@sema-agent/server 7.51.0 → 7.52.0

package/dist/http/server.js

@@ -10,7 +10,7 @@ import { verifyDirectDoorProof } from "../principal-jwt.js";
 import {} from "../memory-sync.js";
 import { MAX_SETTINGS_OUTPUT_STYLE_CHARS, MAX_SETTINGS_PERMISSION_RULES, MAX_SETTINGS_ENV_VARS, MAX_SETTINGS_ENV_KEY_CHARS, MAX_SETTINGS_ENV_VALUE_CHARS } from "../task-settings.js";
 import { parseHooksConfig } from "../hooks/hook-runner.js";
-import { normalizeApproachNotice, validateTaskAgents } from "../spec-fields.js";
+import { normalizeApproachNotice, unknownTaskAgentModelRef, validateTaskAgents } from "../spec-fields.js";
 import { isValidCwd, MAX_ADDITIONAL_DIRS } from "../task-cwd.js";
 import { runInBackground, evictIfConflict, stripCheckpointToken, parkToolCallId, TurnAnchorCapture, HEARTBEAT_MS, markChildrenStoppedByUserOnAbort } from "../runs.js";
 import { readTurnActivityMs, recordTurnActivity } from "../turn-activity.js";
@@ -43,6 +43,7 @@ import { handleAdoption } from "./routes/adoption.js";
 import { handleRetention } from "./routes/retention-ops.js";
 import { handleAdminDrain } from "./routes/admin-drain.js";
 import { handleAdminConfigRefresh } from "./routes/admin-config-refresh.js";
+import { handleMemoryOptOut } from "./routes/admin-memory-optout.js";
 import { handleMemoryPolicy } from "./routes/memory-policy.js";
 import { handleMemoryBundle } from "./routes/memory-bundle.js";
 import { handleMemoryCompliance } from "./routes/memory-compliance.js";
@@ -63,6 +64,7 @@ import { handleNotifyWake, SESSION_WAKE_RE } from "./routes/notify-wake.js";
 import { handleApprovalsAssistant, streamApprovals, isQuestionAnswer, ASSISTANT_RESUME_RE, ASSISTANT_PLAN_REVIEW_RE } from "./routes/approvals-assistant.js";
 export { streamApprovals, isQuestionAnswer };
 import { handleRuns, handleRunVerbs, RUN_SUBAGENT_RESUME_RE } from "./routes/runs.js";
+import { handleRunMemoryCapture } from "./routes/run-memory-capture.js";
 import { handleSideQuery } from "./routes/side-query.js";
 import { handleTasks } from "./routes/tasks.js";
 import { handleLeader } from "./routes/leader.js";
@@ -136,6 +138,7 @@ const ROUTE_DOMAINS = [
     handleA2a,
     handleWorkflowAgentSteer,
     handleRunVerbs,
+    handleRunMemoryCapture,
     handleLeader,
     handleImages,
     handleApprovalsAssistant,
@@ -145,6 +148,7 @@ const ROUTE_DOMAINS = [
     handleRetention,
     handleAdminDrain,
     handleAdminConfigRefresh,
+    handleMemoryOptOut,
     handleMemoryPolicy,
     handleMemoryBundle,
     handleMemoryCompliance,
@@ -441,6 +445,8 @@ export function createHttpServer(rawDeps) {
             return;
         if (await handleRunVerbs(req, res, url, ctx))
             return;
+        if (await handleRunMemoryCapture(req, res, url, ctx))
+            return;
         if (await handleLeader(req, res, url, ctx))
             return;
         if (await handleImages(req, res, url, ctx))
@@ -459,6 +465,8 @@ export function createHttpServer(rawDeps) {
             return;
         if (await handleAdminConfigRefresh(req, res, url, ctx))
             return;
+        if (await handleMemoryOptOut(req, res, url, ctx))
+            return;
         if (await handleMemoryPolicy(req, res, url, ctx))
             return;
         if (await handleMemoryBundle(req, res, url, ctx))
@@ -490,7 +498,7 @@ export function createHttpServer(rawDeps) {
     function runnerFor(spec) {
         return deps.runnerFor?.(spec) ?? deps.runner;
     }
-    async function prepareSpec(req, res, bodyIn, onTypedFailure) {
+    async function prepareSpec(req, res, bodyIn, onTypedFailure, legFacts) {
         const body = bodyIn ?? (await readJson(req));
         if (!body || typeof body.objective !== "string") {
             sendError(res, 400, "request.field_invalid", "missing 'objective' string");
@@ -723,10 +731,22 @@ export function createHttpServer(rawDeps) {
             sendError(res, 400, "request.field_invalid", "rewindFiles must be a boolean");
             return null;
         }
+        if (body.restoreFiles !== undefined && typeof body.restoreFiles !== "boolean") {
+            sendError(res, 400, "request.field_invalid", "restoreFiles must be a boolean");
+            return null;
+        }
+        if (body.acceptPartialRestore !== undefined && typeof body.acceptPartialRestore !== "boolean") {
+            sendError(res, 400, "request.field_invalid", "acceptPartialRestore must be a boolean");
+            return null;
+        }
         if (body.memoryWrite !== undefined && typeof body.memoryWrite !== "boolean") {
             sendError(res, 400, "request.field_invalid", "memoryWrite must be a boolean (false = pause memory writes for this run)");
             return null;
         }
+        if (body.memoryCapture !== undefined && body.memoryCapture !== "off") {
+            sendError(res, 400, "request.field_invalid", "memoryCapture must be the string 'off' when present (the session-level memory-capture opt-out declaration; absent = capture as usual — there is no 'on' spelling)");
+            return null;
+        }
         if (body.requireExistingSession !== undefined && typeof body.requireExistingSession !== "boolean") {
             sendError(res, 400, "request.field_invalid", "requireExistingSession must be a boolean");
             return null;
@@ -808,6 +828,13 @@ export function createHttpServer(rawDeps) {
                 sendError(res, 400, "request.field_invalid", agentsErr);
                 return null;
             }
+            const agentsBare = deps.config.models ?? {};
+            const agentsCatalog = expandTiers(agentsBare, deps.config.tiers ?? {}) ?? agentsBare;
+            const um = unknownTaskAgentModelRef(body.agents, agentsCatalog);
+            if (um !== undefined) {
+                sendError(res, 400, "request.unknown_reference", `unknown agents[${um.index}].model "${um.ref.slice(0, 120)}" — not in the configured catalog (a catalog name or tier word)`, { available: mentionableNames(deps.config, agentsCatalog) });
+                return null;
+            }
         }
         if (body.interactiveTools !== undefined && typeof body.interactiveTools !== "boolean") {
             sendError(res, 400, "request.field_invalid", "interactiveTools must be a boolean");
@@ -932,7 +959,7 @@ export function createHttpServer(rawDeps) {
         }
         try {
             const auth = deps.authorize ? await deps.authorize({ req, body }) : undefined;
-            const spec = await deps.resolveSpec(body, req, auth, { leg: "fresh" });
+            const spec = await deps.resolveSpec(body, req, auth, { leg: "fresh", ...(legFacts?.liveStream === true ? { liveStream: true } : {}) });
             return { spec, runner: runnerFor(spec), auth, verify, cascade, jobId: body.jobId, body };
         }
         catch (err) {
@@ -948,21 +975,52 @@ export function createHttpServer(rawDeps) {
         }
     }
     const resumeFleetScope = (req, auth) => req ? (gatedPrincipal(req, deps.config) ?? "default") : (auth.principal ?? "default");
-    async function resumeCheckpoint(sessionId, decision, reason, settledBy, req, answer, binding, onResumeCommitted, acceptEarly) {
+    async function resumeCheckpoint(sessionId, decision, reason, settledBy, req, answer, binding, onResumeCommitted, acceptEarly, decider) {
         const cs = deps.checkpointStore;
         const token = await cs.findPendingTokenBySession(sessionId);
         if (binding?.checkpointToken && binding.checkpointToken !== token) {
-            const seen = await cs.get(binding.checkpointToken).catch(() => null);
+            let seenUnreadable = false;
+            const seen = await cs.get(binding.checkpointToken).catch((e) => {
+                seenUnreadable = true;
+                recordFailOpen("server.approvals.stale-echoed-token-unreadable", `session=${sessionId} err=${e instanceof Error ? e.message : String(e)}`);
+                return null;
+            });
             const attributable = seen !== null && seen.sessionId === sessionId;
             if (!attributable && seen !== null) {
                 deps.logger?.warn?.("approval_stale_token_foreign", { sessionId, tokenSession: seen.sessionId ?? null });
             }
+            if (!token && !attributable && !seenUnreadable) {
+                deps.logger?.info?.("approval_decide_no_pending", { sessionId, staleTokenEchoed: true });
+                return { status: 404, body: { error: "approval not found", errorCode: "not_found.approval" } };
+            }
+            let currentPending;
+            if (token && decider !== undefined) {
+                const cur = await cs.get(token).catch((e) => {
+                    recordFailOpen("server.approvals.stale-current-pending-unreadable", `session=${sessionId} err=${e instanceof Error ? e.message : String(e)}`);
+                    return null;
+                });
+                const curPa = cur?.pendingAction;
+                const curOwner = cur ? decodeCheckpointScope(cur.scope) : undefined;
+                const scopeOk = cur !== null && (decider.explicitOperator || curOwner === undefined || curOwner === decider.principal);
+                if (cur && cur.sessionId === sessionId && !scopeOk) {
+                    deps.logger?.info?.("approval_decide_no_pending", { sessionId, staleTokenEchoed: true, foreignCurrentSuppressed: true });
+                    return { status: 404, body: { error: "approval not found", errorCode: "not_found.approval" } };
+                }
+                if (cur && cur.status === "pending" && cur.sessionId === sessionId && scopeOk && curPa?.kind === "tool_approval" && curPa.toolCallId) {
+                    currentPending = {
+                        toolName: curPa.toolName,
+                        boundCallId: curPa.toolCallId,
+                        ...(curPa.boundInputHash ? { boundInputHash: curPa.boundInputHash } : {}),
+                    };
+                }
+            }
             return {
                 status: 409,
                 body: {
                     error: "the approval you are deciding is no longer current (already resolved or superseded since you viewed it)",
                     errorCode: "approval_stale",
                     ...(attributable ? { terminal: "resolved" } : {}),
+                    ...(currentPending ? { currentPending } : {}),
                 },
             };
         }
@@ -982,6 +1040,13 @@ export function createHttpServer(rawDeps) {
         }
         if (!cp)
             return { status: 404, body: { error: "checkpoint not found", errorCode: "not_found.checkpoint" } };
+        if (decider !== undefined && !decider.explicitOperator) {
+            const cpOwner = decodeCheckpointScope(cp.scope);
+            if (cpOwner !== undefined && cpOwner !== decider.principal) {
+                deps.logger?.warn?.("approval_decide_row_scope_mismatch", { sessionId, note: "loaded pending row is foreign to the verified caller — TOCTOU fold" });
+                return { status: 404, body: { error: "approval not found", errorCode: "not_found.approval" } };
+            }
+        }
         const decideGateKind = cp.gate?.kind;
         if (!isApprovalGateKind(decideGateKind)) {
             const activeForPath = decideGateKind
@@ -1009,6 +1074,13 @@ export function createHttpServer(rawDeps) {
                 },
             };
         }
+        const paForGrant = cp.pendingAction.kind === "tool_approval" ? cp.pendingAction : undefined;
+        const loadedGrantTool = paForGrant !== undefined && paForGrant.toolName && paForGrant.toolName !== "AskUserQuestion"
+            ? paForGrant.toolName
+            : null;
+        const boundGrant = onResumeCommitted
+            ? (overrideSessionId) => onResumeCommitted({ ...(overrideSessionId !== undefined ? { overrideSessionId } : {}), validatedToolName: loadedGrantTool })
+            : undefined;
         if (req !== undefined && deps.backgroundAgentStore !== undefined && deps.parkedReviveTool !== undefined) {
             const parked = await decideParkedAgent({
                 agentStore: deps.backgroundAgentStore,
@@ -1022,7 +1094,7 @@ export function createHttpServer(rawDeps) {
                 token, scope: cp.scope, sessionId: cp.sessionId, pendingAction: cp.pendingAction,
                 decision, settledBy, ...(reason !== undefined ? { reason } : {}),
                 ...(binding !== undefined ? { binding: { ...(binding.boundCallId !== undefined ? { boundCallId: binding.boundCallId } : {}), ...(binding.boundInputHash !== undefined ? { boundInputHash: binding.boundInputHash } : {}), ...(binding.updatedInput !== undefined ? { updatedInput: binding.updatedInput } : {}) } } : {}),
-                ...(onResumeCommitted ? { grantRemember: (rootSessionId) => onResumeCommitted(rootSessionId) } : {}),
+                ...(boundGrant ? { grantRemember: (rootSessionId) => boundGrant(rootSessionId) } : {}),
                 ...(answer !== undefined ? { answer } : {}),
             });
             if (parked !== undefined) {
@@ -1091,7 +1163,7 @@ export function createHttpServer(rawDeps) {
             settledBy,
         };
         const verifyRounds = verifyRoundsFromBody(ctx.body);
-        return driveResumeIntoRunLog({ runner: runnerFor(spec), token, sessionId: cp.sessionId, principal: auth.principal, fleetScope: resumeFleetScope(req, auth), taskConfig, resumeObjective, outcome, verifyRounds, ...(onResumeCommitted ? { onResumeCommitted } : {}), ...(acceptEarly === true ? { acceptEarly: true } : {}) });
+        return driveResumeIntoRunLog({ runner: runnerFor(spec), token, sessionId: cp.sessionId, principal: auth.principal, fleetScope: resumeFleetScope(req, auth), taskConfig, resumeObjective, outcome, verifyRounds, ...(boundGrant ? { onResumeCommitted: boundGrant } : {}), ...(acceptEarly === true ? { acceptEarly: true } : {}) });
     }
     async function driveResumeIntoRunLog(args) {
         if (args.acceptEarly !== true)
@@ -1158,6 +1230,17 @@ export function createHttpServer(rawDeps) {
             ? fleetRunPublisher(deps.fleetBus, { runId: taskId, scope: fleetScope, rootTaskId: taskId, ...fleetRunLabels(resumeObjective) })
             : undefined;
         const resumeTaskConfig = taskId ? { ...taskConfig, taskId } : taskConfig;
+        if (deps.toolApproval && taskId) {
+            const toolApproval = deps.toolApproval;
+            resumeTaskConfig.onAsk = approvalLeg.windowZero
+                ? () => Promise.resolve(toolApproval.unattendedAskOutcome())
+                : toolApproval.boundAsk({
+                    owner: principal ?? null,
+                    taskId,
+                    sessionId,
+                    ...(approvalLeg.active ? { legKey, ...(legDeadlineMonotonic !== undefined ? { legDeadlineMonotonic } : {}) } : {}),
+                });
+        }
         if (taskId && resumeTaskConfig.resourceSuspend)
             recordResumeResourceWindow(taskId, resumeTaskConfig.resourceSuspend);
         let fleetSettled = false;
@@ -1189,7 +1272,7 @@ export function createHttpServer(rawDeps) {
         const cancelCtrl = new AbortController();
         const preemptCtrl = new AbortController();
         if (taskId && deps.runStore) {
-            claimedRow = freshRunClaimed ? true : await deps.runStore.markResuming(taskId);
+            claimedRow = freshRunClaimed ? true : await deps.runStore.markResuming(taskId, deps.instanceId ?? "default");
             if (!claimedRow)
                 return { status: 409, body: { error: "run is not in a resumable (suspended) state (already resumed, decided, or expired)", errorCode: "conflict.not_resumable" } };
             markChildrenStoppedByUserOnAbort(cancelCtrl.signal, taskId, principal);
@@ -2118,7 +2201,7 @@ export function createHttpServer(rawDeps) {
             ...(req.gateBoundInputHash !== null ? { boundInputHash: req.gateBoundInputHash } : {}),
             ...(req.updatedInput !== undefined ? { updatedInput: req.updatedInput } : {}),
         };
-        const out = await resumeCheckpoint(cp.sessionId, req.decision, req.note, "human", req.httpReq, undefined, binding, undefined, true);
+        const out = await resumeCheckpoint(cp.sessionId, req.decision, req.note, "human", req.httpReq, undefined, binding, undefined, true, { principal: req.principal, explicitOperator: false });
         return { status: out.status, body: out.body };
     }
     const isRunLiveOnThisReplica = (taskId) => inflightRuns.has(taskId) || steerableRuns.has(taskId);
@@ -2162,22 +2245,28 @@ export function isCredentialGatedRewrite(method, url) {
     if (m === "POST") {
         return (url === "/v1/adoption" ||
             url.startsWith("/v1/rules/cc-import/") ||
+            url.startsWith("/v1/rules/local-import/") ||
             url === "/v1/memory/import" ||
             url === "/v1/memory/export" ||
             url === "/v1/memory/erase" ||
             url.startsWith("/v1/memory/origin/entries/"));
     }
+    if (m === "PUT")
+        return url === "/v1/admin/memory-optout" || url.startsWith("/v1/admin/memory-optout/");
     if (m === "DELETE")
-        return url === "/v1/rules";
+        return url === "/v1/rules" || url.startsWith("/v1/admin/memory-optout/");
     if (m === "GET") {
         return (/^\/v1\/memory\/entries\/[^/]+\/provenance$/.test(url) ||
             url === "/v1/memory/origin/external" ||
-            url === "/v1/memory/origin/clearances");
+            url === "/v1/memory/origin/clearances" ||
+            url === "/v1/admin/memory-optout");
     }
     return false;
 }
 const ROUTE_LABEL_PATTERNS = [
     [/^\/v1\/runs\/[^/]+\/steer$/, "/v1/runs/:id/steer"],
+    [/^\/v1\/runs\/[^/]+\/memory\/capture-optout$/, "/v1/runs/:id/memory/capture-optout"],
+    [/^\/v1\/runs\/[^/]+\/interrupt$/, "/v1/runs/:id/interrupt"],
     [/^\/v1\/runs\/[^/]+\/detach$/, "/v1/runs/:id/detach"],
     [/^\/v1\/runs\/[^/]+\/cancel$/, "/v1/runs/:id/cancel"],
     [/^\/v1\/runs\/[^/]+\/compact$/, "/v1/runs/:id/compact"],
@@ -2195,10 +2284,12 @@ const ROUTE_LABEL_PATTERNS = [
     [/^\/v1\/approvals\/[^/]+\/decide$/, "/v1/approvals/:id/decide"],
     [/^\/v1\/approvals\/[^/]+\/exemptions(\/[^/]+)?$/, "/v1/approvals/:id/exemptions"],
     [/^\/v1\/sessions\/[^/]+\/(wake|fork|init|notify|events|head|mcp|a2a|policy|settings)$/, "/v1/sessions/:id/$verb"],
+    [/^\/v1\/admin\/memory-optout\/[^/]+$/, "/v1/admin/memory-optout/:principal"],
+    [/^\/v1\/sessions\/[^/]+\/memory\/erase$/, "/v1/sessions/:id/memory/erase"],
     [/^\/v1\/sessions\/[^/]+\/sync\/(manifest|entries|plan)$/, "/v1/sessions/:id/sync/$verb"],
     [/^\/v1\/sessions\/[^/]+\/sync\/import(\/[^/]+\/entries)?$/, "/v1/sessions/:id/sync/import"],
     [/^\/v1\/sessions\/[^/]+\/sync\/blobs(\/[^/]+)?$/, "/v1/sessions/:id/sync/blobs"],
-    [/^\/v1\/sessions\/[^/]+\/sync\/snapshots\/[^/]+\/blobs\/[^/]+$/, "/v1/sessions/:id/sync/snapshots/:key/blobs/:hash"],
+    [/^\/v1\/sessions\/[^/]+\/sync\/history\/blobs\/[^/]+$/, "/v1/sessions/:id/sync/history/blobs/:hash"],
     [/^\/v1\/sessions\/[^/]+\/workspace(\/[^/]+(\/(tree|file|archive))?)?$/, "/v1/sessions/:id/workspace"],
     [/^\/v1\/sessions\/[^/]+$/, "/v1/sessions/:id"],
     [/^\/v1\/assistant\/tasks\/[^/]+\/preempt$/, "/v1/assistant/tasks/:id/preempt"],
@@ -2240,8 +2331,10 @@ const ROUTE_LABEL_LITERALS = new Set([
     "/v1/adoption",
     "/v1/admin/drain",
     "/v1/admin/config/refresh",
+    "/v1/admin/memory-optout",
     "/v1/admin/memory/consolidation/run", "/v1/admin/memory/consolidation",
     "/v1/rules/cc-import/prepare", "/v1/rules/cc-import/redeem",
+    "/v1/rules/local-import/prepare", "/v1/rules/local-import/redeem",
     "/v1/rules",
     "/.well-known/agent-card.json", "/v1/a2a",
     "/v1/agents/roster",

package/dist/http/verify-rounds.d.ts

@@ -1,5 +1,5 @@
 /**
- * design/97 R9 — the verify-rounds shape (used by the developer-mode adversarial-verification gate, 1.44) pulled
+ * design/97 R9 — the verify-rounds shape (used by the developer-mode independent-verification gate, 1.44) pulled
  * out to a NEUTRAL LEAF: it was three copies of the same anonymous `{ maxRounds: number; costCeilingMicroUsd?:
  * number }` object type (route-ctx.ts ×2, runs.ts `runInBackground`'s public signature) plus four call sites in
  * http/server.ts that each re-derived the same "verify:true → clamp rounds + fold cost ceiling" expression from a

package/dist/http/wire-types.d.ts

@@ -75,7 +75,7 @@ export interface TaskRequestBody {
      *  (MAX_TASK_COST_USD / MAX_TASK_TOKENS) — a caller may ask for less, never more. */
     maxCostUsd?: number;
     maxTokens?: number;
-    /** Developer mode (1.44): run the task behind the adversarial verification gate (impl → independent
+    /** Developer mode (1.44): run the task behind the independent verification gate (impl → independent
      *  read-only verify → fix loop). Default off. `verifyRounds` is clamped to [1,5] (default 2). Not
      *  supported on /v1/tasks/stream (the gate is multi-round, not a single stream). */
     verify?: boolean;
@@ -100,7 +100,7 @@ export interface TaskRequestBody {
      *  `TaskSpec.skills`. Merged AFTER the scenario's skills with SCENARIO-WINS on a name clash (the security
      *  baseline can never be shadowed by user content — see mergeUserSkills). Caps: ≤10 skills, content ≤32KB
      *  each. User skills are user-authored content in the user's OWN principal-isolated task (self-harm
-     *  surface, not privilege escalation); scenario/center skills remain the only trusted layer. */
+     *  surface, not privilege widening); scenario/center skills remain the only trusted layer. */
     skills?: Array<{
         name: string;
         description: string;
@@ -163,14 +163,23 @@ export interface TaskRequestBody {
         count?: number;
         role?: string;
     };
-    /** Rewind-files (shell-host contract E19): opt-in — snapshot the working tree each completed turn + RESTORE it when a
-     *  `resumeAt` branch is taken ("rewind to this message" also rewinds the files). Requires a FileSnapshotStore; works for
-     *  ANY execution env since core's gate-split (1.134.0). OFF/absent ⇒ no snapshot/restore work. */
+    /** S-15 file restore (design/381): with `resumeAt`, ALSO converge the working tree's **agent-edited files**
+     *  (the tracked set — nothing else is visible to the history, so a user's parallel work is structurally
+     *  untouchable) to that entry's history boundary. Capture needs no request anymore: first-touch tracking is
+     *  always on when the deployment wires a history store. Requires a FileHistoryStore. */
+    restoreFiles?: boolean;
+    /** DV-15: opt-in tolerance for a PARTIAL file restore (default = loud terminal failure carrying the per-file
+     *  ledger; `true` = keep going and disclose the same ledger on the result's rewindNotes). */
+    acceptPartialRestore?: boolean;
+    /** RETIRED spelling (whole-tree epoch). Still accepted on the wire: its capture sense (true, no resumeAt) is
+     *  a tolerated no-op with a deprecation disclosure; its restore sense (true + resumeAt) is a typed rejection
+     *  naming `restoreFiles` — the restore semantics genuinely changed (whole tree ⇒ tracked set), so that
+     *  migration is explicit by design (core adjudicates; the server never remaps it silently). */
     rewindFiles?: boolean;
-    /** R8 code-only rewind (CC "Restore code" mode, core 1.166 `rewindFilesTo`): restore the working tree to the snapshot
-     *  at a prior USER message WITHOUT forking the conversation (the session leaf is untouched — only the files move). The
+    /** R8 code-only rewind (CC "Restore code" mode): converge the TRACKED set to the history boundary at a prior
+     *  USER message WITHOUT forking the conversation (the session leaf is untouched — only the files move). The
      *  value is the same handle as `resumeAt` (the prompt's taskId); the service resolves it → the entry id. Honored ONLY
-     *  when `resumeAt` is ABSENT (the two modes are mutually exclusive). Requires the anchor map + a FileSnapshotStore. */
+     *  when `resumeAt` is ABSENT (the two modes are mutually exclusive). Requires the anchor map + a FileHistoryStore. */
     rewindFilesTo?: string;
     /** design/131 (core 1.246): per-task resilience INTENT flags. allowDegrade/allowFailover are caller-facing;
      *  bypassBreaker is operator-only (resolveSpec drops it for non-operators — a permission downgrade, not a 400). */
@@ -294,6 +303,17 @@ export interface TaskRequestBody {
      *  adopt-on-read semantics: a paused run still sees the user's hand-edits and git-pull drops, it just commits
      *  nothing. Restriction is the session's DECLARATION, never the plane's structure. */
     memoryWrite?: boolean;
+    /** design/383 §2.1(core 7.0.0 片2/3;server S-49):**session 记忆采集 opt-out 声明** —— `"off"` = 「本会话
+     *  不进长期记忆」:单成员闭集,**没有** `"on"`(缺席就是照常采集的唯一形)。透传为 `TaskSpec.memory.capture`,
+     *  由 core 按部署姿态(`MEMORY_CAPTURE_POLICY`)+ 该 principal 的 `allowMemoryOptOut` verdict 裁:拒 = 403
+     *  `memory.capture_optout_denied`。**一次性**:声明落一条单向控制面记录,后续 resume 恒不采集(record wins),
+     *  同会话重复声明幂等;要回到采集只能开新会话。与 `memoryWrite:false`(本 run 只读平面,可逐 run 切换)
+     *  **不是一个轴**:那是「这次别写」,这是「这个会话永远别记」。
+     *  ⚠️ 拼写门**两腿同判、响亮拒**:fresh 400 `request.field_invalid`;resume 重放同判(不做 resume 降级 ——
+     *  把一条隐私请求按打字错误静默丢掉恰是 core 禁的方向;core 的 `config.memory_capture_spelling` 是第二道墙)。
+     *  记忆面暗的部署(引擎未接线 / 多租户)上本键随 `memory` 整体缺席而无处落 —— 那里本就零采集。
+     *  Rides the persisted body onto resume legs(与 memoryWrite 同姿势)。 */
+    memoryCapture?: "off";
     /** 142-S4 projectId 线程化(design/142 §2):这个 run 归属的项目(center 登记簿键,generic lowercase
      *  UUID — core S1 `resolveProjectId` marker 或 S3 无仓 mint 的产物;客户端只透传,零铸造权威)。是「哪个
      *  项目」的选择器,不是身份/capability — scope 的 tenant 段永远来自 verified principal。SHAPE 门在
@@ -387,4 +407,17 @@ export type DecideBinding = {
     /** design/37 edit: operator-corrected tool args, applied by core AFTER the binding check, on approve only. */
     updatedInput?: unknown;
 };
+/** S-02([5522]④→[5525] 坐标轮换判定):409 `approval_stale` 拒体上的 additive 机读指路 ——
+ *  **本会话当前 pending** 的 D-1 回显坐标,让持旧坐标的壳一跳重定位(免重拉列表)。
+ *  键名/键形与 GET /v1/approvals 的 pending 行逐字同名(壳复用同一解析)。
+ *  🔴 恒**不含** checkpointToken(runs.ts §12-C:resume 凭证从不外发);只在当前 pending **在场**、
+ *  属 tool_approval、且已过路由级 owner 门的域内铸 —— 无 pending / 非工具门 / 读失败 ⇒ 键缺席(不造键)。 */
+export type ApprovalStaleCurrentPending = {
+    /** 当前 pending 被门住的工具名(与 pending 行的 `toolName` 同源同值)。 */
+    toolName: string;
+    /** 当前 pending 的 `pendingAction.toolCallId` —— 壳重定位后 decide 时回显的 D-1 锚。 */
+    boundCallId: string;
+    /** 当前 pending 的 server 铸 `boundInputHash`(行上有才带;逐字回显,壳不重算)。 */
+    boundInputHash?: string;
+};
 //# sourceMappingURL=wire-types.d.ts.map

package/dist/leader/endpoint.d.ts

@@ -44,7 +44,7 @@ export interface LeaderEndpoint {
         status: number;
         body: object;
     } | null>;
-    /** 对抗复查 B-1(CRITICAL):the number of leader runs still RUNNING in the background — the drain gate
+    /** 交叉复查 B-1(CRITICAL):the number of leader runs still RUNNING in the background — the drain gate
      *  counts them (a SIGTERM used to see 0 and hard-shut mid-leader-run).
      *
      *  🔴 刻意**只数本副本**(即使 store 在场):drain 门问的是「这个进程还在驱动几条 run」,不是「全集群

package/dist/leader/leader.d.ts

@@ -94,7 +94,7 @@ export interface LeaderDeps {
         maxRepairs?: number;
     };
     /** core 1.72 native L3a (design/54 §4): when set, each worker runs via `runWithVerification` (run the module +
-     *  an ADVERSARIAL DECORRELATED verifier tries to break it reading the diff/workspace + a bounded fix-loop)
+     *  an INDEPENDENT DECORRELATED verifier tries to break it reading the diff/workspace + a bounded fix-loop)
      *  instead of plain fan-out. The worker runner's `models` catalog MUST carry the heterogeneous `verifierModel`
      *  (decorrelation = deployment contract). Mutually exclusive with `moduleGate` (this IS the native version). */
     verifyWorker?: VerifyConfig;

package/dist/leader/repair-oracle.d.ts

@@ -6,7 +6,7 @@
  * fixes the `OracleResult` shape + the read-only/identity contract; the composition lives HERE so the core type
  * never grows a discriminated union.
  *
- * Hardened by the adversarial round (§10):
+ * Hardened by the cross-review round (§10):
  *  - §10.1 HERMETIC grade: the grader tree is reset to a clean base (`git reset --hard <integBase> && git clean
  *    -fdx`) BEFORE applying the worker's LATEST full `base..HEAD` diff each call — so a 2nd/3rd attempt never
  *    applies cumulatively onto an already-applied tree (the BROKEN finding). The diff is recomputed fresh every
@@ -63,7 +63,7 @@ export interface RepairOracleCfg {
     };
     /** fork1.2 — paths the candidate patch must NOT touch (the seeded hidden-oracle / test paths).
      *  The §10.2 factory lane OMITs the engine's path-level probe, so a patch that EDITS the grader's oracle could
-     *  tamper with the grade and get rubber-stamped as `candidate_only`. A patch touching one of these is REFUSED
+     *  rewrite the grade and get rubber-stamped as `candidate_only`. A patch touching one of these is REFUSED
      *  as `needs_human_oracle` (surfaced for a human, never a silent candidate). Matched by exact path or subtree. */
     oraclePaths?: string[];
     /** 🔴 council 2026-06-17 — the seeded hidden-oracle files (path + content). The hermetic `git clean -fdx`

package/dist/leader/repair-oracle.js

@@ -36,7 +36,7 @@ export function mkRepairOracle(cfg) {
         if (tampered) {
             cfg.log?.("repair_oracle_tampering_guard", { path: tampered });
             cfg.onGraded?.({ diff: diff.patch, hash: diffHash, passed: false });
-            return { tier: "none", passed: false, flaky: false, retries: 0, trace: `candidate patch touches oracle/test path '${tampered}' — refusing to grade (fork1.2 test-tampering guard)` };
+            return { tier: "none", passed: false, flaky: false, retries: 0, trace: `candidate patch touches oracle/test path '${tampered}' — refusing to grade (fork1.2 test-alteration guard)` };
         }
         if (lastGradedHash !== undefined && diffHash === lastGradedHash) {
             cfg.log?.("repair_oracle_stale_diff", { hash: diffHash });

package/dist/main.js

@@ -30,6 +30,7 @@ import { setRedactionObserver, redactSecrets } from "./trace/redact.js";
 import { RateLimiter } from "./observability/rate-limit.js";
 import { createHttpServer, explicitOperatorOk, hasServiceAuth } from "./http/server.js";
 import { exportMemoryScope } from "./memory-export.js";
+import { workflowModelAllowlistFor } from "./task-workflow.js";
 import { createMemoryBundleFaces } from "./memory-bundle-engine.js";
 import { backendOwnsControlPlane, createMemoryComplianceFaces, createMemoryOriginFaces } from "./memory-operator-faces.js";
 import { performMemorySync } from "./memory-sync.js";
@@ -134,7 +135,7 @@ async function main() {
     if (adoptionBoot.scanned > 0 || adoptionBoot.error !== undefined) {
         logger.info("adoption_boot_scan", { ...adoptionBoot });
     }
-    const { brain, pricing, counterDegradeHook, costQuota, modelUsageTracker, promptManifestTracker, fleetUsage, fleetLease, tracer, sideQueryAccounting, toolResultStore, sessionPolicyStore, fileSnapshotStore, } = createBudgetAndTracing({ config, logger, metrics, backend, breakerState });
+    const { brain, pricing, counterDegradeHook, costQuota, modelUsageTracker, promptManifestTracker, fleetUsage, fleetLease, tracer, sideQueryAccounting, toolResultStore, sessionPolicyStore, fileHistoryStore, } = createBudgetAndTracing({ config, logger, metrics, backend, breakerState });
     const permissionRuleStores = config.permissionRulesEnabled && backend ? backend.permissionRule() : undefined;
     const ruleConsent = permissionRuleStores ? createRuleConsentLane(permissionRuleStores) : undefined;
     if (config.permissionRulesEnabled && permissionRuleStores === undefined) {
@@ -163,7 +164,8 @@ async function main() {
         getParkedRedeem: () => parkedAskRedeem,
         ruleScopeRootFor: (sessionId) => cardRuleScopeRoot(sessionId !== undefined ? perSessionCwd.get(sessionId) : undefined, config),
     });
-    const { principalCaps, centerRuntimeCapsResolver, runtimeCapsResolver } = createRuntimeCaps({ config, logger });
+    const memoryOptOutGrantStore = backend?.memoryOptOutGrant();
+    const { principalCaps, centerRuntimeCapsResolver, runtimeCapsResolver } = createRuntimeCaps({ config, logger, memoryOptOutGrant: memoryOptOutGrantStore });
     const orgMemoryAdmission = createOrgMemoryAdmissionWiring({ config, logger, metrics });
     const sharedMemoryStore = orgMemoryAdmission.directory !== undefined
         ? backend?.sharedMemoryStore?.(createSharedMemoryScopeAuthorizer({
@@ -238,12 +240,14 @@ async function main() {
         retentionExecutorWired: config.retentionSweep.intervalSec > 0 && retentionExecutor !== undefined && retentionLaneStore !== undefined,
     });
     const mcpRevocations = configCenter.takeMcpRevocations();
+    const workflowModelAllowlistSnapshot = workflowModelAllowlistFor(config) ?? [];
     const runnerDeps = createRunnerDeps({
         hands: commitHands,
         mcpRevocations,
         config, logger, metrics, localRoot, promptSource: configCenter.promptSource, rosterStore, backgroundAgentStore, mailboxStore, usageWindowStore, brain,
         pricing, tracer, outcomeSink, elicitation, question, toolApproval, sessionStore, memoryEngine,
-        memorySyncRunner, toolResultStore: runnerOffloadStore, sessionPolicyStore, runtimeCapsResolver, fileSnapshotStore,
+        memorySyncRunner, toolResultStore: runnerOffloadStore, sessionPolicyStore, runtimeCapsResolver, fileHistoryStore,
+        legacyRewindBoundaryProbe: backend?.legacyRewindBoundaryProbe ? backend.legacyRewindBoundaryProbe.bind(backend) : undefined,
         permissionRuleStore: permissionRuleStores?.provider,
         executionEnvFactory, lspManager, fleetBus, deploymentHooks, workflowRunStore, workflowJournalStore,
         workflowAgentRegistry, workflowNotifyGate, workflowCompletionInbox, deliverWorkflowCompletion, orgMemoryAdmission,
@@ -452,7 +456,7 @@ async function main() {
     let runDenySweep;
     const reaper = startReapers({
         config, logger, metrics, localRoot, backend, subRunner, runStore, checkpointStore,
-        rateLimiter, costQuota, toolResultStore, fileSnapshotStore, taskAttachmentStore, imageBakes, worktreeReap,
+        rateLimiter, costQuota, toolResultStore, fileHistoryStore, taskAttachmentStore, imageBakes, worktreeReap,
         workflowNotifyGate, workflowRecoverOpts, workflowJournalStore, sqlWorkflowRunStore, workflowNotifyJournal, rosterStore,
         backgroundAgentStore, mailboxStore, toolApproval, permissionRuleStores,
         getRunDenySweep: () => runDenySweep,
@@ -521,7 +525,7 @@ async function main() {
         deviceStore: deviceLane?.store,
         dropSessionScoped,
         config, logger, metrics, localRoot, backend, sessionStore, runStore, checkpointStore, toolResultStore,
-        resumeAnchorStore, approvalExemptionStore, sessionPolicyStore, taskAttachmentStore, fileSnapshotStore,
+        resumeAnchorStore, approvalExemptionStore, sessionPolicyStore, taskAttachmentStore, fileHistoryStore,
         workflowCompletionInbox, taskListLane,
     });
     const leaderEndpoint = createLeaderFace({ config, logger, brain, pricing, executionEnvFactory, toolResultStore, sessionStore, checkpointStore, governanceSeams, backend });
@@ -559,7 +563,7 @@ async function main() {
         checkpointStore,
         sessionPolicyStore: sessionPolicyStore ? sessionPolicyStore : undefined,
         ruleConsent,
-        fileSnapshotStore: fileSnapshotStore ? fileSnapshotStore : undefined,
+        fileHistoryStore: fileHistoryStore ? fileHistoryStore : undefined,
         toolResultStore,
         taskAttachmentStore: taskAttachmentStore ? taskAttachmentStore : undefined,
         backgroundAgentStore: backgroundAgentStore ? backgroundAgentStore : undefined,
@@ -606,6 +610,7 @@ async function main() {
         memoryCompliance: memoryComplianceFaces,
         memoryOriginFace: memoryOriginFaces,
         memoryConsolidation: memoryConsolidationFaces,
+        memoryOptOutGrant: memoryOptOutGrantStore,
         orgMemoryDirectory: orgMemoryAdmission.directory,
         sharedMemoryStore: sharedMemoryStore ? sharedMemoryStore : undefined,
         sessionMirrorRuling: principalCaps
@@ -639,6 +644,7 @@ async function main() {
         modelReady: () => configCenter.modelReady(),
         scenarioDetails,
         workflowsCapable,
+        workflowModelAllowlist: workflowModelAllowlistSnapshot,
         staticWiring,
         memoryPosture,
         instanceId,
@@ -678,6 +684,7 @@ async function main() {
         sessionEnvSelection,
         lockedKeys: governanceSeams.lockedKeys,
         liveQuestionFace: question,
+        approverSeat: createRunnerDepsOnAsk(toolApproval),
     });
     const runnerFor = (spec) => pickHandsRunner(handsLanes.laneOf(spec), { full: runner, handsless: handslessRunner });
     const sideQuery = createSideQueryLane({ brain, config, getKeyResolver: () => configCenter.getKeyResolver() });

package/dist/memory-bundle-engine.d.ts

@@ -29,7 +29,7 @@
  * HTTP 面诚实 501。
  *
  * 🔴 首版把这件事当成**运行期**事实(照常挂载,让 core 每次抛 `memory.export_incomplete` / 422),
- * 被 codex 对抗复审驳倒(#277 提货批 [medium],验真后修):`typeof backend.exportSnapshotOf === "function"`
+ * 被 codex 交叉复审驳倒(#277 提货批 [medium],验真后修):`typeof backend.exportSnapshotOf === "function"`
  * 是一次**属性检查**,boot 期就判得出;而且它是**永久**缺席(换后端才会变),不是瞬时状态。照旧挂着
  * 就成了「能力位说 yes、每一次调用都确定性失败」——本仓「says yes ⟺ route works」是结构性承诺,
  * 一个恒假的 yes 会让壳给用户开出一条走不通的迁移流程。

package/dist/memory-operator-faces.d.ts

@@ -23,7 +23,7 @@
  * Runner 每任务现构的引擎会看到**两个不同的控制面**。
  *
  * ⇒ 裁:`controlPlaneRoot` 缺席 ⇒ 本工厂返回 **undefined**,两口整个不挂载,HTTP 面诚实 501。今天满足这一
- * 条的只有 core 自带的 `FileMemoryEngineBackend`(它把控制面钉死在 config-root 一侧);本仓两只 SQL 记忆
+ * 条的只有 core 自带的 `FileMemoryEngineBackend`(它把控制面写死在 config-root 一侧);本仓两只 SQL 记忆
  * 孪生(`plugins/memory-engine-{pg,tidb}.ts`)没有这个面 ⇒ 在那些部署上两口不挂。SQL 控制面是 core 的候升件
  * (design/316 §0b-4 咨询单),**绝不**在本层为它们现造一个「够用的」控制面 —— 那是把一个 core 拒绝生产的
  * 半吊子治理面自己造出来,与 bundle 那条「a governance-less export is the laundering shape」同族。
@@ -36,7 +36,7 @@
  *
  * 判据是一次**属性检查**、boot 期就判得出、而且是**永久**缺席(换后端才会变)——不是瞬时状态。照旧挂着
  * 就成了「能力位说 yes、每一次调用都确定性失败」,而本仓「says yes ⟺ route works」是结构性承诺。
- * (这条纪律是 #264 提货批被 codex 对抗复审驳倒后立的,见 memory-bundle-engine.ts 头注。)
+ * (这条纪律是 #264 提货批被 codex 交叉复审驳倒后立的,见 memory-bundle-engine.ts 头注。)
  *
  * ⚠️ **刻意不把审计/托管/证据三个可选面编进构造判定**:`committedSnapshotOf` / `custodyOf` 缺席时 core
  * 明写要诚实答 `binding:"unknown"` / `contentState:"capability-absent"` / `custody:"capability-absent"`
@@ -70,7 +70,7 @@ export interface MemoryComplianceFaces {
     }) => Promise<MemoryErasureAttestation>;
 }
 /**
- * **选择子替身**的拦截谓词(codex 对抗复审 [critical],亲验复现后修 —— 复现器与结论逐条在
+ * **选择子替身**的拦截谓词(codex 交叉复审 [critical],亲验复现后修 —— 复现器与结论逐条在
  * `test/memory-compliance-http.test.ts` 的同名 describe 与 `test/memory-operator-faces.test.ts` 里)。
  *
  * ## 病(在 core 5.57.0 上实测,不是纸面推演)
@@ -82,7 +82,7 @@ export interface MemoryComplianceFaces {
  *    `__proto__` 那一下改的是克隆体的**原型**,于是这个键从 `Object.keys` 里消失;
  *  · core 的 `erasureRequestInvalid` 数的是 `Object.keys` ⇒ 只看见一个 `scope` ⇒ **判合法**;
  *  · 而两条执行腿的分派都写作 `"ids" in select`(engine.js:477 降级腿、file-backend.js:2614 证据腿),
- *    `in` **查原型链** ⇒ 继承来的 `ids` 赢,删的是攻击者点名的那批 id;
+ *    `in` **查原型链** ⇒ 继承来的 `ids` 赢,删的是不当调用方点名的那批 id;
  *  · 收执里的 `select` / `selectHash` 记的却是那个自有的 `scope`。
  * ⇒ **删掉的东西与凭据上写的不是同一批**,而这一口的全部意义就是那份可归档的凭据;删除不可回滚。
  *
@@ -94,7 +94,7 @@ export interface MemoryComplianceFaces {
  * 本仓禁止的形,而且悄悄改写调用方的请求会让它以为自己删的是别的东西)。
  *
  * 两个执法点共用**这一只**谓词:路由拿它出 400(wire 可见、有钉),seam 拿它 fail-closed 兜底(seam 是
- * 可导出模块,不能靠「今天只有一个调用方」这句话来安全;走到那一臂 = 路由的门被绕过了 = 装配 bug,
+ * 可导出模块,不能靠「今天只有一个调用方」这句话来安全;走到那一臂 = 路由的门被跳过了 = 装配 bug,
  * 500 fail-loud 是对的)。刻意不做「只在 seam 拦」:那样 wire 上就没有一句能测的诚实拒。
  *
  * 走法是**迭代**而非递归:体的深度只受体积上限约束,一个深嵌套的 JSON 能把递归版打爆栈(把一个