@sema-agent/server 7.150.0 → 7.152.0

package/dist/http/approval-sweeps.d.ts

@@ -1,7 +1,7 @@
 /**
  * 审批扫腿([ref] 切片:`http/server.ts` 5196–5488 逐字搬家,正文一字未改)——两条不经 HTTP 路由的赎回口:
  * ①`denyExpiredApprovals`([ref] D-D,SLA 到期的 deny-sweep,main.ts 的 reaper 按拍调);
- * ②`redeemParkedAsk`([ref],live 回决腿的 PARKED 赎回席,装配层接进协调器的晚绑座)。
+ * ②`redeemParkedAsk`([ref],决断口停驻臂的 PARKED 赎回席,装配层接进协调器的晚绑座)。
  * 两者都走 resume 家族的 `resumeCheckpoint`,所以它们的属主是「谁在无 HTTP 请求的情况下替人做决定」这件事,
  * 不是请求流水线。`createWallClockJumpGuard` 建的 `denySweepClockGuard` 是 ① 的私有件,随它同居。
  * ctx 字段 3 只(`deps` / `resumeCheckpoint` / `decisionRowAdmits`),机器算(closure-free-vars)与手抄一致。

package/dist/http/approval-sweeps.js

@@ -7,8 +7,8 @@ import { hostDecisionFacts } from "../host-decision.js";
 import {} from "../tool-approval.js";
 import { APPROVAL_GATE_KINDS } from "../approval-content-kind.js";
 import { createWallClockJumpGuard } from "../wall-clock-jump-guard.js";
-import { gatedPerson } from "./principal-gate.js";
-import { hasServiceAuth } from "../identity-source.js";
+import { gatedPerson, verifiedIdentitySource } from "./principal-gate.js";
+import { passesCredentialGate } from "../identity-source.js";
 import { costQuotaRefusalOf } from "./request-guards.js";
 import { admissionRefusalOf, readinessOf } from "./readiness.js";
 import { memberLeaseOf } from "../fleet/engine-signal.js";
@@ -19,6 +19,7 @@ import { storedBodyReplayRefusal } from "./stored-body-replay.js";
 import { refusalBody } from "./refusal-body.js";
 import { CARD_EXPIRE_OUTCOME, expireCardUnderStoredScope } from "../card-settle-stored-scope.js";
 import { DENY_SWEEP_PAGE_ROWS } from "../plugins/checkpoint-store-face.js";
+import { ruleReceiptOf } from "./route-ctx.js";
 const BLOCKED_SCALAR_KEYS = ["errorCode", "blockedBy", "field", "reason", "count", "cap", "index"];
 function blockedScalars(body) {
     const out = {};
@@ -216,8 +217,8 @@ export function createApprovalSweeps(ctx) {
         if (!cs) {
             return { status: 404, body: refusalBody({ errorCode: "not_found.approval", message: "approval not found" }) };
         }
-        if (!hasServiceAuth(deps.config) && !deps.config.allowUnauthedWrites) {
-            return { status: 503, body: refusalBody({ errorCode: "auth.service_token_required", message: "this worker requires a service auth token (set SERVICE_AUTH_TOKEN) before accepting task submissions" }) };
+        if (!passesCredentialGate(req.httpReq === undefined ? undefined : verifiedIdentitySource(req.httpReq, deps.config)) && !deps.config.allowUnauthedWrites) {
+            return { status: 503, body: refusalBody({ errorCode: "auth.service_token_required", message: "this worker requires a service auth token (set SERVICE_AUTH_TOKEN) or a verified registry sign-in token before accepting task submissions" }) };
         }
         const refusal = admissionRefusalOf(readinessOf(deps), memberLeaseOf(deps), "hitl-answer");
         if (refusal !== undefined)
@@ -232,7 +233,7 @@ export function createApprovalSweeps(ctx) {
                 }
             }
         }
-        const answerer = { subject: recoveredSubject(req.principal), operator: false };
+        const answerer = { subject: recoveredSubject(req.principal), operator: req.operator };
         let cp;
         try {
             cp = await cs.get(req.gateToken);
@@ -258,8 +259,10 @@ export function createApprovalSweeps(ctx) {
             ...(req.updatedInput !== undefined ? { updatedInput: req.updatedInput } : {}),
         };
         const remember = req.remember === "session" ? { grantedBy: req.principal ?? null, laneCannotRecord: "decide_once" } : undefined;
-        const out = await resumeCheckpoint(cp.sessionId, req.decision, req.note, hostDecisionFacts(req.decider, req.principal), req.httpReq, undefined, binding, remember, true, answerer);
-        return { status: out.status, body: out.body, ...(remember !== undefined ? { rememberApplied: out.rememberApplied === true } : {}), gateGeneration: checkpointRevOf(cp) };
+        const persistRule = req.persistRule !== undefined ? { slot: req.persistRule, inputWasEdited: req.updatedInput !== undefined } : undefined;
+        const out = await resumeCheckpoint(cp.sessionId, req.decision, req.note, hostDecisionFacts(req.decider, req.principal), req.httpReq, undefined, binding, remember, true, answerer, undefined, persistRule);
+        const rule = out.status >= 200 && out.status < 300 ? ruleReceiptOf(out, persistRule) : undefined;
+        return { status: out.status, body: out.body, ...(remember !== undefined ? { rememberApplied: out.rememberApplied === true } : {}), ...(rule !== undefined ? { rule } : {}) };
     }
     return { denyExpiredApprovals, redeemParkedAsk };
 }

package/dist/http/checkpoint-ctx.d.ts

@@ -43,6 +43,8 @@
 import type { CheckpointCtx } from "./route-ctx.js";
 import type { TaskRequestBody } from "./wire-types.js";
 import type { ProjectContext } from "../project-context.js";
+import type { MemorySeed } from "../project-registry.js";
+import type { PermissionModeWrite } from "../permission-mode-admission.js";
 import type { InertToolListEntry } from "../rule-entry-list.js";
 import { type Refusal } from "./refusal-body.js";
 /** allow 层读法从这一版起(7.117.0):此前的写者对 `settings.permissions.allow` 是另一种读法(≤7.114.x 名单 / 7.115.0–7.116.x 表态)。规则见顶注「allow 读法问」。 */
@@ -79,7 +81,9 @@ export declare function buildCheckpointCtx(fields: {
     unattendedLeg?: true;
     promptScreened?: true;
     projectContext?: ProjectContext | undefined;
+    memorySeed?: MemorySeed | null | undefined;
     writerVersion: string;
+    permissionModeWrite: PermissionModeWrite | undefined;
 }, sealer: CheckpointCtxSealer | undefined, sessionId: string): SealedCheckpointCtx;
 /**
  * 退役请求键问:**退役的请求键**闭集 = 两张处置表之并(新提交在键闭集门 400;存体里还带着它 = 这份体是更早的写者写下的)。键住在哪张表就是它的处置格,规则全文见头注「退役请求键问」。

package/dist/http/checkpoint-ctx.js

@@ -44,6 +44,8 @@ export function buildCheckpointCtx(fields, sealer, sessionId) {
         ...(fields.unattendedLeg === true ? { unattendedLeg: true } : {}),
         ...(fields.promptScreened === true ? { promptScreened: true } : {}),
         ...(fields.projectContext !== undefined ? { projectContext: fields.projectContext } : {}),
+        ...(fields.memorySeed !== undefined ? { memorySeed: fields.memorySeed } : {}),
+        ...(fields.permissionModeWrite !== undefined ? { permissionModeWrite: fields.permissionModeWrite } : {}),
     };
     return sealCheckpointCtx(ctx, sealer, sessionId);
 }

package/dist/http/dispatch.d.ts

@@ -33,7 +33,8 @@ export interface HealthDeploymentModsSection {
  * 配了 service token、没开 REQUIRE_PRINCIPAL 的部署上,`POST /v1/tasks` 吃凭据,这三族读路对端口全开。
  *
  * 规则(一条,三族同读;fail-closed):
- *  · 部署**没配**任何 service 凭据(`hasServiceAuth` 假)⇒ 放行 —— 与全局门对 `/v1/tasks` 同判(run-local 形);
+ *  · 部署**没配**任何 service 凭据(`hasServiceAuth` 假)⇒ 放行 —— 问的是「全局凭据门武装没有」,与门后各口同判(门不武装 ⇒ 门后的读口也不要凭据;
+ *    写门是另一问,问的是请求,见 `identity-source.ts` 头注律 5);
  *  · 否则要么出示了**服务凭据**(service token 单 / 多,或只读 `TRACE_TOKEN` —— 后者正是这几族在门前的理由),
  *    要么带着**验过的** principal(registry 登录令牌 / direct-door 签名 principal 令牌;判据 = `verifiedIdentitySource`,
  *    与 off-box operator 读面同一只)。调用方自己写的 principal 头不是凭据。
@@ -42,9 +43,13 @@ export interface HealthDeploymentModsSection {
  */
 export declare function readCredentialOk(req: IncomingMessage, config: ServiceConfig): boolean;
 /**
- * `GET /health` 这次请求的**读者档**(`health-reader.ts` 头注:三档与每档拿什么)—— 读的是上面那一只读路谓词,不另立第二份「凭据」读法:
- * 没配服务凭据 ⇒ `open`(谓词的第一臂);配了而谓词认 ⇒ `credentialed`;配了而谓词不认 ⇒ `anonymous`。
+ * `GET /health` 这次请求的**读者档**(`health-reader.ts` 头注:四档与每档拿什么)—— 唯一判官。读的是上面那一只读路谓词与请求的通道事实(`request-channel.ts`),不另立第二份「凭据」读法:
+ * 没配服务凭据 ⇒ `open`(谓词的第一臂);配了而谓词认 ⇒ `credentialed`;配了而谓词不认 ⇒ 按通道穷举:经本机控制 socket ⇒ `engine-user`,经 TCP ⇒ `anonymous`
+ * (TCP 对端地址不读 —— 没有回环档)。`credentialed` 先于 `engine-user`:经 socket 带了凭据的读者归凭据档(两档投影相同,先后只影响「它证明了什么」)。
+ * 通道一臂只在这一面换档:读路谓词、全局凭据门与身份来源闭集都不读通道(通道不是凭据)。
  * 调用点必须在鉴权桥预认证**之后**(已验登录令牌是谓词的一臂,读的是预认证挂上的身份)。
+ * **圈禁的身份不算读路凭据**(名册的非人档;`/health` 不声明权力,判官 `requestConfinedTier`):这次请求只按它出示的 service / trace 凭据分档 ——
+ * 与别的空间的登录令牌([ref])同一读法:探针面从不拒,身份不算,读者按没出示凭据分档(没出示 ⇒ 照上面按通道穷举:经本机控制 socket 仍是 `engine-user`,通道不是凭据、圈禁也不改它)。
  */
 export declare function healthReaderOf(req: IncomingMessage, config: ServiceConfig): HealthReader;
 export declare function createDispatch(ctx: {

package/dist/http/dispatch.js

@@ -4,19 +4,21 @@ import { partsOf } from "../owner-brands.js";
 import { DEPLOYMENT_SHAPE_PREDICATES } from "../deployment-shape.js";
 import { publicStoreProbeError } from "../store-live-probe.js";
 import { looksLikeJwt } from "@sema-agent/settings-schema/api/auth-bridge";
-import { admitBridgeIdentity } from "../auth-bridge.js";
+import { admitBridgeIdentity, ssoForeignScope } from "../auth-bridge.js";
 import { ROUTE_METHOD_ORDER } from "./route-ctx.js";
-import { READ_CREDENTIAL_ROUTES, PUBLIC_ROUTES, POST_CREDENTIAL_ROUTES, routeLabel, isBillableSubmitPath, billableKindOf, isCredentialGatedRewrite, isMethodDispatchedSubmitPath, lookupRoute, isProbePath, isSubscriptionRequest } from "./route-table.js";
+import { READ_CREDENTIAL_ROUTES, PUBLIC_ROUTES, POST_CREDENTIAL_ROUTES, routeLabel, isBillableSubmitPath, billableKindOf, isCredentialGatedRewrite, isMethodDispatchedSubmitPath, lookupRoute, isProbePath, isSubscriptionRequest, declaredPowerOf } from "./route-table.js";
 import { sendJson, sendError, sendHttpError, isSseResponse, endSseWithError } from "./send.js";
 import { admissionRefusalOf, readinessOf, healthReadinessKeys, sendReadyz, sendBillableRefusal, billableRefusalOf, billableRefusalFrame } from "./readiness.js";
-import { ENGINE_SIGNAL_KEY, buildEngineSignal, fleetMembershipKeys, healthConfigLedgerKeys, healthDrainingKeys, memberLeaseOf, mintEngineSignal, restartActionable } from "../fleet/engine-signal.js";
+import { ENGINE_SIGNAL_KEY } from "@sema-agent/settings-schema/fleet";
+import { buildEngineSignal, fleetMembershipKeys, healthConfigLedgerKeys, memberLeaseOf, mintEngineSignal, restartActionable } from "../fleet/engine-signal.js";
 import { buildHealthSelfReport } from "./health-self-report.js";
 import { projectHealthBody } from "./health-reader.js";
+import { requestChannelOf } from "./request-channel.js";
 import { projectHealthStoreSection, unwiredStorePosture } from "../store-posture.js";
 import { autoBackgroundOnTimeout as autoBackgroundOnTimeoutFact, autoBackgroundOnTimeoutWord, deploymentModPackages as deploymentModPackagesFact } from "../capability-facts.js";
 import { hostBackgroundShellEnabled } from "../config.js";
-import { actsForDeployment, admitRunIdentity, authorized, bearerPresentedButUnverified, devOpenDeployment, systemFor, gatedSubject, sendPrincipalRefusal, sendUnauthorized, traceTokenPresented, verifiedIdentitySource } from "./principal-gate.js";
-import { hasServiceAuth } from "../identity-source.js";
+import { actsForDeployment, admitRunIdentity, authorized, bearerPresentedButUnverified, devOpenDeployment, requestConfinedTier, systemFor, gatedSubject, sendPrincipalConfined, sendPrincipalRefusal, sendUnauthorized, traceTokenPresented, verifiedIdentitySource } from "./principal-gate.js";
+import { hasServiceAuth, passesCredentialGate } from "../identity-source.js";
 import { inflightTotal } from "../fleet/drain-entry.js";
 const PROCESS_STARTED_AT_MS = Date.now() - Math.round(process.uptime() * 1000);
 export function readCredentialOk(req, config) {
@@ -29,7 +31,33 @@ export function readCredentialOk(req, config) {
 export function healthReaderOf(req, config) {
     if (!hasServiceAuth(config))
         return "open";
-    return readCredentialOk(req, config) ? "credentialed" : "anonymous";
+    const confined = requestConfinedTier(req, config, declaredPowerOf("GET", "/health")) !== undefined;
+    const credentialed = confined ? systemFor(req, config) !== undefined || traceTokenPresented(req, config) : readCredentialOk(req, config);
+    if (credentialed)
+        return "credentialed";
+    const channel = requestChannelOf(req);
+    switch (channel) {
+        case "control-socket":
+            return "engine-user";
+        case "tcp":
+            return "anonymous";
+        default: {
+            const unknownChannel = channel;
+            throw new Error(`health reader: request channel ${String(unknownChannel)} has no reader tier`);
+        }
+    }
+}
+function credentialAttribution(req, credential, config) {
+    switch (credential) {
+        case "service_token":
+            return systemFor(req, config) ?? null;
+        case "sso":
+            return "sso";
+        default: {
+            const unknownCredential = credential;
+            throw new Error(`credential gate: credential ${String(unknownCredential)} has no attribution`);
+        }
+    }
 }
 function cors(res, req, origins, principalHeader) {
     if (!origins || origins.length === 0)
@@ -120,6 +148,11 @@ export function createDispatch(ctx) {
             const rawBearer = /^Bearer\s/i.test(authz) ? authz.replace(/^Bearer\s+/i, "") : "";
             if (rawBearer && looksLikeJwt(rawBearer)) {
                 const identity = admitBridgeIdentity(await deps.webAdminJwtVerifier.verify(rawBearer), { logger: deps.logger, metrics: deps.metrics });
+                const foreign = identity === undefined ? undefined : ssoForeignScope(identity, deps.config);
+                if (identity !== undefined && foreign !== undefined) {
+                    deps.logger?.warn?.("auth_bridge_scope_refused", { principal: identity.principal, tokenScope: foreign.tokenScope, boundScope: foreign.boundScope });
+                    return systemFor(req, deps.config) === undefined ? "foreign_scope" : undefined;
+                }
                 if (identity) {
                     setSsoPrincipal(req, identity.principal);
                     req.headers[deps.config.principalHeader.toLowerCase()] = identity.principal;
@@ -132,6 +165,7 @@ export function createDispatch(ctx) {
                 }
             }
         }
+        return undefined;
     }
     async function handle(req, res) {
         const startedAt = Date.now();
@@ -193,7 +227,6 @@ export function createDispatch(ctx) {
             const fullBody = {
                 status: "ok",
                 ...(typeof deps.capabilities?.version === "string" ? { version: deps.capabilities.version } : {}),
-                ...healthDrainingKeys(signal),
                 ...(() => {
                     const breakdown = deps.drainState?.inflightBreakdown?.();
                     return breakdown ? { inflight: inflightTotal(breakdown), inflightBreakdown: breakdown } : {};
@@ -209,6 +242,7 @@ export function createDispatch(ctx) {
                             lingerMs: lease.lingerMs,
                             tickMs: lease.tickMs,
                             lane: lease.lane,
+                            attached: lease.attached,
                             ...(fa ? { firstAttach: { windowMs: fa.windowMs, since: fa.since, attachedAt: fa.attachedAt } } : {}),
                             ...(ho ? { handover: { since: ho.since, reason: ho.reason, lingerMs: ho.lingerMs, backgroundShells: ho.backgroundShells } } : {}),
                         },
@@ -294,39 +328,32 @@ export function createDispatch(ctx) {
             res.end(deps.metrics.render());
             return;
         }
-        await attachBridgeIdentity(req);
+        if ((await attachBridgeIdentity(req)) === "foreign_scope") {
+            sendError(res, 403, "auth.scope_mismatch", "forbidden — the sign-in token was issued for a different scope than the one this worker serves: send a sign-in token issued for this worker's scope, or send this request to a worker of your token's scope");
+            return;
+        }
+        const confined = requestConfinedTier(req, deps.config, declaredPowerOf(method, url));
+        if (confined !== undefined) {
+            sendPrincipalConfined(res, confined);
+            return;
+        }
         if (await dispatchSegment(READ_CREDENTIAL_ROUTES, req, res, url, search, method, allow.pre, ctx, (r) => readCredentialOk(r, deps.config)))
             return;
         if (await dispatchSegment(PUBLIC_ROUTES, req, res, url, search, method, allow.pre, ctx, undefined, false))
             return;
         const identitySource = verifiedIdentitySource(req, deps.config);
         admitRunIdentity(req, identitySource, deps.logger);
-        let source = null;
-        const anyServiceAuth = hasServiceAuth(deps.config);
-        if (anyServiceAuth) {
-            switch (identitySource) {
-                case "service_token":
-                    source = systemFor(req, deps.config) ?? null;
-                    break;
-                case "sso":
-                    source = "sso";
-                    break;
-                case "direct_door_jwt":
-                case undefined:
-                    sendUnauthorized(res, "credential");
-                    return;
-                default: {
-                    const unknownSource = identitySource;
-                    throw new Error(`credential gate: identity source ${String(unknownSource)} has no gate row`);
-                }
-            }
+        const credential = passesCredentialGate(identitySource) ? identitySource : undefined;
+        if (credential === undefined && hasServiceAuth(deps.config)) {
+            sendUnauthorized(res, "credential");
+            return;
         }
-        reqState.source = source;
-        if (!anyServiceAuth &&
+        reqState.source = credential === undefined ? null : credentialAttribution(req, credential, deps.config);
+        if (credential === undefined &&
             !deps.config.allowUnauthedWrites &&
             ((req.method === "POST" && (isBillableSubmitPath(url) || url.startsWith("/v1/images/bakes"))) ||
                 isCredentialGatedRewrite(req.method ?? "", url))) {
-            sendError(res, 503, "auth.service_token_required", "this worker requires a service auth token (set SERVICE_AUTH_TOKEN) before accepting task submissions");
+            sendError(res, 503, "auth.service_token_required", "this worker requires a service auth token (set SERVICE_AUTH_TOKEN) or a verified registry sign-in token before accepting task submissions");
             return;
         }
         const billableKind = req.method === "POST" && !isMethodDispatchedSubmitPath(url) ? billableKindOf(url) : undefined;
@@ -337,8 +364,8 @@ export function createDispatch(ctx) {
                 return;
             }
         }
-        if (isDestructiveSessionWrite(req.method ?? "", url) && !anyServiceAuth && !deps.config.allowUnauthedWrites) {
-            sendError(res, 503, "auth.service_token_required", "this worker requires a service auth token (set SERVICE_AUTH_TOKEN) before accepting destructive session writes (policy / sync-import / fork / delete)");
+        if (isDestructiveSessionWrite(req.method ?? "", url) && credential === undefined && !deps.config.allowUnauthedWrites) {
+            sendError(res, 503, "auth.service_token_required", "this worker requires a service auth token (set SERVICE_AUTH_TOKEN) or a verified registry sign-in token before accepting destructive session writes (policy / sync-import / fork / delete)");
             return;
         }
         if (await dispatchSegment(POST_CREDENTIAL_ROUTES, req, res, url, search, method, allow.post, ctx))

package/dist/http/durable-run-leg.js

@@ -1,6 +1,6 @@
 import { uuidv7 } from "@sema-agent/core";
 import { heldWorkflowParkDecisions } from "../parked-decide.js";
-import { runInBackground } from "../runs.js";
+import { createRunAnchorWriter, runInBackground } from "../runs.js";
 import { recheckClaimBeforeLaunch, refusalAfterLostClaim, startClaimHeartbeat } from "./claim-heartbeat.js";
 import { heldFor } from "../peer-seat.js";
 import { fleetRunPublisher, fleetRunLabels, nameFleetRowOnDelivery } from "../fleet/fleet-bus.js";
@@ -11,12 +11,12 @@ import { buildActiveRunConflict } from "./active-run-conflict.js";
 import { commitExecutionContext, faultedAnswerOf } from "./execution-context.js";
 import { rootSessionAbsentAnswer } from "./execution-context.js";
 import { timeClaim } from "./claim-latency.js";
-import { commitSessionInheritEnv } from "./session-inherit-env.js";
+import { commitLegBindings } from "../session-bindings.js";
 import { clearTurnActivity, readTurnActivityMs } from "../turn-activity.js";
 import { recordResourceWindow } from "../resource-window.js";
 import { persistSubmissionCtx, SUBMIT_CTX_CLAIM_LOST } from "./submit-ctx.js";
 import { withdrawClaimedRun } from "./claimed-run.js";
-import { sessionFactsReadOf } from "./owner-access.js";
+import { sessionFactsReadOf, sessionOccupantReadOf } from "./owner-access.js";
 import { createSessionWorkspaceRecorder, sessionWorkspaceStoreOf } from "../session-workspace.js";
 export async function mintAndDriveDurableRun(ctx, runStore, args) {
     const { deps } = ctx;
@@ -82,24 +82,24 @@ async function claimAndCommit(ctx, runStore, args, sessionId, taskId) {
     finally {
         stopPreLaunchHeartbeat();
     }
-    commitSessionInheritEnv(deps, args.prepared.spec.sessionId, args.prepared.body);
+    commitLegBindings(deps, undefined, args.prepared.spec.sessionId, args.prepared.legFacts?.sessionBindings);
     return { holdingLeg: created.legId };
 }
 function launchDurableRun(ctx, runStore, args, sessionId, taskId, trustedInternals, legId) {
     const { deps } = ctx;
     const { inflightRuns, preemptableRuns, steerableRuns } = ctx.registry;
-    const anchorOwner = args.prepared.auth?.subject ?? null;
     const sessionFactsOf = sessionFactsReadOf(deps.sessionStorage);
-    const captureTurnAnchor = deps.resumeAnchorStore && sessionFactsOf
-        ? async (eventId) => {
-            const leaf = (await sessionFactsOf(sessionId))?.leafId;
-            if (leaf)
-                await deps.resumeAnchorStore.put(sessionId, eventId, leaf, anchorOwner);
-        }
-        : undefined;
-    const captureUserMessageAnchor = deps.resumeAnchorStore
-        ? async (entryId) => { await deps.resumeAnchorStore.put(sessionId, taskId, entryId, anchorOwner); }
-        : undefined;
+    const anchors = createRunAnchorWriter({
+        seat: deps.backend?.landedAttendants(),
+        sessionId,
+        owner: args.prepared.auth?.subject ?? null,
+        promptKey: taskId,
+        witness: args.prepared.legFacts?.sessionWitness,
+        occupantOf: sessionOccupantReadOf(deps.sessionStorage),
+        leafOf: sessionFactsOf === undefined ? undefined : async (id) => (await sessionFactsOf(id))?.leafId,
+    });
+    const captureTurnAnchor = anchors.turn;
+    const captureUserMessageAnchor = anchors.prompt;
     const fleetPub = fleetRunPublisher(deps.fleetBus, {
         runId: taskId,
         scope: args.fleetScope,
@@ -113,7 +113,6 @@ function launchDurableRun(ctx, runStore, args, sessionId, taskId, trustedInterna
             coordinator: deps.toolApproval,
             streamApprovalOn: resolveStreamApprovalGate({
                 toolApprovalEnabled: true,
-                streamApprovalEnabled: deps.config.streamApproval?.enabled === true,
                 backend: deps.backend,
                 checkpointStore: deps.checkpointStore,
             }).active,
@@ -122,7 +121,7 @@ function launchDurableRun(ctx, runStore, args, sessionId, taskId, trustedInterna
             declaredFamilies: declaredApprovalFrameFamilies(args.prepared.body.settings),
             origin: approvalLegOriginOf(args.prepared.execution),
         }
-        : undefined, deps.checkpointStore, args.prepared.engineNotices, trustedInternals, deps.userInputLedger, args.prepared.acceptance, createSessionWorkspaceRecorder(sessionWorkspaceStoreOf(deps.sessionStorage), args.prepared.legFacts?.sessionWitness), args.prepared.legFacts?.skills, args.prepared.legFacts?.registeredCwd));
+        : undefined, deps.checkpointStore, args.prepared.engineNotices, trustedInternals, deps.userInputLedger, args.prepared.acceptance, createSessionWorkspaceRecorder(sessionWorkspaceStoreOf(deps.sessionStorage), args.prepared.legFacts?.sessionWitness), args.prepared.legFacts?.skills, args.prepared.legFacts?.sessionBindings.cwd));
     args.runSlot?.release();
     args.prepared.seat.markRecord();
     return { status: 202, body: { taskId, sessionId, status: "running", ...(args.prepared.warnings !== undefined ? { warnings: args.prepared.warnings } : {}) } };

package/dist/http/health-reader.d.ts

@@ -1,12 +1,18 @@
 /**
- * `GET /health` 的**读者分档** —— 同一张面四种读者(k8s / Docker 探针、壳在带凭据之前读的自报位、嵌入宿主的引擎身份验证、持凭运维),
+ * `GET /health` 的**读者分档** —— 同一张面五种读者(k8s / Docker 探针、壳在带凭据之前读的自报位、嵌入宿主的引擎身份验证、同机附着方、持凭运维),
  * 键集按**读者**而不是按「这个键敏不敏感」定。
  *
- * ## 规则(一条)
- * 读者三档,答案只有一处:
+ * ## 律:证明只有两种,判官只有一只
+ * 一次请求的读者能向本服务证明的只有两件事 —— **凭据**(读路谓词 `dispatch.ts` 的 `readCredentialOk`:service token ∨ 只读 trace token ∨ 已验 principal)
+ * 与**通道**(请求从本机控制 socket 进来,`request-channel.ts`:能穿过数据根下私有目录的只有引擎的 OS 用户与 root)。TCP 对端地址**不是**证明 ——
+ * 它说的是包从哪只接口进来,不说包是谁发的(同机反代 / TCP 中继 / 共享绑址上更具体的回环绑定都让它失真),所以没有「回环档」,转发头也不读。
+ * 读者四档,答案只有一处(`dispatch.ts` 的 `healthReaderOf`;本文件只持有闭集与出口):
  *  · `open`        —— 部署没配任何服务凭据(单机 / loopback 开发形;全局凭据门不武装):全键,字节同分档之前;
- *  · `credentialed` —— 配了服务凭据,且这次请求出示了**读路谓词**认的凭据(`dispatch.ts` 的 `readCredentialOk`:service token ∨ 只读 trace token ∨ 已验 principal):全键;
- *  · `anonymous`   —— 配了服务凭据而这次请求没出示:**只拿显式白名单** {@link ANONYMOUS_HEALTH_KEYS}。
+ *  · `credentialed` —— 配了服务凭据,且这次请求出示了**读路谓词**认的凭据:全键;
+ *  · `engine-user`  —— 配了服务凭据、没出示凭据,但请求经**本机控制 socket** 到达:全键。它换来的只是这一面的自描述(本面按构造不带任何秘密),
+ *    **不是凭据**:别的任何口照旧要凭据(通道不进读路谓词、全局门与身份来源闭集 —— 宿主车道上模型跑的命令也是引擎的 OS 用户);
+ *    这是一条显式的披露政策 —— 「引擎的 OS 用户有权读引擎的自描述」;
+ *  · `anonymous`   —— 配了服务凭据,这次请求既没出示凭据、也不是经控制 socket 来的:**只拿显式白名单** {@link ANONYMOUS_HEALTH_KEYS}。
  * 白名单 = 存活位(`status`)+ 壳的 pre-credential 自报位三键(`auth` / `operator` / `center`,`health-self-report.ts` 铸;壳在带凭据**之前**要读的就是它们)。
  * 其余的键 —— 现有的(`dataRoot` / `pid` / `configHash` / `sessionBackend` / `startedAt` / `port` / `version` / `engineSignal` …)与将来新长的 —— 对匿名读者一律不出:
  * 这是**白名单**(挑出四键),不是黑名单(剥掉几键)—— 黑名单形下每个新键默认漏出,这一面又恒在凭据门之前、缺省全网卡监听(安全轴 fail-closed)。
@@ -14,14 +20,15 @@
  * ## 谁读哪一档
  *  · 探针(k8s `httpGet` / Docker `HEALTHCHECK`):只要 HTTP 200 —— 匿名也是 200,存活位在白名单里;摘流语义的探针读 `/readyz`(不分档,体只有就绪位);
  *  · 壳的 pre-credential 读路:`auth` / `operator` / `center` 三键(7.121.0)—— 白名单;
- *  · 嵌入宿主的引擎身份验证(`pid` ∧ `dataRoot`,见 `test/health-identity-contract.test.ts`):宿主就是带着部署的服务凭据起的引擎,身份验证带同一枚凭据读 —— 在 `credentialed` 档;
+ *  · 嵌入宿主的引擎身份验证(`pid` ∧ `dataRoot`,见 `test/health-identity-contract.test.ts`):带部署的服务凭据读 ⇒ `credentialed`;经控制 socket 读 ⇒ `engine-user`;
  *    没配服务凭据的嵌入形(桌面宿主自起、不配凭据)在 `open` 档,与改前逐字节同;
+ *  · 同机附着方(没有令牌的壳 / 桌面宿主附着别的进程起的引擎):经控制 socket 读 ⇒ `engine-user`(读法见 USAGE「同机附着方怎么读身份」);
  *  · 持凭运维 / 编排器:`credentialed` 档,全键。
  *
  * 没有旋钮:一个放宽用的旋钮就是一把「把路径指纹重新开给匿名方」的钥匙,而本规则要的恰是它没有这把钥匙。
  */
-/** 读者三档(闭集;顺序无语义)。 */
-export declare const HEALTH_READERS: readonly ["open", "credentialed", "anonymous"];
+/** 读者四档(闭集;顺序无语义)。 */
+export declare const HEALTH_READERS: readonly ["open", "credentialed", "engine-user", "anonymous"];
 export type HealthReader = (typeof HEALTH_READERS)[number];
 /**
  * 匿名读者的**显式白名单**:存活位 + 自报位三键。穷举 —— 加一个进来是一次有意的、要过评审的放宽(它会对没有凭据的任何人可见)。
@@ -29,7 +36,7 @@ export type HealthReader = (typeof HEALTH_READERS)[number];
  */
 export declare const ANONYMOUS_HEALTH_KEYS: readonly ["status", "auth", "operator", "center"];
 /**
- * 键集判官 —— `/health` 体按读者出口的**唯一**一道:`open` / `credentialed` 原样,`anonymous` 只挑白名单。
+ * 键集判官 —— `/health` 体按读者出口的**唯一**一道:`open` / `credentialed` / `engine-user` 原样,`anonymous` 只挑白名单。
  * 入参是按全键铸好的体(铸点不分读者:一个事实一个铸点,读者分档只在出口);返回新对象,不改入参。
  */
 export declare function projectHealthBody(reader: HealthReader, body: Readonly<Record<string, unknown>>): Readonly<Record<string, unknown>>;

package/dist/http/health-reader.js

@@ -1,9 +1,10 @@
-export const HEALTH_READERS = ["open", "credentialed", "anonymous"];
+export const HEALTH_READERS = ["open", "credentialed", "engine-user", "anonymous"];
 export const ANONYMOUS_HEALTH_KEYS = ["status", "auth", "operator", "center"];
 export function projectHealthBody(reader, body) {
     switch (reader) {
         case "open":
         case "credentialed":
+        case "engine-user":
             return body;
         case "anonymous": {
             const closed = {};

package/dist/http/health-self-report.d.ts

@@ -23,6 +23,9 @@
  *    中心铸的中继令牌,不带 service token)∧ 会话枚举面在(事实 `sessionList`,web 面中继 `GET /v1/sessions`);缺任一 ⇒ `false`。
  *    四件齐时:多租户(`REQUIRE_PRINCIPAL`)每条会话都落着验过的属主 ⇒ `true`;单用户形下一条会话归谁取决于提交它的那次请求带没带
  *    身份(web 面只列调用人自己的会话)—— 部署级答不了 ⇒ `"unknown"`。
+ *  · `center.assertionToken` = web-admin 断言令牌的**声明读数**(配置 `webAdmin.assertionToken`,读口 `center-credential.ts` 的 `readWebAdminCredentialDeclaration`,
+ *    与主凭证同一只判官):`declared` ⇔ 两键之一设了,`absent` ⇔ 都没设;只在接了中心时在场(没接中心的部署不读这一对键,答不了)。只说声明,不说令牌
+ *    有效、也不说引擎向中心出示了它(本版不出示)。
  *
  * ## 无鉴权面
  * `/health` 排在凭据门之前、缺省全网卡监听:本模块只出闭集词、布尔与运维要发布的 URL。两只 URL 值都过 display-safe 律
@@ -33,7 +36,8 @@
  * 所以那一键不是闭集词:调用方不要往里放秘密或人名。
  *
  * ## 在场律
- * 三键**恒在场**;缺席 = 老 worker(≤7.120.x)。`center.issuer` / `center.webBaseUrl` 缺席即缺席(没有鉴权桥 / 没配旋钮),不拼不猜。
+ * 三键**恒在场**;缺席 = 老 worker(≤7.120.x)。`center.issuer` / `center.webBaseUrl` 缺席即缺席(没有鉴权桥 / 没配旋钮),不拼不猜;
+ * `center.assertionToken` 在场 ⇔ 接了中心(接了中心却缺席 = 老 worker)。
  */
 import type { FlatServiceDeps } from "./server.js";
 import { type IdentitySource } from "../identity-source.js";
@@ -43,6 +47,9 @@ export type IdentityAttach = (typeof IDENTITY_ATTACH_WORDS)[number];
 /** `operator` 的词表。 */
 export declare const OPERATOR_PRESENCE_WORDS: readonly ["present", "absent"];
 export type OperatorPresence = (typeof OPERATOR_PRESENCE_WORDS)[number];
+/** `center.assertionToken` 的词表(声明读数:两键之一设了 / 都没设)。 */
+export declare const ASSERTION_TOKEN_DECLARATION_WORDS: readonly ["declared", "absent"];
+export type AssertionTokenDeclaration = (typeof ASSERTION_TOKEN_DECLARATION_WORDS)[number];
 /** `center.sessionsVisible` 的值域(两个布尔 + 一个词;`"unknown"` = 接线齐了,但会话归谁要看提交它的那次请求)。 */
 export declare const SESSIONS_VISIBLE_VALUES: readonly [true, false, "unknown"];
 export type SessionsVisible = (typeof SESSIONS_VISIBLE_VALUES)[number];
@@ -59,6 +66,7 @@ export interface HealthSelfReport {
         readonly issuer?: string;
         readonly webBaseUrl?: string;
         readonly sessionsVisible: SessionsVisible;
+        readonly assertionToken?: AssertionTokenDeclaration;
     };
 }
 /**

package/dist/http/health-self-report.js

@@ -5,6 +5,7 @@ import { centerLaneConfigured } from "../web-admin-client/center-request.js";
 import { buildDisplaySafeUrl } from "../trace/redact.js";
 export const IDENTITY_ATTACH_WORDS = ["available", "unavailable"];
 export const OPERATOR_PRESENCE_WORDS = ["present", "absent"];
+export const ASSERTION_TOKEN_DECLARATION_WORDS = ["declared", "absent"];
 export const SESSIONS_VISIBLE_VALUES = [true, false, "unknown"];
 function carriesCallerIdentity(kind) {
     switch (kind) {
@@ -29,11 +30,12 @@ export function buildHealthSelfReport(deps) {
     const required = kinds.includes("service_token");
     return {
         auth: { required, kinds, identityAttach: kinds.some(carriesCallerIdentity) ? "available" : "unavailable", serviceTokenActsForDeployment: required && serviceTokenDeclaredActsForDeployment(config) },
-        operator: operatorLane(deps).available ? "present" : "absent",
+        operator: operatorLane(deps, "operate").available ? "present" : "absent",
         center: {
             ...(issuer !== undefined ? { issuer: buildDisplaySafeUrl(issuer) } : {}),
             ...(webBaseUrl !== undefined ? { webBaseUrl: buildDisplaySafeUrl(webBaseUrl) } : {}),
             sessionsVisible,
+            ...(config.webAdmin !== undefined ? { assertionToken: config.webAdmin.assertionToken !== undefined ? "declared" : "absent" } : {}),
         },
     };
 }

package/dist/http/owner-access.d.ts

@@ -23,7 +23,7 @@ import type { IncomingMessage, ServerResponse } from "node:http";
 import type { SessionHead, WorkflowRun, WorkflowRunStore } from "@sema-agent/core";
 import type { RunStore, StoreBackend } from "../plugins/store-backend.js";
 import { type Logger } from "../observability/logger.js";
-import type { LatestRunRef, RunListQuery, RunRecord } from "../plugins/store-contracts.js";
+import type { LatestRunRef, RunListQuery, RunRecord, SessionListQuery } from "../plugins/store-contracts.js";
 import type { ServiceConfig } from "../config-types.js";
 import type { SessionAuditReadOpts } from "../audit.js";
 import { type DeploymentShapeInput } from "../deployment-shape.js";
@@ -31,8 +31,8 @@ import { type SessionAgent } from "../session-agent.js";
 import { type SessionFace } from "../session-incarnation.js";
 import { type Admitted, type Caller, type FaceId, type ListFaceId, type ListFilter, type OwnedReading, type Qual, type RunFaceId, type SessionFaceId, type WorkflowFaceId } from "../owner-faces.js";
 import { type Person, type Subject } from "../owner-brands.js";
-import { type OwnerAwareSessionStore } from "../security.js";
-import { type OperatorRoster } from "./principal-gate.js";
+import { type OwnerAwareSessionStore, type SessionListItem } from "../security.js";
+import type { OperatorRoster } from "../operator-roster.js";
 import { type RouteDeps } from "./route-ctx.js";
 import type { FlatServiceDeps } from "./server.js";
 import type { AgentRosterRouteId } from "./routes/agents-roster.js";
@@ -96,9 +96,8 @@ export declare const ROUTE_FACES: {
     readonly "run-task-stop": "run.supervise";
     readonly "elicitation-respond": null;
     readonly "question-respond": null;
-    readonly "tool-approval-respond": null;
-    readonly "tool-approval-read": null;
     readonly "task-ask-decision": null;
+    readonly "task-ask-read": null;
     readonly "run-permission-mode": "run.supervise";
     readonly "run-memory-capture-optout": "run.drive";
     readonly "session-init": null;
@@ -427,10 +426,15 @@ export declare function admitSessionById(entry: Entry, res: ServerResponse, stor
  */
 export declare function readVisibleSession(entry: Entry, store: SessionGateStore, sessionId: string): Promise<Admitted<SessionHead> | undefined>;
 /**
- * 承认之后的**世代围栏**(会话事件流的心跳拍):这只会话此刻的属主还是承认时读到的那一格吗 —— 删了(没有这一行 / 读不出按面折)或换主 ⇒ 否。
- * 与 {@link readVisibleSession} 的「再判可见」不同:比的是同一行前后两次读到的属主(删建 / 易主 ⇒ 作废),两侧都是行上的属主,不是调用方身份。
+ * 承认之后的**世代围栏**(会话事件流的心跳拍):这只会话此刻的住客还是承认时读到的那一位吗 —— 删了(没有这一行 / 读不出按面折)、删后同 id 重建(包括同一属主)
+ * 或换主 ⇒ 否。比较器 = 住客复核的唯一判 `sameOccupant`(属主 ∧ 化身);与 {@link readVisibleSession} 的「再判可见」不同:两侧都是同一行前后两次的住客读数,不是调用方身份。
  */
-export declare function sessionOwnerUnchanged(entry: Entry, store: SessionGateStore, sessionId: string, admittedOwner: string | null): Promise<boolean>;
+export declare function sessionOccupantUnchanged(entry: Entry, store: SessionGateStore, sessionId: string, admitted: Pick<SessionHead, "owner" | "incarnation">): Promise<boolean>;
+/**
+ * 同步族门读之后的**住客复判**(律在 `routes/session-sync.ts` 门注「门后读」):门承认过的那一位此刻还占着这只 id 吗 —— 同一只比较器 `sameOccupant`,读法是门的两种读法之一:
+ * `pull` = 活行头(拉取口只认活行);`push` = 占位头(活行 ∪ 在删行,与门同一只 `deletionHeadReadOf`)。此刻无行 ⇒ 不是。只在门判**有住客**时调(门判空闲的口门后不读会话数据)。
+ */
+export declare function recheckSyncGate(store: DeletionGateStore, sessionId: string, admitted: SessionFace, port: "pull" | "push"): Promise<boolean>;
 /** 会话行的完整判(不下发,交回承认 / `undefined`):两读之间要再判一次的口(同步导入的提交前复判)与「看不见按自己的形答」的口用。 */
 export declare function judgeSession<T extends OwnedReading>(entry: Entry, store: PlacementReadingStore | undefined, sessionId: string, reading: T): Promise<Admitted<T> | undefined>;
 /** 这一份承认里的调用方是 fleet 吗(本口 `fleet` 列里的一格成立):fork 新属主「继承源属主」那一支读它。 */
@@ -489,6 +493,11 @@ export interface SessionFacts {
  * 读者:回退锚的逐轮捕获(两条起跑腿读叶子)、失认领答复的「会话在不在」(不碰叶子)、同步拉取清单的当前叶子。
  */
 export declare function sessionFactsReadOf(store: Pick<OwnerAwareSessionStore, "headOf"> | undefined): ((sessionId: string) => Promise<SessionFacts | undefined>) | undefined;
+/**
+ * 会话此刻的住客(属主 + 化身,同一行同一次头读,经 {@link sessionFaceOfHead} 投影 —— 活行上读到空化身响亮拒)。读者:运行腿的回退锚写座在见证里还没有化身时
+ * 钉住这条 run 自己的那一位(`runs.ts` 的 `createRunAnchorWriter`;调用发生在 run 在跑、认领在手的时刻)。店不交头读 ⇒ `undefined`。
+ */
+export declare function sessionOccupantReadOf(store: Pick<OwnerAwareSessionStore, "headOf"> | undefined): ((sessionId: string) => Promise<SessionFace | undefined>) | undefined;
 /**
  * 会话在委派树里的位置(wire 键 `agent` 的值;唯一读口):店的 placed 位一读 → `session-agent.ts` 的 `sessionAgentOf`(元组不带属主)。店不交这一面 ⇒ `undefined`
  * (这台部署不存元组,不探)。探针抛 ⇒ 原样上抛 —— 读不出怎么说归读者(视图读响亮失败;队列只缺那一行的键并计数),本函数不替任何一面把故障说成「不是子代」。
@@ -509,10 +518,16 @@ export declare function engineRulesKeyOf(store: Pick<OwnerAwareSessionStore, "he
  * 读者:会话面板的上一腿(面 `run.panel`,看不见 = 不投那个键)。
  */
 export declare function readVisibleLatestRun(entry: Entry, store: Pick<RunStore, "latestRunForSession">, sessionId: string): Promise<LatestRunRef | undefined>;
-/** run 列表的属主过滤参数(一只派生,读与游标指纹同读):视域钉住一位主体 ⇒ 强制那一位(调用方点名的 `owner` 不算);不钉人(fleet)⇒ 点名的照用(运维视图)。 */
-export declare function runListOwnerOf(filter: ListFilter, named: string | undefined): string | undefined;
-/** run 列表的读口(列表面 `list.read`):过滤参数由 {@link runListOwnerOf} 从视域派生,只在这里落成店的过滤参数。 */
+/** 列表的属主过滤参数(run 列表与会话列表同一只派生,读与游标指纹同读):视域钉住一位主体 ⇒ 强制那一位(调用方点名的 `owner` 不算);不钉人(fleet)⇒ 点名的照用(运维视图)。 */
+export declare function listOwnerOf(filter: ListFilter, named: string | undefined): string | undefined;
+/** run 列表的读口(列表面 `list.read`):过滤参数由 {@link listOwnerOf} 从视域派生,只在这里落成店的过滤参数。 */
 export declare function listVisibleRuns(store: Pick<RunStore, "listRuns">, filter: ListFilter, named: string | undefined, query: Omit<RunListQuery, "owner">): Promise<RunRecord[]>;
+/**
+ * 会话列表的读口(列表面 `session.list`;`GET /v1/sessions`):「读 + 过滤」只在这里落成店的过滤参数 —— 属主(由 {@link listOwnerOf} 从视域派生;`""` 是合法的精确属主,
+ * 只有「没给」才不过滤)、无主行的并入(视域的 `includeUnowned`)、视图(`sessionKind`,律 `session-kind.ts`:缺席 = 缺省视图)。谓词都打在店里(同一条 SELECT),
+ * 路由层不另滤行。peer 目录读同一只 lister 的缺省视图(`peer-directory.ts`)。
+ */
+export declare function listVisibleSessions(lister: (opts: SessionListQuery) => Promise<SessionListItem[]>, filter: ListFilter, named: string | undefined, query: Omit<SessionListQuery, "owner" | "includeUnowned">): Promise<SessionListItem[]>;
 /** 审批 / 助手面按停驻 scope 列 run:属主过滤 = scope 的属主键(公共 scope `_` ⇒ 属主为 null 的 run,主体 ⇒ 恰它的;`security.ts` 的唯一编解码),只在这里落成店的过滤参数。 */
 export declare function listRunsOfScope(store: Pick<RunStore, "listRuns">, scope: string, limit: number): Promise<RunRecord[]>;
 /** 一把提交钥匙命中的行对这位调用方算什么:`visible` = 读得到的那一行;`occupied` = 有行但不是这次提交拿得到的(看不见 / 自带 taskId 而键指着别的行)—— 回执 409,不回显那一行。 */
@@ -602,14 +617,18 @@ export interface WorkflowAdmission {
 /** 工作流门的一次判(不下发):承认,或拒因(没有 / 前门 / 看不见 / 会话断言不符)。 */
 export type WorkflowVerdict = WorkflowAdmission | "missing" | "door" | "not_visible" | "session_mismatch";
 /**
- * 工作流列表(`GET /v1/workflows`)—— 属主过滤只在这里落成店参数:调用方换成它的引擎身份(与 {@link judgeWorkflowRun} 同一只换算),店按 `scope` 列筛。
+ * 🔴 **一位调用方的工作流行住在 `scope` 列的哪一格**(唯一读法):调用方的主体换成它的引擎身份(`engine-identity.ts` 的 `engineScopeOf` —— 引擎按它写 scope:
+ * 带场景的请求今天是那个人,匿名是 `"default"`)。列表({@link listVisibleWorkflows})、按 id 的门({@link judgeWorkflowRun})与舰队流的工作流行 / 终态窗(`routes/fleet.ts`)同读这一只。
+ */
+export declare function workflowScopeOf(subject: Subject | undefined): string;
+/**
+ * 工作流列表(`GET /v1/workflows`)—— 属主过滤只在这里落成店参数:{@link workflowScopeOf},店按 `scope` 列筛。
  * 面表 `workflow.read` 只给属主(不放 fleet / 运维)⇒ 列表 = 调用方自己那一格的行。
  */
 export declare function listVisibleWorkflows(entry: Entry, store: Pick<WorkflowRunStore, "listByScope">, opts: Parameters<WorkflowRunStore["listByScope"]>[1]): ReturnType<WorkflowRunStore["listByScope"]>;
 /**
  * 🔴 **工作流行的判(唯一一处;[ref] 第二阶段)**:按 id 读一行(店的 `get`,不带 scope —— 修前是 core 按 scope 读 + 路由再比一次 scope,两读答同一问),
- * 行格 = `scope` 列的属主键(引擎写下的引擎身份,恒有主);调用方一侧换成它的引擎身份(`engine-identity.ts` 的 `engineScopeOf`:引擎按它写 scope ——
- * 带场景的请求是那个人,匿名是 `"default"`)再过事实函数 {@link qualsOf} + 面表;前门按这次请求的调用方判。承认之后按 {@link WORKFLOW_SESSION_ASSERTION} 判会话断言。
+ * 行格 = `scope` 列的属主键(引擎写下的引擎身份,恒有主);调用方一侧换成它的引擎身份({@link workflowScopeOf})再过事实函数 {@link qualsOf} + 面表;前门按这次请求的调用方判。承认之后按 {@link WORKFLOW_SESSION_ASSERTION} 判会话断言。
  */
 export declare function judgeWorkflowRun(entry: Entry, store: Pick<WorkflowRunStore, "get">, runId: string): Promise<WorkflowVerdict>;
 /** 工作流按 id 读面的门:没有 / 看不见 / 会话断言不符同一只投影(`workflow_missing`),前门经它的下发口。交回承认或 `undefined`(已应答)。 */