@sema-agent/server 7.146.0 → 7.148.0

package/dist/boot/stage-07-capability-layer.d.ts

@@ -3,10 +3,7 @@ import type { runStage06 } from "./stage-06-runners.js";
 export declare function runStage07(ctx: Awaited<ReturnType<typeof runStage06>>): Promise<{
     approvalExemptionStore: import("../plugins/approval-exemption-store.js").ApprovalExemptionStore | undefined;
     approvalNonceStore: import("../plugins/approval-nonce-store.js").ApprovalNonceStore | undefined;
-    authorize: (ctx: {
-        req: import("http").IncomingMessage;
-        body: import("../index.js").TaskRequestBody;
-    }) => Promise<import("../security.js").AuthContext>;
+    authorize: (ctx: import("../security.js").AuthorizeInput) => Promise<import("../security.js").AuthContext>;
     imageBakes: import("../plugins/store-backend.js").ImageBake | undefined;
     imageIndex: import("../plugins/store-backend.js").ImageIndex | undefined;
     loadedSkills: import("../capabilities/skills.js").LoadedSkill[];
@@ -27,6 +24,8 @@ export declare function runStage07(ctx: Awaited<ReturnType<typeof runStage06>>):
     userInputLedger: import("../user-input-ledger.js").UserInputLedger | undefined;
     userInputLedgerStore: import("../user-input-ledger.js").UserInputLedgerStore | undefined;
     webSearchProvider: "brave" | "tavily" | "searxng" | undefined;
+    sessionEraser: import("../session-erase.js").SessionEraser | undefined;
+    settleErasedSessions: import("../session-erase.js").SessionEraseSettler;
     approvalAskAudit: import("../approval-ask-audit-store.js").FileApprovalAskAuditStore | undefined;
     centerRuntimeCapsResolver: ((principal: string | undefined) => Promise<import("@sema-agent/core").RuntimeCaps | undefined>) | undefined;
     checkpointStore: import("../plugins/store-backend.js").CheckpointStoreFull | undefined;
@@ -47,11 +46,11 @@ export declare function runStage07(ctx: Awaited<ReturnType<typeof runStage06>>):
     outcomeSink: import("../plugins/file-outcome-sink.js").OutcomeSink | undefined;
     principalCaps: import("../runtime-caps-resolver.js").PrincipalEntitlementsClient | undefined;
     question: import("../question.js").QuestionCoordinator | undefined;
-    retentionExecutor: import("../plugins/retention-store-sql.js").SqlRetentionStore | undefined;
+    retentionExecutor: import("../plugins/retention-deployment.js").RetentionExecutor | undefined;
     retentionLaneStore: import("../plugins/retention-lane-store-sql.js").RetentionLaneStore | undefined;
     runner: import("@sema-agent/core").Runner;
     runnerDeps: import("@sema-agent/core").RunnerDeps;
-    runtimeCapsPeekResolver: import("../runtime-caps-resolver.js").EntitlementsResolverFn | undefined;
+    runtimeCapsPeekReading: ((principal: string | undefined) => Promise<import("../runtime-caps-resolver.js").RuntimeCapsReading>) | undefined;
     sendFileLedger: import("../plugins/send-file-ledger.js").SendFileLedger | undefined;
     sendUserFileEmitter: import("../capabilities/send-user-file-tool.js").SendUserFileEmitter | undefined;
     sendUserFileToolSpec: import("@sema-agent/core").ToolSpec<import("@sema-agent/core").TSchema> | undefined;
@@ -84,13 +83,15 @@ export declare function runStage07(ctx: Awaited<ReturnType<typeof runStage06>>):
     deviceLane: import("./device-lane.js").DeviceLane | undefined;
     peerDesk: import("../peer-seat.js").PeerDesk;
     dropSessionScoped: (sid: string) => void;
+    dropSessionScopedOf: (sid: string, incarnation: string) => boolean;
     executionEnvFactory: import("@sema-agent/core").ExecutionEnvFactory | undefined;
-    fenceSessionOwner: (sid: string, owner: string | null) => void;
-    sessionResidentBackground: () => number;
-    lspManager: import("@sema-agent/core").NodeLspManager | import("../lsp/manager.js").E2bLspManager | undefined;
+    fenceSessionOwner: (sid: string, owner: string | null, incarnation?: string) => void;
+    sessionResidentBackground: () => import("../session-resident-background.js").SessionResidentCounts;
+    lspManager: import("@sema-agent/core").NodeLspManager | undefined;
     spaceReclaimer: import("../workspace-space.js").SpaceReclaimer | undefined;
-    sandboxPodReaper: import("../plugins/k8s-pod-reaper.js").SandboxPodReaper | undefined;
+    sandboxReaper: import("../plugins/sandbox-reaper.js").SandboxReaper | undefined;
     sandboxGitPlane: () => import("../sandbox-git-plane.js").SandboxGitPlane;
+    sandboxCapacity: import("../plugins/local-docker-capacity.js").LocalDockerCapacity | undefined;
     perSessionCwd: Map<string, string>;
     perTaskImage: import("../per-task-image.js").PerTaskImageRegistry;
     sendUserFileTaskEnvs: import("../capabilities/sandbox-file-send.js").TaskEnvRegistry | undefined;
@@ -129,6 +130,7 @@ export declare function runStage07(ctx: Awaited<ReturnType<typeof runStage06>>):
     sideQueryAccounting: import("../budget.js").SideQueryAccounting;
     toolResultStore: import("@sema-agent/core").ToolResultStore | undefined;
     tracer: import("@sema-agent/core").TracerHook;
+    adoptionWiring: import("../adoption/plan.js").AdoptionWiring;
     backend: import("../index.js").StoreBackend | undefined;
     backgroundAgentStore: import("@sema-agent/core").BackgroundAgentStore | undefined;
     breakerState: import("../plugins/breaker-state-sql.js").TiDBBreakerState | import("../plugins/breaker-state-sql.js").PgBreakerState | undefined;
@@ -153,9 +155,10 @@ export declare function runStage07(ctx: Awaited<ReturnType<typeof runStage06>>):
     taskAttachmentStore: import("../plugins/task-attachment-store.js").TaskAttachmentStore | undefined;
     taskListLane: import("./task-list-lane.js").TaskListLane;
     usageWindowStore: import("@sema-agent/core").UsageWindowStore | undefined;
+    config: import("../config-types.js").ServiceConfig;
     ceilingVerdict: import("./unpriced-ceiling-verdict.js").UnpricedCeilingVerdict;
+    storeEvidence: import("../store-posture.js").StoreEvidence;
     webAdmin: import("./web-admin.js").WebAdminRuntime;
-    config: import("../config-types.js").ServiceConfig;
     localRoot: string;
     logger: import("../index.js").Logger;
     metrics: import("../index.js").Metrics;

package/dist/boot/stage-07-capability-layer.js

@@ -14,7 +14,9 @@ import { buildScenarios, builtinScenarioDetails, danglingScenarioRefusal } from
 import { isBrandedDeployment } from "../capabilities/brand-identity.js";
 import { RateLimiter } from "../observability/rate-limit.js";
 import { explicitOperatorOk } from "../http/server.js";
-import { buildOperatorUndeclaredNotice, buildServiceTokenPostureNotice } from "../http/principal-gate.js";
+import { buildServiceTokenPostureNotice } from "../http/principal-gate.js";
+import { personOf } from "../owner-brands.js";
+import { recoveredSubject } from "../owner-faces.js";
 import { selfOrchestrationDenial } from "../task-workflow.js";
 import { centerEntitlementSourceWired } from "../runtime-caps-resolver.js";
 import { reclaimOrphansAtBoot } from "../boot-reclaim.js";
@@ -33,7 +35,7 @@ import { WEB_ADMIN_ENV } from "@sema-agent/settings-schema";
 import { seatText } from "../trace/exit-seat.js";
 export async function runStage07(ctx) {
     const { approvalAskAudit, approvalExemptionStore, backend, backgroundAgentStore, brain, checkpointStore, config, webAdmin, counterDegradeHook, peerDesk, durableEnabled, instanceId, localRoot, logger, question, runner, runnerDeps, sendUserFileToolSpec, sessionEnvSelection, sessionStore, subRunner, taskListLane, toolApproval } = ctx;
-    const authorize = createAuthorizer(config, sessionStore);
+    const authorize = createAuthorizer(config, sessionStore, logger);
     const runStore = backend ? backend.run() : undefined;
     bindRunStore(runStore);
     const resumeAnchorStore = backend ? backend.resumeAnchor() : undefined;
@@ -87,11 +89,11 @@ export async function runStage07(ctx) {
         })()
         : undefined;
     const imageIndex = backend?.imageIndex ? backend.imageIndex() : undefined;
-    const selectEnvTool = config.selectEnvironmentTool && config.remoteExec?.provider === "k8s" && imageIndex
+    const selectEnvTool = config.selectEnvironmentTool && config.remoteExec.provider === "k8s" && imageIndex
         ? selectEnvironmentTool({
             catalog: imageIndex,
             selection: sessionEnvSelection,
-            viewerFor: (principal) => ({ operator: explicitOperatorOk(principal, config), tenantId: principal ?? null }),
+            viewerFor: (principal) => ({ operator: explicitOperatorOk(principal === undefined ? undefined : personOf(recoveredSubject(principal)), config), tenantId: principal ?? null }),
         })
         : undefined;
     const imageBakes = backend?.imageBake && config.imageBakes.enabled ? backend.imageBake() : undefined;
@@ -99,11 +101,6 @@ export async function runStage07(ctx) {
         logger.info("image_bakes_enabled", { operators: config.operatorPrincipals.length, runner: config.imageBakes.runnerPrincipal });
     if (durableEnabled)
         logger.info("durable_approval_enabled", { toolApprovalGate: config.approvalRequire.length });
-    {
-        const undeclared = buildOperatorUndeclaredNotice(config);
-        if (undeclared)
-            logger.warn(undeclared.event, undeclared.fields);
-    }
     {
         const posture = buildServiceTokenPostureNotice(config);
         if (posture)
@@ -128,7 +125,7 @@ export async function runStage07(ctx) {
         }
     }
     for (const w of buildNoResponderBootWarns({
-        lane: executionLaneOf(config.remoteExec?.provider),
+        lane: config.remoteExec.provider,
         selfOrchestrationEnabled: config.selfOrchestrationEnabled,
         approvalFaceWired: toolApproval !== undefined || durableEnabled,
     }))
@@ -182,7 +179,7 @@ export async function runStage07(ctx) {
     const webFetchSummarize = createWebFetchSummarizeLane({ brain, config, getKeyResolver: () => webAdmin.getKeyResolver(), logger });
     const scenarioDeps = {
         runner, subRunner, model: DEFAULT_MODEL_REF, skills, repoClient, requirePrincipal: config.requirePrincipal,
-        handsLane: laneWiresExecutionEnv(executionLaneOf(config.remoteExec?.provider)),
+        handsLane: laneWiresExecutionEnv(config.remoteExec.provider),
         webSearch: webSearch ? webSearch : undefined, logger, webFetchSummarize,
         backgroundAgentStore: backgroundAgentStore ? backgroundAgentStore : undefined,
         checkpointStore: checkpointStore ? checkpointStore : undefined,
@@ -193,7 +190,7 @@ export async function runStage07(ctx) {
     };
     const scenarios = buildScenarios(scenarioDeps);
     const builtinDefaultScenario = scenarios.default;
-    const parkedReviveSurface = checkpointStore && backgroundAgentStore && builtinDefaultScenario ? createParkedReviveSurface(builtinDefaultScenario) : undefined;
+    const parkedReviveSurface = checkpointStore && backgroundAgentStore && builtinDefaultScenario ? createParkedReviveSurface(builtinDefaultScenario, { onBackgroundChildEvent: runnerDeps.onBackgroundChildEvent }) : undefined;
     const parkedReviveInheritedGate = parkedReviveSurface && config.durableApproval
         ? createParkedReviveInheritedGate({
             config, question, logger, localRoot,

package/dist/boot/stage-08-reapers.d.ts

@@ -16,10 +16,7 @@ export declare function runStage08(ctx: Awaited<ReturnType<typeof runStage07>>):
     retentionLaneStarted: import("./retention-lane.js").RetentionLaneController | undefined;
     approvalExemptionStore: import("../plugins/approval-exemption-store.js").ApprovalExemptionStore | undefined;
     approvalNonceStore: import("../plugins/approval-nonce-store.js").ApprovalNonceStore | undefined;
-    authorize: (ctx: {
-        req: import("http").IncomingMessage;
-        body: import("../index.js").TaskRequestBody;
-    }) => Promise<import("../security.js").AuthContext>;
+    authorize: (ctx: import("../security.js").AuthorizeInput) => Promise<import("../security.js").AuthContext>;
     imageBakes: import("../plugins/store-backend.js").ImageBake | undefined;
     imageIndex: import("../plugins/store-backend.js").ImageIndex | undefined;
     loadedSkills: import("../index.js").LoadedSkill[];
@@ -40,6 +37,8 @@ export declare function runStage08(ctx: Awaited<ReturnType<typeof runStage07>>):
     userInputLedger: import("../user-input-ledger.js").UserInputLedger | undefined;
     userInputLedgerStore: import("../user-input-ledger.js").UserInputLedgerStore | undefined;
     webSearchProvider: "brave" | "tavily" | "searxng" | undefined;
+    sessionEraser: import("../session-erase.js").SessionEraser | undefined;
+    settleErasedSessions: import("../session-erase.js").SessionEraseSettler;
     approvalAskAudit: import("../approval-ask-audit-store.js").FileApprovalAskAuditStore | undefined;
     centerRuntimeCapsResolver: ((principal: string | undefined) => Promise<import("@sema-agent/core").RuntimeCaps | undefined>) | undefined;
     checkpointStore: import("../plugins/store-backend.js").CheckpointStoreFull | undefined;
@@ -60,11 +59,11 @@ export declare function runStage08(ctx: Awaited<ReturnType<typeof runStage07>>):
     outcomeSink: import("../plugins/file-outcome-sink.js").OutcomeSink | undefined;
     principalCaps: import("../runtime-caps-resolver.js").PrincipalEntitlementsClient | undefined;
     question: import("../question.js").QuestionCoordinator | undefined;
-    retentionExecutor: import("../plugins/retention-store-sql.js").SqlRetentionStore | undefined;
+    retentionExecutor: import("../plugins/retention-deployment.js").RetentionExecutor | undefined;
     retentionLaneStore: import("../plugins/retention-lane-store-sql.js").RetentionLaneStore | undefined;
     runner: Runner;
     runnerDeps: import("@sema-agent/core").RunnerDeps;
-    runtimeCapsPeekResolver: import("../runtime-caps-resolver.js").EntitlementsResolverFn | undefined;
+    runtimeCapsPeekReading: ((principal: string | undefined) => Promise<import("../runtime-caps-resolver.js").RuntimeCapsReading>) | undefined;
     sendFileLedger: import("../plugins/send-file-ledger.js").SendFileLedger | undefined;
     sendUserFileEmitter: import("../capabilities/send-user-file-tool.js").SendUserFileEmitter | undefined;
     sendUserFileToolSpec: import("@sema-agent/core").ToolSpec<import("@sema-agent/core").TSchema> | undefined;
@@ -97,13 +96,15 @@ export declare function runStage08(ctx: Awaited<ReturnType<typeof runStage07>>):
     deviceLane: import("./device-lane.js").DeviceLane | undefined;
     peerDesk: import("../peer-seat.js").PeerDesk;
     dropSessionScoped: (sid: string) => void;
+    dropSessionScopedOf: (sid: string, incarnation: string) => boolean;
     executionEnvFactory: import("@sema-agent/core").ExecutionEnvFactory | undefined;
-    fenceSessionOwner: (sid: string, owner: string | null) => void;
-    sessionResidentBackground: () => number;
-    lspManager: import("@sema-agent/core").NodeLspManager | import("../lsp/manager.js").E2bLspManager | undefined;
+    fenceSessionOwner: (sid: string, owner: string | null, incarnation?: string) => void;
+    sessionResidentBackground: () => import("../session-resident-background.js").SessionResidentCounts;
+    lspManager: import("@sema-agent/core").NodeLspManager | undefined;
     spaceReclaimer: import("../workspace-space.js").SpaceReclaimer | undefined;
-    sandboxPodReaper: import("../plugins/k8s-pod-reaper.js").SandboxPodReaper | undefined;
+    sandboxReaper: import("../plugins/sandbox-reaper.js").SandboxReaper | undefined;
     sandboxGitPlane: () => import("../sandbox-git-plane.js").SandboxGitPlane;
+    sandboxCapacity: import("../plugins/local-docker-capacity.js").LocalDockerCapacity | undefined;
     perSessionCwd: Map<string, string>;
     perTaskImage: import("../per-task-image.js").PerTaskImageRegistry;
     sendUserFileTaskEnvs: import("../capabilities/sandbox-file-send.js").TaskEnvRegistry | undefined;
@@ -142,6 +143,7 @@ export declare function runStage08(ctx: Awaited<ReturnType<typeof runStage07>>):
     sideQueryAccounting: import("../budget.js").SideQueryAccounting;
     toolResultStore: import("@sema-agent/core").ToolResultStore | undefined;
     tracer: import("@sema-agent/core").TracerHook;
+    adoptionWiring: import("../adoption/plan.js").AdoptionWiring;
     backend: import("../index.js").StoreBackend | undefined;
     backgroundAgentStore: import("@sema-agent/core").BackgroundAgentStore | undefined;
     breakerState: import("../plugins/breaker-state-sql.js").TiDBBreakerState | import("../plugins/breaker-state-sql.js").PgBreakerState | undefined;
@@ -166,9 +168,10 @@ export declare function runStage08(ctx: Awaited<ReturnType<typeof runStage07>>):
     taskAttachmentStore: import("../plugins/task-attachment-store.js").TaskAttachmentStore | undefined;
     taskListLane: import("./task-list-lane.js").TaskListLane;
     usageWindowStore: import("@sema-agent/core").UsageWindowStore | undefined;
+    config: import("../config-types.js").ServiceConfig;
     ceilingVerdict: import("./unpriced-ceiling-verdict.js").UnpricedCeilingVerdict;
+    storeEvidence: import("../store-posture.js").StoreEvidence;
     webAdmin: import("./web-admin.js").WebAdminRuntime;
-    config: import("../config-types.js").ServiceConfig;
     localRoot: string;
     logger: import("../index.js").Logger;
     metrics: import("../index.js").Metrics;

package/dist/boot/stage-08-reapers.js

@@ -6,13 +6,13 @@ import { createLimitSync } from "./limit-sync.js";
 import { runDenySweep } from "./late-binds.js";
 import { seatText } from "../trace/exit-seat.js";
 export function runStage08(ctx) {
-    const { approvalAskAudit, approvalNonceStore, backend, backgroundAgentStore, ceilingVerdict, checkpointStore, parkCommits, config, webAdmin, consolidationSeatWatch, costQuota, degradeRouteWatch, fileHistoryErasure, spaceReclaimer, sandboxPodReaper, handslessRunner, hookAgentRunner, imageBakes, instanceId, localRoot, logger, mailboxStore, metrics, permissionRuleStores, pricing, rateLimiter, retentionExecutor, retentionLaneStore, runStore, runner, sqlWorkflowRunStore, storeSweep, subRunner, taskAttachmentStore, toolApproval, userInputLedger, workflowNotifyGate, workflowNotifyJournal, workflowRecoverOpts, worktreeReap } = ctx;
+    const { approvalAskAudit, approvalNonceStore, backend, backgroundAgentStore, ceilingVerdict, checkpointStore, parkCommits, config, webAdmin, consolidationSeatWatch, costQuota, degradeRouteWatch, fileHistoryErasure, settleErasedSessions, sandboxReaper, handslessRunner, hookAgentRunner, imageBakes, instanceId, localRoot, logger, mailboxStore, metrics, permissionRuleStores, pricing, rateLimiter, retentionExecutor, retentionLaneStore, runStore, runner, sqlWorkflowRunStore, storeSweep, subRunner, taskAttachmentStore, toolApproval, userInputLedger, workflowNotifyGate, workflowNotifyJournal, workflowRecoverOpts, worktreeReap } = ctx;
     const reaper = startReapers({
         config, logger, metrics, localRoot, backend, subRunner, runStore, checkpointStore, parkCommits,
         rateLimiter, costQuota, storeSweep, fileHistoryErasure, taskAttachmentStore, imageBakes, worktreeReap,
         workflowNotifyGate, workflowRecoverOpts, sqlWorkflowRunStore, workflowNotifyJournal,
         backgroundAgentStore, mailboxStore, toolApproval, permissionRuleStores, approvalNonceStore, userInputLedger, approvalAskAudit,
-        ...(sandboxPodReaper !== undefined ? { sandboxPodReaper } : {}),
+        ...(sandboxReaper !== undefined ? { sandboxReaper } : {}),
         getRunDenySweep: () => runDenySweep,
     });
     const ttlMs = config.retentionSweep.intervalSec * 1000 * RETENTION_LEASE_TTL_FACTOR;
@@ -32,7 +32,7 @@ export function runStage08(ctx) {
             },
             audit: { append: (row) => retentionLaneStore.appendAudit(row, Date.now()) },
             holdInForce: (domain) => retentionLaneStore.holdInForce(domain),
-            ...(spaceReclaimer !== undefined ? { spaceReclaimer } : {}),
+            settle: settleErasedSessions,
             logger,
             metrics,
             now: () => Date.now(),

package/dist/boot/stage-09-leader.d.ts

@@ -9,15 +9,10 @@ export declare function runStage09(ctx: Awaited<ReturnType<typeof runStage08>>):
     leaderEndpoint: import("../leader/endpoint.js").LeaderEndpoint | undefined;
     ownerAware: import("../security.js").OwnerAwareSessionStore;
     planCacheProbe: import("../plan-cache-probe.js").PlanCacheProbe;
-    purgeSession: ((sessionId: string, owner: string | null) => Promise<{
-        deleted: boolean;
-    } | {
-        active: string;
-    } | {
-        childrenAlive: readonly string[];
-    }>) | undefined;
+    purgeSession: ((sessionId: string, owner: string | null) => Promise<import("../session-deletion.js").SessionPurgeOutcome>) | undefined;
     webAdminJwtVerifier: import("../auth-bridge.js").WebAdminJwtVerifier | undefined;
     sessionAudit: ((sessionId: string, opts?: import("../audit.js").SessionAuditReadOpts) => Promise<{
+        projectId?: string | undefined;
         agent?: import("../session-agent.js").SessionAgent | undefined;
         owner: string | null;
         sessionId: string;
@@ -40,10 +35,7 @@ export declare function runStage09(ctx: Awaited<ReturnType<typeof runStage08>>):
     retentionLaneStarted: import("./retention-lane.js").RetentionLaneController | undefined;
     approvalExemptionStore: import("../plugins/approval-exemption-store.js").ApprovalExemptionStore | undefined;
     approvalNonceStore: import("../plugins/approval-nonce-store.js").ApprovalNonceStore | undefined;
-    authorize: (ctx: {
-        req: import("http").IncomingMessage;
-        body: import("../index.js").TaskRequestBody;
-    }) => Promise<import("../security.js").AuthContext>;
+    authorize: (ctx: import("../security.js").AuthorizeInput) => Promise<import("../security.js").AuthContext>;
     imageBakes: import("../plugins/store-backend.js").ImageBake | undefined;
     imageIndex: import("../plugins/store-backend.js").ImageIndex | undefined;
     loadedSkills: import("../index.js").LoadedSkill[];
@@ -64,6 +56,8 @@ export declare function runStage09(ctx: Awaited<ReturnType<typeof runStage08>>):
     userInputLedger: import("../user-input-ledger.js").UserInputLedger | undefined;
     userInputLedgerStore: import("../user-input-ledger.js").UserInputLedgerStore | undefined;
     webSearchProvider: "brave" | "tavily" | "searxng" | undefined;
+    sessionEraser: import("../session-erase.js").SessionEraser | undefined;
+    settleErasedSessions: import("../session-erase.js").SessionEraseSettler;
     approvalAskAudit: import("../approval-ask-audit-store.js").FileApprovalAskAuditStore | undefined;
     centerRuntimeCapsResolver: ((principal: string | undefined) => Promise<import("@sema-agent/core").RuntimeCaps | undefined>) | undefined;
     checkpointStore: import("../plugins/store-backend.js").CheckpointStoreFull | undefined;
@@ -84,11 +78,11 @@ export declare function runStage09(ctx: Awaited<ReturnType<typeof runStage08>>):
     outcomeSink: import("../plugins/file-outcome-sink.js").OutcomeSink | undefined;
     principalCaps: import("../runtime-caps-resolver.js").PrincipalEntitlementsClient | undefined;
     question: import("../question.js").QuestionCoordinator | undefined;
-    retentionExecutor: import("../plugins/retention-store-sql.js").SqlRetentionStore | undefined;
+    retentionExecutor: import("../plugins/retention-deployment.js").RetentionExecutor | undefined;
     retentionLaneStore: import("../plugins/retention-lane-store-sql.js").RetentionLaneStore | undefined;
     runner: import("@sema-agent/core").Runner;
     runnerDeps: import("@sema-agent/core").RunnerDeps;
-    runtimeCapsPeekResolver: import("../runtime-caps-resolver.js").EntitlementsResolverFn | undefined;
+    runtimeCapsPeekReading: ((principal: string | undefined) => Promise<import("../runtime-caps-resolver.js").RuntimeCapsReading>) | undefined;
     sendFileLedger: import("../plugins/send-file-ledger.js").SendFileLedger | undefined;
     sendUserFileEmitter: import("../capabilities/send-user-file-tool.js").SendUserFileEmitter | undefined;
     sendUserFileToolSpec: import("@sema-agent/core").ToolSpec<import("@sema-agent/core").TSchema> | undefined;
@@ -121,13 +115,15 @@ export declare function runStage09(ctx: Awaited<ReturnType<typeof runStage08>>):
     deviceLane: import("./device-lane.js").DeviceLane | undefined;
     peerDesk: import("../peer-seat.js").PeerDesk;
     dropSessionScoped: (sid: string) => void;
+    dropSessionScopedOf: (sid: string, incarnation: string) => boolean;
     executionEnvFactory: import("@sema-agent/core").ExecutionEnvFactory | undefined;
-    fenceSessionOwner: (sid: string, owner: string | null) => void;
-    sessionResidentBackground: () => number;
-    lspManager: import("@sema-agent/core").NodeLspManager | import("../lsp/manager.js").E2bLspManager | undefined;
+    fenceSessionOwner: (sid: string, owner: string | null, incarnation?: string) => void;
+    sessionResidentBackground: () => import("../session-resident-background.js").SessionResidentCounts;
+    lspManager: import("@sema-agent/core").NodeLspManager | undefined;
     spaceReclaimer: import("../workspace-space.js").SpaceReclaimer | undefined;
-    sandboxPodReaper: import("../plugins/k8s-pod-reaper.js").SandboxPodReaper | undefined;
+    sandboxReaper: import("../plugins/sandbox-reaper.js").SandboxReaper | undefined;
     sandboxGitPlane: () => import("../sandbox-git-plane.js").SandboxGitPlane;
+    sandboxCapacity: import("../plugins/local-docker-capacity.js").LocalDockerCapacity | undefined;
     perSessionCwd: Map<string, string>;
     perTaskImage: import("../per-task-image.js").PerTaskImageRegistry;
     sendUserFileTaskEnvs: import("../capabilities/sandbox-file-send.js").TaskEnvRegistry | undefined;
@@ -166,6 +162,7 @@ export declare function runStage09(ctx: Awaited<ReturnType<typeof runStage08>>):
     sideQueryAccounting: import("../budget.js").SideQueryAccounting;
     toolResultStore: import("@sema-agent/core").ToolResultStore | undefined;
     tracer: import("@sema-agent/core").TracerHook;
+    adoptionWiring: import("../adoption/plan.js").AdoptionWiring;
     backend: import("../index.js").StoreBackend | undefined;
     backgroundAgentStore: import("@sema-agent/core").BackgroundAgentStore | undefined;
     breakerState: import("../plugins/breaker-state-sql.js").TiDBBreakerState | import("../plugins/breaker-state-sql.js").PgBreakerState | undefined;
@@ -190,9 +187,10 @@ export declare function runStage09(ctx: Awaited<ReturnType<typeof runStage08>>):
     taskAttachmentStore: import("../plugins/task-attachment-store.js").TaskAttachmentStore | undefined;
     taskListLane: import("./task-list-lane.js").TaskListLane;
     usageWindowStore: import("@sema-agent/core").UsageWindowStore | undefined;
+    config: import("../config-types.js").ServiceConfig;
     ceilingVerdict: import("./unpriced-ceiling-verdict.js").UnpricedCeilingVerdict;
+    storeEvidence: import("../store-posture.js").StoreEvidence;
     webAdmin: import("./web-admin.js").WebAdminRuntime;
-    config: import("../config-types.js").ServiceConfig;
     localRoot: string;
     logger: import("../index.js").Logger;
     metrics: import("../index.js").Metrics;

package/dist/boot/stage-09-leader.js

@@ -1,21 +1,29 @@
 import { describeStaticWiring } from "@sema-agent/core";
 import { encodeCheckpointScope } from "../security.js";
-import { authBridgeIssuerOf, createWebAdminJwtVerifier } from "../auth-bridge.js";
+import { createWebAdminJwtVerifier } from "../auth-bridge.js";
+import { authBridgeIssuerOf } from "../identity-source.js";
 import { createSessionFaces } from "./session-faces.js";
 import { createLeaderFace } from "./leader.js";
 import { assertStaticWiringConsistent } from "../http/routes/diagnostics.js";
+import { seatText } from "../trace/exit-seat.js";
 import { buildDisplaySafeUrl } from "../trace/redact.js";
 export function runStage09(ctx) {
-    const { approvalExemptionStore, backend, backgroundAgentStore, brain, checkpointStore, checkpointCtxSealing, config, webAdmin, deploymentMods, dropSessionScoped, durableEnabled, executionEnvFactory, fileHistoryErasure, governanceSeams, localRoot, logger, mailboxRecipientLifecycle, mailboxStore, metrics, pricing, resumeAnchorStore, runStore, runnerDeps, sessionPolicyStore, sessionStore, streamApprovalGate, taskAttachmentStore, spaceReclaimer, taskListLane, toolResultStore, tracer, usageWindowStore, userInputLedgerStore, workflowCompletionInbox } = ctx;
-    const { ownerAware, sessionAudit, sessionWatchRegistry, purgeSession, instrumentDegenerate, planCacheProbe } = createSessionFaces({
+    const { approvalExemptionStore, backend, backgroundAgentStore, brain, checkpointStore, checkpointCtxSealing, config, webAdmin, deploymentMods, dropSessionScoped, durableEnabled, executionEnvFactory, fileHistoryErasure, governanceSeams, localRoot, logger, mailboxRecipientLifecycle, mailboxStore, metrics, pricing, resumeAnchorStore, runStore, runnerDeps, sessionEraser, sessionPolicyStore, sessionStore, settleErasedSessions, storePosture, streamApprovalGate, taskAttachmentStore, spaceReclaimer, taskListLane, toolResultStore, tracer, usageWindowStore, userInputLedgerStore, workflowCompletionInbox } = ctx;
+    const { ownerAware, sessionAudit, sessionWatchRegistry, purgeSession, recoverPendingDeletions, instrumentDegenerate, planCacheProbe } = createSessionFaces({
         dropSessionScoped,
         config, logger, metrics, localRoot, backend, sessionStore, runStore, checkpointStore, toolResultStore,
         resumeAnchorStore, approvalExemptionStore, sessionPolicyStore, taskAttachmentStore, fileHistoryErasure,
+        approvalAskStore: backend?.approvalAsk(),
         workflowCompletionInbox, taskListLane, mailboxStore, mailboxRecipientLifecycle,
         backgroundAgentStore,
         userInputLedgerStore,
         ...(spaceReclaimer !== undefined ? { spaceReclaimer } : {}),
+        ...(sessionEraser !== undefined ? { sessionEraser } : {}),
+        settleErasedSessions,
     });
+    if (recoverPendingDeletions !== undefined) {
+        void recoverPendingDeletions().catch((err) => logger.warn("session_delete_recovery_unfinished", { outcome: "pending_unreadable", err: seatText("operator-log-text", String(err)), effect: "sessions left in the deleting state by an earlier process stay so (they read as gone); the next start or a repeated DELETE finishes them" }));
+    }
     const leaderEndpoint = createLeaderFace({ config, logger, brain, pricing, executionEnvFactory, toolResultStore, sessionStore, checkpointStore, checkpointCtxSealing, governanceSeams, backend, tracer, usageWindowStore, promptSource: webAdmin.promptSource, onError: runnerDeps.onError, deploymentMods });
     const drainState = { draining: false };
     const authBridgeIssuer = authBridgeIssuerOf(config)?.issuer;
@@ -35,7 +43,7 @@ export function runStage09(ctx) {
         ? { checkpointStore, durableApproval: { scope: encodeCheckpointScope(undefined) } }
         : {};
     const staticWiring = describeStaticWiring(runnerDeps, wiringSpecTemplate);
-    assertStaticWiringConsistent({ manifest: staticWiring, parkFacility: durableEnabled, backendKind: backend?.kind }, logger);
+    assertStaticWiringConsistent({ manifest: staticWiring, parkFacility: durableEnabled, store: storePosture }, logger);
     logger.info("wiring_static", {
         fingerprint: staticWiring.configFingerprint ?? null,
         parkEffective: staticWiring.parkLane.effective,

package/dist/boot/stage-10-http-server.d.ts

@@ -8,15 +8,10 @@ export declare function runStage10(ctx: Awaited<ReturnType<typeof runStage09>>):
     leaderEndpoint: import("../leader/endpoint.js").LeaderEndpoint | undefined;
     ownerAware: import("../security.js").OwnerAwareSessionStore;
     planCacheProbe: import("../plan-cache-probe.js").PlanCacheProbe;
-    purgeSession: ((sessionId: string, owner: string | null) => Promise<{
-        deleted: boolean;
-    } | {
-        active: string;
-    } | {
-        childrenAlive: readonly string[];
-    }>) | undefined;
+    purgeSession: ((sessionId: string, owner: string | null) => Promise<import("../session-deletion.js").SessionPurgeOutcome>) | undefined;
     webAdminJwtVerifier: import("../auth-bridge.js").WebAdminJwtVerifier | undefined;
     sessionAudit: ((sessionId: string, opts?: import("../audit.js").SessionAuditReadOpts) => Promise<{
+        projectId?: string | undefined;
         agent?: import("../session-agent.js").SessionAgent | undefined;
         owner: string | null;
         sessionId: string;
@@ -39,10 +34,7 @@ export declare function runStage10(ctx: Awaited<ReturnType<typeof runStage09>>):
     retentionLaneStarted: import("./retention-lane.js").RetentionLaneController | undefined;
     approvalExemptionStore: import("../plugins/approval-exemption-store.js").ApprovalExemptionStore | undefined;
     approvalNonceStore: import("../plugins/approval-nonce-store.js").ApprovalNonceStore | undefined;
-    authorize: (ctx: {
-        req: import("http").IncomingMessage;
-        body: import("../index.js").TaskRequestBody;
-    }) => Promise<import("../security.js").AuthContext>;
+    authorize: (ctx: import("../security.js").AuthorizeInput) => Promise<import("../security.js").AuthContext>;
     imageBakes: import("../plugins/store-backend.js").ImageBake | undefined;
     imageIndex: import("../plugins/store-backend.js").ImageIndex | undefined;
     loadedSkills: import("../index.js").LoadedSkill[];
@@ -63,6 +55,8 @@ export declare function runStage10(ctx: Awaited<ReturnType<typeof runStage09>>):
     userInputLedger: import("../user-input-ledger.js").UserInputLedger | undefined;
     userInputLedgerStore: import("../user-input-ledger.js").UserInputLedgerStore | undefined;
     webSearchProvider: "brave" | "tavily" | "searxng" | undefined;
+    sessionEraser: import("../session-erase.js").SessionEraser | undefined;
+    settleErasedSessions: import("../session-erase.js").SessionEraseSettler;
     approvalAskAudit: import("../approval-ask-audit-store.js").FileApprovalAskAuditStore | undefined;
     centerRuntimeCapsResolver: ((principal: string | undefined) => Promise<import("@sema-agent/core").RuntimeCaps | undefined>) | undefined;
     checkpointStore: import("../plugins/store-backend.js").CheckpointStoreFull | undefined;
@@ -83,11 +77,11 @@ export declare function runStage10(ctx: Awaited<ReturnType<typeof runStage09>>):
     outcomeSink: import("../plugins/file-outcome-sink.js").OutcomeSink | undefined;
     principalCaps: import("../runtime-caps-resolver.js").PrincipalEntitlementsClient | undefined;
     question: import("../question.js").QuestionCoordinator | undefined;
-    retentionExecutor: import("../plugins/retention-store-sql.js").SqlRetentionStore | undefined;
+    retentionExecutor: import("../plugins/retention-deployment.js").RetentionExecutor | undefined;
     retentionLaneStore: import("../plugins/retention-lane-store-sql.js").RetentionLaneStore | undefined;
     runner: import("@sema-agent/core").Runner;
     runnerDeps: import("@sema-agent/core").RunnerDeps;
-    runtimeCapsPeekResolver: import("../runtime-caps-resolver.js").EntitlementsResolverFn | undefined;
+    runtimeCapsPeekReading: ((principal: string | undefined) => Promise<import("../runtime-caps-resolver.js").RuntimeCapsReading>) | undefined;
     sendFileLedger: import("../plugins/send-file-ledger.js").SendFileLedger | undefined;
     sendUserFileEmitter: import("../capabilities/send-user-file-tool.js").SendUserFileEmitter | undefined;
     sendUserFileToolSpec: import("@sema-agent/core").ToolSpec<import("@sema-agent/core").TSchema> | undefined;
@@ -120,13 +114,15 @@ export declare function runStage10(ctx: Awaited<ReturnType<typeof runStage09>>):
     deviceLane: import("./device-lane.js").DeviceLane | undefined;
     peerDesk: import("../peer-seat.js").PeerDesk;
     dropSessionScoped: (sid: string) => void;
+    dropSessionScopedOf: (sid: string, incarnation: string) => boolean;
     executionEnvFactory: import("@sema-agent/core").ExecutionEnvFactory | undefined;
-    fenceSessionOwner: (sid: string, owner: string | null) => void;
-    sessionResidentBackground: () => number;
-    lspManager: import("@sema-agent/core").NodeLspManager | import("../lsp/manager.js").E2bLspManager | undefined;
+    fenceSessionOwner: (sid: string, owner: string | null, incarnation?: string) => void;
+    sessionResidentBackground: () => import("../session-resident-background.js").SessionResidentCounts;
+    lspManager: import("@sema-agent/core").NodeLspManager | undefined;
     spaceReclaimer: import("../workspace-space.js").SpaceReclaimer | undefined;
-    sandboxPodReaper: import("../plugins/k8s-pod-reaper.js").SandboxPodReaper | undefined;
+    sandboxReaper: import("../plugins/sandbox-reaper.js").SandboxReaper | undefined;
     sandboxGitPlane: () => import("../sandbox-git-plane.js").SandboxGitPlane;
+    sandboxCapacity: import("../plugins/local-docker-capacity.js").LocalDockerCapacity | undefined;
     perSessionCwd: Map<string, string>;
     perTaskImage: import("../per-task-image.js").PerTaskImageRegistry;
     sendUserFileTaskEnvs: import("../capabilities/sandbox-file-send.js").TaskEnvRegistry | undefined;
@@ -165,6 +161,7 @@ export declare function runStage10(ctx: Awaited<ReturnType<typeof runStage09>>):
     sideQueryAccounting: import("../budget.js").SideQueryAccounting;
     toolResultStore: import("@sema-agent/core").ToolResultStore | undefined;
     tracer: import("@sema-agent/core").TracerHook;
+    adoptionWiring: import("../adoption/plan.js").AdoptionWiring;
     backend: import("../plugins/store-backend.js").StoreBackend | undefined;
     backgroundAgentStore: import("@sema-agent/core").BackgroundAgentStore | undefined;
     breakerState: import("../plugins/breaker-state-sql.js").TiDBBreakerState | import("../plugins/breaker-state-sql.js").PgBreakerState | undefined;
@@ -189,9 +186,10 @@ export declare function runStage10(ctx: Awaited<ReturnType<typeof runStage09>>):
     taskAttachmentStore: import("../plugins/task-attachment-store.js").TaskAttachmentStore | undefined;
     taskListLane: import("./task-list-lane.js").TaskListLane;
     usageWindowStore: import("@sema-agent/core").UsageWindowStore | undefined;
+    config: import("../config-types.js").ServiceConfig;
     ceilingVerdict: import("./unpriced-ceiling-verdict.js").UnpricedCeilingVerdict;
+    storeEvidence: import("../store-posture.js").StoreEvidence;
     webAdmin: import("./web-admin.js").WebAdminRuntime;
-    config: import("../config-types.js").ServiceConfig;
     localRoot: string;
     logger: import("../index.js").Logger;
     metrics: import("../index.js").Metrics;

package/dist/boot/stage-10-http-server.js

@@ -1,7 +1,7 @@
 import { autoRunOnRecommendationEffective, defaultTaskRegistry } from "@sema-agent/core";
 import { posIntEnv } from "../session-watch.js";
 import { brainSummary, buildFailoverFirstByteNotice } from "../brain.js";
-import { resolveBindHost } from "../config.js";
+import { resolveBindHost } from "../bind-host.js";
 import { buildWriteProtectionPosture } from "../write-protection.js";
 import { isPricingConfigured } from "../budget.js";
 import { createHandsRunnerSelector } from "../capabilities/hands-lane.js";
@@ -32,7 +32,7 @@ import { serviceVersion } from "../service-version.js";
 import { buildDisplaySafeUrl } from "../trace/redact.js";
 import { seatText } from "../trace/exit-seat.js";
 export async function runStage10(ctx) {
-    const { peerDesk, approvalAskAudit, approvalExemptionStore, approvalNonceStore, authorize, backend, backgroundAgentStore, brain, breakerState, centerRuntimeCapsResolver, checkpointStore, checkpointCtxSealing, parkCommits, config, webAdmin, consolidationValve, costQuota, belowTaskChainPatterns, deploymentMods, deploymentModsLoaded, deviceLane, drainState, durableEnabled, elicitation, fenceSessionOwner, fileHistoryStore, fleetBus, fleetLease, fleetUsage, governanceSeams, handslessRunner, hookAgent, hookLlm, hookWakeBus, imageBakes, imageIndex, instanceId, instrumentDegenerate, leaderEndpoint, loadedSkills, localRoot, logger, lspManager, mcpRevocations, memoryBundleFaces, memoryComplianceFaces, memoryConsolidationFaces, memoryEngine, memoryExportStores, memoryOptOutGrantStore, memoryOriginFaces, memoryPosture, memorySyncCursors, memorySyncRunner, metrics, modelUsageTracker, orgMemoryAdmission, otelExporter, outcomeSink, ownerAware, parkedReviveInheritedGate, parkedReviveSurface, perSessionCwd, perTaskImage, planCacheProbe, pricing, principalCaps, promptManifestTracker, purgeSession, question, rateLimiter, reaper, webAdminJwtVerifier, resumeAnchorStore, retentionLaneStarted, retentionLaneStore, ruleConsent, runStore, runner, runnerDeps, runtimeCapsPeekResolver, sandboxGitPlane, scenarioDetails, scenarios, selectEnvTool, sendFileLedger, sendUserFileEmitter, sendUserFileToolSpec, sessionAudit, sessionEnvSelection, sessionMemoryStatusFace, sessionPolicyStore, sessionTitler, sessionWatchRegistry, setSessionCwd, setSessionInheritEnv, setSessionShellEnv, sessionResidentBackground, sharedMemoryStore, sideQueryAccounting, sqlEngine, sqlWorkflowRunStore, staticWiring, storePosture, subRunner, subagentSteerRegistry, taskAttachmentStore, taskLimitCaps, taskTimeoutSec, toolApproval, toolResultStore, usageWindowStore, userInputLedger, webSearchProvider, workflowAgentRegistry, workflowAgentSessionIndex, workflowParkDecisions, workflowCompletionInbox, workflowJournalStore, workflowModelAllowlistSnapshot, workflowNotifyGate, workflowNotifyJournal, workflowRecoverOpts, workflowRunStore, workflowsCapable, orgDeliveryGate } = ctx;
+    const { peerDesk, approvalAskAudit, approvalExemptionStore, approvalNonceStore, authorize, backend, backgroundAgentStore, brain, breakerState, centerRuntimeCapsResolver, checkpointStore, checkpointCtxSealing, parkCommits, config, webAdmin, consolidationValve, costQuota, belowTaskChainPatterns, deploymentMods, deploymentModsLoaded, deviceLane, drainState, dropSessionScopedOf, durableEnabled, elicitation, fenceSessionOwner, fileHistoryStore, fleetBus, fleetLease, fleetUsage, governanceSeams, handslessRunner, hookAgent, hookLlm, hookWakeBus, imageBakes, imageIndex, instanceId, instrumentDegenerate, leaderEndpoint, loadedSkills, localRoot, logger, lspManager, mcpRevocations, sandboxCapacity, memoryBundleFaces, memoryComplianceFaces, memoryConsolidationFaces, memoryEngine, memoryExportStores, memoryOptOutGrantStore, memoryOriginFaces, memoryPosture, memorySyncCursors, memorySyncRunner, metrics, modelUsageTracker, orgMemoryAdmission, otelExporter, outcomeSink, ownerAware, parkedReviveInheritedGate, parkedReviveSurface, perSessionCwd, perTaskImage, planCacheProbe, pricing, principalCaps, promptManifestTracker, purgeSession, question, rateLimiter, reaper, webAdminJwtVerifier, resumeAnchorStore, retentionLaneStarted, retentionLaneStore, ruleConsent, runStore, runner, runnerDeps, runtimeCapsPeekReading, sandboxGitPlane, scenarioDetails, scenarios, selectEnvTool, sendFileLedger, sendUserFileEmitter, sendUserFileToolSpec, sessionAudit, sessionEnvSelection, sessionMemoryStatusFace, sessionPolicyStore, sessionTitler, sessionWatchRegistry, setSessionCwd, setSessionInheritEnv, setSessionShellEnv, sessionResidentBackground, sharedMemoryStore, sideQueryAccounting, sqlEngine, sqlWorkflowRunStore, staticWiring, storePosture, subRunner, subagentSteerRegistry, taskAttachmentStore, taskLimitCaps, taskTimeoutSec, toolApproval, toolResultStore, usageWindowStore, userInputLedger, webSearchProvider, workflowAgentRegistry, workflowAgentSessionIndex, workflowParkDecisions, workflowCompletionInbox, workflowJournalStore, workflowModelAllowlistSnapshot, workflowNotifyGate, workflowNotifyJournal, workflowRecoverOpts, workflowRunStore, workflowsCapable, orgDeliveryGate } = ctx;
     const stores = {
         runStore,
         resumeAnchorStore: resumeAnchorStore ? resumeAnchorStore : undefined,
@@ -85,7 +85,8 @@ export async function runStage10(ctx) {
         sessionAudit,
         routeJudgeBrain: brain,
         purgeSession: purgeSession ? purgeSession : undefined,
-        bindSessionInheritEnv: executionLaneOf(config.remoteExec?.provider) === "host" ? setSessionInheritEnv : undefined,
+        bindSessionInheritEnv: config.remoteExec.provider === "host" ? setSessionInheritEnv : undefined,
+        dropSessionScopedOf,
         subagentTaskOutput: (handle, access) => backgroundAgentOutput(defaultTaskRegistry, handle, access, backgroundAgentStore),
         taskHandleOutput: (handle, access) => taskHandleOutput(defaultTaskRegistry, handle, access, backgroundAgentStore),
         taskHandleStop: (handle, access) => taskHandleStop(defaultTaskRegistry, handle, access, backgroundAgentStore),
@@ -130,7 +131,7 @@ export async function runStage10(ctx) {
         usageWindowStore: usageWindowStore ? usageWindowStore : undefined,
         autoModeFace: {
             seatMounted: runnerDeps.autoMode !== undefined,
-            resolveCaps: runtimeCapsPeekResolver,
+            resolveCaps: runtimeCapsPeekReading,
             classifierModel: () => {
                 const route = classifierRouteFor(runnerDeps);
                 if (route.fault !== undefined)
@@ -173,7 +174,9 @@ export async function runStage10(ctx) {
         webSearchProvider,
         sealedKeyPublic: webAdmin.sealedKeyPublic,
         sandboxGitPlane,
+        sandboxCapacity,
         deploymentModPackages: deploymentModsLoaded.length,
+        perSessionCwd,
         instanceId,
         capabilities: {
             version: serviceVersion(),
@@ -209,7 +212,8 @@ export async function runStage10(ctx) {
         peerDesk,
         getKeyResolver: () => webAdmin.getKeyResolver(),
         taskAttachmentStore, perSessionCwd, setSessionCwd, setSessionShellEnv, fenceSessionOwner,
-        hookLlm, hookAgent, belowTaskChainPatterns, fleetBus, hookWakeBus, resumeAnchorStore, ownerAware, taskLimitCaps, taskTimeoutSec,
+        hookLlm, hookAgent, belowTaskChainPatterns, fleetBus, hookWakeBus, ownerAware, taskLimitCaps, taskTimeoutSec,
+        historyAnchors: resumeAnchorStore && runStore ? { anchors: resumeAnchorStore, runs: runStore } : undefined,
         selectEnvTool, sendUserFileToolSpec, memoryEngine, memorySyncRunner, durableEnabled, approvalExemptionStore,
         checkpointStore, imageIndex, perTaskImage,
         sessionEnvSelection,

package/dist/boot/store-evidence.d.ts

@@ -0,0 +1,20 @@
+/**
+ * 店持久性的**起服取证**(`store-posture.ts` 的 {@link captureStoreEvidence})—— 三根各由自己的属主解析路径,这里只是把三只解析交给判者:
+ *  · 数据根 = `localBackendRootOf`(local 后端开店读的那一只);
+ *  · 封签钥匙目录 = `sealedKeyDirOf`(第 2 段建保管店读的那一只);
+ *  · file 记忆根 = `fileMemoryEngineRoot(config)`(file 记忆引擎的根链),`MEMORY_ENGINE_BACKEND=file` 时取证;进不进判定由第 3 段按引擎**真接没接线**定
+ *    (`buildStorePosture` 的 `memoryRootWired`:多租户 / 关引擎 / 平面分裂车道上不接)。SQL 记忆腿的盘上只有每任务的工作副本,持久面在库里,不取证。
+ *
+ * ⚠️ 位置即契约:调用点是起服**第 2 段段首**(`stage-02-web-admin-pull.ts`,任何第 2 段写之前 —— 第 2 段会建 `<数据根>/sealed-key`)。
+ * 直接调 `openStores` 的测试也经这一只取证,不另写一份三根解析。
+ */
+import type { ServiceConfig } from "../config.js";
+import { type StoreEvidence, type StoreEvidenceHost } from "../store-posture.js";
+/** 取证只读这四格(第 2 段段首手里是装载出的配置,还没合成 `ServiceConfig`;收窄到读的那几格,两种配置形都递得进来)。 */
+export type StoreEvidenceConfig = Pick<ServiceConfig, "localDataRoot" | "sealedKeyDir" | "memoryEngineBackend" | "memoryEngineDir">;
+export declare function captureBootStoreEvidence(a: {
+    readonly config: StoreEvidenceConfig;
+    readonly localRoot: string;
+    readonly host?: Partial<StoreEvidenceHost>;
+}): Promise<StoreEvidence>;
+//# sourceMappingURL=store-evidence.d.ts.map

package/dist/boot/store-evidence.js

@@ -0,0 +1,13 @@
+import { canonicalPathOf, fileMemoryEngineRoot } from "../memory-scope.js";
+import { localBackendRootOf } from "../plugins/store-backend.js";
+import { sealedKeyDirOf } from "../sealed-key-layout.js";
+import { captureStoreEvidence } from "../store-posture.js";
+export async function captureBootStoreEvidence(a) {
+    const { config, localRoot } = a;
+    return captureStoreEvidence({
+        dataRoot: localBackendRootOf(config),
+        sealedKeyDir: sealedKeyDirOf(config, localRoot),
+        memoryRoot: config.memoryEngineBackend === "file" ? fileMemoryEngineRoot(config) : undefined,
+    }, { canonical: canonicalPathOf, ...a.host });
+}
+//# sourceMappingURL=store-evidence.js.map