@sema-agent/server 7.43.0 → 7.44.0

package/dist/approval-reconciler.js

@@ -2,41 +2,9 @@ import { isTerminalRunStatus } from "./plugins/store-contracts.js";
 import { DENY_REASONS, VOID_REASONS } from "./approval-deny-reasons.js";
 import { buildRevokeFrame } from "./approval-card.js";
 import { encodeCheckpointScope } from "./security.js";
-/* 判据 2 的「非 suspended 终局」判据 = `store-contracts.ts` 的 {@link isTerminalRunStatus}(词表属主处的
- * 穷举 switch,core 加/删 `TaskStatus` 成员当场 tsc 红)。此处**不再手抄**一份 `ReadonlySet<string>`:
- * 那份的门对象是 `string`,对词表增删两向都无钉,而这张词表真变过(core 5.8.0 删 `"timeout"`)。
- * `suspended`/`needs_review`/`running` 都不是终局 ⇒ 落判据 3 保持。 */
-/** core 给「被取消」的 run 打的 `errorCode`(§9 C3 的取消判别键)。 */
 const CANCELLED_ERROR_CODE = "cancelled";
-/**
- * 🔴 收敛器每一次 store/读口调用的墙钟上限(codex 交叉复审 round3 R3-2,2026-08-06 真缺陷)。
- *
- * 为什么必须有:`runOnce` 被 reaper 腿的 **in-flight 守卫**包着(一次只跑一轮)。一个挂死的依赖
- * (checkpoint 店 / run 店 / ask 店任意一个黑洞化)会让 `runOnce` 永不返回 ⇒ 守卫从此再不放行 ⇒
- * **全部** approval 行的对账永久停摆,而这正是本模块存在的目的(崩溃恢复)。超时后单行进 per-row
- * catch(warn + 计数 + 留在原态下轮重试),其余行照常推进 —— 一条坏依赖不许饿死整段扫描。
- * 10s:远大于任何健康查询,又远小于 reaper tick 的实际容忍度。
- */
 const RECONCILE_STORE_TIMEOUT_MS = 10_000;
-/**
- * 🔴 **每段**扫描的墙钟预算(codex 交叉复审 round4 R4-2,2026-08-06 验真)。
- *
- * 单看 per-call deadline 是不够的:行是**串行**处理的,一个黑洞化的依赖会让每行都吃满
- * {@link RECONCILE_STORE_TIMEOUT_MS}。默认 batch=200 时 `runOnce` 要跑掉半小时量级,上帽 10000 行更是
- * 一天量级 —— 而 reaper 的 in-flight 守卫在这期间会**跳过每一个 tick**,孤儿段(段二)甚至一次都轮不到。
- * 于是「一个依赖挂了」被放大成「整个对账面停摆数小时」,正好是本模块要防的那件事。
- *
- * 修法:**每段各自**一份预算(不是共享一份)——段一吃光也绝不影响段二开跑(孤儿代打是崩溃恢复的兜底,
- * 优先级不比判据表低)。超预算即停本段,剩下的行下轮接着扫(`deferReconcile` 的队列轮转保证「下轮」
- * 真的能轮到新行),并记一条 warn。
- */
 const RECONCILE_SEGMENT_BUDGET_MS = 30_000;
-/** 给一次读/写套墙钟上限(超时以 Error 拒绝,由 per-row catch 接住)。定时器 `unref`,绝不持住进程;
- *  竞速输的那一路由 `Promise.race` 自己的 handler 接住,不会变成 unhandled rejection。
- *
- *  A-002.10:竞速一结束就 `clearTimeout`。`unref` 只保证不吊住进程退出,**不**回收定时器本身——本函数在
- *  逐行串行的 `runOnce` 里每行要走 1~6 次,不清就是「每行 1~6 只挂满 {@link RECONCILE_STORE_TIMEOUT_MS}」
- *  的累积(batchLimit 默认 200 ⇒ 一轮几百只带闭包的定时器)。`finally` 对成功/失败两路都清。 */
 function withDeadline(op, label, timeoutMs = RECONCILE_STORE_TIMEOUT_MS) {
     let timer;
     return Promise.race([
@@ -50,64 +18,19 @@ function withDeadline(op, label, timeoutMs = RECONCILE_STORE_TIMEOUT_MS) {
             clearTimeout(timer);
     });
 }
-/**
- * 这只 ask 是不是**祖先冻结 approver 层**在委派 fold 中途铸的那一份(#168 件1④,黑板 [2912]③)。
- *
- * 判别位是**产品自己发的**,不是外部约定:core 的 `withDelegationProvenance` 只包**子代自己那条缝**,
- * 祖先层那次走未包装的原函数 ⇒ `AskRequest.delegation` 在不在,就是「这一份是哪一层发的」。落到行上,
- * `delegation.parentToolCallId` 是必填字段,铸行时逐字透传进 `parent_tool_call_id` 列 ⇒ **列非 NULL
- * ⇔ delegation 在场**(不需要新列,也不需要回 `req` 里再读一次)。
- *
- * 第二维 `sourceTaskId !== sessionId` 把「根腿」摘出去:根腿的 `sourceTaskId` 恒等于会话锚(core 给
- * `AskRequest.sourceTaskId` 填的就是该腿 sessionId),它根本不在任何 fold 里,`parent_tool_call_id`
- * 为 NULL 是它的常态而不是信号。
- *
- * 命中 ⇒ 退出硬相等(判据 1 结构上不命中,行落 ②③④⑤)。实测(test AI 围栏)checkpoint 存的摘要**逐字
- * 等于子代自己那条缝**、只不等于祖先层那一次 —— 所以收窄到这一层,子代自己的缝照常参与。
- */
 export function isAncestorFoldMint(ask) {
     return ask.parentToolCallId === null && ask.sourceTaskId !== ask.sessionId;
 }
-/**
- * 判据 1 的**硬谓词**(纯函数,§9 C2 + §8 D-2;#168 件1 起返回分类而不是布尔)。
- *
- * 逐条:
- *  - 祖先层 fold 中途铸点 ⇒ 直接退出(见 {@link isAncestorFoldMint});
- *  - `unparseable` 候选直接出局(读不出 ⇒ 不确定 ⇒ 不命中);
- *  - **身份三元组**:`sourceTaskId` **相等** ∧ `toolCallId` **相等** ∧ 时间维的**因果下界**
- *    `candidate.createdAtMs >= ask.createdAtMs`(⚠️ 第三维**不是等式** —— 把它读成等式会让合法的 park
- *    几乎命不中,行随后落 ②③⑤ 被误判)—— 摘要**不是**身份([2897]③①:
- *    同 args 的两次调用摘要天然相同,只靠摘要硬相等会把第二次投递并进第一次的票);任一维在候选侧
- *    缺席(读不出的 blob 没有 `sourceTaskId`)即身份不成立;
- *  - **hash 双等**:两侧都必须在场且相等,任一侧缺席一律不 bind;禁「能取到时才比」的可选谓词。
- *    归因分两级(顺序即代码顺序):身份这一层先判 —— 同身份候选为空**且**候选集非空 ⇒ `identity_miss`;
- *    走到 hash 这一层才把缺席记成**单铸** `single_mint`(见 {@link GateMatchOutcome})。
- *
- * 多候选时的取舍:优先 `status === "pending"`(活着的那张 gate),否则取最早的一条(读口按
- * `created_at_ms ASC` 返回)。两者都满足全部硬谓词,选谁都不会错配;取 pending 只是让 `PARKED` 行落到
- * 一个还能被 resume 的坐标上,对壳更有用。
- */
 export function classifyGateMatch(ask, candidates) {
     const outcome = classifyGateMatchBeforeFoldVeto(ask, candidates);
-    // 🔴 祖先层否决**排在最后**、而且只否决已经成立的命中(纯减法)。放在最前面判会让这条谓词的每一次
-    // 假阳性(`sourceTaskId ≠ sessionId` 还有别的成因,例如 session-less 的 adhoc 腿)都白白关掉判据 1,
-    // 并把一条本该记成 `single_mint`/`identity_miss` 的行错记成「祖先层铸点」。放在这里,它最坏只是**不
-    // 命中**(与判据 1 的既有 fail-safe 同向),而计数从此只统计「本来会 bind、被这条裁定拦下」的行 ——
-    // 非零读数因此是真信号,不是噪声底。
     if (outcome.kind === "match" && isAncestorFoldMint(ask))
         return { kind: "ancestor_fold_mint" };
     return outcome;
 }
 function classifyGateMatchBeforeFoldVeto(ask, candidates) {
-    // 身份三元组的前两维 + 因果下界(摘要不参与这一层——它是身份之外的**第二道**等式)。
     const sameIdentity = candidates.filter((c) => c.unparseable !== true && c.sourceTaskId !== null && c.sourceTaskId === ask.sourceTaskId && c.boundCallId === ask.toolCallId && c.createdAtMs >= ask.createdAtMs);
     const askHash = ask.boundInputHash;
     if (sameIdentity.length === 0) {
-        // 「同身份的 checkpoint 一条都没有」有两种成因,不能混:
-        //  · 候选集**空** ⇒ 这条弧上根本没有对家,只有 ask 侧铸过(或两侧都没铸)= 单铸;
-        //  · 候选集非空 ⇒ 有对家、只是不是这一只(别的 sourceTaskId/callId),或者读不出(`unparseable`,
-        //    「不确定」)。两者都**不是**「只有一侧铸过」这个事实陈述,一律记 `identity_miss`——
-        //    把一条读不出的坏行说成「对家从来不存在」是拿不确定冒充确定。
         if (candidates.length > 0)
             return { kind: "identity_miss" };
         return { kind: "single_mint", side: askHash === null ? "neither" : "ask_only" };
@@ -116,61 +39,46 @@ function classifyGateMatchBeforeFoldVeto(ask, candidates) {
     if (askHash === null)
         return { kind: "single_mint", side: withHash.length > 0 ? "checkpoint_only" : "neither" };
     if (withHash.length === 0)
-        return { kind: "single_mint", side: "ask_only" }; // 同身份的 park 一条摘要都没有
+        return { kind: "single_mint", side: "ask_only" };
     const matches = withHash.filter((c) => c.boundInputHash === askHash);
     const picked = matches.find((c) => c.status === "pending") ?? matches[0];
     if (picked !== undefined)
         return { kind: "match", candidate: picked };
     return { kind: "hash_mismatch", candidates: withHash.length };
 }
-/** {@link classifyGateMatch} 的布尔面(判据 1 命中即返回那条候选)。分类信息由调用方按需另取。 */
 export function selectGateCandidate(ask, candidates) {
     const outcome = classifyGateMatch(ask, candidates);
     return outcome.kind === "match" ? outcome.candidate : undefined;
 }
-/** 判据表 v2 的判定(纯函数;顺序 = 设计稿 §9 尾的五臂汇总,注见文件头)。 */
 export function decideReconcileAction(input) {
     const { ask, candidates, run, batchState, nowMs, adhocGraceMs, orphanTtlMs } = input;
-    // ① identity ∧ hash 双等
     if (input.allowBind !== false) {
         const match = selectGateCandidate(ask, candidates);
         if (match) {
             return { kind: "bind", gate: { gateToken: match.token, gateBoundCallId: match.boundCallId, gateBoundInputHash: match.boundInputHash } };
         }
     }
-    // 批已 ABORTED = 取消腿走过 ⇒ abort 语义(§9 C3),与 run 终局与否无关:批一旦 ABORTED,这只 ask 的
-    // 投递面已经被整批撤掉,再判 run 状态没有意义。
     if (batchState === "ABORTED")
         return { kind: "void", reason: VOID_REASONS.BATCH_ABORTED };
-    // 🔴 bind-once 落选者(codex round2 R2-3):批已绑给**别人** ⇒ 本行结构上再也赢不了 `bindBatch`。
-    // 它是**当下就可判**的终局(VOID),不是「等等看」——落 hold 会让它滞留到 run 终局,然后被判据 2 误报
-    // 成路由失败。判据要求 `boundAskId` 真的读到且不是自己:读不到(null)时不据此下判(未知 ≠ 落选)。
     if (batchState === "ROUTING_BOUND" && input.batchBoundAskId != null && input.batchBoundAskId !== ask.askId) {
         return { kind: "void", reason: VOID_REASONS.BATCH_BOUND_ELSEWHERE };
     }
-    // ② run 终局分臂
     if (run !== null && isTerminalRunStatus(run.status)) {
         if (run.status === "failed" && run.errorCode === CANCELLED_ERROR_CODE) {
             return { kind: "void", reason: VOID_REASONS.RUN_CANCELLED };
         }
         return { kind: "deny", reason: DENY_REASONS.ROUTING_FAILURE };
     }
-    // ④ adhoc 双谓词(§8 C-2):结构判别 + 窗过 + 宽限。**不是** DENIED(约束②禁超时 denial)。
     if (run === null && ask.sessionId === ask.taskId && nowMs > ask.expiresAtMs + adhocGraceMs) {
         return { kind: "void", reason: VOID_REASONS.ADHOC_LEG_NO_DURABLE_DOMAIN };
     }
-    // ⑤ 遗孤最终可判(§8 A-1 放宽形):量 immutable 的 createdAtMs。放在 ③ 之前判 —— 它是**所有**
-    // 「本轮判不出终局」的行的共同兜底,包括 run 一直在跑的那一支。
     if (nowMs - ask.createdAtMs >= orphanTtlMs)
         return { kind: "void", reason: VOID_REASONS.ORPHAN_TTL_EXCEEDED };
-    // ③ else:保持 PARKING(候下轮;执行器负责 deferReconcile 排队尾)。`candidates` 在这一臂被显式忽略
-    // ——判据 1 已经判过且没命中,这里不做任何「差不多算匹配」的兜底。
     void candidates;
     return { kind: "hold" };
 }
 export function createApprovalReconciler(deps) {
     const { askStore, checkpoints, runs, logger, metrics, batchLimit, pendingGraceMs, adhocGraceMs, orphanTtlMs, emitRevoke } = deps;
-    /** 撤卡帧发射(live only;失败 catch + warn,**绝不回滚 CAS** —— 帧是通知,真源是行)。空名单不发。 */
     const revoke = (row, askIds, reason, nowMs) => {
         if (askIds.length === 0 || !emitRevoke)
             return;
@@ -182,45 +90,19 @@ export function createApprovalReconciler(deps) {
                 logger.warn("approval_revoke_emit_failed", { batchId: row.batchId, count: askIds.length, err: err instanceof Error ? err.message : String(err) });
             }
             catch {
-                // 可观测面自身绝不能变成故障源(reapers.ts createThrottledReaperCatch 同款纪律)。
             }
         }
     };
-    /** 一条 `PARKING` 行的收敛(读事实 → 纯判定 → 一次 CAS)。返回本行落到哪一臂 + 判据 1 的分类(供统计;
-     *  `match` 缺席 = 本轮压根没走到判据 1,与「走了但没命中」是两回事,不能记成同一格)。 */
     const reconcileOne = async (ask, nowMs) => {
-        // ⓪ 批态**先读**(codex round3 R3-2):它是唯一一个能让本行「结构上再也不可能 bind」的事实,而且是
-        //    一次主键读。批已 `ABORTED` 或已绑给**别人** ⇒ 判据 1 的 `bindBatch` 谓词(`ROUTING_UNBOUND`)
-        //    注定不成立 ⇒ 跳过 checkpoint/run 两次读**结论不变**,却少挂两个可能黑洞化的依赖(原先的次序下,
-        //    一条挂死的 checkpoint 店会把这类**当下就可判**的行连同整个 `runOnce` 一起拖住,再经 reaper 的
-        //    in-flight 守卫把后续所有 tick 一并封死)。
         const batchRow = await withDeadline(askStore.getBatch(ask.batchId), "getBatch");
         let batchState = batchRow?.state ?? "MISSING";
         let batchBoundAskId = batchRow?.boundAskId ?? null;
         const irreversibleBatch = batchState === "ABORTED" || (batchState === "ROUTING_BOUND" && batchBoundAskId !== null && batchBoundAskId !== ask.askId);
-        // 判据 1:窄谓词精确查(scope 必填 —— 租户门是读口自己的责任,§8 D-3)。因果下界直接下推成
-        // `sinceMs`,SQL 侧就把早于本 ask 的 checkpoint 排掉了(`selectGateCandidate` 里还会再判一次,
-        // 纵深防御)。
         let gateMatch;
         if (checkpoints && !irreversibleBatch) {
-            // 🔴 **已知缺口,登记而不假称已解**(codex 交叉复审 2026-08-07 [high] 一,验真;**先存**,不是本批
-            // 引入):这里的 session 维传的是 `ask.sessionId` = **投递上下文**的会话(`tool-approval.ts` 铸行时
-            // 取 `primary.sessionId`),而委派子代那条腿的 checkpoint 落在**子代自己**的 sessionId 上
-            // (core 铸 `cp.sessionId = 该腿 sessionId`,同值也写进 `cp.sourceTaskId`)。⇒ 子代自己那条 approver
-            // 缝的 park 在 SQL 谓词这一层就被滤掉了,判据 1 对委派腿结构上够不着 —— 黑板 [2912]③「子代自己那条
-            // 缝可以参与硬相等」的那一半,在本仓当前接线下还落不了地(行改走 ②③④⑤,fail-safe)。
-            //
-            // 顺带说清本批**改善**了什么:三元组把 `cp.sourceTaskId === ask.sourceTaskId` 变成硬谓词之后,
-            // 一只子代 ask 再也不可能认领**宿主**腿的 park(同 session 查出来的候选,callId 撞车 + 同 args 摘要
-            // 相同就够了,而 `PARKED` 不可回滚)——那是本批之前真实存在的错配面。
-            //
-            // 修法(未做,需自带判据):把 session 维换成「铸 park 的那条腿的会话」。风险在于 `ask.sourceTaskId`
-            // 有 `?? origin.taskId` 兜底,core 万一不填就会把一个 taskId 当 session 去查(比今天更差),所以
-            // **必须**配一条用真 checkpoint 店、宿主/子代两个不同 sessionId 的端到端钉才动。开题上报。
             const candidates = await withDeadline(checkpoints.findCheckpointCandidatesForAsk(encodeCheckpointScope(ask.owner), ask.sessionId, ask.toolCallId, ask.createdAtMs), "findCheckpointCandidatesForAsk");
             gateMatch = classifyGateMatch(ask, candidates);
             if (gateMatch.kind === "hash_mismatch") {
-                // 留痕不拒(见 ReconcileStats.hashMismatch 顶注):warn 说清成因方向,行继续按 ②③④⑤ 判。
                 try {
                     logger.warn("approval_reconcile_hash_mismatch", {
                         askId: ask.askId,
@@ -233,13 +115,10 @@ export function createApprovalReconciler(deps) {
                     });
                 }
                 catch {
-                    /* 可观测面绝不成为故障源 */
                 }
             }
             const match = gateMatch.kind === "match" ? gateMatch.candidate : undefined;
             if (match) {
-                // 🔴 `bindBatch` 内部**一次**完成 `PARKING→PARKED` + gate 落行 + 兄弟连坐 VOID(§8 A-2:正文
-                // 「先 transitionAsk 再 bindBatch」是死锁形,已作废)。只调它一次。
                 const res = await withDeadline(askStore.bindBatch(ask.batchId, ask.askId, {
                     gateToken: match.token,
                     gateBoundCallId: match.boundCallId,
@@ -249,53 +128,32 @@ export function createApprovalReconciler(deps) {
                     revoke(ask, res.voidedSiblings, "superseded_by_park", nowMs);
                     return { outcome: "parked", match: gateMatch };
                 }
-                // 判别式失败臂(§9 C3):拿到批的**真实**态 + 中选者,降级续判 —— `ABORTED` ⇒ VOID(abort 语义),
-                // `ROUTING_BOUND` 且中选者是兄弟 ⇒ VOID(bind-once 落选者,R2-3),其余按 ②③④⑤。
                 batchState = res.batchState;
                 batchBoundAskId = res.boundAskId ?? null;
             }
         }
-        // run 行只在批**还可能**让本行走下去时才读(不可逆批态下它对结论零影响,见 ⓪)。
         const run = runs && !irreversibleBatch ? ((await withDeadline(runs.getRun(ask.taskId), "getRun")) ?? null) : null;
-        // 判据 1 已经在上面单独判过(命中即 `bindBatch`,不命中/绑失败都落这里)⇒ `allowBind: false`。
         const action = decideReconcileAction({ ask, candidates: [], run, batchState, batchBoundAskId, nowMs, adhocGraceMs, orphanTtlMs, allowBind: false });
         switch (action.kind) {
             case "bind": {
-                // `allowBind: false` 下结构上不可达;留一条防御性 hold,绝不在这里第二次调 bindBatch。
                 await withDeadline(askStore.deferReconcile(ask.askId, "PARKING", ask.rev, nowMs), "deferReconcile");
                 return { outcome: "held", match: gateMatch };
             }
             case "deny": {
-                // 🔴 全仓唯一的 `DENIED` 写点(grep 钉)。归因是判据 2 的**终局证据**,不是超时推断。
-                // CAS 输(行在本轮判定期间被别人收走)= 正常,如实记成 held(没动过行),下轮重扫。
                 const won = await withDeadline(askStore.transitionAsk(ask.askId, "PARKING", "DENIED", { deniedReason: action.reason, updatedAtMs: nowMs }), "transitionAsk(DENIED)");
                 return { outcome: won ? "denied" : "held", match: gateMatch };
             }
             case "void": {
-                // 🔴 codex 交叉复审 C3(2026-08-06 真缺陷):**必须看 CAS 的返回值**。原先无条件记账 + 发撤卡帧
-                // ——本行若在判定与写入之间被另一个副本 `bindBatch` 收成 PARKED,这次 CAS 干净地输,行**没有**
-                // 被翻成 VOID,而帧却告诉壳「这张卡作废了」⇒ 直接违反撤卡帧守恒(名单 ≡ 真被翻成 VOID 的集合),
-                // 壳会清掉一张仍然有效、还在等 gate 的卡。输 ⇒ 什么都不做,下轮按新态重判。
                 const won = await withDeadline(askStore.transitionAsk(ask.askId, "PARKING", "VOID", { deniedReason: action.reason, updatedAtMs: nowMs }), "transitionAsk(VOID)");
                 if (!won)
                     return { outcome: "held", match: gateMatch };
                 if (action.reason === VOID_REASONS.ORPHAN_TTL_EXCEEDED) {
                     logger.warn("approval_ask_orphan_voided", { askId: ask.askId, taskId: ask.taskId, ageMs: nowMs - ask.createdAtMs, ttlMs: orphanTtlMs });
                 }
-                // 单行 VOID 也是撤卡:壳上那张卡必须消失(名单 = 这一行自己)。
-                // reason 取 `"aborted"`:v1 的闭集只有两员,而 `"superseded_by_park"` 的字面语义是「**被别人的
-                // park 连坐**」——②④⑤ 三条臂(run 取消 / 批 ABORTED / adhoc 无对账域 / 遗孤 TTL)都不是那回事,
-                // 硬套会把归因写成谎。`"aborted"`(这条腿死了)是两员里唯一诚实的那个;真正的细分归因在**行上**
-                // (`denied_reason` 落的是 VOID_REASONS 的具体值),帧只负责让壳清卡。
-                // (存疑登记:v2 若要让壳按成因分渲,给 reason 闭集加一个 `"voided"` 成员即可,属 wire 加员。)
-                // 落选者(R2-3)是**真的**被别人的 park 顶掉 ⇒ 用 `superseded_by_park`;其余单行 VOID 用 `"aborted"`
-                // (两员闭集里唯一诚实的那个,见上注)。
                 revoke(ask, [ask.askId], action.reason === VOID_REASONS.BATCH_BOUND_ELSEWHERE ? "superseded_by_park" : "aborted", nowMs);
                 return { outcome: "voided", match: gateMatch };
             }
             case "hold": {
-                // 队列轮转(§8 D-4 / §9 C5):推 `updated_at_ms` 排到队尾。CAS 输(版本已被别人推进)= 正常,
-                // 本轮判定已过期,下轮重来。
                 await withDeadline(askStore.deferReconcile(ask.askId, "PARKING", ask.rev, nowMs), "deferReconcile");
                 return { outcome: "held", match: gateMatch };
             }
@@ -319,10 +177,9 @@ export function createApprovalReconciler(deps) {
                 budgetExhausted: 0,
                 orphansExpired: 0,
             };
-            // ── 段一:PARKING 判据表 ────────────────────────────────────────────────────────────────
             const parking = await withDeadline(askStore.listByState("PARKING", batchLimit), "listByState(PARKING)");
             stats.scanned = parking.length;
-            const parkingDeadline = Date.now() + RECONCILE_SEGMENT_BUDGET_MS; // R4-2:段一预算
+            const parkingDeadline = Date.now() + RECONCILE_SEGMENT_BUDGET_MS;
             for (const ask of parking) {
                 if (Date.now() >= parkingDeadline) {
                     stats.budgetExhausted += 1;
@@ -330,12 +187,11 @@ export function createApprovalReconciler(deps) {
                         logger.warn("approval_reconcile_budget_exhausted", { segment: "PARKING", processed: stats.parked + stats.denied + stats.voided + stats.held + stats.failed, scanned: stats.scanned, budgetMs: RECONCILE_SEGMENT_BUDGET_MS });
                     }
                     catch {
-                        /* 可观测面绝不成为故障源 */
                     }
-                    break; // 剩下的行下轮接着扫(队列轮转保证轮得到),绝不霸着 in-flight 守卫不放
+                    break;
                 }
                 if (ask.boundInputHash === null)
-                    stats.unmatchableNoHash += 1; // 判据 1 盲区(见字段顶注)
+                    stats.unmatchableNoHash += 1;
                 try {
                     const { outcome, match } = await reconcileOne(ask, nowMs);
                     if (outcome === "parked")
@@ -346,8 +202,6 @@ export function createApprovalReconciler(deps) {
                         stats.voided += 1;
                     else
                         stats.held += 1;
-                    // 判据 1 的分类计数(#168 件1②③④)——`match` 缺席 = 本轮没走到判据 1(无 checkpoint 面 /
-                    // 批已不可逆),那既不是 mismatch 也不是单铸,一格都不记。
                     switch (match?.kind) {
                         case "hash_mismatch":
                             stats.hashMismatch += 1;
@@ -364,26 +218,20 @@ export function createApprovalReconciler(deps) {
                                 stats.singleMintNeither += 1;
                             break;
                         default:
-                            break; // match / identity_miss / 未走到判据 1:无计数格
+                            break;
                     }
                 }
                 catch (err) {
-                    // 🔴 per-row 隔离(邻居 bg-agent per-scope 先例):一条行的坏 blob / 一次瞬时错误不许饿死同批
-                    // 其余 199 行。失败响亮(warn + 计数),行留在 PARKING 下轮重试。
                     stats.failed += 1;
                     try {
                         logger.warn("approval_reconcile_row_failed", { askId: ask.askId, taskId: ask.taskId, err: err instanceof Error ? err.message : String(err) });
                     }
                     catch {
-                        /* 可观测面绝不成为故障源 */
                     }
                 }
             }
-            // ── 段二:孤儿 STREAM_PENDING 代打 expire(§1.3 + §8 D-1.1 宽限)──────────────────────────
-            // 🔴 **不是第五竞争者**:它就是窗到期竞争者在崩溃后的补位,同一 CAS 同一转移。宽限保证活属主的
-            // 本地 timer 常态必胜(reaper 退回纯崩溃兜底),不与在场闭包抢。
             const pending = await withDeadline(askStore.listByState("STREAM_PENDING", batchLimit), "listByState(STREAM_PENDING)");
-            const orphanDeadline = Date.now() + RECONCILE_SEGMENT_BUDGET_MS; // R4-2:段二**独立**预算(段一吃光也照跑)
+            const orphanDeadline = Date.now() + RECONCILE_SEGMENT_BUDGET_MS;
             for (const row of pending) {
                 if (Date.now() >= orphanDeadline) {
                     stats.budgetExhausted += 1;
@@ -391,16 +239,15 @@ export function createApprovalReconciler(deps) {
                         logger.warn("approval_reconcile_budget_exhausted", { segment: "STREAM_PENDING", expired: stats.orphansExpired, scanned: pending.length, budgetMs: RECONCILE_SEGMENT_BUDGET_MS });
                     }
                     catch {
-                        /* 同上 */
                     }
                     break;
                 }
                 if (row.expiresAtMs + pendingGraceMs >= nowMs)
-                    continue; // 窗未过 / 还在宽限内:属主在场,不碰
+                    continue;
                 try {
                     const res = await withDeadline(askStore.expireAsk(row.askId, row.batchId), "expireAsk(orphan)");
                     if (!res.won)
-                        continue; // 干净地输 = 属主刚刚赢了,正常
+                        continue;
                     stats.orphansExpired += 1;
                     revoke(row, res.voidedSiblings, "superseded_by_park", nowMs);
                 }
@@ -410,12 +257,9 @@ export function createApprovalReconciler(deps) {
                         logger.warn("approval_orphan_expire_failed", { askId: row.askId, taskId: row.taskId, err: err instanceof Error ? err.message : String(err) });
                     }
                     catch {
-                        /* 同上 */
                     }
                 }
             }
-            // 判据 1 盲区响亮化:有行结构上无法命中就每 tick 报一次(不是每行一次——刷屏没有信息量)。
-            // 静默地把「没法比」当成「比过了、不匹配」正是这条要治的病(它下游就是一个不诚实的 DENIED)。
             if (stats.unmatchableNoHash > 0) {
                 try {
                     logger.warn("approval_reconcile_rows_unmatchable", {
@@ -425,10 +269,8 @@ export function createApprovalReconciler(deps) {
                     });
                 }
                 catch {
-                    /* 可观测面绝不成为故障源 */
                 }
             }
-            // 健康 tick 保持安静(邻居 reapCount 同姿势):只有真动了行才记一条。
             if (stats.parked + stats.denied + stats.voided + stats.orphansExpired > 0) {
                 metrics?.inc("approval_reconciled_total", { outcome: "parked" }, stats.parked);
                 metrics?.inc("approval_reconciled_total", { outcome: "denied" }, stats.denied);

package/dist/approval.js

@@ -1,35 +1,10 @@
-/**
- * Human-in-the-loop approval gate (F4) — durable-only since 5.0.0 ([2354]/[2356] A-5:OA 轮询车道
- * (createOaApprovalPolicy + ApprovalStore pending 行轮询)整体退役;唯一门形 = durable checkpoint
- * suspend/resume,见 createDurableAskPolicy 与 /v1/approvals 的 checkpointStore 腿)。
- */
 import {} from "@sema-agent/core";
-/**
- * 运维**是否表达了门意图** —— boot 的单用户 allow-all 基线只在"零门意图"时才允许铺开,
- * 所以这个谓词漏一格 = 那一格的意图被 allow-all 静默吞掉。
- *
- * 🔴 由来(2026-07-31 缝合审):这判据本来是 `main.ts` 里的一行内联表达式,只枚举了
- * requireApproval / deny / durableApproval **三格**,漏了 `approvalNeverAuto`。漏的根因不是手滑,
- * 是 `config-types.ts` 当时把 neverAuto 描述成 "Subset of approvalRequire" —— 若真是子集,
- * 枚举 requireApproval 就覆盖了它。但本文件 inv#2 的执行面逐字相反(neverAuto ⊄ requireApproval),
- * 于是「单用户 + 只配 APPROVAL_NEVER_AUTO=Bash」这一**语义完全合理**的形被判成零门意图 ⇒
- * 落进 `createAllowDenyPolicy({})` 全面放行 ⇒ 那张"永远问人"的表从未进入任何 policy,Bash 直接跑。
- *
- * 判定挪到**与 inv#2 同一个文件**就是为了这个:两者再想漂开,得有人同时改这两段。
- * 新增任何"门意图"配置项时,这里必须同步加一格(下面的表驱动测试会点名漏的那格)。
- */
 export function hasOperatorGateIntent(config) {
     return (config.approvalRequire.length > 0 ||
         config.approvalDeny.length > 0 ||
-        config.approvalNeverAuto.length > 0 || // ← 漏了这格,见上面的由来
+        config.approvalNeverAuto.length > 0 ||
         config.durableApproval);
 }
-/**
- * 门意图不可服务=boot 拒启(全窗复审 D3-F1,HIGH;与 env 墓碑族同谱系)。
- * v4.3.0 的轮询门形(APPROVAL_REQUIRE + DB backend + DURABLE_APPROVAL 未设)在 5.0.0 只剩 core 每任务
- * warn——**原先拦、现在放**(方向反转)。「留 undefined 让 core warn」对新配置是曝露误配,对升级存量是
- * 门静默消失,后者必须响亮。放这文件与 hasOperatorGateIntent/inv#2 同源(意图判据再漂要同时改两段)。
- */
 export function assertGateIntentServiceable(config, checkpointStorePresent) {
     if (!hasOperatorGateIntent(config) || checkpointStorePresent)
         return;
@@ -39,53 +14,31 @@ export function assertGateIntentServiceable(config, checkpointStorePresent) {
     throw new Error("DURABLE_APPROVAL=true but no checkpoint store is available — the configured DB backend has no checkpoint face (or no backend is configured). Wire a MySQL-protocol/PostgreSQL/file backend, or unset DURABLE_APPROVAL.");
 }
 export function createDurableAskPolicy(opts) {
-    // 🔒 RAW-name matching(core 5.0.0 RB-476:canonicalToolName 折叠面整体退役)。安全前提没有变松,
-    // 只是换了执行者:live 请求名恒为 CC canonical(旧名在 core roster 层响亮 miss,永远到不了本 policy);
-    // 配置侧写了退役名 = core prepare 硬失败 `config.legacy_tool_name`(+ 本仓 config 装配墓碑先一步拒启)。
-    // 旧的双侧归一防的「旧名滑过新名规则」在 5.0.0 下无成立路径——折叠臂留着才是静默兼容层。
     const require = new Set(opts.requireApproval);
     const deny = new Set(opts.deny ?? []);
     const neverAuto = new Set(opts.neverAuto ?? []);
     const budget = Math.max(0, Math.floor(opts.autoBudget ?? 0));
-    // design/80 D-E (upgrade-budget): a per-run-leg counter of NORMAL gated calls auto-approved so far. The policy
-    // is rebuilt per resolveSpec call (= per submit AND per resume — server.ts), so this closure is per-leg —
-    // adequate for a runaway-loop circuit-breaker (the loop lives within one leg; a suspend only fires on an
-    // over-budget / never-auto ask, which escalates to a human anyway). A durable per-run budget is a refinement.
     let autoApproved = 0;
     return {
         check: (req) => {
-            const toolName = req.toolName; // RAW(5.0.0):live 名恒 canonical,折叠面已随 core RB-476 退役
+            const toolName = req.toolName;
             if (deny.has(toolName))
                 return { action: "deny", message: `tool "${req.toolName}" is denied by policy` };
-            // inv#2: a never-auto (irreversible / safety) tool ALWAYS asks a human — UNCONDITIONALLY, even if it was not
-            // also listed in requireApproval. An operator marking a tool "never auto-approve" means "always human"; it
-            // must never fall through to a bare allow (the footgun: neverAuto ⊄ requireApproval). Checked BEFORE the
-            // budget so a safety tool is never auto-approved. The enforcement is THIS deterministic policy `ask` — NOT a
-            // decisionReason (core 1.102 council proved decisionReason both misses policy-ask asks AND is forgeable, so
-            // the safety axis is sourced only from tool marks / core's persisted CheckpointGate.safetyAxis, never here).
             if (neverAuto.has(toolName))
                 return { action: "ask", message: `human approval required to run "${req.toolName}"` };
             if (require.has(toolName)) {
-                // Invariant alignment (workflow audit 2026-07-13): the DURABLE-resource-exhausted escalation is a
-                // SAFETY-axis ask (like neverAuto), so it outranks an exemption. In practice core already fail-fasts
-                // an exhausted leg before any tool call (runtask budget gate) — this is defense-in-depth ordering,
-                // zero behavior change on the live path, and it makes "耗尽恒问人" structural rather than incidental.
                 const remEarly = req.budget?.resourceRemainingMicroUsd;
                 if (remEarly !== undefined && remEarly <= 0) {
                     return { action: "ask", message: `durable resource budget exhausted — human approval required to run "${req.toolName}"` };
                 }
-                // Session exemption — an APPROVAL MEMORY, not a policy loosen: deny/neverAuto already won
-                // above; this only skips the HUMAN ask for a require-listed tool the operator said "remember" on. The
-                // probe is fail-closed (store error ⇒ not exempt ⇒ the normal ask path). AskUserQuestion is excluded
-                // for the same reason as the budget below (owned by the durable-question policy; its ask must stand).
                 if (opts.exempt && toolName !== "AskUserQuestion") {
                     return (async () => {
                         let exempted = false;
                         try {
-                            exempted = (await opts.exempt(toolName)) === true; // strict: a truthy non-boolean must not auto-approve
+                            exempted = (await opts.exempt(toolName)) === true;
                         }
                         catch {
-                            exempted = false; // fail-closed: a store hiccup must never auto-approve
+                            exempted = false;
                         }
                         if (exempted) {
                             opts.onExempted?.(toolName, req.toolName);
@@ -99,27 +52,11 @@ export function createDurableAskPolicy(opts) {
             return { action: "allow" };
         },
     };
-    /** The pre-existing require-branch tail (durable resource cap → per-leg count budget → ask), factored so the
-     *  async exemption probe and the sync path share ONE implementation (no drift). */
     function decideRequired(req, toolName) {
-        // a NORMAL gated tool AUTO-APPROVES while under the per-leg budget (the AI proceeds, no human); once the
-        // budget is exhausted the rest escalate to a human (the circuit-breaker trips). budget 0 ⇒ always ask.
-        // 🔴 EXCLUDE AskUserQuestion: it is owned by the durable-question policy (it ALWAYS asks), and
-        // combinePolicies (deny>ask>allow) makes that ask outrank our allow anyway — so counting it would
-        // silently shrink the real auto-approve budget for genuine NORMAL tools (adversarial finding). It falls
-        // through to ask here, consuming no budget.
-        // design/80 D-E-core (b, Framing 3): self-limit against the DURABLE resource ledger. If the run's durable
-        // resource budget is EXHAUSTED, escalate to a human REGARDLESS of the per-leg count budget. `req.budget`
-        // (core 1.103, built per-leg from the frozen-total resourceLedger) survives suspend/resume and CANNOT be
-        // re-granted (frozen-total, prior-wins) — so this is the durable cap that closes the per-leg re-grant below.
-        // 🔴 `resourceRemainingMicroUsd` is NEVER falsy-tested: 0 = exhausted (escalate), undefined = no ceiling.
         const rem = req.budget?.resourceRemainingMicroUsd;
         if (rem !== undefined && rem <= 0) {
             return { action: "ask", message: `durable resource budget exhausted — human approval required to run "${req.toolName}"` };
         }
-        // The per-leg COUNT budget remains a circuit-breaker (looser than configured across a deny-resume, but
-        // BOUNDED by core's suspendLoopCap, and inv#2 holds — a safety tool returned ask above). The durable
-        // resource cap above is the exact-per-run limiter the per-leg counter could not be (finding#1).
         if (toolName !== "AskUserQuestion" && budget > 0 && autoApproved < budget) {
             autoApproved++;
             return { action: "allow" };

package/dist/audit.js

@@ -1,23 +1,12 @@
-// 🔴 core 1.403 迁移(2026-07-25):`Session` 从 runtime class 降级成纯 interface,可构造的 storage-backed
-// class 改名 `StoredSession`(core CHANGELOG 1.403.0:"the constructable storage-backed class formerly
-// exported as `Session` is now `StoredSession`")——这里是 runtime 构造用法,照 core 给的迁移指南改。
 import { StoredSession, FileSessionRepo, InMemorySessionStorage, boundedTail } from "@sema-agent/core";
 import { TiDBSessionStorage } from "./plugins/tidb-session-storage.js";
 import { PgSessionStorage } from "./plugins/pg-session-storage.js";
-/** Build the audit view from the durable log. Returns undefined if the session does not exist. */
 export async function buildSessionAudit(pool, sessionId) {
     return auditFromStorage(await TiDBSessionStorage.wake(pool, sessionId), sessionId);
 }
-/** The PG twin — same view over PgSessionStorage.wake. Until this, the
- *  audit face was TiDB-only and a PG/local deployment 404'd the whole web session area. local = follow-on
- *  (its storage seam has no wake-equivalent yet — may turn out to be a core gap). */
 export async function buildSessionAuditPg(pool, sessionId) {
     return auditFromStorage(await PgSessionStorage.wake(pool, sessionId), sessionId);
 }
-/** The LOCAL (File) leg — web session area on DB_BACKEND=local.
- *  实现姿势:`FileSessionRepo.exportEntries`(纯读、torn-tail 恢复、missing→not_found)→
- *  `boundedTail`(纯函数切 floor)→ InMemorySessionStorage → 同一 auditFromStorage 内核。零写面、
- *  零新 seam;createdAt 从 repo.list() 的 metadata 取(File 形态 meta 与 entries 分储)。 */
 export async function buildSessionAuditLocal(root, sessionId) {
     const repo = new FileSessionRepo(root);
     let entries;
@@ -32,19 +21,14 @@ export async function buildSessionAuditLocal(root, sessionId) {
     const meta = (await repo.list()).find((m) => m.id === sessionId);
     const { tail, floorEntryId } = boundedTail(entries);
     const storage = new InMemorySessionStorage({ entries: tail, floorEntryId, ...(meta ? { metadata: meta } : {}) });
-    return auditFromStorage(storage, sessionId); // BaseSessionStorage 本有 getFloorId(构造喂了 floorEntryId)
+    return auditFromStorage(storage, sessionId);
 }
-/** The dialect-neutral kernel: both wake() twins land on core's StoredSession over a BaseSessionStorage. */
 async function auditFromStorage(storage, sessionId) {
     if (!storage)
         return undefined;
     const session = new StoredSession(storage);
     const meta = await session.getMetadata();
     const ctx = await session.buildContext();
-    // [1023]①: the typed prompt_epoch entry is NOT an LLM message, so it never appears in buildContext()'s
-    // messages — attach it as its own additive field. One kernel call covers all three dialect twins.
-    // (On the Local leg the bounded tail may pre-date the root pin; core resolves through the kept
-    // compaction's restatement — a truly pre-epoch session stays undefined → key omitted.)
     const promptEpoch = await session.getPromptEpoch();
     return {
         sessionId,
@@ -56,18 +40,6 @@ async function auditFromStorage(storage, sessionId) {
         ...(promptEpoch ? { promptEpoch } : {}),
     };
 }
-// ── web 会话区性能 PRD 的两条 additive 缝 ────────────────────────────────────────────────────
-//
-// The audit view's `messages` used to be ALL-OR-NOTHING: a 1000-entry session shipped its whole current
-// context on open (first-paint transfer + parse both scale with history). Two PURE post-processing helpers
-// give the route the additive knobs (hard requirement: parameterless requests stay byte-identical):
-//   windowMessages — tail/before+limit windowing over the messages array (offset-based; offsets are stable
-//     within one floor generation — the response's floorEntryId is the generation tag, a compaction changes
-//     it and the web refetches);
-//   truncateMessageBlobs — cap oversized string bodies (tool outputs are the whale) to a preview + a
-//     `truncated:true` marker; the web expands one message on demand via the single-message face.
-/** Window `messages` — `tail=N` (last N) or `before=<offset>&limit=N` ([max(0,before-N), before)).
- *  Returns the window + its {offset,total} so the web can page upward. */
 export function windowMessages(messages, opts) {
     const total = messages.length;
     if (opts.before !== undefined) {
@@ -80,16 +52,7 @@ export function windowMessages(messages, opts) {
     const offset = Math.max(0, total - tail);
     return { messages: messages.slice(offset), window: { offset, total } };
 }
-/** 引擎注入块的闭集标签([1075]①,web [1069] 同款拆法):user wire 消息里每轮前置的
- *  <system-reminder>/<task-notification> 原文段。裁剪时这些段**优先整段丢弃**——blobCap 预算留给
- *  用户真正说的话(clay 报障现场:注入块排在人话前把 4096 字节吃光,`[truncated …]` 后正文整段消失)。
- *  ⚠️ 开标签必须**属性容忍**([4974] 同形第三例):core ≥5.46(design/319)铸的 <system-reminder> 恒带
- *  `mark="<22位base64url>"` 属性,裸标签精确匹配对新 core 恒不命中=本剥离整条失效、[1075]① 报障病静默回归
- *  (常绿测试固件手写裸标签掩盖了它——红先格改用 core 真 mintSystemReminder 铸形)。剥离是裁剪优先级判定
- *  不是信任判定,宽容属性无伪造面(带假属性的假 reminder 被剥=同样正确的让位)。 */
 const INJECTED_BLOCK_RE = /<(system-reminder|task-notification)(?:\s[^>]*)?>[\s\S]*?<\/\1>\s*/g;
-/** blobCap 下先剥注入块再量预算:剥后若已在预算内=保住全部人话(加 `injectedDropped:true` 注记);
- *  仍超才截人话本身。剥离只在「原文本超预算」时发生——预算内的消息原样(含注入块)零变化,旧行为不动。 */
 function capWithInjectionAwareness(s, capBytes) {
     const total = Buffer.byteLength(s, "utf8");
     if (total <= capBytes)
@@ -99,14 +62,8 @@ function capWithInjectionAwareness(s, capBytes) {
     if (droppedAny && Buffer.byteLength(stripped, "utf8") <= capBytes) {
         return { text: `${stripped}…[${total - Buffer.byteLength(stripped, "utf8")} bytes of injected context omitted]`, dropped: true };
     }
-    // 剥后仍超(或无注入块):截 stripped——人话最后动,且从头保留(注入块已让位)。
     return { text: `${stripped.slice(0, capBytes)}…[truncated ${total} bytes total]`, dropped: droppedAny };
 }
-/** Cap oversized STRING bodies inside a message (top-level `content` string, or `text`/`content`
- *  string fields of content parts — the shapes core emits; anything else passes through untouched). A capped
- *  message gains `truncated: true` (message level — the web renders an expand affordance and refetches that
- *  one message at full size). Pure/copy-on-write: uncapped messages keep their original reference.
- *  [1075]①:超预算时引擎注入块(INJECTED_BLOCK_RE 闭集)优先整段让位,用户正文最后截。 */
 export function truncateMessageBlobs(messages, capBytes) {
     const capStr = (s) => capWithInjectionAwareness(s, capBytes)?.text;
     return messages.map((m) => {