@sema-agent/server 7.149.0 → 7.150.0

package/dist/http/owner-access.js

@@ -1,8 +1,12 @@
 import { createLogger } from "../observability/logger.js";
 import { DEPLOYMENT_SHAPE_PREDICATES } from "../deployment-shape.js";
-import { FACES, fleetOn, listFilterOf, ownerCellOf, qualsOf, visibleOn } from "../owner-faces.js";
+import { engineScopeOf } from "../engine-identity.js";
+import { sameOccupant } from "../execution-placement.js";
+import { sessionAgentOf } from "../session-agent.js";
+import { deletionHeadReadOf, sessionFaceOfHead } from "../session-incarnation.js";
+import { FACES, fleetOn, listFilterOf, ownerCellOf, qualsOf, recoveredSubject, visibleOn } from "../owner-faces.js";
 import { mintOwnedRow, partsOf, personOf, subjectOf } from "../owner-brands.js";
-import { sessionCellFor } from "../security.js";
+import { claimCallerOf, ownerOfCheckpointScope, sessionCellFor } from "../security.js";
 import { openFaceFaultWire, SessionOwnerUnreadableError } from "../session-error-wire.js";
 import { seatText } from "../trace/exit-seat.js";
 import { actsForDeployment, explicitOperatorOk, gatedSubject, sendPrincipalRefusal, sendUnauthorized, traceTokenPresented } from "./principal-gate.js";
@@ -96,6 +100,11 @@ export const ROUTE_FACES = {
     "assistant-task-preempt": "run.preempt",
     "assistant-task-resume": "run.resume",
     "assistant-task-plan-review": "run.decision",
+    "workflows-list": "workflow.read",
+    "workflow-detail": "workflow.read",
+    "workflow-journal": "workflow.read",
+    "workflow-stream": "workflow.read",
+    "workflow-agent-steer": "workflow.steer",
     "sessions-list": "session.list",
     "sendfile-links": "list.read",
     "fleet-stream": "list.read",
@@ -276,6 +285,9 @@ export function refuse(entry, res, reason, id) {
         case "deleted_false":
             sendJson(res, 200, { deleted: false });
             return;
+        case "workflow_missing":
+            sendError(res, 404, "not_found.workflow", "workflow not found");
+            return;
         case "run_exists":
         case "attach_absent":
         case "omit":
@@ -290,8 +302,10 @@ function rowRead(reading) {
     return reading !== undefined && reading !== null;
 }
 function verdictOn(entry, cell) {
+    return verdictOnQuals(entry, qualsOf(entry.caller, cell));
+}
+function verdictOnQuals(entry, quals) {
     const face = FACES[entry.face];
-    const quals = qualsOf(entry.caller, cell);
     if (face.operator && quals.has("operator"))
         return quals;
     if (doorRefusal(face, entry.face, entry.caller) !== undefined)
@@ -325,14 +339,23 @@ export async function admitRunRow(entry, res, runStore, row, id) {
         refuse(entry, res, "session_mismatch", id);
         return undefined;
     }
+    return observedAdmission(entry, runStore, admitted);
+}
+async function observedAdmission(entry, runStore, admitted) {
     return { ...admitted, row: mintOwnedRow(await runRowAt(entry.mouth, runStore, admitted.row)) };
 }
 export async function admitRunById(entry, res, runStore, taskId) {
     return admitRunRow(entry, res, runStore, await runStore.getRun(taskId), taskId);
 }
+export async function admitRunByIdem(entry, res, runStore, idemKey) {
+    return admitRunRow(entry, res, runStore, await runStore.getRunByIdem(idemKey));
+}
 export async function readVisibleRun(entry, runStore, taskId) {
     const row = await runStore.getRun(taskId);
-    return rowRead(row) && seesRun(entry, row.owner) ? runRowAt(entry.mouth, runStore, row) : undefined;
+    if (!rowRead(row))
+        return undefined;
+    const admitted = judgeRun(entry, row);
+    return admitted === undefined ? undefined : observedAdmission(entry, runStore, admitted);
 }
 export function seesRun(entry, owner) {
     const verdict = verdictOn(entry, ownerCellOf(owner));
@@ -371,9 +394,25 @@ export async function admitSessionRow(entry, res, store, sessionId, reading) {
 export async function judgeSessionRow(entry, store, sessionId, reading) {
     return judge(entry, reading, await sessionCellFor(entry.face, entry.caller, store, sessionId, reading.owner));
 }
+export async function judgeSessionById(entry, store, sessionId) {
+    const head = await readOwnerCell(entry, sessionId, () => store.headOf(sessionId));
+    return sessionRowPresent(head) ? judgeSessionRow(entry, store, sessionId, head) : undefined;
+}
 export async function admitSessionById(entry, res, store, sessionId) {
+    const verdict = await judgeSessionById(entry, store, sessionId);
+    if (verdict === undefined) {
+        refuse(entry, res, "missing");
+        return undefined;
+    }
+    return deliverVerdict(entry, res, verdict);
+}
+export async function readVisibleSession(entry, store, sessionId) {
+    const verdict = await judgeSessionById(entry, store, sessionId);
+    return verdict === undefined || verdict === "door" || verdict === "not_visible" ? undefined : verdict;
+}
+export async function sessionOwnerUnchanged(entry, store, sessionId, admittedOwner) {
     const head = await readOwnerCell(entry, sessionId, () => store.headOf(sessionId));
-    return admitSessionRow(entry, res, store, sessionId, head);
+    return sessionRowPresent(head) && head.owner === admittedOwner;
 }
 export async function judgeSession(entry, store, sessionId, reading) {
     if (!sessionRowPresent(reading))
@@ -390,4 +429,144 @@ export function entryIsFleet(entry) {
 export function routeListFilter(req, w, route) {
     return listFilterOf(faceOfRoute(route), callerOf(req, w));
 }
+export function sealRouteDeps(deps) {
+    return deps;
+}
+export async function runFactsOf(store, taskId) {
+    const row = await store.getRun(taskId);
+    return rowRead(row) ? { status: row.status, instanceId: row.instanceId, sessionId: row.sessionId } : undefined;
+}
+export async function latestRunIdOf(store, sessionId) {
+    return (await store.latestRunForSession(sessionId))?.taskId;
+}
+export function sessionFactsReadOf(store) {
+    const headOf = store?.headOf;
+    if (typeof headOf !== "function")
+        return undefined;
+    return async (sessionId) => {
+        const head = await headOf.call(store, sessionId);
+        return rowRead(head) ? { get leafId() { return head.leafId; } } : undefined;
+    };
+}
+export async function readSessionAgent(store, sessionId) {
+    const placementOf = store?.placementOf;
+    if (placementOf === undefined)
+        return undefined;
+    return sessionAgentOf(await placementOf.call(store, sessionId));
+}
+export function occupantRecheckOf(store) {
+    const headOf = store?.headOf;
+    if (typeof headOf !== "function")
+        return undefined;
+    return async (sessionId, occupant) => {
+        const head = await headOf.call(store, sessionId);
+        if (!rowRead(head))
+            return "gone";
+        return sameOccupant(occupant, head) ? "same" : "replaced";
+    };
+}
+export async function engineRulesKeyOf(store, sessionId, principal) {
+    if (principal === undefined || typeof store?.headOf !== "function")
+        return principal;
+    const owner = (await store.headOf(sessionId))?.owner;
+    if (owner === undefined || owner === null)
+        return principal;
+    return personOf(recoveredSubject(owner)) === principal ? owner : principal;
+}
+export async function readVisibleLatestRun(entry, store, sessionId) {
+    const latest = await store.latestRunForSession(sessionId);
+    return rowRead(latest) && seesRun(entry, latest.owner) ? latest : undefined;
+}
+export function runListOwnerOf(filter, named) {
+    return filter.gateOwner ?? named;
+}
+export function listVisibleRuns(store, filter, named, query) {
+    const owner = runListOwnerOf(filter, named);
+    return store.listRuns({ ...query, ...(owner ? { owner } : {}) });
+}
+export function listRunsOfScope(store, scope, limit) {
+    return store.listRuns({ owner: ownerOfCheckpointScope(scope), limit });
+}
+export function replayHitOf(subject, config, row, clientTaskId) {
+    const sameRun = clientTaskId === undefined || clientTaskId === row.taskId;
+    return sameRun && seesRunAs("run.replay", claimCallerOf(subject, config), row.owner) ? { kind: "visible", row } : { kind: "occupied" };
+}
+export async function readReplayHit(subject, config, store, key, clientTaskId) {
+    const row = "idemKey" in key ? await store.getRunByIdem(key.idemKey) : await store.getRun(key.taskId);
+    return rowRead(row) ? replayHitOf(subject, config, row, clientTaskId) : undefined;
+}
+export async function admitSessionView(entry, res, store, sessionAudit, sessionId, readOpts) {
+    const gated = store !== undefined && typeof store.headOf === "function";
+    if (gated && (await admitSessionById(entry, res, store, sessionId)) === undefined)
+        return undefined;
+    let audit;
+    try {
+        audit = await sessionAudit(sessionId, readOpts);
+    }
+    catch (e) {
+        if (gated)
+            throw e;
+        throw new Error(`session view read failed before ownership could be established: ${e instanceof Error ? e.message : String(e)}`, { cause: e });
+    }
+    if ((await admitSessionRow(entry, res, store, sessionId, audit)) === undefined)
+        return undefined;
+    return audit;
+}
+export async function readSyncGate(entry, store, sessionId) {
+    const live = await store.headOf(sessionId);
+    const face = rowRead(live) ? sessionFaceOfHead(sessionId, live) : undefined;
+    const held = face === undefined ? await deletionHeadReadOf(store)(sessionId) : undefined;
+    const occupant = face ?? (rowRead(held) ? sessionFaceOfHead(sessionId, held) : undefined);
+    const mayTouch = occupant !== undefined && (await judgeSession(entry, store, sessionId, occupant)) !== undefined;
+    return { face, occupant, mayTouch };
+}
+export async function toolResultRefOwned(store, ref, run) {
+    const provenance = store?.ownerOf ? await store.ownerOf(ref) : undefined;
+    return provenance !== undefined && provenance.sessionId === run.sessionId && (provenance.taskId === undefined || provenance.taskId === run.taskId);
+}
+export async function readVisibleLeaderRow(store, id, visible) {
+    const row = await store.getRun(id);
+    return row !== undefined && visible(row.owner) ? row : undefined;
+}
+export const WORKFLOW_SESSION_ASSERTION = {
+    "workflow-detail": { phase: "accept", label: "workflow.detail" },
+    "workflow-journal": { phase: "accept", label: "workflow.journal" },
+    "workflow-stream": { phase: "accept", label: "workflow.stream" },
+    "workflow-agent-steer": { phase: "accept", label: "workflow.agent-steer" },
+};
+export function listVisibleWorkflows(entry, store, opts) {
+    return store.listByScope(engineScopeOf(entry.caller.subject), opts);
+}
+export async function judgeWorkflowRun(entry, store, runId) {
+    const row = await store.get(runId);
+    if (!rowRead(row))
+        return "missing";
+    const engineCaller = { ...entry.caller, subject: recoveredSubject(engineScopeOf(entry.caller.subject)) };
+    const verdict = verdictOnQuals(entry, qualsOf(engineCaller, ownerCellOf(row.scope)));
+    if (verdict === "door" || verdict === "not_visible")
+        return verdict;
+    const rule = Object.hasOwn(WORKFLOW_SESSION_ASSERTION, entry.mouth) ? WORKFLOW_SESSION_ASSERTION[entry.mouth] : undefined;
+    if (rule === undefined)
+        throw new Error(`owner access: mouth ${entry.mouth} judges a workflow row but is not registered in WORKFLOW_SESSION_ASSERTION`);
+    return sessionAsserted(rule, entry.req, row.originatingSessionId, verdict.has("operator")) ? { row, quals: verdict } : "session_mismatch";
+}
+export async function admitWorkflowRun(entry, res, store, runId) {
+    const verdict = await judgeWorkflowRun(entry, store, runId);
+    switch (verdict) {
+        case "missing":
+        case "not_visible":
+        case "session_mismatch":
+            refuse(entry, res, verdict);
+            return undefined;
+        case "door":
+            sendDoorRefusal(entry, res, doorRefusal(FACES[entry.face], entry.face, entry.caller));
+            return undefined;
+        default:
+            return verdict;
+    }
+}
+export async function admitSessionForDeletion(entry, res, store, sessionId) {
+    const placementOf = store.placementOf?.bind(store);
+    return admitSessionById(entry, res, { headOf: deletionHeadReadOf(store), ...(placementOf !== undefined ? { placementOf } : {}) }, sessionId);
+}
 //# sourceMappingURL=owner-access.js.map

package/dist/http/readiness.d.ts

@@ -72,7 +72,8 @@ export declare function sendReadyz(res: ServerResponse, v: ReadinessVerdict): vo
 export declare const BILLABLE_KINDS: readonly ["submit", "hitl-answer", "resume"];
 export type BillableKind = (typeof BILLABLE_KINDS)[number];
 /**
- * 计费面的拒因(**数组序 = 优先序**):就绪原因({@link READINESS_REASONS})∪ `lease_expired`(服务租约过期且中心不可达满 `T_max`)。
+ * 计费面的拒因(**数组序 = 优先序**):就绪原因({@link READINESS_REASONS})∪ `lease_expired`(服务租约过期且中心不可达满 `T_max` —— 含从起步起一直没听到
+ * 中心的成员:推定在围栏内,钟从本进程起点)。
  * `lease_expired` 刻意不是就绪原因:它不翻 `/readyz`(中心不可达不是本实例的病,摘它出路由只会把取消 / HITL / 读面一起摘掉)。
  */
 export declare const ADMISSION_REFUSALS: readonly ["draining", "model_roster_pending", "lease_expired"];
@@ -80,7 +81,8 @@ export type AdmissionRefusal = (typeof ADMISSION_REFUSALS)[number];
 /**
  * 计费面请求的**唯一**准入判(dispatch 的计费门、a2a `message/send`、PARKED 赎回席同调):按 {@link ADMISSION_REFUSALS} 序找第一条
  * 成立且按 {@link ADMISSION_TABLE} 拒这一种的拒因;没有 ⇒ `undefined`(放行)。入参是**判决**而不是 deps:就绪判由调用点经唯一谓词
- * {@link readinessOf} 现读(模块边界上那一只 —— 谓词单源钉注入它,任何读点自己读 `drainState` 都会当场红),租约读数取 `deps.servingLease`。
+ * {@link readinessOf} 现读(模块边界上那一只 —— 谓词单源钉注入它,任何读点自己读 `drainState` 都会当场红),租约读数经唯一读者
+ * `fleet/engine-signal.ts` 的 `memberLeaseOf`(只有 fleet 成员有租约;成员没有任何中心读数之前是推定的 `expired`,同一臂)。
  */
 export declare function admissionRefusalOf(verdict: ReadinessVerdict, lease: ServingLeaseView | undefined, kind: BillableKind): BillableRefusal | undefined;
 /** 计费提交门的拒绝(首条 reason 定码)。`retryAfterSec` 由发送形(`sendBillableRefusal`)镜像成头;交回

package/dist/http/resume-ctx-read.js

@@ -1,12 +1,27 @@
 import { openCheckpointCtx } from "./checkpoint-ctx.js";
 import { storeFaultClassOf } from "../plugins/store-fault.js";
 import { refusalBody } from "./refusal-body.js";
+import { frozenProjectContextOf } from "../project-context.js";
 export async function readResumeCtx(load, opening) {
     const read = await readStoredCtx(load);
     if (read.kind !== "ok")
         return read;
     const opened = openCheckpointCtx(read.ctx, opening.opener, opening.sessionId);
-    return opened.kind === "ok" ? { kind: "ok", ctx: opened.ctx } : { kind: "unsealable", field: opened.field, reason: opened.reason };
+    if (opened.kind !== "ok")
+        return { kind: "unsealable", field: opened.field, reason: opened.reason };
+    const frozen = frozenProjectContextOf(opened.ctx.projectContext);
+    switch (frozen.kind) {
+        case "absent":
+            return { kind: "ok", ctx: opened.ctx };
+        case "malformed":
+            return { kind: "corrupt", where: `checkpoint ctx for session ${JSON.stringify(opening.sessionId)}: projectContext` };
+        case "ok":
+            return { kind: "ok", ctx: { ...opened.ctx, projectContext: frozen.context } };
+        default: {
+            const unhandled = frozen;
+            throw new Error(`resume-ctx-read: unplaced frozen project context reading ${JSON.stringify(unhandled)}`);
+        }
+    }
 }
 async function readStoredCtx(load) {
     let stored;

package/dist/http/resume-legs.js

@@ -3,7 +3,7 @@ import { createHash } from "node:crypto";
 import { uuidv7, resumeWithVerification, resumeCascade, CheckpointError, judgeCheckpointRow, defaultTaskRegistry, taskNotificationDedupKey, validatePendingSteer, GLOBAL_USAGE_KEY } from "@sema-agent/core";
 import { decideParkedAgent, deliverToHoldingRun, denyWorkflowParkForked, denyWorkflowParksUnreadable, findParkOrigin, heldWorkflowParkDecisions, planWorkflowParkedDecide } from "../parked-decide.js";
 import { parkDecisionFingerprint } from "../orchestration/workflow-park-decision.js";
-import { headReadOf } from "../session-incarnation.js";
+import { runFactsOf, sealRouteDeps, sessionFactsReadOf } from "./owner-access.js";
 import { createSessionWorkspaceRecorder, sessionWorkspaceStoreOf } from "../session-workspace.js";
 const DELIVERY_NOT_RECORDED = "workflow park decide: this delivery no longer holds the host session (its claim was released) — the decision was not recorded and this delivery was not started";
 import { HttpError, checkpointPartsOf, decodeCheckpointScope, scopeCellOf, CHECKPOINT_PUBLIC_SCOPE } from "../security.js";
@@ -15,7 +15,7 @@ import { commitParkRow } from "../park-row-commit.js";
 import { atHostBoundary, failureCodeOf, nestedPauseOf, sealResultForExit, outwardPlane, outwardThrownMessage } from "../terminal.js";
 import { voidVerifierPauseCard } from "../verifier-pause-card.js";
 import { buildCancelledLedgerRow, CANCELLED_CODE, CARD_SETTLED_BY_CANCEL_MESSAGE, createRunAbort, mintCancelledResult, withCardSettledByCancelMessage } from "../run-cancel-context.js";
-import { isTerminalRunStatus, runProvenElsewhere } from "../plugins/store-contracts.js";
+import { createLegCtxClaim, isTerminalRunStatus } from "../plugins/store-contracts.js";
 import { readTurnActivityMs, recordTurnActivity } from "../turn-activity.js";
 import { recordResumeResourceWindow } from "../resource-window.js";
 import { emitPendingWorkflowCompletions, taskNotificationInboxEntry, taskNotificationStreamKeyOf, NotifiedKeys } from "../orchestration/workflow-completion-inbox.js";
@@ -66,7 +66,7 @@ import { deploymentListAsks } from "../approval.js";
 import { isParkLedgerEventType } from "../trace/ledger-events.js";
 import { readResumeCtx, resumeCtxCorruptAnswer, resumeCtxUnreadableAnswer, resumeCtxUnsealableAnswer, resumeStoreFailureOf } from "./resume-ctx-read.js";
 import { objectiveWithheldIn } from "./submit-ctx.js";
-import { buildCheckpointVersionKeys, resumeAssemblyRefusalAnswer, resumeRefusalWithCard, sealCheckpointCtx, storedBodyReplayAnswer, storedBodyReplayLogFields, withPermissionModeRewritten } from "./checkpoint-ctx.js";
+import { buildCheckpointVersionKeys, resumeAssemblyRefusalAnswer, resumeRefusalWithCard, sealCheckpointCtx, storedBodyReplayAnswer, storedBodyReplayLogFields } from "./checkpoint-ctx.js";
 import { refusalBody, resumeRefusalFacts } from "./refusal-body.js";
 import { storedBodyReplayRefusal } from "./stored-body-replay.js";
 import { restateResumeCtx } from "./resume-restatement.js";
@@ -580,7 +580,7 @@ export function createResumeLegs(ctx) {
                 const liveReceiptOf = async (held) => {
                     if (held === null || held.fingerprint !== fingerprint)
                         return undefined;
-                    const run = await runStore.getRun(held.deliveredTaskId);
+                    const run = await runFactsOf(runStore, held.deliveredTaskId);
                     return run != null && !isTerminalRunStatus(run.status) ? acceptedResumingReceipt(held.deliveredTaskId, held.hostSessionId, NO_SETTLEMENT_EVIDENCE) : undefined;
                 };
                 const replay = await liveReceiptOf(await decisions.get(token));
@@ -690,6 +690,7 @@ export function createResumeLegs(ctx) {
             leg: "resume",
             onNotice: (n) => engineNotices.push(n),
             ...(ctx.unattendedLeg === true ? { unattendedLeg: true } : {}),
+            ...(ctx.projectContext !== undefined ? { projectContext: ctx.projectContext } : {}),
             lease,
             execution,
         });
@@ -762,10 +763,10 @@ export function createResumeLegs(ctx) {
         };
         const commitResumeCtx = () => Promise.resolve().then(async () => {
             const sealed = sealCheckpointCtx({ ...resumeCtx.ctx, writerVersion: serviceVersion() }, deps.checkpointCtxSealing, resumeCtx.sessionId);
-            const claim = claimedRow && taskId !== undefined && deps.runStore !== undefined ? { fence: deps.runStore, taskId, legHolds: (run) => !runProvenElsewhere(run, deps.instanceId) } : undefined;
+            const claim = heldLeg !== undefined && taskId !== undefined && deps.runStore !== undefined ? createLegCtxClaim(deps.runStore, taskId, heldLeg) : undefined;
             const landed = await deps.checkpointStore.putCtx(resumeCtx.sessionId, sealed, claim);
             if (landed === "claim_released")
-                resumeCtxNotPersisted("claim_released: this run no longer holds the session claim (settled or reaped before the write-back landed) — nothing written");
+                resumeCtxNotPersisted("claim_released: this leg no longer holds the run (settled, reaped, or claimed again by a later leg before the write-back landed) — nothing written");
         }).catch((e) => resumeCtxNotPersisted(errorText(e)));
         const legKey = createHash("sha256").update(String(token)).digest("hex");
         const streamApprovalOn = resolveStreamApprovalGate({
@@ -1148,9 +1149,9 @@ export function createResumeLegs(ctx) {
                 cancelLedgerAppend = append;
                 await openEngineNoticePort(append);
                 const anchorOwner = subject ?? null;
-                const headOf = headReadOf(deps.sessionStorage);
-                const captureTurnAnchor = deps.resumeAnchorStore && headOf
-                    ? async (eventId) => { const leaf = (await headOf(sessionId))?.leafId; if (leaf)
+                const sessionFactsOf = sessionFactsReadOf(deps.sessionStorage);
+                const captureTurnAnchor = deps.resumeAnchorStore && sessionFactsOf
+                    ? async (eventId) => { const leaf = (await sessionFactsOf(sessionId))?.leafId; if (leaf)
                         await deps.resumeAnchorStore.put(sessionId, eventId, leaf, anchorOwner); }
                     : undefined;
                 const captureUserMessageAnchor = deps.resumeAnchorStore && taskId && freshRunClaimed
@@ -1416,9 +1417,12 @@ export function createResumeLegs(ctx) {
                 const withElicitation = () => deps.elicitation && taskId
                     ? deps.elicitation.runWithContext({ taskId, owner: subject ?? null, transport: hitlTransport, abortSignal: cancelCtrl.signal }, withApproval)
                     : withApproval();
+                const withQuestion = () => deps.question && taskId
+                    ? deps.question.runWithContext({ taskId, owner: subject ?? null, transport: hitlTransport, abortSignal: cancelCtrl.signal }, withElicitation)
+                    : withElicitation();
                 return await (deps.sendUserFile && taskId
-                    ? deps.sendUserFile.runWithContext({ taskId, emit: async (frame) => { const { type, ...rest } = frame; await append(type, rest); } }, withElicitation)
-                    : withElicitation());
+                    ? deps.sendUserFile.runWithContext({ taskId, emit: async (frame) => { const { type, ...rest } = frame; await append(type, rest); } }, withQuestion)
+                    : withQuestion());
             })));
         }
         catch (e) {
@@ -1877,7 +1881,7 @@ export function createResumeLegs(ctx) {
             throw new Error("drivePlanReview: permissionModeAfter was passed for a task whose stored permission mode is not \"plan\" — the caller must refuse this before any state changes (see the plan_review route's pre-nonce gate)");
         }
         const approvedMode = planReviewDecisionExitsPlan(decision) && effMode === "plan" ? (permissionModeAfter ?? "default") : undefined;
-        const rebuildCtx = approvedMode === undefined ? ctx : withPermissionModeRewritten(ctx, { ...ctx.body, permissionMode: approvedMode });
+        const rebuildCtx = approvedMode === undefined ? ctx : { ...ctx, body: { ...ctx.body, permissionMode: approvedMode } };
         const resolved = await resolveResumeSpecOrBlocked(rebuildCtx, req, auth);
         if (!resolved.ok)
             return resolved.answer;
@@ -1907,10 +1911,10 @@ export function createResumeLegs(ctx) {
         activeTaskIdOf: async (sessionId) => deps.runStore?.getActiveTaskId?.(sessionId),
         liveRuns: steerableRuns,
         inbox: deps.workflowCompletionInbox,
-        headOf: headReadOf(deps.sessionStorage),
+        sessionStorage: deps.sessionStorage,
     });
     const routeCtxBase = {
-        deps,
+        deps: sealRouteDeps(deps),
         registry: { idemCache, inflightRuns, preemptableRuns, steerableRuns, wakeParkMints, counters },
         helpers: { readJson, readRawBody, rateLimited, quotaExceeded, ownerQuotaDenied, leaseDenied, ownerLeaseDenied, usageWindowDenied, admitRun, safeDecode },
         local: { images: createImagesLocal(deps), sessions: createSessionsLocal(), sessionSync: createSessionSyncLocal(), capabilities: createCapabilitiesLocal() },

package/dist/http/route-ctx.d.ts

@@ -39,6 +39,7 @@ import type { RememberLaneCannotRecord } from "../parked-decide.js";
 import type { RowWayOut } from "./resume-legs.js";
 import type { KeyCaller } from "../owner-faces.js";
 import type { Subject } from "../owner-brands.js";
+import type { RouteBackend, RouteRunStore, RouteSessionStore } from "./owner-access.js";
 /** 跨域可变状态 = lens1 §C2 实测的那 8 条「运行期登记簿」,一个对象。
  *  [ref]:`cancelledViaVerb`(按 taskId 键控的「这次是取消动词」旁表)删除 —— 中止成因改挂在每条腿自己的
  *  {@link RunAbort} 句柄上(`inflightRuns` 的值),同寿同删,不再有一张与腿不同寿的旁表。 */
@@ -199,14 +200,6 @@ export interface CheckpointCtx {
      * 传原 ctx / 其展开 ⇒ 标随行。缺席 = 不是无人值守腿(HTTP 提交腿;7.106.0 前落盘的行 —— 那时这些腿不铸模式,checkpoint 里也没有)。
      */
     unattendedLeg?: true;
-    /**
-     * 体里**模式词的读法记号**(闭集只有当前一词 `"entry_word"`):在场 = 这一行体的顶层 `permissionMode` 是这条 run 模式词唯一的源(提交入口盖过运维
-     * `AUTONOMY=plan` 的地板;`plan_review` 写回改它),续跑照它读。**服务端写、不来自请求体**。缺席(7.121.x 及以前写下的行 —— 那时运维的 plan 由治理层每段重钳)
-     * 而本部署此刻有入口地板、体的词被地板钳会变 ⇒ 续跑腿响亮拒、行字节不动(规则与删除条件的属主 = `http/checkpoint-ctx.ts` 顶注「模式词问」)。
-     * 写点两个(写模式词的人盖记号,同模块):`buildCheckpointCtx`(每一次新的持久化写都写)与 `withPermissionModeRewritten`(`plan_review` 改词的写回);
-     * 不改词的续跑腿写回传原 ctx ⇒ 记号随行。
-     */
-    permissionModeReading?: import("./checkpoint-ctx.js").PermissionModeReading;
     /**
      * 🔴 [ref] —— **写这份上下文的服务版本**(`package.json` 的 `version`),**服务端写、不来自请求体**(与 {@link unattendedLeg} 同为 `body` 的兄弟键)。
      * 写点两个:`buildCheckpointCtx`(每一次新的持久化写)与续跑腿的写回({@link DriveResumeArgs.resumeCtx} 的唯一写点,CAS 赢点盖本进程的版本 —— 接下来写下一张停车行的就是它)。
@@ -226,6 +219,14 @@ export interface CheckpointCtx {
      * 缺席 = 体里的目标就是交付的那一份(腿上没有屏)。
      */
     promptScreened?: true;
+    /**
+     * 这条 run 继承到的**项目上下文**(`project-context.ts` 的 {@link import("../project-context.js").ProjectContext}:项目 id · 继承的 `cwd` · 项目简报)——
+     * 新提交腿在装配器头部判一次,**服务端写、不来自请求体**(与 {@link memoryScope} 同为 `body` 的兄弟键,先例同形:提交腿推导、落盘,续跑原样读回)。
+     * 写点:`buildCheckpointCtx`(提交腿那一笔,经 `persistSubmissionCtx` 读这条腿的部署事实);leader worker 的写者不带(它的 spec 不经新提交腿的判)。续跑腿的写回传原 ctx / 其展开 ⇒ 随行。
+     * 读者只有一只:`resume-legs.ts` `resolveResumeSpec` 把它原样递给装配器(`opts.projectContext`)—— 续跑腿不再读登记簿、不再推观者(停驻期间登记被改 / 被删 / 看不见了,续跑照旧用这一份)。
+     * 缺席 = 没继承(含 7.150.0 之前写下的行:不回填,续跑不继承 = 那时的行为)。
+     */
+    projectContext?: import("../project-context.js").ProjectContext;
 }
 /**
  * `/decide` 第三条车道交给宿主投递腿(wake:`DriveResumeArgs` / fresh:`DurableRunLegArgs`)的**一件**:这一跑在内存里带着的决定,
@@ -442,13 +443,13 @@ export interface RouteLegs {
     /** POST /v1/tasks · /v1/tasks/stream · /v1/runs 的共同前段:读体 → 校验 → resolveSpec。null = 已应答(400/…)。
      *
      *  `body` = **已解析好的**请求体,给那些体不是「这条 HTTP 请求的 JSON 正文」的调用方
-     *  (DESIGN-269 车2:A2A JSON-RPC 腿已经把正文读成了一条 `message/send` 请求,再 `readJson(req)`
+     *  ([ref] 车2:A2A JSON-RPC 腿已经把正文读成了一条 `message/send` 请求,再 `readJson(req)`
      *  一次只会读到空流)。缺席 ⇒ 照旧自己读体,既有三个调用方一字不改。
      *  ⚠️ 这是**入口形**的分歧,不是校验面的分歧:传进来的体与自己读的体走**同一段**校验/授权/
      *  resolveSpec —— 分叉出第二条校验路径正是本参数存在的理由的反面。
      *
      *  `onTypedFailure` = 「typed 拒绝**别写响应**,交回给我」。默认(缺席)行为不变:`HttpError` 走
-     *  `sendError` 连 `extra` 一起回显。DESIGN-269 车2 的 A2A 腿必须传它 —— 那些 `extra`(尤其
+     *  `sendError` 连 `extra` 一起回显。[ref] 车2 的 A2A 腿必须传它 —— 那些 `extra`(尤其
      *  `scenario_unknown` 的**全部场景名**)对壳是指路材料,对一个外部 peer 是内部词表外泄。 */
     prepareSpec(req: IncomingMessage, res: ServerResponse, body?: TaskRequestBody, onTypedFailure?: (err: import("../security.js").HttpError) => void, 
     /** [ref] 件C:**腿身份**(不是能力表态)。`liveStream: true` 只由 `POST /v1/tasks/stream` 的装配点按
@@ -600,8 +601,19 @@ export declare function sendResumeOutcome(res: ServerResponse, out: {
 }, logger: {
     info?: (msg: string, fields?: Record<string, unknown>) => void;
 } | undefined, extraBody?: Record<string, unknown>): void;
+/**
+ * 🔴 **路由层的服务 deps(类型墙,[ref] 第二阶段)**:run 店 / 会话店上带属主的读口(按 id / 按键 / 按会话 / 列表 —— `owner-access.ts` 的 {@link RouteRunStore} /
+ * {@link RouteSessionStore})、会话视图读 `sessionAudit` 与后端铸这两只店的工厂(`backend.run()` / `backend.session()`,{@link RouteBackend})在型上调不了:路由在不在照判(能力事实只问方法在不在,见证随视图封着),带属主的行只经属主存取器读。
+ * 值上就是服务的那一只 deps,只在 `owner-access.ts` 的 `sealRouteDeps` 铸一次;视图是完整 deps 的子型(交给持认领腿的写口照常)。
+ */
+export type RouteDeps = Omit<FlatServiceDeps, "runStore" | "sessionStorage" | "sessionAudit" | "backend"> & {
+    runStore?: RouteRunStore;
+    sessionStorage?: RouteSessionStore;
+    sessionAudit?: never;
+    backend?: RouteBackend;
+};
 export interface RouteCtxBase {
-    deps: FlatServiceDeps;
+    deps: RouteDeps;
     registry: RunRegistry;
     helpers: RouteHelpers;
     local: RouteLocals;

package/dist/http/routes/a2a-serve.js

@@ -4,12 +4,13 @@ import { memoRedactedRead, redactErrorMessage } from "../../observability/run-te
 import { isParkedRunStatus, isTerminalRunStatus } from "../../plugins/store-contracts.js";
 import { HttpError } from "../../security.js";
 import { idemCallerOf, idemIdentityOf, idemKeyOf, inflightKeyOf } from "../idempotency.js";
-import { isRunExistsConflictBody, replayOfExistingRun } from "../submit-replay.js";
+import { answerReplay, isRunExistsConflictBody } from "../submit-replay.js";
 import { isActiveRunConflictBody } from "../active-run-conflict.js";
 import { sendJson, sendError, sendHttpError } from "../send.js";
 import { admissionRefusalOf, readinessOf, sendBillableRefusal } from "../readiness.js";
+import { memberLeaseOf } from "../../fleet/engine-signal.js";
 import { gatedPerson, gatedSubject, sendPrincipalRefusal, verifiedIdentitySource } from "../principal-gate.js";
-import { callerOf, protocolEntry, readVisibleRun, runRowAt } from "../owner-access.js";
+import { callerOf, protocolEntry, readReplayHit, readVisibleRun, runRowAt } from "../owner-access.js";
 import { assertNever } from "../route-ctx.js";
 import * as facts from "../../capability-facts.js";
 import { createDurableRun } from "./runs.js";
@@ -181,7 +182,7 @@ function rpcErrorFromTypedFailure(err) {
 }
 function submitUnavailable(res, ctx) {
     const { deps } = ctx;
-    const refusal = admissionRefusalOf(readinessOf(deps), deps.servingLease?.(), "submit");
+    const refusal = admissionRefusalOf(readinessOf(deps), memberLeaseOf(deps), "submit");
     if (refusal === undefined)
         return false;
     sendBillableRefusal(res, refusal);
@@ -197,15 +198,14 @@ function readBlocking(params) {
         throw new RpcError(JSONRPC_INVALID_PARAMS, "params.configuration.blocking must be a boolean");
     return c.blocking;
 }
-async function waitForRun(ctx, store, res, taskId, budgetMs) {
+async function waitForRun(ctx, entry, store, res, taskId, budgetMs) {
     const { deps } = ctx;
     const deadline = Date.now() + budgetMs;
     let last = null;
     for (;;) {
         let run;
         try {
-            const raw = await store.getRun(taskId);
-            run = raw ? await runRowAt("run.a2a", store, raw) : null;
+            run = (await readVisibleRun(entry, store, taskId))?.row ?? null;
         }
         catch (e) {
             deps.logger?.warn?.("a2a_serve_wait_read_failed", { error: e?.message });
@@ -254,10 +254,11 @@ async function handleMessageSend({ req, res, ctx, params, serve, runStore }) {
         ...(contextId !== undefined ? { sessionId: contextId } : {}),
         ...(scenario !== undefined ? { scenario } : {}),
     };
-    const keyed = (await runStore.getRunByIdem(idem.key).catch(() => undefined)) ?? (await runStore.getRun(body.taskId).catch(() => undefined));
-    const replay = keyed ? await replayOfExistingRun(keyed, { subject: submitter, clientTaskId: body.taskId, idem }, "durable", deps, runStore) : undefined;
-    if (keyed && replay?.status === 202) {
-        return taskFromRun(await runRowAt("run.a2a", runStore, keyed));
+    const keyed = (await readReplayHit(submitter, deps.config, runStore, { idemKey: idem.key }, body.taskId).catch(() => undefined)) ??
+        (await readReplayHit(submitter, deps.config, runStore, { taskId: body.taskId }, body.taskId).catch(() => undefined));
+    const replay = keyed ? await answerReplay(keyed, { subject: submitter, clientTaskId: body.taskId, idem }, "durable", runStore) : undefined;
+    if (keyed?.kind === "visible" && replay?.status === 202) {
+        return taskFromRun(await runRowAt("run.a2a", runStore, keyed.row));
     }
     const inflight = replay === undefined ? ctx.registry.idemCache.peek(inflightKeyOf(idem, "durable", body.taskId)) : undefined;
     let receipt;
@@ -298,7 +299,7 @@ async function handleMessageSend({ req, res, ctx, params, serve, runStore }) {
     }
     const taskId = receiptBody.taskId;
     const sessionId = receiptBody.sessionId;
-    const run = await waitForRun(ctx, runStore, res, taskId, blocking ? serve.blockingWaitMs : 0);
+    const run = await waitForRun(ctx, protocolEntry(req, deps, "run.a2a", callerOf(req, deps)), runStore, res, taskId, blocking ? serve.blockingWaitMs : 0);
     if (run)
         return taskFromRun(run);
     return {
@@ -330,10 +331,10 @@ function durableIdempotencyTaskId(scope, messageId) {
 async function handleTasksGet({ req, ctx, params, runStore }) {
     const { deps } = ctx;
     const id = asNonEmptyString(params.id, "params.id", MAX_TASK_ID_CHARS);
-    const run = await readVisibleRun(protocolEntry(req, deps, "run.a2a", callerOf(req, deps)), runStore, id);
-    if (!run)
+    const admitted = await readVisibleRun(protocolEntry(req, deps, "run.a2a", callerOf(req, deps)), runStore, id);
+    if (!admitted)
         throw new RpcError(A2A_TASK_NOT_FOUND, A2A_TASK_NOT_FOUND_MESSAGE);
-    return taskFromRun(run);
+    return taskFromRun(admitted.row);
 }
 async function handleExtendedCard({ req, ctx, serve }) {
     return buildAgentCard(serve, cardReaderOf(req, ctx.deps.config), A2A_METHODS);

package/dist/http/routes/approvals-assistant.d.ts

@@ -2,12 +2,13 @@ import type { IncomingMessage, ServerResponse } from "node:http";
 import type { QuestionAnswer } from "@sema-agent/core";
 import type { CheckpointStoreFull } from "../../plugins/store-backend.js";
 import { type ToolApprovalCoordinator } from "../../tool-approval.js";
+import { type RouteSessionStore } from "../owner-access.js";
 import { type GovernancePosture } from "../../runtime-governance.js";
 import { type GateIntentView } from "../../approval.js";
 import { type RouteCtx, type RouteDecl, type RouteMatch, type RouteIdsOf } from "../route-ctx.js";
 import { type KeyClosureIssue } from "../../request-key-closure.js";
 import { type PeerInboundPendingRow } from "../../peer-inbound-face.js";
-import { type PlacementReadingSessionStore, type SessionAgent } from "../../session-agent.js";
+import type { SessionAgent } from "../../session-agent.js";
 /** 族的成员 = 路由表行 id(改名 / 删行 ⇒ 下表的键当场编译红)。 */
 export type DecisionDoorId = Extract<ApprovalsAssistantRouteId, "approval-decide" | "assistant-task-plan-review">;
 /** 一道门的静态描述 —— 只写**这道门自己**的东西;路径、路径段、别门的键一概不在这里写(从来源读)。 */
@@ -164,7 +165,7 @@ peerInbound: (() => readonly PeerInboundPendingRow[]) | undefined,
  * 🔴 [ref]:停驻行 `agent` 的会话店面 —— 与 `GET /v1/approvals` 同一只(`deps.sessionStorage`),经同一只整批投影 {@link projectDurableQueue}。
  * `undefined` / 店不交 `placementOf` = 这台部署不存委派元组 ⇒ 没有一帧带 `agent`(帧字节与 [ref] 之前逐字相同)。位置在 `scope` 之前、与 `live` 并列:每个生产调用点都必须表态。
  */
-sessions: PlacementReadingSessionStore | undefined, scope: string | undefined, 
+sessions: Pick<RouteSessionStore, "placementOf"> | undefined, scope: string | undefined, 
 /** [ref]②:出身归因的部署侧一半 + 三张审批名单(问的属主)。缺席 ⇒ 归不出治理出身(键缺席,与 best-effort 同方向)、没有一行读作
  *  部署名单的问(记不住,方向是多问)。**位置在 `pollMs` 之前**是刻意的:`pollMs` 只有测试传,而本参数是每个生产调用点都必须给的那一个。 */
 governance?: PendingProjectionDeployment, pollMs?: number): Promise<void>;