@sema-agent/server 7.145.0 → 7.146.0

package/dist/http/routes/adoption.js

@@ -1,6 +1,8 @@
 import { createAdoptionRunner } from "../../adoption/runner.js";
 import { AdoptionRequestSchema } from "../../adoption/wire.js";
 import { checkAdoptionPrincipalShape, checkAdoptionWidths } from "../../adoption/plan.js";
+import { judgeAdoptionImportBinding, readAdoptionImportBody, runAdoptionImport } from "../../adoption/import.js";
+import { limitRefusal } from "../../limit-refusal.js";
 import { sendJson, sendError } from "../send.js";
 import { gatedPrincipal, explicitOperatorOk, sendOperatorPrincipalsRequired, sendPrincipalRefusal } from "../principal-gate.js";
 import { assertNever } from "../route-ctx.js";
@@ -39,7 +41,21 @@ function sendOutcome(res, out) {
 function assertNoRejectCodeLeft(unhandled) {
     throw new Error(`adoption: unhandled reject code ${JSON.stringify(unhandled)} — the wire contract's closed set and this switch have drifted apart`);
 }
+function sendAdoptionStoreRequired(res) {
+    sendError(res, 501, "capability.adoption_store_required", "adoption requires a SQL store backend (DB_BACKEND=mysql|pg)");
+}
 export async function handleAdoption(req, res, match, ctx) {
+    switch (match.decl.id) {
+        case "adoption-submit":
+        case "adoption-detail":
+            return operatorLane(req, res, match.decl.id, match.params, ctx);
+        case "adoption-sessions-import":
+            return sourceLane(req, res, match.params, ctx);
+        default:
+            return assertNever(match.decl.id);
+    }
+}
+async function operatorLane(req, res, id, params, ctx) {
     const { deps } = ctx;
     const { readJson } = ctx.helpers;
     const principal = gatedPrincipal(req, deps.config);
@@ -59,7 +75,7 @@ export async function handleAdoption(req, res, match, ctx) {
     if (!fact.available) {
         switch (fact.why) {
             case "adoption_store_absent":
-                sendError(res, 501, "capability.adoption_store_required", "adoption requires a SQL store backend (DB_BACKEND=mysql|pg)");
+                sendAdoptionStoreRequired(res);
                 return;
             case "operator_principals_empty":
                 sendOperatorPrincipalsRequired(res);
@@ -70,14 +86,14 @@ export async function handleAdoption(req, res, match, ctx) {
     }
     const store = fact.backend.adoptionLog();
     const runner = createAdoptionRunner({ store, dialect: deps.backend?.kind === "pg" ? "pg" : "mysql", now: Date.now, logger: deps.logger });
-    switch (match.decl.id) {
+    switch (id) {
         case "adoption-detail": {
-            const id = ctx.helpers.safeDecode(match.params.id);
-            if (id === null) {
+            const adoptionId = ctx.helpers.safeDecode(params.id);
+            if (adoptionId === null) {
                 sendError(res, 400, "request.id_invalid", "invalid adoption id");
                 return;
             }
-            const out = await runner.get(id);
+            const out = await runner.get(adoptionId);
             if (!out) {
                 sendError(res, 404, "not_found.adoption", "adoption not found");
                 return;
@@ -112,11 +128,69 @@ export async function handleAdoption(req, res, match, ctx) {
             return;
         }
         default:
-            return assertNever(match.decl.id);
+            return assertNever(id);
+    }
+}
+async function sourceLane(req, res, params, ctx) {
+    const { deps } = ctx;
+    if (ctx.helpers.rateLimited(req, res))
+        return;
+    const principal = gatedPrincipal(req, deps.config);
+    if (principal === undefined) {
+        sendPrincipalRefusal(res, req, deps.config);
+        return;
+    }
+    const face = facts.adoptionSessionImport(deps);
+    if (!face.available) {
+        switch (face.why) {
+            case "adoption_store_absent":
+                sendAdoptionStoreRequired(res);
+                return;
+            case "session_import_staging_absent":
+                sendError(res, 501, "capability.session_store_required", "importing sessions requires a durable session store (DB_BACKEND=mysql|pg|local)");
+                return;
+            default:
+                return assertNever(face.why);
+        }
+    }
+    const adoptionId = ctx.helpers.safeDecode(params.id);
+    if (adoptionId === null) {
+        sendError(res, 400, "request.id_invalid", "invalid adoption id");
+        return;
+    }
+    const binding = judgeAdoptionImportBinding(await face.backend.adoptionLog().getById(adoptionId), principal);
+    switch (binding.kind) {
+        case "absent":
+            sendError(res, 404, "not_found.adoption", "adoption not found");
+            return;
+        case "not_source":
+            sendError(res, 403, "auth.adoption_source_only", "only this adoption's source principal may import sessions into it (verbatim; an operator cannot import on its behalf)");
+            return;
+        case "not_adopted":
+            sendError(res, 409, "adoption.not_adopted", "this adoption has not completed (it is still in flight, or it was rejected); sessions can be imported once the operator's adoption reaches status adopted");
+            return;
+        case "bound":
+            break;
+        default:
+            return assertNever(binding);
+    }
+    const sessions = readAdoptionImportBody(await ctx.helpers.readJson(req));
+    if (sessions === undefined) {
+        sendError(res, 400, "request.body_shape", "invalid import body — expected exactly {sessions: [...]} (the destination is the adoption's; the body cannot name one)");
+        return;
+    }
+    const cap = deps.config.adoptionImportMaxSessions;
+    if (sessions.length > cap) {
+        const refusal = limitRefusal("sessions", "entries", sessions.length, cap, { tail: "split the batch (the current cap is capabilities.adoptionImport.maxSessions), or have the operator raise ADOPTION_IMPORT_MAX_SESSIONS" });
+        sendError(res, 400, "request.field_invalid", refusal.message, refusal.facts);
+        return;
     }
+    const results = await runAdoptionImport({ adoptionId: binding.adoptionId, toPrincipal: binding.toPrincipal, maxSessionBytes: deps.config.adoptionImportMaxSessionBytes, sessionStorage: face.sessionStorage }, sessions);
+    sendJson(res, 200, { results });
 }
 export const ADOPTION_ROUTES = [
     { id: "adoption-submit", path: "/v1/adoption", credentialGated: ["POST"], methods: ["POST"] },
     { id: "adoption-detail", pattern: /^\/v1\/adoption\/(?<id>[^/]+)$/, label: "/v1/adoption/:id", methods: ["GET"] },
+    { id: "adoption-sessions-import", pattern: /^\/v1\/adoption\/(?<id>[^/]+)\/sessions$/, label: "/v1/adoption/:id/sessions", credentialGated: ["POST"], methods: ["POST"] },
 ];
 //# sourceMappingURL=adoption.js.map

package/dist/http/routes/agents-roster.js

@@ -20,6 +20,7 @@ const ROSTER_KEY_DISPOSITION = {
     parentSessionId: "strip",
     rootSessionId: "strip",
     usage: "strip",
+    requestedBy: "strip",
 };
 void ROSTER_KEY_DISPOSITION;
 export function rosterAgentId(row) {

package/dist/http/routes/approvals-assistant.js

@@ -3,7 +3,8 @@ import { skillCardFacts } from "../../approval-card.js";
 import { hostDecisionFacts, readDecider, retiredDecisionKeyFacts, DECIDED_BY_NOT_IN_PROOF } from "../../host-decision.js";
 import { sameExecutionRecord } from "@sema-agent/core";
 import { findParkedAgentForCheckpoint } from "../../parked-decide.js";
-import { DECIDED_REPLAY_SCAN_CAP, approvalPayloadFingerprint } from "../../plugins/checkpoint-store-sql.js";
+import { DECIDED_REPLAY_SCAN_CAP } from "../../plugins/checkpoint-store-face.js";
+import { approvalPayloadFingerprint } from "../../plugins/approval-payload-fingerprint.js";
 import { carriesDeploymentListQuestion, standingAnswerDurablyRecordable } from "../../tool-approval.js";
 import { APPROVAL_GATE_KINDS } from "../../approval-content-kind.js";
 import { isParkedRunStatus } from "../../plugins/store-contracts.js";

package/dist/http/routes/background.js

@@ -23,6 +23,7 @@ const ROW_KEY_DISPOSITION = {
     toolUseId: "strip",
     updatedAt: "strip",
     sessionId: "keep",
+    requestedBy: "strip",
 };
 void ROW_KEY_DISPOSITION;
 function projectRow(r) {

package/dist/http/routes/capabilities.js

@@ -35,6 +35,7 @@ import * as facts from "../../capability-facts.js";
 import { judgeAutoModeArming } from "../../auto-mode-face.js";
 import { coercePermissionModeStrict, PERMISSION_MODE_WORDS, taskHooksHonored } from "../../task-settings.js";
 import { gatedPrincipal, sendPrincipalRefusal } from "../principal-gate.js";
+import { readAdoptionImportCapability } from "../../adoption/import.js";
 import { headReadOf } from "../../session-incarnation.js";
 import { callerTrust } from "../caller-trust.js";
 import { sessionRulesNamespaceFormsHonored } from "../../session-policy-wire.js";
@@ -121,6 +122,7 @@ export async function handleCapabilities(req, res, match, ctx) {
                 sharedMemory: facts.sharedMemoryRead(deps).available,
                 principalInboxDelivery: facts.principalInboxDelivery(deps).available,
                 adoption: facts.adoption(deps).available,
+                adoptionImport: await readAdoptionImportCapability(facts.adoptionSessionImport(deps), gatedPrincipal(req, deps.config), deps.config),
                 memoryBundle: facts.memoryBundle(deps).available,
                 memoryCompliance: facts.memoryCompliance(deps).available,
                 memoryOrigin: facts.memoryOrigin(deps).available,
@@ -147,7 +149,7 @@ export async function handleCapabilities(req, res, match, ctx) {
                 scratchpadDir: true,
                 subagentSteer: facts.subagentSteer(deps).available,
                 subagentResume: facts.subagentSteer(deps).available,
-                taskSettings: { permissions: true, permissionMode: true, model: true, outputStyle: true, env: DEPLOYMENT_SHAPE_PREDICATES.callerCwd.holds(deps.config), hooks: taskHooksHonored(deps.config), pluginHooks: taskHooksHonored(deps.config), managedHookGroups: taskHooksHonored(deps.config), httpHookAllowlists: taskHooksHonored(deps.config), tightenOnlySeats: true, approvalFrameFamilies: true },
+                taskSettings: { permissions: true, permissionMode: true, model: true, outputStyle: true, env: DEPLOYMENT_SHAPE_PREDICATES.callerCwd.holds(deps.config), hooks: taskHooksHonored(deps.config), pluginHooks: taskHooksHonored(deps.config), managedHookGroups: taskHooksHonored(deps.config), httpHookAllowlists: taskHooksHonored(deps.config), tightenOnlySeats: true, approvalFrameFamilies: true, autoCompactEnabled: true },
                 settings: { permissions: { allowGrant: true, allowLayer: true, layers: true, layeredAllow: true, callerTrust: callerTrust(req, deps.config).trust } },
                 permissionModeAuto: {
                     accepted: true,
@@ -187,6 +189,7 @@ export async function handleCapabilities(req, res, match, ctx) {
                 mcpProbe: true,
                 mcpAssertionHeaderSent: MCP_ASSERTION_HEADER_SENT,
                 mcpTransportKinds: [...MCP_REQUEST_TRANSPORT_KINDS],
+                engine: { handover: facts.engineHandover(deps).available },
                 mcpElicitation: facts.elicitation(deps).available,
                 askUserQuestion: facts.askUserQuestion(deps).available,
                 toolApproval: facts.toolApproval(deps).available,

package/dist/http/routes/diagnostics.d.ts

@@ -13,6 +13,7 @@ import { type PostureKnobReading, type PostureSource } from "../../posture-sourc
 import type { IncomingMessage, ServerResponse } from "node:http";
 import type { WiringManifest } from "@sema-agent/core";
 import { type StreamApprovalGate, type StreamApprovalGateInput } from "../../tool-approval.js";
+import { verifiedIdentitySource } from "../principal-gate.js";
 import type { RouteCtx, RouteMatch, RouteIdsOf } from "../route-ctx.js";
 /** 流内审批门的读数形:上场即 `"active"`,否则是那**四**个合取项里**第一个**不满足的原因词
  *  (与 `resolveStreamApprovalGate` 同一闭集,词表**取型**自它 ⇒ 增删 reason 在此处自动跟随/编译红;
@@ -82,23 +83,17 @@ export declare function assertStaticWiringConsistent(facts: StaticWiringFacts, l
     warn: (msg: string, meta?: Record<string, unknown>) => void;
 } | undefined): StaticWiringAudit;
 /**
- * [ref]③ clay 裁 (b)(2026-08-12,core [ref]④ + cli [ref]① 双背书):**零凭证 turnkey 形**的
- * loopback 来源门判据(单一属主,端点与测试同吃)。
+ * 诊断面的**远程来源门**(单一属主,端点与测试同吃;[ref]③ clay 裁 (b) 的那只门,7.63.0 起按身份判):远程请求后面没有
+ * **验过的身份**(`verifiedIdentitySource`:service 凭据 / 鉴权桥登录令牌 / 直连门签名令牌)⇒ 拒;本机(loopback)照读。
  *
- * 只在「operator 名单空 ∧ 非多租户 ∧ 全局 service-credential 门也不在场(没配 SERVICE_AUTH_TOKEN /
- * AUTH_TOKENS)」的部署形上判——那正是全局门整个不设、诊断端点此前无认证可读的形。诊断面泄的是装配
- * 拓扑(store 接线/能力位/治理姿态),对误暴露公网端口的 turnkey 机器构成侦察面。(b) 对本机自用零摩擦
- * (壳缺省钉 BIND_HOST=127.0.0.1,local curl 照常),对远程侦察 fail-closed;配了 token 的部署远程读
- * 走认证(全局门),不进本臂。
+ * 名单里的名字、单用户声明放进来的「每个调用方」,都只在这次请求带可验身份时才是身份 —— 没有凭据可验的部署上,主体头是谁都能写的
+ * 字符串,端口误暴露到公网就是侦察面(装配拓扑 / 治理姿态 / 写保护名表)。配了 service 凭据的部署上,到得了这里的请求都过了全局凭据门、
+ * 必然带着验过的身份,本判不咬;不要求静态凭据在场(鉴权桥的登录令牌就是身份)。
  *
- * 判源=TCP 对端地址(`req.socket.remoteAddress`),**非任何头**——XFF 类头在无反代的 turnkey 形上本就
- * 是自造面;有反代的部署必然配 token(反代后 remoteAddress 恒 loopback,门自然放行,语义仍对:该形的
- * 边界由反代+token 承担)。`remoteAddress` 缺席(socket 已断等边缘)⇒ 判拒(fail-closed,安全轴方向)。
+ * 判源 = TCP 对端地址(`req.socket.remoteAddress`),**非任何头**(XFF 类头在无反代形上是自造面;有反代的部署必然配凭据)。
+ * `remoteAddress` 缺席(socket 已断等边缘)⇒ 判拒(fail-closed)。
  */
-export declare function zeroCredentialLoopbackDenied(remoteAddress: string | undefined, config: {
-    authToken?: string;
-    authTokens?: Record<string, string>;
-}): boolean;
+export declare function remoteWithoutVerifiedIdentity(req: IncomingMessage, config: Parameters<typeof verifiedIdentitySource>[1]): boolean;
 export declare function handleDiagnostics(req: IncomingMessage, res: ServerResponse, match: RouteMatch<DiagnosticsRouteId>, ctx: RouteCtx): Promise<void>;
 export declare const DIAGNOSTICS_ROUTES: readonly [{
     readonly id: "diagnostics-wiring";

package/dist/http/routes/diagnostics.js

@@ -95,32 +95,22 @@ export function assertStaticWiringConsistent(facts, logger) {
     }
     return audit;
 }
-export function zeroCredentialLoopbackDenied(remoteAddress, config) {
-    const anyServiceAuth = Boolean(config.authToken) || Object.keys(config.authTokens ?? {}).length > 0;
-    if (anyServiceAuth)
-        return false;
-    return !isLoopbackAddress(remoteAddress);
+export function remoteWithoutVerifiedIdentity(req, config) {
+    return !isLoopbackAddress(req.socket.remoteAddress) && verifiedIdentitySource(req, config) === undefined;
 }
 export async function handleDiagnostics(req, res, match, ctx) {
     const { deps } = ctx;
     switch (match.decl.id) {
         case "diagnostics-wiring": {
-            if (deps.config.operatorPrincipals.length > 0 || deps.config.requirePrincipal) {
-                if (!facts.operatorLane(deps).available) {
-                    sendOperatorPrincipalsRequired(res);
-                    return;
-                }
-                const principal = gatedPrincipal(req, deps.config);
-                if (!explicitOperatorOk(principal, deps.config)) {
-                    sendError(res, 403, "auth.operator_only", "wiring diagnostics are operator-only on a multi-tenant worker");
-                    return;
-                }
-                if (!isLoopbackAddress(req.socket.remoteAddress) && verifiedIdentitySource(req, deps.config) === undefined) {
-                    sendError(res, 403, "auth.loopback_only", "wiring diagnostics on a zero-credential deployment are readable from loopback only — configure SERVICE_AUTH_TOKEN to read remotely");
-                    return;
-                }
+            if (!facts.operatorLane(deps).available) {
+                sendOperatorPrincipalsRequired(res);
+                return;
+            }
+            if (!explicitOperatorOk(gatedPrincipal(req, deps.config), deps.config)) {
+                sendError(res, 403, "auth.operator_only", "wiring diagnostics are operator-only");
+                return;
             }
-            else if (zeroCredentialLoopbackDenied(req.socket.remoteAddress, deps.config)) {
+            if (remoteWithoutVerifiedIdentity(req, deps.config)) {
                 sendError(res, 403, "auth.loopback_only", "wiring diagnostics on a zero-credential deployment are readable from loopback only — configure SERVICE_AUTH_TOKEN to read remotely");
                 return;
             }

package/dist/http/routes/engine.d.ts

@@ -0,0 +1,31 @@
+/**
+ * `POST /v1/engine/handover` · `POST /v1/engine/attach` —— 附着租约的交接车道([ref] v3,「Move to background and exit」)。
+ *
+ * 一只门的两扇口:交接口置交接位(壳随后自己退出、不 SIGTERM 引擎;后台 shell 在跑时引擎不退),attach 口清位(下一只壳收回)。车道、窗、
+ * 工作谓词全在租约腿(`boot/engine-lease.ts`);本域只读写**交接门**(`drainState.engineHandover`,收尾链装配时进盒子)。
+ *  · 门序:身份(多租户形的主体门,与运维口同一只铸点)→ 能力事实 `engineHandover`(与 `capabilities.engine.handover` 同读;不可用 ⇒ 501
+ *    `capability.engine_handover_unavailable`,按 why 两句)→ 验型(体坏 ⇒ 400,零状态变化)→ 写门。billable=false,**不吃排空 503**
+ *    (排空一开始租约腿在它的下一拍收摊,能力事实随即答 501;那一拍之内的交接 / attach 无害 —— 引擎已在退)。
+ *  · 交接体只收 `{ reason: "background_exit" }`(闭集);attach 体只收空对象或空体(字面 `null` 与空体同读 —— 共用读体器的全服务律)。
+ *    非对象体 ⇒ 400 `request.invalid_json`(`not_object`)。
+ *  · 能力事实读两次、是同一只函数:读体之前读一次(决定 501 先于 400),验完体、写门之前**无 await** 再读一次 —— 读体途中腿停了(停机开始)
+ *    就答 501,不拿读体之前的旧事实去写一只已不在观察的门(codex r1 [medium])。
+ *  · 两口幂等:再次交接回同一个 `since`;不在交接车道时 attach 照回此刻车道(`handedOverForMs` 缺席)。
+ */
+import type { IncomingMessage, ServerResponse } from "node:http";
+import type { RouteCtx, RouteMatch, RouteIdsOf } from "../route-ctx.js";
+export declare const ENGINE_HANDOVER_PATH = "/v1/engine/handover";
+export declare const ENGINE_ATTACH_PATH = "/v1/engine/attach";
+export declare function handleEngine(req: IncomingMessage, res: ServerResponse, match: RouteMatch<EngineRouteId>, ctx: RouteCtx): Promise<void>;
+export declare const ENGINE_ROUTES: readonly [{
+    readonly id: "engine-handover";
+    readonly path: "/v1/engine/handover";
+    readonly methods: readonly ["POST"];
+}, {
+    readonly id: "engine-attach";
+    readonly path: "/v1/engine/attach";
+    readonly methods: readonly ["POST"];
+}];
+type EngineRouteId = RouteIdsOf<typeof ENGINE_ROUTES>;
+export {};
+//# sourceMappingURL=engine.d.ts.map

package/dist/http/routes/engine.js

@@ -0,0 +1,81 @@
+import { sendJson, sendError, sendHttpError, invalidJsonError } from "../send.js";
+import { gatedPrincipal, sendPrincipalRefusal } from "../principal-gate.js";
+import * as facts from "../../capability-facts.js";
+import { HANDOVER_REASONS } from "../../boot/engine-lease.js";
+import { assertNever } from "../route-ctx.js";
+export const ENGINE_HANDOVER_PATH = "/v1/engine/handover";
+export const ENGINE_ATTACH_PATH = "/v1/engine/attach";
+const HANDOVER_REASONS_SPELLED = HANDOVER_REASONS.map((r) => `"${r}"`).join(", ");
+const ATTACH_BODY_MESSAGE = "the attach request takes no fields (send {} or an empty body) — nothing was changed";
+function isPlainObject(v) {
+    return typeof v === "object" && v !== null && !Array.isArray(v);
+}
+function readHandoverReason(body) {
+    const keys = Object.keys(body);
+    if (keys.length !== 1 || keys[0] !== "reason")
+        return undefined;
+    const reason = body.reason;
+    return HANDOVER_REASONS.find((r) => r === reason);
+}
+function sendHandoverUnavailable(res, why) {
+    switch (why) {
+        case "engine_handover_lane_absent":
+            sendError(res, 501, "capability.engine_handover_unavailable", "handover is not available on this engine: its attachment lease is not armed (neither ENGINE_AUTO_EXIT nor SEMA_PARENT_PID), or the deployment is multi-tenant (REQUIRE_PRINCIPAL=true) — GET /v1/capabilities reports engine.handover=false; exit and stop tasks instead");
+            return;
+        case "engine_lease_stopped":
+            sendError(res, 501, "capability.engine_handover_unavailable", "this engine is shutting down: its attachment lease has stopped observing, so there is nothing to hand over or attach to");
+            return;
+        default:
+            return assertNever(why);
+    }
+}
+export async function handleEngine(req, res, match, ctx) {
+    const { deps } = ctx;
+    if (deps.config.requirePrincipal && gatedPrincipal(req, deps.config) === undefined) {
+        sendPrincipalRefusal(res, req, deps.config);
+        return;
+    }
+    const before = facts.engineHandover(deps);
+    if (!before.available) {
+        sendHandoverUnavailable(res, before.why);
+        return;
+    }
+    const body = await ctx.helpers.readJson(req);
+    if (!isPlainObject(body)) {
+        sendHttpError(res, invalidJsonError("not_object"));
+        return;
+    }
+    let write;
+    switch (match.decl.id) {
+        case "engine-handover": {
+            const reason = readHandoverReason(body);
+            if (reason === undefined) {
+                sendError(res, 400, "request.field_invalid", `the handover request must be exactly { reason } with reason one of ${HANDOVER_REASONS_SPELLED} — nothing was changed`);
+                return;
+            }
+            write = (door) => door.enter(reason);
+            break;
+        }
+        case "engine-attach": {
+            if (Object.keys(body).length > 0) {
+                sendError(res, 400, "request.field_invalid", ATTACH_BODY_MESSAGE);
+                return;
+            }
+            write = (door) => door.attach();
+            break;
+        }
+        default:
+            return assertNever(match.decl.id);
+    }
+    const now = facts.engineHandover(deps);
+    if (!now.available) {
+        sendHandoverUnavailable(res, now.why);
+        return;
+    }
+    sendJson(res, 200, write(now.door));
+}
+export const ENGINE_ROUTES = [
+    { id: "engine-handover", path: ENGINE_HANDOVER_PATH, methods: ["POST"] },
+    { id: "engine-attach", path: ENGINE_ATTACH_PATH, methods: ["POST"] },
+];
+//# sourceMappingURL=engine.js.map

package/dist/http/routes/memory-bundle.js

@@ -1,6 +1,7 @@
 import { z } from "zod";
 import { sendJson, sendError } from "../send.js";
 import { sentMemoryStoreRefusal } from "../memory-store-refusal-reply.js";
+import { sentControlPlaneCorrupt } from "../memory-control-plane-corrupt-reply.js";
 import { buildOriginFencedBundle, readOriginAware } from "../../memory-origin-fence.js";
 import { gatedPrincipal, explicitOperatorOk, sendOperatorPrincipalsRequired, sendPrincipalRefusal } from "../principal-gate.js";
 import { assertNever } from "../route-ctx.js";
@@ -42,6 +43,8 @@ function sentClassifiedFailure(res, ctx, face, err) {
         return true;
     if (sentMemoryStoreRefusal(res, err, ctx.deps.logger))
         return true;
+    if (sentControlPlaneCorrupt(res, err, { kind: "operator" }))
+        return true;
     ctx.deps.logger?.warn?.(`memory_bundle_${face}_failed`, { err: String(err) });
     return false;
 }

package/dist/http/routes/memory-consolidation.js

@@ -1,7 +1,7 @@
 import { z } from "zod";
-import { ControlPlaneCorruptError } from "@sema-agent/core";
 import { sendJson, sendError } from "../send.js";
 import { sentMemoryLayerRefusal } from "../memory-layer-reply.js";
+import { sentControlPlaneCorrupt } from "../memory-control-plane-corrupt-reply.js";
 import { gatedPrincipal, explicitOperatorOk, sendPrincipalRefusal, sendOperatorPrincipalsRequired } from "../principal-gate.js";
 import { assertNever } from "../route-ctx.js";
 import * as facts from "../../capability-facts.js";
@@ -104,7 +104,7 @@ export async function handleMemoryConsolidation(req, res, match, ctx) {
             const scope = "scope" in decided ? decided.scope : undefined;
             let row;
             try {
-                row = scope !== undefined ? faces.lastRun(scope) : undefined;
+                row = scope !== undefined ? await faces.lastRun(scope) : undefined;
             }
             catch (err) {
                 if (sentMemoryLayerRefusal(res, err, { kind: "operator" }))
@@ -160,10 +160,8 @@ export async function handleMemoryConsolidation(req, res, match, ctx) {
                     sendError(res, 409, "memory.consolidation_refused", `memory consolidation refused (${coreCode}): ${err instanceof Error ? err.message : String(err)}`);
                     return;
                 }
-                if (err instanceof ControlPlaneCorruptError) {
-                    sendError(res, 500, "internal.memory_control_plane_corrupt", err.message);
+                if (sentControlPlaneCorrupt(res, err, { kind: "operator" }))
                     return;
-                }
                 ctx.deps.logger?.warn?.("memory_consolidation_run_failed", { scope: decided.scope, err: String(err) });
                 sendError(res, 500, "internal.error", "memory consolidation run failed");
             }

package/dist/http/routes/memory-origin.d.ts

@@ -78,7 +78,7 @@
  * 分层:本模块不值 import `server.ts`(那条边闭合运行时装载环),只 `import type`。
  */
 import type { IncomingMessage, ServerResponse } from "node:http";
-import { type OriginClearanceRow } from "@sema-agent/core";
+import type { OriginClearanceRow } from "@sema-agent/core";
 import type { RouteCtx, RouteMatch, RouteIdsOf } from "../route-ctx.js";
 export declare const MEMORY_ORIGIN_EXTERNAL_PATH = "/v1/memory/origin/external";
 export declare const MEMORY_ORIGIN_CLEARANCES_PATH = "/v1/memory/origin/clearances";

package/dist/http/routes/memory-origin.js

@@ -1,7 +1,7 @@
 import { z } from "zod";
-import { ControlPlaneCorruptError } from "@sema-agent/core";
 import { sendJson, sendError } from "../send.js";
 import { sentMemoryStoreRefusal } from "../memory-store-refusal-reply.js";
+import { sentControlPlaneCorrupt } from "../memory-control-plane-corrupt-reply.js";
 import { buildOriginFence, readOriginAware } from "../../memory-origin-fence.js";
 import { readLayerSeat, sentMemoryLayerRefusal } from "../memory-layer-reply.js";
 import { gatedPrincipal, explicitOperatorOk, sendOperatorPrincipalsRequired, sendPrincipalRefusal } from "../principal-gate.js";
@@ -59,10 +59,8 @@ function sentClassifiedFailure(res, ctx, face, err) {
     }
     if (face !== "clearances" && sentMemoryStoreRefusal(res, err, ctx.deps.logger))
         return true;
-    if (err instanceof ControlPlaneCorruptError) {
-        sendError(res, 500, "internal.memory_control_plane_corrupt", err.message);
+    if (sentControlPlaneCorrupt(res, err, { kind: "operator" }))
         return true;
-    }
     ctx.deps.logger?.warn?.(`memory_origin_${face}_failed`, { err: String(err) });
     return false;
 }

package/dist/http/routes/memory-policy.js

@@ -1,4 +1,4 @@
-import { formatUserScope } from "@sema-agent/core";
+import { formatUserScope, isReplicableScope } from "@sema-agent/core";
 import { parseMemorySyncRequest } from "../../memory-sync.js";
 import { memorySyncIdentityRule } from "../../memory-sync-identity.js";
 import * as facts from "../../capability-facts.js";
@@ -160,6 +160,10 @@ export async function handleMemoryPolicy(req, res, match, ctx) {
                 sendError(res, 400, "memory_sync_invalid_scope", "missing :scope");
                 return;
             }
+            if (!isReplicableScope(scope)) {
+                sendError(res, 400, "memory_sync_invalid_scope", "a userlocal: memory layer never leaves the store it is written in — it is not synced");
+                return;
+            }
             if (sendScopeGateRefusal(res, await gateMemoryScope(deps, principal, scope, "write")))
                 return;
             const body = await readJson(req);

package/dist/http/routes/observability.js

@@ -12,12 +12,9 @@ export async function handleObservability(req, res, match, ctx) {
                 sendOperatorPrincipalsRequired(res);
                 return;
             }
-            if (deps.config.requirePrincipal) {
-                const principal = gatedPrincipal(req, deps.config);
-                if (!explicitOperatorOk(principal, deps.config)) {
-                    sendError(res, 403, "auth.operator_only", "outcomes view is operator-only on a multi-tenant worker");
-                    return;
-                }
+            if (!explicitOperatorOk(gatedPrincipal(req, deps.config), deps.config)) {
+                sendError(res, 403, "auth.operator_only", "the outcomes view is operator-only");
+                return;
             }
             if (!fact.available) {
                 switch (fact.why) {

package/dist/http/routes/runs.js

@@ -4,7 +4,7 @@ import { z } from "zod";
 import { uuidv7, mintCheckpointToken, CheckpointError, policyCannotAnswer, validatePendingSteer, TASK_OUTPUT_REPLAY_KINDS, isSystemInjectionPriority } from "@sema-agent/core";
 import { isTerminalRunStatus, isParkedRunStatus, runProvenElsewhere } from "../../plugins/store-contracts.js";
 import { askOwnerAdmits, askRowCarriesOwner } from "../../plugins/approval-ask-store-sql.js";
-import { LIVE_RUN_GATE_KINDS, TERMINAL_PARK_GATE_KINDS } from "../../plugins/checkpoint-store-sql.js";
+import { LIVE_RUN_GATE_KINDS, TERMINAL_PARK_GATE_KINDS } from "../../plugins/checkpoint-store-face.js";
 import { redactSecrets } from "../../trace/redact.js";
 import { isUuidV7, encodeCheckpointScope } from "../../security.js";
 import { redactSteerIn, STEER_IN_MAX_CHARS, STEER_IN_MAX_REQUEST_CHARS } from "../../orchestration/workflow-agent-steer.js";
@@ -1578,7 +1578,7 @@ export async function handleRunVerbs(req, res, match, ctx) {
 export async function createDurableRun(req, res, ctx, prepared, idem) {
     const { deps } = ctx;
     const { idemCache } = ctx.registry;
-    const { leaseDenied, usageWindowDenied } = ctx.helpers;
+    const { leaseDenied, usageWindowDenied, admitRun } = ctx.helpers;
     const source = ctx.req.source;
     const runs = facts.durableRuns(deps);
     if (!runs.available) {
@@ -1600,6 +1600,9 @@ export async function createDurableRun(req, res, ctx, prepared, idem) {
     }
     if ((await leaseDenied(req, res)) || (await usageWindowDenied(req, res)))
         return null;
+    const runSlot = admitRun(req, res);
+    if (runSlot === undefined)
+        return null;
     return await idemCache.run(idem !== undefined ? inflightKeyOf(idem, "durable", clientTaskId) : undefined, async () => {
         const out = await mintAndDriveDurableRun({ deps, registry: ctx.registry, helpers: ctx.helpers, local: ctx.local, legs: ctx.legs }, runStore, {
             prepared,
@@ -1609,9 +1612,10 @@ export async function createDurableRun(req, res, ctx, prepared, idem) {
             elicitOwner: submitter ?? null,
             source,
             identity: runIdentityOf(req, deps.config, prepared.auth?.principal ?? null),
+            runSlot,
         });
         return out.existing ? await replayOfExistingRun(out.existing, caller, "durable", deps, runStore) : out;
-    });
+    }).finally(() => runSlot.release());
 }
 function clientTaskIdOf(body) {
     const raw = typeof body === "object" && body !== null ? body.taskId : undefined;