@sema-agent/server 7.45.0 → 7.46.0-rc.2

package/dist/plugins/checkpoint-store-sql.js

@@ -2,7 +2,7 @@ import { createHash } from "node:crypto";
 import { APPROVAL_GATE_KINDS_SQL_IN } from "../tool-approval.js";
 import { CheckpointError, MAX_RULE_TEXT_CHARS, validatePendingSteer, appendPendingSteer, checkpointVersionOf, winnerFromOutcome, summarizeCheckpoint, MAX_SUPPORTED_CHECKPOINT_VERSION, } from "@sema-agent/core";
 import { redactDeep, redactSecrets } from "../trace/redact.js";
-import { MAX_RULE_SUGGESTIONS, RuleSuggestionRawSchema } from "../approval-card.js";
+import { MAX_RULE_OFFERS, MAX_RULE_OFFER_BATCH_MEMBERS, RuleOfferRawSchema } from "../approval-card.js";
 import { parseJsonStrict as parseJson } from "./sql-row-helpers.js";
 import { recordFailOpen } from "../observability/fail-open.js";
 import { mysqlDriver, pgDriver, dialectProtocolJsonEncoder } from "./sql-driver.js";
@@ -14,27 +14,41 @@ export const TERMINAL_GRACE_MS = 3_600_000;
 export function tokenFingerprint(token) {
     return "sha256:" + createHash("sha256").update(token).digest("hex").slice(0, 12);
 }
-const MAX_RULE_SUGGESTION_SCAN = 32;
-export function boundedRuleSuggestions(raw, opts = {}) {
+const MAX_RULE_OFFER_SCAN = 32;
+function preboundBatchMembers(item) {
+    if (typeof item !== "object" || item === null)
+        return item;
+    const candidate = item;
+    if (candidate.kind !== "batch" || !Array.isArray(candidate.rules) || candidate.rules.length <= MAX_RULE_OFFER_BATCH_MEMBERS)
+        return item;
+    return { ...candidate, rules: candidate.rules.slice(0, MAX_RULE_OFFER_BATCH_MEMBERS) };
+}
+export function boundedRuleOffers(raw, opts = {}) {
     if (!Array.isArray(raw))
         return undefined;
     const observe = opts.countRedactions ?? true;
+    const scrub = (text) => redactSecrets(text, { observe }).slice(0, MAX_RULE_TEXT_CHARS);
     const out = [];
-    for (const item of raw.slice(0, MAX_RULE_SUGGESTION_SCAN)) {
-        if (out.length >= MAX_RULE_SUGGESTIONS)
+    for (const item of raw.slice(0, MAX_RULE_OFFER_SCAN)) {
+        if (out.length >= MAX_RULE_OFFERS)
             break;
-        const parsed = RuleSuggestionRawSchema.safeParse(item);
+        const parsed = RuleOfferRawSchema.safeParse(preboundBatchMembers(item));
         if (!parsed.success)
             continue;
-        out.push({
-            rule: redactSecrets(parsed.data.rule, { observe }).slice(0, MAX_RULE_TEXT_CHARS),
-            match: parsed.data.match,
-            command: redactSecrets(parsed.data.command, { observe }).slice(0, MAX_RULE_TEXT_CHARS),
-        });
+        if (parsed.data.kind === "single") {
+            out.push({ kind: "single", rule: scrub(parsed.data.rule), match: parsed.data.match, command: scrub(parsed.data.command) });
+        }
+        else {
+            out.push({
+                kind: "batch",
+                rules: parsed.data.rules.slice(0, MAX_RULE_OFFER_BATCH_MEMBERS).map((r) => ({ rule: scrub(r.rule), match: r.match, command: scrub(r.command), segment: scrub(r.segment) })),
+                uncoveredSegments: parsed.data.uncoveredSegments,
+            });
+        }
     }
     return out.length > 0 ? out : undefined;
 }
-function readRuleSuggestionsCell(cell) {
+function readRuleOffersCell(cell) {
     let parsed;
     try {
         parsed = parseJson(cell);
@@ -43,7 +57,7 @@ function readRuleSuggestionsCell(cell) {
         recordFailOpen("server.approvals.rule-suggestions-cell-unreadable");
         return undefined;
     }
-    return boundedRuleSuggestions(parsed, { countRedactions: false });
+    return boundedRuleOffers(parsed, { countRedactions: false });
 }
 function readRiskDescriptorCell(cell) {
     try {
@@ -207,7 +221,7 @@ export class SqlCheckpointStore {
         const pa = cp.pendingAction;
         const version = checkpointVersionOf(cp);
         const toolInput = boundedToolInput(pa?.args);
-        const ruleSuggestions = boundedRuleSuggestions(pa?.ruleSuggestions);
+        const ruleOffers = boundedRuleOffers(pa?.ruleOffers);
         try {
             await this.db.query(this.q("INSERT INTO checkpoint (token, scope, session_id, version, status, tool_name, tool_call_id, tool_input, checkpoint, deadline, created_at_ms, terminal_at_ms, gate_kind, bound_input_hash, risk_descriptor, rule_suggestions) " +
                 "VALUES (?,?,?,?,'pending',?,?,?,?,?,?,?,?,?,?,?)", "INSERT INTO checkpoint (token, scope, session_id, version, status, tool_name, tool_call_id, tool_input, checkpoint, deadline, created_at_ms, terminal_at_ms, gate_kind, bound_input_hash, risk_descriptor, rule_suggestions) " +
@@ -226,7 +240,7 @@ export class SqlCheckpointStore {
                 cp.gate?.kind ?? null,
                 pa?.boundInputHash ?? null,
                 ((g) => (g?.riskDescriptor ? this.json(g.riskDescriptor, "risk descriptor") : null))(cp.gate),
-                ruleSuggestions === undefined ? null : this.json(ruleSuggestions, "rule suggestions"),
+                ruleOffers === undefined ? null : this.json(ruleOffers, "rule offers"),
             ]);
         }
         catch (e) {
@@ -340,7 +354,7 @@ export class SqlCheckpointStore {
             const toolCallId = r.tool_call_id ?? null;
             const boundInputHash = r.bound_input_hash ?? null;
             const gateKind = r.gate_kind ?? null;
-            const ruleSuggestions = readRuleSuggestionsCell(r.rule_suggestions);
+            const ruleOffers = readRuleOffersCell(r.rule_suggestions);
             return {
                 sessionId: String(r.session_id),
                 scope: String(r.scope),
@@ -354,7 +368,7 @@ export class SqlCheckpointStore {
                 createdAt: Number(r.created_at_ms),
                 deadline: r.deadline == null ? null : Number(r.deadline),
                 riskDescriptor: readRiskDescriptorCell(r.risk_descriptor),
-                ...(ruleSuggestions !== undefined ? { ruleSuggestions } : {}),
+                ...(ruleOffers !== undefined ? { ruleOffers } : {}),
             };
         });
         return out.sort((a, b) => (b.riskDescriptor?.severity ?? 0) - (a.riskDescriptor?.severity ?? 0) || a.createdAt - b.createdAt);

package/dist/plugins/local-checkpoint-store.js

@@ -3,7 +3,7 @@ import { existsSync, readFileSync, readdirSync, renameSync, unlinkSync, mkdirSyn
 import { join } from "node:path";
 import { isApprovalGateKind } from "../tool-approval.js";
 import { FileCheckpointStore, atomicWriteFile, sanitizePathComponent, } from "@sema-agent/core";
-import { boundedRuleSuggestions, boundedToolInput, TERMINAL_BACKSTOP_MS, TERMINAL_GRACE_MS } from "./checkpoint-store-sql.js";
+import { boundedRuleOffers, boundedToolInput, TERMINAL_BACKSTOP_MS, TERMINAL_GRACE_MS } from "./checkpoint-store-sql.js";
 import { UNMANAGED_RETENTION } from "./retention-store-sql.js";
 function terminalAtOf(cp) {
     return Math.max(cp.createdAt + TERMINAL_BACKSTOP_MS, (cp.deadline ?? 0) + TERMINAL_GRACE_MS);
@@ -156,8 +156,8 @@ export class LocalCheckpointStore {
                 deadline: cp.deadline ?? null,
                 riskDescriptor: gate?.riskDescriptor ?? null,
                 ...(() => {
-                    const rs = boundedRuleSuggestions(pa?.ruleSuggestions);
-                    return rs !== undefined ? { ruleSuggestions: rs } : {};
+                    const rs = boundedRuleOffers(pa?.ruleOffers);
+                    return rs !== undefined ? { ruleOffers: rs } : {};
                 })(),
             });
         }

package/dist/plugins/permission-rule-store-file.d.ts

@@ -1,4 +1,4 @@
-import { FilePermissionRuleStoreProvider, type RuleApprovalRecord, type RuleApprovalRecordStore, type RuleScope } from "@sema-agent/core";
+import { FilePermissionRuleStoreProvider, type RuleApprovalRecord, type RuleApprovalRecordStore, type RuleScope, type StaleRuleApprovalRecord } from "@sema-agent/core";
 import { type RuleImportTicket, type RuleTicketDecisionClock, type RuleTicketRedeemResult } from "./permission-rule-store-sql.js";
 import type { PermissionRuleStoreBundle } from "../rules-consent.js";
 /**
@@ -19,7 +19,7 @@ export declare class FileRuleApprovalRecordStore implements RuleApprovalRecordSt
      *  关后写面抛 `log_closed`(core 语义):**不重开**,因为「这只店已经交还」与「这条命还能写」
      *  不能两立,静默重开会让一次 dispose 之后的写落进一份没人再读的日志。 */
     close(): void;
-    get(id: string): Promise<RuleApprovalRecord | undefined>;
+    get(id: string): Promise<RuleApprovalRecord | StaleRuleApprovalRecord | undefined>;
     create(record: RuleApprovalRecord): Promise<void>;
     cas(id: string, expectRev: number, next: RuleApprovalRecord): Promise<boolean>;
     /** 与 SQL 侧同名方法同义(超帽拒绝时收掉 `prepareCcImport` 已落盘的那条 pending 记录)。

package/dist/plugins/permission-rule-store-file.js

@@ -9,21 +9,34 @@ const RuleScopeSchema = z.union([
 ]);
 const RuleDotSchema = z.object({ actor: z.string().min(1), counter: z.number().int().nonnegative().safe() }).strict();
 const RuleCandidateSchema = z.object({ rule: z.string(), scope: RuleScopeSchema }).strict();
+const RuleOffer2Schema = z.union([
+    z.object({ kind: z.literal("single"), candidate: z.number().int().nonnegative().safe() }).strict(),
+    z
+        .object({
+        kind: z.literal("batch"),
+        candidates: z.array(z.number().int().nonnegative().safe()),
+        segments: z.array(z.string()).optional(),
+        uncoveredSegments: z.number().int().nonnegative().safe().optional(),
+    })
+        .strict(),
+]);
 const ApprovalRecordSchema = z
     .object({
     id: z.string().min(1),
     principal: z.string().optional(),
     owner: z.union([z.object({ kind: z.literal("principal"), principal: z.string() }).strict(), z.object({ kind: z.literal("local-owner") }).strict()]).optional(),
+    schema: z.literal(2),
     kind: z.enum(["card", "import", "starter"]),
     state: z.enum(["pending", "approved", "redeemed"]),
     candidates: z.array(RuleCandidateSchema),
+    offers: z.array(RuleOffer2Schema),
     createdAt: z.string(),
     toolCallId: z.string().optional(),
     boundInputHash: z.string().optional(),
     command: z.string().optional(),
     edited: z.object({ index: z.number().int().nonnegative().safe(), text: z.string(), at: z.string() }).strict().optional(),
     rev: z.number().int().nonnegative().safe(),
-    selectedCandidate: z.number().int().nonnegative().safe().optional(),
+    selectedOffer: z.number().int().nonnegative().safe().optional(),
     redeemedDots: z.record(z.string(), RuleDotSchema).optional(),
 })
     .strict();
@@ -32,21 +45,40 @@ function toApprovalRecord(row) {
         id: row.id,
         ...(row.principal !== undefined ? { principal: row.principal } : {}),
         ...(row.owner !== undefined ? { owner: row.owner } : {}),
+        schema: row.schema,
         kind: row.kind,
         state: row.state,
         candidates: row.candidates,
+        offers: row.offers,
         createdAt: row.createdAt,
         ...(row.toolCallId !== undefined ? { toolCallId: row.toolCallId } : {}),
         ...(row.boundInputHash !== undefined ? { boundInputHash: row.boundInputHash } : {}),
         ...(row.command !== undefined ? { command: row.command } : {}),
         ...(row.edited !== undefined ? { edited: row.edited } : {}),
         rev: row.rev,
-        ...(row.selectedCandidate !== undefined ? { selectedCandidate: row.selectedCandidate } : {}),
+        ...(row.selectedOffer !== undefined ? { selectedOffer: row.selectedOffer } : {}),
         ...(row.redeemedDots !== undefined
             ? { redeemedDots: Object.fromEntries(Object.entries(row.redeemedDots).map(([k, v]) => [Number(k), v])) }
             : {}),
     };
 }
+const StaleApprovalRowSchema = z
+    .object({
+    id: z.string().min(1),
+    schema: z.unknown().optional(),
+    principal: z.string().optional(),
+    owner: z.union([z.object({ kind: z.literal("principal"), principal: z.string() }).strict(), z.object({ kind: z.literal("local-owner") }).strict()]).optional(),
+})
+    .loose();
+const StaleApprovalLineSchema = z.object({ op: z.literal("put"), record: StaleApprovalRowSchema }).loose();
+function toStaleEnvelope(row) {
+    return {
+        staleSchema: true,
+        id: row.id,
+        ...(row.principal !== undefined ? { principal: row.principal } : {}),
+        ...(row.owner !== undefined ? { owner: row.owner } : {}),
+    };
+}
 const ApprovalLineSchema = z.union([
     z.object({ op: z.literal("put"), record: ApprovalRecordSchema }).strict(),
     z.object({ op: z.literal("discard"), id: z.string().min(1) }).strict(),
@@ -100,6 +132,11 @@ export class FileRuleApprovalRecordStore {
         for (const raw of readJsonlRecords(path, (info) => this.gate.trip(info.reason))) {
             const parsed = ApprovalLineSchema.safeParse(raw);
             if (!parsed.success) {
+                const stale = StaleApprovalLineSchema.safeParse(raw);
+                if (stale.success && stale.data.record.schema !== 2) {
+                    this.rows.set(stale.data.record.id, toStaleEnvelope(stale.data.record));
+                    continue;
+                }
                 this.gate.trip(`a replayed record does not carry a readable shape: ${parsed.error.message}`);
                 continue;
             }
@@ -134,7 +171,7 @@ export class FileRuleApprovalRecordStore {
             throw new Error(`rule-approval CAS must advance rev by exactly one (expectRev=${expectRev}, next.rev=${next.rev})`);
         }
         const cur = this.rows.get(id);
-        if (cur === undefined || cur.rev !== expectRev)
+        if (cur === undefined || "staleSchema" in cur || cur.rev !== expectRev)
             return false;
         this.log.append({ op: "put", record: next }, true);
         this.rows.set(id, structuredClone(next));
@@ -143,7 +180,7 @@ export class FileRuleApprovalRecordStore {
     async discardPendingRecord(recordId) {
         this.gate.assertUsable();
         const cur = this.rows.get(recordId);
-        if (cur === undefined || cur.state !== "pending")
+        if (cur === undefined || "staleSchema" in cur || cur.state !== "pending")
             return false;
         this.log.append({ op: "discard", id: recordId }, true);
         this.rows.delete(recordId);

package/dist/plugins/permission-rule-store-sql.d.ts

@@ -1,4 +1,4 @@
-import { type PermissionRuleWriter, type PermissionRuleStore, type PermissionRuleStoreProvider, type RuleScope, type RuleSyncFrontier, type RuleApprovalRecord, type RuleApprovalRecordStore, type RuleOwner } from "@sema-agent/core";
+import { type PermissionRuleWriter, type PermissionRuleStore, type PermissionRuleStoreProvider, type RuleScope, type RuleSyncFrontier, type RuleApprovalRecord, type StaleRuleApprovalRecord, type RuleApprovalRecordStore, type RuleOwner } from "@sema-agent/core";
 import type { Pool as MySqlPool } from "mysql2/promise";
 import type { PgQueryFn } from "./pg-query.js";
 import { type SqlDriver } from "./sql-driver.js";
@@ -82,7 +82,7 @@ export declare class SqlRuleApprovalRecordStore implements RuleApprovalRecordSto
     constructor(db: SqlDriver, now?: () => number);
     private q;
     private enc;
-    get(id: string): Promise<RuleApprovalRecord | undefined>;
+    get(id: string): Promise<RuleApprovalRecord | StaleRuleApprovalRecord | undefined>;
     create(record: RuleApprovalRecord): Promise<void>;
     /**
      * 丢弃一条**从未被确认**的记录(codex 交叉复审 round8 [medium],可控半场)。

package/dist/plugins/permission-rule-store-sql.js

@@ -51,6 +51,17 @@ const FrontierSchema = z.record(z.string(), z.number().int().nonnegative().safe(
 const RuleCandidateSchema = z.object({ rule: z.string(), scope: RuleScopeSchema }).strict();
 const RedeemedDotsSchema = z.record(z.string(), RuleDotSchema);
 const RuleEditedSchema = z.object({ index: z.number().int().nonnegative().safe(), text: z.string(), at: z.string() }).strict();
+const RuleOffer2Schema = z.union([
+    z.object({ kind: z.literal("single"), candidate: z.number().int().nonnegative().safe() }).strict(),
+    z
+        .object({
+        kind: z.literal("batch"),
+        candidates: z.array(z.number().int().nonnegative().safe()),
+        segments: z.array(z.string()).optional(),
+        uncoveredSegments: z.number().int().nonnegative().safe().optional(),
+    })
+        .strict(),
+]);
 export const PERMISSION_RULE_TABLE = "permission_rule";
 export const PERMISSION_RULE_APPROVAL_TABLE = "permission_rule_approval";
 export const PERMISSION_RULE_TICKET_TABLE = "permission_rule_ticket";
@@ -87,7 +98,19 @@ export const TIDB_PERMISSION_RULE_STATEMENTS = [
     state VARCHAR(32) NOT NULL,
     rev BIGINT NOT NULL DEFAULT 0,
     candidates_json LONGTEXT NOT NULL,
-    selected_candidate INT NULL,
+    -- version:**数据格式版本**(= core \`RuleApprovalRecord.schema\`,本形恒 2;OCC 守卫另在 rev,
+    -- 两轴禁混,schema-naming 门③ 白名单登记)。读侧对非 2 的行交还 design/375 §4.5 的
+    -- StaleRuleApprovalRecord 信封(identity 键 only)—— 本仓 SCHEMA POLICY 是删表重建,重建后的表
+    -- 不该有这种行,这一臂是「未来再换形」的防御位,绝不静默 widen 成一条本形担保不了的记录。
+    version INT NOT NULL,
+    -- offers_json:core \`RuleOffer2[]\`(design/375 §4.1)—— 按 index 引用 candidates 的 OPTION 结构,
+    -- **绝不存规则文本副本**(显示三元组由 core \`ruleOffersOfRecord\` 从候选文本投影;存副本=造一个
+    -- 与真会落地的规则漂移的面)。batch 臂上 segments/uncoveredSegments 是 CARD 记录的铸造时事实。
+    offers_json LONGTEXT NOT NULL,
+    -- selected_offer:确认转移记下的 **OFFER index**(design/375 §4.3,接替 selected_candidate 的席位)。
+    -- ⚠️ 两个 index 空间刻意分离:确认键 OFFER index(本列),而 ticket / redeemed_dots_json 仍键
+    -- CANDIDATE index —— 兑付/重放锚不随卡面 OPTION 结构漂。
+    selected_offer INT NULL,
     redeemed_dots_json LONGTEXT NULL,
     tool_call_id VARCHAR(255) NULL,
     bound_input_hash VARCHAR(255) NULL,
@@ -147,14 +170,16 @@ function isMissingColumnError(err, dialect) {
 }
 export async function assertPermissionRuleApprovalSchema(query, dialect) {
     try {
-        await query(`SELECT command, edited_json FROM ${PERMISSION_RULE_APPROVAL_TABLE} WHERE 1=0`);
+        await query(`SELECT command, edited_json, version, offers_json, selected_offer FROM ${PERMISSION_RULE_APPROVAL_TABLE} WHERE 1=0`);
     }
     catch (err) {
         if (!isMissingColumnError(err, dialect))
             throw err;
-        throw new Error(`${PERMISSION_RULE_APPROVAL_TABLE} is missing the #340 card-edit columns (command / edited_json) — refusing to start. ` +
-            `The approval card now accepts a person-EDITED rule text, and the engine's coverage gate reads the adjudicated ` +
-            `command back off this record; the record also carries which candidate was edited. This repository ships no ` +
+        throw new Error(`${PERMISSION_RULE_APPROVAL_TABLE} is missing required columns — refusing to start. This build needs the ` +
+            `#340 card-edit columns (command / edited_json) and the design/375 record-form columns ` +
+            `(version / offers_json / selected_offer): the approval record now stores its OPTION structure and the ` +
+            `chosen offer, and the store refuses to read rows whose record-form version it cannot vouch for. ` +
+            `This repository ships no ` +
             `ALTER TABLE migrations, so the table must be recreated: run \`DROP TABLE ${PERMISSION_RULE_APPROVAL_TABLE};\` on the ` +
             `${dialect === "pg" ? "PostgreSQL" : "MySQL-protocol"} backend and restart — the schema is recreated at boot. ` +
             `The cost is bounded: this table holds pending/settled approval RECORDS (the audit trail of who said yes to which ` +
@@ -190,7 +215,13 @@ export async function ensurePgPermissionRuleSchema(q) {
     state VARCHAR(32) COLLATE "C" NOT NULL,
     rev BIGINT NOT NULL DEFAULT 0,
     candidates_json TEXT COLLATE "C" NOT NULL,
-    selected_candidate INT,
+    -- version / offers_json / selected_offer:design/375 换形三列(MySQL 孪生的行内注写了理由:
+    -- version=数据格式版本恒 2,非 2 的行读成 Stale 信封;offers_json=按 index 引用的 OPTION 结构,
+    -- 禁存文本副本;selected_offer=确认的 OFFER index,与 ticket/redeemed_dots 的 CANDIDATE index
+    -- 两空间分离)。
+    version INT NOT NULL,
+    offers_json TEXT COLLATE "C" NOT NULL,
+    selected_offer INT,
     redeemed_dots_json TEXT COLLATE "C",
     tool_call_id VARCHAR(255) COLLATE "C",
     bound_input_hash VARCHAR(255) COLLATE "C",
@@ -445,11 +476,18 @@ export class SqlRuleApprovalRecordStore {
         return dialectProtocolJsonEncoder(this.db.dialect)(v, label);
     }
     async get(id) {
-        const { rows } = await this.db.query(this.q(`SELECT record_id, owner_kind, principal, kind, state, rev, candidates_json, selected_candidate, redeemed_dots_json, tool_call_id, bound_input_hash, command, edited_json, created_at_iso FROM ${PERMISSION_RULE_APPROVAL_TABLE} WHERE record_id = ?`, `SELECT record_id, owner_kind, principal, kind, state, rev, candidates_json, selected_candidate, redeemed_dots_json, tool_call_id, bound_input_hash, command, edited_json, created_at_iso FROM ${PERMISSION_RULE_APPROVAL_TABLE} WHERE record_id = $1`), [id]);
+        const { rows } = await this.db.query(this.q(`SELECT record_id, owner_kind, principal, kind, state, version, rev, candidates_json, offers_json, selected_offer, redeemed_dots_json, tool_call_id, bound_input_hash, command, edited_json, created_at_iso FROM ${PERMISSION_RULE_APPROVAL_TABLE} WHERE record_id = ?`, `SELECT record_id, owner_kind, principal, kind, state, version, rev, candidates_json, offers_json, selected_offer, redeemed_dots_json, tool_call_id, bound_input_hash, command, edited_json, created_at_iso FROM ${PERMISSION_RULE_APPROVAL_TABLE} WHERE record_id = $1`), [id]);
         const row = rows[0];
         if (row === undefined)
             return undefined;
+        const ownerKind = String(row.owner_kind);
+        const principal = row.principal === null || row.principal === undefined ? undefined : String(row.principal);
+        const identity = ownerKind === "principal" ? { principal: principal ?? "" } : { owner: { kind: "local-owner" } };
+        if (Number(row.version) !== 2) {
+            return { staleSchema: true, id: String(row.record_id), ...identity };
+        }
         const candidates = parseColumn(z.array(RuleCandidateSchema), row.candidates_json, "candidates_json", id);
+        const offers = parseColumn(z.array(RuleOffer2Schema), row.offers_json, "offers_json", id);
         const dotsRaw = row.redeemed_dots_json === null || row.redeemed_dots_json === undefined ? undefined : parseColumn(RedeemedDotsSchema, row.redeemed_dots_json, "redeemed_dots_json", id);
         const edited = row.edited_json === null || row.edited_json === undefined ? undefined : parseColumn(RuleEditedSchema, row.edited_json, "edited_json", id);
         const kind = z.enum(["card", "import", "starter"]).safeParse(row.kind);
@@ -457,40 +495,42 @@ export class SqlRuleApprovalRecordStore {
         if (!kind.success || !state.success) {
             throw new Error(`${PERMISSION_RULE_APPROVAL_TABLE} row ${id} carries an unreadable kind/state (${String(row.kind)}/${String(row.state)})`);
         }
-        const ownerKind = String(row.owner_kind);
-        const principal = row.principal === null || row.principal === undefined ? undefined : String(row.principal);
         const redeemedDots = dotsRaw === undefined ? undefined : Object.fromEntries(Object.entries(dotsRaw).map(([k, v]) => [Number(k), v]));
         return {
             id: String(row.record_id),
-            ...(ownerKind === "principal" ? { principal: principal ?? "" } : { owner: { kind: "local-owner" } }),
+            ...identity,
+            schema: 2,
             kind: kind.data,
             state: state.data,
             candidates,
+            offers,
             createdAt: String(row.created_at_iso),
             rev: Number(row.rev ?? 0),
             ...(row.tool_call_id !== null && row.tool_call_id !== undefined ? { toolCallId: String(row.tool_call_id) } : {}),
             ...(row.bound_input_hash !== null && row.bound_input_hash !== undefined ? { boundInputHash: String(row.bound_input_hash) } : {}),
             ...(row.command !== null && row.command !== undefined ? { command: String(row.command) } : {}),
             ...(edited !== undefined ? { edited } : {}),
-            ...(row.selected_candidate !== null && row.selected_candidate !== undefined ? { selectedCandidate: Number(row.selected_candidate) } : {}),
+            ...(row.selected_offer !== null && row.selected_offer !== undefined ? { selectedOffer: Number(row.selected_offer) } : {}),
             ...(redeemedDots !== undefined ? { redeemedDots } : {}),
         };
     }
     async create(record) {
         const nowMs = this.now();
         const owner = record.owner ?? { kind: "principal", principal: record.principal ?? "" };
-        await this.db.query(this.q(`INSERT INTO ${PERMISSION_RULE_APPROVAL_TABLE} (record_id, owner_key, owner_kind, principal, kind, state, rev, candidates_json, selected_candidate, redeemed_dots_json, tool_call_id, bound_input_hash, command, edited_json, created_at_iso, created_at_ms, updated_at_ms)
-         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`, `INSERT INTO ${PERMISSION_RULE_APPROVAL_TABLE} (record_id, owner_key, owner_kind, principal, kind, state, rev, candidates_json, selected_candidate, redeemed_dots_json, tool_call_id, bound_input_hash, command, edited_json, created_at_iso, created_at_ms, updated_at_ms)
-         VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14, $15, $16, $17)`), [
+        await this.db.query(this.q(`INSERT INTO ${PERMISSION_RULE_APPROVAL_TABLE} (record_id, owner_key, owner_kind, principal, kind, state, version, rev, candidates_json, offers_json, selected_offer, redeemed_dots_json, tool_call_id, bound_input_hash, command, edited_json, created_at_iso, created_at_ms, updated_at_ms)
+         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`, `INSERT INTO ${PERMISSION_RULE_APPROVAL_TABLE} (record_id, owner_key, owner_kind, principal, kind, state, version, rev, candidates_json, offers_json, selected_offer, redeemed_dots_json, tool_call_id, bound_input_hash, command, edited_json, created_at_iso, created_at_ms, updated_at_ms)
+         VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14, $15, $16, $17, $18, $19)`), [
             record.id,
             buildRuleOwnerKey(owner),
             owner.kind,
             owner.kind === "principal" ? owner.principal : null,
             record.kind,
             record.state,
+            record.schema,
             record.rev,
             this.enc(record.candidates, "permission_rule_approval.candidates_json"),
-            record.selectedCandidate ?? null,
+            this.enc(record.offers, "permission_rule_approval.offers_json"),
+            record.selectedOffer ?? null,
             record.redeemedDots === undefined ? null : this.enc(record.redeemedDots, "permission_rule_approval.redeemed_dots_json"),
             record.toolCallId ?? null,
             record.boundInputHash ?? null,
@@ -502,18 +542,19 @@ export class SqlRuleApprovalRecordStore {
         ]);
     }
     async discardPendingRecord(recordId) {
-        const { affected } = await this.db.query(this.q(`DELETE FROM ${PERMISSION_RULE_APPROVAL_TABLE} WHERE record_id = ? AND state = 'pending'`, `DELETE FROM ${PERMISSION_RULE_APPROVAL_TABLE} WHERE record_id = $1 AND state = 'pending'`), [recordId]);
+        const { affected } = await this.db.query(this.q(`DELETE FROM ${PERMISSION_RULE_APPROVAL_TABLE} WHERE record_id = ? AND state = 'pending' AND version = 2`, `DELETE FROM ${PERMISSION_RULE_APPROVAL_TABLE} WHERE record_id = $1 AND state = 'pending' AND version = 2`), [recordId]);
         return affected === 1;
     }
     async cas(id, expectRev, next) {
         if (next.rev !== expectRev + 1) {
             throw new Error(`rule-approval CAS must advance rev by exactly one (expectRev=${expectRev}, next.rev=${next.rev})`);
         }
-        const { affected } = await this.db.query(this.q(`UPDATE ${PERMISSION_RULE_APPROVAL_TABLE} SET state = ?, rev = ?, candidates_json = ?, selected_candidate = ?, redeemed_dots_json = ?, edited_json = ?, updated_at_ms = ? WHERE record_id = ? AND rev = ?`, `UPDATE ${PERMISSION_RULE_APPROVAL_TABLE} SET state = $1, rev = $2, candidates_json = $3, selected_candidate = $4, redeemed_dots_json = $5, edited_json = $6, updated_at_ms = $7 WHERE record_id = $8 AND rev = $9`), [
+        const { affected } = await this.db.query(this.q(`UPDATE ${PERMISSION_RULE_APPROVAL_TABLE} SET state = ?, rev = ?, candidates_json = ?, offers_json = ?, selected_offer = ?, redeemed_dots_json = ?, edited_json = ?, updated_at_ms = ? WHERE record_id = ? AND rev = ? AND version = 2`, `UPDATE ${PERMISSION_RULE_APPROVAL_TABLE} SET state = $1, rev = $2, candidates_json = $3, offers_json = $4, selected_offer = $5, redeemed_dots_json = $6, edited_json = $7, updated_at_ms = $8 WHERE record_id = $9 AND rev = $10 AND version = 2`), [
             next.state,
             next.rev,
             this.enc(next.candidates, "permission_rule_approval.candidates_json"),
-            next.selectedCandidate ?? null,
+            this.enc(next.offers, "permission_rule_approval.offers_json"),
+            next.selectedOffer ?? null,
             next.redeemedDots === undefined ? null : this.enc(next.redeemedDots, "permission_rule_approval.redeemed_dots_json"),
             next.edited === undefined ? null : this.enc(next.edited, "permission_rule_approval.edited_json"),
             this.now(),

package/dist/plugins/store-backend.d.ts

@@ -142,7 +142,7 @@ export interface StoreBackend {
      * 三面 —— 规则桶 provider / durable 审批记录 / server 自铸的 CC 导入票。
      *
      * 🔴 **可选**(与上面那些 REQUIRED 家族不同),缺席是一个真答案:core 的 `RunnerDeps.permissionRuleStore`
-     * 本身就是 optional,缺席 ⇒ 引擎的 `permissionRules.storeWired` 如实报 `false`,ask 帧不投 `ruleSuggestions`
+     * 本身就是 optional,缺席 ⇒ 引擎的 `permissionRules.storeWired` 如实报 `false`,ask 帧不投 `ruleOffers`
      * (发一格按下去无处可兑的「不再询问」= wire 谎言,比缺席更坏)。
      *
      * `local` 车道**刻意不给 in-memory twin**:一条规则是「人授权过的持久事实」,进程内 Map 形会在重启时

package/dist/plugins/tidb-pool.js

@@ -250,10 +250,10 @@ export const SCHEMA_STATEMENTS = [
      -- triage-sort the supervisor inbox by severity DESC — WITHOUT parsing the checkpoint blob per row.
      -- NULL on gates with no descriptor.
      risk_descriptor TEXT        NULL,
-     -- rule_suggestions ([3683]-2/[3684]② mint 面归因):core 挂在 pendingAction.ruleSuggestions 上的规则
-     -- 候选(design/179 §4;与同步腿 AskRequest.ruleSuggestions 同一条契约),在 put() 落列 —— 于是
+     -- rule_suggestions ([3683]-2/[3684]② mint 面归因):core 挂在 pendingAction.ruleOffers 上的规则
+     -- 候选(design/179 §4;与同步腿 AskRequest.ruleOffers 同一条契约;design/375 换形后载荷=判别联合,列名保留),在 put() 落列 —— 于是
      -- listPending 不必为一格展示材料去拖整只 checkpoint blob(那是整份 suspend 快照)。落列前过
-     -- boundedRuleSuggestions:窄读(坏条丢弃)+ redactSecrets(候选文本由命令原文铸出,而运维队列跨租户
+     -- boundedRuleOffers:窄读(坏条丢弃)+ redactSecrets(候选文本由命令原文铸出,而运维队列跨租户
      -- 可见)+ 基数截断。NULL = 无供给(规则车道没武装 / 命令说不出规则 / 这只 ask 规则清不掉),读口
      -- 据此省键而不是铸空数组。
      rule_suggestions TEXT       NULL,

package/dist/rules-consent.d.ts

@@ -1,4 +1,4 @@
-import { type RuleOwner, type ImportPreview, type ImportResult, type ImportedSettingsLayer, type PersistedAllowRule, type RemoveResult, type EditedRuleTextPrecheck, type RuleScope } from "@sema-agent/core";
+import { type RuleOwner, type ImportPreview, type RedeemedBatchMember, type ImportedSettingsLayer, type PersistedAllowRule, type RemoveResult, type EditedRuleTextPrecheck, type RuleScope, type RuleOffer } from "@sema-agent/core";
 import type { PermissionRuleStoreProvider, RuleApprovalRecordStore } from "@sema-agent/core";
 import { type RuleImportTicket, type RuleTicketDecisionClock, type RuleTicketRedeemResult } from "./plugins/permission-rule-store-sql.js";
 /**
@@ -80,12 +80,19 @@ export declare const RULE_IMPORT_RETRY_AFTER_SEC = 2;
  * 「几百次 SQL」而不是「几万次」。
  */
 export declare const MAX_IMPORT_CANDIDATES = 200;
-/** 一次导入 prepare 的产物(HTTP 200 体的素材),或**超帽**的拒绝(见 {@link MAX_IMPORT_CANDIDATES})。 */
+/** 一次导入 prepare 的产物(HTTP 200 体的素材),或**超帽**的拒绝(见 {@link MAX_IMPORT_CANDIDATES})。
+ *  5.58(design/375):零 importable 候选 ⇒ core **不铸** `approvalId`(「absence says so」)⇒ 无票可铸,
+ *  第三臂把 preview(全 skipped 的理由就在里面)原样交给人看——不是错误,是「没有什么可确认」。 */
 export type RuleImportPrepared = {
     ok: true;
     preview: ImportPreview;
     ticket: string;
     expiresAtMs: number;
+} | {
+    ok: true;
+    preview: ImportPreview;
+    ticket?: undefined;
+    expiresAtMs?: undefined;
 } | {
     ok: false;
     reason: "too-many-candidates";
@@ -95,7 +102,10 @@ export type RuleImportPrepared = {
  *  只为服务端日志/诊断。 */
 export type RuleImportRedeemed = {
     ok: true;
-    result: ImportResult;
+    result: {
+        members: readonly RedeemedBatchMember[];
+        rev: number;
+    };
 }
 /** `retryable` = 这次失败**没有裁定任何事**(store 抛错 / CAS 冲突),认领已放回,属主原样重试即可。
  *  它与裁定性拒绝(载荷被篡改、记录不存在)分家是承重的:把两者塌成一格,一次数据库抖动就会被
@@ -118,14 +128,31 @@ export type CardRuleRedemption =
  | {
     kind: "edited";
     text: string;
+}
+/** design/377:人勾了**合取批**——传的是**行素材上人看到的那只 batch 整只**(不是裸 index),
+ *  等式两侧(看到的 / 重铸可兑的)在本车道一个函数里对齐(防漂等式,见 batch 分支行注)。 */
+ | {
+    kind: "batch";
+    offer: Extract<RuleOffer, {
+        kind: "batch";
+    }>;
 };
 /** 卡道兑付的结果。`canonical` = **真正落盘**的那条规则文本(编辑臂上它可能与人敲的原字节不同 ——
  *  core 会把 `Bash(adb *)` 规范成 `Bash(adb:*)`;界面要回显的是这一份,不是输入框里的那一份)。 */
 export type CardRulePersisted = {
     ok: true;
+    kind: "single";
     rule: string;
     rev: number;
     alreadyRedeemed: boolean;
+}
+/** design/377 批臂:全体成员落地(persisted/deduped 都计——等价规则已在店=同意已生效)。
+ *  `rules` = 规范文本,**展示序**(= batch offer 的成员序,壳逐条回显)。 */
+ | {
+    ok: true;
+    kind: "batch";
+    rules: readonly string[];
+    rev: number;
 } | {
     ok: false;
     reason: "no-candidates" | "unknown-candidate" | "confirm-refused" | "redeem-refused"