@sema-agent/server 7.150.0 → 7.151.0

package/dist/trace/self-minted-wire.js

@@ -254,6 +254,22 @@ export const SELF_MINTED_WIRE = {
             absent: { attr: "-", since: "7.121.0" },
         },
     },
+    healthCenterKey: {
+        at: "GET /health center",
+        members: {
+            issuer: { attr: "present-iff auth bridge configured", since: "7.121.0" },
+            webBaseUrl: { attr: "present-iff the center web console base is configured", since: "7.121.0" },
+            sessionsVisible: { attr: "always", since: "7.121.0" },
+            assertionToken: { attr: "present-iff center configured", since: "7.151.0" },
+        },
+    },
+    healthAssertionToken: {
+        at: "GET /health center.assertionToken",
+        members: {
+            declared: { attr: "-", since: "7.151.0" },
+            absent: { attr: "-", since: "7.151.0" },
+        },
+    },
     healthSessionsVisible: {
         at: "GET /health center.sessionsVisible",
         members: {
@@ -341,6 +357,7 @@ export const SELF_MINTED_WIRE = {
             tickMs: { attr: "present-iff engine lease leg armed and observing", since: "7.141.0" },
             firstAttach: { attr: "present-iff engineLease present and the owned window is finite", since: "7.146.0" },
             lane: { attr: "always within engineLease", since: "7.146.0" },
+            attached: { attr: "always within engineLease (open SSE attach stream count on this replica; 0 is legal for a polling-only shell)", since: "7.151.0" },
             handover: { attr: "present-iff lane is handover", since: "7.146.0" },
         },
     },
@@ -429,6 +446,13 @@ export const SELF_MINTED_WIRE = {
         members: {
             rowTag: { attr: "present-iff the row can be written conditionally (the store has the row write primitive and the row carries an incarnation)", since: "7.139.0" },
             unreadable: { attr: "present-iff the session head's leaf cannot be read (the file backend: the archive header is corrupt / truncated, or the archive cannot be read); the SQL backends never carry it; PATCH answers 500 for such a session before writing, so its 200 / 409 rows never carry it", since: "7.142.0" },
+            sessionKind: { attr: "present-iff the session was created by a submission that declared sessionKind (the default view lists only sessions without one)", since: "7.151.0" },
+        },
+    },
+    sessionKind: {
+        at: "POST /v1/tasks · /v1/tasks/stream · /v1/runs 体 sessionKind = GET /v1/sessions?sessionKind= = sessions[].sessionKind = GET /v1/sessions/:id sessionKind = GET /v1/capabilities sessionKinds[](<词> → -)",
+        members: {
+            sidechain: { attr: "-", since: "7.151.0" },
         },
     },
     projectRowKey: {
@@ -459,6 +483,7 @@ export const SELF_MINTED_WIRE = {
         at: "GET /v1/sessions/:id 体顶层键(本版新出现;<键> → 在场律)",
         members: {
             projectId: { attr: "present-iff the session row's last own workspace_changed frame carried a project", since: "7.147.0" },
+            sessionKind: { attr: "present-iff the session was created by a submission that declared sessionKind", since: "7.151.0" },
         },
     },
     sessionsListRowUnreadableKey: {
@@ -516,11 +541,6 @@ export const SELF_MINTED_WIRE = {
             "SSE tool_end#structured.authorization": { attr: "present-iff structured.code unauthorized and reason in the closed set; members = reason", since: "7.138.0" },
             "GET /v1/runs/:id/events#tool_end.structured.authorization": { attr: "present-iff structured.code unauthorized and reason in the closed set; members = reason", since: "7.138.0" },
         },
-        retired: {
-            "GET /v1/sessions/:id#messages[].details.authorization.resourceMetadataUrl": { attr: "remote-claimed URL from the endpoint's challenge (deep-scrubbed text)", since: "7.138.0", until: "7.150.0" },
-            "SSE tool_end#structured.authorization(reason 以外的成员)": { attr: "card members passed through the text redactor (resourceMetadataUrl, a custom card's own members)", since: "7.138.0", until: "7.150.0" },
-            "GET /v1/runs/:id/events#tool_end.structured.authorization(reason 以外的成员)": { attr: "card members passed through the text redactor (resourceMetadataUrl, a custom card's own members)", since: "7.138.0", until: "7.150.0" },
-        },
     },
     wiringModProvenance: {
         at: "wiring_manifest mods[].provenance",
@@ -608,14 +628,23 @@ export const SELF_MINTED_WIRE = {
         },
     },
     workflowParkDeliveryResult: {
-        at: "POST /v1/approvals/:id/decide · 应答口(workflow 子代停驻卡,持有它的 run 在本进程里跑):引擎答词 → 应答",
+        at: "POST /v1/approvals/:id/decide · 应答口(workflow 子代停驻卡,持有它的 run 读作 running、决定行已在记录栅栏里立住):引擎答词 → 应答",
         members: {
             driving: { attr: "200 {taskId: <workflow runId>, status: resuming, decision}(无结清证据)", since: "7.148.0" },
-            already_taken: { attr: "同一决定 ⇒ 首张回执原样回放;另一个决定 ⇒ 409 decide.claim_lost", since: "7.148.0" },
+            already_taken: { attr: "200 同一张回执(单一仲裁之下 run 收下过的只可能是这同一个决定)", since: "7.151.0" },
             settled: { attr: "409 decide.gate_moved", since: "7.148.0" },
-            not_parked_here: { attr: "409 decide.gate_moved", since: "7.148.0" },
-            unreadable: { attr: "503 decide.store_unreachable", since: "7.148.0" },
-            kept_parked: { attr: "400 decide.parked_restatement_unsupported(只在决断带续跑重述键时可达)", since: "7.148.0" },
+            not_parked_here: { attr: "200 同一张回执(决定已立住;run 收场后由收场送达交给宿主会话的下一跑)", since: "7.151.0" },
+            unreadable: { attr: "200 同一张回执(决定已立住;持有进程在下一个维护拍再交)", since: "7.151.0" },
+            kept_parked: { attr: "不可达(恒送决定;重述键在记录栅栏里判 ⇒ 400 decide.parked_restatement_unsupported)", since: "7.151.0" },
+        },
+    },
+    workflowParkDeliveryKind: {
+        at: "POST /v1/approvals/:id/decide · 应答口(workflow 子代停驻卡,持有它的 run 读作 running、决定行已在记录栅栏里立住):引擎答形 → 应答",
+        members: {
+            live: { attr: "按 results[0] 答(集 workflowParkDeliveryResult)", since: "7.148.0" },
+            suspending: { attr: "200 {taskId: <workflow runId>, status: resuming, decision}(决定已立住;run 收场后由收场送达交给宿主会话的下一跑)", since: "7.151.0" },
+            not_active: { attr: "200 {taskId: <workflow runId>, status: resuming, decision}(决定已立住;持有进程在下一个维护拍交,或 run 收场后由收场送达交)", since: "7.151.0" },
+            not_armed: { attr: "500(引擎不变量破:没有 checkpoint 座的 run 停驻不出这张卡)", since: "7.148.0" },
         },
     },
     settingsEnvCredentialMatch: {
@@ -922,6 +951,8 @@ export const SELF_MINTED_WIRE = {
             "POST /v1/tool-approvals/:id/respond#edited_rule_text_refused_after_adoption(匿名活卡收编给具名主体后新属主交坏规则文本;体 request.body_shape;契约成文的判据,今天经 /v1/adoption 到不了)": { attr: 400, since: "7.136.0" },
             "POST /v1/tasks|/v1/runs#command_line_slots_without_sealed_key_store(stdio MCP 的 command / args 与 command hook 的 command / args;体 conflict.checkpoint_ctx_unsealable + field + reason no_key_store;POST /v1/tasks/stream 在终局帧上带本码;本服务自己的装配下不可达(装配期已对「店在而封签器缺席」拒启,见 submit-ctx.ts 自述))": { attr: 409, since: "7.136.0" },
             "ALL authenticated routes#bearer_token_without_scope_claim(鉴权桥验证腿;配了 service 凭据或多租 REQUIRE_PRINCIPAL 的部署;体通用 auth.unauthorized)": { attr: 401, since: "7.136.0" },
+            "ALL routes after the auth-bridge pre-authentication (not GET /health)#sso_token_foreign_scope(fleet 成员 FLEET_GENERATION 在场;验过签的登记中心登录令牌 scope ≠ FLEET_SCOPE〔缺席 = 缺省 scope〕;同一枚 Bearer 是本部署 service 凭据的不在此列;体 auth.scope_mismatch)": { attr: 403, since: "7.151.0" },
+            "POST /v1/tasks|/v1/tasks/stream|/v1/runs|其余 fail-closed 写口(计费提交 · bake · 改写门 · 破坏性会话写)与 POST /v1/tool-approvals/:id/respond 的停驻赎回臂#verified_sign_in_token_without_service_credential(部署只接了鉴权桥 —— AUTH_BRIDGE_ISSUER 或接了中心的回退 issuer —— 没配 SERVICE_AUTH_TOKEN(S)、没开 ALLOW_UNAUTHED_WRITES;请求出示鉴权桥验过的登记中心登录令牌;没带过门凭据的请求仍 503)": { attr: "该口自己的受理(POST /v1/runs 202 · POST /v1/tasks 同步 200 …)", revises: ["errorCode:auth.service_token_required"], since: "7.151.0" },
             "ALL principal-reading routes#principal_not_a_name(主体头 / SSO 令牌的 sub / 直连门 JWT 的 sub 不是一位主体的名字:空 / 空白 / 带控制、行段分隔或不可见格式字符;体 principal_not_a_name)": { attr: 400, since: "7.137.0" },
             "POST /v1/tasks|/v1/tasks/stream|/v1/runs#promptProfile(新提交;体 request.body_shape + unknownKeys [promptProfile])": { attr: 400, since: "7.137.0" },
             "POST /v1/tasks|/v1/tasks/stream|/v1/runs#skills[i].mods|agents[i].skills[j].mods(新提交;体 request.field_invalid)": { attr: 400, since: "7.137.0" },
@@ -1001,6 +1032,22 @@ export const SELF_MINTED_WIRE = {
             "POST /v1/sessions/:id/sync/plan|POST /v1/sessions/:id/sync/import|PUT /v1/sessions/:id/sync/blobs/:hash#foreign_session_deleting(推送三口的门:id 上是别的主体正在删除的会话 —— 删除围栏已立、尚未删净;「被占着」读活行 ∪ 在删行,与对别人的活行同答;本人 / fleet 对自己在删的会话不变,拉取口仍只认活行;体 not_found.session,与对不存在 id 的拉取答复逐字节同)": { attr: 404, since: "7.149.0" },
             "POST /v1/sessions/:id/sync/import#idle_id_other_principal_in_flight(第一阶段:id 上还没有会话行,而另一个主体在这只 id 上的第一阶段正在飞;导入租约键 = 落点属主格 + 会话 id,空闲 id 上各占各的;体 = 第一阶段的暂存回执 stagingId;先提交者得,输的那一份在提交前复判答 404 not_found.session,与赢家的提交撞在同一刻时由店的属主 CAS 拒 409 conflict)": { attr: 200, since: "7.149.0" },
             "POST /v1/tasks|/v1/tasks/stream|/v1/runs#a2aPeers_headers_reserved_member(新提交;a2aPeers[i].headers 的成员名是 constructor / prototype —— 与 mcpServers[i].transport.headers / .env 同一张保留成员名表、同一只读法,大小写敏感;体 request.field_invalid + field 成员级路径 a2aPeers[i].headers.<名>;存盘续跑体里同形 ⇒ 续跑家族既有一面 #stored_unread_members 409)": { attr: 400, since: "7.149.0" },
+            "POST /v1/tasks|/v1/runs#rewindFilesTo_with_cascade(新提交;提交体同带非空串 `rewindFilesTo` 与 `cascade: true` —— 梯级每一级在引擎现铸的会话里跑、不取根,文件回退无处落地;拒在任何副作用之前、梯子一级都不起;体 request.field_conflict + reason cascade_verify + fields [rewindFilesTo, cascade];`/v1/tasks/stream` 上带 `cascade` 的提交本来就 400(同码),不入此面)": { attr: 400, since: "7.151.0" },
+            "POST /v1/tasks/:taskId/asks/:askId/decision#parked_redeemed(问已转停驻、门仍开着,部署接了停驻赎回 —— 非直连门;交与 live 应答口停驻臂同一只赎回;体 = 本口基本键 + accepted parked_redeemed + 赎回受理体;受理之后决定记在问行上)": { attr: 200, revises: ["errorCode:gone.ask_parked"], since: "7.151.0" },
+            "POST /v1/tasks/:taskId/asks/:askId/decision#parked_standing_same_key(问已转停驻、门上已站着一次决定,本次请求的 idempotencyKey 就是问行上记录的那一把;体 = 首决回放,与 DECIDED 行的回放同一只渲染)": { attr: 200, revises: ["errorCode:gone.ask_parked"], since: "7.151.0" },
+            "POST /v1/tasks/:taskId/asks/:askId/decision#parked_standing_conflict(问已转停驻、门上已站着一次决定,本次请求不是记录上那一把键 / 没带键;体 conflict.ask_decided 回显首决;首决取问行上答的就是门上这一次的那份记录,否则取停驻门)": { attr: 409, revises: ["errorCode:gone.ask_parked"], since: "7.151.0" },
+            "POST /v1/tasks/:taskId/asks/:askId/decision#parked_redemption_refused(问已转停驻、门仍开着,停驻赎回没生效且门此刻仍没决;体 = 赎回的拒原样:429 成本配额 + Retry-After / 503 服务凭据或就绪 / 409 approval_stale 或 conflict.not_resumable / 400 decide_requires_binding / 500;赎回的 404 改答本口的 not_found.ask)": { attr: "as the shared parked redemption answers (429 / 503 / 409 / 400 / 500; its 404 ⇒ 404 not_found.ask)", revises: ["errorCode:gone.ask_parked"], since: "7.151.0" },
+            "POST /v1/tasks|/v1/tasks/stream|/v1/runs#userAttachments 的 path 条目在 e2b / k8s / local-docker / adb 车道上(目标给得出那一次观测:Linux、挂着 /proc、有 timeout / readlink / stat / head / base64)与 device 车道上(执行器声明修订号 ≥ 6 且在 hello.supports 声明了 openBound)—— human_input.attachments[].outcome": { attr: "attached", since: "7.151.0" },
+            "GET /v1/device/ws#instruction kind openBound(server → executor;协议修订号 6 的 kind,只派发给声明修订号 ≥ 6 且 hello.supports 声明了它的执行器;args { path, op: open|size|readBytes|list, identity?, kind?, max? })": { attr: "dispatched-iff-declared", since: "7.151.0" },
+            "GET /v1/device/ws#result outcome stat.identity(openBound 开答的 <device>:<inode>;可选串,不是串 ⇒ bad_shape)": { attr: "accepted", since: "7.151.0" },
+            "POST /v1/sessions/:id/sync/import/:stagingId/entries|POST /v1/sessions/:id/sync/import#landed_occupant_gone(条目已提交 / identical 短路之后,写文件历史 · 会话规则 · 回退锚 · 行两位的落定段段首锁会话根行,读出落定的那一位住客已不在:会话被删、或同 id 被重建 —— 含同一属主;段体零字节写;体 conflict + sync conflict,不带 relation;运维 warn session_sync_landed_occupant_gone)": { attr: 409, since: "7.151.0" },
+            "POST /v1/sessions/:id/sync/import/:stagingId/entries#staged_commit_occupant_changed(暂存提交时这只 id 上的会话已不是第一阶段门判过的那一位住客:属主或化身不同 —— 含同一属主删建;提交事务回滚;体 conflict + 暂存导入住客已变的固定句)": { attr: 409, since: "7.151.0" },
+            "GET /v1/sessions/:id/sync/manifest|/v1/sessions/:id/sync/entries|/v1/sessions/:id/sync/history/blobs/:hash#occupant_changed_after_gate(门读到住客之后、答复发出之前复判:这只 id 上已不是门承认的那一位 —— 删了 / 同 id 重建;含否定答复 404 not_found.blob;entries 在应答头发出之前;体 not_found.session,与门后被删同体)": { attr: 404, since: "7.151.0" },
+            "GET /v1/sessions/:id/sync/entries#occupant_changed_mid_stream(应答头已发;每页交出之前复判不中 ⇒ 流结束、不写尾行 = 截断;运维 info session_sync_pull_occupant_changed)": { attr: 200, since: "7.151.0" },
+            "POST /v1/sessions/:id/sync/plan|POST /v1/sessions/:id/sync/import#occupant_changed_after_gate(门读到住客之后、非故障出口发出之前复判占位头:已不是那一位;含关系体、422 缺块、409 写者 / 活跃拒;体 conflict + sync conflict,不带 relation)": { attr: 409, since: "7.151.0" },
+            "POST /v1/sessions/:id/sync/import/:stagingId/entries#pre_commit_activity_occupant_changed(提交前的活性复查:门读到住客、读到一份活 run / 活子代之后,复判这只 id 上已不是那一位 —— 那份活性是别一代的;暂存放掉;体 conflict + sync conflict,不带 activeTaskId / children)": { attr: 409, since: "7.151.0" },
+            "PATCH /v1/sessions/:id#session_deleting(门那一读之后会话进了在删:删除围栏已立、尚未删净;行格判官把在删读作行不在;零写;体 not_found.session)": { attr: 404, since: "7.151.0" },
+            "PUT /v1/sessions/:id/policy#occupant_changed_after_gate(门读到的那一位住客在写规则的落定段段首已不在:删了 / 同 id 重建;零写;体 not_found.session,与门同体)": { attr: 404, since: "7.151.0" },
         },
         retired: {},
     },
@@ -1032,11 +1079,44 @@ export const SELF_MINTED_WIRE = {
     sessionMemoryStatusKey: {
         at: "GET /v1/sessions/:id/memory-status 200 体顶层键(<键> → 在场律)",
         members: {
-            memorySync: { attr: "present-iff this deployment runs a memory sync leg;{parked:[{scope,wayOut}]} in sync order;parked:[] ⇔ no layer parked;deployment fact (same for every session, ?scope= not applied)", since: "7.141.0" },
+            memorySync: { attr: "present-iff this deployment runs a memory sync leg;{parked:[entry]} in sync order (entry keys: memorySyncParkedKey);parked:[] ⇔ no layer parked;deployment fact (same for every session, ?scope= not applied)", since: "7.151.0" },
             writeHome: { attr: "present-iff the engine answered it ∧ the single-user host lane (the capability bit projectContext's range predicate: hosted / sandbox / device / no-hands lanes ⇒ absent);the engine's absolute directory, byte for byte;with ?scope= that store's engine answer;without ?scope= the session-level home the engine chose across the stores (the newest store's own home;absent while any store's reading is unreadable, on a same-instant tie, or when no store names one)", since: "7.146.0" },
             planes: { attr: "present-iff no ?scope= ∧ the single-user host lane (same predicate as writeHome);[{plane:\"project\"|\"personal\", writeHome?}] one row per store in the engine's store order, each row the engine's own answer for that store (writeHome verbatim, absent when that store names none);the rows' other keys are not on the wire", since: "7.146.0" },
         },
     },
+    memorySyncParkedKey: {
+        at: "GET /v1/sessions/:id/memory-status memorySync.parked[] 条目键(<键> → 在场律)",
+        members: {
+            scope: { attr: "always;the layer's key (the sync layer first, then the owner's project layers by key)", since: "7.141.0" },
+            wayOut: { attr: "always;closed set memorySyncWayOut", since: "7.141.0" },
+            cause: { attr: "always;closed set memorySyncParkCause;why the layer is parked (not the trigger of the round that hit it)", since: "7.151.0" },
+            axis: { attr: "present-iff cause is cursor_refused ∧ the engine's reading is inside both closed sets (axis in memorySyncCursorAxis ∧ found in memorySyncCursorFound;an unknown word in either ⇒ both keys absent);the axis the engine refused the cursor on", since: "7.151.0" },
+            found: { attr: "present-iff axis is present (the two keys come as a pair);closed set memorySyncCursorFound;whether the cursor has no binding on that axis (absent) or is bound to another value (other)", since: "7.151.0" },
+        },
+    },
+    memorySyncParkCause: {
+        at: "GET /v1/sessions/:id/memory-status memorySync.parked[].cause",
+        members: {
+            cursor_refused: { attr: "-", since: "7.151.0" },
+            cursor_unusable: { attr: "-", since: "7.151.0" },
+        },
+    },
+    memorySyncCursorAxis: {
+        at: "GET /v1/sessions/:id/memory-status memorySync.parked[].axis",
+        members: {
+            scope: { attr: "-", since: "7.151.0" },
+            peer: { attr: "-", since: "7.151.0" },
+            store: { attr: "-", since: "7.151.0" },
+            incarnation: { attr: "-", since: "7.151.0" },
+        },
+    },
+    memorySyncCursorFound: {
+        at: "GET /v1/sessions/:id/memory-status memorySync.parked[].found",
+        members: {
+            absent: { attr: "-", since: "7.151.0" },
+            other: { attr: "-", since: "7.151.0" },
+        },
+    },
     memorySyncWayOut: {
         at: "GET /v1/sessions/:id/memory-status memorySync.parked[].wayOut",
         members: {
@@ -1169,6 +1249,7 @@ export const SELF_MINTED_WIRE = {
     refusalSentenceForm: {
         at: "拒体 message 的句型(<码>#<座> → 句型骨架;码 / 状态 / 机读位不变)",
         members: {
+            "409 conflict#staged_import_commit(会话同步推送第二阶段的提交:暂存提交的住客 CAS 没过)": { attr: "session changed hands while the import streamed (deleted, re-created or re-owned); nothing was imported — start the sync again", since: "7.151.0" },
             "401 auth.unauthorized#operator(/metrics* · GET /v1/tasks/source-summary)": { attr: "… send the deployment's service token … without a principal header where this deployment lets its service token act for the deployment itself (GET /health reports it as auth.serviceTokenActsForDeployment; …), or a read-only token this endpoint accepts (…)", since: "7.146.0" },
             "422 invalid_entries#row_contract(会话同步推送第二阶段;收编批量导入同句进逐元素 detail)": { attr: "malformed entry (id and parentId must be strings of 1-64 characters, type a string of 1-32 characters)", since: "7.146.0" },
             "404 not_found.run#a*/wa* id(compact · detach · 子代动词口;各 run 口的非属主臂)": { attr: "run not found — \"<id>\" looks like an agent handle (a*/wa* domain) … (the handle hint, same sentence as the missing-row arm)", since: "7.148.0" },
@@ -1179,7 +1260,7 @@ export const SELF_MINTED_WIRE = {
             "400 request.field_invalid#title.no_visible_character(PATCH /v1/sessions/:id · 会话同步 2c 导入的 title)": { attr: "title must contain at least one visible character", since: "7.136.0" },
             "503 state.file_history_unreadable#store_connection_fault(会话同步三条拉取读腿)": { attr: "this session's stored state could not be read right now (the store connection failed), so nothing was exported — retry later", since: "7.136.0" },
             "503 state.file_history_unreadable#store_deployment_fault(会话同步三条拉取口)": { attr: "this session's stored state cannot be read: the store does not match what this deployment requires (a table is missing or the database account lacks a privilege), so nothing was exported — retrying will not help until an operator repairs the store", since: "7.137.0" },
-            "connect_failed(run 失败终局)#snapshot_bucket_missing(k8s 车道读 latest 得 404 NoSuchBucket;连沙箱失败,一只 pod 都不建)": { attr: "workspace space pointer read failed (snapshot_bucket_missing): the workspace snapshot bucket <name> (WORKSPACE_SNAPSHOT_BUCKET; default workspaces) does not exist in the object store — refusing to start this run … Ways out: create the bucket, or set WORKSPACE_SNAPSHOT_BUCKET to one that exists, or set WORKSPACE_PERSIST=off …", since: "7.136.0" },
+            "env.snapshot_bucket_missing#snapshot_bucket_missing(k8s 车道读 latest / 取快照归档得 404 NoSuchBucket;建连的立定拒 —— 不留 pod〔读 latest 不建,取归档建的那只释放〕,执行环境记住它直到销毁)": { attr: "workspace space pointer read failed (snapshot_bucket_missing): the workspace snapshot bucket <name> (WORKSPACE_SNAPSHOT_BUCKET; default workspaces) does not exist in the object store — refusing to start this run … Ways out: create the bucket, or set WORKSPACE_SNAPSHOT_BUCKET to one that exists, or set WORKSPACE_PERSIST=off …", since: "7.151.0" },
             "400 request.field_invalid#images[i].url.credential": { attr: "<field> <规则句> — the URL is kept as written (a parked task's resume context, logs), while images[i] can carry the image bytes inline: send { data, mimeType } instead of a URL that holds the credential", since: "7.136.0" },
             "400 request.field_invalid#images.not_array": { attr: "head: images is <shape>, not an array of image entries", since: "7.148.0" },
             "400 request.field_invalid#images[i].not_object": { attr: "head: images[i] is <shape>, not an image entry (an object)", since: "7.148.0" },
@@ -1215,6 +1296,11 @@ export const SELF_MINTED_WIRE = {
             "409 conflict.session_memory_unobserved#no_leaf": { attr: "this session has no transcript yet, so there is no revision to sync from — run a task in it (…), then sync", since: "7.143.0" },
             "400 request.field_invalid#unread_request_members(新提交:settings.env 有成员不是帽内的串;嵌入方直调装配时四座同句)": { attr: "this request carries a member|members this server version's readers cannot take as written, on a deployment that would apply it|them: <坐标,至多 8 处>[ (and <n> more)] — running it would silently leave that member|those members out (a hook that guards a tool, an MCP server's credentials); submit it again with this member|these members in the current form", since: "7.147.0" },
             "409 resume_blocked_by_policy#unread_members(续跑四门 · steer 铸唤醒卡之前)": { attr: "resume blocked by an admission policy change: <同上一句>", since: "7.147.0" },
+            "503 auth.service_token_required#task_submissions(计费提交 · bake · 改写门;停驻赎回席同句)": { attr: "this worker requires a service auth token (set SERVICE_AUTH_TOKEN) or a verified registry sign-in token before accepting task submissions", since: "7.151.0" },
+            "503 auth.service_token_required#destructive_session_writes": { attr: "this worker requires a service auth token (set SERVICE_AUTH_TOKEN) or a verified registry sign-in token before accepting destructive session writes (policy / sync-import / fork / delete)", since: "7.151.0" },
+            "413 request.payload_too_large#store_row_too_large(POST /v1/tasks|/v1/tasks/stream|/v1/runs;续跑输入一行装不下,row / statement / value 三墙)": { attr: "the database refused to store this task: it is larger than the database keeps in one row|accepts in one statement|PostgreSQL holds in one value — nothing was run; <出路>", since: "7.151.0" },
+            "adopt_failed|track_failed|snapshot_failed|restore_failed#store_fault(文件历史店的失败句:会话同步推送与 blob 交换的拒体 · rewind / restore 的逐文件失败句)": { attr: "<动作> failed: <类别句> [original code: <原码>]", since: "7.151.0" },
+            "子代失败句#store_fault(tool_end 子代卡 structured.errorMessage · 后台子代通告的 summary · GET /v1/runs/:id/subagents/:handle/output 的 content / output · 父模型读到的子代报告行)": { attr: "<类别句> [original code: <原码>](与 run 终局 terminal.failed.message 同一句)", since: "7.151.0" },
         },
     },
     decisionBodyKey: {
@@ -1289,13 +1375,14 @@ export const SELF_MINTED_WIRE = {
         },
     },
     deviceProtocolRevision: {
-        at: "GET /v1/capabilities deviceExecutor.protocolVersion 与 device WS challenge 帧的修订号(<修订号> → 它加进结局码闭集的词;零加词的语义修订 → 变更名)",
+        at: "GET /v1/capabilities deviceExecutor.protocolVersion 与 device WS challenge 帧的修订号(<修订号> → 它加的词:结局码 `+词`、下发指令 kind `+kind:词`;两张表都零加词的语义修订 → 变更名)",
         members: {
             1: { attr: "base", since: "7.51.0" },
             2: { attr: "+liveness_no_output", since: "7.133.0" },
             3: { attr: "+name_too_long", since: "7.137.0" },
             4: { attr: "+symlink_loop", since: "7.143.0" },
             5: { attr: "paths-unfolded", since: "7.150.0" },
+            6: { attr: "+kind:openBound", since: "7.151.0" },
         },
     },
     hookNonBlockingFailureReason: {
@@ -1363,6 +1450,7 @@ export const SELF_MINTED_WIRE = {
             "GET /v1/config/catalog#rows[MODEL_ROUTER_ID].derivedDefaultNote": { attr: "absent=>classifier-role-in-served-table", since: "7.143.0" },
             "GET /v1/config/catalog#rows[MINIO_BUCKET].semantics": { attr: "leader-diff-out-bucket;independent-of-WORKSPACE_SNAPSHOT_BUCKET", since: "7.148.0" },
             "GET /v1/config/catalog#rows[MINIO_BUCKET].derivedDefaultNote": { attr: "absent=>WORKSPACE_SNAPSHOT_BUCKET_DEFAULT(not-the-explicit-value)", since: "7.148.0" },
+            "GET /v1/config/catalog#rows[ALLOW_UNAUTHED_WRITES].semantics": { attr: "write-gate-admits-requests-without-a-gate-credential(service-token|verified-sign-in-token);submissions+rewrites+destructive-session-writes", since: "7.151.0" },
             "GET /v1/sessions/:id/mcp#servers[].error": { attr: "exit-seat:mcp-remote-text(engine-mark=masked-value)+truncate:200", since: "7.138.0" },
             "POST /v1/sessions/:id/mcp/reconnect#reason|status.error|listingIncomplete.error": { attr: "exit-seat:mcp-remote-text(engine-mark=masked-value)+truncate:200", since: "7.138.0" },
             "GET /v1/config/catalog#rows[MODEL_VISION].semantics": { attr: "names-engine-notice:model.capability_downgraded", since: "7.137.0" },

package/docs/DEVICE-EXECUTOR-PROTOCOL.md

@@ -152,8 +152,9 @@ pre-auth frame closes the connection outright.
 
 **Which revision to declare.** `challenge.protocolVersion` is the highest protocol revision this server speaks
 (`DEVICE_MIN_PROTOCOL_VERSION` is the lowest it accepts, §2.1). Put the highest revision *you* implement that is
-not above `challenge.protocolVersion` into `hello.protocolVersion` — the same integer you sign (§1.3) — and emit
-only the `errorCode` words of that revision (the revision table in §2.1). Nothing is renegotiated after `hello`:
+not above `challenge.protocolVersion` into `hello.protocolVersion` — the same integer you sign (§1.3) — declare in
+`supports` only the instruction kinds of that revision, and emit only the `errorCode` words of that revision (the revision
+table in §2.1). Nothing is renegotiated after `hello`:
 the revision you declared is the contract for the whole connection. If the highest revision you implement is below
 `DEVICE_MIN_PROTOCOL_VERSION`, the server answers `helloReject: protocol_version_unsupported` (§1.4).
 Revisions are cumulative on the executor's side: an executor that implements revision *N* implements every revision
@@ -345,7 +346,7 @@ base64 inside JSON fields.
 | Constant | Value | Meaning |
 |---|---|---|
 | `DEVICE_WS_PATH` | `/v1/device/ws` | the upgrade path (prefer the `wsPath` from `/v1/capabilities`) |
-| `DEVICE_PROTOCOL_VERSION` | `5` | the protocol revision this server speaks (the highest it accepts) |
+| `DEVICE_PROTOCOL_VERSION` | `6` | the protocol revision this server speaks (the highest it accepts) |
 | `DEVICE_MIN_PROTOCOL_VERSION` | `5` | the lowest revision it accepts (the revision table says why); below it (or above the highest), a loud `helloReject` — never a silent downgrade |
 | `DEVICE_HELLO_DOMAIN_TAG` | `sema.device.hello.v1` | the handshake signature domain tag (§1.3) |
 
@@ -366,36 +367,43 @@ cap. An instruction whose frame would be over it is refused before dispatch (you
 chunks are sliced so that a chunk frame, base64 and envelope included, fits. You can therefore cap the frames you
 accept at `maxFrameBytes`.
 
-#### Protocol revisions and the `errorCode` set
+#### Protocol revisions: the `errorCode` set and the instruction kinds
 
 The protocol revision is the only thing an executor can read *before* it sends `hello` (the `challenge` frame
 carries it), so everything you must know to be correct on this server is a function of the revision, not a
-separate list: the set of `errorCode` words the server accepts from you, and what the frames it sends you mean.
-The table gives, per revision, the words **added** at that revision and any other change made at it; the word set
-at revision *N* is the union of the rows up to *N*, and the full set at the current revision is the §3.3 table.
+separate list: the set of `errorCode` words the server accepts from you, the set of instruction kinds it may send you,
+and what the frames it sends you mean. The table gives, per revision, the words **added** to each set at that revision
+and any other change made at it; a set at revision *N* is the union of its column's rows up to *N*, and the full sets at
+the current revision are the §3.3 table (`errorCode`) and the §3.1 table (instruction kinds, in this order).
 
 <!-- closed-set: DEVICE_OUTCOME_ERROR_CODES_BY_REVISION -->
 
-| Revision | `errorCode` words added at this revision | Other change at this revision |
-|---|---|---|
-| `1` | `aborted`, `already_exists`, `auth_failed`, `callback_error`, `invalid`, `is_directory`, `not_directory`, `not_found`, `not_supported`, `outcome_unknown`, `permission_denied`, `precondition_failed`, `shell_unavailable`, `spawn_error`, `suspended`, `target_unavailable`, `timeout`, `transport_lost`, `unknown` | — |
-| `2` | `liveness_no_output` | — |
-| `3` | `name_too_long` | — |
-| `4` | `symlink_loop` | — |
-| `5` | — | every path an instruction carries (`args.path`, `args.paths`, `cwd`) arrives **unfolded** (since server 7.150.0): absolute as written, or anchored at the session's working directory, with `.` / `..` / empty segments kept — the server anchors and never folds. Resolve it as your filesystem does and judge containment on where it resolves (§3.1, §6 item 6). An executor written for revision 4 or below expects folded paths, so this is also the lowest revision the server accepts |
+| Revision | `errorCode` words added at this revision | Instruction kinds added at this revision | Other change at this revision |
+|---|---|---|---|
+| `1` | `aborted`, `already_exists`, `auth_failed`, `callback_error`, `invalid`, `is_directory`, `not_directory`, `not_found`, `not_supported`, `outcome_unknown`, `permission_denied`, `precondition_failed`, `shell_unavailable`, `spawn_error`, `suspended`, `target_unavailable`, `timeout`, `transport_lost`, `unknown` | `exec`, `execStream`, `readTextFile`, `readTextLines`, `readBinaryFile`, `writeFile`, `writeFileExclusive`, `writeFileGuarded`, `appendFile`, `fileInfo`, `listDir`, `canonicalPath`, `exists`, `readLink`, `createDir`, `remove`, `createTempDir`, `createTempFile`, `statBatch` | — |
+| `2` | `liveness_no_output` | — | — |
+| `3` | `name_too_long` | — | — |
+| `4` | `symlink_loop` | — | — |
+| `5` | — | — | every path an instruction carries (`args.path`, `args.paths`, `cwd`) arrives **unfolded** (since server 7.150.0): absolute as written, or anchored at the session's working directory, with `.` / `..` / empty segments kept — the server anchors and never folds. Resolve it as your filesystem does and judge containment on where it resolves (§3.1, §6 item 6). An executor written for revision 4 or below expects folded paths, so this is also the lowest revision the server accepts |
+| `6` | — | `openBound` | — |
 
 Rules: adding a frame or a field is additive and does not raise the revision. Every other change
-raises `DEVICE_PROTOCOL_VERSION` and adds a row here — a word added to a closed set the server *accepts from you*
-(today: the `errorCode` set; second column), or a **semantic change**, a change in what a frame the server sends you
-means (third column): a semantic change raises the revision. A released row never changes. When an executor written for
+raises `DEVICE_PROTOCOL_VERSION` and adds a row here — a word added to either closed set of the instruction exchange:
+an `errorCode` word the server *accepts from you* (second column) or an instruction kind the server *sends you*
+(third column) — or a **semantic change**, a change in what a frame the server sends you means (fourth column):
+a semantic change raises the revision. A released row never changes. The server sends a kind only on a connection
+whose declared revision is at or above the row that added it, and only if that connection's `supports` declares it
+(§3.2): a kind above your revision is never sent to you, so an executor written for the older revision still honors
+the newer one and the lowest accepted revision stays where it was (revision 6 added `openBound`; a revision-5 executor
+never receives it). When an executor written for
 an older revision cannot honor the change, the same release raises `DEVICE_MIN_PROTOCOL_VERSION` to the new
 revision, so such an executor is refused once at `hello` (§1.4) instead of failing call by call.
-Declare a revision as §1.2 says and send only the words of that revision: an executor
+Declare a revision as §1.2 says and use only the words of that revision: an executor
 that declared revision 1 never sends `liveness_no_output` (the server does not police this per connection — it
 decodes every connection against the current revision's full set — but a word above your declared revision is outside
-your contract). The same sets are importable:
-`DEVICE_OUTCOME_ERROR_CODES_BY_REVISION` and `deviceOutcomeErrorCodesAt(revision)` from
-`@sema-agent/server/device-protocol`.
+your contract), and a kind above your declared revision in `supports` is ignored like a word the server does not know.
+The same sets are importable: `DEVICE_OUTCOME_ERROR_CODES_BY_REVISION` / `deviceOutcomeErrorCodesAt(revision)` and
+`DEVICE_INSTRUCTION_KINDS_BY_REVISION` / `deviceInstructionKindsAt(revision)` from `@sema-agent/server/device-protocol`.
 
 ### 2.2 Device → server frames
 
@@ -532,6 +540,7 @@ entry can be asked again as written.
 | `createTempDir` | `{ prefix? }` | `{ok:true, kind:"write", canonicalPath}` | the created directory's path **is** the receipt |
 | `createTempFile` | `{ prefix?, suffix? }` | `{ok:true, kind:"write", canonicalPath}` | same |
 | `statBatch` | `{ paths: string[] }` | `{ok:true, kind:"stat", …}` | declared but **not dispatched today** (see §8) |
+| `openBound` | `{ path, op, identity?, kind?, max? }` | per `op`: `open` / `size` / `list` ⇒ `{ok:true, kind:"stat", …}`, `readBytes` ⇒ `{ok:true, kind:"read"}` | **optional face**, revision 6 — a bound read: the object judged is the object read (§3.7) |
 
 The server checks the outcome *kind* against the instruction kind. Answering an `execStream` with
 `{ok:true, kind:"void"}` — a perfectly well-formed frame — is refused as a protocol violation and the
@@ -540,22 +549,26 @@ outcome are always accepted.
 
 ### 3.2 Declaring what you implement: `hello.supports`
 
-`supports` is a plain `string[]` of instruction kinds. The server intersects it with its own closed set;
-**a kind you do not declare is never dispatched to you**, and a call that needs it fails loudly with
-`not_supported` instead of silently doing something else. A kind the server does not recognize is simply
-ignored (that is how a newer executor talks to an older server without breaking it).
+`supports` is a plain `string[]` of instruction kinds. The server intersects it with the kinds of the revision you declared
+(§2.1); **a kind you do not declare is never dispatched to you**, and a call that needs it fails loudly with
+`not_supported` instead of silently doing something else. A kind the server does not recognize — or one above the
+revision you declared — is simply ignored (that is how a newer executor talks to an older server without breaking it).
 
-Three faces are **presence-typed**, which is a stronger statement than "optional":
+Four faces are **presence-typed**, which is a stronger statement than "optional":
 
 - `writeFileExclusive` — atomic create-if-absent
 - `writeFileGuarded` — verify-and-write in one atomic step
 - `readLink` — read a symlink target
+- `openBound` — a bound read (§3.7): every answer is about the object that was opened and checked
 
 The engine decides *at environment-construction time* whether these exist, and when they do not it
 degrades honestly (an advisory check instead of an atomic one). **Therefore: absence is absence. Never
 emulate a guarded or exclusive write with a two-step "check then write".** A two-step emulation reopens
 exactly the race the atomic primitive exists to close, while wearing the face of an atomic operation —
-which is worse than not having it, because nothing downstream can tell.
+which is worse than not having it, because nothing downstream can tell. The same holds for `openBound`:
+**never emulate it with `fileInfo` + `readBinaryFile`** (two path reads cannot tell that the bytes came from the
+object that was judged); without it, the engine simply does not bind a read on this device (a path attachment is
+accepted and reported `not_attached`).
 
 Two more consequences you must design for:
 
@@ -712,8 +725,45 @@ side**. Verifying with `stat` and then writing is exactly the emulation that is
 - `readLink` — optional but strongly recommended: it is the fourth governance read, and its absence makes
   symlink adjudication coarser.
 - `writeFileExclusive`, `writeFileGuarded` — optional; implement them only if you can do them atomically.
+- `openBound` — optional (revision 6); without it a path attachment on this device is accepted but not attached (§3.7).
 - `statBatch` — safe to omit today.
 
+
+### 3.7 `openBound` and its four answers
+
+`openBound` is a revision-6 kind: the server sends it only on a connection whose `hello.protocolVersion` is 6 or above
+**and** whose `supports` declares it. On a revision-5 connection the face is absent, exactly as if you had not declared
+it (the engine does not bind a read; a path attachment is reported `not_attached`).
+
+The protocol has no handle that lives across instructions, so the engine's bound-read object is answered one
+instruction per answer. Every `openBound` instruction is a **complete rebinding**: open `path` locally (do not
+follow a final symbolic link), ask the kernel **once, through that open**, which path the opened object now has and
+what it is, answer **through that same open**, then close it. Never read the path a second time to answer.
+
+<!-- closed-set: DEVICE_BOUND_READ_OPS -->
+
+| `op` | Carries | Answer with | Refuse with |
+|---|---|---|---|
+| `open` | `path` | `{ok:true, kind:"stat", identity, info}` — `identity` = the opened object's `<device>:<inode>`; `info.kind` is `file` or `dir` | `precondition_failed` (the final component is a link, or the opened object is not at `path`); `invalid` (neither a regular file nor a directory) |
+| `size` | `path`, `identity`, `kind` | `{ok:true, kind:"stat", info}` — `info.size` = the current size | `precondition_failed` when the object opened now is not `identity` / `kind` or not at `path` |
+| `readBytes` | `path`, `identity`, `kind`, `max` | `{ok:true, kind:"read"}`, the bytes as `data` chunks | as `size`, plus `invalid` when the file is over `max` bytes when the read starts (read nothing) |
+| `list` | `path`, `identity`, `kind` | `{ok:true, kind:"stat", entries}` — the opened directory's direct children, links not followed; the server reads only each entry's leaf name | as `size` |
+
+Rules:
+
+- **One observation per answer.** The check that the opened object is at `path` must be a single observation of
+  that open (Linux: `readlink("/proc/self/fd/<fd>")`; macOS: an open with `O_NOFOLLOW_ANY` refuses a link on any
+  component, so the open itself is the observation). Separate `fstat` / `lstat` / `realpath` calls are three
+  observations that a directory swapped in and out between them gets through. If your platform cannot give one
+  observation, answer `not_supported` — the engine reads that as "this face is absent here".
+- **Identity and kind both.** For `size` / `readBytes` / `list`, the object you opened must equal both `identity`
+  and `kind` from the `open` answer, else `precondition_failed`. Two opens whose identities are equal do not prove
+  they opened one object after an inode number was reused; that residue is accepted by the engine's contract.
+- **Bounded.** An open can block (a FIFO swapped in under the path); the whole answer must finish within the
+  instruction's `timeoutMs` and your executor must not leave the blocked open behind.
+- **No privilege above the session's own commands.** Open as the same user that runs the session's `exec`.
+- Error codes are the words of your declared revision (§2.1); nothing new is needed.
+
 ---
 
 ## 4. Streaming execution
@@ -1055,6 +1105,7 @@ These two are a real distinction to the caller: `not_started` is safely retryabl
 
 - [ ] `readLink` (recommended soon after — it is the fourth governance read)
 - [ ] `writeFileExclusive`, `writeFileGuarded` — declare only when atomic (§3.2)
+- [ ] `openBound` — declare only with one observation per answer, and only when you declare revision 6 or above (§3.7)
 - [ ] `statBatch` — not dispatched today
 
 **Process shape (recommended)**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/server",
-  "version": "7.150.0",
+  "version": "7.151.0",
   "description": "Sema Server — the server/API implementation layer for Sema, wiring core, registry, model providers, and cloud agent execution. Built on @sema-agent/core.",
   "type": "module",
   "license": "BUSL-1.1",
@@ -83,7 +83,7 @@
   },
   "dependencies": {
     "@modelcontextprotocol/server": "2.4.0",
-    "@sema-agent/core": "7.66.0",
+    "@sema-agent/core": "7.66.1",
     "@sema-agent/settings-schema": "25.1.0",
     "e2b": "2.36.0",
     "libsodium-wrappers": "0.8.4",