@sema-agent/server 7.150.0 → 7.152.0

package/dist/boot/stores.js

@@ -9,7 +9,7 @@ import { PgMemoryEngineBackend, ensurePgMemoryEngineSchema } from "../plugins/me
 import { TiDBMemoryEngineBackend, ensureTiDBMemoryEngineSchema } from "../plugins/memory-engine-tidb.js";
 import { PgMemoryHistoryStore, PgMemorySyncStore, ensurePgMemoryHistorySchema, ensurePgMemorySyncSchema } from "../plugins/memory-sync-store-pg.js";
 import { TiDBMemoryHistoryStore, TiDBMemorySyncStore, ensureTiDBMemoryHistorySchema, ensureTiDBMemorySyncSchema } from "../plugins/memory-sync-store-tidb.js";
-import { MinioBlobBackend } from "../plugins/blob-backend.js";
+import { createSessionBlobBackend } from "../plugins/blob-backend.js";
 import { ensureSnapshotBuckets } from "../plugins/snapshot-bucket-presence.js";
 import { PgBackgroundAgentStore, TiDBBackgroundAgentStore, ensurePgBackgroundAgentSchema, ensureTiDBBackgroundAgentSchema } from "../stores-sql/background-agent-store-sql.js";
 import { recordFailOpen } from "../observability/fail-open.js";
@@ -304,14 +304,17 @@ export async function openStores(ctx) {
         const mysqlPool = backend?.mysqlPool?.();
         const pgPool = backend?.pgPool?.();
         if (pgPool || mysqlPool) {
-            const minio = config.snapshotBlobStore;
-            if (!minio) {
+            const namespace = backend?.sessionBlobNamespace?.();
+            if (!config.snapshotBlobStore) {
                 logger.error("attachments_disabled_object_store_required", {
                     hint: "cloud deployments must configure object storage (MINIO_ENDPOINT/MINIO_ACCESS_KEY/MINIO_SECRET_KEY) — attachment routes will 501 until it is set",
                 });
             }
+            else if (!namespace) {
+                throw new Error("object storage is configured but the store backend holds no session blob namespace — the attachment store's bytes have no namespace proven to be this database's (a store backend that does not implement sessionBlobNamespace())");
+            }
             else {
-                const bytes = new MinioBlobBackend({ ...minio, keyPrefix: `${minio.keyPrefix ?? ""}attachments/` });
+                const bytes = createSessionBlobBackend(namespace, "attachments");
                 if (pgPool) {
                     const q = async (text, params) => { const r = await pgPool.query(text, params); return { rows: r.rows }; };
                     await ensurePgTaskAttachmentSchema(q);

package/dist/boot/web-admin.js

@@ -2,7 +2,7 @@ import { createHash } from "node:crypto";
 import { readFile as fsReadFile } from "node:fs/promises";
 import { homedir } from "node:os";
 import { join } from "node:path";
-import { WEB_ADMIN_ENV, formatConfigPath } from "@sema-agent/settings-schema";
+import { WEB_ADMIN_ENV } from "@sema-agent/settings-schema";
 import { stableStringify } from "@sema-agent/settings-schema/hash";
 import { buildModelRefusalsSignal } from "../model-entry-refusal.js";
 import { CenterPromptSource, FilePromptArtifactStore, FilePromptSourceStateStore, MemoryPromptArtifactStore, MemoryPromptSourceStateStore, } from "@sema-agent/core";
@@ -13,7 +13,7 @@ import { centerScenarios, centerScenarioDetails } from "../capabilities/scenario
 import { isRosterGateArmed } from "../config.js";
 import { DEPLOYMENT_SHAPE_PREDICATES } from "../deployment-shape.js";
 import { defaultLkgPath, defaultSkillCacheDir, saveLkg, loadLkg, preIdentityLkgLeftover, PRE_IDENTITY_LKG_REASON } from "../config-lkg.js";
-import { answerStillCurrent, centerStateBin, credentialIdentityNow, judgeCenterCredentialAtBoot } from "../center-credential.js";
+import { answerStillCurrent, buildAssertionTokenBootFields, centerStateBin, credentialIdentityNow, judgeCenterCredentialAtBoot } from "../center-credential.js";
 import { createCenterConfigTier } from "../center-config-tier.js";
 import { buildCenterCredentialHealthView, createCenterCredentialRenewer } from "../center-credential-renewer.js";
 import { centerManagedConfigKeys } from "../web-admin-client/apply-effective.js";
@@ -103,6 +103,8 @@ export async function createWebAdminRuntime(ctx) {
     if (bootVerdict?.verdict === "loud") {
         logger.error("center_credential_unreadable", { key: WEB_ADMIN_ENV.tokenFile, failure: bootVerdict.failure, reason: bootVerdict.reason, effect: bootVerdict.effect });
     }
+    if (cc !== undefined)
+        logger.info("center_assertion_token", buildAssertionTokenBootFields(cc.assertionToken));
     const credentialRenewer = cc !== undefined && cc.credential.origin.from === "file"
         ? createCenterCredentialRenewer({ source: cc.credential, centerUrl: cc.baseUrl, leadMs: config.centerCredentialRenewLeadMs, logger })
         : undefined;
@@ -521,12 +523,7 @@ export async function createWebAdminRuntime(ctx) {
             }
             if (read.migrated !== undefined) {
                 const m = read.migrated;
-                logger.info("config_lkg_migrated", {
-                    to: lkgPath,
-                    fromFormat: m.fromFormat,
-                    ...(m.note !== undefined ? { note: m.note } : {}),
-                    receipts: m.receipts.map((r) => ({ migration: r.migration, document: r.document, path: formatConfigPath(r.path), appliedAs: r.appliedAs })),
-                });
+                logger.info("config_lkg_migrated", { to: lkgPath, fromFormat: m.fromFormat, note: m.note });
                 try {
                     await saveLkg(lkgPath, cc?.worker, identity, read.lkg.effective, read.lkg.etag);
                 }

package/dist/boot/workflow-orchestration.d.ts

@@ -11,11 +11,12 @@
  *     → `workflowRunStore`(包装体)的顺序是数据依赖链,不可重排。
  *  3. `getRunStore()` 是晚绑取值(runStore 在本段之后构造),原文靠同作用域前向引用。
  */
-import { type WorkflowRun, type WorkflowRunStore } from "@sema-agent/core";
+import { type WorkflowRun } from "@sema-agent/core";
 import type { ServiceConfig } from "../config.js";
 import { FleetEventBus } from "../fleet/fleet-bus.js";
 import { type WorkflowAgentSessionIndex } from "../orchestration/workflow-agent-session-index.js";
 import type { WorkflowParkDecisionStore } from "../orchestration/workflow-park-decision.js";
+import { HeldParksHere } from "../orchestration/workflow-park-holder.js";
 import type { Logger } from "../observability/logger.js";
 import type { Metrics } from "../observability/metrics.js";
 import { type WorkflowCompletionInbox } from "../orchestration/workflow-completion-inbox.js";
@@ -31,9 +32,12 @@ export interface WorkflowOrchestrationCtx {
     backend: StoreBackend | undefined;
     /** 晚绑(runStore 在本段之后构造)——见文件头「位置即契约」③。 */
     getRunStore: () => ReturnType<StoreBackend["run"]> | undefined;
+    /** 晚绑(HTTP 服务的产物,第 10 段之后才有):run 收场送达里把「带着已受理、未交付的决定收场」的那条 run 的行交给续跑车道的那一手。
+     *  抛 = 需要重投(会话正忙 / 店瞬态 / 收编弧在跑 / 本座还没绑)⇒ 不 ack、`recover` 在维护拍上重投。契约属主 = `http/resume-legs.ts` 的 `handOverRunEndedDecisions`。 */
+    getRunEndedHandoff: () => ((runId: string) => Promise<void>) | undefined;
 }
 export declare function createWorkflowOrchestration(ctx: WorkflowOrchestrationCtx): {
-    sqlWorkflowRunStore: WorkflowRunStore | undefined;
+    sqlWorkflowRunStore: import("../plugins/workflow-run-store-sql.js").SqlWorkflowRunStore | undefined;
     workflowNotifyJournal: import("../orchestration/workflow-notify-journal.js").WorkflowNotifyJournalStore | undefined;
     workflowCompletionInbox: WorkflowCompletionInbox | undefined;
     deliverWorkflowCompletion: (p: WorkflowCompletionPayload) => Promise<void>;
@@ -51,5 +55,6 @@ export declare function createWorkflowOrchestration(ctx: WorkflowOrchestrationCt
     };
     workflowAgentSessionIndex: WorkflowAgentSessionIndex | undefined;
     workflowParkDecisions: WorkflowParkDecisionStore | undefined;
+    heldParksHere: HeldParksHere | undefined;
 };
 //# sourceMappingURL=workflow-orchestration.d.ts.map

package/dist/boot/workflow-orchestration.js

@@ -2,6 +2,8 @@ import { FileWorkflowRunStore, InMemoryWorkflowRunStore } from "@sema-agent/core
 import { join } from "node:path";
 import { FleetEventBus } from "../fleet/fleet-bus.js";
 import { LocalWorkflowAgentSessionIndex } from "../orchestration/workflow-agent-session-index.js";
+import { FencedWorkflowRecordStore } from "../orchestration/workflow-record-fence.js";
+import { HeldParksHere } from "../orchestration/workflow-park-holder.js";
 import { createCorruptReadFailOpenSeat } from "../observability/corrupt-read-seat.js";
 import { FileWorkflowCompletionInbox, InMemoryWorkflowCompletionInbox, buildWorkflowCompleteInboxEntry, resolveCompletionRoute } from "../orchestration/workflow-completion-inbox.js";
 import { FileWorkflowNotifyJournalStore, JournalingWorkflowRunStore, WorkflowNotifyGate } from "../orchestration/workflow-notify-journal.js";
@@ -10,16 +12,16 @@ import { WorkflowAgentRegistry } from "../orchestration/workflow-agent-steer.js"
 import { workflowJournalOf } from "../plugins/store-backend.js";
 import { seatText } from "../trace/exit-seat.js";
 export function createWorkflowOrchestration(ctx) {
-    const { config, logger, metrics, localRoot, backend, getRunStore } = ctx;
+    const { config, logger, metrics, localRoot, backend, getRunStore, getRunEndedHandoff } = ctx;
     const workflowBootAtMs = Date.now();
     const sqlWorkflowRunStore = config.workflowRunStoreBackend === "auto" ? backend?.workflowRun?.((msg, meta) => logger.warn(msg, meta)) : undefined;
     const baseWorkflowRunStore = config.selfOrchestrationEnabled
         ? config.workflowRunStoreBackend === "memory"
-            ? new InMemoryWorkflowRunStore()
+            ? new FencedWorkflowRecordStore(new InMemoryWorkflowRunStore())
             : (sqlWorkflowRunStore ??
-                new FileWorkflowRunStore(join(config.localDataRoot ?? localRoot, "workflows"), {
+                new FencedWorkflowRecordStore(new FileWorkflowRunStore(join(config.localDataRoot ?? localRoot, "workflows"), {
                     onCorruptRead: createCorruptReadFailOpenSeat("server.workflow-run.corrupt-record-skipped"),
-                }))
+                })))
         : undefined;
     const workflowNotifyJournal = config.selfOrchestrationEnabled && config.workflowRunStoreBackend !== "memory"
         ? (sqlWorkflowRunStore ? backend.notifyJournal() : new FileWorkflowNotifyJournalStore(join(config.localDataRoot ?? localRoot, "workflows"), undefined))
@@ -36,6 +38,20 @@ export function createWorkflowOrchestration(ctx) {
             ...(p.sourceTaskId ? { sourceTaskId: p.sourceTaskId } : {}),
         });
         metrics.inc("workflow_runs_total", { status: p.status });
+        if (workflowParkDecisions !== undefined) {
+            const handOver = getRunEndedHandoff();
+            try {
+                if (handOver === undefined)
+                    throw new Error(`workflow run ${p.runId}: the run-ended decision handoff is not bound yet (the HTTP server is not up) — leaving the completion pending for the next recovery sweep`);
+                await handOver(p.runId);
+            }
+            catch (err) {
+                if (workflowNotifyGate !== undefined)
+                    throw err;
+                metrics.inc("workflow_park_handoff_total", { result: "not_redelivered" });
+                logger.warn("workflow_park_handoff_not_redelivered", { runId: p.runId, err: seatText("operator-log-text", String(err)) });
+            }
+        }
         if (!workflowCompletionInbox)
             return;
         try {
@@ -61,9 +77,10 @@ export function createWorkflowOrchestration(ctx) {
                 ? backend.workflowAgentSessionIndex()
                 : new LocalWorkflowAgentSessionIndex(join(config.localDataRoot ?? localRoot, "workflows"), undefined))
         : undefined;
-    const workflowParkDecisions = config.selfOrchestrationEnabled && backend !== undefined && (sqlWorkflowRunStore !== undefined || backend.kind === "local") ? backend.workflowParkDecisions?.() : undefined;
+    const workflowParkDecisions = config.selfOrchestrationEnabled && backend !== undefined && baseWorkflowRunStore !== undefined && (sqlWorkflowRunStore !== undefined || backend.kind === "local") ? backend.workflowParkDecisions?.(baseWorkflowRunStore) : undefined;
+    const heldParksHere = workflowParkDecisions !== undefined ? new HeldParksHere() : undefined;
     const workflowRunStore = baseWorkflowRunStore
-        ? new JournalingWorkflowRunStore(baseWorkflowRunStore, workflowNotifyGate, fleetBus, workflowAgentSessionIndex)
+        ? new JournalingWorkflowRunStore(baseWorkflowRunStore, workflowNotifyGate, fleetBus, workflowAgentSessionIndex, heldParksHere)
         : undefined;
     const replicaLocalNotifyJournal = workflowNotifyJournal instanceof FileWorkflowNotifyJournalStore;
     const workflowRecoverOpts = {
@@ -78,7 +95,7 @@ export function createWorkflowOrchestration(ctx) {
     return {
         sqlWorkflowRunStore, workflowNotifyJournal, workflowCompletionInbox, deliverWorkflowCompletion,
         workflowNotifyGate, fleetBus, workflowRunStore, workflowJournalStore, outcomeSink,
-        workflowAgentRegistry, subagentSteerRegistry, workflowRecoverOpts, workflowAgentSessionIndex, workflowParkDecisions,
+        workflowAgentRegistry, subagentSteerRegistry, workflowRecoverOpts, workflowAgentSessionIndex, workflowParkDecisions, heldParksHere,
     };
 }
 //# sourceMappingURL=workflow-orchestration.js.map

package/dist/bounded-rotation.d.ts

@@ -0,0 +1,29 @@
+/**
+ * **维护拍上有界轮转扫一组候选**的唯一实现(两个调用方:审批族悬挂 ask 的跨副本执行通知 `ToolApprovalCoordinator.pollSuspendedDecisions`、
+ * workflow 停驻卡持有进程的拉取腿 `orchestration/workflow-park-holder.ts`)。
+ *
+ * 判据(审批族 codex R3 / R5 的两条修,原样搬来):
+ *  · **帽**:每拍最多 `maxPerTick` 条;**预算**:每拍最多 `budgetMs` 墙钟,超了当场停(剩下的下拍接着扫)—— 串行点读在慢店上不许把「一拍的延迟」变成分钟级;
+ *  · **轮转**:起点是「上一拍扫到第几个」的下一位 —— 没有它,帽把同样的前 N 条锁成永久前缀,后面的永远轮不到;
+ *  · 游标是**整数偏移**,不是条目身份:上一拍最后碰的那条恰好消失时,按身份找位置会塌回队首(永久饥饿);偏移只回答「扫到第几个」,集合变了也只是近似。
+ * 多层(`tiers`):按层序扫,每层各一只游标;前一层吃满帽 / 预算,后一层这一拍轮不到。截断的那一拍由调用方响亮报(`truncated` / `backlog`)。
+ */
+/** 一层候选的轮转游标(调用方持有,跨拍存活)。 */
+export interface RotationCursor {
+    offset: number;
+}
+export interface RotationLimits {
+    readonly maxPerTick: number;
+    readonly budgetMs: number;
+}
+/** 一拍的读数:`visited` = 本拍真处理的条数;`backlog` = 还没轮到的(下界 0);`truncated` = 帽 / 预算截断位。 */
+export interface RotationTally {
+    readonly visited: number;
+    readonly backlog: number;
+    readonly truncated: boolean;
+}
+export declare function boundedRotation<T>(tiers: ReadonlyArray<{
+    readonly items: readonly T[];
+    readonly cursor: RotationCursor;
+}>, limits: RotationLimits, visit: (item: T) => Promise<void>, now?: () => number): Promise<RotationTally>;
+//# sourceMappingURL=bounded-rotation.d.ts.map

package/dist/bounded-rotation.js

@@ -0,0 +1,24 @@
+export async function boundedRotation(tiers, limits, visit, now = Date.now) {
+    const ordered = [];
+    tiers.forEach(({ items, cursor }, tier) => {
+        const start = items.length > 0 ? cursor.offset % items.length : 0;
+        for (const item of [...items.slice(start), ...items.slice(0, start)])
+            ordered.push({ item, tier, start });
+    });
+    const deadlineMs = now() + limits.budgetMs;
+    const visitedPerTier = tiers.map(() => 0);
+    let visited = 0;
+    let truncated = false;
+    for (const { item, tier, start } of ordered) {
+        if (visited >= limits.maxPerTick || now() >= deadlineMs) {
+            truncated = true;
+            break;
+        }
+        visited++;
+        tiers[tier].cursor.offset = start + ++visitedPerTier[tier];
+        await visit(item);
+    }
+    const total = tiers.reduce((n, t) => n + t.items.length, 0);
+    return { visited, backlog: Math.max(0, total - visited), truncated };
+}
+//# sourceMappingURL=bounded-rotation.js.map

package/dist/capabilities/approvals-push.d.ts

@@ -22,9 +22,9 @@
  *
  * 🔴 **刻意不合并进 `approvals` 或 `toolApproval`**:
  *  · `approvals` 答的是「这条车道在不在」(它为真而本位为假的部署是**常态**:没开工具审批的那些);
- *  · `toolApproval` 答的是「活体工具审批 HITL 在不在」,与「那条 SSE 推不推 live 行」不是一回事 ——
- *    没有 checkpoint 底座的部署上它可以为真而**根本没有这条流**。
- * 任一位单读都会对一半部署说谎,所以本位是它们的合取、而不是其中之一的别名。
+ *  · `toolApproval` 答的是「活体工具审批 HITL 在不在」。协调器只在呈卡协议上场(含 park 设施 = checkpoint 底座)时构造,
+ *    所以生产装配上 `toolApproval` 为真蕴含 ①,本位与 `toolApproval` 同值;本位仍逐项对着腿的判据写合取(不读另一位的投影)。
+ *    三位(`toolApproval` / `streamApproval` / 本位)如今说的是同一件事 —— 合并成一位是另一件 wire 变更,不在这里做。
  *
  * ⚠️ **位为真只保证这条源在场**,不保证这一次有任何悬挂 ask、也不保证跨副本可见:live 半场是**进程内
  * 投影**(与 `GET /v1/approvals` 的 `livePending` 逐字同限,非本件引入),durable park 行那一半才是

package/dist/capabilities/scenarios.d.ts

@@ -347,12 +347,26 @@ export interface ScenarioRuling {
  */
 export type ScenarioRulingRead = ScenarioRuling | "unavailable" | undefined;
 /**
- * 一个场景名的**来源**(闭集:新增一词 ⇒ {@link danglingScenarioRefusal} 的穷尽 switch 编译红)。
- *  · `ruling` —— 中心按主体指派的场景(`ScenarioRuling.scenario`);
- *  · `deployment` —— 部署自己写的缺省(`DEFAULT_SCENARIO` / config `defaultScenario`)。
- * 请求体显式给的名字不在此列:那是调用方的话,不在册 ⇒ 400 `scenario_unknown`(见 {@link gateScenarioRequest})。
+ * 一次请求生效的场景名**从哪一层来**(闭集,唯一属主;wire 上 `GET /v1/capabilities/scenario` 的 `source`、`state.scenario_assignment_unknown` 拒体的 `source` 读的都是它):
+ *  · `request` —— 这次请求点了名(体 `scenario` / 场景头 `x-agent-scenario` / 读面的 `?scenario=`;点名读法 `request-form.ts` `scenarioRequestedBy`);
+ *  · `ruling` —— 没点名,中心按主体指派的场景(`ScenarioRuling.scenario`);
+ *  · `deployment` —— 没点名、也没有指派,部署自己写的缺省(`DEFAULT_SCENARIO` / config `defaultScenario`)。
+ * 新增一词 ⇒ 自铸登记 `selfMinted.scenarioSource` 的 `satisfies Record<ScenarioSource, …>` 编译红;链上两层另由 {@link danglingScenarioRefusal} 的穷尽 switch 判。
  */
-export type ScenarioNameSource = "ruling" | "deployment";
+export type ScenarioSource = "request" | "ruling" | "deployment";
+/**
+ * 指派链上的两层(请求没点名时走的链)—— 「名字悬空」只在这两层上成立:点名的不在册名是调用方的错,门先答 400 `scenario_unknown`,不走悬空判据。
+ * 所以 `state.scenario_assignment_unknown` 拒体的 `source` 只会是这两词。
+ */
+export type ScenarioChainSource = Exclude<ScenarioSource, "request">;
+/**
+ * **门的答**(唯一一种形):这次请求生效的场景名(一定在册)与它来自哪一层。提交腿、`run-local` 与每一张读面读的都是这一只答;
+ * `GET /v1/capabilities/scenario` 的 200 体就是它(键名同 wire)。
+ */
+export interface ScenarioChoice {
+    readonly scenario: string;
+    readonly source: ScenarioSource;
+}
 /**
  * 🔴 **悬空场景名的判据与拒句 —— 全仓唯一属主。**
  *
@@ -365,10 +379,10 @@ export type ScenarioNameSource = "ruling" | "deployment";
  * 返回 `undefined` = 在册;否则是**拒句**(点名名字与来源、给在册词表、说怎么修)。判据按**自有键**(`known` 是场景表的
  * `Object.keys`,`constructor` / `__proto__` 不是场景名)。
  */
-export declare function danglingScenarioRefusal(name: string, source: ScenarioNameSource, known: readonly string[]): string | undefined;
+export declare function danglingScenarioRefusal(name: string, source: ScenarioChainSource, known: readonly string[]): string | undefined;
 /**
- * resolveSpec 的执法入口(指派为默认、body.scenario 可换但限 allowlist)。返回本请求的
- * **在册**生效场景名 —— 返回值一定在 `known` 里:下游直接按它取场景,没有「未知名 → default」的回退臂。
+ * resolveSpec 的执法入口(指派为默认、body.scenario 可换但限 allowlist)。返回本请求的**门的答**({@link ScenarioChoice}):
+ * **在册**生效场景名 + 它来自哪一层 —— 名字一定在 `known` 里:下游直接按它取场景,没有「未知名 → default」的回退臂;来层在铸名的那一臂上同时写下,读面不另算。
  * 读数 `ruling` 三态各一条出路({@link ScenarioRulingRead}),判序:
  *
  *   1. body.scenario 显式给出而不在册 ⇒ typed 400 `scenario_unknown`(调用方的错;词表面先于治理面,不等中心)。
@@ -383,7 +397,7 @@ export declare function danglingScenarioRefusal(name: string, source: ScenarioNa
  *
  * `principal` 只进运维日志,不参与判定。
  */
-export declare function gateScenarioRequest(ruling: ScenarioRulingRead, bodyScenario: unknown, defaultScenario: string, known: readonly string[], logger?: Logger, principal?: string): string;
+export declare function gateScenarioRequest(ruling: ScenarioRulingRead, bodyScenario: unknown, defaultScenario: string, known: readonly string[], logger?: Logger, principal?: string): ScenarioChoice;
 /**
  * 一条请求的场景名过门 —— {@link gateScenarioRequest} 的**唯一一处实参装配**。
  *
@@ -393,8 +407,9 @@ export declare function gateScenarioRequest(ruling: ScenarioRulingRead, bodyScen
  * 每个读口自己拼一遍这六个实参 = 第二只门:两口对「在册」「放行」「缺席取谁」各判各的,读口就开始对不上 run。
  * 所以装配只在这里,读口持有的是**绑好的门**;凡回答这类问题的口,场景名都由门给 —— 点名与缺席都问。
  *
- * 契约:`(principal, requested) => 在册的场景名`(返回值一定在册;被拒 ⇒ 抛 {@link gateScenarioRequest} 的那几只 typed 错,
- * 读口不改写)。`requested` 非串(缺席)⇒ 门走指派链(ruling 胜者,否则部署缺省),与 run 时同一读法。
+ * 契约:`(principal, requested) => 门的答 { scenario, source }`({@link ScenarioChoice};名字一定在册;被拒 ⇒ 抛 {@link gateScenarioRequest} 的那几只 typed 错,
+ * 读口不改写)。`requested` 非串(缺席)⇒ 门走指派链(ruling 胜者,否则部署缺省),与 run 时同一读法。`requested` 由调用方经 `scenarioRequestedBy`
+ * (`request-form.ts`,场景头 × 点名的唯一读法)取 —— 提交腿与读面同调。
  * `principalCaps` 缺席(无中心 / 干跑 / 嵌入方 / `run-local`)⇒ 读数恒缺席,门走「请求名或部署缺省」那条链;
  * 在场 ⇒ 它的读数三态({@link ScenarioRulingRead})原样交门,故障态由门拒。
  */
@@ -411,14 +426,14 @@ export interface ScenarioGateSources {
     readonly logger?: Logger;
 }
 export interface ScenarioGate {
-    (principal: string | undefined, requested: unknown): Promise<string>;
+    (principal: string | undefined, requested: unknown): Promise<ScenarioChoice>;
     /** 在册词表 —— 门判「在不在册」读的**同一张**场景表的自有键(活读,不抄快照)。请求的场景头在分派层判在册读它(读面没有体,不过整只门)。 */
     readonly known: () => readonly string[];
 }
 /**
  * 门问中心裁定走哪条腿(闭集;新增一词 ⇒ 下面的穷尽 `switch` 编译红)—— 与 `resolveRuntimeCaps` / `peekRuntimeCapsReading` 是同一对:
  *  · `enforce` —— 任务提交腿:中心裁定走执法腿,center 硬失败铸下的 fail-closed 降级项两腿都认;
- *  · `peek` —— 读面(`GET /v1/capabilities/mcp` 状态面、`GET /v1/sessions/:id/mcp` / `…/a2a` 两张会话面板):只读腿,同一只缓存 / 同一条抓取 / 同一份读数(中心答不出 ⇒ 读面同拒),但硬失败铸的降级项只对读面自己算数,
+ *  · `peek` —— 读面(`GET /v1/capabilities/scenario` 生效场景面、`GET /v1/capabilities/mcp` 状态面、`GET /v1/sessions/:id/mcp` / `…/a2a` 两张会话面板):只读腿,同一只缓存 / 同一条抓取 / 同一份读数(中心答不出 ⇒ 读面同拒),但硬失败铸的降级项只对读面自己算数,
  *    不替这个主体的真提交留下 `{allowWorkflows:false, allowFork:false, autoMode:false}` 的短窗 deny(读面不许成为别人被拒的原因)。
  */
 export type ScenarioGateLeg = "enforce" | "peek";

package/dist/capabilities/scenarios.js

@@ -315,7 +315,7 @@ export function gateScenarioRequest(ruling, bodyScenario, defaultScenario, known
                 extra: { allowlist: allowed },
             });
         }
-        return bodyScenario;
+        return { scenario: bodyScenario, source: "request" };
     }
     const [name, source] = ruling?.scenario != null ? [ruling.scenario, "ruling"] : [defaultScenario, "deployment"];
     const refusal = danglingScenarioRefusal(name, source, known);
@@ -323,7 +323,7 @@ export function gateScenarioRequest(ruling, bodyScenario, defaultScenario, known
         logger?.warn("scenario_assignment_unknown", { scenario: name, source, ...(principal !== undefined ? { principal } : {}) });
         throw createCodedHttpError(503, "state.scenario_assignment_unknown", refusal, { scenario: name, source });
     }
-    return name;
+    return { scenario: name, source };
 }
 export function createScenarioGate(sources, leg) {
     const rulingOf = (principal) => {

package/dist/capability-facts.d.ts

@@ -21,8 +21,10 @@
 import type { FlatServiceDeps } from "./http/server.js";
 import type { ServiceConfig } from "./config.js";
 import type { OwnerAwareSessionStore } from "./security.js";
-import type { ServiceBlobExchange, ServiceFileHistoryStore } from "./plugins/store-backend.js";
+import type { ServiceFileHistoryStore, StoreBackend } from "./plugins/store-backend.js";
+import type { OperatorPower, OperatorRoster } from "./operator-roster.js";
 import { resolveStreamApprovalGate, type ApprovalFrameFamily } from "./tool-approval.js";
+import { type LandingBlobFaces } from "./session-sync.js";
 import { type WorkspaceSyncCapability } from "./workspace-space.js";
 import type { WorkspaceCacheCapability } from "./workspace-cache.js";
 import type { HistoryAnchorReaders } from "./history-anchor.js";
@@ -42,7 +44,7 @@ export declare const CAPABILITY_FACT_WHY: {
     readonly session_fork_face_absent: "the session store has no fork face";
     readonly session_row_faces_absent: "the session store has no session-row faces (headOf / sessionSummaryOf / writeSessionRowCells)";
     readonly session_purge_absent: "no session purge coordinator is wired";
-    readonly session_policy_store_absent: "no session policy store is wired";
+    readonly session_kind_faces_absent: "the session store cannot record a session kind (it needs the birth receipt face that takes a kind, sessionKindOf, listSessions and listIdleOfKind) or no session purge coordinator is wired to age such sessions out";
     readonly store_backend_absent: "no store backend is wired (DB_BACKEND=memory, multi-tenant bare boot, or half-configured SQL)";
     readonly file_history_store_absent: "no file-history store is wired";
     readonly resume_anchor_store_absent: "no rewind anchor map is wired (the handle → session-entry map a rewind target is read through, with the run store an unknown handle is checked against — both come from the store backend)";
@@ -53,7 +55,7 @@ export declare const CAPABILITY_FACT_WHY: {
     readonly session_export_absent: "the session store has no entry export faces (exportEntries / exportEntriesStream)";
     readonly session_import_staging_absent: "the session store has no staged-import face (beginImportStaging)";
     readonly policy_purge_absent: "the session policy store has no deleteBySession purge verb";
-    readonly blob_exchange_absent: "the file-history store carries no blob exchange (FileHistoryStore.blobExchange — SQL backends only)";
+    readonly blob_exchange_absent: "the file-history store carries no complete blob face (the blob exchange FileHistoryStore.blobExchange together with the per-landing provenance face blobLanding — SQL backends only)";
     readonly device_hub_absent: "the device lane hub is not wired";
     readonly device_store_absent: "the device store is not wired";
     readonly device_enrollment_absent: "device enrollment is not wired";
@@ -82,8 +84,7 @@ export declare const CAPABILITY_FACT_WHY: {
     readonly a2a_serve_off: "A2A_SERVE_ENABLED is off";
     readonly elicitation_disabled: "inbound MCP elicitation is off (MCP_ELICITATION_ENABLED)";
     readonly ask_question_disabled: "AskUserQuestion live HITL is off (ASK_QUESTION_ENABLED)";
-    readonly tool_approval_disabled: "live tool approval is off (TOOL_APPROVAL_ENABLED)";
-    readonly stream_approval_disabled: "the stream approval protocol is off (STREAM_APPROVAL_ENABLED)";
+    readonly tool_approval_disabled: "this worker presents no approval cards (needs TOOL_APPROVAL_ENABLED, a store backend (DB_BACKEND) and DURABLE_APPROVAL)";
     readonly read_root_grant_posture_refused: "this is not a single-user host-lane deployment (REMOTE_EXEC=host without REQUIRE_PRINCIPAL), the only posture that honors a read-directory grant";
     readonly background_agent_store_absent: "no background-agent store is wired";
     readonly sendfile_ledger_absent: "no SendUserFile ledger is wired";
@@ -187,6 +188,12 @@ type SessionLister = NonNullable<OwnerAwareSessionStore["listSessions"]>;
 export declare function sessionList(d: Pick<Deps, "sessionStorage">): Fact<"session_lister_absent", {
     lister: SessionLister;
 }>;
+/**
+ * 会话种类在场(律 `session-kind.ts`):会话店交「带种类的出生回执」(`registerWithReceipt` 的第三参;授权口登记新行的那一笔)∧ 按 id 的种类读 `sessionKindOf`(既有会话上的比对)
+ * ∧ 列表面 `listSessions`(视图谓词在店里)∧ 老化候选面 `listIdleOfKind` ∧ 删除协调器(老化删走它)。读者三只、同读这一只:能力位 `capabilities.sessionKinds`、
+ * 受理门的 `request.precondition_unmet`、授权口的种类判。三只持久店恒在;内存店不在。
+ */
+export declare function sessionKinds(d: Pick<Deps, "sessionStorage" | "purgeSession">): Fact<"session_kind_faces_absent">;
 export declare function sessionFork<D extends SessionDeps>(d: D): Fact<"session_fork_face_absent" | "session_head_face_absent", {
     sessionStorage: SessionWith<D, "headOf" | "fork">;
 }>;
@@ -204,40 +211,42 @@ export declare function sessionDelete<D extends Pick<Deps, "purgeSession" | "ses
     purge: Store<"purgeSession">;
     sessionStorage: HeadReadingSessionStore<D>;
 }>;
-export declare function sessionPolicy<D extends Pick<Deps, "sessionPolicyStore" | "sessionStorage">>(d: D): Fact<"session_policy_store_absent" | "session_head_face_absent", {
-    policyStore: Store<"sessionPolicyStore">;
+/** 会话规则面(`GET` / `PUT /v1/sessions/:id/policy`):后端 ∧ 会话头读。见证交后端:`GET` 读 `backend.sessionPolicy()`(恒同一只 —— 引擎的规则席读同一只),
+ *  `PUT` 写经同一只后端的落定席位 `landedAttendants()`(段首锁会话根行判门读的那一位住客,门后会话被删 / 同 id 重建 ⇒ 零写)写进的就是那一只。读与写同出一只后端,没有第二个店源。 */
+export declare function sessionPolicy<D extends Pick<Deps, "sessionStorage" | "backend">>(d: D): Fact<"session_head_face_absent" | "store_backend_absent", {
     sessionStorage: HeadReadingSessionStore<D>;
+    backend: StoreBackend;
 }>;
 type SyncSessionStore<D extends SessionDeps> = SessionWith<D, "exportEntries" | "exportEntriesStream" | "beginImportStaging" | "headOf" | "sessionSummaryOf" | "writeSessionRowCells">;
-type SessionSyncWhy = "store_backend_absent" | "file_history_store_absent" | "session_export_absent" | "session_import_staging_absent" | "session_row_faces_absent" | "policy_purge_absent";
-/** 会话对等同步的**对话半族**(manifest / entries / plan / import 两相):后端 ∧ 文件历史店 ∧ 导出两面 ∧ staged 导入面 ∧
+type SessionSyncWhy = "store_backend_absent" | "session_export_absent" | "session_import_staging_absent" | "session_row_faces_absent" | "policy_purge_absent";
+/** 会话对等同步的**对话半族**(manifest / entries / plan / import 两相):后端(文件历史店 / 规则店 / 锚店都是它恒交的那一只,落定席位写的同一只)∧ 导出两面 ∧ staged 导入面 ∧
  *  会话行三口(门读头 `headOf` —— 属主 + 化身一次读,属主判门、化身给 identical 短路腿;manifest 带 `title` / `pinned`;导入经行格写原语以 `replay` 写者
  *  按导入落定的那一位住客重放它们)∧ policy 店能清(overwrite-dst 的 commit 要擦目的端旧 policy 行)。
  *  文件历史的 blob 搬运是另一只事实。 */
-export declare function sessionSync<D extends Pick<Deps, "backend" | "sessionStorage" | "fileHistoryStore" | "sessionPolicyStore">>(d: D): Fact<SessionSyncWhy, {
+export declare function sessionSync<D extends Pick<Deps, "backend" | "sessionStorage">>(d: D): Fact<SessionSyncWhy, {
     backend: Held<D, "backend">;
     sessionStorage: SyncSessionStore<D>;
     historyStore: ServiceFileHistoryStore;
 }>;
-/** 会话同步的**文件历史半族**:对话半族 ∧ 文件历史店带 blob 交换组(只有 SQL 两只店有)。「店能不能交换 blob」只在 `blobExchangeOf` 判一次(core 判官),
- *  blob 取值口 `blobGetterOf` 读的是同一只 —— 本事实为真 ⟺ 取值口通到 `blobExchange.get`;判过的组随事实交出,路由的 GET / PUT / 在场预检只读它。 */
-export declare function sessionSyncFileHistory(d: Pick<Deps, "backend" | "sessionStorage" | "fileHistoryStore" | "sessionPolicyStore">): Fact<SessionSyncWhy | "blob_exchange_absent", {
+/** 会话同步的**文件历史半族**:对话半族 ∧ 文件历史店带完整的 blob 面 —— 交换组 + 按落点来历面(只有 SQL 两只店有)。「店有没有这只面」只在 `landingBlobFacesOf` 判一次
+ *  (交换组经 core 判官),判过的面随事实交出:路由的 PUT / 在场预检 / 重放取值 / GET 只读它(按落点,没有全局读者)。 */
+export declare function sessionSyncFileHistory(d: Pick<Deps, "backend" | "sessionStorage">): Fact<SessionSyncWhy | "blob_exchange_absent", {
     historyStore: ServiceFileHistoryStore;
-    blobExchange: ServiceBlobExchange;
+    blobs: LandingBlobFaces;
 }>;
 type RewindFilesWhy = "file_history_store_absent" | "session_head_face_absent" | "resume_anchor_store_absent" | "execution_lane_handless" | "workspace_rebuilt_per_task" | "session_store_shared";
 /**
  * run 外的「只恢复代码」口(`POST /v1/sessions/:id/rewind-files`,[ref])这台部署**解不解得出** —— 能力位 `sessionRewindFiles` 与该口的 501 读这一只。
- * 四格缺一不可,每格都是那一口真要用的设施:文件历史店(引擎 `Runner.rewindFiles` 读的同一只;旋钮 `FILE_HISTORY_CAPTURE` 只关捕获、不摘店,
- * 所以与它无关 —— 已存边界照常可回退)∧ 会话头读(属主门 + 坏档判据)∧ 锚店与 run 店(`to` 手柄经锚店翻成 entry id,未知手柄的 404 成因半句读 run 店,
- * `history-anchor.ts`;两只同出存储后端,所以是同一格)∧ 执行车道有手
+ * 四格缺一不可,每格都是那一口真要用的设施:文件历史店(后端恒交的那一只 —— 引擎 `Runner.rewindFiles` 读的同一只;没有后端 ⇒ 没有它;旋钮 `FILE_HISTORY_CAPTURE` 只关捕获、
+ * 不摘店,所以与它无关 —— 已存边界照常可回退)∧ 会话头读(属主门 + 坏档判据)∧ 锚店与 run 店(`to` 手柄经锚店翻成 entry id,未知手柄的 404 成因半句读 run 店,
+ * `history-anchor.ts`;锚店是后端恒交的那一只,run 店同出存储后端,所以是同一格)∧ 执行车道有手
  * (无手车道上引擎恒拒 `rewind.files_env_unsupported`:没有工作区可回退 —— 位说有而口恒拒不许发生)∧ 即时回退的工作区活过一次执行(部署形表行 `rewindableWorkspace`;
  * 否则恢复的结果到不了下一次执行)∧ 会话店由本进程独占(local 后端:数据根被一个活进程锁住 ⇒ 引擎的进程内会话锁就是全局互斥;
  * SQL 后端被多副本共用,而 run 外回退还没有一只跨副本的持久认领 —— 「先查认领再交引擎」只是检查不是互斥,所以在共享店上位为假、口 501,不留「检查即放行」)。
  * 动词本身是引擎 `Runner` 的必有成员(型上必在),不是一格。
  * 见证 = 判过在场的设施(历史店 · 手柄翻译的两只读店 · 会话店);路由在拒臂之后只读见证。
  */
-export declare function sessionRewindFiles<D extends Pick<Deps, "fileHistoryStore" | "resumeAnchorStore" | "runStore" | "sessionStorage" | "config" | "backend">>(d: D): Fact<RewindFilesWhy, {
+export declare function sessionRewindFiles<D extends Pick<Deps, "runStore" | "sessionStorage" | "config" | "backend">>(d: D): Fact<RewindFilesWhy, {
     historyStore: ServiceFileHistoryStore;
     anchors: HistoryAnchorReaders & {
         readonly runs: Held<D, "runStore">;
@@ -250,7 +259,7 @@ export declare function sessionRewindFiles<D extends Pick<Deps, "fileHistoryStor
  * `previewFileDelta` 不在 core 包根导出面上,本仓不另写一份 —— 等 core 导出它,SQL 店补这一座、本位随之转真,路由零改)。本位为假**不是**口不收 `dryRun`:口照收,答 `preview: null`
  * (「这台给不出统计」≠「什么都不会变」);所以本事实没有 501 拒点,只有能力位读它。
  */
-export declare function sessionRewindFilesPreview(d: Pick<Deps, "fileHistoryStore" | "resumeAnchorStore" | "runStore" | "sessionStorage" | "config" | "backend">): Fact<RewindFilesWhy | "file_history_preview_absent">;
+export declare function sessionRewindFilesPreview(d: Pick<Deps, "runStore" | "sessionStorage" | "config" | "backend">): Fact<RewindFilesWhy | "file_history_preview_absent">;
 /** 持久审批底座(checkpoint 店)在场 —— `/v1/approvals/*` 与 `/v1/assistant/*` 整条车道、会话 wake 都站在它上面。 */
 export declare function checkpointPark(d: Pick<Deps, "checkpointStore">): Fact<"checkpoint_store_absent", {
     checkpointStore: Store<"checkpointStore">;
@@ -264,17 +273,18 @@ export declare function askUserQuestion(d: Pick<Deps, "question">): Fact<"ask_qu
 export declare function toolApproval(d: Pick<Deps, "toolApproval">): Fact<"tool_approval_disabled", {
     coordinator: Store<"toolApproval">;
 }>;
-type StreamApprovalWhy = "tool_approval_disabled" | "stream_approval_disabled" | "store_backend_absent" | "checkpoint_store_absent";
+type StreamApprovalWhy = "tool_approval_disabled" | "store_backend_absent" | "checkpoint_store_absent";
 type ActiveStreamApproval = Extract<ReturnType<typeof resolveStreamApprovalGate>, {
     active: true;
 }>;
 /** 流内审批协议在场 —— 判据的属主仍是 `resolveStreamApprovalGate`(三条执行腿的装配也读它);本事实把它的拒因译进 why 闭集。 */
 export declare function streamApproval(d: Pick<Deps, "toolApproval" | "config" | "backend" | "checkpointStore">): Fact<StreamApprovalWhy, {
     askStore: ActiveStreamApproval["askStore"];
+    coordinator: Store<"toolApproval">;
 }>;
 /**
  * 读根授权(「Yes, and add directory」)这台部署**受理不受理** —— `GET /v1/capabilities` 的 `approvalReadRootGrant` 位,与
- * `POST /v1/tool-approvals/:id/respond` 对应答体 `readRootGrant` 的受理门**读同一只**(位说不受理而口照收,就是「位说 X、行为不是 X」)。
+ * 决断口 `POST /v1/tasks/:taskId/asks/:askId/decision` 对决定体 `readRootGrant` 的受理门**读同一只**(位说不受理而口照收,就是「位说 X、行为不是 X」)。
  *
  * 判据 = 部署形表行 `callerOwnsWorkerDisk`(手在本 worker 盘上 ∧ 单主;与调用方附加目录同一条信任边界):授权把一个**宿主目录**加进本 run 的读目录,
  * 只有「这台机器一个可信主人」的姿态才有这个授权的语义;多租户与云上 / 容器车道的读面另有归宿(沙箱内的读面档位见 `READ_FACE`)。
@@ -285,14 +295,13 @@ export declare function readRootGrant(d: Pick<Deps, "config">): Fact<"read_root_
 /**
  * 审批开卡帧的族 —— `GET /v1/capabilities` 的 `approvalFrameFamilies` 位。**值族投影**(出形是闭集词数组,不是 `{ available }`;同
  * `engineCapabilityBits` 一类),入参是 {@link streamApproval} **已求出的那一份事实**而不是 deps:一次请求里 `streamApproval` 位与本位读同一次判据求值
- * (判据读活配置与 backend,两次求值在开关热改的窗口里会撕出 `streamApproval:true` 配旧族的应答;也多取一次 ask 店)。
+ * (判据读活配置与 backend,两次求值会撕出两位互相矛盾的应答;也多取一次 ask 店)。
  *  · 流内审批在场(呈卡协议上场)⇒ `["approval_request"]`;
- *  · 活卡协调器在、协议没上场(开关关 / 无 store backend / 无 park 设施)⇒ `["tool_approval"]`;
- *  · 活卡协调器缺席 ⇒ `[]`(没有审批卡可呈)。
- * 对 why 闭集穷举:`streamApproval` 的拒因多一个 ⇒ 这里编译红,逼着给新拒因定族。三条执行腿选族读的是同一只判据的 `active`,
- * 与本映射的「在场 ⇒ 呈卡族」是同一条规则(真腿对拍钉在 `test/stream-approval-on-e2e.test.ts`)。没有端点按它拒:它是消费方分派帧族的读点,`streamApproval` 的词义不变。
- * [ref]:它也是壳**声明**的依据 —— 一条 run 只在 `settings.approvalFrameFamilies` 含本位那一个族时有活审批通道(三条腿判的是同一只映射
- * `presentedApprovalFrameFamily`);不含 ⇒ 这条腿不呈卡,问当场交无人值守政策口。本位的值不因声明而变。
+ *  · 其余每一形(审批席缺席 / 无 store backend / 无 park 设施)⇒ `[]`:这台 worker 不呈卡,每条腿的问当场交无人值守政策口
+ *    (审批只有一个帧族,没有「协议没上场就回退发另一族活卡」的腿)。
+ * 族词由 `presentedApprovalFrameFamily` 一处映射(三条执行腿判「这台 worker 呈不呈卡 / 这条 run 声明了没有」读同一只 —— 壳照本位声明,服务端照同一只函数判;
+ * 真腿对拍钉在 `test/stream-approval-on-e2e.test.ts`)。没有端点按它拒:它是消费方分派帧族与声明的读点,`streamApproval` 的词义不变。
+ * [ref]:一条 run 只在 `settings.approvalFrameFamilies` 含本位那一个族时有活审批通道;本位为空 ⇒ 这台 worker 上没有 run 有。本位的值不因声明而变。
  */
 export declare function approvalFrameFamilies(stream: ReturnType<typeof streamApproval>): readonly ApprovalFrameFamily[];
 export declare function deviceLane(d: Pick<Deps, "deviceHub">): Fact<"device_hub_absent", {
@@ -368,14 +377,16 @@ export declare function principalInboxDelivery(d: Pick<Deps, "orgDeliveryGate">)
 export declare function engineHandover(d: Pick<Deps, "drainState">): Fact<"engine_handover_lane_absent" | "engine_lease_stopped", {
     door: EngineHandoverDoor;
 }>;
-/** 这台部署有运维名册(名单非空 ∨ 单用户声明 `OPERATOR_SINGLE_USER`;唯一读法 `operatorRosterPresent`)。没有时 `explicitOperatorOk` 对任何身份恒假
- *  ⇒ 这一族的口对谁都打不通 = 部署不可用(不是鉴权拒)。
+/** 这台部署上有人能持这只运维权力(档表里持 `power` 的某档名单非空 ∨ 单用户声明 `OPERATOR_SINGLE_USER`;唯一读法 `operatorRosterPresent`)。没有时 `explicitOperatorOk(…, power)`
+ *  对任何身份恒假 ⇒ 这一族的口对谁都打不通 = 部署不可用(不是鉴权拒)。`power` 必填:运维面族传 `"operate"`,排空口传它声明行的 `power`。
+ *  原因词只有 `operator_principals_empty` 一个:全运维档持每一只权力,所以「没人持 `power`」恒蕴含「没有全运维」—— 这个词的义对每只权力都真;
+ *  各权力的完整出路句由 `sendOperatorPrincipalsRequired(res, power)` 在拒发口说。
  *
  * operator 族的复合事实**先判名单、再判设施**:门序是「身份 → 名单空(501)→ 授权(403)→ 设施缺席(501)」——
  * 名单空时没有人过得了授权,不先判它,这一形就永远答成 403;设施缺席则留在授权之后答(不对非 operator 透露部署形态)。 */
 export declare function operatorLane(d: {
-    readonly config: Pick<ServiceConfig, "operatorPrincipals" | "operatorSingleUser">;
-}): Fact<"operator_principals_empty">;
+    readonly config: OperatorRoster;
+}, power: OperatorPower): Fact<"operator_principals_empty">;
 /** 带收编日志的后端(见证随调用方的 deps:路由层的后端视图上店工厂照样封着)。 */
 type AdoptionCapableBackend<D extends Pick<Deps, "backend">> = Held<D, "backend"> & {
     adoptionLog(): ReturnType<NonNullable<Store<"backend">["adoptionLog"]>>;