@sema-agent/server 7.54.0 → 7.56.0

package/dist/boot/runtime-caps.js

@@ -4,6 +4,8 @@ export function assertMemoryCapturePolicyWirable(input) {
         return;
     if (input.grantSourceWired)
         return;
+    if (input.centerEntitlementPresent === true)
+        return;
     throw new Error(`MEMORY_CAPTURE_POLICY=governed requires a per-principal memory opt-out verdict source, and this deployment wires NONE ` +
         `— under "governed" core REFUSES every session memory-capture opt-out whose verdict is absent (fail-closed, the posture's ` +
         `own contract), so a governed worker without a source would refuse every \`memory.capture:"off"\` declaration and the ` +
@@ -15,7 +17,7 @@ export function assertMemoryCapturePolicyWirable(input) {
 }
 export function createRuntimeCaps(ctx) {
     const { config, logger } = ctx;
-    assertMemoryCapturePolicyWirable({ policy: config.memoryCapturePolicy, grantSourceWired: ctx.memoryOptOutGrant !== undefined });
+    assertMemoryCapturePolicyWirable({ policy: config.memoryCapturePolicy, grantSourceWired: ctx.memoryOptOutGrant !== undefined, centerEntitlementPresent: Boolean(config.configCenter && !config.configCenter.dryRun) });
     if (config.configCenter && !config.configCenter.dryRun && scopedTokenNeedsWorker(config.configCenter.token, config.configCenter.worker)) {
         logger.warn("runtime_caps_scoped_token_no_worker", {
             reason: "SEMA_REGISTRY_TOKEN is a worker-scoped wpt_ token but SEMA_REGISTRY_WORKER is unset → center 403s per-principal caps → ALL workflow self-orchestration will be fail-closed denied. Set SEMA_REGISTRY_WORKER (the orchestrator normally injects it) or use the full SERVICE_PULL_TOKEN.",

package/dist/boot/stores.js

@@ -17,7 +17,8 @@ import { PgTaskAttachmentStore, TiDBTaskAttachmentStore, ensurePgTaskAttachmentS
 import { createSessionStore } from "../plugins/session-store.js";
 import { createTaskListLane } from "./task-list-lane.js";
 import { ensurePgTaskListSchema, ensureTiDBTaskListSchema } from "../plugins/task-list-store-sql.js";
-import { ensurePgDeviceSchema, ensureTiDBDeviceSchema } from "../plugins/device-store-sql.js";
+import { assertDeviceAuditRebindEventSchema, ensurePgDeviceSchema, ensureTiDBDeviceSchema } from "../plugins/device-store-sql.js";
+import { mysqlDriver, pgDriver } from "../plugins/sql-driver.js";
 import { assertCloudSnapshotBlobPosture, openStoreBackendWithFallback } from "../plugins/store-backend.js";
 import { buildMemoryRemoteLaneWarn, memoryEngineBackendFor, memoryEngineRemoteLanePosture } from "../memory-scope.js";
 import { assertToolResultProvenanceSchema } from "../plugins/tool-result-store-sql.js";
@@ -386,6 +387,12 @@ export async function openStores(ctx) {
             await ensurePgDeviceSchema(async (text, params) => pgPool.query(text, params));
         if (mysqlPool)
             await ensureTiDBDeviceSchema(mysqlPool);
+        if (config.remoteExec?.provider === "device") {
+            if (pgPool)
+                await assertDeviceAuditRebindEventSchema(pgDriver(pgPool));
+            else if (mysqlPool)
+                await assertDeviceAuditRebindEventSchema(mysqlDriver(mysqlPool));
+        }
     }
     const sessionStore = createSessionStore(config, backend, metrics);
     if (config.requirePrincipal && backend?.kind === "local") {

package/dist/config-center/types.d.ts

@@ -103,7 +103,8 @@ export interface CenterMcpServer {
      * 所以它的家在 center 下发这条腿;请求腿那半场的门与结构性兑现见 `task-mcp.ts`
      * 的 `assertRequestMcpContentOrigin` 顶注。
      *
-     * ⚠️ **两条腿今天都到不了这里**([ref]③ / [ref]③ / [ref],2026-08-31 双绊线实测更正 —— 本注旧版那句
+     * ✅ **两条腿已通**([ref],settings-schema 1.4.0 补键 + config-provider 映射行,2026-09-02;双绊线翻正销账)。
+     * 病史([ref]③ / [ref]③ / [ref],2026-08-31 双绊线实测更正 —— 本注更旧版那句
      * 「远端 /effective.mcp 腿是直读 JSON,今天就通」**不成立**,doc-rot):settings-schema(原 registry-core)
      * 的 `McpServerSpec` 是默认 strip 的 zod object 且没有 `contentOrigin` 可选键,本地腿在 FileConfigStore 的
      * `parseDomainLoud(DOMAIN_SCHEMAS.mcp)`、远端腿在消费端边界 `readEffectiveWire`([ref] 裁B)**各被剥一次**。

package/dist/config-provider.js

@@ -145,6 +145,7 @@ export function mapToServiceEffective(eff, version) {
                     enabled: s.enabled,
                     ...(s.allowTools !== undefined ? { allowTools: s.allowTools } : {}),
                     ...(s.elicitation !== undefined ? { elicitation: s.elicitation } : {}),
+                    ...(s.contentOrigin !== undefined ? { contentOrigin: s.contentOrigin } : {}),
                 };
                 if (s.transport.kind === "stdio") {
                     return {

package/dist/device-store.d.ts

@@ -28,6 +28,13 @@ export declare const DEVICE_ERROR_CODES: {
     readonly ENROLLMENT_INVALID: "device.enrollment_invalid";
     /** 反枚举 404:设备不存在 **与** 设备不是你的,逐字节同形。 */
     readonly NOT_FOUND: "not_found.device";
+    /** O4 换绑动词(2026-08-30 v2 稿 §2 步 3):前态 CAS 输 —— 体带当前 rev(`currentRev`,[ref]
+     *  currentPending 哲学,壳一跳重定位)。**唯一铸造点 = `POST /v1/devices/sessions/:rootSessionId/rebind`**
+     *  (管理面,`http/routes/devices.ts`);adapter/准入链结构上不产它。 */
+    readonly REBIND_REV_CONFLICT: "device.rebind_rev_conflict";
+    /** O4 换绑动词(v2 稿 §2 步 4):该根会话名下有非终态 run(durable 判据 = run store 的 session
+     *  claim;hub 内存在途计数**不作门**——跨副本不可见)—— 体带 `activeTaskId`。铸造点同上一条。 */
+    readonly REBIND_ACTIVE_RUN: "device.rebind_active_run";
 };
 /** {@link DEVICE_ERROR_CODES} 的值联合 —— 闭集(未知码 = 编译错误,[ref] 词表纪律)。 */
 export type DeviceErrorCode = (typeof DEVICE_ERROR_CODES)[keyof typeof DEVICE_ERROR_CODES];
@@ -60,9 +67,13 @@ export declare const DEVICE_ERROR_STATUS: Readonly<Record<DeviceRejectCode, numb
  *
  * ⚠️ §4.8 的**遥测**清单比这张表长(`device_connected`/`device_disconnected`/`device_heartbeat_lost`/
  * `device_instruction_dispatched`/`device_outcome_unknown`)—— 那些是**计数器/日志**面,不落审计表。
- * 只有下面这 8 个是「安全轴事件,必须可追溯查询」。加成员 = 同时改这里 + 两侧 DDL 的 CHECK。
+ * 只有下面这 9 个是「安全轴事件,必须可追溯查询」。加成员 = 同时改这里 + 两侧 DDL 的 CHECK
+ * (`AUDIT_EVENT_CHECK` 由本数组生成,DDL 自动跟);**且**存量表的旧 CHECK 不会被
+ * `CREATE TABLE IF NOT EXISTS` 更新 —— 升级探针见 `device-store-sql.ts` 的
+ * `assertDeviceAuditRebindEventSchema`(能力探测:PG 强制 CHECK、TiDB 默认不执行,探的是**行为**
+ * 不是元数据 —— memory `capability-detection-not-impl-names` 同判)。
  */
-export declare const DEVICE_AUDIT_EVENTS: readonly ["device_enrolled", "device_revoked", "device_token_rotated", "device_enroll_token_reuse", "device_frame_unexpected", "device_identity_mismatch", "device_superseded", "device_attached_elsewhere"];
+export declare const DEVICE_AUDIT_EVENTS: readonly ["device_enrolled", "device_revoked", "device_token_rotated", "device_enroll_token_reuse", "device_frame_unexpected", "device_identity_mismatch", "device_superseded", "device_attached_elsewhere", "session_rebound"];
 export type DeviceAuditEvent = (typeof DEVICE_AUDIT_EVENTS)[number];
 /** v1 平台闭集(AR-R1-8)。win32 = follow-on(§10 车A-4 的 flavor 注)。 */
 export declare const DEVICE_PLATFORM_OS: readonly ["darwin", "linux"];
@@ -158,6 +169,10 @@ export declare function assertDevicePubkeyShape(pubkey: string): void;
 export declare function assertNewDeviceShape(input: NewDeviceInput): void;
 export declare function assertIssueTokenShape(input: IssueEnrollTokenInput): void;
 export declare function assertRevokeShape(input: RevokeDeviceInput): void;
+/** O4 换绑入参的整形门(三形共用)。`expectedRev` 收窄为非负整数:它要进 SQL 等值谓词,小数/负数/NaN
+ *  在两方言的 BIGINT 比对下不是「不匹配」而是各自的隐式转换歧义面 —— 在门口拒,方言分歧面消失。
+ *  ⚠️ HTTP 层对坏形先答 400(业务拒绝);这里的抛是**编程/装配错误**的兜底,不是 wire 分支。 */
+export declare function assertRebindShape(input: RebindSessionInput): void;
 export declare function assertAcquireShape(input: AcquireConnectionInput): void;
 /** token 摘要必须是**规范形**(小写 sha256 hex):大小写混形在 VARBINARY/COLLATE "C" 下是两个键,
  *  于是同一个明文 token 能被消费两次 —— 这是 §7-T5 ③「一次性 CAS」的直接跳过面。 */
@@ -273,6 +288,47 @@ export type BindSessionResult = {
 } | {
     outcome: "device_revoked";
 };
+/**
+ * O4 显式换绑(2026-08-30 v2 稿 §2)。`owner` = **绑定行的**复合身份(HTTP 层已裁决:属主同域或
+ * explicit operator;operator 代操作时传的也是行的 owner,不是操作员自己)——店内所有谓词恒带它,
+ * 判别位在店里就消失(反枚举,文件头注)。`expectedRev` = 壳从 S-4 读面拿到的前态(强制显式,
+ * 防两操作员并发换绑互踩)。
+ */
+export interface RebindSessionInput {
+    rootSessionId: string;
+    toDeviceId: string;
+    expectedRev: number;
+    owner: DeviceOwner;
+}
+/**
+ * O4 换绑的判别式结果(门序 = v2 稿 §2:目标设备在场 → 幂等短路 → 前态 CAS → 审计;活跃 run 门在
+ * **HTTP 层**、CAS 之前判 —— run store 是另一只店,CAS 语句不兼职)。
+ */
+export type RebindSessionResult = 
+/** CAS 赢家:`rev+1` + `bound_at` 刷新 + `session_rebound` 审计行**同一事务**提交。 */
+{
+    outcome: "rebound";
+    row: DeviceSessionRow;
+}
+/** 真幂等:`toDeviceId` ≡ 当前绑定 ∧ `expectedRev` ≡ 当前 rev ⇒ 回显不加 rev、不写审计。 */
+ | {
+    outcome: "idempotent";
+    row: DeviceSessionRow;
+}
+/** 前态输(rev 不符,含「toDeviceId 同但 rev 错」——前态错就是错)⇒ 携当前行供壳一跳重定位。 */
+ | {
+    outcome: "rev_conflict";
+    row: DeviceSessionRow;
+}
+/** 绑定行不在**或**不是该 owner 的 —— 反枚举同形(HTTP 层折 404 同串)。 */
+ | {
+    outcome: "binding_not_found";
+}
+/** 目标设备不在 / 不是该 owner 的 / **已吊销** —— v2 稿 §2 步 2:三臂同折 404(设备 id 也是
+ *  不可枚举面);吊销不单列 = 判别位在店里就消失,消费层想泄也泄不出来。 */
+ | {
+    outcome: "device_not_found";
+};
 export interface RevokeDeviceInput {
     deviceId: string;
     owner: DeviceOwner;
@@ -344,12 +400,18 @@ export interface DeviceStore {
     /** 管理面/测试用的无 owner 谓词读口 —— **不得**接到任何 principal-scoped 的 wire 面上。 */
     getDeviceUnscoped(deviceId: string): Promise<DeviceRow | null>;
     listDevicesByOwner(owner: DeviceOwner): Promise<DeviceRow[]>;
+    /** O4/S-4:全量列表(operator 面专用;`getDeviceUnscoped` 同一条纪律 —— 不得接到任何
+     *  principal-scoped 的 wire 面上,消费点必须先过 explicit operator 门)。 */
+    listDevicesUnscoped(): Promise<DeviceRow[]>;
     revokeDevice(input: RevokeDeviceInput): Promise<RevokeDeviceResult>;
     acquireConnection(input: AcquireConnectionInput): Promise<AcquireConnectionResult>;
     /** 世代谓词命中 = true;0 行 = 已失权。 */
     heartbeatConnection(input: HeartbeatConnectionInput): Promise<boolean>;
     releaseConnection(deviceId: string, generation: number): Promise<boolean>;
     bindSession(input: BindSessionInput): Promise<BindSessionResult>;
+    /** O4 显式换绑(v2 稿 §2 步 2/3/5):目标设备门 + 前态 CAS + `session_rebound` 审计行同一事务。
+     *  活跃 run 门**不在这里**(run store 是另一只店)—— 由 HTTP 层在调用前判(v2 稿 §2 步 4)。 */
+    rebindSession(input: RebindSessionInput): Promise<RebindSessionResult>;
     getSessionBinding(rootSessionId: string): Promise<DeviceSessionRow | null>;
     /** purge coordinator 座(§6 注②:core 的会话删除是**逐 store 显式调用**,不是 DB 自动扫;
      *  只建表不接 purge = 删会话后绑定残留 ⇒ sessionId 重用致旧设备粘连/claim conflict/隐私残留)。 */
@@ -380,11 +442,13 @@ export declare class InMemoryDeviceStore implements DeviceStore {
     readDeviceForAdmission(deviceId: string, owner: DeviceOwner): Promise<DeviceAdmissionView | null>;
     getDeviceUnscoped(deviceId: string): Promise<DeviceRow | null>;
     listDevicesByOwner(owner: DeviceOwner): Promise<DeviceRow[]>;
+    listDevicesUnscoped(): Promise<DeviceRow[]>;
     revokeDevice(input: RevokeDeviceInput): Promise<RevokeDeviceResult>;
     acquireConnection(input: AcquireConnectionInput): Promise<AcquireConnectionResult>;
     heartbeatConnection(input: HeartbeatConnectionInput): Promise<boolean>;
     releaseConnection(deviceId: string, generation: number): Promise<boolean>;
     bindSession(input: BindSessionInput): Promise<BindSessionResult>;
+    rebindSession(input: RebindSessionInput): Promise<RebindSessionResult>;
     getSessionBinding(rootSessionId: string): Promise<DeviceSessionRow | null>;
     deleteByRootSession(rootSessionId: string): Promise<number>;
     appendAudit(input: AppendAuditInput): Promise<void>;

package/dist/device-store.js

@@ -10,6 +10,8 @@ export const DEVICE_ERROR_CODES = {
     BUSY: "device.busy",
     ENROLLMENT_INVALID: "device.enrollment_invalid",
     NOT_FOUND: "not_found.device",
+    REBIND_REV_CONFLICT: "device.rebind_rev_conflict",
+    REBIND_ACTIVE_RUN: "device.rebind_active_run",
 };
 export const DEVICE_RATE_LIMIT_CODE = "limit.rate_exceeded";
 export const DEVICE_DRAINING_CODE = "draining";
@@ -24,6 +26,8 @@ export const DEVICE_ERROR_STATUS = {
     "device.busy": 429,
     "device.enrollment_invalid": 403,
     "not_found.device": 404,
+    "device.rebind_rev_conflict": 409,
+    "device.rebind_active_run": 409,
     "limit.rate_exceeded": 429,
     "draining": 503,
 };
@@ -36,6 +40,7 @@ export const DEVICE_AUDIT_EVENTS = [
     "device_identity_mismatch",
     "device_superseded",
     "device_attached_elsewhere",
+    "session_rebound",
 ];
 export const DEVICE_PLATFORM_OS = ["darwin", "linux"];
 export const DEVICE_STATUSES = ["active", "revoked"];
@@ -114,6 +119,14 @@ export function assertRevokeShape(input) {
     assertBoundedText("revokedBy", input.revokedBy, DEVICE_TEXT_LIMITS.actor);
     assertBoundedText("revokeReason", input.reason ?? "", DEVICE_TEXT_LIMITS.revokeReason);
 }
+export function assertRebindShape(input) {
+    assertRootSessionIdShape(input.rootSessionId);
+    assertDeviceIdShape(input.toDeviceId);
+    assertDeviceOwnerShape(input.owner);
+    if (!Number.isInteger(input.expectedRev) || input.expectedRev < 0) {
+        throw new Error(`device-store: expectedRev must be a non-negative integer (got ${input.expectedRev}) — it enters a byte-exact BIGINT equality predicate`);
+    }
+}
 export function assertAcquireShape(input) {
     assertDeviceIdShape(input.deviceId);
     assertDeviceOwnerShape(input.owner);
@@ -284,6 +297,9 @@ export class InMemoryDeviceStore {
         assertDeviceOwnerShape(owner);
         return [...this.devices.values()].filter((d) => sameOwner(d.owner, owner)).sort((a, b) => (a.deviceId < b.deviceId ? -1 : 1)).map((d) => this.snapshotDevice(d));
     }
+    async listDevicesUnscoped() {
+        return [...this.devices.values()].sort((a, b) => (a.deviceId < b.deviceId ? -1 : 1)).map((d) => this.snapshotDevice(d));
+    }
     async revokeDevice(input) {
         assertRevokeShape(input);
         const row = this.devices.get(input.deviceId);
@@ -365,6 +381,25 @@ export class InMemoryDeviceStore {
         this.sessions.set(row.rootSessionId, row);
         return { outcome: "bound", row: this.snapshotSession(row) };
     }
+    async rebindSession(input) {
+        assertRebindShape(input);
+        const device = this.devices.get(input.toDeviceId);
+        if (!device || !sameOwner(device.owner, input.owner) || device.status !== "active")
+            return { outcome: "device_not_found" };
+        const row = this.sessions.get(input.rootSessionId);
+        if (!row || !sameOwner(row.owner, input.owner))
+            return { outcome: "binding_not_found" };
+        if (row.deviceId === input.toDeviceId && row.rev === input.expectedRev)
+            return { outcome: "idempotent", row: this.snapshotSession(row) };
+        if (row.rev !== input.expectedRev)
+            return { outcome: "rev_conflict", row: this.snapshotSession(row) };
+        const from = row.deviceId;
+        row.deviceId = input.toDeviceId;
+        row.boundAtMs = this.now();
+        row.rev += 1;
+        this.pushAudit({ event: "session_rebound", deviceId: input.toDeviceId, owner: row.owner, detail: { from, to: input.toDeviceId, rev: row.rev } });
+        return { outcome: "rebound", row: this.snapshotSession(row) };
+    }
     async getSessionBinding(rootSessionId) {
         assertRootSessionIdShape(rootSessionId);
         const row = this.sessions.get(rootSessionId);

package/dist/device-ws-hub.d.ts

@@ -56,6 +56,14 @@ export type DeviceDispatchInput = {
     [K in DeviceInstructionKind]: {
         rootSessionId: string;
         requester: DeviceOwner;
+        /**
+         * O4 §3 投递门**身份重断言**(codex 轮2 R2-[high],红先 R4b 实证):调用方 env **铸造时**钉住的
+         * 设备。准入在 dispatch 内解出的是**当前**绑定 —— 显式换绑与在飞 turn 竞态时两者可以不同,而
+         * adapter 的 connect 身份检查罩不住已连接 env 的后续调用(它们不再过 connect)。差异 ⇒ 恒拒
+         * `device.identity_mismatch`(cwd/能力面是从铸造设备读的,静默改道 = 在错误机器的工作区上执行)。
+         * **必填**:可选会让漏传静默([ref] `originTaskId` 同判)。
+         */
+        expectedDeviceId: string;
         kind: K;
         args: DeviceInstructionArgsByKind[K];
         cwd?: string;

package/dist/device-ws-hub.js

@@ -811,6 +811,12 @@ export function createDeviceWsHub(options) {
         if (abortedNow())
             return abortedBeforeCommit();
         const { deviceId, connGeneration } = admitted.value;
+        if (deviceId !== input.expectedDeviceId) {
+            return {
+                kind: "rejected",
+                reject: rejection(DEVICE_ERROR_CODES.IDENTITY_MISMATCH, `this session is now bound to a different device (${deviceId}) than the one this instruction's environment was minted for — refusing to silently re-target; re-initiate the work on the currently bound device (O4 v2 §3)`),
+            };
+        }
         const conn = conns.get(deviceId);
         if (!conn || conn.phase !== "active" || conn.goodbye) {
             return { kind: "rejected", reject: rejection(DEVICE_ERROR_CODES.OFFLINE, "the bound device has no dispatchable connection on this replica") };

package/dist/http/route-ctx.d.ts

@@ -198,10 +198,16 @@ export interface RouteLegs {
         status: number;
         body: object;
     }>;
-    /** assistant 抢占腿的复位(gate-kind 守卫 + 驱动)。 */
+    /** assistant 抢占腿的复位(gate-kind 守卫 + 行级属主复核 + 驱动)。 */
     resumePreempted(sessionId: string, req: IncomingMessage | undefined, 
     /** [ref] 件 S-1:透传给 {@link DriveResumeArgs.acceptEarly}(200 受理语义)。HTTP `/resume` 腿传 `true`。 */
-    acceptEarly?: boolean): Promise<{
+    acceptEarly?: boolean, 
+    /** [ref]②([ref]):调用方已验身份的裁定 —— 腿内在被真正载入的 checkpoint 行上重跑属主判
+     *  ([ref] R3 同形;缺席 = 匿名 dev 部署,不咬)。 */
+    decider?: {
+        principal?: string;
+        explicitOperator: boolean;
+    }): Promise<{
         status: number;
         body: object;
     }>;
@@ -221,7 +227,13 @@ export interface RouteLegs {
         principalPresent?: boolean;
     }, 
     /** [ref] 件 S-1:透传给 {@link DriveResumeArgs.acceptEarly}(200 受理语义)。HTTP `/plan_review` 腿传 `true`。 */
-    acceptEarly?: boolean): Promise<{
+    acceptEarly?: boolean, 
+    /** [ref]②([ref]):调用方已验身份的裁定(直连门 = HMAC 验出的 principal)—— 腿内行级属主复核
+     *  ([ref] R3 同形;缺席 = 匿名 dev 部署,不咬)。 */
+    decider?: {
+        principal?: string;
+        explicitOperator: boolean;
+    }): Promise<{
         status: number;
         body: object;
     }>;

package/dist/http/routes/approvals-assistant.js

@@ -108,6 +108,7 @@ async function handleApprovalsAssistantBody(req, res, url, ctx, miss) {
             sendJson(res, 200, {
                 pending: (await cs.listPending(scope)).map((r) => projectPendingForWire(r, deps.config)),
                 ...(deps.toolApproval ? { livePending: deps.toolApproval.listLivePending(scope) } : {}),
+                ...(deps.approvalAskAudit ? { crashConverged: deps.approvalAskAudit.listCrashConverged(scope) } : {}),
             });
             return;
         }
@@ -298,7 +299,7 @@ async function handleApprovalsAssistantBody(req, res, url, ctx, miss) {
                 sendError(res, 404, "not_found.run", "task not found");
                 return;
             }
-            const out = await resumePreempted(run.sessionId, req, true);
+            const out = await resumePreempted(run.sessionId, req, true, { principal, explicitOperator });
             sendResumeOutcome(res, out, deps.logger);
             return;
         }
@@ -364,7 +365,7 @@ async function handleApprovalsAssistantBody(req, res, url, ctx, miss) {
                 sendError(res, 404, "not_found.run", "task not found");
                 return;
             }
-            const out = await resumePlanReview(run.sessionId, decision, decision === "edit" ? body.editedPlan : undefined, typeof body.reason === "string" ? body.reason : undefined, req, { taskId, principalPresent: principal !== undefined }, true);
+            const out = await resumePlanReview(run.sessionId, decision, decision === "edit" ? body.editedPlan : undefined, typeof body.reason === "string" ? body.reason : undefined, req, { taskId, principalPresent: principal !== undefined }, true, { principal: deciderPrincipal, explicitOperator });
             sendResumeOutcome(res, out, deps.logger);
             return;
         }

package/dist/http/routes/devices.d.ts

@@ -0,0 +1,64 @@
+/**
+ * O4 设备换绑 wire + S-4 additive 投影(DEBTS [ref];设计真源 = sema-internal
+ * `server/designs/2026-08-30-o4-device-rebind-wire-v2.md`,冻结稿)—— `/v1/devices/*` 管理面的
+ * **首批三动词**(capabilities.ts 那条「车C 的 `/v1/devices/*`」预留注所指的族,本文件开族):
+ *
+ *   · `GET  /v1/devices` —— 设备列表(owner 域过滤;explicit operator 全量)。行 =
+ *     `{ deviceId, name?, status: "online"|"offline", lastSeenAt? }`(v2 稿 §4 冻结形;`status` 由
+ *     **hub 在场性**判 —— v1 部署形 = 单副本(基线稿 §4.6),汇聚端的活连接集就是本副本的 presence
+ *     真源;`name` = displayName,空串诚实缺席;`lastSeenAt` ISO-8601)。**吊销行不列**:revoked 是
+ *     终态(重注册 = 新 deviceId),列出来只会被壳当换绑目标然后撞 404。
+ *   · `GET  /v1/devices/sessions/:rootSessionId` —— S-4 绑定读面(壳换绑 UX 的全部材料):
+ *     `{ rootSessionId, boundDevice: { deviceId, rev, boundAt } }`。稿 §4 允许「并入 session 读面」或
+ *     「独立读面」两形,选**独立读面**:sessions 的 GET 面承诺「无参请求字节不变」(routes/sessions.ts
+ *     的 additive contract 注),且 audit 投影由 boot/session-faces 组装、不持 device 店 —— 并入即跨
+ *     装配缝加一次店读;独立读面把 device wire 族收在一个文件里,户口与门序自洽。
+ *   · `POST /v1/devices/sessions/:rootSessionId/rebind` —— 显式换绑动词(v2 稿 §2 门序五步,逐字):
+ *     ① gatedPrincipal + owner 门(非属主 404 反枚举同串,[ref] 纪律)
+ *     ② 目标设备在场门(不存在 / 不是该域的 / 已吊销 ⇒ 404 **同串** —— 设备 id 也是不可枚举面)
+ *     ③ 无活跃 run 门(**CAS 前判、CAS 语句不兼职**;durable 判据 = run store 的 session claim
+ *        `getActiveTaskId`,hub 内存在途计数不作门 —— 内存态跨副本不可见;拒 = 409
+ *        `device.rebind_active_run` 体带 `activeTaskId`)
+ *     ④ 前态 CAS(店内单事务:`rev` 恒变列 + `session_rebound` 审计行;输 = 409
+ *        `device.rebind_rev_conflict` 体带 `currentRev` —— [ref] currentPending 哲学,壳一跳重定位)
+ *     ⑤ 赢 = 200 `{ rootSessionId, deviceId, rev, workspaceCarryover: "none" }`。
+ *     幂等形:toDeviceId ≡ 当前 ∧ expectedRev ≡ 当前 rev ⇒ 200 回显不加 rev(真幂等,不写审计)。
+ *     `workspaceCarryover: "none"` 是 **wire 冻结字面**(v2 稿 §5):换绑只改路由,不搬字节 —— 壳据
+ *     此渲「新设备上是全新工作区」的诚实披露;两个 200 形恒带。
+ *
+ * ── 调用方域(owner domain)的唯一铸造点 ─────────────────────────────────────────────────────────
+ * device lane 的三表自持 O11 复合身份 `{owner_tenant, owner_subject}`(device-store.ts 头注;全局
+ * principal 一个字节不动)。基线稿 §11-O11 的落法:「认证需在 SSO 校验点把 tenant+subject 传到 device
+ * placement 校验腿」——对位到本仓的真源即:subject = `gatedPrincipal`(verified 链),tenant =
+ * `ssoVerifiedScope`(registry-JWT 的 `scope` claim,security.ts:同为签名真源、非自报头)。两者齐备
+ * 才构成一个 device 域;缺 tenant claim 的凭据(纯 principal 头 / 静态 token 直连)**判不出域** ⇒
+ * 非 operator 一律响亮 403(fail-closed + loud,[ref]:静默空列表是假健康)——基线稿对 enrollment 的
+ * 同向裁定是「缺 tenant/global scope 明确拒注册」。将来的 enrollment/管理端点(车C 余件)**必须**从
+ * 这同一个函数取域,不得手抄第二份派生。
+ *
+ * ── 反枚举 404 的单一铸造点 ──────────────────────────────────────────────────────────────────────
+ * 「绑定不在 / 不是你的 / 目标设备不在 / 不是该域的 / 已吊销」五臂共用 {@link sendDeviceNotFound} ——
+ * 判别位在一个函数里就消失,memory `anti-enum-404-ambiguity` 的教训(判别位留在上层 = 迟早有一个
+ * 调用点忘记归一)在结构上关掉。码/文案与 device-enrollment.ts 的 `rejectNotFound` 同串
+ * (`not_found.device` + "device not found")。
+ *
+ * ── 门与失败方向 ────────────────────────────────────────────────────────────────────────────────
+ * 活跃 run 门的 store 读**不吞错**(server.ts 有两处 `getActiveTaskId(...).catch(() => undefined)`,
+ * 那是观测面;这里是门 —— store 打不通就 500,绝不当「没有活跃 run」放行,[ref])。run store 缺席 =
+ * 501 `capability.run_store_required`(门无判据即拒,不是跳过)。
+ *
+ * billable = false 全族(纯管理/读面,零模型工作);刻意不吃 drain 503(读面与管理动作在排空期
+ * 照常有效 —— 换绑本身正是「设备要换了」的运维动作)。错误码登记:附录 A + error-code-catalog-live
+ * (send 点全部写**字面量** + `satisfies DeviceErrorCode` 钉闭集 —— 目录门扫的是字面量,闭集纪律由
+ * 编译器执行,两道门同时成立;device-store.ts「禁手抄」条的本义是禁**脱离闭集**的字面量)。
+ */
+import type { IncomingMessage, ServerResponse } from "node:http";
+import type { RouteCtx } from "../route-ctx.js";
+import { type DeviceOwner } from "../../device-store.js";
+/**
+ * 调用方 device 域的**唯一铸造点**(文件头注)。undefined = 判不出域(无 principal,或无 tenant
+ * claim)——消费点必须走 explicit operator 或响亮 403,禁静默空视图。
+ */
+export declare function deviceOwnerDomainOf(req: IncomingMessage, config: RouteCtx["deps"]["config"]): DeviceOwner | undefined;
+export declare function handleDevices(req: IncomingMessage, res: ServerResponse, url: string, ctx: RouteCtx): Promise<boolean>;
+//# sourceMappingURL=devices.d.ts.map

package/dist/http/routes/devices.js

@@ -0,0 +1,173 @@
+import { sendError, sendJson } from "../send.js";
+import { explicitOperatorOk, gatedPrincipal } from "../principal-gate.js";
+import { ssoVerifiedScope } from "../../security.js";
+import { assertDeviceIdShape, assertRootSessionIdShape, sameDeviceOwner, } from "../../device-store.js";
+const DEVICE_NOT_FOUND_MESSAGE = "device not found";
+const NO_DEVICE_DOMAIN_MESSAGE = "device management needs a caller domain: this credential carries no verified tenant scope claim (registry auth-bridge JWT `scope`) and is not an explicit operator — connect through the registry auth bridge, or configure OPERATOR_PRINCIPALS";
+const DEVICE_LANE_REQUIRED_MESSAGE = "device management requires the device execution lane (REMOTE_EXEC=device with a SQL store backend) — this deployment has no device lane wired";
+const _deviceRouteCodesPinned = ["not_found.device", "device.rebind_rev_conflict", "device.rebind_active_run"];
+void _deviceRouteCodesPinned;
+function sendDeviceNotFound(res) {
+    sendError(res, 404, "not_found.device", DEVICE_NOT_FOUND_MESSAGE);
+}
+export function deviceOwnerDomainOf(req, config) {
+    const subject = gatedPrincipal(req, config);
+    if (subject === undefined)
+        return undefined;
+    const tenant = ssoVerifiedScope(req);
+    if (tenant === undefined)
+        return undefined;
+    return { tenant, subject };
+}
+function wellFormedKey(assert, v) {
+    try {
+        assert(v);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+function deviceListRow(row, online) {
+    return {
+        deviceId: row.deviceId,
+        ...(row.displayName !== "" ? { name: row.displayName } : {}),
+        status: online.has(row.deviceId) ? "online" : "offline",
+        ...(row.lastSeenAtMs !== null ? { lastSeenAt: new Date(row.lastSeenAtMs).toISOString() } : {}),
+    };
+}
+function boundDeviceOf(row) {
+    return { deviceId: row.deviceId, rev: row.rev, boundAt: new Date(row.boundAtMs).toISOString() };
+}
+export async function handleDevices(req, res, url, ctx) {
+    const miss = { fell: false };
+    await handleDevicesBody(req, res, url, ctx, miss);
+    return !miss.fell;
+}
+async function handleDevicesBody(req, res, url, ctx, miss) {
+    const { deps } = ctx;
+    const { readJson, safeDecode } = ctx.helpers;
+    if (url !== "/v1/devices" && !url.startsWith("/v1/devices/")) {
+        miss.fell = true;
+        return;
+    }
+    const listHit = req.method === "GET" && url === "/v1/devices";
+    const readM = req.method === "GET" ? /^\/v1\/devices\/sessions\/([^/]+)$/.exec(url) : null;
+    const rebindM = req.method === "POST" ? /^\/v1\/devices\/sessions\/([^/]+)\/rebind$/.exec(url) : null;
+    if (!listHit && !readM && !rebindM) {
+        miss.fell = true;
+        return;
+    }
+    const principal = gatedPrincipal(req, deps.config);
+    if (deps.config.requirePrincipal && principal === undefined) {
+        sendError(res, 401, "auth.principal_required", `missing principal header '${deps.config.principalHeader}'`);
+        return;
+    }
+    const store = deps.deviceStore;
+    const hub = deps.deviceHub;
+    if (!store || !hub) {
+        sendError(res, 501, "capability.device_lane_required", DEVICE_LANE_REQUIRED_MESSAGE);
+        return;
+    }
+    const operator = explicitOperatorOk(principal, deps.config.operatorPrincipals);
+    const domain = deviceOwnerDomainOf(req, deps.config);
+    if (listHit) {
+        if (!operator && domain === undefined) {
+            sendError(res, 403, "auth.forbidden", NO_DEVICE_DOMAIN_MESSAGE);
+            return;
+        }
+        const rows = operator ? await store.listDevicesUnscoped() : await store.listDevicesByOwner(domain);
+        const online = new Set(hub.connectedDeviceIds());
+        sendJson(res, 200, { devices: rows.filter((r) => r.status !== "revoked").map((r) => deviceListRow(r, online)) });
+        return;
+    }
+    const seg = (readM ?? rebindM)[1];
+    const decoded = safeDecode(seg);
+    if (decoded === null) {
+        sendError(res, 400, "request.path_malformed", "session id segment is not valid percent-encoding");
+        return;
+    }
+    if (!wellFormedKey(assertRootSessionIdShape, decoded)) {
+        sendError(res, 400, "request.id_invalid", "invalid session id segment (device binding keys are byte-exact: non-empty, no control characters or surrounding whitespace, at most 128 bytes)");
+        return;
+    }
+    const rootSessionId = decoded;
+    if (readM) {
+        if (!operator && domain === undefined) {
+            sendError(res, 403, "auth.forbidden", NO_DEVICE_DOMAIN_MESSAGE);
+            return;
+        }
+        const binding = await store.getSessionBinding(rootSessionId);
+        if (!binding || (!operator && !sameDeviceOwner(binding.owner, domain))) {
+            sendDeviceNotFound(res);
+            return;
+        }
+        sendJson(res, 200, { rootSessionId, boundDevice: boundDeviceOf(binding) });
+        return;
+    }
+    if (!operator && domain === undefined) {
+        sendError(res, 403, "auth.forbidden", NO_DEVICE_DOMAIN_MESSAGE);
+        return;
+    }
+    const binding = await store.getSessionBinding(rootSessionId);
+    if (!binding || (!operator && !sameDeviceOwner(binding.owner, domain))) {
+        sendDeviceNotFound(res);
+        return;
+    }
+    let body;
+    try {
+        body = (await readJson(req));
+    }
+    catch {
+        sendError(res, 400, "request.invalid_json", "invalid JSON body");
+        return;
+    }
+    if (typeof body !== "object" || body === null || typeof body.toDeviceId !== "string" || body.expectedRev === undefined) {
+        sendError(res, 400, "request.body_shape", "body must be { toDeviceId: string, expectedRev: number } — expectedRev is the binding rev read from GET /v1/devices/sessions/{rootSessionId} (explicit prior state; two concurrent operators must not silently stomp each other)");
+        return;
+    }
+    if (typeof body.expectedRev !== "number" || !Number.isInteger(body.expectedRev) || body.expectedRev < 0) {
+        sendError(res, 400, "request.field_invalid", "expectedRev must be a non-negative integer");
+        return;
+    }
+    if (!wellFormedKey(assertDeviceIdShape, body.toDeviceId)) {
+        sendError(res, 400, "request.field_invalid", "toDeviceId is not a valid device id (byte-exact key: non-empty, no control characters or surrounding whitespace, at most 64 bytes)");
+        return;
+    }
+    const toDeviceId = body.toDeviceId;
+    const expectedRev = body.expectedRev;
+    const target = await store.readDeviceForAdmission(toDeviceId, binding.owner);
+    if (!target || target.row.status !== "active") {
+        sendDeviceNotFound(res);
+        return;
+    }
+    if (!deps.runStore) {
+        sendError(res, 501, "capability.run_store_required", "device rebind needs the run store to judge the no-active-run door (a durable, cross-replica criterion) — this deployment has no run store wired");
+        return;
+    }
+    const activeTaskId = await deps.runStore.getActiveTaskId(rootSessionId);
+    if (activeTaskId) {
+        sendError(res, 409, "device.rebind_active_run", "this session has a non-terminal run — rebinding now would leave in-flight work addressed at another workspace; cancel the run (or let it finish), then retry", { activeTaskId });
+        return;
+    }
+    const result = await store.rebindSession({ rootSessionId, toDeviceId, expectedRev, owner: binding.owner });
+    switch (result.outcome) {
+        case "rebound":
+        case "idempotent":
+            sendJson(res, 200, { rootSessionId, deviceId: result.row.deviceId, rev: result.row.rev, workspaceCarryover: "none" });
+            return;
+        case "rev_conflict":
+            sendError(res, 409, "device.rebind_rev_conflict", "expectedRev does not match the binding's current rev — the session↔device binding changed since it was read; re-read it and retry with currentRev", { currentRev: result.row.rev });
+            return;
+        case "binding_not_found":
+        case "device_not_found":
+            sendDeviceNotFound(res);
+            return;
+        default: {
+            const unhandled = result;
+            void unhandled;
+            throw new Error("device rebind: unknown store outcome");
+        }
+    }
+}
+//# sourceMappingURL=devices.js.map

package/dist/http/routes/leader.js

@@ -7,7 +7,7 @@ export async function handleLeader(req, res, url, ctx) {
 }
 async function handleLeaderBody(req, res, url, ctx, miss) {
     const { deps } = ctx;
-    const { readJson, rateLimited, quotaExceeded, leaseDenied } = ctx.helpers;
+    const { readJson, rateLimited, quotaExceeded, leaseDenied, usageWindowDenied } = ctx.helpers;
     if (deps.leaderEndpoint) {
         const isLeaderPost = req.method === "POST" && url === "/v1/leader";
         const isLeaderGet = req.method === "GET" && /^\/v1\/leader\/[^/]+$/.test(url);
@@ -18,7 +18,7 @@ async function handleLeaderBody(req, res, url, ctx, miss) {
             }
             const requester = gatedPrincipal(req, deps.config) ?? null;
             if (isLeaderPost) {
-                if (rateLimited(req, res) || quotaExceeded(req, res) || (await leaseDenied(req, res)))
+                if (rateLimited(req, res) || quotaExceeded(req, res) || (await leaseDenied(req, res)) || (await usageWindowDenied(req, res)))
                     return;
                 let body;
                 try {

package/dist/http/routes/workflows.js

@@ -196,7 +196,7 @@ async function handleWorkflowAgentSteerBody(req, res, url, ctx, miss) {
         sendNotRunningWf(!wfRun
             ? "workflow agent is not running on this replica (no live handle)"
             : wfRun.status === "running"
-                ? "workflow agent is active on another replica — cross-replica live-steer is not yet supported"
+                ? "no live handle for this workflow agent on this replica — the run may be live on another replica (cross-replica live-steer is not yet supported), or this replica holds no steerable stream for it; read the workflow status faces for progress"
                 : `workflow is ${wfRun.status} — agent is not running`);
         return;
     }