@sema-agent/server 7.142.0 → 7.144.0

package/dist/http/route-ctx.d.ts

@@ -18,6 +18,7 @@ import type { IncomingMessage, ServerResponse } from "node:http";
 import type { HostDecision } from "../host-decision.js";
 import type { EntryProblem } from "../entry-problems.js";
 import type { SessionOwnerCell } from "../security.js";
+import type { SessionNotifyDoor } from "../session-notify-door.js";
 import type { TaskStream, TaskSpec, TaskResult, QuestionAnswer, Checkpoint, CheckpointToken, ResumeOutcome, RunInternals, Runner, EngineNotice } from "@sema-agent/core";
 import type { FlatServiceDeps, RequestAuth } from "./server.js";
 import type { TaskRequestBody, DecideBinding } from "./wire-types.js";
@@ -34,6 +35,7 @@ import type { RunIdentity } from "../identity-source.js";
 import type { PeerLease } from "../peer-seat.js";
 import type { RootedTaskSpec } from "./execution-context.js";
 import type { GateCommitment, GateSettlementEvidence } from "../gate-settlement.js";
+import type { ResumeRestatement } from "./resume-restatement.js";
 /** 跨域可变状态 = lens1 §C2 实测的那 8 条「运行期登记簿」,一个对象。
  *  [ref]:`cancelledViaVerb`(按 taskId 键控的「这次是取消动词」旁表)删除 —— 中止成因改挂在每条腿自己的
  *  {@link RunAbort} 句柄上(`inflightRuns` 的值),同寿同删,不再有一张与腿不同寿的旁表。 */
@@ -123,6 +125,11 @@ export interface PreparedTaskSubmission {
     /** [ref]:本次提交的执行 Runner —— 场景 hands=none 时是无手孪生(不挂 executionEnvFactory)。
      *  两个消费域一律用它,不再直接摸 `deps.runner`(那正是「场景表态了、执行点没听」的缝)。 */
     runner: Runner;
+    /**
+     * 这条腿的**部署事实**(执行车道 · run 技能名册 · 受理见证;`leg-facts.ts`):漏斗在复制之前按装配输出读出的那一份,此后作普通值走 ——
+     * 不在 spec 上(引擎的 TaskSpec 一读门拒任何非引擎成员)。缺席 = 嵌入方自带的装配器没铸(名册段 / 会话行记录座随之缺席;车道已在选路时响亮拒)。
+     */
+    legFacts: import("../leg-facts.js").LegFacts | undefined;
     /** authorizer 交出的身份与根(必填席,恒在;续跑家族的内部车道交它从 checkpoint 重建的那一只)。 */
     auth: RequestAuth;
     verify?: VerifyRoundsSpec;
@@ -257,9 +264,10 @@ export interface DriveResumeArgs {
      *
      * 🔴 写失败**响亮但不致命**(codex r1 两条 [high] 验真后定):core 的 `resumeStream` 是 **EAGER** 的 ——
      * 写点这一拍 run 已经在执行,裸抛会把一条活腿判成 failed + 释放 claim 而执行还在继续。⇒ 一个臂、
-     * 四条腿同守:计数 `resume_ctx_not_persisted_total` + 一行 warn,本次续跑照常。方向论证(不是 [ref] 的
-     * 静默放宽):写失败 ⇒ 耐久体保持**上一次**的值,而这四条腿里只有 `drivePlanReview` 改写这个体、
-     * 且只会**放宽** ⇒ 落盘的恒不比本次续跑更宽。旧的 `plan_approve_mode_not_persisted`(plan 专用)随本批删除,
+     * 四条腿同守:计数 `resume_ctx_not_persisted_total` + 一行 warn,本次续跑照常。写失败 ⇒ 耐久体保持**上一次**的值:
+     * 模式词那一格(`drivePlanReview` 只会放宽)落盘的恒不比本次续跑更宽;续跑请求的重述键(`resume-restatement.ts`)
+     * 可能收窄对端表,写失败时落盘的仍是上一份表 ⇒ 下一次**不带重述**的续跑按上一份重建 —— 这一形是收不紧的,所以
+     * 那一行 warn 如实点名它(响亮,不静默)。旧的 `plan_approve_mode_not_persisted`(plan 专用)随 [ref] 删除,
      * 由上面这只家族级的取代。全文见 `resume-legs.ts` 的 `commitResumeCtx` 顶注。
      */
     resumeCtx: {
@@ -274,6 +282,8 @@ export interface DriveResumeArgs {
     /** [ref]:续跑腿的执行 Runner。resume 会用同一条 resolveSpec 重解析场景,故与首跑选同一只 —— 否则
      *  一次续跑就把手带 band 重新 mount 回来(收窄只在首跑成立 = 没成立)。 */
     runner: Runner;
+    /** 这条腿的部署事实(`leg-facts.ts`):续跑漏斗在复制之前读出的那一份(与 {@link PreparedTaskSubmission.legFacts} 同一律)。读者 = 本腿的 `wiring_manifest.skills` 段与会话行记录座。 */
+    legFacts: import("../leg-facts.js").LegFacts | undefined;
     sessionId: string;
     principal: string | undefined;
     fleetScope: string;
@@ -418,7 +428,7 @@ export interface RouteLegs {
     /** [ref] 件C:**腿身份**(不是能力表态)。`liveStream: true` 只由 `POST /v1/tasks/stream` 的装配点按
      *  URL 传 —— 那是全树唯一挂 HITL 活流投递面的腿,逐腿 `interactionPosture` 判据的第一条合取项。
      *  缺席 ⇒ 无人腿(bg / A2A / resume),行为字节不变。 */
-    legFacts?: {
+    legRoute?: {
         liveStream?: boolean;
     }): Promise<PreparedTaskSubmission | null>;
     /** 同步腿的终局记账(计费/配额/指标),tasks 域用。 */
@@ -429,7 +439,10 @@ export interface RouteLegs {
      *  「漏报出处」变成编译错,不是一条下游把「没人答」渲染成「有人拒」的静默假出处。
      *  🔴 [ref](core 7.6.0 S6-A):宿主报事实、core 铸词 —— server 不再传结算词(旧形传 core 的三词之一,
      *  于是「哪个词配哪个 decision」这条相容规则要 server 自己记,而记错的方向恰是上面那句要防的)。 */
-    resumeCheckpoint(sessionId: string, decision: "approve" | "deny", reason: string | undefined, hostDecision: HostDecision, req?: IncomingMessage, answer?: QuestionAnswer, binding?: DecideBinding, 
+    resumeCheckpoint(sessionId: string, decision: "approve" | "deny", reason: string | undefined, hostDecision: HostDecision, req: IncomingMessage | undefined, answer: QuestionAnswer | undefined, 
+    /** 这次决定落在哪一个动作上:调用方点名它看到的那一对(`boundCallId` + `boundInputHash`);缺任一 ⇒ 400 `decide_requires_binding`
+     *  (判在门型守卫之后,判官 `decidedActionOf`)。本函数从不拿当前停驻行补。 */
+    binding: DecideBinding, 
     /** [ref] codex R4(验真后修):remember 豁免的 grant 挂点。**工具名不再由路由自己读**(那是与本函数
      *  载入行分歧的第三次 scope-less 读,三读分歧下会给他人工具落豁免=提权)——由本函数把**已属主校验的
      *  载入 cp** 的可记工具名(`rememberableToolName`,非 tool_approval / AskUserQuestion / legacy null / [ref] 强制卡 ⇒ `null`
@@ -446,7 +459,9 @@ export interface RouteLegs {
     decider?: {
         principal?: string;
         explicitOperator: boolean;
-    }): Promise<ResumeLegOutcome>;
+    }, 
+    /** 续跑请求的重述键(`mcpServers` / `a2aPeers`),门读出并判过的那一份;缺席 = 冻结读法。语义属主 = `resume-restatement.ts` 顶注。 */
+    restatement?: ResumeRestatement): Promise<ResumeLegOutcome>;
     /** 全 resume 家族的共同下半场(lease admission + 写 run log + fleet 发布)。 */
     driveResumeIntoRunLog(args: DriveResumeArgs): Promise<ResumeLegOutcome>;
     /** assistant 抢占腿的复位(gate-kind 守卫 + 行级属主复核 + 驱动)。 */
@@ -458,7 +473,9 @@ export interface RouteLegs {
     decider?: {
         principal?: string;
         explicitOperator: boolean;
-    }): Promise<ResumeLegOutcome>;
+    }, 
+    /** 续跑请求的重述键(同 {@link RouteLegs.resumeCheckpoint} 末参)。 */
+    restatement?: ResumeRestatement): Promise<ResumeLegOutcome>;
     /** notify-wake 域:唤醒一条 parked checkpoint。 */
     resumeWake(sessionId: string, message: string | undefined, caller: string | undefined, req: IncomingMessage | undefined, 
     /** [ref] 件 S-1:透传给 {@link DriveResumeArgs.acceptEarly}(200 受理语义)。HTTP `/wake` 腿传 `true`
@@ -466,7 +483,11 @@ export interface RouteLegs {
     acceptEarly?: boolean, 
     /** 透传给 {@link DriveResumeArgs.workflowDecision}。HTTP `/wake` 腿**不设**此位 —— 它是 `/decide` 第三条车道投递腿的专用席,
      *  而两条腿共用这一条驱动路径正是 `notify-wake.ts` 那条「wake 会烧模型,所以复用 resume 家族的同一条腿」的成文纪律。 */
-    workflowDecision?: WorkflowDecisionDelivery): Promise<ResumeLegOutcome>;
+    workflowDecision?: WorkflowDecisionDelivery, 
+    /** 付费方身份(`/decide` workflow 车道专用;HTTP `/wake` 腿不设)。语义属主 = `resume-legs.ts` 同名形参顶注。 */
+    ownerLeaseAdmittedFor?: string, 
+    /** 续跑请求的重述键(同 {@link RouteLegs.resumeCheckpoint} 末参)。 */
+    restatement?: ResumeRestatement): Promise<ResumeLegOutcome>;
     /**
      * assistant plan_review 三态腿的**纯读段**([ref],7.97.0):选卡 → 属主轻读 → 载入 → 行级 scope → 门类 → 这条决断
      * 唯一的一次 ctx 读。任何一步拒 ⇒ `{ok:false, answer}`(不改任何状态;端点在消费一次性 nonce **之前**把它答出去);
@@ -503,7 +524,11 @@ export interface RouteLegs {
     acceptEarly?: boolean, 
     /** [ref]:批准之后这条会话继续用的 permission mode(闭集 `PLAN_APPROVE_PERMISSION_MODES_AFTER`;只在把计划带出 plan 的决定
      *  —— `approve` / `edit` —— 上有意义,缺席 ⇒ `"default"`)。语义与判据的唯一属主 = `resume-legs.ts` 的同名形参顶注。 */
-    permissionModeAfter?: PlanApprovePermissionModeAfter): Promise<ResumeLegOutcome>;
+    permissionModeAfter?: PlanApprovePermissionModeAfter, 
+    /** 续跑请求的重述键(同 {@link RouteLegs.resumeCheckpoint} 末参)。 */
+    restatement?: ResumeRestatement): Promise<ResumeLegOutcome>;
+    /** 会话通知门(`POST /v1/sessions/:id/notify` 与 Runner 之外的后台子代完成共用的那一只;活流登记簿是本服务的,门随服务建一次)。 */
+    sessionNotify: SessionNotifyDoor;
 }
 /**
  * [ref] 件 S-2 —— resume 族**受理点的断连留痕**(裁定:维持 detach,补观察面)。
@@ -729,7 +754,7 @@ export declare const RUN_NOT_FOUND_MESSAGE = "run not found \u2014 the id belong
  * 走一只常量 + `runOwnerOk(..., "session")` 的会话拼法,「改一处」就是改全域。
  */
 export declare const SESSION_NOT_FOUND_MESSAGE = "session not found";
-/** [ref] 前缀=域判别子既成契约:a\* 与 wa\* 形 id 给 TaskOutput/journal 指路;其余给 {@link RUN_NOT_FOUND_MESSAGE}。 */
+/** [ref] 前缀=域判别子既成契约:a\* 与 wa\* 形 id 给任务句柄读腿 / journal 指路;其余给 {@link RUN_NOT_FOUND_MESSAGE}。 */
 export declare function runNotFoundMessage(id: string): string;
 export {};
 //# sourceMappingURL=route-ctx.d.ts.map

package/dist/http/route-ctx.js

@@ -33,7 +33,7 @@ export const SESSION_NOT_FOUND_MESSAGE = "session not found";
 export function runNotFoundMessage(id) {
     const aStar = /^(?:a|wa)[0-9a-f]{4,}$/i.test(id);
     return aStar
-        ? `run not found — "${id}" looks like an agent handle (a*/wa* domain), which is never in the run store; use the TaskOutput tool (or the workflow journal / subagents surface) to read it, and the run's durable taskId (X-Task-Id) for this endpoint`
+        ? `run not found — "${id}" looks like an agent handle (a*/wa* domain), which is never in the run store; read it through its run's task-handle surface (GET /v1/runs/:id/tasks/:handle/output, or the workflow journal / subagents surface), and use the run's durable taskId (X-Task-Id) for this endpoint`
         : RUN_NOT_FOUND_MESSAGE;
 }
 //# sourceMappingURL=route-ctx.js.map

package/dist/http/routes/approvals-assistant.d.ts

@@ -6,6 +6,7 @@ import { type GovernancePosture } from "../../runtime-governance.js";
 import { type GateIntentView } from "../../approval.js";
 import { type RouteCtx, type RouteDecl, type RouteMatch, type RouteIdsOf } from "../route-ctx.js";
 import { type KeyClosureIssue } from "../../request-key-closure.js";
+import { type PeerInboundPendingRow } from "../../peer-inbound-face.js";
 /** 族的成员 = 路由表行 id(改名 / 删行 ⇒ 下表的键当场编译红)。 */
 export type DecisionDoorId = Extract<ApprovalsAssistantRouteId, "approval-decide" | "assistant-task-plan-review">;
 /** 一道门的静态描述 —— 只写**这道门自己**的东西;路径、路径段、别门的键一概不在这里写(从来源读)。 */
@@ -137,7 +138,14 @@ export declare function streamApprovals(req: IncomingMessage, res: ServerRespons
  * 缺席,流的字节与 [ref] 之前逐字相同(能力缺席 = 零变化,不是空数组)。**位置在 `pollMs` 之前**
  * 与 `governance` 同一条理由:`pollMs` 只有测试传,而本参数是每个生产调用点都必须表态的那一个。
  */
-live: Pick<ToolApprovalCoordinator, "listLivePending"> | undefined, scope: string | undefined, 
+live: Pick<ToolApprovalCoordinator, "listLivePending"> | undefined, 
+/**
+ * 🔴 [ref]:`pending` 车道的**第二个半场** —— 被扣的跨会话来信(`peer_inbound` 行),与 `GET /v1/approvals` 的 `pending[]`
+ * **同一只**闭包({@link peerInboundRowsFor},已绑调用方自己的信箱 scope)。与停驻行同一条 delta 车道、同一对事件名
+ * (`pending` / `resolved`):两族同一扇决断口,帧上的 `kind` 判别。`undefined` = 本腿没有这一半场(流字节只差每帧的 `kind`)。
+ * 位置在 `scope` 之前、与 `live` 并列:每个生产调用点都必须表态。
+ */
+peerInbound: (() => readonly PeerInboundPendingRow[]) | undefined, scope: string | undefined, 
 /** [ref]②:出身归因的部署侧一半 + 三张审批名单(问的属主)。缺席 ⇒ 归不出治理出身(键缺席,与 best-effort 同方向)、没有一行读作
  *  部署名单的问(记不住,方向是多问)。**位置在 `pollMs` 之前**是刻意的:`pollMs` 只有测试传,而本参数是每个生产调用点都必须给的那一个。 */
 governance?: PendingProjectionDeployment, pollMs?: number): Promise<void>;

package/dist/http/routes/approvals-assistant.js

@@ -1,6 +1,6 @@
 import { screenedGate } from "../../trace/project.js";
 import { skillCardFacts } from "../../approval-card.js";
-import { hostDecisionFacts, readDecidedBy, retiredDecisionKeyFacts, DECIDED_BY_NOT_IN_PROOF, DECIDED_BY_OUTSIDE_CLOSED_SET } from "../../host-decision.js";
+import { hostDecisionFacts, readDecider, retiredDecisionKeyFacts, DECIDED_BY_NOT_IN_PROOF } from "../../host-decision.js";
 import { sameExecutionRecord } from "@sema-agent/core";
 import { findParkedAgentForCheckpoint } from "../../parked-decide.js";
 import { DECIDED_REPLAY_SCAN_CAP, approvalPayloadFingerprint } from "../../plugins/checkpoint-store-sql.js";
@@ -32,16 +32,29 @@ import { MAX_CHECKPOINT_ID_CHARS, durableRowIdentity } from "../../checkpoint-id
 import { MAX_KEY_ECHO, keyClosureClause, scanKeyClosure } from "../../request-key-closure.js";
 import { fieldConflictFacts } from "../../field-conflict.js";
 import { buildSettlementEvidence, decisionCommittedOf } from "../../gate-settlement.js";
+import { seatText } from "../../trace/exit-seat.js";
+import { approvalQueueKindOfDoorId } from "../../approval-queue-kind.js";
+import { defaultPeerInboundFace, parsePeerInboundId, peerBoxScope } from "../../peer-inbound-face.js";
+import { RESUME_RESTATABLE_KEYS, readResumeRestatement } from "../resume-restatement.js";
 const DECIDE_BODY_DECLARED_KEYS = [
-    "answer", "boundCallId", "boundInputHash", "checkpointToken", "decidedBy", "decision", "feedback", "reason", "remember", "updatedInput",
+    "answer", "boundCallId", "boundInputHash", "checkpointToken", "decidedBy", "decidedVia", "decision", "feedback", "reason", "remember", "updatedInput",
+    ...RESUME_RESTATABLE_KEYS,
 ];
 const DECIDE_PROOF_COVERED_KEYS = ["answer", "boundCallId", "boundInputHash", "decision", "reason"];
-const DECIDE_NOT_IN_PROOF_KEYS = ["checkpointToken", "decidedBy", "feedback", "remember", "updatedInput"];
+const DECIDE_NOT_IN_PROOF_KEYS = ["checkpointToken", "decidedBy", "decidedVia", "feedback", "remember", "updatedInput", ...RESUME_RESTATABLE_KEYS];
+function readDecisionDoorRestatement(res, body, directDoorActive) {
+    if (directDoorActive && RESUME_RESTATABLE_KEYS.some((key) => body[key] !== undefined)) {
+        sendError(res, 400, "restatement_not_in_proof", "mcpServers / a2aPeers (the resume request's restatement of its MCP / A2A peer tables) are not supported on a direct-door worker (not covered by the decision proof)");
+        return null;
+    }
+    return { restatement: readResumeRestatement(body) };
+}
 const PLAN_REVIEW_BODY_DECLARED_KEYS = [
-    "boundCallId", "checkpointId", "decidedBy", "decision", "editedPlan", "permissionModeAfter", "reason",
+    "boundCallId", "checkpointId", "decidedBy", "decidedVia", "decision", "editedPlan", "permissionModeAfter", "reason",
+    ...RESUME_RESTATABLE_KEYS,
 ];
 const PLAN_REVIEW_PROOF_COVERED_KEYS = ["boundCallId", "checkpointId", "decision", "editedPlan", "permissionModeAfter", "reason"];
-const PLAN_REVIEW_NOT_IN_PROOF_KEYS = ["decidedBy"];
+const PLAN_REVIEW_NOT_IN_PROOF_KEYS = ["decidedBy", "decidedVia", ...RESUME_RESTATABLE_KEYS];
 const PROOF_SLOT_OF = {
     answer: "answer",
     boundCallId: "boundCallId",
@@ -230,7 +243,7 @@ async function decideIdempotentReplay(cs, args) {
                 return undefined;
             }
         }
-        if (binding.boundInputHash !== undefined && row.boundInputHash !== binding.boundInputHash)
+        if (binding.boundInputHash === undefined || row.boundInputHash !== binding.boundInputHash)
             return undefined;
         if (row.decision !== decision)
             return undefined;
@@ -300,15 +313,15 @@ export async function handleApprovalsAssistant(req, res, match, ctx) {
         const operator = explicitOperatorOk(principal, deps.config);
         const ownScope = principal ?? CHECKPOINT_PUBLIC_SCOPE;
         if (match.decl.id === "approvals-stream") {
-            const scope = operator
-                ? (new URLSearchParams(match.search).get("owner") ?? undefined)
-                : ownScope;
-            await streamApprovals(req, res, cs, deps.toolApproval, scope, deps.config);
+            const ownerParam = operator ? (new URLSearchParams(match.search).get("owner") ?? undefined) : undefined;
+            const scope = operator ? ownerParam : ownScope;
+            await streamApprovals(req, res, cs, deps.toolApproval, peerInboundRowsFor(defaultPeerInboundFace, principal, ownerParam), scope, deps.config);
             return;
         }
         if (match.decl.id === "approvals-list") {
+            const ownerParam = operator ? (new URLSearchParams(match.search).get("owner") ?? undefined) : undefined;
             const scope = operator
-                ? (new URLSearchParams(match.search).get("owner") ?? undefined)
+                ? ownerParam
                 : ownScope;
             let durableRows;
             try {
@@ -318,8 +331,9 @@ export async function handleApprovalsAssistant(req, res, match, ctx) {
                 sendApprovalsReadFailure(req, res, deps.logger, err);
                 return;
             }
+            const pending = [...durableRows.map((r) => projectPendingForWire(r, deps.config)), ...peerInboundRowsFor(defaultPeerInboundFace, principal, ownerParam)()];
             sendJson(res, 200, {
-                pending: durableRows.map((r) => projectPendingForWire(r, deps.config)),
+                pending,
                 serverNowMs: Date.now(),
                 ...(deps.toolApproval ? { livePending: deps.toolApproval.listLivePending(scope) } : {}),
                 ...(deps.approvalAskAudit ? { crashConverged: deps.approvalAskAudit.listCrashConverged(scope) } : {}),
@@ -398,6 +412,7 @@ export async function handleApprovalsAssistant(req, res, match, ctx) {
                     ...durableRowIdentity("assistant-inbox", s.checkpointId, s.token),
                     scope: s.scope,
                     createdAt: s.createdAt,
+                    rowVerdict: s.rowVerdict,
                     ...(s.gateKind !== undefined ? { gateKind: s.gateKind } : {}),
                     ...(s.severity !== undefined ? { severity: s.severity } : {}),
                     ...(s.spentMicroUsd !== undefined ? { spentMicroUsd: s.spentMicroUsd } : {}),
@@ -528,6 +543,7 @@ export async function handleApprovalsAssistant(req, res, match, ctx) {
                 sendPrincipalRefusal(res, req, deps.config);
                 return;
             }
+            const restatement = readResumeRestatement(await readJson(req));
             const taskId = match.params.taskId;
             const run = await runStore.getRun(taskId);
             if (!run) {
@@ -539,7 +555,7 @@ export async function handleApprovalsAssistant(req, res, match, ctx) {
                 sendError(res, 404, "not_found.run", "task not found");
                 return;
             }
-            const out = await resumePreempted(run.sessionId, req, true, { principal, explicitOperator });
+            const out = await resumePreempted(run.sessionId, req, true, { principal, explicitOperator }, restatement);
             sendResumeOutcome(res, out, deps.logger);
             return;
         }
@@ -574,13 +590,13 @@ export async function handleApprovalsAssistant(req, res, match, ctx) {
                 sendError(res, 400, "request.field_conflict", "decision 'edit' requires a non-empty editedPlan (the operator's revised plan)", fieldConflictFacts("plan_edit", ["decision", "editedPlan"]));
                 return;
             }
-            const decidedByReading = readDecidedBy(body.decidedBy, deps.config.directDoorActive);
+            const decidedByReading = readDecider(body, deps.config.directDoorActive);
             switch (decidedByReading.kind) {
                 case "not_in_proof":
                     sendError(res, 400, "decided_by_not_in_proof", DECIDED_BY_NOT_IN_PROOF);
                     return;
                 case "outside_closed_set":
-                    sendError(res, 400, "request.field_invalid", DECIDED_BY_OUTSIDE_CLOSED_SET);
+                    sendError(res, 400, "request.field_invalid", decidedByReading.message);
                     return;
                 case "accepted":
                     break;
@@ -589,6 +605,9 @@ export async function handleApprovalsAssistant(req, res, match, ctx) {
                     throw new Error(`unhandled decidedBy reading: ${JSON.stringify(unreachable)}`);
                 }
             }
+            const restated = readDecisionDoorRestatement(res, body, deps.config.directDoorActive);
+            if (restated === null)
+                return;
             if (decision === "edit" && !isWellFormedUnicode(body.editedPlan)) {
                 sendError(res, 400, "request.field_invalid", "editedPlan must be well-formed Unicode text (a lone surrogate cannot be signed unambiguously)");
                 return;
@@ -704,7 +723,7 @@ export async function handleApprovalsAssistant(req, res, match, ctx) {
                     return;
                 }
             }
-            const out = await drivePlanReview(plan.prepared, decision, decision === "edit" ? body.editedPlan : undefined, typeof body.reason === "string" ? body.reason : undefined, hostDecisionFacts(decidedByReading.decidedBy, deciderPrincipal), req, true, isPlanApprovePermissionModeAfter(body.permissionModeAfter) ? body.permissionModeAfter : undefined);
+            const out = await drivePlanReview(plan.prepared, decision, decision === "edit" ? body.editedPlan : undefined, typeof body.reason === "string" ? body.reason : undefined, hostDecisionFacts(decidedByReading.decider, deciderPrincipal), req, true, isPlanApprovePermissionModeAfter(body.permissionModeAfter) ? body.permissionModeAfter : undefined, restated.restatement);
             sendResumeOutcome(res, out, deps.logger);
             return;
         }
@@ -716,10 +735,22 @@ export async function handleApprovalsAssistant(req, res, match, ctx) {
                 sendError(res, 400, "request.path_malformed", "malformed approval id (invalid percent-encoding)");
                 return;
             }
+            const doorKind = approvalQueueKindOfDoorId(sessionId);
+            switch (doorKind) {
+                case "peer_inbound":
+                    await decidePeerInbound(req, res, sessionId, { readJson, config: deps.config, logger: deps.logger, principal, face: defaultPeerInboundFace });
+                    return;
+                case "checkpoint":
+                    break;
+                default: {
+                    const unreachable = doorKind;
+                    throw new Error(`approval decide: door id of an unknown kind ${String(unreachable)}`);
+                }
+            }
             const body = (await readJson(req));
             const decision = body?.decision === "approve" ? "approve" : body?.decision === "deny" ? "deny" : undefined;
             if (!decision) {
-                sendError(res, 400, "request.body_shape", "body must be { decision: 'approve' | 'deny', reason?, answer?, checkpointToken?, boundCallId?, boundInputHash?, updatedInput?, remember?, decidedBy?, feedback? }", retiredDecisionKeyFacts(body)?.extra);
+                sendError(res, 400, "request.body_shape", "body must be { decision: 'approve' | 'deny', boundCallId, boundInputHash, reason?, answer?, checkpointToken?, updatedInput?, remember?, decidedBy?, decidedVia?, feedback? }", retiredDecisionKeyFacts(body)?.extra);
                 return;
             }
             {
@@ -756,10 +787,6 @@ export async function handleApprovalsAssistant(req, res, match, ctx) {
                     sendError(res, 501, "capability.store_required", "approval exemptions need a store backend (DB_BACKEND=mysql|pg|local)");
                     return;
                 }
-                if (!body.checkpointToken && !body.boundCallId) {
-                    sendError(res, 400, "remember_requires_binding", "remember requires the decision binding (echo checkpointToken and/or boundCallId from the pending approval)");
-                    return;
-                }
                 remember = true;
             }
             let answer;
@@ -799,13 +826,13 @@ export async function handleApprovalsAssistant(req, res, match, ctx) {
                 sendError(res, 400, "feedback_not_in_proof", "feedback is not supported on a direct-door worker (not covered by the decision proof)");
                 return;
             }
-            const decidedByReading = readDecidedBy(body.decidedBy, deps.config.directDoorActive);
+            const decidedByReading = readDecider(body, deps.config.directDoorActive);
             switch (decidedByReading.kind) {
                 case "not_in_proof":
                     sendError(res, 400, "decided_by_not_in_proof", DECIDED_BY_NOT_IN_PROOF);
                     return;
                 case "outside_closed_set":
-                    sendError(res, 400, "request.field_invalid", DECIDED_BY_OUTSIDE_CLOSED_SET);
+                    sendError(res, 400, "request.field_invalid", decidedByReading.message);
                     return;
                 case "accepted":
                     break;
@@ -814,12 +841,15 @@ export async function handleApprovalsAssistant(req, res, match, ctx) {
                     throw new Error(`unhandled decidedBy reading: ${JSON.stringify(unreachable)}`);
                 }
             }
-            const decidedBy = decidedByReading.decidedBy;
+            const decider = decidedByReading.decider;
+            const restated = readDecisionDoorRestatement(res, body, deps.config.directDoorActive);
+            if (restated === null)
+                return;
             if (body.feedback !== undefined && decision !== "approve") {
                 sendError(res, 400, "request.field_conflict", "feedback is only valid with decision 'approve' — the words of a denial are its reason", fieldConflictFacts("approval_feedback", ["feedback", "decision"]));
                 return;
             }
-            if (body.feedback !== undefined && decidedBy !== "person") {
+            if (body.feedback !== undefined && decider.decidedBy !== "person") {
                 sendError(res, 400, "request.field_conflict", "feedback is only valid on a person's decision — the agent reads it as the user's own words, which a policy decision cannot carry", fieldConflictFacts("approval_feedback", ["feedback", "decidedBy"]));
                 return;
             }
@@ -871,7 +901,7 @@ export async function handleApprovalsAssistant(req, res, match, ctx) {
                     pendingGrant = { sessionId: grant.overrideSessionId ?? sessionId, toolName: canonical };
                 }
                 : undefined;
-            const out = await resumeCheckpoint(sessionId, decision, body.reason ?? undefined, hostDecisionFacts(decidedBy, deciderPrincipal), req, answer, binding, grantOnCommit, true, { principal: deciderPrincipal, explicitOperator });
+            const out = await resumeCheckpoint(sessionId, decision, body.reason ?? undefined, hostDecisionFacts(decider, deciderPrincipal), req, answer, binding, grantOnCommit, true, { principal: deciderPrincipal, explicitOperator }, restated.restatement);
             if (pendingGrant !== undefined && decisionCommittedOf(out) && deps.approvalExemptionStore) {
                 try {
                     await deps.approvalExemptionStore.grant(pendingGrant.sessionId, pendingGrant.toolName, deciderPrincipal ?? null);
@@ -907,6 +937,60 @@ export async function handleApprovalsAssistant(req, res, match, ctx) {
     }
     return assertNever(match.decl.id);
 }
+async function decidePeerInbound(req, res, id, env) {
+    const body = (await env.readJson(req));
+    const decision = body?.decision === "approve" ? "approve" : body?.decision === "deny" ? "deny" : undefined;
+    if (!decision) {
+        sendError(res, 400, "request.body_shape", "body must be { decision: 'approve' | 'deny' }", retiredDecisionKeyFacts(body)?.extra);
+        return;
+    }
+    {
+        const keyIssue = decisionBodyKeyIssue("approval-decide", body);
+        if (keyIssue) {
+            const retired = retiredDecisionKeyFacts(body);
+            sendError(res, 400, "request.body_shape", retired?.error ?? keyIssue.message, { unknownKeys: keyIssue.unknownKeys, unsupportedKeys: keyIssue.unsupportedKeys, ...retired?.extra });
+            return;
+        }
+    }
+    const notForThisKind = Object.keys(body).filter((k) => k !== "decision").sort();
+    if (notForThisKind.length > 0) {
+        sendError(res, 400, "request.body_shape", `body: key(s) ${notForThisKind.join(", ")} do not apply to a held cross-session message (kind peer_inbound) — refused rather than dropped, because a dropped key reads as "in effect" to the caller. This kind takes { decision: 'approve' | 'deny' } only`, { unknownKeys: [], unsupportedKeys: notForThisKind.slice(0, MAX_KEY_ECHO) });
+        return;
+    }
+    let decider = env.principal;
+    if (env.config.directDoorActive) {
+        const hdr = (n) => {
+            const h = req.headers[n];
+            return Array.isArray(h) ? h[0] : h;
+        };
+        const proof = verifyDirectDoorProof({ jwt: hdr(PRINCIPAL_TOKEN_HEADER), mac: hdr(APPROVAL_MAC_HEADER), kid: hdr(APPROVAL_MAC_KID_HEADER) }, buildApprovalEnvelope(id, DECIDE_PROOF_COVERED_KEYS, { answer: undefined, boundCallId: undefined, boundInputHash: undefined, decision, reason: null }), env.config);
+        if (!proof.ok) {
+            sendError(res, proof.status, proof.errorCode, proof.error);
+            return;
+        }
+        decider = proof.principal;
+    }
+    const coord = parsePeerInboundId(id);
+    const outcome = coord === undefined ? { kind: "not_found" } : await env.face.decide(peerBoxScope(decider), coord, decision);
+    switch (outcome.kind) {
+        case "not_found":
+            sendError(res, 404, "not_found.approval", "approval not found");
+            return;
+        case "unrecorded":
+            env.logger?.warn("peer_inbound_decision_unrecorded", { id, decision, err: seatText("operator-log-text", String(outcome.error)) });
+            sendError(res, 503, "state.peer_decision_unrecorded", "the decision on this held cross-session message could not be recorded (the mailbox store refused the move) — nothing was decided; retry the same request");
+            return;
+        case "settled": {
+            const reply = { kind: "peer_inbound", id, outcome: outcome.outcome };
+            sendJson(res, 200, reply);
+            return;
+        }
+        default: {
+            const unreachable = outcome;
+            throw new Error(`peer inbound decide: unhandled result ${JSON.stringify(unreachable)}`);
+        }
+    }
+}
 const APPROVALS_STREAM_POLL_MS = 3000;
 function approvalsReadFailureOf(err) {
     const fault = storeFaultClassOf(err);
@@ -946,6 +1030,12 @@ function redactPendingDisclosures(row) {
     const next = redactRiskDescriptor(rd);
     return next === rd ? row : { ...row, riskDescriptor: next };
 }
+function peerInboundRowsFor(face, principal, operatorOwnerParam) {
+    if (operatorOwnerParam !== undefined && operatorOwnerParam !== principal)
+        return () => [];
+    const scope = peerBoxScope(principal);
+    return () => face.list(scope);
+}
 function projectPendingForWire(row, deployment) {
     const governance = deployment;
     const redacted = redactPendingDisclosures(row);
@@ -959,7 +1049,7 @@ function projectPendingForWire(row, deployment) {
         classes: row.classes,
         deploymentListQuestion,
     });
-    return { ...redacted, ...(governanceForced ? { governanceForced } : {}), ...(rememberRefused ? { rememberRefused: true } : {}) };
+    return { kind: "checkpoint", ...redacted, ...(governanceForced ? { governanceForced } : {}), ...(rememberRefused ? { rememberRefused: true } : {}) };
 }
 function createSseDeltaLane(res, spec) {
     let prev = new Map();
@@ -978,8 +1068,19 @@ function createSseDeltaLane(res, spec) {
         },
     };
 }
-export async function streamApprovals(req, res, cs, live, scope, governance, pollMs = APPROVALS_STREAM_POLL_MS) {
-    const keyOf = (p) => JSON.stringify([p.sessionId, p.toolCallId ?? null]);
+export async function streamApprovals(req, res, cs, live, peerInbound, scope, governance, pollMs = APPROVALS_STREAM_POLL_MS) {
+    const keyOf = (p) => {
+        switch (p.kind) {
+            case "checkpoint":
+                return JSON.stringify([p.kind, p.sessionId, p.toolCallId ?? null]);
+            case "peer_inbound":
+                return JSON.stringify([p.kind, p.id]);
+            default: {
+                const unreachable = p;
+                throw new Error(`approvals stream: pending row of an unknown kind ${JSON.stringify(unreachable)}`);
+            }
+        }
+    };
     sseHeaders(res);
     res.write(`event: meta\ndata: ${JSON.stringify({ type: "meta", version: 1, mode: "approvals-delta", pollMs: APPROVALS_STREAM_POLL_MS })}\n\n`);
     let closed = false;
@@ -992,7 +1093,18 @@ export async function streamApprovals(req, res, cs, live, scope, governance, pol
         keyOf,
         bytesOf: (p) => JSON.stringify({ type: "pending", ...p }),
         upsertData: (p, nowMs) => ({ type: "pending", ...p, serverNowMs: nowMs }),
-        exitData: (p, nowMs) => ({ type: "resolved", sessionId: p.sessionId, toolCallId: p.toolCallId, serverNowMs: nowMs }),
+        exitData: (p, nowMs) => {
+            switch (p.kind) {
+                case "checkpoint":
+                    return { type: "resolved", kind: p.kind, sessionId: p.sessionId, toolCallId: p.toolCallId, serverNowMs: nowMs };
+                case "peer_inbound":
+                    return { type: "resolved", kind: p.kind, id: p.id, serverNowMs: nowMs };
+                default: {
+                    const unreachable = p;
+                    throw new Error(`approvals stream: pending row of an unknown kind ${JSON.stringify(unreachable)}`);
+                }
+            }
+        },
     });
     const liveLane = createSseDeltaLane(res, {
         upsertEvent: "live_pending",
@@ -1006,7 +1118,7 @@ export async function streamApprovals(req, res, cs, live, scope, governance, pol
     while (!closed) {
         let snapshot;
         try {
-            const pending = (await cs.listPending(scope)).map((r) => projectPendingForWire(r, governance));
+            const pending = [...(await cs.listPending(scope)).map((r) => projectPendingForWire(r, governance)), ...(peerInbound?.() ?? [])];
             snapshot = { pending, livePending: live ? live.listLivePending(scope) : [] };
         }
         catch (err) {

package/dist/http/routes/capabilities.js

@@ -16,6 +16,8 @@ import { buildEmptyMcpProbeFace, buildMcpInjectionRefusal, buildMcpProbeCacheKey
 import { mcpForScenario } from "../../web-admin-client/facade.js";
 import { sendScenarioNotFound } from "../scenario-read-face.js";
 import { sendJson, sendError } from "../send.js";
+import { codeFieldOf } from "../../terminal.js";
+import { engineRefusalAnswerOf } from "../engine-refusal.js";
 import { assertNever } from "../route-ctx.js";
 import { fileHistoryCaptureOf } from "../../file-history-capture.js";
 import { projectMemoryEngineCapability } from "../../memory-posture.js";
@@ -146,7 +148,7 @@ export async function handleCapabilities(req, res, match, ctx) {
                 subagentSteer: facts.subagentSteer(deps).available,
                 subagentResume: facts.subagentSteer(deps).available,
                 taskSettings: { permissions: true, permissionMode: true, model: true, outputStyle: true, env: DEPLOYMENT_SHAPE_PREDICATES.callerCwd.holds(deps.config), hooks: taskHooksHonored(deps.config), pluginHooks: taskHooksHonored(deps.config), managedHookGroups: taskHooksHonored(deps.config), httpHookAllowlists: taskHooksHonored(deps.config), tightenOnlySeats: true, approvalFrameFamilies: true },
-                settings: { permissions: { allowGrant: true, allowLayer: true, layers: true, callerTrust: callerTrust(req, deps.config).trust } },
+                settings: { permissions: { allowGrant: true, allowLayer: true, layers: true, layeredAllow: true, callerTrust: callerTrust(req, deps.config).trust } },
                 permissionModeAuto: {
                     accepted: true,
                     classifierSeat: deps.autoModeFace?.seatMounted === true,
@@ -193,6 +195,7 @@ export async function handleCapabilities(req, res, match, ctx) {
                 approvalFrameFamilies: [...facts.approvalFrameFamilies(streamApprovalFact)],
                 approvalDecisionNote: true,
                 approvalDecidedBy: true,
+                approvalDecidedVia: true,
                 planReviewCheckpointId: true,
                 permissionModes: [...PERMISSION_MODES],
                 sessionReadRedaction: true,
@@ -307,7 +310,7 @@ export async function handleCapabilities(req, res, match, ctx) {
                 modelPlane: buildModelPlaneFace(deps.config, {
                     envTableIsPlaceholder: isRosterGateArmed(deps.config.webAdmin),
                     candidateRejection,
-                    modelRefusals: deps.modelRefusalsState?.(),
+                    latestPlaneRefusal: deps.latestPlaneRefusalState?.(),
                 }),
                 aliases: selectableAliasNames(deps.config.models, atCatalog, deps.config.modelRefusals).map((name) => ({ name, ...mentionBit(name) })),
             });
@@ -374,6 +377,12 @@ async function answerMcpProbe(res, ctx, answer, outcome, declaredBy) {
             sendMcpProbeRefusal(res, ctx, buildMcpProbeDeclarationRefusal(), "failed");
             return;
         }
+        const engineRefusal = engineRefusalAnswerOf(err);
+        if (engineRefusal !== undefined) {
+            deps.logger?.warn("mcp_status_face_declaration_refused", { ...codeFieldOf(err), error: engineRefusal.refusal.message });
+            sendError(res, engineRefusal.status, engineRefusal.refusal.errorCode, engineRefusal.refusal.message);
+            return;
+        }
         throw err;
     }
 }

package/dist/http/routes/memory-policy.d.ts

@@ -1,7 +1,7 @@
 /**
  * [ref] A9 域模块 —— memory 导出/同步 + 只读策略面。
  *
- * 路由:`GET /v1/memory/export`、`POST /v1/memory/sync/:scope`、`GET /v1/policy`。
+ * 路由:`GET /v1/memory/export`、`POST /v2/memory/sync/:scope`、`GET /v1/policy`。
  * owner 门 = 「本人 user scope / 本人的项目层 / 显式 operator / `org:` 键的目录成员」(见 {@link gateMemoryScope}),
  * 越界一律 404(零存在性 oracle)。本域零可变状态。
  */
@@ -35,7 +35,7 @@ export declare const MEMORY_POLICY_ROUTES: readonly [{
 }, {
     readonly id: "memory-sync-scope";
     readonly pattern: RegExp;
-    readonly label: "/v1/memory/sync/:scope";
+    readonly label: "/v2/memory/sync/:scope";
     readonly methods: readonly ["POST"];
 }];
 /** 本域可分派行的 `id` 闭集 —— handler 的 `switch` 按它判穷尽(漏一口 = 编译红)。 */

package/dist/http/routes/memory-policy.js

@@ -214,6 +214,6 @@ export async function handleMemoryPolicy(req, res, match, ctx) {
 export const MEMORY_POLICY_ROUTES = [
     { id: "memory-export", path: "/v1/memory/export", methods: ["GET"] },
     { id: "policy", path: "/v1/policy", methods: ["GET"] },
-    { id: "memory-sync-scope", pattern: /^\/v1\/memory\/sync\/(?<scope>.*)$/, label: "/v1/memory/sync/:scope", methods: ["POST"] },
+    { id: "memory-sync-scope", pattern: /^\/v2\/memory\/sync\/(?<scope>.*)$/, label: "/v2/memory/sync/:scope", methods: ["POST"] },
 ];
 //# sourceMappingURL=memory-policy.js.map