@sema-agent/server 7.145.0 → 7.147.0

package/dist/http/routes/engine.d.ts

@@ -0,0 +1,31 @@
+/**
+ * `POST /v1/engine/handover` · `POST /v1/engine/attach` —— 附着租约的交接车道([ref] v3,「Move to background and exit」)。
+ *
+ * 一只门的两扇口:交接口置交接位(壳随后自己退出、不 SIGTERM 引擎;后台 shell 在跑时引擎不退),attach 口清位(下一只壳收回)。车道、窗、
+ * 工作谓词全在租约腿(`boot/engine-lease.ts`);本域只读写**交接门**(`drainState.engineHandover`,收尾链装配时进盒子)。
+ *  · 门序:身份(多租户形的主体门,与运维口同一只铸点)→ 能力事实 `engineHandover`(与 `capabilities.engine.handover` 同读;不可用 ⇒ 501
+ *    `capability.engine_handover_unavailable`,按 why 两句)→ 验型(体坏 ⇒ 400,零状态变化)→ 写门。billable=false,**不吃排空 503**
+ *    (排空一开始租约腿在它的下一拍收摊,能力事实随即答 501;那一拍之内的交接 / attach 无害 —— 引擎已在退)。
+ *  · 交接体只收 `{ reason: "background_exit" }`(闭集);attach 体只收空对象或空体(字面 `null` 与空体同读 —— 共用读体器的全服务律)。
+ *    非对象体 ⇒ 400 `request.invalid_json`(`not_object`)。
+ *  · 能力事实读两次、是同一只函数:读体之前读一次(决定 501 先于 400),验完体、写门之前**无 await** 再读一次 —— 读体途中腿停了(停机开始)
+ *    就答 501,不拿读体之前的旧事实去写一只已不在观察的门(codex r1 [medium])。
+ *  · 两口幂等:再次交接回同一个 `since`;不在交接车道时 attach 照回此刻车道(`handedOverForMs` 缺席)。
+ */
+import type { IncomingMessage, ServerResponse } from "node:http";
+import type { RouteCtx, RouteMatch, RouteIdsOf } from "../route-ctx.js";
+export declare const ENGINE_HANDOVER_PATH = "/v1/engine/handover";
+export declare const ENGINE_ATTACH_PATH = "/v1/engine/attach";
+export declare function handleEngine(req: IncomingMessage, res: ServerResponse, match: RouteMatch<EngineRouteId>, ctx: RouteCtx): Promise<void>;
+export declare const ENGINE_ROUTES: readonly [{
+    readonly id: "engine-handover";
+    readonly path: "/v1/engine/handover";
+    readonly methods: readonly ["POST"];
+}, {
+    readonly id: "engine-attach";
+    readonly path: "/v1/engine/attach";
+    readonly methods: readonly ["POST"];
+}];
+type EngineRouteId = RouteIdsOf<typeof ENGINE_ROUTES>;
+export {};
+//# sourceMappingURL=engine.d.ts.map

package/dist/http/routes/engine.js

@@ -0,0 +1,81 @@
+import { sendJson, sendError, sendHttpError, invalidJsonError } from "../send.js";
+import { gatedPrincipal, sendPrincipalRefusal } from "../principal-gate.js";
+import * as facts from "../../capability-facts.js";
+import { HANDOVER_REASONS } from "../../boot/engine-lease.js";
+import { assertNever } from "../route-ctx.js";
+export const ENGINE_HANDOVER_PATH = "/v1/engine/handover";
+export const ENGINE_ATTACH_PATH = "/v1/engine/attach";
+const HANDOVER_REASONS_SPELLED = HANDOVER_REASONS.map((r) => `"${r}"`).join(", ");
+const ATTACH_BODY_MESSAGE = "the attach request takes no fields (send {} or an empty body) — nothing was changed";
+function isPlainObject(v) {
+    return typeof v === "object" && v !== null && !Array.isArray(v);
+}
+function readHandoverReason(body) {
+    const keys = Object.keys(body);
+    if (keys.length !== 1 || keys[0] !== "reason")
+        return undefined;
+    const reason = body.reason;
+    return HANDOVER_REASONS.find((r) => r === reason);
+}
+function sendHandoverUnavailable(res, why) {
+    switch (why) {
+        case "engine_handover_lane_absent":
+            sendError(res, 501, "capability.engine_handover_unavailable", "handover is not available on this engine: its attachment lease is not armed (neither ENGINE_AUTO_EXIT nor SEMA_PARENT_PID), or the deployment is multi-tenant (REQUIRE_PRINCIPAL=true) — GET /v1/capabilities reports engine.handover=false; exit and stop tasks instead");
+            return;
+        case "engine_lease_stopped":
+            sendError(res, 501, "capability.engine_handover_unavailable", "this engine is shutting down: its attachment lease has stopped observing, so there is nothing to hand over or attach to");
+            return;
+        default:
+            return assertNever(why);
+    }
+}
+export async function handleEngine(req, res, match, ctx) {
+    const { deps } = ctx;
+    if (deps.config.requirePrincipal && gatedPrincipal(req, deps.config) === undefined) {
+        sendPrincipalRefusal(res, req, deps.config);
+        return;
+    }
+    const before = facts.engineHandover(deps);
+    if (!before.available) {
+        sendHandoverUnavailable(res, before.why);
+        return;
+    }
+    const body = await ctx.helpers.readJson(req);
+    if (!isPlainObject(body)) {
+        sendHttpError(res, invalidJsonError("not_object"));
+        return;
+    }
+    let write;
+    switch (match.decl.id) {
+        case "engine-handover": {
+            const reason = readHandoverReason(body);
+            if (reason === undefined) {
+                sendError(res, 400, "request.field_invalid", `the handover request must be exactly { reason } with reason one of ${HANDOVER_REASONS_SPELLED} — nothing was changed`);
+                return;
+            }
+            write = (door) => door.enter(reason);
+            break;
+        }
+        case "engine-attach": {
+            if (Object.keys(body).length > 0) {
+                sendError(res, 400, "request.field_invalid", ATTACH_BODY_MESSAGE);
+                return;
+            }
+            write = (door) => door.attach();
+            break;
+        }
+        default:
+            return assertNever(match.decl.id);
+    }
+    const now = facts.engineHandover(deps);
+    if (!now.available) {
+        sendHandoverUnavailable(res, now.why);
+        return;
+    }
+    sendJson(res, 200, write(now.door));
+}
+export const ENGINE_ROUTES = [
+    { id: "engine-handover", path: ENGINE_HANDOVER_PATH, methods: ["POST"] },
+    { id: "engine-attach", path: ENGINE_ATTACH_PATH, methods: ["POST"] },
+];
+//# sourceMappingURL=engine.js.map

package/dist/http/routes/memory-bundle.js

@@ -1,6 +1,7 @@
 import { z } from "zod";
 import { sendJson, sendError } from "../send.js";
 import { sentMemoryStoreRefusal } from "../memory-store-refusal-reply.js";
+import { sentControlPlaneCorrupt } from "../memory-control-plane-corrupt-reply.js";
 import { buildOriginFencedBundle, readOriginAware } from "../../memory-origin-fence.js";
 import { gatedPrincipal, explicitOperatorOk, sendOperatorPrincipalsRequired, sendPrincipalRefusal } from "../principal-gate.js";
 import { assertNever } from "../route-ctx.js";
@@ -42,6 +43,8 @@ function sentClassifiedFailure(res, ctx, face, err) {
         return true;
     if (sentMemoryStoreRefusal(res, err, ctx.deps.logger))
         return true;
+    if (sentControlPlaneCorrupt(res, err, { kind: "operator" }))
+        return true;
     ctx.deps.logger?.warn?.(`memory_bundle_${face}_failed`, { err: String(err) });
     return false;
 }

package/dist/http/routes/memory-consolidation.js

@@ -1,7 +1,7 @@
 import { z } from "zod";
-import { ControlPlaneCorruptError } from "@sema-agent/core";
 import { sendJson, sendError } from "../send.js";
 import { sentMemoryLayerRefusal } from "../memory-layer-reply.js";
+import { sentControlPlaneCorrupt } from "../memory-control-plane-corrupt-reply.js";
 import { gatedPrincipal, explicitOperatorOk, sendPrincipalRefusal, sendOperatorPrincipalsRequired } from "../principal-gate.js";
 import { assertNever } from "../route-ctx.js";
 import * as facts from "../../capability-facts.js";
@@ -104,7 +104,7 @@ export async function handleMemoryConsolidation(req, res, match, ctx) {
             const scope = "scope" in decided ? decided.scope : undefined;
             let row;
             try {
-                row = scope !== undefined ? faces.lastRun(scope) : undefined;
+                row = scope !== undefined ? await faces.lastRun(scope) : undefined;
             }
             catch (err) {
                 if (sentMemoryLayerRefusal(res, err, { kind: "operator" }))
@@ -160,10 +160,8 @@ export async function handleMemoryConsolidation(req, res, match, ctx) {
                     sendError(res, 409, "memory.consolidation_refused", `memory consolidation refused (${coreCode}): ${err instanceof Error ? err.message : String(err)}`);
                     return;
                 }
-                if (err instanceof ControlPlaneCorruptError) {
-                    sendError(res, 500, "internal.memory_control_plane_corrupt", err.message);
+                if (sentControlPlaneCorrupt(res, err, { kind: "operator" }))
                     return;
-                }
                 ctx.deps.logger?.warn?.("memory_consolidation_run_failed", { scope: decided.scope, err: String(err) });
                 sendError(res, 500, "internal.error", "memory consolidation run failed");
             }

package/dist/http/routes/memory-origin.d.ts

@@ -78,7 +78,7 @@
  * 分层:本模块不值 import `server.ts`(那条边闭合运行时装载环),只 `import type`。
  */
 import type { IncomingMessage, ServerResponse } from "node:http";
-import { type OriginClearanceRow } from "@sema-agent/core";
+import type { OriginClearanceRow } from "@sema-agent/core";
 import type { RouteCtx, RouteMatch, RouteIdsOf } from "../route-ctx.js";
 export declare const MEMORY_ORIGIN_EXTERNAL_PATH = "/v1/memory/origin/external";
 export declare const MEMORY_ORIGIN_CLEARANCES_PATH = "/v1/memory/origin/clearances";
@@ -105,7 +105,7 @@ export declare function buildClearanceRowWire(r: OriginClearanceRow): {
     requestId: string;
     reason: string;
     at: number;
-    status: "done" | "failed" | "pending";
+    status: "done" | "pending" | "failed";
     originUnknownKeys?: string[] | undefined;
     clearanceId: string;
     entryId: string;

package/dist/http/routes/memory-origin.js

@@ -1,7 +1,7 @@
 import { z } from "zod";
-import { ControlPlaneCorruptError } from "@sema-agent/core";
 import { sendJson, sendError } from "../send.js";
 import { sentMemoryStoreRefusal } from "../memory-store-refusal-reply.js";
+import { sentControlPlaneCorrupt } from "../memory-control-plane-corrupt-reply.js";
 import { buildOriginFence, readOriginAware } from "../../memory-origin-fence.js";
 import { readLayerSeat, sentMemoryLayerRefusal } from "../memory-layer-reply.js";
 import { gatedPrincipal, explicitOperatorOk, sendOperatorPrincipalsRequired, sendPrincipalRefusal } from "../principal-gate.js";
@@ -59,10 +59,8 @@ function sentClassifiedFailure(res, ctx, face, err) {
     }
     if (face !== "clearances" && sentMemoryStoreRefusal(res, err, ctx.deps.logger))
         return true;
-    if (err instanceof ControlPlaneCorruptError) {
-        sendError(res, 500, "internal.memory_control_plane_corrupt", err.message);
+    if (sentControlPlaneCorrupt(res, err, { kind: "operator" }))
         return true;
-    }
     ctx.deps.logger?.warn?.(`memory_origin_${face}_failed`, { err: String(err) });
     return false;
 }

package/dist/http/routes/memory-policy.js

@@ -1,4 +1,4 @@
-import { formatUserScope } from "@sema-agent/core";
+import { formatUserScope, isReplicableScope } from "@sema-agent/core";
 import { parseMemorySyncRequest } from "../../memory-sync.js";
 import { memorySyncIdentityRule } from "../../memory-sync-identity.js";
 import * as facts from "../../capability-facts.js";
@@ -160,6 +160,10 @@ export async function handleMemoryPolicy(req, res, match, ctx) {
                 sendError(res, 400, "memory_sync_invalid_scope", "missing :scope");
                 return;
             }
+            if (!isReplicableScope(scope)) {
+                sendError(res, 400, "memory_sync_invalid_scope", "a userlocal: memory layer never leaves the store it is written in — it is not synced");
+                return;
+            }
             if (sendScopeGateRefusal(res, await gateMemoryScope(deps, principal, scope, "write")))
                 return;
             const body = await readJson(req);

package/dist/http/routes/notify-wake.js

@@ -119,7 +119,8 @@ export async function handleNotifyWake(req, res, match, ctx) {
                 return;
             }
             const restatement = readResumeRestatement(wakeBody);
-            const out = await resumeWake(wakeSession, wakeBody.message, principal, req, true, undefined, undefined, restatement);
+            const message = typeof wakeBody.message === "string" ? { text: wakeBody.message, trusted: false } : undefined;
+            const out = await resumeWake(wakeSession, message, principal, req, true, undefined, undefined, restatement);
             sendResumeOutcome(res, out, deps.logger);
             return;
         }

package/dist/http/routes/observability.js

@@ -12,12 +12,9 @@ export async function handleObservability(req, res, match, ctx) {
                 sendOperatorPrincipalsRequired(res);
                 return;
             }
-            if (deps.config.requirePrincipal) {
-                const principal = gatedPrincipal(req, deps.config);
-                if (!explicitOperatorOk(principal, deps.config)) {
-                    sendError(res, 403, "auth.operator_only", "outcomes view is operator-only on a multi-tenant worker");
-                    return;
-                }
+            if (!explicitOperatorOk(gatedPrincipal(req, deps.config), deps.config)) {
+                sendError(res, 403, "auth.operator_only", "the outcomes view is operator-only");
+                return;
             }
             if (!fact.available) {
                 switch (fact.why) {

package/dist/http/routes/projects.d.ts

@@ -0,0 +1,70 @@
+/**
+ * 项目登记簿的**读面** —— `GET /v1/projects`、`GET /v1/projects/:id`。
+ *
+ * ## 律(三句)
+ *  · **一个项目 = settings-schema 的一只 `ProjectRegistration`**:形与判官只在 settings-schema;本仓把判过的登记原样放在 `config.projects` 一张表里
+ *    (`web-admin-client/apply-effective.ts` 的 stage 是唯一写者),本面只读那一张。行 = `{ id, …登记的原键原名 }` —— 不铸 `name` / `repos` /
+ *    `createdAt` 之类的别名(端侧要别的叫法自己投影),逐键处置在 {@link PROJECT_ROW_DISPOSITIONS} 一张表里(settings-schema 给登记加键 ⇒ 这里 tsc 红,
+ *    先表态再上 wire)。
+ *  · **登记簿只由配置中心下发**:settings-schema 的本地读取集不收 `projects` 域 ⇒ 没有中心腿在应用配置的部署上没有登记簿 —— 两口 501
+ *    `capability.unavailable`,能力位 `capabilities.projects`(布尔)读同一只事实(`capability-facts.ts` 的 `projectRegistry`)答 `false`;
+ *    有登记簿时答 `true`。本面不开写动词(写到哪里由另一张设计定;写面到货时另立一位,本位不改义)。
+ *  · **可见性 fail-closed**:身份判在登记簿在场判**之前**(否则「这台有没有登记簿」先于 401 泄出去);fleet 调用方(`fleetViewOf` 读档)看全部;
+ *    带验过主体的调用方只看 `registeredBy` 恰是自己的登记;看不见的与不存在的同码同句(404 `not_found.project`,不给存在性预言机)。
+ *
+ * 归档:`archivedAt` 在场 = 已归档。列表缺省不列,`?archived=true` 只列已归档的,`?archived=false` 与缺省同;单项读不论归档与否都答(会话行引用它)。
+ */
+import type { IncomingMessage, ServerResponse } from "node:http";
+import type { ProjectRegistration } from "@sema-agent/settings-schema";
+import type { RouteCtx, RouteMatch, RouteIdsOf } from "../route-ctx.js";
+/** 404 的唯一句(不存在与看不见同句)。 */
+export declare const PROJECT_NOT_FOUND_MESSAGE = "no such project";
+/** 投影根:这只登记的 id(登记簿的键 —— 不是登记的成员)。 */
+interface ProjectRowRoot {
+    readonly id: string;
+}
+/**
+ * 项目行的**逐键处置**(表序 = 出口序)。登记的每个键原样出门;`contextItems` 逐条按成员处置(闭集三形,成员同为 `kind` / `value`)。
+ * `id` 是本面铸的唯一键:登记簿的键,行上要有它才能回指 `GET /v1/projects/:id` 与提交体 `projectId`。
+ */
+export declare const PROJECT_ROW_DISPOSITIONS: {
+    readonly id: {
+        readonly mint: (_reg: ProjectRegistration, root: ProjectRowRoot) => string;
+    };
+    readonly displayName: "forward";
+    readonly goal: "forward";
+    readonly contextItems: {
+        readonly nested: {
+            readonly kind: "forward";
+            readonly value: "forward";
+        };
+        readonly rows: "each";
+    };
+    readonly gitRemotes: "forward";
+    readonly defaultScopes: "forward";
+    readonly notes: "forward";
+    readonly icon: "forward";
+    readonly color: "forward";
+    readonly registeredBy: "forward";
+    readonly registeredAt: "forward";
+    readonly archivedAt: "forward";
+};
+/** 项目行的键全集(处置表的键 = wire 上可能出现的每一个键;自铸登记表 `trace/self-minted-wire.ts` 的 `projectRowKey` 按它 `satisfies`)。 */
+export type ProjectRowKey = keyof typeof PROJECT_ROW_DISPOSITIONS;
+/** 一只登记 → wire 行(唯一投影)。 */
+export declare function projectRowOf(id: string, registration: ProjectRegistration): Record<string, unknown>;
+export declare function handleProjects(req: IncomingMessage, res: ServerResponse, match: RouteMatch<ProjectsRouteId>, ctx: RouteCtx): Promise<void>;
+export declare const PROJECTS_ROUTES: readonly [{
+    readonly id: "projects-list";
+    readonly path: "/v1/projects";
+    readonly methods: readonly ["GET"];
+}, {
+    readonly id: "project-get";
+    readonly pattern: RegExp;
+    readonly label: "/v1/projects/:id";
+    readonly methods: readonly ["GET"];
+}];
+/** 本域可分派行的 `id` 闭集。 */
+export type ProjectsRouteId = RouteIdsOf<typeof PROJECTS_ROUTES>;
+export {};
+//# sourceMappingURL=projects.d.ts.map

package/dist/http/routes/projects.js

@@ -0,0 +1,86 @@
+import { PROJECT_ID_REGEX } from "@sema-agent/core";
+import { sendJson, sendError } from "../send.js";
+import { fleetViewOf, sendUnauthorized } from "../principal-gate.js";
+import { assertNever } from "../route-ctx.js";
+import * as facts from "../../capability-facts.js";
+import { projectByTable } from "../../trace/projection-table.js";
+export const PROJECT_NOT_FOUND_MESSAGE = "no such project";
+export const PROJECT_ROW_DISPOSITIONS = {
+    id: { mint: (_reg, root) => root.id },
+    displayName: "forward",
+    goal: "forward",
+    contextItems: { nested: { kind: "forward", value: "forward" }, rows: "each" },
+    gitRemotes: "forward",
+    defaultScopes: "forward",
+    notes: "forward",
+    icon: "forward",
+    color: "forward",
+    registeredBy: "forward",
+    registeredAt: "forward",
+    archivedAt: "forward",
+};
+export function projectRowOf(id, registration) {
+    return projectByTable("project", PROJECT_ROW_DISPOSITIONS, registration, { id });
+}
+function readArchivedQuery(raw) {
+    switch (raw) {
+        case null:
+        case "false":
+            return false;
+        case "true":
+            return true;
+        default:
+            return "invalid";
+    }
+}
+export async function handleProjects(req, res, match, ctx) {
+    const { deps } = ctx;
+    const { safeDecode } = ctx.helpers;
+    const { fleetWide, gateOwner } = fleetViewOf(req, deps, "read");
+    if (!fleetWide && gateOwner === null) {
+        sendUnauthorized(res, "identity");
+        return;
+    }
+    const registry = facts.projectRegistry(deps);
+    if (!registry.available) {
+        sendError(res, 501, "capability.unavailable", "the project registry is not available on this deployment: projects are published only by the configuration center, and no center configuration is applied here");
+        return;
+    }
+    const visible = (registration) => fleetWide || registration.registeredBy === gateOwner;
+    switch (match.decl.id) {
+        case "projects-list": {
+            const archived = readArchivedQuery(new URLSearchParams(match.search).get("archived"));
+            if (archived === "invalid") {
+                sendError(res, 400, "request.query_invalid", "archived must be `true` or `false`");
+                return;
+            }
+            const projects = Object.entries(registry.registry)
+                .filter(([, registration]) => visible(registration) && (registration.archivedAt !== undefined) === archived)
+                .map(([id, registration]) => projectRowOf(id, registration));
+            sendJson(res, 200, { projects });
+            return;
+        }
+        case "project-get": {
+            const raw = safeDecode(match.params.projectId);
+            if (raw === null || !PROJECT_ID_REGEX.test(raw)) {
+                sendError(res, 400, "request.id_invalid", "invalid project id (must be a canonical uuid)");
+                return;
+            }
+            const id = raw.toLowerCase();
+            const registration = Object.hasOwn(registry.registry, id) ? registry.registry[id] : undefined;
+            if (registration === undefined || !visible(registration)) {
+                sendError(res, 404, "not_found.project", PROJECT_NOT_FOUND_MESSAGE);
+                return;
+            }
+            sendJson(res, 200, projectRowOf(id, registration));
+            return;
+        }
+        default:
+            return assertNever(match.decl.id);
+    }
+}
+export const PROJECTS_ROUTES = [
+    { id: "projects-list", path: "/v1/projects", methods: ["GET"] },
+    { id: "project-get", pattern: /^\/v1\/projects\/(?<projectId>[^/]+)$/, label: "/v1/projects/:id", methods: ["GET"] },
+];
+//# sourceMappingURL=projects.js.map

package/dist/http/routes/rules.js

@@ -142,6 +142,10 @@ export async function handleRules(req, res, match, ctx) {
                     logger.info("local rule import tightening write failed", { detail: prepared.detail, committed: prepared.committed });
                     sendRuleWriteFailure(res, "import-tightening", prepared.committed);
                     return;
+                case "record-store-refused":
+                    logger.info("local rule import record store refused", { detail: prepared.detail, committed: prepared.committed });
+                    sendRuleWriteFailure(res, "import-record", prepared.committed);
+                    return;
                 default: {
                     const unknown = prepared;
                     throw new Error(`unknown local import refusal: ${JSON.stringify(unknown)}`);
@@ -189,8 +193,19 @@ export async function handleRules(req, res, match, ctx) {
         }
         const prepared = await lane.prepareImport(principal, parsed.data.layers);
         if (!prepared.ok) {
-            sendError(res, 413, "request.payload_too_large", "too many allow entries across the submitted settings layers");
-            return;
+            switch (prepared.reason) {
+                case "too-many-candidates":
+                    sendError(res, 413, "request.payload_too_large", "too many allow entries across the submitted settings layers");
+                    return;
+                case "record-store-refused":
+                    logger.info("rule import record store refused", { detail: prepared.detail, committed: prepared.committed });
+                    sendRuleWriteFailure(res, "import-record", prepared.committed);
+                    return;
+                default: {
+                    const unknown = prepared;
+                    throw new Error(`unknown rule import refusal: ${JSON.stringify(unknown)}`);
+                }
+            }
         }
         sendJson(res, 200, { preview: prepared.preview, ...(prepared.ticket !== undefined ? { ticket: prepared.ticket, expiresAtMs: prepared.expiresAtMs } : {}) });
         return;
@@ -306,6 +321,19 @@ function sendRuleWriteFailure(res, verb, committed) {
                     throw new Error(`unknown rule-write committed word: ${JSON.stringify(unknownWord)}`);
                 }
             }
+        case "import-record":
+            switch (committed) {
+                case "no":
+                    sendError(res, 503, "state.rule_write_failed", "the import's approval record could not be created (no ticket was issued and no allow rule was written; deny / ask rows of a local batch may already be in force) — send the same request again", { committed });
+                    return;
+                case "unknown":
+                    sendError(res, 503, "state.rule_write_failed", "the import's approval record may or may not have been created (no ticket was issued and no allow rule was written; deny / ask rows of a local batch may already be in force) — send the same request again", { committed });
+                    return;
+                default: {
+                    const unknownWord = committed;
+                    throw new Error(`unknown rule-import committed word: ${JSON.stringify(unknownWord)}`);
+                }
+            }
         case "revoke":
             switch (committed) {
                 case "no":

package/dist/http/routes/runs.js

@@ -4,7 +4,7 @@ import { z } from "zod";
 import { uuidv7, mintCheckpointToken, CheckpointError, policyCannotAnswer, validatePendingSteer, TASK_OUTPUT_REPLAY_KINDS, isSystemInjectionPriority } from "@sema-agent/core";
 import { isTerminalRunStatus, isParkedRunStatus, runProvenElsewhere } from "../../plugins/store-contracts.js";
 import { askOwnerAdmits, askRowCarriesOwner } from "../../plugins/approval-ask-store-sql.js";
-import { LIVE_RUN_GATE_KINDS, TERMINAL_PARK_GATE_KINDS } from "../../plugins/checkpoint-store-sql.js";
+import { LIVE_RUN_GATE_KINDS, TERMINAL_PARK_GATE_KINDS } from "../../plugins/checkpoint-store-face.js";
 import { redactSecrets } from "../../trace/redact.js";
 import { isUuidV7, encodeCheckpointScope } from "../../security.js";
 import { redactSteerIn, STEER_IN_MAX_CHARS, STEER_IN_MAX_REQUEST_CHARS } from "../../orchestration/workflow-agent-steer.js";
@@ -440,10 +440,10 @@ export async function handleRuns(req, res, match, ctx) {
         const priority = body.priority;
         const steerIdemRaw = headerStr(req.headers["idempotency-key"]);
         const messageId = steerIdemRaw ? `idem-${idemKeyOf(steerIdemRaw, idemCallerOf(req, ctx), "run").slice(0, 32)}` : uuidv7();
-        const trusted = explicitOperatorOk(principal, deps.config);
+        const operator = explicitOperatorOk(principal, deps.config);
         const steerInput = () => ({
             text,
-            trusted,
+            trusted: false,
             inputId: messageId,
             ...(priority !== undefined ? { priority } : {}),
         });
@@ -462,7 +462,7 @@ export async function handleRuns(req, res, match, ctx) {
             sendError(res, 404, "not_found.run", runNotFoundMessage(taskId));
             return;
         }
-        if (!trusted && !runOwnerOk(req, res, run.owner))
+        if (!operator && !runOwnerOk(req, res, run.owner))
             return;
         if (!runSessionAcceptOk(req, res, run, "run.steer"))
             return;
@@ -505,7 +505,7 @@ export async function handleRuns(req, res, match, ctx) {
             if (acceptance === "refused")
                 return;
             try {
-                await relayAcceptedInput(deps, acceptance, () => live.steer(text, { trusted, inputId: messageId, ...(priority !== undefined ? { priority } : {}) }));
+                await relayAcceptedInput(deps, acceptance, () => live.steer(text, { trusted: false, inputId: messageId, ...(priority !== undefined ? { priority } : {}) }));
                 sendJson(res, 200, { taskId, status: "running", delivery: "applied", messageId, ...(priority ? { priority } : {}) });
                 return;
             }
@@ -765,10 +765,10 @@ export async function handleRuns(req, res, match, ctx) {
         const interruptIdemRaw = headerStr(req.headers["idempotency-key"]);
         const interruptInputId = interruptIdemRaw ? `idem-${idemKeyOf(interruptIdemRaw, idemCallerOf(req, ctx), "run").slice(0, 32)}` : uuidv7();
         const interruptMessageId = interruptInputId;
-        const trusted = explicitOperatorOk(principal, deps.config);
+        const operator = explicitOperatorOk(principal, deps.config);
         if (!interruptBare) {
             try {
-                validatePendingSteer({ text, trusted, inputId: interruptInputId });
+                validatePendingSteer({ text, trusted: false, inputId: interruptInputId });
             }
             catch (e) {
                 if (e instanceof CheckpointError && e.code === "steering.invalid_content") {
@@ -783,7 +783,7 @@ export async function handleRuns(req, res, match, ctx) {
             sendError(res, 404, "not_found.run", runNotFoundMessage(taskId));
             return;
         }
-        if (!trusted && !runOwnerOk(req, res, run.owner))
+        if (!operator && !runOwnerOk(req, res, run.owner))
             return;
         if (!runSessionAcceptOk(req, res, run, "run.interrupt"))
             return;
@@ -838,7 +838,7 @@ export async function handleRuns(req, res, match, ctx) {
         if (acceptance === "refused")
             return;
         try {
-            await relayAcceptedInput(deps, acceptance, () => liveStream.steer(text, { trusted, priority: "now", ...(interruptInputId !== undefined ? { inputId: interruptInputId } : {}) }));
+            await relayAcceptedInput(deps, acceptance, () => liveStream.steer(text, { trusted: false, priority: "now", ...(interruptInputId !== undefined ? { inputId: interruptInputId } : {}) }));
         }
         catch (e) {
             const code = e.code;
@@ -1578,7 +1578,7 @@ export async function handleRunVerbs(req, res, match, ctx) {
 export async function createDurableRun(req, res, ctx, prepared, idem) {
     const { deps } = ctx;
     const { idemCache } = ctx.registry;
-    const { leaseDenied, usageWindowDenied } = ctx.helpers;
+    const { leaseDenied, usageWindowDenied, admitRun } = ctx.helpers;
     const source = ctx.req.source;
     const runs = facts.durableRuns(deps);
     if (!runs.available) {
@@ -1600,6 +1600,9 @@ export async function createDurableRun(req, res, ctx, prepared, idem) {
     }
     if ((await leaseDenied(req, res)) || (await usageWindowDenied(req, res)))
         return null;
+    const runSlot = admitRun(req, res);
+    if (runSlot === undefined)
+        return null;
     return await idemCache.run(idem !== undefined ? inflightKeyOf(idem, "durable", clientTaskId) : undefined, async () => {
         const out = await mintAndDriveDurableRun({ deps, registry: ctx.registry, helpers: ctx.helpers, local: ctx.local, legs: ctx.legs }, runStore, {
             prepared,
@@ -1609,9 +1612,10 @@ export async function createDurableRun(req, res, ctx, prepared, idem) {
             elicitOwner: submitter ?? null,
             source,
             identity: runIdentityOf(req, deps.config, prepared.auth?.principal ?? null),
+            runSlot,
         });
         return out.existing ? await replayOfExistingRun(out.existing, caller, "durable", deps, runStore) : out;
-    });
+    }).finally(() => runSlot.release());
 }
 function clientTaskIdOf(body) {
     const raw = typeof body === "object" && body !== null ? body.taskId : undefined;