@sema-agent/server 7.148.0 → 7.149.0

package/dist/store-posture.js

@@ -176,10 +176,27 @@ export function buildStorePosture(a) {
         ...(a.degradedReason !== undefined ? { degradedReason: a.degradedReason } : {}),
         durability: weakestDurability(roots.map((r) => r.verdict)),
         roots,
+        ...localDeclarationOf(backend, a.localDeclaration),
     };
 }
+function localDeclarationOf(backend, declaration) {
+    switch (backend) {
+        case "local":
+            if (declaration === undefined)
+                throw new Error("store posture: a local backend was assembled without the declaration it handed its stores — wiring defect (read it back from the backend)");
+            return { localDeclaration: declaration };
+        case "memory":
+        case "mysql":
+        case "pg":
+            return {};
+        default: {
+            const unhandled = backend;
+            throw new Error(`store posture: unknown backend kind ${String(unhandled)}`);
+        }
+    }
+}
 export function unwiredStorePosture(declared) {
-    return buildStorePosture({ declared, assembled: undefined, degradedReason: undefined, evidence: undefined, memoryRootWired: false });
+    return buildStorePosture({ declared, assembled: undefined, degradedReason: undefined, evidence: undefined, memoryRootWired: false, localDeclaration: undefined });
 }
 export function buildStoreFreshStartLine(posture, evidence) {
     if (posture.backend !== "local" || evidence.dataRootHeldData)

package/dist/stores-sql/checkpoint-store-sql.d.ts

@@ -40,7 +40,7 @@ export declare const CHECKPOINT_ADDED_COLUMNS: ReadonlyArray<{
  *
  * 判据 = **能力探测**(恒空的 `WHERE 1=0` 读)+ **方言的缺列错误码**({@link isMissingColumnError},
  * 判据属主 `sql-errors.ts`);其余错误**原样 rethrow**,一个字都不加工 —— 把一次瞬时故障诊断成「缺列」的拒因
- * 比它要挡的缺陷更贵([ref] 两轮收窄的结论逐字继承)。拒因的出路是**闭集三条**(与整库对账同一份,{@link describeProbedTableDrift}),
+ * 比它要挡的缺陷更贵([ref] 两轮收窄的结论逐字继承)。拒因的出路是**闭集三条**(与整库对账同一份,{@link probedMissingColumnRefusal}),
  * 没有销毁性的一条:这张表里是在飞的停驻,出路是原表上加列。
  *
  * 位置:与三条先例同款,不在 `ensureSchema` 里(那条通道的契约是「只发 CREATE」),放在 boot 的

package/dist/stores-sql/checkpoint-store-sql.js

@@ -8,7 +8,7 @@ import { recordFailOpen } from "../observability/fail-open.js";
 import { durableRowIdentity, withoutCheckpointToken } from "../checkpoint-identity.js";
 import { mysqlDriver, pgDriver, dialectProtocolJsonEncoder } from "../plugins/sql-driver.js";
 import { isDupKeyError, isMissingColumnError, rowTooLargeOrSelf, StoreRowTooLargeError } from "../plugins/sql-errors.js";
-import { describeProbedTableDrift } from "../plugins/schema-drift-sentence.js";
+import { probedMissingColumnRefusal } from "../plugins/schema-drift-sentence.js";
 import { MANAGED_RETENTION, UNMANAGED_RETENTION } from "../plugins/retention-declaration.js";
 import { approvalPayloadFingerprint } from "../plugins/approval-payload-fingerprint.js";
 import { approvalDecisionOfWinner, boundedRuleOffers, boundedToolInput, candidateIdentityOf, DECIDED_REPLAY_SCAN_CAP, DENY_SWEEP_PAGE_ROWS, isUnreadableSummaryForm, parkedLegTaskId, queueRowGateKind, queueTriageOrder, readRiskDescriptorBody, TERMINAL_BACKSTOP_MS, TERMINAL_GRACE_MS, UnreadableCheckpointRowError, } from "../plugins/checkpoint-store-face.js";
@@ -77,12 +77,10 @@ export async function assertCheckpointColumnSchema(query, dialect) {
         catch (err) {
             if (!isMissingColumnError(err, dialect))
                 throw err;
-            throw new Error(`checkpoint is missing the column ${column} — refusing to start. ` +
+            throw await probedMissingColumnRefusal(query, dialect, ["checkpoint"], `checkpoint is missing the column ${column} — refusing to start. ` +
                 `On this table ${breaksAt} — at runtime, after a healthy-looking boot. ` +
                 "The table holds IN-FLIGHT durable parks (suspended approvals/reviews awaiting a decision), so the way forward is an in-place " +
-                "ALTER that keeps them; `checkpoint_ctx`, run rows and every other persistent face are untouched.\n" +
-                `Underlying probe error: ${err instanceof Error ? err.message : String(err)}\n\n` +
-                (await describeProbedTableDrift(query, dialect, ["checkpoint"])));
+                "ALTER that keeps them; `checkpoint_ctx`, run rows and every other persistent face are untouched.", err);
         }
     }
 }

package/dist/stores-sql/file-history-store-sql.d.ts

@@ -208,7 +208,7 @@ export declare class PgFileHistoryStore extends SqlFileHistoryStore {
  * ONLY a provable missing-column error gets the missing-column refusal — everything else
  * (timeout / reset / permission / missing table) rethrows untouched: diagnosing a connection blip as a
  * schema drift is more expensive than the defect this gate exists to stop. The refusal's ways out are the
- * closed set of three shared with the whole-database check (`describeProbedTableDrift`); none of them
+ * closed set of three shared with the whole-database check (`probedMissingColumnRefusal`); none of them
  * is destructive. Honest cost statement: the history lives in these tables (per-file REWIND history,
  * working-tree convenience state) — session transcripts and every other durable subsystem are untouched.
  */

package/dist/stores-sql/file-history-store-sql.js

@@ -3,7 +3,7 @@ import { captureFileBackupViaEnv, applyFileRestoreViaEnv, fileHistoryModeProvenD
 import { BlobTooLargeError, SqlBlobIndex } from "./blob-index-sql.js";
 import { mysqlDriver, pgDriver } from "../plugins/sql-driver.js";
 import { isMissingColumnError, retryOnDeadlock } from "../plugins/sql-errors.js";
-import { describeProbedTableDrift } from "../plugins/schema-drift-sentence.js";
+import { probedMissingColumnRefusal } from "../plugins/schema-drift-sentence.js";
 import { recordFailOpen } from "../observability/fail-open.js";
 import { foldCaughtFailure } from "../file-history-disclosure.js";
 export const FILE_HISTORY_BLOB_TABLE = "file_history_blob";
@@ -844,12 +844,10 @@ export async function assertFileHistorySchema(query, dialect) {
         catch (err) {
             if (!isMissingColumnError(err, dialect))
                 throw err;
-            throw new Error(`${table} is missing required columns — refusing to start. This build's per-file rewind history (S-15) ` +
+            throw await probedMissingColumnRefusal(query, dialect, [table], `${table} is missing required columns — refusing to start. This build's per-file rewind history (S-15) ` +
                 `references every probed column unconditionally; a partial table would fail mid-write and could publish a ` +
                 `half-shaped history graph. The file_history_* tables hold the per-file REWIND history (working-tree convenience ` +
-                `state); session transcripts and all other durable subsystems are untouched, and an in-place ALTER keeps the history.\n` +
-                `Underlying probe error: ${err instanceof Error ? err.message : String(err)}\n\n` +
-                (await describeProbedTableDrift(query, dialect, [table])));
+                `state); session transcripts and all other durable subsystems are untouched, and an in-place ALTER keeps the history.`, err);
         }
     }
 }

package/dist/stores-sql/tool-result-store-sql.d.ts

@@ -22,7 +22,7 @@ export declare function ensureSchema(pool: PgPool | PgPoolClient): Promise<void>
  * 一句看不出根因的话。这正是「响亮或 fail-closed,禁静默降级」那条要挡的形态。
  *
  * 判据用**能力探测**而不是版本号/information_schema:发一条恒空的 `WHERE 1=0` 读,列不在就报错。
- * 探针读抛且是**可证**的缺列 ⇒ 拒启(其余错误原样上抛,与兄弟探针同一条规则)。拒因的出路是**闭集三条**(与整库对账同一份,{@link describeProbedTableDrift} / {@link schemaWaysOut}),没有销毁性的一条:
+ * 探针读抛且是**可证**的缺列 ⇒ 拒启(其余错误原样上抛,与兄弟探针同一条规则)。拒因的出路是**闭集三条**(与整库对账同一份,{@link probedMissingColumnRefusal} / {@link schemaWaysOut}),没有销毁性的一条:
  * 缺的出处两列由对账同一套件逐条打印 `ALTER TABLE tool_result ADD COLUMN …`;键宽不够则第 (2) 条是部署者自己把 `ref` 加宽到本构建的定义。
  */
 export declare function assertToolResultProvenanceSchema(query: (sql: string) => Promise<{

package/dist/stores-sql/tool-result-store-sql.js

@@ -3,7 +3,7 @@ import { pgSanitizeText } from "../plugins/pg-safe-json.js";
 import { mysqlDriver, pgDriver } from "../plugins/sql-driver.js";
 import { MANAGED_RETENTION, UNMANAGED_RETENTION } from "../plugins/retention-declaration.js";
 import { ensureIndexes } from "../plugins/ensure-index.js";
-import { describeProbedTableDrift, schemaWaysOut } from "../plugins/schema-drift-sentence.js";
+import { probedMissingColumnRefusal, schemaMismatchRefusal, schemaWaysOut } from "../plugins/schema-drift-sentence.js";
 import { isMissingColumnError } from "../plugins/sql-errors.js";
 export const PG_TOOL_RESULT_SCHEMA = [
     `CREATE TABLE IF NOT EXISTS tool_result (
@@ -29,7 +29,7 @@ export async function assertToolResultProvenanceSchema(query, dialect) {
         : "SELECT character_maximum_length AS len FROM information_schema.columns WHERE table_schema = current_schema() AND table_name = 'tool_result' AND column_name = 'ref'").catch(() => ({ rows: [] }));
     const width = Number(widthRow.rows[0]?.len ?? NaN);
     if (Number.isFinite(width) && width < MAX_MINTED_TOOL_RESULT_REF_CHARS) {
-        throw new Error(`tool_result.ref is VARCHAR(${width}) but core 5.26.0 mints refs up to ${MAX_MINTED_TOOL_RESULT_REF_CHARS} characters ` +
+        throw schemaMismatchRefusal(`tool_result.ref is VARCHAR(${width}) but core 5.26.0 mints refs up to ${MAX_MINTED_TOOL_RESULT_REF_CHARS} characters ` +
             `(#119 made the ref injective: four \`~\`-separated segments) — refusing to start. A truncating primary key aliases two distinct refs onto ` +
             `one row — one run's tool output reads back from another run's ref. ` +
             `The ${dialect === "pg" ? "PostgreSQL" : "MySQL-protocol"} database is behind this build on that key column; offloaded results are a recoverable-window cache, ` +
@@ -46,13 +46,11 @@ export async function assertToolResultProvenanceSchema(query, dialect) {
     catch (err) {
         if (!isMissingColumnError(err, dialect))
             throw err;
-        throw new Error(`tool_result is missing the #119 provenance columns (owner_session_id / owner_task_id) — refusing to start. ` +
+        throw await probedMissingColumnRefusal(query, dialect, ["tool_result"], `tool_result is missing the #119 provenance columns (owner_session_id / owner_task_id) — refusing to start. ` +
             `This release picks up @sema-agent/core 5.26.0, which changed how an offloaded tool result is addressed ` +
             `(the ref grew past the old VARCHAR(190) key) and made the store record who wrote each row. Without the columns every offload write ` +
             `fails with unknown column and core's failure arm turns it into an inline placeholder — the service keeps running and the tool output is lost. ` +
-            `Offloaded tool results are a recoverable-window cache (the inline previews in transcripts are unaffected).\n` +
-            `Underlying probe error: ${err instanceof Error ? err.message : String(err)}\n\n` +
-            (await describeProbedTableDrift(query, dialect, ["tool_result"])));
+            `Offloaded tool results are a recoverable-window cache (the inline previews in transcripts are unaffected).`, err);
     }
 }
 function toolResultAgeCutoff(now, opts) {

package/dist/task-a2a.d.ts

@@ -57,7 +57,7 @@ export declare const A2A_PEER_DISPOSITION: {
     readonly toolAxes: "engine";
 };
 /** 请求体 `a2aPeers[i]` 的键闭集 = 处置表的键(书写序即判序)。 */
-export declare const A2A_PEER_ENTRY_KEYS: readonly ("url" | "name" | "headers" | "cardUrl" | "principalHeader" | "allowSkills" | "toolAxes")[];
+export declare const A2A_PEER_ENTRY_KEYS: readonly ("url" | "name" | "headers" | "toolAxes" | "principalHeader" | "cardUrl" | "allowSkills")[];
 /**
  * **请求入口的一次读**(`boot/resolve-spec.ts` 在腿首铸一份,受理门与读器——续跑重放腿只有读器——都吃这一份):`body.a2aPeers` 若是数组,返回同形数组
  * (每个对象条目换成它的 {@link PeerSnapshot};非对象条目原样;长度保真 —— 界外的条数仍是受理门撞帽拒与读器丢弃留声的依据,只快照界内的条目);不是数组(缺席 / `null` / 别的形)原样返回。
@@ -68,8 +68,6 @@ export declare const A2A_PEER_ENTRY_KEYS: readonly ("url" | "name" | "headers" |
 export declare function snapshotRequestA2a(raw: unknown, options: {
     readonly reread: boolean;
 }): unknown;
-/** 读这条对端的是哪条腿:`fresh` = 新提交;`resume` = 续跑重放升级前存下的请求体(`boot/resolve-spec.ts` 的 `opts.leg` 分流,同一个读法)。 */
-type A2aRequestLeg = "fresh" | "resume";
 /** 请求面对端 → 草稿:按 {@link A2A_PEER_DISPOSITION} 拆(`headers` 进件,其余进声明;拆法与 MCP 请求腿同一只 `splitDeclaration`)。件缺席或空 ⇒ 草稿不带件。纯函数,不登记。 */
 export declare function toA2aDraft(peer: RequestA2aPeer): A2aDraft;
 /**
@@ -81,8 +79,8 @@ export declare function validateRequestA2a(raw: unknown): {
     dropped: A2aInjectionDrop[];
 } | null;
 /**
- * 一份请求的 `a2aPeers` 里,读器挂得上、`headers` 却剔掉了成员的那些坐标(`a2aPeers[<下标>].headers.__proto__`:成员名过回显清洗,只会是读器的保留名,不带值、不带调用方写的对端名)——
- * 「请求成员读不出」那一只判据(`unread-request-members.ts`)的 A2A 一座。读器与挂载同一只({@link normalizeA2aPeer},续跑重放腿的读法;新提交腿上同一形由判官表 400)。
+ * 一份请求的 `a2aPeers` 里,读器挂得上、`headers` 却剔掉了成员的那些坐标(`a2aPeers[<下标>].headers.<保留名>`:成员名只会是契约包保留成员名表里的名字,不带值、不带调用方写的对端名)——
+ * 「请求成员读不出」那一只判据(`unread-request-members.ts`)的 A2A 一座。读器与挂载同一只({@link normalizeA2aPeer},只有一种读法;新提交腿上同一形先由判官表 400)。
  * 挂不上的对端不算(整条不进,有自己的留声)。`storedToolAxes` = 续跑重放腿递的 M19 重读座。不是数组 ⇒ 空。
  */
 export declare function requestA2aHeadersUnread(raw: unknown, storedToolAxes?: StoredToolAxesRereadM19): string[];
@@ -123,9 +121,6 @@ desk: Pick<PeerDesk, "declare">, lease: PeerLease, logger?: {
     info?(m: string, meta?: unknown): void;
     warn(m: string, meta?: unknown): void;
 }, 
-/** 哪条腿在读(`boot/resolve-spec.ts` 按 `opts.leg` 递;缺省 = 新提交,最严的读法):只决定 `headers` 里 `__proto__` 名成员的处置(见 {@link normalizeA2aPeer})。 */
-leg?: A2aRequestLeg, 
 /** 一次性迁移 M19 的重读座(窗口见 `plugins/one-time-migrations.ts` 登记表):只在续跑重放腿、只在窗开着时由 `boot/resolve-spec.ts` 递进来 —— 与 MCP 请求腿同一份。 */
 storedToolAxes?: StoredToolAxesRereadM19): A2aServerSpec[] | undefined;
-export {};
 //# sourceMappingURL=task-a2a.d.ts.map

package/dist/task-a2a.js

@@ -1,11 +1,11 @@
 import { types } from "node:util";
 import { resolveComplianceDenies } from "@sema-agent/core";
-import { describeNotStringArray, describeValueShape, findUrlCredential, isStringArray } from "@sema-agent/settings-schema";
+import { describeNotStringArray, describeValueShape, findUrlCredential, isStringArray, readPlainStringRecord } from "@sema-agent/settings-schema";
 import { errorKindOf } from "./observability/err-text.js";
-import { declarationKeys, readPlainStringRecord, splitDeclaration } from "./plain-string-record.js";
+import { declarationKeys, splitDeclaration } from "./request-declaration-disposition.js";
 import { mintDeclaration, peerSentence } from "./peer-seat.js";
 import { readRequestToolAxes } from "./request-tool-axes.js";
-import { MAX_KEY_ECHO, echoKeyName, keyClosureClause, scanKeyNames } from "./request-key-closure.js";
+import { MAX_KEY_ECHO, keyClosureClause, scanKeyNames } from "./request-key-closure.js";
 import { urlCredentialHeaderExit, urlCredentialRefusalReason } from "./url-credential-refusal.js";
 import { createMountSeat, declarationEntryNotObject, declarationIssueFacts, declarationNameIssue, declarationOverCapFacts, declaredName, judgeDeclarationKeys, requestDeclarationRefusal, throwDeclarationRefusal, } from "./request-declaration-refusal.js";
 import { sendHeaderOwnershipIssue } from "./task-mcp.js";
@@ -53,7 +53,12 @@ function peerUrlIssue(key) {
     };
 }
 const A2A_SEND_HEADER_PATHS = { headers: "headers", principalHeader: "principalHeader" };
-const HEADERS_RESERVED_MEMBER_PATH = "headers.__proto__";
+function readPeerHeaders(raw) {
+    const read = readPlainStringRecord(raw);
+    if (!read.ok)
+        return { record: undefined, issues: [{ path: "headers", reason: `must be a plain object of string values — ${read.detail}` }] };
+    return { record: read.record, issues: read.reservedMembers.map((name) => ({ path: `headers.${name}`, reason: `no member of a declaration may be named "${name}"` })) };
+}
 const PEER_SNAPSHOT = Symbol("a2aPeerSnapshot");
 function openCloneNode(v, ancestors) {
     if (v === null || v === undefined || typeof v === "string" || typeof v === "number" || typeof v === "boolean")
@@ -134,7 +139,7 @@ function mintPeerSnapshot(entry, reread) {
         cardUrl: source.cardUrl,
         principalHeader: source.principalHeader,
         allowSkills: Array.isArray(allowSkills) ? Array.from(allowSkills) : allowSkills,
-        headers: headers === undefined ? undefined : readPlainStringRecord(headers),
+        headers: headers === undefined ? undefined : readPeerHeaders(headers),
         toolAxes: toolAxesRead,
         toolAxesDeclared: reread && toolAxesRead !== undefined && !toolAxesRead.ok ? cloneDeclaration(toolAxes) : undefined,
         unknownKeys: Object.keys(source).filter((name) => !A2A_PEER_ENTRY_KEY_SET.has(name)),
@@ -162,18 +167,10 @@ const A2A_PEER_KEY_JUDGES = {
     name: declarationNameIssue,
     url: peerUrlIssue("url"),
     cardUrl: peerUrlIssue("cardUrl"),
-    headers: (o) => {
-        const read = o.headers;
-        if (read === undefined)
-            return undefined;
-        if (!read.ok)
-            return { path: "headers", reason: `must be a plain object of string values — ${read.member === undefined ? read.fault : `its member "${echoKeyName("", read.member)}" ${read.fault}`}` };
-        const reserved = read.stripped[0];
-        return reserved === undefined ? undefined : { path: HEADERS_RESERVED_MEMBER_PATH, reason: reserved.fault };
-    },
+    headers: (o) => o.headers?.issues[0],
     principalHeader: (o) => o.principalHeader !== undefined && typeof o.principalHeader !== "string"
         ? { path: "principalHeader", reason: `must be a string (a header name) — got ${describeValueShape(o.principalHeader)}` }
-        : sendHeaderOwnershipIssue({ headers: o.headers?.ok === true ? o.headers.record : undefined, principalHeader: o.principalHeader }, "a2a", A2A_SEND_HEADER_PATHS),
+        : sendHeaderOwnershipIssue({ headers: o.headers?.record, principalHeader: o.principalHeader }, "a2a", A2A_SEND_HEADER_PATHS),
     allowSkills: (o) => o.allowSkills === undefined || isStringArray(o.allowSkills)
         ? undefined
         : { path: "allowSkills", reason: `must be an array of strings (omit the key to leave the peer's skills unrestricted) — got ${describeNotStringArray(o.allowSkills)}` },
@@ -182,19 +179,20 @@ const A2A_PEER_KEY_JUDGES = {
         return read === undefined || read.ok ? undefined : toolAxesIssue(read);
     },
 };
-function normalizeA2aPeer(e, leg, at, storedToolAxes) {
+function normalizeA2aPeer(e, at, storedToolAxes) {
     const dropBecause = (issue) => ({ draft: null, because: declarationIssueFacts(at, issue) });
     const notObject = declarationEntryNotObject(A2A_SEAT, e, at);
     if (notObject !== undefined)
         return { draft: null, because: { field: at, reason: notObject } };
     const o = snapshotPeer(e, storedToolAxes !== undefined);
+    const lost = o.headers?.record === undefined ? [] : o.headers.issues;
     for (const key of A2A_PEER_ENTRY_KEYS) {
         const issue = A2A_PEER_KEY_JUDGES[key](o, at);
         if (issue === undefined)
             continue;
         if (issue.credential !== undefined)
             continue;
-        if (leg === "resume" && issue.path === HEADERS_RESERVED_MEMBER_PATH)
+        if (lost.includes(issue))
             continue;
         if (key === "toolAxes" && storedToolAxes !== undefined)
             continue;
@@ -204,9 +202,9 @@ function normalizeA2aPeer(e, leg, at, storedToolAxes) {
     if (o.cardUrl !== undefined)
         spec.cardUrl = o.cardUrl;
     const { headers, toolAxes: axes } = o;
-    if (headers?.ok === true)
+    if (headers?.record !== undefined)
         spec.headers = headers.record;
-    const lost = headers?.ok === true && headers.stripped.length > 0 ? { headersLost: headers.stripped.map((m) => echoKeyName("headers.", m.name)) } : {};
+    const headersLost = lost.length > 0 ? { headersLost: lost.map((issue) => issue.path) } : {};
     if (o.principalHeader !== undefined)
         spec.principalHeader = o.principalHeader;
     if (o.allowSkills !== undefined)
@@ -227,22 +225,22 @@ function normalizeA2aPeer(e, leg, at, storedToolAxes) {
                 return unread;
             if (again.toolAxes !== undefined)
                 spec.toolAxes = again.toolAxes;
-            return { draft: toA2aDraft(spec), toolAxesReread: peerSentence(axes.problem), ...lost };
+            return { draft: toA2aDraft(spec), toolAxesReread: peerSentence(axes.problem), ...headersLost };
         }
         if (axes.toolAxes !== undefined)
             spec.toolAxes = axes.toolAxes;
     }
-    return { draft: toA2aDraft(spec), ...lost };
+    return { draft: toA2aDraft(spec), ...headersLost };
 }
 export function toA2aDraft(peer) {
     const split = splitDeclaration(peer, A2A_PEER_DISPOSITION);
     return { spec: split.engine, ...(split.pieces === undefined ? {} : { pieces: split.pieces }) };
 }
 export function validateRequestA2a(raw) {
-    const v = validateRequestA2aEntries(raw, "fresh");
+    const v = validateRequestA2aEntries(raw);
     return v === null ? null : { ok: v.ok, dropped: v.dropped };
 }
-function validateRequestA2aEntries(raw, leg, storedToolAxes) {
+function validateRequestA2aEntries(raw, storedToolAxes) {
     if (raw === undefined || raw === null)
         return { ok: [], dropped: [], toolAxesReread: [] };
     if (!Array.isArray(raw))
@@ -251,7 +249,7 @@ function validateRequestA2aEntries(raw, leg, storedToolAxes) {
     const dropped = [];
     const toolAxesReread = [];
     for (const [i, e] of raw.slice(0, MAX_REQUEST_A2A_PEERS).entries()) {
-        const read = normalizeA2aPeer(e, leg, `${A2A_SEAT.list}[${i}]`, storedToolAxes);
+        const read = normalizeA2aPeer(e, `${A2A_SEAT.list}[${i}]`, storedToolAxes);
         if (read.draft !== null) {
             ok.push(read.draft);
             if (read.toolAxesReread !== undefined)
@@ -271,7 +269,7 @@ export function requestA2aHeadersUnread(raw, storedToolAxes) {
     const out = [];
     for (const [i, e] of raw.slice(0, MAX_REQUEST_A2A_PEERS).entries()) {
         const at = `${A2A_SEAT.list}[${i}]`;
-        const read = normalizeA2aPeer(e, "resume", at, storedToolAxes);
+        const read = normalizeA2aPeer(e, at, storedToolAxes);
         if (read.draft !== null)
             for (const member of read.headersLost ?? [])
                 out.push(`${at}.${member}`);
@@ -307,14 +305,14 @@ export function mergeRequestA2a(baseline, drafts, desk, lease) {
     const winners = drafts.filter((d) => !taken.has(d.spec.name));
     return winners.length === 0 ? baseline : [...(baseline ?? []), ...winners.map((d) => mintDeclaration(desk, d, lease))];
 }
-export function resolveRequestA2a(baseline, bodyA2a, config, desk, lease, logger, leg = "fresh", storedToolAxes) {
+export function resolveRequestA2a(baseline, bodyA2a, config, desk, lease, logger, storedToolAxes) {
     if (bodyA2a === undefined || bodyA2a === null)
         return baseline;
     if (!a2aInjectionHonored(config)) {
         logger?.warn("a2a_injection_ignored", { reason: "gate_closed (per-request A2A peers honored only on a single-user, unlocked, compliance-permitted deployment)" });
         return baseline;
     }
-    const v = validateRequestA2aEntries(bodyA2a, leg, storedToolAxes);
+    const v = validateRequestA2aEntries(bodyA2a, storedToolAxes);
     if (v === null) {
         logger?.warn("a2a_injection_ignored", { reason: "a2aPeers not an array" });
         return baseline;

package/dist/task-cwd.d.ts

@@ -1,4 +1,5 @@
 import { type DeploymentShapeInput } from "./deployment-shape.js";
+import type { RunInternals } from "@sema-agent/core";
 /**
  * 词法归一:纯字符串运算,折 `.` / `..` / 重复分隔符,**不碰 fs**。
  * `posix.normalize` 把 `..` 在根部截断(`/../x` → `/x`),与「根之上没有东西」的语义一致;尾部分隔符
@@ -85,23 +86,38 @@ export declare function parseAdditionalDirectories(raw: unknown): string[] | und
  * sandbox — "当前工作目录为空"): resolve the HOST lane's effective workspace for a task. Precedence:
  *   1. the session's explicitly-registered `cwd` (the caller's own launch dir, the cwd seam) — an explicit
  *      per-session choice always wins;
- *   2. the TRUSTED `ctx.parentCwd` (core threads the PARENT task's working root via `RunInternals` when this
- *      task is a delegated child — never a TaskSpec field), UNLESS the child asked for `isolation:"worktree"`
- *      (an isolated fan-out child must not share the parent's mutable dir) — then `undefined`;
- *   3. undefined → the factory's ephemeral per-task dir (top-level task with no registered cwd).
+ *   2. the TRUSTED `ctx.parentCwd` — the working root of the run that handed this leg its work, via `RunInternals`
+ *      (never a TaskSpec field): a delegating parent (core threads it to a delegated child) or a composition host (the
+ *      submission whose cascade ladder / verification gate this leg belongs to: those legs run in sessions the engine
+ *      mints, which arm 1 cannot read, so the composition entries hand them the submission's registered cwd —
+ *      {@link compositionLegRoot}) — UNLESS the leg asked for `isolation:"worktree"` (an isolated fan-out child must
+ *      not share the parent's mutable dir) — then `undefined`;
+ *   3. undefined → the factory's ephemeral per-task dir (no registered cwd anywhere up the chain).
  * The `isolation:"worktree"` ⇒ `undefined` rule is this function's own and holds by itself (the child never inherits the
  * parent's dir). It is NOT what answers a worktree ask on the host lane: `boot/execution-env.ts` never reaches here with one —
  * the worktree wrapper (one layer out) mints the tree and does not call the base factory, and without the wrapper the base
  * factory REFUSES (`isolation.unavailable`) instead of minting the empty ephemeral dir rule 3 would give. That refusal arm is
  * revoked when engine 7.61.0 refuses by itself; this function's rule then goes on keeping the child off the parent's dir.
- * CC parity: a Task sub-agent inherits the main session's cwd. Trust: `parentCwd` comes from core's trusted
- * run-internals channel (same posture as `isolation`), so no tenancy gate is needed here — but the HOST lane
- * itself is single-user by deployment shape, and container lanes (k8s/e2b/local-docker) never consult this.
+ * CC parity: a Task sub-agent inherits the main session's cwd. Trust: `parentCwd` comes from the trusted
+ * run-internals channel (same posture as `isolation`) — written by core's delegation callers, or by this service's
+ * composition entries from a cwd the registration gate (`callerCwd`) already admitted — so no tenancy gate is needed
+ * here; the HOST lane itself is single-user by deployment shape, and container lanes (k8s/e2b/local-docker) never consult this.
  */
 export declare function effectiveHostWorkspace(sessionCwd: string | undefined, ctx: {
     isolation?: string;
     parentCwd?: string;
 }): string | undefined;
+/**
+ * 组合入口(`runCascade` / `resumeCascade` / `runWithVerification` / `resumeWithVerification`)交给它驱动的**每一条腿**的那一格:这次提交登记的工作目录,
+ * 作交活方的工作目录(`RunInternals.parentCwd`)—— {@link effectiveHostWorkspace} 的第 2 臂,委派子代用的同一臂(device 车道的 `effectiveDeviceCwd` 同序)。
+ *
+ * 为什么组合腿要它:梯子的每一级是在引擎**现铸的会话**里冷跑(core `runCascade` 剥掉 spec 的 `sessionId`),验证门的验证器腿的 spec 不带会话 ——
+ * 工厂按腿的会话查登记表(第 1 臂)查不到提交登记在根会话上的那一枚,不交就落第 3 臂(临时目录):用户让梯子在项目里改文件,改到了别处;验证器验的是一只空目录。
+ * 跑在根会话上的腿(验证门的实现腿 / 修复腿)第 1 臂先命中,同一个值。
+ * 没登记(`registeredCwd` 缺席:非 host / device 车道、多租户、根会话的提交从没带过 `cwd`、嵌入方装配器没铸事实)⇒ 空对象 —— 每一条腿照旧落临时目录、收场由托管表删。
+ * 登记粘在会话上(`setSessionCwd` 只在请求带 `cwd` 时写):同一会话之前带过、这次不带 ⇒ 交的仍是那一枚 —— 与第 1 臂对同一会话上普通 run 的读法一致。
+ */
+export declare function compositionLegRoot(registeredCwd: string | undefined): Pick<RunInternals, "parentCwd">;
 /** {@link launchWorkspaceOf} 读到的那一格出自哪里(闭集;起服那一行日志与随包文档的 `workspaceFrom` 词)。 */
 export type LaunchWorkspaceFrom = "workspace-flag" | "host-workspace-base" | "process-cwd";
 /** 起服时的「工作区」:目录 + 它读自哪一格。 */

package/dist/task-cwd.js

@@ -46,6 +46,9 @@ export function parseAdditionalDirectories(raw) {
 export function effectiveHostWorkspace(sessionCwd, ctx) {
     return sessionCwd ?? (ctx.isolation !== "worktree" ? ctx.parentCwd : undefined);
 }
+export function compositionLegRoot(registeredCwd) {
+    return registeredCwd !== undefined ? { parentCwd: registeredCwd } : {};
+}
 export function launchWorkspaceOf(config, explicit, cwd = process.cwd) {
     if (explicit !== undefined)
         return { dir: explicit, from: "workspace-flag" };

package/dist/task-mcp.d.ts

@@ -69,9 +69,9 @@ export declare const MAX_REQUEST_MCP_DROP_NAMES = 32;
  */
 export declare const MCP_SERVER_ENTRY_KEYS: readonly ["allowTools", "contentOrigin", "elicitation", "name", "sessionMetaKey", "source", "startupTimeoutMs", "toolAxes", "toolFaces", "transport"];
 /** `transport.kind:"stdio"` 的键闭集 = stdio 臂处置表的键(`env` 是件,其余进声明)。 */
-export declare const STDIO_MCP_TRANSPORT_KEYS: readonly ("env" | "kind" | "args" | "command")[];
+export declare const STDIO_MCP_TRANSPORT_KEYS: readonly ("kind" | "env" | "args" | "command")[];
 /** `transport.kind:"http"` 的键闭集 = http 臂处置表的键(`headers` 是件,`assertionHeader` 承载不发送,其余进声明)。 */
-export declare const HTTP_MCP_TRANSPORT_KEYS: readonly ("url" | "headers" | "kind" | "principalHeader" | "assertionHeader")[];
+export declare const HTTP_MCP_TRANSPORT_KEYS: readonly ("url" | "kind" | "headers" | "principalHeader" | "assertionHeader")[];
 /**
  * Does THIS deployment honor caller-supplied per-request MCP servers? TRUE for a SINGLE-USER deployment
  * (deployment-shape row `multiTenant` does not hold) — the requester is the super-admin of their own worker, so their `.mcp.json` is
@@ -189,7 +189,7 @@ export declare function requestMcpDeclarationRefusal(list: unknown): Declaration
  * 重放腿走读器({@link normalizeServer} / {@link classifyRequestMcp}),处置:整只不是数组 ⇒ 整只忽略 + 运维 warn `mcp_injection_ignored`;条目不是对象 / 坏硬键
  * (`name` / `transport` 硬字段 / `allowTools` / `toolAxes` / `toolFaces`)⇒ 这一条 server 整条不进 + 运维 warn `mcp_injection_dropped` + 用户面通告 `mcp.injection_dropped` 点名 `field`
  * (`toolAxes` 在一次性迁移 M19 的窗开着时先按升级前读法重读一次,过了就挂,见读器的注);超上限的尾项 ⇒ `over_cap` 点名;坏软键(`contentOrigin` / `elicitation` / `source`)
- * 与词表外的键 ⇒ 丢键、server 照挂(`contentOrigin` 另有 `mcp_content_class_dropped` 留声);`transport` 软字段有几处读器不交(`env` / `headers` 不是纯数据的串记录、其中名叫 `__proto__` 的成员、
+ * 与词表外的键 ⇒ 丢键、server 照挂(`contentOrigin` 另有 `mcp_content_class_dropped` 留声);`transport` 软字段有几处读器不交(`env` / `headers` 不是纯数据的串记录、其中名叫保留名(`__proto__` / `constructor` / `prototype`)的成员、
  * `args` / `principalHeader` 坏形)⇒ 这份请求不重放(「请求成员读不出」那一只判据,`unread-request-members.ts`,经 {@link requestMcpTransportUnread} 读这一座;续跑腿折 409)。
  */
 export declare function assertRequestMcpEntries(bodyMcp: unknown): void;

package/dist/task-mcp.js

@@ -5,7 +5,7 @@ import { GOVERNANCE_HTTP_STATUS } from "./governance-http-status.js";
 import { DEPLOYMENT_SHAPE_PREDICATES } from "./deployment-shape.js";
 import { MCP_SOURCE_LABEL_MAX, isMcpSourceLabel, readMcpSourceLabel } from "./mcp-source-label.js";
 import { MCP_HTTP_TRANSPORT_DISPOSITION, MCP_STDIO_TRANSPORT_DISPOSITION, describeMcpAssertionHeaderNotAString, describeMcpIdentityHeadersConflict, mcpIdentityHeadersIssue, noteMcpAssertionHeaderIgnored, noteMcpAssertionHeaderNotSent, specWithholdsMcpAssertionHeader, toMcpDraft, } from "./mcp-assertion-header.js";
-import { declarationKeys } from "./plain-string-record.js";
+import { declarationKeys } from "./request-declaration-disposition.js";
 import { mintDeclaration, peerSentence } from "./peer-seat.js";
 import { MAX_KEY_ECHO, echoKeyName, keyClosureClause, scanKeyClosure } from "./request-key-closure.js";
 import { readRequestToolAxes } from "./request-tool-axes.js";

package/dist/task-settings.js

@@ -135,6 +135,7 @@ export function settingsEnvCredentialIssue(reaching, credentialNames) {
         message: `settings.env carries credentials: ${named.join(", ")}${more}. A credential reaches the engine only through the environment its process starts from, never through a request's settings.env — ` +
             "that block comes from a settings file the model can read, and the request hands it to the session's shell and hooks. Move these out of settings.env into the engine's environment " +
             "(a sema shell that keeps credentials in its credentials.env file does this; upgrade a shell that still writes them into settings.json). " +
+            "A settings hook reads a variable from the engine's environment only when the deployment names it in HOOK_ENV_ALLOW; this engine's own credential variables (the entries matched by name) reach no hook at all. " +
             "If an entry is not a credential: rename a variable that matched by name, or keep a value that matched by shape out of settings.env the same way (the shape scan is deliberately coarse)",
         fields: { field: "settings.env", entries },
         keys: hits.map((h) => h.key),

package/dist/terminal.d.ts

@@ -105,6 +105,8 @@ export declare function mapPauseSeats<T>(result: T, f: (seat: SeatObject, keys:
  *  ①摘掉**耐久恢复能力凭据**(`CheckpointToken`)—— 座表 {@link PAUSE_SEATS} 上的每一座;②把**域外的失败码**折成本仓的
  *  `internal.store_error`({@link outwardFailureCode},[ref])—— 码座两只:因由的 `terminal.code` 与 cascade 每一级的 `attempts[].errorCode`(同一类码,见 {@link foldOutwardFailureCodes});
  *  因由上折码时**失败句同时换成对外句**(类别句 + 原码尾注,库驱动原句不上 wire,{@link outwardStoreFailure})。
+ *  同一处还接上本仓对**读拒字节地板不守**的说法(属主 `read-deny-floor-notice.ts`):拒起的失败句是本仓那一句(码不变),照跑的结果按 `runId` 挂 `readDenyFloor`
+ *  ({@link withReadDenyFloorSummary})—— 结果离开引擎的每个出口都经这里,说法一处接上。
  *
  * 🔴 为什么两件事合在一只函数里而不是并列两只(7.92.2 改名 `stripResumeToken` → `sealResultForExit`):
  * 它们是**同一个出口上的同一件事** —— 「这条结果可以见人了吗」。并列两只 = 六个结算点各自要记得调两次,

package/dist/terminal.js

@@ -5,6 +5,7 @@ import { recordFailOpen } from "./observability/fail-open.js";
 import { redactSecrets } from "./trace/redact.js";
 import { seatText } from "./trace/exit-seat.js";
 import { storeFaultSentenceOfCode } from "./plugins/store-fault.js";
+import { readDenyFloorRefusalMessage, readDenyFloorSummaryOf } from "./read-deny-floor-notice.js";
 export function failureCodeOf(terminal) {
     return terminal.kind === "failed" ? terminal.code : undefined;
 }
@@ -59,7 +60,14 @@ export function sealStoredResult(result, seat) {
 function seal(result, at) {
     if (result === null || typeof result !== "object")
         return result;
-    return foldOutwardFailureCodes(mapPauseSeats(result, dropCapability), at);
+    const sealed = foldOutwardFailureCodes(mapPauseSeats(result, dropCapability), at);
+    return at === "exit" ? withReadDenyFloorSummary(sealed) : sealed;
+}
+function withReadDenyFloorSummary(result) {
+    if (result.readDenyFloor !== undefined)
+        return result;
+    const summary = readDenyFloorSummaryOf(result.runId);
+    return summary === undefined ? result : { ...result, readDenyFloor: summary };
 }
 function foldOutwardFailureCodes(result, at) {
     const terminal = foldCauseCode(result.terminal, at);
@@ -75,8 +83,10 @@ function foldCauseCode(terminal, at) {
     const t = failedCauseWithCode(terminal);
     if (t === undefined)
         return terminal;
-    if (outwardFailureCode(t.code) === t.code)
-        return terminal;
+    if (outwardFailureCode(t.code) === t.code) {
+        const presented = at === "exit" ? readDenyFloorRefusalMessage(t.code) : undefined;
+        return presented === undefined || presented === t.message ? terminal : { ...t, message: presented };
+    }
     const folded = outwardStoreFailure(t.code, t.message, at);
     return { ...t, code: folded.code, message: folded.message };
 }
@@ -139,12 +149,17 @@ function failedCauseWithCode(t) {
     return kind === "failed" && typeof code === "string" ? { ...t, kind, code } : undefined;
 }
 export function outwardPlane(terminal) {
+    return outwardProjection(terminal, "exit");
+}
+function outwardProjection(terminal, at) {
     const plane = terminalProjection(terminal);
     if (plane.errorCode === undefined)
         return plane;
     const outward = outwardFailureCode(plane.errorCode);
-    if (outward === plane.errorCode)
-        return plane;
+    if (outward === plane.errorCode) {
+        const presented = at === "exit" && plane.status === "failed" ? readDenyFloorRefusalMessage(plane.errorCode) : undefined;
+        return presented === undefined ? plane : { ...plane, errorMessage: presented };
+    }
     return plane.status === "failed" ? { ...plane, errorCode: outward, errorMessage: outwardStoreMessage(plane.errorCode) } : { ...plane, errorCode: outward };
 }
 export function nestedPauseOf(terminal) {
@@ -166,7 +181,7 @@ export function persistedPlaneOf(result) {
     if (r.terminal !== null && typeof r.terminal === "object") {
         let projected;
         try {
-            projected = outwardPlane(r.terminal);
+            projected = outwardProjection(r.terminal, "stored");
         }
         catch (e) {
             recordFailOpen("server.terminal.persisted-plane-malformed", e instanceof Error ? e.message : String(e));