@sema-agent/server 7.146.0 → 7.148.0

package/dist/boot/resolve-spec.js

@@ -2,7 +2,7 @@ import { realpathSync } from "node:fs";
 import { join } from "node:path";
 import { NodeExecutionEnv, QUESTION_AWAITS_RESUME, deriveAskEffective, expandTiers, resolveAskSeamForm } from "@sema-agent/core";
 import { cappedCeiling } from "../budget.js";
-import { recordFailOpen } from "../observability/fail-open.js";
+import { unreadRequestMembers, unreadRequestMembersRefusal } from "../unread-request-members.js";
 import { SessionEnvironmentSelection, selectEnvironmentTool } from "../capabilities/select-environment-tool.js";
 import { sendUserFileTool } from "../capabilities/send-user-file-tool.js";
 import { buildExcludeToolsSeat, buildPromptSeats, buildRunSkills, createScenarioGate, selectScenario } from "../capabilities/scenarios.js";
@@ -10,15 +10,14 @@ import { toolPolicyForHands } from "../capabilities/hands-lane.js";
 import { mintLegFacts } from "../leg-facts.js";
 import { applyLongtailDefer } from "../capabilities/tool-defer.js";
 import { assertGuardPatternsUsable, buildApprovalGrantNotice, buildOnlySensitiveBaselineWarning, createApprovalBaselinePolicy, createDeploymentGovernanceInputs } from "../deployment-governance.js";
-import { createDeploymentListExemption, gateIntentUnserviceableReason, singleUserAutoAcceptBaselineApplies } from "../approval.js";
+import { createSessionExemptionRead, gateIntentUnserviceableReason, singleUserAutoAcceptBaselineApplies } from "../approval.js";
 import { acceptShellScratchpadDir, buildEnvFacts, egressForRemoteExec, ensureScratchpadDir, resumeFactsForLane, scratchpadCoveringTaskRoot } from "../env-facts.js";
 import { FleetEventBus } from "../fleet/fleet-bus.js";
 import { createSettingsHooksRegistrations, settingsHooksBudgetMs } from "../hooks/hook-runner.js";
-import { HOST_POSTURE_REFUSED_CODE, permissionModeWriteFaceRefusal, taskInheritEnvRefusal } from "../hosted-posture.js";
 import { headerStr } from "../http/principal-gate.js";
 import { explicitOperatorOk } from "../http/server.js";
-import { isAtMentionable, matchCatalogModel, refusedCatalogEntry, resolveTaskModel, selectableCatalog, terminalCatalogName } from "../model-select.js";
-import { echoModelRef, modelUnavailableMessage } from "../model-entry-refusal.js";
+import { isAtMentionable, matchCatalogModel, pickUserModel, refusedCatalogEntry, terminalCatalogName } from "../model-select.js";
+import { echoModelRef, modelNotAllowedMessage, modelUnavailableMessage } from "../model-entry-refusal.js";
 import { PerTaskImageRegistry, resolveSandboxImageRef } from "../per-task-image.js";
 import { remoteScratchpadDirFor } from "../plugins/remote-scratchpad.js";
 import { attachmentBindRefusalAnswer, bindAttachmentsForTask } from "../plugins/task-attachment-store.js";
@@ -26,19 +25,23 @@ import { resourceSuspendOptIn } from "../resource-suspend.js";
 import { routeServiceTask, supPostureOverrides } from "../router/route-orchestration.js";
 import { tightenGoverned } from "../governance-overrides.js";
 import { applyRuntimeGovernance } from "../runtime-governance.js";
-import { HttpError, createCodedHttpError, encodeCheckpointScope } from "../security.js";
+import { HttpError, claimCallerOf, createCodedHttpError, encodeCheckpointScope } from "../security.js";
+import { partsOf } from "../owner-brands.js";
+import { recoveredSubject } from "../owner-faces.js";
+import { taskSpecIdentityOf } from "../engine-identity.js";
+import { anchorReaderOf, resolveHistoryAnchor } from "../history-anchor.js";
 import { headReadOf, sessionFaceOfHead } from "../session-incarnation.js";
 import { legProjectIdOf, sessionWorkspaceStoreOf } from "../session-workspace.js";
 import { memorySpecForRequest } from "../memory-scope.js";
 import { createMemoryProjectLayers } from "../memory-project-layer.js";
-import { inheritEnvFacts, inheritEnvFieldIssue, singleMemberOffFieldIssue } from "../request-value-closure.js";
+import { inheritEnvFieldIssue, singleMemberOffFieldIssue } from "../request-value-closure.js";
 import { a2aForScenario, mcpForScenario } from "../web-admin-client/facade.js";
 import { compactionSpecFragment, normalizeAttachments, normalizeResilience, normalizeResumeAtMode, normalizeSuggestNextPrompts, promptLeanSpecFragment, resolveTaskLimits, retainBackgroundProcessesFromBody, taskAgentsSpecFragment, toolMaterializeStrategyFromBody, allowToolsSpecFragment, toolNameListFromBody } from "../spec-fields.js";
 import { isAbsoluteHostPath } from "@sema-agent/settings-schema";
 import { effectiveHostWorkspace, parseAdditionalDirectories, satisfiedByProcessCwd, shellEnvMismatchCount } from "../task-cwd.js";
 import { DEPLOYMENT_SHAPE_PREDICATES } from "../deployment-shape.js";
 import { assertRequestA2aEntries, resolveRequestA2a, snapshotRequestA2a } from "../task-a2a.js";
-import { assertRequestImageUrls } from "../request-image-urls.js";
+import { assertRequestImages } from "../request-images.js";
 import { assertRequestMcpEntries, assertRequestMcpUnlocked, resolveRequestMcp } from "../task-mcp.js";
 import { GOVERNANCE_HTTP_STATUS } from "../governance-http-status.js";
 import { storedToolAxesRereadM19 } from "../stored-request-tool-axes-m19.js";
@@ -47,8 +50,10 @@ import { storedEnvCredentialsDropM38 } from "../stored-request-env-credentials-m
 import { serverCredentialValueSources } from "../server-secret-env.js";
 import { MAX_SETTINGS_OUTPUT_STYLE_CHARS, REQUEST_SETTINGS_REFUSAL_PREFIX, SETTINGS_RULE_REFUSAL_CODE, SettingsRuleRefusalError, acceptAppendSystemPrompt, applyTaskSettings, createWorkflowAskPolicy, effectivePermissionMode, effectiveThinking, parseTaskSettings, readSettingsEnv, taskHooksHonored, settingsEnvCredentialIssue, settingsPermissionBucketIssue, withoutKeys } from "../task-settings.js";
 import { tightenOnlySeatIssue } from "../tighten-only-seats.js";
+import { buildNeverAutoRetiredNotice } from "../retired-name-host-notice.js";
 import { entryProblemsFacts } from "../entry-problems.js";
 import { inertToolListEntryOf } from "../rule-entry-list.js";
+import { assertAttachmentIdsShape, assertImageProfileLane, assertInheritEnvServed, assertToolListsReadable, assertWriteFaceAdmitted, bodyImageProfileOf, scenarioRequestedBy } from "../request-form.js";
 import { TENANCY_WALL_CLOCK_BASE_SEC, enableForkFromBody, normalizeRetainSubagentSessions, selfOrchestrationFromBody } from "../task-workflow.js";
 import { redactSecrets } from "../trace/redact.js";
 import { DeferredSandboxPathEnv, sandboxPathEnvSlots } from "./deferred-sandbox-path-env.js";
@@ -56,26 +61,32 @@ import { executionLaneHomeDir, executionLaneOf, laneIsolated, laneWiresExecution
 import { executionConfigRootOf } from "../execution-config-root.js";
 import { withUnattendedLeg } from "../unattended-permission-mode.js";
 import { fieldConflictFacts } from "../field-conflict.js";
+function identityAxesOf(auth) {
+    const subject = auth?.subject === undefined ? undefined : recoveredSubject(auth.subject);
+    const parts = subject === undefined ? undefined : partsOf(subject);
+    return { subject, parts, person: parts?.person };
+}
 function unrooted(spec) {
     const { sessionId: _neverWritten, ...resolved } = spec;
     return resolved;
 }
 export function createResolveSpec(ctx) {
-    const { config, logger, metrics, localRoot, scenarios, principalCaps, centerRuntimeCapsResolver, getKeyResolver, taskAttachmentStore, perSessionCwd, setSessionCwd, setSessionShellEnv, fenceSessionOwner, hookLlm, hookAgent, belowTaskChainPatterns, fleetBus, hookWakeBus, resumeAnchorStore, ownerAware, taskLimitCaps, taskTimeoutSec, selectEnvTool, sendUserFileToolSpec, memoryEngine, memorySyncRunner, durableEnabled, approvalExemptionStore, checkpointStore, imageIndex, perTaskImage, sessionEnvSelection, liveQuestionFace, approverSeat, lockedKeys, loadedSkills, peerDesk, } = ctx;
+    const { config, logger, metrics, localRoot, scenarios, principalCaps, centerRuntimeCapsResolver, getKeyResolver, taskAttachmentStore, perSessionCwd, setSessionCwd, setSessionShellEnv, fenceSessionOwner, hookLlm, hookAgent, belowTaskChainPatterns, fleetBus, hookWakeBus, historyAnchors, ownerAware, taskLimitCaps, taskTimeoutSec, selectEnvTool, sendUserFileToolSpec, memoryEngine, memorySyncRunner, durableEnabled, approvalExemptionStore, checkpointStore, imageIndex, perTaskImage, sessionEnvSelection, liveQuestionFace, approverSeat, lockedKeys, loadedSkills, peerDesk, } = ctx;
     const deploymentSkillSources = new Map(loadedSkills.map((k) => [k.spec.name, k.source]));
     const scenarioGate = createScenarioGate({ config, scenarios, principalCaps, logger }, "enforce");
     const sessionHeadOf = headReadOf(ownerAware);
+    const anchorsResolvable = sessionHeadOf === undefined ? undefined : historyAnchors;
     const sessionWorkspace = sessionWorkspaceStoreOf(ownerAware);
     assertGuardPatternsUsable(config);
     const onlySensitiveBaseline = buildOnlySensitiveBaselineWarning(config, {
         approvalSeat: durableEnabled ? "durable" : "absent",
         singleUserAutoAcceptBaseline: singleUserAutoAcceptBaselineApplies(config),
     });
-    const realTaskRootOf = (auth) => {
+    const realTaskRootOf = (root) => {
         if (DEPLOYMENT_SHAPE_PREDICATES.sandboxPathAdjudication.holds(config))
             return undefined;
-        const sessionCwd = auth?.sessionId ? effectiveHostWorkspace(perSessionCwd.get(auth.sessionId), {}) : undefined;
-        return sessionCwd ?? (executionLaneOf(config.remoteExec?.provider) === "in-process" ? process.cwd() : undefined);
+        const sessionCwd = effectiveHostWorkspace(perSessionCwd.get(root), {});
+        return sessionCwd ?? (laneWiresExecutionEnv(config.remoteExec.provider) ? undefined : process.cwd());
     };
     const memoryProjectLayers = createMemoryProjectLayers({ stores: memoryEngine, syncRunner: memorySyncRunner, log: logger });
     if (onlySensitiveBaseline)
@@ -84,6 +95,7 @@ export function createResolveSpec(ctx) {
     if (approvalGrantNotice)
         logger.info(approvalGrantNotice.event, approvalGrantNotice.fields);
     const resolveSpec = async (body, req, auth, opts) => {
+        const root = opts.execution.root;
         const seatRefusal = gateIntentUnserviceableReason(config, checkpointStore !== undefined);
         if (seatRefusal !== undefined)
             throw createCodedHttpError(501, "capability.checkpoint_store_required", seatRefusal);
@@ -102,7 +114,7 @@ export function createResolveSpec(ctx) {
                 cwd: body.cwd,
                 shellScratchpadDir: body.scratchpadDir,
                 localDataRoot: config.localDataRoot ?? localRoot,
-                sessionId: auth?.sessionId,
+                sessionId: root,
                 requirePrincipal: config.requirePrincipal,
                 callerOwnsWorkerDisk: DEPLOYMENT_SHAPE_PREDICATES.callerOwnsWorkerDisk.holds(config),
             });
@@ -118,17 +130,7 @@ export function createResolveSpec(ctx) {
             const inheritEnvIssue = inheritEnvFieldIssue(body);
             if (inheritEnvIssue)
                 throw new HttpError(400, inheritEnvIssue.message, { code: "request.field_invalid", extra: inheritEnvIssue.facts });
-            if (body.inheritEnv === "all") {
-                const lane = executionLaneOf(config.remoteExec?.provider);
-                if (lane !== "host") {
-                    throw new HttpError(400, `inheritEnv:"all" applies to the host lane only (this deployment runs ${lane}) — only the host lane builds the model-driven shell's environment from this machine's own, so the declaration has no effect here; omit it (or send "scrub", the default, which every lane accepts)`, { code: "request.field_invalid", extra: inheritEnvFacts("lane_not_host") });
-                }
-                const why = taskInheritEnvRefusal(config);
-                if (why !== undefined)
-                    throw new HttpError(422, why, { code: HOST_POSTURE_REFUSED_CODE });
-                if (!auth?.sessionId)
-                    throw new HttpError(400, `inheritEnv:"all" requires a session-resolving deployment (no authorizer session) — the host shell's environment is bound per session`, { code: "request.field_invalid", extra: inheritEnvFacts("no_authorizer_session") });
-            }
+            assertInheritEnvServed(body, config);
         }
         {
             const bucketIssue = settingsPermissionBucketIssue(body.settings?.permissions);
@@ -151,7 +153,7 @@ export function createResolveSpec(ctx) {
                         dropped[e.match]++;
                     logger.warn("settings_env_credentials_dropped", {
                         migration: "M38",
-                        sessionId: auth?.sessionId ?? null,
+                        sessionId: root,
                         dropped,
                         note: "this replayed request was stored before the upgrade and its settings.env carries credentials (a credential variable name of this engine, or a value shaped like a secret); while one-time migration M38 is open they are dropped from what the session's shell and hooks receive and the task resumes — the engine's own credentials come from its process environment and are unaffected; once the window closes the same request is refused",
                     });
@@ -162,14 +164,12 @@ export function createResolveSpec(ctx) {
         }
         {
             const replay = opts?.leg === "resume";
-            const inertList = inertToolListEntryOf(body, replay ? ["deny"] : undefined);
-            if (inertList !== undefined)
-                throw new HttpError(400, inertList.message, { code: inertList.code, ...(inertList.extra !== undefined ? { extra: { ...inertList.extra } } : {}) });
+            assertToolListsReadable(body, replay ? ["deny"] : undefined);
             if (replay) {
                 const stale = inertToolListEntryOf(body, ["allow"]);
                 if (stale !== undefined) {
                     logger.warn("stored_allow_list_inert_resumed", {
-                        sessionId: auth?.sessionId ?? null,
+                        sessionId: root,
                         layer: stale.layer,
                         sentence: stale.message,
                         note: "this resumed task's stored request carries an allow-list entry the engine reads as nothing (a retired name, a case twin, an unreadable spelling or a content form): the entry stays as written and grants nothing — the task ran that way before the upgrade, so it continues; fix the entry in a new submission to get what it was meant to allow",
@@ -179,88 +179,82 @@ export function createResolveSpec(ctx) {
         }
         if (opts?.leg === "fresh")
             assertRequestA2aEntries(a2aPeers);
-        if (opts?.leg === "fresh")
-            assertRequestImageUrls(body.images);
-        const gated = await gateScenarioAndAppend(body, auth, opts, settingsEnv);
-        const effMode = effectivePermissionMode(body, gated.parsedSettings.settings);
         {
-            const why = permissionModeWriteFaceRefusal(effMode, config);
-            if (why !== undefined)
-                throw new HttpError(422, why, { code: HOST_POSTURE_REFUSED_CODE });
+            const unread = unreadRequestMembers({ settings: body.settings, mcpServers: body.mcpServers, a2aPeers }, config, opts?.leg === "fresh" ? { replay: false, settingsEnv } : { replay: true, today: new Date().toISOString().slice(0, 10), storedToolAxes, settingsEnv });
+            if (unread.length > 0) {
+                const refusal = unreadRequestMembersRefusal(unread);
+                throw new HttpError(400, refusal.message, { code: refusal.errorCode, ...(refusal.facts !== undefined ? { extra: { ...refusal.facts } } : {}) });
+            }
         }
-        const lane = bindSettingsCwdEnvAndModel(body, auth, gated, opts);
-        const anchors = await resolveHistoryAnchors(body, auth);
-        const projectKey = memoryEngine ? await memoryProjectLayers.prepare(config, auth?.memoryScope, realTaskRootOf(auth)) : undefined;
+        if (opts?.leg === "fresh")
+            assertRequestImages(body.images);
+        const gated = await gateScenarioAndAppend(body, auth, root, opts, settingsEnv);
+        const effMode = effectivePermissionMode(body, gated.parsedSettings.settings);
+        assertWriteFaceAdmitted(effMode, config);
+        const lane = bindSettingsCwdEnvAndModel(body, auth, root, gated, opts);
+        const anchors = await resolveHistoryAnchors(body, req, auth, root);
+        const projectKey = memoryEngine ? await memoryProjectLayers.prepare(config, auth?.memoryScope, realTaskRootOf(root)) : undefined;
         const runSkills = buildRunSkills({ scenario: gated.cap.skills, request: body.skills, disable: body.disableSkills === true, deploymentSources: deploymentSkillSources }, logger);
-        const spec = assembleSpecLiteral(body, auth, req, opts, { ...gated, ...lane, ...anchors, projectKey, a2aPeers, storedToolAxes, runSkills }, effMode);
-        const folded = await foldGovernanceAndSettings(body, auth, spec, gated);
-        const final = await applyImageFactsAndRouting(body, auth, folded.governed, {
+        const spec = assembleSpecLiteral(body, auth, root, req, opts, { ...gated, ...lane, ...anchors, projectKey, a2aPeers, storedToolAxes, runSkills }, effMode);
+        const folded = await foldGovernanceAndSettings(body, auth, root, spec, gated);
+        const retiredNotice = opts.onNotice !== undefined ? buildNeverAutoRetiredNotice(gated.parsedSettings.settings?.tightenOnly?.neverAuto, root) : undefined;
+        if (retiredNotice !== undefined)
+            opts.onNotice?.(retiredNotice);
+        const final = await applyImageFactsAndRouting(body, auth, root, folded.governed, {
             scenarioName: gated.scenarioName,
             scratchpadDir: folded.scratchpadDir,
             hostSemanticsLane: folded.hostSemanticsLane,
         });
         return { spec: final, facts: { hands: gated.hands, skills: runSkills.roster, sessionWitness: gated.sessionWitness } };
     };
-    const gateScenarioAndAppend = async (body, auth, opts, settingsEnv) => {
-        const scenarioName = await scenarioGate(auth?.principal, body.scenario);
-        const root = opts.execution.root;
+    const gateScenarioAndAppend = async (body, auth, root, opts, settingsEnv) => {
+        const { parts: subjectParts, person } = identityAxesOf(auth);
+        const requestedScenario = scenarioRequestedBy(subjectParts?.scenario, body.scenario);
+        const scenarioName = await scenarioGate(person, requestedScenario);
         const rootFace = sessionHeadOf === undefined ? undefined : sessionFaceOfHead(root, await sessionHeadOf(root));
         const sessionWitness = { sessionId: root, owner: rootFace?.owner ?? null, incarnation: rootFace?.incarnation ?? null };
-        const cap = selectScenario(scenarios, scenarioName)(body, auth?.principal, { sessionId: sessionWitness.sessionId, delegationRoot: sessionWitness });
-        const acceptedAppend = acceptAppendSystemPrompt(body.appendSystemPrompt, (detail) => logger.warn("append_system_prompt_dropped", { detail, sessionId: auth?.sessionId ?? null }));
+        const cap = selectScenario(scenarios, scenarioName)(body, person, { sessionId: sessionWitness.sessionId, delegationRoot: sessionWitness });
+        const acceptedAppend = acceptAppendSystemPrompt(body.appendSystemPrompt, (detail) => logger.warn("append_system_prompt_dropped", { detail, sessionId: root }));
         const objective = typeof body.objective === "string" ? body.objective : "";
         const parsedSettings = parseTaskSettings(body.settings, {
             ...(opts?.leg === "fresh" || !taskHooksHonored(config) ? {} : { storedHooksReread: storedHooksRereadM20(new Date().toISOString().slice(0, 10)) }),
             settingsEnv,
         });
-        if (parsedSettings.deferred.length > 0) {
-            logger.warn("task_settings_deferred", { fields: parsedSettings.deferred, sessionId: auth?.sessionId ?? null });
-        }
         if (parsedSettings.hooksReread !== undefined) {
             logger.warn("hooks_read_as_before_upgrade", {
                 migration: "M20",
-                sessionId: auth?.sessionId ?? null,
+                sessionId: root,
                 stripped: parsedSettings.hooksReread.stripped,
-                note: "this replayed request was stored before the upgrade and its settings.hooks carries a shape the hooks reader now refuses (a key the reader does not know that hides a guard-event member, or a JSON `__proto__` event key); while one-time migration M20 is open the keys named in `stripped` are dropped — what the pre-upgrade reader dropped — and the rest goes through the same reader again, so the guard hooks keep running; once the window closes the same request has its whole settings.hooks left out",
+                note: "this replayed request was stored before the upgrade and its settings.hooks carries a shape the hooks reader now refuses (a key the reader does not know that hides a guard-event member, or a JSON `__proto__` event key); while one-time migration M20 is open the keys named in `stripped` are dropped — what the pre-upgrade reader dropped — and the rest goes through the same reader again, so the guard hooks keep running; once the window closes the same request is refused on resume (409 resume_blocked_by_policy)",
             });
         }
-        if (parsedSettings.deferred.includes("hooks") && taskHooksHonored(config)) {
-            recordFailOpen("server.hooks.resume-reader-refused", `leg=${opts?.leg ?? "resume"}`);
-        }
         let attachmentNotice;
         {
             const reqAtt = body.attachmentIds;
             if (reqAtt !== undefined) {
-                if (!Array.isArray(reqAtt) || !reqAtt.every((x) => typeof x === "string" && x.length > 0 && x.length <= 64)) {
-                    throw new HttpError(400, "`attachmentIds` must be an array of attachment ids (strings)");
-                }
-                if (reqAtt.length > 16)
-                    throw new HttpError(400, "`attachmentIds` exceeds the per-task limit (16)");
+                assertAttachmentIdsShape(reqAtt);
                 if (reqAtt.length > 0) {
                     if (!taskAttachmentStore)
                         throw new HttpError(501, "attachmentIds require a store backend (DB_BACKEND=mysql|pg|local)");
-                    if (!auth?.sessionId)
-                        throw new HttpError(400, "`attachmentIds` requires a session-resolving deployment (no authorizer session)");
-                    const sid = auth.sessionId;
                     const lane = opts.execution.lane;
                     const r = await bindAttachmentsForTask({
                         store: taskAttachmentStore,
-                        owner: auth?.principal ?? "default",
+                        owner: auth?.subject ?? "default",
                         ids: reqAtt,
-                        sessionId: sid,
+                        sessionId: root,
                         lane: { word: lane, isolated: laneIsolated(lane) },
                         leg: opts?.leg === "fresh" ? "fresh" : "resume",
                         nowMs: Date.now(),
                         onMissing: (id) => {
                             if (opts?.leg === "fresh")
                                 throw new HttpError(400, `attachment not found: ${id}`);
-                            logger.warn("attachment_missing_on_resume", { sessionId: sid, id });
+                            logger.warn("attachment_missing_on_resume", { sessionId: root, id });
                         },
                         onRefused: (refusal) => {
                             const answer = attachmentBindRefusalAnswer(refusal);
                             if (opts?.leg === "fresh")
                                 throw createCodedHttpError(answer.status, answer.errorCode, answer.message, answer.extra);
-                            logger.warn("attachment_refused_on_resume", { sessionId: sid, errorCode: answer.errorCode, ...answer.extra });
+                            logger.warn("attachment_refused_on_resume", { sessionId: root, errorCode: answer.errorCode, ...answer.extra });
                         },
                     });
                     attachmentNotice = r.notice;
@@ -269,46 +263,45 @@ export function createResolveSpec(ctx) {
         }
         return { scenarioName, cap, hands: cap.hands, acceptedAppend, objective, parsedSettings, attachmentNotice, sessionWitness };
     };
-    const bindSettingsCwdEnvAndModel = (body, auth, gated, opts) => {
+    const bindSettingsCwdEnvAndModel = (body, auth, root, gated, opts) => {
         const { objective, parsedSettings } = gated;
         const cwdWriteGate = DEPLOYMENT_SHAPE_PREDICATES.callerCwd.holds(config);
-        const execLane = executionLaneOf(config.remoteExec?.provider);
-        if (auth?.sessionId)
-            fenceSessionOwner(auth.sessionId, auth.principal ?? null);
-        if (typeof body.cwd === "string" && body.cwd.length > 0 && auth?.sessionId) {
+        const execLane = config.remoteExec.provider;
+        fenceSessionOwner(root, auth?.subject ?? null, opts.execution.occupant?.incarnation);
+        if (typeof body.cwd === "string" && body.cwd.length > 0) {
             if (cwdWriteGate && isAbsoluteHostPath(body.cwd))
-                setSessionCwd(auth.sessionId, body.cwd);
-            else if (DEPLOYMENT_SHAPE_PREDICATES.inProcessSingleUser.holds(config) && isAbsoluteHostPath(body.cwd) && satisfiedByProcessCwd(body.cwd, realpathSync))
-                logger.debug("task_cwd_inherited", { lane: execLane, sessionId: auth.sessionId });
+                setSessionCwd(root, body.cwd);
+            else if (DEPLOYMENT_SHAPE_PREDICATES.noHandsSingleUser.holds(config) && isAbsoluteHostPath(body.cwd) && satisfiedByProcessCwd(body.cwd, realpathSync))
+                logger.debug("task_cwd_inherited", { lane: execLane, sessionId: root });
             else
-                logger.warn("task_cwd_ignored", { honored: cwdWriteGate, lane: execLane, sessionId: auth.sessionId });
+                logger.warn("task_cwd_ignored", { honored: cwdWriteGate, lane: execLane, sessionId: root });
         }
-        if (parsedSettings.settings?.shellEnv && auth?.sessionId) {
+        if (parsedSettings.settings?.shellEnv) {
             if (cwdWriteGate)
-                setSessionShellEnv(auth.sessionId, parsedSettings.settings.shellEnv);
-            else if (DEPLOYMENT_SHAPE_PREDICATES.inProcessSingleUser.holds(config)) {
+                setSessionShellEnv(root, parsedSettings.settings.shellEnv);
+            else if (DEPLOYMENT_SHAPE_PREDICATES.noHandsSingleUser.holds(config)) {
                 const requested = parsedSettings.settings.shellEnv;
                 const mismatched = shellEnvMismatchCount(requested, process.env);
                 if (mismatched === 0)
-                    logger.debug("task_shell_env_inherited", { lane: execLane, keys: Object.keys(requested).length, sessionId: auth.sessionId });
+                    logger.debug("task_shell_env_inherited", { lane: execLane, keys: Object.keys(requested).length, sessionId: root });
                 else
-                    logger.warn("task_shell_env_ignored", { honored: false, lane: execLane, mismatchedKeys: mismatched, sessionId: auth.sessionId });
+                    logger.warn("task_shell_env_ignored", { honored: false, lane: execLane, mismatchedKeys: mismatched, sessionId: root });
             }
             else
-                logger.warn("task_shell_env_ignored", { honored: false, lane: execLane, sessionId: auth.sessionId });
+                logger.warn("task_shell_env_ignored", { honored: false, lane: execLane, sessionId: root });
         }
         const taskHooks = (() => {
             const hc = parsedSettings.settings?.hooks;
             if (!hc)
                 return [];
             if (!taskHooksHonored(config)) {
-                logger.warn("task_hooks_ignored", { honored: false, sessionId: auth?.sessionId ?? null });
+                logger.warn("task_hooks_ignored", { honored: false, sessionId: root });
                 return [];
             }
             return createSettingsHooksRegistrations(hc, {
                 logger,
-                sessionId: auth?.sessionId ?? "",
-                cwd: (auth?.sessionId ? perSessionCwd.get(auth.sessionId) : undefined) ?? process.cwd(),
+                sessionId: root,
+                cwd: perSessionCwd.get(root) ?? process.cwd(),
                 ...(parsedSettings.settings?.shellEnv ? { shellEnv: parsedSettings.settings.shellEnv } : {}),
                 httpHookAllowlistLayers: parsedSettings.settings?.httpHookAllowlist !== undefined ? [parsedSettings.settings.httpHookAllowlist] : [],
                 belowTaskChainPatterns,
@@ -316,79 +309,66 @@ export function createResolveSpec(ctx) {
                 hookAgent,
                 onHookNotice: (n) => fleetBus.publishHookNotice({
                     ...n,
-                    ...(auth?.principal ? { ownerScope: auth.principal } : {}),
-                    ...(auth?.sessionId ? { ownerSessionId: auth.sessionId } : {}),
+                    ...(auth?.subject ? { ownerScope: auth.subject } : {}),
+                    ownerSessionId: root,
                 }),
-                ...(auth?.sessionId
-                    ? {
-                        wake: async (text) => hookWakeBus.deliver
-                            ?
-                                hookWakeBus.deliver(auth.sessionId, `[hook asyncRewake] ${redactSecrets(text)}`)
-                            : false,
-                    }
-                    : {}),
+                wake: async (text) => hookWakeBus.deliver
+                    ?
+                        hookWakeBus.deliver(root, `[hook asyncRewake] ${redactSecrets(text)}`)
+                    : false,
             }, settingsHooksBudgetMs(config));
         })();
         const rawAddDirs = body.additionalDirectories;
         const callerOwnsWorkerDisk = DEPLOYMENT_SHAPE_PREDICATES.callerOwnsWorkerDisk.holds(config);
         const additionalDirectories = callerOwnsWorkerDisk ? parseAdditionalDirectories(rawAddDirs) : undefined;
         if (rawAddDirs !== undefined && !callerOwnsWorkerDisk) {
-            logger.warn("task_additional_directories_ignored", { honored: false, sessionId: auth?.sessionId ?? null });
+            logger.warn("task_additional_directories_ignored", { honored: false, sessionId: root });
         }
         const rawAddReadDirs = body.additionalReadDirectories;
         const additionalReadDirectories = callerOwnsWorkerDisk ? parseAdditionalDirectories(rawAddReadDirs) : undefined;
         if (rawAddReadDirs !== undefined && !callerOwnsWorkerDisk) {
-            logger.warn("task_additional_read_directories_ignored", { honored: false, sessionId: auth?.sessionId ?? null });
+            logger.warn("task_additional_read_directories_ignored", { honored: false, sessionId: root });
         }
-        const wireCatalog = selectableCatalog(config.models, config.tiers, config.modelRefusals);
-        const picked = resolveTaskModel(body.model ?? parsedSettings.settings?.model, objective, wireCatalog, config.atMention, config.modelRefusals);
+        const { selectable: wireCatalog, picked } = pickUserModel(config, body.model ?? parsedSettings.settings?.model, objective);
         if (picked.unavailable !== undefined) {
             const { requested, name, refusal, source } = picked.unavailable;
             if (opts?.leg === "fresh") {
                 throw new HttpError(400, modelUnavailableMessage(source === "mention" ? "@-mention" : "model", requested, name, refusal), { code: "request.model_unavailable" });
             }
             metrics.inc("task_model_unavailable_fallback_total");
-            logger.warn("task_model_unavailable_fallback", { requested: echoModelRef(requested), name, code: refusal.code, source, fallback: picked.model, sessionId: auth?.sessionId ?? null });
+            logger.warn("task_model_unavailable_fallback", { requested: echoModelRef(requested), name, code: refusal.code, source, fallback: picked.model, sessionId: root });
         }
         if (picked.notAllowed !== undefined) {
             const { requested, resolved, source } = picked.notAllowed;
             if (opts?.leg === "fresh") {
-                throw new HttpError(400, `model "${echoModelRef(requested)}" is not @-mentionable on this deployment (it resolves to catalog model "${resolved}") — which models can be @-mentioned is configured by the operator (models.atMention)`, { code: "request.model_not_allowed" });
+                throw new HttpError(400, modelNotAllowedMessage("model", requested, resolved), { code: "request.model_not_allowed" });
             }
             metrics.inc("task_model_not_allowlisted_resume_total");
-            logger.warn("task_model_not_allowlisted_resume", { requested: echoModelRef(requested), resolved, source, sessionId: auth?.sessionId ?? null, note: "resumed leg keeps running the model it was started on — the allowlist gates fresh picks only" });
+            logger.warn("task_model_not_allowlisted_resume", { requested: echoModelRef(requested), resolved, source, sessionId: root, note: "resumed leg keeps running the model it was started on — the allowlist gates fresh picks only" });
         }
         if (picked.unknownExplicit !== undefined) {
             metrics.inc("task_model_unknown_fallback_total");
-            logger.warn("task_model_unknown_fallback", { requested: echoModelRef(picked.unknownExplicit), fallback: picked.model, sessionId: auth?.sessionId ?? null });
+            logger.warn("task_model_unknown_fallback", { requested: echoModelRef(picked.unknownExplicit), fallback: picked.model, sessionId: root });
         }
         return { taskHooks, additionalDirectories, additionalReadDirectories, wireCatalog, picked };
     };
-    const NO_ANCHOR_HINT = "no rewind anchor is recorded under that handle (a prompt that carried attachments records none when its attachment frames were interrupted or their count did not match)";
-    const resolveHistoryAnchors = async (body, auth) => {
+    const resolveHistoryAnchors = async (body, req, auth, root) => {
+        const anchorReader = req === undefined ? undefined : anchorReaderOf(req, { config, logger }, claimCallerOf(identityAxesOf(auth).subject, config));
         let resumeAtEntryId;
         if (typeof body.resumeAt === "string" && body.resumeAt.length > 0) {
-            if (!auth?.sessionId)
-                throw new HttpError(422, "resumeAt requires a session to branch (resume_at.no_session)", { code: "resume_at.no_session" });
-            if (!resumeAnchorStore || !sessionHeadOf)
+            if (!anchorsResolvable)
                 throw new HttpError(501, "resume-at is not available on this worker (no session-store backend for the anchor map)");
-            resumeAtEntryId = await resumeAnchorStore.resolve(auth.sessionId, body.resumeAt, auth.principal ?? null);
-            if (resumeAtEntryId === undefined)
-                throw new HttpError(404, `resumeAt: no such message in this session (resume_at.unknown_event) — ${NO_ANCHOR_HINT}; give an explicit resumeAt`, { code: "resume_at.unknown_event" });
+            resumeAtEntryId = await resolveHistoryAnchor("resumeAt", anchorsResolvable, anchorReader, root, body.resumeAt, auth?.subject ?? null, "resumeAt");
         }
         let rewindFilesToEntryId;
         if (resumeAtEntryId === undefined && typeof body.rewindFilesTo === "string" && body.rewindFilesTo.length > 0) {
-            if (!auth?.sessionId)
-                throw new HttpError(422, "rewindFilesTo requires a session (rewind_files_to.no_session)", { code: "rewind_files_to.no_session" });
-            if (!resumeAnchorStore || !sessionHeadOf)
+            if (!anchorsResolvable)
                 throw new HttpError(501, "rewind-files-to is not available on this worker (no session-store backend for the anchor map)");
-            rewindFilesToEntryId = await resumeAnchorStore.resolve(auth.sessionId, body.rewindFilesTo, auth.principal ?? null);
-            if (rewindFilesToEntryId === undefined)
-                throw new HttpError(404, `rewindFilesTo: no such message in this session (rewind_files_to.unknown_event) — ${NO_ANCHOR_HINT}; name another prompt`, { code: "rewind_files_to.unknown_event" });
+            rewindFilesToEntryId = await resolveHistoryAnchor("rewindFilesTo", anchorsResolvable, anchorReader, root, body.rewindFilesTo, auth?.subject ?? null, "rewindFilesTo");
         }
         const submittedProjectId = auth?.resolvedProjectId ?? (typeof body.projectId === "string" && body.projectId ? body.projectId.toLowerCase() : undefined);
         const s4DefaultScopes = submittedProjectId ? config.projects[submittedProjectId]?.defaultScopes : undefined;
-        const legProjectId = await legProjectIdOf(submittedProjectId, sessionWorkspace, auth?.sessionId);
+        const legProjectId = await legProjectIdOf(submittedProjectId, sessionWorkspace, root);
         return { resumeAtEntryId, rewindFilesToEntryId, s4DefaultScopes, legProjectId };
     };
     const declaresInteractivePosture = (body, req, opts) => {
@@ -405,7 +385,8 @@ export function createResolveSpec(ctx) {
         const askForm = resolveAskSeamForm(body.approvalReach !== undefined ? { approvalReach: body.approvalReach } : {}, approverSeat !== undefined ? { onAsk: approverSeat } : {});
         return deriveAskEffective(askForm.form, "unresolved") === "human_reachable";
     };
-    const assembleSpecLiteral = (body, auth, req, opts, parts, effMode) => {
+    const assembleSpecLiteral = (body, auth, root, req, opts, parts, effMode) => {
+        const { parts: subjectParts, person } = identityAxesOf(auth);
         const { scenarioName, cap, hands, acceptedAppend, parsedSettings, attachmentNotice, taskHooks, additionalDirectories, additionalReadDirectories, wireCatalog, picked, resumeAtEntryId, rewindFilesToEntryId, s4DefaultScopes, legProjectId, projectKey, a2aPeers, storedToolAxes, runSkills, } = parts;
         const spec = {
             objective: attachmentNotice ? `${picked.cleanedObjective}\n\n${attachmentNotice}` : picked.cleanedObjective,
@@ -414,7 +395,7 @@ export function createResolveSpec(ctx) {
             ...(body.outputStyle !== undefined ? { outputStyle: body.outputStyle } : {}),
             ...(body.projectMemory !== undefined ? { projectMemory: body.projectMemory } : {}),
             ...(legProjectId !== undefined ? { projectId: legProjectId } : {}),
-            principal: auth?.principal,
+            principal: taskSpecIdentityOf(subjectParts).principal,
             images: body.images,
             ...(body.userAttachments !== undefined ? { userAttachments: body.userAttachments } : {}),
             ...(body.clientContext ? { clientContext: { timeZone: body.clientContext.timeZone, userEmail: body.clientContext.userEmail } } : {}),
@@ -425,7 +406,6 @@ export function createResolveSpec(ctx) {
                 : {}),
             resumeAt: resumeAtEntryId,
             resumeAtMode: normalizeResumeAtMode(body.resumeAtMode, resumeAtEntryId !== undefined),
-            requireExistingSession: body.requireExistingSession === true ? true : undefined,
             enableFork: enableForkFromBody(body, config, Boolean(centerRuntimeCapsResolver)),
             suggestNextPrompts: normalizeSuggestNextPrompts(body.suggestNextPrompts),
             restoreFiles: body.restoreFiles === true ? true : undefined,
@@ -439,8 +419,8 @@ export function createResolveSpec(ctx) {
             selfOrchestration: selfOrchestrationFromBody({ selfOrchestration: body.selfOrchestration === true || parsedSettings.settings?.ultracode === true }, config, Boolean(centerRuntimeCapsResolver)),
             forwardSubagentEvents: body.forwardSubagentEvents === true ? true : undefined,
             retainSubagentSessions: normalizeRetainSubagentSessions(body.retainSubagentSessions),
-            ...taskAgentsSpecFragment(body.agents, config.requirePrincipal, (event, fields) => logger.warn(event, { ...fields, sessionId: auth?.sessionId ?? null })),
-            ...(retainBackgroundProcessesFromBody(body.retainBackgroundProcesses, config.requirePrincipal, (event, fields) => logger.warn(event, { ...fields, sessionId: auth?.sessionId ?? null })) === true
+            ...taskAgentsSpecFragment(body.agents, config.requirePrincipal, (event, fields) => logger.warn(event, { ...fields, sessionId: root })),
+            ...(retainBackgroundProcessesFromBody(body.retainBackgroundProcesses, config.requirePrincipal, (event, fields) => logger.warn(event, { ...fields, sessionId: root })) === true
                 ? { retainBackgroundProcesses: true }
                 : {}),
             ...(body.excludeAllTools === true ? { excludeAllTools: true } : {}),
@@ -453,7 +433,7 @@ export function createResolveSpec(ctx) {
             ...(declaresInteractivePosture(body, req, opts) ? { interactionPosture: "interactive" } : {}),
             ...(body.approvalReach !== undefined ? { approvalReach: body.approvalReach } : {}),
             ...(typeof body.oneShot === "boolean" ? { oneShot: body.oneShot } : {}),
-            resilience: normalizeResilience(body.resilience, explicitOperatorOk(auth?.principal, config)),
+            resilience: normalizeResilience(body.resilience, explicitOperatorOk(person, config)),
             finalVerification: cap.finalVerification === true || body.finalVerification === true ? true : undefined,
             attachments: normalizeAttachments(body.attachments),
             ...(taskHooks.length > 0 ? { mods: [...taskHooks] } : {}),
@@ -471,23 +451,23 @@ export function createResolveSpec(ctx) {
                         throw new HttpError(400, `unknown compactionModel "${echoModelRef(body.compactionModel)}" — not in the configured catalog (name, tier word, or id; a catalog refresh may have removed it mid-request)`);
                     }
                     metrics.inc("task_model_unknown_fallback_total");
-                    logger.warn("compaction_model_unknown_fallback", { requested: echoModelRef(body.compactionModel), sessionId: auth?.sessionId ?? null });
+                    logger.warn("compaction_model_unknown_fallback", { requested: echoModelRef(body.compactionModel), sessionId: root });
                     return {};
                 }
                 if (!isAtMentionable(cm, wireCatalog, config.atMention, config.modelRefusals)) {
                     const terminal = terminalCatalogName(cm, wireCatalog, config.modelRefusals) ?? cm;
                     if (opts?.leg === "fresh") {
-                        throw new HttpError(400, `compactionModel "${echoModelRef(body.compactionModel)}" is not @-mentionable on this deployment (it resolves to catalog model "${terminal}") — which models can be @-mentioned is configured by the operator (models.atMention)`, { code: "request.model_not_allowed" });
+                        throw new HttpError(400, modelNotAllowedMessage("compactionModel", body.compactionModel, terminal), { code: "request.model_not_allowed" });
                     }
                     metrics.inc("task_model_not_allowlisted_resume_total");
-                    logger.warn("task_model_not_allowlisted_resume", { requested: echoModelRef(body.compactionModel), resolved: terminal, source: "compaction", sessionId: auth?.sessionId ?? null, note: "resumed leg keeps the compaction model it was started with — the allowlist gates fresh picks only" });
+                    logger.warn("task_model_not_allowlisted_resume", { requested: echoModelRef(body.compactionModel), resolved: terminal, source: "compaction", sessionId: root, note: "resumed leg keeps the compaction model it was started with — the allowlist gates fresh picks only" });
                 }
                 return { compactionModel: cm };
             })()),
             thinking: effectiveThinking(body.reasoningEffort, parsedSettings.settings?.ultracode === true),
             getApiKeyAndHeaders: getKeyResolver(),
             ...(() => {
-                const limits = resolveTaskLimits(body.limits, taskLimitCaps, taskTimeoutSec, config.requirePrincipal, (event, fields) => logger.warn(event, { ...fields, sessionId: auth?.sessionId ?? null }));
+                const limits = resolveTaskLimits(body.limits, taskLimitCaps, taskTimeoutSec, config.requirePrincipal, (event, fields) => logger.warn(event, { ...fields, sessionId: root }));
                 const declarations = [];
                 if (taskLimitCaps.timeoutSec !== undefined)
                     declarations.push({ key: "server.limits.timeoutSecCap", value: String(taskLimitCaps.timeoutSec), reason: "env TASK_TIMEOUT_MAX_SEC (seconds; operator ceiling applied to caller limits.maxWalltimeMs as cap×1000)" });
@@ -535,13 +515,13 @@ export function createResolveSpec(ctx) {
             ...(() => { const v = toolNameListFromBody(body.userInvokedSkills); return v ? { userInvokedSkills: v } : {}; })(),
             ...(parsedSettings.settings?.skillListingBudgetFraction !== undefined ? { skillListingBudgetFraction: parsedSettings.settings.skillListingBudgetFraction } : {}),
             ...(parsedSettings.settings?.skillListingMaxDescChars !== undefined ? { skillListingMaxDescChars: parsedSettings.settings.skillListingMaxDescChars } : {}),
-            mcp: resolveRequestMcp(mcpForScenario(config.mcpServers, scenarioName), body.mcpServers, config, peerDesk, opts.lease, logger, opts?.onNotice !== undefined ? { sessionId: auth?.sessionId, emit: opts.onNotice } : undefined, storedToolAxes),
+            mcp: resolveRequestMcp(mcpForScenario(config.mcpServers, scenarioName), body.mcpServers, config, peerDesk, opts.lease, logger, opts?.onNotice !== undefined ? { sessionId: root, emit: opts.onNotice } : undefined, storedToolAxes),
             a2a: resolveRequestA2a(a2aForScenario(config.a2aPeers, scenarioName), a2aPeers, config, peerDesk, opts.lease, logger, opts?.leg === "fresh" ? "fresh" : "resume", storedToolAxes),
             toolPolicy: toolPolicyForHands(hands, durableEnabled
                 ? createApprovalBaselinePolicy(config, {
                     kind: "durable",
                     question: liveQuestionFace,
-                    ...(approvalExemptionStore !== undefined && auth?.sessionId ? { exemption: createDeploymentListExemption(approvalExemptionStore, auth.sessionId, logger) } : {}),
+                    ...(approvalExemptionStore !== undefined ? { exemption: createSessionExemptionRead(approvalExemptionStore, root, logger, "deployment_list") } : {}),
                 })
                 : singleUserAutoAcceptBaselineApplies(config)
                     ? createApprovalBaselinePolicy(config, { kind: "absent" })
@@ -550,14 +530,13 @@ export function createResolveSpec(ctx) {
                 ? {
                     checkpointStore,
                     durableApproval: {
-                        scope: encodeCheckpointScope(auth?.principal),
+                        scope: encodeCheckpointScope(auth?.subject),
                         ...(config.approvalTimeoutSec > 0 ? { ttlMs: config.approvalTimeoutSec * 1000 } : {}),
                     },
                     ...((rs) => (rs ? { resourceSuspend: rs } : {}))(resourceSuspendOptIn({
                         enabled: config.resourceSuspend,
                         ttlSec: config.resourceSuspendTtlSec,
-                        isCascade: body.cascade === true,
-                        scope: encodeCheckpointScope(auth?.principal),
+                        scope: encodeCheckpointScope(auth?.subject),
                         totalTokens: config.resourceSuspendTotalTokens,
                         totalBudgetUsd: config.resourceSuspendTotalBudgetUsd,
                         maxSlices: config.resourceSuspendMaxSlices,
@@ -568,7 +547,7 @@ export function createResolveSpec(ctx) {
         };
         return spec;
     };
-    const foldGovernanceAndSettings = async (body, auth, spec, gated) => {
+    const foldGovernanceAndSettings = async (body, auth, root, spec, gated) => {
         const { acceptedAppend, parsedSettings } = gated;
         const hostSemanticsLane = !DEPLOYMENT_SHAPE_PREDICATES.sandboxPathAdjudication.holds(config);
         const laneHomeBase = () => {
@@ -577,7 +556,7 @@ export function createResolveSpec(ctx) {
         };
         const pathAdjudication = hostSemanticsLane
             ? (() => {
-                const realRoot = realTaskRootOf(auth);
+                const realRoot = realTaskRootOf(root);
                 const gateCwd = realRoot ?? join(config.localDataRoot ?? localRoot, "fs-write-gate-unrooted");
                 return {
                     env: new NodeExecutionEnv({ cwd: gateCwd }),
@@ -588,9 +567,9 @@ export function createResolveSpec(ctx) {
             })()
             : {
                 env: new DeferredSandboxPathEnv({
-                    sessionId: auth?.sessionId,
+                    sessionId: root,
                     slots: sandboxPathEnvSlots,
-                    logger: { warn: (event, fields) => logger.warn(event, { ...(fields ?? {}), lane: config.remoteExec?.provider }) },
+                    logger: { warn: (event, fields) => logger.warn(event, { ...(fields ?? {}), lane: config.remoteExec.provider }) },
                 }),
                 ...laneHomeBase(),
             };
@@ -598,18 +577,18 @@ export function createResolveSpec(ctx) {
         let governed = governedBase;
         let effectiveSettings = parsedSettings.settings;
         if (effectiveSettings?.outputStyle && acceptedAppend && acceptedAppend.length + 2 + effectiveSettings.outputStyle.length > MAX_SETTINGS_OUTPUT_STYLE_CHARS) {
-            logger.warn("output_style_dropped", { detail: `combined append carriers exceed the ${MAX_SETTINGS_OUTPUT_STYLE_CHARS} cap (rider ${acceptedAppend.length} + style ${effectiveSettings.outputStyle.length}) — style dropped (pre-cap stored body on a resume leg?)`, sessionId: auth?.sessionId ?? null });
+            logger.warn("output_style_dropped", { detail: `combined append carriers exceed the ${MAX_SETTINGS_OUTPUT_STYLE_CHARS} cap (rider ${acceptedAppend.length} + style ${effectiveSettings.outputStyle.length}) — style dropped (pre-cap stored body on a resume leg?)`, sessionId: root });
             const { outputStyle: _dropped2, ...rest2 } = effectiveSettings;
             effectiveSettings = Object.keys(rest2).length > 0 ? rest2 : undefined;
         }
         const shellScratchpad = await acceptShellScratchpadDir(body.scratchpadDir, {
             requirePrincipal: config.requirePrincipal,
             hostSemanticsLane,
-            warn: (msg, meta) => logger.warn(msg, { ...(meta ?? {}), sessionId: auth?.sessionId ?? null }),
+            warn: (msg, meta) => logger.warn(msg, { ...(meta ?? {}), sessionId: root }),
         });
         const scratchpadDir = shellScratchpad ??
-            (hostSemanticsLane && auth?.sessionId
-                ? await ensureScratchpadDir(config.localDataRoot ?? localRoot, auth.sessionId, (msg, meta) => logger.warn(msg, { ...(meta ?? {}), sessionId: auth.sessionId }))
+            (hostSemanticsLane
+                ? await ensureScratchpadDir(config.localDataRoot ?? localRoot, root, (msg, meta) => logger.warn(msg, { ...(meta ?? {}), sessionId: root }))
                 : undefined);
         if (effectiveSettings) {
             const configRoot = executionConfigRootOf(config);
@@ -629,52 +608,41 @@ export function createResolveSpec(ctx) {
         }
         if (governed.selfOrchestration === true) {
             governed = tightenGoverned(governed, {
-                toolPolicy: createWorkflowAskPolicy(approvalExemptionStore && auth?.sessionId
-                    ? async (toolName) => {
-                        const hit = await approvalExemptionStore.has(auth.sessionId, toolName);
-                        if (hit)
-                            logger.info("workflow_gate_exempted", { toolName, sessionId: auth.sessionId });
-                        return hit;
-                    }
-                    : undefined),
+                toolPolicy: createWorkflowAskPolicy(approvalExemptionStore ? createSessionExemptionRead(approvalExemptionStore, root, logger, "workflow_gate") : undefined),
             });
         }
         return { governed, scratchpadDir, hostSemanticsLane };
     };
-    const applyImageFactsAndRouting = async (body, auth, governed, folded) => {
+    const applyImageFactsAndRouting = async (body, auth, root, governed, folded) => {
+        const { person } = identityAxesOf(auth);
         const { scenarioName, scratchpadDir, hostSemanticsLane } = folded;
-        const bodyProfile = typeof body.sandboxImageProfile === "string" && body.sandboxImageProfile.length > 0 ? body.sandboxImageProfile : undefined;
-        const taskImageProfile = bodyProfile ?? (body.cascade === true || body.verify === true ? undefined : sessionEnvSelection.get(auth?.sessionId));
+        const bodyProfile = bodyImageProfileOf(body);
+        const taskImageProfile = bodyProfile ?? (body.cascade === true || body.verify === true ? undefined : sessionEnvSelection.get(root));
         let resolvedImageCaps;
         if (taskImageProfile !== undefined) {
-            if (config.remoteExec?.provider !== "k8s") {
-                throw createCodedHttpError(501, "capability.k8s_lane_required", "sandboxImageProfile is only supported on the k8s sandbox backend");
-            }
+            assertImageProfileLane(taskImageProfile, config);
             if (!imageIndex) {
                 throw createCodedHttpError(501, "capability.image_index_required", "sandboxImageProfile requires the sandbox-image-pool, which needs a SQL store backend (DB_BACKEND=mysql|pg) — this deployment's store wires no image index");
             }
-            if (!auth?.sessionId) {
-                throw createCodedHttpError(400, "request.precondition_unmet", "sandboxImageProfile requires a resolved session");
-            }
             const capsNeeded = Array.isArray(body.capabilitiesNeeded)
                 ? body.capabilitiesNeeded.filter((c) => typeof c === "string")
                 : undefined;
             const resolved = await resolveSandboxImageRef({
                 profile: taskImageProfile,
                 ...(capsNeeded && capsNeeded.length > 0 ? { capabilitiesNeeded: capsNeeded } : {}),
-                viewer: { operator: explicitOperatorOk(auth.principal, config), tenantId: auth.principal ?? null },
+                viewer: { operator: explicitOperatorOk(person, config), tenantId: person ?? null },
                 index: imageIndex,
             });
             if (!resolved.ok)
                 throw createCodedHttpError(resolved.status, resolved.errorCode, resolved.message);
-            perTaskImage.set(auth.sessionId, resolved.ref);
+            perTaskImage.set(root, resolved.ref);
             resolvedImageCaps = resolved.capabilities;
         }
         const remoteScratchpadDir = !hostSemanticsLane && DEPLOYMENT_SHAPE_PREDICATES.remoteScratchpad.holds(config)
-            ? remoteScratchpadDirFor(auth?.sessionId)
+            ? remoteScratchpadDirFor(root)
             : undefined;
         const declaredScratchpadDir = scratchpadDir ?? remoteScratchpadDir;
-        const pkgSourceLane = config.remoteExec?.provider === "e2b" || config.remoteExec?.provider === "k8s";
+        const pkgSourceLane = config.remoteExec.provider === "e2b" || config.remoteExec.provider === "k8s";
         const facts = buildEnvFacts({
             ...(declaredScratchpadDir ? { scratchpadDir: declaredScratchpadDir } : {}),
             ...(config.envFactsEnabled
@@ -683,7 +651,7 @@ export function createResolveSpec(ctx) {
                     capabilities: resolvedImageCaps,
                     ...(pkgSourceLane ? { pkgSource: config.sandboxPkgSource } : {}),
                     egress: egressForRemoteExec(config.remoteExec),
-                    resumeFacts: resumeFactsForLane(config.remoteExec?.provider, config.remoteExec?.provider === "k8s" ? { k8sSnapshot: Boolean(config.remoteExec.s3Snapshot) } : undefined),
+                    resumeFacts: resumeFactsForLane(config.remoteExec.provider, config.remoteExec.provider === "k8s" ? { k8sSnapshot: Boolean(config.remoteExec.s3Snapshot) } : undefined),
                 }
                 : {}),
         });
@@ -692,10 +660,10 @@ export function createResolveSpec(ctx) {
         if (config.routerEnabled) {
             const decision = routeServiceTask({
                 vmIsolatedExecEnv: DEPLOYMENT_SHAPE_PREDICATES.vmIsolatedHands.holds(config),
-                hasExecutionEnv: laneWiresExecutionEnv(executionLaneOf(config.remoteExec?.provider)),
+                hasExecutionEnv: laneWiresExecutionEnv(config.remoteExec.provider),
                 ...(config.autonomy ? { autonomy: config.autonomy } : {}),
             });
-            logger.info("orchestration_routed", { mode: decision.mode, reason: decision.reason, sessionId: auth?.sessionId ?? null });
+            logger.info("orchestration_routed", { mode: decision.mode, reason: decision.reason, sessionId: root });
             if (decision.mode === "supervisor") {
                 return tightenGoverned(governed, supPostureOverrides());
             }