@sema-agent/server 7.62.0 → 7.64.0

package/dist/config-types.d.ts

@@ -6,7 +6,7 @@
  *  compiling unchanged. All imports below are top-level `import type` (erased — never a load edge,
  *  see test/module-cycle-gate.test.ts header on verbatimModuleSyntax). */
 import type { SealedKeyPoison } from "./sealed-key.js";
-import type { A2aServerSpec, CompliancePosture, CrossSessionDialogExpiry, CrossSessionInboundSetting, FileHistoryRetentionPolicy, LockedKey, McpServerSpec, Model, ModelRoles, RetentionPolicy } from "@sema-agent/core";
+import type { A2aServerSpec, CompliancePosture, CrossSessionDialogExpiry, CrossSessionInboundSetting, FileHistoryRetentionPolicy, LockedKey, McpServerSpec, Model, ModelRoles, RetentionPolicy, WriteProtectedEntry } from "@sema-agent/core";
 import type { ApprovalHmacKey, PrincipalJwtKey } from "./auth-keys.js";
 import type { ElicitationThrottle } from "./elicitation.js";
 import type { QuestionThrottle } from "./question.js";
@@ -1268,6 +1268,31 @@ export interface ServiceConfigFlat {
      *  已收口:守卫按 `ToolCallRequest.cwd` 解析写目标,两条 lane 同得。剩余射程边界(引擎未盖戳的直接
      *  调用形)成文在 `deployment-governance.ts` 的 `RelativeTargetLexicalEnv` 类注。 */
     sensitiveWritePatterns: string[];
+    /**
+     * S-138 —— core **写保护名表**(`RunnerDeps.writeProtectedPaths` 座)的部署决定。两根 env 旋钮
+     * 共铸这**一个**键(它们写的是同一条语义面,两根同写 ⇒ boot 拒启,见 config.ts 的解析点):
+     *  · `WRITE_PROTECTED_EXTRA` ⇒ `{knob:"extra", entries:[...WRITE_PROTECTED_DEFAULT_TABLE, …增量]}`;
+     *  · `WRITE_PROTECTED_TABLE_REPLACE` ⇒ `{knob:"replace", entries:<JSON 数组原样>}`(`[]` = 显式无表)。
+     *
+     * 🔴 **缺席 = 不铸键**(与 `readFace` 族同律):座缺席时 core 的 `resolveWriteProtectedTable` 返回它
+     * 自己的缺省 51 行 —— 本仓**不复制那张表**,上游改表之日起不会有第二份真源。「缺席 = 没装表」是
+     * B-023 F2 的那个误读,读面(`writeProtection` 两位)正是为了让它不可能再发生。
+     *
+     * 🔴 为什么带 `knob` 而不是只存数组:`extra` 与 `replace` 铸出的 `entries` 在**值**上分不出来
+     * (一份 `[...DEFAULT, 两行]` 既可能是加法、也可能是运维手抄的整表),而两者对运维的意义相反 ——
+     * 读面的 `source`/`replaced` 要回答的正是「运维动没动那张表」。从值反推 = 猜,故意存事实。
+     * 座席(纯数组)由 `buildDeploymentPostureSeats` 从本键**派生**(`crossSessionInbound` 同族形制:
+     * config 存决定、座席存引擎形)。
+     *
+     * ⚠️ 与 {@link sensitiveWritePatterns} 是**并列机制、不互相覆盖**(core d.ts 原话):那一套是模式
+     * (正则/glob)型 deny,这一套是字面名表的 `allow → ask` 降级。两个读面因此分开报。
+     */
+    writeProtectedPaths?: {
+        /** 哪根旋钮写的(闭集;读面 `source` / `replaced` 的唯一判据 —— 不从 entries 的值反推)。 */
+        readonly knob: "extra" | "replace";
+        /** 座席原样递给 core 的表项(裸名简写或 `{name,kind}` 行;坏值在 boot 期由 core 响亮拒)。 */
+        readonly entries: readonly WriteProtectedEntry[];
+    };
     /** [ref]§四 opt-in (cli[ref]② finding, core[ref] suggested mechanism): the CC manual-family permission
      *  modes (default/auto/acceptEdits) gate every fs WRITE hand tool (Write/Edit/NotebookEdit) but never touched
      *  Bash — a model can `echo -n '…' > file` straight past the write-approval card. `MANUAL_MODE_SHELL_GATE`
@@ -1638,7 +1663,7 @@ export type ServiceStoreConfig = Pick<ServiceConfigFlat, "sessionBackend" | "ses
 export type ServiceModelPlaneConfig = Pick<ServiceConfigFlat, "gatewayBaseUrl" | "gatewayApiKey" | "gatewayFallbackUrls" | "gatewayMaxRetries" | "anthropic" | "resilience" | "model" | "models" | "modelApiKeyEnv" | "modelApiKeys" | "modelQuotaWeights" | "tiers" | "projects" | "roles" | "atModelAllowlist" | "cascadeLadder" | "degrade">;
 /** 组:approval(审批 / HITL 门)。`directDoorActive` 无 env 解析腿(装配层三域合取的产物),但语义上
  *  就是本组的门状态,故进组;`parseApprovalDomain` 的返回类型相应是 `Omit<…, "directDoorActive">`。 */
-export type ServiceApprovalConfig = Pick<ServiceConfigFlat, "approvalRequire" | "approvalDeny" | "approvalTimeoutSec" | "approvalAutoBudget" | "approvalNeverAuto" | "approvalHmacKeys" | "durableApproval" | "directApprovalDoor" | "directDoorActive" | "resourceSuspend" | "resourceSuspendTtlSec" | "resourceSuspendTotalTokens" | "resourceSuspendTotalBudgetUsd" | "resourceSuspendMaxSlices" | "askQuestionEnabled" | "questionThrottle" | "toolApprovalEnabled" | "permissionRulesEnabled" | "permissionRulesEnabledExplicit" | "streamAskWindowMarginMs" | "streamApproval" | "unattendedApprovalPolicy" | "mcpElicitation" | "sensitiveWritePatterns" | "manualModeShellGate" | "permissionsDisableAutoMode" | "crossSessionInbound" | "crossSessionDialogExpiry">;
+export type ServiceApprovalConfig = Pick<ServiceConfigFlat, "approvalRequire" | "approvalDeny" | "approvalTimeoutSec" | "approvalAutoBudget" | "approvalNeverAuto" | "approvalHmacKeys" | "durableApproval" | "directApprovalDoor" | "directDoorActive" | "resourceSuspend" | "resourceSuspendTtlSec" | "resourceSuspendTotalTokens" | "resourceSuspendTotalBudgetUsd" | "resourceSuspendMaxSlices" | "askQuestionEnabled" | "questionThrottle" | "toolApprovalEnabled" | "permissionRulesEnabled" | "permissionRulesEnabledExplicit" | "streamAskWindowMarginMs" | "streamApproval" | "unattendedApprovalPolicy" | "mcpElicitation" | "sensitiveWritePatterns" | "writeProtectedPaths" | "manualModeShellGate" | "permissionsDisableAutoMode" | "crossSessionInbound" | "crossSessionDialogExpiry">;
 /** 组:memory(记忆面 + TOC 同步腿)。 */
 export type ServiceMemoryConfig = Pick<ServiceConfigFlat, "memoryEngineEnabled" | "memoryEngineDir" | "memoryEngineRemoteLaneAllowed" | "memoryEngineBackend" | "memoryScope" | "memoryPersistenceCapable" | "memorySync" | "memoryEmbedder" | "memoryOrgAdmissionMode" | "memoryDelegationEvidence" | "memoryProvenance" | "memoryCapturePolicy" | "memoryConsolidationDriver" | "memoryOrgDirectoryJson" | "memoryOrgGrantTtlMs" | "memoryOrgUnavailableBackoffMs" | "projectMemoryEnabled" | "syncImportLeaseStaleSec">;
 /** 组:auth(鉴权 / 身份 / 治理棒)。`commandPolicy` 只有 sema-registry 腿(无 env 标量形),故 env 解析

package/dist/config.js

@@ -2,7 +2,7 @@ import { readFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
 import { fileURLToPath } from "node:url";
-import { BUILTIN_COMPLIANCE_DENIES, COMPLIANCE_CAPABILITIES, CROSS_SESSION_INBOUND_SETTINGS, CROSS_SESSION_DIALOG_EXPIRY_VALUES, compileReadDeny, resolveReadDenyBuiltins, CODE_AGENT_PROMPT, formatUserScope, PROTOCOL_TABLE, protocolOf, RECOMMENDED_SENSITIVE_PATTERNS, RETIRED_TOOL_NAMES, resolveFileHistoryRetention, resolveLockedKeys, validatePermissionRules } from "@sema-agent/core";
+import { BUILTIN_COMPLIANCE_DENIES, COMPLIANCE_CAPABILITIES, CROSS_SESSION_INBOUND_SETTINGS, CROSS_SESSION_DIALOG_EXPIRY_VALUES, compileReadDeny, resolveReadDenyBuiltins, CODE_AGENT_PROMPT, formatUserScope, PROTOCOL_TABLE, protocolOf, RECOMMENDED_SENSITIVE_PATTERNS, RETIRED_TOOL_NAMES, resolveFileHistoryRetention, resolveLockedKeys, validatePermissionRules, WRITE_PROTECTED_DEFAULT_TABLE, resolveWriteProtectedTable } from "@sema-agent/core";
 import { ROSTER_PRIMARY_ROLES, ROSTER_CHEAP_ROLES } from "@sema-agent/settings-schema";
 import { parseApprovalHmacKeys, parsePrincipalJwks } from "./auth-keys.js";
 import { DEFAULT_ELICITATION_THROTTLE } from "./elicitation.js";
@@ -10,6 +10,7 @@ import { isV2ScopeKey } from "./memory-scope.js";
 import { DEFAULT_QUESTION_THROTTLE } from "./question.js";
 import { GIT_API_KINDS, isGitApiKind } from "./git-api-kind.js";
 import { RETENTION_MODES, MEMORY_CONSOLIDATION_MIN_INTERVAL_SEC } from "./config-types.js";
+import { buildWriteProtectionPosture } from "./write-protection.js";
 import { normalizeSshFingerprint } from "./ssh-host-key.js";
 import { CONTROL_AND_BIDI_STRIP_RE } from "./text-bidi.js";
 export { RETENTION_MODES, MEMORY_CONSOLIDATION_MIN_INTERVAL_SEC } from "./config-types.js";
@@ -414,6 +415,85 @@ function assertReadDenyBuiltinsResolvable(tiers, exclude) {
     if (exclude !== undefined)
         check("READ_DENY_BUILTIN_EXCLUDE", { ...(tiers !== undefined ? { tiers } : {}), exclude });
 }
+const WRITE_PROTECTED_JSON_SHAPED = /[[\]{}"]/;
+function writeProtectedTableOrRefuse(name, raw, opts) {
+    const trimmed = raw.trim();
+    if (trimmed === "") {
+        throw new Error(`env ${name}="" is empty — refusing to start rather than guessing which of the two meanings you wanted. ` +
+            `An unexpanded compose variable and a deliberate posture must not look alike on a protection knob: unset the variable to keep the engine's default table, ` +
+            `or write WRITE_PROTECTED_TABLE_REPLACE=[] for the explicit "no write-protection table at all" posture.`);
+    }
+    let list;
+    if (WRITE_PROTECTED_JSON_SHAPED.test(trimmed)) {
+        let parsed;
+        try {
+            parsed = JSON.parse(trimmed);
+        }
+        catch (e) {
+            throw new Error(`env ${name} is not valid JSON: ${e instanceof Error ? e.message : String(e)} — expected a JSON ARRAY of "name" strings or {name, kind} rows.`);
+        }
+        if (!Array.isArray(parsed)) {
+            throw new Error(`env ${name} must be a JSON ARRAY of "name" strings or {name, kind} rows — got ${typeof parsed === "object" && parsed !== null ? "a JSON object" : `the JSON scalar ${JSON.stringify(parsed)}`}. ` +
+                `A single row still needs its brackets: [${trimmed}].`);
+        }
+        list = parsed;
+    }
+    else if (!opts.bareNames) {
+        throw new Error(`env ${name} must be a JSON array — the whole-table REPLACEMENT knob deliberately has no comma shorthand: ` +
+            `a slipped bare string there would swap the engine's whole table for one row. Write ["${trimmed.split(",")[0].trim()}"] if that is really what you mean, ` +
+            `or use WRITE_PROTECTED_EXTRA to ADD rows to the default table.`);
+    }
+    else {
+        const parts = trimmed.split(",").map((s) => s.trim());
+        const names = parts.filter((s) => s.length > 0);
+        if (names.length !== parts.length)
+            throw new Error(`env ${name}="${raw}" has an empty entry between commas — refusing to start rather than silently applying a half-parsed list (#157).`);
+        list = names;
+    }
+    try {
+        return resolveWriteProtectedTable([...(opts.prefix ?? []), ...list]);
+    }
+    catch (e) {
+        throw new Error(`env ${name}: ${e instanceof Error ? e.message : String(e)}`);
+    }
+}
+function parseWriteProtectedTableEnv(extraRaw, replaceRaw) {
+    if (extraRaw !== undefined && replaceRaw !== undefined) {
+        throw new Error(`env WRITE_PROTECTED_EXTRA and WRITE_PROTECTED_TABLE_REPLACE are both set — two writers on ONE semantic surface (the engine's write-protection table). ` +
+            `There is no honest composition of "add to the default table" and "replace the table wholesale", so this refuses to boot instead of picking one: ` +
+            `keep WRITE_PROTECTED_EXTRA for additions, or fold your additions into WRITE_PROTECTED_TABLE_REPLACE and unset the other.`);
+    }
+    if (extraRaw !== undefined) {
+        return { knob: "extra", entries: writeProtectedTableOrRefuse("WRITE_PROTECTED_EXTRA", extraRaw, { bareNames: true, prefix: WRITE_PROTECTED_DEFAULT_TABLE }) };
+    }
+    if (replaceRaw === undefined)
+        return undefined;
+    const decision = { knob: "replace", entries: writeProtectedTableOrRefuse("WRITE_PROTECTED_TABLE_REPLACE", replaceRaw, { bareNames: false }) };
+    const posture = buildWriteProtectionPosture({ writeProtectedPaths: decision });
+    const dropped = posture.droppedDefaultRows ?? [];
+    CONFIG_NOTICES.push(posture.source === "off"
+        ? {
+            event: "write_protection_table_disabled",
+            fields: {
+                env: "WRITE_PROTECTED_TABLE_REPLACE",
+                raw: "[]",
+                droppedCount: String(dropped.length),
+                effect: `the engine's write-protection table is now EMPTY — all ${String(dropped.length)} default rows are gone and a write to any of them ` +
+                    `(.zshrc / .ssh / .git / …) no longer gets the allow→ask demotion. This is a legal, explicit posture; it is logged loudly so it can never be a silent one`,
+            },
+        }
+        : {
+            event: "write_protection_table_replaced",
+            fields: {
+                env: "WRITE_PROTECTED_TABLE_REPLACE",
+                rows: String(posture.rows.length),
+                droppedCount: String(dropped.length),
+                droppedDefaultRows: dropped.join(","),
+                effect: "whole-table replacement: the default rows listed above are NO LONGER protected (use WRITE_PROTECTED_EXTRA if you meant to ADD rows to the default table)",
+            },
+        });
+    return decision;
+}
 function enumEnv(name, fallback, allowed) {
     const v = (process.env[name] ?? fallback);
     if (!allowed.includes(v))
@@ -966,6 +1046,7 @@ function parseApprovalDomain(ctx) {
                 return [];
             return trimmed.split(",").map((p) => p.trim()).filter((p) => p.length > 0);
         })(process.env.SENSITIVE_WRITE_PATTERNS),
+        ...((decision) => (decision === undefined ? {} : { writeProtectedPaths: decision }))(parseWriteProtectedTableEnv(process.env.WRITE_PROTECTED_EXTRA, process.env.WRITE_PROTECTED_TABLE_REPLACE)),
         ...((raw) => {
             const trimmed = (raw ?? "").trim();
             if (trimmed === "always" || trimmed === "classify")
@@ -1803,7 +1884,7 @@ const APPROVAL_GROUP_KEYS = [
     "approvalRequire", "approvalDeny", "approvalTimeoutSec", "approvalAutoBudget", "approvalNeverAuto",
     "approvalHmacKeys", "durableApproval", "directApprovalDoor", "directDoorActive", "resourceSuspend",
     "resourceSuspendTtlSec", "resourceSuspendTotalTokens", "resourceSuspendTotalBudgetUsd", "resourceSuspendMaxSlices", "askQuestionEnabled", "questionThrottle", "toolApprovalEnabled", "permissionRulesEnabled", "permissionRulesEnabledExplicit", "streamAskWindowMarginMs", "streamApproval", "unattendedApprovalPolicy", "mcpElicitation",
-    "sensitiveWritePatterns", "manualModeShellGate", "permissionsDisableAutoMode", "crossSessionInbound", "crossSessionDialogExpiry",
+    "sensitiveWritePatterns", "writeProtectedPaths", "manualModeShellGate", "permissionsDisableAutoMode", "crossSessionInbound", "crossSessionDialogExpiry",
 ];
 const MEMORY_GROUP_KEYS = [
     "memoryEngineEnabled", "memoryEngineDir", "memoryEngineRemoteLaneAllowed", "memoryEngineBackend", "memoryScope",

package/dist/degenerate-instrument.d.ts

@@ -1,36 +1,3 @@
-/**
- * Degenerate-repetition instrument (a/b classifier).
- *
- * When a task fails with `errorCode === "output.degenerate"` (core 1.59), core hands back
- * `salvagedOutput` = the degenerate turn's text — **already tail-TRIMMED at the brain stream layer**.
- * 🔴 [ref] correction (this note used to claim "the **whole** text, good head + looped garbage tail";
- * that was true of core 1.59 and false of every engine that ships `trimDegenerateTail` — verified against
- * the installed dist, not against JSDoc): on the main path `assemble-result` fills the seat from the same
- * final message the brain already trimmed, so what arrives here is `head + exactly ONE copy of the
- * repeating unit` (unit ≤ `MAX_PERIOD` = 100 chars). Untrimmed text only reaches us on the narrow
- * fallbacks — the cut landed on the reasoning face, or `trimDegenerateTail` bailed (`reps < 2`, empty
- * unit, unit-loop period mismatch). Consequence for the numbers below: {@link repetitionTail} is a
- * **no-op** on the main-path input (one copy is not ≥ {@link MIN_REPEATS}), so `uniquePrefixLen`
- * collapses onto `salvagedLen` and the a/unknown split degrades to a pure length test. The a-vs-b
- * decision is unaffected (it is decided by `priorChars`, independently); the residual bias on a/unknown
- * is bounded by one unit ≤ 100 chars. Pin: the "已裁形" case in `test/degenerate-instrument.test.ts`
- * drives the REAL `inspectDegenerate` + `trimDegenerateTail` and asserts the tail measures 0.
- * Core's *salvage ②* — recovering the "last substantive turn" instead of the current one — is being
- * gated on REAL data: how often is the useful answer actually in an EARLIER turn vs. in the degenerate
- * turn itself? This instrument answers that, per event, without changing any behaviour.
- *
- * Classification (since the last user message = this task's own turns):
- *  - **a** good+garbage SAME turn — the degenerate turn carries a substantive unique head before the
- *    loop. Whole-turn salvage ① + a tail-trim is enough; ② would add nothing.
- *  - **b** good EARLIER / degenerate LATER — a substantive assistant turn already exists before the
- *    degenerate one. ② ("last-substantive-turn") would recover it; ① (current turn) throws it away.
- *  - **unknown** — degenerate from the start, nothing substantive anywhere (neither ① nor ② helps).
- *
- * Output is measurement only: a `degenerate_total{class}` counter (→ `/metrics/summary`) plus one
- * structured log line carrying the raw signals. The aggregate a/b/unknown frequencies are what gets
- * reported back to the core AI to decide whether ② is worth building. The repetition-boundary estimate
- * here is for *measuring* the unique head — it is NOT the production tail-trim (that lives in core).
- */
 import { type TaskResult } from "@sema-agent/core";
 import type { Pool } from "mysql2/promise";
 import type { Metrics } from "./observability/metrics.js";

package/dist/degenerate-instrument.js

@@ -1,3 +1,4 @@
+import { failureCodeOf } from "./terminal.js";
 import { StoredSession } from "@sema-agent/core";
 import { TiDBSessionStorage } from "./plugins/tidb-session-storage.js";
 const SUBSTANTIVE_CHARS = 200;
@@ -95,7 +96,7 @@ async function readPriorTurns(pool, sessionId, salvaged) {
 }
 export function makeDegenerateInstrument(pool, metrics, logger) {
     return (result) => {
-        if (result.errorCode !== "output.degenerate")
+        if (failureCodeOf(result.terminal) !== "output.degenerate")
             return;
         void (async () => {
             const salvaged = result.salvagedOutput ?? "";

package/dist/fleet/fleet-bus.d.ts

@@ -1,4 +1,4 @@
-import type { TaskNotificationPayload, WorkflowRun } from "@sema-agent/core";
+import type { TaskNotificationPayload, TerminalCause, WorkflowRun } from "@sema-agent/core";
 import type { RunRecord } from "../plugins/store-contracts.js";
 /** [ref] 幽灵行案的单源判别:一条 `task_notification` 只有在 **agent 族 × 终态** 时才允许打
  *  `onChildTerminal`(fleet「subagent 树」只渲 agent 子代)。`background_bash`/`monitor`/`external`
@@ -546,11 +546,16 @@ export declare function fleetRunPublisher(bus: FleetEventBus | undefined, run: {
 export type FleetRunPublisher = ReturnType<typeof fleetRunPublisher>;
 /** [ref]①/(a) 案:TaskResult → 终态行帧残局键映射(sync/background/resume 三条腿各自 settle,共用一处
  *  映射——键名映射写三遍必漂移)。usage 与 {@link BgNotification.usage} 同形:stats.tokens→totalTokens、
- *  stats.toolCalls→toolUses(名对齐,消费端一个形状)。errorCode "cancelled" ⇒ stoppedBy:"user"(与
- *  markStopSource 的归因值同源);transcriptId 顶层 = run 的 sessionId([ref]§二拍)。缺源的键不铸。 */
+ *  stats.toolCalls→toolUses(名对齐,消费端一个形状)。失败码 "cancelled" ⇒ stoppedBy:"user"(与
+ *  markStopSource 的归因值同源);transcriptId 顶层 = run 的 sessionId([ref]§二拍)。缺源的键不铸。
+ *
+ *  🔴 S-136(core 7.6.0 D-8):入参从**结构性可缺席** `errorCode?: string` 改成 `terminal?: TerminalCause`。
+ *  留着旧形不会红 —— 那正是危险所在:`TaskResult` 上已经没有 `errorCode` 这个键了,可结构性可选参数照样
+ *  编译通过,于是 `stoppedBy:"user"` 会**静默地永远不再铸**(取消的 run 在舰队行上从此看不出是被人杀的)。
+ *  终局事实一律走因由,`failureCodeOf` 是本仓读「这次失败带的是哪个码」的唯一形。 */
 export declare function fleetRunResiduals(result: {
     sessionId?: string;
-    errorCode?: string;
+    terminal?: TerminalCause;
     stats?: {
         turns?: number;
         tokens?: number;

package/dist/fleet/fleet-bus.js

@@ -1,5 +1,6 @@
 import { EventEmitter } from "node:events";
 import { deriveAgentDisplayStatus, isDelegatedAgentTerminal } from "@sema-agent/core";
+import { persistedPlaneOf } from "../terminal.js";
 import { recordFailOpen } from "../observability/fail-open.js";
 import { redactSecrets } from "../trace/redact.js";
 export function isFleetAgentTerminalNotification(n) {
@@ -341,7 +342,7 @@ export function fleetRunResiduals(result) {
         : {};
     return {
         ...(Object.keys(usage).length > 0 ? { usage } : {}),
-        ...(result.errorCode === "cancelled" ? { stoppedBy: "user" } : {}),
+        ...(persistedPlaneOf(result).errorCode === "cancelled" ? { stoppedBy: "user" } : {}),
         ...(result.sessionId ? { transcriptId: result.sessionId } : {}),
     };
 }

package/dist/host-decision.d.ts

@@ -0,0 +1,39 @@
+/**
+ * **宿主的决策事实** —— 一条耐久 park 被结算时,本服务能如实陈述的那半件事:谁结束了这次等待,以及
+ * 审批通道自报的归属。一个叶子模块(只依赖 `@sema-agent/core`),四个消费点共用一个定义。
+ *
+ * ## 为什么是「事实」而不是「结算词」(core 7.6.0 / [ref] S6-A,BREAKING)
+ *
+ * 旧形里 server 要往 `ResumeOutcome` 上写 core 的**结算词**(`ApprovalSettledBy` = `"human"` /
+ * `"timeout"` / `"aborted"`),于是「哪个词配哪个 decision」这条相容规则得由 server 自己记住 —— 而记错的
+ * 方向恰恰是这条规则存在的理由:**「窗到期」被报成「另一个人拒绝了」**。7.6.0 起 core 的
+ * `@contract settlement.single_mint` 逐字写着「宿主永不铸词」:宿主交事实,core 在 resume 入口铸
+ * `human_allowed` / `human_refused` / `park_sla_expired`,写进行的 `resolvedOutcome.gateOutcome`,再投影到
+ * 那次调用的 `tool_end.gate`。
+ *
+ * ⇒ 本仓的规则从「记住一张词×决定的相容表」变成「说出你知道的那两件事」。相容性也不再靠记忆:一次
+ * sweep 不可能 `allow`,core pre-CAS 拒。
+ */
+import { type ResumeOutcome } from "@sema-agent/core";
+/**
+ * 谁结束了这次等待,以及通道自报的归属。
+ *  · `decidedBy: "person"` —— 运维经审批通道做的决定(两条 HTTP `/decide` 腿);
+ *  · `decidedBy: "sla_timeout"` —— 宿主自己的 SLA 扫在行的 deadline 上判的(FACET A;**只有** sweep 能这么说,
+ *    而 sweep 结构上不能 `allow`)。
+ *  · `approver` —— 通道自报的结算方标识串。**缺席永不读成**「没人批」或「有人批」,只意味着通道没报名字。
+ */
+/** 直接取 core `ResumeOutcome` policy_ask 臂的 `hostDecision` 型 —— 本仓不复述那两个词(第二铸点)。 */
+export type HostDecision = Extract<ResumeOutcome, {
+    gate: "policy_ask";
+}>["hostDecision"];
+/**
+ * 一次**人为** decide 的事实。`principal` = 那条腿已经验过身份的决策者(缺席 = 匿名档的部署,通道确实
+ * 没有名字可报)。
+ *
+ * 归属串走 core 的 `screenApproverAttribution` **先筛后带**:core 对形不合的归属是 pre-CAS 响亮拒
+ * (`checkpoint.invalid_outcome`),而一个奇形怪状的 principal 把一次合法的人工决策变成 400 是纯回归。
+ * 筛不过 ⇒ **不带这一格**(而不是带一个被改造过的串):归属是转录,不是可以「修一修」的东西 —— 修出来的
+ * 名字既不是通道报的那个,也不是「通道没报」,两头都不真。
+ */
+export declare function personDecision(principal: string | undefined): HostDecision;
+//# sourceMappingURL=host-decision.d.ts.map

package/dist/host-decision.js

@@ -0,0 +1,6 @@
+import { screenApproverAttribution } from "@sema-agent/core";
+export function personDecision(principal) {
+    const screened = screenApproverAttribution(principal);
+    return { decidedBy: "person", ...(screened.approver !== undefined ? { approver: screened.approver } : {}) };
+}
+//# sourceMappingURL=host-decision.js.map

package/dist/http/principal-gate.d.ts

@@ -11,6 +11,15 @@ export declare function systemFor(req: IncomingMessage, config: ServiceConfig):
 /** "presented credentials must verify":Authorization 带 Bearer/token scheme 且三路全验不过 → true。
  *  其他 scheme(Basic 等,非我方凭证空间)不管——由原有门语义处置,避免误伤未知代理注头。 */
 export declare function bearerPresentedButUnverified(req: IncomingMessage, config: ServiceConfig): boolean;
+/** loopback 三形(IPv4 / IPv6 / IPv4-mapped)—— 一处定义,diagnostics 门与任何「本机自用」判据同吃。缺席 ⇒ false(fail-closed)。 */
+export declare function isLoopbackAddress(addr: string | undefined): boolean;
+/**
+ * 这次请求的身份是不是**密码学验过**的(而不是调用方自述的 header):`sso` = registry JWT(入口预认证的签名真源)/
+ * `direct_door_jwt` = direct-door principal JWT 验过 / `service_token` = 出示了单一或 per-system service token。
+ * 缺席 = 只有自述头或什么都没有。一处判定(7.63.0 codex [high]+[medium]):off-box 读 operator 面的门用它——名单只在
+ * 有可验身份时才是身份,零凭据下它只是谁都能写的字符串;而 JWT 身份不依赖静态 token 的在场。
+ */
+export declare function verifiedIdentitySource(req: IncomingMessage, config: ServiceConfig): "sso" | "direct_door_jwt" | "service_token" | undefined;
 export declare function gatedPrincipal(req: IncomingMessage, config: ServiceConfig): string | undefined;
 /** The EXPLICIT operator gate (IMAGE-API-DESIGN.md §P2.4a MUST-FIX) — NOT the bare `isOperator` (whose empty-list
  *  "true-for-all" is an unrestricted-write exec door the instant OPERATOR_PRINCIPALS is empty). Requires a non-empty

package/dist/http/principal-gate.js

@@ -33,6 +33,18 @@ export function bearerPresentedButUnverified(req, config) {
         return false;
     return true;
 }
+export function isLoopbackAddress(addr) {
+    return addr === "127.0.0.1" || addr === "::1" || addr === "::ffff:127.0.0.1";
+}
+export function verifiedIdentitySource(req, config) {
+    if (ssoVerifiedPrincipal(req))
+        return "sso";
+    if (systemFor(req, config) !== undefined)
+        return "service_token";
+    if (config.directDoorActive && verifiedPrincipal(req, config) !== undefined)
+        return "direct_door_jwt";
+    return undefined;
+}
 export function gatedPrincipal(req, config) {
     if (bearerPresentedButUnverified(req, config))
         return undefined;

package/dist/http/route-ctx.d.ts

@@ -15,7 +15,8 @@
  * 本文件对 server.ts 的引用一律 `import type`(tsc 擦除,非装载边)。
  */
 import type { IncomingMessage, ServerResponse } from "node:http";
-import type { ApprovalSettledBy, TaskStream, TaskSpec, TaskResult, QuestionAnswer, CheckpointToken, ResumeOutcome, Runner } from "@sema-agent/core";
+import type { HostDecision } from "../host-decision.js";
+import type { TaskStream, TaskSpec, TaskResult, QuestionAnswer, CheckpointToken, ResumeOutcome, Runner } from "@sema-agent/core";
 import type { FlatServiceDeps, RequestAuth } from "./server.js";
 import type { TaskRequestBody, DecideBinding } from "./wire-types.js";
 import type { IdempotencyCache } from "./idempotency.js";
@@ -244,10 +245,12 @@ export interface RouteLegs {
     /** 同步腿的终局记账(计费/配额/指标),tasks 域用。 */
     finalizeTaskResult(result: TaskResult, principal: string | undefined, objective: string, sessionId: string | undefined): void;
     /** approvals 决策腿:session → pending checkpoint → markResuming CAS → 驱动续跑。
-     *  `settledBy` = **这次结算的出处**(core `ApprovalSettledBy`),必填:本腿有两个调用方(HTTP
-     *  `/decide` = 人;内部 D-D SLA deny-sweep = 窗到期),而函数内部分辨不出谁在叫它 —— 必填参数把
-     *  「漏报出处」变成编译错,不是一条下游把「没人答」渲染成「有人拒」的静默假出处。 */
-    resumeCheckpoint(sessionId: string, decision: "approve" | "deny", reason: string | undefined, settledBy: ApprovalSettledBy, req?: IncomingMessage, answer?: QuestionAnswer, binding?: DecideBinding, 
+     *  `hostDecision` = **这次结算的事实**(谁结束了这次等待 + 通道自报的归属),必填:本腿有两个调用方
+     *  (HTTP `/decide` = 人;内部 D-D SLA deny-sweep = 窗到期),而函数内部分辨不出谁在叫它 —— 必填参数把
+     *  「漏报出处」变成编译错,不是一条下游把「没人答」渲染成「有人拒」的静默假出处。
+     *  🔴 S-136(core 7.6.0 S6-A):宿主报事实、core 铸词 —— server 不再传结算词(旧形传 core 的三词之一,
+     *  于是「哪个词配哪个 decision」这条相容规则要 server 自己记,而记错的方向恰是上面那句要防的)。 */
+    resumeCheckpoint(sessionId: string, decision: "approve" | "deny", reason: string | undefined, hostDecision: HostDecision, req?: IncomingMessage, answer?: QuestionAnswer, binding?: DecideBinding, 
     /** [ref] codex R4(验真后修):remember 豁免的 grant 挂点。**工具名不再由路由自己读**(那是与本函数
      *  载入行分歧的第三次 scope-less 读,三读分歧下会给他人工具落豁免=提权)——由本函数把**已属主校验的
      *  载入 cp** 的工具名(`validatedToolName`,非 tool_approval / AskUserQuestion / legacy null ⇒ `null`

package/dist/http/routes/a2a-serve.js

@@ -1,3 +1,4 @@
+import { persistedPlaneOf } from "../../terminal.js";
 import { createHash } from "node:crypto";
 import { memoRedactedRead, redactErrorMessage } from "../../observability/run-terminal-log.js";
 import { A2A_TASK_STATES } from "@sema-agent/core";
@@ -84,8 +85,9 @@ function statusTextForRun(run, state) {
     const memo = (seat, raw) => (isTerminalRunStatus(run.status) ? memoRedactedRead(`a2a.${seat}`, raw, (v) => redactErrorMessage(v) ?? "") : (redactErrorMessage(raw) ?? ""));
     if (run.error)
         return memo("error", run.error);
-    if (run.result?.errorMessage)
-        return memo("errorMessage", run.result.errorMessage);
+    const runPlaneMessage = persistedPlaneOf(run.result).errorMessage;
+    if (runPlaneMessage)
+        return memo("errorMessage", runPlaneMessage);
     return undefined;
 }
 function taskFromRun(run, stale) {

package/dist/http/routes/approvals-assistant.d.ts

@@ -1,16 +1,3 @@
-/**
- * [ref] A9 域模块 —— 人在环审批面(durable F4 + legacy)与 assistant-scheduler 三动词。
- *
- * 路由(前缀 `/v1/approvals` 与 `/v1/assistant`):
- *   · durable 腿(接了 checkpointStore 时优先):list / stream(SSE 原生推送)/ decide|answer / preempt /
- *     resume / plan_review;
- *   · legacy 腿(approvalStore 轮询车道)已于 5.0.0 整体退役([ref]/[ref] A-5)——无 checkpointStore 时
- *     `/v1/approvals` 落 404(诚实缺席),不再有 trusted-header 决裁面。
- *
- * 所有会**烧模型**的续跑都经 `ctx.legs.*`(resumeCheckpoint / resumePreempted / resumePlanReview)走 resume
- * 家族的同一条腿:lease admission、markResuming CAS、写 run log、发 fleet 帧都在腿里,本域只做入站鉴权/形状门。
- * 本域零可变状态(抢占登记簿 `preemptableRuns` 属跨域 registry)。
- */
 import type { IncomingMessage, ServerResponse } from "node:http";
 import type { QuestionAnswer } from "@sema-agent/core";
 import type { CheckpointStoreFull } from "../../plugins/store-backend.js";

package/dist/http/routes/approvals-assistant.js

@@ -1,3 +1,4 @@
+import { personDecision } from "../../host-decision.js";
 import { DECIDED_REPLAY_SCAN_CAP, approvalPayloadFingerprint } from "../../plugins/checkpoint-store-sql.js";
 import { APPROVAL_GATE_KINDS } from "../../tool-approval.js";
 import { isParkedRunStatus } from "../../plugins/store-contracts.js";
@@ -483,7 +484,7 @@ async function handleApprovalsAssistantBody(req, res, url, ctx, miss) {
                     pendingGrant = { sessionId: grant.overrideSessionId ?? sessionId, toolName: canonical };
                 }
                 : undefined;
-            const out = await resumeCheckpoint(sessionId, decision, body.reason ?? undefined, "human", req, answer, binding, grantOnCommit, true, { principal: deciderPrincipal, explicitOperator });
+            const out = await resumeCheckpoint(sessionId, decision, body.reason ?? undefined, personDecision(deciderPrincipal), req, answer, binding, grantOnCommit, true, { principal: deciderPrincipal, explicitOperator });
             const outErrorCode = out.body.errorCode;
             if (pendingGrant !== undefined && out.status === 200 && outErrorCode !== "cancelled" && deps.approvalExemptionStore) {
                 try {

package/dist/http/routes/capabilities.js

@@ -9,6 +9,7 @@ import { mcpInjectionHonored } from "../../task-mcp.js";
 import { sendJson, sendError } from "../send.js";
 import { resolveStreamApprovalGate } from "../../tool-approval.js";
 import { projectMemoryEngineCapability } from "../../memory-posture.js";
+import { projectWriteProtectionCapability } from "../../write-protection.js";
 import { projectSqlEngineCapability } from "../../sql-engine-posture.js";
 import { workflowModelAllowlistFor, selfOrchestrationDenial } from "../../task-workflow.js";
 import { centerEntitlementSourceWired } from "../../runtime-caps-resolver.js";
@@ -114,6 +115,7 @@ async function handleCapabilitiesBody(req, res, url, ctx, miss) {
                 ...autoMode,
             },
             readFace: deps.config.readFace ?? null,
+            writeProtection: projectWriteProtectionCapability(deps.writeProtection),
             appendSystemPrompt: true,
             compactionModel: true,
             subagentOutput: Boolean(deps.subagentTaskOutput) && Boolean(deps.runStore),

package/dist/http/routes/diagnostics.js

@@ -1,6 +1,6 @@
 import { resolveStreamApprovalGate } from "../../tool-approval.js";
 import { sendJson, sendError } from "../send.js";
-import { gatedPrincipal, explicitOperatorOk } from "../principal-gate.js";
+import { gatedPrincipal, explicitOperatorOk, isLoopbackAddress, verifiedIdentitySource } from "../principal-gate.js";
 export function buildServerWiringGates(input) {
     const gate = resolveStreamApprovalGate({
         toolApprovalEnabled: input.toolApprovalEnabled,
@@ -56,9 +56,7 @@ export function zeroCredentialLoopbackDenied(remoteAddress, config) {
     const anyServiceAuth = Boolean(config.authToken) || Object.keys(config.authTokens ?? {}).length > 0;
     if (anyServiceAuth)
         return false;
-    const addr = remoteAddress ?? "";
-    const isLoopback = addr === "127.0.0.1" || addr === "::1" || addr === "::ffff:127.0.0.1";
-    return !isLoopback;
+    return !isLoopbackAddress(remoteAddress);
 }
 export async function handleDiagnostics(req, res, url, ctx) {
     const miss = { fell: false };
@@ -74,6 +72,10 @@ async function handleDiagnosticsBody(req, res, url, ctx, miss) {
                 sendError(res, 403, "auth.operator_only", "wiring diagnostics are operator-only on a multi-tenant worker");
                 return;
             }
+            if (!isLoopbackAddress(req.socket.remoteAddress) && verifiedIdentitySource(req, deps.config) === undefined) {
+                sendError(res, 403, "auth.loopback_only", "wiring diagnostics on a zero-credential deployment are readable from loopback only — configure SERVICE_AUTH_TOKEN to read remotely");
+                return;
+            }
         }
         else if (zeroCredentialLoopbackDenied(req.socket.remoteAddress, deps.config)) {
             sendError(res, 403, "auth.loopback_only", "wiring diagnostics on a zero-credential deployment are readable from loopback only — configure SERVICE_AUTH_TOKEN to read remotely");
@@ -87,6 +89,7 @@ async function handleDiagnosticsBody(req, res, url, ctx, miss) {
             static: deps.staticWiring,
             memoryPosture: deps.memoryPosture ?? null,
             sqlEngine: deps.sqlEngineFacts?.() ?? null,
+            writeProtection: deps.writeProtection ?? null,
             configApply: deps.configApplyState?.() ?? null,
             mcpRevocations: deps.mcpRevocationState?.() ?? null,
             serverGates: buildServerWiringGates({

package/dist/http/routes/runs.js

@@ -1,3 +1,4 @@
+import { persistedPlaneOf } from "../../terminal.js";
 import { memoRedactedRead, memoRedactTerminalResult, redactErrorMessage, redactHead, redactLedgerEventData, redactTerminalResult } from "../../observability/run-terminal-log.js";
 import { z } from "zod";
 import { uuidv7, mintCheckpointToken, CheckpointError, validatePendingSteer } from "@sema-agent/core";
@@ -260,7 +261,7 @@ async function handleRunsBody(req, res, url, ctx, miss) {
                 result: isTerminalRunStatus(run.status) ? memoRedactTerminalResult("run.result", run.result ?? undefined) : redactTerminalResult(run.result ?? undefined),
                 supervisorCost,
                 suggestions,
-                errorCode: stale ? undefined : (run.result?.errorCode ?? undefined),
+                errorCode: stale ? undefined : (persistedPlaneOf(run.result).errorCode ?? undefined),
                 error: stale ? "run stalled (instance lost?)" : isTerminalRunStatus(run.status) ? memoRedactedRead("run.error", run.error ?? undefined, redactErrorMessage) : redactErrorMessage(run.error ?? undefined),
                 jobId: run.jobId ?? undefined,
                 source: run.source ?? undefined,
@@ -331,7 +332,7 @@ async function handleRunsBody(req, res, url, ctx, miss) {
             const err = note;
             try {
                 const cancelContext = buildCancelContext(taskId, Date.parse(run.createdAt));
-                const result = { taskId, sessionId: run.sessionId, status: "failed", errorCode: "cancelled", errorMessage: err, stats: { turns: 0, tokens: 0 }, ...(cancelContext ? { cancelContext } : {}) };
+                const result = { taskId, sessionId: run.sessionId, terminal: { kind: "failed", code: "cancelled", message: err }, stats: { turns: 0, tokens: 0 }, ...(cancelContext ? { cancelContext } : {}) };
                 let lastErr;
                 for (let attempt = 0;; attempt++) {
                     try {