@sema-agent/server 7.50.0 → 7.52.0

package/dist/http/server.js

@@ -10,7 +10,7 @@ import { verifyDirectDoorProof } from "../principal-jwt.js";
 import {} from "../memory-sync.js";
 import { MAX_SETTINGS_OUTPUT_STYLE_CHARS, MAX_SETTINGS_PERMISSION_RULES, MAX_SETTINGS_ENV_VARS, MAX_SETTINGS_ENV_KEY_CHARS, MAX_SETTINGS_ENV_VALUE_CHARS } from "../task-settings.js";
 import { parseHooksConfig } from "../hooks/hook-runner.js";
-import { normalizeApproachNotice, validateTaskAgents } from "../spec-fields.js";
+import { normalizeApproachNotice, unknownTaskAgentModelRef, validateTaskAgents } from "../spec-fields.js";
 import { isValidCwd, MAX_ADDITIONAL_DIRS } from "../task-cwd.js";
 import { runInBackground, evictIfConflict, stripCheckpointToken, parkToolCallId, TurnAnchorCapture, HEARTBEAT_MS, markChildrenStoppedByUserOnAbort } from "../runs.js";
 import { readTurnActivityMs, recordTurnActivity } from "../turn-activity.js";
@@ -43,6 +43,7 @@ import { handleAdoption } from "./routes/adoption.js";
 import { handleRetention } from "./routes/retention-ops.js";
 import { handleAdminDrain } from "./routes/admin-drain.js";
 import { handleAdminConfigRefresh } from "./routes/admin-config-refresh.js";
+import { handleMemoryOptOut } from "./routes/admin-memory-optout.js";
 import { handleMemoryPolicy } from "./routes/memory-policy.js";
 import { handleMemoryBundle } from "./routes/memory-bundle.js";
 import { handleMemoryCompliance } from "./routes/memory-compliance.js";
@@ -63,6 +64,7 @@ import { handleNotifyWake, SESSION_WAKE_RE } from "./routes/notify-wake.js";
 import { handleApprovalsAssistant, streamApprovals, isQuestionAnswer, ASSISTANT_RESUME_RE, ASSISTANT_PLAN_REVIEW_RE } from "./routes/approvals-assistant.js";
 export { streamApprovals, isQuestionAnswer };
 import { handleRuns, handleRunVerbs, RUN_SUBAGENT_RESUME_RE } from "./routes/runs.js";
+import { handleRunMemoryCapture } from "./routes/run-memory-capture.js";
 import { handleSideQuery } from "./routes/side-query.js";
 import { handleTasks } from "./routes/tasks.js";
 import { handleLeader } from "./routes/leader.js";
@@ -136,6 +138,7 @@ const ROUTE_DOMAINS = [
     handleA2a,
     handleWorkflowAgentSteer,
     handleRunVerbs,
+    handleRunMemoryCapture,
     handleLeader,
     handleImages,
     handleApprovalsAssistant,
@@ -145,6 +148,7 @@ const ROUTE_DOMAINS = [
     handleRetention,
     handleAdminDrain,
     handleAdminConfigRefresh,
+    handleMemoryOptOut,
     handleMemoryPolicy,
     handleMemoryBundle,
     handleMemoryCompliance,
@@ -244,6 +248,7 @@ export function createHttpServer(rawDeps) {
                 res.end();
         });
     });
+    deps.deviceHub?.attach(server);
     const routeCtxBase = {
         deps,
         registry: { idemCache, inflightRuns, preemptableRuns, cancelledViaVerb, steerableRuns, wakeParkMints, counters },
@@ -440,6 +445,8 @@ export function createHttpServer(rawDeps) {
             return;
         if (await handleRunVerbs(req, res, url, ctx))
             return;
+        if (await handleRunMemoryCapture(req, res, url, ctx))
+            return;
         if (await handleLeader(req, res, url, ctx))
             return;
         if (await handleImages(req, res, url, ctx))
@@ -458,6 +465,8 @@ export function createHttpServer(rawDeps) {
             return;
         if (await handleAdminConfigRefresh(req, res, url, ctx))
             return;
+        if (await handleMemoryOptOut(req, res, url, ctx))
+            return;
         if (await handleMemoryPolicy(req, res, url, ctx))
             return;
         if (await handleMemoryBundle(req, res, url, ctx))
@@ -489,7 +498,7 @@ export function createHttpServer(rawDeps) {
     function runnerFor(spec) {
         return deps.runnerFor?.(spec) ?? deps.runner;
     }
-    async function prepareSpec(req, res, bodyIn, onTypedFailure) {
+    async function prepareSpec(req, res, bodyIn, onTypedFailure, legFacts) {
         const body = bodyIn ?? (await readJson(req));
         if (!body || typeof body.objective !== "string") {
             sendError(res, 400, "request.field_invalid", "missing 'objective' string");
@@ -722,10 +731,22 @@ export function createHttpServer(rawDeps) {
             sendError(res, 400, "request.field_invalid", "rewindFiles must be a boolean");
             return null;
         }
+        if (body.restoreFiles !== undefined && typeof body.restoreFiles !== "boolean") {
+            sendError(res, 400, "request.field_invalid", "restoreFiles must be a boolean");
+            return null;
+        }
+        if (body.acceptPartialRestore !== undefined && typeof body.acceptPartialRestore !== "boolean") {
+            sendError(res, 400, "request.field_invalid", "acceptPartialRestore must be a boolean");
+            return null;
+        }
         if (body.memoryWrite !== undefined && typeof body.memoryWrite !== "boolean") {
             sendError(res, 400, "request.field_invalid", "memoryWrite must be a boolean (false = pause memory writes for this run)");
             return null;
         }
+        if (body.memoryCapture !== undefined && body.memoryCapture !== "off") {
+            sendError(res, 400, "request.field_invalid", "memoryCapture must be the string 'off' when present (the session-level memory-capture opt-out declaration; absent = capture as usual — there is no 'on' spelling)");
+            return null;
+        }
         if (body.requireExistingSession !== undefined && typeof body.requireExistingSession !== "boolean") {
             sendError(res, 400, "request.field_invalid", "requireExistingSession must be a boolean");
             return null;
@@ -807,6 +828,13 @@ export function createHttpServer(rawDeps) {
                 sendError(res, 400, "request.field_invalid", agentsErr);
                 return null;
             }
+            const agentsBare = deps.config.models ?? {};
+            const agentsCatalog = expandTiers(agentsBare, deps.config.tiers ?? {}) ?? agentsBare;
+            const um = unknownTaskAgentModelRef(body.agents, agentsCatalog);
+            if (um !== undefined) {
+                sendError(res, 400, "request.unknown_reference", `unknown agents[${um.index}].model "${um.ref.slice(0, 120)}" — not in the configured catalog (a catalog name or tier word)`, { available: mentionableNames(deps.config, agentsCatalog) });
+                return null;
+            }
         }
         if (body.interactiveTools !== undefined && typeof body.interactiveTools !== "boolean") {
             sendError(res, 400, "request.field_invalid", "interactiveTools must be a boolean");
@@ -931,7 +959,7 @@ export function createHttpServer(rawDeps) {
         }
         try {
             const auth = deps.authorize ? await deps.authorize({ req, body }) : undefined;
-            const spec = await deps.resolveSpec(body, req, auth, { leg: "fresh" });
+            const spec = await deps.resolveSpec(body, req, auth, { leg: "fresh", ...(legFacts?.liveStream === true ? { liveStream: true } : {}) });
             return { spec, runner: runnerFor(spec), auth, verify, cascade, jobId: body.jobId, body };
         }
         catch (err) {
@@ -947,21 +975,52 @@ export function createHttpServer(rawDeps) {
         }
     }
     const resumeFleetScope = (req, auth) => req ? (gatedPrincipal(req, deps.config) ?? "default") : (auth.principal ?? "default");
-    async function resumeCheckpoint(sessionId, decision, reason, settledBy, req, answer, binding, onResumeCommitted, acceptEarly) {
+    async function resumeCheckpoint(sessionId, decision, reason, settledBy, req, answer, binding, onResumeCommitted, acceptEarly, decider) {
         const cs = deps.checkpointStore;
         const token = await cs.findPendingTokenBySession(sessionId);
         if (binding?.checkpointToken && binding.checkpointToken !== token) {
-            const seen = await cs.get(binding.checkpointToken).catch(() => null);
+            let seenUnreadable = false;
+            const seen = await cs.get(binding.checkpointToken).catch((e) => {
+                seenUnreadable = true;
+                recordFailOpen("server.approvals.stale-echoed-token-unreadable", `session=${sessionId} err=${e instanceof Error ? e.message : String(e)}`);
+                return null;
+            });
             const attributable = seen !== null && seen.sessionId === sessionId;
             if (!attributable && seen !== null) {
                 deps.logger?.warn?.("approval_stale_token_foreign", { sessionId, tokenSession: seen.sessionId ?? null });
             }
+            if (!token && !attributable && !seenUnreadable) {
+                deps.logger?.info?.("approval_decide_no_pending", { sessionId, staleTokenEchoed: true });
+                return { status: 404, body: { error: "approval not found", errorCode: "not_found.approval" } };
+            }
+            let currentPending;
+            if (token && decider !== undefined) {
+                const cur = await cs.get(token).catch((e) => {
+                    recordFailOpen("server.approvals.stale-current-pending-unreadable", `session=${sessionId} err=${e instanceof Error ? e.message : String(e)}`);
+                    return null;
+                });
+                const curPa = cur?.pendingAction;
+                const curOwner = cur ? decodeCheckpointScope(cur.scope) : undefined;
+                const scopeOk = cur !== null && (decider.explicitOperator || curOwner === undefined || curOwner === decider.principal);
+                if (cur && cur.sessionId === sessionId && !scopeOk) {
+                    deps.logger?.info?.("approval_decide_no_pending", { sessionId, staleTokenEchoed: true, foreignCurrentSuppressed: true });
+                    return { status: 404, body: { error: "approval not found", errorCode: "not_found.approval" } };
+                }
+                if (cur && cur.status === "pending" && cur.sessionId === sessionId && scopeOk && curPa?.kind === "tool_approval" && curPa.toolCallId) {
+                    currentPending = {
+                        toolName: curPa.toolName,
+                        boundCallId: curPa.toolCallId,
+                        ...(curPa.boundInputHash ? { boundInputHash: curPa.boundInputHash } : {}),
+                    };
+                }
+            }
             return {
                 status: 409,
                 body: {
                     error: "the approval you are deciding is no longer current (already resolved or superseded since you viewed it)",
                     errorCode: "approval_stale",
                     ...(attributable ? { terminal: "resolved" } : {}),
+                    ...(currentPending ? { currentPending } : {}),
                 },
             };
         }
@@ -981,6 +1040,13 @@ export function createHttpServer(rawDeps) {
         }
         if (!cp)
             return { status: 404, body: { error: "checkpoint not found", errorCode: "not_found.checkpoint" } };
+        if (decider !== undefined && !decider.explicitOperator) {
+            const cpOwner = decodeCheckpointScope(cp.scope);
+            if (cpOwner !== undefined && cpOwner !== decider.principal) {
+                deps.logger?.warn?.("approval_decide_row_scope_mismatch", { sessionId, note: "loaded pending row is foreign to the verified caller — TOCTOU fold" });
+                return { status: 404, body: { error: "approval not found", errorCode: "not_found.approval" } };
+            }
+        }
         const decideGateKind = cp.gate?.kind;
         if (!isApprovalGateKind(decideGateKind)) {
             const activeForPath = decideGateKind
@@ -1008,6 +1074,13 @@ export function createHttpServer(rawDeps) {
                 },
             };
         }
+        const paForGrant = cp.pendingAction.kind === "tool_approval" ? cp.pendingAction : undefined;
+        const loadedGrantTool = paForGrant !== undefined && paForGrant.toolName && paForGrant.toolName !== "AskUserQuestion"
+            ? paForGrant.toolName
+            : null;
+        const boundGrant = onResumeCommitted
+            ? (overrideSessionId) => onResumeCommitted({ ...(overrideSessionId !== undefined ? { overrideSessionId } : {}), validatedToolName: loadedGrantTool })
+            : undefined;
         if (req !== undefined && deps.backgroundAgentStore !== undefined && deps.parkedReviveTool !== undefined) {
             const parked = await decideParkedAgent({
                 agentStore: deps.backgroundAgentStore,
@@ -1021,7 +1094,7 @@ export function createHttpServer(rawDeps) {
                 token, scope: cp.scope, sessionId: cp.sessionId, pendingAction: cp.pendingAction,
                 decision, settledBy, ...(reason !== undefined ? { reason } : {}),
                 ...(binding !== undefined ? { binding: { ...(binding.boundCallId !== undefined ? { boundCallId: binding.boundCallId } : {}), ...(binding.boundInputHash !== undefined ? { boundInputHash: binding.boundInputHash } : {}), ...(binding.updatedInput !== undefined ? { updatedInput: binding.updatedInput } : {}) } } : {}),
-                ...(onResumeCommitted ? { grantRemember: (rootSessionId) => onResumeCommitted(rootSessionId) } : {}),
+                ...(boundGrant ? { grantRemember: (rootSessionId) => boundGrant(rootSessionId) } : {}),
                 ...(answer !== undefined ? { answer } : {}),
             });
             if (parked !== undefined) {
@@ -1090,7 +1163,7 @@ export function createHttpServer(rawDeps) {
             settledBy,
         };
         const verifyRounds = verifyRoundsFromBody(ctx.body);
-        return driveResumeIntoRunLog({ runner: runnerFor(spec), token, sessionId: cp.sessionId, principal: auth.principal, fleetScope: resumeFleetScope(req, auth), taskConfig, resumeObjective, outcome, verifyRounds, ...(onResumeCommitted ? { onResumeCommitted } : {}), ...(acceptEarly === true ? { acceptEarly: true } : {}) });
+        return driveResumeIntoRunLog({ runner: runnerFor(spec), token, sessionId: cp.sessionId, principal: auth.principal, fleetScope: resumeFleetScope(req, auth), taskConfig, resumeObjective, outcome, verifyRounds, ...(boundGrant ? { onResumeCommitted: boundGrant } : {}), ...(acceptEarly === true ? { acceptEarly: true } : {}) });
     }
     async function driveResumeIntoRunLog(args) {
         if (args.acceptEarly !== true)
@@ -1157,6 +1230,17 @@ export function createHttpServer(rawDeps) {
             ? fleetRunPublisher(deps.fleetBus, { runId: taskId, scope: fleetScope, rootTaskId: taskId, ...fleetRunLabels(resumeObjective) })
             : undefined;
         const resumeTaskConfig = taskId ? { ...taskConfig, taskId } : taskConfig;
+        if (deps.toolApproval && taskId) {
+            const toolApproval = deps.toolApproval;
+            resumeTaskConfig.onAsk = approvalLeg.windowZero
+                ? () => Promise.resolve(toolApproval.unattendedAskOutcome())
+                : toolApproval.boundAsk({
+                    owner: principal ?? null,
+                    taskId,
+                    sessionId,
+                    ...(approvalLeg.active ? { legKey, ...(legDeadlineMonotonic !== undefined ? { legDeadlineMonotonic } : {}) } : {}),
+                });
+        }
         if (taskId && resumeTaskConfig.resourceSuspend)
             recordResumeResourceWindow(taskId, resumeTaskConfig.resourceSuspend);
         let fleetSettled = false;
@@ -1188,7 +1272,7 @@ export function createHttpServer(rawDeps) {
         const cancelCtrl = new AbortController();
         const preemptCtrl = new AbortController();
         if (taskId && deps.runStore) {
-            claimedRow = freshRunClaimed ? true : await deps.runStore.markResuming(taskId);
+            claimedRow = freshRunClaimed ? true : await deps.runStore.markResuming(taskId, deps.instanceId ?? "default");
             if (!claimedRow)
                 return { status: 409, body: { error: "run is not in a resumable (suspended) state (already resumed, decided, or expired)", errorCode: "conflict.not_resumable" } };
             markChildrenStoppedByUserOnAbort(cancelCtrl.signal, taskId, principal);
@@ -1604,6 +1688,8 @@ export function createHttpServer(rawDeps) {
                     e.code === "resume.constraint_unprojectable" ||
                     e.code === "resume.usage_window_exhausted" ||
                     e.code === "resume.principal_mismatch" ||
+                    e.code === "resume.placement_mismatch" ||
+                    e.code === "resume.preflight_rejected" ||
                     e.code.startsWith("wake.") ||
                     (e.code === "checkpoint.unsupported_version" && checkpointRowRedeemableElsewhere(e.detail?.reason));
                 if (claimedRow && taskId && deps.runStore) {
@@ -1633,7 +1719,7 @@ export function createHttpServer(rawDeps) {
                             ? (outcome.gate === "policy_ask" ? "approval_binding_mismatch" : "resume_outcome_invalid")
                             : e.code,
                         ...(e.detail?.field ? { field: e.detail.field } : {}),
-                        ...(e.code === "resume.usage_window_exhausted" && typeof e.detail?.retryAfterMs === "number" && Number.isFinite(e.detail.retryAfterMs) && e.detail.retryAfterMs > 0
+                        ...((e.code === "resume.usage_window_exhausted" || e.code === "resume.preflight_rejected") && typeof e.detail?.retryAfterMs === "number" && Number.isFinite(e.detail.retryAfterMs) && e.detail.retryAfterMs > 0
                             ? { retryAfterSec: Math.max(1, Math.ceil(e.detail.retryAfterMs / 1000)) }
                             : {}),
                         ...(retriable ? { retriable: true } : {}),
@@ -2115,7 +2201,7 @@ export function createHttpServer(rawDeps) {
             ...(req.gateBoundInputHash !== null ? { boundInputHash: req.gateBoundInputHash } : {}),
             ...(req.updatedInput !== undefined ? { updatedInput: req.updatedInput } : {}),
         };
-        const out = await resumeCheckpoint(cp.sessionId, req.decision, req.note, "human", req.httpReq, undefined, binding, undefined, true);
+        const out = await resumeCheckpoint(cp.sessionId, req.decision, req.note, "human", req.httpReq, undefined, binding, undefined, true, { principal: req.principal, explicitOperator: false });
         return { status: out.status, body: out.body };
     }
     const isRunLiveOnThisReplica = (taskId) => inflightRuns.has(taskId) || steerableRuns.has(taskId);
@@ -2159,22 +2245,28 @@ export function isCredentialGatedRewrite(method, url) {
     if (m === "POST") {
         return (url === "/v1/adoption" ||
             url.startsWith("/v1/rules/cc-import/") ||
+            url.startsWith("/v1/rules/local-import/") ||
             url === "/v1/memory/import" ||
             url === "/v1/memory/export" ||
             url === "/v1/memory/erase" ||
             url.startsWith("/v1/memory/origin/entries/"));
     }
+    if (m === "PUT")
+        return url === "/v1/admin/memory-optout" || url.startsWith("/v1/admin/memory-optout/");
     if (m === "DELETE")
-        return url === "/v1/rules";
+        return url === "/v1/rules" || url.startsWith("/v1/admin/memory-optout/");
     if (m === "GET") {
         return (/^\/v1\/memory\/entries\/[^/]+\/provenance$/.test(url) ||
             url === "/v1/memory/origin/external" ||
-            url === "/v1/memory/origin/clearances");
+            url === "/v1/memory/origin/clearances" ||
+            url === "/v1/admin/memory-optout");
     }
     return false;
 }
 const ROUTE_LABEL_PATTERNS = [
     [/^\/v1\/runs\/[^/]+\/steer$/, "/v1/runs/:id/steer"],
+    [/^\/v1\/runs\/[^/]+\/memory\/capture-optout$/, "/v1/runs/:id/memory/capture-optout"],
+    [/^\/v1\/runs\/[^/]+\/interrupt$/, "/v1/runs/:id/interrupt"],
     [/^\/v1\/runs\/[^/]+\/detach$/, "/v1/runs/:id/detach"],
     [/^\/v1\/runs\/[^/]+\/cancel$/, "/v1/runs/:id/cancel"],
     [/^\/v1\/runs\/[^/]+\/compact$/, "/v1/runs/:id/compact"],
@@ -2192,10 +2284,12 @@ const ROUTE_LABEL_PATTERNS = [
     [/^\/v1\/approvals\/[^/]+\/decide$/, "/v1/approvals/:id/decide"],
     [/^\/v1\/approvals\/[^/]+\/exemptions(\/[^/]+)?$/, "/v1/approvals/:id/exemptions"],
     [/^\/v1\/sessions\/[^/]+\/(wake|fork|init|notify|events|head|mcp|a2a|policy|settings)$/, "/v1/sessions/:id/$verb"],
+    [/^\/v1\/admin\/memory-optout\/[^/]+$/, "/v1/admin/memory-optout/:principal"],
+    [/^\/v1\/sessions\/[^/]+\/memory\/erase$/, "/v1/sessions/:id/memory/erase"],
     [/^\/v1\/sessions\/[^/]+\/sync\/(manifest|entries|plan)$/, "/v1/sessions/:id/sync/$verb"],
     [/^\/v1\/sessions\/[^/]+\/sync\/import(\/[^/]+\/entries)?$/, "/v1/sessions/:id/sync/import"],
     [/^\/v1\/sessions\/[^/]+\/sync\/blobs(\/[^/]+)?$/, "/v1/sessions/:id/sync/blobs"],
-    [/^\/v1\/sessions\/[^/]+\/sync\/snapshots\/[^/]+\/blobs\/[^/]+$/, "/v1/sessions/:id/sync/snapshots/:key/blobs/:hash"],
+    [/^\/v1\/sessions\/[^/]+\/sync\/history\/blobs\/[^/]+$/, "/v1/sessions/:id/sync/history/blobs/:hash"],
     [/^\/v1\/sessions\/[^/]+\/workspace(\/[^/]+(\/(tree|file|archive))?)?$/, "/v1/sessions/:id/workspace"],
     [/^\/v1\/sessions\/[^/]+$/, "/v1/sessions/:id"],
     [/^\/v1\/assistant\/tasks\/[^/]+\/preempt$/, "/v1/assistant/tasks/:id/preempt"],
@@ -2237,8 +2331,10 @@ const ROUTE_LABEL_LITERALS = new Set([
     "/v1/adoption",
     "/v1/admin/drain",
     "/v1/admin/config/refresh",
+    "/v1/admin/memory-optout",
     "/v1/admin/memory/consolidation/run", "/v1/admin/memory/consolidation",
     "/v1/rules/cc-import/prepare", "/v1/rules/cc-import/redeem",
+    "/v1/rules/local-import/prepare", "/v1/rules/local-import/redeem",
     "/v1/rules",
     "/.well-known/agent-card.json", "/v1/a2a",
     "/v1/agents/roster",

package/dist/http/verify-rounds.d.ts

@@ -1,5 +1,5 @@
 /**
- * design/97 R9 — the verify-rounds shape (used by the developer-mode adversarial-verification gate, 1.44) pulled
+ * design/97 R9 — the verify-rounds shape (used by the developer-mode independent-verification gate, 1.44) pulled
  * out to a NEUTRAL LEAF: it was three copies of the same anonymous `{ maxRounds: number; costCeilingMicroUsd?:
  * number }` object type (route-ctx.ts ×2, runs.ts `runInBackground`'s public signature) plus four call sites in
  * http/server.ts that each re-derived the same "verify:true → clamp rounds + fold cost ceiling" expression from a

package/dist/http/wire-types.d.ts

@@ -75,7 +75,7 @@ export interface TaskRequestBody {
      *  (MAX_TASK_COST_USD / MAX_TASK_TOKENS) — a caller may ask for less, never more. */
     maxCostUsd?: number;
     maxTokens?: number;
-    /** Developer mode (1.44): run the task behind the adversarial verification gate (impl → independent
+    /** Developer mode (1.44): run the task behind the independent verification gate (impl → independent
      *  read-only verify → fix loop). Default off. `verifyRounds` is clamped to [1,5] (default 2). Not
      *  supported on /v1/tasks/stream (the gate is multi-round, not a single stream). */
     verify?: boolean;
@@ -100,7 +100,7 @@ export interface TaskRequestBody {
      *  `TaskSpec.skills`. Merged AFTER the scenario's skills with SCENARIO-WINS on a name clash (the security
      *  baseline can never be shadowed by user content — see mergeUserSkills). Caps: ≤10 skills, content ≤32KB
      *  each. User skills are user-authored content in the user's OWN principal-isolated task (self-harm
-     *  surface, not privilege escalation); scenario/center skills remain the only trusted layer. */
+     *  surface, not privilege widening); scenario/center skills remain the only trusted layer. */
     skills?: Array<{
         name: string;
         description: string;
@@ -163,14 +163,23 @@ export interface TaskRequestBody {
         count?: number;
         role?: string;
     };
-    /** Rewind-files (shell-host contract E19): opt-in — snapshot the working tree each completed turn + RESTORE it when a
-     *  `resumeAt` branch is taken ("rewind to this message" also rewinds the files). Requires a FileSnapshotStore; works for
-     *  ANY execution env since core's gate-split (1.134.0). OFF/absent ⇒ no snapshot/restore work. */
+    /** S-15 file restore (design/381): with `resumeAt`, ALSO converge the working tree's **agent-edited files**
+     *  (the tracked set — nothing else is visible to the history, so a user's parallel work is structurally
+     *  untouchable) to that entry's history boundary. Capture needs no request anymore: first-touch tracking is
+     *  always on when the deployment wires a history store. Requires a FileHistoryStore. */
+    restoreFiles?: boolean;
+    /** DV-15: opt-in tolerance for a PARTIAL file restore (default = loud terminal failure carrying the per-file
+     *  ledger; `true` = keep going and disclose the same ledger on the result's rewindNotes). */
+    acceptPartialRestore?: boolean;
+    /** RETIRED spelling (whole-tree epoch). Still accepted on the wire: its capture sense (true, no resumeAt) is
+     *  a tolerated no-op with a deprecation disclosure; its restore sense (true + resumeAt) is a typed rejection
+     *  naming `restoreFiles` — the restore semantics genuinely changed (whole tree ⇒ tracked set), so that
+     *  migration is explicit by design (core adjudicates; the server never remaps it silently). */
     rewindFiles?: boolean;
-    /** R8 code-only rewind (CC "Restore code" mode, core 1.166 `rewindFilesTo`): restore the working tree to the snapshot
-     *  at a prior USER message WITHOUT forking the conversation (the session leaf is untouched — only the files move). The
+    /** R8 code-only rewind (CC "Restore code" mode): converge the TRACKED set to the history boundary at a prior
+     *  USER message WITHOUT forking the conversation (the session leaf is untouched — only the files move). The
      *  value is the same handle as `resumeAt` (the prompt's taskId); the service resolves it → the entry id. Honored ONLY
-     *  when `resumeAt` is ABSENT (the two modes are mutually exclusive). Requires the anchor map + a FileSnapshotStore. */
+     *  when `resumeAt` is ABSENT (the two modes are mutually exclusive). Requires the anchor map + a FileHistoryStore. */
     rewindFilesTo?: string;
     /** design/131 (core 1.246): per-task resilience INTENT flags. allowDegrade/allowFailover are caller-facing;
      *  bypassBreaker is operator-only (resolveSpec drops it for non-operators — a permission downgrade, not a 400). */
@@ -294,6 +303,17 @@ export interface TaskRequestBody {
      *  adopt-on-read semantics: a paused run still sees the user's hand-edits and git-pull drops, it just commits
      *  nothing. Restriction is the session's DECLARATION, never the plane's structure. */
     memoryWrite?: boolean;
+    /** design/383 §2.1(core 7.0.0 片2/3;server S-49):**session 记忆采集 opt-out 声明** —— `"off"` = 「本会话
+     *  不进长期记忆」:单成员闭集,**没有** `"on"`(缺席就是照常采集的唯一形)。透传为 `TaskSpec.memory.capture`,
+     *  由 core 按部署姿态(`MEMORY_CAPTURE_POLICY`)+ 该 principal 的 `allowMemoryOptOut` verdict 裁:拒 = 403
+     *  `memory.capture_optout_denied`。**一次性**:声明落一条单向控制面记录,后续 resume 恒不采集(record wins),
+     *  同会话重复声明幂等;要回到采集只能开新会话。与 `memoryWrite:false`(本 run 只读平面,可逐 run 切换)
+     *  **不是一个轴**:那是「这次别写」,这是「这个会话永远别记」。
+     *  ⚠️ 拼写门**两腿同判、响亮拒**:fresh 400 `request.field_invalid`;resume 重放同判(不做 resume 降级 ——
+     *  把一条隐私请求按打字错误静默丢掉恰是 core 禁的方向;core 的 `config.memory_capture_spelling` 是第二道墙)。
+     *  记忆面暗的部署(引擎未接线 / 多租户)上本键随 `memory` 整体缺席而无处落 —— 那里本就零采集。
+     *  Rides the persisted body onto resume legs(与 memoryWrite 同姿势)。 */
+    memoryCapture?: "off";
     /** 142-S4 projectId 线程化(design/142 §2):这个 run 归属的项目(center 登记簿键,generic lowercase
      *  UUID — core S1 `resolveProjectId` marker 或 S3 无仓 mint 的产物;客户端只透传,零铸造权威)。是「哪个
      *  项目」的选择器,不是身份/capability — scope 的 tenant 段永远来自 verified principal。SHAPE 门在
@@ -387,4 +407,17 @@ export type DecideBinding = {
     /** design/37 edit: operator-corrected tool args, applied by core AFTER the binding check, on approve only. */
     updatedInput?: unknown;
 };
+/** S-02([5522]④→[5525] 坐标轮换判定):409 `approval_stale` 拒体上的 additive 机读指路 ——
+ *  **本会话当前 pending** 的 D-1 回显坐标,让持旧坐标的壳一跳重定位(免重拉列表)。
+ *  键名/键形与 GET /v1/approvals 的 pending 行逐字同名(壳复用同一解析)。
+ *  🔴 恒**不含** checkpointToken(runs.ts §12-C:resume 凭证从不外发);只在当前 pending **在场**、
+ *  属 tool_approval、且已过路由级 owner 门的域内铸 —— 无 pending / 非工具门 / 读失败 ⇒ 键缺席(不造键)。 */
+export type ApprovalStaleCurrentPending = {
+    /** 当前 pending 被门住的工具名(与 pending 行的 `toolName` 同源同值)。 */
+    toolName: string;
+    /** 当前 pending 的 `pendingAction.toolCallId` —— 壳重定位后 decide 时回显的 D-1 锚。 */
+    boundCallId: string;
+    /** 当前 pending 的 server 铸 `boundInputHash`(行上有才带;逐字回显,壳不重算)。 */
+    boundInputHash?: string;
+};
 //# sourceMappingURL=wire-types.d.ts.map

package/dist/leader/endpoint.d.ts

@@ -44,7 +44,7 @@ export interface LeaderEndpoint {
         status: number;
         body: object;
     } | null>;
-    /** 对抗复查 B-1(CRITICAL):the number of leader runs still RUNNING in the background — the drain gate
+    /** 交叉复查 B-1(CRITICAL):the number of leader runs still RUNNING in the background — the drain gate
      *  counts them (a SIGTERM used to see 0 and hard-shut mid-leader-run).
      *
      *  🔴 刻意**只数本副本**(即使 store 在场):drain 门问的是「这个进程还在驱动几条 run」,不是「全集群

package/dist/leader/leader.d.ts

@@ -94,7 +94,7 @@ export interface LeaderDeps {
         maxRepairs?: number;
     };
     /** core 1.72 native L3a (design/54 §4): when set, each worker runs via `runWithVerification` (run the module +
-     *  an ADVERSARIAL DECORRELATED verifier tries to break it reading the diff/workspace + a bounded fix-loop)
+     *  an INDEPENDENT DECORRELATED verifier tries to break it reading the diff/workspace + a bounded fix-loop)
      *  instead of plain fan-out. The worker runner's `models` catalog MUST carry the heterogeneous `verifierModel`
      *  (decorrelation = deployment contract). Mutually exclusive with `moduleGate` (this IS the native version). */
     verifyWorker?: VerifyConfig;

package/dist/leader/repair-oracle.d.ts

@@ -6,7 +6,7 @@
  * fixes the `OracleResult` shape + the read-only/identity contract; the composition lives HERE so the core type
  * never grows a discriminated union.
  *
- * Hardened by the adversarial round (§10):
+ * Hardened by the cross-review round (§10):
  *  - §10.1 HERMETIC grade: the grader tree is reset to a clean base (`git reset --hard <integBase> && git clean
  *    -fdx`) BEFORE applying the worker's LATEST full `base..HEAD` diff each call — so a 2nd/3rd attempt never
  *    applies cumulatively onto an already-applied tree (the BROKEN finding). The diff is recomputed fresh every
@@ -63,7 +63,7 @@ export interface RepairOracleCfg {
     };
     /** fork1.2 — paths the candidate patch must NOT touch (the seeded hidden-oracle / test paths).
      *  The §10.2 factory lane OMITs the engine's path-level probe, so a patch that EDITS the grader's oracle could
-     *  tamper with the grade and get rubber-stamped as `candidate_only`. A patch touching one of these is REFUSED
+     *  rewrite the grade and get rubber-stamped as `candidate_only`. A patch touching one of these is REFUSED
      *  as `needs_human_oracle` (surfaced for a human, never a silent candidate). Matched by exact path or subtree. */
     oraclePaths?: string[];
     /** 🔴 council 2026-06-17 — the seeded hidden-oracle files (path + content). The hermetic `git clean -fdx`

package/dist/leader/repair-oracle.js

@@ -36,7 +36,7 @@ export function mkRepairOracle(cfg) {
         if (tampered) {
             cfg.log?.("repair_oracle_tampering_guard", { path: tampered });
             cfg.onGraded?.({ diff: diff.patch, hash: diffHash, passed: false });
-            return { tier: "none", passed: false, flaky: false, retries: 0, trace: `candidate patch touches oracle/test path '${tampered}' — refusing to grade (fork1.2 test-tampering guard)` };
+            return { tier: "none", passed: false, flaky: false, retries: 0, trace: `candidate patch touches oracle/test path '${tampered}' — refusing to grade (fork1.2 test-alteration guard)` };
         }
         if (lastGradedHash !== undefined && diffHash === lastGradedHash) {
             cfg.log?.("repair_oracle_stale_diff", { hash: diffHash });

package/dist/leader/wire.js

@@ -366,7 +366,8 @@ export function createLeaderRunner(cfg) {
         };
         const provisionIntegrationSandbox = async () => {
             if (cfg.envFactory) {
-                const env = cfg.envFactory({ sessionId: `leader-integ-${Date.now()}` });
+                const integSessionId = `leader-integ-${Date.now()}`;
+                const env = cfg.envFactory({ sessionId: integSessionId, placementRootSessionId: integSessionId });
                 try {
                     await sh(env)(body.seedCmd);
                     await injectOracles(env);
@@ -412,7 +413,8 @@ export function createLeaderRunner(cfg) {
         const resolveRepair = async (solo, _sub) => {
             let env;
             if (cfg.envFactory) {
-                env = cfg.envFactory({ sessionId: `leader-grader-${Date.now()}` });
+                const graderSessionId = `leader-grader-${Date.now()}`;
+                env = cfg.envFactory({ sessionId: graderSessionId, placementRootSessionId: graderSessionId });
             }
             else {
                 if (!cfg.e2bApiKey)