@sema-agent/server 7.62.0 → 7.64.0

package/dist/http/routes/tasks.js

@@ -1,6 +1,7 @@
 import { redactErrorMessage, redactHead, redactTerminalResult } from "../../observability/run-terminal-log.js";
-import { runWithVerification, runCascade, uuidv7 } from "@sema-agent/core";
-import { graftParkToolCallId, markChildrenStoppedByUserOnAbort, resumeAtHttpStatus, stripCheckpointToken, HEARTBEAT_MS } from "../../runs.js";
+import { runWithVerification, runCascade, uuidv7, terminalProjection } from "@sema-agent/core";
+import { graftParkToolCallId, markChildrenStoppedByUserOnAbort, resumeAtHttpStatus, HEARTBEAT_MS } from "../../runs.js";
+import { stripResumeToken } from "../../terminal.js";
 import { withPrincipal } from "../../observability/principal-context.js";
 import { fleetRunPublisher, fleetRunLabels, fleetRunResiduals, isFleetAgentTerminalNotification } from "../../fleet/fleet-bus.js";
 import { defaultSubagentTailBus, projectTailFrame } from "../../fleet/subagent-tail-bus.js";
@@ -50,11 +51,12 @@ async function handleTasksBody(req, res, url, ctx, miss) {
     const reqState = ctx.req;
     const source = ctx.req.source;
     const noteRunOutcome = (r) => {
-        if (!r?.status)
+        if (!r?.terminal)
             return;
-        reqState.runStatus = r.status;
-        if (r.errorCode)
-            reqState.runErrorCode = r.errorCode;
+        const plane = terminalProjection(r.terminal);
+        reqState.runStatus = plane.status;
+        if (plane.errorCode)
+            reqState.runErrorCode = plane.errorCode;
     };
     if (req.method === "POST" && (url === "/v1/tasks" || url === "/v1/tasks/stream")) {
         const rawIdem = headerStr(req.headers["idempotency-key"]);
@@ -193,10 +195,8 @@ async function handleTasksBody(req, res, url, ctx, miss) {
                     return {
                         taskId: durableTaskId ?? "",
                         sessionId: prepared.spec.sessionId ?? "",
-                        status: "failed",
+                        terminal: { kind: "failed", code: "cancelled", message: errorMessage },
                         result: "",
-                        errorCode: "cancelled",
-                        errorMessage,
                         stats: { turns: 0, tokens: 0 },
                         ...(ctx ? { cancelContext: ctx } : {}),
                     };
@@ -403,16 +403,16 @@ async function handleTasksBody(req, res, url, ctx, miss) {
                                 if (ev.type === "message_committed" && ev.role === "user")
                                     userMsgEntryId = ev.entryId;
                                 if (ev.type === "done") {
-                                    finalResult = redactTerminalResult(stripCheckpointToken(await graftParkToolCallId(ev.result, deps.checkpointStore)));
+                                    finalResult = redactTerminalResult(stripResumeToken(await graftParkToolCallId(ev.result, deps.checkpointStore)));
                                     if (durableTaskId && finalResult)
                                         finalResult = { ...finalResult, taskId: durableTaskId };
-                                    if (durableTaskId && cancelledViaVerb.has(durableTaskId) && finalResult?.status === "failed" && !finalResult.errorCode) {
-                                        finalResult = { ...finalResult, errorCode: "cancelled" };
+                                    if (durableTaskId && cancelledViaVerb.has(durableTaskId) && finalResult?.terminal.kind === "failed" && !finalResult.terminal.code) {
+                                        finalResult = { ...finalResult, terminal: { ...finalResult.terminal, code: "cancelled" } };
                                     }
                                     finalizeTaskResult(ev.result, principal, prepared.spec.objective, prepared.spec.sessionId);
                                     noteRunOutcome(finalResult);
                                     putRewindAnchor();
-                                    settleFleet(finalResult?.status ?? "completed", fleetRunResiduals(finalResult));
+                                    settleFleet(finalResult ? terminalProjection(finalResult.terminal).status : "completed", fleetRunResiduals(finalResult));
                                     if (ledgerSink && finalResult) {
                                         if (usageKey && deps.modelUsage && deps.runStore && durableTaskId) {
                                             const rs2 = deps.runStore;
@@ -622,12 +622,13 @@ async function handleTasksBody(req, res, url, ctx, miss) {
                         }, withApproval)
                         : withApproval());
                     if (durableTaskId && deps.runStore) {
-                        if (finalResult?.status === "suspended" && deps.checkpointStore)
+                        const finalPlane = finalResult ? terminalProjection(finalResult.terminal) : undefined;
+                        if (finalPlane?.status === "suspended" && deps.checkpointStore)
                             await deps.runStore.setSuspended(durableTaskId);
-                        else if (finalResult?.status === "needs_review" && deps.checkpointStore)
+                        else if (finalPlane?.status === "needs_review" && deps.checkpointStore)
                             await deps.runStore.setNeedsReview(durableTaskId);
-                        else if (finalResult)
-                            await deps.runStore.setTerminal(durableTaskId, finalResult.status, finalResult, finalResult.errorMessage ?? null);
+                        else if (finalResult && finalPlane)
+                            await deps.runStore.setTerminal(durableTaskId, finalPlane.status, finalResult, finalPlane.errorMessage ?? null);
                         else {
                             putRewindAnchor();
                             const pending = await deps.checkpointStore?.findPendingTokenBySession(prepared.spec.sessionId);
@@ -688,8 +689,9 @@ async function handleTasksBody(req, res, url, ctx, miss) {
                                         ledgerTerminal = true;
                                         await ledgerSink.onDone(finalResult).catch(() => undefined);
                                     }
-                                    await deps.runStore.setTerminal(durableTaskId, finalResult.status, finalResult, finalResult.errorMessage ?? null);
-                                    settleFleet(finalResult.status, fleetRunResiduals(finalResult));
+                                    const retryPlane = terminalProjection(finalResult.terminal);
+                                    await deps.runStore.setTerminal(durableTaskId, retryPlane.status, finalResult, retryPlane.errorMessage ?? null);
+                                    settleFleet(retryPlane.status, fleetRunResiduals(finalResult));
                                 }
                                 else if (ac.signal.aborted) {
                                     const err = "stream aborted before completion (run cancelled)";
@@ -721,7 +723,7 @@ async function handleTasksBody(req, res, url, ctx, miss) {
             };
             counters.uncountedBillableInflight++;
             try {
-                resp = await idemCache.run(idemKey, runStreamSubmitLeg, (r) => r.body?.status === "completed");
+                resp = await idemCache.run(idemKey, runStreamSubmitLeg, (r) => r.body?.terminal.kind === "completed");
             }
             catch (e) {
                 deps.logger?.error("stream_error", { closed, err: redactHead(e instanceof Error ? e.message : String(e), 2000) });
@@ -805,33 +807,35 @@ async function handleTasksBody(req, res, url, ctx, miss) {
                         cancelledViaVerb.delete(durableTaskId);
                     }
                 }
-                if (cancelVerbLabel && result.status === "failed" && !result.errorCode) {
-                    result = { ...result, errorCode: "cancelled" };
+                if (cancelVerbLabel && result.terminal.kind === "failed" && !result.terminal.code) {
+                    result = { ...result, terminal: { ...result.terminal, code: "cancelled" } };
                 }
                 const resumeAtStatus = resumeAtHttpStatus(result);
                 if (resumeAtStatus) {
+                    const resumeAtPlane = terminalProjection(result.terminal);
                     if (durableTaskId && deps.runStore)
-                        await deps.runStore.setTerminal(durableTaskId, "failed", stripCheckpointToken(result), result.errorMessage ?? null);
-                    const retryAfterSec = result.errorCode === "memory.admission_required" && result.retryAfterMs !== undefined
+                        await deps.runStore.setTerminal(durableTaskId, "failed", stripResumeToken(result), resumeAtPlane.errorMessage ?? null);
+                    const retryAfterSec = resumeAtPlane.errorCode === "memory.admission_required" && result.retryAfterMs !== undefined
                         ? Math.max(1, Math.ceil(result.retryAfterMs / 1000))
                         : undefined;
-                    return { status: resumeAtStatus, body: { errorCode: result.errorCode, error: redactErrorMessage(result.errorMessage) ?? "resume-at failed", ...(retryAfterSec !== undefined ? { retryAfterSec } : {}) } };
+                    return { status: resumeAtStatus, body: { errorCode: resumeAtPlane.errorCode, error: redactErrorMessage(resumeAtPlane.errorMessage) ?? "resume-at failed", ...(retryAfterSec !== undefined ? { retryAfterSec } : {}) } };
                 }
-                if (result.status === "suspended" && deps.checkpointStore && deps.runStore && prepared.spec.sessionId) {
+                const syncPlane = terminalProjection(result.terminal);
+                if (syncPlane.status === "suspended" && deps.checkpointStore && deps.runStore && prepared.spec.sessionId) {
                     if (durableTaskId)
                         await deps.runStore.setSuspended(durableTaskId);
                     return { status: 200, body: withDiscoveryNotice({ taskId: durableTaskId, sessionId: prepared.spec.sessionId, status: "suspended" }) };
                 }
-                if (result.status === "needs_review" && deps.checkpointStore && deps.runStore && prepared.spec.sessionId) {
+                if (syncPlane.status === "needs_review" && deps.checkpointStore && deps.runStore && prepared.spec.sessionId) {
                     if (durableTaskId)
                         await deps.runStore.setNeedsReview(durableTaskId);
                     return { status: 200, body: withDiscoveryNotice({ taskId: durableTaskId, sessionId: prepared.spec.sessionId, status: "needs_review" }) };
                 }
                 if (durableTaskId && deps.runStore)
-                    await deps.runStore.setTerminal(durableTaskId, result.status, stripCheckpointToken(result), result.errorMessage ?? null);
+                    await deps.runStore.setTerminal(durableTaskId, syncPlane.status, stripResumeToken(result), syncPlane.errorMessage ?? null);
                 finalizeTaskResult(result, principal, prepared.spec.objective, prepared.spec.sessionId);
                 noteRunOutcome(result);
-                return { status: 200, body: withDiscoveryNotice(redactTerminalResult(stripCheckpointToken(result))) };
+                return { status: 200, body: withDiscoveryNotice(redactTerminalResult(stripResumeToken(result))) };
             };
             const resp = await idemCache.run(idemKey, runSyncSubmitLeg, (r) => r.status < 400);
             sendSubmitResult(res, resp);

package/dist/http/routes/workflows.d.ts

@@ -1,14 +1,3 @@
-/**
- * [ref] A9 域模块 —— S8 自编排 workflow 面([ref]/98)。
- *
- * 路由:`GET /v1/workflows`(列表)· `GET /v1/workflows/:id[/journal]`(详情)· `GET /v1/workflows/:id/stream`
- * (在进程内 live SSE)· `POST /v1/workflows/:id/agents/:label/steer`(SVC-5:给 workflow 里某个仍在跑的
- * agent 注入引导)。
- *
- * ⚠️ 只读三路跑在全局 service-credential 门**之前**(与 trace/fleet 同列),因此块内那道按 scope 的 per-tenant
- * 门就是这些读的唯一租户边界;steer 那路在门之后。两段在 `handle()` 里原本相隔很远(中间隔着 tasks/runs 两域),
- * 拆分保持了各自的相对位置 —— 本文件里的先后只是同域归并,不代表路由顺序变化。本域零可变状态。
- */
 import type { IncomingMessage, ServerResponse } from "node:http";
 import type { RouteCtx } from "../route-ctx.js";
 export declare function handleWorkflows(req: IncomingMessage, res: ServerResponse, url: string, ctx: RouteCtx): Promise<boolean>;

package/dist/http/routes/workflows.js

@@ -1,3 +1,4 @@
+import { persistedPlaneOf } from "../../terminal.js";
 import { z } from "zod";
 import { getWorkflowRun, subscribeWorkflow, deriveAgentDisplayStatus, callKeyOrdinal } from "@sema-agent/core";
 import { redactSteerIn, STEER_IN_MAX_CHARS, STEER_IN_MAX_REQUEST_CHARS } from "../../orchestration/workflow-agent-steer.js";
@@ -85,20 +86,23 @@ async function handleWorkflowsReadBody(req, res, url, ctx, miss) {
                 journalProjectionMemo.set(memoKey, out);
                 return out;
             };
-            const projectResultUncached = (callKey, r) => ({
-                callKey,
-                ordinal: callKeyOrdinal(callKey),
-                status: r.status,
-                ...(r.errorMessage ? { error: firstLine(r.errorMessage) } : {}),
-                ...(r.result
-                    ? {
-                        result: redactHead(r.result, MAX_RESULT_CHARS),
-                        ...(r.result.length > MAX_RESULT_CHARS ? { resultTruncated: true, resultChars: r.result.length } : {}),
-                    }
-                    : {}),
-                ...(r.stats ? { tokens: r.stats.tokens, turns: r.stats.turns } : {}),
-                ...(r.haltedOnUserRejection === true ? { haltedOnUserRejection: true } : {}),
-            });
+            const projectResultUncached = (callKey, r) => {
+                const plane = persistedPlaneOf(r);
+                return {
+                    callKey,
+                    ordinal: callKeyOrdinal(callKey),
+                    status: plane.status,
+                    ...(plane.errorMessage ? { error: firstLine(plane.errorMessage) } : {}),
+                    ...(r.result
+                        ? {
+                            result: redactHead(r.result, MAX_RESULT_CHARS),
+                            ...(r.result.length > MAX_RESULT_CHARS ? { resultTruncated: true, resultChars: r.result.length } : {}),
+                        }
+                        : {}),
+                    ...(r.stats ? { tokens: r.stats.tokens, turns: r.stats.turns } : {}),
+                    ...(r.haltedOnUserRejection === true ? { haltedOnUserRejection: true } : {}),
+                };
+            };
             const js = deps.workflowJournalStore;
             let projected;
             if (js.loadPage) {

package/dist/http/server.d.ts

@@ -660,6 +660,13 @@ export interface ServiceDeploymentDeps {
      *  的 `sql` 位(窄投影)。getter 而不是快照:池重连后驱动会重新初始化并刷新事实,快照会说谎。
      *  缺席 / 返回 null = 本部署没有 SQL 后端(env-only worker、local 文件后端)—— 诚实缺席,不铸空壳。 */
     sqlEngineFacts?: () => import("../plugins/sql-driver.js").SqlEngineFacts | null;
+    /** S-138:**写保护名表**的姿态(`write-protection.ts` 的 boot 期单一推导点 —— 与递给每只 Runner 的
+     *  `writeProtectedPaths` 座同一份 config 决定)。两个读面共用:`GET /v1/diagnostics/wiring` 的
+     *  `writeProtection` 段(operator-only,**逐行**表 + 来源 + 被丢的缺省行名)与 `GET /v1/capabilities`
+     *  的 `writeProtection` 位(窄投影 `{armed, rows, replaced}`,**不含行内容**)。
+     *  boot 期算一次的**存活对象**(纯 config 派生,运行期不变;core 座没有热改腿)。
+     *  缺席 = 这个进程不是由 composition root 装起来的(测试夹具形)⇒ 诊断面报 null、能力位报 null。 */
+    writeProtection?: import("../write-protection.js").WriteProtectionPosture;
     /** ① core ruling — SPLIT: `capabilities.workflows` = the ENGINE-CAN axis, boot-computed from core's own
      *  `workflowsCapability(deps)` (hardened script runner ∧ governance), NOT the `Boolean(workflowRunStore)` store
      *  proxy. Orthogonal to `workflowsList` (the durable-list axis = `workflowRunStore`). Falls back to the store

package/dist/http/server.js

@@ -2,7 +2,7 @@ import http from "node:http";
 import { redactErrorMessage, redactHead } from "../observability/run-terminal-log.js";
 import { once } from "node:events";
 import { createHash } from "node:crypto";
-import { uuidv7, isThinkingLevel, expandTiers, resumeWithVerification, CheckpointError, defaultTaskRegistry, validatePendingSteer, subscribeWorkflow, GLOBAL_USAGE_KEY, usageRetryAfterMs, RUN_WORKFLOW_TOOL_NAME } from "@sema-agent/core";
+import { uuidv7, isThinkingLevel, expandTiers, resumeWithVerification, CheckpointError, defaultTaskRegistry, validatePendingSteer, subscribeWorkflow, GLOBAL_USAGE_KEY, usageRetryAfterMs, RUN_WORKFLOW_TOOL_NAME, terminalProjection, PAUSE_REGISTRY } from "@sema-agent/core";
 import { decideParkedAgent, findParkedAgentForCheckpoint } from "../parked-decide.js";
 import { isModelAllowlisted, matchCatalogModel } from "../model-select.js";
 import {} from "../config-center/facade.js";
@@ -15,7 +15,9 @@ import { centerEntitlementSourceWired } from "../runtime-caps-resolver.js";
 import { parseHooksConfig } from "../hooks/hook-runner.js";
 import { normalizeApproachNotice, unknownTaskAgentModelRef, validateTaskAgents } from "../spec-fields.js";
 import { isValidCwd, MAX_ADDITIONAL_DIRS } from "../task-cwd.js";
-import { runInBackground, evictIfConflict, stripCheckpointToken, parkToolCallId, TurnAnchorCapture, HEARTBEAT_MS, markChildrenStoppedByUserOnAbort } from "../runs.js";
+import { runInBackground, evictIfConflict, parkToolCallId, TurnAnchorCapture, HEARTBEAT_MS, markChildrenStoppedByUserOnAbort } from "../runs.js";
+import { failureCodeOf, nestedPauseOf, stripResumeToken } from "../terminal.js";
+import { personDecision } from "../host-decision.js";
 import { readTurnActivityMs, recordTurnActivity } from "../turn-activity.js";
 import { recordResumeResourceWindow } from "../resource-window.js";
 import { publicStoreProbeError } from "../store-live-probe.js";
@@ -122,17 +124,14 @@ function mentionableNames(config, catalog) {
     return Object.keys(catalog).filter((n) => n !== "default" && isModelAllowlisted(n, catalog, allowlist));
 }
 function isCheckpointReopenedFailure(r) {
-    return r.status === "failed" && (r.errorCode === "resume.env_failed" || r.errorCode === "resume.tool_unavailable");
+    const code = failureCodeOf(r.terminal);
+    return code === "resume.env_failed" || code === "resume.tool_unavailable";
 }
 function nestedParkStatusOf(r) {
-    switch (r.errorCode) {
-        case "unexpected.needs_review":
-            return "needs_review";
-        case "unexpected.suspended":
-            return "suspended";
-        default:
-            return undefined;
-    }
+    const paused = nestedPauseOf(r.terminal);
+    if (paused === undefined)
+        return undefined;
+    return PAUSE_REGISTRY[paused.gate.kind].taskStatus;
 }
 const ROUTE_DOMAINS = [
     handleTraceUsage,
@@ -1014,7 +1013,7 @@ export function createHttpServer(rawDeps) {
         }
     }
     const resumeFleetScope = (req, auth) => req ? (gatedPrincipal(req, deps.config) ?? "default") : (auth.principal ?? "default");
-    async function resumeCheckpoint(sessionId, decision, reason, settledBy, req, answer, binding, onResumeCommitted, acceptEarly, decider) {
+    async function resumeCheckpoint(sessionId, decision, reason, hostDecision, req, answer, binding, onResumeCommitted, acceptEarly, decider) {
         const cs = deps.checkpointStore;
         const token = (await cs.findPendingTokenBySession(sessionId, undefined, { gateKinds: APPROVAL_GATE_KINDS })) ?? (await cs.findPendingTokenBySession(sessionId));
         if (binding?.checkpointToken && binding.checkpointToken !== token) {
@@ -1162,7 +1161,7 @@ export function createHttpServer(rawDeps) {
             if (out.body?.errorCode === "cancelled")
                 return;
             try {
-                lateSettleSink.recordLateSettle({ ...lateSettleAnchor, outcome: decision === "approve" ? "allowed" : "denied", settledBy, settledAtMs: Date.now() });
+                lateSettleSink.recordLateSettle({ ...lateSettleAnchor, outcome: decision === "approve" ? "allowed" : "denied", decidedBy: hostDecision.decidedBy, ...(hostDecision.approver !== undefined ? { approver: hostDecision.approver } : {}), settledAtMs: Date.now() });
             }
             catch (e) {
                 recordFailOpen("server.approval-ask-audit.append-failed", `kind=late_settle err=${e instanceof Error ? e.message : String(e)}`);
@@ -1188,7 +1187,7 @@ export function createHttpServer(rawDeps) {
                 ...(deps.logger ? { warn: (event, fields) => deps.logger?.warn?.(event, fields) } : {}),
             }, {
                 token, scope: cp.scope, sessionId: cp.sessionId, pendingAction: cp.pendingAction,
-                decision, settledBy, ...(reason !== undefined ? { reason } : {}),
+                decision, hostDecision, ...(reason !== undefined ? { reason } : {}),
                 ...(binding !== undefined ? { binding: { ...(binding.boundCallId !== undefined ? { boundCallId: binding.boundCallId } : {}), ...(binding.boundInputHash !== undefined ? { boundInputHash: binding.boundInputHash } : {}), ...(binding.updatedInput !== undefined ? { updatedInput: binding.updatedInput } : {}) } } : {}),
                 ...(boundGrant ? { grantRemember: (rootSessionId) => boundGrant(rootSessionId) } : {}),
                 ...(answer !== undefined ? { answer } : {}),
@@ -1257,7 +1256,7 @@ export function createHttpServer(rawDeps) {
             ...(decision === "approve" && binding?.updatedInput !== undefined ? { updatedInput: binding.updatedInput } : {}),
             ...(reason ? { reason } : {}),
             ...(answer !== undefined ? { answer } : {}),
-            settledBy,
+            hostDecision,
         };
         const verifyRounds = verifyRoundsFromBody(ctx.body);
         const driven = await driveResumeIntoRunLog({ runner: runnerFor(spec), token, sessionId: cp.sessionId, principal: auth.principal, fleetScope: resumeFleetScope(req, auth), taskConfig, resumeObjective, outcome, verifyRounds, ...(boundGrant ? { onResumeCommitted: boundGrant } : {}), ...(acceptEarly === true ? { acceptEarly: true } : {}), ...(req !== undefined ? { callerInitiated: true } : {}), ...(ownerLeaseAdmittedHere ? { ownerLeaseAdmitted: true } : {}) });
@@ -1477,9 +1476,10 @@ export function createHttpServer(rawDeps) {
                     };
                     resumeLegLive = true;
                     const vr = await resumeWithVerification(legRunner, token, outcome, { ...resumeTaskConfig, signal: cancelCtrl.signal, preemptSignal: preemptCtrl.signal }, resumeObjective, verifyRounds, verifyInternals);
-                    let safe = stripCheckpointToken(vr);
+                    let safe = stripResumeToken(vr);
+                    const vrNested = nestedPauseOf(vr.terminal);
                     const reParkStatus = nestedParkStatusOf(vr);
-                    const reSuspended = reParkStatus !== undefined;
+                    const reSuspended = vrNested !== undefined;
                     const vrReopened = isCheckpointReopenedFailure(vr) && (await confirmCheckpointReopened());
                     if (vrReopened)
                         reopenConfirmedPark = true;
@@ -1490,8 +1490,8 @@ export function createHttpServer(rawDeps) {
                             await appendPromptManifest(ap, deps.promptManifests, taskId);
                             if (reSuspended || vrReopened) {
                                 await appendModelUsageDelta(ap, deps.modelUsage, taskId);
-                                const vrParkCallId = reSuspended ? await parkToolCallId({ ...vr, status: reParkStatus }, deps.checkpointStore) : undefined;
-                                await ap(reSuspended ? reParkStatus : "suspended", { gate: vr.checkpointGate ?? null, ...(vrParkCallId !== undefined ? { toolCallId: vrParkCallId } : {}), ...(vrReopened ? { reopened: vr.errorCode ?? null } : {}) });
+                                const vrParkCallId = vrNested !== undefined ? await parkToolCallId({ terminal: vrNested }, deps.checkpointStore) : undefined;
+                                await ap(reParkStatus ?? "suspended", { gate: vrNested?.gate ?? null, ...(vrParkCallId !== undefined ? { toolCallId: vrParkCallId } : {}), ...(vrReopened ? { reopened: failureCodeOf(vr.terminal) ?? null } : {}) });
                             }
                             else {
                                 safe = await attachModelUsage(safe, { append: ap, getEvents: (id, a) => rs2.getEvents(id, a), modelUsage: deps.modelUsage, taskId });
@@ -1503,8 +1503,8 @@ export function createHttpServer(rawDeps) {
                                 throw e;
                         }
                     }
-                    if (reSuspended)
-                        return { ...safe, status: reParkStatus };
+                    if (vrNested !== undefined)
+                        return { ...safe, terminal: vrNested };
                     if (vr.verification?.verdict)
                         deps.metrics?.inc("verifications_total", { verdict: vr.verification.verdict });
                     return safe;
@@ -1699,30 +1699,31 @@ export function createHttpServer(rawDeps) {
                     }
                     await flush();
                     const r = await stream.result();
-                    if (r.status === "suspended") {
+                    const rPark = r.terminal.kind === "paused" ? terminalProjection(r.terminal).status : undefined;
+                    if (rPark === "suspended") {
                         const parkCallId = await parkToolCallId(r, deps.checkpointStore);
-                        await append("suspended", { gate: r.checkpointGate ?? null, ...(parkCallId !== undefined ? { toolCallId: parkCallId } : {}) });
+                        await append("suspended", { gate: r.terminal.kind === "paused" ? r.terminal.gate : null, ...(parkCallId !== undefined ? { toolCallId: parkCallId } : {}) });
                         await appendModelUsageDelta(append, deps.modelUsage, taskId);
                         return r;
                     }
-                    if (r.status === "needs_review") {
-                        await append("needs_review", { gate: r.checkpointGate ?? null });
+                    if (rPark === "needs_review") {
+                        await append("needs_review", { gate: r.terminal.kind === "paused" ? r.terminal.gate : null });
                         await appendModelUsageDelta(append, deps.modelUsage, taskId);
                         return r;
                     }
                     if (isCheckpointReopenedFailure(r) && (await confirmCheckpointReopened())) {
                         reopenConfirmedPark = true;
                         try {
-                            await append("suspended", { gate: null, reopened: r.errorCode ?? null });
+                            await append("suspended", { gate: null, reopened: failureCodeOf(r.terminal) ?? null });
                             await appendModelUsageDelta(append, deps.modelUsage, taskId);
                         }
                         catch {
                         }
                         return r;
                     }
-                    const safe = await attachModelUsage(stripCheckpointToken(r), { append, getEvents: (id, a) => rs.getEvents(id, a), modelUsage: deps.modelUsage, taskId });
+                    const safe = await attachModelUsage(stripResumeToken(r), { append, getEvents: (id, a) => rs.getEvents(id, a), modelUsage: deps.modelUsage, taskId });
                     await append("done", { result: safe });
-                    if (taskConfig.suggestNextPrompts && safe.status === "completed") {
+                    if (taskConfig.suggestNextPrompts && safe.terminal.kind === "completed") {
                         const suggestions = await stream.suggestions().catch(() => []);
                         if (suggestions.length)
                             await append("suggestions", { suggestions: suggestions.map((s) => redactSecrets(s)) });
@@ -1772,8 +1773,8 @@ export function createHttpServer(rawDeps) {
                         }
                     }
                     if (claimedRow && taskId && deps.runStore) {
-                        const c = { taskId, sessionId, status: "failed", errorCode: "cancelled", errorMessage: e.message, stats: { turns: 0, tokens: 0 } };
-                        await deps.runStore.setTerminal(taskId, "failed", c, c.errorMessage ?? null).catch(() => undefined);
+                        const c = { taskId, sessionId, terminal: { kind: "failed", code: "cancelled", message: e.message }, stats: { turns: 0, tokens: 0 } };
+                        await deps.runStore.setTerminal(taskId, "failed", c, e.message).catch(() => undefined);
                     }
                     settleFleet("failed");
                     return { status: 200, body: { taskId, sessionId, status: "failed", errorCode: "cancelled" } };
@@ -1793,8 +1794,8 @@ export function createHttpServer(rawDeps) {
                     (e.code === "checkpoint.unsupported_version" && checkpointRowRedeemableElsewhere(e.detail?.reason));
                 if (claimedRow && taskId && deps.runStore) {
                     if (retriable && freshRunClaimed) {
-                        const c = { taskId, sessionId, status: "failed", errorCode: e.code, errorMessage: e.message, stats: { turns: 0, tokens: 0 } };
-                        await deps.runStore.setTerminal(taskId, "failed", c, c.errorMessage ?? null).catch((err) => {
+                        const c = { taskId, sessionId, terminal: { kind: "failed", code: e.code, message: e.message }, stats: { turns: 0, tokens: 0 } };
+                        await deps.runStore.setTerminal(taskId, "failed", c, e.message).catch((err) => {
                             deps.logger?.warn?.("wake_synthetic_run_release_failed", { taskId, sessionId, errorCode: e.code, error: err instanceof Error ? err.message : String(err), note: "the synthetic run row for this refused fresh-run resume could not be settled — its task_active claim is still held and the next attempt on this session will 409 conflict.session_active_run until reapStale collects it (runStaleSec)" });
                         });
                         settleFleet("failed");
@@ -1827,8 +1828,8 @@ export function createHttpServer(rawDeps) {
             }
             if (cancelCtrl.signal.aborted) {
                 if (taskId && deps.runStore) {
-                    const c = { taskId, sessionId, status: "failed", errorCode: "cancelled", errorMessage: "cancelled by user", stats: { turns: 0, tokens: 0 } };
-                    await deps.runStore.setTerminal(taskId, "failed", c, c.errorMessage ?? null).catch(() => undefined);
+                    const c = { taskId, sessionId, terminal: { kind: "failed", code: "cancelled", message: "cancelled by user" }, stats: { turns: 0, tokens: 0 } };
+                    await deps.runStore.setTerminal(taskId, "failed", c, "cancelled by user").catch(() => undefined);
                 }
                 settleFleet("failed");
                 return { status: 200, body: { taskId, sessionId, status: "failed", errorCode: "cancelled" } };
@@ -1859,22 +1860,23 @@ export function createHttpServer(rawDeps) {
         }
         evictIfConflict(deps.runner, sessionId, result);
         const checkpointReopened = reopenConfirmedPark;
+        const resumePlane = terminalProjection(result.terminal);
         if (taskId && deps.runStore) {
-            if (result.status === "suspended" || checkpointReopened)
+            if (resumePlane.status === "suspended" || checkpointReopened)
                 await deps.runStore.setSuspended(taskId);
-            else if (result.status === "needs_review")
+            else if (resumePlane.status === "needs_review")
                 await deps.runStore.setNeedsReview(taskId);
             else
-                await deps.runStore.setTerminal(taskId, result.status, stripCheckpointToken(result), result.errorMessage ?? null);
+                await deps.runStore.setTerminal(taskId, resumePlane.status, stripResumeToken(result), resumePlane.errorMessage ?? null);
         }
-        settleFleet(checkpointReopened ? "suspended" : result.status, fleetRunResiduals(result));
+        settleFleet(checkpointReopened ? "suspended" : resumePlane.status, fleetRunResiduals(result));
         return {
             status: 200,
             body: {
-                taskId, sessionId, status: result.status,
+                taskId, sessionId, status: resumePlane.status,
                 bindingEnforced: true,
-                ...(result.errorCode ? { errorCode: result.errorCode } : {}),
-                ...(result.errorMessage ? { errorMessage: redactErrorMessage(result.errorMessage) ?? "" } : {}),
+                ...(resumePlane.errorCode ? { errorCode: resumePlane.errorCode } : {}),
+                ...(resumePlane.errorMessage ? { errorMessage: redactErrorMessage(resumePlane.errorMessage) ?? "" } : {}),
                 ...(checkpointReopened ? { retriable: true } : {}),
             },
         };
@@ -2091,12 +2093,13 @@ export function createHttpServer(rawDeps) {
         return driveResumeIntoRunLog({ runner: runnerFor(spec), token, sessionId: cp.sessionId, principal: auth.principal, fleetScope: resumeFleetScope(req, auth), taskConfig, resumeObjective, outcome, verifyRounds, ...(acceptEarly === true ? { acceptEarly: true } : {}), ...(req !== undefined ? { callerInitiated: true } : {}) });
     }
     function recordTaskResult(result) {
-        deps.metrics?.inc("tasks_total", { status: result.status });
+        const plane = terminalProjection(result.terminal);
+        deps.metrics?.inc("tasks_total", { status: plane.status });
         if (result.stats.tokens)
             deps.metrics?.inc("task_tokens_total", {}, result.stats.tokens);
         if (result.stats.cacheHitRate !== undefined)
             deps.metrics?.observe("task_cache_hit_rate", result.stats.cacheHitRate);
-        const code = result.errorCode;
+        const code = plane.errorCode;
         if (code && code.startsWith("limits.")) {
             deps.metrics?.inc("budget_exceeded_total", { code });
         }
@@ -2110,7 +2113,7 @@ export function createHttpServer(rawDeps) {
     }
     function finalizeTaskResult(result, principal, objective, sessionId) {
         recordTaskResult(result);
-        deps.planCacheProbe?.record(principal, objective, result.status === "completed");
+        deps.planCacheProbe?.record(principal, objective, result.terminal.kind === "completed");
         evictIfConflict(deps.runner, sessionId, result);
     }
     function quotaExceeded(req, res) {
@@ -2347,7 +2350,7 @@ export function createHttpServer(rawDeps) {
                 parkedSkipped += 1;
                 continue;
             }
-            await resumeCheckpoint(sessionId, "deny", "approval SLA expired — auto-denied", "timeout").then((r) => { if (r.status >= 400)
+            await resumeCheckpoint(sessionId, "deny", "approval SLA expired — auto-denied", { decidedBy: "sla_timeout" }).then((r) => { if (r.status >= 400)
                 deps.logger?.warn?.("deny_sweep_resume_blocked", { sessionId, status: r.status, errorCode: r.body?.errorCode }); }, (e) => deps.logger?.warn?.("deny_sweep_resume_failed", { sessionId, err: redactHead(e instanceof Error ? e.message : String(e), 2000) }));
         }
         if (parkedSkipped > 0)
@@ -2420,7 +2423,7 @@ export function createHttpServer(rawDeps) {
             ...(req.gateBoundInputHash !== null ? { boundInputHash: req.gateBoundInputHash } : {}),
             ...(req.updatedInput !== undefined ? { updatedInput: req.updatedInput } : {}),
         };
-        const out = await resumeCheckpoint(cp.sessionId, req.decision, req.note, "human", req.httpReq, undefined, binding, undefined, true, { principal: req.principal, explicitOperator: false });
+        const out = await resumeCheckpoint(cp.sessionId, req.decision, req.note, personDecision(req.principal), req.httpReq, undefined, binding, undefined, true, { principal: req.principal, explicitOperator: false });
         return { status: out.status, body: out.body };
     }
     const isRunLiveOnThisReplica = (taskId) => inflightRuns.has(taskId) || steerableRuns.has(taskId);
@@ -2430,6 +2433,7 @@ const WORKER_SWAP_REDEEMABLE = {
     version_newer: true,
     env_factory_missing: true,
     governed_unwired: true,
+    origin_missing: true,
     real_approval_damaged: false,
     real_approval_forged: false,
     read_face_damaged: false,

package/dist/leader/fanout.d.ts

@@ -27,7 +27,7 @@
  * MVP scope: the COMPOSITION mechanics, unit-tested with a mock runner. Real E2B workers + branch/baseSha from
  * a worker's actual git state are wired at M4/M5 (joint dogfood).
  */
-import type { TaskSpec, TaskResult, TaskStream, RepairTerminal } from "@sema-agent/core";
+import { type TaskSpec, type TaskResult, type TaskStream, type RepairTerminal, type CheckpointGate } from "@sema-agent/core";
 /** What the Coordinator gets back per worker (council#6 — merge(b) routes on this). */
 export interface WorkerReport {
     workerId: string;
@@ -48,10 +48,11 @@ export interface WorkerReport {
     /** [ref] Slice 6: the terminal checkpoint gate when a worker is still SUSPENDED (the leader auto-resumed
      *  it up to its bound but it didn't fully complete — e.g. the overall deadline hit or the slice cap). Present
      *  ⇒ resumable: the operator/leader can escalate (more budget) or accept the belt-diff partial progress. */
-    checkpointGate?: TaskResult["checkpointGate"];
-    /** [ref] Slice 6: the worker's terminal `TaskResult.errorCode` (e.g. `limits.max_cost_exceeded` on an
-     *  exhausted resume, `limits.max_turns_exceeded` — core 5.8.0 码名轴) — surfaced for /v1/leader observability. */
-    errorCode?: TaskResult["errorCode"];
+    checkpointGate?: CheckpointGate;
+    /** [ref] Slice 6: the worker's terminal failure code (e.g. `limits.max_cost_exceeded` on an
+     *  exhausted resume, `limits.max_turns_exceeded` — core 5.8.0 码名轴) — surfaced for /v1/leader observability.
+     *  S-136:源从 `TaskResult.errorCode` 换成因由 `failed` 臂的 `code`(本报告面的键名与形不变)。 */
+    errorCode?: string;
     /** LEADER-REPAIRLOOP-INTEGRATION §10.6 (THE push chokepoint): the `runRepairLoop` terminal a single-agent
      *  worker resolved to, when the repair loop ran on this worker (LEADER_REPAIR_LOOP on). It MUST ride on the
      *  report because a SAFE-tier `candidate_only` maps to core verdict "PASS" → this report's `status` collapses
@@ -105,24 +106,6 @@ export interface FanOutResult {
     /** True if the overall deadline fired and cancelAll ran. */
     cancelled: boolean;
 }
-/**
- * 「这条 worker 的 TaskResult 停在门上(durable park)了吗」——`TaskStatus` 的穷举判据。
- *
- * 🔴 park 是**两个词**(扫描P2,status/kind 同名词混淆病族):`suspended`(工具审批 / human /
- * resource_limit 门)与 `needs_review`(`plan_review` 与 dry-run 拦截门)。真源 = core
- * `agents/suspend-guard.js` 的 `isDurablePause`(逐字 `status === "suspended" || status === "needs_review"`),
- * `mapNestedSuspend` / `verify.js` 的 `unverifiedReason` 两处都按这张表分词。
- *
- * 只认 `suspended` 的后果不是「少一个标签」:一条 plan_review 停下的 worker 会被报成 `failed` ⇒
- * fanOut 的 C4 抢占({@link FanOutOptions.cancelOnSuspend})不触发(其余 worker 继续烧钱)、leader 的
- * replan「suspended 波」看不见它、`suspendedSessions` 的豁免名单漏掉它 ⇒ 它那张还能被决议的 checkpoint
- * 与暂停中的环境会被当失败清掉。带验证器的那条腿早已改用「还带着 checkpointToken 就是 park」的判据
- * (leader.ts round-3 review BLOCKER),这里是它当时漏掉的另外半场。
- *
- * `never` 收敛 = core `TaskStatus` 增删成员的**编译期**执行点(同 `store-contracts.ts` 两条判据的姿势);
- * 运行时未知词保守判**非 park**(与既有 `else → failed` 同行为,不静默扩大 park 面)。
- */
-export declare function isDurablePauseStatus(s: TaskResult["status"]): boolean;
 /**
  * Fan out `subtasks` in parallel. Never throws — every worker resolves to a WorkerReport (failures captured).
  * The caller (Coordinator) merges only `status==="completed"` reports.

package/dist/leader/fanout.js

@@ -1,4 +1,6 @@
+import { terminalProjection } from "@sema-agent/core";
 import { redactErrorMessage, redactWorkerReportError } from "../observability/run-terminal-log.js";
+import { pausedCauseOf } from "../terminal.js";
 class Semaphore {
     max;
     active = 0;
@@ -19,24 +21,10 @@ class Semaphore {
         }
     }
 }
-export function isDurablePauseStatus(s) {
-    switch (s) {
-        case "suspended":
-        case "needs_review":
-            return true;
-        case "completed":
-        case "failed":
-        case "blocked":
-            return false;
-        default: {
-            const unhandled = s;
-            void unhandled;
-            return false;
-        }
-    }
-}
-function mapStatus(s) {
-    return s === "completed" ? "completed" : isDurablePauseStatus(s) ? "suspended" : "failed";
+function mapStatus(terminal) {
+    if (terminal.kind === "completed")
+        return "completed";
+    return pausedCauseOf(terminal) !== undefined ? "suspended" : "failed";
 }
 export async function fanOut(subtasks, opts) {
     const sharedAC = new AbortController();
@@ -80,7 +68,8 @@ export async function fanOut(subtasks, opts) {
             let report;
             try {
                 const result = await stream.result();
-                report = { ...base, status: mapStatus(result.status), stats: result.stats, ...(result.errorMessage ? { error: redactErrorMessage(result.errorMessage) ?? "" } : {}) };
+                const plane = terminalProjection(result.terminal);
+                report = { ...base, status: mapStatus(result.terminal), stats: result.stats, ...(plane.errorMessage ? { error: redactErrorMessage(plane.errorMessage) ?? "" } : {}) };
             }
             catch (e) {
                 report = { ...base, status: cancelled ? "timeout" : "failed", error: redactErrorMessage(e instanceof Error ? e.message : String(e)) ?? "" };

package/dist/leader/leader.d.ts

@@ -15,18 +15,21 @@
 import { type RunnerLike, type WorkerReport } from "./fanout.js";
 import { type ExecStreamLike } from "./diffout.js";
 import { type MergeDeps, type MergeResult } from "./merge.js";
-import { type TaskSpec, type VerifyConfig, type CheckpointToken, type ToolSpec, type RepairTerminal, type OracleTier, type RepairResult } from "@sema-agent/core";
+import { type TaskSpec, type VerifyConfig, type CheckpointToken, type TerminalCause, type ToolSpec, type RepairTerminal, type OracleTier, type RepairResult } from "@sema-agent/core";
 /** [ref] Slice 6: drive a worker's resource-suspend auto-resume to a terminal (or bound) state. Exported
- *  for unit tests. Loops `resume(token, slice)` WHILE the result carries a `resource_limit` checkpoint gate —
- *  NOT by status (the verify wrapper may surface a suspend as failed-with-token). Exits on: a terminal result
- *  (completed/failed → no gate), an exhausted budget (core fails the resume fast → no token/gate), a
- *  human-approval gate (kind ≠ "resource_limit" — never auto-resumed), `signal.aborted`, or `maxSlices` (a
- *  belt; core's ledger fail-fast + per-task suspend-loop cap are the primary bounds). Returns the final result. */
+ *  for unit tests. Loops `resume(token, slice)` WHILE the result's terminal cause is a park on a
+ *  `resource_limit` gate. Exits on: a terminal cause that is not a park, a park on any OTHER gate
+ *  (a human approval / a review — never auto-resumed), an exhausted budget (core fails the resume fast, so
+ *  the cause is `failed` with no nested park), `signal.aborted`, or `maxSlices` (a belt; core's ledger
+ *  fail-fast + per-task suspend-loop cap are the primary bounds). Returns the final result.
+ *
+ *  🔴 S-136(core 7.6.0 D-8):判据从「两个平面键合读」(`checkpointToken` 在场 ∧ `checkpointGate.kind`)
+ *  换成**一条因由**({@link pausedCauseOf}) —— 这条循环从一开始就刻意**不按 status 判**(顶注原话:
+ *  「the verify wrapper may surface a suspend as failed-with-token」),因为嵌套边界会把 park 报成 failed;
+ *  现在那件事是形状:两条路径同一个读法,而 token 与 gate 在同一个 `PausedCause` 上,不可能只有一半。
+ */
 export declare function autoResumeOnResource<T extends {
-    checkpointToken?: CheckpointToken;
-    checkpointGate?: {
-        kind: string;
-    };
+    terminal: TerminalCause;
 }>(initial: T, signal: {
     readonly aborted: boolean;
 }, resume: (token: CheckpointToken, slice: number) => Promise<T>, maxSlices?: number): Promise<T>;