@sema-agent/server 7.43.0 → 7.44.0

package/dist/http/routes/approvals-assistant.js

@@ -3,19 +3,15 @@ import { principalFrom, decodeCheckpointScope, PRINCIPAL_TOKEN_HEADER, APPROVAL_
 import { verifyDirectDoorProof } from "../../principal-jwt.js";
 import { MAX_APPROVAL_REASON_CHARS } from "../../approval-hmac.js";
 import { redactedPreview, redactSecrets } from "../../trace/redact.js";
-import { fleetRunLabels } from "../../fleet/fleet-bus.js"; // [2069]④ §3 行展示名与 fleet 行同源(见用处的注)
+import { fleetRunLabels } from "../../fleet/fleet-bus.js";
 import { sleep } from "../sse-log.js";
 import { bindSseLifecycle } from "../sse-lifecycle.js";
 import { sendJson, sendError, sseHeaders, SSE_MAX_STREAM_MS, SSE_HEARTBEAT_IDLE_MS } from "../send.js";
 import { gatedPrincipal, explicitOperatorOk, isOperator } from "../principal-gate.js";
 import { governanceOriginOf } from "../active-run-conflict.js";
-// design/80 seam #2 (assistant-scheduler): graceful preempt (durable yield) + resource_limit resume of one task.
 export const ASSISTANT_PREEMPT_RE = /^\/v1\/assistant\/tasks\/([^/]+)\/preempt$/;
 export const ASSISTANT_RESUME_RE = /^\/v1\/assistant\/tasks\/([^/]+)\/resume$/;
 export const ASSISTANT_PLAN_REVIEW_RE = /^\/v1\/assistant\/tasks\/([^/]+)\/plan_review$/;
-/** Structural check for an operator-supplied QuestionAnswer (durable ask resume, TC-5.4). Strict on the
- *  load-bearing shape — `answers[]` non-empty, each `{header: string, selected: string[], note?: string}` —
- *  so a typo'd payload fails the request instead of resuming the task with an answer the tool can't use. */
 export function isQuestionAnswer(v) {
     if (!v || typeof v !== "object" || Array.isArray(v))
         return false;
@@ -38,28 +34,15 @@ export async function handleApprovalsAssistant(req, res, url, ctx) {
     await handleApprovalsAssistantBody(req, res, url, ctx, miss);
     return !miss.fell;
 }
-/** 路由体 = 从 `server.ts` 的 `handle()` 里**整段剪切**过来的原文(唯一改动:统一去缩进两格)。裸 `return;`
- *  = 「本域已应答」;走到函数尾才是「没匹配上」。跨域的东西一律在首行解构出来。 */
 async function handleApprovalsAssistantBody(req, res, url, ctx, miss) {
     const { deps } = ctx;
     const { preemptableRuns } = ctx.registry;
     const { readJson, rateLimited, quotaExceeded } = ctx.helpers;
     const { resumeCheckpoint, resumePreempted, resumePlanReview } = ctx.legs;
-    // Durable F4 (design/45): the approval queue over the CHECKPOINT store. Operators list pending (non-secret)
-    // and decide by the session handle → the service maps session→token INTERNALLY and resumes (token never in
-    // a URL/body/log). Takes precedence over the poll gate when a checkpointStore is wired.
     if (deps.checkpointStore && (url.startsWith("/v1/approvals") || url.startsWith("/v1/assistant"))) {
         const cs = deps.checkpointStore;
-        // 🔴 D-G §6: a direct-mode worker NEVER trusts x-agent-principal — NOT EVEN for the READ paths (else a forged
-        // operator header leaks every tenant's pending tool-call args via GET/stream, adversarial HIGH). For reads there
-        // is no per-decision checkpointToken, so identity comes from a verified principal JWT WITHOUT a cnf.bnd; an
-        // absent/invalid token ⇒ undefined principal ⇒ scope "__none__" + operator=false (fail-closed). The POST /decide
-        // path below re-verifies the SAME token WITH cnf.bnd (channel-bound to the action).
-        const principal = gatedPrincipal(req, deps.config); // direct-door safe — identity-only proof; single source of truth (see gatedPrincipal)
+        const principal = gatedPrincipal(req, deps.config);
         const operator = isOperator(principal, deps.config.operatorPrincipals);
-        // design/80 (native push): SSE stream of pending-approval deltas so the portal SUBSCRIBES ONCE instead of
-        // polling GET /v1/approvals every ~10s. Same operator/owner scope as the list. Must precede the list/decide
-        // matches (the decide regex would otherwise treat "stream" as a sessionId on a POST — but this is GET-only).
         if (req.method === "GET" && url === "/v1/approvals/stream") {
             const scope = operator
                 ? (new URL(req.url ?? "", "http://x").searchParams.get("owner") ?? undefined)
@@ -69,26 +52,14 @@ async function handleApprovalsAssistantBody(req, res, url, ctx, miss) {
         }
         if (req.method === "GET" && url === "/v1/approvals") {
             const scope = operator
-                ? (new URL(req.url ?? "", "http://x").searchParams.get("owner") ?? undefined) // operator: all (or ?owner)
-                : (principal ?? "__none__"); // non-operator: only its own scope (never others' pending)
-            // #209 件4 + [3684]②:行整只上 wire(键集契约照旧「整只透传、不按键投影」),但两格由投影函数
-            // 负责——`riskDescriptor.shadowedRule` 脱敏、`governanceForced` 归因。与 `/v1/approvals/stream`
-            // **共用同一个** `projectPendingForWire`(两条读面各投各的必漂,见其顶注)。
-            // #315([4658] 案):第二顶层键 `livePending` = streamApproval 窗内的流内 ask(此前对轮询消费端
-            // 结构性不可见,要等窗超时转 park 才浮现)。**分数组不混编**:两族行形与决议路由不同(live 行
-            // 决议口=respond,durable 行=decide;数组名即路由判据)。scope 复用同一表达式(operator=全量,
-            // principal=只见自己;"__none__" 恒空)。协调器未装配 ⇒ 键**缺席**不编 [](缺席=「本部署无
-            // live 审批面」,空数组=「有面、此刻无待批」,两义须可判别)。
+                ? (new URL(req.url ?? "", "http://x").searchParams.get("owner") ?? undefined)
+                : (principal ?? "__none__");
             sendJson(res, 200, {
                 pending: (await cs.listPending(scope)).map((r) => projectPendingForWire(r, deps.config)),
                 ...(deps.toolApproval ? { livePending: deps.toolApproval.listLivePending(scope) } : {}),
             });
             return;
         }
-        // exemptions surface — the UI's "本会话不再询问" state (list) + revoke. Same authz shape as
-        // /decide: an explicit operator may inspect any session; otherwise the caller must OWN the session's scope
-        // (peekPendingScope only knows PENDING sessions, so ownership here reads the session store's owner — the
-        // durable authority). Non-owner ⇒ 404 (no existence oracle, decide-route parity).
         {
             const em = /^\/v1\/approvals\/([^/]+)\/exemptions(?:\/([^/]+))?$/.exec(url);
             if (em && (req.method === "GET" || req.method === "DELETE")) {
@@ -107,14 +78,8 @@ async function handleApprovalsAssistantBody(req, res, url, ctx, miss) {
                     return;
                 }
                 const operators = deps.config.operatorPrincipals;
-                const isExplicitOperator = explicitOperatorOk(principal, operators); // E1: single mint point (principal-gate)
+                const isExplicitOperator = explicitOperatorOk(principal, operators);
                 if (!isExplicitOperator) {
-                    // 🔴 fail-CLOSED owner gate (both reviewers, 2026-07-13): mirror the sibling owner-gated routes
-                    // (session policy/delete) — ownerOf REQUIRED (absent ⇒ 501, never open), a store error PROPAGATES
-                    // (500, never open; the old `.catch(() => undefined)` flipped a DB blip into authorization), and an
-                    // UNKNOWN session (owner === undefined) 404s with no existence oracle. owner === null (ownerless
-                    // anonymous/dev session) stays open — decide-route parity. No uuid shape-gate: this population is
-                    // the checkpoint sessionId space (decide-route parity), not the sessions-API surface.
                     const ownerOf = deps.sessionStorage?.ownerOf?.bind(deps.sessionStorage);
                     if (!ownerOf) {
                         sendError(res, 501, "capability.session_store_required", "approval exemptions require a session-store backend");
@@ -128,7 +93,7 @@ async function handleApprovalsAssistantBody(req, res, url, ctx, miss) {
                 }
                 if (req.method === "GET") {
                     if (exToolName !== undefined) {
-                        sendError(res, 404, "request.route_unsupported", "not found"); // GET is list-only (no per-tool read)
+                        sendError(res, 404, "request.route_unsupported", "not found");
                         return;
                     }
                     sendJson(res, 200, { exemptions: await deps.approvalExemptionStore.list(exSessionId) });
@@ -138,46 +103,17 @@ async function handleApprovalsAssistantBody(req, res, url, ctx, miss) {
                     sendError(res, 400, "request.route_unsupported", "DELETE needs /exemptions/:toolName");
                     return;
                 }
-                const revoked = await deps.approvalExemptionStore.revoke(exSessionId, exToolName); // RAW(5.0.0):豁免键空间=CC canonical 名,live/存量行同名
+                const revoked = await deps.approvalExemptionStore.revoke(exSessionId, exToolName);
                 sendJson(res, revoked ? 200 : 404, revoked ? { revoked: true } : { error: "not found", errorCode: "not_found.exemption" });
                 return;
             }
         }
-        // design/80 #2 (assistant-scheduler, design/75 §3): the SINGLE INBOX — one prioritized view of the HITL gates
-        // across ALL of a user's N concurrent durable tasks. = listPending(scope) (already severity-sorted with the
-        // riskDescriptor) ENRICHED with each task's objective so the user knows WHICH of their tasks each gate belongs
-        // to (the missing cross-task aggregation). Scheduling priority = the severity sort; preemption is
-        // a later policy layer. Same owner-scoping as listPending (a non-operator sees only its own tasks' gates).
         if (req.method === "GET" && url === "/v1/assistant/inbox") {
-            // SECURITY (review w16yqkkxv): the assistant inbox is a PER-USER view — ALWAYS scope to a CONCRETE owner,
-            // never a system-wide dump. A non-operator sees its own principal; an operator may inspect ONE owner via
-            // ?owner, else its own. (≠ /v1/approvals, the admin queue, which intentionally lists all.) This removes the
-            // scope=undefined / empty-?owner path that made listPending() return every tenant's pendings unbounded.
             const ownerParam = new URL(req.url ?? "", "http://x").searchParams.get("owner") || undefined;
             const scope = operator && ownerParam ? ownerParam : (principal ?? "__none__");
-            // 🔴 (BUG FIX) the inbox is the documented CheckpointSummary view (gateKind + severity SCALAR +
-            // spentMicroUsd + deadline), NOT the rich operator-queue PendingCheckpoint. It USED to spread listPending()'s
-            // raw rich rows — which carried `riskDescriptor.severity` (an object, not the scalar), the tool input + the
-            // decide binding, and NO gateKind — diverging from the contract + the tasks view (which already projects via
-            // summarizeCheckpoint). Switched to listByScope (the SAME summarizeCheckpoint projection tasks uses) so the
-            // inbox + tasks are consistent; the rich decide-binding lives on /v1/approvals (the operator queue), not here.
             const summaries = await cs.listByScope(scope);
             const inbox = (await Promise.all(summaries.map(async (s) => {
-                // `createdAt` + `toolInput` are now PROJECTED into CheckpointSummary by core's summarizeCheckpoint
-                // (core 1.116.0): listByScope returns them in
-                // ONE query, so the per-entry `cs.get(token)` N+1 is GONE. `objective` lives in the task body
-                // (checkpoint_ctx), not the summary, so it still needs getCtx (best-effort; missing ⇒ null).
                 const ctx = await cs.getCtx(s.sessionId).catch(() => null);
-                // 🔴 STRIP the resume `token` (the unexposed secret capability — resume is by sessionId, never the
-                // token) AND the RAW `toolInput` (core bounds but does NOT redact it — redaction is
-                // the consumer's job). Re-emit the REDACTED `input` instead.
-                // 🔴 EXPLICIT projection([2029] cli 批准的收窄,辖域=仅本 inbox 面)—— 此前是「剥 token/toolInput、
-                // 其余整行展开」,于是 core summarizeCheckpoint 在 tool_approval 门上填的 toolName/toolCallId/preview/
-                // principal/sourceTaskId/contentKind 全部漏上 wire(其中 preview 还没过脱敏,而它同源的 toolInput 是
-                // 显式脱敏的)。四客户端仓结构性零消费(inbox verb 无调用点,[2029] 取证),按 §2 原意收成显式白名单:
-                // §1 镜像键(OMIT-when-absent)+ 两个显式 nullable 的 enrichment(objective/input)。富行
-                // (toolName/toolCallId/decide 绑定)只住 /v1/approvals —— 那面有具名消费者(desktop session-host
-                // 冷恢复),不在本刀辖域。`input` = REDACTED preview,只有 tool_approval 门携带(其余 ⇒ null)。
                 const input = s.toolInput != null ? redactedPreview(s.toolInput) : null;
                 return {
                     sessionId: s.sessionId,
@@ -190,70 +126,25 @@ async function handleApprovalsAssistantBody(req, res, url, ctx, miss) {
                     objective: ctx?.body?.objective ?? null,
                     input,
                 };
-            }))
-            // severity DESC, then **explicitly** oldest-first within a tier ([2027] 第五节欠单②,红先绿后:
-            // test/assistant-triage-ordering.test.ts)。旧姿势只比 severity,靠「listByScope 是 created_at_ms ASC
-            // + Array#sort 稳定」来兑现 §2 那句 oldest-first —— 而那个前提**只在本仓的 SQL 后端成立**
-            // (checkpoint-store-sql.ts 的 `ORDER BY created_at_ms ASC`):core 的 `CheckpointStore.listByScope` 接口
-            // 零顺序声明,InMemory/File 两个实现直接遍历 Map(LOCAL 车道包的正是 File store)⇒ 那句承诺过去是
-            // **后端相关**的。比较器自带兜底后它与 store 顺序无关。形与 listPending 的同族 sort 逐字一致
-            // (checkpoint-store-sql.ts `|| a.createdAt - b.createdAt`)。createdAt 缺席(pre-1.116 投影的老行)
-            // 计 0 = 档内最老:确定性优于「看它恰好落在哪」。
-            ).sort((a, b) => (b.severity ?? 0) - (a.severity ?? 0) || (a.createdAt ?? 0) - (b.createdAt ?? 0));
-            sendJson(res, 200, { inbox }); // CheckpointSummary (token-stripped) + objective, severity-prioritized — the assistant single inbox
+            }))).sort((a, b) => (b.severity ?? 0) - (a.severity ?? 0) || (a.createdAt ?? 0) - (b.createdAt ?? 0));
+            sendJson(res, 200, { inbox });
             return;
         }
-        // design/80 #2 (assistant-scheduler): the N-TASKS overview = the cross-task SCHEDULING view. A user's active
-        // durable agent tasks, each joined (when suspended on a HITL gate) with the core scheduler seam
-        // listByScope(scope) → {gateKind, severity, spentMicroUsd, deadline} (core 1.105, ONE query, no N+1). The
-        // result is ordered for triage: blocked-on-a-gate first, then by risk severity DESC, then by budget spent
-        // DESC — i.e. the order a scheduler would advance/escalate them. Same owner-scoping. Needs the run-store.
         if (req.method === "GET" && url === "/v1/assistant/tasks") {
-            // SECURITY (review w16yqkkxv): per-user view — ALWAYS a CONCRETE owner (operator inspects ONE via ?owner,
-            // else its own; non-operator = its own). No scope=undefined → no unbounded cross-tenant listPending()/listRuns.
             const ownerParam = new URL(req.url ?? "", "http://x").searchParams.get("owner") || undefined;
             const scope = operator && ownerParam ? ownerParam : (principal ?? "__none__");
             if (!deps.runStore) {
                 sendJson(res, 200, { tasks: [] });
                 return;
             }
-            // Rich per-gate summary via the core seam (severity + budget) — ONE scoped query, bounded (LIMIT 500).
             const summaries = await cs.listByScope(scope);
             const byGate = new Map(summaries.map((s) => [s.sessionId, s]));
             const runs = await deps.runStore.listRuns({ owner: scope, limit: 100 });
             const tasks = runs
-                // 🔴 wlzq75oac HIGH: a plan_review / dry-run review park persists as status='needs_review' (NOT 'suspended'),
-                // so a running/suspended-only filter DROPPED exactly the HITL-gated tasks §3 promises to surface "needs-
-                // attention first" — the operator could never discover the very plan_review tasks §4c says to resolve.
-                // Same class as the inbox leak (handler vs contract drift). needs_review is a non-terminal park → include it.
-                // 判据取词表属主(合并码重扫):park 两个词由 `isParkedRunStatus` 穷举,手抄形对 core 加词无编译期钉。
                 .filter((r) => r.status === "running" || isParkedRunStatus(r.status))
                 .map((r) => {
                 const s = byGate.get(r.sessionId);
                 const gate = s ? { kind: s.gateKind, severity: s.severity ?? null, spentMicroUsd: s.spentMicroUsd ?? null, deadline: s.deadline ?? null } : null;
-                // 🔴 `needsAttention` = 「此刻有一个**可解的活门**」= `!!gate`,**不是**「run 行停着」([2034]/[2035]
-                // 附带登记的 handler↔§3 文档出入,2026-07-30 裁定 (b):改文档对齐本行,常驻钉
-                // `test/assistant-tasks-needs-attention.test.ts`)。gate 来自 `listByScope`,三个实现都只回
-                // `status='pending'` 的行 ⇒ 分歧态 = run 停在 suspended/needs_review 而 pending checkpoint 已不在。
-                // 该态**可达且周期性发生**:TTL 收割的两半(checkpointStore.reapExpired 只动 checkpoint /
-                // runStore.failSuspendedWithExpiredCheckpoint 才动 run 行)在 boot/reapers.ts 同一 tick 里互不 await。
-                // 三问:① 需要方=triage 视图,它拿这一位只做「哪张卡现在能动 + 排前面」(比较器第一级);
-                // ② 若改按 status 算,分歧态会产出**不可解之卡**——标成待处理、排进前段,而 /decide 必 404、
-                //    /plan_review 与 /resume 同族拒,且与同一行的 `gate:null` 自相矛盾;现写法的代价是这段窗口里
-                //    「只渲染 needsAttention 段」的客户端看不到它;
-                // ③ 补偿=(a) 行**不消失**——它仍在本列表里带真实 `status`,「所有还停着的任务」由 status 回答;
-                //    (b) failSuspendedWithExpiredCheckpoint 三个 run store 全实装、每 tick 无条件跑(不受
-                //    APPROVAL_TIMEOUT_SEC 开关),窗口由 REAP_INTERVAL_SEC 封顶后收敛成 failed。
-                // [2069]④(cli 2026-07-30):additive 展示位。行此前只有 taskId/status/needsAttention,面板
-                // 渲不出「这是哪个任务」。源 = run 行自己的 `objectivePreview`(写入时已脱敏 + ~120 截断)——
-                // **不**走 §2 inbox 那套 per-row `getCtx`:本视图头注逐字承诺「ONE query, no N+1」,为两个
-                // 展示位把它变成 N+1 是拿契约换排版。
-                // · `name` 经 `fleetRunLabels()`,与 fleet 行**同一个函数** ⇒ 同一个 run 在两个面板里名字一致
-                //   (两处各写一遍必然漂),顺带白拿 [1414]④ 的控制帧形保护(`<task-notification…>` 给中性名)。
-                // · `description` = 未截断原值,**仅在与 name 不同时才发** —— 相同就是同一句话印两遍
-                //   (BC-1 在 fleet 行上杀掉的 objective-shown-twice)。
-                // · 两键 OMIT-when-absent(无 preview ⇒ 都不发,占位归客户端),同批 [2070]③ 同一条纪律。
-                //   钉:test/assistant-tasks-display-keys.test.ts。
                 const preview = r.objectivePreview?.trim() ? r.objectivePreview : undefined;
                 const label = preview !== undefined ? fleetRunLabels(preview).name : undefined;
                 return {
@@ -267,32 +158,18 @@ async function handleApprovalsAssistantBody(req, res, url, ctx, miss) {
             sendJson(res, 200, { tasks });
             return;
         }
-        // design/80 seam #2: POST /v1/assistant/tasks/:id/preempt — the scheduler's graceful "yield this task"
-        // (durable + resumable; the OPPOSITE of /v1/runs/:id/cancel's kill). Durable cross-replica preempt flag
-        // (the owning instance's heartbeat honors it) + a same-replica preempt-controller fast path. On a direct
-        // worker the caller is the crypto-VERIFIED JWT principal (above) — owner-scoped, no trusted-header bypass.
         const preemptMatch = req.method === "POST" ? ASSISTANT_PREEMPT_RE.exec(url) : null;
         if (preemptMatch) {
             if (rateLimited(req, res) || quotaExceeded(req, res))
-                return; // 🔴 复审 C3:preempt is NON-billable
-            // (yields a task, runs no model — see the billable-route classifier) → NO lease gate, else an exhausted
-            // tenant could not stop its own spending.
+                return;
             if (!deps.runStore) {
                 sendError(res, 501, "capability.run_store_required", "preemption requires a durable run store (DB_BACKEND=mysql|pg|local)");
                 return;
             }
-            // requirePrincipal parity with the sibling mutating endpoints (runOwnerOk / cancel / runs): 401 before the
-            // lookup when configured (uses the crypto-verified `principal` — never the trusted header on a direct door).
             if (deps.config.requirePrincipal && principal === undefined) {
                 sendError(res, 401, "auth.principal_required", `missing principal header '${deps.config.principalHeader}'`);
                 return;
             }
-            // Precondition: a preempt only durably suspends when the worker opts tasks into resourceSuspend
-            // (RESOURCE_SUSPEND=true) AND has the durable-suspend substrate (a checkpoint store — resolveSpec wires
-            // resourceSuspend ONLY inside the durableEnabled block, so without a checkpoint store the preemptSignal is
-            // never armed) AND core deems the task eligible (remote env + durable tool-results). Reject honestly when the
-            // worker can't preempt at all (e.g. the local in-memory backend has no checkpoint store), rather than 202
-            // "preempting" a signal nothing honors.
             if (!deps.config.resourceSuspend || !deps.checkpointStore) {
                 sendError(res, 501, "feature.preemption_disabled", "preemption not enabled on this worker (needs RESOURCE_SUSPEND=true + a durable checkpoint store)");
                 return;
@@ -303,41 +180,19 @@ async function handleApprovalsAssistantBody(req, res, url, ctx, miss) {
                 sendError(res, 404, "not_found.run", "task not found");
                 return;
             }
-            // Owner-gate: an EXPLICIT operator may preempt any tenant's task (preemption is a scheduler action); a
-            // normal caller only its own. 404 (not 403) for a non-owner — no existence oracle (parity with runOwnerOk
-            // + the cancel/decide precedent). NOT the bare isOperator (its empty-list "true-for-all" would let any
-            // caller preempt anyone — same trap the /decide owner-gate avoids).
             const operators = deps.config.operatorPrincipals;
-            const explicitOperator = explicitOperatorOk(principal, operators); // E1: single mint point (principal-gate)
+            const explicitOperator = explicitOperatorOk(principal, operators);
             if (!explicitOperator && run.owner !== null && run.owner !== principal) {
                 sendError(res, 404, "not_found.run", "task not found");
                 return;
             }
             if (run.status === "running") {
-                // Honesty guard (review wtyc7ist3): if THIS replica owns the run (instance match) yet it is NOT in
-                // preemptableRuns, it is a verify/cascade leg — those durably suspend as a FAILED result, so they are
-                // deliberately never registered + never honored (runs.ts). Don't set a dead durable flag or claim
-                // "preempting"; report the honest no-op. (Owned-elsewhere → instanceId mismatch → fall through to the
-                // durable flag so the owning replica's heartbeat honors it iff that leg is eligible — best-effort.)
                 const ownedHere = run.instanceId != null && run.instanceId === deps.instanceId;
                 if (ownedHere && !preemptableRuns.has(taskId)) {
                     sendJson(res, 202, { taskId, status: run.status, note: "task is not preempt-eligible (verify/cascade leg) — preempt is a no-op" });
                     return;
                 }
-                // Durable flag FIRST (only flips a still-running row), abort after — if the run suspended/terminal'd in
-                // the getRun→here window the flag affects 0 rows, so re-read and answer by the ACTUAL state.
-                let flagged = await deps.runStore.requestPreempt(taskId, run.owner); // owner guard: single-DB defense-in-depth (owner-gate already enforced above)
-                // 🔴 抢跑输了(旗打空 0 行)⇒ 按 run 的**真实**状态**三向**重判(重扫二轮红先修;与 `runs.ts` 取消腿
-                // 的孪生臂 `CANCEL_RECLASSIFY_ATTEMPTS` 那一段同源同形)。旧形无论重读到什么都发 202 no-op,于是
-                // **同一条 park 行**:不经这个竞态窗时回 409 `conflict.already_suspended`(前置检查那一支,`403a841`),
-                // 经过它时回 202「task no longer running」。按状态码分支的调度器对同一个状态拿到两种答案,而契约文
-                // §4d 把它写成了绝对规则(parked ⇒ 409 / genuinely terminal ⇒ 202),只成文了其中一种。
-                //  · **park**(判据取词表属主 `isParkedRunStatus`,穷举 switch + never 臂)⇒ 409,`status` 带**行的真词**;
-                //  · **running**(park→running 二次跃迁真实存在:并发 approve 的恢复腿把行翻回来)⇒ **重挂旗**,
-                //    有界重试;行活过来正是该重挂旗的时刻,不是该撒谎的时刻;
-                //  · 真终局 ⇒ 照旧幂等 202 no-op(带真实状态)。
-                // 有界(park↔running 反复跳时不许把请求钉在这):次数用尽仍 running ⇒ 如实 409 让调用方重试,
-                // 码与取消腿的同名情形共用(同一件事:并发决议赢了,它的恢复腿正在跑)。
+                let flagged = await deps.runStore.requestPreempt(taskId, run.owner);
                 const PREEMPT_RECLASSIFY_ATTEMPTS = 3;
                 for (let attempt = 0; !flagged; attempt++) {
                     const now = await deps.runStore.getRun(taskId);
@@ -346,7 +201,7 @@ async function handleApprovalsAssistantBody(req, res, url, ctx, miss) {
                         return;
                     }
                     if (now?.status === "running" && attempt < PREEMPT_RECLASSIFY_ATTEMPTS) {
-                        flagged = await deps.runStore.requestPreempt(taskId, run.owner); // 行又活了 ⇒ 重挂 durable 旗(赢了就走下面的快路)
+                        flagged = await deps.runStore.requestPreempt(taskId, run.owner);
                         continue;
                     }
                     if (now?.status === "running") {
@@ -356,12 +211,10 @@ async function handleApprovalsAssistantBody(req, res, url, ctx, miss) {
                     sendJson(res, 202, { taskId, status: now?.status ?? "failed", note: "task no longer running — preempt is a no-op" });
                     return;
                 }
-                preemptableRuns.get(taskId)?.abort(); // fast path: preempt landed on the running instance → suspend now
+                preemptableRuns.get(taskId)?.abort();
                 sendJson(res, 202, { taskId, status: "preempting", note: "graceful durable yield — the task suspends at the next clean turn boundary if preempt-eligible; resume via POST /v1/assistant/tasks/:id/resume" });
             }
             else if (isParkedRunStatus(run.status)) {
-                // 扫描P2 顺带件:park 是两个词(isParkedRunStatus 属主)——needs_review(plan_review/dry-run 门)
-                // 此前掉进 else 被谎报「already terminal — no-op」(无状态破坏,纯指路错)。extras.status 带真词。
                 sendError(res, 409, "conflict.already_suspended", "task is already suspended", { taskId, status: run.status });
             }
             else {
@@ -369,13 +222,10 @@ async function handleApprovalsAssistantBody(req, res, url, ctx, miss) {
             }
             return;
         }
-        // design/80 seam #2: POST /v1/assistant/tasks/:id/resume — resume a task durably SUSPENDED on a
-        // resource_limit gate (a scheduler preempt OR a budget/turns/walltime slice, design/74). NOT an approval
-        // gate (resumePreempted's gate-kind guard 409s a policy_ask — that goes through POST /v1/approvals/:id/decide).
         const resumeMatch = req.method === "POST" ? ASSISTANT_RESUME_RE.exec(url) : null;
         if (resumeMatch) {
             if (rateLimited(req, res) || quotaExceeded(req, res))
-                return; // 🔴 复审 C2:lease admitted INSIDE driveResumeIntoRunLog on the CHECKPOINT-OWNER principal (the billed tenant), not the request principal — a cross-tenant operator resume must charge the owner's lease, not the operator's. resume hits TiDB + runs the model
+                return;
             if (!deps.runStore) {
                 sendError(res, 501, "capability.run_store_required", "resume requires a durable run store (DB_BACKEND=mysql|pg|local)");
                 return;
@@ -383,7 +233,7 @@ async function handleApprovalsAssistantBody(req, res, url, ctx, miss) {
             if (deps.config.requirePrincipal && principal === undefined) {
                 sendError(res, 401, "auth.principal_required", `missing principal header '${deps.config.principalHeader}'`);
                 return;
-            } // parity with sibling mutating endpoints
+            }
             const taskId = resumeMatch[1];
             const run = await deps.runStore.getRun(taskId);
             if (!run) {
@@ -391,33 +241,19 @@ async function handleApprovalsAssistantBody(req, res, url, ctx, miss) {
                 return;
             }
             const operators = deps.config.operatorPrincipals;
-            const explicitOperator = explicitOperatorOk(principal, operators); // E1: single mint point (principal-gate)
+            const explicitOperator = explicitOperatorOk(principal, operators);
             if (!explicitOperator && run.owner !== null && run.owner !== principal) {
                 sendError(res, 404, "not_found.run", "task not found");
                 return;
             }
-            // 🕐 **#316 同族登记(本批不改行为)**:这条腿与 legacy `/decide` 同病 —— `driveResumeIntoRunLog`
-            // 在响应之前同步跑完整条 resume 流,响应时长 = 模型往返、无服务端上限。#316 只对 legacy decide 腿
-            // 做了 200 受理化(那是 [4660] 雪崩的实测首环),本腿维持终局形:**wire BREAKING 需要消费方先表态**
-            // (能力显式表态制,[3780] 裁 A)。候消费方认领后同形改造 —— 改法现成:`resumePreempted` 一路把
-            // `acceptEarly: true` 透到 `driveResumeIntoRunLog` 即可(受理点/判定边界全在 `DriveResumeArgs.acceptEarly`)。
-            const out = await resumePreempted(run.sessionId, req); // gate-kind guard + drive into the run log (shared)
+            const out = await resumePreempted(run.sessionId, req);
             sendJson(res, out.status, out.body);
             return;
         }
-        // design/80 D-B: POST /v1/assistant/tasks/:id/plan_review — resolve a PRE-ACTION `plan_review` gate, 3-state
-        // (approve | edit | reject). A SIBLING of preempt/resume (a scheduler-resolvable gate with NO bound tool
-        // action — the human reviews the PLAN, not a tool call), NOT the /decide wire (a tool-approval allow/deny +
-        // action binding) and NOT the needs_review wire (never reuse it). `edit` carries the
-        // operator's REVISED plan (core threads `editedPlan` into the resumed run). 🔴 D-G ruling:
-        // a plan_review binds NO action, so on a direct-door worker the self-asserted x-agent-principal is NEVER
-        // trusted — it carries the PRINCIPAL-ONLY proof (verifyDirectDoorProof actionBinding:false = JWT identity +
-        // cnf.bnd + HMAC over {sessionId,decision}, no boundInputHash), then the SAME operator-or-owner gate on the
-        // CRYPTO-VERIFIED principal. On a BFF worker the trusted-header principal owner-gate applies (parity with resume).
         const planReviewMatch = req.method === "POST" ? ASSISTANT_PLAN_REVIEW_RE.exec(url) : null;
         if (planReviewMatch) {
             if (rateLimited(req, res) || quotaExceeded(req, res))
-                return; // 🔴 复审 C2:lease admitted in driveResumeIntoRunLog (owner principal). resume hits TiDB + runs the model (approve/edit)
+                return;
             if (!deps.runStore) {
                 sendError(res, 501, "capability.run_store_required", "plan_review requires a durable run store (DB_BACKEND=mysql|pg|local)");
                 return;
@@ -425,13 +261,8 @@ async function handleApprovalsAssistantBody(req, res, url, ctx, miss) {
             if (deps.config.requirePrincipal && principal === undefined) {
                 sendError(res, 401, "auth.principal_required", `missing principal header '${deps.config.principalHeader}'`);
                 return;
-            } // parity with sibling mutating endpoints
+            }
             const taskId = planReviewMatch[1];
-            // 3-state decision; `edit` MUST carry the revised plan, `approve`/`reject` must NOT (a stray editedPlan
-            // signals a wrong-gate call — reject, don't drop it). Parsed + validated BEFORE the task is resolved so
-            // every bad-body 400 is existence-INDEPENDENT (depends only on the body). 🔴 wq64gmm5e LOW: getRun's 404
-            // used to fire BEFORE the body/proof — a task-existence oracle (404-vs-401) on a direct-door worker,
-            // divergent from /decide. Now the existence branch comes AFTER and is status-uniform with a bad proof.
             const body = (await readJson(req));
             const decision = body?.decision === "approve" ? "approve" : body?.decision === "edit" ? "edit" : body?.decision === "reject" ? "reject" : undefined;
             if (!decision) {
@@ -450,38 +281,24 @@ async function handleApprovalsAssistantBody(req, res, url, ctx, miss) {
                 sendError(res, 400, "request.field_invalid", "reason must be a string");
                 return;
             }
-            // 与 /decide 腿同一上限:reason 入签之后,超长只能**拒**(截断产出的字节签名器复现不了 ⇒ 恒 401)。
             if (typeof body.reason === "string" && body.reason.length > MAX_APPROVAL_REASON_CHARS) {
                 sendError(res, 413, "reason_too_large", `reason too large (max ${MAX_APPROVAL_REASON_CHARS} chars)`);
                 return;
             }
             const run = await deps.runStore.getRun(taskId);
             if (!run) {
-                // No such task. On a DIRECT-DOOR worker return the SAME 401 a bad proof gets (parity with /decide): a
-                // missing task is indistinguishable from a bad proof — the caller cannot mint a valid proof for an
-                // unknown sessionId anyway — so existence never leaks. On a BFF worker the trusted-header owner posture 404s.
                 if (deps.config.directDoorActive) {
                     sendError(res, 401, "principal_unverified", "principal proof required");
                     return;
                 }
-                // [4268]/[4274] 件5(#43 P0 联调观测件):**只进日志,不上 wire**。两支 404 在 wire 面必须逐字同形
-                // (反枚举:「不存在」与「不属于你」不可区分是本门的要求,不是疏漏),代价是服务端自己也说不清撞的
-                // 是哪一支 —— 联调一次 404 只能靠猜。判别位放在服务端日志:运维/联调拿得到成因,枚举者拿不到。
-                // `principalPresent` 只记**有无**([4288]):principal / owner 两个身份串一个都不许进日志 ——
-                // 日志的读者面比 wire 宽,把值写进去等于在日志面重建一条本来被封住的枚举通道。
                 deps.logger?.info?.("decide_404", { reason: "no-row", taskId, principalPresent: principal !== undefined });
                 sendError(res, 404, "not_found.run", "task not found");
                 return;
             }
-            // ── D-G principal-only proof (non-action gate): on a direct-door worker derive the CRYPTO-VERIFIED principal
-            // from the signed proof, never the self-asserted header. The envelope binds {sessionId, decision} so a forged
-            // or replayed plan decision is rejected; no boundInputHash (there is no tool action). fail-closed.
             let deciderPrincipal = principal;
             if (deps.config.directDoorActive) {
                 const hdr = (n) => { const h = req.headers[n]; return Array.isArray(h) ? h[0] : h; };
-                const proof = verifyDirectDoorProof({ jwt: hdr(PRINCIPAL_TOKEN_HEADER), mac: hdr(APPROVAL_MAC_HEADER), kid: hdr(APPROVAL_MAC_KID_HEADER) }, 
-                // reason 入签:同一条规则也适用于身份绑定腿(两个绑定位为 null,第五位照常参与)。
-                { sessionId: run.sessionId, decision, reason: typeof body.reason === "string" ? body.reason : null }, deps.config, { actionBinding: false });
+                const proof = verifyDirectDoorProof({ jwt: hdr(PRINCIPAL_TOKEN_HEADER), mac: hdr(APPROVAL_MAC_HEADER), kid: hdr(APPROVAL_MAC_KID_HEADER) }, { sessionId: run.sessionId, decision, reason: typeof body.reason === "string" ? body.reason : null }, deps.config, { actionBinding: false });
                 if (!proof.ok) {
                     sendError(res, proof.status, proof.errorCode, proof.error);
                     return;
@@ -489,34 +306,23 @@ async function handleApprovalsAssistantBody(req, res, url, ctx, miss) {
                 deciderPrincipal = proof.principal;
             }
             const operators = deps.config.operatorPrincipals;
-            const explicitOperator = explicitOperatorOk(deciderPrincipal, operators); // E1: single mint point (principal-gate)
+            const explicitOperator = explicitOperatorOk(deciderPrincipal, operators);
             if (!explicitOperator && run.owner !== null && run.owner !== deciderPrincipal) {
-                // no existence oracle (verified principal on a direct worker) —— wire 面与上面的「查无此行」逐字同形;
-                // 判别位同样只进服务端日志(件5,理由见上一处注)。刻意**不记** owner/principal 两个值:判别成因用
-                // reason 一个词就够,把两个身份写进日志等于在日志面重建一条本来被封住的枚举通道。
                 deps.logger?.info?.("decide_404", { reason: "owner-mismatch", taskId, principalPresent: principal !== undefined });
                 sendError(res, 404, "not_found.run", "task not found");
                 return;
             }
-            // 🕐 **#316 同族登记(本批不改行为)**:同 `/resume` 腿那条注 —— 本腿同样在响应前同步跑完整条
-            // resume 流(时长 = 模型往返、无上限)。改造形现成(`acceptEarly` 透传),候消费方表态后同形改。
-            const out = await resumePlanReview(run.sessionId, decision, decision === "edit" ? body.editedPlan : undefined, typeof body.reason === "string" ? body.reason : undefined, req, 
-            // [4277]/[4288] 件5:让四个 reason 的判别日志共用同一个 id 字段 + 同一个 principalPresent 口径。
-            { taskId, principalPresent: principal !== undefined });
+            const out = await resumePlanReview(run.sessionId, decision, decision === "edit" ? body.editedPlan : undefined, typeof body.reason === "string" ? body.reason : undefined, req, { taskId, principalPresent: principal !== undefined });
             sendJson(res, out.status, out.body);
             return;
         }
-        // [2373]C-4(5.0.0):裸 `POST /v1/approvals/:id` 装饰臂删——/decide 是唯一决裁形(裸形曾与
-        // `GET /v1/approvals/:id` 撞 URL 空间,并把限流/计费/wire 注三处记账劈成两条)。
         const m = /^\/v1\/approvals\/([^/]+)\/decide$/.exec(url);
         if (m && req.method === "POST") {
             if (rateLimited(req, res) || quotaExceeded(req, res))
-                return; // 🔴 复审 C2:lease admitted in driveResumeIntoRunLog (owner principal). resume hits TiDB — rate-limit (council)
-            // NOTE: the operator gate is checked AFTER the body parse below — D-G's direct door needs the parsed
-            // envelope (checkpointToken + decision) to verify the HMAC before it can derive the deciding principal.
+                return;
             let sessionId;
             try {
-                sessionId = decodeURIComponent(m[1]); // a malformed %-sequence is a client error (400), not a 500
+                sessionId = decodeURIComponent(m[1]);
             }
             catch {
                 sendError(res, 400, "request.path_malformed", "malformed approval id (invalid percent-encoding)");
@@ -528,11 +334,6 @@ async function handleApprovalsAssistantBody(req, res, url, ctx, miss) {
                 sendError(res, 400, "request.body_shape", "body must be { decision: 'approve' | 'deny', reason?, answer?, checkpointToken?, boundCallId?, boundInputHash?, updatedInput?, remember? }");
                 return;
             }
-            // `reason` 现在**在签名载荷里**(三方裁 (a),见 security.ts `approvalHmacMessage` 顶注)⇒ 它的形必须先钉死:
-            //  · 非字符串会让规范化编码产出一个签名器不可能复现的消息(对象会被内联进 JSON)—— 此前这条腿
-            //    根本没校验 reason 的类型(plan_review 腿有),入签之后这就成了硬前置。
-            //  · 超长**拒而不截**:服务端截过的字节与签名方签的字节必然不同 ⇒ MAC 恒不匹配,截断只会把一个
-            //    可诊断的 413 变成费解的 401(与 steer 入参上限同一判据:诚实拒绝优于自作主张改写)。
             if (body.reason !== undefined && typeof body.reason !== "string") {
                 sendError(res, 400, "request.field_invalid", "reason must be a string");
                 return;
@@ -541,11 +342,6 @@ async function handleApprovalsAssistantBody(req, res, url, ctx, miss) {
                 sendError(res, 413, "reason_too_large", `reason too large (max ${MAX_APPROVAL_REASON_CHARS} chars)`);
                 return;
             }
-            // `remember:"session"` — record a per-session per-toolName approval exemption alongside an
-            // approve ("本会话不再询问"). Closed enum (extensible later, e.g. "principal"); deny+remember = 400 (a
-            // "remembered deny" is a different semantic — not smuggled in here); direct-door v1 = 400 (remember is
-            // NOT in the HMAC envelope's signed payload — accepting it unsigned would be a tamper hole; extending
-            // the MAC payload is a v2 with the BFF, see docs/design/APPROVAL-SESSION-EXEMPTION.md).
             let remember = false;
             if (body.remember !== undefined) {
                 if (body.remember !== "session") {
@@ -564,22 +360,12 @@ async function handleApprovalsAssistantBody(req, res, url, ctx, miss) {
                     sendError(res, 501, "capability.store_required", "approval exemptions need a store backend (DB_BACKEND / LOCAL lane)");
                     return;
                 }
-                // 🔴 remember REQUIRES the D-1 decision-binding echo (workflow audit 2026-07-13, my override of the
-                // verify-reject): an unbound decide can consume a gate that was SWAPPED after the operator's GET (see
-                // gate A, approve lands on gate B) — tolerable as a one-shot legacy quirk, NOT as the mint of a
-                // SESSION-PERSISTENT auto-approval for a tool the operator never saw. remember is a NEW contract, so
-                // it can demand the strict calling shape — the BFF receives boundCallId on the pending row
-                // (HITL-7 注纠,[2400] 审计:checkpointToken 从不上 pending 行,listPending 的 SELECT 无 token 列;
-                // 下面的门是「或」关系,boundCallId 单独即满足,所以旧措辞没造成真故障)。
-                // Plain decide without remember keeps the legacy unbound fallback untouched.
                 if (!body.checkpointToken && !body.boundCallId) {
                     sendError(res, 400, "remember_requires_binding", "remember requires the decision binding (echo checkpointToken and/or boundCallId from the pending approval)");
                     return;
                 }
                 remember = true;
             }
-            // Durable ask (TC-5.4): the operator's out-of-band QuestionAnswer rides the approve. Trusted
-            // control-plane input (the model never produces it); malformed = client error, absent = unchanged.
             let answer;
             if (body.answer !== undefined) {
                 if (!isQuestionAnswer(body.answer)) {
@@ -588,27 +374,12 @@ async function handleApprovalsAssistantBody(req, res, url, ctx, miss) {
                 }
                 answer = body.answer;
             }
-            // D-1 (design/80) decision-action binding: the operator echoes back the checkpointToken + boundCallId +
-            // boundInputHash they SAW in GET /v1/approvals. The service binds the resume to that exact action (core
-            // verifies opaque equality, fail-closed PRE-CAS) and rejects a stale view distinctly (approval_stale).
-            // All OPTIONAL — a legacy BFF caller that omits them falls back to the current-pending values (deprecated).
             for (const f of ["checkpointToken", "boundCallId", "boundInputHash"]) {
                 if (body[f] !== undefined && typeof body[f] !== "string") {
                     sendError(res, 400, "request.field_invalid", `${f} must be a string (the value surfaced on the pending approval record)`);
                     return;
                 }
             }
-            // 🔴 直连门上拒 `updatedInput`(2026-07-26 修),判据与上面拒 `remember` **逐字同一条**:
-            // 「不在决策证明的签名载荷里」。此前只 `remember` 有这条门,而 `updatedInput` 改写的是
-            // **将被执行的工具实参**(core `runtask.js` 在哈希比对**之后**用 `outcome.updatedInput ?? pendingAction.args`)
-            // ⇒ 同一份 JWT+MAC 对「原 body」与「加了 updatedInput 的 body」**都放行**,而 `boundInputHash` 仍是
-            // 原动作的哈希。直连门的威胁模型就是「线上字节不可信」(否则不需要 HMAC),能改字节的一方
-            // (反代 / 被劫持的客户端)可在操作员批准 `ls` 的同一次决定里换掉实参。
-            // ⚠️ 已亲验的缓解:core 会把改写后的实参**重新过一遍 base tool policy**,所以越权面被限制在策略仍允许的
-            // 范围内、不是任意命令 —— 但那是"减轻",不是"这个字段被签名覆盖了"。
-            // 修法刻意**不是**把它塞进 HMAC 载荷(那要求所有直连门客户端改签名 = 跨仓 wire 变更),而是把**既有的、
-            // 代码自己写下的**判据施加到它漏掉的那个字段上:fail-closed、server 单方面可做、与 `remember` 对称。
-            // BFF/gated 门(头已由上游验过)**不受影响** —— 这条只在 `directDoorActive` 生效。
             if (deps.config.directDoorActive && body.updatedInput !== undefined) {
                 sendError(res, 400, "updated_input_not_in_proof", "updatedInput is not supported on a direct-door worker (not covered by the decision proof)");
                 return;
@@ -619,75 +390,44 @@ async function handleApprovalsAssistantBody(req, res, url, ctx, miss) {
                 boundInputHash: body.boundInputHash,
                 updatedInput: body.updatedInput,
             };
-            // ── design/80 D-G: the authorization gate. On a DIRECT-MODE worker the trusted-header path is DISABLED —
-            // every /decide MUST carry the crypto proof (signed principal JWT + cnf.bnd + HMAC envelope), and the
-            // self-asserted x-agent-principal is NEVER consulted. On a normal (BFF) worker, the existing trusted-header
-            // operator gate is byte-identical. Fail-closed: a direct-door failure rejects, never falls back to the header.
             let deciderPrincipal = principal;
             if (deps.config.directDoorActive) {
                 const hdr = (n) => {
                     const h = req.headers[n];
                     return Array.isArray(h) ? h[0] : h;
                 };
-                const proof = verifyDirectDoorProof({ jwt: hdr(PRINCIPAL_TOKEN_HEADER), mac: hdr(APPROVAL_MAC_HEADER), kid: hdr(APPROVAL_MAC_KID_HEADER) }, 
-                // reason 入签(三方裁 (a) + clay 干净切):落账理由属于决定内容,与 decision 同受完整性保护。
-                { sessionId, boundCallId: binding.boundCallId, boundInputHash: binding.boundInputHash, decision, reason: typeof body.reason === "string" ? body.reason : null }, deps.config);
+                const proof = verifyDirectDoorProof({ jwt: hdr(PRINCIPAL_TOKEN_HEADER), mac: hdr(APPROVAL_MAC_HEADER), kid: hdr(APPROVAL_MAC_KID_HEADER) }, { sessionId, boundCallId: binding.boundCallId, boundInputHash: binding.boundInputHash, decision, reason: typeof body.reason === "string" ? body.reason : null }, deps.config);
                 if (!proof.ok) {
                     sendError(res, proof.status, proof.errorCode, proof.error);
                     return;
                 }
-                deciderPrincipal = proof.principal; // the CRYPTO-VERIFIED principal replaces the self-asserted header
+                deciderPrincipal = proof.principal;
             }
-            // Authorization (council finding): an EXPLICIT operator may decide ANY approval; otherwise the
-            // caller must OWN the checkpoint's scope. 🔴 NOT the bare isOperator — its empty-OPERATOR_PRINCIPALS
-            // "true-for-all" would let ANY authenticated caller decide ANOTHER user's checkpoint via a leaked, NON-
-            // credential sessionId+boundInputHash (from a log/screenshot/ticket). A non-owner-non-operator gets 404
-            // (no existence oracle — parity with runOwnerOk + the cancel P0 precedent), never 403.
             const operators = deps.config.operatorPrincipals;
-            const explicitOperator = explicitOperatorOk(deciderPrincipal, operators); // E1: single mint point (principal-gate)
+            const explicitOperator = explicitOperatorOk(deciderPrincipal, operators);
             if (!explicitOperator) {
                 const cpScope = await cs.peekPendingScope(sessionId);
-                // "_" = the anonymous-submit scope SENTINEL (main.ts writes auth?.principal ?? "_" at suspend) — treat it
-                // like null (open), as the sibling sites already do (the 5040/5599/5653 normalizations). Without this an
-                // anonymous single-user durable worker DEADLOCKS its own approvals (decide → 404 forever; workflow audit
-                // 2026-07-13, confirmed by both verify lenses).
                 const decodedCpScope = cpScope != null ? decodeCheckpointScope(cpScope) : undefined;
-                const ownsIt = cpScope == null || decodedCpScope === undefined || decodedCpScope === deciderPrincipal; // null/"_" = anonymous/dev (open)
+                const ownsIt = cpScope == null || decodedCpScope === undefined || decodedCpScope === deciderPrincipal;
                 if (!ownsIt) {
                     sendError(res, 404, "not_found.approval", "approval not found");
                     return;
                 }
             }
-            // remember: capture the pending gate's toolName BEFORE the resume consumes the row. AskUserQuestion
-            // gates are excluded (the durable-question policy owns them — an exemption row would be dead weight the
-            // ask-gate probe explicitly skips). null toolName (legacy row) ⇒ nothing to remember.
             let rememberToolName = null;
             if (remember) {
-                // [1.202 live 复验抓获] 旧姿势 `listPending(deciderPrincipal ?? "__none__")` 在匿名单用户 lane
-                // (decider 无 principal、checkpoint scope="_" 哨兵)永远滤空 ⇒ remember 结构性失灵(rememberApplied
-                // 恒 false,豁免从不落店)。授权已由上方 owner gate 把过(cpScope null/"_"/相符,同 5040/5599/5653
-                // 的 "_" 归一先例)——这里直接读该 session 的 pending 行拿 toolName,不再按 decider 二次过滤。
                 const tok = await cs.findPendingTokenBySession(sessionId);
                 const cp0 = tok ? await cs.get(tok) : null;
                 const pa0 = cp0?.pendingAction;
                 const tn = pa0 && pa0.kind === "tool_approval" ? pa0.toolName : null;
                 rememberToolName = tn && tn !== "AskUserQuestion" ? tn : null;
             }
-            // grant timing(codex M2,1.294 isExempt 同腿生效):grant 挪进 onResumeCommitted——markResuming CAS
-            // 赢了(decide 已被接受、并发 sibling 已输)之后、模型腿驱动**之前**落店,所以 resumed leg 自己的下一个
-            // ask 就能命中豁免(gate isExempt + ask 政策层探针都实时读店);旧姿势 await 整条 resume 腿(可跑数分钟)
-            // 之后才 grant,同腿第二次同工具 ask 必再 park 一轮。输掉 CAS(409)/stale(404)⇒ 钩不触发,绝不留
-            // 豁免;CAS 赢后模型腿再失败 ⇒ 豁免保留(operator 的 approve+remember 意图在 accept 时已成立,与
-            // 「grant 失败不回滚 approve」同向)。grant 失败只 warn 不阻断 resume,响应带 rememberApplied 如实。
             let rememberApplied = false;
-            // overrideSessionId([1591] 候裁② server 修):parked 赎回腿把 grant 锚改到行的 root/host 会话
-            // (部署侧豁免探针闭包统一捕获 host 会话键——落子代会话则键永不相交,rememberApplied 会是假话)。
-            // legacy 任务腿不传 override,行为逐字不变。
             const grantOnCommit = remember && deps.approvalExemptionStore && rememberToolName
                 ? async (overrideSessionId) => {
                     const grantSessionId = overrideSessionId ?? sessionId;
                     try {
-                        const canonical = rememberToolName; // RAW(5.0.0):行 toolName 由 core 铸,恒 canonical
+                        const canonical = rememberToolName;
                         await deps.approvalExemptionStore.grant(grantSessionId, canonical, deciderPrincipal ?? null);
                         rememberApplied = true;
                         deps.logger?.info?.("approval_exemption_granted", { sessionId: grantSessionId, toolName: canonical, grantedBy: deciderPrincipal ?? null });
@@ -697,12 +437,6 @@ async function handleApprovalsAssistantBody(req, res, url, ctx, miss) {
                     }
                 }
                 : undefined;
-            // #204 件6①:出处 = `"human"` —— 这条腿是运维**亲自**在 HTTP 上给的终局(approve/deny 两向都是)。
-            // #316([4660] Inkglow 案 → [4664]① 定谳):末位 `true` = **200 受理语义**。这条腿此前在响应之前
-            // 同步跑完整条 resume 流(模型往返、无服务端上限)⇒ 壳侧 60s AbortSignal 必然超时,而重试打回来
-            // 又撞 CAS —— [4660] 雪崩的首环。改后 HTTP 立刻回 `{taskId, status:"resuming", bindingEnforced:true}`,
-            // 结果面走既有 `GET /v1/runs/:id`(poll)/ `/events`(SSE)。**受理不是免检**:429/409/404 三类判定
-            // 逐字仍在响应前给出(判据全文见 `DriveResumeArgs.acceptEarly`)。
             const out = await resumeCheckpoint(sessionId, decision, body.reason ?? undefined, "human", req, answer, binding, grantOnCommit, true);
             if (remember && deps.approvalExemptionStore) {
                 sendJson(res, out.status, { ...out.body, rememberApplied });
@@ -714,154 +448,57 @@ async function handleApprovalsAssistantBody(req, res, url, ctx, miss) {
         sendError(res, 404, "not_found.route", "not found");
         return;
     }
-    // [2354]/[2356] A-5(5.0.0):legacy F4 轮询腿(approvalStore list/by-id/decide,trusted-header 决裁)
-    // 整体退役。无 checkpointStore 的部署打 /v1/approvals 一律落到本域尾部的未匹配路径(404 诚实缺席)。
     miss.fell = true;
 }
-/** Server-side poll cadence for the native-push approvals stream. The CLIENT subscribes ONCE and never polls;
- *  the server diffs at this cadence (TiDB has no LISTEN/NOTIFY) and pushes deltas. 3s < the ~10s client poll it
- *  replaces, so the operator sees a new suspend faster AND the portal loses its polling loop. (Each SSE
- *  connection runs its OWN poll loop — fine for a handful of operators; a shared fan-out poll is a future
- *  optimization if the operator count grows.) */
 const APPROVALS_STREAM_POLL_MS = 3000;
-/**
- * 🔴 #209 件4(codex 对抗复审 R3-[high],验真后修)—— **durable 读面的脱敏投影**。
- *
- * core 5.25.0 的 `RiskDescriptor.shadowedRule` = 被越级的那条持久规则的**原文**。core 侧只过
- * `inlineUntrusted`(中和 + 限长),**不**做秘密脱敏 —— 它的 JSDoc 也只承诺中和,不承诺无秘密
- * (与同结构里的 `summary` 不同:那一格 core 明写「NEVER raw secrets / full args / env」)。
- * 而规则原文是**人手写的文本**,一条 `Bash(curl -H "Authorization: Bearer …")` 形的规则完全拼得出来。
- *
- * 同步路(`tool_approval` 帧 / `card_json`)在铸点就 `redactSecrets` 了;durable 路两条读面
- * (`GET /v1/approvals` 与 `/v1/approvals/stream`)此前把 `listPending()` 的行**整只**上 wire ⇒
- * 同一份内容在两条腿上一条脱敏、一条不脱敏,而 operator 的队列是**跨租户**可见的那一条。
- *
- * 修在**读面**而不是落库点,理由是本仓成文的分工(同文件 inbox 段那条 `redactedPreview(s.toolInput)` 的
- * 逐字理由):「core bounds but does NOT redact it — redaction is the consumer's job」。落库点改写会与
- * core 的属主面打架,而且救不了**别的副本**已经写下的行。
- *
- * 🔴 只动这一格,不顺手洗整只 descriptor:`summary` 有 core 的无秘密承诺、`touchedPaths` 是路径,
- * 两者的现行为不在本批辖域内(要改得走各自的三问)。键集**不变** —— 「整只透传、不按键投影」那条契约
- * (`test/approval-shadowed-rule-wire.test.ts` §3)照旧成立,变的只是这一格的**内容**。
- */
 function redactPendingDisclosures(row) {
     const rd = row.riskDescriptor;
     if (rd === null || rd === undefined || typeof rd.shadowedRule !== "string")
         return row;
     return { ...row, riskDescriptor: { ...rd, shadowedRule: redactSecrets(rd.shadowedRule) } };
 }
-/**
- * 🔴 [3683]-2 / [3684]②:两条 durable 读面(`GET /v1/approvals` + `/v1/approvals/stream`)的**唯一**
- * 投影 —— 脱敏(#209 件4)+ 出身归因(#220 的另一半)一次做完。
- *
- * 出身格的病灶如实记:`governanceForced` 此前只在 409 体上算(`buildActiveRunConflict`),而运维队列
- * 的行不算 —— 同一道 park 门,客户端从 409 看得见「这是运维治理层下的」,从队列看不见。它**不是**一个
- * 落库缺口:判据的两半(行上 `riskDescriptor.shellGateDoctrine` + 本部署的治理姿态)在这条读面上都够得着,
- * 缺的只是**没有人算**。所以补法 = 让两面共用 `governanceOriginOf` 这一个属主(在读面算的已知失真、
- * 以及「根治要 core 在 mint 写进行里」的登记,逐字在 `runtime-governance.ts` 那个函数的顶注,不复述)。
- *
- * 🔴 `true` 才写键,恒不写 `false` —— 与活卡帧 / 409 体 / `card_json` 同一条纪律:缺席 = 「没有治理来源
- * 的证据」,不是「这不是治理门」。
- *
- * ⚠️ **`delegation` 刻意不在这里**(同批如实登记,禁编造键):park 行上**没有**这条信息 —— core 的
- * `Checkpoint` / `PendingAction` / `CheckpointGate` 三个面都不带 `{parentToolCallId, depth, agentName}`
- * (`Checkpoint.state.delegationProvenance` 是 design/180 的内容安全聚合 `{version, coverageStartTurn,
- * sawExternal, incomplete}`,与 ask 的出处链是两件事)。同步腿的这一格来自 `AskRequest.delegation`,
- * 那条路 park 时不随行。⇒ 无供给,诚实缺席;要它得先有 core 侧的属主面。
- */
 function projectPendingForWire(row, governance) {
     const redacted = redactPendingDisclosures(row);
     const governanceForced = governanceOriginOf({ riskDescriptor: row.riskDescriptor ?? undefined }, governance);
     return governanceForced ? { ...redacted, governanceForced } : redacted;
 }
-/**
- * GET /v1/approvals/stream (design/80 native push): SSE — pushes pending-approval deltas so the portal
- * SUBSCRIBES ONCE instead of polling GET /v1/approvals every ~10s (better UX: near-real-time + no client poll
- * loop). Polls listPending(scope) and diffs against the prior snapshot: `pending` for a new suspend, `resolved`
- * for a decided/expired/gone one. Cross-replica BY CONSTRUCTION — the poll reads the SHARED checkpoint table,
- * so a suspend on ANY replica is seen by an operator streaming on a DIFFERENT replica. A transient DB blip
- * heartbeats + retries (never kills the stream); a 15-min cap + req-close end it (parity with streamTaskTrace).
- * Poll-granularity caveat (**narrowed** by [3684]②): the delta now re-emits a `pending` frame whenever a key's
- * WIRE PROJECTION changes (upsert), not only when the key enters — so a same-key re-suspend within one interval
- * IS visible as long as anything on the row differs. What still shows no delta is the strictly degenerate case:
- * a resolve + re-suspend on the same (session,toolCallId) whose projection is BYTE-IDENTICAL — indistinguishable
- * by construction, and harmless (the card the operator sees is the card that is pending). Pins: the two halves of
- * `test/wire-pairing-approvals-stream.test.ts` S3b (changed ⇒ re-emit with the NEW payload; unchanged ⇒ silence).
- *
- * A-002.19(2026-08-09 亲验定性=设计接受,非欠账):每连接自跑 pollMs 轮询打共享 checkpoint 表,
- * 之所以不建 fan-out/单轮询器基建——①消费方=portal 运营面,并发连接数量级为个位(不是用户面);
- * ②listPending 走 (scope,status) 索引,单查成本与一次 /v1/approvals 轮询同阶,而本路正是替代客户端
- * ~10s 轮询的(净负载持平或更低);③DB blip 已 fail-soft(心跳+下拍重试),15-min cap 兜顶。连接
- * 数假设若被打破(portal 多开成常态),届时把 poll 收敛为进程内单轮询器多路复用——那是量级触发的
- * 演化,不是现在的缺陷。
- */
-export async function streamApprovals(req, res, cs, scope, 
-/** [3684]②:出身归因的部署侧一半(缺席 ⇒ 归不出治理出身 ⇒ 键缺席,与 best-effort 同方向)。**位置在
- *  `pollMs` 之前**是刻意的:`pollMs` 只有测试传,而本参数是每个生产调用点都必须给的那一个。 */
-governance, pollMs = APPROVALS_STREAM_POLL_MS) {
-    // JSON-encode the (sessionId, toolCallId) pair so distinct pendings can NEVER collide into one Map key,
-    // regardless of what a caller-supplied sessionId contains (any single-char delimiter — space OR even NUL — is
-    // injectable by an adversarial id, masking/wrong-removing an approval card; adversarial finding). JSON escaping
-    // makes every distinct (sessionId, toolCallId) pair a distinct key.
+export async function streamApprovals(req, res, cs, scope, governance, pollMs = APPROVALS_STREAM_POLL_MS) {
     const keyOf = (p) => JSON.stringify([p.sessionId, p.toolCallId ?? null]);
     sseHeaders(res);
-    // Each data payload ALSO carries a `type` field mirroring the SSE event name — so a client can dispatch on
-    // `data.type` without relying on the SSE `event:` line (some proxies strip event names; `onmessage` ignores
-    // named events). The SSE event name stays for native EventSource addEventListener.
     res.write(`event: meta\ndata: ${JSON.stringify({ type: "meta", version: 1, mode: "approvals-delta", pollMs: APPROVALS_STREAM_POLL_MS })}\n\n`);
     let closed = false;
-    // design/245 件1:req+res 双挂 + 一次性闸(理由全文在 `sse-lifecycle.ts` 顶注)。本腿每连接自跑一条
-    // 打共享 checkpoint 表的轮询(见上方 A-002.19 的定性),旗翻不过来的代价就是这条 DB 轮询对着死
-    // socket 跑满 15 分钟 —— 断连清理在本腿是**负载**问题,不只是收摊问题。
     bindSseLifecycle(req, res, () => { closed = true; });
     const start = Date.now();
     let lastBeat = Date.now();
     let prev = new Map();
-    /**
-     * 🔴 [3684]② / codex 对抗复审 [medium](验真后修):**上一拍每行的 wire 投影字节**。
-     *
-     * 旧 delta 只判「键进/键出」——对一条内容**不变**的 park 行那是对的,而 `governanceForced` 是**派生位**,
-     * 它随 `config.autonomy`(config-center 的 `apply-effective` 就地热改)在**同一条行还挂着**的时候翻面。
-     * 只判键的话,常驻订阅的 portal 会一直渲着旧徽标(最长到 15 分钟 cap 重连),而同一时刻
-     * `GET /v1/approvals` 已经给出另一个答案 —— 两条本该同源的读面当场分家。
-     *
-     * ⇒ 判据改成**投影字节变了就重发**。`pending` 帧对同一 (sessionId, toolCallId) 键因此是 **upsert**
-     * 语义(消费端本来就按这个键建表);重复发一帧是无害的(幂等覆盖),漏发一帧是错的徽标。
-     */
     let prevFrames = new Map();
     let first = true;
     while (!closed) {
         let pending;
         try {
-            // #209 件4 + [3684]②:与 `GET /v1/approvals` **同一个**投影函数(脱敏 + 出身归因)—— 两条 durable
-            // 读面各投各的就会漂(SSE 那条恰恰是 operator 常驻订阅的那条,漏掉它等于没修)。
             pending = (await cs.listPending(scope)).map((r) => projectPendingForWire(r, governance));
         }
         catch {
-            // a transient TiDB blip must NOT kill the subscription — heartbeat + retry next tick (fail-soft)
             if (!res.writableEnded)
                 res.write(`event: heartbeat\ndata: ${JSON.stringify({ type: "heartbeat" })}\n\n`);
             await sleep(pollMs);
             continue;
         }
         const cur = new Map(pending.map((p) => [keyOf(p), p]));
-        // 一行只序列化一次:既是要发的帧体,也是与上一拍比对的判据(两处各算一遍必然漂)。
         const curFrames = new Map([...cur].map(([k, p]) => [k, JSON.stringify({ type: "pending", ...p })]));
         if (first) {
-            // initial snapshot so a freshly-subscribed portal renders the current queue immediately (no first-poll gap)
             for (const frame of curFrames.values())
                 res.write(`event: pending\ndata: ${frame}\n\n`);
             res.write(`event: synced\ndata: ${JSON.stringify({ type: "synced", count: pending.length })}\n\n`);
             first = false;
         }
         else {
-            // 新 park **或**同一行的投影内容变了(见 `prevFrames` 顶注:派生位会在行不变时翻面)⇒ upsert 一帧
             for (const [k, frame] of curFrames)
                 if (prevFrames.get(k) !== frame)
                     res.write(`event: pending\ndata: ${frame}\n\n`);
             for (const [k, p] of prev)
                 if (!cur.has(k))
-                    res.write(`event: resolved\ndata: ${JSON.stringify({ type: "resolved", sessionId: p.sessionId, toolCallId: p.toolCallId })}\n\n`); // decided/expired/gone
+                    res.write(`event: resolved\ndata: ${JSON.stringify({ type: "resolved", sessionId: p.sessionId, toolCallId: p.toolCallId })}\n\n`);
         }
         prev = cur;
         prevFrames = curFrames;