@sema-agent/server 7.146.0 → 7.148.0

package/dist/observability/metrics.d.ts

@@ -1,4 +1,6 @@
 export type Labels = Record<string, string>;
+/** 认领时延直方图的名字(注册在 {@link createMetrics};计时口径与 `step` 闭集的属主是 `http/claim-latency.ts`,它引这个常量 —— 名字只此一处)。 */
+export declare const EXECUTION_CLAIM_METRIC = "execution_claim_duration_seconds";
 export declare class Metrics {
     private counters;
     private gauges;

package/dist/observability/metrics.js

@@ -2,6 +2,7 @@ import { DENIED_BY_VALUES } from "@sema-agent/core";
 import { buildPermissionRuleEventsHelp } from "./permission-rule-events.js";
 import { MCP_PROBE_OUTCOMES } from "../capabilities/mcp-probe.js";
 const DEFAULT_BUCKETS = [0.05, 0.1, 0.25, 0.5, 1, 2.5, 5, 10, 30, 60];
+export const EXECUTION_CLAIM_METRIC = "execution_claim_duration_seconds";
 function labelKey(labels) {
     return Object.keys(labels)
         .sort()
@@ -214,6 +215,7 @@ export function createMetrics() {
     m.counter("http_requests_total", "HTTP requests by route/method/status");
     m.histogram("http_request_duration_seconds", "HTTP request duration");
     m.counter("rate_limited_total", "Requests rejected by the rate limiter");
+    m.counter("submission_exit_total", "Submission exit closes by end word (accepted|record|refused) and verdict (withdrawn | kept_<word>): what happened to the session a submission minted when it ended — withdrawn = a refused submission's fresh session removed before the terminal answer; kept_upgrade_pending = the database has no withdraw mark yet (an earlier-version replica may still be serving); kept_withdraw_failed = the withdraw threw and the session stayed (see the fail-open tag)");
     m.counter("brain_echo_dropped_total", "Provider echo fields (response request-id header / reported model name) the engine's brain dropped at write time for failing the echo shape (visible ASCII, 1-128 chars), by field (requestId|responseModel|apiErrorCode — the last is the provider's own refusal word on a 4xx, core 7.38.0); non-zero = the endpoint or a gateway in front of it echoes out-of-shape bytes");
     m.counter("mcp_probe_total", `No-run MCP status face outcomes by outcome (${MCP_PROBE_OUTCOMES.join("/")} — see src/capabilities/mcp-probe.ts MCP_PROBE_OUTCOMES; rate_limited has TWO causes: the per-identity fixed window AND the replica-wide in-flight cap, which can refuse caller B because of caller A)`);
     m.counter("tasks_total", "Finished tasks by terminal status");
@@ -239,6 +241,7 @@ export function createMetrics() {
     m.counter("deny_sweep_policy_blocked_expired_total", "approvals the SLA deny-sweep expired because the resume leg refused them for an admission-policy reason (resume_blocked_by_policy: the stored request is refused in this version for good, so the model-continuing deny cannot be delivered; counted once per card, only when this sweep won the settle)");
     m.counter("submit_ctx_run_release_failed_total", "Submissions whose resume-input write failed AND whose just-claimed run could not be released, by step (terminal|idem_key); the session stays held until REAP_RUN_STALE_SEC (one submit_ctx_run_release_failed warn per failure)");
     m.counter("deny_sweep_list_failed_total", "SLA deny-sweep ticks whose read of the expired approvals failed (that tick denies nothing; one deny_sweep_list_failed warn per failure)");
+    m.counter("deny_sweep_row_failed_total", "SLA deny-sweep rows whose stored request could not be read this tick (a projection-drift throw); that row is not resumed this tick, the rest of the page is swept (one deny_sweep_row_failed warn per failure)");
     m.counter("degraded_total", "Tasks degraded to a cheaper model (1.40), by reason (budget/rate_limit/breaker_open)");
     m.counter("task_model_not_allowlisted_resume_total", "Resumed legs whose model/compactionModel is outside the @-mention allowlist (allowed to keep running by design — the allowlist gates fresh picks only)");
     m.counter("task_model_unavailable_fallback_total", "Resumed legs whose explicit model pick names a catalog entry that is unavailable on this deployment (no brain mounted for its provider / entry fails its schema) — the leg runs on the default model; fresh submits get 400 request.model_unavailable");
@@ -271,10 +274,6 @@ export function createMetrics() {
     m.counter("brain_calls_total", "Brain calls by provider/model (S18); provider=unknown = unrecognized routing fallthrough");
     m.gauge("fleet_counter_bucket_skew_ms", "DB clock minus local clock in ms (S10) — skew splits cross-replica counter windows");
     m.gauge("fleet_clock_probe_ok", "1 = last DB clock probe succeeded, 0 = failing (skew gauge is stale while 0)");
-    m.counter("lsp_bridge_start_total", "LSP sandbox bridge (re)starts attempted, by provider and generation");
-    m.counter("lsp_bridge_dead_total", "LSP sandbox bridge generations that died, by reason (the word IS the model-facing unavailableReason)");
-    m.counter("lsp_session_open_total", "LSP session opens, by language and outcome (ok/failed)");
-    m.counter("lsp_session_heal_total", "LSP session heals (dead-transport reopen), by outcome (ok/failed)");
     m.gauge("snapshot_blob_backend", "1 on the active snapshot-blob backend series (S21), by backend (minio|sql)");
     m.counter("memory_embed_failed_total", "Memory embedding calls that failed at runtime (S22), by backend (the memory-engine dialect that owns the embedder)");
     m.counter("memory_knn_query_failed_total", "Memory KNN searchScored queries that failed at runtime (S22)");
@@ -302,8 +301,10 @@ export function createMetrics() {
     m.counter("remote_env_file_timeout_total", "Remote-env file-op timeouts, by provider");
     m.counter("remote_env_rpc_timeout_total", "Remote-env RPC timeouts, by provider");
     m.counter("sandbox_pods_reaped_total", "Sandbox pods deleted by the k8s lane's pod reaper, by reason (containers_ended: every container finished; run_ended_past_hold: the pod's run ended longer ago than the hold)");
+    m.counter("local_docker_containers_reaped_total", "Containers deleted by the local-docker lane's orphan-container reaper, by reason (run_ended: the container's run row is terminal — nothing can use its workspace any more)");
     m.counter("task_outcomes_total", "Task outcome-ledger rows recorded, by status and oracle green flag");
     m.counter("workflow_runs_total", "Self-orchestration workflow runs, by status");
+    m.histogram(EXECUTION_CLAIM_METRIC, "Execution-claim round-trip latency by step (run_claim: RunStore.createRun incl. the SQL root-session row lock; placement_commit: the one post-claim execution-placement write)", [0.001, 0.005, 0.02, 0.1, 0.5, 2, 10]);
     m.histogram("auth_bridge_verify_seconds", "Registry SSO JWT verify latency (hot path sub-ms; cold path includes a JWKS fetch)", [0.001, 0.005, 0.02, 0.1, 0.5, 2, 10]);
     return m;
 }

package/dist/observability/otel-exporter.js

@@ -1,4 +1,5 @@
 import { recordFailOpen } from "./fail-open.js";
+import { createEgressFetch } from "../egress-redirect.js";
 const CUMULATIVE = 2;
 const nano = (ms) => (BigInt(ms) * 1000000n).toString();
 const attrs = (labels) => Object.entries(labels).map(([key, v]) => ({ key, value: { stringValue: String(v) } }));
@@ -61,7 +62,7 @@ export function buildOtlpPayload(snap, opts) {
 export function startOtlpExporter(metrics, opts) {
     const startMs = Date.now();
     const url = `${opts.endpoint}/v1/metrics`;
-    const fetchImpl = opts.fetchImpl ?? fetch;
+    const fetchImpl = createEgressFetch("declare the final collector address as OTEL_EXPORTER_OTLP_ENDPOINT", opts.fetchImpl);
     let inFlight = false;
     const exportOnce = async () => {
         if (inFlight)

package/dist/observability/principal-context.d.ts

@@ -6,12 +6,19 @@
  * call still reads the originating principal. Absent store = unattributed (dev / no principal).
  */
 import { AsyncLocalStorage } from "node:async_hooks";
-export declare const principalContext: AsyncLocalStorage<string>;
-/** 这次执行的记账身份钉表;不在任何 {@link withPrincipal} 作用域里 ⇒ `undefined`(记账按此刻身份)。 */
+import { type Person, type Subject } from "../owner-brands.js";
+/**
+ * 场景子命名空间:ALS 带**主体**(分区键),不带人 —— 读者有两种:记账三写口(成本 / 用量批报 / 租约)读人({@link currentPerson} = `personOf(主体)`),
+ * leader 子任务的 spec 读分区(`leader/wire.ts` 经引擎交界一处铸身份格)。只带人会让 leader 子任务丢分区;只带主体、人现解码,两种读者各取一格。
+ */
+export declare const principalContext: AsyncLocalStorage<Subject>;
+/** 这次执行的记账身份钉表;不在任何 {@link withSubject} 作用域里 ⇒ `undefined`(记账按此刻身份)。 */
 export declare function currentExecutionPins(): Map<object, string> | undefined;
-/** Run `fn` with `principal` as the ambient context (principal-wise a no-op wrapper when principal is undefined — the outer
- *  principal, if any, stays). [ref]: also opens the execution's accounting-pin scope when none is open yet (nested calls share it). */
-export declare function withPrincipal<T>(principal: string | undefined, fn: () => T): T;
-/** The principal attributed to the current async execution, if any. */
-export declare function currentPrincipal(): string | undefined;
+/** Run `fn` with `subject` as the ambient context (a no-op wrapper when the subject is undefined — the outer
+ *  subject, if any, stays). [ref]: also opens the execution's accounting-pin scope when none is open yet (nested calls share it). */
+export declare function withSubject<T>(subject: Subject | undefined, fn: () => T): T;
+/** The subject (partition key) the current async execution runs in, if any. */
+export declare function currentSubject(): Subject | undefined;
+/** The person the current async execution is attributed to (cost / usage / lease accounting) = the person behind {@link currentSubject}. */
+export declare function currentPerson(): Person | undefined;
 //# sourceMappingURL=principal-context.d.ts.map

package/dist/observability/principal-context.js

@@ -1,14 +1,19 @@
 import { AsyncLocalStorage } from "node:async_hooks";
+import { personOf } from "../owner-brands.js";
 export const principalContext = new AsyncLocalStorage();
 const executionPins = new AsyncLocalStorage();
 export function currentExecutionPins() {
     return executionPins.getStore();
 }
-export function withPrincipal(principal, fn) {
-    const run = () => (principal ? principalContext.run(principal, fn) : fn());
+export function withSubject(subject, fn) {
+    const run = () => (subject ? principalContext.run(subject, fn) : fn());
     return executionPins.getStore() !== undefined ? run() : executionPins.run(new Map(), run);
 }
-export function currentPrincipal() {
+export function currentSubject() {
     return principalContext.getStore();
 }
+export function currentPerson() {
+    const subject = principalContext.getStore();
+    return subject === undefined ? undefined : personOf(subject);
+}
 //# sourceMappingURL=principal-context.js.map

package/dist/observability/run-terminal.d.ts

@@ -86,7 +86,6 @@ export declare function notifyRunTerminal(rec: RunTerminalRecord): void;
  *  不抛**:脱敏失败 ⇒ 落固定占位 `«redacted:oversized»`(绝不落原文,也绝不阻断终态翻转),并走既有 fail-open 遥测 tag。
  *  🔴 [ref] 之后这条 throw 臂**照留**(结构性兜底,不依赖「脱敏器今天抛不抛」):它守的是「终态翻转不被一次脱敏异常拦下」,
  *  而脱敏器是一张会长新臂的表 —— 计数 `server.run-terminal.redact-threw` 恒零是证据,不归零就是新形,运维按 detail 回溯。 */
-export declare const OVERSIZED_REDACTION_PLACEHOLDER = "\u00ABredacted:oversized\u00BB";
 /** [ref] 窄范围重扫 [medium]:`redactSecrets` 对 PEM 起始栅栏密集的多 MB 文案**不抛但慢**(实测 1MB 1.4s / 8MB 7.9s 同步阻塞
  *  事件循环),而终态座每次写要扫两遍(appendEvent + setTerminal 入口)、每次读再扫一遍。超过本上限的自由文本**整段**换占位
  *  (fail-closed:不截断——截断会把密钥切成半截,[ref] 的病;不扫——O(1)),取证面丢的是「>256KB 的错误文案」这一档。 */
@@ -263,6 +262,13 @@ export declare function redactTerminalResult<T extends object | null | undefined
  * 本函数是**写入口**(结果第一次落盘 ⇒ 折码运维线索 `at=exit`);读面读存量行用 {@link sealStoredRunRowResult}(读座必填)。
  */
 export declare function sealRunRowResult(result: PersistedTaskResult | null): PersistedTaskResult | null;
+/**
+ * run 行 `error_code` 列的**写律**(三只 run 店、写 `result` 的三个写口 —— `setTerminal` / `setSuspended` / `setNeedsReview` —— 同一只):
+ * 列 = 落在行上的那份结果(已过 {@link sealRunRowResult})的对外码(core 的唯一派生 `outwardPlane`);没有结果 ⇒ `null`。
+ * 列是 run 的 `errorCode` 的**唯一读法**(读面、A2A、审批对账、fleet 都读它),所以停驻行的 `review.pending` 也落在列上。
+ * 其余迁移(续跑认领 / 收割 / 接管)把 `result` 写空的同时写自己的码或空,不经本函数。
+ */
+export declare function runRowErrorCodeOf(sealed: PersistedTaskResult | null): string | null;
 /**
  * {@link sealRunRowResult} 的**读入口**(`GET /v1/runs/:id` 的非终态臂读停驻行):同一套封口 + 同一只汇点,只差折码运维线索的观看点 ——
  * 读座必填({@link StoredResultReadSeat}),再观看走 fail-open 纪律(见 `terminal.ts` 的 `sealStoredResult`)。

package/dist/observability/run-terminal.js

@@ -3,8 +3,9 @@ import { redactSecrets } from "../trace/redact.js";
 import { isProviderEchoShape } from "@sema-agent/core";
 import { isModelTextLedgerEventType, isParkLedgerEventType } from "../trace/ledger-events.js";
 import { isUnsuccessfulRunStatus } from "../plugins/store-contracts.js";
-import { mapPauseSeats, PAUSE_SEATS, sealResultForExit, sealStoredResult } from "../terminal.js";
+import { mapPauseSeats, outwardPlane, PAUSE_SEATS, sealResultForExit, sealStoredResult } from "../terminal.js";
 import { errorText } from "./err-text.js";
+import { OVERSIZED_REDACTION_PLACEHOLDER } from "../trace/exit-seat.js";
 import { recordFailOpen } from "./fail-open.js";
 import { toolEndMediaAsDescriptors } from "../trace/tool-output-media.js";
 const MESSAGE_CAP = 1024;
@@ -53,7 +54,6 @@ export function notifyRunTerminal(rec) {
         ...(rec.elapsedMs !== undefined ? { elapsedMs: rec.elapsedMs } : {}),
     });
 }
-export const OVERSIZED_REDACTION_PLACEHOLDER = "«redacted:oversized»";
 export const REDACT_INPUT_CAP = 65_536;
 export const REDACT_OUTPUT_MAX_BYTES = 65_000;
 const OUTPUT_TRUNCATED_MARK = "…[truncated: exceeds store column]";
@@ -436,6 +436,9 @@ function redactLegacyPlaneLeaves(result) {
 export function sealRunRowResult(result) {
     return result === null ? null : redactTerminalResult(sealResultForExit(result));
 }
+export function runRowErrorCodeOf(sealed) {
+    return sealed === null ? null : (outwardPlane(sealed.terminal).errorCode ?? null);
+}
 export function sealStoredRunRowResult(result, seat) {
     return result === null ? null : redactTerminalResult(sealStoredResult(result, seat));
 }

package/dist/observability/secret-env-scrub.d.ts

@@ -17,6 +17,12 @@
  *     有部署级出路的现场([ref]:`server.lsp.spawn-env`;7.103.0 起 + `server.bake-runner.spawn-env`)升 `warn`,并带当前放行名单与出路句
  *     —— 规则见 `SecretEnvScrubSiteSpec`。
  *     不是「每 site 一次」:一个**新**的密钥形 key 后来才出现(部署加了一个凭证)时,那才是最该看见的一行。
+ *     🔴 **名字只有一个读者**:披露行回答「这条腿扣了哪些名字」。引擎自己读执行环境的那条腿(模型可驱动的 host shell:引擎每个会话读执行环境的必填答
+ *     `ExecutionEnv.withheldEnv`、铸 `inherit_env.names_withheld`,本仓的通告转发体把它落成结构化 `engine_notice` 行并上会话流)已经在说同一批名字 ⇒ 那一格登记
+ *     `told:"engine-notice"`:本座只记计数(`secret_env_scrubbed_total`,不带名字 —— 每条规则扣了几次是另一个事实),不写披露行。引擎没有读者的腿
+ *     (git / 语言服务器 / bake-runner / hooks / docker / adb,以及 host 适配器类里本服务自己的 git worktree 基环境 —— 它从不交给引擎)本服务是唯一的读者,登记
+ *     `told:"log"`,披露行照旧。哪一格是哪一种不手抄:车道适配器里 `get withheldEnv()` 有真读者的那几只 = `told:"engine-notice"` 的那几格
+ *     (`test/withheld-names-one-reading.test.ts` 闭集互推);同一个类里不交给引擎的那条腿另立现场(按腿命名,不按类)。
  *  findings 全部是 core 的 `SecretEnvFinding`(7.129.0 / core 7.51.1 起只有引擎一只写手,经 `server-secret-env.ts` 的唯一组合):形状臂的五词
  *  `exact-name` / `prefix-rule`(`OTEL_*`)/ `namespace-rule`(`SEMA_` 命名空间)/ `name-rule`(名字形状)/ `value-rule`(值里带凭据),加
  *  `own-credential`(本进程起服声明的自有凭据名 —— 配置目录 secret 名 ∪ 名单型旋钮名 —— 被形状臂漏下、由声明臂扣的;`all` 词下也扣)。
@@ -46,49 +52,69 @@ import type { Metrics } from "./metrics.js";
  * 一个剥除现场的登记:`note` = 这条腿上泄漏意味着什么;`remedy` = 部署方能不能自己把某个被剥的键放回来。
  *
  * 🔴 [ref]:`remedy` 在场与否决定披露行的**级别**,规则一句 —— **有出路的现场用 warn,并把出路句与当前放行名单写进同一行**;
- * 没有出路的现场是纯保护留痕,照旧 info。理由:没有出路的剥除(模型可驱动的 shell、git 钩子)是本服务替部署方做的决定,
+ * 没有出路的现场是纯保护留痕,照旧 info。理由:没有出路的剥除(git 钩子、CLI 腿)是本服务替部署方做的决定,
  * 读者只需要知道它生效了;有出路的剥除(语言服务器)可能让一件功能静默变差(补全 / 诊断缺了私有 registry 的依赖),
  * 那是部署方要自己决定的事 —— 看不见 = 无从归因。出路句不带任何值。
+ *
+ * `told` 说**谁把这条腿扣下的名字告诉人**(一个事实一个读者,见文件头):`"log"` = 本座的披露行(有 `note`);`"engine-notice"` = 引擎读这条腿的执行环境并铸
+ * `inherit_env.names_withheld`,本座不再写第二遍名字(无披露行 ⇒ 无 `note`、无出路句;计数照记)。
  */
-export interface SecretEnvScrubSiteSpec {
+export type SecretEnvScrubSiteSpec = {
+    readonly told: "log";
     readonly note: string;
     readonly remedy: string | null;
-}
+} | {
+    readonly told: "engine-notice";
+    readonly remedy: null;
+};
 /** 登记过的剥除现场。闭集:未登记的 site 传不进 {@link recordSecretEnvScrub}(编译期拒,同 FAIL_OPEN_TAGS 纪律)。 */
 export declare const SECRET_ENV_SCRUB_SITES: {
     readonly "server.remote-env-host.spawn-env": {
-        readonly note: "模型可驱动的 host shell 继承 env(`inheritEnv` 三词任一,缺省 `\"scrub\"`;`\"all\"` 词下扣的只有本服务自己的凭据名)——这条腿上的一次泄漏等于把编排器的脑钥/仓库令牌交给模型选的命令";
+        readonly told: "engine-notice";
+        readonly remedy: null;
+    };
+    readonly "server.remote-env-host.git-base": {
+        readonly told: "log";
+        readonly note: "本服务自己的 git worktree 基环境(host 车道 worktree 隔离:`git worktree add / remove / prune`)交给 git 与它拉起的 hook / credential helper 的 env —— 继承词 `\"all\"`,扣的只有本服务自己的凭据;一次泄漏等于把本服务凭据交给仓里的 hook";
         readonly remedy: null;
     };
     readonly "server.remote-env-local-docker.spawn-env": {
+        readonly told: "log";
         readonly note: "local-docker 车道交给宿主 `docker` CLI 的 env(它拉起的凭据助手 / CLI 插件同读)—— 继承词 `\"all\"`,扣的只有本服务自己的凭据;一次泄漏等于把本服务凭据交给宿主上的第三方助手";
         readonly remedy: null;
     };
     readonly "server.remote-env-adb.spawn-env": {
+        readonly told: "log";
         readonly note: "adb 车道交给宿主 `adb` CLI 的 env(首次调用起的常驻 adb server 继承同一份并一直活着)—— 继承词 `\"all\"`,扣的只有本服务自己的凭据;一次泄漏等于把本服务凭据留在一只常驻进程的环境里";
         readonly remedy: null;
     };
     readonly "server.hooks.spawn-env": {
+        readonly told: "log";
         readonly note: "settings hooks 的命令腿(请求带来的命令跑在宿主上)的 env —— 严格名单(`PATH` / `HOME` / 终端 / locale 等十二名)经引擎的 `hostChildEnv` 组合:名单外一律不交,本服务自有凭据任何情况都不交;请求的有效环境层(`settings.env`)作授予叠在上面;请求给工具 shell 的继承词对它不作用";
         readonly remedy: null;
     };
     readonly "server.project-memory.git-subprocess": {
+        readonly told: "log";
         readonly note: "project-memory 读仓叙事时的 git 子进程 env —— 仓内的钩子/凭证助手会以本进程身份运行";
         readonly remedy: null;
     };
     readonly "server.lsp.spawn-env": {
+        readonly told: "log";
         readonly note: "宿主车道本地语言服务器子进程 env(core 7.30.1 #1073 的 `NodeLspManagerOptions.env`)—— 语言服务器会执行仓里的代码(构建脚本/插件/工作区配置),一次泄漏等于把本进程的凭据交给仓";
         readonly remedy: `LSP_ENV_ALLOW=NAME,NAME \u70B9\u540D\u653E\u884C(\u539F\u6837\u4EA4\u7ED9\u8BED\u8A00\u670D\u52A1\u5668,\u90E8\u7F72\u65B9\u663E\u5F0F\u627F\u62C5;${string});\u503C\u4E0D\u8FDB\u65E5\u5FD7`;
     };
     readonly "server.center-plugins.git-clone": {
+        readonly told: "log";
         readonly note: "center 下发插件的 git clone / fetch 子进程 env —— 克隆的是 center 声明里的第三方仓,git 与它拉起的 transport / askpass 以本进程身份运行";
         readonly remedy: null;
     };
     readonly "server.leader.git-push": {
+        readonly told: "log";
         readonly note: "leader 控制面把集成结果推回 durable remote 的 git 子进程 env —— 这条腿保留宿主 git 配置(写凭据可能走宿主 credential helper),helper / hook 以本进程身份运行";
         readonly remedy: null;
     };
     readonly "server.bake-runner.spawn-env": {
+        readonly told: "log";
         readonly note: "bake-runner(构建宿主守护进程)交给 build.sh 与主机命令(git fetch / docker push / docker image inspect / df)的 env —— 配方脚本在构建宿主上以 runner 身份运行,一次泄漏等于把 runner 的 BAKE_RUNNER_TOKEN 交给配方";
         readonly remedy: "BAKE_ENV_ALLOW=NAME,NAME 点名放行(原样交给 build.sh 与主机命令,部署方显式承担;bake-runner 进程的旋钮,没有多租户姿态);值不进日志";
     };

package/dist/observability/secret-env-scrub.js

@@ -2,39 +2,49 @@ import { summarizeRedactions } from "@sema-agent/core";
 import { describeAllowlistPostures } from "../env-name-allowlist-knobs.js";
 import { createLogger } from "./logger.js";
 export const SECRET_ENV_SCRUB_SITES = {
-    "server.remote-env-host.spawn-env": {
-        note: "模型可驱动的 host shell 继承 env(`inheritEnv` 三词任一,缺省 `\"scrub\"`;`\"all\"` 词下扣的只有本服务自己的凭据名)——这条腿上的一次泄漏等于把编排器的脑钥/仓库令牌交给模型选的命令",
+    "server.remote-env-host.spawn-env": { told: "engine-notice", remedy: null },
+    "server.remote-env-host.git-base": {
+        told: "log",
+        note: "本服务自己的 git worktree 基环境(host 车道 worktree 隔离:`git worktree add / remove / prune`)交给 git 与它拉起的 hook / credential helper 的 env —— 继承词 `\"all\"`,扣的只有本服务自己的凭据;一次泄漏等于把本服务凭据交给仓里的 hook",
         remedy: null,
     },
     "server.remote-env-local-docker.spawn-env": {
+        told: "log",
         note: "local-docker 车道交给宿主 `docker` CLI 的 env(它拉起的凭据助手 / CLI 插件同读)—— 继承词 `\"all\"`,扣的只有本服务自己的凭据;一次泄漏等于把本服务凭据交给宿主上的第三方助手",
         remedy: null,
     },
     "server.remote-env-adb.spawn-env": {
+        told: "log",
         note: "adb 车道交给宿主 `adb` CLI 的 env(首次调用起的常驻 adb server 继承同一份并一直活着)—— 继承词 `\"all\"`,扣的只有本服务自己的凭据;一次泄漏等于把本服务凭据留在一只常驻进程的环境里",
         remedy: null,
     },
     "server.hooks.spawn-env": {
+        told: "log",
         note: "settings hooks 的命令腿(请求带来的命令跑在宿主上)的 env —— 严格名单(`PATH` / `HOME` / 终端 / locale 等十二名)经引擎的 `hostChildEnv` 组合:名单外一律不交,本服务自有凭据任何情况都不交;请求的有效环境层(`settings.env`)作授予叠在上面;请求给工具 shell 的继承词对它不作用",
         remedy: null,
     },
     "server.project-memory.git-subprocess": {
+        told: "log",
         note: "project-memory 读仓叙事时的 git 子进程 env —— 仓内的钩子/凭证助手会以本进程身份运行",
         remedy: null,
     },
     "server.lsp.spawn-env": {
+        told: "log",
         note: "宿主车道本地语言服务器子进程 env(core 7.30.1 #1073 的 `NodeLspManagerOptions.env`)—— 语言服务器会执行仓里的代码(构建脚本/插件/工作区配置),一次泄漏等于把本进程的凭据交给仓",
         remedy: `LSP_ENV_ALLOW=NAME,NAME 点名放行(原样交给语言服务器,部署方显式承担;${describeAllowlistPostures()});值不进日志`,
     },
     "server.center-plugins.git-clone": {
+        told: "log",
         note: "center 下发插件的 git clone / fetch 子进程 env —— 克隆的是 center 声明里的第三方仓,git 与它拉起的 transport / askpass 以本进程身份运行",
         remedy: null,
     },
     "server.leader.git-push": {
+        told: "log",
         note: "leader 控制面把集成结果推回 durable remote 的 git 子进程 env —— 这条腿保留宿主 git 配置(写凭据可能走宿主 credential helper),helper / hook 以本进程身份运行",
         remedy: null,
     },
     "server.bake-runner.spawn-env": {
+        told: "log",
         note: "bake-runner(构建宿主守护进程)交给 build.sh 与主机命令(git fetch / docker push / docker image inspect / df)的 env —— 配方脚本在构建宿主上以 runner 身份运行,一次泄漏等于把 runner 的 BAKE_RUNNER_TOKEN 交给配方",
         remedy: "BAKE_ENV_ALLOW=NAME,NAME 点名放行(原样交给 build.sh 与主机命令,部署方显式承担;bake-runner 进程的旋钮,没有多租户姿态);值不进日志",
     },
@@ -77,6 +87,9 @@ export function recordSecretEnvScrub(site, findings, allowed) {
             counts.set(k, (counts.get(k) ?? 0) + 1);
         }
         drainToMetrics();
+        const spec = SECRET_ENV_SCRUB_SITES[site];
+        if (spec.told === "engine-notice")
+            return;
         const logger = sink.logger;
         if (logger === undefined)
             return;
@@ -86,7 +99,6 @@ export function recordSecretEnvScrub(site, findings, allowed) {
         const fresh = findings.filter((f) => !disclosed.has(`${site}${SEP}${f.key}`)).slice(0, room);
         if (fresh.length === 0)
             return;
-        const spec = SECRET_ENV_SCRUB_SITES[site];
         const fields = {
             site,
             note: spec.note,

package/dist/orchestration/hardened-vm-runner.d.ts

@@ -98,6 +98,7 @@ export declare function isScriptRealmRejection(promise: unknown): boolean;
  * message channel for a rejection nobody awaited does not exist anyway.
  */
 export declare function describeRejectionReason(reason: unknown): string;
+export declare function installScriptRejectionReport(report: (summary: string) => void): void;
 export declare function installScriptRealmRejectionGuard(): void;
 /**
  * The membrane handed to a surface's `buildGlobals` callback to construct the CONTEXT-LOCAL bindings the

package/dist/orchestration/hardened-vm-runner.js

@@ -55,17 +55,23 @@ export function describeRejectionReason(reason) {
     return `<unknown typeof ${typeof reason}>`;
 }
 let rejectionGuardInstalled = false;
+let scriptRejectionReport;
+export function installScriptRejectionReport(report) {
+    scriptRejectionReport = report;
+}
 export function installScriptRealmRejectionGuard() {
     if (rejectionGuardInstalled)
         return;
     rejectionGuardInstalled = true;
     process.on("unhandledRejection", (reason, promise) => {
         if (isScriptRealmRejection(promise)) {
-            const summary = describeRejectionReason(reason);
-            try {
-                console.warn(`hardened-vm: un-awaited script rejection contained: ${summary}`);
-            }
-            catch {
+            const report = scriptRejectionReport;
+            if (report !== undefined) {
+                try {
+                    report(describeRejectionReason(reason));
+                }
+                catch {
+                }
             }
             return;
         }

package/dist/orchestration/hardened-vm-worker-runner.d.ts

@@ -1,18 +1,4 @@
 import { type WorkflowScriptRunner } from "@sema-agent/core";
 import { type HardenedVmLimits } from "./hardened-vm-runner.js";
-/**
- * Worker-isolated S8 hard runner ([ref] v2). Runs the hardened-vm membrane inside a `worker_thread`, adding
- * RESOURCE isolation on top of the in-process {@link import("./hardened-vm-runner.js").createHardenedVmRunner}'s
- * BOUNDARY isolation:
- *   - HEAP cap (`resourceLimits.maxOldGenerationSizeMb`): a runaway-allocation script OOMs the WORKER (an `error`
- *     event), never the shared main process — closes the in-process resource-exhaustion gap.
- *   - `terminate()` on wall-clock timeout / abort: kills a MICROTASK-starvation loop (`while(true){await null}`)
- *     the in-process wall-clock race cannot pre-empt (it starves its own event loop).
- *   - credential isolation: the worker gets only the script + args; `agent`/`log` IPC to the main thread (which
- *     holds the real Runner/DB/keys); a (validated-impossible) boundary crossing lands in a credential-free isolate.
- *
- * `safeForUntrustedScripts: true` — the membrane it runs is the conformance-validated + robustness-tested one. Use
- * this (over the in-process runner) for genuinely-untrusted multi-tenant scripts where resource isolation matters.
- */
 export declare function createWorkerHardenedVmRunner(limits?: HardenedVmLimits): WorkflowScriptRunner;
 //# sourceMappingURL=hardened-vm-worker-runner.d.ts.map

package/dist/orchestration/hardened-vm-worker-runner.js

@@ -1,10 +1,12 @@
 import { Worker } from "node:worker_threads";
 import { WorkflowScriptError } from "@sema-agent/core";
 import { scopedPhaseGate, workflowTotalTimeoutMsDefault } from "./hardened-vm-runner.js";
+import { createLogger } from "../observability/logger.js";
 const DEFAULTS = { totalTimeoutMs: workflowTotalTimeoutMsDefault(), syncTimeoutMs: 5_000, maxAgents: 1000, concurrency: 12, maxHeapMb: 128 };
 const IS_TS = import.meta.url.endsWith(".ts");
 const WORKER_URL = new URL(IS_TS ? "./hardened-vm-worker.ts" : "./hardened-vm-worker.js", import.meta.url);
 const WORKER_EXEC_ARGV = IS_TS ? ["--import", "tsx/esm"] : undefined;
+const containedLog = createLogger();
 export function createWorkerHardenedVmRunner(limits = {}) {
     const cfg = { ...DEFAULTS, ...limits };
     return {
@@ -60,6 +62,9 @@ export function createWorkerHardenedVmRunner(limits = {}) {
                     else if (msg.type === "log") {
                         primitives.log(String(msg.msg));
                     }
+                    else if (msg.type === "scriptRejectionContained") {
+                        containedLog.warn("unhandled_rejection_script_realm_contained", { reason: String(msg.reason) });
+                    }
                     else if (msg.type === "done") {
                         finish(() => resolve({ result: msg.result, meta: (msg.meta ?? { name: "workflow", description: "" }) }));
                     }

package/dist/orchestration/hardened-vm-worker.js

@@ -1,7 +1,7 @@
 import { parentPort, workerData } from "node:worker_threads";
 import { splitWorkflowMeta } from "@sema-agent/core";
 const ext = import.meta.url.endsWith(".ts") ? "ts" : "js";
-const { runInHardenedVm, orchestrationGlobals } = (await import(`./hardened-vm-runner.${ext}`));
+const { runInHardenedVm, orchestrationGlobals, installScriptRejectionReport } = (await import(`./hardened-vm-runner.${ext}`));
 const port = parentPort;
 if (!port)
     throw new Error("hardened-vm-worker must run inside a worker_thread");
@@ -26,6 +26,7 @@ port.on("message", (msg) => {
         p.rej(e);
     }
 });
+installScriptRejectionReport((summary) => port.postMessage({ type: "scriptRejectionContained", reason: summary }));
 const ipcCall = (type, extra) => new Promise((res, rej) => {
     const id = nextId++;
     pending.set(id, { res, rej });

package/dist/orchestration/workflow-agent-session-index.d.ts

@@ -39,14 +39,14 @@ export type WorkflowRunParkKey = NonNullable<WorkflowRun["parks"]>[number];
  *  · 这一位**在场却不是数组** ⇒ 读不出(`undefined`):记录说了话、说的不是一份列表;
  *  · 每条四个身份位必须是非空串;`originUnconfirmed` 只认字面 `true`(core 从不写 `false`);
  *  · **持有者两成员同进同出**(core 7.44.0 逐字:both or neither):`parkedBy` 非空串、`generation` 非负安全整数;只有其一、或任一形坏
- *    ⇒ 坏条目。两者皆无 = 旧引擎写的条目(证不了持有者),照读;
+ *    ⇒ 坏条目。两者皆无 = 引擎 7.43 及以前写的条目(不持有任何东西),照读;
  *  · **任一条目形坏 ⇒ 整只读不出来**(整档成败制):core 对同一形整条拒 resume(`park_binding_broken`);「丢掉坏的、留下好的」会静默
  *    铸出一份**比真相少几条 park** 的集合,而这只读者的消费面正是 park 的路由与赎回。
  */
 export declare function readRunParks(run: unknown): WorkflowRunParkKey[] | undefined;
 /**
  * 🔴 **「这条记录的 run 持有这条停驻」的唯一读法**(core 7.44.0 [ref] 逐字):`entry.parkedBy === record.id`。
- * 继承来、本跑还没走到的条目带上一跑的 id;旧引擎写的条目两成员皆无 —— 两者都不是本记录持有的。
+ * 继承来、本跑还没走到的条目带上一跑的 id;引擎 7.43 及以前写的条目两成员皆无 —— 两者都不是本记录持有的。
  */
 export declare function heldParksOf(recordId: string, parks: readonly WorkflowRunParkKey[]): WorkflowRunParkKey[];
 /**
@@ -62,12 +62,11 @@ export declare function buildParkSessionRows(runId: string, run: {
  * 一次路由的判决(闭集):
  *  · `held`   —— 持有这个子会话的记录里最高代次**恰一条**:`park` = 它持有的那一条条目(赎回键在条目上);
  *  · `forked` —— 最高代次上不止一条记录(同一条 run 先后被续跑两次,两支都走到了这里):`runIds` 升序;
- *  · `unproven` —— 没有任何记录持有它,而这件事证不了:`unreadable` = 某一条候选记录的 `parks[]` 读不出(它可能就是持有者);
- *    `older_engine` = 点名它的条目没有持有者位(写于不带这两位的旧引擎);`runId` = 去续跑的那一条(`unreadable` 时是读不出的那条里 id 最小的);
- *    `readableHolderRunId` 只在 `unreadable` 上可能在场 —— **其余可读候选里**持有它的最高代次**恰一条**记录(规则 ②,与 `held` 同一只判);没有 / 并列 ⇒ 缺席。
+ *  · `unproven` —— 没有任何记录持有它,而这件事证不了:某一条候选记录的 `parks[]` 读不出(它可能就是持有者);`runId` = 读不出的那几条里 id 最小的;
+ *    `readableHolderRunId` —— **其余可读候选里**持有它的最高代次**恰一条**记录(规则 ②,与 `held` 同一只判);没有 / 并列 ⇒ 缺席。
  *    它不改判决(任一读不出 ⇒ 整卡拒不变),只让拒体多给一条线索:读不出的那条引擎往往恰拒续跑,而健康的持有者就在旁边(工作可从它续上;
  *    读不出的那条的指针仍在候选里,续跑它之后这张卡照旧整卡拒,直到那条记录被修好);
- *  · `none`   —— 没有任何记录持有它,且候选全部读得出、条目都带持有者位 ⇒ 诚实 miss。
+ *  · `none`   —— 候选全部读得出、没有任何记录持有它(含点名它的条目没有持有者位的存量记录 —— 引擎 7.43 及以前写下)⇒ 诚实 miss。
  */
 export type WorkflowParkRoute = {
     readonly kind: "held";
@@ -79,7 +78,6 @@ export type WorkflowParkRoute = {
     readonly runIds: readonly string[];
 } | {
     readonly kind: "unproven";
-    readonly cause: "unreadable" | "older_engine";
     readonly runId: string;
     readonly run: WorkflowRun;
     readonly readableHolderRunId?: string;
@@ -90,14 +88,11 @@ export type WorkflowParkRoute = {
  * 🔴 **路由与赎回的唯一判决**(纯函数;输入 = 点名这个子会话的每一条记录,读不到的记录 —— 已被收割 —— 由调用方先剔掉)。
  *
  * 一条规则,按序:
- *  ① 任一候选的 `parks[]` 读不出 ⇒ `unproven/unreadable`(它可能正是最高代次的持有者;宁可不投,绝不投错 —— 引擎对条目形坏的记录整条拒续跑);
+ *  ① 任一候选的 `parks[]` 读不出 ⇒ `unproven`(它可能正是最高代次的持有者;宁可不投,绝不投错 —— 引擎对条目形坏的记录整条拒续跑);
  *    其余可读候选按下一条判出的持有者(恰一条)带进 `readableHolderRunId`(只给出路,不改判决);
  *  ② 其余候选里,持有这个子会话({@link heldParksOf})的条目取最高 `generation`:恰一条记录 ⇒ `held`;多于一条 ⇒ `forked`;
- *  ③ 没有持有者:有条目两成员皆无(旧引擎写的)⇒ `unproven/older_engine`,`runId` = 这类记录里最晚建的那条(续跑它,新引擎走到这张停驻时
- *    写下自己的代次 0 行);否则 `none`。
+ *  ③ 没有持有者 ⇒ `none`(点名它的条目没有持有者位的存量记录同判:那种条目不持有任何东西)。
  * 判决不看写序、不看 `agents[]`、不看 `originRunId`(core:那一位说的是「材料在哪条 run 的 journal 里」,不是「谁站在上面」)。
- *
- * 🔴 **窗与删码**:规则 ③ 的 `older_engine` 读臂是一次性迁移 M9 的读侧半场(升级那一刻还停驻着的存量记录)。窗口与删码清单见 `plugins/one-time-migrations.ts` 登记表 M9 一行,随 M9 一起删;这里不写第二份窗。
  */
 export declare function routeWorkflowPark(sessionId: string, candidates: readonly WorkflowRun[]): WorkflowParkRoute;
 /** 账本一行的**内域形**:一条 run 当时的整份指针快照(`{runId, rows}`;同一条 run 后写的一行整份覆盖先写的 —— 本仓只增不删,所以后一行恒是前一行的超集)。 */

package/dist/orchestration/workflow-agent-session-index.js

@@ -57,17 +57,12 @@ export function routeWorkflowPark(sessionId, candidates) {
     const top = highestHolders(sessionId, readable);
     if (firstUnreadable !== undefined) {
         const holder = top.length === 1 ? top[0].run.id : undefined;
-        return { kind: "unproven", cause: "unreadable", runId: firstUnreadable.id, run: firstUnreadable, ...(holder !== undefined ? { readableHolderRunId: holder } : {}) };
+        return { kind: "unproven", runId: firstUnreadable.id, run: firstUnreadable, ...(holder !== undefined ? { readableHolderRunId: holder } : {}) };
     }
     if (top.length === 1)
         return { kind: "held", runId: top[0].run.id, run: top[0].run, park: top[0].park };
     if (top.length > 1)
         return { kind: "forked", runIds: top.map((t) => t.run.id) };
-    const older = readable.filter(({ parks }) => parks.some((p) => p.sessionId === sessionId && p.parkedBy === undefined));
-    if (older.length > 0) {
-        const latest = older.reduce((a, b) => (b.run.createdAt > a.run.createdAt || (b.run.createdAt === a.run.createdAt && b.run.id > a.run.id) ? b : a));
-        return { kind: "unproven", cause: "older_engine", runId: latest.run.id, run: latest.run };
-    }
     return { kind: "none" };
 }
 function highestHolders(sessionId, readable) {

package/dist/orchestration/workflow-completion-inbox.d.ts

@@ -1,4 +1,3 @@
-import { type SemaProvenanceInput } from "../trace/sema-provenance.js";
 import { type SystemInjectionPriority, type TaskNotificationPayload } from "@sema-agent/core";
 import type { LedgerEventType } from "../trace/ledger-events.js";
 /** One pending completion, scoped to the session that must be told about it. `summary` is ALREADY
@@ -17,11 +16,12 @@ export interface WorkflowCompletionInboxEntry {
      *  originating leg was IDLE (core's in-process injection had no harness to steer — the durable half
      *  is the deployment's job). `runId` then holds the core task_id (disjoint id spaces). */
     kind?: "workflow_complete" | "task_notification";
-    /** The per-kind extras as a JSON text — bounded + redacted AT ENQUEUE (the store carries only egress-safe bytes).
+    /** The per-kind extras as a JSON text — bounded + redacted AT ENQUEUE (the store carries only egress-safe bytes) and judged against
+     *  the entry byte budget by {@link encodeInboxBody}, the only minter of {@link InboxPayload}.
      *  `task_notification`: {task_type, toolUseId?, result?, output_file?, …}. `workflow_complete`: at most `{"completionId": …, "diagnostics": …}`
-     *  (see {@link buildWorkflowCompleteInboxEntry}; each key absent when the engine minted none). The SQL stores' existing `payload`
-     *  column carries it verbatim for both kinds — no DDL. */
-    payload?: string;
+     *  (see {@link buildWorkflowCompleteInboxEntry}; each key absent when the engine minted none). Over budget, either kind carries its minimal
+     *  form instead (stream-key fields + `_sema_provenance` when it fits + `payloadTruncated`). The SQL stores' existing `payload` column carries it verbatim for both kinds — no DDL. */
+    payload?: InboxPayload;
 }
 /** Session-keyed queue of finished-workflow completions awaiting a push to the originating session.
  *  Two-phase delivery (1.80, closes the 1.77-review "drained-but-append-failed" at-most-once window): `pending`
@@ -199,11 +199,26 @@ export declare class FileWorkflowCompletionInbox extends InMemoryWorkflowComplet
     /** Close the ledger fd (shutdown). */
     close(): void;
 }
+/** 品牌键:模块私有的 `unique symbol` —— 别处写不出一个 {@link InboxPayload} 字面量。 */
+declare const INBOX_PAYLOAD: unique symbol;
+/** 判过条目字节预算的 `payload` 文本(JSON)。`string` 的子型:读者零改;条目的 `payload` 位只收 {@link encodeInboxBody} 铸的值 ⇒ 绕过预算座是 tsc 红。
+ *  读侧(SQL 店把列读回来、File 店重放账本)单跳收窄:那些字节只可能是本座写下的(或预算立座之前的存量行,drain 照读)。 */
+export type InboxPayload = string & {
+    readonly [INBOX_PAYLOAD]: true;
+};
+/** 被裁条目在 payload(与 drain 出的补投帧)上的点名:`droppedKeys` = 全形里被丢的成员名(全形键序;末尾的 `summary` = 摘要原句被扣下、帧上的 `summary`
+ *  是 {@link INBOX_SUMMARY_WITHHELD}),`bytes` = 全形的 UTF-8 字节数。 */
+export interface PayloadTruncated {
+    droppedKeys: string[];
+    bytes: number;
+}
+/** 摘要原句因失去归因被扣下时,帧上 `summary` 换成的**本服务铸**的一句(受信、不含任何对端字节)。 */
+export declare const INBOX_SUMMARY_WITHHELD = "[payload over budget: summary withheld; see payloadTruncated]";
 /**
  * 一次 workflow 完成 → 入箱条目(`workflow_complete` 家族;启动期投递闭包的**唯一**构造点)。`summary` 在 core 的 notifier seam 上已脱敏 + 限长,这里原样入箱;
  * `completionId`(引擎铸,`WorkflowCompletionPayload` 上在场 iff 引擎给了)逐字落进 `payload` 列 —— 同一次完成的补投帧与 live 帧同一个相关 id,本服务零自铸。
- * `diagnostics`(引擎铸的诊断教学文本,在场 iff 引擎给了)是自由文本:**这里**过出口座(`inbox-diagnostics-text` 行 —— 与 live `task_notification.diagnostics` 同一个脱敏 scope,
- * 加一条界)再落 `payload` 列,drain 逐字带出;店里不放未洗的字节。
+ * `diagnostics`(引擎铸的诊断教学文本,在场 iff 引擎给了)是自由文本:**这里**过出口座(`completion-diagnostics-text` 行 —— 与 live `task_notification.diagnostics` **同一行**:同一份脱敏、同一份界、
+ * 读者是人的档在行上声明)再落 `payload` 列,drain 逐字带出;店里不放未洗的字节。引擎 notifier seam 递来的已是抹过的文本,座再读一遍是恒等(档的不动点)—— 补投帧与 live 帧的一致不靠上游记得抹。
  */
 export declare function buildWorkflowCompleteInboxEntry(route: {
     sessionId: string;
@@ -225,7 +240,7 @@ export declare function buildWorkflowCompleteInboxEntry(route: {
  * deterministic `WorkflowStatus` poll is the floor); at-least-once — the shell dedups by runId (two legs racing
  * the same session may double-emit; same contract).
  *
- * 🔒 Tenancy (defence-in-depth over the authorizer's sessionId→owner gate): only entries whose stamped
+ * 🔒 Tenancy (defence-in-depth over the authorizer's sessionId→owner gate; the face `inbox.drain` in `owner-faces.ts`): only entries whose stamped
  * `owner` matches `callerPrincipal` are EMITTED — a session deleted-then-reclaimed by a different tenant
  * (which rotates the sessionId→owner binding) can't surface the prior owner's completions. `owner: null`
  * (single-user turnkey) has no tenancy boundary → always emitted. A non-matching entry is a DELIBERATE drop —
@@ -286,7 +301,12 @@ export type EngineNotificationParkInput = ParkedNotificationFields & {
         from: string;
         body: string;
     };
-    _sema_provenance?: SemaProvenanceInput;
+    _sema_provenance?: unknown;
+    /** [ref]:会话箱车道的三只载体 —— 判据与 live 腿同一只(`trace/task-notification-facets.ts`,入参按 `unknown` 收)。park 腿**真的会**收到它们:
+     *  会话箱 drain 的注入先经本服务的 `onTaskNotification` 观察者,sync 腿的停驻判据含「客户端已断开」(run 未收束的窗里一次轮界 drain 就走到这里)。 */
+    crossSessionMessage?: unknown;
+    crossSessionNotice?: unknown;
+    inboxNotice?: unknown;
     /** [ref](core 7.30.0 [ref] S1 / [ref] / [ref]):委派终态帧三枚 facet + 重供两键 —— 判据与 live 腿同一只
      *  (`trace/task-notification-facets.ts`,入参按 `unknown` 收、判过形才成 typed)。 */
     spawnName?: string;