@sema-agent/server 7.52.1 → 7.54.0

package/dist/leader/fanout.d.ts

@@ -1,5 +1,5 @@
 /**
- * v2 MVP — leader fan-out composition layer (design/50 §3, V2-MVP-PLAN.md M1, core seam).
+ * v2 MVP — leader fan-out composition layer ([ref] §3, V2-MVP-PLAN.md M1, core seam).
  *
  * Runs N sub-task workers in parallel over `runner.runTaskStream` sharing ONE AbortController, bounded by a
  * Semaphore, with an overall deadline (no infinite wait — council#5), and a
@@ -7,7 +7,7 @@
  * snapshot — closing the late-registration race (council round-2). Returns a typed WorkerReport per worker (council#6 — the
  * Coordinator needs a defined shape to route diffs in merge(b)).
  *
- * ── 重复 spawn 的去重由谁负责(#193 车4 件1,台账 P1-9③ 更正)────────────────────────────────────
+ * ── 重复 spawn 的去重由谁负责([ref] 车4 件1,台账 P1-9③ 更正)────────────────────────────────────
  * 这段头注**曾经**写着 fan-out 带一道「concurrency claim(run-store createRun unique-key CAS)」并称
  * 「the rule-5 dual-session tax solved at worker scale」。亲读后裁定:那道 claim 全链路无人传,而且
  * **由构造即无效** —— 它的 CAS 键是 `(workerId, sessionId)`,而 sessionId 是 `wire.ts` 每次现铸的
@@ -41,15 +41,15 @@ export interface WorkerReport {
     error?: string;
     /** The worker's TaskResult.stats (tokens/cost/turns) — for the value-campaign cost accounting. */
     stats?: TaskResult["stats"];
-    /** design/52 L3a module sub-gate: did this worker's module pass the per-module judge (after any repair)? */
+    /** [ref] L3a module sub-gate: did this worker's module pass the per-module judge (after any repair)? */
     moduleJudge?: "pass" | "fail";
     /** Number of bounded repairs the module sub-gate spent on this worker (0 = passed first try). */
     repairs?: number;
-    /** design/74 Slice 6: the terminal checkpoint gate when a worker is still SUSPENDED (the leader auto-resumed
+    /** [ref] Slice 6: the terminal checkpoint gate when a worker is still SUSPENDED (the leader auto-resumed
      *  it up to its bound but it didn't fully complete — e.g. the overall deadline hit or the slice cap). Present
      *  ⇒ resumable: the operator/leader can escalate (more budget) or accept the belt-diff partial progress. */
     checkpointGate?: TaskResult["checkpointGate"];
-    /** design/74 Slice 6: the worker's terminal `TaskResult.errorCode` (e.g. `limits.max_cost_exceeded` on an
+    /** [ref] Slice 6: the worker's terminal `TaskResult.errorCode` (e.g. `limits.max_cost_exceeded` on an
      *  exhausted resume, `limits.max_turns_exceeded` — core 5.8.0 码名轴) — surfaced for /v1/leader observability. */
     errorCode?: TaskResult["errorCode"];
     /** LEADER-REPAIRLOOP-INTEGRATION §10.6 (THE push chokepoint): the `runRepairLoop` terminal a single-agent
@@ -95,7 +95,7 @@ export interface FanOutOptions {
      *  cancelled worker actually aborts (else the overall-timeout's `await work` can never unblock). Like the default
      *  path it need not catch — runOne maps a throw to failed/timeout. */
     runWorker?: (st: FanOutSubtask, signal: AbortSignal) => Promise<WorkerReport>;
-    /** Replan-lite C4 (design/68 §6): when a worker settles SUSPENDED, immediately cancelAll the rest — the
+    /** Replan-lite C4 ([ref] §6): when a worker settles SUSPENDED, immediately cancelAll the rest — the
      *  suspended worker itself has already settled (its stream is deregistered), so the cancel sweep cannot
      *  touch its checkpoint/paused env (the destroy-exemption falls out of the registration lifecycle). */
     cancelOnSuspend?: boolean;

package/dist/leader/grader-env-factory.d.ts

@@ -20,7 +20,7 @@
  * built. v1 reuses the integration sandbox (R1) + re-seeds it (R2) instead. **There is no config key that turns
  * such a factory on** — an earlier revision of this header named one and shipped a `throw`-only stub beside it,
  * but no such key ever existed in `config.ts`, so an operator following that text set an env var that did
- * nothing. Both the stub and the promise were removed (#193 车4 件3 / staleness ledger P2-9); the auto-accept
+ * nothing. Both the stub and the promise were removed ([ref] 车4 件3 / staleness ledger P2-9); the auto-accept
  * slice, when it happens, is a new design件 that lands its factory, its wiring and its knob in one batch.
  *
  * Everything here is additive + OFF by default: nothing in this file runs unless the Stage-2 seams call it behind

package/dist/leader/leader.d.ts

@@ -1,8 +1,8 @@
 /**
- * v2 MVP M4 — the leader orchestrator (design/50 §3, V2-MVP-PLAN.md). Composes the proven pieces into one
+ * v2 MVP M4 — the leader orchestrator ([ref] §3, V2-MVP-PLAN.md). Composes the proven pieces into one
  * callable API: Planner → fanOut (M1) → diff-out (M2) → merge(b) (M3) → Coordinator push.
  *
- * Worker-env model (design/68 §8 F2(a)): preferred = FACTORY env (runner-owned lifecycle; durable suspend only
+ * Worker-env model ([ref] §8 F2(a)): preferred = FACTORY env (runner-owned lifecycle; durable suspend only
  * yields a complete ownedEnv on this path) + diff-out via the worker's mandatory SELF-UPLOAD last step
  * (`fetchDiff`, diffup.ts). Compat = the original static env the leader owns: provision up-front, pull each
  * branch's diff OUT of the still-alive env (pullDiff), destroy every env in a `finally`.
@@ -16,7 +16,7 @@ import { type RunnerLike, type WorkerReport } from "./fanout.js";
 import { type ExecStreamLike } from "./diffout.js";
 import { type MergeDeps, type MergeResult } from "./merge.js";
 import { type TaskSpec, type VerifyConfig, type CheckpointToken, type ToolSpec, type RepairTerminal, type OracleTier, type RepairResult } from "@sema-agent/core";
-/** design/74 Slice 6: drive a worker's resource-suspend auto-resume to a terminal (or bound) state. Exported
+/** [ref] Slice 6: drive a worker's resource-suspend auto-resume to a terminal (or bound) state. Exported
  *  for unit tests. Loops `resume(token, slice)` WHILE the result carries a `resource_limit` checkpoint gate —
  *  NOT by status (the verify wrapper may surface a suspend as failed-with-token). Exits on: a terminal result
  *  (completed/failed → no gate), an exhausted budget (core fails the resume fast → no token/gate), a
@@ -44,16 +44,16 @@ export interface ProvisionedWorker {
     branch: string;
     /** base commit of THIS worker's env (drives `git format-patch <baseSha>..<branch>` diff-out). */
     baseSha: string;
-    /** runs the worker agent on this worker's env (static `executionEnv` or a factory — design/68 F2(a)). */
+    /** runs the worker agent on this worker's env (static `executionEnv` or a factory — [ref] F2(a)). */
     runner: RunnerLike;
     /** Static-env mode (M2 compat): pull the worker's branch diff OUT of its (post-task, still-alive) env. */
     diffEnv?: ExecStreamLike;
-    /** Factory-env mode (design/68 F2(a), preferred when set): fetch the diff the worker SELF-UPLOADED as its
+    /** Factory-env mode ([ref] F2(a), preferred when set): fetch the diff the worker SELF-UPLOADED as its
      *  mandatory last task step (presigned MinIO object) — the env is runner-owned and already gone. */
     fetchDiff?: () => Promise<import("./diffout.js").PullDiffResult>;
     /** Static-env mode only: the leader owns + destroys the env. Factory envs omit this — the runner's factory
      *  lifecycle destroys them, and a SUSPENDED worker's paused env is thereby exempt from the leader's reap
-     *  (design/68 row4/C4: destroying a suspended worker's env = expiring its resume token). */
+     *  ([ref] row4/C4: destroying a suspended worker's env = expiring its resume token). */
     destroy?: () => Promise<void>;
     spec: Omit<TaskSpec, "sessionId" | "signal">;
     /** Optional read-effect PROBE tools for the L3 verifier (verifyWorker path). The default verifierTools = the
@@ -71,7 +71,7 @@ export interface LeaderDeps {
     push: MergeDeps["push"];
     /** Integration test command (the merge gate) + repo dir inside the sandbox. */
     testCmd: string;
-    /** Optional truecorrect MEASURE (design/59): a thorough hidden-oracle command run IN the integration sandbox
+    /** Optional truecorrect MEASURE ([ref]): a thorough hidden-oracle command run IN the integration sandbox
      *  after the gate passes (NOT a gate) — offloads the measure from the control plane. Result in result.merge.measure. */
     measureCmd?: string;
     repoDir?: string;
@@ -80,7 +80,7 @@ export interface LeaderDeps {
     /** fan-out deadline + concurrency cap. */
     timeoutMs: number;
     maxConcurrency: number;
-    /** design/52 L3a — optional per-module sub-gate + bounded repair, run AFTER fan-out, BEFORE merge. For each
+    /** [ref] L3a — optional per-module sub-gate + bounded repair, run AFTER fan-out, BEFORE merge. For each
      *  completed worker: judge its module (diff) vs its sub-objective; on fail, re-run that ONE worker with the
      *  judge's feedback (bounded by maxRepairs, default 1) on its own still-alive env, then re-judge. A module that
      *  still fails is marked `failed` (merge quarantines it). Catches per-module escapes the end-integration test
@@ -93,12 +93,12 @@ export interface LeaderDeps {
         repairObjective: (sub: SubtaskSpec, reason: string) => string;
         maxRepairs?: number;
     };
-    /** core 1.72 native L3a (design/54 §4): when set, each worker runs via `runWithVerification` (run the module +
+    /** core 1.72 native L3a ([ref] §4): when set, each worker runs via `runWithVerification` (run the module +
      *  an INDEPENDENT DECORRELATED verifier tries to break it reading the diff/workspace + a bounded fix-loop)
      *  instead of plain fan-out. The worker runner's `models` catalog MUST carry the heterogeneous `verifierModel`
      *  (decorrelation = deployment contract). Mutually exclusive with `moduleGate` (this IS the native version). */
     verifyWorker?: VerifyConfig;
-    /** Replan-lite (design/68 §6): bounded, DETERMINISTIC reactions — no runtime DAG surgery. When set:
+    /** Replan-lite ([ref] §6): bounded, DETERMINISTIC reactions — no runtime DAG surgery. When set:
      *  worker failed → redispatch ×1 on a FRESH env (clean base; a crashed worker's half-written workspace is
      *  never reused) → still failed = collapse-remainder-to-single; verify FAIL (repair already bounded inside
      *  the verify loop) → collapse; structural merge conflict → collapse + record; budgetUsd exceeded → stop
@@ -151,7 +151,7 @@ export interface LeaderResult {
     route?: "single" | "fanout";
     /** Set when planning/provisioning failed before fan-out. */
     error?: string;
-    /** Replan-lite (design/68 §6): which trigger won arbitration + what was done. */
+    /** Replan-lite ([ref] §6): which trigger won arbitration + what was done. */
     replan?: {
         trigger: "suspended" | "budget" | "merge-conflict" | "verify-fail" | "worker-failed";
         redispatched?: string[];
@@ -163,7 +163,7 @@ export interface LeaderResult {
         workerId: string;
         sessionId: string;
     }>;
-    /** design/74 Slice 6 / task#16: the diff (uncommitted work auto-committed by the belt, then diff-out) of
+    /** [ref] Slice 6 / task#16: the diff (uncommitted work auto-committed by the belt, then diff-out) of
      *  workers that did NOT merge (failed / still-suspended). Their progress is otherwise lost — the merge only
      *  integrates COMPLETED workers — so surface it here for review/cherry-pick instead of silently dropping it
      *  (the migration-run loss: a network-failed worker's 4 commits vanished). Best-effort + non-empty only. */

package/dist/leader/merge.d.ts

@@ -1,5 +1,5 @@
 /**
- * v2 MVP M3 — merge(b), the hard bone (design/50 §7, V2-MVP-PLAN.md, search [25]/[26], council round-1).
+ * v2 MVP M3 — merge(b), the hard bone ([ref] §7, V2-MVP-PLAN.md, search [25]/[26], council round-1).
  *
  * The deterministic Coordinator integrates N completed workers' branches under FULL isolation:
  *   1. pull each worker's patch OUT of its container (M2 `pullDiff` — no creds go in).
@@ -65,7 +65,7 @@ export interface IntegrationRepair {
  * then VERIFIES no marker/.rej remains before continuing, and the downstream test gate still guards correctness.
  * Wired by the caller (provisionIntegrationSandbox); when unset, an apply conflict stays terminal exactly as before
  * (zero behaviour change). Reuses the IntegrationRepair sandbox + hands pattern → no new core/env seam (the seam
- * design/68 §8 feared for "adopting N half-done workspaces" is unnecessary for the conflict case).
+ * [ref] §8 feared for "adopting N half-done workspaces" is unnecessary for the conflict case).
  */
 export interface ConflictResolver {
     /** Max resolution attempts before giving up (each = one agent run + one marker/.rej re-check). */
@@ -112,7 +112,7 @@ export interface MergeDeps {
     repoDir?: string;
     /** Full test command run in the sandbox (the merge gate). */
     testCmd: string;
-    /** Optional truecorrect MEASURE (design/59): a thorough hidden-oracle command run IN the integration sandbox
+    /** Optional truecorrect MEASURE ([ref]): a thorough hidden-oracle command run IN the integration sandbox
      *  (E2B) right after the gate passes — offloads the measure from the CPU-contended control plane (the
      *  frontier-multi oracle-timeout fix). NOT a gate (does not affect `ok`); the result lands in MergeResult.measure
      *  for the caller to read as the objective truly-correct signal. Same place + env as the gate, just a thornier test. */

package/dist/leader/planner.d.ts

@@ -1,5 +1,5 @@
 /**
- * v2 MVP — LLM Planner (design/50 §3: leader = LLM-planner that splits a DAG + deterministic Coordinator).
+ * v2 MVP — LLM Planner ([ref] §3: leader = LLM-planner that splits a DAG + deterministic Coordinator).
  * Decomposes an objective into N **disjoint-file** sub-tasks via one model completion, then VALIDATES the plan
  * deterministically (the trust boundary: an LLM proposes, the Coordinator enforces — service[19] leaderless-
  * leader). Disjoint file-ownership is the invariant that lets workers run in parallel + merge without conflict.
@@ -14,17 +14,17 @@ export interface PlanOptions {
     maxSubtasks?: number;
     /** Extra repo/context guidance appended to the prompt (e.g. file layout, conventions). */
     context?: string;
-    /** Deployment knob (design/68 §11 A6, correctness-first): `false` = never fan out — `routePlan` skips the
+    /** Deployment knob ([ref] §11 A6, correctness-first): `false` = never fan out — `routePlan` skips the
      *  router model call entirely and returns the deterministic single route (zero routing cost, zero risk of a
      *  false fan-out). Default (undefined/true) = the router decides. */
     fanoutEnabled?: boolean;
-    /** Economic guard threshold (design/68 §7, search[83] ruling): an objective SHORTER than this never reaches
+    /** Economic guard threshold ([ref] §7, search[83] ruling): an objective SHORTER than this never reaches
      *  the router — deterministic single (a small task can't be economically decomposable; false-single is the
      *  cheap error side). Default 64 — deliberately below the route corpus's smallest fan-out case. */
     minFanoutChars?: number;
 }
 /**
- * Deterministic economic 防灾 guard (design/68 §7 / §11 D2, search [83] ruling (b)): the asymmetry is that a
+ * Deterministic economic 防灾 guard ([ref] §7 / §11 D2, search [83] ruling (b)): the asymmetry is that a
  * false fan-out is the -98% disaster while a false single merely runs slower — so every case decidable WITHOUT
  * the model resolves to single, for free. Pure function (unit-testable); the semantic judgments (sequential/
  * coupled/uncertain) stay with the router LLM, and "估不准回 single" is the collapse fallback (B3).
@@ -65,7 +65,7 @@ export declare function routePrompt(objective: string, opts?: PlanOptions): stri
  *  validated by `parsePlan` (the same disjointness/shape invariants the Coordinator depends on). */
 export declare function routePlan(objective: string, runRoute: (prompt: string) => Promise<string>, opts?: PlanOptions): Promise<SubtaskSpec[]>;
 /**
- * Decomposer quality gate (design/68 §5/§11 B1-B3): run the router, and on a rejected/unparseable plan retry
+ * Decomposer quality gate ([ref] §5/§11 B1-B3): run the router, and on a rejected/unparseable plan retry
  * the LLM AT MOST ONCE, then COLLAPSE TO SINGLE (never fail the task on a bad plan — single is almost always
  * the right fallback, and a false fan-out is the -98% disaster; a plan failure must not be louder than that).
  * `collapsed` carries the reason (observability: a collapse is a router-quality signal, not silent).

package/dist/leader/repair-oracle.d.ts

@@ -1,6 +1,6 @@
 /**
  * The PROFILE-injected `RepairOracle` closure for the leader's single-agent self-repair loop
- * (`runRepairLoop`, core design/78 / D1). See `sema-internal server/docs/LEADER-REPAIRLOOP-INTEGRATION.md` (§3.1 + the authoritative
+ * (`runRepairLoop`, core [ref] / D1). See `sema-internal server/docs/LEADER-REPAIRLOOP-INTEGRATION.md` (§3.1 + the authoritative
  * §10 corrected layer). The closure GRADES a worker's candidate in an ISOLATED grader env (the reused
  * integration sandbox, distinct from the worker env) and maps the result to a core `OracleResult`. core only
  * fixes the `OracleResult` shape + the read-only/identity contract; the composition lives HERE so the core type

package/dist/leader/wire.d.ts

@@ -1,15 +1,16 @@
 import { type Brain, type Model, type ModelRoles, type ModelPricing, type TaskSpec, type ExecutionEnvFactory, type RemoteExecutionEnv, type ToolResultStore, type SessionStore, type RunnerDeps } from "@sema-agent/core";
 import type { CheckpointStoreFull } from "../plugins/store-backend.js";
 import { type LeaderDeps, type LeaderResult } from "./leader.js";
+import { type DeploymentPostureSeats } from "../boot/runner-deps.js";
 import type { LeaderRequestBody } from "./endpoint.js";
 export interface LeaderWireConfig {
     /** Static-env compat mode (E2B only): the leader provisions/owns each env. Required when `envFactory` unset. */
     e2bApiKey?: string;
-    /** design/68 F2(a) + k8s lane: the per-task execution-env factory the service main already built for
+    /** [ref] F2(a) + k8s lane: the per-task execution-env factory the service main already built for
      *  REMOTE_EXEC (e2b or k8s/Kata) — workers and the integration sandbox run on envs from THIS factory.
      *  Requires `s3` (diff-out is the worker's self-upload; there is no leader-held env to pull from). */
     envFactory?: ExecutionEnvFactory;
-    /** Durable suspend/resume for SUB-WORKERS (design/68 C4): when set, each worker task carries the durable
+    /** Durable suspend/resume for SUB-WORKERS ([ref] C4): when set, each worker task carries the durable
      *  question/ask policy + checkpoint store, so a gated ask/AskUserQuestion SUSPENDS the worker (checkpoint +
      *  paused env) instead of failing — the trigger replan-lite C4 arbitrates on. Mirrors main.ts's per-task
      *  durable wiring; ctx is seeded at provision so the surfaced token is resumable on the single-agent path. */
@@ -31,11 +32,22 @@ export interface LeaderWireConfig {
      *  the resume dies with SessionError "Entry <leafId> not found" (found live: drill c3 deny path). */
     sessionStore?: SessionStore;
     /**
-     * design/170 件B/C/D(#252,codex R2-F1)—— 部署治理三座席,**原样递给本车道的每一只 Runner**。
+     * [ref] 件B/C/D([ref],codex R2-F1)—— 部署治理三座席,**原样递给本车道的每一只 Runner**。
      * 主车道的 `boot/governance-seams.ts` 是唯一属主(判据、拒启、解析全在那里),本字段只是把它的产物
      * 搬过来:一个进程里「这台部署禁哪些能力、锁了哪些键」只能有一个答案。缺席 = 与接线前逐字相同。
      */
     governance?: Pick<RunnerDeps, "compliancePostureResolver" | "lockedConfig" | "retentionPolicy">;
+    /**
+     * [ref](黑板 [ref])—— **部署姿态座席族**(readFace 四席 `readFace`/`readDenyPatterns`/`readDenyBuiltinTiers`/
+     * `readDenyBuiltinExclude` + `memoryDelegationEvidence`/`memoryProvenance`/`memoryCapturePolicy`/
+     * `delegationEntryCaps`),**原样递给本车道的每一只 Runner**。唯一属主 = `boot/runner-deps.ts` 的
+     * `buildDeploymentPostureSeats(config)`(主 runner / subRunner / run-local 的共享基座展开的就是它),
+     * `boot/leader.ts` 把**同一函数、同一 config** 的产物搬过来:一个进程里「这台部署的 READ 面 / 记忆姿态 /
+     * 委派 caps」只能有一个答案。缺席 = 展开空对象 = 五处字面量键缺席(与接线前逐字相同)。
+     * 修前(≤7.53)这五只 Runner 一席都没有:运维写的 READ_DENY_PATTERNS / MEMORY_DELEGATION_EVIDENCE 等对
+     * leader 编排的 planner / worker / repair / conflict 四类任务**静默不生效**(core 内建 deny 表仍在)。
+     */
+    deploymentPosture?: DeploymentPostureSeats;
     /** Worker model brain + catalog (the same the service runs tasks on). */
     brain: Brain;
     models: Record<string, Model>;
@@ -48,7 +60,7 @@ export interface LeaderWireConfig {
         name: string;
         email: string;
     };
-    /** design/68 A6 knob: false = router never fans out (deterministic single route, zero router cost). */
+    /** [ref] A6 knob: false = router never fans out (deterministic single route, zero router cost). */
     fanoutEnabled?: boolean;
     /** The model (a catalog name) the ROUTER/planner call runs on. The route is a trivial single-vs-fanout
      *  classification; running it on a heavy reasoning model (deepseek-v4-pro + reasoning) returns an EMPTY
@@ -65,7 +77,7 @@ export interface LeaderWireConfig {
      *  Env override: LEADER_CONFLICT_ROUNDS. Resolves the conflict in-place + keeps the other workers' work, instead
      *  of discarding all fan-out output and redoing single. Runs the strong (default) model with hands in the sandbox. */
     conflictRounds?: number;
-    /** design/68 §8 F2(a): when set, workers run on FACTORY envs (runner-owned lifecycle — the durable-suspend-
+    /** [ref] §8 F2(a): when set, workers run on FACTORY envs (runner-owned lifecycle — the durable-suspend-
      *  complete path; a suspended worker's paused env is exempt from the leader reap by construction) and diff-out
      *  is the worker's mandatory self-upload to this MinIO/S3 store (presigned per worker; creds adapter-held).
      *  Unset = the original leader-owned static-env mode (pullDiff compat). */
@@ -85,11 +97,11 @@ export interface LeaderWireConfig {
 /** The env surface wire needs (both the E2B and k8s adapters implement core's RemoteExecutionEnv). */
 type WireEnv = Pick<RemoteExecutionEnv, "exec" | "writeFile">;
 /**
- * Resume-safe worker staging (the design/68 F2(a) factory-env path). Runs adapter-side before the agent's
+ * Resume-safe worker staging (the [ref] F2(a) factory-env path). Runs adapter-side before the agent's
  * first workspace-touching call: seed the base repo at the worker branch + plant the upload script (so the
  * presigned URL never passes through the model).
  *
- * 🔴 BL-1 fix (design/74 Slice 6): on a RESOURCE-SUSPEND RESUME core re-invokes the `executionEnvFactory`,
+ * 🔴 BL-1 fix ([ref] Slice 6): on a RESOURCE-SUSPEND RESUME core re-invokes the `executionEnvFactory`,
  * producing a FRESH `withStaging` wrapper (`staged=undefined`) whose `stage()` runs AGAIN — AFTER core's
  * `resumeVM()` has already untar'd the snapshot onto the fresh pod (`resumeVM` is not a STAGED_METHOD, so it
  * is NOT intercepted by the staging proxy; the agent's first `exec` is what triggers `stage()`, lazily, and
@@ -134,7 +146,7 @@ export declare function leaderResourceConfig(env?: NodeJS.ProcessEnv): {
     workerBudgetUsd: number;
     workerLimits: Partial<TaskSpec>;
     presignTtlSec: number;
-    /** design/74 Slice 6: opt-in (LEADER_RESOURCE_SUSPEND=true) resource-slice suspend for workers. When set, a
+    /** [ref] Slice 6: opt-in (LEADER_RESOURCE_SUSPEND=true) resource-slice suspend for workers. When set, a
      *  worker SUSPENDS at the per-slice window (`sliceMaxCostUsd`) instead of failing at the budget, and the
      *  leader auto-resumes (resumeWithVerification) until the TOTAL (`totalBudgetUsd` = workerBudgetUsd) is spent
      *  — a budget overrun becomes a resumable pause, not a worker failure. ⚠️ 语义更新(core 5.11.0 B3,
@@ -160,7 +172,7 @@ export interface LeaderLoopConfig {
     measureGatesOn: boolean;
     repairLoopAttempts: number;
     oracleFlakyK: number;
-    /** replan-lite (design/68 §6) fan-out spend cap from LEADER_BUDGET_USD. Absent = replan-lite's own default
+    /** replan-lite ([ref] §6) fan-out spend cap from LEADER_BUDGET_USD. Absent = replan-lite's own default
      *  (unset env stays absent — existing contract untouched; see leaderLoopConfig doc below). */
     replanBudgetUsd?: number;
 }

package/dist/leader/wire.js

@@ -129,6 +129,7 @@ export function createLeaderRunner(cfg) {
     const { repairRounds, repairBudgetUsd, conflictRounds, repairLoopOn, measureGatesOn, repairLoopAttempts, oracleFlakyK, replanBudgetUsd, } = leaderLoopConfig({ repairRounds: cfg.repairRounds, conflictRounds: cfg.conflictRounds });
     const onNoticeSeat = createEngineNoticeSeat(cfg.logger);
     const governanceSeat = cfg.governance ?? {};
+    const deploymentPostureSeat = cfg.deploymentPosture ?? {};
     const mkRepair = (rawEnv, repoDir, oracleFiles) => {
         if (repairRounds <= 0)
             return undefined;
@@ -142,7 +143,7 @@ export function createLeaderRunner(cfg) {
                         throw new Error(`oracle still present after remove (${f.path}) — refusing repair (measurement integrity)`);
                 }
                 try {
-                    const runner = new Runner({ brain: cfg.brain, models: cfg.models, roles: cfg.roles, pricing: cfg.pricing, ...onNoticeSeat, ...governanceSeat, executionEnv: rawEnv, rootPath: repoDir });
+                    const runner = new Runner({ brain: cfg.brain, models: cfg.models, roles: cfg.roles, pricing: cfg.pricing, ...onNoticeSeat, ...governanceSeat, ...deploymentPostureSeat, executionEnv: rawEnv, rootPath: repoDir });
                     const objective = [
                         `The integrated project at ${repoDir} fails its build/test. Make the MINIMAL change to the working tree so this command exits 0 (cd into the repo and run it yourself to confirm):`,
                         `  ${testCmd}`,
@@ -185,7 +186,7 @@ export function createLeaderRunner(cfg) {
                         throw new Error(`oracle still present after remove (${f.path}) — refusing conflict-resolve (measurement integrity)`);
                 }
                 try {
-                    const runner = new Runner({ brain: cfg.brain, models: cfg.models, roles: cfg.roles, pricing: cfg.pricing, ...onNoticeSeat, ...governanceSeat, executionEnv: rawEnv, rootPath: repoDir });
+                    const runner = new Runner({ brain: cfg.brain, models: cfg.models, roles: cfg.roles, pricing: cfg.pricing, ...onNoticeSeat, ...governanceSeat, ...deploymentPostureSeat, executionEnv: rawEnv, rootPath: repoDir });
                     const objective = [
                         `A parallel worker '${workerId}' ported a module on its own branch, but applying its patch onto the already-integrated tree at ${repoDir} produced a MERGE CONFLICT (git apply --3way). The OTHER workers' patches already applied cleanly — integrate THIS worker's changes too, resolving the overlap.`,
                         `Resolve EVERY conflict in the working tree: open each file containing conflict markers (<<<<<<< / ======= / >>>>>>>) and merge BOTH sides' real intent (keep both workers' behaviour — never drop one side just to make it apply). Then apply any rejected hunks recorded in *.rej files by hand, and DELETE every *.rej and *.orig file.`,
@@ -248,7 +249,7 @@ export function createLeaderRunner(cfg) {
             if (Array.isArray(body.subtasks) && body.subtasks.length > 0) {
                 return validateSubtasks(body.subtasks);
             }
-            const planRunner = new Runner({ brain: cfg.brain, models: cfg.models, roles: cfg.roles, pricing: cfg.pricing, ...onNoticeSeat, ...governanceSeat });
+            const planRunner = new Runner({ brain: cfg.brain, models: cfg.models, roles: cfg.roles, pricing: cfg.pricing, ...onNoticeSeat, ...governanceSeat, ...deploymentPostureSeat });
             const runRoute = async (prompt) => {
                 const res = await planRunner.runTaskStream({
                     objective: prompt,
@@ -338,7 +339,7 @@ export function createLeaderRunner(cfg) {
                     workerId: sub.workerId, sessionId, branch: sub.branch,
                     baseSha,
                     runner: keepCtxWarm(new Runner({
-                        brain: cfg.brain, models: cfg.models, roles: cfg.roles, pricing: cfg.pricing, ...onNoticeSeat, ...governanceSeat,
+                        brain: cfg.brain, models: cfg.models, roles: cfg.roles, pricing: cfg.pricing, ...onNoticeSeat, ...governanceSeat, ...deploymentPostureSeat,
                         ...(cfg.toolResultStore ? { toolResultStore: cfg.toolResultStore } : {}),
                         ...(cfg.sessionStore ? { sessionStore: cfg.sessionStore } : {}),
                         executionEnvFactory: (ctx) => withStaging(envFactory(ctx), stage, async (e) => {
@@ -358,7 +359,7 @@ export function createLeaderRunner(cfg) {
             const baseSha = await sh(env)(`cd ${repo} && git rev-parse HEAD`);
             return {
                 workerId: sub.workerId, sessionId, branch: sub.branch, baseSha,
-                runner: keepCtxWarm(new Runner({ brain: cfg.brain, models: cfg.models, roles: cfg.roles, pricing: cfg.pricing, ...onNoticeSeat, ...governanceSeat, ...(cfg.toolResultStore ? { toolResultStore: cfg.toolResultStore } : {}), ...(cfg.sessionStore ? { sessionStore: cfg.sessionStore } : {}), executionEnv: env })),
+                runner: keepCtxWarm(new Runner({ brain: cfg.brain, models: cfg.models, roles: cfg.roles, pricing: cfg.pricing, ...onNoticeSeat, ...governanceSeat, ...deploymentPostureSeat, ...(cfg.toolResultStore ? { toolResultStore: cfg.toolResultStore } : {}), ...(cfg.sessionStore ? { sessionStore: cfg.sessionStore } : {}), executionEnv: env })),
                 diffEnv: env,
                 destroy: () => env.destroy().then(() => { }),
                 spec: { ...workerLimits, ...sub.spec, ...durableSpec, ...resourceSpec },

package/dist/lsp/manager.d.ts

@@ -68,7 +68,7 @@ export interface E2bLspManagerOptions {
 }
 /**
  * §DESIGN-V2 F1/F8/F9 —— 本文件曾**手抄**一份 core 的 `settleOnAbort`(注释自陈 core「un-exported」,并写下
- * 「一旦 core 导出即 find-and-delete」的计划)。A-033.1(#256)执行了那句话:core 现已从包根导出它
+ * 「一旦 core 导出即 find-and-delete」的计划)。[ref]([ref])执行了那句话:core 现已从包根导出它
  * (`index.d.ts:27`,来自 `core/lsp.js`),手抄件遂删除,本文件的两处调用直接消费 core 的实现。
  *
  * 它的语义(读点在 `open` 的两处调用):给**这一个**调用方一个自己的 settle —— 调用方的 `signal` 让它拿到
@@ -86,7 +86,7 @@ export declare class E2bLspManager implements LspServerManager {
     private readonly log;
     private readonly hasServerCommand;
     private readonly metrics;
-    /** design/121 (core 1.220, board [S] ①): the workspace diagnostics registry — WORKSPACE-scoped (survives
+    /** [ref] (core 1.220, board [S] ①): the workspace diagnostics registry — WORKSPACE-scoped (survives
      *  heal/evict; diagnostics belong to files, not servers), drained by the Runner at turn boundaries. Every
      *  session feeds it from `textDocument/publishDiagnostics` (the WS transport now dispatches notifications).
      *  ⚠️ ONE registry across sandboxes on this manager instance (it is per-deployment) — same posture as

package/dist/lsp/types.d.ts

@@ -1,5 +1,5 @@
 /**
- * LSP sidecar — service-side types (design/64 §13.1). core 1.82+ ships `createLspTool(manager)`
+ * LSP sidecar — service-side types ([ref] §13.1). core 1.82+ ships `createLspTool(manager)`
  * + the `LspServerManager`/`LspSession`/`LspResult` SEAM (`@sema-agent/core`); the runner mounts the tool
  * when OUR manager is wired via `RunnerDeps.lspManager`. We re-export core's seam types — SINGLE SOURCE OF TRUTH,
  * incl. the injectable `LspTransport` (the WS-bridge connection to the language server inside E2B) + `LspReadText`.

package/dist/lsp/ws-transport.d.ts

@@ -17,7 +17,7 @@ export declare class WsLspTransport implements LspTransport {
     private isClosed;
     private keepalive;
     private awaitingPong;
-    /** design/121: server→client NOTIFICATION subscribers (publishDiagnostics etc.). */
+    /** [ref]: server→client NOTIFICATION subscribers (publishDiagnostics etc.). */
     private readonly notificationHandlers;
     constructor(ws: WsLike, requestTimeoutMs?: number, keepaliveMs?: number);
     /** Manager-visible liveness (LspTransport.closed): evict + reopen instead of reusing a dead connection. */
@@ -26,7 +26,7 @@ export declare class WsLspTransport implements LspTransport {
     private failAll;
     request(method: string, params: unknown, signal?: AbortSignal): Promise<unknown>;
     notify(method: string, params: unknown): void;
-    /** design/121 (core 1.220): subscribe to server→client notifications; returns unsubscribe. Additive —
+    /** [ref] (core 1.220): subscribe to server→client notifications; returns unsubscribe. Additive —
      *  core's diagnostics registry is the intended consumer; with no subscriber, behavior is byte-identical. */
     onNotification(handler: (method: string, params: unknown) => void): () => void;
     close(): Promise<void>;

package/dist/main.js

@@ -32,7 +32,7 @@ import { createHttpServer, explicitOperatorOk, hasServiceAuth } from "./http/ser
 import { exportMemoryScope } from "./memory-export.js";
 import { workflowModelAllowlistFor } from "./task-workflow.js";
 import { createMemoryBundleFaces } from "./memory-bundle-engine.js";
-import { backendOwnsControlPlane, createMemoryComplianceFaces, createMemoryOriginFaces } from "./memory-operator-faces.js";
+import { backendOwnsControlPlane, createMemoryComplianceFaces, createMemoryOriginFaces, createSessionMemoryStatusFace } from "./memory-operator-faces.js";
 import { performMemorySync } from "./memory-sync.js";
 import { startOtlpExporter } from "./observability/otel-exporter.js";
 import { HEARTBEAT_MS, backgroundAgentOutput, taskHandleOutput, taskHandleStop } from "./runs.js";
@@ -120,17 +120,23 @@ async function main() {
     await configCenter.applyLocalRemoteExec();
     const { backend, storeBackendDegraded, memoryEngine, memorySyncCursors, rosterStore, backgroundAgentStore, taskAttachmentStore, mailboxStore, memoryExportBackend, memorySyncRunner, sessionStore, breakerState, usageWindowStore, memoryPosture, taskListLane, } = await openStores({ config, logger, metrics, localRoot });
     const instanceId = uuidv7();
-    const memoryBundleFaces = memoryEngine ? createMemoryBundleFaces(memoryEngine) : undefined;
+    const sessionCaptureRecordStore = backend?.sessionCaptureRecords();
+    const memoryBundleFaces = memoryEngine ? createMemoryBundleFaces(memoryEngine, { ...(sessionCaptureRecordStore !== undefined ? { captureRecordStore: sessionCaptureRecordStore } : {}) }) : undefined;
     const memoryComplianceFaces = memoryEngine
         ? createMemoryComplianceFaces(memoryEngine, {
             onIncident: (err) => logger.warn("memory_compliance_incident", { code: err.code ?? null, detail: err.message }),
+            ...(sessionCaptureRecordStore !== undefined ? { captureRecordStore: sessionCaptureRecordStore } : {}),
         })
         : undefined;
     const memoryOriginFaces = memoryEngine
         ? createMemoryOriginFaces(memoryEngine, {
             onIncident: (err) => logger.warn("memory_origin_incident", { code: err.code ?? null, detail: err.message }),
+            ...(sessionCaptureRecordStore !== undefined ? { captureRecordStore: sessionCaptureRecordStore } : {}),
         })
         : undefined;
+    const sessionMemoryStatusFace = memoryEngine
+        ? createSessionMemoryStatusFace(memoryEngine, { ...(sessionCaptureRecordStore !== undefined ? { captureRecordStore: sessionCaptureRecordStore } : {}) })
+        : undefined;
     const adoptionBoot = await runAdoptionBootScan({ backend, logger });
     if (adoptionBoot.scanned > 0 || adoptionBoot.error !== undefined) {
         logger.info("adoption_boot_scan", { ...adoptionBoot });
@@ -211,6 +217,7 @@ async function main() {
             ...(config.memoryProvenance !== undefined ? { provenance: config.memoryProvenance } : {}),
             onIncident: (err) => logger.warn("memory_consolidation_incident", { code: err.code ?? null, detail: err.message }),
             onStopDetail: (audit) => logger.warn("memory_consolidation_stop_detail", audit),
+            ...(sessionCaptureRecordStore !== undefined ? { captureRecordStore: sessionCaptureRecordStore } : {}),
         })
         : undefined;
     for (const w of buildConsolidationValveAudit({
@@ -246,6 +253,7 @@ async function main() {
         mcpRevocations,
         config, logger, metrics, localRoot, promptSource: configCenter.promptSource, rosterStore, backgroundAgentStore, mailboxStore, usageWindowStore, brain,
         pricing, tracer, outcomeSink, elicitation, question, toolApproval, sessionStore, memoryEngine,
+        sessionCaptureRecordStore,
         memorySyncRunner, toolResultStore: runnerOffloadStore, sessionPolicyStore, runtimeCapsResolver, fileHistoryStore,
         legacyRewindBoundaryProbe: backend?.legacyRewindBoundaryProbe ? backend.legacyRewindBoundaryProbe.bind(backend) : undefined,
         permissionRuleStore: permissionRuleStores?.provider,
@@ -610,6 +618,7 @@ async function main() {
         memoryBundleImport: memoryBundleFaces ? memoryBundleFaces.importBundle : undefined,
         memoryCompliance: memoryComplianceFaces,
         memoryOriginFace: memoryOriginFaces,
+        sessionMemoryStatus: sessionMemoryStatusFace,
         memoryConsolidation: memoryConsolidationFaces,
         memoryOptOutGrant: memoryOptOutGrantStore,
         orgMemoryDirectory: orgMemoryAdmission.directory,
@@ -662,6 +671,7 @@ async function main() {
         mcpRevocations,
         mcpRevocationState: () => configCenter.mcpRevocationState(),
         configRefreshNow: () => configCenter.refreshNow(),
+        configCenterManagedKeys: () => configCenter.centerManagedKeys(),
         drainState,
         storeDegraded: storeBackendDegraded,
         storeLiveState: storeLiveProbe ? () => storeLiveProbe.state() : undefined,

package/dist/mcp-content-origin.d.ts

@@ -1,5 +1,5 @@
 /**
- * design/378(core 5.60.0)—— `McpServerSpec.contentOrigin` 的**闭词表单一属主**。
+ * [ref](core 5.60.0)—— `McpServerSpec.contentOrigin` 的**闭词表单一属主**。
  *
  * core 给 MCP 条目开了一个**内容出处声明**座位:一台 server 的整套工具的结果算 `"local"`(部署自己
  * 写的)/ `"execution"`(执行环境产物,`execIsExternalContent` 仍能收紧)/ `"external"`(第三方内容,

package/dist/memory-bundle-engine.d.ts

@@ -1,5 +1,5 @@
 /**
- * #264 v2-c —— `POST /v1/memory/{export,import}` 两口的**引擎接线**(core 5.40.0 design/178 v2-c)。
+ * [ref] v2-c —— `POST /v1/memory/{export,import}` 两口的**引擎接线**(core 5.40.0 [ref] v2-c)。
  *
  * ## 为什么需要这个模块(而不是在 main.ts 里直接 new)
  *
@@ -29,7 +29,7 @@
  * HTTP 面诚实 501。
  *
  * 🔴 首版把这件事当成**运行期**事实(照常挂载,让 core 每次抛 `memory.export_incomplete` / 422),
- * 被 codex 交叉复审驳倒(#277 提货批 [medium],验真后修):`typeof backend.exportSnapshotOf === "function"`
+ * 被 codex 交叉复审驳倒([ref] 提货批 [medium],验真后修):`typeof backend.exportSnapshotOf === "function"`
  * 是一次**属性检查**,boot 期就判得出;而且它是**永久**缺席(换后端才会变),不是瞬时状态。照旧挂着
  * 就成了「能力位说 yes、每一次调用都确定性失败」——本仓「says yes ⟺ route works」是结构性承诺,
  * 一个恒假的 yes 会让壳给用户开出一条走不通的迁移流程。
@@ -41,7 +41,7 @@
  * `memory.export_incomplete` —— 那是诚实的运行期拒,附录 A 单列一条。绝不在这里回落到「用通用读面拼
  * 一个包」:core 明写那正是它拒绝生产的形(a governance-less export is the laundering shape)。
  */
-import { type MemoryBackend, type MemoryExportBundle, type MemoryImportReport } from "@sema-agent/core";
+import { type MemoryBackend, type MemoryExportBundle, type MemoryImportReport, type SessionCaptureRecordStore } from "@sema-agent/core";
 /** 两口 HTTP 面消费的窄能力面(`ServiceDeps.memoryBundle{Export,Import}` 的实参来源)。 */
 export interface MemoryBundleFaces {
     exportScopes: (scopes: readonly string[]) => Promise<MemoryExportBundle>;
@@ -60,5 +60,7 @@ export interface MemoryBundleFaces {
 export declare function createMemoryBundleFaces(store: {
     backend: MemoryBackend;
     root: string;
+}, opts?: {
+    captureRecordStore?: SessionCaptureRecordStore;
 }): MemoryBundleFaces | undefined;
 //# sourceMappingURL=memory-bundle-engine.d.ts.map

package/dist/memory-bundle-engine.js

@@ -1,9 +1,9 @@
 import { MemoryEngine } from "@sema-agent/core";
-export function createMemoryBundleFaces(store) {
+export function createMemoryBundleFaces(store, opts) {
     const b = store.backend;
     if (typeof b.exportSnapshotOf !== "function" || typeof b.importBundleCommit !== "function")
         return undefined;
-    const engine = new MemoryEngine({ backend: store.backend, memoryDir: store.root });
+    const engine = new MemoryEngine({ backend: store.backend, memoryDir: store.root, ...(opts?.captureRecordStore !== undefined ? { captureRecordStore: opts.captureRecordStore } : {}) });
     return {
         exportScopes: (scopes) => engine.exportMemoryScopes(scopes),
         importBundle: (bundle, opts) => engine.importMemoryBundle(bundle, opts),