@sema-agent/server 7.147.0 → 7.149.0

package/dist/http/execution-context.js

@@ -1,14 +1,18 @@
+import { RUN_STALE_SEC_DEFAULT } from "../run-stale-default.js";
 import { HttpError, createCodedHttpError, ssoVerifiedScope } from "../security.js";
-import { gatedPrincipal } from "./principal-gate.js";
+import { gatedPerson } from "./principal-gate.js";
 import { DEVICE_ERROR_CODES, assertDeviceIdShape } from "../device-store.js";
 import { buildDeviceRejection } from "../device-enrollment.js";
-import { sameOccupant } from "../execution-placement.js";
+import { SessionForkInProgressError, sameOccupant } from "../execution-placement.js";
 import { deployedExecutionLanes } from "../execution-lane-caps.js";
 import { gateExecutionLane } from "../runtime-caps-resolver.js";
-import { releaseClaimedRun } from "./claimed-run.js";
+import { releaseClaimedRun, withdrawClaimedRun } from "./claimed-run.js";
 import { sessionIdRetiredFor } from "../deleted-session-ids.js";
 import { refusalBody } from "./refusal-body.js";
 import { timeClaim } from "./claim-latency.js";
+import { storeFaultClassOf } from "../plugins/store-fault.js";
+import { resumeClaimFaultAnswer } from "./resume-ctx-read.js";
+import { resumeAssemblyRefusalAnswer, resumeRefusalWithCard } from "./checkpoint-ctx.js";
 export async function resolveExecutionContext(deps, entry) {
     const lanes = deployedExecutionLanes(deps.config);
     switch (entry.kind) {
@@ -69,8 +73,7 @@ function laneOf(root, cell, lanes) {
     }
 }
 function sessionMirrorError(root) {
-    const answer = sessionMirrorAnswer(root);
-    return createCodedHttpError(answer.status, answer.body.errorCode, answer.body.error, { forkPath: forkPathOf(root) });
+    return refusalHttpError(sessionMirrorAnswer(root));
 }
 export function forkPathOf(root) {
     return `/v1/sessions/${encodeURIComponent(root)}/fork`;
@@ -86,14 +89,13 @@ function sessionMirrorAnswer(root) {
     };
 }
 function rootSessionGoneError() {
-    const absent = rootSessionAbsentAnswer();
-    return createCodedHttpError(absent.status, absent.body.errorCode, absent.body.error);
+    return refusalHttpError(rootSessionAbsentAnswer());
 }
 export function isRootSessionGoneError(err) {
     return err instanceof HttpError && err.code === rootSessionAbsentAnswer().body.errorCode;
 }
 export function deviceOwnerDomainOf(req, config) {
-    const subject = gatedPrincipal(req, config);
+    const subject = gatedPerson(req, config);
     if (subject === undefined)
         return undefined;
     const tenant = ssoVerifiedScope(req);
@@ -141,8 +143,8 @@ async function admitDevicePlacement(deps, entry, lane, seat, reading) {
     try {
         admitted = await deps.deviceEnrollment.admitSession({ rootSessionId: entry.root, placement: reading, requester: owner, ...(requestedDeviceId === undefined ? {} : { requestedDeviceId }) });
     }
-    catch {
-        throw asHttpError(registryUnavailable());
+    catch (e) {
+        throw asHttpError(faultedAnswerOf(e, registryUnavailable));
     }
     if (admitted.ok)
         return { rootSessionId: entry.root, occupant: reading.occupant, owner, admittedDeviceId: admitted.value.deviceId, firstBind: false };
@@ -152,8 +154,8 @@ async function admitDevicePlacement(deps, entry, lane, seat, reading) {
     try {
         view = await deps.deviceStore.readDeviceForAdmission(requestedDeviceId, owner);
     }
-    catch {
-        throw asHttpError(registryUnavailable());
+    catch (e) {
+        throw asHttpError(faultedAnswerOf(e, registryUnavailable));
     }
     if (!view)
         throw asHttpError(buildDeviceRejection(DEVICE_ERROR_CODES.NOT_FOUND, "device not found"));
@@ -163,12 +165,25 @@ async function admitDevicePlacement(deps, entry, lane, seat, reading) {
         throw asHttpError(buildDeviceRejection(DEVICE_ERROR_CODES.OFFLINE, "device is not connected"));
     return { rootSessionId: entry.root, occupant: reading.occupant, owner, admittedDeviceId: requestedDeviceId, firstBind: true };
 }
-export function stampSpecRoot(spec, ctx) {
+export function stampSpecRoot(spec, ctx, submission) {
     const named = spec.sessionId;
     if (named !== undefined && named !== ctx.root) {
         throw createCodedHttpError(400, "request.precondition_unmet", "the deployment's spec resolver named a session other than the one this submission was authorized for — a submission's root session comes only from the authorizer, so resolveSpec must not set sessionId (read opts.execution.root instead)");
     }
-    return { ...spec, sessionId: ctx.root };
+    switch (submission.use) {
+        case "session": {
+            const mustExist = ctx.occupant !== undefined || submission.requireExistingSession === true;
+            return mustExist ? { ...spec, sessionId: ctx.root, requireExistingSession: true } : { ...spec, sessionId: ctx.root };
+        }
+        case "ladder_host": {
+            const { requireExistingSession: _noAcquireOnALadder, ...ladderSpec } = spec;
+            return { ...ladderSpec, sessionId: ctx.root };
+        }
+        default: {
+            const unhandled = submission;
+            throw new Error(`stampSpecRoot: unhandled root use ${JSON.stringify(unhandled)}`);
+        }
+    }
 }
 export function rootSessionAbsentAnswer() {
     return {
@@ -179,8 +194,64 @@ export function rootSessionAbsentAnswer() {
         }),
     };
 }
+export function isRootSessionGoneRefusal(refusal) {
+    return refusal.body.errorCode === rootSessionAbsentAnswer().body.errorCode;
+}
+export function faultedAnswerOf(e, answer) {
+    const fault = storeFaultClassOf(e);
+    switch (fault) {
+        case "corrupt":
+        case "connection":
+        case "deployment":
+        case "unclassified":
+            return answer();
+        case "defect":
+            throw e;
+        default: {
+            const unhandled = fault;
+            throw new Error(`faultedAnswerOf: the store-fault judge answered a class this reader does not place: ${String(unhandled)}`);
+        }
+    }
+}
+export function runStoreUnavailableAnswer() {
+    return {
+        status: 503,
+        body: refusalBody({ errorCode: "state.run_store_unavailable", message: "this task could not be recorded just now (the store did not answer), so nothing was started. Send it again later; if this keeps happening, ask whoever operates this deployment to check its database." }),
+    };
+}
+export const SUBMISSION_CLAIM_FACE = { refused: (refusal) => refusal, faulted: runStoreUnavailableAnswer };
+export const CONTINUATION_CLAIM_FACE = {
+    refused: (refusal) => (isRootSessionGoneRefusal(refusal) ? refusal : cardWaitingRefusalAnswer(refusal)),
+    faulted: resumeClaimFaultAnswer,
+};
+export function cardWaitingRefusalAnswer(refusal) {
+    const { error, errorCode, ...facts } = refusal.body;
+    return resumeRefusalWithCard(resumeAssemblyRefusalAnswer(refusal.status, { errorCode, message: error, facts }), true);
+}
+export function refusalHttpError(refusal) {
+    const { error, errorCode, ...facts } = refusal.body;
+    return createCodedHttpError(refusal.status, errorCode, error, Object.keys(facts).length > 0 ? facts : undefined);
+}
+export async function resolveBeforeClaim(deps, entry, face) {
+    try {
+        return await resolveExecutionContext(deps, entry);
+    }
+    catch (e) {
+        if (e instanceof HttpError)
+            throw e;
+        throw new ClaimFaultAnswer(faultedAnswerOf(e, face.faulted));
+    }
+}
+export class ClaimFaultAnswer extends HttpError {
+    answer;
+    constructor(answer) {
+        const { error, errorCode: code, ...facts } = answer.body;
+        super(answer.status, error, Object.keys(facts).length > 0 ? { code, extra: facts } : { code });
+        this.answer = answer;
+    }
+}
 export function placementWriteDeadlineMs(runStaleSec) {
-    const stale = typeof runStaleSec === "number" && Number.isFinite(runStaleSec) && runStaleSec > 0 ? runStaleSec : 120;
+    const stale = typeof runStaleSec === "number" && Number.isFinite(runStaleSec) && runStaleSec > 0 ? runStaleSec : RUN_STALE_SEC_DEFAULT;
     return Math.min(15_000, Math.max(1_000, Math.floor((stale * 1000) / 4)));
 }
 function deviceRefusal(rej) {
@@ -207,7 +278,7 @@ export async function commitExecutionContext(deps, claim, ctx) {
     return timeClaim(deps.metrics, "placement_commit", commitPlacement(deps, claim, ctx, seat, occupant));
 }
 async function commitPlacement(deps, claim, ctx, seat, occupant) {
-    const release = (why) => releaseClaim(deps, claim, why);
+    const release = (why, ending) => withdrawClaim(deps, claim, why, ending);
     const deadlineMs = placementWriteDeadlineMs(deps.config?.runStaleSec);
     const withDeadline = async (work) => {
         let timer;
@@ -225,56 +296,64 @@ async function commitPlacement(deps, claim, ctx, seat, occupant) {
                 clearTimeout(timer);
         }
     };
-    const goneAnswer = () => (claim.kind === "parked" ? claim.goneAnswer : rootSessionAbsentAnswer());
     let refusal;
     try {
         refusal =
             ctx.device !== undefined
-                ? await commitDevice(deps, seat, ctx.device, withDeadline, goneAnswer)
+                ? await commitDevice(deps, seat, ctx.device, withDeadline)
                 : ctx.placement === "absent"
-                    ? await commitPlace(seat, ctx, occupant, withDeadline, goneAnswer)
-                    : await reassertWriter(seat, ctx, occupant, withDeadline, goneAnswer);
+                    ? await commitPlace(seat, ctx, occupant, withDeadline)
+                    : await reassertWriter(seat, ctx, occupant, withDeadline);
     }
     catch (err) {
-        deps.logger?.warn("execution_placement_commit_failed", { root: ctx.root, lane: ctx.lane, placement: ctx.placement, deadlineMs, err: err instanceof Error ? err.message : String(err) });
-        await release(`execution placement could not be committed: ${err instanceof Error ? err.message : String(err)}`);
-        if (ctx.device !== undefined) {
-            refusal = deviceRefusal(registryUnavailable());
+        if (err instanceof SessionForkInProgressError) {
+            refusal = { status: 409, body: refusalBody({ errorCode: err.code, message: err.message }) };
             deps.metrics?.inc("execution_placement_rejects_total", { errorCode: refusal.body.errorCode });
+            await release(`execution placement rejected: [${refusal.body.errorCode}] ${refusal.body.error}`, "refused");
             return refusal;
         }
+        deps.logger?.warn("execution_placement_commit_failed", { root: ctx.root, lane: ctx.lane, placement: ctx.placement, deadlineMs, err: err instanceof Error ? err.message : String(err) });
+        await release(`execution placement could not be committed: ${err instanceof Error ? err.message : String(err)}`, "faulted");
         throw err;
     }
     if (refusal === null)
         return null;
     deps.metrics?.inc("execution_placement_rejects_total", { errorCode: refusal.body.errorCode });
-    await release(`execution placement rejected: [${refusal.body.errorCode}] ${refusal.body.error}`);
+    await release(`execution placement rejected: [${refusal.body.errorCode}] ${refusal.body.error}`, isRootSessionGoneRefusal(refusal) ? "gone" : "refused");
     return refusal;
 }
-async function releaseClaim(deps, claim, why) {
+export async function withdrawClaim(deps, claim, why, ending) {
+    const loud = (taskId, step, err) => {
+        deps.logger?.warn("execution_placement_run_release_failed", { taskId, step, err: err instanceof Error ? err.message : String(err) });
+        deps.metrics?.inc("execution_placement_run_release_failed_total");
+    };
     switch (claim.kind) {
         case "run":
-            await releaseClaimedRun(claim.runStore, claim.taskId, why, (err, step) => {
-                deps.logger?.warn("execution_placement_run_release_failed", { taskId: claim.taskId, step, err: err instanceof Error ? err.message : String(err) });
-                deps.metrics?.inc("execution_placement_run_release_failed_total");
-            });
+            await withdrawClaimedRun(claim.runStore, claim.taskId, claim.legId, (err, step) => loud(claim.taskId, step, err));
+            return;
+        case "resumed":
+            if (ending !== "gone") {
+                await claim.restore();
+                return;
+            }
+            await releaseClaimedRun(claim.runStore, claim.taskId, why, (err, step) => loud(claim.taskId, step, err));
             return;
         case "parked":
             await claim.rollback(why);
             return;
         default: {
             const unhandled = claim;
-            throw new Error(`commitExecutionContext: unknown claim ${JSON.stringify(unhandled)}`);
+            throw new Error(`withdrawClaim: unknown claim ${JSON.stringify(unhandled)}`);
         }
     }
 }
-async function commitPlace(seat, ctx, occupant, withDeadline, goneAnswer) {
+async function commitPlace(seat, ctx, occupant, withDeadline) {
     if (ctx.lane === "device") {
         return deviceRefusal(buildDeviceRejection(DEVICE_ERROR_CODES.NOT_BOUND, "this session has no device binding — nothing was started"));
     }
-    return placeOutcomeAnswer(ctx.root, await withDeadline(seat.place(ctx.root, occupant, { role: "writer", lane: ctx.lane })), goneAnswer);
+    return placeOutcomeAnswer(ctx.root, await withDeadline(seat.place(ctx.root, occupant, { role: "writer", lane: ctx.lane })));
 }
-function placeOutcomeAnswer(root, outcome, goneAnswer) {
+function placeOutcomeAnswer(root, outcome) {
     switch (outcome.outcome) {
         case "placed":
         case "same":
@@ -284,17 +363,17 @@ function placeOutcomeAnswer(root, outcome, goneAnswer) {
         case "mirror":
             return sessionMirrorAnswer(root);
         case "gone":
-            return goneAnswer();
+            return rootSessionAbsentAnswer();
         default: {
             const unhandled = outcome;
             throw new Error(`commitExecutionContext: no answer for ${JSON.stringify(unhandled)}`);
         }
     }
 }
-async function reassertWriter(seat, ctx, occupant, withDeadline, goneAnswer) {
+async function reassertWriter(seat, ctx, occupant, withDeadline) {
     const now = await withDeadline(seat.read(ctx.root));
     if (now === undefined || !sameOccupant(now.occupant, occupant))
-        return goneAnswer();
+        return rootSessionAbsentAnswer();
     const cell = now.cell;
     switch (cell.role) {
         case "writer":
@@ -310,20 +389,31 @@ async function reassertWriter(seat, ctx, occupant, withDeadline, goneAnswer) {
         }
     }
 }
-async function commitDevice(deps, seat, intent, withDeadline, goneAnswer) {
+async function commitDevice(deps, seat, intent, withDeadline) {
     const enrollment = deps.deviceEnrollment;
     if (!enrollment) {
         throw new Error("commitExecutionContext: a device placement intent was minted without a DeviceEnrollment — assembly bug (both are read from the same ServiceDeps)");
     }
+    const registry = async (work) => {
+        try {
+            return { ok: true, value: await withDeadline(work) };
+        }
+        catch (e) {
+            return { ok: false, refusal: deviceRefusal(faultedAnswerOf(e, registryUnavailable)) };
+        }
+    };
     if (intent.firstBind) {
-        const bound = await withDeadline(enrollment.bindPlacement({ rootSessionId: intent.rootSessionId, occupant: intent.occupant, deviceId: intent.admittedDeviceId, requester: intent.owner }));
+        const binding = await registry(enrollment.bindPlacement({ rootSessionId: intent.rootSessionId, occupant: intent.occupant, deviceId: intent.admittedDeviceId, requester: intent.owner }));
+        if (!binding.ok)
+            return binding.refusal;
+        const bound = binding.value;
         if (bound.ok)
             return null;
         if ("reject" in bound)
             return deviceRefusal(bound.reject);
         switch (bound.placement) {
             case "gone":
-                return goneAnswer();
+                return rootSessionAbsentAnswer();
             case "mirror":
                 return sessionMirrorAnswer(intent.rootSessionId);
             case "tree_bound":
@@ -336,8 +426,10 @@ async function commitDevice(deps, seat, intent, withDeadline, goneAnswer) {
     }
     const placement = await withDeadline(seat.read(intent.rootSessionId));
     if (placement === undefined || !sameOccupant(placement.occupant, intent.occupant))
-        return goneAnswer();
-    const readmitted = await withDeadline(enrollment.admitSession({ rootSessionId: intent.rootSessionId, placement, requester: intent.owner, requestedDeviceId: intent.admittedDeviceId }));
-    return readmitted.ok ? null : deviceRefusal(readmitted.reject);
+        return rootSessionAbsentAnswer();
+    const readmission = await registry(enrollment.admitSession({ rootSessionId: intent.rootSessionId, placement, requester: intent.owner, requestedDeviceId: intent.admittedDeviceId }));
+    if (!readmission.ok)
+        return readmission.refusal;
+    return readmission.value.ok ? null : deviceRefusal(readmission.value.reject);
 }
 //# sourceMappingURL=execution-context.js.map

package/dist/http/health-reader.d.ts

@@ -0,0 +1,36 @@
+/**
+ * `GET /health` 的**读者分档** —— 同一张面四种读者(k8s / Docker 探针、壳在带凭据之前读的自报位、嵌入宿主的引擎身份验证、持凭运维),
+ * 键集按**读者**而不是按「这个键敏不敏感」定。
+ *
+ * ## 规则(一条)
+ * 读者三档,答案只有一处:
+ *  · `open`        —— 部署没配任何服务凭据(单机 / loopback 开发形;全局凭据门不武装):全键,字节同分档之前;
+ *  · `credentialed` —— 配了服务凭据,且这次请求出示了**读路谓词**认的凭据(`dispatch.ts` 的 `readCredentialOk`:service token ∨ 只读 trace token ∨ 已验 principal):全键;
+ *  · `anonymous`   —— 配了服务凭据而这次请求没出示:**只拿显式白名单** {@link ANONYMOUS_HEALTH_KEYS}。
+ * 白名单 = 存活位(`status`)+ 壳的 pre-credential 自报位三键(`auth` / `operator` / `center`,`health-self-report.ts` 铸;壳在带凭据**之前**要读的就是它们)。
+ * 其余的键 —— 现有的(`dataRoot` / `pid` / `configHash` / `sessionBackend` / `startedAt` / `port` / `version` / `engineSignal` …)与将来新长的 —— 对匿名读者一律不出:
+ * 这是**白名单**(挑出四键),不是黑名单(剥掉几键)—— 黑名单形下每个新键默认漏出,这一面又恒在凭据门之前、缺省全网卡监听(安全轴 fail-closed)。
+ *
+ * ## 谁读哪一档
+ *  · 探针(k8s `httpGet` / Docker `HEALTHCHECK`):只要 HTTP 200 —— 匿名也是 200,存活位在白名单里;摘流语义的探针读 `/readyz`(不分档,体只有就绪位);
+ *  · 壳的 pre-credential 读路:`auth` / `operator` / `center` 三键(7.121.0)—— 白名单;
+ *  · 嵌入宿主的引擎身份验证(`pid` ∧ `dataRoot`,见 `test/health-identity-contract.test.ts`):宿主就是带着部署的服务凭据起的引擎,身份验证带同一枚凭据读 —— 在 `credentialed` 档;
+ *    没配服务凭据的嵌入形(桌面宿主自起、不配凭据)在 `open` 档,与改前逐字节同;
+ *  · 持凭运维 / 编排器:`credentialed` 档,全键。
+ *
+ * 没有旋钮:一个放宽用的旋钮就是一把「把路径指纹重新开给匿名方」的钥匙,而本规则要的恰是它没有这把钥匙。
+ */
+/** 读者三档(闭集;顺序无语义)。 */
+export declare const HEALTH_READERS: readonly ["open", "credentialed", "anonymous"];
+export type HealthReader = (typeof HEALTH_READERS)[number];
+/**
+ * 匿名读者的**显式白名单**:存活位 + 自报位三键。穷举 —— 加一个进来是一次有意的、要过评审的放宽(它会对没有凭据的任何人可见)。
+ * 每一只都必须是 `/health` 体里真有的键(`test/health-reader-closed-set.test.ts` 逐键钉在场),抄错名字不会悄悄把闭集缩成更小的一个。
+ */
+export declare const ANONYMOUS_HEALTH_KEYS: readonly ["status", "auth", "operator", "center"];
+/**
+ * 键集判官 —— `/health` 体按读者出口的**唯一**一道:`open` / `credentialed` 原样,`anonymous` 只挑白名单。
+ * 入参是按全键铸好的体(铸点不分读者:一个事实一个铸点,读者分档只在出口);返回新对象,不改入参。
+ */
+export declare function projectHealthBody(reader: HealthReader, body: Readonly<Record<string, unknown>>): Readonly<Record<string, unknown>>;
+//# sourceMappingURL=health-reader.d.ts.map

package/dist/http/health-reader.js

@@ -0,0 +1,21 @@
+export const HEALTH_READERS = ["open", "credentialed", "anonymous"];
+export const ANONYMOUS_HEALTH_KEYS = ["status", "auth", "operator", "center"];
+export function projectHealthBody(reader, body) {
+    switch (reader) {
+        case "open":
+        case "credentialed":
+            return body;
+        case "anonymous": {
+            const closed = {};
+            for (const key of ANONYMOUS_HEALTH_KEYS)
+                if (Object.hasOwn(body, key))
+                    closed[key] = body[key];
+            return closed;
+        }
+        default: {
+            const unknownReader = reader;
+            throw new Error(`health reader: unknown reader ${String(unknownReader)}`);
+        }
+    }
+}
+//# sourceMappingURL=health-reader.js.map

package/dist/http/health-self-report.d.ts

@@ -4,11 +4,11 @@
  *
  * ## 规则(一条):自报位是**投影**,不是第二份规则
  * 每一位读的是**门本身读的那只谓词 / 那只取值口**,本模块不判任何东西:
- *  · `auth.kinds` = `IDENTITY_SOURCES`(`identity-source.ts`;`verifiedIdentitySource` 的回值闭集,序 = 判定次序)里,这台部署的装配**能**回的那几个词 —— 取唯一读法 `wiredIdentitySources`
- *    (`principal-gate.ts`;「这台部署有没有身份边界」的门 `devOpenDeployment` 读同一只):
- *    `service_token` ⇐ 全局门武装(`systemFor` 只在配了 service token 时回得出值)· `sso` ⇐ 鉴权桥装了(入口预认证只在
- *    `webAdminJwtVerifier` 在场时挂身份)· `direct_door_jwt` ⇐ 直连门开着(`verifiedIdentitySource` 那一臂的第一个合取项);
- *  · `auth.required` = kinds 里有没有 `service_token` —— 那一词接没接线就是全局凭据门的武装谓词(`hasServiceAuth`;`wiredIdentitySources` 的
+ *  · `auth.kinds` = `IDENTITY_SOURCES`(`identity-source.ts`;`verifiedIdentitySource` 的回值闭集,序 = 判定次序)里,这台部署的配置**能**回的那几个词 —— 取唯一读法 `configuredIdentitySources`
+ *    (`identity-source.ts`;「这台部署有没有身份边界」的部署形表行 `identityBoundary` 读同一只):
+ *    `service_token` ⇐ 全局门武装(`systemFor` 只在配了 service token 时回得出值)· `sso` ⇐ 配置里有鉴权桥 issuer(显式或中心回退;起服第 9 段按同一个读数装验签器,
+ *    验签器与配置里的桥两者不一致的装配(任一方向)在 `createHttpServer` 拒)· `direct_door_jwt` ⇐ 直连门开着(`verifiedIdentitySource` 那一臂的第一个合取项);
+ *  · `auth.required` = kinds 里有没有 `service_token` —— 那一词接没接线就是全局凭据门的武装谓词(`hasServiceAuth`;`configuredIdentitySources` 的
  *    `service_token` 臂读的正是它),所以 `required` 与 `kinds` 是同一次求值的两个投影,不是两个来源;
  *  · `auth.identityAttach` = kinds 里有没有**带调用方身份**的一类({@link carriesCallerIdentity},穷举):`service_token` 认的是系统
  *    (`systemFor` 回系统名或 null),不是人;
@@ -19,7 +19,7 @@
  *  · `center.issuer` = 鉴权桥 issuer 的唯一取值 `authBridgeIssuerOf`(装配 `boot/stage-09-leader.ts` 与 caps `centerWiring.issuer` 同读);
  *  · `center.webBaseUrl` = 运维旋钮 `SEMA_WEB_ADMIN_WEB_URL`(`config.webAdmin.webBaseUrl`,接了中心才挂;起服时已判成固定基址);
  *  · `center.sessionsVisible` = 中心的 web 面能不能列出本引擎的会话 —— 四件接线事实全在才可能:中心车道配齐(`centerLaneConfigured`,
- *    租约 / 用量 / 公告同一只谓词)∧ 公告地址在(配置席 `fleetAdvertiseAddress`:web 面只拨中心登记过的实例地址)∧ 鉴权桥在(web 面带的是
+ *    租约 / 用量 / 公告同一只谓词)∧ 公告地址在(配置席 `fleetAdvertiseAddress`:web 面只拨中心登记过的实例地址)∧ 鉴权桥在(kinds 里有 `sso`;web 面带的是
  *    中心铸的中继令牌,不带 service token)∧ 会话枚举面在(事实 `sessionList`,web 面中继 `GET /v1/sessions`);缺任一 ⇒ `false`。
  *    四件齐时:多租户(`REQUIRE_PRINCIPAL`)每条会话都落着验过的属主 ⇒ `true`;单用户形下一条会话归谁取决于提交它的那次请求带没带
  *    身份(web 面只列调用人自己的会话)—— 部署级答不了 ⇒ `"unknown"`。
@@ -36,7 +36,7 @@
  * 三键**恒在场**;缺席 = 老 worker(≤7.120.x)。`center.issuer` / `center.webBaseUrl` 缺席即缺席(没有鉴权桥 / 没配旋钮),不拼不猜。
  */
 import type { FlatServiceDeps } from "./server.js";
-import type { IdentitySource } from "../identity-source.js";
+import { type IdentitySource } from "../identity-source.js";
 /** `auth.identityAttach` 的词表。 */
 export declare const IDENTITY_ATTACH_WORDS: readonly ["available", "unavailable"];
 export type IdentityAttach = (typeof IDENTITY_ATTACH_WORDS)[number];
@@ -62,8 +62,8 @@ export interface HealthSelfReport {
     };
 }
 /**
- * 三键的**唯一铸点**(`build*`:纯数据)。只读装配本身:`auth` 四位都从一次 `wiredIdentitySources` 求值投出(`required` = 其中有 `service_token`;
+ * 三键的**唯一铸点**(`build*`:纯数据)。只读部署本身:`auth` 四位都从一次 `configuredIdentitySources` 求值投出(`required` = 其中有 `service_token`;
  * `serviceTokenActsForDeployment` = `required` ∧ 门读的那一格声明),不收调用方递进来的第二份布尔 —— 一个事实一次求值。
  */
-export declare function buildHealthSelfReport(deps: Pick<FlatServiceDeps, "config" | "webAdminJwtVerifier" | "sessionStorage" | "runStore">): HealthSelfReport;
+export declare function buildHealthSelfReport(deps: Pick<FlatServiceDeps, "config" | "sessionStorage" | "runStore">): HealthSelfReport;
 //# sourceMappingURL=health-self-report.d.ts.map

package/dist/http/health-self-report.js

@@ -1,6 +1,6 @@
-import { serviceTokenDeclaredActsForDeployment, wiredIdentitySources } from "./principal-gate.js";
+import { serviceTokenDeclaredActsForDeployment } from "./principal-gate.js";
+import { authBridgeIssuerOf, configuredIdentitySources } from "../identity-source.js";
 import { operatorLane, sessionList } from "../capability-facts.js";
-import { authBridgeIssuerOf } from "../auth-bridge.js";
 import { centerLaneConfigured } from "../web-admin-client/center-request.js";
 import { buildDisplaySafeUrl } from "../trace/redact.js";
 export const IDENTITY_ATTACH_WORDS = ["available", "unavailable"];
@@ -21,8 +21,8 @@ function carriesCallerIdentity(kind) {
 }
 export function buildHealthSelfReport(deps) {
     const { config } = deps;
-    const bridgeWired = deps.webAdminJwtVerifier !== undefined;
-    const kinds = wiredIdentitySources(deps);
+    const kinds = configuredIdentitySources(config);
+    const bridgeWired = kinds.includes("sso");
     const issuer = authBridgeIssuerOf(config)?.issuer;
     const webBaseUrl = config.webAdmin?.webBaseUrl;
     const sessionsVisible = centerLaneConfigured(config) && config.fleetAdvertiseAddress !== undefined && bridgeWired && sessionList(deps).available ? (config.requirePrincipal ? true : "unknown") : false;

package/dist/http/idempotency.d.ts

@@ -1,5 +1,6 @@
 import type { IncomingMessage } from "node:http";
 import type { ServiceConfig } from "../config-types.js";
+import type { Subject } from "../owner-brands.js";
 import type { WiringManifestReceipt } from "./wire-types.js";
 import type { SubmitReplayFace } from "./submit-replay.js";
 import type { RunIdemBinding } from "../plugins/store-contracts.js";
@@ -36,8 +37,8 @@ export declare class IdempotencyCache<T> {
  * `Idempotency-Key` 的**资源族**闭集 —— 键的作用域里那一位是**资源族,不是端点**。
  *
  *  · `run`    —— 一条 run(`POST /v1/tasks` · `/v1/tasks/stream` · `/v1/runs` · A2A `message/send` 都建同一种行;
- *                同一条 run 换腿重试仍同键,不会重复计费)。同族的两个动词口(`/v1/runs/:id/steer` · `/interrupt`)
- *                也按本族取键,收成引擎的 `inputId`(它们的去重属主是引擎的输入队列,不是本仓的行)。
+ *                同一条 run 换腿重试仍同键,不会重复计费)。同族的动词口 `/v1/runs/:id/steer`
+ *                也按本族取键,收成引擎的 `inputId`(它的去重属主是引擎的输入队列,不是本仓的行;`/interrupt` 是不带输入的 halt,不取键)。
  *  · `leader` —— 一条 leader run(`leader_run.idem_key`)。
  *  · `bake`   —— 一次镜像烘焙(`image_bake.idem_key`)。
  *
@@ -45,12 +46,14 @@ export declare class IdempotencyCache<T> {
  */
 export type IdemFamily = "run" | "leader" | "bake";
 /**
- * 一次提交的**调用方身份**(幂等的作用域就是它)—— 授权口建立的那两样:验过的 principal(`gatedPrincipal`)与凭据族
+ * 一次提交的**调用方身份**(幂等的作用域就是它)—— 授权口建立的那两样:验过的 principal(`gatedSubject`)与凭据族
  * (`source`:鉴权门由出示的服务凭据派生的系统名,`RouteRequestState.source` 是它唯一的赋值点)。由 {@link idemCallerOf}
  * 从请求一处读出;键里用的那一位由 {@link idemIdentityOf} 一处定。
  */
 export interface IdemCaller {
-    readonly principal: string | null | undefined;
+    /** 验过的主体(分区键;`gatedSubject` 的读数,带 `Subject` 品牌 —— 提交重放与 leader 登记表的属主门直接拿它当调用方,不再另铸;
+     *  幂等身份位读它 ⇒ 同一只 `Idempotency-Key` 在同一个人的两个场景里是两把键)。 */
+    readonly subject: Subject | null | undefined;
     readonly source: string | null | undefined;
 }
 /** 本次请求的 {@link IdemCaller} —— 一处读:验过的 principal + 鉴权门派生的凭据族(两样都是既有的席位,这里不另判身份)。 */
@@ -118,7 +121,8 @@ export declare function inflightKeyOf(idem: RunIdemBinding, face: SubmitReplayFa
  * 就成了「键缺席」,而 present-iff 的读法会把它读成「这台引擎不给回执」。挂在 outcome 上 = 它是**这条 run 的
  * 属性**(哪条腿跑的都一样),由各腿自己的应答构造器在送出那一刻按自己的 wire 形挂。
  * 落定之后的同键重放不走这里:它读行,体是首答的信封 + `replay: true`(`http/submit-replay.ts` → `http/sync-submit-body.ts`)—— 回执是起手那一帧
- * 的活捕获、不落行,所以重放体上**不带** `wiringManifest`(`replay: true` 就是那一形的判别位)。
+ * 的活捕获、不落行,所以读行的重放体上**不带** `wiringManifest`。在飞合流的跟随方拿的是这一只 outcome(回执照带)经 `replayedOutcome` 叠位 ——
+ * `replay: true` 只说「这份结局不是本次请求产出的」,不判别带不带回执。
  *
  * 🔴 **租户面安全(别在复审里当成漏)**:合流的那份回执是按**第一位调用方**的 `explicitOperatorOk` 投的,
  * 而键本身就按身份位分区(`idemKeyOf` 的 `principal ?? source`)⇒ 合流到它的只可能是**同一个** principal(无 principal 时

package/dist/http/idempotency.js

@@ -1,6 +1,6 @@
 import { createHash } from "node:crypto";
 import { canonicalJsonStringify } from "@sema-agent/core";
-import { gatedPrincipal } from "./principal-gate.js";
+import { gatedSubject } from "./principal-gate.js";
 export class IdempotencyCache {
     ttlMs;
     sweepThreshold;
@@ -66,11 +66,11 @@ function idemFamilyTag(family) {
     }
 }
 export function idemCallerOf(req, ctx) {
-    return { principal: gatedPrincipal(req, ctx.deps.config), source: ctx.req.source };
+    return { subject: gatedSubject(req, ctx.deps.config), source: ctx.req.source };
 }
 export function idemIdentityOf(caller) {
-    if (caller.principal !== undefined && caller.principal !== null)
-        return `principal\x1e${caller.principal}`;
+    if (caller.subject !== undefined && caller.subject !== null)
+        return `principal\x1e${caller.subject}`;
     if (caller.source !== undefined && caller.source !== null)
         return `source\x1e${caller.source}`;
     return "";

package/dist/http/memory-compliance-failure-reply.d.ts

@@ -8,39 +8,38 @@
  * core 的另外三只 409 与 `ControlPlaneCorruptError` 全落 500 `internal.error` —— 「同一个 requestId 拿去抹另一个会话」这种**调用方自己
  * 能改**的错被说成服务器坏了。两份分类 = 两个判官,少的那份恒是静默的一份。现在**码与状态**只在这里判一次,两面同读。
  *
- * ## 规则(三层,与 operator 面既有层序逐字同序)
+ * ## 规则(两层,与 operator 面既有层序逐字同序)
+ *  ⓪ 先于本映射:两面的 catch 先调记忆面的一只收尾 `sentMemoryFaceFault`(`memory-face-fault-reply.ts`:层拒 / 控制面损坏 `ControlPlaneCorruptError`,
+ *     九只记忆面同一只;控制面损坏一码两义的固定句在那里按面分)—— 本映射只接 core 的带码拒;
  *  ① core 的**本口专属**码(闭集穷举 `switch`,见 {@link sentCoreCode})—— 码与状态两面同;文案按受众(下一节,一条规则);
- *  ② **店形拒**一族(按族表读;成员举例 `memory.target_outside_store` / `memory.scope_home_not_directory` / 引擎 7.65.0 起 `memory.control_plane_links_unsupported`)—— 跨面 store 状态码,409、码原样
+ *  ② **店形拒**一族(按族表读;成员举例 `memory.target_outside_store` / `memory.scope_home_not_directory` / 引擎 7.65.0 起 `memory.control_plane_links_unsupported` / 引擎 7.66.0 起 `memory.control_plane_strays`)—— 跨面 store 状态码,409、码原样
  *     (判据 `memory-store-refusal.ts` 一只;运维行 `memory_store_form_refused { code, path?, form? }` 两受众同一只铸点,路径只在那里);
- *  ③ `ControlPlaneCorruptError` —— typed 500 `internal.memory_control_plane_corrupt`(fail-closed 信号,一码两义;映射本体在 `memory-control-plane-corrupt-reply.ts` 那一只,导出导入 / 外源 / 整理 / 合规各口同调);
  *  其余 ⇒ `false`(未分类,调用方发它自己那句 500 且**不回显**内部文本)。
  *
- * ## 文案按受众分(码与状态不分)—— **一条规则,三层同施,不按码挑**(F9,7.108.0 合并复审 opus 腿 O-9)
- * core 原句是写给运维的诊断材料:③ 点名**宿主路径**(控制面账本文件;② 自 core 7.44.0 起句子不带路径、路径在 `detail.path` ⇒ 运维行),① 的 `selector_mismatch` 带**首个请求的
+ * ## 文案按受众分(码与状态不分)—— **一条规则,各层同施,不按码挑**(F9,7.108.0 合并复审 opus 腿 O-9;⓪ 那只收尾同一条规则)
+ * core 原句是写给运维的诊断材料:控制面损坏点名**宿主路径**(控制面账本文件;② 自 core 7.44.0 起句子不带路径、路径在 `detail.path` ⇒ 运维行),① 的 `selector_mismatch` 带**首个请求的
  * 选择子哈希**(`pinned set <selectHash>`,无盐 sha256 —— operator 选择子可字典还原,首个请求未必是这位会话所有者发的):
  *  · operator 受众 ⇒ 原句上 wire(过了 operator 门,这些材料对这个受众不是泄露);
  *  · 会话所有者受众 ⇒ **一律**一句固定指路(每码一句,只说「怎么办」),原句整句交 `withheld` 落运维 warn —— 不逐码判断哪句安全
- *    (逐码挑 = core 改一句文案就可能静默漏出一样新东西)。② ③ 的固定句**两形都真**:
- *    ② 链先于请求在场 ⇒ 提交点之前拒、什么都没做;提交点之后才换上的链 ⇒ 已删的几条算数、journal 留盘(codex 一审 C1);scope home 不是真目录那一句
- *       同样不许诺零删除(home 被换掉的时刻本层判不出),只指路「运维放回真目录后用同一个 requestId 重发」;
- *    ③ 一码两义 —— 操作前账本读不出 ⇒ 什么都没发生;落定后残留枚举失败 ⇒ 抹除已提交、重放收敛(core 原话)。两句都不许诺零删除,
- *    都指路「运维修好后用同一个 requestId 重发」(两义下这句都对)。本层**不**嗅 core 文案分辨前后(拿上游自由文本当判别式是第二真源)。
+ *    (逐码挑 = core 改一句文案就可能静默漏出一样新东西)。② 的固定句**两形都真**:链先于请求在场 ⇒ 提交点之前拒、什么都没做;提交点之后才换上的链
+ *    ⇒ 已删的几条算数、journal 留盘(codex 一审 C1);scope home 不是真目录那一句同样不许诺零删除(home 被换掉的时刻本层判不出),只指路
+ *    「运维放回真目录后用同一个 requestId 重发」。本层**不**嗅 core 文案分辨前后(拿上游自由文本当判别式是第二真源)。
  */
 import type { ServerResponse } from "node:http";
 import type { Logger } from "../observability/logger.js";
+import type { MemoryFaceAudience } from "./memory-face-fault-reply.js";
 /**
  * 已分类拒 → HTTP 状态的**唯一**码表 = 自铸 wire 值登记处的 `sessionMemoryEraseStatus` 集(F3:wire 变更清单从同一张表 diff,状态改一处、
  * 清单跟着列)。两面同读([ref]:码与状态只判一次)。键写错 ⇒ tsc 红(索引的是 `as const` 表的键)。
  */
-/** 读这张映射的受众(闭集)。会话所有者受众必须交一只 `withheld` —— 被换成固定句的 core 原句落到那里(运维材料不许丢)。 */
-export type MemoryComplianceAudience = {
+/** 读这张映射的受众:记忆面受众闭集里 operator 与会话所有者的抹除面(本映射的固定句都是抹除句;会话所有者的状态面不读它 ⇒ 型面上传不进来)。 */
+export type MemoryComplianceAudience = Extract<MemoryFaceAudience, {
     readonly kind: "operator";
 } | {
-    readonly kind: "session_owner";
-    readonly withheld: (coreMessage: string) => void;
-};
+    readonly face: "erase";
+}>;
 /**
- * 按上面三层应答;返回 `true` = 已应答,`false` = 未分类(一个字节都没写,调用方发它自己那句 500 并落它自己的运维 warn)。
+ * 按上面两层应答;返回 `true` = 已应答,`false` = 未分类(一个字节都没写,调用方发它自己那句 500 并落它自己的运维 warn)。
  * `logger` = 店形拒那一条运维行的去处(两受众同一只;缺席 ⇒ 不落)。
  */
 export declare function sentMemoryComplianceFailure(res: ServerResponse, err: unknown, audience: MemoryComplianceAudience, logger: Pick<Logger, "warn"> | undefined): boolean;

package/dist/http/memory-compliance-failure-reply.js

@@ -1,5 +1,4 @@
 import { logStoreFormRefusal, storeFormRefusalOf } from "../memory-store-refusal.js";
-import { sentControlPlaneCorrupt } from "./memory-control-plane-corrupt-reply.js";
 import { sentMemoryStoreRefusal } from "./memory-store-refusal-reply.js";
 import { sendError } from "./send.js";
 import { assertNever } from "./route-ctx.js";
@@ -66,6 +65,9 @@ export function sentMemoryComplianceFailure(res, err, audience, logger) {
                     case "memory.control_plane_links_unsupported":
                         sendError(res, 409, "memory.control_plane_links_unsupported", "session memory erasure refused — this deployment's memory control plane is on a file system that cannot make hard links, so its memory store does not open and this erasure changed nothing; ask the operator to move the control plane to a volume that supports hard links, then resend with the same requestId");
                         return true;
+                    case "memory.control_plane_strays":
+                        sendError(res, 409, "memory.control_plane_strays", "session memory erasure refused — this deployment's memory engine was not opened because its control plane still holds records from before that its governance store does not read, so this erasure changed nothing; ask the operator to adopt those records into the governance store, then resend with the same requestId");
+                        return true;
                     default:
                         return assertNever(storeForm.code);
                 }
@@ -73,6 +75,6 @@ export function sentMemoryComplianceFailure(res, err, audience, logger) {
                 return assertNever(audience);
         }
     }
-    return sentControlPlaneCorrupt(res, err, audience);
+    return false;
 }
 //# sourceMappingURL=memory-compliance-failure-reply.js.map