@sema-agent/server 7.149.0 → 7.151.0

package/docs/DEVICE-EXECUTOR-PROTOCOL.md

@@ -152,10 +152,15 @@ pre-auth frame closes the connection outright.
 
 **Which revision to declare.** `challenge.protocolVersion` is the highest protocol revision this server speaks
 (`DEVICE_MIN_PROTOCOL_VERSION` is the lowest it accepts, §2.1). Put the highest revision *you* implement that is
-not above `challenge.protocolVersion` into `hello.protocolVersion` — the same integer you sign (§1.3) — and emit
-only the `errorCode` words of that revision (the revision table in §2.1). Nothing is renegotiated after `hello`:
+not above `challenge.protocolVersion` into `hello.protocolVersion` — the same integer you sign (§1.3) — declare in
+`supports` only the instruction kinds of that revision, and emit only the `errorCode` words of that revision (the revision
+table in §2.1). Nothing is renegotiated after `hello`:
 the revision you declared is the contract for the whole connection. If the highest revision you implement is below
 `DEVICE_MIN_PROTOCOL_VERSION`, the server answers `helloReject: protocol_version_unsupported` (§1.4).
+Revisions are cumulative on the executor's side: an executor that implements revision *N* implements every revision
+below it, so against an older server it declares that server's revision (a revision-5 executor serves a revision-4
+server, whose paths arrive folded — a subset of what revision 5 sends). `DEVICE_MIN_PROTOCOL_VERSION` is the lowest
+revision **this server** accepts, not a floor for your own negotiation.
 
 ### 1.3 The `hello` signature (byte-exact — do not improvise)
 
@@ -247,7 +252,7 @@ sign exactly these bytes with the device's Ed25519 private key.
 |---|---|---|
 | `auth_failed` | deliberately ambiguous: unknown device id, malformed id, malformed epoch, bad signature, or the server's device registry was unreachable | do **not** hammer: back off exponentially. If it never clears, the enrollment is gone — re-enroll. The server will not tell you which of these it was (anti-enumeration) |
 | `revoked` | this device has been revoked. Terminal | stop reconnecting, delete the private key, ask the user to re-enroll (it yields a new `deviceId`) |
-| `protocol_version_unsupported` | your `protocolVersion` is outside the range this server accepts; the frame carries `minProtocolVersion` | upgrade the executor. Never retry-with-a-different-version in a loop |
+| `protocol_version_unsupported` | your `protocolVersion` is outside the range this server accepts; the frame carries `minProtocolVersion` and a one-line `message` that names your revision, the range and — below the floor — the change at the floor revision (§2.1) | upgrade the executor (`message` is fit to show as is). Never retry-with-a-different-version in a loop |
 | `draining` | this replica is shutting down or upgrading and takes no new connections | reconnect with backoff; a replacement replica will accept you |
 | `already_connected` | **the connection lease for this `deviceId` is not available right now**: a previous connection is still considered fresh, the stored lease has not expired yet, or the deployment forbids takeover | retry with bounded backoff — the lease expires on its own (deployment default 45 s, and a previous socket is judged stale after ~3 missed heartbeats). This code does **not** prove another process is alive: a half-open network drop can make your *own* previous connection look fresh. Do not exit permanently on it; do hold a machine-local single-instance lock so you are never racing yourself |
 
@@ -341,8 +346,8 @@ base64 inside JSON fields.
 | Constant | Value | Meaning |
 |---|---|---|
 | `DEVICE_WS_PATH` | `/v1/device/ws` | the upgrade path (prefer the `wsPath` from `/v1/capabilities`) |
-| `DEVICE_PROTOCOL_VERSION` | `4` | the protocol revision this server speaks (the highest it accepts) |
-| `DEVICE_MIN_PROTOCOL_VERSION` | `1` | the lowest revision it accepts; below it (or above the highest), a loud `helloReject` — never a silent downgrade |
+| `DEVICE_PROTOCOL_VERSION` | `6` | the protocol revision this server speaks (the highest it accepts) |
+| `DEVICE_MIN_PROTOCOL_VERSION` | `5` | the lowest revision it accepts (the revision table says why); below it (or above the highest), a loud `helloReject` — never a silent downgrade |
 | `DEVICE_HELLO_DOMAIN_TAG` | `sema.device.hello.v1` | the handshake signature domain tag (§1.3) |
 
 <!-- closed-set: DEVICE_WS_LIMITS -->
@@ -357,30 +362,48 @@ base64 inside JSON fields.
 Note the asymmetry: the transport cap is 1 MiB, and the 4096-byte pre-auth cap is applied **after** the
 frame has been reassembled. Keep `hello` small; it is not a place for long `supports` prose.
 
-#### Protocol revisions and the `errorCode` set
+`maxFrameBytes` binds the server too: every frame it sends is measured after serialization and is never over the
+cap. An instruction whose frame would be over it is refused before dispatch (you never receive it), and `payload`
+chunks are sliced so that a chunk frame, base64 and envelope included, fits. You can therefore cap the frames you
+accept at `maxFrameBytes`.
+
+#### Protocol revisions: the `errorCode` set and the instruction kinds
 
 The protocol revision is the only thing an executor can read *before* it sends `hello` (the `challenge` frame
-carries it), so the set of `errorCode` words the server accepts from you is a function of the revision, not a
-separate list. The table gives, per revision, the words **added** at that revision; the set at revision *N* is
-the union of the rows up to *N*, and the full set at the current revision is the §3.3 table.
+carries it), so everything you must know to be correct on this server is a function of the revision, not a
+separate list: the set of `errorCode` words the server accepts from you, the set of instruction kinds it may send you,
+and what the frames it sends you mean. The table gives, per revision, the words **added** to each set at that revision
+and any other change made at it; a set at revision *N* is the union of its column's rows up to *N*, and the full sets at
+the current revision are the §3.3 table (`errorCode`) and the §3.1 table (instruction kinds, in this order).
 
 <!-- closed-set: DEVICE_OUTCOME_ERROR_CODES_BY_REVISION -->
 
-| Revision | `errorCode` words added at this revision |
-|---|---|
-| `1` | `aborted`, `already_exists`, `auth_failed`, `callback_error`, `invalid`, `is_directory`, `not_directory`, `not_found`, `not_supported`, `outcome_unknown`, `permission_denied`, `precondition_failed`, `shell_unavailable`, `spawn_error`, `suspended`, `target_unavailable`, `timeout`, `transport_lost`, `unknown` |
-| `2` | `liveness_no_output` |
-| `3` | `name_too_long` |
-| `4` | `symlink_loop` |
-
-Rules: adding a frame or a field is additive and does not raise the revision; adding a word to a closed set the
-server *accepts from you* (today: the `errorCode` set) raises `DEVICE_PROTOCOL_VERSION` and adds a row here; a
-released row never changes. Declare a revision as §1.2 says and send only the words of that revision: an executor
+| Revision | `errorCode` words added at this revision | Instruction kinds added at this revision | Other change at this revision |
+|---|---|---|---|
+| `1` | `aborted`, `already_exists`, `auth_failed`, `callback_error`, `invalid`, `is_directory`, `not_directory`, `not_found`, `not_supported`, `outcome_unknown`, `permission_denied`, `precondition_failed`, `shell_unavailable`, `spawn_error`, `suspended`, `target_unavailable`, `timeout`, `transport_lost`, `unknown` | `exec`, `execStream`, `readTextFile`, `readTextLines`, `readBinaryFile`, `writeFile`, `writeFileExclusive`, `writeFileGuarded`, `appendFile`, `fileInfo`, `listDir`, `canonicalPath`, `exists`, `readLink`, `createDir`, `remove`, `createTempDir`, `createTempFile`, `statBatch` | — |
+| `2` | `liveness_no_output` | — | — |
+| `3` | `name_too_long` | — | — |
+| `4` | `symlink_loop` | — | — |
+| `5` | — | — | every path an instruction carries (`args.path`, `args.paths`, `cwd`) arrives **unfolded** (since server 7.150.0): absolute as written, or anchored at the session's working directory, with `.` / `..` / empty segments kept — the server anchors and never folds. Resolve it as your filesystem does and judge containment on where it resolves (§3.1, §6 item 6). An executor written for revision 4 or below expects folded paths, so this is also the lowest revision the server accepts |
+| `6` | — | `openBound` | — |
+
+Rules: adding a frame or a field is additive and does not raise the revision. Every other change
+raises `DEVICE_PROTOCOL_VERSION` and adds a row here — a word added to either closed set of the instruction exchange:
+an `errorCode` word the server *accepts from you* (second column) or an instruction kind the server *sends you*
+(third column) — or a **semantic change**, a change in what a frame the server sends you means (fourth column):
+a semantic change raises the revision. A released row never changes. The server sends a kind only on a connection
+whose declared revision is at or above the row that added it, and only if that connection's `supports` declares it
+(§3.2): a kind above your revision is never sent to you, so an executor written for the older revision still honors
+the newer one and the lowest accepted revision stays where it was (revision 6 added `openBound`; a revision-5 executor
+never receives it). When an executor written for
+an older revision cannot honor the change, the same release raises `DEVICE_MIN_PROTOCOL_VERSION` to the new
+revision, so such an executor is refused once at `hello` (§1.4) instead of failing call by call.
+Declare a revision as §1.2 says and use only the words of that revision: an executor
 that declared revision 1 never sends `liveness_no_output` (the server does not police this per connection — it
 decodes every connection against the current revision's full set — but a word above your declared revision is outside
-your contract). The same sets are importable:
-`DEVICE_OUTCOME_ERROR_CODES_BY_REVISION` and `deviceOutcomeErrorCodesAt(revision)` from
-`@sema-agent/server/device-protocol`.
+your contract), and a kind above your declared revision in `supports` is ignored like a word the server does not know.
+The same sets are importable: `DEVICE_OUTCOME_ERROR_CODES_BY_REVISION` / `deviceOutcomeErrorCodesAt(revision)` and
+`DEVICE_INSTRUCTION_KINDS_BY_REVISION` / `deviceInstructionKindsAt(revision)` from `@sema-agent/server/device-protocol`.
 
 ### 2.2 Device → server frames
 
@@ -407,7 +430,7 @@ zeros, a plus sign, whitespace or a float form are rejected as malformed.
 |---|---|---|
 | `challenge` | `nonce` string, `protocolVersion` int | first frame the server sends, immediately on open |
 | `helloAck` | `ok`, `heartbeatIntervalMs`, `maxInflight`, `gen`, `pendingInstructions`, `chunkWatermarks`, `reconnectGraceMs`, `cancelGraceMs`, `chunkGapTimeoutMs`, `executionCeilingGraceMs` | §1.5 |
-| `helloReject` | `code`, `minProtocolVersion?` | §1.4; the socket closes right after |
+| `helloReject` | `code`, `minProtocolVersion?`, `message?` | §1.4; `minProtocolVersion` and `message` appear on `protocol_version_unsupported` only; the socket closes right after |
 | `instruction` | `gen`, `instructionId`, `rootSessionId`, `issuedSeq` int, `kind`, `args`, `cwd?`, `shellEnv?`, `timeoutMs` int | one unit of work (§3). `cwd` appears on `exec` / `execStream` only, and always there (§3.1) |
 | `payload` | `gen`, `instructionId`, `part` (`begin` \| `chunk` \| `commit`), `offset?`, `dataB64?`, `totalLen?`, `sha256?` | the bytes for a write-family instruction (§3.4) |
 | `cancel` | `gen`, `instructionId` | idempotent; answer with a terminal `result` (§5 R11) |
@@ -480,11 +503,19 @@ silently forgiven: it becomes a gap or a missing terminal, and the instruction e
 
 ### 3.1 The closed set, its arguments, and the success outcome each one owes
 
-Every `path` in `args` arrives **already absolute and POSIX-normalized** — the server resolved it against
-the session's working directory before sending. `exec` and `execStream` additionally carry `cwd`, which is
-**always present and always absolute**: run the command in exactly that directory. There is no implicit
-base to fall back to, so an executor needs no branch for a missing or relative `cwd`. Every other kind
-carries no `cwd` — its paths are already absolute.
+Every `path` in `args` arrives **already absolute** — the server anchored a relative one at the session's
+working directory before sending — and **as written: a `..` or `.` segment, or an empty one, is never folded**
+(revision 5, §2.1). Hand it to your
+filesystem as it is. The kernel resolves `..` component by component, so a `..` that follows a symbolic link
+goes where the link leads (`<root>/bridge/../next` with `bridge -> elsewhere/sub` is `<root>/elsewhere/next`,
+not `<root>/next`) — and that is the file the engine's gates judged: they asked you about this same spelling
+(`exists` / `canonicalPath` / `fileInfo` / `readLink`). `exec` and `execStream` additionally carry `cwd`, which is
+**always present and always absolute** (unfolded the same way): run the command in exactly that directory.
+There is no implicit base to fall back to, so an executor needs no branch for a missing or relative `cwd`.
+Every other kind carries no `cwd` — its paths are already absolute. The paths the server reports back are its
+own spellings, not the ones you return: `fileInfo` reports the path it asked; `listDir` reads only the leaf name
+(last segment) of each entry's `WireFileInfo.path` and reports the entry as `<asked path>/<leaf>`, so a listed
+entry can be asked again as written.
 
 <!-- closed-set: DEVICE_INSTRUCTION_KINDS -->
 
@@ -509,6 +540,7 @@ carries no `cwd` — its paths are already absolute.
 | `createTempDir` | `{ prefix? }` | `{ok:true, kind:"write", canonicalPath}` | the created directory's path **is** the receipt |
 | `createTempFile` | `{ prefix?, suffix? }` | `{ok:true, kind:"write", canonicalPath}` | same |
 | `statBatch` | `{ paths: string[] }` | `{ok:true, kind:"stat", …}` | declared but **not dispatched today** (see §8) |
+| `openBound` | `{ path, op, identity?, kind?, max? }` | per `op`: `open` / `size` / `list` ⇒ `{ok:true, kind:"stat", …}`, `readBytes` ⇒ `{ok:true, kind:"read"}` | **optional face**, revision 6 — a bound read: the object judged is the object read (§3.7) |
 
 The server checks the outcome *kind* against the instruction kind. Answering an `execStream` with
 `{ok:true, kind:"void"}` — a perfectly well-formed frame — is refused as a protocol violation and the
@@ -517,22 +549,26 @@ outcome are always accepted.
 
 ### 3.2 Declaring what you implement: `hello.supports`
 
-`supports` is a plain `string[]` of instruction kinds. The server intersects it with its own closed set;
-**a kind you do not declare is never dispatched to you**, and a call that needs it fails loudly with
-`not_supported` instead of silently doing something else. A kind the server does not recognize is simply
-ignored (that is how a newer executor talks to an older server without breaking it).
+`supports` is a plain `string[]` of instruction kinds. The server intersects it with the kinds of the revision you declared
+(§2.1); **a kind you do not declare is never dispatched to you**, and a call that needs it fails loudly with
+`not_supported` instead of silently doing something else. A kind the server does not recognize — or one above the
+revision you declared — is simply ignored (that is how a newer executor talks to an older server without breaking it).
 
-Three faces are **presence-typed**, which is a stronger statement than "optional":
+Four faces are **presence-typed**, which is a stronger statement than "optional":
 
 - `writeFileExclusive` — atomic create-if-absent
 - `writeFileGuarded` — verify-and-write in one atomic step
 - `readLink` — read a symlink target
+- `openBound` — a bound read (§3.7): every answer is about the object that was opened and checked
 
 The engine decides *at environment-construction time* whether these exist, and when they do not it
 degrades honestly (an advisory check instead of an atomic one). **Therefore: absence is absence. Never
 emulate a guarded or exclusive write with a two-step "check then write".** A two-step emulation reopens
 exactly the race the atomic primitive exists to close, while wearing the face of an atomic operation —
-which is worse than not having it, because nothing downstream can tell.
+which is worse than not having it, because nothing downstream can tell. The same holds for `openBound`:
+**never emulate it with `fileInfo` + `readBinaryFile`** (two path reads cannot tell that the bytes came from the
+object that was judged); without it, the engine simply does not bind a read on this device (a path attachment is
+accepted and reported `not_attached`).
 
 Two more consequences you must design for:
 
@@ -567,8 +603,8 @@ a moment ago. If you omit `created`, the consumer reports the weaker of the two
 
 `message` is required on the failure arm and is shown to the model — make it specific.
 
-This is the full set at the current revision (`3`); the revision table in §2.1 says which revision each word arrived
-with, and an executor sends only the words of the revision it declared (§1.2).
+This is the full set at the current revision (`DEVICE_PROTOCOL_VERSION`, §2.1); the revision table in §2.1 says which revision
+each word arrived with, and an executor sends only the words of the revision it declared (§1.2).
 
 <!-- closed-set: DEVICE_OUTCOME_ERROR_CODES -->
 
@@ -689,8 +725,45 @@ side**. Verifying with `stat` and then writing is exactly the emulation that is
 - `readLink` — optional but strongly recommended: it is the fourth governance read, and its absence makes
   symlink adjudication coarser.
 - `writeFileExclusive`, `writeFileGuarded` — optional; implement them only if you can do them atomically.
+- `openBound` — optional (revision 6); without it a path attachment on this device is accepted but not attached (§3.7).
 - `statBatch` — safe to omit today.
 
+
+### 3.7 `openBound` and its four answers
+
+`openBound` is a revision-6 kind: the server sends it only on a connection whose `hello.protocolVersion` is 6 or above
+**and** whose `supports` declares it. On a revision-5 connection the face is absent, exactly as if you had not declared
+it (the engine does not bind a read; a path attachment is reported `not_attached`).
+
+The protocol has no handle that lives across instructions, so the engine's bound-read object is answered one
+instruction per answer. Every `openBound` instruction is a **complete rebinding**: open `path` locally (do not
+follow a final symbolic link), ask the kernel **once, through that open**, which path the opened object now has and
+what it is, answer **through that same open**, then close it. Never read the path a second time to answer.
+
+<!-- closed-set: DEVICE_BOUND_READ_OPS -->
+
+| `op` | Carries | Answer with | Refuse with |
+|---|---|---|---|
+| `open` | `path` | `{ok:true, kind:"stat", identity, info}` — `identity` = the opened object's `<device>:<inode>`; `info.kind` is `file` or `dir` | `precondition_failed` (the final component is a link, or the opened object is not at `path`); `invalid` (neither a regular file nor a directory) |
+| `size` | `path`, `identity`, `kind` | `{ok:true, kind:"stat", info}` — `info.size` = the current size | `precondition_failed` when the object opened now is not `identity` / `kind` or not at `path` |
+| `readBytes` | `path`, `identity`, `kind`, `max` | `{ok:true, kind:"read"}`, the bytes as `data` chunks | as `size`, plus `invalid` when the file is over `max` bytes when the read starts (read nothing) |
+| `list` | `path`, `identity`, `kind` | `{ok:true, kind:"stat", entries}` — the opened directory's direct children, links not followed; the server reads only each entry's leaf name | as `size` |
+
+Rules:
+
+- **One observation per answer.** The check that the opened object is at `path` must be a single observation of
+  that open (Linux: `readlink("/proc/self/fd/<fd>")`; macOS: an open with `O_NOFOLLOW_ANY` refuses a link on any
+  component, so the open itself is the observation). Separate `fstat` / `lstat` / `realpath` calls are three
+  observations that a directory swapped in and out between them gets through. If your platform cannot give one
+  observation, answer `not_supported` — the engine reads that as "this face is absent here".
+- **Identity and kind both.** For `size` / `readBytes` / `list`, the object you opened must equal both `identity`
+  and `kind` from the `open` answer, else `precondition_failed`. Two opens whose identities are equal do not prove
+  they opened one object after an inode number was reused; that residue is accepted by the engine's contract.
+- **Bounded.** An open can block (a FIFO swapped in under the path); the whole answer must finish within the
+  instruction's `timeoutMs` and your executor must not leave the blocked open behind.
+- **No privilege above the session's own commands.** Open as the same user that runs the session's `exec`.
+- Error codes are the words of your declared revision (§2.1); nothing new is needed.
+
 ---
 
 ## 4. Streaming execution
@@ -972,11 +1045,16 @@ These two are a real distinction to the caller: `not_started` is safely retryabl
    *Honest boundary*: this is a decision-and-audit property, not enforcement against a compromised
    machine. The protocol assumes an honest executor; it protects against races and mistakes, not against
    an executor that lies.
-6. **Respect `workspaceRoot` and resolve nothing yourself.** Paths arrive absolute and normalized; the
-   server has already resolved them against the session's working directory, falling back to the
-   `workspaceRoot` you registered. Do not re-interpret them, do not expand `~`, do not follow a different
-   base. You **may** enforce your own containment policy on top (refusing paths outside a root you are
-   willing to serve) — if you do, refuse with `permission_denied`. What you must never do is silently
+6. **Respect `workspaceRoot` and resolve nothing yourself.** Paths arrive absolute and unfolded; the
+   server has already anchored them at the session's working directory, falling back to the
+   `workspaceRoot` you registered. Do not re-interpret them: never fold a `..` lexically (with a link before
+   it, the folded spelling names a different file than the one the gates judged), do not expand `~`, do not
+   follow a different base. You **may** enforce your own containment policy on top (refusing paths outside a
+   root you are willing to serve) — judge it on where the path resolves (the real path of its existing part),
+   never on a string prefix of the spelling (`<root>/../etc` starts with `<root>/`); if you refuse, refuse
+   with `permission_denied`. Negative control: with `bridge` a link to `/opt/x/sub` (outside the root),
+   `<root>/bridge/../next` resolves to `/opt/x/next` — the link carried the `..` out of the root, so the
+   answer is `permission_denied` (not `not_found`, not success). What you must never do is silently
    redirect a path to somewhere else: a write that lands in a different place than the caller adjudicated
    is the exact failure this lane is built to prevent.
 7. **Do not cache and replay results.** No answer may be served from a cache keyed by command text, path
@@ -1027,6 +1105,7 @@ These two are a real distinction to the caller: `not_started` is safely retryabl
 
 - [ ] `readLink` (recommended soon after — it is the fourth governance read)
 - [ ] `writeFileExclusive`, `writeFileGuarded` — declare only when atomic (§3.2)
+- [ ] `openBound` — declare only with one observation per answer, and only when you declare revision 6 or above (§3.7)
 - [ ] `statBatch` — not dispatched today
 
 **Process shape (recommended)**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/server",
-  "version": "7.149.0",
+  "version": "7.151.0",
   "description": "Sema Server — the server/API implementation layer for Sema, wiring core, registry, model providers, and cloud agent execution. Built on @sema-agent/core.",
   "type": "module",
   "license": "BUSL-1.1",
@@ -83,8 +83,8 @@
   },
   "dependencies": {
     "@modelcontextprotocol/server": "2.4.0",
-    "@sema-agent/core": "7.66.0",
-    "@sema-agent/settings-schema": "24.0.0",
+    "@sema-agent/core": "7.66.1",
+    "@sema-agent/settings-schema": "25.1.0",
     "e2b": "2.36.0",
     "libsodium-wrappers": "0.8.4",
     "mysql2": "3.22.6",

package/wire-changes/server@7.150.0.json

@@ -0,0 +1,335 @@
+{
+  "repo": "server",
+  "version": "7.150.0",
+  "from": "v7.149.0",
+  "fromCommit": "4ddd53ff8ba95bf63354b58203d01db51e025795",
+  "to": "v7.150.0",
+  "generator": "scripts/wire-changes-server.mjs",
+  "sources": [
+    "docs/ASSISTANT-WIRE-CONTRACT.md#A.1",
+    "docs/ASSISTANT-WIRE-CONTRACT.md#A.1b",
+    "docs/ASSISTANT-WIRE-CONTRACT.md#A.1h",
+    "docs/ASSISTANT-WIRE-CONTRACT.md#A.1g",
+    "docs/ASSISTANT-WIRE-CONTRACT.md#B.1",
+    "docs/ASSISTANT-WIRE-CONTRACT.md#B.1a",
+    "docs/ASSISTANT-WIRE-CONTRACT.md#B.2b",
+    "docs/ASSISTANT-WIRE-CONTRACT.md#B.2",
+    "docs/ASSISTANT-WIRE-CONTRACT.md#D.3",
+    "src/trace/wire-projection-faces.ts",
+    "src/trace/self-minted-wire.ts",
+    "node_modules/@sema-agent/core/wire-changes",
+    "src/trace/core-vocab-wire.ts"
+  ],
+  "added": [
+    {
+      "id": "A1",
+      "source": "capability",
+      "member": "projectInheritance",
+      "text": "附录 B.1 能力位新增 `projectInheritance`(谓词类 config 依赖)"
+    },
+    {
+      "id": "A2",
+      "source": "selfMinted.deviceProtocolRevision",
+      "member": "5",
+      "text": "自铸 GET /v1/capabilities deviceExecutor.protocolVersion 与 device WS challenge 帧的修订号(<修订号> → 它加进结局码闭集的词;零加词的语义修订 → 变更名) 新增 `5`(属性 paths-unfolded;since 7.150.0 = 本版新上 wire)"
+    },
+    {
+      "id": "A3",
+      "source": "selfMinted.listeningLineKey",
+      "member": "boundAddress",
+      "text": "自铸 stdout 启动协议行 listening(<键> → 在场律) 新增 `boundAddress`(属性 always;since 7.150.0 = 本版新上 wire)"
+    },
+    {
+      "id": "A4",
+      "source": "selfMinted.projectRowKey",
+      "member": "contentAttestedAt",
+      "text": "自铸 GET /v1/projects projects[] 行键 = GET /v1/projects/:id 200 体(<键> → 在场律) 新增 `contentAttestedAt`(属性 present-iff the registration carries the configuration center's content attestation (settings-schema 25.1.0; the time the center's write path last admitted the project's goal / notes / contextItems under the publisher role);since 7.150.0 = 本版新上 wire)"
+    }
+  ],
+  "registered": [
+    {
+      "id": "L1",
+      "source": "selfMinted.listeningLineKey",
+      "member": "bindHost",
+      "text": "自铸 stdout 启动协议行 listening(<键> → 在场律) 登记 `bindHost`(属性 always;since 1.306.0 —— 早于本版,只是登记)"
+    },
+    {
+      "id": "L2",
+      "source": "selfMinted.listeningLineKey",
+      "member": "bindHostNote",
+      "text": "自铸 stdout 启动协议行 listening(<键> → 在场律) 登记 `bindHostNote`(属性 present-iff BIND_HOST unset and the bind was narrowed to loopback (unauthenticated write face);since 3.15.0 —— 早于本版,只是登记)"
+    },
+    {
+      "id": "L3",
+      "source": "selfMinted.listeningLineKey",
+      "member": "brain",
+      "text": "自铸 stdout 启动协议行 listening(<键> → 在场律) 登记 `brain`(属性 always;since 1.214.2 —— 早于本版,只是登记)"
+    },
+    {
+      "id": "L4",
+      "source": "selfMinted.listeningLineKey",
+      "member": "breakerState",
+      "text": "自铸 stdout 启动协议行 listening(<键> → 在场律) 登记 `breakerState`(属性 always;since 1.214.2 —— 早于本版,只是登记)"
+    },
+    {
+      "id": "L5",
+      "source": "selfMinted.listeningLineKey",
+      "member": "costQuota",
+      "text": "自铸 stdout 启动协议行 listening(<键> → 在场律) 登记 `costQuota`(属性 always;since 1.214.2 —— 早于本版,只是登记)"
+    },
+    {
+      "id": "L6",
+      "source": "selfMinted.listeningLineKey",
+      "member": "instanceId",
+      "text": "自铸 stdout 启动协议行 listening(<键> → 在场律) 登记 `instanceId`(属性 always;since 1.214.2 —— 早于本版,只是登记)"
+    },
+    {
+      "id": "L7",
+      "source": "selfMinted.listeningLineKey",
+      "member": "maxPrincipalCostUsd",
+      "text": "自铸 stdout 启动协议行 listening(<键> → 在场律) 登记 `maxPrincipalCostUsd`(属性 always;since 1.214.2 —— 早于本版,只是登记)"
+    },
+    {
+      "id": "L8",
+      "source": "selfMinted.listeningLineKey",
+      "member": "memory",
+      "text": "自铸 stdout 启动协议行 listening(<键> → 在场律) 登记 `memory`(属性 always;since 1.214.2 —— 早于本版,只是登记)"
+    },
+    {
+      "id": "L9",
+      "source": "selfMinted.listeningLineKey",
+      "member": "model",
+      "text": "自铸 stdout 启动协议行 listening(<键> → 在场律) 登记 `model`(属性 always;since 1.214.2 —— 早于本版,只是登记)"
+    },
+    {
+      "id": "L10",
+      "source": "selfMinted.listeningLineKey",
+      "member": "otel",
+      "text": "自铸 stdout 启动协议行 listening(<键> → 在场律) 登记 `otel`(属性 always;since 1.214.2 —— 早于本版,只是登记)"
+    },
+    {
+      "id": "L11",
+      "source": "selfMinted.listeningLineKey",
+      "member": "perModelKeys",
+      "text": "自铸 stdout 启动协议行 listening(<键> → 在场律) 登记 `perModelKeys`(属性 always;since 1.214.2 —— 早于本版,只是登记)"
+    },
+    {
+      "id": "L12",
+      "source": "selfMinted.listeningLineKey",
+      "member": "port",
+      "text": "自铸 stdout 启动协议行 listening(<键> → 在场律) 登记 `port`(属性 always;since 1.214.2 —— 早于本版,只是登记)"
+    },
+    {
+      "id": "L13",
+      "source": "selfMinted.listeningLineKey",
+      "member": "rateLimit",
+      "text": "自铸 stdout 启动协议行 listening(<键> → 在场律) 登记 `rateLimit`(属性 always;since 1.214.2 —— 早于本版,只是登记)"
+    },
+    {
+      "id": "L14",
+      "source": "selfMinted.listeningLineKey",
+      "member": "rateLimitPerMin",
+      "text": "自铸 stdout 启动协议行 listening(<键> → 在场律) 登记 `rateLimitPerMin`(属性 always;since 1.214.2 —— 早于本版,只是登记)"
+    },
+    {
+      "id": "L15",
+      "source": "selfMinted.listeningLineKey",
+      "member": "sealedModelKeys",
+      "text": "自铸 stdout 启动协议行 listening(<键> → 在场律) 登记 `sealedModelKeys`(属性 always;since 1.214.2 —— 早于本版,只是登记)"
+    },
+    {
+      "id": "L16",
+      "source": "selfMinted.listeningLineKey",
+      "member": "sealedPoisonedModels",
+      "text": "自铸 stdout 启动协议行 listening(<键> → 在场律) 登记 `sealedPoisonedModels`(属性 always;since 1.214.2 —— 早于本版,只是登记)"
+    },
+    {
+      "id": "L17",
+      "source": "selfMinted.listeningLineKey",
+      "member": "session",
+      "text": "自铸 stdout 启动协议行 listening(<键> → 在场律) 登记 `session`(属性 always;since 1.214.2 —— 早于本版,只是登记)"
+    },
+    {
+      "id": "L18",
+      "source": "selfMinted.listeningLineKey",
+      "member": "toolResultStore",
+      "text": "自铸 stdout 启动协议行 listening(<键> → 在场律) 登记 `toolResultStore`(属性 always;since 1.214.2 —— 早于本版,只是登记)"
+    },
+    {
+      "id": "L19",
+      "source": "selfMinted.listeningLineKey",
+      "member": "workflowRunStore",
+      "text": "自铸 stdout 启动协议行 listening(<键> → 在场律) 登记 `workflowRunStore`(属性 always;since 1.214.2 —— 早于本版,只是登记)"
+    },
+    {
+      "id": "L20",
+      "source": "selfMinted.mcpAuthorizationKey",
+      "member": "GET /v1/capabilities/mcp#servers[].authorization",
+      "text": "自铸 MCP 授权记录 authorization 的出现面(<面>#<键> → 在场律) 登记 `GET /v1/capabilities/mcp#servers[].authorization`(属性 present-iff errorCode unauthorized;since 7.138.0 —— 早于本版,只是登记)"
+    },
+    {
+      "id": "L21",
+      "source": "selfMinted.mcpAuthorizationKey",
+      "member": "GET /v1/runs/:id/events#tool_end.structured.authorization",
+      "text": "自铸 MCP 授权记录 authorization 的出现面(<面>#<键> → 在场律) 登记 `GET /v1/runs/:id/events#tool_end.structured.authorization`(属性 present-iff structured.code unauthorized and reason in the closed set; members = reason;since 7.138.0 —— 早于本版,只是登记)"
+    },
+    {
+      "id": "L22",
+      "source": "selfMinted.mcpAuthorizationKey",
+      "member": "GET /v1/sessions/:id#messages[].details.authorization",
+      "text": "自铸 MCP 授权记录 authorization 的出现面(<面>#<键> → 在场律) 登记 `GET /v1/sessions/:id#messages[].details.authorization`(属性 present-iff details.code unauthorized;since 7.138.0 —— 早于本版,只是登记)"
+    },
+    {
+      "id": "L23",
+      "source": "selfMinted.mcpAuthorizationKey",
+      "member": "GET /v1/sessions/:id/mcp#lastLegMcp.mcp[].authorization",
+      "text": "自铸 MCP 授权记录 authorization 的出现面(<面>#<键> → 在场律) 登记 `GET /v1/sessions/:id/mcp#lastLegMcp.mcp[].authorization`(属性 present-iff errorCode unauthorized;since 7.138.0 —— 早于本版,只是登记)"
+    },
+    {
+      "id": "L24",
+      "source": "selfMinted.mcpAuthorizationKey",
+      "member": "POST /v1/capabilities/mcp/probe#servers[].authorization",
+      "text": "自铸 MCP 授权记录 authorization 的出现面(<面>#<键> → 在场律) 登记 `POST /v1/capabilities/mcp/probe#servers[].authorization`(属性 present-iff errorCode unauthorized;since 7.138.0 —— 早于本版,只是登记)"
+    },
+    {
+      "id": "L25",
+      "source": "selfMinted.mcpAuthorizationKey",
+      "member": "SSE tool_end#structured.authorization",
+      "text": "自铸 MCP 授权记录 authorization 的出现面(<面>#<键> → 在场律) 登记 `SSE tool_end#structured.authorization`(属性 present-iff structured.code unauthorized and reason in the closed set; members = reason;since 7.138.0 —— 早于本版,只是登记)"
+    }
+  ],
+  "excluded": [],
+  "removed": [
+    {
+      "id": "R1",
+      "source": "selfMinted.mcpAuthorizationKey",
+      "member": "GET /v1/runs/:id/events#tool_end.structured.authorization(reason 以外的成员)",
+      "text": "自铸 MCP 授权记录 authorization 的出现面(<面>#<键> → 在场律) 于本版退役 `GET /v1/runs/:id/events#tool_end.structured.authorization(reason 以外的成员)`(原属性 card members passed through the text redactor (resourceMetadataUrl, a custom card's own members);自 7.138.0 起在 wire 上,until 7.150.0 = 本版)"
+    },
+    {
+      "id": "R2",
+      "source": "selfMinted.mcpAuthorizationKey",
+      "member": "GET /v1/sessions/:id#messages[].details.authorization.resourceMetadataUrl",
+      "text": "自铸 MCP 授权记录 authorization 的出现面(<面>#<键> → 在场律) 于本版退役 `GET /v1/sessions/:id#messages[].details.authorization.resourceMetadataUrl`(原属性 remote-claimed URL from the endpoint's challenge (deep-scrubbed text);自 7.138.0 起在 wire 上,until 7.150.0 = 本版)"
+    },
+    {
+      "id": "R3",
+      "source": "selfMinted.mcpAuthorizationKey",
+      "member": "SSE tool_end#structured.authorization(reason 以外的成员)",
+      "text": "自铸 MCP 授权记录 authorization 的出现面(<面>#<键> → 在场律) 于本版退役 `SSE tool_end#structured.authorization(reason 以外的成员)`(原属性 card members passed through the text redactor (resourceMetadataUrl, a custom card's own members);自 7.138.0 起在 wire 上,until 7.150.0 = 本版)"
+    }
+  ],
+  "changed": [
+    {
+      "id": "C1",
+      "source": "engineNotice",
+      "member": "mcp.authorization_required",
+      "text": "附录 D.3 engine_notice 码 `mcp.authorization_required` 的detail:`{ server, reason, authorizeUrl?, principal?, sessionId, runId }` —— `reason` ∈ `rejected`(401)/ `scope`(403 `insufficient_scope`)/ `none`(授权座没有这位用户的授权),闭集属主 core,server echo-only;`authorizeUrl` 只来自部署的授权座(本部署今天没有授权座 ⇒ 恒缺席,句子指向连接器设置) → `{ server, reason, authorizeUrl?, principal?, sessionId, runId }` —— `reason` ∈ `rejected`(401)/ `scope`(403 `insufficient_scope`)/ `none`(对端座答这位用户未授权),闭集属主 core;`reason` / `authorizeUrl` 是 MCP 授权记录的成员,经与状态行同一张处置表出门(结构位:不过 detail 的自由文本消毒与截断;词出闭集 ⇒ 记录成员整组缺席);`authorizeUrl` 只来自部署的对端座,处置表今天不放行 ⇒ 恒缺席,句子指向连接器设置"
+    },
+    {
+      "id": "C2",
+      "source": "selfMinted.fieldConflictReason",
+      "member": "scratchpad_root",
+      "text": "自铸 400 / 409 / 422 request.field_conflict reason `scratchpad_root` 的属性:- → fields = cwd (sent) or projectId (inherited from the project), then scratchpadDir when the request's own covers it(since 7.150.0)"
+    },
+    {
+      "id": "C3",
+      "source": "selfMinted.fieldConflictReason",
+      "member": "system_prompt_fold",
+      "text": "自铸 400 / 409 / 422 request.field_conflict reason `system_prompt_fold` 的属性:- → fields in fold order from appendSystemPrompt / projectId (the inherited project brief) / settings.outputStyle; count / cap(since 7.150.0)"
+    }
+  ],
+  "narrowed": [],
+  "closedSetMembers": [
+    {
+      "set": "capability",
+      "at": [
+        "docs/ASSISTANT-WIRE-CONTRACT.md#B.1"
+      ],
+      "added": [
+        "projectInheritance"
+      ],
+      "registered": [],
+      "removed": [],
+      "breaking": false
+    },
+    {
+      "set": "selfMinted.deviceProtocolRevision",
+      "at": [
+        "src/trace/self-minted-wire.ts#deviceProtocolRevision"
+      ],
+      "added": [
+        "5"
+      ],
+      "registered": [],
+      "removed": [],
+      "breaking": false
+    },
+    {
+      "set": "selfMinted.listeningLineKey",
+      "at": [
+        "src/trace/self-minted-wire.ts#listeningLineKey"
+      ],
+      "added": [
+        "boundAddress"
+      ],
+      "registered": [
+        "bindHost",
+        "bindHostNote",
+        "brain",
+        "breakerState",
+        "costQuota",
+        "instanceId",
+        "maxPrincipalCostUsd",
+        "memory",
+        "model",
+        "otel",
+        "perModelKeys",
+        "port",
+        "rateLimit",
+        "rateLimitPerMin",
+        "sealedModelKeys",
+        "sealedPoisonedModels",
+        "session",
+        "toolResultStore",
+        "workflowRunStore"
+      ],
+      "removed": [],
+      "breaking": false
+    },
+    {
+      "set": "selfMinted.mcpAuthorizationKey",
+      "at": [
+        "src/trace/self-minted-wire.ts#mcpAuthorizationKey"
+      ],
+      "added": [],
+      "registered": [
+        "GET /v1/capabilities/mcp#servers[].authorization",
+        "GET /v1/runs/:id/events#tool_end.structured.authorization",
+        "GET /v1/sessions/:id#messages[].details.authorization",
+        "GET /v1/sessions/:id/mcp#lastLegMcp.mcp[].authorization",
+        "POST /v1/capabilities/mcp/probe#servers[].authorization",
+        "SSE tool_end#structured.authorization"
+      ],
+      "removed": [
+        "GET /v1/runs/:id/events#tool_end.structured.authorization(reason 以外的成员)",
+        "GET /v1/sessions/:id#messages[].details.authorization.resourceMetadataUrl",
+        "SSE tool_end#structured.authorization(reason 以外的成员)"
+      ],
+      "breaking": true
+    },
+    {
+      "set": "selfMinted.projectRowKey",
+      "at": [
+        "src/trace/self-minted-wire.ts#projectRowKey"
+      ],
+      "added": [
+        "contentAttestedAt"
+      ],
+      "registered": [],
+      "removed": [],
+      "breaking": false
+    }
+  ],
+  "breaking": 3
+}