的部署事实(部署 MCP / A2A 基线物化之后读;见文件头「时点」)。 */
+export type GovernanceAssemblyFacts = Pick<ServiceConfig, "lockedConfigKeys" | "compliancePosture" | "mcpServers" | "a2aPeers" | "requirePrincipal">;
 /**
- * 件C 的装配相容性判据(纯,可单测)——见文件头「两条判据」。
- *
- * 🔴 失败方向朝**拒启**:一把在本部署上必然把每条腿都拒掉的锁,不是「配得比较严」,是配错了;继续启动
- * 只会让服务对每一个请求说 `config.locked_key`,而运维手里没有任何线索指向那把锁。
+ * **装配相容性门**(见文件头「一条判据、一个时点」):锁住的键 / 否决的能力所守的面撞上本部署装配的面 ⇒ 抛(起服拒)。
+ * 🔴 时点即契约:调用方必须在部署 MCP / A2A 基线**物化之后**调它(server 第 7 段紧跟 `applyCenterCapabilities`;run-local 在候选采纳段之后),
+ * 每个起服入口恰好一次。中心侧后来加了 MCP 服务器 / A2A 对端:那一族是 restart-to-apply 面,变更翻 `restartRequired` 让编排器滚动重启 ——
+ * 重启就撞上这道门,所以没有第二条热路径判据。
  */
-export declare function assertLockAssemblable(input: {
-    lockedKeys: ReadonlySet<LockedKey>;
-    deploymentMcpConfigured: boolean;
-}): void;
-/**
- * 治理面的**装配相容性**总判据(codex 交叉复审 R2-F2 起扩面)——锁与合规档位在这条轴上是同一件事:
- * 两者都可能把「本部署自己的装配」判成 core 门口的违规,而那不是「配得更严」,是**这台从此每条腿必失败**。
- *
- * 合规半场的判据来自亲核 core 的 prepare 门(`prepare-task` 的 compliance 段):被否决的能力若**已在
- * spec 上**,core 是**整拒 prepare**(`config.compliance_denied`),不是「不挂载」。于是:
- *  · `mcp_servers` 被禁 ∧ 部署自带 MCP 基线 ⇒ 每条腿的 `spec.mcp` 都在 ⇒ 必拒;
- *  · `web_fetch` 被禁 ∧ 花名册挂了 WebFetch ⇒ 必拒。⚠️ `hipaa` 的**内建 floor 就含 `web_fetch`**,而本仓
- *    的单用户花名册**恒挂** WebFetch(`capabilities/scenarios.ts` 的 roster 过滤只在多租户下摘它)——
- *    也就是说「单用户 + hipaa」在本仓是一个每条腿必失败的组合。这条判据的全部价值就在这儿:让它在
- *    启动期说出来,而不是让运维看着一台"启动成功、任务全失败"的 worker 猜。
- *  · `workflows` 被禁只在 `spec.selfOrchestration === true` 的腿上拒(per-task,不是部署恒真)⇒ 不在本
- *    判据内,由那条腿自己响亮拒;`org_memory_mount` 走件A 的准入面。**成文定界,不留白。**
- */
-export declare function assertGovernanceAssemblable(input: {
-    lockedKeys: ReadonlySet<LockedKey>;
-    /** 已解析的合规否决集(空集 = 无档位)。 */
-    complianceDenies: ReadonlySet<string>;
-    deploymentMcpConfigured: boolean;
-    /** 本部署的花名册是否会挂 WebFetch(= 单用户形;多租户下 roster 过滤掉它)。 */
-    webFetchMounted: boolean;
-}): void;
+export declare function assertGovernanceAssemblable(facts: GovernanceAssemblyFacts): void;
 /**
- * 装配三座席。**拒启口即装配口**:相容性判据与 core 的留存能力校验都在这里跑,调用方不必记得再调一次
- * (件A 的 C12 探测同姿势)。
+ * 装配三座席(件B/C/D)与 core 的留存能力校验 —— **不**判装配相容性:座席铸在部署 MCP / A2A 基线物化之前,那道门由起服入口在物化之后调
+ * {@link assertGovernanceAssemblable}(见文件头「时点」)。
  */
 export declare function createGovernanceSeams(ctx: GovernanceSeamsCtx): GovernanceSeams;
 //# sourceMappingURL=governance-seams.d.ts.map

package/dist/boot/governance-seams.js

@@ -1,44 +1,77 @@
 import { assertRetentionCapability, resolveComplianceDenies, resolveLockedKeys } from "@sema-agent/core";
-export function assertLockAssemblable(input) {
-    if (input.lockedKeys.has("toolPolicy")) {
-        throw new Error('LOCKED_CONFIG_KEYS contains "toolPolicy", which this server cannot arm: it COMPOSES the effective tool policy itself on ' +
+import { DEPLOYMENT_SHAPE_PREDICATES } from "../deployment-shape.js";
+const FACE_ASSEMBLED = {
+    toolPolicy: () => true,
+    mcp: (facts) => (facts.mcpServers?.servers.length ?? 0) > 0,
+    a2a: (facts) => (facts.a2aPeers?.length ?? 0) > 0,
+    webFetch: (facts) => !DEPLOYMENT_SHAPE_PREDICATES.multiTenant.holds(facts),
+};
+const LOCK_CONFLICTS = {
+    toolPolicy: {
+        face: "toolPolicy",
+        refusal: 'LOCKED_CONFIG_KEYS contains "toolPolicy", which this server cannot arm: it COMPOSES the effective tool policy itself on ' +
             "every leg (deployment approval baseline + the tighten-only governance pass over the sensitive-path guard set), so " +
             "`TaskSpec.toolPolicy` is always present at the engine's prepare door and the lock would refuse EVERY task with " +
             "config.locked_key. The policy is already deployment-owned and no request can loosen it (the fold is deny-wins), so " +
-            "this lock has nothing to guard here — remove it from LOCKED_CONFIG_KEYS.");
-    }
-    if (input.lockedKeys.has("mcp") && input.deploymentMcpConfigured) {
-        throw new Error('LOCKED_CONFIG_KEYS contains "mcp" while this deployment configures MCP servers of its own (scenario/center MCP): the ' +
+            "this lock has nothing to guard here — remove it from LOCKED_CONFIG_KEYS.",
+    },
+    mcp: {
+        face: "mcp",
+        refusal: 'LOCKED_CONFIG_KEYS contains "mcp" while this deployment configures MCP servers of its own (config.d/mcp.json or the center\'s mcp domain): the ' +
             "deployment's servers ride the SAME `TaskSpec.mcp` field the lock guards (the engine has no deployment-level MCP seat), " +
             "so every task would be refused at prepare with config.locked_key. Either drop the `mcp` lock, or remove the configured " +
-            "MCP servers — a locked deployment mounts no MCP at all.");
-    }
-}
-export function assertGovernanceAssemblable(input) {
-    assertLockAssemblable({ lockedKeys: input.lockedKeys, deploymentMcpConfigured: input.deploymentMcpConfigured });
-    if (input.complianceDenies.has("mcp_servers") && input.deploymentMcpConfigured) {
-        throw new Error('the compliance posture denies "mcp_servers" while this deployment configures MCP servers of its own: the engine REFUSES ' +
+            "MCP servers — a locked deployment mounts no MCP at all.",
+    },
+    a2a: {
+        face: "a2a",
+        refusal: 'LOCKED_CONFIG_KEYS contains "a2a" while this deployment configures A2A peers of its own (the center\'s a2a domain): the ' +
+            "deployment's peers ride the SAME `TaskSpec.a2a` field the lock guards (the engine has no deployment-level A2A peer seat), " +
+            "so every task would be refused at prepare with config.locked_key. Either drop the `a2a` lock, or remove the configured " +
+            "A2A peers — a locked deployment dials no A2A peer at all.",
+    },
+    compliancePosture: null,
+    retentionPolicy: null,
+};
+const DENY_CONFLICTS = {
+    mcp_servers: {
+        face: "mcp",
+        refusal: 'the compliance posture denies "mcp_servers" while this deployment configures MCP servers of its own: the engine REFUSES ' +
             "(not silently narrows) every prepare whose TaskSpec.mcp is non-empty, so every task would fail with config.compliance_denied. " +
-            "Remove the configured MCP servers, or drop mcp_servers from the posture.");
-    }
-    if (input.complianceDenies.has("web_fetch") && input.webFetchMounted) {
-        throw new Error('the compliance posture denies "web_fetch" while this deployment mounts the WebFetch tool: the engine REFUSES every prepare ' +
+            "Remove the configured MCP servers, or drop mcp_servers from the posture.",
+    },
+    a2a_peers: {
+        face: "a2a",
+        refusal: 'the compliance posture denies "a2a_peers" while this deployment configures A2A peers of its own: the engine REFUSES ' +
+            "(not silently narrows) every prepare whose TaskSpec.a2a is non-empty, so every task would fail with config.compliance_denied. " +
+            "Remove the configured A2A peers, or drop a2a_peers from the posture.",
+    },
+    web_fetch: {
+        face: "webFetch",
+        refusal: 'the compliance posture denies "web_fetch" while this deployment mounts the WebFetch tool: the engine REFUSES every prepare ' +
             "whose roster carries it, so every task on the default roster would fail with config.compliance_denied. This server drops " +
             "WebFetch from the roster only on a MULTI-TENANT deployment (REQUIRE_PRINCIPAL=true) — a single-user deployment cannot " +
-            "currently honor a web_fetch denial. Run the posture multi-tenant, or drop the profile/deny.");
-    }
+            "currently honor a web_fetch denial. Run the posture multi-tenant, or drop the profile/deny.",
+    },
+    workflows: null,
+    org_memory_mount: null,
+};
+function resolveGovernanceDeclarations(config) {
+    return {
+        lockedKeys: resolveLockedKeys(config.lockedConfigKeys !== undefined ? { keys: config.lockedConfigKeys } : undefined),
+        complianceDenies: config.compliancePosture !== undefined ? resolveComplianceDenies(config.compliancePosture) : new Set(),
+    };
+}
+export function assertGovernanceAssemblable(facts) {
+    const { lockedKeys, complianceDenies } = resolveGovernanceDeclarations(facts);
+    const conflicts = [...[...lockedKeys].map((key) => LOCK_CONFLICTS[key]), ...[...complianceDenies].map((cap) => DENY_CONFLICTS[cap])];
+    for (const conflict of conflicts)
+        if (conflict !== null && FACE_ASSEMBLED[conflict.face](facts))
+            throw new Error(conflict.refusal);
 }
 export function createGovernanceSeams(ctx) {
     const { config, logger, retentionStores } = ctx;
-    const lockedKeys = resolveLockedKeys(config.lockedConfigKeys !== undefined ? { keys: config.lockedConfigKeys } : undefined);
+    const { lockedKeys, complianceDenies } = resolveGovernanceDeclarations(config);
     const posture = config.compliancePosture;
-    const complianceDenies = posture !== undefined ? resolveComplianceDenies(posture) : new Set();
-    assertGovernanceAssemblable({
-        lockedKeys,
-        complianceDenies,
-        deploymentMcpConfigured: (config.mcpServers?.servers.length ?? 0) > 0,
-        webFetchMounted: config.requirePrincipal !== true,
-    });
     const lockedConfig = config.lockedConfigKeys !== undefined && config.lockedConfigKeys.length > 0 ? { keys: config.lockedConfigKeys } : undefined;
     if (lockedConfig)
         logger.info("locked_config_enabled", { keys: [...lockedKeys].sort() });

package/dist/boot/late-binds.d.ts

@@ -1,5 +1,5 @@
 /**
- * 晚绑席([ref] 十段切分的**唯一**跨段可变面)—— 四只 cell,读点在前段、写点在后段。
+ * 晚绑席([ref] 十段切分的**唯一**跨段可变面)—— 五只 cell,读点在前段、写点在后段。
  *
  * 为什么是模块级 live binding 而不是 ctx 字段:读点的原文是**裸标识符**(`() => runStore`、
  * `() => parkedAskRedeem`),而 ctx 字段是**快照** —— 把读点改成 `ctx.runStore` 就是正文改写,
@@ -8,9 +8,10 @@
  *  · `runStore` / `rateLimiter` —— 声明行留在第 7 段原位,紧随一行 `bindX(...)` 把值交过来;
  *  · `parkedAskRedeem` / `runDenySweep` —— 它们的**声明行本身**就是 `let`(逐字搬进本文件,含缩进),
  *    赋值点(server 造出来之后那两处)也随之搬进 `bindServerLateSeats` —— 跨模块给 import 赋值是非法的,
- *    所以 cell 与它的写点必须同居一个模块。
+ *    所以 cell 与它的写点必须同居一个模块;
+ *  · `sessionNotifyDoor` —— 同上一形(server 的产物,写点在 `bindServerLateSeats`)。
  *
- * 时序与修前逐字相同:四只 cell 的读点全是 `() => x` 取值闭包(boot 期不求值,最早的求值发生在
+ * 时序与修前逐字相同:五只 cell 的读点全是 `() => x` 取值闭包(boot 期不求值,最早的求值发生在
  * listen 之后的请求/tick 上),写点仍在各自原来的那一拍。未绑窗内取值得到 `undefined` —— 这正是
  * 各消费座既有的 fail-closed 臂(device 限速座:`gate()` 取不到就抛,见 boot/device-lane.ts:68)。
  */
@@ -20,11 +21,13 @@ import type { RateGate } from "../observability/rate-limit.js";
 import type { ServiceConfig } from "../config.js";
 import type { StoreBackend } from "../plugins/store-backend.js";
 import type { createHttpServer } from "../http/server.js";
+import type { SessionNotifyDoor } from "../session-notify-door.js";
 declare let runStore: ReturnType<StoreBackend["run"]> | undefined;
 declare let rateLimiter: RateGate | undefined;
 declare let parkedAskRedeem: ParkedAskRedeem | undefined;
 declare let runDenySweep: ((now: number) => Promise<void>) | undefined;
-export { runStore, rateLimiter, parkedAskRedeem, runDenySweep };
+declare let sessionNotifyDoor: SessionNotifyDoor | undefined;
+export { runStore, rateLimiter, parkedAskRedeem, runDenySweep, sessionNotifyDoor };
 export declare function bindRunStore(v: ReturnType<StoreBackend["run"]> | undefined): void;
 export declare function bindRateLimiter(v: RateGate): void;
 export declare function bindServerLateSeats(ctx: {

package/dist/boot/late-binds.js

@@ -2,7 +2,8 @@ let runStore;
 let rateLimiter;
 let parkedAskRedeem;
 let runDenySweep;
-export { runStore, rateLimiter, parkedAskRedeem, runDenySweep };
+let sessionNotifyDoor;
+export { runStore, rateLimiter, parkedAskRedeem, runDenySweep, sessionNotifyDoor };
 export function bindRunStore(v) {
     runStore = v;
 }
@@ -12,6 +13,7 @@ export function bindRateLimiter(v) {
 export function bindServerLateSeats(ctx) {
     const { config, logger, server } = ctx;
     runDenySweep = server.denyExpiredApprovals;
+    sessionNotifyDoor = server.sessionNotifyDoor;
     if (!config.directDoorActive)
         parkedAskRedeem = server.redeemParkedAsk;
     else

package/dist/boot/leader.js

@@ -45,7 +45,7 @@ export function createLeaderFace(ctx) {
             (leaderProvider === "k8s" && "s3" in leaderMinio && executionEnvFactory) ||
             (leaderProvider === "host" && executionEnvFactory))
         ? createLeaderEndpoint(createLeaderRunner({
-            brain, models: config.models, roles: config.roles, pricing, logger,
+            brain, models: config.models, roles: config.roles, tiers: config.tiers, pricing, logger,
             governance: {
                 compliancePostureResolver: governanceSeams.compliancePostureResolver,
                 lockedConfig: governanceSeams.lockedConfig,
@@ -61,9 +61,7 @@ export function createLeaderFace(ctx) {
             ...(ctx.onError ? { onError: ctx.onError } : {}),
             mods: ctx.deploymentMods,
             fanoutEnabled: config.leaderFanoutEnabled,
-            ...((process.env.MODEL_ROUTER_ID || process.env.MODEL_CHEAP_ID)
-                ? { routerModel: (process.env.MODEL_ROUTER_ID || process.env.MODEL_CHEAP_ID) }
-                : {}),
+            ...(process.env.MODEL_ROUTER_ID ? { routerModel: process.env.MODEL_ROUTER_ID } : {}),
             ...(leaderProvider === "e2b" ? { e2bApiKey: config.remoteExec.apiKey } : {}),
             ...(executionEnvFactory ? { envFactory: executionEnvFactory } : {}),
             ...leaderMinio,

package/dist/boot/memory-consolidation.d.ts

@@ -1,6 +1,5 @@
 import { type LaneHomeDeployment } from "../execution-lane-caps.js";
 import { type MemoryScopeStores } from "../memory-scope-stores.js";
-import type { SessionCaptureRecordSource } from "../plugins/store-backend.js";
 import type { RestartSliceCtx } from "../web-admin-client/restart-signal.js";
 import type { MemoryConsolidationDriverConfig, ServiceConfig } from "../config-types.js";
 import { resolveMemoryConsolidationDriver, type ConsolidationWriteJudge, type ConsolidationWriteJudgeInput, type EngineNotice, type ConsolidationDriverRunRow, type ConsolidationRunReceipt, type MemoryConsolidationDriverDeps, type PermissionRuleStoreProvider } from "@sema-agent/core";
@@ -500,13 +499,6 @@ export declare function createMemoryConsolidationFaces(stores: MemoryScopeStores
     /** 停因自由文本的**运维日志**座(缺席 = 没人听,不影响任何行为)。载荷由 {@link buildStopDetailAudit}
      *  铸,调用点在单飞回调**之内** ⇒ 一轮真 run 一行,并入的等待者不各落一行。 */
     onStopDetail?: (audit: ReturnType<typeof buildStopDetailAudit>) => void;
-    /** [ref]②(383 §2.1b):capture opt-out 记录的按平面取用源(main.ts 取一次,与 Runner 同源;每只引擎按它那只店的控制面取)。
-     *  🔴 这只引擎是四只 operator 面里**真读名册**的那只:`consolidationEligibility` 第四臂
-     *  (engine.js `listCaptureOptOutSessions`)拿它筛掉 opt-out 会话的贡献条目 —— SQL 部署上漏喂
-     *  = 驱动器读文件空名册 ⇒ 蒸馏器放大用户明说不要记的内容(S-5 真实失效形;全站同批注入律,
-     *  机器钉 capture-optout-lane ②)。[ref] 起 local 车道在引擎接线时也供(core 文件三腿,同一只控制面);
-     *  缺席 ⇒ 记忆面暗(引擎未接线),与 Runner 同本。 */
-    captureRecords?: SessionCaptureRecordSource;
     /** core 7.50.0:整理跑的**写判官座**(必填 —— 缺席不是「没有规则」,core 也拒)。操作面不判任何东西,只把它原样递给驱动动词:
      *  早问库目录一次、应用时问每个产物文件,答 `no_objection` 以外一律拒写。装配层给哪一只见 {@link createOperatorValveWriteJudge}。 */
     writeJudge: ConsolidationWriteJudge;

package/dist/boot/memory-consolidation.js

@@ -4,8 +4,8 @@ import { buildOperatorRosterWayOut } from "../http/principal-gate.js";
 import { memoryMountRootOf } from "../memory-scope.js";
 import { executionLaneHomeDir } from "../execution-lane-caps.js";
 import { DEFAULT_MODEL_REF, resolveMainModel } from "../model-select.js";
-import { backendOwnsControlPlane, captureRecordStoreOf } from "../memory-operator-faces.js";
-import { memoryStoreForRequest } from "../memory-scope-stores.js";
+import { captureRecordStoreOf } from "../memory-operator-faces.js";
+import { backendOwnsControlPlane, memoryStoreForRequest } from "../memory-scope-stores.js";
 import { createConsolidationWriteJudge, deliverWriteRefusal, expandTiers, MemoryEngine, modelOriginOf, readConsolidationDriverRun, resolveMemoryConsolidationDriver, runMemoryConsolidationDriver, } from "@sema-agent/core";
 import { seatText } from "../trace/exit-seat.js";
 export function resolveConsolidationDriverSeat(deps) {
@@ -342,7 +342,7 @@ export function createMemoryConsolidationFaces(stores, input) {
         const known = engines.get(store);
         if (known !== undefined)
             return known;
-        const records = captureRecordStoreOf(input.captureRecords, store);
+        const records = captureRecordStoreOf(stores.captureRecords, store);
         const engine = new MemoryEngine({
             backend: store,
             memoryDir: memoryMountRootOf(store, stores.root),

package/dist/boot/reapers.js

@@ -91,7 +91,7 @@ export function startReapers(ctx) {
     const runDenySweepGuard = createThrottledReaperCatch("run_deny_sweep", logger);
     const runsReapSuspendedGuard = createThrottledReaperCatch("runs_reap_suspended", logger);
     const checkpointReapCtxGuard = createThrottledReaperCatch("checkpoint_reap_ctx", logger);
-    const toolResultReapOlderThanGuard = createThrottledReaperCatch("tool_result_reap_older_than", logger);
+    const toolResultReapGuard = createThrottledReaperCatch("tool_result_reap", logger);
     const fileHistorySweepOrphanBlobsGuard = createThrottledReaperCatch("file_history_sweep_orphan_blobs", logger);
     const legacySnapshotBlobSweepGuard = createThrottledReaperCatch("legacy_snapshot_blob_sweep", logger);
     const attachmentReapUnboundGuard = createThrottledReaperCatch("attachment_reap_unbound", logger);
@@ -244,9 +244,10 @@ export function startReapers(ctx) {
         rateLimiter?.sweep();
         if (costQuota instanceof CostQuota)
             costQuota.reap();
-        leg(toolResultStore
-            ?.reapOlderThan?.(Date.now() - config.toolResultTtlSec * 1000)
-            ?.then(() => toolResultReapOlderThanGuard.onSuccess(), toolResultReapOlderThanGuard.onError));
+        const reapToolResults = toolResultStore?.reap?.bind(toolResultStore);
+        leg(reapToolResults && Promise.resolve()
+            .then(() => reapToolResults(Date.now(), { maxAgeMs: config.toolResultTtlSec * 1000 }))
+            .then(() => toolResultReapGuard.onSuccess(), toolResultReapGuard.onError));
         leg(fileHistoryErasure
             ?.sweepOrphanBlobs?.()
             .then(() => fileHistorySweepOrphanBlobsGuard.onSuccess(), fileHistorySweepOrphanBlobsGuard.onError));

package/dist/boot/resolve-spec.d.ts

@@ -1,7 +1,7 @@
 import { SessionEnvironmentSelection, selectEnvironmentTool } from "../capabilities/select-environment-tool.js";
 import { sendUserFileTool } from "../capabilities/send-user-file-tool.js";
 import { selectScenario } from "../capabilities/scenarios.js";
-import { type LoadedSkill } from "../capabilities/skills.js";
+import type { LoadedSkill } from "../capabilities/skills.js";
 import type { ServiceConfig } from "../config.js";
 import { type LiveQuestionFace } from "../deployment-governance.js";
 import { FleetEventBus } from "../fleet/fleet-bus.js";

package/dist/boot/resolve-spec.js

@@ -6,8 +6,8 @@ import { recordFailOpen } from "../observability/fail-open.js";
 import { SessionEnvironmentSelection, selectEnvironmentTool } from "../capabilities/select-environment-tool.js";
 import { sendUserFileTool } from "../capabilities/send-user-file-tool.js";
 import { buildExcludeToolsSeat, buildPromptSeats, buildRunSkills, createScenarioGate, selectScenario } from "../capabilities/scenarios.js";
-import { stampRunSkills } from "../capabilities/skills.js";
-import { stampHandsLane, toolPolicyForHands } from "../capabilities/hands-lane.js";
+import { toolPolicyForHands } from "../capabilities/hands-lane.js";
+import { mintLegFacts } from "../leg-facts.js";
 import { applyLongtailDefer } from "../capabilities/tool-defer.js";
 import { assertGuardPatternsUsable, buildApprovalGrantNotice, buildOnlySensitiveBaselineWarning, createApprovalBaselinePolicy, createDeploymentGovernanceInputs } from "../deployment-governance.js";
 import { createDeploymentListExemption, gateIntentUnserviceableReason, singleUserAutoAcceptBaselineApplies } from "../approval.js";
@@ -28,7 +28,7 @@ import { tightenGoverned } from "../governance-overrides.js";
 import { applyRuntimeGovernance } from "../runtime-governance.js";
 import { HttpError, createCodedHttpError, encodeCheckpointScope } from "../security.js";
 import { headReadOf, sessionFaceOfHead } from "../session-incarnation.js";
-import { legProjectIdOf, sessionWorkspaceStoreOf, stampLegSessionWitness } from "../session-workspace.js";
+import { legProjectIdOf, sessionWorkspaceStoreOf } from "../session-workspace.js";
 import { memorySpecForRequest } from "../memory-scope.js";
 import { createMemoryProjectLayers } from "../memory-project-layer.js";
 import { inheritEnvFacts, inheritEnvFieldIssue, singleMemberOffFieldIssue } from "../request-value-closure.js";
@@ -177,13 +177,13 @@ export function createResolveSpec(ctx) {
             scratchpadDir: folded.scratchpadDir,
             hostSemanticsLane: folded.hostSemanticsLane,
         });
-        const stamped = stampHandsLane(final, gated.hands);
-        return stampLegSessionWitness(stampRunSkills(stamped, runSkills.roster), gated.sessionWitness);
+        return { spec: final, facts: { hands: gated.hands, skills: runSkills.roster, sessionWitness: gated.sessionWitness } };
     };
     const gateScenarioAndAppend = async (body, auth, opts) => {
         const scenarioName = await scenarioGate(auth?.principal, body.scenario);
         const root = opts.execution.root;
-        const sessionWitness = { sessionId: root, incarnation: (sessionHeadOf === undefined ? undefined : sessionFaceOfHead(root, await sessionHeadOf(root)))?.incarnation ?? null };
+        const rootFace = sessionHeadOf === undefined ? undefined : sessionFaceOfHead(root, await sessionHeadOf(root));
+        const sessionWitness = { sessionId: root, owner: rootFace?.owner ?? null, incarnation: rootFace?.incarnation ?? null };
         const cap = selectScenario(scenarios, scenarioName)(body, auth?.principal, { sessionId: sessionWitness.sessionId, delegationRoot: sessionWitness });
         const acceptedAppend = acceptAppendSystemPrompt(body.appendSystemPrompt, (detail) => logger.warn("append_system_prompt_dropped", { detail, sessionId: auth?.sessionId ?? null }));
         const objective = typeof body.objective === "string" ? body.objective : "";
@@ -680,8 +680,8 @@ export function createResolveSpec(ctx) {
         return governed;
     };
     const resolveSpecForLeg = async (body, req, auth, opts) => {
-        const spec = await resolveSpec(body, req, auth, opts);
-        return unrooted(opts.unattendedLeg !== true ? spec : withUnattendedLeg(spec));
+        const { spec, facts } = await resolveSpec(body, req, auth, opts);
+        return mintLegFacts(unrooted(opts.unattendedLeg !== true ? spec : withUnattendedLeg(spec)), facts);
     };
     return resolveSpecForLeg;
 }

package/dist/boot/runner-deps.d.ts

@@ -7,7 +7,7 @@
  * ⚠️ **位置即契约**:必须晚于 stores/exec-env/coordinators/workflow 段(所有键都是它们的产物),
  * 且早于 `new Runner(runnerDeps)` —— Runner 构造时展开 tier 表成私有目录副本(之后的换代经
  * `Runner.swapDeps` 换进,见 boot/stage-08-reapers.ts)。
- * `getRunStore()` 是唯一的晚绑取值(runStore 在本段之后才构造),原文靠同作用域前向引用。
+ * runStore 在本段之后才构造 ⇒ 本段不读它(本段没有晚绑取值)。
  */
 import { type CacheBreakFinding, type CrossBoundaryPosture, type RunnerDeps, type WorkflowRunStore, type AskOutcome } from "@sema-agent/core";
 import type { createBrain } from "../brain.js";
@@ -19,13 +19,13 @@ import type { Logger } from "../observability/logger.js";
 import type { Metrics } from "../observability/metrics.js";
 import { type ConsolidationDriverSeat } from "./memory-consolidation.js";
 import { WorkflowAgentRegistry } from "../orchestration/workflow-agent-steer.js";
-import { type WorkflowCompletionInbox } from "../orchestration/workflow-completion-inbox.js";
 import { type EngineNoticeRouter } from "../trace/engine-notice-wire.js";
 import { WorkflowNotifyGate, type WorkflowCompletionPayload } from "../orchestration/workflow-notify-journal.js";
 import type { ServiceWorkflowJournalStore, SessionCaptureRecordSource, StoreBackend, ToolResultStoreFull } from "../plugins/store-backend.js";
 import type { createSessionStore } from "../plugins/session-store.js";
 import type { QuestionCoordinator } from "../question.js";
 import type { ToolApprovalCoordinator } from "../tool-approval.js";
+import { type PeerInboundFace } from "../peer-inbound-face.js";
 import type { MemoryBackend } from "@sema-agent/core";
 import type { MemorySyncRunner } from "../memory-sync-client.js";
 import type { MailboxRecipientLifecycle } from "../plugins/mailbox-recipient-lifecycle.js";
@@ -68,7 +68,10 @@ export declare function createRunnerDepsOnAsk(toolApproval: ToolApprovalCoordina
  *  `classificationKnown:false`(指标标签折 `unknown`),不吞不编;与安装包的锁步由 test/boot-runner-deps-shared-base.test.ts
  *  的 dist 扫描格钉住(两种发射写法都读;读不出词的经变量发射点本身红;core 加词/收进 d.ts 那天先红)。
  *  第七词 `peer-seat-hold`(runtask 的 `holdDeclarations`,字面量):对端座的三员对象里 `hold` / `release` 抛了 ⇒ 引擎报一次、该引用
- *  不被持有;座是本仓的 desk,所以这是部署自己的故障,与其余六词同走 warn + 计数。 */
+ *  不被持有;座是本仓的 desk,所以这是部署自己的故障,与其余六词同走 warn + 计数。
+ *  第八词 `input-author-unreadable`(core 7.61.0 `run-leg.js` 的 `objectiveAuthorOf` 回调,字面量):宿主经 `RunInternals.objectiveAuthor`
+ *  递了一个不在 `INPUT_AUTHORS` 里的词 ⇒ 引擎报一次、该目标按操作者的输入筛。本服务不递这个字段(src 零读写),只有嵌入方手铸时才发射,
+ *  仍是部署侧的故障,同走 warn + 计数。 */
 export declare const CONFIG_ADVISORY_CLASSIFICATIONS: ReadonlySet<string>;
 /** [ref]:core 的 [ref] 前缀缓存**断裂**探测器交给宿主的根因**闭集**,以及每个词的日志级别。
  *  闭集**不抄词**:词源直接取 core 公开导出的 `CacheBreakFinding["cause"]`(`@sema-agent/core` 根导出,
@@ -240,10 +243,7 @@ export interface RunnerDepsCtx {
     workflowJournalStore: ServiceWorkflowJournalStore | undefined;
     workflowAgentRegistry: WorkflowAgentRegistry | undefined;
     workflowNotifyGate: WorkflowNotifyGate | undefined;
-    workflowCompletionInbox: WorkflowCompletionInbox | undefined;
     deliverWorkflowCompletion: (p: WorkflowCompletionPayload) => Promise<void>;
-    /** 晚绑(runStore 在本段之后构造)——见文件头「位置即契约」。 */
-    getRunStore: () => ReturnType<StoreBackend["run"]> | undefined;
 }
 /** [ref] A10 留档发现②:main runner `RunnerDeps` 与 main.ts subRunner 字面量之间此前手工重复
  * 的 ~15 个键,类型标注见 {@link createSharedRunnerDeps} 头注。 */
@@ -281,7 +281,10 @@ export interface EngineNoticeMetricsSeat {
 }
 export declare function createEngineNoticeForwarder(logger: {
     warn: (msg: string, fields?: Record<string, unknown>) => void;
-}, router?: EngineNoticeRouter, metrics?: EngineNoticeMetricsSeat): NonNullable<RunnerDeps["onNotice"]>;
+}, router?: EngineNoticeRouter, metrics?: EngineNoticeMetricsSeat, 
+/** [ref]:收信方决断面的坐标表(进程单例,与 core 的 held 队列注册表同寿命;它只读两条 peer 通告的坐标,见 `peer-inbound-face.ts`)。
+ *  默认值与 `router` 同一条理由:装配点多,必填会让「新车道忘了传」变成被扣的信静默不列。 */
+peerInbound?: Pick<PeerInboundFace, "observe">): NonNullable<RunnerDeps["onNotice"]>;
 /**
  * `onNotice` **席**的装配判据本身 —— 「`warn` 真在场才铸席」这一条从此是**一个可直接调用的函数**,
  * 不是散在装配点、只能靠扫源码文本去猜的一行三元(codex 交叉复审 R1-[medium],验真后修)。