@sema-agent/server 7.149.0 → 7.151.0

package/dist/http/server.d.ts

@@ -1,9 +1,11 @@
 import http from "node:http";
 import type { MemoryComplianceFaces, MemoryOriginFaces, SessionMemoryStatusFace } from "../memory-operator-faces.js";
 import type { SideQueryAccounting } from "../budget.js";
-import type { SessionPurgeOutcome } from "../session-deletion.js";
+import type { SessionAgeOutExpectation, SessionPurgeOutcome } from "../session-deletion.js";
 import type { IncomingMessage } from "node:http";
 import { type Runner, type RunnerDeps, type TaskSpec, type TaskResult, type WorkflowRunStore, type MemoryEntry, type MemoryExportBundle, type MemoryImportReport, type SideQuerySpec, type SideQueryResult, type Brain, type EngineNotice } from "@sema-agent/core";
+import type { ProjectContext } from "../project-context.js";
+import type { MemorySeed } from "../project-registry.js";
 import type { TaskRequestBody } from "./wire-types.js";
 import type { ServiceConfig } from "../config-types.js";
 import { type SessionMirrorRuling } from "../web-admin-client/facade.js";
@@ -11,7 +13,7 @@ import type { RestartSignal } from "@sema-agent/settings-schema/fleet";
 import { type AuthorizeInput, type OwnerAwareSessionStore } from "../security.js";
 import type { PeerDesk, PeerLease } from "../peer-seat.js";
 import type { ExecutionRoot, ResolvedTaskSpec } from "./execution-context.js";
-import type { RunStore, ImageIndex, ImageBake, CheckpointStoreFull, ResumeAnchorStore, ApprovalExemptionStore, ApprovalNonceStore, ServiceSessionPolicyStore, ServiceFileHistoryStore, ToolResultStoreFull, StoreBackend } from "../plugins/store-backend.js";
+import type { RunStore, ImageIndex, ImageBake, CheckpointStoreFull, ApprovalExemptionStore, ApprovalNonceStore, ToolResultStoreFull, StoreBackend } from "../plugins/store-backend.js";
 import type { RuleConsentLane } from "../rules-consent.js";
 import { type MemorySyncAnswer, type MemorySyncRequest } from "../memory-sync.js";
 import type { MemorySyncRunner } from "../memory-sync-client.js";
@@ -57,9 +59,9 @@ export interface RequestAuth {
     sessionId: string;
     memoryScope?: string;
     /** 142-S4:the SHAPE-VALIDATED **且已归一(小写)** 的 `body.projectId`(authorizer 的 core
-     *  `PROJECT_ID_REGEX` 门通过后折小写回传;[ref]/[ref] 宽读严写)。main.ts 拿它查 config.projects 的
-     *  defaultScopes(memory.scopes 种子)。resume 腿(checkpoint 重建 auth)缺席 — 回落持久化的
-     *  body.projectId(原始提交已验形),那条回落腿自己再折一次小写,两腿查同一个键。 */
+     *  `PROJECT_ID_REGEX` 门通过后折小写回传;[ref]/[ref] 宽读严写)。装配器拿它判 memory.scopes 种子项目(对提交者可见才算,
+     *  `project-registry.ts`)与这条腿的项目。resume 腿(checkpoint 重建 auth)缺席 — 项目回落持久化的
+     *  body.projectId(原始提交已验形,那条回落腿自己再折一次小写);种子不回落,读冻结的种子项目。 */
     resolvedProjectId?: string;
     /** authorizer 判过的头(`security.ts` `createAuthorizer` 交出;语义见 `AuthContext.head`)⇒ fresh 执行上下文的 `judged`。自建 authorizer 不给 = 解析器不比住客。 */
     head?: import("@sema-agent/core").SessionHead;
@@ -130,7 +132,11 @@ export interface ServiceCoreDeps {
      *  已过期,按新行为改。
      *  `opts.unattendedLeg`([ref] 候裁 18,codex r3 F1;[ref] ① 改形):续跑家族在 ctx 带无人值守标(`CheckpointCtx.unattendedLeg`)时递 `true` ——
      *  装配器在**全部折叠之后**经首跑同一只合并口 `withUnattendedLeg` 重挂那条腿(`default` + 按类作答的 onAsk)。只由续跑腿
-     *  按服务端写的 ctx 位递,绝不从请求体读。 */
+     *  按服务端写的 ctx 位递,绝不从请求体读。
+     *  `opts.projectContext`(项目上下文继承):续跑家族把提交腿冻结的那一份(`CheckpointCtx.projectContext`,服务端写)原样递回 —— 装配器在续跑腿上只重放它、不读登记簿;
+     *  新提交腿不递(装配器自己在头部判)。同样只由续跑腿按服务端写的 ctx 位递,绝不从请求体读。
+     *  `opts.memorySeed`(登记簿默认读层种子):续跑家族把提交腿冻结的种子(`CheckpointCtx.memorySeed`:种子项目 + 判出它的那一位观者,服务端写)原样递回 —— 装配器在续跑腿上
+     *  只认它(以冻结的观者经同一只可见性判读此刻的登记)、不推观者、不按存体的 `projectId` 现查;新提交腿不递(装配器自己在头部判)。只由续跑腿按服务端写的 ctx 位递,绝不从请求体读。 */
     /** `opts.execution`(必填):这条腿的执行上下文(`http/execution-context.ts`;只 `fresh` / `continuation` 两形,`root` 恒在)。装配器要用这条腿的根会话
      *  (场景设施的分区键、受理见证)读 `opts.execution.root` —— 它与 server 随后盖进 spec 的根是同一个值,装配器自己不写根。 */
     /** `opts.lease`(必填):这条腿的**宿主租约** —— 装配在它之下登记本腿交给引擎的对端声明(`peerDesk.declare(草稿, opts.lease)`)。
@@ -141,6 +147,8 @@ export interface ServiceCoreDeps {
         liveStream?: boolean;
         onNotice?: (notice: EngineNotice) => void;
         unattendedLeg?: true;
+        projectContext?: ProjectContext;
+        memorySeed?: MemorySeed | null;
         lease: PeerLease;
         execution: ExecutionRoot;
     }) => ResolvedTaskSpec | Promise<ResolvedTaskSpec>;
@@ -192,9 +200,6 @@ export interface ServiceCoreDeps {
 export interface ServiceStoreDeps {
     /** Durable async-run registry + event log (S1/S2). Enables /v1/runs when present. */
     runStore?: RunStore;
-    /** E18 resume-at: the eventId→entryId anchor map (tidb/pg/local). Present whenever a backend is — resolveSpec
-     *  resolves body.resumeAt(eventId)→entryId, the run lifecycle captures per-turn anchors, E21 purges them. */
-    resumeAnchorStore?: ResumeAnchorStore;
     /** Per-session approval exemption store — enables decide body `remember:"session"` + the
      *  exemptions list/revoke surfaces on /v1/approvals. The ask-gate probe is wired separately (main.ts). */
     approvalExemptionStore?: ApprovalExemptionStore;
@@ -211,9 +216,6 @@ export interface ServiceStoreDeps {
      *  封不了就不落,没有「明文照写」的第二种装配。嵌入方:`checkpointCtxSealing: await ensureCheckpointCtxSealing(sealedKeyDir)`
      *  (保管目录要跨重启持久、多副本各副本是同一份钥匙,否则封它的那把钥匙不在 ⇒ 409 `conflict.checkpoint_ctx_unsealable` `reason:"key_not_held"`)。 */
     checkpointCtxSealing?: import("./checkpoint-ctx.js").CheckpointCtxSealing;
-    /** E6 durable SessionPolicyStore (operator-tightened per-session tool rules). Enables PUT/GET /v1/sessions/:id/policy
-     *  when present; core reads the rules at prepare-time (subtract-only) via RunnerDeps.sessionPolicyStore (wired separately). */
-    sessionPolicyStore?: ServiceSessionPolicyStore;
     /** [ref] tool-results 读面([ref] 请求,core [ref] `buildToolResultRef` 到货):`GET /v1/tasks/:id/
      *  tool-results/:ref` 的数据源 —— 与 RunnerDeps 侧的 offload 店**同实例**(main.ts 的 `toolResultStore`,
      *  即「durable 后端在场」那一只;无 backend 部署里 Runner 用的内存兜底 `runnerOffloadStore` **不接**这里)。
@@ -221,14 +223,6 @@ export interface ServiceStoreDeps {
      *  与 unknown-ref / 归属不符两臂**同形** 404 才是防 oracle 的收口([ref] 的「另定」项按防 oracle 收紧)。
      *  这是本组「absent ⇒ 501 诚实缺席」通例的**唯一具名例外**,例外理由即上一句。 */
     toolResultStore?: ToolResultStoreFull;
-    /** [ref] per-edited-file rewind history store. Present ⇒ the rewind capabilities are advertised; core uses it
-     *  via RunnerDeps.fileHistoryStore (first-touch tracking + per-turn boundaries + tracked-set restore, ANY
-     *  env). Also the 2c history-transfer store (exportHistory/importHistory + blob negotiation faces).
-     *  🔴 [ref]:这是装配单点 `assembleFileHistory` 的**店**(后端在即在,与 `FILE_HISTORY_CAPTURE` 无关 —— 旋钮只关捕获,
-     *  落在 core 的 `RunnerDeps.fileHistoryCapture` 上)。rewind 族四位与 2c sync 路由族跟它走;能力词 `fileHistoryCapture`
-     *  = `fileHistoryCaptureOf(本键, config.fileHistoryCapture)`(与 core 捕获位同一只判定)。
-     *  擦除(E21 / 孤儿 blob GC)不读本键,读 boot 侧的擦除脸。 */
-    fileHistoryStore?: ServiceFileHistoryStore;
     /** D-1 通用文件上传(clay 拍 2026-07-27:独立附件 store,不骑 snapshot blob 面):enables
      *  POST/GET/DELETE /v1/attachments*。缺席 ⇒ 501(与其他可选 store 面同姿)。绑定/物化半场在
      *  main.ts(resolveSpec + env factory 包装);本面只管上传/取回/删除三动词 + server 权威上限。 */
@@ -419,11 +413,11 @@ export interface ServiceSeamDeps {
      */
     deviceEnrollment?: import("../device-enrollment.js").DeviceEnrollment;
     /**
-     * [ref] × 7.106.0 合并复审 X1:host 车道会话登记簿的 `inheritEnv` **写口**(`boot/execution-env.ts` 的 `setSessionInheritEnv`)。
-     * 唯一调用者 = `http/session-inherit-env.ts` 的 `commitSessionInheritEnv`(四个 run 认领点在认领之后调;判据与残余见那只文件)。
-     * 缺席 = 本部署不是 host 车道(没有工厂读这一格)⇒ 提交点 no-op。装配 = `boot/stage-10-http-server.ts`(host 车道才给)。
+     * 会话登记簿的**绑定写座**(`boot/execution-env.ts` `createSessionScopedRegistries`:cwd / shellEnv / inheritEnv 三格写一笔、按回执撤一笔)。
+     * 唯一写者 = `session-bindings.ts` 的 `commitLegBindings`(四个 run 认领点在认领之后调);唯一撤回者 = 提交出口(`submission-exit.ts`,
+     * 写了之后才收场 `refused` 的提交)。律与残余见 `session-bindings.ts` 头注。缺席(夹具 / 嵌入方没接)= 没有登记簿 ⇒ 提交点 no-op。
      */
-    bindSessionInheritEnv?: import("./session-inherit-env.js").SessionInheritEnvCommitCtx["bindSessionInheritEnv"];
+    sessionBindings?: import("../session-bindings.js").SessionBindingSeat;
     /**
      * 会话登记簿四表(cwd / shellEnv / inheritEnv / 属主,`boot/execution-env.ts` `createSessionScopedRegistries` 的 `dropSessionOf`)按**住客**清掉一只 ——
      * 记下的住客恰是交来的化身才清、答 `true`。读者只有提交出口(`submission-exit.ts`):被拒提交铸下的会话撤回之后清(同 id 的下一位已登记、写下的条目不动)。
@@ -438,12 +432,14 @@ export interface ServiceSeamDeps {
     } & Record<string, unknown>) | undefined>;
     /** E21 删除协调器(会话三态 活 → 在删 → 没了,`session-deletion.ts`):删会话的对话史与服务自己的 run 账 / 检查点 / 卸载结果等全部挂靠行,一次调用。
      *  结局 = {@link SessionPurgeOutcome}(删了 / 不在 · 围栏判到认领 · 子代预检拒 · 被接管)。点亮 DELETE /v1/sessions/:id。 */
-    purgeSession?: (sessionId: string, owner: string | null) => Promise<SessionPurgeOutcome>;
+    purgeSession?: (sessionId: string, owner: string | null, opts?: {
+        readonly ageOut?: SessionAgeOutExpectation;
+    }) => Promise<SessionPurgeOutcome>;
     /** [ref]③(b): read a BACKGROUND agent-handle child's final report / current status out of the core
      *  TaskRegistry (the same face the TaskOutput tool reads — agent handles are NEVER in the run store).
      *  Wired in main.ts to `defaultTaskRegistry.pollTask` (non-blocking). Access is the REGISTRATION tuple:
      *  owner = the parent run's taskId (resume legs register children under the sessionId — the registry's
-     *  sessionScoped arm matches via `access.sessionId`), scope = the run's principal ?? "default". */
+     *  sessionScoped arm matches via `access.sessionId`), scope = the run owner's engine-identity cell (`engineScopeOfOwner`). */
     subagentTaskOutput?: (handle: string, access: {
         owner: string;
         scope: string;
@@ -720,7 +716,7 @@ export interface ServiceDeploymentDeps {
      */
     deploymentModPackages?: number;
     /**
-     * 会话 → 调用方登记的工作目录(提交体 `cwd` 的唯一写口 `setSessionCwd` 写的那一张进程内表,`boot/execution-env.ts` `createSessionScopedRegistries`)。
+     * 会话 → 登记的工作目录(受理的提交经绑定写座 {@link ServiceDeps.sessionBindings} 写的那一张进程内表,`boot/execution-env.ts` `createSessionScopedRegistries`)。
      * **只读**,读者只有 run 外回退口(`POST /v1/sessions/:id/rewind-files`):host 工厂按 `effectiveHostWorkspace(本表.get(会话), ctx)` 定根(`execution-env.ts`
      * host 臂),口在交引擎之前用**同一只函数、同一份入参**问「工厂这一次会不会落到一只用完即删的临时目录」—— 会 ⇒ 拒,不让台账说恢复了而项目没动。
      * 缺席(夹具 / 嵌入方没接)⇒ 读作「没有登记」⇒ host 车道上口拒(fail-closed)。
@@ -755,8 +751,8 @@ export interface ServiceDeploymentDeps {
      * 缺席(嵌入方 / 夹具)= 两项恒 0,两个读数逐字同 7.145.x。
      */
     sessionResidentBackground?: () => SessionResidentCounts;
-    /** 编排器片 2 件 3:服务租约此刻的读数(`fleet/serving-lease.ts` 的客户端交出;引擎信号铸点与计费准入判同读)。缺席 = 没装租约客户端
-     *  (非 fleet 成员 / 没接中心 / 测试夹具)⇒ `none`(与没有租约的引擎逐字同)。 */
+    /** 编排器片 2 件 3:服务租约此刻的读数(`fleet/serving-lease.ts` 的客户端交出;唯一读者 `fleet/engine-signal.ts` 的 `memberLeaseOf` —— 引擎信号铸点
+     *  与计费准入判经它同读,只在 `config.fleetGeneration` 在场〔成员〕时读)。缺席 = 没装租约客户端(非 fleet 成员 / 测试夹具)⇒ `none`。 */
     servingLease?: () => import("../fleet/engine-signal.js").ServingLeaseView;
     /** boot ready 门(b):false = 布防(`CONFIG_REQUIRE_ROSTER=true`)且首次 effective pull 尚未落 roster
      *  (worker 只有占位模型)。就绪原因 `model_roster_pending`(`http/readiness.ts`):计费提交 503 + `/readyz` 503 +
@@ -800,7 +796,7 @@ export interface ServiceDeploymentDeps {
     /** [ref] 追加件:`POST /v1/admin/config/refresh` 的实现面 —— 触发**一次既有**的 refresh 拍(在飞则 join)。
      *  缺席 / 回 `"not-wired"` = 本部署没有配置管道 ⇒ 该口诚实 4xx(绝不吞成 200)。 */
     configRefreshNow?: () => Promise<"triggered" | "not-wired" | "failed">;
-    /** DESIGN-278 §5 S2([ref]):center **当前在管**的 ServiceConfig 键集 —— `GET /v1/config/catalog`
+    /** [ref] §5 S2([ref]):center **当前在管**的 ServiceConfig 键集 —— `GET /v1/config/catalog`
      *  判 `effectiveLane`(env 占位/center 在管/默认)的 center 半场。缺席或返回 undefined = 本部署
      *  没有配置管道(纯 env worker / 测试夹具)⇒ 目录把每条 center 腿如实标「不在管」(additive)。 */
     webAdminManagedKeys?: () => ReadonlySet<string> | undefined;
@@ -946,6 +942,8 @@ export declare function createHttpServer(rawDeps: ServiceDeps): http.Server & {
     redeemParkedAsk: ParkedAskRedeem;
     /** 会话通知门(装配层把它接进场景层后台完成 sink 的晚绑座;门与律见 `session-notify-door.ts`)。 */
     sessionNotifyDoor: SessionNotifyDoor;
+    /** run 收场送达的转交(装配层把它接进 workflow 编排面完成送达的晚绑座;律见 `resume-legs.ts` 的 `handOverRunEndedDecisions`)。 */
+    handOverRunEndedDecisions: (runId: string) => Promise<void>;
 };
 /** SSE: replay durable events after Last-Event-ID, then tail until the run is terminal (or stale). */
 /**

package/dist/http/server.js

@@ -26,6 +26,7 @@ import { createRunConcurrencyGate, liveRunIdsOf } from "./run-concurrency-cap.js
 import { sqlEngineSeatIssue } from "../sql-engine-posture.js";
 import { parkDecisionStoreRefusal } from "../orchestration/workflow-park-decision.js";
 import { CHECKPOINT_CTX_SEALING_REQUIRED } from "./checkpoint-ctx.js";
+import { SERVING_LEASE_MEMBERSHIP_REQUIRED } from "../fleet/engine-signal.js";
 import { PARKED_REVIVE_EXECUTION_SEAT_REQUIRED } from "../parked-decide.js";
 import { a2aAudienceVerifiedSourceRefusal, operatorDeclarationRefusal } from "../config-invariants.js";
 import { retiredServiceDepsRefusal } from "./retired-service-deps.js";
@@ -148,6 +149,8 @@ export function createHttpServer(rawDeps) {
         throw new Error(`createHttpServer: ${CHECKPOINT_CTX_SEALING_REQUIRED}`);
     if (deps.parkedReviveSurface !== undefined && deps.sessionStorage?.executionPlacement === undefined)
         throw new Error(`createHttpServer: ${PARKED_REVIVE_EXECUTION_SEAT_REQUIRED}`);
+    if (deps.servingLease !== undefined && deps.config.fleetGeneration === undefined)
+        throw new Error(`createHttpServer: ${SERVING_LEASE_MEMBERSHIP_REQUIRED}`);
     const idemCache = new IdempotencyCache();
     const inflightRuns = new Map();
     const preemptableRuns = new DrainYieldingPreemptBook(() => deps.drainState?.draining === true);
@@ -183,7 +186,7 @@ export function createHttpServer(rawDeps) {
     if (deps.drainState)
         deps.drainState.yieldInflight = () => preemptableRuns.yieldAll();
     if (deps.hookWakeBus) {
-        deps.hookWakeBus.deliver = async (sessionId, text) => {
+        const deliverHookWake = async (sessionId, text) => {
             try {
                 validatePendingSteer({ text, trusted: false });
             }
@@ -218,11 +221,12 @@ export function createHttpServer(rawDeps) {
                 return false;
             }
         };
+        deps.hookWakeBus.deliver = deliverHookWake;
     }
     const { quotaExceeded, ownerCostQuotaDenied, ownerFleetLeaseDenied, ownerLeaseDenied, ownerQuotaDenied, leaseDenied, usageWindowDenialFor, usageWindowDenied, rateLimited, safeDecode, readJson, readRawBody } = createRequestGuards({ deps });
     const { prepareSpec } = createAdmission({ deps, readJson, runnerFor });
     const { admitRun } = createRunConcurrencyGate({ deps, inflightRuns, steerableRuns });
-    const { routeCtxBase, resumeCheckpoint, driveResumeIntoRunLog, driveResumeLeg, decisionRowAdmits, resumePreempted, startFreshHostTurn, resumeWake, sessionNotifyDoor } = createResumeLegs({ deps, runnerFor, idemCache, inflightRuns, preemptableRuns, steerableRuns, wakeParkMints, counters, readJson, readRawBody, rateLimited, quotaExceeded, ownerQuotaDenied, leaseDenied, ownerLeaseDenied, usageWindowDenied, admitRun, safeDecode, prepareSpec, finalizeTaskResult, ownerCostQuotaDenied, ownerFleetLeaseDenied, usageWindowDenialFor });
+    const { routeCtxBase, resumeCheckpoint, driveResumeIntoRunLog, driveResumeLeg, decisionRowAdmits, resumePreempted, startFreshHostTurn, resumeWake, sessionNotifyDoor, handOverRunEndedDecisions } = createResumeLegs({ deps, runnerFor, idemCache, inflightRuns, preemptableRuns, steerableRuns, wakeParkMints, counters, readJson, readRawBody, rateLimited, quotaExceeded, ownerQuotaDenied, leaseDenied, ownerLeaseDenied, usageWindowDenied, admitRun, safeDecode, prepareSpec, finalizeTaskResult, ownerCostQuotaDenied, ownerFleetLeaseDenied, usageWindowDenialFor });
     const { denyExpiredApprovals, redeemParkedAsk } = createApprovalSweeps({ deps, resumeCheckpoint, decisionRowAdmits });
     const { handle } = createDispatch({ deps, noteActivity, routeCtxBase, counters });
     const server = http.createServer((req, res) => {
@@ -285,6 +289,6 @@ export function createHttpServer(rawDeps) {
         deps.planCacheProbe?.record(principal, objective, result.terminal.kind === "completed");
     }
     const isRunLiveOnThisReplica = (taskId) => liveRunIdsOf(inflightRuns, steerableRuns).has(taskId);
-    return Object.assign(server, { denyExpiredApprovals, isRunLiveOnThisReplica, redeemParkedAsk, sessionNotifyDoor });
+    return Object.assign(server, { denyExpiredApprovals, isRunLiveOnThisReplica, redeemParkedAsk, sessionNotifyDoor, handOverRunEndedDecisions });
 }
 //# sourceMappingURL=server.js.map

package/dist/http/stored-body-replay.d.ts

@@ -1,29 +1,9 @@
-/**
- * 「这条停驻行的持久化体在本版上能否重放」—— **唯一**判据(四问一只,外加 `settings.env` 凭据一臂;五个问点同调:续跑驱动段 `resume-legs.ts` `resolveResumeSpecOrBlocked`、
- * plan_review 的 prepare 段、SLA 拒扫腿的跳过臂 `approval-sweeps.ts`、终态 run 的 steer 铸唤醒卡之前 `routes/runs.ts`;`resolveSpec` 本身留作提交腿的拒点)。
- * 四问的规则、记号、拒句与删除条件的属主 = `http/checkpoint-ctx.ts` 顶注;答复 = 那里的 `storedBodyReplayAnswer`。
- *
- * 为什么判据住在这里而不是 `checkpoint-ctx.ts`:模式词问要读体的**生效模式词**(`task-settings.ts` `storedBodyPermissionMode`,请求设置的解析层)与本部署此刻的
- * **入口地板**(`runtime-governance.ts` `autonomyModeFloor`)—— 这两只属主带着配置层的包外依赖;`checkpoint-ctx.ts` 被随包的本地排空脚本经编译产物 import,
- * 它的闭包只许 node 内建 / 引擎包根(`test/drain-check-local.test.ts` 的闭包门)。判据只有这一只,allow 读法问、工具名清单问与退役请求键问的谓词照旧住在各自属主里。
- */
-import type { PermissionMode } from "@sema-agent/core";
-import { type Autonomy } from "../runtime-governance.js";
 import { type InertToolListEntry } from "../rule-entry-list.js";
 import { type ExecutionConfigRootDeployment } from "../execution-config-root.js";
 import { type UnreadMembersDeployment } from "../unread-request-members.js";
 import { type ModelApiKeyEnvTable } from "../server-secret-env.js";
 import { type StoredBodyReplayRefusal } from "./checkpoint-ctx.js";
 import type { CheckpointCtx } from "./route-ctx.js";
-/**
- * 模式词问:本行体里的模式词能否按当前读法重放。不能 ⇔ 本部署此刻有入口地板 ∧ 行上没有当前的模式词读法记号 ∧ 体的生效词进这块地板会变
- * (`runtime-governance.ts` `entryPermissionMode`,与提交入口的盖章同一只函数;判的是「词变不变」而不是 `clamped` —— 体无词的旧行进地板取地板本身,
- * 那也是变)⇒ 返回拒因的两个事实(体的词、地板);能 ⇒ `undefined`。
- */
-export declare function permissionModeReadingUnstated(ctx: CheckpointCtx, floor: PermissionMode | undefined): {
-    stored: PermissionMode | undefined;
-    floor: PermissionMode;
-} | undefined;
 /**
  * 存体里 `settings.permissions.deny` / `ask`(规则编译器读的收紧表)有永远不生效的条目(名字层:退役名 / 短名 / 铸不出的段 / 近似名;core 的规则文法:括号 / 内容文法 / 主字段……;
  * `~/` 形而这个部署解不出 home),或三桶里 user 层的 `/` 形规则而这个部署读不出执行环境的配置根 —— 拒点是 `applyTaskSettings`(422,在 `resolveSpec` 里),那一拍 plan_review 的一次性 nonce 已烧、终态 steer 的唤醒卡已铸、SLA 拒扫跳不过;所以预判也问一遍。
@@ -36,17 +16,16 @@ export declare function permissionModeReadingUnstated(ctx: CheckpointCtx, floor:
  */
 export declare function ruleTablesRefusalWithoutTaskRoot(body: unknown, deployment: ExecutionConfigRootDeployment): InertToolListEntry | undefined;
 /**
- * 预判读的部署配置:`autonomy`(模式词问的模式词地板)、执行车道的 home 两位(`~/` 形规则那一问)、配置根的几位(user 设置层 `/` 规则那一问)与「请求成员读不出」那一问的
+ * 预判读的部署配置:执行车道的 home 两位(`~/` 形规则那一问)、配置根的几位(user 设置层 `/` 规则那一问)与「请求成员读不出」那一问的
  * 租户轴 / 两只注入闸的否决位。`ServiceConfig` 结构上满足,四个问点传 `deps.config` 整份。
  */
 export type StoredReplayDeployment = ExecutionConfigRootDeployment & UnreadMembersDeployment & {
-    readonly autonomy?: Autonomy | undefined;
     /** 生效配置模型条目 name → `apiKeyEnv`(`settings.env` 凭据判据的名单一臂;缺席 = 没有模型条目,与 `serverCredentialValueSources` 的缺省同读)。 */
     readonly modelApiKeyEnv?: ModelApiKeyEnvTable | undefined;
 };
 /**
- * 四问一只判据:不能重放 ⇒ 返回拒的那条规则;能 ⇒ `undefined`。顺序:allow 读法(体里带非空 `allow` 而写者版本证不出 ≥ 7.117.0;常设,按写者版本)→ 请求设置里的条目表(**与拒点同序**:桶门〔形 / 空串 / 超帽〕→ 工具名清单读成空〔**只问限制方向**:放行方向的存量条目读成空,续跑照旧、只留一行运维 warn〕→ 请求成员读不出〔hooks / env / MCP transport / A2A headers …,判据 `unread-request-members.ts`〕→ deny / ask 的名字层 + 规则文法)→ 模式词读法记号 → 体里的退役请求键(几问同中时答先中的那一问 ——
- * 任一问中都不重放,句子只需一句)。`deployment` = 本部署**此刻**的 `config`(活 config:热改即生效):`autonomy` 的地板由它的唯一属主算,`~/` 形规则的 home 由 `executionLaneHomeDir` 算,问点都不自己算。
+ * 三问一只判据:不能重放 ⇒ 返回拒的那条规则;能 ⇒ `undefined`。顺序:allow 读法(体里带非空 `allow` 而写者版本证不出 ≥ 7.117.0;常设,按写者版本)→ 请求设置里的条目表(**与拒点同序**:桶门〔形 / 空串 / 超帽〕→ 工具名清单读成空〔**只问限制方向**:放行方向的存量条目读成空,续跑照旧、只留一行运维 warn〕→ 请求成员读不出〔hooks / env / MCP transport / A2A headers …,判据 `unread-request-members.ts`〕→ deny / ask 的名字层 + 规则文法)→ 体里的退役请求键(几问同中时答先中的那一问 ——
+ * 任一问中都不重放,句子只需一句)。`deployment` = 本部署**此刻**的 `config`(活 config:热改即生效):`~/` 形规则的 home 由 `executionLaneHomeDir` 算,问点都不自己算。
  */
 export declare function storedBodyReplayRefusal(ctx: CheckpointCtx, deployment: StoredReplayDeployment): StoredBodyReplayRefusal | undefined;
 //# sourceMappingURL=stored-body-replay.d.ts.map

package/dist/http/stored-body-replay.js

@@ -1,7 +1,6 @@
-import { REQUEST_SETTINGS_REFUSAL_PREFIX, SETTINGS_PERMISSION_BUCKETS, SETTINGS_RULE_REFUSAL_CODE, neverAutoNamesRefusal, readSettingsEnv, rulePolicyBucketsRefusal, settingsEnvCredentialIssue, settingsPermissionBucketIssue, storedBodyPermissionMode } from "../task-settings.js";
+import { REQUEST_SETTINGS_REFUSAL_PREFIX, SETTINGS_PERMISSION_BUCKETS, SETTINGS_RULE_REFUSAL_CODE, neverAutoNamesRefusal, readSettingsEnv, rulePolicyBucketsRefusal, settingsEnvCredentialIssue, settingsPermissionBucketIssue } from "../task-settings.js";
 import { readTightenOnlySeats, tightenOnlySeatField, tightenOnlySeatIssue } from "../tighten-only-seats.js";
 import { entryProblemsFacts } from "../entry-problems.js";
-import { autonomyModeFloor, entryPermissionMode } from "../runtime-governance.js";
 import { inertToolListEntryOf, replayInertEntry } from "../rule-entry-list.js";
 import { executionLaneHomeDir } from "../execution-lane-caps.js";
 import { executionConfigRootOf } from "../execution-config-root.js";
@@ -10,13 +9,7 @@ import { storedEnvCredentialsDropM38 } from "../stored-request-env-credentials-m
 import { storedToolAxesRereadM19 } from "../stored-request-tool-axes-m19.js";
 import { MAX_NAMED_MEMBERS, unreadRequestMembers, unreadRequestMembersRefusal } from "../unread-request-members.js";
 import { serverCredentialValueSources } from "../server-secret-env.js";
-import { allowListWriterUnproven, permissionModeReadingStated, retiredRequestKeyOf } from "./checkpoint-ctx.js";
-export function permissionModeReadingUnstated(ctx, floor) {
-    if (floor === undefined || permissionModeReadingStated(ctx))
-        return undefined;
-    const stored = storedBodyPermissionMode(ctx.body);
-    return entryPermissionMode(stored, floor).effective === stored ? undefined : { stored, floor };
-}
+import { allowListWriterUnproven, retiredRequestKeyOf } from "./checkpoint-ctx.js";
 const RETIRED_KEY_REWRITE_MIGRATION = { promptProfile: "M30" };
 const BUCKET_GATE_CODE = "request.field_invalid";
 const BUCKET_SIDE = {
@@ -87,9 +80,6 @@ export function storedBodyReplayRefusal(ctx, deployment) {
     const entry = ruleTablesRefusalWithoutTaskRoot(ctx.body, deployment);
     if (entry !== undefined)
         return { kind: "inert_tool_list", entry };
-    const mode = permissionModeReadingUnstated(ctx, autonomyModeFloor(deployment.autonomy));
-    if (mode !== undefined)
-        return { kind: "permission_mode_reading", ...mode, ...writer };
     const retiredKey = retiredRequestKeyOf(ctx.body);
     if (retiredKey !== undefined)
         return { kind: "retired_request_key", key: retiredKey, rewriteWindowEnd: migrationWindowEnd(RETIRED_KEY_REWRITE_MIGRATION[retiredKey]), ...writer };

package/dist/http/submit-ctx.d.ts

@@ -31,7 +31,6 @@ export declare function persistSubmitCtx(store: SubmitCtxStore, deps: {
     readonly logger?: Logger | undefined;
     readonly metrics?: Metrics | undefined;
     readonly checkpointCtxSealing?: CheckpointCtxSealer | undefined;
-    readonly instanceId?: string | undefined;
 }, claim: {
     readonly runStore: RunStore;
     readonly taskId: string;
@@ -41,7 +40,7 @@ export declare function persistSubmitCtx(store: SubmitCtxStore, deps: {
  * 提交腿写续跑输入的入口(三个调用点同调这一只):体与标记按受理座提交时交出的那一份定(见文件头「体里的目标按哪一份写」),只写这一笔。
  * 写不进的处置与答复 = {@link persistSubmitCtx}(本函数只定体、不另判)。
  */
-export declare function persistSubmissionCtx(store: SubmitCtxStore, deps: Parameters<typeof persistSubmitCtx>[1], claim: Parameters<typeof persistSubmitCtx>[2], prepared: Pick<PreparedTaskSubmission, "body" | "auth" | "verify" | "acceptance" | "bodyFromScreenedCtx"> & {
+export declare function persistSubmissionCtx(store: SubmitCtxStore, deps: Parameters<typeof persistSubmitCtx>[1], claim: Parameters<typeof persistSubmitCtx>[2], prepared: Pick<PreparedTaskSubmission, "body" | "auth" | "verify" | "acceptance" | "bodyFromScreenedCtx"> & Partial<Pick<PreparedTaskSubmission, "legFacts">> & {
     readonly spec: Pick<PreparedTaskSubmission["spec"], "sessionId" | "model">;
 }): Promise<SubmitCtxRefusal | typeof SUBMIT_CTX_CLAIM_LOST | undefined>;
 //# sourceMappingURL=submit-ctx.d.ts.map

package/dist/http/submit-ctx.js

@@ -1,6 +1,6 @@
 import { StoreRowTooLargeError } from "../plugins/sql-errors.js";
 import { withdrawClaimedRun } from "./claimed-run.js";
-import { runProvenElsewhere } from "../plugins/store-contracts.js";
+import { createLegCtxClaim } from "../plugins/store-contracts.js";
 import { buildCheckpointCtx, CheckpointCtxUnsealableError } from "./checkpoint-ctx.js";
 import { refusalBody } from "./refusal-body.js";
 import { limitFactsUnmeasured } from "../limit-refusal.js";
@@ -29,11 +29,11 @@ function unsealableRefusal(e) {
 function rowTooLargeRefusal(tooLarge) {
     switch (tooLarge.wall) {
         case "row":
-            return { status: 413, body: refusalBody({ errorCode: "request.payload_too_large", message: `the database refused to store this task: it is larger than the database keeps in one row (${tooLarge.dbMessage}) — nothing was run; shrink the inline images / userAttachments, or ask the operator to raise the database's single-row limit (TiDB performance.txn-entry-size-limit)`, facts: limitFactsUnmeasured("body", "bytes") }) };
+            return { status: 413, body: refusalBody({ errorCode: "request.payload_too_large", message: `the database refused to store this task: it is larger than the database keeps in one row — nothing was run; shrink the inline images / userAttachments, or ask the operator to raise the database's single-row limit (TiDB performance.txn-entry-size-limit)`, facts: limitFactsUnmeasured("body", "bytes") }) };
         case "statement":
-            return { status: 413, body: refusalBody({ errorCode: "request.payload_too_large", message: `the database refused to store this task: it is larger than the database accepts in one statement (${tooLarge.dbMessage}) — nothing was run; shrink the inline images / userAttachments, or ask the operator to raise the database's max_allowed_packet`, facts: limitFactsUnmeasured("body", "bytes") }) };
+            return { status: 413, body: refusalBody({ errorCode: "request.payload_too_large", message: `the database refused to store this task: it is larger than the database accepts in one statement — nothing was run; shrink the inline images / userAttachments, or ask the operator to raise the database's max_allowed_packet`, facts: limitFactsUnmeasured("body", "bytes") }) };
         case "value":
-            return { status: 413, body: refusalBody({ errorCode: "request.payload_too_large", message: `the database refused to store this task: it is larger than PostgreSQL holds in one value (${tooLarge.dbMessage}) — nothing was run; shrink the inline images / userAttachments`, facts: limitFactsUnmeasured("body", "bytes") }) };
+            return { status: 413, body: refusalBody({ errorCode: "request.payload_too_large", message: `the database refused to store this task: it is larger than PostgreSQL holds in one value — nothing was run; shrink the inline images / userAttachments`, facts: limitFactsUnmeasured("body", "bytes") }) };
         default: {
             const unhandled = tooLarge.wall;
             throw new Error(`row-too-large refusal without an HTTP answer: ${String(unhandled)}`);
@@ -44,7 +44,7 @@ export async function persistSubmitCtx(store, deps, claim, sessionId, fields) {
     let landed;
     try {
         const ctx = buildCheckpointCtx(fields, deps.checkpointCtxSealing, sessionId);
-        landed = await store.putCtx(sessionId, ctx, claim === undefined ? undefined : { fence: claim.runStore, taskId: claim.taskId, legHolds: (run) => !runProvenElsewhere(run, deps.instanceId) });
+        landed = await store.putCtx(sessionId, ctx, claim === undefined ? undefined : createLegCtxClaim(claim.runStore, claim.taskId, claim.legId));
     }
     catch (err) {
         const tooLarge = err instanceof StoreRowTooLargeError ? err : undefined;
@@ -62,7 +62,7 @@ export async function persistSubmitCtx(store, deps, claim, sessionId, fields) {
         }
         if (tooLarge === undefined)
             throw err;
-        deps.logger?.warn("submit_ctx_row_too_large", { sessionId, taskId: claim?.taskId, wall: tooLarge.wall, db: tooLarge.dbMessage });
+        deps.logger?.warn("submit_ctx_row_too_large", { sessionId, taskId: claim?.taskId, wall: tooLarge.wall });
         return rowTooLargeRefusal(tooLarge);
     }
     return landed === "claim_released" ? SUBMIT_CTX_CLAIM_LOST : undefined;
@@ -76,6 +76,8 @@ export async function persistSubmissionCtx(store, deps, claim, prepared) {
         body: screened && prepared.verify === undefined ? withheldBody(prepared.body, prepared.spec.model) : prepared.body,
         memoryScope: prepared.auth?.memoryScope,
         ...(screened || prepared.bodyFromScreenedCtx === true ? { promptScreened: true } : {}),
+        ...(prepared.legFacts?.projectContext !== undefined ? { projectContext: prepared.legFacts.projectContext } : {}),
+        ...(prepared.legFacts?.memorySeed !== undefined ? { memorySeed: prepared.legFacts.memorySeed } : {}),
         writerVersion: serviceVersion(),
     });
 }

package/dist/http/submit-replay.d.ts

@@ -9,7 +9,8 @@
  *
  * ## 判定(三条,按序;别的一律不放)
  *  · 这次提交自带 taskId 而命中的行**不是**那一条(`Idempotency-Key` 指向别的行)⇒ 冲突;
- *  · 调用方读不到这一行(属主门 = `qualsOf`,「这个调用方读得到这一行 run 吗」的唯一谓词,经属主存取器 `owner-access.ts` 读)⇒ 冲突;
+ *  · 调用方读不到这一行(属主门 = `qualsOf`,「这个调用方读得到这一行 run 吗」的唯一谓词,经属主存取器 `owner-access.ts` 读与判 —— 按钥匙读行也只在那里:
+ *    `readReplayHit`;建行撞唯一键时观察到的行经同一只判 `replayHitOf`)⇒ 冲突;
  *    冲突 ⇒ `409 conflict.run_exists`,体里**不回显**那条行的任何标识(不给跨租户预言机)。先于下一条判:读不到的行不比体。
  *  · 这次提交带 `Idempotency-Key`(`caller.idem` 在场)、那一行绑的**就是这把键**,而它记着的请求体指纹与这次不同 ⇒
  *    `409 conflict.idempotency_payload_mismatch`(同形 `{ error, errorCode }`,不回显键与那一行);**不**回放首发、不新建、那一行不动。
@@ -33,6 +34,7 @@ import type { RunIdemBinding, RunRecord } from "../plugins/store-contracts.js";
 import type { RunStore } from "../plugins/store-backend.js";
 import type { ServiceConfig } from "../config-types.js";
 import type { SubmitOutcome } from "./idempotency.js";
+import { type ReplayHit } from "./owner-access.js";
 import type { Subject } from "../owner-brands.js";
 /** 提交腿的回执形(闭集;穷举 `switch`,加一形不写这里 = 编译红)。 */
 export type SubmitReplayFace = "durable" | "sync";
@@ -56,7 +58,18 @@ export declare function isReplayedOutcome(outcome: SubmitOutcome): boolean;
 /** 一份提交回执是不是 {@link replayOfExistingRun} 铸的**冲突**体(判别位 = 机器码;铸点就在下面,码与它同文件)—— 把回执渲成别的协议形的
  *  调用方(A2A)按它分句,不另抄码。 */
 export declare function isRunExistsConflictBody(body: unknown): boolean;
+/** 进门按一把提交钥匙(`Idempotency-Key` 铸的键 / 调用方自铸的 `body.taskId`)读行作答:没命中 ⇒ `undefined`(这是一次新提交);命中 ⇒ 本文件的唯一回执。 */
+export declare function replayOfKey(key: {
+    readonly idemKey: string;
+} | {
+    readonly taskId: string;
+}, caller: ReplayCaller, face: SubmitReplayFace, deps: {
+    config: ServiceConfig;
+}, runStore: Pick<RunStore, "getRun" | "getRunByIdem" | "bindIdemBodyFingerprint" | "observeRun">): Promise<SubmitOutcome | undefined>;
+/** 建行撞唯一键时观察到的那一行(店的观察臂交回的既有行)作答:与按钥匙读到的同一只判、同一张回执。 */
 export declare function replayOfExistingRun(seen: RunRecord, caller: ReplayCaller, face: SubmitReplayFace, deps: {
     config: ServiceConfig;
-}, runStore: RunStore): Promise<SubmitOutcome>;
+}, runStore: Pick<RunStore, "bindIdemBodyFingerprint" | "observeRun">): Promise<SubmitOutcome>;
+/** 一次命中的回执(判已在属主存取器里落成 {@link ReplayHit}):占用 ⇒ 冲突;读得到 ⇒ 体指纹 → 观察口 → 按提交腿的形答。 */
+export declare function answerReplay(hit: ReplayHit, caller: ReplayCaller, face: SubmitReplayFace, runStore: Pick<RunStore, "bindIdemBodyFingerprint" | "observeRun">): Promise<SubmitOutcome>;
 //# sourceMappingURL=submit-replay.d.ts.map

package/dist/http/submit-replay.js

@@ -1,5 +1,4 @@
-import { runRowAt, seesRunAs } from "./owner-access.js";
-import { claimCallerOf } from "../security.js";
+import { readReplayHit, replayHitOf, runRowAt } from "./owner-access.js";
 import { syncSubmitBodyOfRow } from "./sync-submit-body.js";
 import { refusalBody } from "./refusal-body.js";
 export function replayedOutcome(outcome) {
@@ -15,11 +14,18 @@ export function isReplayedOutcome(outcome) {
 export function isRunExistsConflictBody(body) {
     return typeof body === "object" && body !== null && body.errorCode === "conflict.run_exists";
 }
+export async function replayOfKey(key, caller, face, deps, runStore) {
+    const hit = await readReplayHit(caller.subject, deps.config, runStore, key, caller.clientTaskId);
+    return hit === undefined ? undefined : answerReplay(hit, caller, face, runStore);
+}
 export async function replayOfExistingRun(seen, caller, face, deps, runStore) {
-    const sameRun = caller.clientTaskId === undefined || caller.clientTaskId === seen.taskId;
-    if (!sameRun || !seesRunAs("run.replay", claimCallerOf(caller.subject, deps.config), seen.owner)) {
+    return answerReplay(replayHitOf(caller.subject, deps.config, seen, caller.clientTaskId), caller, face, runStore);
+}
+export async function answerReplay(hit, caller, face, runStore) {
+    if (hit.kind === "occupied") {
         return { status: 409, body: refusalBody({ errorCode: "conflict.run_exists", message: "a run already exists for this submission's taskId or Idempotency-Key" }) };
     }
+    const seen = hit.row;
     if (caller.idem !== undefined) {
         const held = await runStore.bindIdemBodyFingerprint(seen.taskId, caller.idem);
         if (held !== null && held !== caller.idem.bodyFingerprint) {

package/dist/http/wire-types.d.ts

@@ -41,6 +41,14 @@ export interface TaskRequestAttachments {
 export interface TaskRequestBody {
     objective: string;
     sessionId?: string;
+    /**
+     * 这一次提交建的会话是哪一**种**(闭集一词 `"sidechain"` = 客户端放置的子代对话;缺席 = 顶层对话;律在 `session-kind.ts`)。
+     * 只在**建这只会话的那一笔**写下(不带 `sessionId` / 带一只还不存在的 id),此后终身不改:带键提交到一只既有的会话 ⇒ 种类相等照常、不等 409
+     * `conflict.session_kind_mismatch`(会话一字节不变,体上机读位 `sessionKind` = 行上的词,顶层行缺席);不带键 = 不声明(续轮不必重发)。
+     * 词表外 ⇒ 400 `request.field_invalid`;部署记不了种类(能力位 `sessionKinds` 为空)⇒ 400 `request.precondition_unmet`,都在任何写之前。
+     * 续跑腿不读不判(键随存体留着)。
+     */
+    sessionKind?: "sidechain";
     /** Which deployment SCENARIO assembles this task's tools/prompt/skills (the keys of the worker's scenario
      *  table — e.g. "default"/"code"/"code-review"/"scan"/"cowork"). An INTENT bounded by the deployment's own table AND,
      *  on a governed worker, by the principal's center-resolved allowlist: an unknown name is a typed 400
@@ -109,7 +117,8 @@ export interface TaskRequestBody {
      *  `RunnerDeps.loadProjectMemory` —— 项目层、声明的指令文件、它们喂的那几处一并缺席(引擎自己的 git 状态车道、记忆引擎、技能 / hooks / MCP 不受影响)。
      *  原样投给引擎;拼写门与 `fileHistory` 同一张单成员关断词表(`request-value-closure.ts`:别的值 fresh 400 `request.field_invalid`、续跑重放同判),
      *  引擎读到的恒是这一个词;子代随父继承(引擎的夹紧表)。
-     *  本服务自铸的 `wiring_manifest.instructions` 段在这样的腿上缺席(loader 没被调就没有陈述)。能力位 `projectMemory`。 */
+     *  本服务自铸的 `wiring_manifest.instructions` 段在这样的腿上缺席(loader 没被调就没有陈述)。能力位 `projectMemory`。
+     *  7.150.0 起同一个词也关掉这条 run 从项目登记簿继承的项目简报(`project-context.ts`;继承来的 `cwd` 不受它管 —— 位置不是上下文内容)。 */
     projectMemory?: TaskSpec["projectMemory"];
     /** Explicit model selection (CLI `/model` picker + `run --model <ref>`). An INTENT by catalog
      *  name (e.g. "deepseek-pro") — resolveSpec gates it against the SAME allow-list as an inline `@name` mention
@@ -239,7 +248,9 @@ export interface TaskRequestBody {
      *  (unknown ⇒ 404 `rewind_files_to.unknown_event`). Honored ONLY when `resumeAt` is ABSENT (the two modes are mutually
      *  exclusive). Requires the anchor map + a FileHistoryStore + the session store's head read (capability
      *  `rewindFilesTo`). Its out-of-run twin — no run, no model call — is `POST /v1/sessions/:id/rewind-files` with the same
-     *  handle in `to` (capability `sessionRewindFiles`). */
+     *  handle in `to` (capability `sessionRewindFiles`). Not accepted together with `cascade: true` — the ladder's rungs
+     *  run on sessions the engine mints, so there is no history of this session to restore from ⇒ 400 `request.field_conflict`
+     *  (`reason: "cascade_verify"`, `fields: ["rewindFilesTo", "cascade"]`) at admission, before any side effect. */
     rewindFilesTo?: string;
     /** [ref](core 7.31.0 [ref] `TaskSpec.fileHistory`)—— 请求级的**文件历史关断词**,唯一词 `"disabled"`(core 的拼法,
      *  与 `checkpointStore` 同;没有 `"enabled"` —— 缺席就是「部署说了算」的唯一形,声明只能单向收紧)。`"disabled"` ⇒
@@ -448,9 +459,11 @@ export interface TaskRequestBody {
      *  authorizer(core `PROJECT_ID_REGEX`,不合形状=422 typed `invalid_project_id`)。**大小写不敏感收、
      *  归一小写用**([ref]/[ref]:词法与 core 的格式单源对齐,带 /i;收下后折小写再派生 scope/查表 ——
      *  同一个 id 的两种大小写写法落同一只记忆盘)。多租户 DB 记忆面下它把派生
-     *  scope 从 user 盘切到项目盘(`proj:<tenant>/<projectId>`)并以 config.projects[projectId].defaultScopes
-     *  作 memory.scopes 种子;单用户部署忽略派生(memoryScopeFor 不变),仅 defaultScopes 种子生效。
-     *  Rides the persisted body onto resume legs(与 memoryWrite 同姿势)。 */
+     *  scope 从 user 盘切到项目盘(`proj:<tenant>/<projectId>`);它对提交者**可见**时(`project-registry.ts`,与 `GET /v1/projects/:id` 同一只判)
+     *  那只登记的 defaultScopes 作 memory.scopes 种子(看不见 / 未登记 ⇒ 无种子,同答);单用户部署忽略派生(memoryScopeFor 不变),仅种子生效。
+     *  Rides the persisted body onto resume legs(与 memoryWrite 同姿势)—— 种子不随体:续跑腿只认提交腿冻结的种子(`CheckpointCtx.memorySeed`,以冻结的观者重判)。
+     *  7.150.0 起它(或会话行上声明过的项目)也选这条 run **继承的项目上下文**(`project-context.ts`;能力位 `projectInheritance`):登记对提交者可见且带内容证明 ⇒
+     *  项目简报进系统提示追加折叠的中段、射程内第一条 folder 填缺席的 `cwd`;判一次、随 run 冻结。项目继承来的成员参与的拒,`fields` 以本键为坐标。 */
     projectId?: string;
     /** [#40 / TOC cwd seam, SDK 0.0.36] The TOC client's launch directory — the agent's HOST execution-env workspace
      *  runs HERE (CC-parity: `sema` in a project dir operates on THAT project). An ABSOLUTE host path. 🔒 honored ONLY
@@ -572,7 +585,7 @@ export interface TaskRequestBody {
      *  `transport.env`(stdio)/ `transport.headers`(http)是这台 server 的**件**:server 交给引擎的声明里不带它们,件由部署的对端座在起子进程 / 发请求时按原字节作答
      *  (只对胜出部署同名判的条目登记;件的名与值由引擎在每次发送时判,不合 ⇒ 那一台不连、兄弟照挂)。 */
     mcpServers?: RequestMcpServerSpec[];
-    /** [DESIGN-269 车1] Caller-supplied per-request A2A peers (remote agents this task may call), aligned to
+    /** [[ref] 车1] Caller-supplied per-request A2A peers (remote agents this task may call), aligned to
      *  core `A2aServerSpec`. 🔒 honored on a SINGLE-USER deployment (task-a2a.ts `a2aInjectionHonored`, the same
      *  predicate `capabilities.a2aInjection` advertises) — the requester is the super-admin of their OWN worker,
      *  on ANY execution lane (an A2A call is a plain outbound HTTPS request from the worker, so the lane where

package/dist/identity-source.d.ts

@@ -2,7 +2,7 @@
  * **身份来源闭集 + run 行身份元组** —— 叶子模块(零依赖):凭据门(`http/principal-gate.ts`)、run 店契约(`plugins/store-contracts.ts`)、
  * 三只 run 店与 leader run 店(`plugins/leader-run-store-sql.ts`)、中央建表语句(`plugins/tidb-pool.ts` / `plugins/pg-pool.ts`)与 `/health` 自报位读同一份。
  *
- * ## 律(三句;全仓只在这里写一次)
+ * ## 律(五条;全仓只在这里写一次)
  * 1. **一张表、一个次序**:{@link IDENTITY_SOURCES} 的序 = 凭据门的判定次序(`verifiedIdentitySource` 答表里第一个验得过的词)= `/health.auth.kinds` 的出现序。
  *    出示了部署的 service 凭据就是 `service_token` —— 哪怕同一枚 Bearer 也被鉴权桥验成登录令牌、哪怕运维给这枚凭据起的系统名叫 `sso`;
  *    验不过 service 凭据而鉴权桥挂了身份 ⇒ `sso`;都没有而直连门 principal 令牌验过 ⇒ `direct_door_jwt`。
@@ -15,6 +15,10 @@
  * 4. **令牌声明装不进它的列就不记**(不截断:截断 = 两个不同的值折成一个):`sso` 臂从验过的令牌铸元组时,某一格装不进它的列宽({@link RUN_IDENTITY_CLAIM_COLUMNS})
  *    ⇒ 那一格「未记录」—— 可空的格(化身号)记 `null`;必填的格(scope)装不下就铸不出合形元组 ⇒ 无元组。两格结果不同来自元组的型,不是两条规则:
  *    同一只判({@link runIdentityClaimOverflow})、同一行告警 `run_identity_claim_unrecorded { claim, chars, max }`(凭据门的铸点发;只名与长度,不带值)。
+ * 5. **凭据门认哪几类来源,一列答**({@link passesCredentialGate}):service 凭据与鉴权桥验过的登录令牌过门,直连门 principal 令牌不过(它只证审批决定者是谁)。
+ *    两道门读这同一列、各问各的事:全局凭据门(401)只在部署配了 service 凭据时武装({@link hasServiceAuth});fail-closed 写门(503:计费提交 / bake / 改写门 /
+ *    破坏性会话写 / 停驻赎回开新腿)恒武装,问的是**这次请求**带没带过门的凭据,`ALLOW_UNAUTHED_WRITES` 是它唯一的逃生口 —— 写门不读任何部署级布尔:
+ *    部署接没接过门的来源,落在「这次请求验不验得出」里(没接 ⇒ 没有一次请求验得出 ⇒ 照拒)。
  *
  * 化身号 `principalInc`:令牌 `sub_inc` 声明原样(契约包 `VerifiedIdentity.principalInc`)。来源链只有一条 —— 验证器读出 → 注入边界再判形(`auth-bridge.ts` 的
  * `admitBridgeIdentity`)→ 入口预认证挂 request-local(`security.ts` 的 `setSsoPrincipalInc`)→ 凭据门 `admitRunIdentity` 的 `sso` 臂铸进元组(律 4)→ 建行原样写入。
@@ -46,9 +50,22 @@ export declare function authBridgeIssuerOf(config: Pick<IdentitySourceConfig, "a
     readonly issuer: string;
     readonly source: "explicit" | "fallback";
 } | undefined;
-/** 「这台部署配了任何一把 service 凭证吗」—— fail-closed 写门族的真值源,也是身份来源 `service_token` 接没接线的那一句。**单一属主**:全局凭据门(`http/dispatch.ts`)、
- *  停驻行的赎回席(`http/approval-sweeps.ts`)、记忆整理阀门的启动期告警(`boot/stage-06-runners.ts`)、以及 {@link configuredIdentitySources} 读同一句(手抄迟早只改一处,而这条判据决定的是「无凭证部署上写口开不开」)。 */
+/**
+ * 「这台部署配了任何一把 service 凭证吗」—— 身份来源 `service_token` 接没接线的那一句,也是**全局凭据门的武装谓词**(配了 ⇒ 门后各口不带过门凭据就 401;
+ * 没配 ⇒ 门不武装,写门照样只认过门的凭据,见文件头律 5)。**单一属主**(手抄迟早只改一处):全局凭据门的武装(`http/dispatch.ts`)、门前读路谓词与 `/health` 读者档
+ * (同文件 `readCredentialOk` / `healthReaderOf`,问的都是「门武装没有」)、监听收窄与两条单用户边界不变量(`bind-host.ts` 的 `bindMustNarrow`,`config-invariants.ts`)、
+ * 多租无 fleet 凭据的启动期告警(`boot/stage-07-capability-layer.ts`)、以及 {@link configuredIdentitySources} 读同一句。**不是**写门的判据(写门问请求,律 5)。
+ */
 export declare function hasServiceAuth(config: Pick<IdentitySourceConfig, "authToken" | "authTokens">): boolean;
+/** 凭据门认的那几类来源(律 5;{@link passesCredentialGate} 收窄到它)。 */
+export type CredentialGateSource = Extract<IdentitySource, "service_token" | "sso">;
+/**
+ * 🔴 **律 5 的那一列:这一类来源过不过凭据门**(缺席 = 这次请求没有验过的来源 ⇒ 不过)。service 凭据是部署发的凭据;鉴权桥验过的登录令牌由本部署信任的签发方签、
+ * 主体就是令牌里的那一位(主体头盖不过它);直连门 principal 令牌只证审批决定者是谁,从来不替代凭据。穷举:加一个来源不接这里 ⇒ 编译红。
+ * 读者:全局凭据门的 401 与 fail-closed 写门的 503(`http/dispatch.ts`,读同一次 `verifiedIdentitySource` 的答案)、停驻赎回席(`http/approval-sweeps.ts`)、
+ * 以及它在部署上的投影 —— 部署形表行 `credentialGateSource`(`deployment-shape.ts`;请求面不读那一行,写门问的是请求)。
+ */
+export declare function passesCredentialGate(kind: IdentitySource | undefined): kind is CredentialGateSource;
 /**
  * 🔴 **「这台部署能回哪几个身份来源」的唯一读法**({@link IDENTITY_SOURCES} 里配置接了线的那几个词,序同表)。读者:部署形表的 `identity` 轴
  * (`deployment-shape.ts`,「有没有身份边界」那一行由它答)、`/health.auth`(自报位,`http/health-self-report.ts`)、server-as-peer 受众门(`http/server.ts`)。

package/dist/identity-source.js

@@ -23,6 +23,20 @@ function identitySourceConfigured(kind, config) {
         }
     }
 }
+export function passesCredentialGate(kind) {
+    switch (kind) {
+        case "service_token":
+        case "sso":
+            return true;
+        case "direct_door_jwt":
+        case undefined:
+            return false;
+        default: {
+            const unknownKind = kind;
+            throw new Error(`identity sources: unknown identity source ${String(unknownKind)}`);
+        }
+    }
+}
 export function configuredIdentitySources(config) {
     return IDENTITY_SOURCES.filter((k) => identitySourceConfigured(k, config));
 }

package/dist/index.d.ts

@@ -41,5 +41,9 @@ export { judgeServedModelRoute, type ServedModelRouteView, type ServedModelRoute
 export type { UserInputLedgerStore, UserInputAcceptance, NewUserInputAcceptance, OpenScanCursor, OpenScanPage, SettleHow, WriterGoneEvidence } from "./user-input-ledger.js";
 export type { OrgDeliveryQuotaStore, OrgDeliveryQuotaPolicy, OrgDeliveryQuotaVerdict } from "./plugins/org-delivery-quota-store.js";
 export type { ServerOrgDeliveryGate, ServerOrgDeliveryOutcome } from "./org-delivery-gate.js";
+export type { LandedAttendantSeat, LandedAnchor, FileHistoryReplayResult, FileHistoryReplayFailure } from "./plugins/landed-attendants.js";
+export type { LandedOutcome } from "./session-row.js";
+export type { SessionFace } from "./session-incarnation.js";
+export type { BlobGetter } from "./session-sync.js";
 export { APPROVAL_GATE_KINDS, type ApprovalGateKind } from "./approval-content-kind.js";
 //# sourceMappingURL=index.d.ts.map