@sema-agent/server 7.147.0 → 7.149.0

package/dist/http/routes/runs.js

@@ -1,10 +1,13 @@
+import { seatText } from "../../trace/exit-seat.js";
 import { liveToolEndForBacklog } from "../../trace/tool-output-media.js";
 import { redactHead, redactLedgerEventForRead } from "../../observability/run-terminal.js";
 import { z } from "zod";
 import { uuidv7, mintCheckpointToken, CheckpointError, policyCannotAnswer, validatePendingSteer, TASK_OUTPUT_REPLAY_KINDS, isSystemInjectionPriority } from "@sema-agent/core";
-import { isTerminalRunStatus, isParkedRunStatus, runProvenElsewhere } from "../../plugins/store-contracts.js";
-import { askOwnerAdmits, askRowCarriesOwner } from "../../plugins/approval-ask-store-sql.js";
+import { isHolderDeathVerdict, isTerminalRunStatus, isParkedRunStatus, runProvenElsewhere } from "../../plugins/store-contracts.js";
+import { askRowCarriesOwner } from "../../plugins/approval-ask-store-sql.js";
 import { LIVE_RUN_GATE_KINDS, TERMINAL_PARK_GATE_KINDS } from "../../plugins/checkpoint-store-face.js";
+import { runCancelCardOf } from "../../run-cancel-card.js";
+import { CARD_EXPIRE_OUTCOME, expireCardUnderStoredScope } from "../../card-settle-stored-scope.js";
 import { redactSecrets } from "../../trace/redact.js";
 import { isUuidV7, encodeCheckpointScope } from "../../security.js";
 import { redactSteerIn, STEER_IN_MAX_CHARS, STEER_IN_MAX_REQUEST_CHARS } from "../../orchestration/workflow-agent-steer.js";
@@ -14,7 +17,7 @@ import { streamSseLog } from "../sse-log.js";
 import { bindSseLifecycle } from "../sse-lifecycle.js";
 import { buildApprovalPreamble, buildApprovalPreambleSseFrames, readClosedWordSeat, storedCardDemandsAPerson } from "../../approval-card.js";
 import { heldAskOf, liveHostSource, readDecider, retiredDecisionKeyFacts, DECIDED_BY_NOT_IN_PROOF, POLICY_CANNOT_ALLOW_PERSON_ASK } from "../../host-decision.js";
-import { ASK_DECISION_CONSUMER_ABSENT, approvalPreambleReplays, outcomeOfDecidedRow, presentedApprovalFrameFamily, resolveStreamApprovalGate } from "../../tool-approval.js";
+import { ASK_DECISION_CONSUMER_ABSENT, approvalPreambleReplays, outcomeOfDecidedRow, parkSessionOf, presentedApprovalFrameFamily, resolveStreamApprovalGate } from "../../tool-approval.js";
 import { MAX_DECISION_NOTE_CHARS, noteLandedOnRow, noteRecordedReceipt } from "../../approval-ask-machine.js";
 import { askRowEndingCause } from "../../approval-deny-reasons.js";
 import { normalizeRunEventType, screenedStoredEventData } from "../../trace/project.js";
@@ -22,21 +25,24 @@ import { invalidJsonError, sendJson, sendError, sendHttpError, sseHeaders } from
 import { mintCancelledResult } from "../../run-cancel-context.js";
 import { acceptedInputKindOf } from "../../user-input-ledger.js";
 import { INJECTION_TIERS } from "../../trace/injection-tier.js";
-import { headerStr, gatedPrincipal, explicitOperatorOk, sendPrincipalRefusal, runIdentityOf } from "../principal-gate.js";
+import { headerStr, gatedSubject, explicitOperatorOk, sendPrincipalRefusal, runIdentityOf } from "../principal-gate.js";
 import { ActorAssertionWire } from "@sema-agent/settings-schema";
 import * as facts from "../../capability-facts.js";
 import { assertNever } from "../route-ctx.js";
 import { readRunFace } from "../run-read-face.js";
 import { replayOfExistingRun } from "../submit-replay.js";
 import { mintAndDriveDurableRun } from "../durable-run-leg.js";
-import { RUN_NOT_FOUND_MESSAGE, runNotFoundMessage } from "../route-ctx.js";
-import { withPrincipal } from "../../observability/principal-context.js";
-import { readResumeCtx } from "../resume-ctx-read.js";
+import { SUBMISSION_CLAIM_FACE } from "../execution-context.js";
+import { admitRunById, admitRunRow, enter, runRowAt } from "../owner-access.js";
+import { keyAdmission, ownerCellOf, recoveredSubject } from "../../owner-faces.js";
+import { personOf } from "../../owner-brands.js";
+import { withSubject } from "../../observability/principal-context.js";
+import { readResumeCtx, resumeCtxUnreadableAnswer } from "../resume-ctx-read.js";
 import { storedBodyReplayAnswer, storedBodyReplayLogFields } from "../checkpoint-ctx.js";
 import { headReadOf } from "../../session-incarnation.js";
 import { serviceVersion } from "../../service-version.js";
 import { storedBodyReplayRefusal } from "../stored-body-replay.js";
-import { steerBodyKeyIssue } from "../../request-key-closure.js";
+import { haltBodyIssue, steerBodyKeyIssue } from "../../request-key-closure.js";
 import { fieldConflictFacts } from "../../field-conflict.js";
 const STEER_PRIORITY_WORDS = INJECTION_TIERS.map((tier) => `'${tier}'`);
 const STEER_PRIORITY_UNION = STEER_PRIORITY_WORDS.join(" | ");
@@ -78,28 +84,16 @@ export function projectDecisionActor(raw) {
     const parsed = AskDecisionActorSchema.safeParse(raw);
     return parsed.success ? parsed.data : undefined;
 }
-async function subagentReadGate(req, res, ctx, runId, search) {
+async function subagentReadGate(req, res, ctx, runId, route) {
     const { deps } = ctx;
-    const principal = gatedPrincipal(req, deps.config);
-    if (deps.config.requirePrincipal && principal === undefined) {
-        sendPrincipalRefusal(res, req, deps.config);
+    const entry = enter(req, res, deps, route);
+    if (entry === undefined)
         return null;
-    }
-    const trusted = explicitOperatorOk(principal, deps.config);
-    const run = await deps.runStore.getRun(runId);
-    if (!run) {
-        sendError(res, 404, "not_found.run", RUN_NOT_FOUND_MESSAGE);
-        return null;
-    }
-    if (!trusted && !ctx.helpers.runOwnerOk(req, res, run.owner)) {
+    const admitted = (await admitRunById(entry, res, deps.runStore, runId));
+    if (admitted === undefined)
         return null;
-    }
-    const callerSession = new URLSearchParams(search).get("session");
-    if (!trusted && run.sessionId && callerSession !== run.sessionId) {
-        sendError(res, 404, "not_found.run", RUN_NOT_FOUND_MESSAGE);
-        return null;
-    }
-    return { run, trusted };
+    const trusted = admitted.quals.has("operator");
+    return { run: admitted.row, trusted };
 }
 function sendHandleMiss(res, run, thisInstanceId) {
     if (isTerminalRunStatus(run.status)) {
@@ -112,7 +106,7 @@ function sendHandleMiss(res, run, thisInstanceId) {
     }
     return false;
 }
-async function streamRunEvents(req, res, deps, runStore, taskId, staleMs) {
+async function streamRunEvents(req, res, deps, runStore, taskId) {
     await streamSseLog(req, res, {
         preamble: async (signal) => {
             const gate = resolveStreamApprovalGate({
@@ -143,7 +137,7 @@ async function streamRunEvents(req, res, deps, runStore, taskId, staleMs) {
         onPreambleFailure: (reason, err) => deps.logger?.warn?.("approval_preamble_failed", { taskId, reason, face: "run.events", error: err instanceof Error ? err.message : String(err ?? "") }),
         statusOf: async (id) => {
             const run = await runStore.getRun(id);
-            return run ? { status: run.status, updatedAt: run.updatedAt } : undefined;
+            return run ? runRowAt("run-events", runStore, run) : undefined;
         },
         getEvents: (id, after) => runStore.getEvents(id, after),
         formatEvent: (ev) => {
@@ -152,13 +146,16 @@ async function streamRunEvents(req, res, deps, runStore, taskId, staleMs) {
             const data = screenedStoredEventData(type, redacted);
             return { id: ev.seq, event: type, data: { type, ...(data ?? {}) } };
         },
-        staleFrame: () => ({ event: "failed", data: { type: "failed", errorMessage: "run stalled (instance lost?)" } }),
-    }, taskId, staleMs);
+        isTerminalEvent: (ev) => ev.type === "done" || ev.type === "failed",
+        closingFrameOf: (row, deliveredTerminal) => !deliveredTerminal && isHolderDeathVerdict(row)
+            ? { event: "failed", data: { type: "failed", ...(row.error !== null ? { errorMessage: seatText("trace-frame-text", row.error) } : {}), errorCode: row.errorCode } }
+            : undefined,
+    }, taskId);
 }
 function sendSteerReplayRefusal(res, refusal) {
     const detail = refusal?.detail;
     const differs = detail !== null && typeof detail === "object" ? readClosedWordSeat(detail, "differs") : undefined;
-    sendError(res, 409, "steering.duplicate_input_id", refusal instanceof Error ? refusal.message : "this steering input id was already accepted with different values", differs !== undefined ? { detail: { differs } } : undefined);
+    sendError(res, 409, "steering.duplicate_input_id", refusal instanceof Error ? refusal.message : "this steering input id was already accepted with different values", differs !== undefined ? { differs } : undefined);
 }
 async function acceptLiveUserInput(deps, res, at) {
     if (!deps.userInputLedger)
@@ -190,7 +187,7 @@ async function relayAcceptedInput(deps, acceptance, call) {
 export async function handleRuns(req, res, match, ctx) {
     const { deps } = ctx;
     const { idemCache, inflightRuns, preemptableRuns, steerableRuns, wakeParkMints } = ctx.registry;
-    const { readJson, rateLimited, quotaExceeded, leaseDenied, usageWindowDenied, runOwnerOk, runSessionAcceptOk } = ctx.helpers;
+    const { readJson, rateLimited, quotaExceeded, leaseDenied, usageWindowDenied } = ctx.helpers;
     const { prepareSpec } = ctx.legs;
     const source = ctx.req.source;
     if (match.decl.id === "runs-submit") {
@@ -201,7 +198,7 @@ export async function handleRuns(req, res, match, ctx) {
         }
         const runStore = runs.runStore;
         const rawIdem = headerStr(req.headers["idempotency-key"]);
-        const submitter = gatedPrincipal(req, deps.config);
+        const submitter = gatedSubject(req, deps.config);
         const keyedBody = rawIdem ? await readJson(req) : undefined;
         const idem = rawIdem ? submissionIdemOf(rawIdem, idemCallerOf(req, ctx), keyedBody) : undefined;
         if (idem) {
@@ -213,14 +210,19 @@ export async function handleRuns(req, res, match, ctx) {
             const inflight = idemCache.peek(inflightKeyOf(idem, "durable", clientTaskId));
             const keyedRow = inflight ? undefined : await runStore.getRunByIdem(idem.key);
             if (inflight || keyedRow) {
-                const resp = inflight ? await inflight : await replayOfExistingRun(keyedRow, { principal: submitter, idem, ...(clientTaskId !== undefined ? { clientTaskId } : {}) }, "durable", deps, runStore);
+                const resp = inflight ? await inflight : await replayOfExistingRun(keyedRow, { subject: submitter, idem, ...(clientTaskId !== undefined ? { clientTaskId } : {}) }, "durable", deps, runStore);
                 sendJson(res, resp.status, resp.body);
                 return;
             }
         }
         if (rateLimited(req, res) || quotaExceeded(req, res))
             return;
-        const prepared = await prepareSpec(req, res, keyedBody);
+        const body = rawIdem ? keyedBody : await readJson(req);
+        if (!idem && clientTaskIdOf(body) === false) {
+            sendError(res, 400, "request.id_invalid", "body.taskId must be a uuidv7 string (caller-minted idempotency key)");
+            return;
+        }
+        const prepared = await prepareSpec(req, res, body);
         if (!prepared)
             return;
         try {
@@ -241,12 +243,11 @@ export async function handleRuns(req, res, match, ctx) {
             return;
         }
         const runStore = runs.runStore;
-        if (deps.config.requirePrincipal && !gatedPrincipal(req, deps.config)) {
-            sendPrincipalRefusal(res, req, deps.config);
+        const entry = enter(req, res, deps, match.decl.id);
+        if (entry === undefined)
             return;
-        }
         let run;
-        let notFound;
+        let pathId;
         if (match.decl.id === "runs-by-idem") {
             const rawKey = new URLSearchParams(match.search).get("idempotencyKey");
             if (!rawKey) {
@@ -254,27 +255,20 @@ export async function handleRuns(req, res, match, ctx) {
                 return;
             }
             run = await runStore.getRunByIdem(idemKeyOf(rawKey, idemCallerOf(req, ctx), "run"));
-            notFound = RUN_NOT_FOUND_MESSAGE;
         }
         else {
-            const taskId = match.params.taskId;
-            run = await runStore.getRun(taskId);
-            notFound = runNotFoundMessage(taskId);
-        }
-        if (!run) {
-            sendError(res, 404, "not_found.run", notFound);
-            return;
+            pathId = match.params.taskId;
+            run = await runStore.getRun(pathId);
         }
-        const taskId = run.taskId;
-        if (!runOwnerOk(req, res, run.owner))
-            return;
-        if (!runSessionAcceptOk(req, res, run, match.decl.id === "run-events" ? "run.events" : "run.poll"))
+        const admitted = await admitRunRow(entry, res, runStore, run, pathId);
+        if (admitted === undefined)
             return;
+        const taskId = admitted.row.taskId;
         if (match.decl.id === "run-events") {
-            await streamRunEvents(req, res, deps, runStore, taskId, deps.config.runStaleSec * 1000);
+            await streamRunEvents(req, res, deps, runStore, taskId);
         }
         else {
-            sendJson(res, 200, await readRunFace(deps, runStore, run));
+            sendJson(res, 200, await readRunFace(deps, runStore, admitted.row));
         }
         return;
     }
@@ -285,29 +279,22 @@ export async function handleRuns(req, res, match, ctx) {
             return;
         }
         const runStore = runs.runStore;
-        if (deps.config.requirePrincipal && !gatedPrincipal(req, deps.config)) {
-            sendPrincipalRefusal(res, req, deps.config);
+        const entry = enter(req, res, deps, match.decl.id);
+        if (entry === undefined)
             return;
-        }
         const taskId = match.params.taskId;
-        const run = await runStore.getRun(taskId);
-        if (!run) {
-            sendError(res, 404, "not_found.run", runNotFoundMessage(taskId));
-            return;
-        }
-        if (!runOwnerOk(req, res, run.owner))
-            return;
-        if (!runSessionAcceptOk(req, res, run, "run.cancel"))
+        const cancelAdmitted = (await admitRunById(entry, res, runStore, taskId));
+        if (cancelAdmitted === undefined)
             return;
+        const run = cancelAdmitted.row;
         const rs = runStore;
-        const cancelSuspended = async () => {
+        const cancelSuspended = async (parked) => {
             const cs = deps.checkpointStore;
             let note = "cancelled while suspended (pending approval settled)";
             if (cs) {
-                const token = await cs.findPendingTokenBySession(run.sessionId, undefined, { gateKinds: LIVE_RUN_GATE_KINDS });
+                const token = await runCancelCardOf(cs, run.sessionId);
                 if (token) {
-                    const cp = await cs.get(token);
-                    const won = cp ? await cs.expire(token, cp.scope) : false;
+                    const won = (await expireCardUnderStoredScope(cs, token)) === CARD_EXPIRE_OUTCOME.expired;
                     if (!won) {
                         const now = await rs.getRun(taskId);
                         const st = now?.status;
@@ -341,7 +328,7 @@ export async function handleRuns(req, res, match, ctx) {
             }
             const err = note;
             try {
-                const result = mintCancelledResult({ taskId, sessionId: run.sessionId, startedAtMs: Date.parse(run.createdAt), message: err, cause: "cancel_verb" });
+                const result = mintCancelledResult({ taskId, sessionId: run.sessionId, startedAtMs: Date.parse(run.createdAt), message: err, cause: "cancel_verb", parkedResult: parked });
                 let lastErr;
                 for (let attempt = 0;; attempt++) {
                     try {
@@ -376,7 +363,7 @@ export async function handleRuns(req, res, match, ctx) {
             for (let attempt = 0; !flagged; attempt++) {
                 const now = await runStore.getRun(taskId);
                 if (now !== undefined && isParkedRunStatus(now.status)) {
-                    await cancelSuspended();
+                    await cancelSuspended(now.result);
                     return;
                 }
                 if (now?.status === "running" && attempt < CANCEL_RECLASSIFY_ATTEMPTS) {
@@ -394,7 +381,7 @@ export async function handleRuns(req, res, match, ctx) {
             sendJson(res, 202, { taskId, status: "cancelling", cancelRequested: true });
         }
         else if (isParkedRunStatus(run.status)) {
-            await cancelSuspended();
+            await cancelSuspended(run.result);
         }
         else {
             sendJson(res, 202, { taskId, status: run.status, cancelRequested: run.cancelRequested, note: "run already terminal — cancel is a no-op" });
@@ -410,11 +397,9 @@ export async function handleRuns(req, res, match, ctx) {
             return;
         }
         const runStore = runs.runStore;
-        const principal = gatedPrincipal(req, deps.config);
-        if (deps.config.requirePrincipal && principal === undefined) {
-            sendPrincipalRefusal(res, req, deps.config);
+        const entry = enter(req, res, deps, match.decl.id);
+        if (entry === undefined)
             return;
-        }
         const taskId = match.params.taskId;
         const body = ((await readJson(req)) ?? {});
         if (typeof body.text !== "string" || body.text.length === 0) {
@@ -440,7 +425,6 @@ export async function handleRuns(req, res, match, ctx) {
         const priority = body.priority;
         const steerIdemRaw = headerStr(req.headers["idempotency-key"]);
         const messageId = steerIdemRaw ? `idem-${idemKeyOf(steerIdemRaw, idemCallerOf(req, ctx), "run").slice(0, 32)}` : uuidv7();
-        const operator = explicitOperatorOk(principal, deps.config);
         const steerInput = () => ({
             text,
             trusted: false,
@@ -457,15 +441,10 @@ export async function handleRuns(req, res, match, ctx) {
             }
             throw e;
         }
-        const run = await runStore.getRun(taskId);
-        if (!run) {
-            sendError(res, 404, "not_found.run", runNotFoundMessage(taskId));
-            return;
-        }
-        if (!operator && !runOwnerOk(req, res, run.owner))
-            return;
-        if (!runSessionAcceptOk(req, res, run, "run.steer"))
+        const steerAdmitted = (await admitRunById(entry, res, runStore, taskId));
+        if (steerAdmitted === undefined)
             return;
+        const run = steerAdmitted.row;
         let parkQueueFull;
         let parkDuplicateKey;
         const tryPark = async () => {
@@ -473,7 +452,7 @@ export async function handleRuns(req, res, match, ctx) {
             if (!park.available)
                 return "no-store";
             const cs = park.checkpointStore;
-            const parkBinding = { gateKinds: LIVE_RUN_GATE_KINDS };
+            const parkBinding = { gateKinds: LIVE_RUN_GATE_KINDS, axis: "run" };
             const scope = await cs.peekPendingScope(run.sessionId, parkBinding);
             if (scope === null || scope === undefined)
                 return "no-checkpoint";
@@ -583,7 +562,7 @@ export async function handleRuns(req, res, match, ctx) {
                 return;
             }
             const prior = wakeParkMints.get(run.sessionId) ?? Promise.resolve();
-            const mintResult = { parked: false, queueFull: false, duplicateKey: false, noResumeCtx: false };
+            const mintResult = { parked: false, queueFull: false, duplicateKey: false, noResumeCtx: false, unreadableCtx: false };
             const parkOnce = async (t, sc) => {
                 try {
                     if (await deps.checkpointStore.setPendingSteer(t, sc, steerInput()))
@@ -638,6 +617,10 @@ export async function handleRuns(req, res, match, ctx) {
                     mintResult.unsealableCtx = resumeRead;
                     return;
                 }
+                if (resumeRead.kind === "unreadable") {
+                    mintResult.unreadableCtx = true;
+                    return;
+                }
                 if (resumeRead.kind === "absent") {
                     mintResult.noResumeCtx = true;
                     return;
@@ -661,7 +644,11 @@ export async function handleRuns(req, res, match, ctx) {
                     createdAt: Date.now(),
                     sourceSessionId: run.sessionId,
                 });
-                const stillRead = await readResumeCtx(cs.getCtx(run.sessionId), { sessionId: run.sessionId, opener: deps.checkpointCtxSealing });
+                const withdrawThenRethrow = async (e) => {
+                    await withdrawWakeCard(wakeToken, cpScope, "resume_context_defect");
+                    throw e;
+                };
+                const stillRead = await readResumeCtx(cs.getCtx(run.sessionId), { sessionId: run.sessionId, opener: deps.checkpointCtxSealing }).catch(withdrawThenRethrow);
                 if (stillRead.kind === "corrupt" || stillRead.kind === "unsealable") {
                     await withdrawWakeCard(wakeToken, cpScope, stillRead.kind === "corrupt" ? "resume_context_corrupt" : "resume_context_unsealable");
                     if (stillRead.kind === "corrupt")
@@ -670,12 +657,17 @@ export async function handleRuns(req, res, match, ctx) {
                         mintResult.unsealableCtx = stillRead;
                     return;
                 }
+                if (stillRead.kind === "unreadable") {
+                    await withdrawWakeCard(wakeToken, cpScope, "resume_context_unreadable");
+                    mintResult.unreadableCtx = true;
+                    return;
+                }
                 if (stillRead.kind !== "ok") {
                     await withdrawWakeCard(wakeToken, cpScope, "resume_context_absent");
                     mintResult.noResumeCtx = true;
                     return;
                 }
-                const winner = await cs.findPendingTokenBySession(run.sessionId, undefined, { gateKinds: TERMINAL_PARK_GATE_KINDS, pick: "oldest" }).catch(() => null);
+                const winner = await cs.findPendingTokenBySession(run.sessionId, undefined, { gateKinds: TERMINAL_PARK_GATE_KINDS, pick: "oldest", axis: "run" }).catch(() => null);
                 if (winner !== null && winner !== wakeToken) {
                     await withdrawWakeCard(wakeToken, cpScope, "converged_on_winner");
                     await parkOnce(winner, cpScope);
@@ -708,6 +700,11 @@ export async function handleRuns(req, res, match, ctx) {
                 sendError(res, 409, "conflict.checkpoint_ctx_unsealable", "run already ended and this session's stored resume context holds credentials this server cannot unseal (reason says why) — nothing was queued, because POST /v1/sessions/:id/wake could not resume it; restore the sealed-key directory that sealed them, restart this server (it reads its keys only at startup) and steer again, or submit a new task instead", { field: mintResult.unsealableCtx.field, reason: mintResult.unsealableCtx.reason });
                 return;
             }
+            if (mintResult.unreadableCtx) {
+                const { status, body: { error, errorCode, ...facts } } = resumeCtxUnreadableAnswer();
+                sendError(res, status, errorCode, error, facts);
+                return;
+            }
             if (mintResult.unservable !== undefined) {
                 deps.logger?.warn?.("steer_wake_park_refused_stored_body", { taskId, sessionId: run.sessionId, ...storedBodyReplayLogFields(mintResult.unservable) });
                 const { status, body: { error, errorCode, ...rest } } = storedBodyReplayAnswer(mintResult.unservable, serviceVersion(), false);
@@ -735,62 +732,23 @@ export async function handleRuns(req, res, match, ctx) {
             return;
         }
         const runStore = runs.runStore;
-        const principal = gatedPrincipal(req, deps.config);
-        if (deps.config.requirePrincipal && principal === undefined) {
-            sendPrincipalRefusal(res, req, deps.config);
+        const entry = enter(req, res, deps, match.decl.id);
+        if (entry === undefined)
             return;
-        }
         const taskId = match.params.taskId;
-        const interruptRaw = await readJson(req);
-        const interruptNormalized = interruptRaw === null || interruptRaw === undefined ? {} : interruptRaw;
-        if (typeof interruptNormalized !== "object" || Array.isArray(interruptNormalized)) {
-            sendError(res, 400, "request.body_shape", "body must be {} (bare halt: cut the in-flight turn and stop the run at this boundary) or { text: string (non-empty) } (cut + steer: the text reaches the model after the cut)");
-            return;
-        }
-        const interruptBody = interruptNormalized;
-        const interruptBare = !("text" in interruptBody);
-        let text = "";
-        if (!interruptBare) {
-            if (typeof interruptBody.text !== "string" || interruptBody.text.length === 0) {
-                sendError(res, 400, "request.body_shape", "body must be {} (bare halt: cut the in-flight turn and stop the run at this boundary) or { text: string (non-empty) } (cut + steer: the text reaches the model after the cut)");
-                return;
-            }
-            text = interruptBody.text;
-        }
-        const keyIssue = steerBodyKeyIssue(interruptBody, "interrupt");
-        if (keyIssue) {
-            sendError(res, 400, "request.body_shape", keyIssue.message, { unknownKeys: keyIssue.unknownKeys, unsupportedKeys: keyIssue.unsupportedKeys });
+        const haltIssue = haltBodyIssue(await readJson(req));
+        if (haltIssue) {
+            sendError(res, 400, "request.body_shape", haltIssue.message, { unknownKeys: haltIssue.unknownKeys, unsupportedKeys: haltIssue.unsupportedKeys });
             return;
         }
-        const interruptIdemRaw = headerStr(req.headers["idempotency-key"]);
-        const interruptInputId = interruptIdemRaw ? `idem-${idemKeyOf(interruptIdemRaw, idemCallerOf(req, ctx), "run").slice(0, 32)}` : uuidv7();
-        const interruptMessageId = interruptInputId;
-        const operator = explicitOperatorOk(principal, deps.config);
-        if (!interruptBare) {
-            try {
-                validatePendingSteer({ text, trusted: false, inputId: interruptInputId });
-            }
-            catch (e) {
-                if (e instanceof CheckpointError && e.code === "steering.invalid_content") {
-                    sendError(res, 422, "steering.invalid_content", e.message);
-                    return;
-                }
-                throw e;
-            }
-        }
-        const run = await runStore.getRun(taskId);
-        if (!run) {
-            sendError(res, 404, "not_found.run", runNotFoundMessage(taskId));
-            return;
-        }
-        if (!operator && !runOwnerOk(req, res, run.owner))
-            return;
-        if (!runSessionAcceptOk(req, res, run, "run.interrupt"))
+        const interruptAdmitted = (await admitRunById(entry, res, runStore, taskId));
+        if (interruptAdmitted === undefined)
             return;
+        const run = interruptAdmitted.row;
         const sendInterruptNotRunning = (error) => sendError(res, 409, "steering.not_running", error);
         const sendNoLiveTurn = (status, streamJustSettled) => {
             if (isParkedRunStatus(status)) {
-                sendError(res, 409, "interrupt.nothing_in_flight", "run is waiting on a pending decision — there is no in-flight turn to interrupt; to deliver input use POST /v1/runs/:id/steer (it waits with the pending decision and is delivered when the run resumes)");
+                sendError(res, 409, "interrupt.nothing_in_flight", "run is waiting on a pending decision — there is no in-flight turn to interrupt; answer that decision to let the run resume, or POST /v1/runs/:id/cancel to stop the run");
                 return;
             }
             if (streamJustSettled) {
@@ -814,53 +772,23 @@ export async function handleRuns(req, res, match, ctx) {
             sendNoLiveTurn(run.status, false);
             return;
         }
-        if (interruptBare) {
-            let haltReceipt;
-            try {
-                haltReceipt = await liveStream.halt();
-            }
-            catch (e) {
-                if (e.code !== "steering.not_running")
-                    throw e;
-                const freshRun = await runStore.getRun(taskId).catch(() => undefined);
-                sendNoLiveTurn(freshRun?.status ?? run.status, true);
-                return;
-            }
-            sendJson(res, 202, {
-                taskId,
-                status: run.status,
-                turnCut: haltReceipt.turnCut,
-                note: "halt accepted — cut + stop: turnCut reports whether THIS call cut a live turn (repeat calls answer turnCut:false once the stop is latched). A halt that CONSUMES (it cut a turn, or stopped the loop at a boundary) ends the run at that boundary as status:\"completed\" with haltedByUser:true — resume by submitting the next objective on the same session. Each real cut is marked by a task.turn_interrupted event with detail.cause:\"user_halt\". A halt racing the run's natural last moments consumes NOTHING: the run's own ending stands (completed with the answer as result, or failed when the model's own abort owns the final) and the result does NOT carry haltedByUser — the only trace of that halt is a task.halt_unconsumed engine notice.",
-            });
-            return;
-        }
-        const acceptance = await acceptLiveUserInput(deps, res, { messageId: interruptMessageId, sessionId: run.sessionId, taskId, leg: liveStream, tier: "now" });
-        if (acceptance === "refused")
-            return;
+        let haltReceipt;
         try {
-            await relayAcceptedInput(deps, acceptance, () => liveStream.steer(text, { trusted: false, priority: "now", ...(interruptInputId !== undefined ? { inputId: interruptInputId } : {}) }));
+            haltReceipt = await liveStream.halt();
         }
         catch (e) {
-            const code = e.code;
-            if (code === "steering.invalid_content") {
-                sendError(res, 422, "steering.invalid_content", e instanceof Error ? e.message : "invalid steering content");
-                return;
-            }
-            if (code === "steering.blocked_by_hook") {
-                sendError(res, 422, "steering.blocked_by_hook", e instanceof Error ? e.message : "the deployment's userPromptSubmit hook refused this input (fail-closed)");
-                return;
-            }
-            if (code === "steering.duplicate_input_id") {
-                sendSteerReplayRefusal(res, e);
-                return;
-            }
-            if (code !== "steering.not_running")
+            if (e.code !== "steering.not_running")
                 throw e;
             const freshRun = await runStore.getRun(taskId).catch(() => undefined);
             sendNoLiveTurn(freshRun?.status ?? run.status, true);
             return;
         }
-        sendJson(res, 202, { taskId, status: run.status, delivery: "queued-immediate", messageId: interruptMessageId, note: "interrupt accepted — the cut is best-effort: a task.turn_interrupted event on the run stream is the proof a turn was actually cut; with nothing in flight the text lands at the next turn boundary" });
+        sendJson(res, 202, {
+            taskId,
+            status: run.status,
+            turnCut: haltReceipt.turnCut,
+            note: "halt accepted — cut + stop: turnCut reports whether THIS call cut a live turn (repeat calls answer turnCut:false once the stop is latched). A halt that CONSUMES (it cut a turn, or stopped the loop at a boundary) ends the run at that boundary as status:\"completed\" with haltedByUser:true — resume by submitting the next objective on the same session. Each real cut is marked by a task.turn_interrupted event with detail.cause:\"user_halt\". A halt racing the run's natural last moments consumes NOTHING: the run's own ending stands (completed with the answer as result, or failed when the model's own abort owns the final) and the result does NOT carry haltedByUser — the only trace of that halt is a task.halt_unconsumed engine notice.",
+        });
         return;
     }
     if (match.decl.id === "run-compact") {
@@ -872,22 +800,14 @@ export async function handleRuns(req, res, match, ctx) {
             return;
         }
         const runStore = runs.runStore;
-        const principal = gatedPrincipal(req, deps.config);
-        if (deps.config.requirePrincipal && principal === undefined) {
-            sendPrincipalRefusal(res, req, deps.config);
+        const entry = enter(req, res, deps, match.decl.id);
+        if (entry === undefined)
             return;
-        }
         const taskId = match.params.taskId;
-        const run = await runStore.getRun(taskId);
-        if (!run) {
-            sendError(res, 404, "not_found.run", RUN_NOT_FOUND_MESSAGE);
-            return;
-        }
-        const operator = explicitOperatorOk(principal, deps.config);
-        if (!operator && !runOwnerOk(req, res, run.owner))
-            return;
-        if (!runSessionAcceptOk(req, res, run, "run.compact"))
+        const compactAdmitted = (await admitRunById(entry, res, runStore, taskId));
+        if (compactAdmitted === undefined)
             return;
+        const run = compactAdmitted.row;
         const parsed = await readJson(req);
         if (parsed === null || typeof parsed !== "object") {
             sendHttpError(res, invalidJsonError("not_object"));
@@ -927,27 +847,19 @@ export async function handleRuns(req, res, match, ctx) {
             return;
         }
         const runStore = runs.runStore;
-        const principal = gatedPrincipal(req, deps.config);
-        if (deps.config.requirePrincipal && principal === undefined) {
-            sendPrincipalRefusal(res, req, deps.config);
+        const entry = enter(req, res, deps, match.decl.id);
+        if (entry === undefined)
             return;
-        }
         const taskId = match.params.taskId;
         const body = ((await readJson(req)) ?? {});
         if (typeof body.toolCallId !== "string" || body.toolCallId.length === 0 || body.toolCallId.length > 256) {
             sendError(res, 400, "request.body_shape", "body must be { toolCallId: string (non-empty, ≤256 chars) }");
             return;
         }
-        const run = await runStore.getRun(taskId);
-        if (!run) {
-            sendError(res, 404, "not_found.run", RUN_NOT_FOUND_MESSAGE);
-            return;
-        }
-        const operator = explicitOperatorOk(principal, deps.config);
-        if (!operator && !runOwnerOk(req, res, run.owner))
-            return;
-        if (!runSessionAcceptOk(req, res, run, "run.detach"))
+        const detachAdmitted = (await admitRunById(entry, res, runStore, taskId));
+        if (detachAdmitted === undefined)
             return;
+        const run = detachAdmitted.row;
         const live = steerableRuns.get(taskId);
         if (!live) {
             sendError(res, 409, "detach.not_running", run.status === "running" ? "run is active on another replica — detach is replica-local" : `run is ${run.status} — no running tool call to detach`);
@@ -961,7 +873,7 @@ export async function handleRuns(req, res, match, ctx) {
 }
 export async function handleRunVerbs(req, res, match, ctx) {
     const { deps } = ctx;
-    const { readJson, rateLimited, quotaExceeded, ownerQuotaDenied, leaseDenied, ownerLeaseDenied, safeDecode, runOwnerOk, runSessionAcceptOk } = ctx.helpers;
+    const { readJson, rateLimited, quotaExceeded, ownerQuotaDenied, leaseDenied, ownerLeaseDenied, safeDecode } = ctx.helpers;
     if (match.decl.id === "run-subagent-output") {
         const outputFact = facts.subagentOutput(deps);
         if (!outputFact.available) {
@@ -976,7 +888,7 @@ export async function handleRunVerbs(req, res, match, ctx) {
             sendError(res, 400, "request.path_malformed", "malformed subagent path (invalid percent-encoding)");
             return;
         }
-        const gated = await subagentReadGate(req, res, ctx, runId, match.search);
+        const gated = await subagentReadGate(req, res, ctx, runId, match.decl.id);
         if (!gated)
             return;
         const { run } = gated;
@@ -1004,7 +916,7 @@ export async function handleRunVerbs(req, res, match, ctx) {
             sendError(res, 400, "request.path_malformed", "malformed subagent path (invalid percent-encoding)");
             return;
         }
-        const gatedTail = await subagentReadGate(req, res, ctx, runId, match.search);
+        const gatedTail = await subagentReadGate(req, res, ctx, runId, match.decl.id);
         if (!gatedTail)
             return;
         const { run } = gatedTail;
@@ -1072,7 +984,7 @@ export async function handleRunVerbs(req, res, match, ctx) {
             sendError(res, 400, "request.path_malformed", "malformed task path (invalid percent-encoding)");
             return;
         }
-        const gatedB = await subagentReadGate(req, res, ctx, runId, match.search);
+        const gatedB = await subagentReadGate(req, res, ctx, runId, match.decl.id);
         if (!gatedB)
             return;
         const { run } = gatedB;
@@ -1137,11 +1049,9 @@ export async function handleRunVerbs(req, res, match, ctx) {
             return;
         }
         const runStore = steerFact.runStore;
-        const principal = gatedPrincipal(req, deps.config);
-        if (deps.config.requirePrincipal && principal === undefined) {
-            sendPrincipalRefusal(res, req, deps.config);
+        const entry = enter(req, res, deps, match.decl.id);
+        if (entry === undefined)
             return;
-        }
         const runId = safeDecode(match.params.runId);
         const target = safeDecode(match.params.sub);
         if (runId === null || target === null) {
@@ -1164,16 +1074,10 @@ export async function handleRunVerbs(req, res, match, ctx) {
             sendError(res, 413, "steer.content_too_large", `content exceeds ${STEER_IN_MAX_REQUEST_CHARS} characters (got ${body.content.length}); note only the first ${STEER_IN_MAX_CHARS} are delivered anyway`);
             return;
         }
-        const trusted = explicitOperatorOk(principal, deps.config);
-        const run = await runStore.getRun(runId);
-        if (!run) {
-            sendError(res, 404, "not_found.run", RUN_NOT_FOUND_MESSAGE);
-            return;
-        }
-        if (!trusted && !runOwnerOk(req, res, run.owner))
-            return;
-        if (!runSessionAcceptOk(req, res, run, `subagent.${verb}`))
+        const childAdmitted = (await admitRunById(entry, res, runStore, runId));
+        if (childAdmitted === undefined)
             return;
+        const run = childAdmitted.row;
         const send409 = (errorCode, error) => sendError(res, 409, errorCode, error);
         const redacted = redactSteerIn(body.content, target);
         const resolution = steerFact.registry.resolve(runId, target);
@@ -1194,7 +1098,7 @@ export async function handleRunVerbs(req, res, match, ctx) {
                     if (await ownerLeaseDenied(res, run.owner ?? undefined))
                         return;
                     const resumeFn = handle.resume;
-                    const marker = await withPrincipal(run.owner ?? undefined, () => resumeFn(redacted));
+                    const marker = await withSubject(recoveredSubject(run.owner), () => resumeFn(redacted));
                     sendJson(res, 200, { taskId: runId, target, status: "running", delivery: "applied", marker, note: `Message queued for delivery to ${handle.agentName ?? target}; it will continue in the background.` });
                     return;
                 }
@@ -1241,7 +1145,7 @@ export async function handleRunVerbs(req, res, match, ctx) {
             sendError(res, 501, "feature.elicitation_disabled", "inbound MCP elicitation is not enabled on this worker (MCP_ELICITATION_ENABLED)");
             return;
         }
-        const principal = gatedPrincipal(req, deps.config);
+        const principal = gatedSubject(req, deps.config);
         if (deps.config.requirePrincipal && principal === undefined) {
             sendPrincipalRefusal(res, req, deps.config);
             return;
@@ -1260,7 +1164,7 @@ export async function handleRunVerbs(req, res, match, ctx) {
             sendError(res, 501, "feature.ask_question_disabled", "AskUserQuestion live HITL is not enabled on this worker (ASK_QUESTION_ENABLED)");
             return;
         }
-        const principal = gatedPrincipal(req, deps.config);
+        const principal = gatedSubject(req, deps.config);
         if (deps.config.requirePrincipal && principal === undefined) {
             sendPrincipalRefusal(res, req, deps.config);
             return;
@@ -1279,7 +1183,7 @@ export async function handleRunVerbs(req, res, match, ctx) {
             sendError(res, 501, "feature.tool_approval_disabled", "live tool-approval HITL is not enabled on this worker (TOOL_APPROVAL_ENABLED)");
             return;
         }
-        const principal = gatedPrincipal(req, deps.config);
+        const principal = gatedSubject(req, deps.config);
         if (deps.config.requirePrincipal && principal === undefined) {
             sendPrincipalRefusal(res, req, deps.config);
             return;
@@ -1308,7 +1212,7 @@ export async function handleRunVerbs(req, res, match, ctx) {
             return;
         }
         const askStore = streamFact.askStore;
-        const principal = gatedPrincipal(req, deps.config);
+        const principal = gatedSubject(req, deps.config);
         if (deps.config.requirePrincipal && principal === undefined) {
             sendPrincipalRefusal(res, req, deps.config);
             return;
@@ -1350,9 +1254,8 @@ export async function handleRunVerbs(req, res, match, ctx) {
             askNotFound();
             return;
         }
-        const ownerOk = askOwnerAdmits(row0.owner, principal);
-        const operatorOk = explicitOperatorOk(principal, deps.config);
-        if (!ownerOk && !operatorOk) {
+        const askAdmission = keyAdmission("ask.decide", { subject: principal, operator: explicitOperatorOk(principal === undefined ? undefined : personOf(principal), deps.config) }, ownerCellOf(row0.owner));
+        if (askAdmission === undefined) {
             askNotFound();
             return;
         }
@@ -1360,7 +1263,7 @@ export async function handleRunVerbs(req, res, match, ctx) {
             id: principal ?? "_",
             ...(body.actor ? { label: redactSecrets(body.actor.label).slice(0, ASK_ACTOR_LABEL_MAX) } : {}),
             verified: principal !== undefined,
-            via: ownerOk ? "owner" : "operator",
+            via: askAdmission === "row" ? "owner" : "operator",
         };
         const decidedRowIsAuthoritative = (row) => {
             if (row.state !== "DECIDED" || row.decision !== "approve" && row.decision !== "deny" || row.provisional || row.decidedAtMs === null) {
@@ -1423,7 +1326,7 @@ export async function handleRunVerbs(req, res, match, ctx) {
                 }
                 case "PARKED":
                     sendError(res, 410, "gone.ask_parked", "the in-stream window closed and this ask was parked onto the durable approval gate — decide it through that gate for the session echoed here", {
-                        sessionId: row.sessionId,
+                        sessionId: parkSessionOf(row),
                         gateBoundCallId: row.gateBoundCallId,
                         gateBoundInputHash: row.gateBoundInputHash,
                     });
@@ -1576,31 +1479,43 @@ export async function handleRunVerbs(req, res, match, ctx) {
     return assertNever(match.decl.id);
 }
 export async function createDurableRun(req, res, ctx, prepared, idem) {
+    try {
+        const out = await createDurableRunHeld(req, res, ctx, prepared, idem);
+        await prepared.seat.close();
+        return out;
+    }
+    catch (err) {
+        await prepared.seat.close();
+        throw err;
+    }
+}
+async function createDurableRunHeld(req, res, ctx, prepared, idem) {
     const { deps } = ctx;
     const { idemCache } = ctx.registry;
     const { leaseDenied, usageWindowDenied, admitRun } = ctx.helpers;
+    const seat = prepared.seat;
     const source = ctx.req.source;
     const runs = facts.durableRuns(deps);
     if (!runs.available) {
-        sendError(res, 501, "capability.run_store_required", "async runs require a durable run store (DB_BACKEND=mysql|pg|local)");
+        await seat.deliverTerminal(() => sendError(res, 501, "capability.run_store_required", "async runs require a durable run store (DB_BACKEND=mysql|pg|local)"));
         return null;
     }
     const runStore = runs.runStore;
     const clientTaskId = clientTaskIdOf(prepared.body);
     if (clientTaskId === false) {
-        sendError(res, 400, "request.id_invalid", "body.taskId must be a uuidv7 string (caller-minted idempotency key)");
+        await seat.deliverTerminal(() => sendError(res, 400, "request.id_invalid", "body.taskId must be a uuidv7 string (caller-minted idempotency key)"));
         return null;
     }
-    const submitter = gatedPrincipal(req, deps.config);
-    const caller = { principal: submitter, idem, ...(clientTaskId !== undefined ? { clientTaskId } : {}) };
+    const submitter = gatedSubject(req, deps.config);
+    const caller = { subject: submitter, idem, ...(clientTaskId !== undefined ? { clientTaskId } : {}) };
     if (clientTaskId) {
         const existing = await runStore.getRun(clientTaskId);
         if (existing)
             return await replayOfExistingRun(existing, caller, "durable", deps, runStore);
     }
-    if ((await leaseDenied(req, res)) || (await usageWindowDenied(req, res)))
+    if ((await leaseDenied(req, res, seat)) || (await usageWindowDenied(req, res, seat)))
         return null;
-    const runSlot = admitRun(req, res);
+    const runSlot = await admitRun(req, res, seat);
     if (runSlot === undefined)
         return null;
     return await idemCache.run(idem !== undefined ? inflightKeyOf(idem, "durable", clientTaskId) : undefined, async () => {
@@ -1611,10 +1526,13 @@ export async function createDurableRun(req, res, ctx, prepared, idem) {
             fleetScope: submitter ?? "default",
             elicitOwner: submitter ?? null,
             source,
-            identity: runIdentityOf(req, deps.config, prepared.auth?.principal ?? null),
+            identity: runIdentityOf(req, deps.config, prepared.auth?.subject ?? null),
             runSlot,
+            face: SUBMISSION_CLAIM_FACE,
         });
-        return out.existing ? await replayOfExistingRun(out.existing, caller, "durable", deps, runStore) : out;
+        const receipt = out.existing ? await replayOfExistingRun(out.existing, caller, "durable", deps, runStore) : out;
+        await prepared.seat.close();
+        return receipt;
     }).finally(() => runSlot.release());
 }
 function clientTaskIdOf(body) {