@sema-agent/server 7.147.0 → 7.149.0

package/dist/boot/resolve-spec.js

@@ -10,15 +10,14 @@ import { toolPolicyForHands } from "../capabilities/hands-lane.js";
 import { mintLegFacts } from "../leg-facts.js";
 import { applyLongtailDefer } from "../capabilities/tool-defer.js";
 import { assertGuardPatternsUsable, buildApprovalGrantNotice, buildOnlySensitiveBaselineWarning, createApprovalBaselinePolicy, createDeploymentGovernanceInputs } from "../deployment-governance.js";
-import { createDeploymentListExemption, gateIntentUnserviceableReason, singleUserAutoAcceptBaselineApplies } from "../approval.js";
+import { createSessionExemptionRead, gateIntentUnserviceableReason, singleUserAutoAcceptBaselineApplies } from "../approval.js";
 import { acceptShellScratchpadDir, buildEnvFacts, egressForRemoteExec, ensureScratchpadDir, resumeFactsForLane, scratchpadCoveringTaskRoot } from "../env-facts.js";
 import { FleetEventBus } from "../fleet/fleet-bus.js";
 import { createSettingsHooksRegistrations, settingsHooksBudgetMs } from "../hooks/hook-runner.js";
-import { HOST_POSTURE_REFUSED_CODE, permissionModeWriteFaceRefusal, taskInheritEnvRefusal } from "../hosted-posture.js";
 import { headerStr } from "../http/principal-gate.js";
 import { explicitOperatorOk } from "../http/server.js";
-import { isAtMentionable, matchCatalogModel, refusedCatalogEntry, resolveTaskModel, selectableCatalog, terminalCatalogName } from "../model-select.js";
-import { echoModelRef, modelUnavailableMessage } from "../model-entry-refusal.js";
+import { isAtMentionable, matchCatalogModel, pickUserModel, refusedCatalogEntry, terminalCatalogName } from "../model-select.js";
+import { echoModelRef, modelNotAllowedMessage, modelUnavailableMessage, refusedNameLogField } from "../model-entry-refusal.js";
 import { PerTaskImageRegistry, resolveSandboxImageRef } from "../per-task-image.js";
 import { remoteScratchpadDirFor } from "../plugins/remote-scratchpad.js";
 import { attachmentBindRefusalAnswer, bindAttachmentsForTask } from "../plugins/task-attachment-store.js";
@@ -26,20 +25,23 @@ import { resourceSuspendOptIn } from "../resource-suspend.js";
 import { routeServiceTask, supPostureOverrides } from "../router/route-orchestration.js";
 import { tightenGoverned } from "../governance-overrides.js";
 import { applyRuntimeGovernance } from "../runtime-governance.js";
-import { HttpError, createCodedHttpError, encodeCheckpointScope } from "../security.js";
-import { resolveHistoryAnchor } from "../history-anchor.js";
+import { HttpError, claimCallerOf, createCodedHttpError, encodeCheckpointScope } from "../security.js";
+import { partsOf } from "../owner-brands.js";
+import { recoveredSubject } from "../owner-faces.js";
+import { taskSpecIdentityOf } from "../engine-identity.js";
+import { anchorReaderOf, resolveHistoryAnchor } from "../history-anchor.js";
 import { headReadOf, sessionFaceOfHead } from "../session-incarnation.js";
 import { legProjectIdOf, sessionWorkspaceStoreOf } from "../session-workspace.js";
 import { memorySpecForRequest } from "../memory-scope.js";
 import { createMemoryProjectLayers } from "../memory-project-layer.js";
-import { inheritEnvFacts, inheritEnvFieldIssue, singleMemberOffFieldIssue } from "../request-value-closure.js";
+import { inheritEnvFieldIssue, singleMemberOffFieldIssue } from "../request-value-closure.js";
 import { a2aForScenario, mcpForScenario } from "../web-admin-client/facade.js";
 import { compactionSpecFragment, normalizeAttachments, normalizeResilience, normalizeResumeAtMode, normalizeSuggestNextPrompts, promptLeanSpecFragment, resolveTaskLimits, retainBackgroundProcessesFromBody, taskAgentsSpecFragment, toolMaterializeStrategyFromBody, allowToolsSpecFragment, toolNameListFromBody } from "../spec-fields.js";
 import { isAbsoluteHostPath } from "@sema-agent/settings-schema";
 import { effectiveHostWorkspace, parseAdditionalDirectories, satisfiedByProcessCwd, shellEnvMismatchCount } from "../task-cwd.js";
 import { DEPLOYMENT_SHAPE_PREDICATES } from "../deployment-shape.js";
 import { assertRequestA2aEntries, resolveRequestA2a, snapshotRequestA2a } from "../task-a2a.js";
-import { assertRequestImageUrls } from "../request-image-urls.js";
+import { assertRequestImages } from "../request-images.js";
 import { assertRequestMcpEntries, assertRequestMcpUnlocked, resolveRequestMcp } from "../task-mcp.js";
 import { GOVERNANCE_HTTP_STATUS } from "../governance-http-status.js";
 import { storedToolAxesRereadM19 } from "../stored-request-tool-axes-m19.js";
@@ -48,8 +50,10 @@ import { storedEnvCredentialsDropM38 } from "../stored-request-env-credentials-m
 import { serverCredentialValueSources } from "../server-secret-env.js";
 import { MAX_SETTINGS_OUTPUT_STYLE_CHARS, REQUEST_SETTINGS_REFUSAL_PREFIX, SETTINGS_RULE_REFUSAL_CODE, SettingsRuleRefusalError, acceptAppendSystemPrompt, applyTaskSettings, createWorkflowAskPolicy, effectivePermissionMode, effectiveThinking, parseTaskSettings, readSettingsEnv, taskHooksHonored, settingsEnvCredentialIssue, settingsPermissionBucketIssue, withoutKeys } from "../task-settings.js";
 import { tightenOnlySeatIssue } from "../tighten-only-seats.js";
+import { buildNeverAutoRetiredNotice } from "../retired-name-host-notice.js";
 import { entryProblemsFacts } from "../entry-problems.js";
 import { inertToolListEntryOf } from "../rule-entry-list.js";
+import { assertAttachmentIdsShape, assertImageProfileLane, assertInheritEnvServed, assertToolListsReadable, assertWriteFaceAdmitted, bodyImageProfileOf, scenarioRequestedBy } from "../request-form.js";
 import { TENANCY_WALL_CLOCK_BASE_SEC, enableForkFromBody, normalizeRetainSubagentSessions, selfOrchestrationFromBody } from "../task-workflow.js";
 import { redactSecrets } from "../trace/redact.js";
 import { DeferredSandboxPathEnv, sandboxPathEnvSlots } from "./deferred-sandbox-path-env.js";
@@ -57,15 +61,21 @@ import { executionLaneHomeDir, executionLaneOf, laneIsolated, laneWiresExecution
 import { executionConfigRootOf } from "../execution-config-root.js";
 import { withUnattendedLeg } from "../unattended-permission-mode.js";
 import { fieldConflictFacts } from "../field-conflict.js";
+function identityAxesOf(auth) {
+    const subject = auth?.subject === undefined ? undefined : recoveredSubject(auth.subject);
+    const parts = subject === undefined ? undefined : partsOf(subject);
+    return { subject, parts, person: parts?.person };
+}
 function unrooted(spec) {
     const { sessionId: _neverWritten, ...resolved } = spec;
     return resolved;
 }
 export function createResolveSpec(ctx) {
-    const { config, logger, metrics, localRoot, scenarios, principalCaps, centerRuntimeCapsResolver, getKeyResolver, taskAttachmentStore, perSessionCwd, setSessionCwd, setSessionShellEnv, fenceSessionOwner, hookLlm, hookAgent, belowTaskChainPatterns, fleetBus, hookWakeBus, resumeAnchorStore, ownerAware, taskLimitCaps, taskTimeoutSec, selectEnvTool, sendUserFileToolSpec, memoryEngine, memorySyncRunner, durableEnabled, approvalExemptionStore, checkpointStore, imageIndex, perTaskImage, sessionEnvSelection, liveQuestionFace, approverSeat, lockedKeys, loadedSkills, peerDesk, } = ctx;
+    const { config, logger, metrics, localRoot, scenarios, principalCaps, centerRuntimeCapsResolver, getKeyResolver, taskAttachmentStore, perSessionCwd, setSessionCwd, setSessionShellEnv, fenceSessionOwner, hookLlm, hookAgent, belowTaskChainPatterns, fleetBus, hookWakeBus, historyAnchors, ownerAware, taskLimitCaps, taskTimeoutSec, selectEnvTool, sendUserFileToolSpec, memoryEngine, memorySyncRunner, durableEnabled, approvalExemptionStore, checkpointStore, imageIndex, perTaskImage, sessionEnvSelection, liveQuestionFace, approverSeat, lockedKeys, loadedSkills, peerDesk, } = ctx;
     const deploymentSkillSources = new Map(loadedSkills.map((k) => [k.spec.name, k.source]));
     const scenarioGate = createScenarioGate({ config, scenarios, principalCaps, logger }, "enforce");
     const sessionHeadOf = headReadOf(ownerAware);
+    const anchorsResolvable = sessionHeadOf === undefined ? undefined : historyAnchors;
     const sessionWorkspace = sessionWorkspaceStoreOf(ownerAware);
     assertGuardPatternsUsable(config);
     const onlySensitiveBaseline = buildOnlySensitiveBaselineWarning(config, {
@@ -120,15 +130,7 @@ export function createResolveSpec(ctx) {
             const inheritEnvIssue = inheritEnvFieldIssue(body);
             if (inheritEnvIssue)
                 throw new HttpError(400, inheritEnvIssue.message, { code: "request.field_invalid", extra: inheritEnvIssue.facts });
-            if (body.inheritEnv === "all") {
-                const lane = config.remoteExec.provider;
-                if (lane !== "host") {
-                    throw new HttpError(400, `inheritEnv:"all" applies to the host lane only (this deployment runs ${lane}) — only the host lane builds the model-driven shell's environment from this machine's own, so the declaration has no effect here; omit it (or send "scrub", the default, which every lane accepts)`, { code: "request.field_invalid", extra: inheritEnvFacts("lane_not_host") });
-                }
-                const why = taskInheritEnvRefusal(config);
-                if (why !== undefined)
-                    throw new HttpError(422, why, { code: HOST_POSTURE_REFUSED_CODE });
-            }
+            assertInheritEnvServed(body, config);
         }
         {
             const bucketIssue = settingsPermissionBucketIssue(body.settings?.permissions);
@@ -162,9 +164,7 @@ export function createResolveSpec(ctx) {
         }
         {
             const replay = opts?.leg === "resume";
-            const inertList = inertToolListEntryOf(body, replay ? ["deny"] : undefined);
-            if (inertList !== undefined)
-                throw new HttpError(400, inertList.message, { code: inertList.code, ...(inertList.extra !== undefined ? { extra: { ...inertList.extra } } : {}) });
+            assertToolListsReadable(body, replay ? ["deny"] : undefined);
             if (replay) {
                 const stale = inertToolListEntryOf(body, ["allow"]);
                 if (stale !== undefined) {
@@ -187,32 +187,34 @@ export function createResolveSpec(ctx) {
             }
         }
         if (opts?.leg === "fresh")
-            assertRequestImageUrls(body.images);
+            assertRequestImages(body.images);
         const gated = await gateScenarioAndAppend(body, auth, root, opts, settingsEnv);
         const effMode = effectivePermissionMode(body, gated.parsedSettings.settings);
-        {
-            const why = permissionModeWriteFaceRefusal(effMode, config);
-            if (why !== undefined)
-                throw new HttpError(422, why, { code: HOST_POSTURE_REFUSED_CODE });
-        }
+        assertWriteFaceAdmitted(effMode, config);
         const lane = bindSettingsCwdEnvAndModel(body, auth, root, gated, opts);
-        const anchors = await resolveHistoryAnchors(body, auth, root);
+        const anchors = await resolveHistoryAnchors(body, req, auth, root);
         const projectKey = memoryEngine ? await memoryProjectLayers.prepare(config, auth?.memoryScope, realTaskRootOf(root)) : undefined;
         const runSkills = buildRunSkills({ scenario: gated.cap.skills, request: body.skills, disable: body.disableSkills === true, deploymentSources: deploymentSkillSources }, logger);
         const spec = assembleSpecLiteral(body, auth, root, req, opts, { ...gated, ...lane, ...anchors, projectKey, a2aPeers, storedToolAxes, runSkills }, effMode);
         const folded = await foldGovernanceAndSettings(body, auth, root, spec, gated);
+        const retiredNotice = opts.onNotice !== undefined ? buildNeverAutoRetiredNotice(gated.parsedSettings.settings?.tightenOnly?.neverAuto, root) : undefined;
+        if (retiredNotice !== undefined)
+            opts.onNotice?.(retiredNotice);
         const final = await applyImageFactsAndRouting(body, auth, root, folded.governed, {
             scenarioName: gated.scenarioName,
             scratchpadDir: folded.scratchpadDir,
             hostSemanticsLane: folded.hostSemanticsLane,
         });
-        return { spec: final, facts: { hands: gated.hands, skills: runSkills.roster, sessionWitness: gated.sessionWitness } };
+        const registeredCwd = perSessionCwd.get(root);
+        return { spec: final, facts: { hands: gated.hands, skills: runSkills.roster, sessionWitness: gated.sessionWitness, ...(registeredCwd !== undefined ? { registeredCwd } : {}) } };
     };
     const gateScenarioAndAppend = async (body, auth, root, opts, settingsEnv) => {
-        const scenarioName = await scenarioGate(auth?.principal, body.scenario);
+        const { parts: subjectParts, person } = identityAxesOf(auth);
+        const requestedScenario = scenarioRequestedBy(subjectParts?.scenario, body.scenario);
+        const scenarioName = await scenarioGate(person, requestedScenario);
         const rootFace = sessionHeadOf === undefined ? undefined : sessionFaceOfHead(root, await sessionHeadOf(root));
         const sessionWitness = { sessionId: root, owner: rootFace?.owner ?? null, incarnation: rootFace?.incarnation ?? null };
-        const cap = selectScenario(scenarios, scenarioName)(body, auth?.principal, { sessionId: sessionWitness.sessionId, delegationRoot: sessionWitness });
+        const cap = selectScenario(scenarios, scenarioName)(body, person, { sessionId: sessionWitness.sessionId, delegationRoot: sessionWitness });
         const acceptedAppend = acceptAppendSystemPrompt(body.appendSystemPrompt, (detail) => logger.warn("append_system_prompt_dropped", { detail, sessionId: root }));
         const objective = typeof body.objective === "string" ? body.objective : "";
         const parsedSettings = parseTaskSettings(body.settings, {
@@ -231,18 +233,14 @@ export function createResolveSpec(ctx) {
         {
             const reqAtt = body.attachmentIds;
             if (reqAtt !== undefined) {
-                if (!Array.isArray(reqAtt) || !reqAtt.every((x) => typeof x === "string" && x.length > 0 && x.length <= 64)) {
-                    throw new HttpError(400, "`attachmentIds` must be an array of attachment ids (strings)");
-                }
-                if (reqAtt.length > 16)
-                    throw new HttpError(400, "`attachmentIds` exceeds the per-task limit (16)");
+                assertAttachmentIdsShape(reqAtt);
                 if (reqAtt.length > 0) {
                     if (!taskAttachmentStore)
                         throw new HttpError(501, "attachmentIds require a store backend (DB_BACKEND=mysql|pg|local)");
                     const lane = opts.execution.lane;
                     const r = await bindAttachmentsForTask({
                         store: taskAttachmentStore,
-                        owner: auth?.principal ?? "default",
+                        owner: auth?.subject ?? "default",
                         ids: reqAtt,
                         sessionId: root,
                         lane: { word: lane, isolated: laneIsolated(lane) },
@@ -270,7 +268,7 @@ export function createResolveSpec(ctx) {
         const { objective, parsedSettings } = gated;
         const cwdWriteGate = DEPLOYMENT_SHAPE_PREDICATES.callerCwd.holds(config);
         const execLane = config.remoteExec.provider;
-        fenceSessionOwner(root, auth?.principal ?? null);
+        fenceSessionOwner(root, auth?.subject ?? null, opts.execution.occupant?.incarnation);
         if (typeof body.cwd === "string" && body.cwd.length > 0) {
             if (cwdWriteGate && isAbsoluteHostPath(body.cwd))
                 setSessionCwd(root, body.cwd);
@@ -305,6 +303,7 @@ export function createResolveSpec(ctx) {
                 logger,
                 sessionId: root,
                 cwd: perSessionCwd.get(root) ?? process.cwd(),
+                hookEnvAllow: config.hookEnvAllow,
                 ...(parsedSettings.settings?.shellEnv ? { shellEnv: parsedSettings.settings.shellEnv } : {}),
                 httpHookAllowlistLayers: parsedSettings.settings?.httpHookAllowlist !== undefined ? [parsedSettings.settings.httpHookAllowlist] : [],
                 belowTaskChainPatterns,
@@ -312,7 +311,7 @@ export function createResolveSpec(ctx) {
                 hookAgent,
                 onHookNotice: (n) => fleetBus.publishHookNotice({
                     ...n,
-                    ...(auth?.principal ? { ownerScope: auth.principal } : {}),
+                    ...(auth?.subject ? { ownerScope: auth.subject } : {}),
                     ownerSessionId: root,
                 }),
                 wake: async (text) => hookWakeBus.deliver
@@ -332,20 +331,19 @@ export function createResolveSpec(ctx) {
         if (rawAddReadDirs !== undefined && !callerOwnsWorkerDisk) {
             logger.warn("task_additional_read_directories_ignored", { honored: false, sessionId: root });
         }
-        const wireCatalog = selectableCatalog(config.models, config.tiers, config.modelRefusals);
-        const picked = resolveTaskModel(body.model ?? parsedSettings.settings?.model, objective, wireCatalog, config.atMention, config.modelRefusals);
+        const { selectable: wireCatalog, picked } = pickUserModel(config, body.model ?? parsedSettings.settings?.model, objective);
         if (picked.unavailable !== undefined) {
             const { requested, name, refusal, source } = picked.unavailable;
             if (opts?.leg === "fresh") {
                 throw new HttpError(400, modelUnavailableMessage(source === "mention" ? "@-mention" : "model", requested, name, refusal), { code: "request.model_unavailable" });
             }
             metrics.inc("task_model_unavailable_fallback_total");
-            logger.warn("task_model_unavailable_fallback", { requested: echoModelRef(requested), name, code: refusal.code, source, fallback: picked.model, sessionId: root });
+            logger.warn("task_model_unavailable_fallback", { requested: echoModelRef(requested), ...refusedNameLogField("name", name), code: refusal.code, source, fallback: picked.model, sessionId: root });
         }
         if (picked.notAllowed !== undefined) {
             const { requested, resolved, source } = picked.notAllowed;
             if (opts?.leg === "fresh") {
-                throw new HttpError(400, `model "${echoModelRef(requested)}" is not @-mentionable on this deployment (it resolves to catalog model "${resolved}") — which models can be @-mentioned is configured by the operator (models.atMention)`, { code: "request.model_not_allowed" });
+                throw new HttpError(400, modelNotAllowedMessage("model", requested, resolved), { code: "request.model_not_allowed" });
             }
             metrics.inc("task_model_not_allowlisted_resume_total");
             logger.warn("task_model_not_allowlisted_resume", { requested: echoModelRef(requested), resolved, source, sessionId: root, note: "resumed leg keeps running the model it was started on — the allowlist gates fresh picks only" });
@@ -356,18 +354,19 @@ export function createResolveSpec(ctx) {
         }
         return { taskHooks, additionalDirectories, additionalReadDirectories, wireCatalog, picked };
     };
-    const resolveHistoryAnchors = async (body, auth, root) => {
+    const resolveHistoryAnchors = async (body, req, auth, root) => {
+        const anchorReader = req === undefined ? undefined : anchorReaderOf(req, { config, logger }, claimCallerOf(identityAxesOf(auth).subject, config));
         let resumeAtEntryId;
         if (typeof body.resumeAt === "string" && body.resumeAt.length > 0) {
-            if (!resumeAnchorStore || !sessionHeadOf)
+            if (!anchorsResolvable)
                 throw new HttpError(501, "resume-at is not available on this worker (no session-store backend for the anchor map)");
-            resumeAtEntryId = await resolveHistoryAnchor("resumeAt", resumeAnchorStore, root, body.resumeAt, auth?.principal ?? null, "resumeAt");
+            resumeAtEntryId = await resolveHistoryAnchor("resumeAt", anchorsResolvable, anchorReader, root, body.resumeAt, auth?.subject ?? null, "resumeAt");
         }
         let rewindFilesToEntryId;
         if (resumeAtEntryId === undefined && typeof body.rewindFilesTo === "string" && body.rewindFilesTo.length > 0) {
-            if (!resumeAnchorStore || !sessionHeadOf)
+            if (!anchorsResolvable)
                 throw new HttpError(501, "rewind-files-to is not available on this worker (no session-store backend for the anchor map)");
-            rewindFilesToEntryId = await resolveHistoryAnchor("rewindFilesTo", resumeAnchorStore, root, body.rewindFilesTo, auth?.principal ?? null, "rewindFilesTo");
+            rewindFilesToEntryId = await resolveHistoryAnchor("rewindFilesTo", anchorsResolvable, anchorReader, root, body.rewindFilesTo, auth?.subject ?? null, "rewindFilesTo");
         }
         const submittedProjectId = auth?.resolvedProjectId ?? (typeof body.projectId === "string" && body.projectId ? body.projectId.toLowerCase() : undefined);
         const s4DefaultScopes = submittedProjectId ? config.projects[submittedProjectId]?.defaultScopes : undefined;
@@ -389,6 +388,7 @@ export function createResolveSpec(ctx) {
         return deriveAskEffective(askForm.form, "unresolved") === "human_reachable";
     };
     const assembleSpecLiteral = (body, auth, root, req, opts, parts, effMode) => {
+        const { parts: subjectParts, person } = identityAxesOf(auth);
         const { scenarioName, cap, hands, acceptedAppend, parsedSettings, attachmentNotice, taskHooks, additionalDirectories, additionalReadDirectories, wireCatalog, picked, resumeAtEntryId, rewindFilesToEntryId, s4DefaultScopes, legProjectId, projectKey, a2aPeers, storedToolAxes, runSkills, } = parts;
         const spec = {
             objective: attachmentNotice ? `${picked.cleanedObjective}\n\n${attachmentNotice}` : picked.cleanedObjective,
@@ -397,7 +397,7 @@ export function createResolveSpec(ctx) {
             ...(body.outputStyle !== undefined ? { outputStyle: body.outputStyle } : {}),
             ...(body.projectMemory !== undefined ? { projectMemory: body.projectMemory } : {}),
             ...(legProjectId !== undefined ? { projectId: legProjectId } : {}),
-            principal: auth?.principal,
+            principal: taskSpecIdentityOf(subjectParts).principal,
             images: body.images,
             ...(body.userAttachments !== undefined ? { userAttachments: body.userAttachments } : {}),
             ...(body.clientContext ? { clientContext: { timeZone: body.clientContext.timeZone, userEmail: body.clientContext.userEmail } } : {}),
@@ -408,7 +408,6 @@ export function createResolveSpec(ctx) {
                 : {}),
             resumeAt: resumeAtEntryId,
             resumeAtMode: normalizeResumeAtMode(body.resumeAtMode, resumeAtEntryId !== undefined),
-            requireExistingSession: body.requireExistingSession === true ? true : undefined,
             enableFork: enableForkFromBody(body, config, Boolean(centerRuntimeCapsResolver)),
             suggestNextPrompts: normalizeSuggestNextPrompts(body.suggestNextPrompts),
             restoreFiles: body.restoreFiles === true ? true : undefined,
@@ -436,7 +435,7 @@ export function createResolveSpec(ctx) {
             ...(declaresInteractivePosture(body, req, opts) ? { interactionPosture: "interactive" } : {}),
             ...(body.approvalReach !== undefined ? { approvalReach: body.approvalReach } : {}),
             ...(typeof body.oneShot === "boolean" ? { oneShot: body.oneShot } : {}),
-            resilience: normalizeResilience(body.resilience, explicitOperatorOk(auth?.principal, config)),
+            resilience: normalizeResilience(body.resilience, explicitOperatorOk(person, config)),
             finalVerification: cap.finalVerification === true || body.finalVerification === true ? true : undefined,
             attachments: normalizeAttachments(body.attachments),
             ...(taskHooks.length > 0 ? { mods: [...taskHooks] } : {}),
@@ -460,7 +459,7 @@ export function createResolveSpec(ctx) {
                 if (!isAtMentionable(cm, wireCatalog, config.atMention, config.modelRefusals)) {
                     const terminal = terminalCatalogName(cm, wireCatalog, config.modelRefusals) ?? cm;
                     if (opts?.leg === "fresh") {
-                        throw new HttpError(400, `compactionModel "${echoModelRef(body.compactionModel)}" is not @-mentionable on this deployment (it resolves to catalog model "${terminal}") — which models can be @-mentioned is configured by the operator (models.atMention)`, { code: "request.model_not_allowed" });
+                        throw new HttpError(400, modelNotAllowedMessage("compactionModel", body.compactionModel, terminal), { code: "request.model_not_allowed" });
                     }
                     metrics.inc("task_model_not_allowlisted_resume_total");
                     logger.warn("task_model_not_allowlisted_resume", { requested: echoModelRef(body.compactionModel), resolved: terminal, source: "compaction", sessionId: root, note: "resumed leg keeps the compaction model it was started with — the allowlist gates fresh picks only" });
@@ -519,12 +518,12 @@ export function createResolveSpec(ctx) {
             ...(parsedSettings.settings?.skillListingBudgetFraction !== undefined ? { skillListingBudgetFraction: parsedSettings.settings.skillListingBudgetFraction } : {}),
             ...(parsedSettings.settings?.skillListingMaxDescChars !== undefined ? { skillListingMaxDescChars: parsedSettings.settings.skillListingMaxDescChars } : {}),
             mcp: resolveRequestMcp(mcpForScenario(config.mcpServers, scenarioName), body.mcpServers, config, peerDesk, opts.lease, logger, opts?.onNotice !== undefined ? { sessionId: root, emit: opts.onNotice } : undefined, storedToolAxes),
-            a2a: resolveRequestA2a(a2aForScenario(config.a2aPeers, scenarioName), a2aPeers, config, peerDesk, opts.lease, logger, opts?.leg === "fresh" ? "fresh" : "resume", storedToolAxes),
+            a2a: resolveRequestA2a(a2aForScenario(config.a2aPeers, scenarioName), a2aPeers, config, peerDesk, opts.lease, logger, storedToolAxes),
             toolPolicy: toolPolicyForHands(hands, durableEnabled
                 ? createApprovalBaselinePolicy(config, {
                     kind: "durable",
                     question: liveQuestionFace,
-                    ...(approvalExemptionStore !== undefined ? { exemption: createDeploymentListExemption(approvalExemptionStore, root, logger) } : {}),
+                    ...(approvalExemptionStore !== undefined ? { exemption: createSessionExemptionRead(approvalExemptionStore, root, logger, "deployment_list") } : {}),
                 })
                 : singleUserAutoAcceptBaselineApplies(config)
                     ? createApprovalBaselinePolicy(config, { kind: "absent" })
@@ -533,14 +532,13 @@ export function createResolveSpec(ctx) {
                 ? {
                     checkpointStore,
                     durableApproval: {
-                        scope: encodeCheckpointScope(auth?.principal),
+                        scope: encodeCheckpointScope(auth?.subject),
                         ...(config.approvalTimeoutSec > 0 ? { ttlMs: config.approvalTimeoutSec * 1000 } : {}),
                     },
                     ...((rs) => (rs ? { resourceSuspend: rs } : {}))(resourceSuspendOptIn({
                         enabled: config.resourceSuspend,
                         ttlSec: config.resourceSuspendTtlSec,
-                        isCascade: body.cascade === true,
-                        scope: encodeCheckpointScope(auth?.principal),
+                        scope: encodeCheckpointScope(auth?.subject),
                         totalTokens: config.resourceSuspendTotalTokens,
                         totalBudgetUsd: config.resourceSuspendTotalBudgetUsd,
                         maxSlices: config.resourceSuspendMaxSlices,
@@ -612,27 +610,19 @@ export function createResolveSpec(ctx) {
         }
         if (governed.selfOrchestration === true) {
             governed = tightenGoverned(governed, {
-                toolPolicy: createWorkflowAskPolicy(approvalExemptionStore
-                    ? async (toolName) => {
-                        const hit = await approvalExemptionStore.has(root, toolName);
-                        if (hit)
-                            logger.info("workflow_gate_exempted", { toolName, sessionId: root });
-                        return hit;
-                    }
-                    : undefined),
+                toolPolicy: createWorkflowAskPolicy(approvalExemptionStore ? createSessionExemptionRead(approvalExemptionStore, root, logger, "workflow_gate") : undefined),
             });
         }
         return { governed, scratchpadDir, hostSemanticsLane };
     };
     const applyImageFactsAndRouting = async (body, auth, root, governed, folded) => {
+        const { person } = identityAxesOf(auth);
         const { scenarioName, scratchpadDir, hostSemanticsLane } = folded;
-        const bodyProfile = typeof body.sandboxImageProfile === "string" && body.sandboxImageProfile.length > 0 ? body.sandboxImageProfile : undefined;
+        const bodyProfile = bodyImageProfileOf(body);
         const taskImageProfile = bodyProfile ?? (body.cascade === true || body.verify === true ? undefined : sessionEnvSelection.get(root));
         let resolvedImageCaps;
         if (taskImageProfile !== undefined) {
-            if (config.remoteExec.provider !== "k8s") {
-                throw createCodedHttpError(501, "capability.k8s_lane_required", "sandboxImageProfile is only supported on the k8s sandbox backend");
-            }
+            assertImageProfileLane(taskImageProfile, config);
             if (!imageIndex) {
                 throw createCodedHttpError(501, "capability.image_index_required", "sandboxImageProfile requires the sandbox-image-pool, which needs a SQL store backend (DB_BACKEND=mysql|pg) — this deployment's store wires no image index");
             }
@@ -642,7 +632,7 @@ export function createResolveSpec(ctx) {
             const resolved = await resolveSandboxImageRef({
                 profile: taskImageProfile,
                 ...(capsNeeded && capsNeeded.length > 0 ? { capabilitiesNeeded: capsNeeded } : {}),
-                viewer: { operator: explicitOperatorOk(auth?.principal, config), tenantId: auth?.principal ?? null },
+                viewer: { operator: explicitOperatorOk(person, config), tenantId: person ?? null },
                 index: imageIndex,
             });
             if (!resolved.ok)

package/dist/boot/retention-lane.d.ts

@@ -31,7 +31,7 @@
  */
 import type { RetentionPolicy } from "@sema-agent/core";
 import type { RetentionMode } from "../config-types.js";
-import type { SpaceReclaimer } from "../workspace-space.js";
+import type { SessionEraseSettler } from "../session-erase.js";
 import type { RetentionExecutor } from "../plugins/retention-deployment.js";
 /** 同 domain 连续失败多少次算「卡住了」(fail-loud 的阈值)。`5` 与 reaper 家族的
  *  `REAPER_FAILURE_WARN_THRESHOLD` 同值同理由:一次抖动(一次重连、一次超时)正是容错要吸收的,
@@ -97,9 +97,9 @@ export interface RetentionSweepCtx {
      * `createThrottledReaperCatch` 必须建在 `setInterval` 之外是同一条理由。
      */
     streaks?: Map<string, number>;
-    /** 结束的空间的回收座(k8s 车道 ∧ 配了缓存卷或快照存储时在场;与会话删除协调器同一只):enforce 删掉会话树之后,把回执里结束了的空间交给它
-     *  (缓存卷、`space/` 快照、该会话停驻车道的快照一并回收)。它从不抛(失败 = 一行 + fail-open 计数);缺席 = 本部署没有可回收的东西。 */
-    spaceReclaimer?: SpaceReclaimer;
+    /** 删后收尾(`session-erase.ts`,与会话删除协调器同一只):enforce 删掉会话树之后,把回执里的 `erased` 交给它 —— 附件字节、完成信箱围栏、会话信箱清仓、
+     *  住客空间回收、无出处卸载结果的如实告知。每一步失败只记一行(行已删,不再有重试路)。 */
+    settle: SessionEraseSettler;
 }
 /** 一轮的读数(给日志与判据用;lane 自己不做任何决策依赖它)。 */
 export interface RetentionSweepOutcome {

package/dist/boot/retention-lane.js

@@ -94,8 +94,8 @@ async function sweepDomainEnforce(ctx, d) {
     };
     const checkpoints = await ctx.executor.expireCheckpoints(input);
     const sessions = await ctx.executor.deleteExpiredSessions(input);
-    if (sessions.endedSpaces !== undefined && ctx.spaceReclaimer !== undefined)
-        await ctx.spaceReclaimer.reclaim(sessions.endedSpaces);
+    if (sessions.erased !== undefined)
+        await (await ctx.settle(sessions.erased)).spaces;
     const toolResults = await ctx.executor.deleteOrphanToolResults(input);
     const touched = checkpoints.deleted + sessions.deleted + toolResults.deleted;
     if (touched > 0) {

package/dist/boot/runner-deps.d.ts

@@ -28,6 +28,7 @@ import type { ToolApprovalCoordinator } from "../tool-approval.js";
 import type { MemoryBackend } from "@sema-agent/core";
 import type { MemorySyncRunner } from "../memory-sync-client.js";
 import type { MailboxRecipientLifecycle } from "../plugins/mailbox-recipient-lifecycle.js";
+import { DEPLOYMENT_SHAPE_PREDICATES } from "../deployment-shape.js";
 import type { PeerDesk } from "../peer-seat.js";
 /**
  * `RunnerDeps.onAsk` 的装配([ref] 件4:从内联闭包提为具名导出,**纯 testability 重构、零行为变化**)。
@@ -219,19 +220,20 @@ export interface RunnerDepsCtx {
      *  缺席=undefined=pre-338 语义(纯 env 部署无中心撤销面)。 */
     mcpRevocations: RunnerDeps["mcpRevocations"];
     /**
-     * 交接件⑤ —— commit 尾注的署名座(`RunnerDeps.hands.commitCoAuthor`)。
+     * 交接件⑤ —— commit 尾注的署名(`RunnerDeps.hands.commitCoAuthor`;缺席 = 不署)。手带(`hands`)本身由共享基座铸,调用方只交这一格。
      *
-     * 🔴 为什么它属于**共享基座**而不是主 runner 的差异键:署名是**部署身份**([ref]① clay 拍:
+     * 🔴 为什么手带属于**共享基座**而不是主 runner 的差异键:署名是**部署身份**([ref]① clay 拍:
      * 「署名 = 产品身份资产,归部署」),不是「哪一只 Runner 在跑」的属性。一个被委派出去的子代
      * 提交进的是**同一个仓**、代表的是**同一个部署** —— 它的 commit 少一行 trailer 没有任何理由。
      * 修前两条腿都漏:`main.ts` 与 `run-local.ts` 的 subRunner 都只在主 runner 上写了这一键,而两处
      * 的「差异键」注释块逐条列了 sessionStore / checkpointStore / 四个座位,**都没提 hands**
      * —— 也就是说它不是一次有理由的分歧,是漏配(与本函数头注记的 [ref]§三族A 同一个病族)。
-     * 由**调用方**给值(而不是在基座里按 `config` 现算):两条腿的判据本就不同(HTTP 腿按
+     * 署名由**调用方**给值(而不是在基座里按 `config` 现算):两条腿的判据本就不同(HTTP 腿按
      * 品牌判官 `isBrandedDeployment`(`capabilities/brand-identity.ts`)分 branded/非 branded,run-local 恒是 Sema 本地形),
-     * 各自算一次、传进来一次,两只 Runner 自动同源。
+     * 各自算一次、传进来一次。手带的另一格 `autoBackgroundOnTimeout` 两条腿判据相同(部署旋钮 `AUTO_BACKGROUND_ON_TIMEOUT`),
+     * 所以由手带的唯一铸点 {@link buildHandsBand} 按 `config` 读 —— 读点只有一处,两只 Runner 自动同源。
      */
-    hands: RunnerDeps["hands"];
+    commitCoAuthor: NonNullable<RunnerDeps["hands"]>["commitCoAuthor"];
     executionEnvFactory: RunnerDeps["executionEnvFactory"];
     lspManager: RunnerDeps["lspManager"];
     fleetBus: FleetEventBus;
@@ -246,7 +248,7 @@ export interface RunnerDepsCtx {
 }
 /** [ref] A10 留档发现②:main runner `RunnerDeps` 与 main.ts subRunner 字面量之间此前手工重复
  * 的 ~15 个键,类型标注见 {@link createSharedRunnerDeps} 头注。 */
-export type SharedRunnerDeps = Pick<RunnerDeps, "brain" | "readFace" | "readDenyPatterns" | "readDenyBuiltinTiers" | "readDenyBuiltinExclude" | "readDenyFloorRequired" | "memoryDelegationEvidence" | "memoryProvenance" | "memoryCapturePolicy" | "delegationEntryCaps" | "crossSessionInbound" | "crossSessionDialogExpiry" | "writeProtectedPaths" | "memoryEngineDir" | "allowedTools" | "crossBoundaryPosture" | "models" | "roles" | "tiers" | "pricing" | "tracer" | "promptSource" | "executionEnvFactory" | "lspManager" | "backgroundAgentStore" | "mailboxStore" | "rosterStore" | "mods" | "toolResultStore" | "checkpointStore" | "hands" | "sessionPolicyStore" | "usageWindows" | "usageWindowStore" | "memoryScopeAdmission" | "deploymentMemoryScopes" | "sharedMemoryStores" | "compliancePostureResolver" | "lockedConfig" | "retentionPolicy" | "onNotice" | "mcpRevocations" | "peerSeat">;
+export type SharedRunnerDeps = Pick<RunnerDeps, "brain" | "readFace" | "readDenyPatterns" | "readDenyBuiltinTiers" | "readDenyBuiltinExclude" | "readDenyFloorRequired" | "memoryDelegationEvidence" | "memoryProvenance" | "memoryCapturePolicy" | "delegationEntryCaps" | "crossSessionInbound" | "crossSessionDialogExpiry" | "writeProtectedPaths" | "memoryEngineDir" | "allowedTools" | "crossBoundaryPosture" | "models" | "roles" | "tiers" | "pricing" | "tracer" | "promptSource" | "executionEnvFactory" | "lspManager" | "backgroundAgentStore" | "mailboxStore" | "rosterStore" | "mods" | "toolResultStore" | "checkpointStore" | "fileHistoryStore" | "fileHistoryCapture" | "hands" | "sessionPolicyStore" | "usageWindows" | "usageWindowStore" | "memoryScopeAdmission" | "deploymentMemoryScopes" | "sharedMemoryStores" | "compliancePostureResolver" | "lockedConfig" | "retentionPolicy" | "onNotice" | "mcpRevocations" | "peerSeat">;
 /**
  * [ref] A10 留档发现②(review 2026-07-29,[ref]§三族A 同源修补的延续):main runner 的
  * `RunnerDeps` 字面量(下方 `createRunnerDeps`)与 `main.ts` 里 subRunner 的 `new Runner({...})`
@@ -273,7 +275,7 @@ export type SharedRunnerDeps = Pick<RunnerDeps, "brain" | "readFace" | "readDeny
  *    属性,比再抽一层共享基座更强的同源保证),不重复收纳进这里。
  */
 /** 基座真实消费的窄面(Pick)——subRunner 调用点(main.ts)只需凑这 13 个字段,不必造全量 ctx。 */
-export type SharedRunnerDepsCtx = Pick<RunnerDepsCtx, "config" | "brain" | "pricing" | "tracer" | "promptSource" | "executionEnvFactory" | "lspManager" | "backgroundAgentStore" | "mailboxStore" | "rosterStore" | "deploymentMods" | "toolResultStore" | "checkpointStore" | "sessionPolicyStore" | "hands" | "usageWindowStore" | "orgMemoryAdmission" | "sharedMemoryStores" | "logger" | "governanceSeams" | "mcpRevocations" | "metrics" | "engineDataRoot" | "peerDesk">;
+export type SharedRunnerDepsCtx = Pick<RunnerDepsCtx, "config" | "brain" | "pricing" | "tracer" | "promptSource" | "executionEnvFactory" | "lspManager" | "backgroundAgentStore" | "mailboxStore" | "rosterStore" | "deploymentMods" | "toolResultStore" | "checkpointStore" | "fileHistoryStore" | "sessionPolicyStore" | "commitCoAuthor" | "usageWindowStore" | "orgMemoryAdmission" | "sharedMemoryStores" | "logger" | "governanceSeams" | "mcpRevocations" | "metrics" | "engineDataRoot" | "peerDesk">;
 /** 转发席只需要 `inc` —— 刻意窄到这一个动词,免得把整只 Metrics 拖进这条纯转发腿。 */
 export interface EngineNoticeMetricsSeat {
     inc: (name: string, labels?: Record<string, string>) => void;
@@ -347,6 +349,13 @@ export declare const CROSS_BOUNDARY_POSTURE_REQUIRES_PRINCIPAL: {
     readonly single_user: false;
 };
 export declare function crossBoundaryPostureOf(requirePrincipal: boolean): CrossBoundaryPosture;
+/**
+ * 手带(`RunnerDeps.hands`)的**唯一**铸点(纯数据 ⇒ `build*`)。两格两个来源:署名由腿给(两条腿判据不同,见 {@link RunnerDepsCtx.commitCoAuthor};
+ * leader 车道今天不署名,显式交 `undefined`),前台命令超时转后台读部署旋钮 `AUTO_BACKGROUND_ON_TIMEOUT` —— 旋钮的读点只有这里。
+ * 共享基座(主 / 无手 / hook 代理 / 子代,HTTP 与 run-local 两条腿)与 leader 车道(`boot/leader.ts` → `LeaderWireConfig.hands`)同调这一只:
+ * 有手的每一只 Runner 都拿到它,`/health.autoBackgroundOnTimeout` 说「生效」时没有哪只 Runner 例外。
+ */
+export declare function buildHandsBand(config: Pick<ServiceConfig, "autoBackgroundOnTimeout">, commitCoAuthor: RunnerDepsCtx["commitCoAuthor"]): NonNullable<RunnerDeps["hands"]>;
 export declare function buildDeploymentPostureSeats(config: DeploymentPostureConfig): DeploymentPostureSeats;
 /**
  * 部署读拒行**进场**的唯一告知点(非锚定行一行 `read_deny_unanchored_rows`;判据与行形在 `read-deny-anchor-audit.ts`)。律:**一份读拒行的值第一次装进 Runner 席时点名一次** ——
@@ -356,5 +365,17 @@ export declare function buildDeploymentPostureSeats(config: DeploymentPostureCon
  */
 export declare function announceReadDenyRows(config: Pick<ServiceConfig, "readDenyPatterns">, logger: Pick<Logger, "warn">): void;
 export declare function createSharedRunnerDeps(ctx: SharedRunnerDepsCtx): SharedRunnerDeps;
+/**
+ * 这台部署**声明本机属主的规则桶**吗(core `RunnerDeps.localOwnerRules`:不带主体的 run 经规则店的 `forLocalOwner()` 读持久规则,而不是读零规则)。
+ * 声明 ⟺ 单用户形(部署形表 `multiTenant` 不成立 —— `REQUIRE_PRINCIPAL` 未开)∧ 规则店装配了。
+ *
+ * 规则店缺席时不声明:core 把「声明了却没有可存规则的桶」当配置矛盾、在每次 prepare 整轮拒(连带主体的 run 一起),而「没有规则店」本来就是
+ * 「没有持久规则」—— 声明与店同生同灭。多租形不声明:不带主体的调用方在那里不是任何人的代表,零规则地板是对的。
+ * 单用户形上不带主体的调用方就是这台部署的那一个人(身份边界由跨键不变量 `single-user-anonymous-boundary` 守:无凭据 ∧ 写面无鉴权 ∧ 监听不只在回环 ⇒ 拒启)。
+ * 收编(adoption)把本机属主桶整桶改键到一个主体名下,收编计划同时要求 `REQUIRE_PRINCIPAL=true` ⇒ 声明随之撤回(计划表的 `core-decl` 行)。
+ *
+ * 读者两处、同读这一只:Runner 装配({@link createRunnerDeps})与运维整理阀门的写判官(`boot/stage-06-runners.ts`)。
+ */
+export declare function localOwnerRulesDeclared(config: Parameters<typeof DEPLOYMENT_SHAPE_PREDICATES.multiTenant.holds>[0], permissionRuleStore: RunnerDeps["permissionRuleStore"]): boolean;
 export declare function createRunnerDeps(ctx: RunnerDepsCtx): RunnerDeps;
 //# sourceMappingURL=runner-deps.d.ts.map

package/dist/boot/runner-deps.js

@@ -9,6 +9,7 @@ import { createHardenedVmRunner } from "../orchestration/hardened-vm-runner.js";
 import { createWorkerHardenedVmRunner } from "../orchestration/hardened-vm-worker-runner.js";
 import { WorkflowAgentRegistry } from "../orchestration/workflow-agent-steer.js";
 import { defaultEngineNoticeRouter, redactNoticeMessage, redactNoticeRuleText } from "../trace/engine-notice-wire.js";
+import { presentEngineNotice } from "../read-deny-floor-notice.js";
 import { WorkflowNotifyGate } from "../orchestration/workflow-notify-journal.js";
 import { makeLoadProjectMemory, makeProbeInstructionSources } from "../project-memory.js";
 import { createInstructionSourceSeat } from "../instruction-source-notice.js";
@@ -48,7 +49,8 @@ export const PROMPT_CACHE_BREAK_CAUSE_LEVEL = {
 const PROMPT_CACHE_BREAK_LEVELS = new Map(Object.entries(PROMPT_CACHE_BREAK_CAUSE_LEVEL));
 const CEILING_ORIGINS = new Set(["walltime", "turns"]);
 export function createEngineNoticeForwarder(logger, router = defaultEngineNoticeRouter, metrics) {
-    return (notice) => {
+    return (engineNotice) => {
+        const notice = presentEngineNotice(engineNotice);
         const detail = redactNoticeRuleText(notice.code, notice.detail);
         const message = redactNoticeMessage(notice.message);
         logger.warn("engine_notice", { code: notice.code, message, ...(detail !== undefined ? { detail } : {}) });
@@ -75,6 +77,9 @@ export function crossBoundaryPostureOf(requirePrincipal) {
     }
     throw new Error(`cross-boundary posture table has no word for requirePrincipal=${requirePrincipal} (the table must map both values)`);
 }
+export function buildHandsBand(config, commitCoAuthor) {
+    return { commitCoAuthor, autoBackgroundOnTimeout: config.autoBackgroundOnTimeout };
+}
 export function buildDeploymentPostureSeats(config) {
     const crossSessionLayers = buildCrossSessionInboundLayers(config);
     const lkgRows = lkgReadDenyRows(config.configLkgPath);
@@ -124,9 +129,11 @@ export function createSharedRunnerDeps(ctx) {
         mailboxStore: ctx.mailboxStore ? ctx.mailboxStore : undefined,
         rosterStore: ctx.rosterStore ? ctx.rosterStore : undefined,
         mods: ctx.deploymentMods,
-        hands: ctx.hands,
+        hands: buildHandsBand(ctx.config, ctx.commitCoAuthor),
         toolResultStore: ctx.toolResultStore,
         checkpointStore: ctx.checkpointStore ? ctx.checkpointStore : undefined,
+        fileHistoryStore: ctx.fileHistoryStore ? ctx.fileHistoryStore : undefined,
+        fileHistoryCapture: coreFileHistoryCaptureSeat(ctx.fileHistoryStore, ctx.config.fileHistoryCapture),
         sessionPolicyStore: ctx.sessionPolicyStore ? ctx.sessionPolicyStore : undefined,
         memoryScopeAdmission: ctx.orgMemoryAdmission.memoryScopeAdmission ? ctx.orgMemoryAdmission.memoryScopeAdmission : undefined,
         deploymentMemoryScopes: ctx.orgMemoryAdmission.deploymentMemoryScopes && ctx.orgMemoryAdmission.deploymentMemoryScopes.length > 0 ? ctx.orgMemoryAdmission.deploymentMemoryScopes : undefined,
@@ -142,8 +149,11 @@ export function createSharedRunnerDeps(ctx) {
     };
     return shared;
 }
+export function localOwnerRulesDeclared(config, permissionRuleStore) {
+    return permissionRuleStore !== undefined && !DEPLOYMENT_SHAPE_PREDICATES.multiTenant.holds(config);
+}
 export function createRunnerDeps(ctx) {
-    const { config, logger, metrics, localRoot, outcomeSink, elicitation, question, toolApproval, sessionStore, memoryEngine, sessionCaptureRecords, memorySyncRunner, runtimeCapsResolver, fileHistoryStore, permissionRuleStore, fleetBus, workflowRunStore, workflowJournalStore, workflowAgentRegistry, workflowNotifyGate, deliverWorkflowCompletion, } = ctx;
+    const { config, logger, metrics, localRoot, outcomeSink, elicitation, question, toolApproval, sessionStore, memoryEngine, sessionCaptureRecords, memorySyncRunner, runtimeCapsResolver, permissionRuleStore, fleetBus, workflowRunStore, workflowJournalStore, workflowAgentRegistry, workflowNotifyGate, deliverWorkflowCompletion, } = ctx;
     const peerSessionLister = sessionStore.listSessionRows?.bind(sessionStore);
     const memoryEngineIncident = createMemoryEngineIncidentSink({ logger, metrics });
     const sharedRunnerDeps = createSharedRunnerDeps(ctx);
@@ -228,9 +238,8 @@ export function createRunnerDeps(ctx) {
             }
             : undefined,
         runtimeCapsResolver: runtimeCapsResolver ? runtimeCapsResolver : undefined,
-        fileHistoryStore: fileHistoryStore ? fileHistoryStore : undefined,
-        fileHistoryCapture: coreFileHistoryCaptureSeat(fileHistoryStore, config.fileHistoryCapture),
         permissionRuleStore: permissionRuleStore ? permissionRuleStore : undefined,
+        localOwnerRules: localOwnerRulesDeclared(config, permissionRuleStore),
         onBackgroundChildEvent: fleetBackgroundChildPublisher(fleetBus, (msg, fields) => logger.info(msg, fields)),
         loadProjectMemory: !DEPLOYMENT_SHAPE_PREDICATES.multiTenant.holds(config) && config.projectMemoryEnabled
             ? makeLoadProjectMemory({ logger, instructionSource: createInstructionSourceSeat(sessionStore, sharedRunnerDeps.onNotice) })

package/dist/boot/runtime-caps.d.ts

@@ -9,7 +9,7 @@
  */
 import type { ServiceConfig } from "../config.js";
 import type { Logger } from "../observability/logger.js";
-import { type EntitlementsResolverFn, type MemoryOptOutVerdictSource } from "../runtime-caps-resolver.js";
+import { type EntitlementsResolverFn, type MemoryOptOutVerdictSource, type RuntimeCapsReading } from "../runtime-caps-resolver.js";
 export interface RuntimeCapsCtx {
     config: ServiceConfig;
     logger: Logger;
@@ -50,6 +50,6 @@ export declare function createRuntimeCaps(ctx: RuntimeCapsCtx): {
     principalCaps: import("../runtime-caps-resolver.js").PrincipalEntitlementsClient | undefined;
     centerRuntimeCapsResolver: ((principal: string | undefined) => Promise<import("@sema-agent/core").RuntimeCaps | undefined>) | undefined;
     runtimeCapsResolver: EntitlementsResolverFn | undefined;
-    runtimeCapsPeekResolver: EntitlementsResolverFn | undefined;
+    runtimeCapsPeekReading: ((principal: string | undefined) => Promise<RuntimeCapsReading>) | undefined;
 };
 //# sourceMappingURL=runtime-caps.d.ts.map

package/dist/boot/runtime-caps.js

@@ -73,7 +73,21 @@ export function createRuntimeCaps(ctx) {
         });
     };
     const runtimeCapsResolver = compose(centerRuntimeCapsResolver, true);
-    const runtimeCapsPeekResolver = compose(principalCaps?.peekRuntimeCaps, false);
-    return { principalCaps, centerRuntimeCapsResolver, runtimeCapsResolver, runtimeCapsPeekResolver };
+    const peekOver = (base) => compose(base, false);
+    const runtimeCapsPeekReading = peekOver(principalCaps === undefined ? undefined : async () => undefined) === undefined
+        ? undefined
+        : async (principal) => {
+            let refusedBy;
+            const base = principalCaps === undefined
+                ? undefined
+                : async (p) => {
+                    const reading = await principalCaps.peekRuntimeCapsReading(p);
+                    refusedBy = reading.autoModeRefusedBy;
+                    return reading.caps;
+                };
+            const caps = await peekOver(base)?.(principal);
+            return { caps, ...(refusedBy !== undefined ? { autoModeRefusedBy: refusedBy } : {}) };
+        };
+    return { principalCaps, centerRuntimeCapsResolver, runtimeCapsResolver, runtimeCapsPeekReading };
 }
 //# sourceMappingURL=runtime-caps.js.map