@sema-agent/server 7.3.0 → 7.4.0

package/dist/question.d.ts

@@ -1,4 +1,4 @@
-import { type AskQuestionRequest, type QuestionAnswer, type AskQuestion } from "@sema-agent/core";
+import { type AskQuestionRequest, type OnQuestionOutcome, type QuestionAnswer, type AskQuestion } from "@sema-agent/core";
 /** A live question frame delivered to whoever tails this run's stream. `type` IS the SSE event name (mirrors the
  *  named-event convention; the payload also carries `type` so a proxy that strips event names still works). The shell
  *  renders `question` as a dialog and dismisses on `question_complete`. */
@@ -6,10 +6,10 @@ export interface QuestionFrame {
     type: "question" | "question_complete";
     questionId: string;
     /** "question" only: the model's structured questions, secret-redacted. UNTRUSTED-for-display (shell renders; never
-     *  re-feeds a model). Absent on an over-cap payload (the ask then headless-defaults). */
+     *  re-feeds a model). Absent on an over-cap payload (the ask then reports unavailable — no frame is emitted at all). */
     questions?: AskQuestion[];
     /** "question_complete" only: whether the human answered (`answered`) or the ask was released unanswered
-     *  (`unanswered` — ttl/abort → the model got the headless default). Cosmetic dialog-dismiss. */
+     *  (`unanswered` — ttl/abort → core was told nobody was reachable). Cosmetic dialog-dismiss. */
     outcome?: "answered" | "unanswered";
     /** Server-signed emit timestamp (additive, [2805]§五→[2806]). Server-minted side-frame ⇒ no core-stream
      *  `eventId` to carry (absence is honest); this is the frame's own time coordinate. */
@@ -31,12 +31,14 @@ export interface QuestionRunContext {
      *  background leg (emit appends to the durable events tail, readable whenever a client attaches). */
     deliverable?: () => boolean;
 }
+/** The per-run question window the deployment owns (core caps nothing). Env: `QUESTION_MAX_CONCURRENT_PER_RUN` /
+ *  `QUESTION_MAX_TOTAL_PER_RUN` / `QUESTION_TTL_MS` (see `ServiceConfig.questionThrottle`). */
 export interface QuestionThrottle {
-    /** Max concurrent in-flight questions per run leg (parallel tool calls can each ask). Breach ⇒ headless default. */
+    /** Max concurrent in-flight questions per run leg (parallel tool calls can each ask). Breach ⇒ unavailable. */
     maxConcurrentPerRun: number;
-    /** Max total questions one run leg surfaces to the human. Breach ⇒ headless default (flood defense). */
+    /** Max total questions one run leg surfaces to the human. Breach ⇒ unavailable (flood defense). */
     maxTotalPerRun: number;
-    /** An unanswered question auto-releases (headless default) after this (ms) — the human walked away; don't hold core. */
+    /** An unanswered question auto-releases as unavailable after this (ms) — the human walked away; don't hold core. */
     ttlMs: number;
 }
 export declare const DEFAULT_QUESTION_THROTTLE: QuestionThrottle;
@@ -54,7 +56,7 @@ export declare function parseQuestionResponse(body: unknown): {
  * Coordinates AskUserQuestion HITL for the singleton runner. Process-local + same-replica (the pending map is in memory,
  * like ElicitationCoordinator / steerableRuns): a respond that lands on another replica finds nothing → 404. Present
  * (passed into `RunnerDeps.onQuestion` + the respond route) ONLY when `ASK_QUESTION_ENABLED` — absent ⇒ core mounts the
- * AskUserQuestion tool with the headless default (a run never hangs; the model just can't get a live answer).
+ * AskUserQuestion tool with no seam at all (`seam_absent` continuation; the model just can't get a live answer).
  */
 export declare class QuestionCoordinator {
     private readonly als;
@@ -63,12 +65,13 @@ export declare class QuestionCoordinator {
     private readonly throttle;
     constructor(throttle?: QuestionThrottle);
     /** Run `fn` with the per-run question context ambient. On exit, release any still-pending question for this run (a
-     *  live-only question cannot outlive its leg → headless default) and drop the run's counters (no leak). */
+     *  live-only question cannot outlive its leg → unavailable) and drop the run's counters (no leak). */
     runWithContext<T>(ctx: QuestionRunContext, fn: () => Promise<T>): Promise<T>;
-    /** `RunnerDeps.onQuestion`. core calls this when the agent's AskUserQuestion tool fires; the resolved answer is what
-     *  the model sees. Headless default (`NO_HUMAN`) in every case with no live human, so the run never hangs. Arrow
-     *  property so it can be passed as `onQuestion: coordinator.question` with `this` bound. */
-    question: (req: AskQuestionRequest, signal?: AbortSignal) => Promise<QuestionAnswer>;
+    /** `RunnerDeps.onQuestion`. core calls this when the agent's AskUserQuestion tool fires; the resolved outcome is what
+     *  core acts on — a {@link QuestionAnswer} ONLY when a human really answered, otherwise `{kind:"unavailable"}` (core
+     *  then parks on a durable leg / continues with the `declined_unavailable` card on a non-durable one; either way the
+     *  run never hangs). Arrow property so it can be passed as `onQuestion: coordinator.question` with `this` bound. */
+    question: (req: AskQuestionRequest, signal?: AbortSignal) => Promise<OnQuestionOutcome>;
     /** `POST /v1/questions/:id/respond` — resolve a parked question with the shell's answer. Owner-gated with a 404 (no
      *  existence oracle): a non-owner AND an unknown id (answered / expired / wrong replica) both get 404. Returns the
      *  HTTP {status, body}; the HTTP layer owns auth (gatedPrincipal + REQUIRE_PRINCIPAL) before calling. */
@@ -83,9 +86,10 @@ export declare class QuestionCoordinator {
      *  resolve-spec 的 durable question policy 用它在**判决时**分腿:有活流 ⇒ allow(问活人),无 ⇒
      *  ask(durable park)。ALS 让这个判断天然 per-leg,policy 组装期不必预知腿别。
      *  🔴 判据是「投递面此刻可达」而不只是「ALS 在场」(复审 A1):detach 腿断连后 run 仍在本作用域里跑,
-     *  只判 ALS 会把一条谁也收不到的问题判成 allow(挂满 ttl 后以空答喂模型),而 park 才是它该走的腿。
+     *  只判 ALS 会把一条谁也收不到的问题判成 allow——挂满 ttl 后以 unavailable 结算,非 durable 形 core
+     *  就此合成续跑,活人再没机会答;而 park 才是它该走的腿。
      *  谓词缺席 ⇒ 恒可达(后台腿的 durable events tail 语义)。谓词本身抛错按不可达处理:判决面
-     *  fail-closed 到 park(park 可由运维补答,空答不可回收)。 */
+     *  fail-closed 到 park(park 可由运维补答,续跑掉的问题不可回收)。 */
     hasLiveContext(): boolean;
     private countersFor;
 }

package/dist/question.js

@@ -15,29 +15,39 @@
  * (the HTTP boundary) and REDACTS secrets from the model-authored QUESTION text before it is persisted/streamed (the
  * same redact-at-write contract as elicitation's `message`/tool outputs — the question is shown to a human, never
  * re-fed to a model, so no `delimitUntrusted` is needed on it). Deployment responsibilities core delegates: THROTTLE
- * (bound concurrency/total/ttl per run — an over-eager agent could flood the human) and no-live-human FALLBACK (a leg
- * with no stream returns the headless "no answer" default so the model proceeds instead of hanging).
+ * (bound concurrency/total/ttl per run — an over-eager agent could flood the human).
+ *
+ * 🔴 VERDICT vs LANDING are separate jobs (#166 裁1). This coordinator is the deployment's HONEST reporter of one fact:
+ * "no human answered this". Every arm with no real human answer — no run context, the run aborted, the throttle window
+ * is spent, the question cannot be presented, the TTL expired (incl. the run-exit sweep) — returns core's
+ * `{kind:"unavailable"}`. It NEVER synthesizes an empty answer set: an empty `{answers:[]}` reads to core as "a human
+ * was here and picked nothing", which on a durable deployment consumes the pending approval and hands the model a
+ * fabricated human verdict instead of parking the question where an operator can still answer it. Choosing the landing
+ * is CORE's job: a durable leg parks a checkpoint (operator answers later via decide), a non-durable leg continues with
+ * the `declined_unavailable` synthetic-continuation card (the model is told nobody is reachable and proceeds on its own
+ * judgment — a run with no human still never hangs). Only a REAL human answer returns a {@link QuestionAnswer}.
  *
  * ROUTING mirrors elicitation: `onQuestion` lives on the SINGLETON runner's `RunnerDeps` (the request carries no taskId),
  * so the run leg establishes a per-run AsyncLocalStorage context (taskId throttle key, owner respond-gate, `emit`
- * closure). `node:async_hooks` propagates it through every await; no context ⇒ headless default (never a hang).
+ * closure). `node:async_hooks` propagates it through every await; no context ⇒ unavailable (never a hang).
  */
 import { AsyncLocalStorage } from "node:async_hooks";
 import { uuidv7 } from "@sema-agent/core";
 import { redactDeep } from "./trace/redact.js";
+import { recordFailOpen } from "./observability/fail-open.js";
 /** Size bound on the model-authored questions payload before it is persisted to the durable log + streamed (parity
  *  with elicitation's MAX_ELICIT_* — an over-large questions blob amplifies into the socket/log). Over the cap ⇒ the
- *  questions are dropped and the ask headless-defaults (a question the human can't see can't be answered). */
+ *  questions are dropped and the ask reports unavailable (a question the human can't see can't be answered). */
 const MAX_QUESTIONS_BYTES = 16384;
 export const DEFAULT_QUESTION_THROTTLE = {
     maxConcurrentPerRun: 2,
     maxTotalPerRun: 20,
     ttlMs: 5 * 60_000,
 };
-/** The headless "no live human answered" result — an EMPTY answer set (no question got a selection). core's
- *  AskUserQuestion tool renders this to the model as "no option selected" so it proceeds with its own judgment instead
- *  of hanging (parity with the `onQuestion===undefined` headless default — a run with no human never blocks). */
-const NO_HUMAN = { answers: [] };
+/** The honest "nobody answered this" outcome. Frozen + shared: it is pure data core reads through
+ *  `classifyQuestionOutcome`, and it must never be confused with an empty ANSWER (which claims a human chose nothing
+ *  and, on a durable leg, spends the approval that park would have preserved). */
+const UNAVAILABLE = Object.freeze({ kind: "unavailable" });
 /** Validate the respond body = core's {@link QuestionAnswer}. `selected`/`note` are OPAQUE passthrough (core fences
  *  them: `selected ⊆ options`, `note` untrusted-fenced) — we validate only the outer SHAPE (answers[] of {header,
  *  selected:string[], note?}), never the option semantics. */
@@ -65,7 +75,7 @@ export function parseQuestionResponse(body) {
 }
 /** redactDeep + size-bound the UNTRUSTED model-authored questions before they are persisted/streamed (a question's
  *  free-text — question/header/option label+description — can echo a secret from the model's context). Over the byte
- *  cap OR unserializable ⇒ undefined (drop; the ask headless-defaults). */
+ *  cap OR unserializable ⇒ undefined (drop; the ask reports unavailable). */
 function boundQuestions(questions) {
     const redacted = redactDeep(questions);
     try {
@@ -81,7 +91,7 @@ function boundQuestions(questions) {
  * Coordinates AskUserQuestion HITL for the singleton runner. Process-local + same-replica (the pending map is in memory,
  * like ElicitationCoordinator / steerableRuns): a respond that lands on another replica finds nothing → 404. Present
  * (passed into `RunnerDeps.onQuestion` + the respond route) ONLY when `ASK_QUESTION_ENABLED` — absent ⇒ core mounts the
- * AskUserQuestion tool with the headless default (a run never hangs; the model just can't get a live answer).
+ * AskUserQuestion tool with no seam at all (`seam_absent` continuation; the model just can't get a live answer).
  */
 export class QuestionCoordinator {
     als = new AsyncLocalStorage();
@@ -92,7 +102,7 @@ export class QuestionCoordinator {
         this.throttle = throttle;
     }
     /** Run `fn` with the per-run question context ambient. On exit, release any still-pending question for this run (a
-     *  live-only question cannot outlive its leg → headless default) and drop the run's counters (no leak). */
+     *  live-only question cannot outlive its leg → unavailable) and drop the run's counters (no leak). */
     runWithContext(ctx, fn) {
         return this.als.run(ctx, async () => {
             try {
@@ -101,31 +111,34 @@ export class QuestionCoordinator {
             finally {
                 for (const [, p] of [...this.pending]) {
                     if (p.taskId === ctx.taskId)
-                        p.settle(NO_HUMAN, "unanswered");
+                        p.settle(UNAVAILABLE, "unanswered");
                 }
                 this.counters.delete(ctx.taskId);
             }
         });
     }
-    /** `RunnerDeps.onQuestion`. core calls this when the agent's AskUserQuestion tool fires; the resolved answer is what
-     *  the model sees. Headless default (`NO_HUMAN`) in every case with no live human, so the run never hangs. Arrow
-     *  property so it can be passed as `onQuestion: coordinator.question` with `this` bound. */
+    /** `RunnerDeps.onQuestion`. core calls this when the agent's AskUserQuestion tool fires; the resolved outcome is what
+     *  core acts on — a {@link QuestionAnswer} ONLY when a human really answered, otherwise `{kind:"unavailable"}` (core
+     *  then parks on a durable leg / continues with the `declined_unavailable` card on a non-durable one; either way the
+     *  run never hangs). Arrow property so it can be passed as `onQuestion: coordinator.question` with `this` bound. */
     question = async (req, signal) => {
         const ctx = this.als.getStore();
         // No run context (a leg not wrapped by runWithContext — synchronous /v1/tasks, verify/cascade, or a leader sub-task
-        // with no live stream) ⇒ headless default. Sub-tasks run in the parent's ALS frame → a child's question inherits the
+        // with no live stream) ⇒ nobody to ask. Sub-tasks run in the parent's ALS frame → a child's question inherits the
         // top-level run's ctx (one human, one stream, one throttle budget), same as elicitation.
         if (!ctx)
-            return NO_HUMAN;
+            return UNAVAILABLE;
+        // Aborted (call signal or the run's own): whatever comes back has no consumer, so claiming a human answered is a lie.
         if (signal?.aborted || ctx.abortSignal?.aborted)
-            return NO_HUMAN;
-        // THROTTLE (service's job — core imposes none): bound concurrency + total. Breach ⇒ headless default.
+            return UNAVAILABLE;
+        // THROTTLE (service's job — core imposes none): bound concurrency + total. Breach ⇒ unavailable, never a denial and
+        // never a fabricated answer — a spent window is a "not now", which is exactly what park/continue is for.
         const rc = this.countersFor(ctx.taskId);
         if (rc.inflight >= this.throttle.maxConcurrentPerRun || rc.total >= this.throttle.maxTotalPerRun)
-            return NO_HUMAN;
+            return UNAVAILABLE;
         const questions = boundQuestions(req.questions);
         if (!questions)
-            return NO_HUMAN; // over-cap / unserializable → can't show it → headless
+            return UNAVAILABLE; // over-cap / unserializable → can't show it → nobody can answer it
         const id = uuidv7();
         rc.inflight += 1; // reserve the concurrency slot; total charged only on a successful emit
         let done = false;
@@ -147,8 +160,10 @@ export class QuestionCoordinator {
             resolveAnswer(a);
         };
         let lastOutcome = "unanswered";
-        const onAbort = () => settle(NO_HUMAN, "unanswered");
-        timer = setTimeout(() => settle(NO_HUMAN, "unanswered"), this.throttle.ttlMs);
+        const onAbort = () => settle(UNAVAILABLE, "unanswered");
+        // TTL: the human walked away. Release as unavailable — core decides whether that parks (durable, operator can still
+        // answer) or continues (non-durable); holding core past the window is not one of the choices.
+        timer = setTimeout(() => settle(UNAVAILABLE, "unanswered"), this.throttle.ttlMs);
         timer.unref?.();
         signal?.addEventListener("abort", onAbort, { once: true });
         ctx.abortSignal?.addEventListener("abort", onAbort, { once: true });
@@ -156,20 +171,53 @@ export class QuestionCoordinator {
         this.pending.set(id, { settle, owner: ctx.owner, taskId: ctx.taskId });
         // Emit the OPEN frame AWAITED so its durable append is ORDERED ahead of the answer/completion/terminal appends (a
         // fire-and-forget append can commit out of seq order and be skipped by the monotonic events-tail cursor). A FAILED
-        // emit headless-defaults (nobody can answer) and must NOT burn the per-run total.
-        try {
-            await ctx.emit({ type: "question", questionId: id, questions, serverNowMs: Date.now() });
+        // emit settles unavailable (nobody can answer a frame that never arrived) and must NOT burn the per-run total.
+        // 🔴 RACED against the settlement (codex 复审 R2-high): a STALLED delivery (a durable append that never settles, a
+        // half-open socket) is a third shape next to ok/threw, and a bare `await ctx.emit` on it outlives TTL *and* abort —
+        // settle would resolve `answerP` while this frame is still parked on the emit, so `question()` never returns, core's
+        // callTool never unblocks and the leg cannot even reach its own cleanup. "The window always releases" has to hold
+        // for the stalled shape too, so the await ends at whichever comes first. Ordering is unchanged on the normal path
+        // (the settlement is still pending there, so the emit is still fully awaited).
+        // The loser of the race keeps its own handlers — an emit that rejects AFTER the race must not surface as an
+        // unhandled rejection.
+        const emitted = (async () => ctx.emit({ type: "question", questionId: id, questions, serverNowMs: Date.now() }))()
+            .then(() => "ok", () => "failed");
+        const delivery = await Promise.race([emitted, answerP.then(() => "stalled")]);
+        if (delivery === "ok") {
             rc.total += 1;
         }
-        catch {
-            settle(NO_HUMAN, "unanswered");
+        else if (delivery === "failed") {
+            // #157(codex 复审 MEDIUM,2026-08-07):投递失败 ⇒ 人在环这道门被**一次故障**跳过,模型自己往下判。
+            // 「绝不把 run 挂死」是刻意的产品姿态,所以方向不改;但它是 P-DEBT 不是合法兜底——债要在遥测里显形。
+            // #166 后本臂结算成 unavailable(而非空答):留痕语义不变(一次投递故障仍可能让人在环被跳过——非
+            // durable 形 core 合成续跑),durable 形则改由 core park,债的方向与本记账口径一致。
+            recordFailOpen("server.question.open-frame-undelivered", `question=${id}`);
+            settle(UNAVAILABLE, "unanswered");
         }
+        // delivery==="stalled":窗已由 TTL/abort/清扫结算,这一问就此让位;账在下面那个迟到臂里补(投递还没
+        // 判出成败,现在既不能计费也不能记债)。
         const answer = await answerP;
         // Completion breadcrumb (dialog dismiss) — FIRE-AND-FORGET so a slow durable append can never delay returning the
-        // answer to core. Best-effort + ordering-uncritical (the shell already has the answer via respond).
-        void Promise.resolve()
-            .then(() => ctx.emit({ type: "question_complete", questionId: id, outcome: lastOutcome, serverNowMs: Date.now() }))
-            .catch(() => undefined);
+        // answer to core. Best-effort (the shell already has the answer via respond), but CHAINED BEHIND the open frame and
+        // BRANCHED on how that frame ended (codex 复审 R3):
+        //  · 送达(含**迟到**送达)⇒ 人真看见了这张卡:补烧总量额度(否则「反复悬挂再落地」是一条绕过刷屏帽的
+        //    路子),再发消卡帧把它消解掉;
+        //  · 投递失败(含**迟到**失败)⇒ 没有卡可消解,发消卡帧只会在流里留一条无主帧;此时补记那条 P-DEBT
+        //    留痕(同步臂已经记过的不会重复:那条腿的 delivery 不是 stalled)。
+        void emitted
+            .then((result) => {
+            if (result === "failed") {
+                if (delivery === "stalled")
+                    recordFailOpen("server.question.open-frame-undelivered", `question=${id}`);
+                return undefined;
+            }
+            if (delivery === "stalled")
+                rc.total += 1;
+            return ctx.emit({ type: "question_complete", questionId: id, outcome: lastOutcome, serverNowMs: Date.now() });
+        })
+            // #157:F 类兜底(丢的是收尾渲染,不是答案)——合法,但必须留痕,否则"面包屑成片消失"只能靠
+            // 用户报"对话框不消解"发现。
+            .catch(() => recordFailOpen("server.question.complete-breadcrumb-dropped", `question=${id}`));
         return answer;
     };
     /** `POST /v1/questions/:id/respond` — resolve a parked question with the shell's answer. Owner-gated with a 404 (no
@@ -197,9 +245,10 @@ export class QuestionCoordinator {
      *  resolve-spec 的 durable question policy 用它在**判决时**分腿:有活流 ⇒ allow(问活人),无 ⇒
      *  ask(durable park)。ALS 让这个判断天然 per-leg,policy 组装期不必预知腿别。
      *  🔴 判据是「投递面此刻可达」而不只是「ALS 在场」(复审 A1):detach 腿断连后 run 仍在本作用域里跑,
-     *  只判 ALS 会把一条谁也收不到的问题判成 allow(挂满 ttl 后以空答喂模型),而 park 才是它该走的腿。
+     *  只判 ALS 会把一条谁也收不到的问题判成 allow——挂满 ttl 后以 unavailable 结算,非 durable 形 core
+     *  就此合成续跑,活人再没机会答;而 park 才是它该走的腿。
      *  谓词缺席 ⇒ 恒可达(后台腿的 durable events tail 语义)。谓词本身抛错按不可达处理:判决面
-     *  fail-closed 到 park(park 可由运维补答,空答不可回收)。 */
+     *  fail-closed 到 park(park 可由运维补答,续跑掉的问题不可回收)。 */
     hasLiveContext() {
         const ctx = this.als.getStore();
         if (ctx === undefined)

package/dist/sema-registry.d.ts

@@ -0,0 +1,41 @@
+/**
+ * Sema-registry adapter — pull the effective config from sema-registry and apply it OVER the
+ * env-derived defaults (env = fallback, center = override). Follows the "universal internal
+ * schema → translate at the boundary" pattern, with our security boundary kept:
+ *
+ *   - the CENTER owns the LOGICAL config: the model roster (names/capabilities/tier), the role map,
+ *     and team templates;
+ *   - the SERVICE env still owns the SECRETS: API keys stay in env (the center never stores a secret);
+ *     keys are per-model via `apiKeyEnv` → `config.modelApiKeyEnv` → the spec's `getApiKeyAndHeaders`
+ *     (core 1.45), so each model/cascade-rung authenticates with its own upstream key.
+ *
+ * Per-model `baseUrl` IS transported (a catalog model may live on a different gateway;
+ * core brain honors model.baseUrl, absent = "" = boot-env endpoint).
+ *
+ * Hot-reload status (复审 2026-07-29 P1-11 — 亲读判定,取代此处旧的 "models/roles are restart-to-apply"
+ * TODO, which went stale when `mutateInPlace` landed):
+ *   - models/roles/roster/teams/projects/autonomy — **HOT**. `applyEffective` mutates `config.models`/
+ *     `config.roles` IN PLACE, and core's Runner reads `this.deps.models/roles` per task off that very
+ *     reference. Both brains re-resolve `model.baseUrl || config.baseUrl` inside `buildRequest()` on every
+ *     call (core 2.1.0 `brain/openai.js` + `brain/anthropic.js`), so a moved gateway takes effect on the
+ *     next task with no restart.
+ *   - the same plane under a **tier-frozen** Runner — deferred, not hot: core expands a PRIVATE catalog copy
+ *     at construction, so `main` defers the whole plane and the `models-tiers` restart slice signals.
+ *   - **`degrade-route`** — the one genuinely boot-frozen catalog consumer left: reactive degrade
+ *     (`MODEL_DEGRADE_REACTIVE`) bakes the target Model + its gateway + its key into the brain composition
+ *     at boot. It cannot be hot-applied without rebuilding the brain, so it is registered on the existing
+ *     restartRequired /health contract instead (see `restart-signal.ts`). Fail-loud beats serving a stale
+ *     gateway silently on the rate-limit path.
+ *   - skills/mcp/scenarios/runtime-gates — restart-to-apply by construction (baked into the boot wiring).
+ *
+ * (design/158 A13, internal-lossless) This module is now a FACADE: the implementation lives in
+ * `src/config-center/` split by responsibility group (HTTP client / EffectiveConfig application /
+ * restart-signal detection / skills+MCP consumption). Every symbol below is re-exported UNCHANGED —
+ * existing `from "./sema-registry.js"` / `from "../sema-registry.js"` imports need zero changes.
+ */
+export { fetchEffective, fetchPrincipalCaps, ConfigCenterHttpError, fetchSkillContent, fetchPromptArtifact, fetchPromptBlob, } from "./config-center/http-client.js";
+export { mutateInPlace, applyEffective, applyRuntimeGates, applyRuntimeHot, resolveDefaultModelName, logEffectiveDiff, runtimeHasActiveGate, } from "./config-center/apply-effective.js";
+export { restartReasons, planeHasActiveTiers, modelPlaneChanged, type RestartSlice, type RestartSliceCtx, type RestartSignal, } from "./config-center/restart-signal.js";
+export { applyCenterSkills, resolveMcpServers, mcpForScenario } from "./config-center/skills-mcp.js";
+export type { CenterSkillManifest, CenterMcpServer, EffectiveConfig, ExecutionRuling, SessionMirrorRuling, } from "./config-center/types.js";
+//# sourceMappingURL=sema-registry.d.ts.map

package/dist/sema-registry.js

@@ -0,0 +1,40 @@
+/**
+ * Sema-registry adapter — pull the effective config from sema-registry and apply it OVER the
+ * env-derived defaults (env = fallback, center = override). Follows the "universal internal
+ * schema → translate at the boundary" pattern, with our security boundary kept:
+ *
+ *   - the CENTER owns the LOGICAL config: the model roster (names/capabilities/tier), the role map,
+ *     and team templates;
+ *   - the SERVICE env still owns the SECRETS: API keys stay in env (the center never stores a secret);
+ *     keys are per-model via `apiKeyEnv` → `config.modelApiKeyEnv` → the spec's `getApiKeyAndHeaders`
+ *     (core 1.45), so each model/cascade-rung authenticates with its own upstream key.
+ *
+ * Per-model `baseUrl` IS transported (a catalog model may live on a different gateway;
+ * core brain honors model.baseUrl, absent = "" = boot-env endpoint).
+ *
+ * Hot-reload status (复审 2026-07-29 P1-11 — 亲读判定,取代此处旧的 "models/roles are restart-to-apply"
+ * TODO, which went stale when `mutateInPlace` landed):
+ *   - models/roles/roster/teams/projects/autonomy — **HOT**. `applyEffective` mutates `config.models`/
+ *     `config.roles` IN PLACE, and core's Runner reads `this.deps.models/roles` per task off that very
+ *     reference. Both brains re-resolve `model.baseUrl || config.baseUrl` inside `buildRequest()` on every
+ *     call (core 2.1.0 `brain/openai.js` + `brain/anthropic.js`), so a moved gateway takes effect on the
+ *     next task with no restart.
+ *   - the same plane under a **tier-frozen** Runner — deferred, not hot: core expands a PRIVATE catalog copy
+ *     at construction, so `main` defers the whole plane and the `models-tiers` restart slice signals.
+ *   - **`degrade-route`** — the one genuinely boot-frozen catalog consumer left: reactive degrade
+ *     (`MODEL_DEGRADE_REACTIVE`) bakes the target Model + its gateway + its key into the brain composition
+ *     at boot. It cannot be hot-applied without rebuilding the brain, so it is registered on the existing
+ *     restartRequired /health contract instead (see `restart-signal.ts`). Fail-loud beats serving a stale
+ *     gateway silently on the rate-limit path.
+ *   - skills/mcp/scenarios/runtime-gates — restart-to-apply by construction (baked into the boot wiring).
+ *
+ * (design/158 A13, internal-lossless) This module is now a FACADE: the implementation lives in
+ * `src/config-center/` split by responsibility group (HTTP client / EffectiveConfig application /
+ * restart-signal detection / skills+MCP consumption). Every symbol below is re-exported UNCHANGED —
+ * existing `from "./sema-registry.js"` / `from "../sema-registry.js"` imports need zero changes.
+ */
+export { fetchEffective, fetchPrincipalCaps, ConfigCenterHttpError, fetchSkillContent, fetchPromptArtifact, fetchPromptBlob, } from "./config-center/http-client.js";
+export { mutateInPlace, applyEffective, applyRuntimeGates, applyRuntimeHot, resolveDefaultModelName, logEffectiveDiff, runtimeHasActiveGate, } from "./config-center/apply-effective.js";
+export { restartReasons, planeHasActiveTiers, modelPlaneChanged, } from "./config-center/restart-signal.js";
+export { applyCenterSkills, resolveMcpServers, mcpForScenario } from "./config-center/skills-mcp.js";
+//# sourceMappingURL=sema-registry.js.map

package/dist/task-settings.d.ts

@@ -149,7 +149,7 @@ export declare function providerDropsAppend(provider: PromptProvider | undefined
 export declare function acceptAppendSystemPrompt(v: unknown, warn?: (detail: string) => void, packDropsAppend?: boolean): string | undefined;
 /** [1248]②/codex F2 — what the workflow ask leg needs from the deployment, on EVERY lane. It is name-keyed and
  *  fs-independent, so it never had the lane split {@link FsWriteGateWiring} carried (that split is itself gone
- *  since #156 — the sandbox lanes now wire a lexical-path gate instead of no gate). */
+ *  since #156 — the sandbox lanes wire a gate of their own shape instead of no gate). */
 export interface WorkflowGateWiring {
     /** The session "don't ask again" probe (approvalExemptionStore.has, canonical toolName key) — same store and
      *  key space as the fs-write gate's probe; one remember="session" grant serves both. */
@@ -162,22 +162,23 @@ export interface WorkflowGateWiring {
  *  (real `exists`/`canonicalPath`/`readLink` fs access — read in dist, fs-write-gate-policy.js), so on a
  *  HOST-SEMANTICS lane (`REMOTE_EXEC` unset or "host") the env MUST be the fs the hand tools write.
  *
- *  #156 — the sandbox lanes (e2b/k8s/ssh/adb/local-docker) now wire a gate TOO, but a different-shaped one: the
+ *  #156/#165 — the sandbox lanes (e2b/k8s/ssh/adb/local-docker) wire a gate TOO, but a different-shaped one: the
  *  tools run OFF this box and the per-task sandbox env is minted inside core (executionEnvFactory) AFTER spec
  *  build, so a worker-local env would adjudicate against the WRONG fs (a wrong ALLOW is worse than no gate — that
- *  is why [816] left those lanes gate-less). The transitional shape instead supplies a `LexicalPathExecutionEnv`
- *  (`src/boot/lexical-path-env.ts`): NO fs is consulted at all, absolute paths are judged by lexical
- *  normalization and everything else fails closed to `ask`. Its residual surface (symlink form) and the endgame
- *  seam (core [2751] read-only env face on HookToolContext) are documented on that module. */
+ *  is why [816] left those lanes gate-less). They supply a `DeferredSandboxPathEnv`
+ *  (`src/boot/deferred-sandbox-path-env.ts`) instead: a proxy that forwards the fs READ primitives to the task's
+ *  REAL sandbox env at adjudication time (a per-session slot the factory decorator fills), keeping only
+ *  `absolutePath` lexical so no relative path is resolved against the wrong base. Empty slot ⇒ fail-closed. */
 export interface FsWriteGateWiring {
-    /** The env the gate canonicalizes against — the worker host env on the host lane, the fs-less
-     *  `LexicalPathExecutionEnv` on the sandbox lanes (#156). */
+    /** The env the gate canonicalizes against — the worker host env on the host lane, the
+     *  `DeferredSandboxPathEnv` proxy over the task's real sandbox env on the sandbox lanes (#165). */
     env: ExecutionEnv;
     /** The task's working directory: the factory's `rootPath` (relative-path base) AND the acceptEdits accept domain.
-     *  ABSENT on the sandbox lanes (#156): the sandbox cwd is not knowable at spec time and inventing one would mint
-     *  a bogus auto-allow domain. With it absent the gate gets no `rootPath` and no `acceptDirs`, so relative paths
-     *  fail to resolve (⇒ ask) and `acceptEdits` degrades to the `default` arm — the same fail-safe direction as the
-     *  host lane's never-created sentinel dir (resolve-spec 修5). */
+     *  ABSENT on the sandbox lanes (#156/#165): the sandbox cwd is the ENGINE's tracked cwd, not the env's own, so
+     *  neither spec time nor the env proxy can supply the right base — inventing one would mint a bogus auto-allow
+     *  domain. With it absent the gate gets no `rootPath` and no `acceptDirs`, so relative paths fail to resolve
+     *  (⇒ ask) and `acceptEdits` degrades to the `default` arm — the same fail-safe direction as the host lane's
+     *  never-created sentinel dir (resolve-spec 修5). */
     cwd?: string;
     /** The session scratchpad dir (envFacts.scratchpadDir, [820]③) — writes there are always auto-allowed. */
     scratchpadDir?: string;

package/dist/task-settings.js

@@ -395,9 +395,9 @@ export function deriveSettingsPolicy(settings, gate, workflowGate) {
         policies.push(createAskListPolicy(ask));
     // The mode-derived fs-write ask gate (core 1.290 factory — real shape read in dist: {env, rootPath?, acceptDirs?,
     // exemptDirs?, defaultWrite}, gates Write/Edit/NotebookEdit, exempt→accept→default layering, canonicalize inside
-    // the given env, only ever allow/ask). undefined without wiring (see FsWriteGateWiring). #156: the sandbox lanes
-    // supply wiring too — same factory, a lexical (fs-less) env and no cwd; the shape difference lives entirely in
-    // what `resolve-spec.ts` puts in the wiring, not in a second code path here.
+    // the given env, only ever allow/ask). undefined without wiring (see FsWriteGateWiring). #156/#165: the sandbox
+    // lanes supply wiring too — same factory, a deferred real-env proxy and no cwd; the shape difference lives
+    // entirely in what `resolve-spec.ts` puts in the wiring, not in a second code path here.
     // ③ (core 1.295): the sensitive-path DENY policy (patterns from the wiring — config SENSITIVE_WRITE_PATTERNS,
     // default = core's RECOMMENDED set) composes into the SAME fold, deny-wins — core semantics deny/"safety", so
     // neither the gate's own allow legs (exemptDirs/acceptDirs/isExempt session exemption) nor a settings allow can
@@ -406,9 +406,9 @@ export function deriveSettingsPolicy(settings, gate, workflowGate) {
     const fsWriteGate = (acceptCwd) => {
         if (!gate)
             return undefined;
-        // #156: `cwd` is optional (absent on the sandbox lanes). Omitting `rootPath` makes core leave a relative
-        // target relative → its lexical env cannot resolve it → ask; omitting `acceptDirs` means acceptEdits mints
-        // no auto-allow domain at all. Both are the intended fail-safe, NOT a degraded copy of the host arm.
+        // #156/#165: `cwd` is optional (absent on the sandbox lanes). Omitting `rootPath` makes core leave a relative
+        // target relative → the sandbox proxy's lexical `absolutePath` refuses it → ask; omitting `acceptDirs` means
+        // acceptEdits mints no auto-allow domain at all. Both are the intended fail-safe, NOT a degraded host arm.
         const gatePolicy = createFsWriteGatePolicy({
             env: gate.env,
             ...(gate.cwd !== undefined ? { rootPath: gate.cwd } : {}),

package/dist/tool-approval.js

@@ -156,10 +156,18 @@ function boundArgs(args) {
 }
 /** #151 车3 刀 3b:`AskRequest.boundInputHash` 的**边界窄读**(车5 §9 C2 的对账 join 键)。
  *
- *  🔴 树上的 core d.ts(5.13.0)**没有这个键**(全仓 0 命中),字段由 core 认领、随预发/终版到货。
- *  窄读让编译与行为解耦:今天恒回 `null`(= 该行结构上永不满足收敛器判据 1,`unmatchableNoHash` 响亮化,
- *  这是设计要的 fail-safe),core 供值后同一行代码自然点亮。非字符串/空串一律按缺席处置 —— 一个形不对的
- *  hash 比没有 hash 更危险(它会让「硬相等」这道门在一个垃圾值上偶然成立)。 */
+ *  ✅ **已点亮**(#164 翻真验证车,2026-08-07 亲验 core 5.15.0):`AskRequest.boundInputHash` 现在既在类型面
+ *  (`core/tool-policy.d.ts:83`,`readonly boundInputHash?: string`)也在真码面(`core/tool-policy.js:610`:
+ *  `onAsk({ ...req, boundInputHash: boundInputHashOf(presented.value), args: approverView.value })`)——
+ *  每一只经 `resolveAsk` 的 ask 都带值。窄读当初就是为这一刻写的:**同一行代码**不改而自然点亮,收敛器
+ *  判据 1 从「结构上恒不命中」变成会命中,`unmatchableNoHash` 从「响亮化的盲区」退回它该有的边缘含义。
+ *  (旧注写的「树上 core 5.13.0 没有这个键 ⇒ 今天恒回 null」自 core 5.15.0 提货起即过期,勿据以判断。)
+ *
+ *  🔴 保留窄读而不改 import 的理由不变:`boundInputHashOf` 至今**不在 core 的公开导出面**上
+ *  (package `exports` 只有 `.` / `./bench` / `./fixtures`),server 因此既算不出也不该算这个摘要 ——
+ *  它的职责恒是「原样透传落列」。非字符串/空串一律按缺席处置:一个形不对的 hash 比没有 hash 更危险
+ *  (它会让「硬相等」这道门在一个垃圾值上偶然成立)。钉:test/stream-approval-on-e2e.test.ts 件4
+ *  (正控 / 缺席 / 空串三臂 + 收敛器 `unmatchableNoHash` 归零的非零对照)。 */
 function readBoundInputHash(req) {
     if (req === null || typeof req !== "object")
         return null;
@@ -772,9 +780,9 @@ export class ToolApprovalCoordinator {
                     // (未打 tag),按 SCHEMA POLICY drop-and-recreate,不给一个从未出厂的形状留兼容层(§6.2 裁定 +
                     // 本仓「不做临时方案」纪律)。
                     cardJson: buildApprovalCardEnvelope(id, card),
-                    // 车5 §9 C2 的对账 join 键。**窄读**(`AskRequest.boundInputHash` 在树上的 core 5.13.0 里 0 命中,
-                    // 字段由 core 认领、待 pre/终版到货)——有则存、无则 null;缺席 ⇒ 收敛器判据 1 结构上不命中
-                    // (`unmatchableNoHash` 响亮化),这是**设计要的** fail-safe,不是降级(禁「能取到时才比」)。
+                    // 车5 §9 C2 的对账 join 键。**窄读**(顶注:core 5.15.0 起真有值,窄读的理由改为「摘要函数
+                    // 不在 core 公开导出面,server 只透传不重算」)——有则存、无则 null;缺席 ⇒ 收敛器判据 1
+                    // 结构上不命中(`unmatchableNoHash` 计数),这是**设计要的** fail-safe,不是降级(禁「能取到时才比」)。
                     boundInputHash: readBoundInputHash(req),
                     schemaVersion: 1,
                     expiresAtMs,

package/dist/trace/project.d.ts

@@ -270,19 +270,54 @@ export declare function workspaceChangedEventData(ev: {
  * resume 账本)都是租户可读面,而 operator 投影是 #154 的独立大件——按 core 写死的失败方向,**没有投影
  * 就不得披露**,所以本批先把整段剥掉止泄(此前 sync 腿的裸 catch-all 会把它连同 `lockedConfig` /
  * `compliance` / `memoryAdmission` / `retention` 四个治理面在场位原样透传给任意订阅者)。
- * 哪天 operator 投影落地,它是**另一个**构造器(按调用方身份分叉),不是往这里加键。
+ * operator 投影是**另一个**构造器({@link wiringManifestOperatorEventData},live 腿按调用方身份挑),
+ * 不是往这里加键 —— 两条 durable 腿没有调用方身份可挑,所以它们恒用本构造器。
  * ⚠️ 剥段还必须连**对该段取的哈希**一起剥:`configFingerprint` 同样不投影,理由见下方它那一行的旁注
  * (无盐哈希 + 4 布尔 = 16 组合的谕示器,把「结构上藏起来」的段原样还原出来)。
  *
  * 其余段逐键挑(禁 `{...manifest}`:1.72 task_progress 教训——未来 core 加段必须由人显式处置,而不是
  * 顺着 spread 裸上线,尤其当新段可能又是一个 audience 受限面时)。所有值都是引擎派生的闭枚举/布尔/
  * 有限数/不透明摘要串,**非用户内容 ⇒ 不脱敏**;畸形值一律按缺席处理(不铸假值,与 compacted 同规)。
+ *
+ * 🔴 **未标签面的准入裁定逐面记录在此,缺省不是「放行」**(#154 裁定 C)。core 只给 `governance` 标了
+ * audience,其余段没有标签 —— 没标签**不等于**可以默认投给租户,每一段都要有一次人的裁定,写在这里:
+ *  · `interaction.posture`(三值:interactive / headless / absent)—— **裁:租户可见**。它是部署形的
+ *    自述(这条腿有没有人能答问题),消费端据此决定渲不渲交互面;不是治理秘密,也不构成任何治理位的
+ *    侧信道(它不参与 governance 那 4 个布尔的还原)。
+ * 未来 core 加一段而它没有 audience 标签时,**先在这里补一条裁定再决定挑不挑键** —— 段级完备性钉
+ * (test/wiring-manifest-projection.test.ts)会在那一刻先把人拦下来。
  */
 export declare function wiringManifestEventData(ev: {
     manifest?: unknown;
     eventId?: unknown;
     parentToolCallId?: unknown;
 }): Record<string, unknown>;
+/**
+ * `wiring_manifest` 的 **operator 投影**(#154 件一)—— {@link wiringManifestEventData} 的租户形加上
+ * `governance` 段与 core 的真 `configFingerprint`。
+ *
+ * 🔴 分叉发生在**读口**,不在账本:两条 durable 腿(ledger-sink / resume)恒存剥后形,因为账本写的那一刻
+ * 不知道未来的读者是谁(`GET /v1/runs/:id/events` 任何 run owner 都读得到),往账本存全量 = 把 operator-only
+ * 面写进租户可读介质;存两份则是双写漂移源。所以只有 live 腿在**知道调用方身份**的那一刻挑构造器。
+ * 代价是 operator 看不到历史腿的 governance 段 —— 治理四布尔是部署形事实(不随 leg 漂),静态自检面
+ * (`GET /v1/diagnostics/wiring`)随时给出当前真值。
+ *
+ * 准入判据是 `explicitOperatorOk`(**不是** `isOperator`):空 `OPERATOR_PRINCIPALS` 必须是「没有人是
+ * operator」,不能是「所有人都是」—— 后者会让一个没配 operator 名单的部署把治理面发给每一个订阅者。
+ *
+ * `configFingerprint` 只在本构造器里透传:它是 `sha256(canonicalize(manifest 去 leg/去两个 provenance))`
+ * 前 16 hex,**无盐**且输入含整个 governance 段,而 governance 只有 4 个布尔 ⇒ 16 种组合。租户手里已有其余
+ * 全部哈希输入,发给租户等于把剥掉的四位原样还原(谕示器);发给 operator 无损 —— 同一份产物里四布尔本就
+ * 在场。
+ *
+ * governance **逐键挑**(禁 `{...governance}`):core 往这个段里加第五键时必须由人显式处置,而不是顺着
+ * spread 裸上线 —— 这个段的每一键都是部署治理面,新键的默认待遇必须是「不发」。
+ */
+export declare function wiringManifestOperatorEventData(ev: {
+    manifest?: unknown;
+    eventId?: unknown;
+    parentToolCallId?: unknown;
+}): Record<string, unknown>;
 /**
  * `human_input`(core 5.14.0 design/171 新 `TaskEvent` 臂)—— 「谁把什么喂进了这条 run」的生命周期账本
  * 帧(objective / 实时 steer / nextTurn / parked-steer 续跑 / wake 五个载体共用一个投影点)。