@sema-agent/server 7.149.0 → 7.150.0

package/dist/http/routes/sessions.js

@@ -14,8 +14,8 @@ import { readWritableSessionPermissionRules } from "../../session-policy-wire.js
 import { sendJson, sendError, sendSessionError, sendSessionPolicyError, sseHeaders, httpErrorBody } from "../send.js";
 import { gatedPerson, gatedSubject, sendPrincipalRefusal } from "../principal-gate.js";
 import { personOf } from "../../owner-brands.js";
-import { headReadOf, leafOfAdmittedHead, sessionFaceOfHead } from "../../session-incarnation.js";
-import { admitSessionById, admitSessionRow, admittedAsFleet, callerEntry, callerOf, deliverVerdict, enter, judgeSessionRow, protocolEntry, readOwnerCell, refuse, seesRun, sessionRowPresent } from "../owner-access.js";
+import { leafOfAdmittedHead, sessionFaceOfHead } from "../../session-incarnation.js";
+import { admitSessionById, admitSessionForDeletion, admitSessionRow, admitSessionView, admittedAsFleet, callerEntry, callerOf, deliverVerdict, enter, judgeSessionById, protocolEntry, readOwnerCell, readVisibleLatestRun, refuse, sessionOwnerUnchanged } from "../owner-access.js";
 import { assertNever } from "../route-ctx.js";
 import * as facts from "../../capability-facts.js";
 import { rosterAgentId } from "./agents-roster.js";
@@ -67,11 +67,9 @@ async function readLastLegMcp(deps, sessionId, entry) {
     const runStore = deps.runStore;
     if (!runStore || sessionId === null)
         return undefined;
-    const latest = await runStore.latestRunForSession(sessionId);
+    const latest = await readVisibleLatestRun(entry, runStore, sessionId);
     if (latest === undefined)
         return undefined;
-    if (!seesRun(entry, latest.owner))
-        return undefined;
     const events = await runStore.getEvents(latest.taskId, 0);
     for (let i = events.length - 1; i >= 0; i--) {
         const ev = events[i];
@@ -87,26 +85,7 @@ async function readLastLegMcp(deps, sessionId, entry) {
 export async function handleSessions(req, res, match, ctx) {
     const { deps } = ctx;
     const { readJson, safeDecode } = ctx.helpers;
-    const readOwnedSessionView = async (entry, sessionAudit, sessionId, readOpts) => {
-        const headOf = headReadOf(deps.sessionStorage);
-        if (headOf !== undefined) {
-            const head = await readOwnerCell(entry, sessionId, () => headOf(sessionId));
-            if ((await admitSessionRow(entry, res, deps.sessionStorage, sessionId, head)) === undefined)
-                return undefined;
-        }
-        let audit;
-        try {
-            audit = await sessionAudit(sessionId, readOpts);
-        }
-        catch (e) {
-            if (headOf !== undefined)
-                throw e;
-            throw new Error(`session view read failed before ownership could be established: ${e instanceof Error ? e.message : String(e)}`, { cause: e });
-        }
-        if ((await admitSessionRow(entry, res, deps.sessionStorage, sessionId, audit)) === undefined)
-            return undefined;
-        return audit;
-    };
+    const readOwnedSessionView = (entry, sessionAudit, sessionId, readOpts) => admitSessionView(entry, res, deps.sessionStorage, sessionAudit, sessionId, readOpts);
     const sse = ctx.local.sessions;
     const { mcpStatusCache, a2aStatusCache } = ctx.local.sessions;
     {
@@ -262,8 +241,8 @@ export async function handleSessions(req, res, match, ctx) {
     }
     {
         if (match.decl.id === "session-head") {
-            const headOf = headReadOf(deps.sessionStorage);
-            if (!headOf) {
+            const headFact = facts.sessionOwnership(deps);
+            if (!headFact.available) {
                 sendError(res, 501, "capability.session_store_required", "session head probe requires a durable session store (DB_BACKEND=mysql|pg|local)");
                 return;
             }
@@ -273,8 +252,7 @@ export async function handleSessions(req, res, match, ctx) {
                 return;
             }
             const headEntry = callerEntry(req, deps, match.decl.id);
-            const headRead = await readOwnerCell(headEntry, headSession, () => headOf(headSession));
-            const admittedHead = await admitSessionRow(headEntry, res, deps.sessionStorage, headSession, headRead);
+            const admittedHead = await admitSessionById(headEntry, res, headFact.sessionStorage, headSession);
             if (admittedHead === undefined)
                 return;
             const leafId = leafOfAdmittedHead(admittedHead.row);
@@ -317,8 +295,6 @@ export async function handleSessions(req, res, match, ctx) {
                 return;
             }
             const evEntry = callerEntry(req, deps, match.decl.id);
-            const readHead = (id) => readOwnerCell(evEntry, id, () => evFact.sessionStorage.headOf(id));
-            const readOwner = async (id) => (await readHead(id))?.owner;
             const watch = evFact.watch;
             const evSession = safeDecode(match.params.sessionId);
             if (evSession === null) {
@@ -354,7 +330,7 @@ export async function handleSessions(req, res, match, ctx) {
                     return;
                 }
                 sse.sseOwnerLookups++;
-                const admissionP = readHead(evSession).then(async (head) => (!sessionRowPresent(head) ? undefined : { head, verdict: await judgeSessionRow(evEntry, evFact.sessionStorage, evSession, head) }));
+                const admissionP = judgeSessionById(evEntry, evFact.sessionStorage, evSession);
                 void admissionP.catch(() => undefined).then(() => { sse.sseOwnerLookups--; });
                 let stallTimer;
                 let admission;
@@ -381,12 +357,13 @@ export async function handleSessions(req, res, match, ctx) {
                     refuse(evEntry, res, "missing");
                     return;
                 }
-                if (deliverVerdict(evEntry, res, admission.verdict) === undefined) {
+                const evAdmitted = deliverVerdict(evEntry, res, admission);
+                if (evAdmitted === undefined) {
                     cleanup();
                     return;
                 }
-                leafOfAdmittedHead(admission.head);
-                const owner = admission.head.owner;
+                leafOfAdmittedHead(evAdmitted.row);
+                const owner = evAdmitted.row.owner;
                 const q = new URLSearchParams(match.search);
                 const lastLeafId = q.get("lastLeafId");
                 let first = true;
@@ -485,9 +462,9 @@ export async function handleSessions(req, res, match, ctx) {
                     }
                     ownerCheckPending = true;
                     ownerCheckStartedAt = Date.now();
-                    void readOwner(evSession).then((o) => {
+                    void sessionOwnerUnchanged(evEntry, evFact.sessionStorage, evSession, owner).then((same) => {
                         ownerCheckPending = false;
-                        if (!closed && o !== owner)
+                        if (!closed && !same)
                             onEnd();
                     }).catch(() => { ownerCheckPending = false; });
                 }, hbMs);
@@ -706,14 +683,11 @@ export async function handleSessions(req, res, match, ctx) {
         const store = rowFact.sessionStorage;
         const sessionId = match.params.sessionId;
         const patchEntry = callerEntry(req, deps, match.decl.id);
-        const head = await store.headOf(sessionId);
-        if (head === undefined) {
-            refuse(patchEntry, res, "missing");
+        const patchAdmitted = await admitSessionById(patchEntry, res, store, sessionId);
+        if (patchAdmitted === undefined)
             return;
-        }
+        const head = patchAdmitted.row;
         const face = sessionFaceOfHead(sessionId, head);
-        if ((await admitSessionRow(patchEntry, res, store, sessionId, face)) === undefined)
-            return;
         leafOfAdmittedHead(head);
         const read = readSessionRowPatch(await readJson(req));
         if ("problem" in read) {
@@ -903,7 +877,7 @@ export async function handleSessions(req, res, match, ctx) {
                 sendError(res, 400, "request.id_invalid", "invalid session id (must be a canonical uuid)");
                 return;
             }
-            const deleteAdmitted = await admitSessionById(deleteEntry, res, deleteFact.gateStore, sessionId);
+            const deleteAdmitted = await admitSessionForDeletion(deleteEntry, res, deleteFact.sessionStorage, sessionId);
             if (deleteAdmitted === undefined)
                 return;
             const owner = deleteAdmitted.row.owner;

package/dist/http/routes/tasks.js

@@ -21,7 +21,8 @@ import { writeLiveFrame, writeLiveHeartbeat } from "../live-frame.js";
 import { contextUsageEventData, turnEndEventData, toolStartEventData, toolEndEventData, taskProgressEventData, taskStartedEventData, taskNotificationEventData, compactedEventData, diagnosticsEventData, brainStatusEventData, steeringInjectedEventData, compactionOutcomeEventData, compactionStartedEventData, workspaceChangedEventData, wiringManifestFaceEventData, toolRosterDeltaEventData, toolProgressEventData, toolDisclosureEventData, humanInputEventData, appendModelUsageDelta, attachModelUsage, createPromptManifestSeat, identityFields } from "../../trace/project.js";
 import { cascadeConfig, fillRunPreviewOnDelivery, runMeta } from "../run-meta.js";
 import { idemCallerOf, inflightKeyOf, submissionIdemOf } from "../idempotency.js";
-import { isReplayedOutcome, replayedOutcome, replayOfExistingRun } from "../submit-replay.js";
+import { answerReplay, isReplayedOutcome, replayedOutcome, replayOfExistingRun } from "../submit-replay.js";
+import { readReplayHit, runFactsOf } from "../owner-access.js";
 import { httpErrorCode, sendJson, sseHeaders } from "../send.js";
 import { collectSsePreamble } from "../sse-log.js";
 import { buildApprovalPreamble } from "../../approval-card.js";
@@ -109,12 +110,12 @@ export async function handleTasks(req, res, match, ctx) {
         const idem = rawIdem ? submissionIdemOf(rawIdem, idemCallerOf(req, ctx), keyedBody) : undefined;
         const inflightKey = idem ? inflightKeyOf(idem, "sync") : undefined;
         const cached = inflightKey ? idemCache.peek(inflightKey) : undefined;
-        const keyedRow = idem && !cached && deps.runStore ? await deps.runStore.getRunByIdem(idem.key) : undefined;
-        if (keyedRow && deps.runStore) {
-            const replay = await replayOfExistingRun(keyedRow, { subject: submitter, idem }, "sync", deps, deps.runStore);
-            if (liveStream && replay.status === 200) {
-                sseHeaders(res, { "x-task-id": keyedRow.taskId });
-                writeMetaFrame(res, keyedRow.taskId, keyedRow.sessionId);
+        const keyedHit = idem && !cached && deps.runStore ? await readReplayHit(submitter, deps.config, deps.runStore, { idemKey: idem.key }, undefined) : undefined;
+        if (keyedHit && deps.runStore) {
+            const replay = await answerReplay(keyedHit, { subject: submitter, idem }, "sync", deps.runStore);
+            if (liveStream && replay.status === 200 && keyedHit.kind === "visible") {
+                sseHeaders(res, { "x-task-id": keyedHit.row.taskId });
+                writeMetaFrame(res, keyedHit.row.taskId, keyedHit.row.sessionId);
                 writeLiveFrame(res, doneFrameOfOutcome(replay));
                 res.end();
             }
@@ -800,7 +801,7 @@ export async function handleTasks(req, res, match, ctx) {
                             evict();
                         if (!runRowSettled && durableTaskId && deps.runStore) {
                             try {
-                                const row = await deps.runStore.getRun(durableTaskId);
+                                const row = await runFactsOf(deps.runStore, durableTaskId);
                                 if (row?.status === "running") {
                                     const pending = await deps.checkpointStore?.findPendingTokenBySession(prepared.spec.sessionId, undefined, { axis: "run" });
                                     const backstopCause = ac.cause();

package/dist/http/routes/trace-usage.js

@@ -9,7 +9,7 @@ import { bindSseLifecycle } from "../sse-lifecycle.js";
 import { sendJson, sendError, sseHeaders, SSE_MAX_STREAM_MS, SSE_HEARTBEAT_IDLE_MS } from "../send.js";
 import { filterFingerprint } from "../cursor-fingerprint.js";
 import { sendUnauthorized } from "../principal-gate.js";
-import { admitRunById, enter, entryIsFleet, readVisibleRun, routeListFilter, runRowAt } from "../owner-access.js";
+import { admitRunById, enter, entryIsFleet, listVisibleRuns, readVisibleRun, routeListFilter, runListOwnerOf, toolResultRefOwned } from "../owner-access.js";
 import { listFilterOf } from "../../owner-faces.js";
 import { assertNever } from "../route-ctx.js";
 import * as facts from "../../capability-facts.js";
@@ -42,7 +42,7 @@ export async function handleTraceUsage(req, res, match, ctx) {
         const traceEntry = enter(req, res, deps, match.decl.id);
         if (traceEntry === undefined)
             return;
-        const gateOwner = listFilterOf(traceEntry.face, traceEntry.caller).gateOwner;
+        const traceFilter = listFilterOf(traceEntry.face, traceEntry.caller);
         const runs = facts.durableRuns(deps);
         if (!runs.available) {
             sendError(res, 501, "capability.run_store_required", "trace API requires a durable run store (DB_BACKEND=mysql|pg|local)");
@@ -61,20 +61,20 @@ export async function handleTraceUsage(req, res, match, ctx) {
         }
         switch (match.decl.id) {
             case "task-trace-list":
-                await handleTaskList(res, runStore, query, gateOwner);
+                await handleTaskList(res, runStore, query, traceFilter);
                 return;
             case "task-trace-turns":
                 await handleTaskTurns(res, runStore, admittedRun, query);
                 return;
             case "task-trace-stream":
-                await streamTaskTrace(req, res, runStore, admittedRun, match.search);
+                await streamTaskTrace(req, res, runStore, traceEntry, admittedRun, match.search);
                 return;
             case "task-trace-artifacts":
                 await handleTaskArtifacts(res, runStore, admittedRun);
                 return;
             case "task-tool-result": {
                 const ownedRun = admittedRun;
-                const readRun = ownedRun !== undefined ? async () => ownedRun : () => readVisibleRun(traceEntry, runStore, taskId);
+                const readRun = ownedRun !== undefined ? async () => ownedRun : async () => (await readVisibleRun(traceEntry, runStore, taskId))?.row;
                 await handleToolResult(res, deps.toolResultStore, taskId, readRun, safeDecode(match.params.ref), query);
                 return;
             }
@@ -161,11 +161,12 @@ function decodeCursor(s, expectF) {
         return undefined;
     }
 }
-async function handleTaskList(res, runStore, query, forceOwner) {
+async function handleTaskList(res, runStore, query, filter) {
     const status = query.get("status") ?? undefined;
     const jobId = query.get("jobId") ?? undefined;
     const source = query.get("source") ?? undefined;
-    const owner = forceOwner != null ? forceOwner : (query.get("owner") ?? undefined);
+    const namedOwner = query.get("owner") ?? undefined;
+    const owner = runListOwnerOf(filter, namedOwner);
     const limit = Math.min(100, Math.max(1, Number(query.get("limit") ?? 50) || 50));
     const f = filterFingerprint([status, jobId, source, owner]);
     const cursor = decodeCursor(query.get("cursor"), f);
@@ -173,7 +174,7 @@ async function handleTaskList(res, runStore, query, forceOwner) {
         sendError(res, 400, "request.cursor_filter_mismatch", "cursor was issued under a different filter (status/jobId/source/owner) — restart from the first page without a cursor");
         return;
     }
-    const rows = await runStore.listRuns({ ...(status ? { status } : {}), ...(jobId ? { jobId } : {}), ...(source ? { source } : {}), ...(owner ? { owner } : {}), ...(cursor ? { cursor } : {}), limit: limit + 1 });
+    const rows = await listVisibleRuns(runStore, filter, namedOwner, { ...(status ? { status } : {}), ...(jobId ? { jobId } : {}), ...(source ? { source } : {}), ...(cursor ? { cursor } : {}), limit: limit + 1 });
     const hasMore = rows.length > limit;
     const page = hasMore ? rows.slice(0, limit) : rows;
     const tasks = page.map((r) => taskSummary(r));
@@ -216,8 +217,7 @@ async function handleToolResult(res, store, taskId, readRun, ref, query) {
     const run = await readRun();
     if (!run)
         return notFound();
-    const owner = store?.ownerOf ? await store.ownerOf(ref) : undefined;
-    const ownedByThisCaller = owner !== undefined && owner.sessionId === run.sessionId && (owner.taskId === undefined || owner.taskId === taskId);
+    const ownedByThisCaller = await toolResultRefOwned(store, ref, run);
     if (!ownedByThisCaller)
         return notFound();
     if (!store)
@@ -240,7 +240,7 @@ async function handleTaskTurns(res, runStore, run, query) {
     const nextCursor = eligible.length > limit && oldest ? String(oldest.seq) : undefined;
     sendJson(res, 200, { turns, ...(nextCursor ? { nextCursor } : {}), retainedFrom });
 }
-async function streamTaskTrace(req, res, runStore, admitted, search) {
+async function streamTaskTrace(req, res, runStore, entry, admitted, search) {
     const taskId = admitted.taskId;
     const lastId = Number(req.headers["last-event-id"] ?? new URLSearchParams(search).get("from") ?? 0);
     let from = Number.isFinite(lastId) ? lastId : 0;
@@ -264,11 +264,11 @@ async function streamTaskTrace(req, res, runStore, admitted, search) {
         }
     };
     while (!closed) {
-        const [events, raw] = await Promise.all([runStore.getEvents(taskId, from), runStore.getRun(taskId)]);
+        const [events, reread] = await Promise.all([runStore.getEvents(taskId, from), readVisibleRun(entry, runStore, taskId)]);
         write(events);
-        if (!raw)
+        if (!reread)
             break;
-        const run = await runRowAt("task-trace-stream", runStore, raw);
+        const run = reread.row;
         if (run.status !== "running") {
             write(await runStore.getEvents(taskId, from));
             if (!deliveredTerminal && isHolderDeathVerdict(run))

package/dist/http/routes/workflows.d.ts

@@ -2,6 +2,7 @@ import type { IncomingMessage, ServerResponse } from "node:http";
 import { type WorkflowRun } from "@sema-agent/core";
 import { type Admit } from "../../trace/projection-table.js";
 import type { RouteCtx, RouteMatch, RouteIdsOf } from "../route-ctx.js";
+/** SVC-5 的 steer 路——`handle()` 里位置在 tasks/runs 之后(鉴权门之后),故是**独立**的域入口。 */
 /** 路由体 = 从 `server.ts` 的 `handle()` 里**整段剪切**过来的原文(唯一改动:统一去缩进两格)。裸 `return;`
  *  = 「本域已应答」;走到函数尾才是「没匹配上」。跨域的东西一律在首行解构出来。 */
 export declare function handleWorkflows(req: IncomingMessage, res: ServerResponse, match: RouteMatch<WorkflowsRouteId>, ctx: RouteCtx): Promise<void>;

package/dist/http/routes/workflows.js

@@ -1,6 +1,6 @@
 import { persistedPlaneOf } from "../../terminal.js";
 import { z } from "zod";
-import { getWorkflowRun, subscribeWorkflow, deriveAgentDisplayStatus, callKeyOrdinal, runParkedOf, JOURNAL_INCOMPATIBLE_ERROR_CODE, WorkflowJournalIncompatibleError } from "@sema-agent/core";
+import { subscribeWorkflow, deriveAgentDisplayStatus, callKeyOrdinal, runParkedOf, JOURNAL_INCOMPATIBLE_ERROR_CODE, WorkflowJournalIncompatibleError } from "@sema-agent/core";
 import { redactSteerIn, STEER_IN_MAX_CHARS, STEER_IN_MAX_REQUEST_CHARS } from "../../orchestration/workflow-agent-steer.js";
 import { journalEntryOfCell, journalEntryPayload, journalRowPayloadOf } from "../../plugins/workflow-journal-payload.js";
 import { redactSecrets } from "../../trace/redact.js";
@@ -10,30 +10,18 @@ import { projectByTable } from "../../trace/projection-table.js";
 const JOURNAL_PROJECTION_MEMO_CAP = 1024;
 const journalProjectionMemo = new Map();
 import { sendJson, sendError, sseHeaders } from "../send.js";
-import { gatedSubject, explicitOperatorOk, sendPrincipalRefusal } from "../principal-gate.js";
+import { explicitOperatorOk } from "../principal-gate.js";
 import { partsOf } from "../../owner-brands.js";
-import { taskSpecIdentityOf } from "../../engine-identity.js";
 import { assertNever } from "../route-ctx.js";
-import { callerOf, sessionAsserted } from "../owner-access.js";
+import { admitWorkflowRun, enter, judgeWorkflowRun, listVisibleWorkflows, refuse } from "../owner-access.js";
 import * as facts from "../../capability-facts.js";
 import { steerBodyKeyIssue } from "../../request-key-closure.js";
-function sendWorkflowAbsent(res) {
-    sendError(res, 404, "not_found.workflow", "workflow not found");
-}
-const WORKFLOW_SESSION_ASSERTION = {
-    "workflow-detail": { phase: "accept", label: "workflow.detail" },
-    "workflow-journal": { phase: "accept", label: "workflow.journal" },
-    "workflow-stream": { phase: "accept", label: "workflow.stream" },
-    "workflow-agent-steer": { phase: "accept", label: "workflow.agent-steer" },
-};
 export async function handleWorkflows(req, res, match, ctx) {
     const { deps } = ctx;
     {
-        const subject = gatedSubject(req, deps.config);
-        if (deps.config.requirePrincipal && !subject) {
-            sendPrincipalRefusal(res, req, deps.config);
+        const wfEntry = enter(req, res, deps, match.decl.id);
+        if (wfEntry === undefined)
             return;
-        }
         let journalStore;
         if (match.decl.id === "workflow-journal") {
             const journalFace = facts.workflowsJournal(deps);
@@ -49,7 +37,6 @@ export async function handleWorkflows(req, res, match, ctx) {
             return;
         }
         const runStore = runs.store;
-        const scope = taskSpecIdentityOf(subject === undefined ? undefined : partsOf(subject)).principal ?? "default";
         const wfId = match.params.runId;
         const isStream = match.decl.id === "workflow-stream";
         if (match.decl.id === "workflows-list") {
@@ -57,7 +44,7 @@ export async function handleWorkflows(req, res, match, ctx) {
             const statusFilter = q.get("status");
             const limit = Math.min(100, Math.max(1, Number(q.get("limit") ?? 50) || 50));
             const sessionFilter = q.get("session");
-            const sessionRuns = await runStore.listByScope(scope, {
+            const sessionRuns = await listVisibleWorkflows(wfEntry, runStore, {
                 ...(statusFilter ? { status: statusFilter } : {}),
                 limit,
                 ...(sessionFilter !== null ? { session: sessionFilter } : {}),
@@ -71,15 +58,11 @@ export async function handleWorkflows(req, res, match, ctx) {
             sendJson(res, 200, { workflows: redacted });
             return;
         }
-        const run = await getWorkflowRun(runStore, wfId, scope);
-        if (!run || run.scope !== scope) {
-            sendWorkflowAbsent(res);
-            return;
-        }
-        if (!sessionAsserted(WORKFLOW_SESSION_ASSERTION[match.decl.id], req, run.originatingSessionId, callerOf(req, deps).operator)) {
-            sendWorkflowAbsent(res);
+        const wfAdmitted = await admitWorkflowRun(wfEntry, res, runStore, wfId);
+        if (wfAdmitted === undefined)
             return;
-        }
+        const run = wfAdmitted.row;
+        const scope = run.scope;
         if (match.decl.id === "workflow-journal") {
             if (journalStore === undefined)
                 throw new Error("workflow-journal reached without the workflowsJournal journal witness");
@@ -182,12 +165,11 @@ export async function handleWorkflowAgentSteer(req, res, match, ctx) {
             sendWorkflowsUnavailable(res, runs.why);
             return;
         }
-        const subject = gatedSubject(req, deps.config);
-        const principal = subject === undefined ? undefined : partsOf(subject).person;
-        if (deps.config.requirePrincipal && principal === undefined) {
-            sendPrincipalRefusal(res, req, deps.config);
+        const steerEntry = enter(req, res, deps, match.decl.id);
+        if (steerEntry === undefined)
             return;
-        }
+        const subject = steerEntry.caller.subject;
+        const principal = subject === undefined ? undefined : partsOf(subject).person;
         const wfRunId = safeDecode(match.params.runId);
         const label = safeDecode(match.params.label);
         if (wfRunId === null || label === null) {
@@ -211,14 +193,14 @@ export async function handleWorkflowAgentSteer(req, res, match, ctx) {
             return;
         }
         const trusted = explicitOperatorOk(principal, deps.config);
-        const ownerScope = taskSpecIdentityOf(subject === undefined ? undefined : partsOf(subject)).principal ?? "default";
-        const wfRun = await getWorkflowRun(runs.store, wfRunId, ownerScope);
-        if (!trusted && !wfRun) {
-            sendWorkflowAbsent(res);
+        const wfVerdict = await judgeWorkflowRun(steerEntry, runs.store, wfRunId);
+        if (wfVerdict === "session_mismatch") {
+            refuse(steerEntry, res, "session_mismatch");
             return;
         }
-        if (wfRun && !sessionAsserted(WORKFLOW_SESSION_ASSERTION["workflow-agent-steer"], req, wfRun.originatingSessionId, callerOf(req, deps).operator)) {
-            sendWorkflowAbsent(res);
+        const wfRun = typeof wfVerdict === "object" ? wfVerdict.row : undefined;
+        if (!trusted && wfRun === undefined) {
+            refuse(steerEntry, res, wfVerdict === "missing" ? "missing" : "not_visible");
             return;
         }
         const sendNotRunningWf = (error) => sendError(res, 409, "steering.not_running", error);

package/dist/http/server.d.ts

@@ -4,6 +4,7 @@ import type { SideQueryAccounting } from "../budget.js";
 import type { SessionPurgeOutcome } from "../session-deletion.js";
 import type { IncomingMessage } from "node:http";
 import { type Runner, type RunnerDeps, type TaskSpec, type TaskResult, type WorkflowRunStore, type MemoryEntry, type MemoryExportBundle, type MemoryImportReport, type SideQuerySpec, type SideQueryResult, type Brain, type EngineNotice } from "@sema-agent/core";
+import type { ProjectContext } from "../project-context.js";
 import type { TaskRequestBody } from "./wire-types.js";
 import type { ServiceConfig } from "../config-types.js";
 import { type SessionMirrorRuling } from "../web-admin-client/facade.js";
@@ -130,7 +131,9 @@ export interface ServiceCoreDeps {
      *  已过期,按新行为改。
      *  `opts.unattendedLeg`([ref] 候裁 18,codex r3 F1;[ref] ① 改形):续跑家族在 ctx 带无人值守标(`CheckpointCtx.unattendedLeg`)时递 `true` ——
      *  装配器在**全部折叠之后**经首跑同一只合并口 `withUnattendedLeg` 重挂那条腿(`default` + 按类作答的 onAsk)。只由续跑腿
-     *  按服务端写的 ctx 位递,绝不从请求体读。 */
+     *  按服务端写的 ctx 位递,绝不从请求体读。
+     *  `opts.projectContext`(项目上下文继承):续跑家族把提交腿冻结的那一份(`CheckpointCtx.projectContext`,服务端写)原样递回 —— 装配器在续跑腿上只重放它、不读登记簿;
+     *  新提交腿不递(装配器自己在头部判)。同样只由续跑腿按服务端写的 ctx 位递,绝不从请求体读。 */
     /** `opts.execution`(必填):这条腿的执行上下文(`http/execution-context.ts`;只 `fresh` / `continuation` 两形,`root` 恒在)。装配器要用这条腿的根会话
      *  (场景设施的分区键、受理见证)读 `opts.execution.root` —— 它与 server 随后盖进 spec 的根是同一个值,装配器自己不写根。 */
     /** `opts.lease`(必填):这条腿的**宿主租约** —— 装配在它之下登记本腿交给引擎的对端声明(`peerDesk.declare(草稿, opts.lease)`)。
@@ -141,6 +144,7 @@ export interface ServiceCoreDeps {
         liveStream?: boolean;
         onNotice?: (notice: EngineNotice) => void;
         unattendedLeg?: true;
+        projectContext?: ProjectContext;
         lease: PeerLease;
         execution: ExecutionRoot;
     }) => ResolvedTaskSpec | Promise<ResolvedTaskSpec>;
@@ -755,8 +759,8 @@ export interface ServiceDeploymentDeps {
      * 缺席(嵌入方 / 夹具)= 两项恒 0,两个读数逐字同 7.145.x。
      */
     sessionResidentBackground?: () => SessionResidentCounts;
-    /** 编排器片 2 件 3:服务租约此刻的读数(`fleet/serving-lease.ts` 的客户端交出;引擎信号铸点与计费准入判同读)。缺席 = 没装租约客户端
-     *  (非 fleet 成员 / 没接中心 / 测试夹具)⇒ `none`(与没有租约的引擎逐字同)。 */
+    /** 编排器片 2 件 3:服务租约此刻的读数(`fleet/serving-lease.ts` 的客户端交出;唯一读者 `fleet/engine-signal.ts` 的 `memberLeaseOf` —— 引擎信号铸点
+     *  与计费准入判经它同读,只在 `config.fleetGeneration` 在场〔成员〕时读)。缺席 = 没装租约客户端(非 fleet 成员 / 测试夹具)⇒ `none`。 */
     servingLease?: () => import("../fleet/engine-signal.js").ServingLeaseView;
     /** boot ready 门(b):false = 布防(`CONFIG_REQUIRE_ROSTER=true`)且首次 effective pull 尚未落 roster
      *  (worker 只有占位模型)。就绪原因 `model_roster_pending`(`http/readiness.ts`):计费提交 503 + `/readyz` 503 +
@@ -800,7 +804,7 @@ export interface ServiceDeploymentDeps {
     /** [ref] 追加件:`POST /v1/admin/config/refresh` 的实现面 —— 触发**一次既有**的 refresh 拍(在飞则 join)。
      *  缺席 / 回 `"not-wired"` = 本部署没有配置管道 ⇒ 该口诚实 4xx(绝不吞成 200)。 */
     configRefreshNow?: () => Promise<"triggered" | "not-wired" | "failed">;
-    /** DESIGN-278 §5 S2([ref]):center **当前在管**的 ServiceConfig 键集 —— `GET /v1/config/catalog`
+    /** [ref] §5 S2([ref]):center **当前在管**的 ServiceConfig 键集 —— `GET /v1/config/catalog`
      *  判 `effectiveLane`(env 占位/center 在管/默认)的 center 半场。缺席或返回 undefined = 本部署
      *  没有配置管道(纯 env worker / 测试夹具)⇒ 目录把每条 center 腿如实标「不在管」(additive)。 */
     webAdminManagedKeys?: () => ReadonlySet<string> | undefined;

package/dist/http/server.js

@@ -26,6 +26,7 @@ import { createRunConcurrencyGate, liveRunIdsOf } from "./run-concurrency-cap.js
 import { sqlEngineSeatIssue } from "../sql-engine-posture.js";
 import { parkDecisionStoreRefusal } from "../orchestration/workflow-park-decision.js";
 import { CHECKPOINT_CTX_SEALING_REQUIRED } from "./checkpoint-ctx.js";
+import { SERVING_LEASE_MEMBERSHIP_REQUIRED } from "../fleet/engine-signal.js";
 import { PARKED_REVIVE_EXECUTION_SEAT_REQUIRED } from "../parked-decide.js";
 import { a2aAudienceVerifiedSourceRefusal, operatorDeclarationRefusal } from "../config-invariants.js";
 import { retiredServiceDepsRefusal } from "./retired-service-deps.js";
@@ -148,6 +149,8 @@ export function createHttpServer(rawDeps) {
         throw new Error(`createHttpServer: ${CHECKPOINT_CTX_SEALING_REQUIRED}`);
     if (deps.parkedReviveSurface !== undefined && deps.sessionStorage?.executionPlacement === undefined)
         throw new Error(`createHttpServer: ${PARKED_REVIVE_EXECUTION_SEAT_REQUIRED}`);
+    if (deps.servingLease !== undefined && deps.config.fleetGeneration === undefined)
+        throw new Error(`createHttpServer: ${SERVING_LEASE_MEMBERSHIP_REQUIRED}`);
     const idemCache = new IdempotencyCache();
     const inflightRuns = new Map();
     const preemptableRuns = new DrainYieldingPreemptBook(() => deps.drainState?.draining === true);
@@ -183,7 +186,7 @@ export function createHttpServer(rawDeps) {
     if (deps.drainState)
         deps.drainState.yieldInflight = () => preemptableRuns.yieldAll();
     if (deps.hookWakeBus) {
-        deps.hookWakeBus.deliver = async (sessionId, text) => {
+        const deliverHookWake = async (sessionId, text) => {
             try {
                 validatePendingSteer({ text, trusted: false });
             }
@@ -218,6 +221,7 @@ export function createHttpServer(rawDeps) {
                 return false;
             }
         };
+        deps.hookWakeBus.deliver = deliverHookWake;
     }
     const { quotaExceeded, ownerCostQuotaDenied, ownerFleetLeaseDenied, ownerLeaseDenied, ownerQuotaDenied, leaseDenied, usageWindowDenialFor, usageWindowDenied, rateLimited, safeDecode, readJson, readRawBody } = createRequestGuards({ deps });
     const { prepareSpec } = createAdmission({ deps, readJson, runnerFor });

package/dist/http/stored-body-replay.d.ts

@@ -1,29 +1,9 @@
-/**
- * 「这条停驻行的持久化体在本版上能否重放」—— **唯一**判据(四问一只,外加 `settings.env` 凭据一臂;五个问点同调:续跑驱动段 `resume-legs.ts` `resolveResumeSpecOrBlocked`、
- * plan_review 的 prepare 段、SLA 拒扫腿的跳过臂 `approval-sweeps.ts`、终态 run 的 steer 铸唤醒卡之前 `routes/runs.ts`;`resolveSpec` 本身留作提交腿的拒点)。
- * 四问的规则、记号、拒句与删除条件的属主 = `http/checkpoint-ctx.ts` 顶注;答复 = 那里的 `storedBodyReplayAnswer`。
- *
- * 为什么判据住在这里而不是 `checkpoint-ctx.ts`:模式词问要读体的**生效模式词**(`task-settings.ts` `storedBodyPermissionMode`,请求设置的解析层)与本部署此刻的
- * **入口地板**(`runtime-governance.ts` `autonomyModeFloor`)—— 这两只属主带着配置层的包外依赖;`checkpoint-ctx.ts` 被随包的本地排空脚本经编译产物 import,
- * 它的闭包只许 node 内建 / 引擎包根(`test/drain-check-local.test.ts` 的闭包门)。判据只有这一只,allow 读法问、工具名清单问与退役请求键问的谓词照旧住在各自属主里。
- */
-import type { PermissionMode } from "@sema-agent/core";
-import { type Autonomy } from "../runtime-governance.js";
 import { type InertToolListEntry } from "../rule-entry-list.js";
 import { type ExecutionConfigRootDeployment } from "../execution-config-root.js";
 import { type UnreadMembersDeployment } from "../unread-request-members.js";
 import { type ModelApiKeyEnvTable } from "../server-secret-env.js";
 import { type StoredBodyReplayRefusal } from "./checkpoint-ctx.js";
 import type { CheckpointCtx } from "./route-ctx.js";
-/**
- * 模式词问:本行体里的模式词能否按当前读法重放。不能 ⇔ 本部署此刻有入口地板 ∧ 行上没有当前的模式词读法记号 ∧ 体的生效词进这块地板会变
- * (`runtime-governance.ts` `entryPermissionMode`,与提交入口的盖章同一只函数;判的是「词变不变」而不是 `clamped` —— 体无词的旧行进地板取地板本身,
- * 那也是变)⇒ 返回拒因的两个事实(体的词、地板);能 ⇒ `undefined`。
- */
-export declare function permissionModeReadingUnstated(ctx: CheckpointCtx, floor: PermissionMode | undefined): {
-    stored: PermissionMode | undefined;
-    floor: PermissionMode;
-} | undefined;
 /**
  * 存体里 `settings.permissions.deny` / `ask`(规则编译器读的收紧表)有永远不生效的条目(名字层:退役名 / 短名 / 铸不出的段 / 近似名;core 的规则文法:括号 / 内容文法 / 主字段……;
  * `~/` 形而这个部署解不出 home),或三桶里 user 层的 `/` 形规则而这个部署读不出执行环境的配置根 —— 拒点是 `applyTaskSettings`(422,在 `resolveSpec` 里),那一拍 plan_review 的一次性 nonce 已烧、终态 steer 的唤醒卡已铸、SLA 拒扫跳不过;所以预判也问一遍。
@@ -36,17 +16,16 @@ export declare function permissionModeReadingUnstated(ctx: CheckpointCtx, floor:
  */
 export declare function ruleTablesRefusalWithoutTaskRoot(body: unknown, deployment: ExecutionConfigRootDeployment): InertToolListEntry | undefined;
 /**
- * 预判读的部署配置:`autonomy`(模式词问的模式词地板)、执行车道的 home 两位(`~/` 形规则那一问)、配置根的几位(user 设置层 `/` 规则那一问)与「请求成员读不出」那一问的
+ * 预判读的部署配置:执行车道的 home 两位(`~/` 形规则那一问)、配置根的几位(user 设置层 `/` 规则那一问)与「请求成员读不出」那一问的
  * 租户轴 / 两只注入闸的否决位。`ServiceConfig` 结构上满足,四个问点传 `deps.config` 整份。
  */
 export type StoredReplayDeployment = ExecutionConfigRootDeployment & UnreadMembersDeployment & {
-    readonly autonomy?: Autonomy | undefined;
     /** 生效配置模型条目 name → `apiKeyEnv`(`settings.env` 凭据判据的名单一臂;缺席 = 没有模型条目,与 `serverCredentialValueSources` 的缺省同读)。 */
     readonly modelApiKeyEnv?: ModelApiKeyEnvTable | undefined;
 };
 /**
- * 四问一只判据:不能重放 ⇒ 返回拒的那条规则;能 ⇒ `undefined`。顺序:allow 读法(体里带非空 `allow` 而写者版本证不出 ≥ 7.117.0;常设,按写者版本)→ 请求设置里的条目表(**与拒点同序**:桶门〔形 / 空串 / 超帽〕→ 工具名清单读成空〔**只问限制方向**:放行方向的存量条目读成空,续跑照旧、只留一行运维 warn〕→ 请求成员读不出〔hooks / env / MCP transport / A2A headers …,判据 `unread-request-members.ts`〕→ deny / ask 的名字层 + 规则文法)→ 模式词读法记号 → 体里的退役请求键(几问同中时答先中的那一问 ——
- * 任一问中都不重放,句子只需一句)。`deployment` = 本部署**此刻**的 `config`(活 config:热改即生效):`autonomy` 的地板由它的唯一属主算,`~/` 形规则的 home 由 `executionLaneHomeDir` 算,问点都不自己算。
+ * 三问一只判据:不能重放 ⇒ 返回拒的那条规则;能 ⇒ `undefined`。顺序:allow 读法(体里带非空 `allow` 而写者版本证不出 ≥ 7.117.0;常设,按写者版本)→ 请求设置里的条目表(**与拒点同序**:桶门〔形 / 空串 / 超帽〕→ 工具名清单读成空〔**只问限制方向**:放行方向的存量条目读成空,续跑照旧、只留一行运维 warn〕→ 请求成员读不出〔hooks / env / MCP transport / A2A headers …,判据 `unread-request-members.ts`〕→ deny / ask 的名字层 + 规则文法)→ 体里的退役请求键(几问同中时答先中的那一问 ——
+ * 任一问中都不重放,句子只需一句)。`deployment` = 本部署**此刻**的 `config`(活 config:热改即生效):`~/` 形规则的 home 由 `executionLaneHomeDir` 算,问点都不自己算。
  */
 export declare function storedBodyReplayRefusal(ctx: CheckpointCtx, deployment: StoredReplayDeployment): StoredBodyReplayRefusal | undefined;
 //# sourceMappingURL=stored-body-replay.d.ts.map

package/dist/http/stored-body-replay.js

@@ -1,7 +1,6 @@
-import { REQUEST_SETTINGS_REFUSAL_PREFIX, SETTINGS_PERMISSION_BUCKETS, SETTINGS_RULE_REFUSAL_CODE, neverAutoNamesRefusal, readSettingsEnv, rulePolicyBucketsRefusal, settingsEnvCredentialIssue, settingsPermissionBucketIssue, storedBodyPermissionMode } from "../task-settings.js";
+import { REQUEST_SETTINGS_REFUSAL_PREFIX, SETTINGS_PERMISSION_BUCKETS, SETTINGS_RULE_REFUSAL_CODE, neverAutoNamesRefusal, readSettingsEnv, rulePolicyBucketsRefusal, settingsEnvCredentialIssue, settingsPermissionBucketIssue } from "../task-settings.js";
 import { readTightenOnlySeats, tightenOnlySeatField, tightenOnlySeatIssue } from "../tighten-only-seats.js";
 import { entryProblemsFacts } from "../entry-problems.js";
-import { autonomyModeFloor, entryPermissionMode } from "../runtime-governance.js";
 import { inertToolListEntryOf, replayInertEntry } from "../rule-entry-list.js";
 import { executionLaneHomeDir } from "../execution-lane-caps.js";
 import { executionConfigRootOf } from "../execution-config-root.js";
@@ -10,13 +9,7 @@ import { storedEnvCredentialsDropM38 } from "../stored-request-env-credentials-m
 import { storedToolAxesRereadM19 } from "../stored-request-tool-axes-m19.js";
 import { MAX_NAMED_MEMBERS, unreadRequestMembers, unreadRequestMembersRefusal } from "../unread-request-members.js";
 import { serverCredentialValueSources } from "../server-secret-env.js";
-import { allowListWriterUnproven, permissionModeReadingStated, retiredRequestKeyOf } from "./checkpoint-ctx.js";
-export function permissionModeReadingUnstated(ctx, floor) {
-    if (floor === undefined || permissionModeReadingStated(ctx))
-        return undefined;
-    const stored = storedBodyPermissionMode(ctx.body);
-    return entryPermissionMode(stored, floor).effective === stored ? undefined : { stored, floor };
-}
+import { allowListWriterUnproven, retiredRequestKeyOf } from "./checkpoint-ctx.js";
 const RETIRED_KEY_REWRITE_MIGRATION = { promptProfile: "M30" };
 const BUCKET_GATE_CODE = "request.field_invalid";
 const BUCKET_SIDE = {
@@ -87,9 +80,6 @@ export function storedBodyReplayRefusal(ctx, deployment) {
     const entry = ruleTablesRefusalWithoutTaskRoot(ctx.body, deployment);
     if (entry !== undefined)
         return { kind: "inert_tool_list", entry };
-    const mode = permissionModeReadingUnstated(ctx, autonomyModeFloor(deployment.autonomy));
-    if (mode !== undefined)
-        return { kind: "permission_mode_reading", ...mode, ...writer };
     const retiredKey = retiredRequestKeyOf(ctx.body);
     if (retiredKey !== undefined)
         return { kind: "retired_request_key", key: retiredKey, rewriteWindowEnd: migrationWindowEnd(RETIRED_KEY_REWRITE_MIGRATION[retiredKey]), ...writer };

package/dist/http/submit-ctx.d.ts

@@ -31,7 +31,6 @@ export declare function persistSubmitCtx(store: SubmitCtxStore, deps: {
     readonly logger?: Logger | undefined;
     readonly metrics?: Metrics | undefined;
     readonly checkpointCtxSealing?: CheckpointCtxSealer | undefined;
-    readonly instanceId?: string | undefined;
 }, claim: {
     readonly runStore: RunStore;
     readonly taskId: string;
@@ -41,7 +40,7 @@ export declare function persistSubmitCtx(store: SubmitCtxStore, deps: {
  * 提交腿写续跑输入的入口(三个调用点同调这一只):体与标记按受理座提交时交出的那一份定(见文件头「体里的目标按哪一份写」),只写这一笔。
  * 写不进的处置与答复 = {@link persistSubmitCtx}(本函数只定体、不另判)。
  */
-export declare function persistSubmissionCtx(store: SubmitCtxStore, deps: Parameters<typeof persistSubmitCtx>[1], claim: Parameters<typeof persistSubmitCtx>[2], prepared: Pick<PreparedTaskSubmission, "body" | "auth" | "verify" | "acceptance" | "bodyFromScreenedCtx"> & {
+export declare function persistSubmissionCtx(store: SubmitCtxStore, deps: Parameters<typeof persistSubmitCtx>[1], claim: Parameters<typeof persistSubmitCtx>[2], prepared: Pick<PreparedTaskSubmission, "body" | "auth" | "verify" | "acceptance" | "bodyFromScreenedCtx"> & Partial<Pick<PreparedTaskSubmission, "legFacts">> & {
     readonly spec: Pick<PreparedTaskSubmission["spec"], "sessionId" | "model">;
 }): Promise<SubmitCtxRefusal | typeof SUBMIT_CTX_CLAIM_LOST | undefined>;
 //# sourceMappingURL=submit-ctx.d.ts.map

package/dist/http/submit-ctx.js

@@ -1,6 +1,6 @@
 import { StoreRowTooLargeError } from "../plugins/sql-errors.js";
 import { withdrawClaimedRun } from "./claimed-run.js";
-import { runProvenElsewhere } from "../plugins/store-contracts.js";
+import { createLegCtxClaim } from "../plugins/store-contracts.js";
 import { buildCheckpointCtx, CheckpointCtxUnsealableError } from "./checkpoint-ctx.js";
 import { refusalBody } from "./refusal-body.js";
 import { limitFactsUnmeasured } from "../limit-refusal.js";
@@ -44,7 +44,7 @@ export async function persistSubmitCtx(store, deps, claim, sessionId, fields) {
     let landed;
     try {
         const ctx = buildCheckpointCtx(fields, deps.checkpointCtxSealing, sessionId);
-        landed = await store.putCtx(sessionId, ctx, claim === undefined ? undefined : { fence: claim.runStore, taskId: claim.taskId, legHolds: (run) => !runProvenElsewhere(run, deps.instanceId) });
+        landed = await store.putCtx(sessionId, ctx, claim === undefined ? undefined : createLegCtxClaim(claim.runStore, claim.taskId, claim.legId));
     }
     catch (err) {
         const tooLarge = err instanceof StoreRowTooLargeError ? err : undefined;
@@ -76,6 +76,7 @@ export async function persistSubmissionCtx(store, deps, claim, prepared) {
         body: screened && prepared.verify === undefined ? withheldBody(prepared.body, prepared.spec.model) : prepared.body,
         memoryScope: prepared.auth?.memoryScope,
         ...(screened || prepared.bodyFromScreenedCtx === true ? { promptScreened: true } : {}),
+        ...(prepared.legFacts?.projectContext !== undefined ? { projectContext: prepared.legFacts.projectContext } : {}),
         writerVersion: serviceVersion(),
     });
 }