@sema-agent/server 7.146.0 → 7.148.0

package/dist/http/dispatch.js

@@ -1,16 +1,22 @@
 import { createHash } from "node:crypto";
-import { setSsoPrincipal, setSsoScope, setSsoRole, setSsoPrincipalInc, isDestructiveSessionWrite, PRINCIPAL_TOKEN_HEADER, APPROVAL_MAC_HEADER, APPROVAL_MAC_KID_HEADER } from "../security.js";
+import { setSsoPrincipal, setSsoScope, setSsoRole, setSsoPrincipalInc, isDestructiveSessionWrite, PRINCIPAL_TOKEN_HEADER, APPROVAL_MAC_HEADER, APPROVAL_MAC_KID_HEADER, HttpError, SCENARIO_HEADER, scenarioHeaderOf, scenarioHeaderUnknownError, verifiedPerson } from "../security.js";
+import { partsOf } from "../owner-brands.js";
+import { DEPLOYMENT_SHAPE_PREDICATES } from "../deployment-shape.js";
 import { publicStoreProbeError } from "../store-live-probe.js";
 import { looksLikeJwt } from "@sema-agent/settings-schema/api/auth-bridge";
 import { admitBridgeIdentity } from "../auth-bridge.js";
 import { ROUTE_METHOD_ORDER } from "./route-ctx.js";
 import { READ_CREDENTIAL_ROUTES, PUBLIC_ROUTES, POST_CREDENTIAL_ROUTES, routeLabel, isBillableSubmitPath, billableKindOf, isCredentialGatedRewrite, isMethodDispatchedSubmitPath, lookupRoute, isProbePath, isSubscriptionRequest } from "./route-table.js";
-import { sendJson, sendError, isSseResponse, endSseWithError } from "./send.js";
+import { sendJson, sendError, sendHttpError, isSseResponse, endSseWithError } from "./send.js";
 import { admissionRefusalOf, readinessOf, healthReadinessKeys, sendReadyz, sendBillableRefusal, billableRefusalOf, billableRefusalFrame } from "./readiness.js";
 import { ENGINE_SIGNAL_KEY, buildEngineSignal, fleetMembershipKeys, healthConfigLedgerKeys, healthDrainingKeys, mintEngineSignal, restartActionable } from "../fleet/engine-signal.js";
 import { buildHealthSelfReport } from "./health-self-report.js";
-import { deploymentModPackages as deploymentModPackagesFact } from "../capability-facts.js";
-import { actsForDeployment, admitRunIdentity, authorized, systemFor, gatedPrincipal, sendPrincipalRefusal, sendUnauthorized, traceTokenPresented, verifiedIdentitySource, hasServiceAuth, devOpenDeployment } from "./principal-gate.js";
+import { projectHealthBody } from "./health-reader.js";
+import { projectHealthStoreSection, unwiredStorePosture } from "../store-posture.js";
+import { autoBackgroundOnTimeout as autoBackgroundOnTimeoutFact, autoBackgroundOnTimeoutWord, deploymentModPackages as deploymentModPackagesFact } from "../capability-facts.js";
+import { hostBackgroundShellEnabled } from "../config.js";
+import { actsForDeployment, admitRunIdentity, authorized, bearerPresentedButUnverified, systemFor, gatedSubject, sendPrincipalRefusal, sendUnauthorized, traceTokenPresented, verifiedIdentitySource, devOpenDeployment } from "./principal-gate.js";
+import { hasServiceAuth } from "../identity-source.js";
 import { inflightTotal } from "../fleet/drain-entry.js";
 const PROCESS_STARTED_AT_MS = Date.now() - Math.round(process.uptime() * 1000);
 export function readCredentialOk(req, config) {
@@ -20,6 +26,11 @@ export function readCredentialOk(req, config) {
         return true;
     return traceTokenPresented(req, config);
 }
+export function healthReaderOf(req, config) {
+    if (!hasServiceAuth(config))
+        return "open";
+    return readCredentialOk(req, config) ? "credentialed" : "anonymous";
+}
 function cors(res, req, origins, principalHeader) {
     if (!origins || origins.length === 0)
         return;
@@ -36,7 +47,7 @@ function cors(res, req, origins, principalHeader) {
         return;
     res.setHeader("access-control-allow-origin", allow);
     res.setHeader("access-control-allow-methods", [...ROUTE_METHOD_ORDER, "OPTIONS"].join(", "));
-    res.setHeader("access-control-allow-headers", `content-type, authorization, last-event-id, ${principalHeader}, idempotency-key, x-detach-on-disconnect, ${PRINCIPAL_TOKEN_HEADER}, ${APPROVAL_MAC_HEADER}, ${APPROVAL_MAC_KID_HEADER}, if-none-match`);
+    res.setHeader("access-control-allow-headers", `content-type, authorization, last-event-id, ${principalHeader}, ${SCENARIO_HEADER}, idempotency-key, x-detach-on-disconnect, ${PRINCIPAL_TOKEN_HEADER}, ${APPROVAL_MAC_HEADER}, ${APPROVAL_MAC_KID_HEADER}, if-none-match`);
     res.setHeader("access-control-expose-headers", "x-task-id, retry-after");
 }
 export function createDispatch(ctx) {
@@ -60,7 +71,29 @@ export function createDispatch(ctx) {
                     endSseWithError(r, frame);
         };
     }
-    async function dispatchSegment(rows, req, res, url, search, method, allow, ctx, admit) {
+    function scenarioHeaderAnswered(req, res) {
+        if (scenarioHeaderOf(req) === undefined)
+            return false;
+        try {
+            if (DEPLOYMENT_SHAPE_PREDICATES.principalRequired.holds(deps.config) && (bearerPresentedButUnverified(req, deps.config) || verifiedPerson(req, deps.config) === undefined)) {
+                sendPrincipalRefusal(res, req, deps.config);
+                return true;
+            }
+            const subject = gatedSubject(req, deps.config);
+            const scenario = subject === undefined ? undefined : partsOf(subject).scenario;
+            const known = deps.scenarioGate.known();
+            if (scenario === undefined || !known.includes(scenario))
+                throw scenarioHeaderUnknownError(String(scenario), known);
+            return false;
+        }
+        catch (e) {
+            if (!(e instanceof HttpError))
+                throw e;
+            sendHttpError(res, e);
+            return true;
+        }
+    }
+    async function dispatchSegment(rows, req, res, url, search, method, allow, ctx, admit, judgesIdentity = true) {
         for (const row of rows) {
             if (row.enabled !== undefined && !row.enabled(deps))
                 continue;
@@ -74,11 +107,32 @@ export function createDispatch(ctx) {
                 sendUnauthorized(res, "credential");
                 return true;
             }
+            if (judgesIdentity && scenarioHeaderAnswered(req, res))
+                return true;
             await row.handler(req, res, { decl: found.decl, params: found.params, search }, ctx);
             return true;
         }
         return false;
     }
+    async function attachBridgeIdentity(req) {
+        if (deps.webAdminJwtVerifier) {
+            const authz = req.headers.authorization ?? "";
+            const rawBearer = /^Bearer\s/i.test(authz) ? authz.replace(/^Bearer\s+/i, "") : "";
+            if (rawBearer && looksLikeJwt(rawBearer)) {
+                const identity = admitBridgeIdentity(await deps.webAdminJwtVerifier.verify(rawBearer), { logger: deps.logger, metrics: deps.metrics });
+                if (identity) {
+                    setSsoPrincipal(req, identity.principal);
+                    req.headers[deps.config.principalHeader.toLowerCase()] = identity.principal;
+                    setSsoScope(req, identity.scope);
+                    if (identity.role)
+                        setSsoRole(req, identity.role);
+                    if (identity.principalInc !== undefined)
+                        setSsoPrincipalInc(req, identity.principalInc);
+                    deps.logger?.info?.("auth_bridge_principal_accepted", { principal: identity.principal, scope: identity.scope });
+                }
+            }
+        }
+    }
     async function handle(req, res) {
         const startedAt = Date.now();
         const method = req.method ?? "GET";
@@ -127,14 +181,16 @@ export function createDispatch(ctx) {
             return;
         }
         if (req.method === "GET" && url === "/health") {
+            await attachBridgeIdentity(req);
+            const reader = healthReaderOf(req, deps.config);
             const signal = mintEngineSignal(deps);
             const engineSignal = buildEngineSignal(signal);
             const declaredMods = deploymentModPackagesFact(deps);
             const configHash = createHash("sha256")
-                .update(JSON.stringify({ model: deps.config.model.id, sessionBackend: deps.config.sessionBackend, dbBackend: deps.config.dbBackend, dataRoot: deps.config.localDataRoot, configProvider: deps.config.configProvider, remoteExec: deps.config.remoteExec?.provider, port: deps.config.port }))
+                .update(JSON.stringify({ model: deps.config.model.id, sessionBackend: deps.config.sessionBackend, dbBackend: deps.config.dbBackend, dataRoot: deps.config.localDataRoot, configProvider: deps.config.configProvider, remoteExec: deps.config.remoteExec.provider, port: deps.config.port }))
                 .digest("hex")
                 .slice(0, 16);
-            sendJson(res, 200, {
+            const fullBody = {
                 status: "ok",
                 ...(typeof deps.capabilities?.version === "string" ? { version: deps.capabilities.version } : {}),
                 ...healthDrainingKeys(signal),
@@ -158,7 +214,10 @@ export function createDispatch(ctx) {
                         },
                     };
                 })(),
-                ...(deps.storePosture?.degradedReason !== undefined ? { durable: false, storeDegraded: true } : {}),
+                ...(deps.sandboxCapacity !== undefined ? { sandboxCapacity: deps.sandboxCapacity.health() } : {}),
+                ...(deps.storePosture?.degradedReason !== undefined ? { storeDegraded: true } : {}),
+                store: projectHealthStoreSection(deps.storePosture ?? unwiredStorePosture(deps.config.dbBackend)),
+                autoBackgroundOnTimeout: autoBackgroundOnTimeoutWord(autoBackgroundOnTimeoutFact(deps.config, hostBackgroundShellEnabled())),
                 ...healthReadinessKeys(signal.verdict),
                 model: deps.config.model.id,
                 sessionBackend: deps.sessionStoreLabel ?? deps.config.sessionBackend,
@@ -201,7 +260,8 @@ export function createDispatch(ctx) {
                     };
                 })(),
                 [ENGINE_SIGNAL_KEY]: engineSignal,
-            });
+            };
+            sendJson(res, 200, projectHealthBody(reader, fullBody));
             return;
         }
         if (req.method === "GET" && url === "/readyz") {
@@ -214,8 +274,8 @@ export function createDispatch(ctx) {
                 return;
             }
             const mt = deps.config.metricsToken;
-            const devOpen = devOpenDeployment(deps) && !mt;
-            const ok = devOpen || (!!mt && authorized(req, mt)) || actsForDeployment(req, deps.config, () => gatedPrincipal(req, deps.config));
+            const devOpen = devOpenDeployment(deps.config) && !mt;
+            const ok = devOpen || (!!mt && authorized(req, mt)) || actsForDeployment(req, deps.config, () => gatedSubject(req, deps.config));
             if (!ok) {
                 sendUnauthorized(res, "operator");
                 return;
@@ -232,26 +292,10 @@ export function createDispatch(ctx) {
             res.end(deps.metrics.render());
             return;
         }
-        if (deps.webAdminJwtVerifier) {
-            const authz = req.headers.authorization ?? "";
-            const rawBearer = /^Bearer\s/i.test(authz) ? authz.replace(/^Bearer\s+/i, "") : "";
-            if (rawBearer && looksLikeJwt(rawBearer)) {
-                const identity = admitBridgeIdentity(await deps.webAdminJwtVerifier.verify(rawBearer), { logger: deps.logger, metrics: deps.metrics });
-                if (identity) {
-                    setSsoPrincipal(req, identity.principal);
-                    req.headers[deps.config.principalHeader.toLowerCase()] = identity.principal;
-                    setSsoScope(req, identity.scope);
-                    if (identity.role)
-                        setSsoRole(req, identity.role);
-                    if (identity.principalInc !== undefined)
-                        setSsoPrincipalInc(req, identity.principalInc);
-                    deps.logger?.info?.("auth_bridge_principal_accepted", { principal: identity.principal, scope: identity.scope });
-                }
-            }
-        }
+        await attachBridgeIdentity(req);
         if (await dispatchSegment(READ_CREDENTIAL_ROUTES, req, res, url, search, method, allow.pre, ctx, (r) => readCredentialOk(r, deps.config)))
             return;
-        if (await dispatchSegment(PUBLIC_ROUTES, req, res, url, search, method, allow.pre, ctx))
+        if (await dispatchSegment(PUBLIC_ROUTES, req, res, url, search, method, allow.pre, ctx, undefined, false))
             return;
         const identitySource = verifiedIdentitySource(req, deps.config);
         admitRunIdentity(req, identitySource, deps.logger);
@@ -298,7 +342,9 @@ export function createDispatch(ctx) {
         if (await dispatchSegment(POST_CREDENTIAL_ROUTES, req, res, url, search, method, allow.post, ctx))
             return;
         if (allow.pre.length > 0 || allow.post.length > 0) {
-            if (allow.post.length > 0 && deps.config.requirePrincipal && gatedPrincipal(req, deps.config) === undefined) {
+            if (allow.post.length > 0 && scenarioHeaderAnswered(req, res))
+                return;
+            if (allow.post.length > 0 && deps.config.requirePrincipal && gatedSubject(req, deps.config) === undefined) {
                 sendPrincipalRefusal(res, req, deps.config);
                 return;
             }

package/dist/http/durable-run-leg.d.ts

@@ -13,17 +13,17 @@ export interface DurableRunLegArgs {
     idem?: RunIdemBinding;
     /** 🔒 这条 run 的 **fleet 行 scope** —— 必须与 `GET /v1/fleet/stream` 过滤用的是同一个身份,且绝不是
      *  自报的 `x-agent-principal` 头(自报头会把行打到受害者的 scope 上,或打到 `default` 而真属主的流把它
-     *  过滤掉)。提交门传 `gatedPrincipal(req) ?? "default"`;`/decide` 的第三条车道传 resume 家族的
+     *  过滤掉)。提交门传 `gatedSubject(req) ?? "default"`;`/decide` 的第三条车道传 resume 家族的
      *  `resumeFleetScope(req, auth)`(同一条 wire 上两条腿因此同答)。 */
     fleetScope: string;
     /** 🔒 这条 run 的 **elicit / question 应答方**(E23:与 respond 门读的是同一个已验身份,不是自报头)。
-     *  提交门传 `gatedPrincipal(req) ?? null` = 提交者本人;`/decide` 的第三条车道传**卡属主**(= 原提交者,
+     *  提交门传 `gatedSubject(req) ?? null` = 提交者本人;`/decide` 的第三条车道传**卡属主**(= 原提交者,
      *  不是代为按下按钮的 operator —— 与 resume 腿那条成文口径逐字同源)。`null` = 匿名/开放部署。 */
     elicitOwner: string | null;
     /** run 行元数据的 `source` 列(调用方的系统身份;内部车道传自己的车道名)。只作归因。 */
     source: string | null;
     /** run 行身份元组(`RunRecord.identity`)—— 调用方经 `runIdentityOf(req, config, 属主)` 读凭据门铸下的那一份交进来(本腿不碰请求);
-     *  属主 = `prepared.auth.principal`(本腿建行写进 `owner` 的同一个值)。`/decide` 第三条车道同一只读法:按下按钮的不是卡属主 ⇒ 空。 */
+     *  属主 = `prepared.auth.subject`(本腿建行写进 `owner` 的同一个值)。`/decide` 第三条车道同一只读法:按下按钮的不是卡属主 ⇒ 空。 */
     identity: RunIdentity | null;
     /** `/decide` 第三条车道的 fresh 投递腿交来的那一件决定投递(带着的决定 + 起跑之前落行的那一笔;语义与 TRUSTED 纪律的属主 =
      *  `route-ctx.ts` 的 {@link WorkflowDecisionDelivery} 顶注)。缺席 ⇒ 只摊本会话已受理的决定行。 */

package/dist/http/durable-run-leg.js

@@ -1,6 +1,7 @@
 import { uuidv7 } from "@sema-agent/core";
 import { heldWorkflowParkDecisions } from "../parked-decide.js";
-import { HEARTBEAT_MS, runInBackground } from "../runs.js";
+import { runInBackground } from "../runs.js";
+import { recheckClaimBeforeLaunch, refusalAfterLostClaim, startClaimHeartbeat } from "./claim-heartbeat.js";
 import { heldFor } from "../peer-seat.js";
 import { fleetRunPublisher, fleetRunLabels, nameFleetRowOnDelivery } from "../fleet/fleet-bus.js";
 import { cascadeConfig, fillRunPreviewOnDelivery, runMeta } from "./run-meta.js";
@@ -8,10 +9,11 @@ import { declaredApprovalFrameFamilies, resolveStreamApprovalGate } from "../too
 import { buildActiveRunConflict } from "./active-run-conflict.js";
 import { commitExecutionContext } from "./execution-context.js";
 import { rootSessionAbsentAnswer } from "./execution-context.js";
+import { timeClaim } from "./claim-latency.js";
 import { commitSessionInheritEnv } from "./session-inherit-env.js";
 import { clearTurnActivity, readTurnActivityMs } from "../turn-activity.js";
 import { recordResourceWindow } from "../resource-window.js";
-import { persistSubmissionCtx } from "./submit-ctx.js";
+import { persistSubmissionCtx, SUBMIT_CTX_CLAIM_LOST } from "./submit-ctx.js";
 import { releaseClaimedRun } from "./claimed-run.js";
 import { headReadOf } from "../session-incarnation.js";
 import { createSessionWorkspaceRecorder, sessionWorkspaceStoreOf } from "../session-workspace.js";
@@ -21,7 +23,7 @@ export async function mintAndDriveDurableRun(ctx, runStore, args) {
     const sessionId = args.prepared.spec.sessionId;
     const taskId = args.clientTaskId ?? uuidv7();
     const trustedInternals = await heldWorkflowParkDecisions(deps, sessionId, args.workflowDecision?.carried);
-    const created = await runStore.createRun(taskId, sessionId, args.prepared.auth?.principal ?? null, deps.instanceId ?? "default", { ...runMeta(args.prepared, args.source), identity: args.identity, idem: args.idem ?? null });
+    const created = await timeClaim(deps.metrics, "run_claim", runStore.createRun(taskId, sessionId, args.prepared.auth?.subject ?? null, deps.instanceId ?? "default", { ...runMeta(args.prepared, args.source), identity: args.identity, idem: args.idem ?? null }));
     if (created.ok)
         clearTurnActivity(taskId);
     if (created.ok)
@@ -31,20 +33,20 @@ export async function mintAndDriveDurableRun(ctx, runStore, args) {
     if (created.sessionAbsent)
         return rootSessionAbsentAnswer();
     if (!created.ok) {
-        return { status: 409, body: await buildActiveRunConflict({ runStore, checkpointStore: deps.checkpointStore, governance: deps.config, runStaleSec: deps.config.runStaleSec, turnActivity: readTurnActivityMs }, sessionId, created.activeTaskId) };
+        return { status: 409, body: await buildActiveRunConflict({ runStore, checkpointStore: deps.checkpointStore, governance: deps.config, turnActivity: readTurnActivityMs }, sessionId, created.activeTaskId) };
     }
     fillRunPreviewOnDelivery(args.prepared.acceptance, runStore, taskId);
-    const owner = args.prepared.auth?.principal ?? null;
-    const preLaunchHeartbeat = setInterval(() => {
-        void runStore.heartbeat(taskId, owner).catch(() => { deps.metrics?.inc("run_signal_poll_errors_total", { kind: "heartbeat" }); });
-    }, HEARTBEAT_MS);
-    preLaunchHeartbeat.unref?.();
+    args.prepared.seat.noteOwnRun(taskId);
+    const owner = args.prepared.auth?.subject ?? null;
+    const stopPreLaunchHeartbeat = startClaimHeartbeat(runStore, taskId, owner, deps.metrics);
     try {
         const placementReject = await commitExecutionContext(deps, { kind: "run", runStore, taskId }, args.prepared.execution);
         if (placementReject)
             return placementReject;
         if (deps.checkpointStore) {
             const ctxRefusal = await persistSubmissionCtx(deps.checkpointStore, deps, { runStore, taskId }, args.prepared);
+            if (ctxRefusal === SUBMIT_CTX_CLAIM_LOST)
+                return await refusalAfterLostClaim(deps, runStore, sessionId, taskId);
             if (ctxRefusal)
                 return ctxRefusal;
         }
@@ -59,12 +61,15 @@ export async function mintAndDriveDurableRun(ctx, runStore, args) {
                 throw err;
             }
         }
+        const lostClaim = await recheckClaimBeforeLaunch(deps, runStore, sessionId, taskId);
+        if (lostClaim !== undefined)
+            return lostClaim;
     }
     finally {
-        clearInterval(preLaunchHeartbeat);
+        stopPreLaunchHeartbeat();
     }
     commitSessionInheritEnv(deps, args.prepared.spec.sessionId, args.prepared.body);
-    const anchorOwner = args.prepared.auth?.principal ?? null;
+    const anchorOwner = args.prepared.auth?.subject ?? null;
     const headOf = headReadOf(deps.sessionStorage);
     const captureTurnAnchor = deps.resumeAnchorStore && headOf
         ? async (eventId) => {
@@ -84,7 +89,7 @@ export async function mintAndDriveDurableRun(ctx, runStore, args) {
         ...fleetRunLabels(args.prepared.acceptance.objectiveAtSubmit),
     });
     nameFleetRowOnDelivery(args.prepared.acceptance, fleetPub);
-    void heldFor(args.prepared.peerLease, () => runInBackground(args.prepared.runner, args.prepared.spec, runStore, taskId, deps.metrics, args.prepared.auth?.principal, args.prepared.verify, args.prepared.cascade ? cascadeConfig(deps.config.cascadeLadder, args.prepared.spec.limits?.maxCostUsd) : undefined, deps.instrumentDegenerate, deps.planCacheProbe, deps.config.traceThinking, inflightRuns, preemptableRuns, steerableRuns, deps.modelUsage, deps.elicitation, args.elicitOwner, captureTurnAnchor, fleetPub, captureUserMessageAnchor, deps.question, deps.workflowCompletionInbox, deps.subagentSteerRegistry, (m, x) => deps.logger?.info?.(m, x), deps.sendUserFile, deps.promptManifests, deps.toolApproval
+    void heldFor(args.prepared.peerLease, () => runInBackground(args.prepared.runner, args.prepared.spec, runStore, taskId, deps.metrics, args.prepared.auth?.subject, args.prepared.verify, args.prepared.cascade ? cascadeConfig(deps.config.cascadeLadder, args.prepared.spec.limits?.maxCostUsd) : undefined, deps.instrumentDegenerate, deps.planCacheProbe, deps.config.traceThinking, inflightRuns, preemptableRuns, steerableRuns, deps.modelUsage, deps.elicitation, args.elicitOwner, captureTurnAnchor, fleetPub, captureUserMessageAnchor, deps.question, deps.workflowCompletionInbox, deps.subagentSteerRegistry, (m, x) => deps.logger?.info?.(m, x), deps.sendUserFile, deps.promptManifests, deps.toolApproval
         ? {
             coordinator: deps.toolApproval,
             streamApprovalOn: resolveStreamApprovalGate({
@@ -100,6 +105,7 @@ export async function mintAndDriveDurableRun(ctx, runStore, args) {
         }
         : undefined, deps.checkpointStore, args.prepared.engineNotices, trustedInternals, deps.userInputLedger, args.prepared.acceptance, createSessionWorkspaceRecorder(sessionWorkspaceStoreOf(deps.sessionStorage), args.prepared.legFacts?.sessionWitness), args.prepared.legFacts?.skills));
     args.runSlot?.release();
+    args.prepared.seat.markRecord();
     return { status: 202, body: { taskId, sessionId, status: "running", ...(args.prepared.warnings !== undefined ? { warnings: args.prepared.warnings } : {}) } };
 }
 //# sourceMappingURL=durable-run-leg.js.map

package/dist/http/execution-context.d.ts

@@ -1,41 +1,3 @@
-/**
- * **执行上下文** —— 每条执行起点从这一只解析器取同一型上下文:根会话是谁、这一位住客在根会话行上的执行放置是什么、这条执行走哪条车道、
- * 主体能不能用这条车道;认领之后的初始放置只有一只写口 {@link commitExecutionContext}。
- *
- * ## 规则(一句)
- * 根只有一个来源 = authorizer(`ServiceCoreDeps.authorize` 必填席,唯一铸点即登记点),根进 spec 只有一个写者 = {@link stampSpecRoot};
- * 执行放置**读只有一只** —— 会话店执行席 `seat.read(root)` 一次行读(住客 + 格),解析器读它、提交腿的门交来的 `judged` 比它、设备准入链判的也是这一读;
- * **写只有一只** —— 认领之后的 {@link commitExecutionContext}(按解析器那一读的住客定址,0 行按住客复读分类,永不对现住客重试)。
- *
- * ## 解析步序(设计 §3.2 表 ①–④;⑤ 取 rig 不在本版)
- *  ① 读:会话店不带执行席 ⇒ absent、`occupant` 缺(只一元车道表的部署可能);否则一次行读 —— 行不在 ⇒ 404 `resume.session_not_found`;`judged`(门判过的那一读)
- *     在场而与行头不是同一位住客(化身 ∧ 属主,写口同一只判官 `sameOccupant`)⇒ 同 404(他人在门与解析之间删掉并同 id 重登记,或同一化身的属主变了 ——
- *     local M10 认领 / identical 重戳 / SQL 导入提交点改属主 —— 判到新住客的车道就是错的);local 格是 `forking`
- *     ⇒ 409 `conflict.fork_in_progress`;读故障抛(不吞成 absent)。解析器不建行、不铸根。
- *     随后(同一步,就在那一读之后):这只根会话 id 在本进程被删过、而那一读的住客不是删前的属主 ⇒ 409 `conflict.session_id_retired`
- *     (表与规则 `deleted-session-ids.ts`,这里是它唯一的读点;店不带执行席 ⇒ fresh 判门判过的那一读,continuation 判不出 ⇒ 表里有就拒)。
- *  ② 定车道:`mirror` ⇒ 409 `conflict.session_mirror`(体带 `forkPath`);`writer(L)` 而 L 不在本部署的车道表 ⇒ 409 `execution_lane.not_served{boundLane}`;absent ⇒ 表首。
- *  ③ 授权:主体的执行车道裁定(`gateExecutionLane`,判据与码同 `runtime-caps-resolver.ts`);服务形不判。
- *  ④ 只 fresh:设备准入链(体 `deviceId` 只在 device 车道收;准入链三步 + 首绑目标三读,全读;判的是步 ① 那一读)。
- *
- * 入口三形(判别联合,{@link ExecutionEntry}):`fresh`(提交腿:根 = authorizer 交出的 `auth.sessionId`,`judged` = authorizer 判过的头)·
- * `continuation`(续跑家族与停驻赎回:根 = checkpoint / 停驻行的根;不带 `judged` —— 步 ① 那一读就是这条执行对根的唯一一读,认领之后由写口按它判)·
- * `service`(服务 run:没有会话根)。
- * `fresh` / `continuation` 两形型上恒带 `root: string`,`service` 形没有 `root` 键 —— 「按一只缺席的根去读行」在型上不可表达。
- *
- * ## 提交({@link commitExecutionContext};设计 §3.2「提交」)
- * 只在认领之后(四个 `createRun` 点、续跑家族 `markResuming` 之后、停驻赎回 `claimParkedAgent` 之后)调,是认领之后改执行放置的唯一写口:
- *  · 有设备意图(fresh ∧ device 车道)⇒ 首绑(设备店一只事务,按住客定址)或已绑臂的再断言(按住客再读 + 准入链再断言设备);
- *  · absent ⇒ place(非 device 车道);命中 = 成立;0 行按住客复读分类:同值 = 成立 · 异车道 ⇒ `execution_lane.tree_bound` · mirror ⇒ `conflict.session_mirror` ·
- *    gone(行不在或住客不是解析器那一位)⇒ 「会话不在」(提交腿 404 `resume.session_not_found`;停驻赎回答它自己的 `decide.not_parked`)—— **不对现住客重试**;
- *  · writer ⇒ 按住客再读断言仍是 writer(L);
- *  · 拒 ⇒ 先释放本次认领(run:终结 + 放认领 + 放幂等键;停驻:回滚认领)再交回拒答;店故障 ⇒ 释放后原样上抛(响亮,不当答案)。
- * claim 之后每一次店往返都带 {@link placementWriteDeadlineMs} 硬时限。
- *
- * ## 便利度不变(clay [ref] 硬约束)
- * 本文件**不产生任何审批**:只做「这条会话放在哪条车道 / 哪台设备上」的读、判与认领之后的一次写。device 车道上 `permissionMode: "bypassPermissions"` 的 run
- * 与 host 车道同构造同读数(判据钉在 device-first-bind 测试的「零额外审批」格)。
- */
 import type { IncomingMessage } from "node:http";
 import type { SessionHead, TaskSpec } from "@sema-agent/core";
 import { type DeviceOwner, type DeviceStore } from "../device-store.js";
@@ -87,8 +49,9 @@ export type ExecutionContext = {
 export type RootedExecutionContext = Extract<ExecutionContext, {
     readonly root: string;
 }>;
-/** 装配器(`resolveSpec`)收的那一半:根、入口形与解析器选定的车道(它不判放置、不选车道 —— `lane` 是解析器那一次的读数,装配器只读:项目包的车道门)。 */
-export type ExecutionRoot = Pick<RootedExecutionContext, "kind" | "root" | "lane">;
+/** 装配器(`resolveSpec`)收的那一半:根、入口形、解析器选定的车道与步 ① 那一读的住客(它不判放置、不选车道 —— `lane` 是解析器那一次的读数,装配器只读:项目包的车道门;
+ *  `occupant` 只给会话登记簿的围栏记「这一位住客」,换住客即清上一位的条目)。 */
+export type ExecutionRoot = Pick<RootedExecutionContext, "kind" | "root" | "lane" | "occupant">;
 /** 解析器读的部署件(全部取自同一只 `ServiceDeps`)。 */
 export interface ExecutionContextDeps {
     readonly config: ServiceConfig;
@@ -119,7 +82,7 @@ export declare function isRootSessionGoneError(err: unknown): boolean;
 /**
  * 调用方 device 域的**唯一铸造点**。`undefined` = 判不出域(无 principal,或凭据不带 tenant claim)—— 消费点必须响亮拒,禁静默空视图。
  *
- * 🔴 位置即契约:`{owner_tenant, owner_subject}` 是 O11 的 device-lane-local 复合身份(全局 principal 一个字节不动)。subject = `gatedPrincipal`(verified 链),
+ * 🔴 位置即契约:`{owner_tenant, owner_subject}` 是 O11 的 device-lane-local 复合身份(全局 principal 一个字节不动)。subject = `gatedPerson`(verified 链),
  * tenant = `ssoVerifiedScope`(registry auth-bridge JWT 的 `scope` claim)—— **两者都是签名真源,不是自报头**。管理面三读三写与首绑写协议全部从这一只函数取域;
  * 派生第二份就是把 O11 的判据本体复制成一份会漂的孪生。
  */
@@ -159,8 +122,20 @@ export type RootedTaskSpec = TaskSpec & {
  * 在场且等于根 ⇒ 同值,照盖;在场而**不等** ⇒ 400 `request.precondition_unmet`(嵌入方的装配器另点了一只会话 —— 它在型上不能这么写,
  * 走到这里只能是擦型或 JS 形;拒在建任何行之前)。续跑家族照它自己的折叠律把这只拒答成 409 `resume_blocked_by_policy`(`blockedBy` = 这只码,
  * `http/resume-legs.ts` 的 `resolveResumeSpecOrBlocked`:装配期的每一只 `HttpError` 在续跑腿上都这么折),同样什么都没续。
+ *
+ * **根「必须已在」的唯一写者也是这里**(`requireExistingSession`;装配器不写它):根是宿主的 ⇒ 引擎取会话时不许「缺行即建」——
+ * 解析器步 ① 读到过这一行(`occupant` 在场),或调用方自己要求了它(`requireExistingSession: true`;店不带执行席时这是唯一的来源)⇒ 盖 `true`:
+ * 门与引擎取会话之间这一行被删(属主删除 / 受理前拒的撤回),引擎答 `resume.session_not_found`,不在原 id 上重建一只无主的空根。
+ * **例外只有一条,来自引擎的派生形**:`cascade: true` 的提交不盖 —— 引擎派生每一级时只删 `sessionId`、其余字段照展开,带着这一位的级就成了
+ * 「没有会话 id 却要求会话已在」,被引擎拒掉(每一级都跑不起来)。引擎把这一位随 `sessionId` 一并剥掉之后,cascade 也盖,这一条例外删去。
+ * 没读到行、调用方也没要求 ⇒ 不盖(与引擎缺省同:没有宿主见过的根可护)。
  */
-export declare function stampSpecRoot(spec: ResolvedTaskSpec, ctx: ExecutionRoot): RootedTaskSpec;
+export declare function stampSpecRoot(spec: ResolvedTaskSpec, ctx: ExecutionRoot, submission: SpecRootSubmission): RootedTaskSpec;
+/** {@link stampSpecRoot} 读的那两位提交事实(受理漏斗交这次的体;续跑家族交 checkpoint 上存的那一份体)。 */
+export interface SpecRootSubmission {
+    readonly cascade?: unknown;
+    readonly requireExistingSession?: unknown;
+}
 /**
  * run 店建行时根会话行已经不在(`CreateRunOutcome.sessionAbsent`:受理之后、认领之前会话被删)的**唯一**答复 ——
  * 四个建行点(同步 / 流式 / durable / wake)、解析期的「行不在 / 住客换了」与提交期的 `gone` 同答 404 `resume.session_not_found`,什么都没建、什么都没跑。
@@ -202,6 +177,7 @@ export interface ExecutionCommitDeps {
     } | undefined;
     readonly metrics?: {
         inc(name: string, labels?: Record<string, string>): void;
+        observe?(name: string, value: number, labels?: Record<string, string>): void;
     } | undefined;
 }
 /**

package/dist/http/execution-context.js

@@ -1,5 +1,6 @@
+import { RUN_STALE_SEC_DEFAULT } from "../run-stale-default.js";
 import { HttpError, createCodedHttpError, ssoVerifiedScope } from "../security.js";
-import { gatedPrincipal } from "./principal-gate.js";
+import { gatedPerson } from "./principal-gate.js";
 import { DEVICE_ERROR_CODES, assertDeviceIdShape } from "../device-store.js";
 import { buildDeviceRejection } from "../device-enrollment.js";
 import { sameOccupant } from "../execution-placement.js";
@@ -8,6 +9,7 @@ import { gateExecutionLane } from "../runtime-caps-resolver.js";
 import { releaseClaimedRun } from "./claimed-run.js";
 import { sessionIdRetiredFor } from "../deleted-session-ids.js";
 import { refusalBody } from "./refusal-body.js";
+import { timeClaim } from "./claim-latency.js";
 export async function resolveExecutionContext(deps, entry) {
     const lanes = deployedExecutionLanes(deps.config);
     switch (entry.kind) {
@@ -92,7 +94,7 @@ export function isRootSessionGoneError(err) {
     return err instanceof HttpError && err.code === rootSessionAbsentAnswer().body.errorCode;
 }
 export function deviceOwnerDomainOf(req, config) {
-    const subject = gatedPrincipal(req, config);
+    const subject = gatedPerson(req, config);
     if (subject === undefined)
         return undefined;
     const tenant = ssoVerifiedScope(req);
@@ -162,12 +164,13 @@ async function admitDevicePlacement(deps, entry, lane, seat, reading) {
         throw asHttpError(buildDeviceRejection(DEVICE_ERROR_CODES.OFFLINE, "device is not connected"));
     return { rootSessionId: entry.root, occupant: reading.occupant, owner, admittedDeviceId: requestedDeviceId, firstBind: true };
 }
-export function stampSpecRoot(spec, ctx) {
+export function stampSpecRoot(spec, ctx, submission) {
     const named = spec.sessionId;
     if (named !== undefined && named !== ctx.root) {
         throw createCodedHttpError(400, "request.precondition_unmet", "the deployment's spec resolver named a session other than the one this submission was authorized for — a submission's root session comes only from the authorizer, so resolveSpec must not set sessionId (read opts.execution.root instead)");
     }
-    return { ...spec, sessionId: ctx.root };
+    const requireExisting = submission.cascade !== true && (ctx.occupant !== undefined || submission.requireExistingSession === true);
+    return requireExisting ? { ...spec, sessionId: ctx.root, requireExistingSession: true } : { ...spec, sessionId: ctx.root };
 }
 export function rootSessionAbsentAnswer() {
     return {
@@ -179,7 +182,7 @@ export function rootSessionAbsentAnswer() {
     };
 }
 export function placementWriteDeadlineMs(runStaleSec) {
-    const stale = typeof runStaleSec === "number" && Number.isFinite(runStaleSec) && runStaleSec > 0 ? runStaleSec : 120;
+    const stale = typeof runStaleSec === "number" && Number.isFinite(runStaleSec) && runStaleSec > 0 ? runStaleSec : RUN_STALE_SEC_DEFAULT;
     return Math.min(15_000, Math.max(1_000, Math.floor((stale * 1000) / 4)));
 }
 function deviceRefusal(rej) {
@@ -203,6 +206,9 @@ export async function commitExecutionContext(deps, claim, ctx) {
     if (ctx.occupant === undefined || seat === undefined)
         return null;
     const occupant = ctx.occupant;
+    return timeClaim(deps.metrics, "placement_commit", commitPlacement(deps, claim, ctx, seat, occupant));
+}
+async function commitPlacement(deps, claim, ctx, seat, occupant) {
     const release = (why) => releaseClaim(deps, claim, why);
     const deadlineMs = placementWriteDeadlineMs(deps.config?.runStaleSec);
     const withDeadline = async (work) => {

package/dist/http/health-reader.d.ts

@@ -0,0 +1,36 @@
+/**
+ * `GET /health` 的**读者分档** —— 同一张面四种读者(k8s / Docker 探针、壳在带凭据之前读的自报位、嵌入宿主的引擎身份验证、持凭运维),
+ * 键集按**读者**而不是按「这个键敏不敏感」定。
+ *
+ * ## 规则(一条)
+ * 读者三档,答案只有一处:
+ *  · `open`        —— 部署没配任何服务凭据(单机 / loopback 开发形;全局凭据门不武装):全键,字节同分档之前;
+ *  · `credentialed` —— 配了服务凭据,且这次请求出示了**读路谓词**认的凭据(`dispatch.ts` 的 `readCredentialOk`:service token ∨ 只读 trace token ∨ 已验 principal):全键;
+ *  · `anonymous`   —— 配了服务凭据而这次请求没出示:**只拿显式白名单** {@link ANONYMOUS_HEALTH_KEYS}。
+ * 白名单 = 存活位(`status`)+ 壳的 pre-credential 自报位三键(`auth` / `operator` / `center`,`health-self-report.ts` 铸;壳在带凭据**之前**要读的就是它们)。
+ * 其余的键 —— 现有的(`dataRoot` / `pid` / `configHash` / `sessionBackend` / `startedAt` / `port` / `version` / `engineSignal` …)与将来新长的 —— 对匿名读者一律不出:
+ * 这是**白名单**(挑出四键),不是黑名单(剥掉几键)—— 黑名单形下每个新键默认漏出,这一面又恒在凭据门之前、缺省全网卡监听(安全轴 fail-closed)。
+ *
+ * ## 谁读哪一档
+ *  · 探针(k8s `httpGet` / Docker `HEALTHCHECK`):只要 HTTP 200 —— 匿名也是 200,存活位在白名单里;摘流语义的探针读 `/readyz`(不分档,体只有就绪位);
+ *  · 壳的 pre-credential 读路:`auth` / `operator` / `center` 三键(7.121.0)—— 白名单;
+ *  · 嵌入宿主的引擎身份验证(`pid` ∧ `dataRoot`,见 `test/health-identity-contract.test.ts`):宿主就是带着部署的服务凭据起的引擎,身份验证带同一枚凭据读 —— 在 `credentialed` 档;
+ *    没配服务凭据的嵌入形(桌面宿主自起、不配凭据)在 `open` 档,与改前逐字节同;
+ *  · 持凭运维 / 编排器:`credentialed` 档,全键。
+ *
+ * 没有旋钮:一个放宽用的旋钮就是一把「把路径指纹重新开给匿名方」的钥匙,而本规则要的恰是它没有这把钥匙。
+ */
+/** 读者三档(闭集;顺序无语义)。 */
+export declare const HEALTH_READERS: readonly ["open", "credentialed", "anonymous"];
+export type HealthReader = (typeof HEALTH_READERS)[number];
+/**
+ * 匿名读者的**显式白名单**:存活位 + 自报位三键。穷举 —— 加一个进来是一次有意的、要过评审的放宽(它会对没有凭据的任何人可见)。
+ * 每一只都必须是 `/health` 体里真有的键(`test/health-reader-closed-set.test.ts` 逐键钉在场),抄错名字不会悄悄把闭集缩成更小的一个。
+ */
+export declare const ANONYMOUS_HEALTH_KEYS: readonly ["status", "auth", "operator", "center"];
+/**
+ * 键集判官 —— `/health` 体按读者出口的**唯一**一道:`open` / `credentialed` 原样,`anonymous` 只挑白名单。
+ * 入参是按全键铸好的体(铸点不分读者:一个事实一个铸点,读者分档只在出口);返回新对象,不改入参。
+ */
+export declare function projectHealthBody(reader: HealthReader, body: Readonly<Record<string, unknown>>): Readonly<Record<string, unknown>>;
+//# sourceMappingURL=health-reader.d.ts.map

package/dist/http/health-reader.js

@@ -0,0 +1,21 @@
+export const HEALTH_READERS = ["open", "credentialed", "anonymous"];
+export const ANONYMOUS_HEALTH_KEYS = ["status", "auth", "operator", "center"];
+export function projectHealthBody(reader, body) {
+    switch (reader) {
+        case "open":
+        case "credentialed":
+            return body;
+        case "anonymous": {
+            const closed = {};
+            for (const key of ANONYMOUS_HEALTH_KEYS)
+                if (Object.hasOwn(body, key))
+                    closed[key] = body[key];
+            return closed;
+        }
+        default: {
+            const unknownReader = reader;
+            throw new Error(`health reader: unknown reader ${String(unknownReader)}`);
+        }
+    }
+}
+//# sourceMappingURL=health-reader.js.map

package/dist/http/health-self-report.d.ts

@@ -4,11 +4,11 @@
  *
  * ## 规则(一条):自报位是**投影**,不是第二份规则
  * 每一位读的是**门本身读的那只谓词 / 那只取值口**,本模块不判任何东西:
- *  · `auth.kinds` = `IDENTITY_SOURCES`(`identity-source.ts`;`verifiedIdentitySource` 的回值闭集,序 = 判定次序)里,这台部署的装配**能**回的那几个词 —— 取唯一读法 `wiredIdentitySources`
- *    (`principal-gate.ts`;「这台部署有没有身份边界」的门 `devOpenDeployment` 读同一只):
- *    `service_token` ⇐ 全局门武装(`systemFor` 只在配了 service token 时回得出值)· `sso` ⇐ 鉴权桥装了(入口预认证只在
- *    `webAdminJwtVerifier` 在场时挂身份)· `direct_door_jwt` ⇐ 直连门开着(`verifiedIdentitySource` 那一臂的第一个合取项);
- *  · `auth.required` = kinds 里有没有 `service_token` —— 那一词接没接线就是全局凭据门的武装谓词(`hasServiceAuth`;`wiredIdentitySources` 的
+ *  · `auth.kinds` = `IDENTITY_SOURCES`(`identity-source.ts`;`verifiedIdentitySource` 的回值闭集,序 = 判定次序)里,这台部署的配置**能**回的那几个词 —— 取唯一读法 `configuredIdentitySources`
+ *    (`identity-source.ts`;「这台部署有没有身份边界」的部署形表行 `identityBoundary` 读同一只):
+ *    `service_token` ⇐ 全局门武装(`systemFor` 只在配了 service token 时回得出值)· `sso` ⇐ 配置里有鉴权桥 issuer(显式或中心回退;起服第 9 段按同一个读数装验签器,
+ *    验签器与配置里的桥两者不一致的装配(任一方向)在 `createHttpServer` 拒)· `direct_door_jwt` ⇐ 直连门开着(`verifiedIdentitySource` 那一臂的第一个合取项);
+ *  · `auth.required` = kinds 里有没有 `service_token` —— 那一词接没接线就是全局凭据门的武装谓词(`hasServiceAuth`;`configuredIdentitySources` 的
  *    `service_token` 臂读的正是它),所以 `required` 与 `kinds` 是同一次求值的两个投影,不是两个来源;
  *  · `auth.identityAttach` = kinds 里有没有**带调用方身份**的一类({@link carriesCallerIdentity},穷举):`service_token` 认的是系统
  *    (`systemFor` 回系统名或 null),不是人;
@@ -19,7 +19,7 @@
  *  · `center.issuer` = 鉴权桥 issuer 的唯一取值 `authBridgeIssuerOf`(装配 `boot/stage-09-leader.ts` 与 caps `centerWiring.issuer` 同读);
  *  · `center.webBaseUrl` = 运维旋钮 `SEMA_WEB_ADMIN_WEB_URL`(`config.webAdmin.webBaseUrl`,接了中心才挂;起服时已判成固定基址);
  *  · `center.sessionsVisible` = 中心的 web 面能不能列出本引擎的会话 —— 四件接线事实全在才可能:中心车道配齐(`centerLaneConfigured`,
- *    租约 / 用量 / 公告同一只谓词)∧ 公告地址在(配置席 `fleetAdvertiseAddress`:web 面只拨中心登记过的实例地址)∧ 鉴权桥在(web 面带的是
+ *    租约 / 用量 / 公告同一只谓词)∧ 公告地址在(配置席 `fleetAdvertiseAddress`:web 面只拨中心登记过的实例地址)∧ 鉴权桥在(kinds 里有 `sso`;web 面带的是
  *    中心铸的中继令牌,不带 service token)∧ 会话枚举面在(事实 `sessionList`,web 面中继 `GET /v1/sessions`);缺任一 ⇒ `false`。
  *    四件齐时:多租户(`REQUIRE_PRINCIPAL`)每条会话都落着验过的属主 ⇒ `true`;单用户形下一条会话归谁取决于提交它的那次请求带没带
  *    身份(web 面只列调用人自己的会话)—— 部署级答不了 ⇒ `"unknown"`。
@@ -36,7 +36,7 @@
  * 三键**恒在场**;缺席 = 老 worker(≤7.120.x)。`center.issuer` / `center.webBaseUrl` 缺席即缺席(没有鉴权桥 / 没配旋钮),不拼不猜。
  */
 import type { FlatServiceDeps } from "./server.js";
-import type { IdentitySource } from "../identity-source.js";
+import { type IdentitySource } from "../identity-source.js";
 /** `auth.identityAttach` 的词表。 */
 export declare const IDENTITY_ATTACH_WORDS: readonly ["available", "unavailable"];
 export type IdentityAttach = (typeof IDENTITY_ATTACH_WORDS)[number];
@@ -62,8 +62,8 @@ export interface HealthSelfReport {
     };
 }
 /**
- * 三键的**唯一铸点**(`build*`:纯数据)。只读装配本身:`auth` 四位都从一次 `wiredIdentitySources` 求值投出(`required` = 其中有 `service_token`;
+ * 三键的**唯一铸点**(`build*`:纯数据)。只读部署本身:`auth` 四位都从一次 `configuredIdentitySources` 求值投出(`required` = 其中有 `service_token`;
  * `serviceTokenActsForDeployment` = `required` ∧ 门读的那一格声明),不收调用方递进来的第二份布尔 —— 一个事实一次求值。
  */
-export declare function buildHealthSelfReport(deps: Pick<FlatServiceDeps, "config" | "webAdminJwtVerifier" | "sessionStorage" | "runStore">): HealthSelfReport;
+export declare function buildHealthSelfReport(deps: Pick<FlatServiceDeps, "config" | "sessionStorage" | "runStore">): HealthSelfReport;
 //# sourceMappingURL=health-self-report.d.ts.map

package/dist/http/health-self-report.js

@@ -1,6 +1,6 @@
-import { serviceTokenDeclaredActsForDeployment, wiredIdentitySources } from "./principal-gate.js";
+import { serviceTokenDeclaredActsForDeployment } from "./principal-gate.js";
+import { authBridgeIssuerOf, configuredIdentitySources } from "../identity-source.js";
 import { operatorLane, sessionList } from "../capability-facts.js";
-import { authBridgeIssuerOf } from "../auth-bridge.js";
 import { centerLaneConfigured } from "../web-admin-client/center-request.js";
 import { buildDisplaySafeUrl } from "../trace/redact.js";
 export const IDENTITY_ATTACH_WORDS = ["available", "unavailable"];
@@ -21,8 +21,8 @@ function carriesCallerIdentity(kind) {
 }
 export function buildHealthSelfReport(deps) {
     const { config } = deps;
-    const bridgeWired = deps.webAdminJwtVerifier !== undefined;
-    const kinds = wiredIdentitySources(deps);
+    const kinds = configuredIdentitySources(config);
+    const bridgeWired = kinds.includes("sso");
     const issuer = authBridgeIssuerOf(config)?.issuer;
     const webBaseUrl = config.webAdmin?.webBaseUrl;
     const sessionsVisible = centerLaneConfigured(config) && config.fleetAdvertiseAddress !== undefined && bridgeWired && sessionList(deps).available ? (config.requirePrincipal ? true : "unknown") : false;