@sema-agent/server 7.3.0 → 7.4.0

package/dist/http/routes/diagnostics.js

@@ -0,0 +1,140 @@
+import { resolveStreamApprovalGate } from "../../tool-approval.js";
+import { sendJson, sendError } from "../send.js";
+import { gatedPrincipal, explicitOperatorOk } from "../principal-gate.js";
+/** 纯数据产物(`build*`):三个门的当前读数。`streamApproval` 走**单一谓词**
+ *  `resolveStreamApprovalGate` —— 与 `/v1/capabilities` 的 `streamApproval` 位、与回决口的 501 门同一个
+ *  符号,所以诊断页读到的与消费端撞到的行为不可能不同。 */
+export function buildServerWiringGates(input) {
+    const gate = resolveStreamApprovalGate({
+        toolApprovalEnabled: input.toolApprovalEnabled,
+        streamApprovalEnabled: input.streamApprovalEnabled,
+        backend: input.backend,
+        parkFacility: input.checkpointStore !== undefined,
+    });
+    return {
+        streamApproval: gate.active ? "active" : gate.reason,
+        durableApproval: input.durableApproval,
+        checkpointStore: input.checkpointStore !== undefined,
+    };
+}
+/**
+ * 三项对表(设计稿件二)。判据全是**两个独立谓词对同一件事的答案**,矛盾即装配谎言 —— 装配谎言不是
+ * 「配置不理想」,是「服务端对自己接了什么线的两套说法互斥」,继续启动只会把矛盾带进运行期的每一条腿。
+ *
+ *  ① park 设施:core 从 `spec.checkpointStore ?? deps.checkpointStore` 判 `parkLane.capable`,我方从
+ *     `backend.checkpoint ∧ DURABLE_APPROVAL` 判 `parkFacility` 并据此决定流内审批协议上不上场。两者
+ *     不等 ⇒ 协议按「窗到期能 park」上场而引擎侧根本不 park(结局是 core fail-closed deny),或反之
+ *     白白关掉一个可用的协议。`capable` 真而 `effective` 不真同样致命:能力在、这条部署形上却不会真的
+ *     park,窗到期依旧无降级目的地。
+ *  ② 会话店持久性:manifest 声明 `declared_durable` 而后端是 local / 根本没有后端 ⇒ 「重启存活」的声明
+ *     没有介质兑现。这条与 memory+durable 两条既有拒启同族(声明与介质必须对得上)。
+ *  ③ interaction posture 声明 `interactive` 却没有任何 question 投递面 ⇒ 只 **warn**:core 在 prepare 时
+ *     会按腿拒,boot 先一步把话说成人话。不拒启,因为部署形本身可能只是暂时没接活体面,而 core 侧已有
+ *     兜底门 —— 拒启会把一个可运行的部署挡在门外。
+ *  ④ park 车道的持久性读数不可信时 ⇒ **warn**(理由与这条判据为什么不是拒启,见其行内注)。
+ *
+ * 判决分两级是有判据的:**拒启**留给「两个谓词对同一件事互斥」(其中一个必错,继续跑就是带着谎言服务);
+ * **警告**留给「读数不可信/声明不完整」(信号本身还不足以断定谁错,据此拒启会挡住正常部署)。
+ */
+export function buildStaticWiringAudit(facts) {
+    const refusals = [];
+    const warnings = [];
+    const park = facts.manifest.parkLane;
+    if (park.capable !== facts.parkFacility) {
+        refusals.push(`park facility contradiction: the engine's static wiring says parkLane.capable=${park.capable} while this server assembled its approval gates with parkFacility=${facts.parkFacility}. ` +
+            `One of the two is wrong about the same checkpoint store — refusing to start rather than serving a worker whose approval lane can silently fail closed. ` +
+            `Check DURABLE_APPROVAL and the backend's checkpoint face (they are what both predicates read).`);
+    }
+    else if (facts.parkFacility && park.effective !== true) {
+        refusals.push(`park facility contradiction: this server assembled its approval gates with parkFacility=true, but the engine's static wiring resolves parkLane.effective=${JSON.stringify(park.effective)} (reasons: ${park.reasons.join(", ") || "none"}). ` +
+            `A window expiry would then have no degradation target and adjudicate as a fail-closed deny — refusing to start.`);
+    }
+    // 判据写成「不在持久集合里」而不是「是 local」是有方向的:将来多一种 backend kind 时,它会**拒启**
+    // 直到有人显式把它判进持久集,而不是静默通过 —— 声明与介质的对表,失败方向必须朝拒绝那边。
+    if (facts.manifest.session.store === "declared_durable" && facts.backendKind !== "mysql" && facts.backendKind !== "pg") {
+        refusals.push(`session store durability contradiction: the engine's static wiring reports session.store="declared_durable" while the store backend is ${facts.backendKind === undefined ? "absent (env-only worker)" : `"${facts.backendKind}"`}. ` +
+            `A durable declaration with no durable medium is a claim nothing can honor — refusing to start. Wire DB_BACKEND=mysql|pg, or fix the store's durability declaration.`);
+    }
+    // park 车道的**持久性读数**(codex 交叉复审 2026-08-07 R2-F2,验真后部分采纳)。`capable` 说的是
+    // 「有没有 checkpoint 店」、`effective` 说的是「这条部署形会不会真 park」—— 两者都为真时仍可能是一个
+    // 重启即丢的店,那样窗到期后被 park 的审批在重启后无法赎回,而流内审批协议正是拿 park 当降级目的地。
+    // 🔴 为什么是 **warn 而不是拒启**:本仓的 SQL/local checkpoint 店**都还没有 `durability` 声明**,core
+    // 因此对每一个真持久部署都读出 `process_local`。据此拒启会拿一个不可信信号挡住 100% 的现存 durable
+    // 部署 —— 那不是查出矛盾。根治在店侧补声明;在那之前,把「这个读数不可信」响亮说出来,不静默。
+    if (facts.parkFacility && facts.manifest.parkLane.checkpointDurability !== "declared_durable") {
+        warnings.push(`park facility is enabled but the checkpoint store does not declare durable storage ` +
+            `(parkLane.checkpointDurability=${JSON.stringify(facts.manifest.parkLane.checkpointDurability ?? null)}). ` +
+            `A parked approval survives a restart only on a durable store — and the in-tree checkpoint adapters currently declare no durability at all, so this reading cannot yet distinguish "really process-local" from "nobody declared it". ` +
+            `Treat park-lane recovery as unproven until the adapter declares its durability.`);
+    }
+    if (facts.manifest.interaction.posture === "interactive" && facts.manifest.question.wired !== "wired") {
+        warnings.push(`interactionPosture declares "interactive" but no question delivery face is wired (question.wired=${JSON.stringify(facts.manifest.question.wired)}) — ` +
+            `every leg that asks a question will be refused by the engine at prepare time. Wire the live question seam (ASK_QUESTION_ENABLED), or declare the headless posture.`);
+    }
+    return { refusals, warnings };
+}
+/**
+ * boot 消费口:`refusals` 非空即抛(拒启,与 memory+durable 两条既有拒启同族的 fail-loud 形),
+ * `warnings` 逐条 warn。返回判决本体,调用方可以继续把读数打进启动 info 行。
+ */
+export function assertStaticWiringConsistent(facts, logger) {
+    const audit = buildStaticWiringAudit(facts);
+    for (const w of audit.warnings)
+        logger?.warn("wiring_static_warning", { detail: w });
+    if (audit.refusals.length > 0) {
+        throw new Error(`static wiring self-check failed — refusing to start:\n${audit.refusals.map((r) => `  · ${r}`).join("\n")}`);
+    }
+    return audit;
+}
+export async function handleDiagnostics(req, res, url, ctx) {
+    const miss = { fell: false };
+    await handleDiagnosticsBody(req, res, url, ctx, miss);
+    return !miss.fell;
+}
+async function handleDiagnosticsBody(req, res, url, ctx, miss) {
+    const { deps } = ctx;
+    // 件三:「这台 worker 到底接了什么线」一屏看清 = core 的静态半场(含 `governance` 段 —— 本面**就是**
+    // 那个段的 operator 受众)+ server 自己三个装配谓词的读数。
+    //
+    // 门 = `explicitOperatorOk`(**不是** `isOperator`)。执法条件是**名单在场 ∨ 多租户**,不是只看
+    // `REQUIRE_PRINCIPAL`:本件的 SSE 腿对同一段 governance 恒判 `explicitOperatorOk`,若这里只在
+    // REQUIRE_PRINCIPAL 时判,「列了 operator 名单却没开 REQUIRE_PRINCIPAL」的部署上就成了流里关着、
+    // 端点上开着 —— 一个秘密两套门,严的那道白严(codex 交叉复审 2026-08-07 R2-F1,验真后采纳)。
+    // 名单为空 ∧ 非多租户 = 单租户 turnkey:该部署没有 operator 这个概念,唯一的用户就是 operator,
+    // 边界由全局 service-credential 门把守(与 `GET /v1/outcomes` 同裁)。
+    // 401 由更上游的全局门给出,本域只判 operator 与否。
+    //
+    // ⚠️ 与 SSE 腿的**残余不对称**(显式裁定,不是疏忽):turnkey 形上流里仍然谁都拿不到治理段,而本端点
+    // 给。理由=流是多订阅面且身份来自连接、端点是一次显式的 operator 请求;失败方向因此在流那侧更严。
+    //
+    // **不含** per-leg effective 历史:治理段只存在于 live 帧的 operator 投影里,durable 账本恒存剥后形
+    // (账本写时不知道未来读者是谁)。历史考古是另一件事,不在本面伪装成有。
+    if (req.method === "GET" && url === "/v1/diagnostics/wiring") {
+        if (deps.config.operatorPrincipals.length > 0 || deps.config.requirePrincipal) {
+            const principal = gatedPrincipal(req, deps.config);
+            if (!explicitOperatorOk(principal, deps.config.operatorPrincipals)) {
+                sendError(res, 403, "auth.operator_only", "wiring diagnostics are operator-only on a multi-tenant worker");
+                return;
+            }
+        }
+        // 静态半场是 **composition root 在 boot 算的**(与拒启自检同一份产物,不可能与它不同)。缺席 ⇒ 这个
+        // 进程不是由 main.ts 装起来的(测试夹具形),此面诚实地不存在 —— 落到全局 404,而不是回一个空壳 200。
+        if (!deps.staticWiring) {
+            miss.fell = true;
+            return;
+        }
+        sendJson(res, 200, {
+            static: deps.staticWiring,
+            serverGates: buildServerWiringGates({
+                toolApprovalEnabled: deps.toolApproval !== undefined,
+                streamApprovalEnabled: deps.config.streamApproval?.enabled === true,
+                backend: deps.backend,
+                checkpointStore: deps.checkpointStore,
+                durableApproval: deps.config.durableApproval === true,
+            }),
+        });
+        return;
+    }
+    miss.fell = true;
+}
+//# sourceMappingURL=diagnostics.js.map

package/dist/http/routes/tasks.js

@@ -6,7 +6,7 @@ import { defaultSubagentTailBus, projectTailFrame } from "../../fleet/subagent-t
 import { emitPendingWorkflowCompletions, taskNotificationInboxEntry, taskNotificationStreamKey, NotifiedKeys } from "../../orchestration/workflow-completion-inbox.js";
 import { createLedgerSink } from "../../trace/ledger-sink.js";
 import { redactSecrets } from "../../trace/redact.js";
-import { contextUsageEventData, toolStartEventData, toolEndEventData, taskProgressEventData, taskNotificationEventData, compactedEventData, diagnosticsEventData, brainStatusEventData, steeringInjectedEventData, compactionOutcomeEventData, workspaceChangedEventData, wiringManifestEventData, humanInputEventData, appendModelUsageDelta, attachModelUsage } from "../../trace/project.js";
+import { contextUsageEventData, toolStartEventData, toolEndEventData, taskProgressEventData, taskNotificationEventData, compactedEventData, diagnosticsEventData, brainStatusEventData, steeringInjectedEventData, compactionOutcomeEventData, workspaceChangedEventData, wiringManifestEventData, wiringManifestOperatorEventData, humanInputEventData, appendModelUsageDelta, attachModelUsage } from "../../trace/project.js";
 import { cascadeConfig, runMeta } from "../run-meta.js";
 import { scopedIdempotencyKey } from "../idempotency.js";
 import { sendJson, sendError, sseHeaders } from "../send.js";
@@ -14,7 +14,8 @@ import { collectSsePreamble } from "../sse-log.js";
 import { buildApprovalPreamble, buildApprovalPreambleSseFrames } from "../../approval-card.js";
 import { createApprovalCardEmitter, resolveApprovalLeg, resolveStreamApprovalGate } from "../../tool-approval.js";
 import { buildActiveRunConflict, toDoneFrameResult } from "../active-run-conflict.js";
-import { headerStr, gatedPrincipal } from "../principal-gate.js";
+import { headerStr, gatedPrincipal, explicitOperatorOk } from "../principal-gate.js";
+import { failOpenTagForDroppedFrame, recordFailOpen } from "../../observability/fail-open.js";
 /** #135([C95]/[C96]):live 腿 SSE 数据帧的**唯一**出口 —— 载荷带账本可锚 `eventId`(非空 string)的帧
  *  前缀 `id: <eventId>` 行(SSE 游标=账本 eventId,壳/SDK 拿它锚进账本或断线换道 events tail 续读);
  *  无 eventId 的帧**不发行**,EventSource 沿用上一游标 —— 绝不合成占位 id(那会把不可锚的位置伪装成可锚)。
@@ -199,6 +200,11 @@ async function handleTasksBody(req, res, url, ctx, miss) {
                 if (!res.writableEnded)
                     onDisconnect();
             });
+            // #154 件一:本连接的 `wiring_manifest` 帧投哪一形。判据 = `explicitOperatorOk`(**不是** `isOperator`:
+            // 空 `OPERATOR_PRINCIPALS` 必须是「没有人是 operator」;把它读成「所有人都是」会让未配名单的部署把
+            // 治理面发给每一个订阅者)。**每连接求一次**、不逐帧求:身份在一条连接内不会变,而逐帧调用会让
+            // 每帧都重跑一遍凭证解析 —— 更重要的是,身份只在这一处判,帧循环里没有第二个可漂的判据。
+            const wiringOperatorFace = explicitOperatorOk(gatedPrincipal(req, deps.config), deps.config.operatorPrincipals);
             // #151 车3 §5.1:sync 腿的**开流重放**——`sseHeaders` + meta 帧之后、`streamBody` 之前,把同一
             // (owner, session) 的未决审批卡投成 `approval_request` preamble 帧。
             //
@@ -751,12 +757,17 @@ async function handleTasksBody(req, res, url, ctx, miss) {
                                     sseData(res, { type: "compaction_outcome", ...compactionOutcomeEventData(ev) });
                                 }
                                 else if (ev.type === "wiring_manifest") {
-                                    // 🔴 core 5.14.0 design/173 新臂 —— **止泄第一刀**。本臂到货当天,它落在下面那条裸
-                                    // catch-all 上,于是 `manifest.governance`(core 盖了 `audience:"operator"` 的治理面在场
-                                    // 段)被原样透传给任意租户订阅者;core 把失败方向写死成「no projection ⇒ do not disclose」,
-                                    // 所以在 operator 投影(#154)落地之前,唯一正确的服务端行为是**整段剥除**。
-                                    // 共享白名单构造器,与两条 durable 腿同源(账本可经 events 重放读走 ⇒ 同一泄露面同一剥法)。
-                                    sseData(res, { type: "wiring_manifest", ...wiringManifestEventData(ev) });
+                                    // 🔴 core 5.14.0 design/173 新臂。`manifest.governance` 盖着 `audience:"operator"`,core 把
+                                    // 失败方向写死成「no projection ⇒ do not disclose」——所以默认(租户)形整段剥除,含**对该段
+                                    // 取的哈希** `configFingerprint`(无盐 + 4 布尔 = 16 组合谕示器)。
+                                    // #154 件一:分叉只在这条 live 腿(**唯一知道调用方身份的腿**),两条 durable 腿恒存剥后形
+                                    // ——账本写时不知道未来读者是谁,存全量 = 把 operator-only 面写进租户可读介质。
+                                    sseData(res, {
+                                        type: "wiring_manifest",
+                                        ...(wiringOperatorFace
+                                            ? wiringManifestOperatorEventData(ev)
+                                            : wiringManifestEventData(ev)),
+                                    });
                                 }
                                 else if (ev.type === "human_input") {
                                     // core 5.14.0 design/171 新臂:谁把什么喂进了这条 run(本帧不带正文,只带载体/署名)。
@@ -803,8 +814,18 @@ async function handleTasksBody(req, res, url, ctx, miss) {
                     const askTaskId = durableTaskId ?? uuidv7();
                     const askOwner = gatedPrincipal(req, deps.config) ?? null;
                     const emitAsk = (frame) => {
-                        if (!res.writableEnded)
-                            res.write(`event: ${frame.type}\ndata: ${JSON.stringify(frame)}\n\n`);
+                        // #157(codex R2 复审 HIGH):流已断时这里是**静默 no-op** —— 上游 coordinator 的 try/catch
+                        // 因此拿不到任何信号,一次断连就被记成"投递成功",问题挂到 TTL 才按无人应答结算。方向本批
+                        // 不动(改成 throw 是既有的刻意决定,见下面 drain 包装处的注释),但**必须留痕**:否则
+                        // `open-frame-undelivered` 只覆盖"持久化抛错",覆盖不到真正常见的那条路。
+                        // `destroyed` 与 `writableEnded` 一起判——emitApproval 用的就是这对谓词。
+                        // 分类按帧型走(`failOpenTagForDroppedFrame`):这条闭包同时驮着 open 帧、完成面包屑与
+                        // 其它运行流帧,一刀切会让**一次**断连把保护型计数记两次,真 open 失败率被面包屑盖住。
+                        if (res.writableEnded || res.destroyed) {
+                            recordFailOpen(failOpenTagForDroppedFrame(frame.type), `frame=${frame.type}`);
+                            return;
+                        }
+                        res.write(`event: ${frame.type}\ndata: ${JSON.stringify(frame)}\n\n`);
                     };
                     // P1 ①②: this new turn is a stream-open for the session — push any async-workflow completions that
                     // finished since (frames ride the SAME connection, before the run's own events; the shell dedups by

package/dist/http/server.d.ts

@@ -413,6 +413,11 @@ export interface ServiceDeploymentDeps {
         ageMs: number;
         error?: string;
     } | undefined;
+    /** #154 件三:core `describeStaticWiring(deps, specTemplate)` 的 boot 产物 —— `GET /v1/diagnostics/wiring`
+     *  的 `static` 半场,**与启动期拒启自检读的是同一份**(诊断页与拒启判据结构性同源)。
+     *  operator-only 面,故整份原样下发(含 `governance` 段:本面就是那个段的受众)。
+     *  缺席 = 这个进程不是由 composition root 装起来的(测试夹具形)⇒ 该路由诚实地不存在(404)。 */
+    staticWiring?: import("@sema-agent/core").WiringManifest;
     /** ① core ruling — SPLIT: `capabilities.workflows` = the ENGINE-CAN axis, boot-computed from core's own
      *  `workflowsCapability(deps)` (hardened script runner ∧ governance), NOT the `Boolean(workflowRunStore)` store
      *  proxy. Orthogonal to `workflowsList` (the durable-list axis = `workflowRunStore`). Falls back to the store

package/dist/http/server.js

@@ -29,6 +29,7 @@ import { streamSseLog } from "./sse-log.js";
 import { clampVerifyRounds, verifyRoundsFromBody } from "./verify-rounds.js"; // design/97 R9: the shape's neutral leaf (route-ctx.ts type-imports VerifyRoundsSpec from here, not from this file)
 import { handleCapabilities } from "./routes/capabilities.js";
 import { handleObservability } from "./routes/observability.js";
+import { handleDiagnostics } from "./routes/diagnostics.js";
 import { handleMemoryPolicy } from "./routes/memory-policy.js";
 import { handleSessionsList } from "./routes/sessions-list.js";
 import { handleSessions, createSessionsLocal } from "./routes/sessions.js";
@@ -591,6 +592,9 @@ export function createHttpServer(rawDeps) {
         // design/158 A9:观测只读面(routes/observability.ts):/v1/outcomes + /v1/usage。
         if (await handleObservability(req, res, url, ctx))
             return;
+        // #154 件三:装配自证只读面(routes/diagnostics.ts):GET /v1/diagnostics/wiring(operator-only)。
+        if (await handleDiagnostics(req, res, url, ctx))
+            return;
         // design/158 A9:memory 导出/同步 + /v1/policy 只读面(routes/memory-policy.ts)。
         if (await handleMemoryPolicy(req, res, url, ctx))
             return;
@@ -2753,6 +2757,8 @@ const ROUTE_LABEL_LITERALS = new Set([
     // 名册门的枚举器当时只认 `url === …`,整条路由对门隐形(枚举器已一并补上)。
     "/v1/fleet/stream",
     "/v1/memory/export", "/v1/sendfile-links",
+    // #154:装配自证读面(operator-only)。低频但**每次都在排障现场被打**,落进 `other` 桶等于排障时看不见。
+    "/v1/diagnostics/wiring",
 ]);
 /** Stable, low-cardinality route label for metrics/logs (ids collapsed to `:id`).
  *  [#104] 字面量**先于**模式:此前模式先查,五条精确路由被形状桶吞掉(`/v1/approvals/stream`

package/dist/main.js

@@ -1,7 +1,7 @@
 import { readFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
-import { Runner, TtlSessionStore, uuidv7, defaultTaskRegistry, combinePolicies, createAllowDenyPolicy, workflowsCapability, createWebFetchSummarizer, resolveTaskModel as coreResolveTaskModel, probeSearchBackend } from "@sema-agent/core";
+import { Runner, TtlSessionStore, uuidv7, defaultTaskRegistry, combinePolicies, createAllowDenyPolicy, workflowsCapability, createWebFetchSummarizer, resolveTaskModel as coreResolveTaskModel, probeSearchBackend, describeStaticWiring } from "@sema-agent/core";
 import { createSessionTitler } from "./session-titler.js";
 import { posIntEnv } from "./session-watch.js";
 import { selectEnvironmentTool } from "./capabilities/select-environment-tool.js";
@@ -13,7 +13,7 @@ import { drainNumEnvWarnings } from "./plugins/remote-shell.js";
 import { ensureChildSessionDurableWithPromotion } from "./plugins/session-store.js";
 import { ForkRoutingSessionStore } from "./plugins/fork-routing-session-store.js";
 import { webSearchConfigFromEnv, createWebSearchBackend, setWebSearchBadPayloadObserver, shouldProbeWebSearchOnBoot } from "./plugins/web-search.js";
-import { createAuthorizer } from "./security.js";
+import { createAuthorizer, encodeCheckpointScope } from "./security.js";
 import { assertGateIntentServiceable, createDurableAskPolicy, hasOperatorGateIntent } from "./approval.js";
 import { loadSkills } from "./capabilities/skills.js";
 import { GiteaClient } from "./capabilities/repo-tools.js";
@@ -22,6 +22,7 @@ import { createLogger } from "./observability/logger.js";
 import { createToolTracer, createPermissionDeniedMeter } from "./observability/tool-trace.js";
 import { createRegistryJwtVerifier } from "./auth-bridge.js";
 import { createMetrics } from "./observability/metrics.js";
+import { installFailOpenRecorder } from "./observability/fail-open.js";
 import { setRedactionObserver, redactSecrets } from "./trace/redact.js";
 import { RateLimiter } from "./observability/rate-limit.js";
 import { createHttpServer, explicitOperatorOk } from "./http/server.js";
@@ -49,6 +50,7 @@ import { createRunnerDeps, createSharedRunnerDeps } from "./boot/runner-deps.js"
 import { createOrgMemoryAdmissionWiring } from "./boot/org-memory.js";
 import { createSessionFaces } from "./boot/session-faces.js";
 import { createLeaderFace } from "./boot/leader.js";
+import { assertStaticWiringConsistent } from "./http/routes/diagnostics.js";
 import { installShutdownHandlers } from "./boot/shutdown.js";
 /** Service version for GET /v1/capabilities — read from the package.json shipped next to src/ in the
  *  image (Dockerfile COPYs it). Best-effort: an unreadable file reports "unknown", never crashes boot. */
@@ -105,6 +107,10 @@ async function main() {
     }
     const logger = createLogger(config.logLevel);
     const metrics = createMetrics();
+    // #157 fail-open 治理:把 logger/metrics 接到进程级 failOpen 记录器上(见 observability/fail-open.ts)。
+    // 排在这里而不是更晚:兜底臂遍布装配链,越早接上,越少的 fail-open 只剩探针行没有结构化痕迹。
+    // 装配前已累计的计数与已喊过的 tag 由 install 继承,不重置也不重喊。
+    installFailOpenRecorder({ logger, metrics });
     // S20 (SILENT-FALLBACK P1) + [792]④ boot notices: config parsing runs before the logger exists — drain both
     // pre-logger collectors via the shared helper (F10: run-local uses the same one, so entrypoints can't drift).
     logConfigDiagnostics(logger);
@@ -181,7 +187,7 @@ async function main() {
     const { sqlWorkflowRunStore, workflowNotifyJournal, workflowCompletionInbox, deliverWorkflowCompletion, workflowNotifyGate, fleetBus, workflowRunStore, workflowJournalStore, outcomeSink, workflowAgentRegistry, subagentSteerRegistry, } = createWorkflowOrchestration({ config, logger, metrics, localRoot, backend, getRunStore: () => runStore });
     // design/158 A10:活体协调器 + SendUserFile 工具面搬到 src/boot/coordinators.ts(逐字;durableEnabled 的
     // 「必须早于 runnerDeps 求值」次序契约见该文件头注)。
-    const { elicitation, question, toolApproval, durableEnabled, sendUserFileEmitter, sendFileLedger, sendUserFileToolSpec } = createLiveCoordinators({ config, logger, backend, sendUserFileTaskEnvs });
+    const { elicitation, question, toolApproval, durableEnabled, streamApprovalGate, sendUserFileEmitter, sendFileLedger, sendUserFileToolSpec } = createLiveCoordinators({ config, logger, backend, sendUserFileTaskEnvs });
     // design/158 A10:per-principal caps 段搬到 src/boot/runtime-caps.ts(逐字)。
     const { principalCaps, centerRuntimeCapsResolver, runtimeCapsResolver } = createRuntimeCaps({ config, logger });
     // design/170 件A(#148 件3③):org 记忆准入装配(目录源三态选择+C12 能力探测,坏配置在此拒启动)。
@@ -704,6 +710,30 @@ async function main() {
     // asyncRewake wake 管道 holder:server 启动时装 deliver(session→本副本活流 steer);createTaskHooks 的
     // ctx.wake 闭包经它投递(main 建壳/server 填实,双向不循环依赖)。
     const hookWakeBus = {};
+    // ═══════════ #154 件二:启动期静态装配自检(coordinators 构造后、listen 之前)═══════════
+    // core 的 `describeStaticWiring` 与本仓的装配谓词是**两个独立实现**在回答同一组问题。答案矛盾 =
+    // 装配谎言(不是「配置不理想」:是服务端对自己接了什么线有两套互斥说法),fail-loud 拒启 ——
+    // 与 memory+durable 两条既有拒启同族。判据本体在 http/routes/diagnostics.ts(诊断读面与拒启判据同源)。
+    //
+    // specTemplate = resolve-spec 对**每一条**任务腿都会盖的那两个 durable 键(它的 durableEnabled 分支)。
+    // 静态半场只读它们的**在场性**(`parkDurableApprovalOptIn = spec.durableApproval !== undefined`),
+    // 所以这里给的是那个形,而不是某条腿的 principal 真值。
+    const wiringSpecTemplate = durableEnabled
+        ? { checkpointStore, durableApproval: { scope: encodeCheckpointScope(undefined) } }
+        : {};
+    const staticWiring = describeStaticWiring(runnerDeps, wiringSpecTemplate);
+    // `parkFacility` 传的必须是**协调器真喂给 `resolveStreamApprovalGate` 的那个实参**(durableEnabled),
+    // 不是在这里重算一遍 —— 重算会把「两个站点算出了不同答案」这件正要被查的事抹平。
+    assertStaticWiringConsistent({ manifest: staticWiring, parkFacility: durableEnabled, backendKind: backend?.kind }, logger);
+    // operator 日志面(**非 wire**)。`configFingerprint` 只有 effective 半场才铸(core 按腿算),静态半场
+    // 没有这一位 ⇒ 诚实报 null,不自造一个服务端哈希(那会是一个要跨仓对表的新语义)。
+    logger.info("wiring_static", {
+        fingerprint: staticWiring.configFingerprint ?? null,
+        parkEffective: staticWiring.parkLane.effective,
+        sessionDurability: staticWiring.session.store,
+        posture: staticWiring.interaction.posture,
+        streamApproval: streamApprovalGate.active ? "active" : streamApprovalGate.reason,
+    });
     // ═══════════ design/158 A8:ServiceDeps 分组装配(七组窄接口)═══════════
     // 每组一个**带类型标注**的中间 const —— 标注位触发 TS 多余属性检查,键放错组当场编译红。
     // (平铺形做不到:69 键的全可选面里任何键名都「属于」它,于是键落错家/从未接线只能靠源码钉
@@ -823,6 +853,7 @@ async function main() {
         modelReady: () => configCenter.modelReady(), // boot ready 门:roster 未落地=计费提交 503+health ready:false
         scenarioDetails, // 场景详情只读面(内建+center 同判定源)
         workflowsCapable, // ① core split: capabilities.workflows = engine-can (workflowsCapability); workflowsList = store (below)
+        staticWiring, // #154 件三:GET /v1/diagnostics/wiring 的 static 半场(与上面的拒启自检同一份产物)
         instanceId,
         // Capability discovery: the deployment facts only main knows. Store-derived booleans
         // (asyncRuns/artifacts/approvals/leader) are computed inside the server from the deps themselves.

package/dist/observability/fail-open.d.ts

@@ -0,0 +1,98 @@
+import type { Logger } from "./logger.js";
+import type { Metrics } from "./metrics.js";
+/** 登记项:`cls` 是判据表的分类(见模块头——只有这两类允许走本封装),`note` 说清"放行的最坏后果"。 */
+export interface FailOpenTagEntry {
+    /** `F`=纯体验/缓存回退,放行最坏后果只是"难看/不够好";`P-DEBT`=保护型欠账,方向明知不对、显式记债。 */
+    readonly cls: "F" | "P-DEBT";
+    /** 这条兜底放行了什么、最坏后果是什么。写给未来读遥测的人,不写来历。 */
+    readonly note: string;
+}
+/** 闭集 tag 词表。形=`<repo>.<domain>.<site>`(跨仓同形,便于三仓遥测并表)。 */
+export declare const FAIL_OPEN_TAGS: {
+    readonly "server.hitl.frame-undelivered-stream-closed": {
+        readonly cls: "P-DEBT";
+        readonly note: "HITL 的 **open** 帧(question / elicitation)写向一条已断/已关的 SSE 连接 ⇒ 静默丢弃,上游据此把投递记成成功,问到 TTL 才按无人应答结算。方向(no-op 而非 throw)是既有的刻意决定,本条只保证它不再无声。";
+    };
+    readonly "server.stream.frame-dropped-stream-closed": {
+        readonly cls: "F";
+        readonly note: "非 HITL-open 的运行流帧写向已断连接 ⇒ 丢弃。连接都没了,这一帧本就无人可看;单独立项是为了不让它挤进上面那条保护型计数。";
+    };
+    readonly "server.question.open-frame-undelivered": {
+        readonly cls: "P-DEBT";
+        readonly note: "AskUserQuestion 的 open 帧投递失败 ⇒ 按 headless 默认结算,模型不问人自己往下判。方向是刻意的产品姿态(绝不把 run 挂死),但一次投递故障确实让人在环这道门被跳过——记债,不当合法兜底。";
+    };
+    readonly "server.elicitation.open-frame-undelivered": {
+        readonly cls: "F";
+        readonly note: "MCP elicitation 的 open 帧投递失败 ⇒ 结算 decline。方向本身是 fail-closed(问不到人就是拒),缺的只是留痕。";
+    };
+    readonly "server.question.complete-breadcrumb-dropped": {
+        readonly cls: "F";
+        readonly note: "question_complete 面包屑(对话框消解提示)持久化失败。答案本身走的是另一条路且早已返回,丢的只是壳里一次收尾渲染。";
+    };
+    readonly "server.elicitation.complete-breadcrumb-dropped": {
+        readonly cls: "F";
+        readonly note: "elicitation_complete 面包屑持久化失败。同上——答案已经在壳手里,丢的是收尾渲染。";
+    };
+    readonly "server.prompts.artifact-cache-write-failed": {
+        readonly cls: "F";
+        readonly note: "已验签的提示词工件回填本地缓存失败。工件本身已返回给调用方;代价是下次同 digest 还要再取一次网络。";
+    };
+};
+/** 词表键推导的闭集类型——未登记的 tag 传不进 {@link recordFailOpen}(编译期拒)。 */
+export type FailOpenTag = keyof typeof FAIL_OPEN_TAGS;
+/**
+ * 断流丢帧该记哪个 tag —— **按帧型分类**,纯函数(与写流的那条闭包解耦,才单测得动)。
+ *
+ * 一刀切记同一个 tag 是错的:承载 HITL 帧的那条闭包同时驮着完成面包屑与其它运行流帧,于是**一次**
+ * 断连会让保护型计数涨两次(open 一次、complete 又一次),真正的 open 失败率被面包屑的假阳性盖住。
+ * 只有 open 帧是"人在环这道门被跳过"的证据,其余都是体验损失。
+ */
+export declare function failOpenTagForDroppedFrame(frameType: string): FailOpenTag;
+/** {@link createFailOpenRecorder} 返回的活对象(有行为、有状态 ⇒ `create*` 而非 `build*`)。 */
+export interface FailOpenRecorder {
+    /** 走到一条登记过的兜底臂。总不抛——观测本身绝不能变成故障(见 reapers 同族判据)。 */
+    record(tag: FailOpenTag, detail?: string): void;
+    /** 本进程各 tag 的累计次数(逐次计数,与一次性 warn 无关)。 */
+    counts(): ReadonlyMap<FailOpenTag, number>;
+    /** 已经喊过 stderr 契约行的 tag 集合——装配时由新实例继承,避免 install 让同一 tag 再喊一次。 */
+    warnedTags(): ReadonlySet<FailOpenTag>;
+    /** 还没进过任何 metrics 汇的次数(装配前命中的欠账)。install 用它补账,补完清零。 */
+    metricsBacklog(): ReadonlyMap<FailOpenTag, number>;
+    /** 已经进过结构化日志的 tag 集合。与 {@link warnedTags} **分开**:stderr 契约行装配前就能喊,
+     *  结构化 warn 却要等 logger 到场——两者共用一个集合会让装配前命中的 tag 永远拿不到结构化痕迹。 */
+    loggedTags(): ReadonlySet<FailOpenTag>;
+}
+/** 探针文件的 env 名(跨仓同名同形:`audits/failopen-governance-176.md` §2-r2,壳/引擎同认)。 */
+export declare const FAIL_OPEN_PROBE_ENV = "SEMA_FAILOPEN_PROBE";
+export interface FailOpenRecorderDeps {
+    logger?: Logger;
+    metrics?: Metrics;
+    /** 探针文件路径。缺省=读 `SEMA_FAILOPEN_PROBE`(读一次,不每次调用都碰 env)。 */
+    probePath?: string;
+    /** 继承自上一个实例的状态(install 换实例时不重置计数、不重喊 warn、不丢欠账)。 */
+    seedCounts?: ReadonlyMap<FailOpenTag, number>;
+    seedWarned?: ReadonlySet<FailOpenTag>;
+    seedBacklog?: ReadonlyMap<FailOpenTag, number>;
+    seedLogged?: ReadonlySet<FailOpenTag>;
+    /** 测试注入:替掉 stderr 契约行的落点。缺省直写 `process.stderr`。 */
+    writeStderr?: (line: string) => void;
+    /** 测试注入:替掉探针文件追加。缺省 `appendFileSync`(同步=进程猝死也不丢已记的行)。 */
+    appendProbe?: (path: string, line: string) => void;
+}
+export declare function createFailOpenRecorder(deps?: FailOpenRecorderDeps): FailOpenRecorder;
+/**
+ * 装配层接线:把 logger/metrics 接到进程单例上。搬四份状态过去,各有各的理由:
+ *  - `seedCounts` —— 逻辑总数续算,不从 0 重来;
+ *  - `seedWarned` —— boot 期已喊过的 stderr 契约行不再喊(「每进程每 tag 一次」是它的全部价值);
+ *  - `seedBacklog` —— 装配**前**命中的次数还没进任何 metrics 汇,交给新实例补账(补完清零,
+ *    所以第二次 install 不会重放);
+ *  - `seedLogged` —— 已真发出去的结构化 warn 不重发;没发过的由新 logger 补一条。
+ */
+export declare function installFailOpenRecorder(deps: Omit<FailOpenRecorderDeps, "seedCounts" | "seedWarned" | "seedBacklog" | "seedLogged">): FailOpenRecorder;
+/** 兜底臂的调用口。`tag` 必须已登记(闭集类型),`detail` 是可选的一行现场(路径/原因,不放密钥)。 */
+export declare function recordFailOpen(tag: FailOpenTag, detail?: string): void;
+/** 本进程各 tag 累计次数——`/metrics` 之外的进程内读数(测试与自检面用)。 */
+export declare function failOpenCounts(): ReadonlyMap<FailOpenTag, number>;
+/** test-only:换一个全新单例(计数与 warn 集合清零),让每个用例都从"第一次"看起。 */
+export declare function resetFailOpenRecorderForTest(deps?: FailOpenRecorderDeps): FailOpenRecorder;
+//# sourceMappingURL=fail-open.d.ts.map