@sema-agent/server 7.147.0 → 7.149.0

package/dist/http/owner-access.js

@@ -1,58 +1,393 @@
-import { mintDurableOwnerKey, mintPrincipal, sessionOwnerCellOf } from "../security.js";
+import { createLogger } from "../observability/logger.js";
+import { DEPLOYMENT_SHAPE_PREDICATES } from "../deployment-shape.js";
+import { FACES, fleetOn, listFilterOf, ownerCellOf, qualsOf, visibleOn } from "../owner-faces.js";
+import { mintOwnedRow, partsOf, personOf, subjectOf } from "../owner-brands.js";
+import { sessionCellFor } from "../security.js";
 import { openFaceFaultWire, SessionOwnerUnreadableError } from "../session-error-wire.js";
 import { seatText } from "../trace/exit-seat.js";
-import { explicitOperatorOk, runOwnerReadable, sessionOwnerReadable } from "./principal-gate.js";
-function operatorArmHolds(config, principal, arm) {
-    switch (arm) {
-        case "owner":
-            return false;
-        case "owner_or_operator":
-            return explicitOperatorOk(principal, config);
+import { actsForDeployment, explicitOperatorOk, gatedSubject, sendPrincipalRefusal, sendUnauthorized, traceTokenPresented } from "./principal-gate.js";
+import { RUN_NOT_FOUND_MESSAGE, runNotFoundMessage, SESSION_NOT_FOUND_MESSAGE } from "./route-ctx.js";
+import { sendError, sendJson } from "./send.js";
+export function callerOf(req, w) {
+    const subject = gatedSubject(req, w.config);
+    return {
+        subject,
+        operator: explicitOperatorOk(subject === undefined ? undefined : personOf(subject), w.config),
+        fleet: actsForDeployment(req, w.config, () => subject),
+        traceRead: traceTokenPresented(req, w.config),
+        principalRequired: DEPLOYMENT_SHAPE_PREDICATES.principalRequired.holds(w.config),
+        multiTenant: DEPLOYMENT_SHAPE_PREDICATES.multiTenant.holds(w.config),
+    };
+}
+export function callerOfDecision(base, decider, roster) {
+    return { ...base, subject: deciderSubjectOf(base.subject, decider), operator: explicitOperatorOk(decider, roster), fleet: undefined, traceRead: false };
+}
+export function deciderSubjectOf(requestSubject, decider) {
+    return decider === undefined ? undefined : subjectOf(decider, requestSubject === undefined ? undefined : partsOf(requestSubject).scenario);
+}
+export const ROUTE_FACES = {
+    "runs-submit": null,
+    "runs-by-idem": "run.read",
+    "run-detail": "run.read",
+    "run-events": "run.read",
+    "run-cancel": "run.drive",
+    "run-steer": "run.supervise",
+    "run-interrupt": "run.supervise",
+    "run-detach": "run.supervise",
+    "run-compact": "run.supervise",
+    "run-subagent-output": "run.supervise",
+    "run-subagent-stream": "run.supervise",
+    "run-subagent-steer": "run.supervise",
+    "run-subagent-resume": "run.supervise",
+    "run-task-output": "run.supervise",
+    "run-task-stop": "run.supervise",
+    "elicitation-respond": null,
+    "question-respond": null,
+    "tool-approval-respond": null,
+    "tool-approval-read": null,
+    "task-ask-decision": null,
+    "run-permission-mode": "run.supervise",
+    "run-memory-capture-optout": "run.drive",
+    "session-init": null,
+    "session-settings": null,
+    "session-mcp": null,
+    "session-a2a": null,
+    "session-head": "session.read",
+    "session-execution-placement": "session.placement",
+    "session-events": "session.read",
+    "session-fork": "session.own",
+    "session-policy-get": "session.policy",
+    "session-policy-put": "session.policy",
+    "session-memory-erase": "session.erase",
+    "session-memory-status": "session.read",
+    "session-workspace": null,
+    "session-detail": "session.read",
+    "session-rewind-files": "session.supervise",
+    "session-patch": "session.act",
+    "session-delete": "session.delete",
+    "session-sync-manifest": "session.own",
+    "session-sync-entries": "session.own",
+    "session-sync-plan": "session.own",
+    "session-sync-import": "session.own",
+    "session-sync-import-entries": "session.own",
+    "session-sync-blob-put": "session.own",
+    "session-sync-history-blob": "session.own",
+    "session-memory-sync": "session.act",
+    "session-background-list": "session.supervise",
+    "session-background-stop": "session.supervise",
+    "session-children-retire": "session.supervise",
+    "mcp-reconnect": "session.supervise",
+    "session-wake": null,
+    "session-notify": "session.notify",
+    "tasks-source-summary": "list.read",
+    "task-trace-list": "list.read",
+    "task-tool-result": "run.trace",
+    "task-trace-turns": "run.trace",
+    "task-trace-stream": "run.trace",
+    "task-trace-artifacts": "run.trace",
+    "usage-analytics": "list.read",
+    "approvals-list": null,
+    "approvals-stream": null,
+    "assistant-inbox": null,
+    "assistant-tasks": null,
+    "approval-decide": null,
+    "approval-exemptions-list": "session.exemption",
+    "approval-exemption-delete": "session.exemption",
+    "assistant-task-preempt": "run.preempt",
+    "assistant-task-resume": "run.resume",
+    "assistant-task-plan-review": "run.decision",
+    "sessions-list": "session.list",
+    "sendfile-links": "list.read",
+    "fleet-stream": "list.read",
+    "projects-list": "list.read",
+    "project-get": "list.read",
+    "agents-roster": "list.read",
+};
+export const RUN_STATE_FACES = {
+    "runs-by-idem": "observe",
+    "run-detail": "observe",
+    "run-events": "observe",
+    "run-cancel": "raw",
+    "run-steer": "raw",
+    "run-interrupt": "raw",
+    "run-detach": "raw",
+    "run-compact": "raw",
+    "run-subagent-output": "observe",
+    "run-subagent-stream": "observe",
+    "run-task-output": "observe",
+    "run-task-stop": "observe",
+    "run-subagent-steer": "raw",
+    "run-subagent-resume": "raw",
+    "run-permission-mode": "raw",
+    "run-memory-capture-optout": "raw",
+    "task-tool-result": "raw",
+    "task-trace-turns": "raw",
+    "task-trace-stream": "observe",
+    "task-trace-artifacts": "raw",
+    "assistant-task-preempt": "raw",
+    "assistant-task-resume": "raw",
+    "assistant-task-plan-review": "raw",
+    "run.a2a": "observe",
+    "run.replay": "observe",
+    "run.leader": "raw",
+    "run.preview": "raw",
+    "run.panel": "raw",
+    "run.anchor": "raw",
+};
+export const RUN_SESSION_ASSERTION = {
+    "runs-by-idem": { phase: "accept", label: "run.poll" },
+    "run-detail": { phase: "accept", label: "run.poll" },
+    "run-events": { phase: "accept", label: "run.events" },
+    "run-cancel": { phase: "accept", label: "run.cancel" },
+    "run-steer": { phase: "accept", label: "run.steer" },
+    "run-interrupt": { phase: "accept", label: "run.interrupt" },
+    "run-detach": { phase: "accept", label: "run.detach" },
+    "run-compact": { phase: "accept", label: "run.compact" },
+    "run-subagent-output": { phase: "enforce" },
+    "run-subagent-stream": { phase: "enforce" },
+    "run-task-output": { phase: "enforce" },
+    "run-task-stop": { phase: "enforce" },
+    "run-subagent-steer": { phase: "accept", label: "subagent.steer" },
+    "run-subagent-resume": { phase: "accept", label: "subagent.resume" },
+    "run-permission-mode": { phase: "accept", label: "run.permission_mode" },
+    "run-memory-capture-optout": null,
+    "task-tool-result": null,
+    "task-trace-turns": null,
+    "task-trace-stream": null,
+    "task-trace-artifacts": null,
+    "assistant-task-preempt": null,
+    "assistant-task-resume": null,
+    "assistant-task-plan-review": null,
+    "run.a2a": null,
+    "run.replay": null,
+    "run.leader": null,
+    "run.preview": null,
+    "run.panel": null,
+    "run.anchor": null,
+};
+export function sessionAssertionVerdict(rule, asserted, rowSession, operator) {
+    if (!rowSession)
+        return "pass";
+    if (asserted === null && rule.phase === "accept")
+        return "pass_unasserted";
+    if (asserted === rowSession)
+        return "pass";
+    return operator ? "pass" : "refuse";
+}
+const sessionAssertLog = createLogger();
+const sessionAssertAbsentWarned = new Set();
+export function sessionAsserted(rule, req, rowSession, operator) {
+    const verdict = sessionAssertionVerdict(rule, new URL(req.url ?? "", "http://x").searchParams.get("session"), rowSession, operator);
+    if (verdict === "pass_unasserted" && rule.phase === "accept" && !sessionAssertAbsentWarned.has(rule.label)) {
+        sessionAssertAbsentWarned.add(rule.label);
+        sessionAssertLog.warn("run_face_session_assert_absent", { face: rule.label, note: "caller sent no ?session= on a session-bound run — allowed in the accept phase; the enforcement train will 404 this ([1498]⑥/[1499])" });
+    }
+    return verdict !== "refuse";
+}
+function sessionAssertionHolds(entry, admitted) {
+    const rule = Object.hasOwn(RUN_SESSION_ASSERTION, entry.mouth) ? RUN_SESSION_ASSERTION[entry.mouth] : null;
+    return rule === null || sessionAsserted(rule, entry.req, admitted.row.sessionId, admitted.quals.has("operator"));
+}
+export async function runRowAt(mouth, store, row) {
+    const face = Object.hasOwn(RUN_STATE_FACES, mouth) ? RUN_STATE_FACES[mouth] : undefined;
+    switch (face) {
+        case "observe":
+            return store.observeRun(row);
+        case "raw":
+            return row;
+        case undefined:
+            throw new Error(`owner access: mouth ${mouth} reads a run row but is not registered in RUN_STATE_FACES`);
         default: {
-            const unknownArm = arm;
-            throw new Error(`owner access: unknown arm ${String(unknownArm)}`);
+            const unknownFace = face;
+            throw new Error(`owner access: unknown run-state face ${String(unknownFace)}`);
         }
     }
 }
-export function runRowReadable(config, principal, owner, arm) {
-    if (operatorArmHolds(config, principal, arm))
-        return true;
-    if (owner === undefined)
-        return false;
-    return runOwnerReadable(principal, owner === null ? null : mintDurableOwnerKey(owner), config);
+function faceOfRoute(route) {
+    const face = ROUTE_FACES[route];
+    if (face === null)
+        throw new Error(`owner access: route ${route} has no owner face`);
+    return face;
 }
-export function runRowReadableOnSessionFace(w, caller, owner, arm) {
-    if (operatorArmHolds(w.config, caller.principal, arm))
-        return true;
-    const cell = owner === null ? { owner: null, placed: false } : { owner: mintDurableOwnerKey(owner) };
-    return sessionOwnerReadable(caller, cell, w);
+function doorRefusal(face, faceId, caller) {
+    if (caller.subject !== undefined || fleetOn(faceId, caller))
+        return undefined;
+    switch (face.door) {
+        case "P401":
+            return caller.principalRequired ? "principal" : undefined;
+        case "I401":
+            return "identity";
+        case "I401r":
+            return caller.principalRequired ? "identity" : undefined;
+        case "none":
+            return undefined;
+        default: {
+            const unknownDoor = face.door;
+            throw new Error(`owner access: unknown door ${String(unknownDoor)}`);
+        }
+    }
 }
-export async function readOwnedRun(config, runStore, principal, taskId, arm) {
-    const row = await runStore.getRun(taskId);
-    return row !== undefined && runRowReadable(config, principal, row.owner, arm) ? row : undefined;
+function sendDoorRefusal(entry, res, kind) {
+    if (kind === "principal")
+        sendPrincipalRefusal(res, entry.req, entry.w.config);
+    else
+        sendUnauthorized(res, "identity");
 }
-export async function readOwnedSession(w, store, caller, sessionId, arm) {
-    return (await readOwnedSessionHead(w, store, caller, sessionId, arm))?.cell;
+export function enter(req, res, w, route) {
+    const entry = callerEntry(req, w, route);
+    const refused = doorRefusal(FACES[entry.face], entry.face, entry.caller);
+    if (refused !== undefined) {
+        sendDoorRefusal(entry, res, refused);
+        return undefined;
+    }
+    return entry;
+}
+export function callerEntry(req, w, route) {
+    return { face: faceOfRoute(route), mouth: route, caller: callerOf(req, w), req, w };
+}
+export function protocolEntry(req, w, face, caller) {
+    return { face, mouth: face, caller, req, w };
+}
+export function withCaller(entry, caller) {
+    return { ...entry, caller };
+}
+export function refuse(entry, res, reason, id) {
+    entry.w.logger?.info("owner_gate_refused", { policyFace: entry.face, reason, principalPresent: entry.caller.subject !== undefined });
+    const projection = FACES[entry.face].projection;
+    switch (projection) {
+        case "run_missing":
+            sendError(res, 404, "not_found.run", id === undefined ? RUN_NOT_FOUND_MESSAGE : runNotFoundMessage(id));
+            return;
+        case "task_missing":
+            sendError(res, 404, "not_found.run", "task not found");
+            return;
+        case "decision_missing":
+            if (entry.w.config.directDoorActive)
+                sendError(res, 401, "principal_unverified", "principal proof required");
+            else
+                sendError(res, 404, "not_found.run", "task not found");
+            return;
+        case "session_missing":
+            sendError(res, 404, "not_found.session", SESSION_NOT_FOUND_MESSAGE);
+            return;
+        case "exemption_missing":
+            sendError(res, 404, "not_found.session", "not found");
+            return;
+        case "deleted_false":
+            sendJson(res, 200, { deleted: false });
+            return;
+        case "run_exists":
+        case "attach_absent":
+        case "omit":
+            throw new Error(`owner access: face ${entry.face} projects ${projection} — the caller answers it, refuse() does not`);
+        default: {
+            const unknownProjection = projection;
+            throw new Error(`owner access: unknown projection ${String(unknownProjection)}`);
+        }
+    }
+}
+function rowRead(reading) {
+    return reading !== undefined && reading !== null;
 }
-export async function readOwnedSessionHead(w, store, caller, sessionId, arm) {
-    const head = await store.headOf(sessionId);
-    if (head === undefined || head.owner === undefined)
+function verdictOn(entry, cell) {
+    const face = FACES[entry.face];
+    const quals = qualsOf(entry.caller, cell);
+    if (face.operator && quals.has("operator"))
+        return quals;
+    if (doorRefusal(face, entry.face, entry.caller) !== undefined)
+        return "door";
+    return visibleOn(entry.face, quals) ? quals : "not_visible";
+}
+function judge(entry, row, cell) {
+    const verdict = verdictOn(entry, cell);
+    return verdict === "door" || verdict === "not_visible" ? verdict : { row: mintOwnedRow(row), quals: verdict };
+}
+export function deliverVerdict(entry, res, verdict, id) {
+    if (verdict === "door") {
+        sendDoorRefusal(entry, res, doorRefusal(FACES[entry.face], entry.face, entry.caller));
         return undefined;
-    const cell = await sessionOwnerCellOf(store, sessionId, head.owner);
-    return operatorArmHolds(w.config, caller.principal, arm) || sessionOwnerReadable(caller, cell, w) ? { cell, head } : undefined;
+    }
+    if (verdict === "not_visible") {
+        refuse(entry, res, "not_visible", id);
+        return undefined;
+    }
+    return verdict;
+}
+export async function admitRunRow(entry, res, runStore, row, id) {
+    if (!rowRead(row)) {
+        refuse(entry, res, "missing", id);
+        return undefined;
+    }
+    const admitted = deliverVerdict(entry, res, judge(entry, row, ownerCellOf(row.owner)), id);
+    if (admitted === undefined)
+        return undefined;
+    if (!sessionAssertionHolds(entry, admitted)) {
+        refuse(entry, res, "session_mismatch", id);
+        return undefined;
+    }
+    return { ...admitted, row: mintOwnedRow(await runRowAt(entry.mouth, runStore, admitted.row)) };
+}
+export async function admitRunById(entry, res, runStore, taskId) {
+    return admitRunRow(entry, res, runStore, await runStore.getRun(taskId), taskId);
+}
+export async function readVisibleRun(entry, runStore, taskId) {
+    const row = await runStore.getRun(taskId);
+    return rowRead(row) && seesRun(entry, row.owner) ? runRowAt(entry.mouth, runStore, row) : undefined;
+}
+export function seesRun(entry, owner) {
+    const verdict = verdictOn(entry, ownerCellOf(owner));
+    return verdict !== "door" && verdict !== "not_visible";
 }
-export async function foldOwnerUnreadable(logger, face, sessionId, read) {
+export function seesRunAs(face, caller, owner) {
+    return visibleOn(face, qualsOf(caller, ownerCellOf(owner)));
+}
+export function judgeRun(entry, row) {
+    const verdict = judge(entry, row, ownerCellOf(row.owner));
+    return verdict === "door" || verdict === "not_visible" ? undefined : verdict;
+}
+export function sessionRowPresent(reading) {
+    return rowRead(reading) && reading.owner !== undefined;
+}
+export async function readOwnerCell(entry, sessionId, read) {
+    if (FACES[entry.face].unreadable === "raise")
+        return read();
     try {
         return await read();
     }
     catch (e) {
         if (!(e instanceof SessionOwnerUnreadableError))
             throw e;
-        logger?.warn("session_owner_unreadable", { face, sessionId, errorCode: openFaceFaultWire(e).errorCode, err: seatText("operator-log-text", e.message) });
+        entry.w.logger?.warn("session_owner_unreadable", { face: entry.mouth, sessionId, errorCode: openFaceFaultWire(e).errorCode, err: seatText("operator-log-text", e.message) });
+        return undefined;
+    }
+}
+export async function admitSessionRow(entry, res, store, sessionId, reading) {
+    if (!sessionRowPresent(reading)) {
+        refuse(entry, res, "missing");
         return undefined;
     }
+    return deliverVerdict(entry, res, await judgeSessionRow(entry, store, sessionId, reading));
+}
+export async function judgeSessionRow(entry, store, sessionId, reading) {
+    return judge(entry, reading, await sessionCellFor(entry.face, entry.caller, store, sessionId, reading.owner));
+}
+export async function admitSessionById(entry, res, store, sessionId) {
+    const head = await readOwnerCell(entry, sessionId, () => store.headOf(sessionId));
+    return admitSessionRow(entry, res, store, sessionId, head);
+}
+export async function judgeSession(entry, store, sessionId, reading) {
+    if (!sessionRowPresent(reading))
+        return undefined;
+    const verdict = await judgeSessionRow(entry, store, sessionId, reading);
+    return verdict === "door" || verdict === "not_visible" ? undefined : verdict;
+}
+export function admittedAsFleet(entry, admitted) {
+    return FACES[entry.face].fleet.some((q) => admitted.quals.has(q));
+}
+export function entryIsFleet(entry) {
+    return fleetOn(entry.face, entry.caller);
 }
-export function createLeaderRunVisibility(config) {
-    return (principal, owner) => runRowReadable(config, principal == null ? undefined : mintPrincipal(principal), owner ?? null, "owner");
+export function routeListFilter(req, w, route) {
+    return listFilterOf(faceOfRoute(route), callerOf(req, w));
 }
 //# sourceMappingURL=owner-access.js.map

package/dist/http/principal-gate.d.ts

@@ -1,6 +1,7 @@
 import type { IncomingMessage, ServerResponse } from "node:http";
 import type { ServiceConfig } from "../config-types.js";
-import { type DurableOwnerKey, type Principal, type SessionCaller, type SessionOwnerCell } from "../security.js";
+import { type Person, type Subject } from "../owner-brands.js";
+import type { Caller } from "../owner-faces.js";
 import { type IdentitySource, type RunIdentity } from "../identity-source.js";
 import type { Logger } from "../observability/logger.js";
 /** Coerce a possibly-repeated request header to a single string (or undefined). */
@@ -15,9 +16,10 @@ export declare function systemFor(req: IncomingMessage, config: ServiceConfig):
  *  其他 scheme(Basic 等,非我方凭证空间)不管——由原有门语义处置,避免误伤未知代理注头。 */
 export declare function bearerPresentedButUnverified(req: IncomingMessage, config: ServiceConfig): boolean;
 /** 「这次请求出示了这台部署的只读 trace 凭据(`TRACE_TOKEN`)」—— 一句,三处读:凭据验不过判({@link bearerPresentedButUnverified})、门前读路谓词
- *  (`dispatch.ts` 的 `readCredentialOk`)、fleet 读档的只读臂({@link fleetViewOf})。没配 ⇒ 恒 false。 */
+ *  (`dispatch.ts` 的 `readCredentialOk`)、fleet 读档的只读臂(属主存取器 `owner-access.ts` 的 `callerOf`;列表面经 `owner-faces.ts` 的 `listFilterOf`)。没配 ⇒ 恒 false。 */
 export declare function traceTokenPresented(req: IncomingMessage, config: ServiceConfig): boolean;
-/** loopback 三形(IPv4 / IPv6 / IPv4-mapped)—— 一处定义,diagnostics 门与任何「本机自用」判据同吃。缺席 ⇒ false(fail-closed)。 */
+/** 对端是不是本机 loopback(`127.0.0.1` / `::1`)—— 一处定义,diagnostics 门与任何「本机自用」判据同吃。拼法不在这里判:先过地址的唯一规范形
+ *  (`canonicalAddress`:IPv4-mapped ⇒ 点分 IPv4、IPv6 压缩小写),再比两只规范值。缺席 / 不是地址 ⇒ false(fail-closed)。 */
 export declare function isLoopbackAddress(addr: string | undefined): boolean;
 /**
  * 🔴 **这次请求验过的身份来源 —— 全仓唯一的判定次序**:按 {@link IDENTITY_SOURCES} 的序逐词问,答第一个验得过的词(次序与它为什么是这个次序见
@@ -38,14 +40,20 @@ export declare function admitRunIdentity(req: IncomingMessage, source: IdentityS
  * 新一跑)⇒ 空 —— 属主本人的凭据没有在这次受理里出示过(律 3)。没有请求 / 请求没过凭据门 ⇒ 空。
  */
 export declare function runIdentityOf(req: IncomingMessage | undefined, config: ServiceConfig, owner: string | null): RunIdentity | null;
-export declare function gatedPrincipal(req: IncomingMessage, config: ServiceConfig): Principal | undefined;
+/**
+ * 🔴 **这次请求的主体**(分区键;读口的唯一请求身份读数 —— 人经 {@link gatedPerson} = `personOf(gatedSubject)` 读,不另读请求)。
+ * 主体的判决只在 `security.ts` 的 `verifiedSubject`(三来源的人 + 场景头,记忆化);这里只加「出示了凭据却验不过 ⇒ 没有可信身份」这一条。
+ */
+export declare function gatedSubject(req: IncomingMessage, config: ServiceConfig): Subject | undefined;
+/** 这次请求的人(人面汇点的读数:成本 / 租约 / 运维名册 / 场景裁定)= {@link gatedSubject} 背后的人。 */
+export declare function gatedPerson(req: IncomingMessage, config: ServiceConfig): Person | undefined;
 /**
  * 「**出示了凭证但验不过** ≠ **没出示**」在 **direct-door principal JWT** 面上的形 —— 本仓
  * {@link bearerPresentedButUnverified} 早就是同一条律在 Bearer 面的形,这里只是把它推到另一面。
  *
  * 判据三段,缺一不成立:①这台机器是直连门(BFF/gated 上 `principalHeader` 由上游验过,本函数恒 false ⇒
  * 那条部署形上零行为变化);②`X-Approval-Principal-Token` **在场**(缺席 = 真的没出示,那是
- * `auth.principal_required` 的语义,不许借本码);③它**验不过**({@link verifiedPrincipal} 回 undefined)。
+ * `auth.principal_required` 的语义,不许借本码);③它**验不过**({@link verifiedPerson} 回 undefined)。
  */
 export declare function principalTokenPresentedButUnverified(req: IncomingMessage, config: ServiceConfig): boolean;
 /**
@@ -87,94 +95,36 @@ export declare const UNAUTHORIZED_OPERATOR = "unauthorized \u2014 this endpoint
 export declare const UNAUTHORIZED_IDENTITY = "unauthorized \u2014 this endpoint acts for a named caller and the request carries no caller identity this deployment verifies: identify the caller the way this deployment does (a registry sign-in token as the Bearer token, a signed principal token on a direct-door deployment, or the principal header set by a trusted front end)";
 export declare function sendUnauthorized(res: ServerResponse, face: UnauthorizedFace): void;
 /**
- * 🔴 **「这个调用方读得到这一行 run 吗」的唯一谓词**([ref] 抽取;此前只活在 `server.ts runOwnerOk` 的
- * 函数体里,而 `runOwnerOk` 把**判断**与**404 怎么发**焊在一起 —— 于是任何需要同一条判断但不想 404 的
- * 读面(如 `/mcp` 面板的 `lastLegMcp`:非属主就不投这个键、面板照常 200)只能手抄一份,而手抄那份必然
- * 漏掉下面这条窄互认臂:`explicitOperatorOk` 顶注已经为同族的病写过「SINGLE mint point,不要再造兄弟」)。
- *
- * 三条放行臂,别的一律不放:
- *  · `owner === null` —— 无属主的行(dev / 存量),本来就是开放的;
- *  · `principal === owner` —— 自己的行。⚠️ `principal` 必须是**验过**的身份(`gatedPrincipal`),
- *    不是自述头 —— `owner` 是创建时从验过的 principal 落库的,拿自述头来比就等于谁都能读别人的 run;
- *  · [ref] C8 **窄互认**:非 `requirePrincipal` 部署上那批 `anon:shell-live` 哨兵行 + 无身份的调用方
- *    (cli 停发哨兵头后的存量会话,否则「能续跑但看不见」)。`gatedPrincipal` 的回值是 `string | undefined`
- *    ⇒ 原文那半个 `principal === null` 比较结构上不可达,抽取时一并去掉(语义逐字不变)。
- *
- * **不含 operator 臂**(刻意,[ref]⑥ 台账):跨属主 operator 在 poll/events/cancel 三读面上今天就是 404,
- * 放宽它是一次独立裁定。需要 operator 臂的读面在**自己的调用点**显式并上 {@link explicitOperatorOk} ——
- * 那样「谁多给了 operator 一条路」在代码上看得见,而不是被偷偷塞进共享谓词里。
- */
-export declare function runOwnerReadable(principal: Principal | undefined, owner: DurableOwnerKey | null, config: Pick<ServiceConfig, "requirePrincipal">): boolean;
-/** 「这台部署配了任何一把 service 凭证吗」—— fail-closed 写门族的真值源,也是身份来源 `service_token` 接没接线的那一句。**单一属主**:`handle()` 的
- *  凭证门、[ref] 的 parked 赎回席、[ref] 的 consolidation 阀门启动期告警、以及下面 {@link wiredIdentitySources} 读同一句(手抄迟早只改一处,而这条判据
- *  决定的是「无凭证部署上写口开不开」)。住在本叶(与 {@link systemFor} 同处)而不是 `dispatch.ts`:身份原语只依赖本叶。 */
-export declare function hasServiceAuth(config: ServiceConfig): boolean;
-/** {@link wiredIdentitySources} 读的装配:部署配置 + 入口预认证的鉴权桥(装了才挂身份;`FlatServiceDeps` 结构上满足)。 */
-export interface IdentityWiring {
-    readonly config: ServiceConfig;
-    readonly webAdminJwtVerifier?: object | undefined;
-}
-/**
- * 🔴 **「这台部署的装配能回哪几个身份来源」的唯一读法**({@link IDENTITY_SOURCES} 里接了线的那几个词,序同表)。两处读它、不各写一份:
- * `/health.auth`(自报位,`http/health-self-report.ts`:`kinds` 与 `required` 同一次求值 —— `required` = 其中有 `service_token`)与 {@link devOpenDeployment}(门)
- * —— 于是「这台部署认不认身份、门武没武装」在自报面与门上只有一只答案。
- */
-export declare function wiredIdentitySources(w: IdentityWiring): readonly IdentitySource[];
-/**
- * 🔴 **「这台部署有没有身份边界」的唯一判据**([ref];[ref] 改读身份来源)。dev-open = 装配**没接任何身份来源**({@link wiredIdentitySources} 为空:
- * 没配 service token、没装鉴权桥、没开直连门)、**也没声明**只读 trace token 或 `REQUIRE_PRINCIPAL`:请求里没有任何东西替主体头作保,头是谁都能自报的
- * **标签**(过滤 / 展示用),不是身份。装了鉴权桥的部署(SSO 单开)带登录令牌的调用方是验过的身份 ⇒ 不是 dev-open(修前只看 token / `REQUIRE_PRINCIPAL`,
- * 这一形被读成 dev-open,任何人 fleet-wide 读全部会话)。
- * 三处读它、不各写一份:fleet 调用方的第一臂({@link sessionCallerOf} —— fleet 面的 {@link fleetViewOf} 与会话行属主门都经它)、
- * 会话面的属主谓词({@link sessionOwnerReadable})、`/metrics` 族的免凭据臂(`dispatch.ts`)—— 于是「调用方是谁」在列表、单会话面与指标面上只有一只读法。
- */
-export declare function devOpenDeployment(w: IdentityWiring): boolean;
-/**
- * 🔴 **律(一句,一个参数)**:出示这台部署的 service 凭据且不报主体的调用方代部署本人说话(fleet),**除非部署声明 `SERVICE_TOKEN_ACTS_FOR_DEPLOYMENT=false`**
- * —— 此时它是无身份调用方,按各面既有的「过了凭据门、没有主体」那一臂答。带主体头的 service 凭据请求是前端(BFF)代那位主体发的 —— 它读那位主体,
- * 不读全舰队(两形同读);部署姿态(单用户 / 多租)不改这一句(单用户形上的主体头同样是「这次请求为谁」)。
- * 本函数是这条律的**唯一实施点**:声明位({@link ServiceConfig.serviceTokenActsForDeployment},env 一处)是这里的一个合取项,两个读者一次继承 ——
- * fleet 调用方的凭据臂({@link sessionCallerOf})与 `/metrics` 族的 service 臂(`dispatch.ts`);不加拒码、不加闸点。自报位 `/health.auth.serviceTokenActsForDeployment`
- * 投的是同一只读法({@link serviceTokenDeclaredActsForDeployment})与同一只武装谓词(`http/health-self-report.ts`)。先判声明与凭据、后取主体:`principal` 只在两者都成立时才求值(调用点那一次 {@link gatedPrincipal}),
- * 没带凭据的请求不因主体头的形而改答。
- */
-export declare function actsForDeployment(req: IncomingMessage, config: ServiceConfig, principal: () => Principal | undefined): boolean;
+ * 🔴 **dev-open 的判据** = 部署形表行 `identityBoundary` 不成立(`deployment-shape.ts`;「这台部署有没有身份边界」的唯一答者):
+ * 没声明 `REQUIRE_PRINCIPAL`、配置没接任何已验身份来源(没配 service token、没配鉴权桥 issuer —— 含中心回退、没开直连门)、也没声明只读 trace token:
+ * 请求里没有任何东西替主体头作保,头是谁都能自报的(不是认证)—— 但报了它的请求仍是「为那位主体」,不是为部署本人({@link actsForDeployment})。只读配置:鉴权桥的验签器由起服第 9 段按同一个配置读数建
+ * (配置里有桥 ⇔ 装了验签器;验签器与配置里的桥两者不一致的装配(任一方向)在 `createHttpServer` 拒),所以这里与先于验签器的一次性迁移段读到同一个答案。
+ * 这是部署事实,不是调用方事实:「这位调用方代不代部署本人说话」只有 {@link actsForDeployment} 一只读法(本函数是它的一臂);另一个读者 `dispatch.ts` 的 `/metrics` 族
+ * 只拿它判「配了只读凭据的这台部署上免凭据臂关着,不必读调用方」(凭据先于主体判),不判调用方是谁。
+ */
+export declare function devOpenDeployment(config: ServiceConfig): boolean;
+/** 代部署本人说话的那一格 = 属主存取器 `Caller.fleet` 的词(闭集只在 `owner-faces.ts` 拼一次):`dev_open` = 没有身份边界的部署上不报主体的调用方;`deployment_token` = 出示部署让它代自己说话的 service 凭据、不报主体的调用方。 */
+export type DeploymentVoice = NonNullable<Caller["fleet"]>;
+/**
+ * 🔴 **律(一句)**:**报了主体的调用方恒是那位主体** —— 每一口、每一种部署形(单用户 / 多租、有没有身份边界)都不改这一句;只有**不报主体**的调用方才代部署本人说话(fleet):
+ * 部署没有身份边界({@link devOpenDeployment} ⇒ `dev_open`:整台一人,不报主体的就是那一位 —— 「不报」= 没有主体头,也没出示一枚这台部署验不过的凭据
+ * ({@link bearerPresentedButUnverified}:出示了验不过 ≠ 没出示 —— 那枚凭据把主体头抹成「没有可信身份」,不许再落回最宽的那一格)),或出示这台部署的 service 凭据且部署没声明
+ * `SERVICE_TOKEN_ACTS_FOR_DEPLOYMENT=false`(⇒ `deployment_token`;声明了 ⇒ 它是无身份调用方,按各面既有的「过了凭据门、没有主体」那一臂答)。
+ * 带主体头的请求是前端(BFF)代那位主体发的、或调用方自报的「这次请求为谁」—— 它读那位主体、动那位主体的,不读全舰队;dev-open 上主体头谁都能自报,
+ * 那是部署选了不验身份(要隔离就给部署接一个身份来源),不是把头读成「为部署本人」的理由:提交的挂接(`security.ts` 的认领面)一向按它判属主,读面、列表与存续面同读这一句。
+ * 本函数是这条律的**唯一实施点**,两个读者一次继承 —— 调用方的 fleet 一格(属主存取器 `owner-access.ts` 的 `callerOf`)与 `/metrics` 族(`dispatch.ts`:`dev_open` 臂在没配
+ * `METRICS_TOKEN` 时免凭据,`deployment_token` 臂即 service 臂);不加拒码、不加闸点。自报位 `/health.auth.serviceTokenActsForDeployment` 投的是声明位的同一只读法
+ * ({@link serviceTokenDeclaredActsForDeployment})与同一只武装谓词(`http/health-self-report.ts`)。
+ * 主体只在部署那一格成立时求值(调用点那一次 {@link gatedSubject}):有身份边界的部署上没带 service 凭据的请求不因主体头的形而改答;dev-open 上要判「报没报主体」,
+ * 主体头形不合的请求与其余各口同答那一只 400。
+ */
+export declare function actsForDeployment(req: IncomingMessage, config: ServiceConfig, subject: () => Subject | undefined): DeploymentVoice | undefined;
 /**
  * 声明位 `SERVICE_TOKEN_ACTS_FOR_DEPLOYMENT` 的**唯一读法**:门({@link actsForDeployment})、自报位(`http/health-self-report.ts`)、起服行
  * ({@link buildServiceTokenPostureNotice})三处都经它,不各写一份真值判断。只有字面 `true` 是「代部署本人」:`loadConfig` 恒写这一格(缺省 `true`),
  * 绕过类型手搓的配置缺这一格 ⇒ 读作不代(fail-closed:安全轴上的缺席不静默放宽),三处同读 —— 不会出现「门收窄、自报位说缺席、起服行沉默」。
  */
 export declare function serviceTokenDeclaredActsForDeployment(config: Pick<ServiceConfig, "serviceTokenActsForDeployment">): boolean;
-/**
- * 🔴 **「这个调用方是不是 fleet 调用方(看得到所有租户)」的唯一铸点**({@link SessionCaller}):验过的主体 + 是不是 fleet —— {@link devOpenDeployment} 上的任何
- * 调用方,或 {@link actsForDeployment}(出示 service 凭据、不报主体,除非部署声明 `SERVICE_TOKEN_ACTS_FOR_DEPLOYMENT=false`)。带主体头的是那位主体,不是 fleet;只读 trace token 不是 service 凭据;operator 不在这里
- * (运维口各自读 {@link explicitOperatorOk})。读者:会话行属主门(无主 placed 行的放行臂)与 fleet 面的 {@link fleetViewOf} —— 同一问一只读法。
- */
-export declare function sessionCallerOf(req: IncomingMessage, w: IdentityWiring): SessionCaller;
-/** fleet 面的两档(闭集):`read` = 只读面,只读 trace 凭据在这一档也是 fleet;`write` = 写面,只认 {@link sessionCallerOf}(读凭据不能变成跨租户写权)。 */
-export type FleetFace = "read" | "write";
-/** 一次 fleet 面判定的读数:`fleetWide` = 看全舰队(不钉人);否则 `gateOwner` = 钉住的那位验过的主体,`null` = 没有可用身份(调用点答 401 identity)。 */
-export interface FleetView {
-    readonly fleetWide: boolean;
-    readonly gateOwner: Principal | null;
-}
-/**
- * 🔴 **fleet 面「看全舰队,还是钉住一位主体」的唯一读法**。fleet 判据只有一个来源 —— {@link sessionCallerOf};本函数只把它投成 fleet 面要的两格,
- * 并按档并上只读 trace 凭据(读档)。读者 —— 读档:舰队流、会话列表、发件链接列表、后台名册、trace 五口、用量三口、`/v1/tasks/source-summary`;
- * 写档:删除、fork、同步族(拉取与推送同门)。
- */
-export declare function fleetViewOf(req: IncomingMessage, w: IdentityWiring, face: FleetFace): FleetView;
-/**
- * **「这个调用方能不能动这只会话」的唯一谓词**(会话面:视图 / head / 事件流 / 记忆状态与自助抹除 / 改名置顶 / 后台任务 / MCP 重连 /
- * 面板的上一腿 MCP 投影)。没有身份边界的部署({@link devOpenDeployment})上不钉任何人(与会话列表同读,列表把这只会话列给谁,谁就读得到它);
- * 有身份边界的部署上:
- *  · **无主的行**经无主臂的唯一判据 `ownerlessRowOpen`(`security.ts`):普通会话照旧对任何调用方开放;委派子代的 placed 行只对 fleet 调用方
- *    ({@link sessionCallerOf})开放 —— 任何具名主体、没有 service 凭据的无身份调用方都与别人的行同体(调用点答 404)([ref])。
- *    代价如实:升级前写下、属主还没定下的存量子代行连它将来的属主也暂时读不到(SQL 两店由一次性迁移 M23 在窗内每次起服回填;本机文件店没有回填臂;7.144.0 起没有任何店在停驻时定属主 —— 属主只由建行那一笔记下引擎交来的 `placement.owner`);
- *  · 有主的行就是 run 面那一条谓词({@link runOwnerReadable}),一字不变。
- * run 面(poll / events / cancel …)不读本谓词 —— 那是 run 资源的门,另一只。
- */
-export declare function sessionOwnerReadable(caller: SessionCaller, cell: SessionOwnerCell, w: IdentityWiring): boolean;
 /**
  * 运维名册 —— 「谁是 operator」读的两格(都住在部署配置里):具名名单 `OPERATOR_PRINCIPALS` 与单用户形的显式声明 `OPERATOR_SINGLE_USER`。
  * 两者互斥(声明只在单用户形、名单为空时成立;否则拒启 —— 一个事实一个来源,`config-invariants.ts` 的 `operator-single-user`)。
@@ -186,11 +136,11 @@ export type OperatorRoster = Pick<ServiceConfig, "operatorPrincipals" | "operato
  *  · 名单非空 ⇒ 验过的主体在名单里才是;
  *  · 单用户形显式声明 `OPERATOR_SINGLE_USER=true` ⇒ 这台部署的**每个调用方**都是(单用户形只有一位用户,能到这台部署的就是他;边界是部署自己的
  *    凭据门 —— 没配凭据的部署上,能连上端口的都是)。声明只在单用户形成立(起服不变量)。
- * `principal` 必须是验过的身份(`gatedPrincipal`),绝不是自述头。全部运维面(审批队列、steer / interrupt / wake 的属主门旁路、记忆运维口、bake 门……)读这一只 —— 只答授权;
+ * `person` 必须是验过的人(`gatedPerson` / `personOf(主体)`),绝不是自述头,也不是带场景的主体(名册登记的是人)。全部运维面(审批队列、steer / interrupt / wake 的属主门旁路、记忆运维口、bake 门……)读这一只 —— 只答授权;
  * 送话口的文本框架(`trusted`)从不读它(调用方的话恒 `trusted: false`,见 `routes/runs.ts` steer 口的注);
  * 🔴 SINGLE mint point (E1):不要再造兄弟。
  */
-export declare function explicitOperatorOk(principal: string | undefined, roster: OperatorRoster): boolean;
+export declare function explicitOperatorOk(person: Person | undefined, roster: OperatorRoster): boolean;
 /** 「这台部署**有没有**运维」的唯一读法(名单非空 ∨ 单用户声明在场)—— 能力事实 `operatorLane` 读这一只(整理阀门的可达性告警随本条退役)。单用户形上,装了运维面的进程里它恒真(`operator-declaration-required`:服务进程起服第 1 段、`createHttpServer` 对不声明的单用户形拒),多租形上空名单 ⇒ 假。 */
 export declare function operatorRosterPresent(roster: OperatorRoster): boolean;
 /**