@sema-agent/server 7.150.0 → 7.152.0

package/dist/boot/stage-06-runners.d.ts

@@ -1,6 +1,8 @@
 import { Runner } from "@sema-agent/core";
+import { type DeploymentPlaneDeps, type DeploymentPlaneLane } from "./runner-deps.js";
 import type { runStage05 } from "./stage-05-execution-env.js";
 export declare function runStage06(ctx: Awaited<ReturnType<typeof runStage05>>): Promise<{
+    deploymentPlane: (lane: DeploymentPlaneLane) => DeploymentPlaneDeps;
     sessionEraser: import("../session-erase.js").SessionEraser | undefined;
     settleErasedSessions: import("../session-erase.js").SessionEraseSettler;
     approvalAskAudit: import("../approval-ask-audit-store.js").FileApprovalAskAuditStore | undefined;
@@ -34,7 +36,7 @@ export declare function runStage06(ctx: Awaited<ReturnType<typeof runStage05>>):
     sendUserFileToolSpec: import("@sema-agent/core").ToolSpec<import("@sema-agent/core").TSchema> | undefined;
     sessionTitler: import("../session-titler.js").SessionTitler | undefined;
     sharedMemoryStore: import("../plugins/shared-memory-store-sql.js").SqlSharedMemoryStore | undefined;
-    sqlWorkflowRunStore: import("@sema-agent/core").WorkflowRunStore | undefined;
+    sqlWorkflowRunStore: import("../plugins/workflow-run-store-sql.js").SqlWorkflowRunStore | undefined;
     streamApprovalGate: import("../tool-approval.js").StreamApprovalGate<import("../approval-gate-currency.js").GateCurrencyStore>;
     subRunner: Runner;
     subagentSteerRegistry: import("../orchestration/subagent-steer.js").SubagentSteerRegistry;
@@ -45,6 +47,7 @@ export declare function runStage06(ctx: Awaited<ReturnType<typeof runStage05>>):
     workflowJournalStore: import("../plugins/store-backend.js").ServiceWorkflowJournalStore | undefined;
     workflowModelAllowlistSnapshot: readonly string[];
     workflowParkDecisions: import("../orchestration/workflow-park-decision.js").WorkflowParkDecisionStore | undefined;
+    workflowParkHolderPull: (() => Promise<import("../orchestration/workflow-park-holder.js").HolderPullTally>) | undefined;
     workflowNotifyGate: import("../orchestration/workflow-notify-journal.js").WorkflowNotifyGate | undefined;
     workflowNotifyJournal: import("../orchestration/workflow-notify-journal.js").WorkflowNotifyJournalStore | undefined;
     workflowRecoverOpts: {
@@ -73,10 +76,12 @@ export declare function runStage06(ctx: Awaited<ReturnType<typeof runStage05>>):
     perSessionCwd: Map<string, string>;
     perTaskImage: import("../per-task-image.js").PerTaskImageRegistry;
     sendUserFileTaskEnvs: import("../capabilities/sandbox-file-send.js").TaskEnvRegistry | undefined;
+    sessionBindings: {
+        commitSessionBindings: (sessionId: string, bindings: import("../session-bindings.js").SessionBindings) => import("../session-bindings.js").SessionBindingReceipt;
+        withdrawSessionBindings: (receipt: import("../session-bindings.js").SessionBindingReceipt) => boolean;
+        settleSessionBindings: (receipt: import("../session-bindings.js").SessionBindingReceipt) => boolean;
+    };
     sessionEnvSelection: import("../capabilities/select-environment-tool.js").SessionEnvironmentSelection;
-    setSessionCwd: (sid: string, cwd: string) => void;
-    setSessionInheritEnv: (sid: string, policy: import("../request-value-closure.js").TaskInheritEnv | undefined) => void;
-    setSessionShellEnv: (sid: string, env: Record<string, string>) => void;
     worktreeReap: (() => Promise<void>) | undefined;
     brain: import("@sema-agent/core").Brain;
     consolidationSeatWatch: import("./memory-consolidation.js").ConsolidationSeatWatch | undefined;

package/dist/boot/stage-06-runners.js

@@ -3,11 +3,13 @@ import { Runner, InMemoryToolResultStore, TtlSessionStore, uuidv7, createAllowDe
 import { createEngineSessionRulesSeat } from "../session-rules-seat.js";
 import { outwardPlane } from "../terminal.js";
 import { createSessionTitler } from "../session-titler.js";
+import { createPerModelAuthSeat } from "./side-query-lane.js";
+import { sessionOccupantReadOf } from "../http/owner-access.js";
 import { cardRuleScopeRoot } from "../task-cwd.js";
 import { ForkRoutingSessionStore } from "../plugins/fork-routing-session-store.js";
 import { withoutHands } from "../capabilities/hands-lane.js";
 import { isBrandedDeployment } from "../capabilities/brand-identity.js";
-import { hasServiceAuth } from "../identity-source.js";
+import { DEPLOYMENT_SHAPE_PREDICATES } from "../deployment-shape.js";
 import { workflowModelAllowlistFor } from "../task-workflow.js";
 import { createHookLlm, buildHookFailureText } from "../hooks/hook-llm.js";
 import { assertRetentionLaneWirable } from "./retention-lane.js";
@@ -20,22 +22,29 @@ import { CHECKPOINT_CTX_SEALING_REQUIRED } from "../http/checkpoint-ctx.js";
 import { sealCheckpointCtxCredentialsM28 } from "../checkpoint-ctx-seal-m28.js";
 import { retirePromptProfileM30 } from "../stored-request-prompt-profile-m30.js";
 import { createRuntimeCaps } from "./runtime-caps.js";
-import { createEngineNoticeForwarder, createRunnerDeps, createSharedRunnerDeps, localOwnerRulesDeclared } from "./runner-deps.js";
+import { createDeploymentPlaneDeps, createEngineNoticeForwarder, createRunnerDeps, createSharedRunnerDeps, localOwnerRulesDeclared } from "./runner-deps.js";
 import { defaultEngineNoticeRouter } from "../trace/engine-notice-wire.js";
 import { createOrgMemoryAdmissionWiring } from "./org-memory.js";
 import { createGovernanceSeams } from "./governance-seams.js";
 import { createSharedMemoryScopeAuthorizer } from "../shared-memory-scope-authorizer.js";
 import { mountOrgDeliveryGate } from "./org-delivery.js";
-import { parkedAskRedeem, runStore } from "./late-binds.js";
+import { parkedAskRedeem, runEndedHandoff, runStore } from "./late-binds.js";
+import { createWorkflowParkHolderPull } from "../orchestration/workflow-park-holder.js";
 import { withInternalRunEnvs } from "../internal-run-env.js";
 import { retentionSweepRuns } from "../plugins/retention-declaration.js";
 import { createOperatorFaceIncidentSink } from "../memory-incident-sink.js";
 export async function runStage06(ctx) {
     const { backend, backgroundAgentStore, brain, engineDataRoot, peerDesk, config, webAdmin, consolidationValve, deploymentMods, executionEnvFactory, fileHistoryStore, localRoot, logger, lspManager, mailboxRecipientLifecycle, mailboxStore, memoryEngine, memorySyncRunner, metrics, perSessionCwd, permissionRuleProvider, pricing, rosterStore, ruleConsent, sendUserFileTaskEnvs, sessionCaptureRecords, sessionPolicyStore, sessionStore, spaceReclaimer, taskAttachmentStore, taskListLane, toolResultStore, tracer, usageWindowStore } = ctx;
-    const { sqlWorkflowRunStore, workflowNotifyJournal, workflowCompletionInbox, deliverWorkflowCompletion, workflowNotifyGate, fleetBus, workflowRunStore, workflowJournalStore, outcomeSink, workflowRecoverOpts, workflowAgentRegistry, subagentSteerRegistry, workflowAgentSessionIndex, workflowParkDecisions, } = createWorkflowOrchestration({ config, logger, metrics, localRoot, backend, getRunStore: () => runStore });
+    const { sqlWorkflowRunStore, workflowNotifyJournal, workflowCompletionInbox, deliverWorkflowCompletion, workflowNotifyGate, fleetBus, workflowRunStore, workflowJournalStore, outcomeSink, workflowRecoverOpts, workflowAgentRegistry, subagentSteerRegistry, workflowAgentSessionIndex, workflowParkDecisions, heldParksHere, } = createWorkflowOrchestration({ config, logger, metrics, localRoot, backend, getRunStore: () => runStore, getRunEndedHandoff: () => runEndedHandoff });
+    backend?.bindWorkflowRunReader?.(workflowRunStore ?? "none");
+    const cardScopeRootOf = (sessionId) => cardRuleScopeRoot(sessionId !== undefined ? perSessionCwd.get(sessionId) : undefined, config);
+    backend?.bindCardScopeRoot?.(cardScopeRootOf);
     const parkCommitted = backend?.checkpoint && config.durableApproval ? createParkCommitWatch(backend.checkpoint(logger)) : undefined;
     const checkpointStore = parkCommitted?.store;
     const parkCommits = parkCommitted?.watch;
+    const workflowParkHolderPull = heldParksHere !== undefined && workflowParkDecisions !== undefined && workflowAgentSessionIndex !== undefined && workflowRunStore !== undefined && checkpointStore !== undefined
+        ? createWorkflowParkHolderPull({ held: heldParksHere, decisions: workflowParkDecisions, checkpointStore, workflowAgentSessionIndex, workflowRunStore, warn: (event, fields) => logger.warn(event, fields) })
+        : undefined;
     const checkpointCtxSealing = webAdmin.checkpointCtxSealing;
     if (checkpointStore !== undefined) {
         if (checkpointCtxSealing === undefined)
@@ -50,7 +59,7 @@ export async function runStage06(ctx) {
         config, logger, backend, sendUserFileTaskEnvs, ruleConsent, parkCommits,
         ...(checkpointStore !== undefined ? { checkpointStore } : {}),
         getParkedRedeem: () => parkedAskRedeem,
-        ruleScopeRootFor: (sessionId) => cardRuleScopeRoot(sessionId !== undefined ? perSessionCwd.get(sessionId) : undefined, config),
+        ruleScopeRootFor: cardScopeRootOf,
     });
     if (streamApprovalGate.active)
         await assertApprovalAskRuleMaterialOnBackend(backend);
@@ -115,7 +124,7 @@ export async function runStage06(ctx) {
         : undefined;
     for (const w of buildConsolidationValveAudit({
         valve: consolidationValve,
-        hasServiceAuth: hasServiceAuth(config),
+        credentialGateSource: DEPLOYMENT_SHAPE_PREDICATES.credentialGateSource.holds(config),
         allowUnauthedWrites: config.allowUnauthedWrites ?? false,
     }).warnings) {
         logger.warn(w.tag, { detail: w.detail });
@@ -158,11 +167,13 @@ export async function runStage06(ctx) {
         const pick = hookModelFor(model);
         if (!pick.ok)
             return pick;
+        const resolver = webAdmin.getKeyResolver();
         try {
             const result = await hookAgentRunner.runTask({
                 objective: prompt,
                 sessionId: uuidv7(),
                 model: pick.catalogRef,
+                getApiKeyAndHeaders: createPerModelAuthSeat(() => resolver),
                 ...(system !== undefined ? { systemPrompt: system } : {}),
                 handsReadOnly: true,
                 enableFork: false,
@@ -186,9 +197,11 @@ export async function runStage06(ctx) {
     };
     const clipHookErr = (s) => (s ?? "").slice(0, 300);
     const titleCapable = sessionStore;
-    const sessionTitler = config.sessionAutoTitle && titleCapable.setTitleIfNull && titleCapable.probeTitle
+    const titleOccupantOf = sessionOccupantReadOf(sessionStore);
+    const sessionTitler = config.sessionAutoTitle && titleCapable.setTitleIfNull && titleCapable.probeTitle && titleOccupantOf
         ? createSessionTitler({
             setTitleIfNull: titleCapable.setTitleIfNull.bind(sessionStore),
+            occupantOf: titleOccupantOf,
             probeTitle: titleCapable.probeTitle.bind(sessionStore),
             llm: hookLlm,
             logger,
@@ -226,15 +239,17 @@ export async function runStage06(ctx) {
             sharedMemoryStores: sharedMemoryStore ? sharedMemoryStore : undefined,
             engineDataRoot,
             peerDesk,
+            runtimeCapsResolver,
+            onError: runnerDeps.onError,
         }),
         sessionStore: subRunnerSessions,
         onBackgroundChildEvent: runnerDeps.onBackgroundChildEvent ? runnerDeps.onBackgroundChildEvent : undefined,
         loadProjectMemory: runnerDeps.loadProjectMemory ? runnerDeps.loadProjectMemory : undefined,
         probeInstructionSources: runnerDeps.probeInstructionSources ? runnerDeps.probeInstructionSources : undefined,
-        onError: runnerDeps.onError ? runnerDeps.onError : undefined,
     };
     const subRunner = new Runner(subRunnerDeps);
+    const deploymentPlane = (lane) => createDeploymentPlaneDeps({ config, logger, metrics, brain, pricing, tracer, promptSource: webAdmin.promptSource, deploymentMods, usageWindowStore, governanceSeams, mcpRevocations, engineDataRoot, runtimeCapsResolver, onError: runnerDeps.onError }, lane);
     const settleErasedSessions = createSessionEraseSettler({ attachments: taskAttachmentStore, spaceReclaimer, logger });
-    return { ...ctx, sessionEraser, settleErasedSessions, approvalAskAudit, approvalExemptionStore, centerRuntimeCapsResolver, checkpointStore, checkpointCtxSealing, parkCommits, durableEnabled, elicitation, fleetBus, governanceSeams, handslessRunner, hookAgent, hookAgentRunner, hookLlm, mcpRevocations, memoryConsolidationFaces, memoryOptOutGrantStore, orgMemoryAdmission, outcomeSink, principalCaps, question, retentionExecutor, retentionLaneStore, runner, runnerDeps, runtimeCapsPeekReading, sendFileLedger, sendUserFileEmitter, sendUserFileToolSpec, sessionTitler, sharedMemoryStore, sqlWorkflowRunStore, streamApprovalGate, subRunner, subagentSteerRegistry, toolApproval, workflowAgentRegistry, workflowAgentSessionIndex, workflowCompletionInbox, workflowJournalStore, workflowModelAllowlistSnapshot, workflowParkDecisions, workflowNotifyGate, workflowNotifyJournal, workflowRecoverOpts, workflowRunStore, workflowsCapable, orgDeliveryGate };
+    return { ...ctx, deploymentPlane, sessionEraser, settleErasedSessions, approvalAskAudit, approvalExemptionStore, centerRuntimeCapsResolver, checkpointStore, checkpointCtxSealing, parkCommits, durableEnabled, elicitation, fleetBus, governanceSeams, handslessRunner, hookAgent, hookAgentRunner, hookLlm, mcpRevocations, memoryConsolidationFaces, memoryOptOutGrantStore, orgMemoryAdmission, outcomeSink, principalCaps, question, retentionExecutor, retentionLaneStore, runner, runnerDeps, runtimeCapsPeekReading, sendFileLedger, sendUserFileEmitter, sendUserFileToolSpec, sessionTitler, sharedMemoryStore, sqlWorkflowRunStore, streamApprovalGate, subRunner, subagentSteerRegistry, toolApproval, workflowAgentRegistry, workflowAgentSessionIndex, workflowCompletionInbox, workflowJournalStore, workflowModelAllowlistSnapshot, workflowParkDecisions, workflowParkHolderPull, workflowNotifyGate, workflowNotifyJournal, workflowRecoverOpts, workflowRunStore, workflowsCapable, orgDeliveryGate };
 }
 //# sourceMappingURL=stage-06-runners.js.map

package/dist/boot/stage-07-capability-layer.d.ts

@@ -24,6 +24,7 @@ export declare function runStage07(ctx: Awaited<ReturnType<typeof runStage06>>):
     userInputLedger: import("../user-input-ledger.js").UserInputLedger | undefined;
     userInputLedgerStore: import("../user-input-ledger.js").UserInputLedgerStore | undefined;
     webSearchProvider: "brave" | "tavily" | "searxng" | undefined;
+    deploymentPlane: (lane: import("./runner-deps.js").DeploymentPlaneLane) => import("./runner-deps.js").DeploymentPlaneDeps;
     sessionEraser: import("../session-erase.js").SessionEraser | undefined;
     settleErasedSessions: import("../session-erase.js").SessionEraseSettler;
     approvalAskAudit: import("../approval-ask-audit-store.js").FileApprovalAskAuditStore | undefined;
@@ -56,7 +57,7 @@ export declare function runStage07(ctx: Awaited<ReturnType<typeof runStage06>>):
     sendUserFileToolSpec: import("@sema-agent/core").ToolSpec<import("@sema-agent/core").TSchema> | undefined;
     sessionTitler: import("../session-titler.js").SessionTitler | undefined;
     sharedMemoryStore: import("../plugins/shared-memory-store-sql.js").SqlSharedMemoryStore | undefined;
-    sqlWorkflowRunStore: import("@sema-agent/core").WorkflowRunStore | undefined;
+    sqlWorkflowRunStore: import("../plugins/workflow-run-store-sql.js").SqlWorkflowRunStore | undefined;
     streamApprovalGate: import("../tool-approval.js").StreamApprovalGate<import("../approval-gate-currency.js").GateCurrencyStore>;
     subRunner: import("@sema-agent/core").Runner;
     subagentSteerRegistry: import("../orchestration/subagent-steer.js").SubagentSteerRegistry;
@@ -67,6 +68,7 @@ export declare function runStage07(ctx: Awaited<ReturnType<typeof runStage06>>):
     workflowJournalStore: import("../plugins/store-backend.js").ServiceWorkflowJournalStore | undefined;
     workflowModelAllowlistSnapshot: readonly string[];
     workflowParkDecisions: import("../orchestration/workflow-park-decision.js").WorkflowParkDecisionStore | undefined;
+    workflowParkHolderPull: (() => Promise<import("../orchestration/workflow-park-holder.js").HolderPullTally>) | undefined;
     workflowNotifyGate: import("../orchestration/workflow-notify-journal.js").WorkflowNotifyGate | undefined;
     workflowNotifyJournal: import("../orchestration/workflow-notify-journal.js").WorkflowNotifyJournalStore | undefined;
     workflowRecoverOpts: {
@@ -95,10 +97,12 @@ export declare function runStage07(ctx: Awaited<ReturnType<typeof runStage06>>):
     perSessionCwd: Map<string, string>;
     perTaskImage: import("../per-task-image.js").PerTaskImageRegistry;
     sendUserFileTaskEnvs: import("../capabilities/sandbox-file-send.js").TaskEnvRegistry | undefined;
+    sessionBindings: {
+        commitSessionBindings: (sessionId: string, bindings: import("../session-bindings.js").SessionBindings) => import("../session-bindings.js").SessionBindingReceipt;
+        withdrawSessionBindings: (receipt: import("../session-bindings.js").SessionBindingReceipt) => boolean;
+        settleSessionBindings: (receipt: import("../session-bindings.js").SessionBindingReceipt) => boolean;
+    };
     sessionEnvSelection: import("../capabilities/select-environment-tool.js").SessionEnvironmentSelection;
-    setSessionCwd: (sid: string, cwd: string) => void;
-    setSessionInheritEnv: (sid: string, policy: import("../request-value-closure.js").TaskInheritEnv | undefined) => void;
-    setSessionShellEnv: (sid: string, env: Record<string, string>) => void;
     worktreeReap: (() => Promise<void>) | undefined;
     brain: import("@sema-agent/core").Brain;
     consolidationSeatWatch: import("./memory-consolidation.js").ConsolidationSeatWatch | undefined;

package/dist/boot/stage-07-capability-layer.js

@@ -33,6 +33,7 @@ import { buildDisplaySafeUrl } from "../trace/redact.js";
 import * as facts from "../capability-facts.js";
 import { WEB_ADMIN_ENV } from "@sema-agent/settings-schema";
 import { seatText } from "../trace/exit-seat.js";
+import { hasServiceAuth } from "../identity-source.js";
 export async function runStage07(ctx) {
     const { approvalAskAudit, approvalExemptionStore, backend, backgroundAgentStore, brain, checkpointStore, config, webAdmin, counterDegradeHook, peerDesk, durableEnabled, instanceId, localRoot, logger, question, runner, runnerDeps, sendUserFileToolSpec, sessionEnvSelection, sessionStore, subRunner, taskListLane, toolApproval } = ctx;
     const authorize = createAuthorizer(config, sessionStore, logger);
@@ -93,7 +94,7 @@ export async function runStage07(ctx) {
         ? selectEnvironmentTool({
             catalog: imageIndex,
             selection: sessionEnvSelection,
-            viewerFor: (principal) => ({ operator: explicitOperatorOk(principal === undefined ? undefined : personOf(recoveredSubject(principal)), config), tenantId: principal ?? null }),
+            viewerFor: (principal) => ({ operator: explicitOperatorOk(principal === undefined ? undefined : personOf(recoveredSubject(principal)), config, "operate"), tenantId: principal ?? null }),
         })
         : undefined;
     const imageBakes = backend?.imageBake && config.imageBakes.enabled ? backend.imageBake() : undefined;
@@ -149,7 +150,7 @@ export async function runStage07(ctx) {
         if (inert)
             logger.warn(inert.event, inert.fields);
     }
-    if (config.requirePrincipal && !config.authToken && Object.keys(config.authTokens ?? {}).length === 0 && !config.traceToken)
+    if (config.requirePrincipal && !hasServiceAuth(config) && !config.traceToken)
         logger.warn("multi_tenant_no_service_token", { detail: "REQUIRE_PRINCIPAL is on but no SERVICE_AUTH_TOKEN/authTokens/TRACE_TOKEN — fleet/trace/session-list are owner-gated only (never fleet-wide, tenant-isolation safe). Set a token for cross-tenant ops visibility." });
     const rateLimiter = backend?.rateLimiter
         ? backend.rateLimiter(config.rateLimitPerMin, counterDegradeHook).startRefresh()

package/dist/boot/stage-08-reapers.d.ts

@@ -37,6 +37,7 @@ export declare function runStage08(ctx: Awaited<ReturnType<typeof runStage07>>):
     userInputLedger: import("../user-input-ledger.js").UserInputLedger | undefined;
     userInputLedgerStore: import("../user-input-ledger.js").UserInputLedgerStore | undefined;
     webSearchProvider: "brave" | "tavily" | "searxng" | undefined;
+    deploymentPlane: (lane: import("./runner-deps.js").DeploymentPlaneLane) => import("./runner-deps.js").DeploymentPlaneDeps;
     sessionEraser: import("../session-erase.js").SessionEraser | undefined;
     settleErasedSessions: import("../session-erase.js").SessionEraseSettler;
     approvalAskAudit: import("../approval-ask-audit-store.js").FileApprovalAskAuditStore | undefined;
@@ -69,7 +70,7 @@ export declare function runStage08(ctx: Awaited<ReturnType<typeof runStage07>>):
     sendUserFileToolSpec: import("@sema-agent/core").ToolSpec<import("@sema-agent/core").TSchema> | undefined;
     sessionTitler: import("../session-titler.js").SessionTitler | undefined;
     sharedMemoryStore: import("../plugins/shared-memory-store-sql.js").SqlSharedMemoryStore | undefined;
-    sqlWorkflowRunStore: import("@sema-agent/core").WorkflowRunStore | undefined;
+    sqlWorkflowRunStore: import("../plugins/workflow-run-store-sql.js").SqlWorkflowRunStore | undefined;
     streamApprovalGate: import("../tool-approval.js").StreamApprovalGate<import("../approval-gate-currency.js").GateCurrencyStore>;
     subRunner: Runner;
     subagentSteerRegistry: import("../orchestration/subagent-steer.js").SubagentSteerRegistry;
@@ -80,6 +81,7 @@ export declare function runStage08(ctx: Awaited<ReturnType<typeof runStage07>>):
     workflowJournalStore: import("../plugins/store-backend.js").ServiceWorkflowJournalStore | undefined;
     workflowModelAllowlistSnapshot: readonly string[];
     workflowParkDecisions: import("../orchestration/workflow-park-decision.js").WorkflowParkDecisionStore | undefined;
+    workflowParkHolderPull: (() => Promise<import("../orchestration/workflow-park-holder.js").HolderPullTally>) | undefined;
     workflowNotifyGate: import("../orchestration/workflow-notify-journal.js").WorkflowNotifyGate | undefined;
     workflowNotifyJournal: import("../orchestration/workflow-notify-journal.js").WorkflowNotifyJournalStore | undefined;
     workflowRecoverOpts: {
@@ -108,10 +110,12 @@ export declare function runStage08(ctx: Awaited<ReturnType<typeof runStage07>>):
     perSessionCwd: Map<string, string>;
     perTaskImage: import("../per-task-image.js").PerTaskImageRegistry;
     sendUserFileTaskEnvs: import("../capabilities/sandbox-file-send.js").TaskEnvRegistry | undefined;
+    sessionBindings: {
+        commitSessionBindings: (sessionId: string, bindings: import("../session-bindings.js").SessionBindings) => import("../session-bindings.js").SessionBindingReceipt;
+        withdrawSessionBindings: (receipt: import("../session-bindings.js").SessionBindingReceipt) => boolean;
+        settleSessionBindings: (receipt: import("../session-bindings.js").SessionBindingReceipt) => boolean;
+    };
     sessionEnvSelection: import("../capabilities/select-environment-tool.js").SessionEnvironmentSelection;
-    setSessionCwd: (sid: string, cwd: string) => void;
-    setSessionInheritEnv: (sid: string, policy: import("../request-value-closure.js").TaskInheritEnv | undefined) => void;
-    setSessionShellEnv: (sid: string, env: Record<string, string>) => void;
     worktreeReap: (() => Promise<void>) | undefined;
     brain: import("@sema-agent/core").Brain;
     consolidationSeatWatch: import("./memory-consolidation.js").ConsolidationSeatWatch | undefined;

package/dist/boot/stage-08-reapers.js

@@ -3,10 +3,10 @@ import { startOtlpExporter } from "../observability/otel-exporter.js";
 import { startReapers } from "./reapers.js";
 import { startRetentionLane, RETENTION_LEASE_TTL_FACTOR } from "./retention-lane.js";
 import { createLimitSync } from "./limit-sync.js";
-import { runDenySweep } from "./late-binds.js";
+import { runDenySweep, sessionAgeOut } from "./late-binds.js";
 import { seatText } from "../trace/exit-seat.js";
 export function runStage08(ctx) {
-    const { approvalAskAudit, approvalNonceStore, backend, backgroundAgentStore, ceilingVerdict, checkpointStore, parkCommits, config, webAdmin, consolidationSeatWatch, costQuota, degradeRouteWatch, fileHistoryErasure, settleErasedSessions, sandboxReaper, handslessRunner, hookAgentRunner, imageBakes, instanceId, localRoot, logger, mailboxStore, metrics, permissionRuleStores, pricing, rateLimiter, retentionExecutor, retentionLaneStore, runStore, runner, sqlWorkflowRunStore, storeSweep, subRunner, taskAttachmentStore, toolApproval, userInputLedger, workflowNotifyGate, workflowNotifyJournal, workflowRecoverOpts, worktreeReap } = ctx;
+    const { approvalAskAudit, approvalNonceStore, backend, backgroundAgentStore, ceilingVerdict, checkpointStore, parkCommits, config, webAdmin, consolidationSeatWatch, costQuota, degradeRouteWatch, fileHistoryErasure, settleErasedSessions, sandboxReaper, handslessRunner, hookAgentRunner, imageBakes, instanceId, localRoot, logger, mailboxStore, metrics, permissionRuleStores, pricing, rateLimiter, retentionExecutor, retentionLaneStore, runStore, runner, sqlWorkflowRunStore, storeSweep, subRunner, taskAttachmentStore, toolApproval, userInputLedger, workflowNotifyGate, workflowNotifyJournal, workflowRecoverOpts, worktreeReap, workflowParkHolderPull } = ctx;
     const reaper = startReapers({
         config, logger, metrics, localRoot, backend, subRunner, runStore, checkpointStore, parkCommits,
         rateLimiter, costQuota, storeSweep, fileHistoryErasure, taskAttachmentStore, imageBakes, worktreeReap,
@@ -14,6 +14,8 @@ export function runStage08(ctx) {
         backgroundAgentStore, mailboxStore, toolApproval, permissionRuleStores, approvalNonceStore, userInputLedger, approvalAskAudit,
         ...(sandboxReaper !== undefined ? { sandboxReaper } : {}),
         getRunDenySweep: () => runDenySweep,
+        getSessionAgeOut: () => sessionAgeOut,
+        ...(workflowParkHolderPull !== undefined ? { workflowParkHolderPull } : {}),
     });
     const ttlMs = config.retentionSweep.intervalSec * 1000 * RETENTION_LEASE_TTL_FACTOR;
     const retentionLaneStarted = retentionExecutor !== undefined && retentionLaneStore !== undefined && config.retentionPolicy !== undefined

package/dist/boot/stage-09-leader.d.ts

@@ -9,9 +9,12 @@ export declare function runStage09(ctx: Awaited<ReturnType<typeof runStage08>>):
     leaderEndpoint: import("../leader/endpoint.js").LeaderEndpoint | undefined;
     ownerAware: import("../security.js").OwnerAwareSessionStore;
     planCacheProbe: import("../plan-cache-probe.js").PlanCacheProbe;
-    purgeSession: ((sessionId: string, owner: string | null) => Promise<import("../session-deletion.js").SessionPurgeOutcome>) | undefined;
+    purgeSession: ((sessionId: string, owner: string | null, opts?: {
+        readonly ageOut?: import("../session-deletion.js").SessionAgeOutExpectation;
+    }) => Promise<import("../session-deletion.js").SessionPurgeOutcome>) | undefined;
     webAdminJwtVerifier: import("../auth-bridge.js").WebAdminJwtVerifier | undefined;
     sessionAudit: ((sessionId: string, opts?: import("../audit.js").SessionAuditReadOpts) => Promise<{
+        sessionKind?: "sidechain" | undefined;
         projectId?: string | undefined;
         agent?: import("../session-agent.js").SessionAgent | undefined;
         owner: string | null;
@@ -56,6 +59,7 @@ export declare function runStage09(ctx: Awaited<ReturnType<typeof runStage08>>):
     userInputLedger: import("../user-input-ledger.js").UserInputLedger | undefined;
     userInputLedgerStore: import("../user-input-ledger.js").UserInputLedgerStore | undefined;
     webSearchProvider: "brave" | "tavily" | "searxng" | undefined;
+    deploymentPlane: (lane: import("./runner-deps.js").DeploymentPlaneLane) => import("./runner-deps.js").DeploymentPlaneDeps;
     sessionEraser: import("../session-erase.js").SessionEraser | undefined;
     settleErasedSessions: import("../session-erase.js").SessionEraseSettler;
     approvalAskAudit: import("../approval-ask-audit-store.js").FileApprovalAskAuditStore | undefined;
@@ -88,7 +92,7 @@ export declare function runStage09(ctx: Awaited<ReturnType<typeof runStage08>>):
     sendUserFileToolSpec: import("@sema-agent/core").ToolSpec<import("@sema-agent/core").TSchema> | undefined;
     sessionTitler: import("../session-titler.js").SessionTitler | undefined;
     sharedMemoryStore: import("../plugins/shared-memory-store-sql.js").SqlSharedMemoryStore | undefined;
-    sqlWorkflowRunStore: import("@sema-agent/core").WorkflowRunStore | undefined;
+    sqlWorkflowRunStore: import("../plugins/workflow-run-store-sql.js").SqlWorkflowRunStore | undefined;
     streamApprovalGate: import("../tool-approval.js").StreamApprovalGate<import("../approval-gate-currency.js").GateCurrencyStore>;
     subRunner: import("@sema-agent/core").Runner;
     subagentSteerRegistry: import("../orchestration/subagent-steer.js").SubagentSteerRegistry;
@@ -99,6 +103,7 @@ export declare function runStage09(ctx: Awaited<ReturnType<typeof runStage08>>):
     workflowJournalStore: import("../plugins/store-backend.js").ServiceWorkflowJournalStore | undefined;
     workflowModelAllowlistSnapshot: readonly string[];
     workflowParkDecisions: import("../orchestration/workflow-park-decision.js").WorkflowParkDecisionStore | undefined;
+    workflowParkHolderPull: (() => Promise<import("../orchestration/workflow-park-holder.js").HolderPullTally>) | undefined;
     workflowNotifyGate: import("../orchestration/workflow-notify-journal.js").WorkflowNotifyGate | undefined;
     workflowNotifyJournal: import("../orchestration/workflow-notify-journal.js").WorkflowNotifyJournalStore | undefined;
     workflowRecoverOpts: {
@@ -127,10 +132,12 @@ export declare function runStage09(ctx: Awaited<ReturnType<typeof runStage08>>):
     perSessionCwd: Map<string, string>;
     perTaskImage: import("../per-task-image.js").PerTaskImageRegistry;
     sendUserFileTaskEnvs: import("../capabilities/sandbox-file-send.js").TaskEnvRegistry | undefined;
+    sessionBindings: {
+        commitSessionBindings: (sessionId: string, bindings: import("../session-bindings.js").SessionBindings) => import("../session-bindings.js").SessionBindingReceipt;
+        withdrawSessionBindings: (receipt: import("../session-bindings.js").SessionBindingReceipt) => boolean;
+        settleSessionBindings: (receipt: import("../session-bindings.js").SessionBindingReceipt) => boolean;
+    };
     sessionEnvSelection: import("../capabilities/select-environment-tool.js").SessionEnvironmentSelection;
-    setSessionCwd: (sid: string, cwd: string) => void;
-    setSessionInheritEnv: (sid: string, policy: import("../request-value-closure.js").TaskInheritEnv | undefined) => void;
-    setSessionShellEnv: (sid: string, env: Record<string, string>) => void;
     worktreeReap: (() => Promise<void>) | undefined;
     brain: import("@sema-agent/core").Brain;
     consolidationSeatWatch: import("./memory-consolidation.js").ConsolidationSeatWatch | undefined;

package/dist/boot/stage-09-leader.js

@@ -1,14 +1,17 @@
 import { describeStaticWiring } from "@sema-agent/core";
 import { encodeCheckpointScope } from "../security.js";
-import { createWebAdminJwtVerifier } from "../auth-bridge.js";
+import { createWebAdminJwtVerifier, ssoBoundScopeOf } from "../auth-bridge.js";
 import { authBridgeIssuerOf } from "../identity-source.js";
 import { createSessionFaces } from "./session-faces.js";
+import { createSessionAgeOut } from "./session-age-out.js";
+import { bindSessionAgeOut } from "./late-binds.js";
+import * as facts from "../capability-facts.js";
 import { createLeaderFace } from "./leader.js";
 import { assertStaticWiringConsistent } from "../http/routes/diagnostics.js";
 import { seatText } from "../trace/exit-seat.js";
 import { buildDisplaySafeUrl } from "../trace/redact.js";
 export function runStage09(ctx) {
-    const { approvalExemptionStore, backend, backgroundAgentStore, brain, checkpointStore, checkpointCtxSealing, config, webAdmin, deploymentMods, dropSessionScoped, durableEnabled, executionEnvFactory, fileHistoryErasure, governanceSeams, localRoot, logger, mailboxRecipientLifecycle, mailboxStore, metrics, pricing, resumeAnchorStore, runStore, runnerDeps, sessionEraser, sessionPolicyStore, sessionStore, settleErasedSessions, storePosture, streamApprovalGate, taskAttachmentStore, spaceReclaimer, taskListLane, toolResultStore, tracer, usageWindowStore, userInputLedgerStore, workflowCompletionInbox } = ctx;
+    const { approvalExemptionStore, deploymentPlane, backend, backgroundAgentStore, checkpointStore, checkpointCtxSealing, config, dropSessionScoped, durableEnabled, executionEnvFactory, fileHistoryErasure, localRoot, logger, mailboxRecipientLifecycle, mailboxStore, metrics, resumeAnchorStore, runStore, runnerDeps, sessionEraser, sessionPolicyStore, sessionStore, settleErasedSessions, storePosture, streamApprovalGate, taskAttachmentStore, spaceReclaimer, taskListLane, toolResultStore, userInputLedgerStore, webAdmin, workflowCompletionInbox } = ctx;
     const { ownerAware, sessionAudit, sessionWatchRegistry, purgeSession, recoverPendingDeletions, instrumentDegenerate, planCacheProbe } = createSessionFaces({
         dropSessionScoped,
         config, logger, metrics, localRoot, backend, sessionStore, runStore, checkpointStore, toolResultStore,
@@ -24,7 +27,11 @@ export function runStage09(ctx) {
     if (recoverPendingDeletions !== undefined) {
         void recoverPendingDeletions().catch((err) => logger.warn("session_delete_recovery_unfinished", { outcome: "pending_unreadable", err: seatText("operator-log-text", String(err)), effect: "sessions left in the deleting state by an earlier process stay so (they read as gone); the next start or a repeated DELETE finishes them" }));
     }
-    const leaderEndpoint = createLeaderFace({ config, logger, brain, pricing, executionEnvFactory, toolResultStore, sessionStore, checkpointStore, checkpointCtxSealing, governanceSeams, backend, tracer, usageWindowStore, promptSource: webAdmin.promptSource, onError: runnerDeps.onError, deploymentMods });
+    const ageOutStore = ownerAware.listIdleOfKind !== undefined ? { listIdleOfKind: ownerAware.listIdleOfKind.bind(ownerAware) } : undefined;
+    bindSessionAgeOut(purgeSession !== undefined && ageOutStore !== undefined && facts.sessionKinds({ sessionStorage: ownerAware, purgeSession }).available
+        ? createSessionAgeOut({ store: ageOutStore, purge: purgeSession, retentionMs: () => config.backgroundAgentRetentionMs, logger, metrics })
+        : undefined);
+    const leaderEndpoint = createLeaderFace({ config, logger, localRoot, executionEnvFactory, toolResultStore, sessionStore, checkpointStore, checkpointCtxSealing, backend, deploymentPlane, getKeyResolver: () => webAdmin.getKeyResolver() });
     const drainState = { draining: false };
     const authBridgeIssuer = authBridgeIssuerOf(config)?.issuer;
     const webAdminJwtVerifier = authBridgeIssuer
@@ -36,8 +43,10 @@ export function runStage09(ctx) {
             metrics,
         })
         : undefined;
-    if (webAdminJwtVerifier)
-        logger.info("auth_bridge_enabled", { issuer: buildDisplaySafeUrl(authBridgeIssuer ?? "") });
+    if (webAdminJwtVerifier) {
+        const boundScope = ssoBoundScopeOf(config);
+        logger.info("auth_bridge_enabled", { issuer: buildDisplaySafeUrl(authBridgeIssuer ?? ""), scopeAdmission: boundScope === undefined ? { judged: false } : { judged: true, scope: boundScope } });
+    }
     const hookWakeBus = {};
     const wiringSpecTemplate = durableEnabled
         ? { checkpointStore, durableApproval: { scope: encodeCheckpointScope(undefined) } }

package/dist/boot/stage-10-http-server.d.ts

@@ -1,11 +1,14 @@
 import { brainSummary } from "../brain.js";
 import { type ServiceConfig } from "../config.js";
 import type { runStage09 } from "./stage-09-leader.js";
+import { type ControlSocketUnavailableReason } from "../control-socket.js";
 /**
  * 启动协议行 `listening` 的字段(行本身是 `observability/logger.ts` 的 {@link import("../observability/logger.js").STARTUP_PROTOCOL_EVENTS} 一员:不随 `LOG_LEVEL`)。
  * 铸点 = 本文件 listen 之后那一行(全仓唯一,`test/source-hygiene-gate.test.ts` M7),字面量过 {@link exactListeningLine}(键集恰等于本型,可选键与条件展开同算);
  * 键集登记在自铸登记表 `listeningLineKey`(`satisfies Record<keyof ListeningLine, …>`:键加一个而登记表没跟 / 多一个 ⇒ tsc 红)。只登顶层键;`brain` 段里的键随 `brainSummary` 走,不在本型。
  *
+ * 本机控制 socket 两格(`controlSocket` / `controlSocketUnavailable`)恰一只在场:同一次开口结局(`control-socket.ts` 的 `openControlSocket`)的投影 —— 绑定的事实由绑定者报,与 `boundAddress` 同一条。
+ *
  * 绑址两格,一格一个事实:`bindHost` = 本进程**请求**绑的地址(`resolveBindHost` 的答案 —— `BIND_HOST` 经无鉴权自收窄之后的那一只;答案缺席 = 全接口时是说明串);`boundAddress` = 内核**实际**绑上的地址
  * (`server.address().address` 原样:`::` / `0.0.0.0` / `127.0.0.1` / `::1` …;配置写 `localhost` 时它是解析出的那一只)。口同理:`port` 读的也是绑定者自己的答案。
  */
@@ -14,6 +17,10 @@ export interface ListeningLine {
     readonly bindHost: string;
     readonly bindHostNote?: string;
     readonly boundAddress: string;
+    /** 本机控制 socket 的绝对路径 —— present-iff 它在听(与下一键恰一只在场;同一次开口结局的投影 `controlSocketLineKeysOf`)。 */
+    readonly controlSocket?: string;
+    /** 本机控制 socket 没开的原因词(闭集 `CONTROL_SOCKET_UNAVAILABLE_REASONS`)—— present-iff 它没在听。 */
+    readonly controlSocketUnavailable?: ControlSocketUnavailableReason;
     readonly model: ServiceConfig["model"]["id"];
     readonly brain: ReturnType<typeof brainSummary>;
     readonly breakerState: string;
@@ -40,9 +47,12 @@ export declare function runStage10(ctx: Awaited<ReturnType<typeof runStage09>>):
     leaderEndpoint: import("../leader/endpoint.js").LeaderEndpoint | undefined;
     ownerAware: import("../security.js").OwnerAwareSessionStore;
     planCacheProbe: import("../plan-cache-probe.js").PlanCacheProbe;
-    purgeSession: ((sessionId: string, owner: string | null) => Promise<import("../session-deletion.js").SessionPurgeOutcome>) | undefined;
+    purgeSession: ((sessionId: string, owner: string | null, opts?: {
+        readonly ageOut?: import("../session-deletion.js").SessionAgeOutExpectation;
+    }) => Promise<import("../session-deletion.js").SessionPurgeOutcome>) | undefined;
     webAdminJwtVerifier: import("../auth-bridge.js").WebAdminJwtVerifier | undefined;
     sessionAudit: ((sessionId: string, opts?: import("../audit.js").SessionAuditReadOpts) => Promise<{
+        sessionKind?: "sidechain" | undefined;
         projectId?: string | undefined;
         agent?: import("../session-agent.js").SessionAgent | undefined;
         owner: string | null;
@@ -87,6 +97,7 @@ export declare function runStage10(ctx: Awaited<ReturnType<typeof runStage09>>):
     userInputLedger: import("../user-input-ledger.js").UserInputLedger | undefined;
     userInputLedgerStore: import("../user-input-ledger.js").UserInputLedgerStore | undefined;
     webSearchProvider: "brave" | "tavily" | "searxng" | undefined;
+    deploymentPlane: (lane: import("./runner-deps.js").DeploymentPlaneLane) => import("./runner-deps.js").DeploymentPlaneDeps;
     sessionEraser: import("../session-erase.js").SessionEraser | undefined;
     settleErasedSessions: import("../session-erase.js").SessionEraseSettler;
     approvalAskAudit: import("../approval-ask-audit-store.js").FileApprovalAskAuditStore | undefined;
@@ -119,7 +130,7 @@ export declare function runStage10(ctx: Awaited<ReturnType<typeof runStage09>>):
     sendUserFileToolSpec: import("@sema-agent/core").ToolSpec<import("@sema-agent/core").TSchema> | undefined;
     sessionTitler: import("../session-titler.js").SessionTitler | undefined;
     sharedMemoryStore: import("../plugins/shared-memory-store-sql.js").SqlSharedMemoryStore | undefined;
-    sqlWorkflowRunStore: import("@sema-agent/core").WorkflowRunStore | undefined;
+    sqlWorkflowRunStore: import("../plugins/workflow-run-store-sql.js").SqlWorkflowRunStore | undefined;
     streamApprovalGate: import("../tool-approval.js").StreamApprovalGate<import("../approval-gate-currency.js").GateCurrencyStore>;
     subRunner: import("@sema-agent/core").Runner;
     subagentSteerRegistry: import("../orchestration/subagent-steer.js").SubagentSteerRegistry;
@@ -130,6 +141,7 @@ export declare function runStage10(ctx: Awaited<ReturnType<typeof runStage09>>):
     workflowJournalStore: import("../plugins/store-backend.js").ServiceWorkflowJournalStore | undefined;
     workflowModelAllowlistSnapshot: readonly string[];
     workflowParkDecisions: import("../orchestration/workflow-park-decision.js").WorkflowParkDecisionStore | undefined;
+    workflowParkHolderPull: (() => Promise<import("../orchestration/workflow-park-holder.js").HolderPullTally>) | undefined;
     workflowNotifyGate: import("../orchestration/workflow-notify-journal.js").WorkflowNotifyGate | undefined;
     workflowNotifyJournal: import("../orchestration/workflow-notify-journal.js").WorkflowNotifyJournalStore | undefined;
     workflowRecoverOpts: {
@@ -158,10 +170,12 @@ export declare function runStage10(ctx: Awaited<ReturnType<typeof runStage09>>):
     perSessionCwd: Map<string, string>;
     perTaskImage: import("../per-task-image.js").PerTaskImageRegistry;
     sendUserFileTaskEnvs: import("../capabilities/sandbox-file-send.js").TaskEnvRegistry | undefined;
+    sessionBindings: {
+        commitSessionBindings: (sessionId: string, bindings: import("../session-bindings.js").SessionBindings) => import("../session-bindings.js").SessionBindingReceipt;
+        withdrawSessionBindings: (receipt: import("../session-bindings.js").SessionBindingReceipt) => boolean;
+        settleSessionBindings: (receipt: import("../session-bindings.js").SessionBindingReceipt) => boolean;
+    };
     sessionEnvSelection: import("../capabilities/select-environment-tool.js").SessionEnvironmentSelection;
-    setSessionCwd: (sid: string, cwd: string) => void;
-    setSessionInheritEnv: (sid: string, policy: import("../request-value-closure.js").TaskInheritEnv | undefined) => void;
-    setSessionShellEnv: (sid: string, env: Record<string, string>) => void;
     worktreeReap: (() => Promise<void>) | undefined;
     brain: import("@sema-agent/core").Brain;
     consolidationSeatWatch: import("./memory-consolidation.js").ConsolidationSeatWatch | undefined;

package/dist/boot/stage-10-http-server.js

@@ -29,23 +29,21 @@ import { createRunnerDepsOnAsk } from "./runner-deps.js";
 import { installShutdownHandlers } from "./shutdown.js";
 import { bindServerLateSeats } from "./late-binds.js";
 import { serviceVersion } from "../service-version.js";
+import { controlSocketLineKeysOf, openControlSocket } from "../control-socket.js";
 import { buildDisplaySafeUrl } from "../trace/redact.js";
 import { seatText } from "../trace/exit-seat.js";
 function exactListeningLine(line) {
     return line;
 }
 export async function runStage10(ctx) {
-    const { peerDesk, approvalAskAudit, approvalExemptionStore, approvalNonceStore, authorize, backend, backgroundAgentStore, brain, breakerState, centerRuntimeCapsResolver, checkpointStore, checkpointCtxSealing, parkCommits, config, webAdmin, consolidationValve, costQuota, belowTaskChainPatterns, deploymentMods, deploymentModsLoaded, deviceLane, drainState, dropSessionScopedOf, durableEnabled, elicitation, fenceSessionOwner, fileHistoryStore, fleetBus, fleetLease, fleetUsage, governanceSeams, handslessRunner, hookAgent, hookLlm, hookWakeBus, imageBakes, imageIndex, instanceId, instrumentDegenerate, leaderEndpoint, loadedSkills, localRoot, logger, lspManager, mcpRevocations, sandboxCapacity, memoryBundleFaces, memoryComplianceFaces, memoryConsolidationFaces, memoryEngine, memoryExportStores, memoryOptOutGrantStore, memoryOriginFaces, memoryPosture, memorySyncCursors, memorySyncRunner, metrics, modelUsageTracker, orgMemoryAdmission, otelExporter, outcomeSink, ownerAware, parkedReviveInheritedGate, parkedReviveSurface, perSessionCwd, perTaskImage, planCacheProbe, pricing, principalCaps, promptManifestTracker, purgeSession, question, rateLimiter, reaper, webAdminJwtVerifier, resumeAnchorStore, retentionLaneStarted, retentionLaneStore, ruleConsent, runStore, runner, runnerDeps, runtimeCapsPeekReading, sandboxGitPlane, scenarioDetails, scenarios, selectEnvTool, sendFileLedger, sendUserFileEmitter, sendUserFileToolSpec, sessionAudit, sessionEnvSelection, sessionMemoryStatusFace, sessionPolicyStore, sessionTitler, sessionWatchRegistry, setSessionCwd, setSessionInheritEnv, setSessionShellEnv, sessionResidentBackground, sharedMemoryStore, sideQueryAccounting, sqlEngine, sqlWorkflowRunStore, staticWiring, storePosture, subRunner, subagentSteerRegistry, taskAttachmentStore, taskLimitCaps, taskTimeoutSec, toolApproval, toolResultStore, usageWindowStore, userInputLedger, webSearchProvider, workflowAgentRegistry, workflowAgentSessionIndex, workflowParkDecisions, workflowCompletionInbox, workflowJournalStore, workflowModelAllowlistSnapshot, workflowNotifyGate, workflowNotifyJournal, workflowRecoverOpts, workflowRunStore, workflowsCapable, orgDeliveryGate } = ctx;
+    const { peerDesk, approvalAskAudit, approvalExemptionStore, approvalNonceStore, authorize, backend, backgroundAgentStore, brain, breakerState, centerRuntimeCapsResolver, checkpointStore, checkpointCtxSealing, parkCommits, config, webAdmin, consolidationValve, costQuota, belowTaskChainPatterns, deploymentMods, deploymentModsLoaded, deviceLane, drainState, dropSessionScopedOf, durableEnabled, elicitation, fenceSessionOwner, fleetBus, fleetLease, fleetUsage, governanceSeams, handslessRunner, hookAgent, hookLlm, hookWakeBus, imageBakes, imageIndex, instanceId, instrumentDegenerate, leaderEndpoint, loadedSkills, localRoot, logger, lspManager, mcpRevocations, sandboxCapacity, memoryBundleFaces, memoryComplianceFaces, memoryConsolidationFaces, memoryEngine, memoryExportStores, memoryOptOutGrantStore, memoryOriginFaces, memoryPosture, memorySyncCursors, memorySyncRunner, metrics, modelUsageTracker, orgMemoryAdmission, otelExporter, outcomeSink, ownerAware, parkedReviveInheritedGate, parkedReviveSurface, perSessionCwd, perTaskImage, planCacheProbe, pricing, principalCaps, promptManifestTracker, purgeSession, question, rateLimiter, reaper, webAdminJwtVerifier, resumeAnchorStore, retentionLaneStarted, retentionLaneStore, ruleConsent, runStore, runner, runnerDeps, runtimeCapsPeekReading, sandboxGitPlane, scenarioDetails, scenarios, selectEnvTool, sendFileLedger, sendUserFileEmitter, sendUserFileToolSpec, sessionAudit, sessionEnvSelection, sessionMemoryStatusFace, sessionTitler, sessionWatchRegistry, sessionBindings, sessionResidentBackground, sharedMemoryStore, sideQueryAccounting, sqlEngine, sqlWorkflowRunStore, staticWiring, storePosture, subRunner, subagentSteerRegistry, taskAttachmentStore, taskLimitCaps, taskTimeoutSec, toolApproval, toolResultStore, usageWindowStore, userInputLedger, webSearchProvider, workflowAgentRegistry, workflowAgentSessionIndex, workflowParkDecisions, workflowCompletionInbox, workflowJournalStore, workflowModelAllowlistSnapshot, workflowNotifyGate, workflowNotifyJournal, workflowRecoverOpts, workflowRunStore, workflowsCapable, orgDeliveryGate } = ctx;
     const stores = {
         runStore,
-        resumeAnchorStore: resumeAnchorStore ? resumeAnchorStore : undefined,
         approvalExemptionStore: approvalExemptionStore ? approvalExemptionStore : undefined,
         approvalNonceStore: approvalNonceStore ? approvalNonceStore : undefined,
         checkpointStore,
         checkpointCtxSealing,
-        sessionPolicyStore: sessionPolicyStore ? sessionPolicyStore : undefined,
         ruleConsent,
-        fileHistoryStore: fileHistoryStore ? fileHistoryStore : undefined,
         toolResultStore,
         taskAttachmentStore: taskAttachmentStore ? taskAttachmentStore : undefined,
         backgroundAgentStore: backgroundAgentStore ? backgroundAgentStore : undefined,
@@ -88,7 +86,7 @@ export async function runStage10(ctx) {
         sessionAudit,
         routeJudgeBrain: brain,
         purgeSession: purgeSession ? purgeSession : undefined,
-        bindSessionInheritEnv: config.remoteExec.provider === "host" ? setSessionInheritEnv : undefined,
+        sessionBindings,
         dropSessionScopedOf,
         subagentTaskOutput: (handle, access) => backgroundAgentOutput(defaultTaskRegistry, handle, access, backgroundAgentStore),
         taskHandleOutput: (handle, access) => taskHandleOutput(defaultTaskRegistry, handle, access, backgroundAgentStore),
@@ -214,7 +212,7 @@ export async function runStage10(ctx) {
         config, logger, metrics, localRoot, scenarios, loadedSkills, principalCaps, centerRuntimeCapsResolver,
         peerDesk,
         getKeyResolver: () => webAdmin.getKeyResolver(),
-        taskAttachmentStore, perSessionCwd, setSessionCwd, setSessionShellEnv, fenceSessionOwner,
+        taskAttachmentStore, perSessionCwd, fenceSessionOwner,
         hookLlm, hookAgent, belowTaskChainPatterns, fleetBus, hookWakeBus, ownerAware, taskLimitCaps, taskTimeoutSec,
         historyAnchors: resumeAnchorStore && runStore ? { anchors: resumeAnchorStore, runs: runStore } : undefined,
         selectEnvTool, sendUserFileToolSpec, memoryEngine, memorySyncRunner, durableEnabled, approvalExemptionStore,
@@ -241,19 +239,6 @@ export async function runStage10(ctx) {
         metrics,
     });
     const bindHost = resolveBindHost(config);
-    if (config.bindHostSource === "HOST" && bindHost !== config.bindHost) {
-        logger.warn("bind_host_from_HOST_env_overridden", {
-            bindHost,
-            ignoredHostEnv: config.bindHost,
-            note: "HOST was inherited from the shell (zsh commonly sets it to the machine name) and would have bound the write face to a non-loopback address — but this deployment has ALLOW_UNAUTHED_WRITES with no service token, so the bind address was narrowed to loopback instead. Two ways out if you meant to expose it: set BIND_HOST explicitly, or configure a service token.",
-        });
-    }
-    else if (config.bindHostSource === "HOST") {
-        logger.warn("bind_host_from_HOST_env", {
-            bindHost,
-            note: "the bind address came from the HOST env var (not BIND_HOST). Shells like zsh commonly set HOST to the machine name — if you did not set it yourself, this may be an inherited shell variable silently configuring the bind face. Set BIND_HOST explicitly to silence this warning.",
-        });
-    }
     let onListenError;
     try {
         await new Promise((resolve, reject) => {
@@ -266,8 +251,6 @@ export async function runStage10(ctx) {
         logger.error("listen_failed", {
             port: config.port,
             bindHost: bindHost ?? "0.0.0.0/::(all interfaces)",
-            ...(config.bindHostSource ? { bindHostSource: config.bindHostSource } : {}),
-            ...(config.bindHostSource === "HOST" ? { note: "bind failed for a host inherited from the HOST env var — set BIND_HOST explicitly (e.g. BIND_HOST=127.0.0.1)." } : {}),
             error: seatText("operator-log-text", e instanceof Error ? e.message : String(e)),
         });
         throw e;
@@ -282,6 +265,14 @@ export async function runStage10(ctx) {
             ...("code" in e ? { code: String(e.code) } : {}),
         });
     });
+    const controlSocketServer = server.controlSocketServer;
+    controlSocketServer.on("error", (e) => {
+        logger.error("control_socket_error", {
+            error: seatText("operator-log-text", e.message),
+            ...("code" in e ? { code: String(e.code) } : {}),
+        });
+    });
+    const controlSocket = await openControlSocket(controlSocketServer, { exclusiveDataRoot: backend?.exclusiveDataRoot?.() });
     const fleetClient = startFleetClientFromConfig(config, {
         instanceId,
         version: serviceVersion(),
@@ -310,6 +301,7 @@ export async function runStage10(ctx) {
             ? { bindHostNote: "auto-narrowed to loopback: write face is unauthenticated (ALLOW_UNAUTHED_WRITES with no service token). Set BIND_HOST explicitly to override." }
             : {}),
         boundAddress: bound.address,
+        ...controlSocketLineKeysOf(controlSocket),
         model: config.model.id,
         brain: brainSummary(config),
         breakerState: config.resilience.circuitBreaker ? (breakerState ? `shared(${backend.kind})` : "in-process") : "off",
@@ -345,6 +337,7 @@ export async function runStage10(ctx) {
     }
     void installShutdownHandlers({
         config, logger, server, reaper, fleetReconcile, otelExporter, breakerState, costQuota, rateLimiter,
+        controlSocket: controlSocket.listening ? controlSocketServer : undefined,
         version: serviceVersion(),
         runner, subRunner, lspManager, workflowNotifyJournal, fleetClient, backend, drainState,
         storeLiveProbe, webAdmin,