@sema-agent/server 7.51.0 → 7.52.0

package/dist/http/routes/sessions.js

@@ -4,8 +4,6 @@ import { isUuidV7, isUuidShape, legacyUnownedSessionOk } from "../../security.js
 import { windowMessages, truncateMessageBlobs } from "../../audit.js";
 import { redactSecrets } from "../../trace/redact.js";
 import { MAX_SETTINGS_OUTPUT_STYLE_CHARS, MAX_SETTINGS_PERMISSION_RULES, MAX_SETTINGS_ENV_VARS, MAX_SETTINGS_ENV_KEY_CHARS, MAX_SETTINGS_ENV_VALUE_CHARS } from "../../task-settings.js";
-import { workspaceContentType, looksBinary } from "../workspace-content.js";
-import { tarHeader, tarPadding, splitTarPath, TAR_END } from "../tar.js";
 import { sendJson, sendError, sseHeaders } from "../send.js";
 import { gatedPrincipal, explicitOperatorOk } from "../principal-gate.js";
 const MCP_STATUS_TTL_MS = 5_000;
@@ -411,6 +409,66 @@ async function handleSessionsBody(req, res, url, ctx, miss) {
             return;
         }
     }
+    {
+        const em = req.method === "POST" ? /^\/v1\/sessions\/([^/]+)\/memory\/erase$/.exec(url) : null;
+        if (em) {
+            const sessionId = safeDecode(em[1]);
+            if (sessionId === null) {
+                sendError(res, 400, "request.path_malformed", "session id segment is not valid percent-encoding");
+                return;
+            }
+            if (deps.config.requirePrincipal && !gatedPrincipal(req, deps.config)) {
+                sendError(res, 401, "auth.principal_required", `missing principal header '${deps.config.principalHeader}'`);
+                return;
+            }
+            if (!deps.sessionAudit) {
+                sendError(res, 501, "capability.memory_engine_required", "memory provenance and erasure are not available on this deployment — they require a wired memory engine (MEMORY_ENGINE=on) whose backend owns the engine control plane (controlPlaneRoot); the file memory backend does, the pg/tidb memory backends do not (their control plane would land on a replica's local disk)");
+                return;
+            }
+            const audit = await deps.sessionAudit(sessionId);
+            if (!audit) {
+                sendError(res, 404, "not_found.session", "session not found");
+                return;
+            }
+            if (!runOwnerOk(req, res, audit.owner))
+                return;
+            const faces = deps.memoryCompliance;
+            if (faces === undefined) {
+                sendError(res, 501, "capability.memory_engine_required", "memory provenance and erasure are not available on this deployment — they require a wired memory engine (MEMORY_ENGINE=on) whose backend owns the engine control plane (controlPlaneRoot); the file memory backend does, the pg/tidb memory backends do not (their control plane would land on a replica's local disk)");
+                return;
+            }
+            const raw = (await readJson(req));
+            if (raw === null || typeof raw !== "object" || Array.isArray(raw)) {
+                sendError(res, 400, "request.body_shape", "invalid session memory erase body — expected { requestId: string, allowUnevidenced?: boolean } (no `select`: this face erases exactly this session's own contributions)");
+                return;
+            }
+            if ("select" in raw) {
+                sendError(res, 400, "request.body_shape", "invalid session memory erase body — `select` is not accepted on the self-service face: the selector is fixed to { sessionId: <this session> } by the path; the operator face POST /v1/memory/erase takes explicit selectors");
+                return;
+            }
+            if (typeof raw.requestId !== "string" || raw.requestId.length === 0) {
+                sendError(res, 400, "request.request_id_required", "memory erasure requires a non-empty `requestId` string — it is this request's idempotency identity and the server never mints one for you (a retry must carry the SAME id)");
+                return;
+            }
+            if (raw.allowUnevidenced !== undefined && typeof raw.allowUnevidenced !== "boolean") {
+                sendError(res, 400, "request.field_invalid", "allowUnevidenced must be a boolean when present");
+                return;
+            }
+            try {
+                sendJson(res, 200, await faces.erase({ requestId: raw.requestId, select: { sessionId }, ...(raw.allowUnevidenced !== undefined ? { allowUnevidenced: raw.allowUnevidenced } : {}) }));
+            }
+            catch (err) {
+                const code = err.code;
+                if (code === "config.memory_erasure_request") {
+                    sendError(res, 400, "config.memory_erasure_request", err instanceof Error ? err.message : "invalid memory erasure request");
+                    return;
+                }
+                deps.logger?.warn?.("session_memory_erase_failed", { sessionId, err: String(err) });
+                sendError(res, 500, "internal.error", "session memory erasure failed");
+            }
+            return;
+        }
+    }
     if (deps.sessionAudit && req.method === "GET") {
         const sm = /^\/v1\/sessions\/([^/]+)$/.exec(url);
         if (sm) {
@@ -621,192 +679,7 @@ async function handleSessionsBody(req, res, url, ctx, miss) {
     {
         const wm = req.method === "GET" ? /^\/v1\/sessions\/([^/]+)\/workspace(?:\/([^/]+)(?:\/(tree|file|archive))?)?$/.exec(url) : null;
         if (wm) {
-            const fs = deps.fileSnapshotStore;
-            const ownerOf = deps.sessionStorage?.ownerOf?.bind(deps.sessionStorage);
-            if (!fs || typeof fs.listKeys !== "function" || typeof fs.exportManifest !== "function" || typeof fs.getBlob !== "function" || !ownerOf) {
-                sendError(res, 501, "capability.snapshot_store_required", "workspace browse requires a durable snapshot store (rewindFiles wiring) and a durable session store");
-                return;
-            }
-            const scope = sessionOwnerScope(req);
-            if (!scope.fleetWide && scope.gateOwner === null) {
-                sendError(res, 401, "auth.unauthorized", "unauthorized");
-                return;
-            }
-            const wsSession = safeDecode(wm[1]);
-            if (wsSession === null || !isUuidShape(wsSession)) {
-                sendError(res, 400, "request.id_invalid", "invalid session id (must be a canonical uuid)");
-                return;
-            }
-            const wsOwner = await ownerOf(wsSession);
-            if (wsOwner === undefined || (!scope.fleetWide && wsOwner !== scope.gateOwner && !legacyUnownedSessionOk(deps.config.requirePrincipal, scope.gateOwner, wsOwner))) {
-                sendError(res, 404, "not_found.session", "session not found");
-                return;
-            }
-            const q = new URL(req.url ?? "", "http://x").searchParams;
-            const keys = (await fs.listKeys(wsSession)).sort().reverse();
-            const sub = wm[3];
-            if (wm[2] === undefined) {
-                const limRaw = q.get("limit");
-                if (limRaw !== null && !(/^[0-9]+$/.test(limRaw) && Number(limRaw) >= 1 && Number(limRaw) <= 100)) {
-                    sendError(res, 400, "request.query_invalid", "limit must be a decimal integer in 1..100");
-                    return;
-                }
-                const lim = limRaw === null ? 20 : Number(limRaw);
-                const beforeRaw = q.get("before");
-                const scoped = beforeRaw !== null ? keys.filter((k) => k < beforeRaw) : keys;
-                const page = scoped.slice(0, lim);
-                const snapshots = [];
-                for (const k of page) {
-                    const m = await fs.exportManifest(wsSession, k);
-                    if (m === null)
-                        continue;
-                    let bytes;
-                    if (typeof fs.blobSizes === "function") {
-                        const sizes = await fs.blobSizes([...new Set(m.values())]);
-                        bytes = 0;
-                        for (const h of m.values())
-                            bytes += sizes.get(h) ?? 0;
-                    }
-                    snapshots.push({ key: k, files: m.size, ...(bytes !== undefined ? { bytes } : {}) });
-                }
-                const lastPageKey = page.length > 0 ? page[page.length - 1] : undefined;
-                const hasMore = lastPageKey !== undefined && scoped.length > page.length;
-                sendJson(res, 200, {
-                    sessionId: wsSession,
-                    snapshots,
-                    ...(snapshots.length > 0 ? { latest: snapshots[0].key } : {}),
-                    total: keys.length,
-                    ...(hasMore ? { nextBefore: lastPageKey } : {}),
-                });
-                return;
-            }
-            const keyRaw = safeDecode(wm[2]);
-            if (keyRaw === null) {
-                sendError(res, 400, "request.path_malformed", "malformed snapshot key");
-                return;
-            }
-            const key = keyRaw === "latest" ? keys[0] : keyRaw;
-            const manifest = key !== undefined ? await fs.exportManifest(wsSession, key) : null;
-            if (key === undefined || manifest === null) {
-                sendError(res, 404, "not_found.snapshot", "snapshot not found");
-                return;
-            }
-            if (sub === "tree") {
-                const limRaw = q.get("limit");
-                if (limRaw !== null && !(/^[0-9]+$/.test(limRaw) && Number(limRaw) >= 1 && Number(limRaw) <= 2000)) {
-                    sendError(res, 400, "request.query_invalid", "limit must be a decimal integer in 1..2000");
-                    return;
-                }
-                const offRaw = q.get("offset");
-                if (offRaw !== null && !/^[0-9]+$/.test(offRaw)) {
-                    sendError(res, 400, "request.query_invalid", "offset must be a non-negative integer");
-                    return;
-                }
-                const lim = limRaw === null ? 500 : Number(limRaw);
-                const off = offRaw === null ? 0 : Number(offRaw);
-                const all = [...manifest.entries()].sort((a, b) => (a[0] < b[0] ? -1 : a[0] > b[0] ? 1 : 0));
-                const page = all.slice(off, off + lim);
-                const sizes = typeof fs.blobSizes === "function" ? await fs.blobSizes([...new Set(page.map(([, h]) => h))]) : undefined;
-                sendJson(res, 200, {
-                    sessionId: wsSession,
-                    key,
-                    entries: page.map(([path, hash]) => ({ path, hash, ...(sizes?.get(hash) !== undefined ? { size: sizes.get(hash) } : {}) })),
-                    total: all.length,
-                    ...(off + lim < all.length ? { nextOffset: off + lim } : {}),
-                });
-                return;
-            }
-            if (sub === "file") {
-                const pathParam = q.get("path");
-                if (!pathParam) {
-                    sendError(res, 400, "request.query_invalid", "missing ?path=<relPath from the tree>");
-                    return;
-                }
-                const hash = manifest.get(pathParam);
-                if (hash === undefined) {
-                    sendError(res, 404, "not_found.file", "no such file in this snapshot (paths are the tree's relPaths, verbatim)");
-                    return;
-                }
-                const cap = deps.config.workspaceFileMaxBytes ?? 8 * 1024 * 1024;
-                if (typeof fs.blobSizes === "function") {
-                    const known = (await fs.blobSizes([hash])).get(hash);
-                    if (known !== undefined && known > cap) {
-                        sendError(res, 413, "workspace_file_too_large", "file exceeds the single-file read limit — download it via the archive endpoint", { sizeBytes: known, limit: cap });
-                        return;
-                    }
-                }
-                const bytes = await fs.getBlob(hash);
-                if (bytes === undefined) {
-                    sendError(res, 404, "not_found.file", "file content no longer available (snapshot raced a reap)");
-                    return;
-                }
-                if (bytes.byteLength > cap) {
-                    sendError(res, 413, "workspace_file_too_large", "file exceeds the single-file read limit — download it via the archive endpoint", { sizeBytes: bytes.byteLength, limit: cap });
-                    return;
-                }
-                const ct = workspaceContentType(pathParam);
-                const bin = looksBinary(bytes);
-                res.writeHead(200, {
-                    "content-type": ct,
-                    "content-length": bytes.byteLength,
-                    "x-content-type-options": "nosniff",
-                    "x-sema-content-binary": bin ? "true" : "false",
-                });
-                res.end(Buffer.from(bytes));
-                return;
-            }
-            if (sub === "archive") {
-                const entries = [...manifest.entries()].sort((a, b) => (a[0] < b[0] ? -1 : a[0] > b[0] ? 1 : 0));
-                const bad = entries.filter(([p]) => splitTarPath(p) === null).map(([p]) => p);
-                if (bad.length > 0) {
-                    sendError(res, 422, "request.content_unrepresentable", `snapshot contains ${bad.length} path(s) not representable in ustar (>255 bytes or unsplittable)`, { paths: bad.slice(0, 5) });
-                    return;
-                }
-                if (typeof fs.hasBlobs === "function") {
-                    const present = await fs.hasBlobs([...new Set(entries.map(([, h]) => h))]);
-                    const missing = entries.filter(([, h]) => !present.has(h)).length;
-                    if (missing > 0) {
-                        sendError(res, 502, "internal.snapshot_blobs_missing", `snapshot is missing ${missing} blob(s) (raced a reap or a partial import) — retry, or pick another snapshot`);
-                        return;
-                    }
-                }
-                res.writeHead(200, {
-                    "content-type": "application/x-tar",
-                    "content-disposition": `attachment; filename="workspace-${key}.tar"`,
-                    "x-content-type-options": "nosniff",
-                });
-                const write = async (buf) => {
-                    if (res.writableEnded || res.destroyed)
-                        throw new Error("client gone");
-                    if (!res.write(buf)) {
-                        await new Promise((resolve, reject) => {
-                            const onDrain = () => { cleanup(); resolve(); };
-                            const onGone = () => { cleanup(); reject(new Error("client gone (closed while draining)")); };
-                            const cleanup = () => { res.off("drain", onDrain); res.off("close", onGone); res.off("error", onGone); };
-                            res.once("drain", onDrain);
-                            res.once("close", onGone);
-                            res.once("error", onGone);
-                        });
-                    }
-                };
-                try {
-                    for (const [p, h] of entries) {
-                        const bytes = await fs.getBlob(h);
-                        if (bytes === undefined)
-                            throw new Error(`blob vanished mid-stream: ${h}`);
-                        await write(tarHeader(p, bytes.byteLength, 0));
-                        await write(Buffer.from(bytes));
-                        await write(tarPadding(bytes.byteLength));
-                    }
-                    await write(TAR_END);
-                    res.end();
-                }
-                catch {
-                    res.destroy();
-                }
-                return;
-            }
-            sendError(res, 404, "request.route_unsupported", "unknown workspace verb — use /tree, /file?path=, or /archive");
+            sendError(res, 501, "capability.workspace_retired", "workspace browse is retired: the whole-tree snapshot epoch it projected was replaced by per-edited-file rewind history (which holds only files the agent edited, not the workspace). There is no whole-tree manifest to browse anymore.");
             return;
         }
     }

package/dist/http/routes/shared-memory.d.ts

@@ -8,7 +8,7 @@
  * 挂载条件 = store ∧ org 折叠面,**双在场**才有这个域(v2/F4 硬化)
  * ─────────────────────────────────────────────────────────────────────────────────────────────────
  * 供给面在场但授权面缺席时,这个域整体**不挂载** —— 请求落到全局 404 `not_found.route`。刻意不是 501:
- *  · 501 的自述是「这个面存在,只是本部署没开」,它对一个连身份都无法被判定的调用方泄露了「这套部署
+ *  · 501 的自述是「这个面存在,只是本部署没开」,它对一个连身份都无法被判定的调用方暴露了「这套部署
  *    有共享记忆库」,并暗示补个配置就能读;
  *  · 「store 好了先挂载、授权后补」是这条纪律真正要堵的中间态 —— 一个没有成员性判据的读面,唯一能做的
  *    要么是全放(跨租户读)要么是全拒(伪装成故障),两个都比「这个面不存在」差。

package/dist/http/routes/tasks.js

@@ -78,7 +78,7 @@ async function handleTasksBody(req, res, url, ctx, miss) {
         }
         if (rateLimited(req, res) || quotaExceeded(req, res) || (await leaseDenied(req, res)) || (await usageWindowDenied(req, res)))
             return;
-        const prepared = await prepareSpec(req, res);
+        const prepared = await prepareSpec(req, res, undefined, undefined, { liveStream: url === "/v1/tasks/stream" });
         if (!prepared)
             return;
         const principal = prepared.auth?.principal;

package/dist/http/routes/workflows.js

@@ -1,3 +1,4 @@
+import { z } from "zod";
 import { getWorkflowRun, subscribeWorkflow, deriveAgentDisplayStatus, callKeyOrdinal } from "@sema-agent/core";
 import { redactSteerIn, STEER_IN_MAX_CHARS, STEER_IN_MAX_REQUEST_CHARS } from "../../orchestration/workflow-agent-steer.js";
 import { redactSecrets } from "../../trace/redact.js";
@@ -201,6 +202,22 @@ async function handleWorkflowAgentSteerBody(req, res, url, ctx, miss) {
     }
     miss.fell = true;
 }
+const LegApprovalKeysSchema = z
+    .object({
+    pendingApproval: z.object({ askIds: z.array(z.string().min(1)).min(1), oldestCreatedAtMs: z.number().finite() }).optional(),
+    approvalWaitedMs: z.number().finite().nonnegative().optional(),
+})
+    .loose();
+function projectLegApprovalKeys(agent) {
+    const parsed = LegApprovalKeysSchema.safeParse(agent);
+    if (!parsed.success)
+        return {};
+    const { pendingApproval, approvalWaitedMs } = parsed.data;
+    return {
+        ...(pendingApproval !== undefined ? { pendingApproval: { askIds: [...pendingApproval.askIds], oldestCreatedAtMs: pendingApproval.oldestCreatedAtMs } } : {}),
+        ...(approvalWaitedMs !== undefined ? { approvalWaitedMs } : {}),
+    };
+}
 function summarizeWorkflowDetail(run) {
     const isDone = (s) => s === "completed" || s === "failed";
     const durationOf = (a) => a.startedAt === undefined || a.endedAt === undefined ? undefined : a.endedAt - a.startedAt;
@@ -245,6 +262,8 @@ function summarizeWorkflowDetail(run) {
         replayed: a.replayed,
         prompt: a.prompt,
         output: a.output,
+        ...projectLegApprovalKeys(a),
+        taskRunId: a.taskRunId,
     }));
     const byId = new Map();
     for (const g of runGroups) {

package/dist/http/server.d.ts

@@ -5,7 +5,7 @@ import type { TaskRequestBody } from "./wire-types.js";
 import type { ServiceConfig } from "../config-types.js";
 import { type RestartSignal, type SessionMirrorRuling } from "../config-center/facade.js";
 import { type OwnerAwareSessionStore } from "../security.js";
-import type { RunStore, ImageIndex, ImageBake, CheckpointStoreFull, ResumeAnchorStore, ApprovalExemptionStore, ServiceSessionPolicyStore, ServiceFileSnapshotStore, ToolResultStoreFull, StoreBackend } from "../plugins/store-backend.js";
+import type { RunStore, ImageIndex, ImageBake, CheckpointStoreFull, ResumeAnchorStore, ApprovalExemptionStore, ServiceSessionPolicyStore, ServiceFileHistoryStore, ToolResultStoreFull, StoreBackend } from "../plugins/store-backend.js";
 import type { RuleConsentLane } from "../rules-consent.js";
 import { type MemorySyncRequest, type MemorySyncResponse } from "../memory-sync.js";
 import type { TaskAttachmentStore } from "../plugins/task-attachment-store.js";
@@ -86,8 +86,14 @@ export interface ServiceCoreDeps {
      *  task). The disposition lives INSIDE resolveSpec because only it derives the effective scenario (principal
      *  ruling + defaultScenario) and holds the center-pack snapshot the provider pick uses — an HTTP-side probe
      *  could disagree with the actual assembly (scenario mismatch / centerPrompts refresh TOCTOU). */
+    /** `opts.liveStream` (S-46 件C):这条腿是不是 `POST /v1/tasks/stream` —— **唯一**挂 HITL 活流投递面
+     *  (`question.runWithContext`)的腿。resolveSpec 拿它做逐腿 `interactionPosture` 判据(判据全文见
+     *  `boot/resolve-spec.ts` 的 `declaresInteractivePosture`)。缺席/false ⇒ 无人腿,不声明 posture ——
+     *  bg(`POST /v1/runs`)、A2A、resume、cron/wake 一律走这一侧,行为字节不变。
+     *  ⚠️ 它是**腿身份**不是能力表态:绝不从请求体读,只由路由装配点按 URL 定(客户端说了不算)。 */
     resolveSpec: (body: TaskRequestBody, req: IncomingMessage | undefined, auth?: RequestAuth, opts?: {
         leg?: "fresh" | "resume";
+        liveStream?: boolean;
     }) => TaskSpec | Promise<TaskSpec>;
     /**
      * #196 场景 hands lane 选路:按 `resolveSpec` 刚产出的 TaskSpec 取本任务的执行 Runner。
@@ -116,13 +122,14 @@ export interface ServiceStoreDeps {
     /** [3321] tool-results 读面([3315] 请求,core [3322] `buildToolResultRef` 到货):`GET /v1/tasks/:id/
      *  tool-results/:ref` 的数据源 —— 与 RunnerDeps 侧的 offload 店**同实例**(main.ts 的 `toolResultStore`,
      *  即「durable 后端在场」那一只;无 backend 部署里 Runner 用的内存兜底 `runnerOffloadStore` **不接**这里)。
-     *  🔴 缺席 ⇒ 路由回 404 而不是 501:501 会向一个无权 caller 泄露「这台机器配没配 durable 店」的部署形,
+     *  🔴 缺席 ⇒ 路由回 404 而不是 501:501 会向一个无权 caller 暴露「这台机器配没配 durable 店」的部署形,
      *  与 unknown-ref / 归属不符两臂**同形** 404 才是防 oracle 的收口([3321] 的「另定」项按防 oracle 收紧)。
      *  这是本组「absent ⇒ 501 诚实缺席」通例的**唯一具名例外**,例外理由即上一句。 */
     toolResultStore?: ToolResultStoreFull;
-    /** E19 rewind-files snapshot store. Present ⇒ the `rewindFiles` capability is advertised; core uses it via
-     *  RunnerDeps.fileSnapshotStore (snapshot per turn + restore on resumeAt, ANY env since gate-split 1.134.0). Also the 2c artifact store. */
-    fileSnapshotStore?: ServiceFileSnapshotStore;
+    /** S-15 per-edited-file rewind history store. Present ⇒ the rewind capabilities are advertised; core uses it
+     *  via RunnerDeps.fileHistoryStore (first-touch tracking + per-turn boundaries + tracked-set restore, ANY
+     *  env). Also the 2c history-transfer store (exportHistory/importHistory + blob negotiation faces). */
+    fileHistoryStore?: ServiceFileHistoryStore;
     /** D-1 通用文件上传(clay 拍 2026-07-27:独立附件 store,不骑 snapshot blob 面):enables
      *  POST/GET/DELETE /v1/attachments*。缺席 ⇒ 501(与其他可选 store 面同姿)。绑定/物化半场在
      *  main.ts(resolveSpec + env factory 包装);本面只管上传/取回/删除三动词 + server 权威上限。 */
@@ -153,7 +160,7 @@ export interface ServiceStoreDeps {
      *  bake + resumable SSE + runner claim/ingest + status-monotonic auto-register). Set when a TiDB pool is
      *  present AND `IMAGE_BAKES_ENABLED`. The auto-register path writes into `imageIndex` (so both are wired
      *  together). 🔴 main.ts boot-asserts `operatorPrincipals` is non-empty when this is on (never a
-     *  world-writable build-host-RCE door, §P2.4a). */
+     *  unrestricted-write build-host exec door, §P2.4a). */
     imageBakes?: ImageBake;
     /** P2 (design/73 §7.2): the outcome-fact sink, for the `GET /v1/outcomes` read aggregate. `summary` is
      *  present on the SQL ledgers; a File sink (no query surface) → the endpoint 501s honestly. */
@@ -172,7 +179,7 @@ export interface ServiceStoreDeps {
      *  OOM 形)。理由仍成立、结论改了 —— backend 依旧要整个传,因为四个 store 必须同源。
      *  The individual stores above are wired for the per-feature routes; the sync routes need the backend
      *  itself because they coordinate the four together (a route can't reassemble it from the parts —
-     *  `backend.session()`/`fileSnapshot()`/`sessionPolicy()`/`resumeAnchor()` must come from ONE backend). Present
+     *  `backend.session()`/`fileHistory()`/`sessionPolicy()`/`resumeAnchor()` must come from ONE backend). Present
      *  whenever a durable backend (tidb/pg/local) is; absent on the env-only/no-backend worker (the routes 501). */
     backend?: StoreBackend;
     /** #154 车二:**持久化权限规则的同意车道**(core design/179 三步协议的宿主半场)。
@@ -312,7 +319,7 @@ export interface ServiceSeamDeps {
      * #345(core 5.57.0 `routePairingStatus`)—— **key↔URL 配对读面**:`GET /v1/models` 每行的
      * `routePairing` 标注就是拿这一只判的。main.ts 接的是**装配好的那只 brain 本身**(不是摘出来的
      * 函数引用:A-057.2 那条「裸摘引用丢接收者」的教训同款,且 core 的装饰器族是按 `stream` 的同一条
-     * 路再分派 `adjudicateRoute` 的,整只传才不会绕过路由/快切层)。
+     * 路再分派 `adjudicateRoute` 的,整只传才不会跳过路由/快切层)。
      *
      * 🔴 缺席 ⇒ 该面每行标 `"unknown"`,**绝不猜**:一只没有 `adjudicateRoute` 面的自定义 brain 是
      * core 明令「callers must treat that as 'no judgment', never as OK or as broken」的形。测试夹具
@@ -403,6 +410,12 @@ export interface ServiceSeamDeps {
         run(scope: string): Promise<ConsolidationRunReceipt>;
         lastRun(scope: string): ConsolidationDriverRunRow | undefined;
     };
+    /** design/383 §3.1 / S-50 §1.3(S-49 S-2):per-principal memory-capture opt-out 授权表的管理面
+     *  (`/v1/admin/memory-optout` 四口,operator-only)—— `backend.memoryOptOutGrant()` 的同一只(与
+     *  `RuntimeCaps.allowMemoryOptOut` 的 resolver 腿读同一张表,零缓存直读 ⇒ 写后下一次 prepare 即生效)。
+     *  缺席 = 本部署没有 SQL 后端(local 车道刻意无源)⇒ 四口 501 `capability.memory_optout_grant_required`
+     *  (「换部署形态」族;与 consolidation 阀门的 404 分家:这里不是旋钮没开,是店在本部署上不存在)。 */
+    memoryOptOutGrant?: import("../plugins/memory-optout-grant-store-sql.js").MemoryOptOutGrantStore;
     /** design/170 件A §7 —— org 记忆授权目录,`boot/org-memory.ts` 装配的**同一个实例**(准入 seam 与
      *  本面共享它的 TTL 缓存/退避窗/gen 高水位)。memory-policy 面的 `org:` 属主门用它回答成员性:
      *  读面要该 scope 在授权表里、写面另要条目 `write === true`。缺席=本部署没有目录源 ⇒ `org:` 键
@@ -605,6 +618,15 @@ export interface ServiceDeploymentDeps {
      *  proxy. Orthogonal to `workflowsList` (the durable-list axis = `workflowRunStore`). Falls back to the store
      *  proxy when absent (older callers / tests that don't pass it). */
     workflowsCapable?: boolean;
+    /** [5673]③ + codex R1-[medium]:`capabilities.workflowModels` 的**引擎快照席**。main.ts 在 boot 期用
+     *  `workflowModelAllowlistFor(config)` 算一次(与 createRunnerDeps 喂给 core `workflowGovernanceBaseline.
+     *  workflowModelAllowlist` 的同一只函数、同一 config 代际),多租户 fail-closed 的 undefined 在装配点
+     *  折 `[]` ⇒ 生产装配下本席**恒在场**。为什么不让能力面每请求活派生:core 5.49 起 models plane 经
+     *  `Runner.swapModels` 永久热,而 governance allowlist 是 Runner 构造期快照 —— 活派生会在热加目录键后
+     *  长期广告一个 core 必拒的词(教学面超前执法面,直到重启)。广告**引擎真快照**让「能力面教的」与
+     *  「core 收到的 allowlist」结构性恒等。缺席(遗留 stub 装配)⇒ 能力面回落活 config 派生(测试便利,
+     *  生产路径到不了)。 */
+    workflowModelAllowlist?: readonly string[];
 }
 /** **数值旋钮**:部署可调的上限/拍距。缺省值写在消费点(`?? 256` 之类),此处只承载覆写。 */
 export interface ServiceKnobDeps {
@@ -711,22 +733,22 @@ export declare function isBillableSubmitPath(url: string): boolean;
  *  · `POST /v1/rules/cc-import/*` —— principal lane 的**持久 allow 规则**铸造口;一条持久 allow 规则对后续
  *    同命令的 classify 档 ask 常驻消音(core #144 之后仍然如此,只是不再消 mandated 的那些)。
  *  · `DELETE /v1/rules` —— 同一个规则店的**撤销**口。方向相反(收紧)但同样是持久改写,而且它多一条
- *    operator 越权域(`?principal=` / body 的 `principal` 让 operator 收回**任一**租户的规则)⇒ 伪造一个
+ *    operator 超范围域(`?principal=` / body 的 `principal` 让 operator 收回**任一**租户的规则)⇒ 自造一个
  *    列在 `OPERATOR_PRINCIPALS` 里的头,就能把每一位租户的规则一次清空。
  * 无 service token 的部署上 `verifiedPrincipal` 走的是「BFF/gated:头已由上游验过」那一支,而这一形恰恰
- * 是**没有**那个上游 —— 于是伪造一个头就能收编别人、替任意租户种下常驻放行、或替他们全删。bake 门当年
+ * 是**没有**那个上游 —— 于是自造一个头就能收编别人、替任意租户种下常驻放行、或替他们全删。bake 门当年
  * 补的就是同一句话,`isDestructiveSessionWrite` 从逐条路由白名单改成族判定也是同一句话(那次的措辞逐字是
  * 「a forged principal header alone could **tighten/DoS** a session's tools」——撤销口落的正是 DoS 那一半)。
  *
- * 🔴 **方法感知**(codex 对抗复审 R2-[high],验真后修):撤销走的是 `DELETE`,而本门最初只挂在 `POST` 的
+ * 🔴 **方法感知**(codex 交叉复审 R2-[high],验真后修):撤销走的是 `DELETE`,而本门最初只挂在 `POST` 的
  * 合取里 —— 于是一个自称「持久改写」的谓词把爆炸半径最大的那条动词漏在门外,正是 `isDestructiveSessionWrite`
  * 当年被抓到的同一形。签名因此收方法,与那只谓词逐字同形。
  * 🔴 读面**原则上**不进本表:`GET /v1/adoption/:id` 与 `GET /v1/rules` 各有自己的**属主门**兜底,本门只拦写。
  *
- * 🔴 **第二个合取项的加宽**(codex 对抗复审 [high],#277 提货批,验真后修)——判据现在是
+ * 🔴 **第二个合取项的加宽**(codex 交叉复审 [high],#277 提货批,验真后修)——判据现在是
  * 「持久改写 **或** 授权唯一输入是 principal 头的**跨租户治理读**」。加宽是为了收进 #264 v2-c 的两口:
  *  · `POST /v1/memory/import` —— 直接落在**原**判据上,而且是本仓最深的那一种持久改写:它把别处铸的
- *    条目 / 挑战 / 污染标记 / 托管链落进本部署的记忆平面。伪造一个在册 operator 头 ⇒ 一份**攻击者自制的
+ *    条目 / 挑战 / 污染标记 / 托管链落进本部署的记忆平面。自造一个在册 operator 头 ⇒ 一份**不当调用方自制的
  *    治理史**成为本店的账;而记忆是模型**每次挂载都读**的面,比种一条常驻 allow 规则更深(那条只影响
  *    ask 会不会问,这条影响模型相信什么)。
  *  · `POST /v1/memory/export` —— 是**读**,按原措辞本不该进。但被点名豁免的那两条读各有属主门兜底,