@sema-agent/server 7.2.0 → 7.4.0

package/dist/question.d.ts

@@ -1,4 +1,4 @@
-import { type AskQuestionRequest, type QuestionAnswer, type AskQuestion } from "@sema-agent/core";
+import { type AskQuestionRequest, type OnQuestionOutcome, type QuestionAnswer, type AskQuestion } from "@sema-agent/core";
 /** A live question frame delivered to whoever tails this run's stream. `type` IS the SSE event name (mirrors the
  *  named-event convention; the payload also carries `type` so a proxy that strips event names still works). The shell
  *  renders `question` as a dialog and dismisses on `question_complete`. */
@@ -6,11 +6,14 @@ export interface QuestionFrame {
     type: "question" | "question_complete";
     questionId: string;
     /** "question" only: the model's structured questions, secret-redacted. UNTRUSTED-for-display (shell renders; never
-     *  re-feeds a model). Absent on an over-cap payload (the ask then headless-defaults). */
+     *  re-feeds a model). Absent on an over-cap payload (the ask then reports unavailable — no frame is emitted at all). */
     questions?: AskQuestion[];
     /** "question_complete" only: whether the human answered (`answered`) or the ask was released unanswered
-     *  (`unanswered` — ttl/abort → the model got the headless default). Cosmetic dialog-dismiss. */
+     *  (`unanswered` — ttl/abort → core was told nobody was reachable). Cosmetic dialog-dismiss. */
     outcome?: "answered" | "unanswered";
+    /** Server-signed emit timestamp (additive, [2805]§五→[2806]). Server-minted side-frame ⇒ no core-stream
+     *  `eventId` to carry (absence is honest); this is the frame's own time coordinate. */
+    serverNowMs?: number;
 }
 /** The per-run context `onQuestion` recovers via ALS. `emit` delivers a frame to the run's live stream; `abortSignal`
  *  (the run's own cancel signal) releases a question parked awaiting a human when the run aborts. */
@@ -28,12 +31,14 @@ export interface QuestionRunContext {
      *  background leg (emit appends to the durable events tail, readable whenever a client attaches). */
     deliverable?: () => boolean;
 }
+/** The per-run question window the deployment owns (core caps nothing). Env: `QUESTION_MAX_CONCURRENT_PER_RUN` /
+ *  `QUESTION_MAX_TOTAL_PER_RUN` / `QUESTION_TTL_MS` (see `ServiceConfig.questionThrottle`). */
 export interface QuestionThrottle {
-    /** Max concurrent in-flight questions per run leg (parallel tool calls can each ask). Breach ⇒ headless default. */
+    /** Max concurrent in-flight questions per run leg (parallel tool calls can each ask). Breach ⇒ unavailable. */
     maxConcurrentPerRun: number;
-    /** Max total questions one run leg surfaces to the human. Breach ⇒ headless default (flood defense). */
+    /** Max total questions one run leg surfaces to the human. Breach ⇒ unavailable (flood defense). */
     maxTotalPerRun: number;
-    /** An unanswered question auto-releases (headless default) after this (ms) — the human walked away; don't hold core. */
+    /** An unanswered question auto-releases as unavailable after this (ms) — the human walked away; don't hold core. */
     ttlMs: number;
 }
 export declare const DEFAULT_QUESTION_THROTTLE: QuestionThrottle;
@@ -51,7 +56,7 @@ export declare function parseQuestionResponse(body: unknown): {
  * Coordinates AskUserQuestion HITL for the singleton runner. Process-local + same-replica (the pending map is in memory,
  * like ElicitationCoordinator / steerableRuns): a respond that lands on another replica finds nothing → 404. Present
  * (passed into `RunnerDeps.onQuestion` + the respond route) ONLY when `ASK_QUESTION_ENABLED` — absent ⇒ core mounts the
- * AskUserQuestion tool with the headless default (a run never hangs; the model just can't get a live answer).
+ * AskUserQuestion tool with no seam at all (`seam_absent` continuation; the model just can't get a live answer).
  */
 export declare class QuestionCoordinator {
     private readonly als;
@@ -60,12 +65,13 @@ export declare class QuestionCoordinator {
     private readonly throttle;
     constructor(throttle?: QuestionThrottle);
     /** Run `fn` with the per-run question context ambient. On exit, release any still-pending question for this run (a
-     *  live-only question cannot outlive its leg → headless default) and drop the run's counters (no leak). */
+     *  live-only question cannot outlive its leg → unavailable) and drop the run's counters (no leak). */
     runWithContext<T>(ctx: QuestionRunContext, fn: () => Promise<T>): Promise<T>;
-    /** `RunnerDeps.onQuestion`. core calls this when the agent's AskUserQuestion tool fires; the resolved answer is what
-     *  the model sees. Headless default (`NO_HUMAN`) in every case with no live human, so the run never hangs. Arrow
-     *  property so it can be passed as `onQuestion: coordinator.question` with `this` bound. */
-    question: (req: AskQuestionRequest, signal?: AbortSignal) => Promise<QuestionAnswer>;
+    /** `RunnerDeps.onQuestion`. core calls this when the agent's AskUserQuestion tool fires; the resolved outcome is what
+     *  core acts on — a {@link QuestionAnswer} ONLY when a human really answered, otherwise `{kind:"unavailable"}` (core
+     *  then parks on a durable leg / continues with the `declined_unavailable` card on a non-durable one; either way the
+     *  run never hangs). Arrow property so it can be passed as `onQuestion: coordinator.question` with `this` bound. */
+    question: (req: AskQuestionRequest, signal?: AbortSignal) => Promise<OnQuestionOutcome>;
     /** `POST /v1/questions/:id/respond` — resolve a parked question with the shell's answer. Owner-gated with a 404 (no
      *  existence oracle): a non-owner AND an unknown id (answered / expired / wrong replica) both get 404. Returns the
      *  HTTP {status, body}; the HTTP layer owns auth (gatedPrincipal + REQUIRE_PRINCIPAL) before calling. */
@@ -80,9 +86,10 @@ export declare class QuestionCoordinator {
      *  resolve-spec 的 durable question policy 用它在**判决时**分腿:有活流 ⇒ allow(问活人),无 ⇒
      *  ask(durable park)。ALS 让这个判断天然 per-leg,policy 组装期不必预知腿别。
      *  🔴 判据是「投递面此刻可达」而不只是「ALS 在场」(复审 A1):detach 腿断连后 run 仍在本作用域里跑,
-     *  只判 ALS 会把一条谁也收不到的问题判成 allow(挂满 ttl 后以空答喂模型),而 park 才是它该走的腿。
+     *  只判 ALS 会把一条谁也收不到的问题判成 allow——挂满 ttl 后以 unavailable 结算,非 durable 形 core
+     *  就此合成续跑,活人再没机会答;而 park 才是它该走的腿。
      *  谓词缺席 ⇒ 恒可达(后台腿的 durable events tail 语义)。谓词本身抛错按不可达处理:判决面
-     *  fail-closed 到 park(park 可由运维补答,空答不可回收)。 */
+     *  fail-closed 到 park(park 可由运维补答,续跑掉的问题不可回收)。 */
     hasLiveContext(): boolean;
     private countersFor;
 }

package/dist/question.js

@@ -15,29 +15,39 @@
  * (the HTTP boundary) and REDACTS secrets from the model-authored QUESTION text before it is persisted/streamed (the
  * same redact-at-write contract as elicitation's `message`/tool outputs — the question is shown to a human, never
  * re-fed to a model, so no `delimitUntrusted` is needed on it). Deployment responsibilities core delegates: THROTTLE
- * (bound concurrency/total/ttl per run — an over-eager agent could flood the human) and no-live-human FALLBACK (a leg
- * with no stream returns the headless "no answer" default so the model proceeds instead of hanging).
+ * (bound concurrency/total/ttl per run — an over-eager agent could flood the human).
+ *
+ * 🔴 VERDICT vs LANDING are separate jobs (#166 裁1). This coordinator is the deployment's HONEST reporter of one fact:
+ * "no human answered this". Every arm with no real human answer — no run context, the run aborted, the throttle window
+ * is spent, the question cannot be presented, the TTL expired (incl. the run-exit sweep) — returns core's
+ * `{kind:"unavailable"}`. It NEVER synthesizes an empty answer set: an empty `{answers:[]}` reads to core as "a human
+ * was here and picked nothing", which on a durable deployment consumes the pending approval and hands the model a
+ * fabricated human verdict instead of parking the question where an operator can still answer it. Choosing the landing
+ * is CORE's job: a durable leg parks a checkpoint (operator answers later via decide), a non-durable leg continues with
+ * the `declined_unavailable` synthetic-continuation card (the model is told nobody is reachable and proceeds on its own
+ * judgment — a run with no human still never hangs). Only a REAL human answer returns a {@link QuestionAnswer}.
  *
  * ROUTING mirrors elicitation: `onQuestion` lives on the SINGLETON runner's `RunnerDeps` (the request carries no taskId),
  * so the run leg establishes a per-run AsyncLocalStorage context (taskId throttle key, owner respond-gate, `emit`
- * closure). `node:async_hooks` propagates it through every await; no context ⇒ headless default (never a hang).
+ * closure). `node:async_hooks` propagates it through every await; no context ⇒ unavailable (never a hang).
  */
 import { AsyncLocalStorage } from "node:async_hooks";
 import { uuidv7 } from "@sema-agent/core";
 import { redactDeep } from "./trace/redact.js";
+import { recordFailOpen } from "./observability/fail-open.js";
 /** Size bound on the model-authored questions payload before it is persisted to the durable log + streamed (parity
  *  with elicitation's MAX_ELICIT_* — an over-large questions blob amplifies into the socket/log). Over the cap ⇒ the
- *  questions are dropped and the ask headless-defaults (a question the human can't see can't be answered). */
+ *  questions are dropped and the ask reports unavailable (a question the human can't see can't be answered). */
 const MAX_QUESTIONS_BYTES = 16384;
 export const DEFAULT_QUESTION_THROTTLE = {
     maxConcurrentPerRun: 2,
     maxTotalPerRun: 20,
     ttlMs: 5 * 60_000,
 };
-/** The headless "no live human answered" result — an EMPTY answer set (no question got a selection). core's
- *  AskUserQuestion tool renders this to the model as "no option selected" so it proceeds with its own judgment instead
- *  of hanging (parity with the `onQuestion===undefined` headless default — a run with no human never blocks). */
-const NO_HUMAN = { answers: [] };
+/** The honest "nobody answered this" outcome. Frozen + shared: it is pure data core reads through
+ *  `classifyQuestionOutcome`, and it must never be confused with an empty ANSWER (which claims a human chose nothing
+ *  and, on a durable leg, spends the approval that park would have preserved). */
+const UNAVAILABLE = Object.freeze({ kind: "unavailable" });
 /** Validate the respond body = core's {@link QuestionAnswer}. `selected`/`note` are OPAQUE passthrough (core fences
  *  them: `selected ⊆ options`, `note` untrusted-fenced) — we validate only the outer SHAPE (answers[] of {header,
  *  selected:string[], note?}), never the option semantics. */
@@ -65,7 +75,7 @@ export function parseQuestionResponse(body) {
 }
 /** redactDeep + size-bound the UNTRUSTED model-authored questions before they are persisted/streamed (a question's
  *  free-text — question/header/option label+description — can echo a secret from the model's context). Over the byte
- *  cap OR unserializable ⇒ undefined (drop; the ask headless-defaults). */
+ *  cap OR unserializable ⇒ undefined (drop; the ask reports unavailable). */
 function boundQuestions(questions) {
     const redacted = redactDeep(questions);
     try {
@@ -81,7 +91,7 @@ function boundQuestions(questions) {
  * Coordinates AskUserQuestion HITL for the singleton runner. Process-local + same-replica (the pending map is in memory,
  * like ElicitationCoordinator / steerableRuns): a respond that lands on another replica finds nothing → 404. Present
  * (passed into `RunnerDeps.onQuestion` + the respond route) ONLY when `ASK_QUESTION_ENABLED` — absent ⇒ core mounts the
- * AskUserQuestion tool with the headless default (a run never hangs; the model just can't get a live answer).
+ * AskUserQuestion tool with no seam at all (`seam_absent` continuation; the model just can't get a live answer).
  */
 export class QuestionCoordinator {
     als = new AsyncLocalStorage();
@@ -92,7 +102,7 @@ export class QuestionCoordinator {
         this.throttle = throttle;
     }
     /** Run `fn` with the per-run question context ambient. On exit, release any still-pending question for this run (a
-     *  live-only question cannot outlive its leg → headless default) and drop the run's counters (no leak). */
+     *  live-only question cannot outlive its leg → unavailable) and drop the run's counters (no leak). */
     runWithContext(ctx, fn) {
         return this.als.run(ctx, async () => {
             try {
@@ -101,31 +111,34 @@ export class QuestionCoordinator {
             finally {
                 for (const [, p] of [...this.pending]) {
                     if (p.taskId === ctx.taskId)
-                        p.settle(NO_HUMAN, "unanswered");
+                        p.settle(UNAVAILABLE, "unanswered");
                 }
                 this.counters.delete(ctx.taskId);
             }
         });
     }
-    /** `RunnerDeps.onQuestion`. core calls this when the agent's AskUserQuestion tool fires; the resolved answer is what
-     *  the model sees. Headless default (`NO_HUMAN`) in every case with no live human, so the run never hangs. Arrow
-     *  property so it can be passed as `onQuestion: coordinator.question` with `this` bound. */
+    /** `RunnerDeps.onQuestion`. core calls this when the agent's AskUserQuestion tool fires; the resolved outcome is what
+     *  core acts on — a {@link QuestionAnswer} ONLY when a human really answered, otherwise `{kind:"unavailable"}` (core
+     *  then parks on a durable leg / continues with the `declined_unavailable` card on a non-durable one; either way the
+     *  run never hangs). Arrow property so it can be passed as `onQuestion: coordinator.question` with `this` bound. */
     question = async (req, signal) => {
         const ctx = this.als.getStore();
         // No run context (a leg not wrapped by runWithContext — synchronous /v1/tasks, verify/cascade, or a leader sub-task
-        // with no live stream) ⇒ headless default. Sub-tasks run in the parent's ALS frame → a child's question inherits the
+        // with no live stream) ⇒ nobody to ask. Sub-tasks run in the parent's ALS frame → a child's question inherits the
         // top-level run's ctx (one human, one stream, one throttle budget), same as elicitation.
         if (!ctx)
-            return NO_HUMAN;
+            return UNAVAILABLE;
+        // Aborted (call signal or the run's own): whatever comes back has no consumer, so claiming a human answered is a lie.
         if (signal?.aborted || ctx.abortSignal?.aborted)
-            return NO_HUMAN;
-        // THROTTLE (service's job — core imposes none): bound concurrency + total. Breach ⇒ headless default.
+            return UNAVAILABLE;
+        // THROTTLE (service's job — core imposes none): bound concurrency + total. Breach ⇒ unavailable, never a denial and
+        // never a fabricated answer — a spent window is a "not now", which is exactly what park/continue is for.
         const rc = this.countersFor(ctx.taskId);
         if (rc.inflight >= this.throttle.maxConcurrentPerRun || rc.total >= this.throttle.maxTotalPerRun)
-            return NO_HUMAN;
+            return UNAVAILABLE;
         const questions = boundQuestions(req.questions);
         if (!questions)
-            return NO_HUMAN; // over-cap / unserializable → can't show it → headless
+            return UNAVAILABLE; // over-cap / unserializable → can't show it → nobody can answer it
         const id = uuidv7();
         rc.inflight += 1; // reserve the concurrency slot; total charged only on a successful emit
         let done = false;
@@ -147,8 +160,10 @@ export class QuestionCoordinator {
             resolveAnswer(a);
         };
         let lastOutcome = "unanswered";
-        const onAbort = () => settle(NO_HUMAN, "unanswered");
-        timer = setTimeout(() => settle(NO_HUMAN, "unanswered"), this.throttle.ttlMs);
+        const onAbort = () => settle(UNAVAILABLE, "unanswered");
+        // TTL: the human walked away. Release as unavailable — core decides whether that parks (durable, operator can still
+        // answer) or continues (non-durable); holding core past the window is not one of the choices.
+        timer = setTimeout(() => settle(UNAVAILABLE, "unanswered"), this.throttle.ttlMs);
         timer.unref?.();
         signal?.addEventListener("abort", onAbort, { once: true });
         ctx.abortSignal?.addEventListener("abort", onAbort, { once: true });
@@ -156,20 +171,53 @@ export class QuestionCoordinator {
         this.pending.set(id, { settle, owner: ctx.owner, taskId: ctx.taskId });
         // Emit the OPEN frame AWAITED so its durable append is ORDERED ahead of the answer/completion/terminal appends (a
         // fire-and-forget append can commit out of seq order and be skipped by the monotonic events-tail cursor). A FAILED
-        // emit headless-defaults (nobody can answer) and must NOT burn the per-run total.
-        try {
-            await ctx.emit({ type: "question", questionId: id, questions });
+        // emit settles unavailable (nobody can answer a frame that never arrived) and must NOT burn the per-run total.
+        // 🔴 RACED against the settlement (codex 复审 R2-high): a STALLED delivery (a durable append that never settles, a
+        // half-open socket) is a third shape next to ok/threw, and a bare `await ctx.emit` on it outlives TTL *and* abort —
+        // settle would resolve `answerP` while this frame is still parked on the emit, so `question()` never returns, core's
+        // callTool never unblocks and the leg cannot even reach its own cleanup. "The window always releases" has to hold
+        // for the stalled shape too, so the await ends at whichever comes first. Ordering is unchanged on the normal path
+        // (the settlement is still pending there, so the emit is still fully awaited).
+        // The loser of the race keeps its own handlers — an emit that rejects AFTER the race must not surface as an
+        // unhandled rejection.
+        const emitted = (async () => ctx.emit({ type: "question", questionId: id, questions, serverNowMs: Date.now() }))()
+            .then(() => "ok", () => "failed");
+        const delivery = await Promise.race([emitted, answerP.then(() => "stalled")]);
+        if (delivery === "ok") {
             rc.total += 1;
         }
-        catch {
-            settle(NO_HUMAN, "unanswered");
+        else if (delivery === "failed") {
+            // #157(codex 复审 MEDIUM,2026-08-07):投递失败 ⇒ 人在环这道门被**一次故障**跳过,模型自己往下判。
+            // 「绝不把 run 挂死」是刻意的产品姿态,所以方向不改;但它是 P-DEBT 不是合法兜底——债要在遥测里显形。
+            // #166 后本臂结算成 unavailable(而非空答):留痕语义不变(一次投递故障仍可能让人在环被跳过——非
+            // durable 形 core 合成续跑),durable 形则改由 core park,债的方向与本记账口径一致。
+            recordFailOpen("server.question.open-frame-undelivered", `question=${id}`);
+            settle(UNAVAILABLE, "unanswered");
         }
+        // delivery==="stalled":窗已由 TTL/abort/清扫结算,这一问就此让位;账在下面那个迟到臂里补(投递还没
+        // 判出成败,现在既不能计费也不能记债)。
         const answer = await answerP;
         // Completion breadcrumb (dialog dismiss) — FIRE-AND-FORGET so a slow durable append can never delay returning the
-        // answer to core. Best-effort + ordering-uncritical (the shell already has the answer via respond).
-        void Promise.resolve()
-            .then(() => ctx.emit({ type: "question_complete", questionId: id, outcome: lastOutcome }))
-            .catch(() => undefined);
+        // answer to core. Best-effort (the shell already has the answer via respond), but CHAINED BEHIND the open frame and
+        // BRANCHED on how that frame ended (codex 复审 R3):
+        //  · 送达(含**迟到**送达)⇒ 人真看见了这张卡:补烧总量额度(否则「反复悬挂再落地」是一条绕过刷屏帽的
+        //    路子),再发消卡帧把它消解掉;
+        //  · 投递失败(含**迟到**失败)⇒ 没有卡可消解,发消卡帧只会在流里留一条无主帧;此时补记那条 P-DEBT
+        //    留痕(同步臂已经记过的不会重复:那条腿的 delivery 不是 stalled)。
+        void emitted
+            .then((result) => {
+            if (result === "failed") {
+                if (delivery === "stalled")
+                    recordFailOpen("server.question.open-frame-undelivered", `question=${id}`);
+                return undefined;
+            }
+            if (delivery === "stalled")
+                rc.total += 1;
+            return ctx.emit({ type: "question_complete", questionId: id, outcome: lastOutcome, serverNowMs: Date.now() });
+        })
+            // #157:F 类兜底(丢的是收尾渲染,不是答案)——合法,但必须留痕,否则"面包屑成片消失"只能靠
+            // 用户报"对话框不消解"发现。
+            .catch(() => recordFailOpen("server.question.complete-breadcrumb-dropped", `question=${id}`));
         return answer;
     };
     /** `POST /v1/questions/:id/respond` — resolve a parked question with the shell's answer. Owner-gated with a 404 (no
@@ -197,9 +245,10 @@ export class QuestionCoordinator {
      *  resolve-spec 的 durable question policy 用它在**判决时**分腿:有活流 ⇒ allow(问活人),无 ⇒
      *  ask(durable park)。ALS 让这个判断天然 per-leg,policy 组装期不必预知腿别。
      *  🔴 判据是「投递面此刻可达」而不只是「ALS 在场」(复审 A1):detach 腿断连后 run 仍在本作用域里跑,
-     *  只判 ALS 会把一条谁也收不到的问题判成 allow(挂满 ttl 后以空答喂模型),而 park 才是它该走的腿。
+     *  只判 ALS 会把一条谁也收不到的问题判成 allow——挂满 ttl 后以 unavailable 结算,非 durable 形 core
+     *  就此合成续跑,活人再没机会答;而 park 才是它该走的腿。
      *  谓词缺席 ⇒ 恒可达(后台腿的 durable events tail 语义)。谓词本身抛错按不可达处理:判决面
-     *  fail-closed 到 park(park 可由运维补答,空答不可回收)。 */
+     *  fail-closed 到 park(park 可由运维补答,续跑掉的问题不可回收)。 */
     hasLiveContext() {
         const ctx = this.als.getStore();
         if (ctx === undefined)

package/dist/runs.d.ts

@@ -5,6 +5,7 @@ import type { Metrics } from "./observability/metrics.js";
 import type { ModelUsageTracker, PromptManifestTracker } from "./budget.js";
 import type { ElicitationCoordinator } from "./elicitation.js";
 import type { QuestionCoordinator } from "./question.js";
+import { type ToolApprovalCoordinator } from "./tool-approval.js";
 import { type FleetRunPublisher } from "./fleet/fleet-bus.js";
 import { type WorkflowCompletionInbox } from "./orchestration/workflow-completion-inbox.js";
 import type { VerifyRoundsSpec } from "./http/verify-rounds.js";
@@ -250,7 +251,21 @@ completionDiagLog?: (msg: string, meta?: Record<string, unknown>) => void,
 sendUserFile?: SendUserFileEmitter, 
 /** [998]② the shared prompt-manifest accumulator (tracer records at prepare; this leg drains the pending
  *  record into a durable `prompt_assembled` event — turns/stream read it). undefined ⇒ not wired. */
-promptManifests?: PromptManifestTracker): Promise<void>;
+promptManifests?: PromptManifestTracker, 
+/**
+ * #151 车3 刀 3b:**bg 腿的流内审批 ctx**(design/172 §4.3(b))。今天为止这条腿连 approval ALS 都没有
+ * ——`deps.onAsk` 拿不到 ctx ⇒ 恒 `"unavailable"` ⇒ durable park,一张卡都不产。接上之后,bg run 的
+ * 权限 ask 走本腿的 **durable events tail**(`GET /v1/runs/:id/events`,唯一带 SSE `id:` 的面)。
+ *
+ * `streamApprovalOn` = 协议上场判据(`resolveStreamApprovalGate`,由路由层求值后传进来 —— 本函数是纯
+ * 执行腿,不该自己读 backend/config)。为假 ⇒ 只接既有四键 ctx(呈卡口/腿轴都不接),本腿字节逐字不变。
+ */
+approval?: {
+    coordinator: ToolApprovalCoordinator;
+    streamApprovalOn: boolean;
+    windowMs: number;
+    windowMarginMs: number;
+}): Promise<void>;
 /** How often a running instance refreshes its run's updated_at (liveness, independent of events).
  *  Must stay strictly below `runStaleSec` (asserted at startup) or the reaper would race live runs. */
 export declare const HEARTBEAT_MS = 30000;

package/dist/runs.js

@@ -3,6 +3,7 @@ import { withPrincipal } from "./observability/principal-context.js";
 import { redactSecrets } from "./trace/redact.js";
 import { taskNotificationEventData, appendModelUsageDelta, appendPromptManifest, attachModelUsage } from "./trace/project.js";
 import { createLedgerSink } from "./trace/ledger-sink.js";
+import { createApprovalCardEmitter, resolveApprovalLeg } from "./tool-approval.js";
 import { fleetRunResiduals, isFleetAgentTerminalNotification } from "./fleet/fleet-bus.js";
 import { defaultSubagentTailBus, projectTailFrame } from "./fleet/subagent-tail-bus.js";
 import { emitPendingWorkflowCompletions, taskNotificationInboxEntry, taskNotificationStreamKey, NotifiedKeys } from "./orchestration/workflow-completion-inbox.js";
@@ -331,7 +332,16 @@ completionDiagLog,
 sendUserFile, 
 /** [998]② the shared prompt-manifest accumulator (tracer records at prepare; this leg drains the pending
  *  record into a durable `prompt_assembled` event — turns/stream read it). undefined ⇒ not wired. */
-promptManifests) {
+promptManifests, 
+/**
+ * #151 车3 刀 3b:**bg 腿的流内审批 ctx**(design/172 §4.3(b))。今天为止这条腿连 approval ALS 都没有
+ * ——`deps.onAsk` 拿不到 ctx ⇒ 恒 `"unavailable"` ⇒ durable park,一张卡都不产。接上之后,bg run 的
+ * 权限 ask 走本腿的 **durable events tail**(`GET /v1/runs/:id/events`,唯一带 SSE `id:` 的面)。
+ *
+ * `streamApprovalOn` = 协议上场判据(`resolveStreamApprovalGate`,由路由层求值后传进来 —— 本函数是纯
+ * 执行腿,不该自己读 backend/config)。为假 ⇒ 只接既有四键 ctx(呈卡口/腿轴都不接),本腿字节逐字不变。
+ */
+approval) {
     const startedAt = Date.now();
     metrics?.addGauge("runs_active", 1);
     fleetPublisher?.onStart(); // MF-Fleet: the row goes live (running) the moment the background run starts
@@ -372,6 +382,21 @@ promptManifests) {
     // The owning principal is this run's owner — thread it as the single-DB-fleet null-safe owner guard on every
     // run-store mutation/poll below (the run row was created with owner = principal ?? null).
     const owner = principal ?? null;
+    // #151 车3 刀 3b(§7.3 + §8.3):本腿的审批装配裁定走**三腿共用**的那一份判据。
+    // 🔴 codex 交叉复审 F3(2026-08-06 真 finding)的修:此前本腿**无条件**包 ALS,只把新协议的口与轴挂在
+    // `streamApprovalOn` 后面 —— 于是 ①开关关时本腿的行为变了(此前它根本没有 approval ctx,每只 ask 恒
+    // `"unavailable"` ⇒ 恒 park;包上之后变成活卡并等满窗,A-1 当场破),②窗=0 在本腿上不生效(照样落行、
+    // 注册资源、发帧,再等一个 0ms 的表)。现在两件都由下面这一个裁定统一管。
+    // 取值点 = **本腿开始执行的时刻** = `runInBackground` 进入(路由层 `void runInBackground(...)` 之后
+    // 立刻),不是请求到达时刻(§3.3:按任务创建至今算会系统性算错)。
+    const approvalLeg = resolveApprovalLeg({
+        streamApprovalOn: approval?.streamApprovalOn === true,
+        windowMs: approval?.windowMs ?? 0,
+        windowMarginMs: approval?.windowMarginMs ?? 0,
+        ...(typeof spec.limits?.maxWalltimeMs === "number" ? { legWalltimeMs: spec.limits.maxWalltimeMs } : {}),
+        nowMonotonicMs: performance.now(),
+    });
+    const legDeadlineMonotonic = approvalLeg.legDeadlineMonotonic;
     const heartbeat = setInterval(() => {
         // 鲁棒性批5 A5(2026-08-05):与下面 cancel/preempt 两条兄弟同族——此前裸吞错,store 持续故障期间本 run
         // 的心跳每拍静默落空、运维零信号,直到某个副本的 reapStale 把它误判死亡(心跳失败正是那个误判的前兆)。
@@ -476,6 +501,15 @@ promptManifests) {
         const { type, ...rest } = frame;
         return append(type, rest);
     };
+    // #151 车3 刀 3b(design/172 §4.3(b)):同款 durable-append emit,服务**审批**帧 —— 既有
+    // `tool_approval`/`tool_approval_complete` 走它,新协议的 `approval_request` 也走它(同一条投递面、
+    // 两种帧,§4.3(a) 的「不新增出口」在这条腿上的落实)。`type` 是 SSE 事件名,其余是 data。
+    // 撤卡帧(`approval_revoke`)**不接**:它是 live-only 语义(不进账本 —— reaper/收敛器那类调用点没有
+    // seq 可分配),而本腿的唯一投递面就是账本;丢帧的结构补偿是重连 preamble 的全量对账基准。
+    const approvalEmit = (frame) => {
+        const { type, ...rest } = frame;
+        return append(type, rest);
+    };
     try {
         // P1 ①② follow-on (core): drain this session's async-workflow completion inbox at the START of the
         // background leg (before ANY branch — verify/cascade/plain-stream all get it; parity with the sync leg's
@@ -742,10 +776,34 @@ promptManifests) {
             const withQuestion = () => question
                 ? question.runWithContext({ taskId, owner: elicitOwner ?? owner, emit: questionEmit, abortSignal: cancelCtrl.signal }, withElicit)
                 : withElicit();
+            // #151 车3 刀 3b:审批 ALS —— 本腿**首次**拿到卡面(此前 `deps.onAsk` 在这条腿上恒无 ctx ⇒
+            // `"unavailable"` ⇒ 恒 park)。嵌套序同样无关(各自独立 ALS)。
+            // 🔴 F3 修:包不包 ALS 由 `approvalLeg` 决定,不再是「协调器在场就包」。
+            //  · `active === false`(协议没上场)⇒ 不包 ⇒ `deps.onAsk` 找不到 ctx ⇒ `"unavailable"` ⇒ core
+            //    durable park —— 这正是本腿在协议之前的逐字行为(A-1)。
+            //  · `windowZero`(运维关窗 / 贴 deadline)⇒ 同样不包。本腿没有 per-task `spec.onAsk` 装配点,
+            //    「不包 ALS」就是 sync 腿那个 immediate-unavailable 闭包在这条腿上的**等价形**(§8.2 已亲证:
+            //    `approverUnavailable === true` 与「onAsk 缺席」在 park 结局上逐字等价)。
+            const withApproval = () => approval && approvalLeg.active && !approvalLeg.windowZero
+                ? approval.coordinator.runWithContext({
+                    taskId,
+                    owner: elicitOwner ?? owner,
+                    emit: approvalEmit,
+                    abortSignal: cancelCtrl.signal,
+                    ...(spec.sessionId ? { sessionId: spec.sessionId } : {}),
+                    // 同一条 durable tail(§4.3(b))。经共用的投递口工厂:账本 append 失败 ⇒ 如实算「这一路没
+                    // 接下」(本腿只有这一个 sink,于是=整条没送到),协调器据此走 park 而不是挂到窗到期(R2-1)。
+                    emitCard: createApprovalCardEmitter({ appendDurable: (f) => approvalEmit(f) }),
+                    // bg run 的这条腿恒是**首腿**(park→resume 走的是 server.ts 的 resume 腿,那条自己带
+                    // token 摘要);空串是首腿的真值,不是「未知」。
+                    legKey: "",
+                    ...(legDeadlineMonotonic !== undefined ? { legDeadlineMonotonic } : {}),
+                }, withQuestion)
+                : withQuestion();
             // SendUserFile 帧与 question 帧同投递面(durable events tail,web 渲染文件卡);嵌套序无关(ALS 互不相交)。
             return sendUserFile
-                ? sendUserFile.runWithContext({ taskId, emit: (frame) => { const { type, ...rest } = frame; return append(type, rest); } }, withQuestion)
-                : withQuestion();
+                ? sendUserFile.runWithContext({ taskId, emit: (frame) => { const { type, ...rest } = frame; return append(type, rest); } }, withApproval)
+                : withApproval();
         });
         // Cancelled mid-stream and the generator ended WITHOUT a terminal event (abort can end the stream cleanly
         // rather than throwing) — finalize cancelled here so the run isn't left "running" for the reaper to catch.

package/dist/runtime-caps-resolver.d.ts

@@ -30,6 +30,9 @@ import type { RuntimeCaps } from "@sema-agent/core";
 import type { EntitlementRuntimeCaps } from "@sema-agent/registry-core";
 import { fetchPrincipalCaps, type ExecutionRuling } from "./config-center/facade.js";
 import type { ScenarioRuling } from "./capabilities/scenarios.js";
+import { type Logger } from "./observability/logger.js";
+/** test-only: reset the once-per-process trace so each test observes a fresh "first hit". */
+export declare function resetExecutionLaneDefaultTraceForTest(): void;
 export interface EntitlementsResolverOpts {
     baseUrl: string;
     token: string;
@@ -99,8 +102,11 @@ export interface PrincipalEntitlementsClient {
  * allowlist + this worker's lane (machine code on the wire, prose stays with the shell/web).
  * No ruling / required=false / caps blip ⇒ pass (fail-open + audit). `allowedLanes` is an
  * OPEN domain — unknown names simply never match this worker's lane.
+ *
+ * `logger` (optional, defaults to this module's `defaultLogger`) is an injection seam purely for the
+ * once-per-process default trace below (test observability) — it does not change enforcement.
  */
-export declare function gateExecutionLane(ruling: ExecutionRuling | undefined, ownLane: string): void;
+export declare function gateExecutionLane(ruling: ExecutionRuling | undefined, ownLane: string, logger?: Logger): void;
 /**
  * Build the per-principal caps client: `resolveRuntimeCaps` matches core's seam signature
  * `(principal) => Promise<RuntimeCaps | undefined>`; `scenarioRuling` rides the SAME fetch/cache/in-flight

package/dist/runtime-caps-resolver.js

@@ -2,6 +2,48 @@ import { fetchPrincipalCaps } from "./config-center/facade.js";
 import { HttpError } from "./security.js";
 import { createLogger } from "./observability/logger.js";
 const defaultLogger = createLogger();
+/** #157 / [2762]§五(sema-comms `audits/failopen-governance-176.md` §7 "已知在办 1 条"):module-scope,
+ *  once-per-process record of which {@link gateExecutionLane} fail-open DEFAULT form has already been traced.
+ *  Two forms are counted SEPARATELY (both currently resolve to the same "pass" default, but they are different
+ *  facts about the world — a caller must be able to tell "we never got a ruling for this principal" apart from
+ *  "center ruled, and explicitly said not-required"):
+ *   - `"no_ruling"` — `ruling === undefined` (no principal / center absent-or-blip / older center missing the key).
+ *   - `"required_false"` — a ruling WAS resolved and it explicitly says `required: false`.
+ *  Each form logs ONCE per process at first hit (a debug line — this is an expected, non-alarming default, not a
+ *  warning); every subsequent hit of the SAME form only increments the counter (no repeat log line — this is a
+ *  per-task gate, so without the throttle a busy deployment would log once per task forever). Pure record-keeping:
+ *  never changes {@link gateExecutionLane}'s pass/deny outcome. */
+const executionLaneDefaultTrace = new Map();
+/** test-only: reset the once-per-process trace so each test observes a fresh "first hit". */
+export function resetExecutionLaneDefaultTraceForTest() {
+    executionLaneDefaultTrace.clear();
+}
+function traceExecutionLaneDefault(form, ownLane, logger) {
+    const hitCount = (executionLaneDefaultTrace.get(form) ?? 0) + 1;
+    executionLaneDefaultTrace.set(form, hitCount);
+    if (hitCount > 1)
+        return; // subsequent hits: silently counted only (see map above), no repeat log line
+    try {
+        // codex 交叉复审第二轮真发现(2026-08-05):a throwing `logger.debug` must NEVER turn this pure
+        // observability step into gateExecutionLane itself throwing — that would silently convert a fail-open
+        // PASS into an uncaught exception, the exact inversion this module's whole design fights elsewhere
+        // (see the FAIL-CLOSED/FAIL-OPEN posture doc above). The hit-count above already advanced, so a retry
+        // of the SAME form stays silent rather than storming — the trade-off is "lose one trace line", not
+        // "lose one task admission".
+        logger.debug("execution_lane_default_applied", {
+            dimension: "execution_lane",
+            form,
+            ownLane,
+            default: "pass",
+            note: form === "no_ruling"
+                ? "no execution-lane ruling was ever resolved for this principal (no principal / center absent-or-blip / older center without the key)"
+                : "center resolved a ruling and explicitly set required=false",
+        });
+    }
+    catch {
+        // tracing must never affect the fail-open admission outcome — see comment above.
+    }
+}
 /** Map center's `EntitlementRuntimeCaps` → the subset core's engine enforces. `allowUltracode` (shell/UX) is
  *  dropped on purpose (not a core primitive); `allowWorkflows` / `forceDurableGate` / `allowFork` are the three the
  *  engine enforces. Returns undefined when no enforceable cap is set (= no restriction). FAIL-CLOSED defense-in-depth:
@@ -60,10 +102,19 @@ export function scopedTokenNeedsWorker(token, worker) {
  * allowlist + this worker's lane (machine code on the wire, prose stays with the shell/web).
  * No ruling / required=false / caps blip ⇒ pass (fail-open + audit). `allowedLanes` is an
  * OPEN domain — unknown names simply never match this worker's lane.
+ *
+ * `logger` (optional, defaults to this module's `defaultLogger`) is an injection seam purely for the
+ * once-per-process default trace below (test observability) — it does not change enforcement.
  */
-export function gateExecutionLane(ruling, ownLane) {
-    if (!ruling?.required)
+export function gateExecutionLane(ruling, ownLane, logger = defaultLogger) {
+    if (!ruling) {
+        traceExecutionLaneDefault("no_ruling", ownLane, logger);
         return;
+    }
+    if (!ruling.required) {
+        traceExecutionLaneDefault("required_false", ownLane, logger);
+        return;
+    }
     if (!ruling.allowedLanes.includes(ownLane)) {
         throw new HttpError(403, `this worker's execution lane "${ownLane}" is not permitted for this principal (execution policy)`, {
             code: "execution_lane_not_allowed",
@@ -149,7 +200,18 @@ export function createPrincipalEntitlementsClient(opts) {
                 return entry;
             }
             catch (err) {
-                const e = err instanceof Error ? err : new Error(String(err));
+                // codex 交叉复审第三轮真发现(2026-08-05):a poison rejection reason (throwing `Symbol.toPrimitive`/
+                // `toString`) must not make THIS normalization line itself throw — this catch block exists to
+                // GUARANTEE the documented FAIL-CLOSED degrade below runs; if normalizing `err` throws, that
+                // guarantee is exactly what breaks (resolveRuntimeCaps/scenarioRuling/executionRuling would reject
+                // instead of resolving to their fail-closed/fail-open defaults on a degraded center response).
+                let e;
+                try {
+                    e = err instanceof Error ? err : new Error(String(err));
+                }
+                catch {
+                    e = new Error("center fetch failed with an unstringifiable rejection reason");
+                }
                 // Caps face FAIL CLOSED: deny the OPTIONAL amplification caps (workflows + fork); never force the durable
                 // gate on error. Scenario face FAIL OPEN: `scenario` stays undefined (no governance — never pin users to
                 // the default scenario on a center blip; deliberate posture split, see PrincipalEntitlementsClient). Cache the

package/dist/sema-registry.d.ts

@@ -0,0 +1,41 @@
+/**
+ * Sema-registry adapter — pull the effective config from sema-registry and apply it OVER the
+ * env-derived defaults (env = fallback, center = override). Follows the "universal internal
+ * schema → translate at the boundary" pattern, with our security boundary kept:
+ *
+ *   - the CENTER owns the LOGICAL config: the model roster (names/capabilities/tier), the role map,
+ *     and team templates;
+ *   - the SERVICE env still owns the SECRETS: API keys stay in env (the center never stores a secret);
+ *     keys are per-model via `apiKeyEnv` → `config.modelApiKeyEnv` → the spec's `getApiKeyAndHeaders`
+ *     (core 1.45), so each model/cascade-rung authenticates with its own upstream key.
+ *
+ * Per-model `baseUrl` IS transported (a catalog model may live on a different gateway;
+ * core brain honors model.baseUrl, absent = "" = boot-env endpoint).
+ *
+ * Hot-reload status (复审 2026-07-29 P1-11 — 亲读判定,取代此处旧的 "models/roles are restart-to-apply"
+ * TODO, which went stale when `mutateInPlace` landed):
+ *   - models/roles/roster/teams/projects/autonomy — **HOT**. `applyEffective` mutates `config.models`/
+ *     `config.roles` IN PLACE, and core's Runner reads `this.deps.models/roles` per task off that very
+ *     reference. Both brains re-resolve `model.baseUrl || config.baseUrl` inside `buildRequest()` on every
+ *     call (core 2.1.0 `brain/openai.js` + `brain/anthropic.js`), so a moved gateway takes effect on the
+ *     next task with no restart.
+ *   - the same plane under a **tier-frozen** Runner — deferred, not hot: core expands a PRIVATE catalog copy
+ *     at construction, so `main` defers the whole plane and the `models-tiers` restart slice signals.
+ *   - **`degrade-route`** — the one genuinely boot-frozen catalog consumer left: reactive degrade
+ *     (`MODEL_DEGRADE_REACTIVE`) bakes the target Model + its gateway + its key into the brain composition
+ *     at boot. It cannot be hot-applied without rebuilding the brain, so it is registered on the existing
+ *     restartRequired /health contract instead (see `restart-signal.ts`). Fail-loud beats serving a stale
+ *     gateway silently on the rate-limit path.
+ *   - skills/mcp/scenarios/runtime-gates — restart-to-apply by construction (baked into the boot wiring).
+ *
+ * (design/158 A13, internal-lossless) This module is now a FACADE: the implementation lives in
+ * `src/config-center/` split by responsibility group (HTTP client / EffectiveConfig application /
+ * restart-signal detection / skills+MCP consumption). Every symbol below is re-exported UNCHANGED —
+ * existing `from "./sema-registry.js"` / `from "../sema-registry.js"` imports need zero changes.
+ */
+export { fetchEffective, fetchPrincipalCaps, ConfigCenterHttpError, fetchSkillContent, fetchPromptArtifact, fetchPromptBlob, } from "./config-center/http-client.js";
+export { mutateInPlace, applyEffective, applyRuntimeGates, applyRuntimeHot, resolveDefaultModelName, logEffectiveDiff, runtimeHasActiveGate, } from "./config-center/apply-effective.js";
+export { restartReasons, planeHasActiveTiers, modelPlaneChanged, type RestartSlice, type RestartSliceCtx, type RestartSignal, } from "./config-center/restart-signal.js";
+export { applyCenterSkills, resolveMcpServers, mcpForScenario } from "./config-center/skills-mcp.js";
+export type { CenterSkillManifest, CenterMcpServer, EffectiveConfig, ExecutionRuling, SessionMirrorRuling, } from "./config-center/types.js";
+//# sourceMappingURL=sema-registry.d.ts.map