@sema-agent/server 7.142.0 → 7.144.0

package/dist/approval-card.js

@@ -1,10 +1,12 @@
 import { z } from "zod";
-import { ALLOW_RULE_MEMBERS, ASK_EVIDENCE_ABSENCE_VALUES, TOOL_APPROVAL_CARDS, BOUND_GRANT_ABSENCES, DENIAL_LIMIT_BOUNDS, MAX_RULE_TEXT_CHARS, PERSISTED_RULE_MATCHES, UNCOVERED_SEGMENT_REASONS, READ_ROOT_CANDIDATE_DIR_MAX, RESUME_STARTUP_CAUSES, RULE_OFFERS_ABSENCES, RULE_OFFER_KINDS, STEER_REPLAY_FACETS, isAskClass, readRuleOffers, isAskOrigin, isAutoModeFallbackCause, isMintableProbeReason, isPersistedRuleMandate, screenAskClassMembers } from "@sema-agent/core";
+import { ALLOW_RULE_MEMBERS, ASK_EVIDENCE_ABSENCE_VALUES, TOOL_APPROVAL_CARDS, BOUND_GRANT_ABSENCES, DENIAL_LIMIT_BOUNDS, MAX_RULE_TEXT_CHARS, PERSISTED_RULE_MATCHES, UNCOVERED_SEGMENT_REASONS, READ_ROOT_CANDIDATE_DIR_MAX, RESUME_STARTUP_CAUSES, RULE_OFFERS_ABSENCES, RULE_OFFER_KINDS, STEER_REPLAY_FACETS, HOOK_QUESTION_CAUSES, isAskClass, readRuleOffers, isAskOrigin, isAutoModeFallbackCause, isMintableProbeReason, isPersistedRuleMandate, screenAskClassMembers } from "@sema-agent/core";
 import { redactSecrets } from "./trace/redact.js";
 import { recordFailOpen } from "./observability/fail-open.js";
 import { readApprovalCard } from "./approval-content-kind.js";
+import { seatText } from "./trace/exit-seat.js";
 import { capText } from "./caller-text-echo.js";
 import { grantBindingArm, grantBindingOf } from "./standing-answer-grant.js";
+import { pgHasUnstorable } from "./plugins/pg-safe-json.js";
 import { retireParkArmWords, retireStoredCardWords } from "./retired-card-words.js";
 export const MAX_AGENT_NAME = 200;
 const MAX_IDENT = 200;
@@ -332,6 +334,45 @@ export function readAskClassPair(carrier) {
     recordFailOpen("server.approval-card.closed-word-out-of-set", isAskClass(askClass) ? `classes=${outOfSetDetail(classes)}` : `askClass=${outOfSetDetail(askClass)}`);
     return undefined;
 }
+export function readAskReasons(carrier) {
+    if (typeof carrier !== "object" || carrier === null || !("askReasons" in carrier))
+        return undefined;
+    const raw = carrier.askReasons;
+    if (raw === undefined)
+        return undefined;
+    const out = [];
+    if (Array.isArray(raw) && raw.length > 0) {
+        for (const e of raw) {
+            const entry = readAskReasonEntry(e);
+            if (entry === undefined)
+                break;
+            out.push(entry);
+        }
+        if (out.length === raw.length)
+            return out;
+    }
+    recordFailOpen("server.approval-card.closed-word-out-of-set", `askReasons=${outOfSetDetail(raw)}`);
+    return undefined;
+}
+function readAskReasonEntry(e) {
+    if (typeof e !== "object" || e === null)
+        return undefined;
+    const r = e;
+    const words = r.words === undefined ? undefined : typeof r.words === "string" ? capText(seatText("trace-frame-text", r.words), MAX_MESSAGE) : null;
+    if (words === null)
+        return undefined;
+    if (r.by === "hook") {
+        if (!HOOK_QUESTION_CAUSES.includes(r.cause))
+            return undefined;
+        const registration = r.registration === undefined ? undefined : typeof r.registration === "string" ? capText(seatText("trace-frame-text", r.registration), MAX_IDENT) : null;
+        if (registration === null)
+            return undefined;
+        return { by: "hook", cause: r.cause, ...(registration !== undefined ? { registration } : {}), ...(words !== undefined ? { words } : {}) };
+    }
+    if (!isAskOrigin(r.by) || r.by === "hook" || words === undefined)
+        return undefined;
+    return { by: r.by, words };
+}
 export function parkRowFacts(stored) {
     if (typeof stored !== "object" || stored === null || !("kind" in stored) || stored.kind !== "tool_approval")
         return {};
@@ -340,6 +381,7 @@ export function parkRowFacts(stored) {
     const mandate = readClosedWordSeat(pendingAction, "mandate");
     const origin = readClosedWordSeat(pendingAction, "origin");
     const askClassPair = readAskClassPair(pendingAction);
+    const askReasons = readAskReasons(pendingAction);
     return {
         ...(readParkRowTrueSeat(pendingAction, "requiresRealApproval") ? { requiresRealApproval: true } : {}),
         ...(readParkRowTrueSeat(pendingAction, "mandated") ? { mandated: true } : {}),
@@ -347,6 +389,7 @@ export function parkRowFacts(stored) {
         ...(origin !== undefined ? { origin } : {}),
         ...(ruleOffersAbsence !== undefined ? { ruleOffersAbsence } : {}),
         ...(askClassPair ?? {}),
+        ...(askReasons !== undefined ? { askReasons } : {}),
         ...grantBindingArm(grantBindingOf(pendingAction)),
     };
 }
@@ -356,12 +399,6 @@ export function skillCardFacts(summary) {
         ...(summary.classifierNoRuling !== undefined ? { classifierNoRuling: summary.classifierNoRuling } : {}),
     };
 }
-export function parkRowCarriesSkillCardFacts(stored) {
-    if (typeof stored !== "object" || stored === null || !("kind" in stored) || stored.kind !== "tool_approval")
-        return false;
-    const digest = "boundGrantDigest" in stored ? stored.boundGrantDigest : undefined;
-    return typeof digest === "string" || ("classifierNoRuling" in stored && stored.classifierNoRuling !== undefined);
-}
 export const DenialLimitFallbackSchema = z
     .object({
     consecutive: z.number().int().nonnegative(),
@@ -416,8 +453,16 @@ export const ApprovalCardSchema = z
     askClass: z.custom((v) => isAskClass(v)).optional(),
     classes: z.array(z.custom((v) => isAskClass(v))).min(1).optional(),
     fromSubagent: z.literal(true).optional(),
-    sourceTaskId: z.string().max(MAX_IDENT).optional(),
+    sourceSessionId: z.string().max(MAX_IDENT).optional(),
+    agentId: z.string().max(MAX_IDENT).optional(),
     sourceAgentName: z.string().max(MAX_AGENT_NAME).optional(),
+    askReasons: z
+        .array(z.union([
+        z.object({ by: z.literal("hook"), registration: z.string().max(MAX_IDENT).optional(), cause: z.enum(HOOK_QUESTION_CAUSES), words: z.string().max(MAX_MESSAGE).optional() }).strict(),
+        z.object({ by: z.custom((v) => isAskOrigin(v) && v !== "hook"), words: z.string().max(MAX_MESSAGE) }).strict(),
+    ]))
+        .min(1)
+        .optional(),
     delegation: z
         .object({
         parentToolCallId: z.string().max(MAX_IDENT),
@@ -439,6 +484,7 @@ export const ApprovalCardEnvelopeSchema = z
     schemaVersion: z.literal(1),
     approvalId: z.string(),
     card: ApprovalCardSchema,
+    liveFacts: z.unknown().optional(),
 })
     .strict();
 export const APPROVAL_CARD_SCHEMA_VERSION = 1;
@@ -459,8 +505,10 @@ export function buildApprovalCard(source, req, requiresRealApproval) {
     const denialLimitFallback = readDenialLimitFallback(req);
     const askClassPair = readAskClassPair(source);
     const toolCallId = capText(source.toolCallId, MAX_IDENT);
-    const sourceTaskId = capText(source.sourceTaskId, MAX_IDENT);
+    const sourceSessionId = capText(source.sourceSessionId, MAX_IDENT);
+    const agentId = capText(source.agentId, MAX_IDENT);
     const sourceAgentName = capText(source.sourceAgentName, MAX_AGENT_NAME);
+    const askReasons = readAskReasons(req);
     const allowRuleShadowed = readAllowRuleShadowed(req);
     const approvalCard = readApprovalCard(source.approvalCard);
     return {
@@ -485,8 +533,10 @@ export function buildApprovalCard(source, req, requiresRealApproval) {
         ...(denialLimitFallback !== undefined ? { denialLimitFallback } : {}),
         ...(askClassPair !== undefined ? { askClass: askClassPair.askClass, classes: askClassPair.classes } : {}),
         ...(source.fromSubagent === true ? { fromSubagent: true } : {}),
-        ...(sourceTaskId !== undefined ? { sourceTaskId } : {}),
+        ...(sourceSessionId !== undefined ? { sourceSessionId } : {}),
+        ...(agentId !== undefined ? { agentId } : {}),
         ...(sourceAgentName !== undefined ? { sourceAgentName } : {}),
+        ...(askReasons !== undefined ? { askReasons } : {}),
         ...(source.delegation
             ? {
                 delegation: {
@@ -498,15 +548,20 @@ export function buildApprovalCard(source, req, requiresRealApproval) {
             : {}),
     };
 }
-export function buildApprovalCardEnvelope(approvalId, card) {
-    return { schemaVersion: APPROVAL_CARD_SCHEMA_VERSION, approvalId, card };
+export function buildApprovalCardEnvelope(approvalId, card, liveFacts) {
+    const seat = pickApprovalRequestLiveFacts(liveFacts);
+    return { schemaVersion: APPROVAL_CARD_SCHEMA_VERSION, approvalId, card, ...(pgHasUnstorable(seat) ? {} : { liveFacts: seat }) };
 }
 export function readStoredCardEnvelope(cardJson) {
-    const stored = retireStoredCardWords(cardJson);
+    const stored = retireStoredCardWords(renameRetiredSourceKey(cardJson));
     if (stored.seats.length > 0)
         noteRetiredCardWordRead("card_json", stored.seats);
     const parsed = ApprovalCardEnvelopeSchema.safeParse(stored.value);
-    return parsed.success ? parsed.data : undefined;
+    if (!parsed.success)
+        return undefined;
+    const { liveFacts: seat, ...envelope } = parsed.data;
+    const liveFacts = seat === undefined ? undefined : ApprovalRequestLiveFactsSchema.safeParse(seat);
+    return liveFacts?.success === true ? { ...envelope, liveFacts: liveFacts.data } : envelope;
 }
 export function currentParkArm(pendingAction) {
     const arm = retireParkArmWords(pendingAction);
@@ -514,6 +569,16 @@ export function currentParkArm(pendingAction) {
         noteRetiredCardWordRead("parked row", arm.seats);
     return arm.value;
 }
+function renameRetiredSourceKey(envelope) {
+    if (envelope === null || typeof envelope !== "object" || Array.isArray(envelope))
+        return envelope;
+    const card = envelope.card;
+    if (card === null || typeof card !== "object" || Array.isArray(card) || !Object.hasOwn(card, "sourceTaskId") || Object.hasOwn(card, "sourceSessionId"))
+        return envelope;
+    const { sourceTaskId, ...rest } = card;
+    recordFailOpen("server.approval-card.retired-card-key-read", "card_json: sourceTaskId");
+    return { ...envelope, card: { ...rest, sourceSessionId: sourceTaskId } };
+}
 function noteRetiredCardWordRead(carrier, seats) {
     recordFailOpen("server.approval-card.retired-card-word-read", `${carrier}: ${seats.join(" / ")}`);
 }
@@ -529,7 +594,7 @@ export function buildApprovalRequestFrame(input) {
         expiresInMs: Math.max(0, input.expiresAtMs - input.nowMs),
         serverNowMs: input.nowMs,
         approvalId: input.approvalId,
-        ...pickApprovalRequestLiveFacts(input.live),
+        ...(input.live !== undefined ? pickApprovalRequestLiveFacts(input.live) : { liveFactsUnknown: true }),
     };
 }
 export const APPROVAL_REQUEST_LIVE_FACT_KEYS = [
@@ -554,6 +619,26 @@ function pickApprovalRequestLiveFacts(src) {
     }
     return out;
 }
+export function adoptStoredLiveFacts(frame, seat) {
+    for (const key of APPROVAL_REQUEST_LIVE_FACT_KEYS)
+        delete frame[key];
+    Object.assign(frame, pickApprovalRequestLiveFacts(seat));
+}
+const ApprovalRequestLiveFactsSchema = z
+    .object({
+    mandated: z.literal(true).optional(),
+    mandate: z.custom((v) => isPersistedRuleMandate(v)).optional(),
+    origin: z.string().min(1).optional(),
+    boundGrantDigest: z.string().optional(),
+    boundGrants: z.object({ skill: z.string().nullable(), allowedTools: z.array(z.string()).readonly(), disallowedTools: z.array(z.string()).readonly() }).strict().optional(),
+    classifierNoRuling: z.custom((v) => isAutoModeFallbackCause(v)).optional(),
+    boundGrantAbsence: z.enum(BOUND_GRANT_ABSENCES).optional(),
+    approvalCard: z.enum(TOOL_APPROVAL_CARDS).optional(),
+    readRootCandidate: z.object({ dir: z.string().min(1).max(READ_ROOT_CANDIDATE_DIR_MAX), clearsThisAsk: z.literal(true), covers: z.literal("exact").optional() }).strict().optional(),
+    probeReason: z.string().min(1).optional(),
+    requestedBy: z.object({ kind: z.literal("extension"), name: z.string() }).strict().optional(),
+})
+    .strict();
 export function buildApprovalCompleteFrame(input) {
     return {
         type: "approval_complete",
@@ -571,25 +656,20 @@ export function buildRevokeFrame(batchId, askIds, reason, serverNowMs, originTas
     return { type: "approval_revoke", schemaVersion: 1, batchId, askIds: [...askIds], reason, serverNowMs, taskId: originTaskId };
 }
 export function buildReplayFrame(row, nowMs) {
-    const parsed = readStoredCardEnvelope(row.cardJson);
-    if (parsed === undefined)
+    const stored = readStoredCardEnvelope(row.cardJson);
+    if (stored === undefined)
         return undefined;
-    return {
-        type: "approval_request",
-        schemaVersion: 1,
-        askId: row.askId,
-        taskId: row.taskId,
-        kind: "permission",
-        card: parsed.card,
-        expiresAtMs: row.expiresAtMs,
-        expiresInMs: Math.max(0, row.expiresAtMs - nowMs),
-        serverNowMs: nowMs,
-        approvalId: row.askId,
-    };
+    return buildApprovalRequestFrame({ askId: row.askId, taskId: row.taskId, approvalId: row.askId, card: stored.card, expiresAtMs: row.expiresAtMs, nowMs, live: stored.liveFacts });
+}
+export function askDemandsAPerson(legRequest, recordCard) {
+    return legRequest?.requiresRealApproval === true || recordCard?.risk.requiresRealApproval === true;
+}
+const UNREADABLE_CARD_DEMANDS_A_PERSON = { risk: { requiresRealApproval: true } };
+export function storedPersonDemandRecord(cardJson) {
+    return readStoredCardEnvelope(cardJson)?.card ?? UNREADABLE_CARD_DEMANDS_A_PERSON;
 }
 export function storedCardDemandsAPerson(cardJson) {
-    const parsed = readStoredCardEnvelope(cardJson);
-    return parsed === undefined || parsed.card.risk.requiresRealApproval;
+    return askDemandsAPerson(undefined, storedPersonDemandRecord(cardJson));
 }
 export function buildApprovalPreamble(rows, nowMs, replayMax) {
     const frames = [];

package/dist/approval-queue-kind.d.ts

@@ -0,0 +1,27 @@
+/**
+ * **运维审批队列 `pending[]` 的行族闭集** —— 全仓唯一的定义处([ref])。
+ *
+ * ## 规则(一句)
+ * `GET /v1/approvals` 的 `pending[]`(与 `/v1/approvals/stream` 的 `pending` / `resolved` 帧)= **决断口是 `POST /v1/approvals/:id/decide` 的全部行**;
+ * 每一行自报它属于哪一族(`kind`,本闭集一词),消费方**先按 `kind` 分支**,再读那一族的键。数组名仍是决断口的判据(`livePending[]` 的口是
+ * `POST /v1/tool-approvals/:approvalId/respond`,不在本闭集里);本闭集回答的是「同一扇门后面是哪一种卡」。
+ *
+ *  · `checkpoint` —— 停驻门(durable park):行 = 店的 `listPending` 那一行(键集照旧,另带 `kind`),门的 `:id` = 行的 `sessionId`,
+ *    再按 `gateKind`(core 的门型闭集)分路;
+ *  · `peer_inbound` —— 被 `crossSessionInbound: hold` 扣住、等收信方决断的跨会话来信:行 = core 进程级 held 队列那一张卡的投影
+ *    (`peer-inbound-face.ts`),门的 `:id` = 行的 `id`(`peer_inbound:` 前缀的坐标串),决断 = core `PeerHeldQueue.settle`。
+ *
+ * 加一族 = 在 {@link APPROVAL_QUEUE_KINDS} 加一个词:决断口分派、流的键与离场帧({@link approvalQueueKindOfDoorId} 的调用点)
+ * 都是对 {@link ApprovalQueueKind} 的穷举 `switch`,漏一臂 = **编译红**(`test/peer-inbound-approvals.test.ts` 的 P6 钉)。
+ */
+/** 行族闭集(序无义;加词 = 全部穷举点编译红)。 */
+export declare const APPROVAL_QUEUE_KINDS: readonly ["checkpoint", "peer_inbound"];
+export type ApprovalQueueKind = (typeof APPROVAL_QUEUE_KINDS)[number];
+/**
+ * `peer_inbound` 族决断口 id 的前缀 —— 一个 id 是不是这一族,**只**看它(`checkpoint` 族的 id 是会话 id:规范 uuid 或服务现铸的
+ * 内部 id,都不含 `:`,所以两族的 id 空间不交)。
+ */
+export declare const PEER_INBOUND_ID_PREFIX = "peer_inbound:";
+/** 决断口 `:id` 段 → 它属于哪一族(唯一判据:前缀)。前缀对而其余不成形的 id 仍归 `peer_inbound`(那一族自己答 404,不落回停驻门)。 */
+export declare function approvalQueueKindOfDoorId(id: string): ApprovalQueueKind;
+//# sourceMappingURL=approval-queue-kind.d.ts.map

package/dist/approval-queue-kind.js

@@ -0,0 +1,6 @@
+export const APPROVAL_QUEUE_KINDS = ["checkpoint", "peer_inbound"];
+export const PEER_INBOUND_ID_PREFIX = "peer_inbound:";
+export function approvalQueueKindOfDoorId(id) {
+    return id.startsWith(PEER_INBOUND_ID_PREFIX) ? "peer_inbound" : "checkpoint";
+}
+//# sourceMappingURL=approval-queue-kind.js.map

package/dist/approval-reconciler.d.ts

@@ -79,7 +79,7 @@ export type GateMatchOutcome =
     kind: "hash_mismatch";
     candidates: number;
 }
-/** 三元组身份就对不上(不是摘要的事):别的 sourceTaskId / 别的 callId / 早于本 ask 的 park。 */
+/** 三元组身份就对不上(不是摘要的事):别的 sourceSessionId / 别的 callId / 早于本 ask 的 park。 */
  | {
     kind: "identity_miss";
 };
@@ -91,8 +91,8 @@ export type GateMatchOutcome =
  * `delegation.parentToolCallId` 是必填字段,铸行时逐字透传进 `parent_tool_call_id` 列 ⇒ **列非 NULL
  * ⇔ delegation 在场**(不需要新列,也不需要回 `req` 里再读一次)。
  *
- * 第二维 `sourceTaskId !== sessionId` 把「根腿」摘出去:根腿的 `sourceTaskId` 恒等于会话锚(core 给
- * `AskRequest.sourceTaskId` 填的就是该腿 sessionId),它根本不在任何 fold 里,`parent_tool_call_id`
+ * 第二维 `sourceSessionId !== sessionId` 把「根腿」摘出去:根腿的 `sourceSessionId` 恒等于会话锚(core 给
+ * `AskRequest.sourceSessionId` 填的就是该腿 sessionId),它根本不在任何 fold 里,`parent_tool_call_id`
  * 为 NULL 是它的常态而不是信号。
  *
  * 命中 ⇒ 退出硬相等(判据 1 结构上不命中,行落 ②③④⑤)。实测(test AI 围栏)checkpoint 存的摘要**逐字
@@ -105,11 +105,11 @@ export declare function isAncestorFoldMint(ask: AskRow): boolean;
  * 逐条:
  *  - 祖先层 fold 中途铸点 ⇒ 直接退出(见 {@link isAncestorFoldMint});
  *  - `unparseable` 候选直接出局(读不出 ⇒ 不确定 ⇒ 不命中);
- *  - **身份三元组**:`sourceTaskId` **相等** ∧ `toolCallId` **相等** ∧ 时间维的**因果下界**
+ *  - **身份三元组**:`sourceSessionId` **相等** ∧ `toolCallId` **相等** ∧ 时间维的**因果下界**
  *    `candidate.createdAtMs >= ask.createdAtMs`(⚠️ 第三维**不是等式** —— 把它读成等式会让合法的 park
  *    几乎命不中,行随后落 ②③⑤ 被误判)—— 摘要**不是**身份([ref]③①:
  *    同 args 的两次调用摘要天然相同,只靠摘要硬相等会把第二次投递并进第一次的票);任一维在候选侧
- *    缺席(读不出的 blob 没有 `sourceTaskId`)即身份不成立;
+ *    缺席(读不出的 blob 没有 `sourceSessionId`)即身份不成立;
  *  - **hash 双等**:两侧都必须在场且相等,任一侧缺席一律不 bind;禁「能取到时才比」的可选谓词。
  *    归因分两级(顺序即代码顺序):身份这一层先判 —— 同身份候选为空**且**候选集非空 ⇒ `identity_miss`;
  *    走到 hash 这一层才把缺席记成**单铸** `single_mint`(见 {@link GateMatchOutcome})。
@@ -178,10 +178,10 @@ export interface ReconcileStats {
      *
      * 🔴 **今天恒零,而且是结构性的**(扫描P2,2026-08-12 亲读验真;登记而不假称已解):读口
      * `findCheckpointCandidatesForAsk` 按 `session_id = ask.sessionId` 查,`session_id` 列写的是
-     * `cp.sessionId`,而 core 每个 checkpoint 铸点都填 `sourceTaskId: sessionId`
+     * `cp.sessionId`,而 core 每个 checkpoint 铸点都填 `sourceSessionId: sessionId`
      * (`runner/prepare-task.js` 四处;`checkpoint-store.d.ts` 逐字「= sessionId at the mint」)⇒ 读口
-     * 返回的候选恒满足 `c.sourceTaskId === ask.sessionId`;而判据 1 命中要 `c.sourceTaskId ===
-     * ask.sourceTaskId`,祖先层否决要 `ask.sourceTaskId !== ask.sessionId` —— 两者互斥,这一臂在生产
+     * 返回的候选恒满足 `c.sourceSessionId === ask.sessionId`;而判据 1 命中要 `c.sourceSessionId ===
+     * ask.sourceSessionId`,祖先层否决要 `ask.sourceSessionId !== ask.sessionId` —— 两者互斥,这一臂在生产
      * 接线下一次也不会被返回。
      *
      * 所以**别把零读数当健康信号**(与 {@link unmatchableNoHash} 的「恒零才是健康态」正相反:那条能非零,

package/dist/approval-reconciler.js

@@ -21,7 +21,7 @@ function withDeadline(op, label, timeoutMs = RECONCILE_STORE_TIMEOUT_MS) {
     });
 }
 export function isAncestorFoldMint(ask) {
-    return ask.parentToolCallId === null && ask.sourceTaskId !== ask.sessionId;
+    return ask.parentToolCallId === null && ask.sourceSessionId !== ask.sessionId;
 }
 export function classifyGateMatch(ask, candidates) {
     const outcome = classifyGateMatchBeforeFoldVeto(ask, candidates);
@@ -30,7 +30,7 @@ export function classifyGateMatch(ask, candidates) {
     return outcome;
 }
 function classifyGateMatchBeforeFoldVeto(ask, candidates) {
-    const sameIdentity = candidates.filter((c) => c.unparseable !== true && c.sourceTaskId !== null && c.sourceTaskId === ask.sourceTaskId && c.boundCallId === ask.toolCallId && c.createdAtMs >= ask.createdAtMs);
+    const sameIdentity = candidates.filter((c) => c.unparseable !== true && c.sourceSessionId !== null && c.sourceSessionId === ask.sourceSessionId && c.boundCallId === ask.toolCallId && c.createdAtMs >= ask.createdAtMs);
     const askHash = ask.boundInputHash;
     if (sameIdentity.length === 0) {
         if (candidates.length > 0)
@@ -96,7 +96,7 @@ export async function bindParkingAskAtGate(deps, ask, nowMs, deadlineMs) {
                 taskId: ask.taskId,
                 toolCallId: ask.toolCallId,
                 candidates: gateMatch.candidates,
-                reason: "ask and checkpoint minted the same bound input under the same (sourceTaskId, toolCallId) identity but the digests differ — " +
+                reason: "ask and checkpoint minted the same bound input under the same (sourceSessionId, toolCallId) identity but the digests differ — " +
                     "the known causes are deployment-side (a hook/policy mutating an object it still holds a reference to between the two mints, " +
                     "or a stateful getter returning a fresh value per read), not out-of-band interference; this ask keeps its fail-safe route (no park, no denial)",
             });

package/dist/audit.js

@@ -129,8 +129,9 @@ const MESSAGE_READ_TREATMENT = {
         runOrigin: "verbatim",
         taskId: "verbatim",
         attachment: "verbatim",
+        rewrittenBy: "verbatim",
     },
-    custom: { role: "verbatim", customType: "verbatim", content: "verbatim", display: "verbatim", details: "verbatim", provenance: "verbatim", timestamp: "verbatim" },
+    custom: { role: "verbatim", customType: "verbatim", content: "verbatim", display: "verbatim", details: "verbatim", provenance: "verbatim", timestamp: "verbatim", rewrittenBy: "verbatim" },
     assistant: {
         role: "verbatim", content: "parts", errorMessage: "text", diagnostics: "structure", repetition: "structure",
         api: "verbatim", provider: "verbatim", model: "verbatim", responseModel: "verbatim", responseId: "verbatim", requestId: "verbatim",
@@ -139,8 +140,9 @@ const MESSAGE_READ_TREATMENT = {
         staticReasoningCut: "verbatim", timestamp: "verbatim",
         providerCondition: "verbatim", providerConditionSource: "verbatim", providerResetAtMs: "verbatim", apiErrorRoute: "verbatim",
         errorBodyIncomplete: "verbatim", modelOutputInvalid: "verbatim", finishReasonUnknown: "verbatim", streamEndIgnored: "verbatim",
+        refusedTool: "verbatim", rewrittenBy: "verbatim",
     },
-    toolResult: { role: "verbatim", toolCallId: "verbatim", toolName: "verbatim", content: "parts", details: "toolCard", isError: "verbatim", timestamp: "verbatim" },
+    toolResult: { role: "verbatim", toolCallId: "verbatim", toolName: "verbatim", content: "parts", details: "toolCard", isError: "verbatim", timestamp: "verbatim", rewrittenBy: "verbatim" },
     bashExecution: {
         role: "verbatim", command: "text", output: "text", exitCode: "verbatim", cancelled: "verbatim", truncated: "verbatim",
         fullOutputPath: "verbatim", timestamp: "verbatim", excludeFromContext: "verbatim",

package/dist/boot/budget-tracing.d.ts

@@ -45,7 +45,7 @@ export declare function createBudgetAndTracing(ctx: BudgetTracingCtx): {
     fleetLease: import("../fleet-lease.js").FleetLeaseManager | undefined;
     tracer: import("@sema-agent/core").TracerHook;
     sideQueryAccounting: import("../budget.js").SideQueryAccounting;
-    toolResultStore: import("../plugins/store-backend.js").ToolResultStoreFull | undefined;
+    toolResultStore: import("@sema-agent/core").ToolResultStore | undefined;
     sessionPolicyStore: import("@sema-agent/core").SessionPolicyStore | undefined;
     fileHistoryStore: import("../plugins/store-backend.js").ServiceFileHistoryStore | undefined;
     fileHistoryErasure: import("../file-history-capture.js").FileHistoryErasureFace | undefined;

package/dist/boot/execution-env.js

@@ -416,7 +416,7 @@ export function createExecutionEnv(ctx) {
             });
         }
         else if (config.remoteExec?.provider === "host") {
-            const gitBaseEnv = new RemoteHostExecutionEnv({ ...homeDirSeat, workspaceDir: config.worktreeIsolation.repoRoot, inheritEnv: "all", backgroundShell: config.requirePrincipal !== true });
+            const gitBaseEnv = new RemoteHostExecutionEnv({ workspaceDir: config.worktreeIsolation.repoRoot, inheritEnv: "all", backgroundShell: config.requirePrincipal !== true });
             executionEnvFactory = withWorktreeIsolation(executionEnvFactory, {
                 repoRoot: config.worktreeIsolation.repoRoot,
                 ...(config.worktreeIsolation.allowedRoots ? { allowedRoots: config.worktreeIsolation.allowedRoots } : {}),

package/dist/boot/governance-seams.d.ts

@@ -29,15 +29,22 @@
  * 补偿是这条 env 旋钮本身:要档位的部署显式写下它。将来 center 真有了档位下发面,「多租户必须能解析出
  * 档位」才是一条有对象可指的判据,那时再立。
  *
- * ## 件C 的两条**装配相容性**判据(本仓特有,见 {@link assertLockAssemblable})
+ * ## 装配相容性:一条判据、一个时点(见 {@link assertGovernanceAssemblable})
  *
- * core 的锁按「spec 是否占了这个字段」判,而本仓是**部署自己**在铸那两个 spec 字段:
- *  · `spec.toolPolicy` —— 治理拍(`applyRuntimeGovernance`)在**任何**客户端表态下都会铸出它(敏感路径
- *    守卫集默认非空);于是 `toolPolicy` 锁会让 core 的 preflight **整拒每一条腿**。
- *  · `spec.mcp` —— 部署自带的 MCP 基线(场景/center 下发)同样经 `spec.mcp` 进 core;部署配了 MCP 又锁
- *    `mcp`,同样是每条腿必拒。
- * 两者都在**启动期**拒(安全控件不得半开 §3.4 C 行),而不是让运维在每条任务腿上各撞一次
- * `config.locked_key` 去猜。
+ * core 的锁按「spec 是否占了这个字段」判、合规否决按「被禁能力是否已在 spec 上」判 —— 占了 / 在场都是**整拒 prepare**
+ * (`config.locked_key` / `config.compliance_denied`),不是「不挂载」。而本仓有几张 spec 面是**部署自己**在铸:
+ *  · `spec.toolPolicy` —— 治理拍(`applyRuntimeGovernance`)在**任何**客户端表态下都铸(敏感路径守卫集默认非空)⇒ 恒在;
+ *  · `spec.mcp` / `spec.a2a` —— 部署自带的 MCP 服务器 / A2A 对端(config.d 或中心下发)经同一字段进 core(引擎没有部署级的服务器 / 对端席)⇒ 配了就在;
+ *  · WebFetch 工具面 —— 单用户花名册恒挂(多租户 roster 才摘)。
+ * 判据只有一条:**锁住的键 / 否决的能力所守的面 ∩ 本部署装配的面 ≠ ∅ ⇒ 起服拒**(安全控件不得半开 §3.4 C 行)—— 那不是「配得比较严」,
+ * 是这台部署的每条腿(或某场景的每条腿)必失败,而运维手里没有任何线索指向那把锁 / 那条否决。两张对照表是 core 两个闭集的 `Record`:
+ * 引擎加一个锁键或合规能力 ⇒ 这里缺行 ⇒ tsc 红,逼人当场判它守不守本部署铸的面(修前是两只 `has()` 判据,引擎后加的 `a2a` 锁与
+ * `a2a_peers` 否决静默不判)。
+ *
+ * **时点**:部署 MCP / A2A 基线在能力层才物化(server = 第 7 段的 `applyCenterCapabilities`;run-local = 候选采纳段的同一行),所以这道门
+ * 在**物化之后**由每个起服入口调恰好一次,出口只有一个:抛 ⇒ 起服拒(退出码 1)。座席铸点 {@link createGovernanceSeams}(第 6 段)**不判**:
+ * 那一刻两格基线恒空(修前判据就跑在那里,于是 `mcp` 锁 / `mcp_servers` 否决对 config.d 与中心声明的服务器从不拒启,任务腿各自在引擎门口
+ * 撞拒);它的 config 窄口里也就没有那两格 —— 「物化之前判」这一形在编译期就写不出来。没有运行期补判:不留每腿 400 臂、不留静默卸臂。
  *
  * ## 件D 的边界(成文,别读成「数据会被删」)
  *
@@ -62,7 +69,8 @@ export interface GovernanceSeams {
 }
 /** 依赖收窄到真实消费面(接口隔离 —— 测试用真形字面量,零铸形)。 */
 export interface GovernanceSeamsCtx {
-    config: Pick<ServiceConfig, "compliancePosture" | "lockedConfigKeys" | "retentionPolicy" | "retentionSweep" | "mcpServers" | "requirePrincipal">;
+    /** 没有 `mcpServers` / `a2aPeers`:座席铸在部署基线物化之前,装配相容性判据不在这里(见文件头「时点」)。 */
+    config: Pick<ServiceConfig, "compliancePosture" | "lockedConfigKeys" | "retentionPolicy" | "retentionSweep">;
     logger: Pick<Logger, "info" | "warn">;
     /**
      * core 留存能力校验的对象集(名字进拒启文案)。喂的是**装配现场的真店**,不是「我以为装了什么」——
@@ -79,41 +87,18 @@ export interface GovernanceSeamsCtx {
      */
     retentionExecutor: ManagedRetentionCapability | null;
 }
+/** 装配相容性门的输入 = **装配完成后**的部署事实(部署 MCP / A2A 基线物化之后读;见文件头「时点」)。 */
+export type GovernanceAssemblyFacts = Pick<ServiceConfig, "lockedConfigKeys" | "compliancePosture" | "mcpServers" | "a2aPeers" | "requirePrincipal">;
 /**
- * 件C 的装配相容性判据(纯,可单测)——见文件头「两条判据」。
- *
- * 🔴 失败方向朝**拒启**:一把在本部署上必然把每条腿都拒掉的锁,不是「配得比较严」,是配错了;继续启动
- * 只会让服务对每一个请求说 `config.locked_key`,而运维手里没有任何线索指向那把锁。
+ * **装配相容性门**(见文件头「一条判据、一个时点」):锁住的键 / 否决的能力所守的面撞上本部署装配的面 ⇒ 抛(起服拒)。
+ * 🔴 时点即契约:调用方必须在部署 MCP / A2A 基线**物化之后**调它(server 第 7 段紧跟 `applyCenterCapabilities`;run-local 在候选采纳段之后),
+ * 每个起服入口恰好一次。中心侧后来加了 MCP 服务器 / A2A 对端:那一族是 restart-to-apply 面,变更翻 `restartRequired` 让编排器滚动重启 ——
+ * 重启就撞上这道门,所以没有第二条热路径判据。
  */
-export declare function assertLockAssemblable(input: {
-    lockedKeys: ReadonlySet<LockedKey>;
-    deploymentMcpConfigured: boolean;
-}): void;
-/**
- * 治理面的**装配相容性**总判据(codex 交叉复审 R2-F2 起扩面)——锁与合规档位在这条轴上是同一件事:
- * 两者都可能把「本部署自己的装配」判成 core 门口的违规,而那不是「配得更严」,是**这台从此每条腿必失败**。
- *
- * 合规半场的判据来自亲核 core 的 prepare 门(`prepare-task` 的 compliance 段):被否决的能力若**已在
- * spec 上**,core 是**整拒 prepare**(`config.compliance_denied`),不是「不挂载」。于是:
- *  · `mcp_servers` 被禁 ∧ 部署自带 MCP 基线 ⇒ 每条腿的 `spec.mcp` 都在 ⇒ 必拒;
- *  · `web_fetch` 被禁 ∧ 花名册挂了 WebFetch ⇒ 必拒。⚠️ `hipaa` 的**内建 floor 就含 `web_fetch`**,而本仓
- *    的单用户花名册**恒挂** WebFetch(`capabilities/scenarios.ts` 的 roster 过滤只在多租户下摘它)——
- *    也就是说「单用户 + hipaa」在本仓是一个每条腿必失败的组合。这条判据的全部价值就在这儿:让它在
- *    启动期说出来,而不是让运维看着一台"启动成功、任务全失败"的 worker 猜。
- *  · `workflows` 被禁只在 `spec.selfOrchestration === true` 的腿上拒(per-task,不是部署恒真)⇒ 不在本
- *    判据内,由那条腿自己响亮拒;`org_memory_mount` 走件A 的准入面。**成文定界,不留白。**
- */
-export declare function assertGovernanceAssemblable(input: {
-    lockedKeys: ReadonlySet<LockedKey>;
-    /** 已解析的合规否决集(空集 = 无档位)。 */
-    complianceDenies: ReadonlySet<string>;
-    deploymentMcpConfigured: boolean;
-    /** 本部署的花名册是否会挂 WebFetch(= 单用户形;多租户下 roster 过滤掉它)。 */
-    webFetchMounted: boolean;
-}): void;
+export declare function assertGovernanceAssemblable(facts: GovernanceAssemblyFacts): void;
 /**
- * 装配三座席。**拒启口即装配口**:相容性判据与 core 的留存能力校验都在这里跑,调用方不必记得再调一次
- * (件A 的 C12 探测同姿势)。
+ * 装配三座席(件B/C/D)与 core 的留存能力校验 —— **不**判装配相容性:座席铸在部署 MCP / A2A 基线物化之前,那道门由起服入口在物化之后调
+ * {@link assertGovernanceAssemblable}(见文件头「时点」)。
  */
 export declare function createGovernanceSeams(ctx: GovernanceSeamsCtx): GovernanceSeams;
 //# sourceMappingURL=governance-seams.d.ts.map

package/dist/boot/governance-seams.js

@@ -1,44 +1,77 @@
 import { assertRetentionCapability, resolveComplianceDenies, resolveLockedKeys } from "@sema-agent/core";
-export function assertLockAssemblable(input) {
-    if (input.lockedKeys.has("toolPolicy")) {
-        throw new Error('LOCKED_CONFIG_KEYS contains "toolPolicy", which this server cannot arm: it COMPOSES the effective tool policy itself on ' +
+import { DEPLOYMENT_SHAPE_PREDICATES } from "../deployment-shape.js";
+const FACE_ASSEMBLED = {
+    toolPolicy: () => true,
+    mcp: (facts) => (facts.mcpServers?.servers.length ?? 0) > 0,
+    a2a: (facts) => (facts.a2aPeers?.length ?? 0) > 0,
+    webFetch: (facts) => !DEPLOYMENT_SHAPE_PREDICATES.multiTenant.holds(facts),
+};
+const LOCK_CONFLICTS = {
+    toolPolicy: {
+        face: "toolPolicy",
+        refusal: 'LOCKED_CONFIG_KEYS contains "toolPolicy", which this server cannot arm: it COMPOSES the effective tool policy itself on ' +
             "every leg (deployment approval baseline + the tighten-only governance pass over the sensitive-path guard set), so " +
             "`TaskSpec.toolPolicy` is always present at the engine's prepare door and the lock would refuse EVERY task with " +
             "config.locked_key. The policy is already deployment-owned and no request can loosen it (the fold is deny-wins), so " +
-            "this lock has nothing to guard here — remove it from LOCKED_CONFIG_KEYS.");
-    }
-    if (input.lockedKeys.has("mcp") && input.deploymentMcpConfigured) {
-        throw new Error('LOCKED_CONFIG_KEYS contains "mcp" while this deployment configures MCP servers of its own (scenario/center MCP): the ' +
+            "this lock has nothing to guard here — remove it from LOCKED_CONFIG_KEYS.",
+    },
+    mcp: {
+        face: "mcp",
+        refusal: 'LOCKED_CONFIG_KEYS contains "mcp" while this deployment configures MCP servers of its own (config.d/mcp.json or the center\'s mcp domain): the ' +
             "deployment's servers ride the SAME `TaskSpec.mcp` field the lock guards (the engine has no deployment-level MCP seat), " +
             "so every task would be refused at prepare with config.locked_key. Either drop the `mcp` lock, or remove the configured " +
-            "MCP servers — a locked deployment mounts no MCP at all.");
-    }
-}
-export function assertGovernanceAssemblable(input) {
-    assertLockAssemblable({ lockedKeys: input.lockedKeys, deploymentMcpConfigured: input.deploymentMcpConfigured });
-    if (input.complianceDenies.has("mcp_servers") && input.deploymentMcpConfigured) {
-        throw new Error('the compliance posture denies "mcp_servers" while this deployment configures MCP servers of its own: the engine REFUSES ' +
+            "MCP servers — a locked deployment mounts no MCP at all.",
+    },
+    a2a: {
+        face: "a2a",
+        refusal: 'LOCKED_CONFIG_KEYS contains "a2a" while this deployment configures A2A peers of its own (the center\'s a2a domain): the ' +
+            "deployment's peers ride the SAME `TaskSpec.a2a` field the lock guards (the engine has no deployment-level A2A peer seat), " +
+            "so every task would be refused at prepare with config.locked_key. Either drop the `a2a` lock, or remove the configured " +
+            "A2A peers — a locked deployment dials no A2A peer at all.",
+    },
+    compliancePosture: null,
+    retentionPolicy: null,
+};
+const DENY_CONFLICTS = {
+    mcp_servers: {
+        face: "mcp",
+        refusal: 'the compliance posture denies "mcp_servers" while this deployment configures MCP servers of its own: the engine REFUSES ' +
             "(not silently narrows) every prepare whose TaskSpec.mcp is non-empty, so every task would fail with config.compliance_denied. " +
-            "Remove the configured MCP servers, or drop mcp_servers from the posture.");
-    }
-    if (input.complianceDenies.has("web_fetch") && input.webFetchMounted) {
-        throw new Error('the compliance posture denies "web_fetch" while this deployment mounts the WebFetch tool: the engine REFUSES every prepare ' +
+            "Remove the configured MCP servers, or drop mcp_servers from the posture.",
+    },
+    a2a_peers: {
+        face: "a2a",
+        refusal: 'the compliance posture denies "a2a_peers" while this deployment configures A2A peers of its own: the engine REFUSES ' +
+            "(not silently narrows) every prepare whose TaskSpec.a2a is non-empty, so every task would fail with config.compliance_denied. " +
+            "Remove the configured A2A peers, or drop a2a_peers from the posture.",
+    },
+    web_fetch: {
+        face: "webFetch",
+        refusal: 'the compliance posture denies "web_fetch" while this deployment mounts the WebFetch tool: the engine REFUSES every prepare ' +
             "whose roster carries it, so every task on the default roster would fail with config.compliance_denied. This server drops " +
             "WebFetch from the roster only on a MULTI-TENANT deployment (REQUIRE_PRINCIPAL=true) — a single-user deployment cannot " +
-            "currently honor a web_fetch denial. Run the posture multi-tenant, or drop the profile/deny.");
-    }
+            "currently honor a web_fetch denial. Run the posture multi-tenant, or drop the profile/deny.",
+    },
+    workflows: null,
+    org_memory_mount: null,
+};
+function resolveGovernanceDeclarations(config) {
+    return {
+        lockedKeys: resolveLockedKeys(config.lockedConfigKeys !== undefined ? { keys: config.lockedConfigKeys } : undefined),
+        complianceDenies: config.compliancePosture !== undefined ? resolveComplianceDenies(config.compliancePosture) : new Set(),
+    };
+}
+export function assertGovernanceAssemblable(facts) {
+    const { lockedKeys, complianceDenies } = resolveGovernanceDeclarations(facts);
+    const conflicts = [...[...lockedKeys].map((key) => LOCK_CONFLICTS[key]), ...[...complianceDenies].map((cap) => DENY_CONFLICTS[cap])];
+    for (const conflict of conflicts)
+        if (conflict !== null && FACE_ASSEMBLED[conflict.face](facts))
+            throw new Error(conflict.refusal);
 }
 export function createGovernanceSeams(ctx) {
     const { config, logger, retentionStores } = ctx;
-    const lockedKeys = resolveLockedKeys(config.lockedConfigKeys !== undefined ? { keys: config.lockedConfigKeys } : undefined);
+    const { lockedKeys, complianceDenies } = resolveGovernanceDeclarations(config);
     const posture = config.compliancePosture;
-    const complianceDenies = posture !== undefined ? resolveComplianceDenies(posture) : new Set();
-    assertGovernanceAssemblable({
-        lockedKeys,
-        complianceDenies,
-        deploymentMcpConfigured: (config.mcpServers?.servers.length ?? 0) > 0,
-        webFetchMounted: config.requirePrincipal !== true,
-    });
     const lockedConfig = config.lockedConfigKeys !== undefined && config.lockedConfigKeys.length > 0 ? { keys: config.lockedConfigKeys } : undefined;
     if (lockedConfig)
         logger.info("locked_config_enabled", { keys: [...lockedKeys].sort() });