@sema-agent/server 7.63.0 → 7.65.0

package/dist/capabilities/hands-lane.d.ts

@@ -12,7 +12,8 @@
  *     不是静默继承 full(词表闭集纪律)。
  *  ② {@link HANDS_EXCLUSIVE_TOOL_NAMES} + {@link handsDenyPolicy} —— 纵深:hands=none 的任务即便被误接到
  *     有手 Runner 上,手独占名单逐一 deny。**不是**主保证(主保证是根本不挂 factory ⇒ 工具面不可见)。
- *  ③ {@link createHandsLaneRegistry} —— resolveSpec 产出 spec 与执行点选 Runner 之间的 lane 传递。
+ *  ③ {@link stampHandsLane} / {@link handsLaneOf} —— 车道作为 TaskSpec 上的**显式字段**(S-149):
+ *     resolveSpec 出口铸一次,执行点读一次,**缺席即拒**(不是回落最宽车道)。
  */
 import { type Runner, type TaskSpec, type ToolPolicy } from "@sema-agent/core";
 /** 场景对手带工具面的表态(闭集)。`full` = core 手带 band 照常 mount;`none` = 不挂 executionEnvFactory 的 Runner。 */
@@ -82,19 +83,58 @@ export declare function tightenWithHandsDeny(base: ToolPolicy | undefined): Tool
 /** 装配点的取用形:`full` 原样放行基线,`none` 叠 deny。**穷举 switch**,无缺省臂。 */
 export declare function toolPolicyForHands(hands: ScenarioHands, base: ToolPolicy | undefined): ToolPolicy | undefined;
 /**
- * 请求级 lane 登记簿 —— resolveSpec 在产出 TaskSpec 时登记本请求的场景表态,执行点凭 spec 取回选 Runner。
+ * 执行车道在 TaskSpec 上的**显式字段键**(S-149;修前是一张以 spec **对象身份**为键的 WeakMap 旁表)。
  *
- * 为什么不把 lane 写进 TaskSpec:那是 core 的类型,server 无自有位;而 `resolveSpec` 的返回形是
- * ServiceDeps 的公开签名,80+ 测试文件在桩它 —— 改返回形的射程远大于本件。登记簿以 spec **对象身份**
- * 为键(每请求一只新对象,并发无串台;WeakMap 弱引用,零清理欠账),由同一只 boot 装配同时交给
- * resolveSpec 与 HTTP 执行点,配对是结构性的。
+ * 为什么是 symbol 而不是字符串键:`TaskSpec` 是**上游 core 的类型面**,一个字符串键会进
+ * `Object.keys` / `JSON.stringify` / core 自己的键审计,等于 server 在别人的契约上私自加一个键;
+ * symbol 键随 spread(`{...spec}`)与 rest 解构(`const {objective, ...taskConfig} = spec`)结构性
+ * 地跟着走,却对上游的键面**不可见**(结构化克隆与 JSON 同样跳过 symbol 键)。于是「车道是 spec 上
+ * 的一个字段、复制 spec 不丢车道」与「不污染上游契约」两件事同时成立。
  *
- * 未登记 ⇒ `full`:唯一可达形是「这只 spec 不是本 resolver 产的」(测试桩)。生产链上 stamp 与 laneOf
- * 同一实例,不存在半接;真误配时纵深 deny 仍在(见 {@link tightenWithHandsDeny})。
+ * 修前的旁表要求「从 resolveSpec 出来的那一只对象必须一路原样活到执行点」——一条**隐形**的对象身份
+ * 契约:任何一次 `{...spec}` 都会静默把车道降级成最宽的 `full`(实测:登记 `none` 的 spec 复制后
+ * `laneOf` 答 `full`)。字段化把那条隐形要求整条删掉。
  */
-export interface HandsLaneRegistry {
-    stamp(spec: TaskSpec, hands: ScenarioHands): void;
-    laneOf(spec: TaskSpec): ScenarioHands;
+export declare const HANDS_LANE_FIELD: unique symbol;
+/** 已铸车道的 TaskSpec。铸点唯一(`boot/resolve-spec.ts` 的 resolveSpec 出口),读点唯一({@link handsLaneOf})。 */
+export type LanedTaskSpec = TaskSpec & {
+    readonly [HANDS_LANE_FIELD]: ScenarioHands;
+};
+/**
+ * 铸车道(**单一属主**:只允许 resolveSpec 的出口调用)。
+ *
+ * 字段是 `enumerable`(所以复制得走)、`writable:false` + `configurable:false`(所以同一只 spec 被
+ * 第二次铸车道会当场 TypeError —— 两个写者是漂移的成因,响亮好过后到者悄悄赢)。
+ */
+export declare function stampHandsLane<T extends TaskSpec>(spec: T, hands: ScenarioHands): T & LanedTaskSpec;
+/**
+ * 车道字段缺席的拒因 —— 具名类,便于调用点/测试按类型判,而不是嗅文案。
+ *
+ * 🔴 **刻意不是 `HttpError`、刻意不铸新的 wire 错误码**:它落到 `http/server.ts` 的兜底 catch,
+ * wire 上是 500 `internal.error`(内部文本不回显,只进 `request_error` 日志行)。理由两条:
+ *  ① 对**消费端**它与任何一次服务端内部故障无差别可操作性(重试一次,仍复现即报运维)—— 附录 A 多一个
+ *     码却给不出不同的动作,是没有价值的契约面;
+ *  ② 本仓的中继码登记表(`test/error-code-catalog-live.test.ts` 的 `RELAYED`,上限 24 条)明写「超了说明
+ *     『码不写字面量』正在变成默认写法,该反过来改代码」—— 一个只能靠登记才看得见的新码正是它拦的东西。
+ * 需要分辨的是**运维**,而运维读的是日志行(本 message 逐字在 `request_error` 里)。
+ */
+export declare class HandsLaneUnstampedError extends Error {
+    constructor();
 }
-export declare function createHandsLaneRegistry(): HandsLaneRegistry;
+/**
+ * 读车道 —— **缺席即拒**([ref] P 类:车道选择是保护型量,fail-closed;`observability/fail-open.ts`
+ * 头注把「车道选择」逐字列在「正解是 fail-closed,不是留痕后继续放行」那一族里)。
+ *
+ * 修前此处是 `?? "full"`:一只没经过本仓 resolver 的 spec 会**静默拿到最宽的车道**(全量可写手带)。
+ * 「唯一可达形是测试桩」这个论证不是防线 —— 它是一句关于今天调用图的断言,而防线要防的正是明天多出
+ * 来的第二个执行点。缺席现在整只拒(500 + 日志留原句),而不是把一个未经裁定的任务放进有手车道。
+ */
+export declare function handsLaneOf(spec: TaskSpec): ScenarioHands;
+/**
+ * 装配点的选路席:`{full, handsless}` 两只 Runner + 车道字段 ⇒ 本任务跑哪一只。
+ *
+ * 具名工厂而不是在 main.ts 手搓闭包:选路规则(读字段 → 穷举 switch)于是只有**一份实现**,
+ * 测试与生产装配拿的是同一只(手搓等价闭包 = 第二真源,正是本件要删的那一类)。
+ */
+export declare function createHandsRunnerSelector(pair: HandsRunnerPair): (spec: TaskSpec) => Runner;
 //# sourceMappingURL=hands-lane.d.ts.map

package/dist/capabilities/hands-lane.js

@@ -36,13 +36,24 @@ export function toolPolicyForHands(hands, base) {
             return tightenWithHandsDeny(base);
     }
 }
-export function createHandsLaneRegistry() {
-    const lanes = new WeakMap();
-    return {
-        stamp: (spec, hands) => {
-            lanes.set(spec, hands);
-        },
-        laneOf: (spec) => lanes.get(spec) ?? "full",
-    };
+export const HANDS_LANE_FIELD = Symbol("sema-server.handsLane");
+export function stampHandsLane(spec, hands) {
+    Object.defineProperty(spec, HANDS_LANE_FIELD, { value: hands, enumerable: true, writable: false, configurable: false });
+    return spec;
+}
+export class HandsLaneUnstampedError extends Error {
+    constructor() {
+        super("execution lane is not stamped on this task spec — refusing to run it rather than falling back to the widest (full-hands) lane");
+        this.name = "HandsLaneUnstampedError";
+    }
+}
+export function handsLaneOf(spec) {
+    const lane = spec[HANDS_LANE_FIELD];
+    if (lane === undefined)
+        throw new HandsLaneUnstampedError();
+    return lane;
+}
+export function createHandsRunnerSelector(pair) {
+    return (spec) => pickHandsRunner(handsLaneOf(spec), pair);
 }
 //# sourceMappingURL=hands-lane.js.map

package/dist/config-catalog.js

@@ -321,7 +321,7 @@ export const CONFIG_CATALOG = [
     r("READ_DENY_BUILTIN_EXCLUDE", "orchestration", "csv", "按行名删内建 deny 条目(档位之后生效;绝不削任务显式 deny)", { danger: SEC, configKey: "readDenyBuiltinExclude", center: cRead("denyBuiltinExclude", "readDenyBuiltinExclude") }),
     r("READ_DENY_BUILTIN_TIERS", "orchestration", "csv", "内建 deny 表档位选择(闭集四档;none=显式空姿态)", { danger: SEC, configKey: "readDenyBuiltinTiers", center: cRead("denyBuiltinTiers", "readDenyBuiltinTiers") }),
     r("READ_DENY_PATTERNS", "orchestration", "csv", "READ 面额外 deny pattern 表", { danger: SEC, configKey: "readDenyPatterns", center: cRead("denyPatterns", "readDenyPatterns") }),
-    r("READ_FACE", "orchestration", "enum", "READ 容纳面档位(env 逐键恒赢 center —— 部署主权表达)", { enumValues: ["open", "roots"], danger: SEC, derivedDefaultNote: "缺席 ⇒ 不铸键,core 默认 roots", configKey: "readFace", center: cRead("face", "readFace") }),
+    r("READ_FACE", "orchestration", "enum", "READ 容纳面档位(env 逐键恒赢 center —— 部署主权表达)", { enumValues: ["open", "roots"], danger: SEC, derivedDefaultNote: "缺席 ⇒ 按 posture 派生(S-167):单用户 turnkey(REQUIRE_PRINCIPAL 未设)铸 open;多租户不铸键、core 默认 roots。生效来源见 GET /v1/diagnostics/wiring 的 readFace.source 四词", configKey: "readFace", center: cRead("face", "readFace") }),
     r("REAP_INTERVAL_SEC", "limitsHttp", "number", "reaper 周期(秒)", { staticDefault: "60", configKey: "reapIntervalSec" }),
     r("REAP_RUN_STALE_SEC", "limitsHttp", "number", "run 活性判陈旧阈(秒)", { staticDefault: "120", configKey: "runStaleSec", center: cLimits("runStaleSec") }),
     r("REMOTE_EXEC", "orchestration", "enum", "执行车道选择(点名而配不齐/认不出 ⇒ 拒启,绝不静默降级到 host/stub)", { enumValues: ["e2b", "k8s", "ssh", "adb", "host", "local-docker", "device"], danger: SEC, derivedDefaultNote: "缺席:CONFIG_PROVIDER=local ⇒ host;其余 ⇒ 进程内 stub", configKey: "remoteExec", resolve: (c) => c.remoteExec?.provider ?? null }),

package/dist/config-center/read-face.js

@@ -1,9 +1,9 @@
 import { compileReadDeny, resolveReadDenyBuiltins } from "@sema-agent/core";
 const KEY_MAP = [
-    ["face", "readFace"],
-    ["denyPatterns", "readDenyPatterns"],
-    ["denyBuiltinTiers", "readDenyBuiltinTiers"],
-    ["denyBuiltinExclude", "readDenyBuiltinExclude"],
+    { centerKey: "face", cfgKey: "readFace", envHolds: (c) => c.readFaceSource === "env" },
+    { centerKey: "denyPatterns", cfgKey: "readDenyPatterns", envHolds: (c) => c.readDenyPatterns !== undefined },
+    { centerKey: "denyBuiltinTiers", cfgKey: "readDenyBuiltinTiers", envHolds: (c) => c.readDenyBuiltinTiers !== undefined },
+    { centerKey: "denyBuiltinExclude", cfgKey: "readDenyBuiltinExclude", envHolds: (c) => c.readDenyBuiltinExclude !== undefined },
 ];
 class ReadFaceDomainError extends Error {
 }
@@ -43,7 +43,7 @@ function normalizeNameList(field, raw) {
     });
 }
 export function applyCenterReadFace(config, eff, logger) {
-    const envHeldKeys = KEY_MAP.filter(([, cfgKey]) => config[cfgKey] !== undefined).map(([centerKey]) => centerKey);
+    const envHeldKeys = KEY_MAP.filter((r) => r.envHolds(config)).map((r) => r.centerKey);
     const domain = eff.readFace;
     if (domain === undefined || domain === null)
         return envHeldKeys;
@@ -55,7 +55,7 @@ export function applyCenterReadFace(config, eff, logger) {
         return envHeldKeys;
     }
     const d = domain;
-    const envHeld = KEY_MAP.filter(([centerKey, cfgKey]) => d[centerKey] !== undefined && config[cfgKey] !== undefined).map(([centerKey, cfgKey]) => `${cfgKey} (readFace.${centerKey})`);
+    const envHeld = KEY_MAP.filter((r) => d[r.centerKey] !== undefined && r.envHolds(config)).map((r) => `${r.cfgKey} (readFace.${r.centerKey})`);
     let staged;
     try {
         const normalized = {
@@ -69,7 +69,7 @@ export function applyCenterReadFace(config, eff, logger) {
         if (normalized.readDenyBuiltinTiers !== undefined || normalized.readDenyBuiltinExclude !== undefined) {
             resolveReadDenyBuiltins(builtinsArg(normalized.readDenyBuiltinTiers, normalized.readDenyBuiltinExclude));
         }
-        staged = Object.fromEntries(KEY_MAP.filter(([, cfgKey]) => config[cfgKey] === undefined).map(([, cfgKey]) => [cfgKey, normalized[cfgKey]]).filter(([, v]) => v !== undefined));
+        staged = Object.fromEntries(KEY_MAP.filter((r) => !r.envHolds(config)).map((r) => [r.cfgKey, normalized[r.cfgKey]]).filter(([, v]) => v !== undefined));
         const finalPatterns = staged.readDenyPatterns ?? config.readDenyPatterns;
         const finalTiers = staged.readDenyBuiltinTiers ?? config.readDenyBuiltinTiers;
         const finalExclude = staged.readDenyBuiltinExclude ?? config.readDenyBuiltinExclude;
@@ -85,8 +85,10 @@ export function applyCenterReadFace(config, eff, logger) {
         });
         return envHeldKeys;
     }
-    if (staged.readFace !== undefined)
+    if (staged.readFace !== undefined) {
         config.readFace = staged.readFace;
+        config.readFaceSource = "center";
+    }
     if (staged.readDenyPatterns !== undefined)
         config.readDenyPatterns = staged.readDenyPatterns;
     if (staged.readDenyBuiltinTiers !== undefined)

package/dist/config-types.d.ts

@@ -5,6 +5,7 @@
  *  in config.ts, which re-exports these names so existing `from "./config.js"` importers keep
  *  compiling unchanged. All imports below are top-level `import type` (erased — never a load edge,
  *  see test/module-cycle-gate.test.ts header on verbatimModuleSyntax). */
+import type { ReadFaceSource } from "./read-face-posture.js";
 import type { SealedKeyPoison } from "./sealed-key.js";
 import type { A2aServerSpec, CompliancePosture, CrossSessionDialogExpiry, CrossSessionInboundSetting, FileHistoryRetentionPolicy, LockedKey, McpServerSpec, Model, ModelRoles, RetentionPolicy, WriteProtectedEntry } from "@sema-agent/core";
 import type { ApprovalHmacKey, PrincipalJwtKey } from "./auth-keys.js";
@@ -1539,9 +1540,17 @@ export interface ServiceConfigFlat {
     /** Task Trace API (S1): persist the agent's reasoning/thinking into the durable run event log (for the CC-style
      *  trace UI). Default ON; `TRACE_THINKING=false` disables capture for sensitive deployments. Redacted on persist. */
     traceThinking: boolean;
-    /** [ref](core 5.30.0 readFace 部署座席):READ 容纳面。缺席=不铸(core 引擎默认 roots,server 不写死
-     *  上游默认);显式坏词启动期响亮拒。只影响读面,写面永不受它管(core 契约)。 */
+    /** [ref](core 5.30.0 readFace 部署座席):READ 容纳面。显式坏词启动期响亮拒;只影响读面,写面永不
+     *  受它管(core 契约)。
+     *  🔴 **S-167(7.65.0)起「缺席」按 posture 分两形**(clay 裁定 2):单用户 turnkey(`REQUIRE_PRINCIPAL`
+     *  未设)⇒ 铸 `open`(工作区外读默认放行);多租户 ⇒ 仍**不铸**(core 引擎默认 roots,server 不写死
+     *  上游默认)。谁定的这一档由 {@link ServiceConfigFlat.readFaceSource} 答 —— 值与来源**同一处写**。 */
     readFace?: "open" | "roots";
+    /** S-167:上面那一档**是谁定的**(闭集四词,见 `read-face-posture.ts`)。不变量:
+     *  `readFace === undefined` ⟺ `readFaceSource === "engine-default"`。
+     *  🔴 承重面**不是**装饰:`config-center/read-face.ts` 的「env 恒赢」逐键判据读的就是它(修前读的是
+     *  「键在不在场」这个代理,posture 会铸键 ⇒ 代理当场失真,center 的 face 会被从没设过 env 的机器挡掉)。 */
+    readFaceSource: ReadFaceSource;
     /** [ref]:部署级 READ deny 追加表(additive-only,core 内建表永不可缩)。env=JSON 数组
      *  [{pattern, caseSensitive?}],boot 时用 core `compileReadDeny` 预验——坏形拒启。缺席=不铸。 */
     readDenyPatterns?: {
@@ -1674,7 +1683,7 @@ export type ServiceMemoryConfig = Pick<ServiceConfigFlat, "memoryEngineEnabled"
  *  config 这一层它只是一句声明。 */
 export type ServiceAuthConfig = Pick<ServiceConfigFlat, "authToken" | "authTokens" | "allowUnauthedWrites" | "corsOrigins" | "principalHeader" | "requirePrincipal" | "autonomy" | "commandPolicy" | "compliancePosture" | "lockedConfigKeys" | "configCatalogEnabled" | "retentionPolicy" | "retentionSweep" | "operatorPrincipals" | "principalJwtPubkeys" | "principalJwtIss" | "principalJwtAud" | "principalJwtMaxTtlSec" | "bindHost" | "bindHostSource">;
 /** 组:orchestration(编排 + 执行车道 + 沙箱面 + workflow/后台 agent 存留)。 */
-export type ServiceOrchestrationConfig = Pick<ServiceConfigFlat, "remoteExec" | "worktreeIsolation" | "leaderEnabled" | "leaderFanoutEnabled" | "routerEnabled" | "selfOrchestrationEnabled" | "selfOrchestrationModels" | "selfOrchestrationWorkerIsolation" | "forkEnabled" | "experimentalObserverAgents" | "schedulerEnabled" | "schedulerSessionWakeup" | "schedulerSessionLifetime" | "schedulerStorePath" | "planModeEnabled" | "hooksTimeoutMs" | "workflowRunStoreBackend" | "workflowOrphanGraceMs" | "workflowJournalRetentionMs" | "workflowRunRetentionMs" | "usageWindows" | "workflowAgentsReadOnly" | "workflowSizeGuideline" | "backgroundAgentRetentionMs" | "backgroundAgentStaleRunningMs" | "backgroundAgentParkClaimStaleMs" | "delegationEntryCaps" | "rosterRetentionMs" | "leaderRunStaleMs" | "scratchpadSweepTtlMs" | "sandboxPkgSource" | "sessionAutoTitle" | "selectEnvironmentTool" | "envFactsEnabled" | "toolDeferLongtail" | "lspEnabled" | "lspHostEnabled" | "imageBakes" | "readFace" | "readDenyPatterns" | "readDenyBuiltinTiers" | "readDenyBuiltinExclude">;
+export type ServiceOrchestrationConfig = Pick<ServiceConfigFlat, "remoteExec" | "worktreeIsolation" | "leaderEnabled" | "leaderFanoutEnabled" | "routerEnabled" | "selfOrchestrationEnabled" | "selfOrchestrationModels" | "selfOrchestrationWorkerIsolation" | "forkEnabled" | "experimentalObserverAgents" | "schedulerEnabled" | "schedulerSessionWakeup" | "schedulerSessionLifetime" | "schedulerStorePath" | "planModeEnabled" | "hooksTimeoutMs" | "workflowRunStoreBackend" | "workflowOrphanGraceMs" | "workflowJournalRetentionMs" | "workflowRunRetentionMs" | "usageWindows" | "workflowAgentsReadOnly" | "workflowSizeGuideline" | "backgroundAgentRetentionMs" | "backgroundAgentStaleRunningMs" | "backgroundAgentParkClaimStaleMs" | "delegationEntryCaps" | "rosterRetentionMs" | "leaderRunStaleMs" | "scratchpadSweepTtlMs" | "sandboxPkgSource" | "sessionAutoTitle" | "selectEnvironmentTool" | "envFactsEnabled" | "toolDeferLongtail" | "lspEnabled" | "lspHostEnabled" | "imageBakes" | "readFace" | "readFaceSource" | "readDenyPatterns" | "readDenyBuiltinTiers" | "readDenyBuiltinExclude">;
 /** 组:limitsHttp(HTTP 面 + 各类上限/配额/回收窗)。 */
 export type ServiceLimitsHttpConfig = Pick<ServiceConfigFlat, "port" | "attachmentOrphanGraceMs" | "workspaceFileMaxBytes" | "attachmentMaxBytes" | "attachmentMimeAllowlist" | "attachmentUnboundTtlMs" | "infraCostRates" | "drainGraceMs" | "sighupIdleGraceMs" | "parentPid" | "engineAutoExit" | "engineLingerMs" | "rateLimitPerMin" | "maxTaskCostUsd" | "maxTaskTokens" | "maxPrincipalCostUsd" | "costQuotaWindowSec" | "reapIntervalSec" | "runStaleSec" | "toolResultTtlSec">;
 /** 组:observability(可观测)。 */

package/dist/config.js

@@ -12,6 +12,7 @@ import { GIT_API_KINDS, isGitApiKind } from "./git-api-kind.js";
 import { RETENTION_MODES, MEMORY_CONSOLIDATION_MIN_INTERVAL_SEC } from "./config-types.js";
 import { buildWriteProtectionPosture } from "./write-protection.js";
 import { normalizeSshFingerprint } from "./ssh-host-key.js";
+import { readFaceForPosture } from "./read-face-posture.js";
 import { CONTROL_AND_BIDI_STRIP_RE } from "./text-bidi.js";
 export { RETENTION_MODES, MEMORY_CONSOLIDATION_MIN_INTERVAL_SEC } from "./config-types.js";
 function csv(name) {
@@ -1458,7 +1459,7 @@ function parseAuthDomain(ctx) {
     };
 }
 function parseOrchestrationDomain(ctx) {
-    const { postureOn } = ctx;
+    const { postureOn, singleUserTurnkey } = ctx;
     const workflowSizeGuidelineRaw = process.env.WORKFLOW_SIZE_GUIDELINE;
     if (workflowSizeGuidelineRaw !== undefined && !["small", "medium", "large", "unrestricted"].includes(workflowSizeGuidelineRaw)) {
         throw new Error(`WORKFLOW_SIZE_GUIDELINE must be small|medium|large|unrestricted, got "${workflowSizeGuidelineRaw}"`);
@@ -1501,7 +1502,9 @@ function parseOrchestrationDomain(ctx) {
         }
     }
     return {
-        ...(process.env.READ_FACE !== undefined ? { readFace: enumEnv("READ_FACE", "roots", ["open", "roots"]) } : {}),
+        ...(process.env.READ_FACE !== undefined
+            ? { readFace: enumEnv("READ_FACE", "roots", ["open", "roots"]), readFaceSource: "env" }
+            : readFaceForPosture(singleUserTurnkey)),
         ...(process.env.READ_DENY_PATTERNS !== undefined ? { readDenyPatterns: parseReadDenyPatternsEnv(process.env.READ_DENY_PATTERNS) } : {}),
         ...(() => {
             const tiers = process.env.READ_DENY_BUILTIN_TIERS !== undefined ? parseNameListEnv("READ_DENY_BUILTIN_TIERS", process.env.READ_DENY_BUILTIN_TIERS, { emptySentinel: "none" }) : undefined;
@@ -1905,7 +1908,7 @@ const ORCHESTRATION_GROUP_KEYS = [
     "workflowSizeGuideline", "backgroundAgentRetentionMs", "backgroundAgentStaleRunningMs",
     "backgroundAgentParkClaimStaleMs", "delegationEntryCaps", "rosterRetentionMs", "leaderRunStaleMs", "scratchpadSweepTtlMs", "sandboxPkgSource",
     "sessionAutoTitle", "selectEnvironmentTool", "envFactsEnabled", "toolDeferLongtail", "lspEnabled", "lspHostEnabled",
-    "imageBakes", "readFace", "readDenyPatterns", "readDenyBuiltinTiers", "readDenyBuiltinExclude",
+    "imageBakes", "readFace", "readFaceSource", "readDenyPatterns", "readDenyBuiltinTiers", "readDenyBuiltinExclude",
 ];
 const LIMITS_HTTP_GROUP_KEYS = [
     "port", "attachmentOrphanGraceMs", "workspaceFileMaxBytes", "attachmentMaxBytes", "attachmentMimeAllowlist",
@@ -1973,7 +1976,7 @@ export function loadConfig() {
     const approval = parseApprovalDomain({ postureOn });
     const memory = parseMemoryDomain({ requirePrincipal });
     const auth = parseAuthDomain({ requirePrincipal });
-    const orchestration = parseOrchestrationDomain({ postureOn });
+    const orchestration = parseOrchestrationDomain({ postureOn, singleUserTurnkey });
     const limitsHttp = parseLimitsHttpDomain();
     const observability = parseObservabilityDomain();
     const integrations = parseIntegrationsDomain();

package/dist/degenerate-instrument.d.ts

@@ -1,36 +1,3 @@
-/**
- * Degenerate-repetition instrument (a/b classifier).
- *
- * When a task fails with `errorCode === "output.degenerate"` (core 1.59), core hands back
- * `salvagedOutput` = the degenerate turn's text — **already tail-TRIMMED at the brain stream layer**.
- * 🔴 [ref] correction (this note used to claim "the **whole** text, good head + looped garbage tail";
- * that was true of core 1.59 and false of every engine that ships `trimDegenerateTail` — verified against
- * the installed dist, not against JSDoc): on the main path `assemble-result` fills the seat from the same
- * final message the brain already trimmed, so what arrives here is `head + exactly ONE copy of the
- * repeating unit` (unit ≤ `MAX_PERIOD` = 100 chars). Untrimmed text only reaches us on the narrow
- * fallbacks — the cut landed on the reasoning face, or `trimDegenerateTail` bailed (`reps < 2`, empty
- * unit, unit-loop period mismatch). Consequence for the numbers below: {@link repetitionTail} is a
- * **no-op** on the main-path input (one copy is not ≥ {@link MIN_REPEATS}), so `uniquePrefixLen`
- * collapses onto `salvagedLen` and the a/unknown split degrades to a pure length test. The a-vs-b
- * decision is unaffected (it is decided by `priorChars`, independently); the residual bias on a/unknown
- * is bounded by one unit ≤ 100 chars. Pin: the "已裁形" case in `test/degenerate-instrument.test.ts`
- * drives the REAL `inspectDegenerate` + `trimDegenerateTail` and asserts the tail measures 0.
- * Core's *salvage ②* — recovering the "last substantive turn" instead of the current one — is being
- * gated on REAL data: how often is the useful answer actually in an EARLIER turn vs. in the degenerate
- * turn itself? This instrument answers that, per event, without changing any behaviour.
- *
- * Classification (since the last user message = this task's own turns):
- *  - **a** good+garbage SAME turn — the degenerate turn carries a substantive unique head before the
- *    loop. Whole-turn salvage ① + a tail-trim is enough; ② would add nothing.
- *  - **b** good EARLIER / degenerate LATER — a substantive assistant turn already exists before the
- *    degenerate one. ② ("last-substantive-turn") would recover it; ① (current turn) throws it away.
- *  - **unknown** — degenerate from the start, nothing substantive anywhere (neither ① nor ② helps).
- *
- * Output is measurement only: a `degenerate_total{class}` counter (→ `/metrics/summary`) plus one
- * structured log line carrying the raw signals. The aggregate a/b/unknown frequencies are what gets
- * reported back to the core AI to decide whether ② is worth building. The repetition-boundary estimate
- * here is for *measuring* the unique head — it is NOT the production tail-trim (that lives in core).
- */
 import { type TaskResult } from "@sema-agent/core";
 import type { Pool } from "mysql2/promise";
 import type { Metrics } from "./observability/metrics.js";

package/dist/degenerate-instrument.js

@@ -1,3 +1,4 @@
+import { failureCodeOf } from "./terminal.js";
 import { StoredSession } from "@sema-agent/core";
 import { TiDBSessionStorage } from "./plugins/tidb-session-storage.js";
 const SUBSTANTIVE_CHARS = 200;
@@ -95,7 +96,7 @@ async function readPriorTurns(pool, sessionId, salvaged) {
 }
 export function makeDegenerateInstrument(pool, metrics, logger) {
     return (result) => {
-        if (result.errorCode !== "output.degenerate")
+        if (failureCodeOf(result.terminal) !== "output.degenerate")
             return;
         void (async () => {
             const salvaged = result.salvagedOutput ?? "";

package/dist/fleet/fleet-bus.d.ts

@@ -1,4 +1,4 @@
-import type { TaskNotificationPayload, WorkflowRun } from "@sema-agent/core";
+import type { TaskNotificationPayload, TerminalCause, WorkflowRun } from "@sema-agent/core";
 import type { RunRecord } from "../plugins/store-contracts.js";
 /** [ref] 幽灵行案的单源判别:一条 `task_notification` 只有在 **agent 族 × 终态** 时才允许打
  *  `onChildTerminal`(fleet「subagent 树」只渲 agent 子代)。`background_bash`/`monitor`/`external`
@@ -546,11 +546,16 @@ export declare function fleetRunPublisher(bus: FleetEventBus | undefined, run: {
 export type FleetRunPublisher = ReturnType<typeof fleetRunPublisher>;
 /** [ref]①/(a) 案:TaskResult → 终态行帧残局键映射(sync/background/resume 三条腿各自 settle,共用一处
  *  映射——键名映射写三遍必漂移)。usage 与 {@link BgNotification.usage} 同形:stats.tokens→totalTokens、
- *  stats.toolCalls→toolUses(名对齐,消费端一个形状)。errorCode "cancelled" ⇒ stoppedBy:"user"(与
- *  markStopSource 的归因值同源);transcriptId 顶层 = run 的 sessionId([ref]§二拍)。缺源的键不铸。 */
+ *  stats.toolCalls→toolUses(名对齐,消费端一个形状)。失败码 "cancelled" ⇒ stoppedBy:"user"(与
+ *  markStopSource 的归因值同源);transcriptId 顶层 = run 的 sessionId([ref]§二拍)。缺源的键不铸。
+ *
+ *  🔴 S-136(core 7.6.0 D-8):入参从**结构性可缺席** `errorCode?: string` 改成 `terminal?: TerminalCause`。
+ *  留着旧形不会红 —— 那正是危险所在:`TaskResult` 上已经没有 `errorCode` 这个键了,可结构性可选参数照样
+ *  编译通过,于是 `stoppedBy:"user"` 会**静默地永远不再铸**(取消的 run 在舰队行上从此看不出是被人杀的)。
+ *  终局事实一律走因由,`failureCodeOf` 是本仓读「这次失败带的是哪个码」的唯一形。 */
 export declare function fleetRunResiduals(result: {
     sessionId?: string;
-    errorCode?: string;
+    terminal?: TerminalCause;
     stats?: {
         turns?: number;
         tokens?: number;

package/dist/fleet/fleet-bus.js

@@ -1,5 +1,6 @@
 import { EventEmitter } from "node:events";
 import { deriveAgentDisplayStatus, isDelegatedAgentTerminal } from "@sema-agent/core";
+import { persistedPlaneOf } from "../terminal.js";
 import { recordFailOpen } from "../observability/fail-open.js";
 import { redactSecrets } from "../trace/redact.js";
 export function isFleetAgentTerminalNotification(n) {
@@ -341,7 +342,7 @@ export function fleetRunResiduals(result) {
         : {};
     return {
         ...(Object.keys(usage).length > 0 ? { usage } : {}),
-        ...(result.errorCode === "cancelled" ? { stoppedBy: "user" } : {}),
+        ...(persistedPlaneOf(result).errorCode === "cancelled" ? { stoppedBy: "user" } : {}),
         ...(result.sessionId ? { transcriptId: result.sessionId } : {}),
     };
 }

package/dist/host-decision.d.ts

@@ -0,0 +1,39 @@
+/**
+ * **宿主的决策事实** —— 一条耐久 park 被结算时,本服务能如实陈述的那半件事:谁结束了这次等待,以及
+ * 审批通道自报的归属。一个叶子模块(只依赖 `@sema-agent/core`),四个消费点共用一个定义。
+ *
+ * ## 为什么是「事实」而不是「结算词」(core 7.6.0 / [ref] S6-A,BREAKING)
+ *
+ * 旧形里 server 要往 `ResumeOutcome` 上写 core 的**结算词**(`ApprovalSettledBy` = `"human"` /
+ * `"timeout"` / `"aborted"`),于是「哪个词配哪个 decision」这条相容规则得由 server 自己记住 —— 而记错的
+ * 方向恰恰是这条规则存在的理由:**「窗到期」被报成「另一个人拒绝了」**。7.6.0 起 core 的
+ * `@contract settlement.single_mint` 逐字写着「宿主永不铸词」:宿主交事实,core 在 resume 入口铸
+ * `human_allowed` / `human_refused` / `park_sla_expired`,写进行的 `resolvedOutcome.gateOutcome`,再投影到
+ * 那次调用的 `tool_end.gate`。
+ *
+ * ⇒ 本仓的规则从「记住一张词×决定的相容表」变成「说出你知道的那两件事」。相容性也不再靠记忆:一次
+ * sweep 不可能 `allow`,core pre-CAS 拒。
+ */
+import { type ResumeOutcome } from "@sema-agent/core";
+/**
+ * 谁结束了这次等待,以及通道自报的归属。
+ *  · `decidedBy: "person"` —— 运维经审批通道做的决定(两条 HTTP `/decide` 腿);
+ *  · `decidedBy: "sla_timeout"` —— 宿主自己的 SLA 扫在行的 deadline 上判的(FACET A;**只有** sweep 能这么说,
+ *    而 sweep 结构上不能 `allow`)。
+ *  · `approver` —— 通道自报的结算方标识串。**缺席永不读成**「没人批」或「有人批」,只意味着通道没报名字。
+ */
+/** 直接取 core `ResumeOutcome` policy_ask 臂的 `hostDecision` 型 —— 本仓不复述那两个词(第二铸点)。 */
+export type HostDecision = Extract<ResumeOutcome, {
+    gate: "policy_ask";
+}>["hostDecision"];
+/**
+ * 一次**人为** decide 的事实。`principal` = 那条腿已经验过身份的决策者(缺席 = 匿名档的部署,通道确实
+ * 没有名字可报)。
+ *
+ * 归属串走 core 的 `screenApproverAttribution` **先筛后带**:core 对形不合的归属是 pre-CAS 响亮拒
+ * (`checkpoint.invalid_outcome`),而一个奇形怪状的 principal 把一次合法的人工决策变成 400 是纯回归。
+ * 筛不过 ⇒ **不带这一格**(而不是带一个被改造过的串):归属是转录,不是可以「修一修」的东西 —— 修出来的
+ * 名字既不是通道报的那个,也不是「通道没报」,两头都不真。
+ */
+export declare function personDecision(principal: string | undefined): HostDecision;
+//# sourceMappingURL=host-decision.d.ts.map

package/dist/host-decision.js

@@ -0,0 +1,6 @@
+import { screenApproverAttribution } from "@sema-agent/core";
+export function personDecision(principal) {
+    const screened = screenApproverAttribution(principal);
+    return { decidedBy: "person", ...(screened.approver !== undefined ? { approver: screened.approver } : {}) };
+}
+//# sourceMappingURL=host-decision.js.map

package/dist/http/route-ctx.d.ts

@@ -15,7 +15,8 @@
  * 本文件对 server.ts 的引用一律 `import type`(tsc 擦除,非装载边)。
  */
 import type { IncomingMessage, ServerResponse } from "node:http";
-import type { ApprovalSettledBy, TaskStream, TaskSpec, TaskResult, QuestionAnswer, CheckpointToken, ResumeOutcome, Runner } from "@sema-agent/core";
+import type { HostDecision } from "../host-decision.js";
+import type { TaskStream, TaskSpec, TaskResult, QuestionAnswer, CheckpointToken, ResumeOutcome, Runner } from "@sema-agent/core";
 import type { FlatServiceDeps, RequestAuth } from "./server.js";
 import type { TaskRequestBody, DecideBinding } from "./wire-types.js";
 import type { IdempotencyCache } from "./idempotency.js";
@@ -244,10 +245,12 @@ export interface RouteLegs {
     /** 同步腿的终局记账(计费/配额/指标),tasks 域用。 */
     finalizeTaskResult(result: TaskResult, principal: string | undefined, objective: string, sessionId: string | undefined): void;
     /** approvals 决策腿:session → pending checkpoint → markResuming CAS → 驱动续跑。
-     *  `settledBy` = **这次结算的出处**(core `ApprovalSettledBy`),必填:本腿有两个调用方(HTTP
-     *  `/decide` = 人;内部 D-D SLA deny-sweep = 窗到期),而函数内部分辨不出谁在叫它 —— 必填参数把
-     *  「漏报出处」变成编译错,不是一条下游把「没人答」渲染成「有人拒」的静默假出处。 */
-    resumeCheckpoint(sessionId: string, decision: "approve" | "deny", reason: string | undefined, settledBy: ApprovalSettledBy, req?: IncomingMessage, answer?: QuestionAnswer, binding?: DecideBinding, 
+     *  `hostDecision` = **这次结算的事实**(谁结束了这次等待 + 通道自报的归属),必填:本腿有两个调用方
+     *  (HTTP `/decide` = 人;内部 D-D SLA deny-sweep = 窗到期),而函数内部分辨不出谁在叫它 —— 必填参数把
+     *  「漏报出处」变成编译错,不是一条下游把「没人答」渲染成「有人拒」的静默假出处。
+     *  🔴 S-136(core 7.6.0 S6-A):宿主报事实、core 铸词 —— server 不再传结算词(旧形传 core 的三词之一,
+     *  于是「哪个词配哪个 decision」这条相容规则要 server 自己记,而记错的方向恰是上面那句要防的)。 */
+    resumeCheckpoint(sessionId: string, decision: "approve" | "deny", reason: string | undefined, hostDecision: HostDecision, req?: IncomingMessage, answer?: QuestionAnswer, binding?: DecideBinding, 
     /** [ref] codex R4(验真后修):remember 豁免的 grant 挂点。**工具名不再由路由自己读**(那是与本函数
      *  载入行分歧的第三次 scope-less 读,三读分歧下会给他人工具落豁免=提权)——由本函数把**已属主校验的
      *  载入 cp** 的工具名(`validatedToolName`,非 tool_approval / AskUserQuestion / legacy null ⇒ `null`

package/dist/http/routes/a2a-serve.js

@@ -1,3 +1,4 @@
+import { persistedPlaneOf } from "../../terminal.js";
 import { createHash } from "node:crypto";
 import { memoRedactedRead, redactErrorMessage } from "../../observability/run-terminal-log.js";
 import { A2A_TASK_STATES } from "@sema-agent/core";
@@ -84,8 +85,9 @@ function statusTextForRun(run, state) {
     const memo = (seat, raw) => (isTerminalRunStatus(run.status) ? memoRedactedRead(`a2a.${seat}`, raw, (v) => redactErrorMessage(v) ?? "") : (redactErrorMessage(raw) ?? ""));
     if (run.error)
         return memo("error", run.error);
-    if (run.result?.errorMessage)
-        return memo("errorMessage", run.result.errorMessage);
+    const runPlaneMessage = persistedPlaneOf(run.result).errorMessage;
+    if (runPlaneMessage)
+        return memo("errorMessage", runPlaneMessage);
     return undefined;
 }
 function taskFromRun(run, stale) {

package/dist/http/routes/approvals-assistant.d.ts

@@ -1,16 +1,3 @@
-/**
- * [ref] A9 域模块 —— 人在环审批面(durable F4 + legacy)与 assistant-scheduler 三动词。
- *
- * 路由(前缀 `/v1/approvals` 与 `/v1/assistant`):
- *   · durable 腿(接了 checkpointStore 时优先):list / stream(SSE 原生推送)/ decide|answer / preempt /
- *     resume / plan_review;
- *   · legacy 腿(approvalStore 轮询车道)已于 5.0.0 整体退役([ref]/[ref] A-5)——无 checkpointStore 时
- *     `/v1/approvals` 落 404(诚实缺席),不再有 trusted-header 决裁面。
- *
- * 所有会**烧模型**的续跑都经 `ctx.legs.*`(resumeCheckpoint / resumePreempted / resumePlanReview)走 resume
- * 家族的同一条腿:lease admission、markResuming CAS、写 run log、发 fleet 帧都在腿里,本域只做入站鉴权/形状门。
- * 本域零可变状态(抢占登记簿 `preemptableRuns` 属跨域 registry)。
- */
 import type { IncomingMessage, ServerResponse } from "node:http";
 import type { QuestionAnswer } from "@sema-agent/core";
 import type { CheckpointStoreFull } from "../../plugins/store-backend.js";

package/dist/http/routes/approvals-assistant.js

@@ -1,3 +1,4 @@
+import { personDecision } from "../../host-decision.js";
 import { DECIDED_REPLAY_SCAN_CAP, approvalPayloadFingerprint } from "../../plugins/checkpoint-store-sql.js";
 import { APPROVAL_GATE_KINDS } from "../../tool-approval.js";
 import { isParkedRunStatus } from "../../plugins/store-contracts.js";
@@ -483,7 +484,7 @@ async function handleApprovalsAssistantBody(req, res, url, ctx, miss) {
                     pendingGrant = { sessionId: grant.overrideSessionId ?? sessionId, toolName: canonical };
                 }
                 : undefined;
-            const out = await resumeCheckpoint(sessionId, decision, body.reason ?? undefined, "human", req, answer, binding, grantOnCommit, true, { principal: deciderPrincipal, explicitOperator });
+            const out = await resumeCheckpoint(sessionId, decision, body.reason ?? undefined, personDecision(deciderPrincipal), req, answer, binding, grantOnCommit, true, { principal: deciderPrincipal, explicitOperator });
             const outErrorCode = out.body.errorCode;
             if (pendingGrant !== undefined && out.status === 200 && outErrorCode !== "cancelled" && deps.approvalExemptionStore) {
                 try {

package/dist/http/routes/diagnostics.d.ts

@@ -1,14 +1,3 @@
-/**
- * [ref] 件二+件三 —— **装配自证**域:启动期静态自检(拒启判据)与 operator 诊断读面
- * (`GET /v1/diagnostics/wiring`)。
- *
- * 🔴 两件为什么同住一个模块:它们回答的是同一个问题(「这台 worker 到底接了什么线」),只是一个在 boot
- * 用它拒绝启动、一个在运行期把它读给 operator。分成两处 = 拒启用的判据与诊断报的读数会各自演化,而
- * 「拒启说没矛盾、诊断页显示矛盾」正是本设计要消灭的那类装配谎言。故 boot 半场是本文件导出的**纯函数**
- * (可单测、无 I/O),路由半场只是它的读口。
- *
- * 分层:本模块不值 import `server.ts`(那条边会闭合运行时装载环),对它只有 `import type`。
- */
 import type { IncomingMessage, ServerResponse } from "node:http";
 import type { WiringManifest } from "@sema-agent/core";
 import { type StreamApprovalGate, type StreamApprovalGateInput } from "../../tool-approval.js";

package/dist/http/routes/diagnostics.js

@@ -1,3 +1,4 @@
+import { buildReadFaceWiring } from "../../read-face-posture.js";
 import { resolveStreamApprovalGate } from "../../tool-approval.js";
 import { sendJson, sendError } from "../send.js";
 import { gatedPrincipal, explicitOperatorOk, isLoopbackAddress, verifiedIdentitySource } from "../principal-gate.js";
@@ -90,6 +91,7 @@ async function handleDiagnosticsBody(req, res, url, ctx, miss) {
             memoryPosture: deps.memoryPosture ?? null,
             sqlEngine: deps.sqlEngineFacts?.() ?? null,
             writeProtection: deps.writeProtection ?? null,
+            readFace: buildReadFaceWiring(deps.config),
             configApply: deps.configApplyState?.() ?? null,
             mcpRevocations: deps.mcpRevocationState?.() ?? null,
             serverGates: buildServerWiringGates({

package/dist/http/routes/runs.js

@@ -1,3 +1,4 @@
+import { persistedPlaneOf } from "../../terminal.js";
 import { memoRedactedRead, memoRedactTerminalResult, redactErrorMessage, redactHead, redactLedgerEventData, redactTerminalResult } from "../../observability/run-terminal-log.js";
 import { z } from "zod";
 import { uuidv7, mintCheckpointToken, CheckpointError, validatePendingSteer } from "@sema-agent/core";
@@ -260,7 +261,7 @@ async function handleRunsBody(req, res, url, ctx, miss) {
                 result: isTerminalRunStatus(run.status) ? memoRedactTerminalResult("run.result", run.result ?? undefined) : redactTerminalResult(run.result ?? undefined),
                 supervisorCost,
                 suggestions,
-                errorCode: stale ? undefined : (run.result?.errorCode ?? undefined),
+                errorCode: stale ? undefined : (persistedPlaneOf(run.result).errorCode ?? undefined),
                 error: stale ? "run stalled (instance lost?)" : isTerminalRunStatus(run.status) ? memoRedactedRead("run.error", run.error ?? undefined, redactErrorMessage) : redactErrorMessage(run.error ?? undefined),
                 jobId: run.jobId ?? undefined,
                 source: run.source ?? undefined,
@@ -331,7 +332,7 @@ async function handleRunsBody(req, res, url, ctx, miss) {
             const err = note;
             try {
                 const cancelContext = buildCancelContext(taskId, Date.parse(run.createdAt));
-                const result = { taskId, sessionId: run.sessionId, status: "failed", errorCode: "cancelled", errorMessage: err, stats: { turns: 0, tokens: 0 }, ...(cancelContext ? { cancelContext } : {}) };
+                const result = { taskId, sessionId: run.sessionId, terminal: { kind: "failed", code: "cancelled", message: err }, stats: { turns: 0, tokens: 0 }, ...(cancelContext ? { cancelContext } : {}) };
                 let lastErr;
                 for (let attempt = 0;; attempt++) {
                     try {