@sema-agent/server 7.65.0 → 7.66.0

package/dist/boot/governance-seams.js

@@ -36,7 +36,7 @@ export function createGovernanceSeams(ctx) {
     assertGovernanceAssemblable({
         lockedKeys,
         complianceDenies,
-        deploymentMcpConfigured: (config.mcpServers?.length ?? 0) > 0,
+        deploymentMcpConfigured: (config.mcpServers?.servers.length ?? 0) > 0,
         webFetchMounted: config.requirePrincipal !== true,
     });
     const lockedConfig = config.lockedConfigKeys !== undefined && config.lockedConfigKeys.length > 0 ? { keys: config.lockedConfigKeys } : undefined;

package/dist/boot/stores.js

@@ -24,7 +24,7 @@ import { buildMemoryRemoteLaneWarn, memoryEngineBackendFor, memoryEngineRemoteLa
 import { assertToolResultProvenanceSchema } from "../plugins/tool-result-store-sql.js";
 import { assertPermissionRuleApprovalSchema, assertPermissionRuleTicketSchema } from "../plugins/permission-rule-store-sql.js";
 import { assertApprovalAskRuleMaterialSchema } from "../plugins/approval-ask-store-sql.js";
-import { assertCheckpointBidiColumnSchema } from "../plugins/checkpoint-store-sql.js";
+import { assertCheckpointColumnSchema } from "../plugins/checkpoint-store-sql.js";
 import { assertFileHistorySchema } from "../plugins/file-history-store-sql.js";
 import { resolveStreamApprovalGate } from "../tool-approval.js";
 import { buildMemoryWriteBoundaryAudit, effectiveMemoryPersistenceCapable } from "./memory-boundary.js";
@@ -56,9 +56,9 @@ export async function openStores(ctx) {
         else if (mysqlPool)
             await assertToolResultProvenanceSchema(async (sql) => ({ rows: (await mysqlPool.query(sql))[0] }), "tidb");
         if (pgPool)
-            await assertCheckpointBidiColumnSchema(async (sql) => ({ rows: (await pgPool.query(sql)).rows }), "pg");
+            await assertCheckpointColumnSchema(async (sql) => ({ rows: (await pgPool.query(sql)).rows }), "pg");
         else if (mysqlPool)
-            await assertCheckpointBidiColumnSchema(async (sql) => ({ rows: (await mysqlPool.query(sql))[0] }), "tidb");
+            await assertCheckpointColumnSchema(async (sql) => ({ rows: (await mysqlPool.query(sql))[0] }), "tidb");
         if (config.permissionRulesEnabled) {
             if (pgPool)
                 await assertPermissionRuleApprovalSchema(async (sql) => ({ rows: (await pgPool.query(sql)).rows }), "pg");

package/dist/capabilities/hands-lane.d.ts

@@ -37,7 +37,9 @@ export declare function pickHandsRunner(hands: ScenarioHands, pair: HandsRunnerP
  * core 手带 band 的工具名**全集** —— 「挂 executionEnvFactory 才出现、不挂就消失」的那一批。
  *
  * 两段来源,都不是拍脑袋:
- *  · `HAND_TOOL_EFFECTS`(core 导出面,`tools/fs`)—— band 的 effect 表,11 名。
+ *  · `handBandEffects()`(core 7.8.0 B1 起的导出面;此前是手抄表常量 `HAND_TOOL_EFFECTS`)—— band 的
+ *    effect 表,由**静态工具目录**按 `mountedBy.includes("hands")` 派生。名册单源之后这张表不再是一张
+ *    手抄名表,加/退工具由目录一处说了算。
  *  · 下方锚定补集 —— `createHandsToolkit` / 手带块还会铸但**不在** effect 表里的 5 名(实测差集,见
  *    test/scenario-hands-lane.test.ts 的对表格:它用真 Runner 跑「有手 roster ∖ 无手 roster」,与本常量逐名对账,
  *    core 加/改 band 成员时红,防漂移)。

package/dist/capabilities/hands-lane.js

@@ -1,4 +1,4 @@
-import { HAND_TOOL_EFFECTS, RETIRED_TOOL_NAMES, combinePolicies, createAllowDenyPolicy } from "@sema-agent/core";
+import { handBandEffects, RETIRED_TOOL_NAMES, combinePolicies, createAllowDenyPolicy } from "@sema-agent/core";
 export function withoutExecutionEnv(deps) {
     const { executionEnvFactory: _handsDropped, ...rest } = deps;
     return rest;
@@ -12,13 +12,13 @@ export function pickHandsRunner(hands, pair) {
     }
 }
 export const HANDS_BAND_TOOL_NAMES = Object.freeze([
-    ...Object.keys(HAND_TOOL_EFFECTS),
+    ...handBandEffects().keys(),
     "SendMessage",
     "AgentTranscript",
     "Monitor",
     "EnterWorktree",
     "ExitWorktree",
-].filter((n) => !RETIRED_TOOL_NAMES.has(n)));
+].filter((n, i, all) => !RETIRED_TOOL_NAMES.has(n) && all.indexOf(n) === i));
 export const HANDS_DUAL_USE_TOOL_NAMES = Object.freeze(["TaskOutput", "TaskStop", "SendMessage", "AgentTranscript"]);
 export const HANDS_EXCLUSIVE_TOOL_NAMES = Object.freeze(HANDS_BAND_TOOL_NAMES.filter((n) => !HANDS_DUAL_USE_TOOL_NAMES.includes(n)));
 export function handsDenyPolicy() {

package/dist/config-center/skills-mcp.d.ts

@@ -1,5 +1,5 @@
 import type { A2aServerSpec, McpServerSpec } from "@sema-agent/core";
-import type { ScopedA2aPeer, ScopedMcpServer } from "../config-types.js";
+import type { CenterMcp, ScopedA2aPeer } from "../config-types.js";
 import type { Logger } from "../observability/logger.js";
 import type { LoadedSkill } from "../capabilities/skills.js";
 import type { CenterA2aPeer, CenterMcpServer, CenterSkillManifest } from "./types.js";
@@ -26,10 +26,10 @@ diskCacheDir?: string): Promise<LoadedSkill[]>;
  */
 export declare function resolveMcpServers(mcp: {
     servers: CenterMcpServer[];
-}, logger?: Logger): ScopedMcpServer[];
+}, logger?: Logger): CenterMcp;
 /** The MCP servers applicable to a scenario: tagged with it, or untagged (global). undefined when none.
  *  [ref]:alias 窗撤销,单键命中(同 `skillsForScenario`)。 */
-export declare function mcpForScenario(servers: ScopedMcpServer[] | undefined, scenario: string): McpServerSpec[] | undefined;
+export declare function mcpForScenario(center: CenterMcp | undefined, scenario: string): McpServerSpec[] | undefined;
 /**
  * DESIGN-269 §2.1 —— resolve center A2A peers (`/effective.a2a`) into core `A2aServerSpec`s + the scenarios
  * each applies to. Exact sibling of {@link resolveMcpServers}, same three rules:

package/dist/config-center/skills-mcp.js

@@ -1,4 +1,5 @@
 import { readMcpSourceLabel } from "../mcp-source-label.js";
+import { readMcpToolFaces } from "../mcp-tool-faces.js";
 import { skillContentHash } from "@sema-agent/settings-schema";
 import { CONTENT_ORIGIN_WORDS, describeBadContentOrigin, isContentOriginWord } from "../mcp-content-origin.js";
 import { fetchSkillContent } from "./http-client.js";
@@ -79,6 +80,7 @@ function resolveRefs(refs, server, kind, logger, event = "sema_registry_mcp_env_
 }
 export function resolveMcpServers(mcp, logger) {
     const out = [];
+    const reservedNames = (mcp.servers ?? []).map((s) => s.name);
     for (const s of mcp.servers ?? []) {
         if (s.enabled === false)
             continue;
@@ -97,13 +99,23 @@ export function resolveMcpServers(mcp, logger) {
                 });
         }
         const source = readMcpSourceLabel(s.name, s.source);
+        const facesRead = readMcpToolFaces(s.toolFaces);
+        if (!facesRead.ok) {
+            logger?.warn("sema_registry_mcp_tool_faces_invalid", {
+                server: s.name,
+                problem: facesRead.problem,
+                note: "server SKIPPED — a toolFaces overlay is a NARROWING declaration (its pathTarget is what the sensitive-path / write fences read); mounting the server without it would silently drop the protection you declared. Fix the entry and republish.",
+            });
+            continue;
+        }
+        const toolFaces = facesRead.faces === undefined ? {} : { toolFaces: facesRead.faces };
         if (s.transport.kind === "stdio") {
             const env = resolveRefs(s.transport.envRefs, s.name, "env", logger);
             if (env === null)
                 continue;
             out.push({
                 scenarios: s.scenarios ?? [],
-                spec: { name: s.name, transport: { kind: "stdio", command: s.transport.command, args: s.transport.args, ...(Object.keys(env).length ? { env } : {}) }, ...allow, ...elicit, ...contentOrigin, ...source },
+                spec: { name: s.name, transport: { kind: "stdio", command: s.transport.command, args: s.transport.args, ...(Object.keys(env).length ? { env } : {}) }, ...allow, ...elicit, ...contentOrigin, ...source, ...toolFaces },
             });
         }
         else {
@@ -112,15 +124,16 @@ export function resolveMcpServers(mcp, logger) {
                 continue;
             out.push({
                 scenarios: s.scenarios ?? [],
-                spec: { name: s.name, transport: { kind: "http", url: s.transport.url, ...(Object.keys(headers).length ? { headers } : {}), ...(s.transport.principalHeader ? { principalHeader: s.transport.principalHeader } : {}) }, ...allow, ...elicit, ...contentOrigin, ...source },
+                spec: { name: s.name, transport: { kind: "http", url: s.transport.url, ...(Object.keys(headers).length ? { headers } : {}), ...(s.transport.principalHeader ? { principalHeader: s.transport.principalHeader } : {}) }, ...allow, ...elicit, ...contentOrigin, ...source, ...toolFaces },
             });
         }
     }
     if (out.length > 0)
         logger?.info("sema_registry_mcp", { servers: out.map((s) => s.spec.name) });
-    return out;
+    return { servers: out, reservedNames };
 }
-export function mcpForScenario(servers, scenario) {
+export function mcpForScenario(center, scenario) {
+    const servers = center?.servers;
     if (!servers || servers.length === 0)
         return undefined;
     const hit = servers.filter((s) => s.scenarios.length === 0 || s.scenarios.includes(scenario)).map((s) => s.spec);

package/dist/config-center/types.d.ts

@@ -116,6 +116,17 @@ export interface CenterMcpServer {
     /** B-036 / S-143:声明方自述的分组标签(开集,非空 ≤80;settings-schema 1.7.0 `McpServerSpec.source`)——上 core
      *  `McpServerSpec.source`,由 `wiring_manifest.mcp[].source` 逐字回显。显示用,不进信任轴。 */
     source?: string;
+    /**
+     * 件8(core 7.8.0 [ref] §2.7;settings-schema 1.9.0 `McpServerSpec.toolFaces`)—— 这台 server 的
+     * **per-tool 面覆盖层**,键 = server 的**原始(未加命名空间)**工具名,值 = `{ family?, pathTarget?,
+     * renderHints?, ruleFace? }`。上 core `McpServerSpec.toolFaces`。
+     *
+     * 🔴 类型是 `unknown` 而不是那个结构,**刻意的**:本类型是两条 center 腿的**承载形**(本地 config.d 经
+     * settings-schema 的 `z.unknown()` 解析透明地过来、远端 /effective 是直读 JSON),判据与坏形处置的单一
+     * 属主是 `mcp-tool-faces.ts` 的 `readMcpToolFaces`(`resolveMcpServers` 在铸 spec 那一刻调它)。在承载
+     * 形上先写一个结构,等于把同一张判据表抄成两份(而其中一份没有执行力)。
+     */
+    toolFaces?: unknown;
     transport: {
         kind: "stdio";
         command: string;

package/dist/config-provider.js

@@ -144,6 +144,7 @@ export function mapToServiceEffective(eff, version) {
                     ...(s.elicitation !== undefined ? { elicitation: s.elicitation } : {}),
                     ...(s.contentOrigin !== undefined ? { contentOrigin: s.contentOrigin } : {}),
                     ...readMcpSourceLabel(s.name, s.source),
+                    ...(s.toolFaces !== undefined ? { toolFaces: s.toolFaces } : {}),
                 };
                 if (s.transport.kind === "stdio") {
                     return {

package/dist/config-types.d.ts

@@ -84,6 +84,15 @@ export interface ScopedMcpServer {
     scenarios: string[];
     spec: McpServerSpec;
 }
+/** The deployment's MCP declaration, resolved (`resolveMcpServers`). `servers` = what actually MOUNTED (env-NAME refs
+ *  resolved, `enabled:false` / missing-ref / malformed-`toolFaces` entries skipped, each with its own loud warn);
+ *  `reservedNames` = EVERY name the deployment declared, mounted or not. A name the deployment declared is CLOSED to
+ *  request-side injection (`resolveRequestMcp`) whether or not it mounted — otherwise "skipped" would silently mean
+ *  "free for the caller to refill without the operator's `toolFaces` / `allowTools`" (车CF codex r2 [high]). */
+export interface CenterMcp {
+    servers: ScopedMcpServer[];
+    reservedNames: readonly string[];
+}
 /** DESIGN-269 §2.1 —— an A2A PEER resolved to a core spec (header-NAME refs already → real values) plus
  *  the scenarios it applies to (empty = all). Exact sibling of {@link ScopedMcpServer}: `resolveSpec`
  *  filters by scenario (`a2aForScenario`) and passes `spec` to core as `TaskSpec.a2a`.
@@ -687,8 +696,9 @@ export interface ServiceConfigFlat {
     };
     /** MCP servers from sema-registry (`/effective.mcp`), resolved at startup (env-NAME refs → values) and
      *  filtered per scenario in `resolveSpec`. Not env-derived — populated by the sema-registry adapter when
-     *  present (restart-to-apply, like models/roles); undefined = no center MCP (scenarios use no MCP). */
-    mcpServers?: ScopedMcpServer[];
+     *  present (restart-to-apply, like models/roles); undefined = no center MCP (scenarios use no MCP).
+     *  Carries both the mounted list and the full declared-name set — see {@link CenterMcp}. */
+    mcpServers?: CenterMcp;
     /** DESIGN-269 §2.1 —— A2A peers from the config center (`/effective.a2a`), resolved at startup
      *  (header-NAME refs → values) and filtered per scenario in `resolveSpec` (`a2aForScenario`). Same
      *  posture as {@link mcpServers}: not env-derived (no A2A_* env leg — a peer is a structured record,

package/dist/http/routes/approvals-assistant.js

@@ -1,4 +1,6 @@
+import { screenedGate } from "../../trace/project.js";
 import { personDecision } from "../../host-decision.js";
+import { sameExecutionRecord } from "@sema-agent/core";
 import { DECIDED_REPLAY_SCAN_CAP, approvalPayloadFingerprint } from "../../plugins/checkpoint-store-sql.js";
 import { APPROVAL_GATE_KINDS } from "../../tool-approval.js";
 import { isParkedRunStatus } from "../../plugins/store-contracts.js";
@@ -71,6 +73,21 @@ async function decideIdempotentReplay(cs, args) {
         if (row.payloadFp === null || row.payloadFp !== requestFp)
             return undefined;
     }
+    const executionOutcome = (() => {
+        const records = rows.map((r) => r.executionOutcome);
+        const first = records[0];
+        if (first === null || first === undefined)
+            return undefined;
+        for (const r of records) {
+            if (r === null)
+                return undefined;
+            if (!sameExecutionRecord(r, first)) {
+                warn("decide_replay_execution_outcome_divergent", { sessionId, rows: rows.length });
+                return undefined;
+            }
+        }
+        return screenedGate(first);
+    })();
     return {
         status: 200,
         body: {
@@ -78,6 +95,7 @@ async function decideIdempotentReplay(cs, args) {
             idempotent: true,
             decision,
             bindingEnforced: true,
+            ...(executionOutcome !== undefined ? { executionOutcome } : {}),
         },
     };
 }

package/dist/http/routes/tasks.js

@@ -12,7 +12,7 @@ import { clearTurnActivity, readTurnActivityMs, recordTurnActivity } from "../..
 import { buildCancelContext } from "../../run-cancel-context.js";
 import { recordResourceWindow } from "../../resource-window.js";
 import { redactSecrets } from "../../trace/redact.js";
-import { contextUsageEventData, toolStartEventData, toolEndEventData, taskProgressEventData, taskNotificationEventData, compactedEventData, diagnosticsEventData, brainStatusEventData, steeringInjectedEventData, compactionOutcomeEventData, workspaceChangedEventData, wiringManifestEventData, wiringManifestOperatorEventData, humanInputEventData, appendModelUsageDelta, attachModelUsage } from "../../trace/project.js";
+import { contextUsageEventData, toolStartEventData, toolEndEventData, taskProgressEventData, taskNotificationEventData, compactedEventData, diagnosticsEventData, brainStatusEventData, steeringInjectedEventData, compactionOutcomeEventData, workspaceChangedEventData, wiringManifestEventData, wiringManifestOperatorEventData, toolRosterDeltaEventData, humanInputEventData, appendModelUsageDelta, attachModelUsage } from "../../trace/project.js";
 import { cascadeConfig, runMeta } from "../run-meta.js";
 import { scopedIdempotencyKey } from "../idempotency.js";
 import { sendJson, sendError, sseHeaders } from "../send.js";
@@ -484,6 +484,11 @@ async function handleTasksBody(req, res, url, ctx, miss) {
                                             : wiringManifestEventData(ev)),
                                     });
                                 }
+                                else if (ev.type === "tool_roster_delta") {
+                                    const rosterDelta = toolRosterDeltaEventData(ev);
+                                    if (rosterDelta !== undefined)
+                                        sseData(res, { type: "tool_roster_delta", ...rosterDelta });
+                                }
                                 else if (ev.type === "human_input") {
                                     sseData(res, { type: "human_input", ...humanInputEventData(ev) });
                                 }

package/dist/http/server.js

@@ -125,7 +125,7 @@ function mentionableNames(config, catalog) {
 }
 function isCheckpointReopenedFailure(r) {
     const code = failureCodeOf(r.terminal);
-    return code === "resume.env_failed" || code === "resume.tool_unavailable";
+    return code === "resume.env_failed" || code === "resume.tool_unavailable" || code === "resume.tool_contract_mismatch";
 }
 function nestedParkStatusOf(r) {
     const paused = nestedPauseOf(r.terminal);

package/dist/mcp-tool-faces.d.ts

@@ -0,0 +1,64 @@
+/**
+ * `McpServerSpec.toolFaces` —— MCP 工具的**面覆盖层**(core 7.8.0 [ref] §1.1/§2.7;声明面
+ * settings-schema 1.9.0)。一条规则、三条腿共用(请求腿 `task-mcp.ts normalizeServer` / center 腿
+ * `config-center/skills-mcp.ts resolveMcpServers` / 本地 config.d 腿 `config-provider.ts` 只做承载),
+ * 与 {@link import("./mcp-source-label.js").readMcpSourceLabel} 同一个「判据单点、三腿一致」的形。
+ *
+ * ## 分工(为什么本层**不**复述 core 的那张表)
+ * 覆盖层的**语义**校验属 core 的摄入侧,而且只有它做得了:`pathTarget.param` 是不是这只工具**物化后
+ * schema** 的顶层属性、审批卡要的键在不在、`ruleFace` 指的是不是标量键 —— 三件都要看远端 server 真发
+ * 回来的 schema,本层手里根本没有。core 的处置也已经定死:不合 ⇒ **这只工具在这条腿上不挂**,并通告
+ * 一次 `config.tool_face_invalid`(亲读 `dist/core/runner/tool-face-overlay.js` 的 `return undefined` 臂 ——
+ * 该文件 d.ts 头注里那句「the tool mounts BARE」是**过期**的,以实现为准)。
+ *
+ * 本层因此只做 core 的校验器**假定成立**的那一件事:**JSON 结构合不合 TS 型**。理由是硬的 —— core 的
+ * `toolFaceProblem` 是按 TS 型写的,`renderHints.summaryParams` 是个字符串时它会 `.find is not a function`
+ * 地把 prepare 整条炸掉,`ruleFace.params` 是个数字时 `for...of` 直接抛。原样透传一份任意 JSON 不是
+ * 「解析透明」,是把类型错误变成运行期崩溃。
+ *
+ * 闭词(`family` / `pathTarget.access` / `renderHints.approvalCard`)判据**取自 core 的导出常量**
+ * (`TOOL_FAMILIES` / `TOOL_PATH_ACCESSES` / `TOOL_APPROVAL_CARDS`),本仓一个词都不枚举 —— 与
+ * `MCP_DELIVERY_VERDICTS` 的消费姿势同款:词表单一属主在 core,抄一遍就是抄了一张会漂的表。
+ *
+ * ## 坏形的方向:**整条 server 不进**(fail-closed)
+ * 🔴 这一条被 codex 对抗复审 r1 的 [high] **翻正过一次**,把翻正的理由留在这里,因为它是本模块最容易
+ * 想错的一格:初版按 `contentOrigin` 的先例判「丢声明、留 server + 留痕」,而那条先例管的是**放宽**键
+ * (丢它 ⇒ 回落到过度标记 = fail-closed 的那一侧)。`toolFaces` 是**收窄**声明:它声明的 `pathTarget`
+ * 正是敏感路径策略、写围栏、编辑跟踪读的那一格 —— 丢掉它,那只工具就**无面挂载**,运维声明的保护
+ * 静默失效。codex 实测(同一只 MCP 写工具、同一个 `/work/.env` 目标,仅把 `renderHints.summaryParams`
+ * 从数组写成字符串):`createSensitivePathPolicy` 从 deny 变成 allow。一条 warn 补偿不了这个方向。
+ *
+ * 所以判据回到本仓对**收窄键**已经成文的那一条(`task-mcp.ts` 的 `allowTools`,[ref] / [ref] codex F1):
+ * **一个键在场就必须合法,否则这条 server 整条不进**。三问逐条:
+ *  ① 谁需要 —— 在部署侧给 MCP 工具声明写围栏 / 审批卡 / 显示名的运维;
+ *  ② 谁受伤 —— 覆盖层写错的那台 server:它**整条**不挂(请求腿进 `dropped` 并点名上报,center 腿跳过
+ *     该条、兄弟 server 照挂)。代价是真的(少一套工具),但它**响亮且立刻**;反方向的代价是一条
+ *     **静默失效的安全声明**,而后者按 [ref] 不许存在于安全轴上;
+ *  ③ 拿什么补偿 —— 报出来的名字本身:请求腿 `mcp_injection_dropped{dropped:[name]}`、center 腿
+ *     `sema_registry_mcp_tool_faces_invalid{server,problem,note}` 一条点名 warn(`problem` 里带工具名与哪一段不合;运维照着改那一行即可)。
+ * 每只工具的面是**整只**判(core 明写 "applied whole or not at all");而**任一只**判不出形 ⇒ 整条 server
+ * 不进 —— 「留下好的那几只」同样是让坏的那一只无面挂载,与整张丢没有区别。
+ */
+import { type McpServerSpec } from "@sema-agent/core";
+type ToolFaces = NonNullable<McpServerSpec["toolFaces"]>;
+/**
+ * 一条 server 条目的 `toolFaces` 判形结果:
+ *  · `{ ok: true, faces }` —— 合形(`faces` 缺席 = 这台 server 没有覆盖层,或声明了一个**空**覆盖层:
+ *    两者对 core 同义,都不铸键);
+ *  · `{ ok: false, problem }` —— 判不出形,**整条 server 不进**(方向与理由见模块头注),`problem` 是
+ *    给运维的一句点名(只带工具名与哪一段不合,不带面的值)。
+ */
+export type McpToolFacesRead = {
+    ok: true;
+    faces?: ToolFaces;
+} | {
+    ok: false;
+    problem: string;
+};
+/**
+ * 从任一腿的原始条目里读出 `toolFaces` —— **三条腿共用的唯一判据点**。
+ * 缺席 ⇒ 合形无覆盖层;整只不是对象 / **任一只**工具的面判不出形 ⇒ `ok:false`(调用方整条 server 不收)。
+ */
+export declare function readMcpToolFaces(v: unknown): McpToolFacesRead;
+export {};
+//# sourceMappingURL=mcp-tool-faces.d.ts.map

package/dist/mcp-tool-faces.js

@@ -0,0 +1,93 @@
+import { TOOL_APPROVAL_CARDS, TOOL_FAMILIES, TOOL_PATH_ACCESSES } from "@sema-agent/core";
+function isRecord(v) {
+    return typeof v === "object" && v !== null && !Array.isArray(v);
+}
+function isStringArray(v) {
+    return Array.isArray(v) && v.every((x) => typeof x === "string");
+}
+function memberOf(table, v) {
+    return typeof v === "string" && table.includes(v);
+}
+function onlyKeys(rec, allowed) {
+    return Object.keys(rec).every((k) => allowed.includes(k));
+}
+function readOneFace(raw) {
+    if (!isRecord(raw))
+        return undefined;
+    if (!onlyKeys(raw, ["family", "pathTarget", "renderHints", "ruleFace"]))
+        return undefined;
+    const out = {};
+    if (raw.family !== undefined) {
+        if (!memberOf(TOOL_FAMILIES, raw.family))
+            return undefined;
+        out.family = raw.family;
+    }
+    if (raw.pathTarget !== undefined) {
+        const pt = raw.pathTarget;
+        if (!isRecord(pt) || typeof pt.param !== "string" || !memberOf(TOOL_PATH_ACCESSES, pt.access))
+            return undefined;
+        if (!onlyKeys(pt, ["param", "access", "aliases", "skillScopeEligible"]))
+            return undefined;
+        if (pt.aliases !== undefined && !isStringArray(pt.aliases))
+            return undefined;
+        if (pt.skillScopeEligible !== undefined && typeof pt.skillScopeEligible !== "boolean")
+            return undefined;
+        out.pathTarget = {
+            param: pt.param,
+            access: pt.access,
+            ...(pt.aliases !== undefined ? { aliases: pt.aliases } : {}),
+            ...(pt.skillScopeEligible === true ? { skillScopeEligible: true } : {}),
+        };
+    }
+    if (raw.renderHints !== undefined) {
+        const rh = raw.renderHints;
+        if (!isRecord(rh) || !onlyKeys(rh, ["userFacingName", "activity", "summaryParams", "resultCards", "approvalCard"]))
+            return undefined;
+        if (rh.userFacingName !== undefined && typeof rh.userFacingName !== "string")
+            return undefined;
+        if (rh.activity !== undefined && typeof rh.activity !== "string")
+            return undefined;
+        if (rh.summaryParams !== undefined && !isStringArray(rh.summaryParams))
+            return undefined;
+        if (rh.resultCards !== undefined && !isStringArray(rh.resultCards))
+            return undefined;
+        if (rh.approvalCard !== undefined && !memberOf(TOOL_APPROVAL_CARDS, rh.approvalCard))
+            return undefined;
+        out.renderHints = {
+            ...(rh.userFacingName !== undefined ? { userFacingName: rh.userFacingName } : {}),
+            ...(rh.activity !== undefined ? { activity: rh.activity } : {}),
+            ...(rh.summaryParams !== undefined ? { summaryParams: rh.summaryParams } : {}),
+            ...(rh.resultCards !== undefined ? { resultCards: rh.resultCards } : {}),
+            ...(rh.approvalCard !== undefined ? { approvalCard: rh.approvalCard } : {}),
+        };
+    }
+    if (raw.ruleFace !== undefined) {
+        const rf = raw.ruleFace;
+        if (!isRecord(rf) || !onlyKeys(rf, ["primaryParams", "params"]))
+            return undefined;
+        if (rf.primaryParams !== undefined && !isStringArray(rf.primaryParams))
+            return undefined;
+        if (rf.params !== undefined && !isStringArray(rf.params))
+            return undefined;
+        out.ruleFace = {
+            ...(rf.primaryParams !== undefined ? { primaryParams: rf.primaryParams } : {}),
+            ...(rf.params !== undefined ? { params: rf.params } : {}),
+        };
+    }
+    return out;
+}
+export function readMcpToolFaces(v) {
+    if (v === undefined)
+        return { ok: true };
+    if (!isRecord(v))
+        return { ok: false, problem: `toolFaces is ${Array.isArray(v) ? "an array" : typeof v}, not an object of per-tool faces` };
+    const faces = {};
+    for (const [tool, raw] of Object.entries(v)) {
+        const face = readOneFace(raw);
+        if (face === undefined)
+            return { ok: false, problem: `the declared face for tool ${JSON.stringify(tool)} does not fit the tool-face shape` };
+        faces[tool] = face;
+    }
+    return Object.keys(faces).length > 0 ? { ok: true, faces } : { ok: true };
+}
+//# sourceMappingURL=mcp-tool-faces.js.map

package/dist/observability/fail-open.d.ts

@@ -17,6 +17,10 @@ export declare const FAIL_OPEN_TAGS: {
         readonly cls: "F";
         readonly note: "S-136(core 7.6.0 design/390 S6-A,`trace/project.ts` 的 `screenedGate`,写腿与两条读腿共用):一条 `tool_end` / 账本行携带的 `GateOutcome` 过不了 core 的 `screenGateOutcome`(I1–I4 不变量,或某一格词出闭集)⇒ **整条 gate 记录不上帧**(report + withhold,core 契约逐字给出的两种响亮形之一;绝不「静默修补」成一条自洽的记录)。放行的最坏后果=这一帧的消费端渲染不出「谁拒的 / 那次等待怎么结束的」,退回到 `isError` + 文案;它**不改变任何裁决**(门早已在 core 里判完,这里只是观测面)。反方向(把一条自相矛盾的记录照发)更坏:消费端按 I2/I3 读出来的结论会是假的。计数让「某个世代的产生者一直在发坏记录」显形。";
     };
+    readonly "server.trace.tool-roster-malformed": {
+        readonly cls: "F";
+        readonly note: "⑪(core 7.8.0 design/388,`trace/project.ts` 的 `wiring_manifest.tools` 段与 `tool_roster_delta` 构造器共用):载荷过不了 core 自己的 typebox 判形器(`ToolRoster` / `ToolRosterDelta`)⇒ 那一段缺席 / 那一帧不发,**绝不半张脸上 wire**。放行的最坏后果=消费端这条腿看不到工具名册(壳退回按名字分组、用通用审批卡),不影响任何裁决——名册是观测/渲染面,门在引擎里早已判完。反方向(把一份判不了形的名册照发)更坏:消费端会把读不出的行当成「这只工具没挂」。计数让「某个世代的产生者一直在发坏名册」显形。";
+    };
     readonly "server.task-mcp.source-label-dropped": {
         readonly cls: "F";
         readonly note: "B-036 / S-143(`mcp-source-label.ts readMcpSourceLabel`,请求腿 + center 腿共用):`mcpServers[].source`(分组标签,显示用、开集)坏形——空串 / 超 80 字 / 非字符串——**丢键留 server**。放行的最坏后果=这台 server 在 wiring_manifest.mcp[] 里没有分组标签(难看),不是门/权限/凭证;本地 config.d 腿由 settings-schema 1.7.0 在解析处拒,故本臂只在请求腿与远端 /effective 直读 JSON 腿可达。";

package/dist/observability/fail-open.js

@@ -8,6 +8,10 @@ export const FAIL_OPEN_TAGS = {
         cls: "F",
         note: "S-136(core 7.6.0 design/390 S6-A,`trace/project.ts` 的 `screenedGate`,写腿与两条读腿共用):一条 `tool_end` / 账本行携带的 `GateOutcome` 过不了 core 的 `screenGateOutcome`(I1–I4 不变量,或某一格词出闭集)⇒ **整条 gate 记录不上帧**(report + withhold,core 契约逐字给出的两种响亮形之一;绝不「静默修补」成一条自洽的记录)。放行的最坏后果=这一帧的消费端渲染不出「谁拒的 / 那次等待怎么结束的」,退回到 `isError` + 文案;它**不改变任何裁决**(门早已在 core 里判完,这里只是观测面)。反方向(把一条自相矛盾的记录照发)更坏:消费端按 I2/I3 读出来的结论会是假的。计数让「某个世代的产生者一直在发坏记录」显形。",
     },
+    "server.trace.tool-roster-malformed": {
+        cls: "F",
+        note: "⑪(core 7.8.0 design/388,`trace/project.ts` 的 `wiring_manifest.tools` 段与 `tool_roster_delta` 构造器共用):载荷过不了 core 自己的 typebox 判形器(`ToolRoster` / `ToolRosterDelta`)⇒ 那一段缺席 / 那一帧不发,**绝不半张脸上 wire**。放行的最坏后果=消费端这条腿看不到工具名册(壳退回按名字分组、用通用审批卡),不影响任何裁决——名册是观测/渲染面,门在引擎里早已判完。反方向(把一份判不了形的名册照发)更坏:消费端会把读不出的行当成「这只工具没挂」。计数让「某个世代的产生者一直在发坏名册」显形。",
+    },
     "server.task-mcp.source-label-dropped": {
         cls: "F",
         note: "B-036 / S-143(`mcp-source-label.ts readMcpSourceLabel`,请求腿 + center 腿共用):`mcpServers[].source`(分组标签,显示用、开集)坏形——空串 / 超 80 字 / 非字符串——**丢键留 server**。放行的最坏后果=这台 server 在 wiring_manifest.mcp[] 里没有分组标签(难看),不是门/权限/凭证;本地 config.d 腿由 settings-schema 1.7.0 在解析处拒,故本臂只在请求腿与远端 /effective 直读 JSON 腿可达。",

package/dist/plugins/checkpoint-store-sql.d.ts

@@ -1,6 +1,6 @@
 import type { Pool as MySqlPool } from "mysql2/promise";
 import type { Pool as PgPool } from "pg";
-import { type Checkpoint, type CheckpointGate, type CheckpointState, type CheckpointStore, type CheckpointSummary, type CheckpointToken, type PendingSteerInput, type ResumeOutcome, type ResolvedOutcome, type ResolveExpectation, type ReopenReason, type RiskDescriptor, type StoreDurability, type StoreFidelity } from "@sema-agent/core";
+import { type ExecutionOutcomeRecordWord, type GateOutcome, type Checkpoint, type CheckpointGate, type CheckpointState, type CheckpointStore, type CheckpointSummary, type CheckpointToken, type PendingSteerInput, type ResumeOutcome, type ResolvedOutcome, type ResolveExpectation, type ReopenReason, type RiskDescriptor, type StoreDurability, type StoreFidelity } from "@sema-agent/core";
 import { type RuleOfferProjection } from "../approval-card.js";
 import { type SqlDialect, type SqlDriver } from "./sql-driver.js";
 export { approvalPayloadFingerprint } from "./approval-payload-fingerprint.js";
@@ -195,16 +195,31 @@ export declare function pendingRowPrecedes(a: {
     createdAt: number;
     token: string;
 }, pick?: "newest" | "oldest"): boolean;
+/**
+ * `checkpoint` 表上**本仓后加、且被无条件引用**的列册 —— 升级前置探针({@link assertCheckpointColumnSchema})
+ * 的唯一数据源。一行一列:列名 + 这一列不在时**运行期**先坏在哪(拒启文案逐字用它,所以运维读到的是
+ * 「我会先在哪里挂」,不是一句泛泛的 schema 不齐)。
+ *
+ * 🔴 为什么是一张表而不是每列一个 `assert*ColumnSchema` 函数(S-160 归一):[ref]① 那次是一列一函数,
+ * 本批 [ref] 又要加两列 —— 照抄就是第二、第三份三十行的同形代码,而它们**唯一的差别只有列名与那句话**。
+ * 探测法(恒空 `WHERE 1=0` 读 + 方言缺列码)、失败方向(只在**可证**缺列时才给删表指路)、恢复动作
+ * (DROP TABLE checkpoint 的代价交代)三者对整张表是同一条,所以规则只留一条,列变成数据:下一次加列
+ * 只加一行,不再多一条规则。
+ */
+export declare const CHECKPOINT_ADDED_COLUMNS: ReadonlyArray<{
+    column: string;
+    breaksAt: string;
+}>;
 /**
  * [ref]① 升级前置断言 —— **拒启**,不是 warn(形照 [ref] `assertApprovalAskRuleMaterialSchema` / [ref] /
  * [ref] 三条先例;codex 店面轮 R1-[high] 采纳 —— 其引证的「MIGRATION.md 常设策略」经亲验不存在,采纳的
- * 依据是本仓 assert*Schema 探针族的真先例与失败方向本身)。
+ * 依据是本仓 assert*Schema 探针族的真先例与失败方向本身)。S-160 起判据对 {@link CHECKPOINT_ADDED_COLUMNS}
+ * **整张列册**跑(见那张表的头注:归一的理由)。
  *
  * 病:本仓不发 `ALTER TABLE`(SCHEMA POLICY:改列就改 CREATE + 删库重建)。一台**没删表**就升上来的
- * 部署,`CREATE TABLE IF NOT EXISTS` 对存量 `checkpoint` 是空操作 —— 本批新增的 `has_bidi_controls`
- * 列不在,而 `put()` 的 INSERT 与 `listPending` 的 SELECT **无条件**引用它。没有这道断言,服务照常过
- * 启动与健康检查,直到:每一次 durable park 落行在 `put()` 撞 unknown column(挂起面整条失效),
- * `GET /v1/approvals` 与 `/stream` 的每一次轮询 500 —— 运行期才响,且首撞点在用户的审批路径上。
+ * 部署,`CREATE TABLE IF NOT EXISTS` 对存量 `checkpoint` 是空操作 —— 后加的列不在,而写口与读口
+ * **无条件**引用它们。没有这道断言,服务照常过启动与健康检查,直到运行期才响,且首撞点在用户的
+ * 审批 / resume 路径上。
  *
  * 判据 = **能力探测**(恒空的 `WHERE 1=0` 读)+ **方言的缺列错误码**({@link isMissingColumnError},
  * 判据属主 `sql-errors.ts`);其余错误**原样 rethrow**,一个字都不加工 —— 一句破坏性的「去 DROP TABLE」
@@ -214,7 +229,7 @@ export declare function pendingRowPrecedes(a: {
  * store 装配段、路由装配之前;**无条件**跑(与 [ref] tool_result 探针同档)——checkpoint 表在两方言的
  * 中央 DDL 里恒在,SQL 后端一开它就是 durable park/审批队列的承载面,不存在「协议不上场」的豁免形。
  */
-export declare function assertCheckpointBidiColumnSchema(query: (sql: string) => Promise<{
+export declare function assertCheckpointColumnSchema(query: (sql: string) => Promise<{
     rows: Record<string, unknown>[];
 }>, dialect: SqlDialect): Promise<void>;
 /**
@@ -321,6 +336,17 @@ export interface DecidedApprovalRecord {
      * 铸法见 {@link approvalPayloadFingerprint}(两条车道共用同一只,免得指纹口径漂)。
      */
     payloadFp: string | null;
+    /**
+     * S-160(core 7.7.0 [ref])—— 这条已决行上**已决动作最后被怎么处置**的结算记录,`null` = **未知**。
+     *
+     * 🔴 缺席只有一个含义:未知,**绝不是**「放行过」。`decision` 说的是决定(人批了没有),这一格说的是
+     * 那次决定在 resume 腿上执行时的处置(部署自己的复核可能在 post-CAS 把人批过的、改过参数的调用否掉,
+     * 于是 `decision: "approve"` 与 denied/policy 的处置**同时**在一行上成立)。[ref] 的病正是「流断之后
+     * 从行重建这条 run 的消费者只读得到前半句」——decide 幂等回放正是那种消费者。
+     *
+     * 铸法 = core 的 {@link executionVerdict} **单口**(两条车道共用),不许任何读点自己判列的在场性。
+     */
+    executionOutcome: GateOutcome | null;
 }
 /**
  * [ref] 件1 —— {@link SqlCheckpointStore.findDecidedApprovalsForBinding} 的扫描上界。
@@ -417,6 +443,17 @@ export declare class SqlCheckpointStore implements CheckpointStore {
     readonly redecision: {
         readonly reopen: true;
     };
+    /**
+     * `CheckpointStore.execution` 声明(core 7.7.0 [ref];S-160)——**必填**,且必须恰是 `{ outcome: true }`:
+     * 店在此承诺 {@link SqlCheckpointStore.recordExecutionOutcome} 是契约描述的那条真 CAS(谓词、四词、
+     * 冲突抛),且 {@link SqlCheckpointStore.reopen} 认这条记录。与 `durability`/`fidelity`/`redecision`
+     * 三格同一条「声明而非鸭子判」姿势,区别只在这一格**不可缺席**:缺席的店会被 core 在 store 席的
+     * 第一次读(`resolveCheckpointStore`)以 `config.invalid_checkpoint_store` 拒启 —— 那是契约的正确行为,
+     * 因为一台记不下「已决动作最后被怎么处置」的部署,它手里每一条 resolved 行在这条轴上都永远读不出来。
+     */
+    readonly execution: {
+        readonly outcome: true;
+    };
     constructor(db: SqlDriver, logger?: {
         info?(msg: string, meta?: unknown): void;
     } | undefined);
@@ -485,6 +522,23 @@ export declare class SqlCheckpointStore implements CheckpointStore {
      * is validated against it — clearing it would defeat the winner-replay invariant.
      */
     reopen(token: CheckpointToken, scope: string, reason: ReopenReason): Promise<boolean>;
+    /**
+     * core 7.7.0 [ref](S-160)—— 记录**已决动作在 resume 腿上最后被怎么处置**:那一次调用的 `tool_end` 帧
+     * 携带的 {@link GateOutcome}。契约(答案闭集四词 / 幂等 / 冲突抛 / 一个字都不碰 status·rev·outcome·
+     * reopen_reason)的**判词逻辑一行都不自铸**:全部消费 core 导出的
+     * {@link executionRecordDisposition} —— 它是每个后端共用的那一份「CAS 谓词 + 幂等/冲突两臂」,
+     * 本店只留 commit 那一半(一条 `UPDATE … WHERE`)。
+     *
+     * 形 = **先读后 CAS**(与 {@link SqlCheckpointStore.setPendingSteer} 同款,理由同款):判词是**按行读**
+     * 出来的(要分辨 already_recorded / conflict / not_resolved / absent 四种,SQL 的 affected 只会告诉你
+     * 「没打中」),所以读一次交给 core 判,再把 commit 那一半压回一条带完整谓词的 UPDATE。两条语句之间那道窗
+     * 由 UPDATE 自己的谓词兜住:CAS 落空就重读重判(下一轮的读会分辨出到底是谁抢先了)。给足冗余仍全败 ⇒
+     * **抛**,绝不返回一个四词之一 —— 那等于替一次没发生的写编一个答案。
+     *
+     * 🔴 `execution_outcome` 坏 cell 在这里与 `get()` 同款 **抛**(strict parse):静默当缺席会让一份不同的
+     * 记录覆盖已经在案的那份,而记录物理不可变正是这条契约的全部意义。
+     */
+    recordExecutionOutcome(token: CheckpointToken, scope: string, gate: GateOutcome): Promise<ExecutionOutcomeRecordWord>;
     /**
      * [ref] D-A (durable steering) —— **core 5.14.0([ref] BREAKING)起是「追加进一条有界有序队列」**,
      * 不再是「盖掉单座」。两个人同时给一条挂起的 run 转向,旧语义会让第二条**静默销毁**第一条(一条没人
@@ -560,6 +614,13 @@ export declare class SqlCheckpointStore implements CheckpointStore {
     /** Pending checkpoints for the operator queue — NON-secret fields only (never the token). `taskId` is
      *  joined from task_active (the JOIN KEY to the run/trace — a suspended run KEEPS its
      *  session claim, so the join is live for every pending row; null only in pathological windows). */
+    /**
+     * S-160 显式记账 —— **本口与 {@link SqlCheckpointStore.listByScope} 都不投执行判词,这是结构性的不是遗漏**:
+     * 两口的谓词都硬 `status='pending'`,而执行记录的 CAS 谓词是 `status='resolved' AND execution_outcome IS NULL`
+     * ⇒ 一条 pending 行**按构造**不可能带记录;反向也封死了(记过的行 `reopen` 拒,永远回不到 pending)。
+     * 所以这两条读面上「没有 `executionOutcome`」不是「缺席=未知」,而是「这一格在这条读面上不存在」。
+     * 真正需要它的读面是**已决行**的那一条:`findDecidedApprovalsForBinding`(decide 幂等回放),见那里。
+     */
     listPending(scope?: string): Promise<PendingCheckpoint[]>;
     /**
      * [ref] #2 (scheduler seam, core 1.105): a scope's PENDING checkpoints as lightweight

package/dist/plugins/checkpoint-store-sql.js

@@ -1,7 +1,7 @@
 import { contentKindOf } from "../approval-content-kind.js";
 import { createHash } from "node:crypto";
 import { APPROVAL_GATE_KINDS_SQL_IN } from "../tool-approval.js";
-import { CheckpointError, MAX_RULE_TEXT_CHARS, validatePendingSteer, appendPendingSteer, checkpointVersionOf, winnerFromOutcome, summarizeCheckpoint, MAX_SUPPORTED_CHECKPOINT_VERSION, } from "@sema-agent/core";
+import { CheckpointError, MAX_RULE_TEXT_CHARS, validatePendingSteer, appendPendingSteer, checkpointVersionOf, winnerFromOutcome, summarizeCheckpoint, MAX_SUPPORTED_CHECKPOINT_VERSION, ExecutionOutcomeConflictError, executionRecordDisposition, executionVerdict, } from "@sema-agent/core";
 import { redactDeep, redactSecrets } from "../trace/redact.js";
 import { MAX_RULE_OFFERS, MAX_RULE_OFFER_BATCH_MEMBERS, RuleOfferRawSchema, backfillLegacyBatchMemberKind, screenUncoveredDetailSeat } from "../approval-card.js";
 import { parseJsonStrict as parseJson } from "./sql-row-helpers.js";
@@ -32,23 +32,41 @@ export function pendingRowPrecedes(a, b, pick) {
         return a.createdAt < b.createdAt || (a.createdAt === b.createdAt && a.token < b.token);
     return a.createdAt > b.createdAt || (a.createdAt === b.createdAt && a.token > b.token);
 }
-export async function assertCheckpointBidiColumnSchema(query, dialect) {
-    try {
-        await query("SELECT has_bidi_controls FROM checkpoint WHERE 1=0");
-    }
-    catch (err) {
-        if (!isMissingColumnError(err, dialect))
-            throw err;
-        throw new Error("checkpoint is missing the S-30 bidi-presence column (has_bidi_controls) — refusing to start. " +
-            "The park-mint write (put) and the operator-queue reads (GET /v1/approvals, /v1/approvals/stream) name the column " +
-            "unconditionally, so on this table every durable suspend fails at first park and every queue poll 500s — at runtime, " +
-            "after a healthy-looking boot. This repository ships no ALTER TABLE migrations, so the table must be recreated: run " +
-            "`DROP TABLE checkpoint;` on the " +
-            (dialect === "pg" ? "PostgreSQL" : "MySQL-protocol") +
-            " backend and restart — the schema is recreated at boot. The cost is bounded but real: the table holds IN-FLIGHT " +
-            "durable parks (suspended approvals/reviews awaiting a decision) — those cards are lost and their runs must be " +
-            "re-triggered; `checkpoint_ctx`, run rows and every other persistent face are untouched. " +
-            `Underlying probe error: ${err instanceof Error ? err.message : String(err)}`);
+export const CHECKPOINT_ADDED_COLUMNS = [
+    {
+        column: "has_bidi_controls",
+        breaksAt: "the park-mint write (put) and the operator-queue reads (GET /v1/approvals, /v1/approvals/stream) name it " +
+            "unconditionally, so every durable suspend fails at first park and every queue poll 500s",
+    },
+    {
+        column: "execution_outcome",
+        breaksAt: "the execution-outcome record (CheckpointStore.recordExecutionOutcome, core 7.7.0 #602) writes it under a CAS and " +
+            "`reopen` reads it as a predicate, so every resumed approval fails to file how the decided action was disposed and " +
+            "every reopen statement errors",
+    },
+    {
+        column: "execution_at_ms",
+        breaksAt: "it is written in the same CAS as `execution_outcome` (the record and its stamp are one write group)",
+    },
+];
+export async function assertCheckpointColumnSchema(query, dialect) {
+    for (const { column, breaksAt } of CHECKPOINT_ADDED_COLUMNS) {
+        try {
+            await query(`SELECT ${column} FROM checkpoint WHERE 1=0`);
+        }
+        catch (err) {
+            if (!isMissingColumnError(err, dialect))
+                throw err;
+            throw new Error(`checkpoint is missing the column ${column} — refusing to start. ` +
+                `On this table ${breaksAt} — at runtime, after a healthy-looking boot. ` +
+                "This repository ships no ALTER TABLE migrations, so the table must be recreated: run " +
+                "`DROP TABLE checkpoint;` on the " +
+                (dialect === "pg" ? "PostgreSQL" : "MySQL-protocol") +
+                " backend and restart — the schema is recreated at boot. The cost is bounded but real: the table holds IN-FLIGHT " +
+                "durable parks (suspended approvals/reviews awaiting a decision) — those cards are lost and their runs must be " +
+                "re-triggered; `checkpoint_ctx`, run rows and every other persistent face are untouched. " +
+                `Underlying probe error: ${err instanceof Error ? err.message : String(err)}`);
+        }
     }
 }
 const MAX_RULE_OFFER_SCAN = 32;
@@ -266,6 +284,7 @@ export function readPendingSteerColumns(seatRaw, queueRaw) {
     };
 }
 const STEER_CAS_ATTEMPTS = 8;
+const EXECUTION_RECORD_CAS_ATTEMPTS = 8;
 export class SqlCheckpointStore {
     db;
     logger;
@@ -273,6 +292,7 @@ export class SqlCheckpointStore {
     durability = "durable";
     fidelity = "json";
     redecision = { reopen: true };
+    execution = { outcome: true };
     constructor(db, logger) {
         this.db = db;
         this.logger = logger;
@@ -318,14 +338,17 @@ export class SqlCheckpointStore {
         const toolInput = boundedToolInput(pa?.args);
         const ruleOffers = boundedRuleOffers(pa?.ruleOffers);
         const hasBidiControls = pa?.hasBidiControls === true ? 1 : null;
+        const executionOutcome = cp.executionOutcome === undefined ? null : this.json(cp.executionOutcome, "execution outcome");
+        const executionAtMs = cp.executionOutcome === undefined ? null : (cp.executionAtMs ?? null);
         try {
-            await this.db.query(this.q("INSERT INTO checkpoint (token, scope, session_id, version, status, tool_name, tool_call_id, tool_input, checkpoint, deadline, created_at_ms, terminal_at_ms, gate_kind, bound_input_hash, risk_descriptor, rule_suggestions, has_bidi_controls) " +
-                "VALUES (?,?,?,?,'pending',?,?,?,?,?,?,?,?,?,?,?,?)", "INSERT INTO checkpoint (token, scope, session_id, version, status, tool_name, tool_call_id, tool_input, checkpoint, deadline, created_at_ms, terminal_at_ms, gate_kind, bound_input_hash, risk_descriptor, rule_suggestions, has_bidi_controls) " +
-                "VALUES ($1,$2,$3,$4,'pending',$5,$6,$7::jsonb,$8::jsonb,$9,$10,$11,$12,$13,$14,$15,$16)"), [
+            await this.db.query(this.q("INSERT INTO checkpoint (token, scope, session_id, version, status, tool_name, tool_call_id, tool_input, checkpoint, deadline, created_at_ms, terminal_at_ms, gate_kind, bound_input_hash, risk_descriptor, rule_suggestions, has_bidi_controls, rev, reopen_reason, execution_outcome, execution_at_ms) " +
+                "VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)", "INSERT INTO checkpoint (token, scope, session_id, version, status, tool_name, tool_call_id, tool_input, checkpoint, deadline, created_at_ms, terminal_at_ms, gate_kind, bound_input_hash, risk_descriptor, rule_suggestions, has_bidi_controls, rev, reopen_reason, execution_outcome, execution_at_ms) " +
+                "VALUES ($1,$2,$3,$4,$5,$6,$7,$8::jsonb,$9::jsonb,$10,$11,$12,$13,$14,$15,$16,$17,$18,$19,$20::jsonb,$21)"), [
                 token,
                 cp.scope,
                 cp.sessionId,
                 version,
+                cp.status,
                 pa?.toolName ?? null,
                 pa?.toolCallId ?? null,
                 toolInput === null ? null : this.json(toolInput, "approval tool_input"),
@@ -338,6 +361,10 @@ export class SqlCheckpointStore {
                 ((g) => (g?.riskDescriptor ? this.json(g.riskDescriptor, "risk descriptor") : null))(cp.gate),
                 ruleOffers === undefined ? null : this.json(ruleOffers, "rule offers"),
                 hasBidiControls,
+                cp.rev ?? 0,
+                cp.reopenReason ?? null,
+                executionOutcome,
+                executionAtMs,
             ]);
         }
         catch (e) {
@@ -348,7 +375,7 @@ export class SqlCheckpointStore {
         }
     }
     async get(token) {
-        const { rows } = await this.db.query(this.q("SELECT version, status, checkpoint, outcome, reopen_reason, rev, pending_steer, pending_steer_queue FROM checkpoint WHERE token = ?", "SELECT version, status, checkpoint, outcome, reopen_reason, rev, pending_steer, pending_steer_queue FROM checkpoint WHERE token = $1"), [token]);
+        const { rows } = await this.db.query(this.q("SELECT version, status, checkpoint, outcome, reopen_reason, rev, pending_steer, pending_steer_queue, execution_outcome, execution_at_ms FROM checkpoint WHERE token = ?", "SELECT version, status, checkpoint, outcome, reopen_reason, rev, pending_steer, pending_steer_queue, execution_outcome, execution_at_ms FROM checkpoint WHERE token = $1"), [token]);
         const r = rows[0];
         if (!r)
             return null;
@@ -363,6 +390,12 @@ export class SqlCheckpointStore {
             cp.resolvedOutcome = winnerFromOutcome(outcomeRaw);
         cp.reopenReason = r.reopen_reason ?? undefined;
         cp.rev = r.rev == null ? 0 : Number(r.rev);
+        const executionOutcome = parseJson(r.execution_outcome);
+        if (executionOutcome !== null) {
+            cp.executionOutcome = executionOutcome;
+            if (r.execution_at_ms != null)
+                cp.executionAtMs = Number(r.execution_at_ms);
+        }
         const steer = readPendingSteerColumns(r.pending_steer, r.pending_steer_queue);
         if (steer.lossy) {
             this.logger?.info?.("checkpoint_pending_steer_unreadable", { tokenFp: tokenFingerprint(token) });
@@ -392,9 +425,32 @@ export class SqlCheckpointStore {
         return res.affected === 1;
     }
     async reopen(token, scope, reason) {
-        const res = await this.db.query(this.q("UPDATE checkpoint SET status = 'pending', reopen_reason = ?, rev = rev + 1 WHERE token = ? AND scope = ? AND status = 'resolved'", "UPDATE checkpoint SET status = 'pending', reopen_reason = $1, rev = rev + 1 WHERE token = $2 AND scope = $3 AND status = 'resolved'"), [reason, token, scope]);
+        const res = await this.db.query(this.q("UPDATE checkpoint SET status = 'pending', reopen_reason = ?, rev = rev + 1 WHERE token = ? AND scope = ? AND status = 'resolved' AND execution_outcome IS NULL", "UPDATE checkpoint SET status = 'pending', reopen_reason = $1, rev = rev + 1 WHERE token = $2 AND scope = $3 AND status = 'resolved' AND execution_outcome IS NULL"), [reason, token, scope]);
         return res.affected === 1;
     }
+    async recordExecutionOutcome(token, scope, gate) {
+        for (let attempt = 0; attempt < EXECUTION_RECORD_CAS_ATTEMPTS; attempt++) {
+            const { rows } = await this.db.query(this.q("SELECT scope, status, execution_outcome FROM checkpoint WHERE token = ?", "SELECT scope, status, execution_outcome FROM checkpoint WHERE token = $1"), [token]);
+            const row = rows[0];
+            const facts = row === undefined
+                ? undefined
+                : {
+                    scope: String(row.scope),
+                    status: row.status,
+                    ...((v) => (v === null ? {} : { executionOutcome: v }))(parseJson(row.execution_outcome)),
+                };
+            const disposition = executionRecordDisposition(facts, scope, gate);
+            if (disposition === "conflict")
+                throw new ExecutionOutcomeConflictError(facts.executionOutcome, gate);
+            if (disposition !== "commit")
+                return disposition;
+            const res = await this.db.query(this.q("UPDATE checkpoint SET execution_outcome = ?, execution_at_ms = ? WHERE token = ? AND scope = ? AND status = 'resolved' AND execution_outcome IS NULL", "UPDATE checkpoint SET execution_outcome = $1::jsonb, execution_at_ms = $2 WHERE token = $3 AND scope = $4 AND status = 'resolved' AND execution_outcome IS NULL"), [this.json(gate, "execution outcome"), Date.now(), token, scope]);
+            if (res.affected === 1)
+                return "recorded";
+        }
+        throw new Error(`recordExecutionOutcome lost the execution-record CAS ${EXECUTION_RECORD_CAS_ATTEMPTS} times on checkpoint ${tokenFingerprint(token)} — ` +
+            "refusing to answer with one of the four contract words (that would invent an account of a write that did not happen)");
+    }
     async setPendingSteer(token, scope, steer) {
         const clean = validatePendingSteer(steer);
         for (let attempt = 0; attempt < STEER_CAS_ATTEMPTS; attempt++) {
@@ -529,8 +585,8 @@ export class SqlCheckpointStore {
         return out;
     }
     async findDecidedApprovalsForBinding(sessionId, boundCallId) {
-        const { rows } = await this.db.query(this.q("SELECT scope, bound_input_hash, outcome FROM checkpoint " +
-            `WHERE session_id=? AND tool_call_id=? AND status='resolved' AND decided_at_ms IS NOT NULL ORDER BY decided_at_ms DESC LIMIT ${DECIDED_REPLAY_SCAN_CAP}`, "SELECT scope, bound_input_hash, outcome FROM checkpoint " +
+        const { rows } = await this.db.query(this.q("SELECT scope, bound_input_hash, outcome, execution_outcome FROM checkpoint " +
+            `WHERE session_id=? AND tool_call_id=? AND status='resolved' AND decided_at_ms IS NOT NULL ORDER BY decided_at_ms DESC LIMIT ${DECIDED_REPLAY_SCAN_CAP}`, "SELECT scope, bound_input_hash, outcome, execution_outcome FROM checkpoint " +
             `WHERE session_id=$1 AND tool_call_id=$2 AND status='resolved' AND decided_at_ms IS NOT NULL ORDER BY decided_at_ms DESC LIMIT ${DECIDED_REPLAY_SCAN_CAP}`), [sessionId, boundCallId]);
         return rows.map((r) => {
             let winner;
@@ -541,11 +597,20 @@ export class SqlCheckpointStore {
             catch (e) {
                 this.logger?.info?.("checkpoint_decided_outcome_unreadable", { sessionId, error: e instanceof Error ? e.message : String(e) });
             }
+            let executed = null;
+            try {
+                const verdict = executionVerdict({ ...((v) => (v === null ? {} : { executionOutcome: v }))(parseJson(r.execution_outcome)) });
+                executed = verdict.kind === "executed" ? verdict.gate : null;
+            }
+            catch (e) {
+                this.logger?.info?.("checkpoint_execution_outcome_unreadable", { sessionId, error: e instanceof Error ? e.message : String(e) });
+            }
             return {
                 scope: String(r.scope),
                 boundInputHash: r.bound_input_hash == null ? null : String(r.bound_input_hash),
                 decision: approvalDecisionOfWinner(winner, boundCallId),
                 payloadFp: winner === undefined ? null : approvalPayloadFingerprint(winner),
+                executionOutcome: executed,
             };
         });
     }

package/dist/plugins/local-checkpoint-store.d.ts

@@ -1,4 +1,4 @@
-import { type Checkpoint, type CheckpointSummary, type CheckpointToken, type PendingSteerInput, type ReopenReason, type ResolveExpectation, type ResumeOutcome, type StoreDurability, type StoreFidelity } from "@sema-agent/core";
+import { type Checkpoint, type CheckpointSummary, type CheckpointToken, type PendingSteerInput, type ReopenReason, type ResolveExpectation, type ExecutionOutcomeRecordWord, type GateOutcome, type ResumeOutcome, type StoreDurability, type StoreFidelity } from "@sema-agent/core";
 import { type DecidedApprovalRecord, type PendingCheckpoint, type PendingRowBinding } from "./checkpoint-store-sql.js";
 export interface LocalCheckpointStoreOptions {
     /** taskId join for the pending card (the local FileRunStore's `getActiveTaskId`). Absent ⇒ `taskId: null`. */
@@ -40,6 +40,20 @@ export declare class LocalCheckpointStore {
     readonly redecision: {
         readonly reopen: true;
     };
+    /**
+     * `CheckpointStore.execution` 声明(core 7.7.0 [ref];S-160)——**必填**,与上面三格同一条判据:**如实
+     * 按内核判**。内核 core `FileCheckpointStore` 自己声明 `{ outcome: true }`,并把执行记录落成 ledger 的
+     * 一个新事件种类(`execution`,与 resolve 同款「先 append+fsync 再翻内存」的崩溃序),
+     * {@link LocalCheckpointStore.recordExecutionOutcome} 与 {@link LocalCheckpointStore.reopen} 都是纯委派
+     * ⇒ 抄内核的读数是诚实的。包装类**不继承**被包装者的声明(委派不是子类),所以这一格必须自己写。
+     *
+     * ⚠️ 升级序的诚实披露(DEPLOY-PREREQS 同句):ledger 里一旦出现 `execution` 事件,**7.7.0 之前的
+     * binary 会拒绝重放这个目录**(响亮,不是静默跳过);而压缩把事件折进快照行之后,那个旧 binary 读到
+     * 一个它不认识的字段、且它的 `reopen` 不认这条记录 —— 跨记录行回滚不受支持。
+     */
+    readonly execution: {
+        readonly outcome: true;
+    };
     private readonly inner;
     private readonly scopesPath;
     private readonly sessionTokensPath;
@@ -63,6 +77,10 @@ export declare class LocalCheckpointStore {
     get(token: CheckpointToken): Promise<Checkpoint | null>;
     resolve(token: CheckpointToken, scope: string, outcome: ResumeOutcome, expect?: ResolveExpectation): Promise<boolean>;
     reopen(token: CheckpointToken, scope: string, reason: ReopenReason): Promise<boolean>;
+    /** core 7.7.0 [ref](S-160):执行判词的 CAS —— 语义、四词、幂等的结构相等与冲突抛全在被包的内核里
+     *  (它自己走 core 的共享判词 `executionRecordDisposition`,ledger 事件 `execution` 是它的 commit 半场),
+     *  本 wrapper 只做转发。服务扩展面(运维队列/会话索引)与这条记录无关:它不改 status,也不新增可枚举行。 */
+    recordExecutionOutcome(token: CheckpointToken, scope: string, gate: GateOutcome): Promise<ExecutionOutcomeRecordWord>;
     /** core 5.14.0([ref]):入参是 `PendingSteerInput`(text/trusted + 可选 actor/inputId/priority),不是
      *  两键单座 —— 形参窄成 `{text,trusted}` 会**静默丢掉**署名与幂等键(TS 的方法参数是双变的,窄形不
      *  报错,只是把三个可选键从类型上抹掉,调用点再也传不进来)。队列语义与边界全在被包的 core

package/dist/plugins/local-checkpoint-store.js

@@ -3,7 +3,7 @@ import { createHash } from "node:crypto";
 import { existsSync, readFileSync, readdirSync, renameSync, unlinkSync, mkdirSync } from "node:fs";
 import { join } from "node:path";
 import { isApprovalGateKind } from "../tool-approval.js";
-import { FileCheckpointStore, atomicWriteFile, sanitizePathComponent, } from "@sema-agent/core";
+import { FileCheckpointStore, atomicWriteFile, executionVerdict, sanitizePathComponent, } from "@sema-agent/core";
 import { approvalDecisionOfWinner, approvalPayloadFingerprint, boundedRuleOffers, boundedToolInput, pendingRowPrecedes, TERMINAL_BACKSTOP_MS, TERMINAL_GRACE_MS } from "./checkpoint-store-sql.js";
 import { UNMANAGED_RETENTION } from "./retention-store-sql.js";
 function terminalAtOf(cp) {
@@ -17,6 +17,7 @@ export class LocalCheckpointStore {
     durability = "durable";
     fidelity = "json";
     redecision = { reopen: true };
+    execution = { outcome: true };
     inner;
     scopesPath;
     sessionTokensPath;
@@ -95,6 +96,9 @@ export class LocalCheckpointStore {
     reopen(token, scope, reason) {
         return this.inner.reopen(token, scope, reason);
     }
+    recordExecutionOutcome(token, scope, gate) {
+        return this.inner.recordExecutionOutcome(token, scope, gate);
+    }
     setPendingSteer(token, scope, steer) {
         return this.inner.setPendingSteer(token, scope, steer);
     }
@@ -227,6 +231,7 @@ export class LocalCheckpointStore {
                 boundInputHash: pa?.boundInputHash ?? null,
                 decision: approvalDecisionOfWinner(cp.resolvedOutcome, boundCallId),
                 payloadFp: cp.resolvedOutcome === undefined ? null : approvalPayloadFingerprint(cp.resolvedOutcome),
+                ...((v) => ({ executionOutcome: v.kind === "executed" ? v.gate : null }))(executionVerdict(cp)),
             });
         }
         return out;

package/dist/plugins/pg-pool.js

@@ -95,6 +95,11 @@ export const PG_SCHEMA_STATEMENTS = [
      -- has_bidi_controls(S-30① / #356②):bidi 在场位,语义与「1 或 NULL、恒不写 0」见 MySQL 孪生同名列的
      -- 行内注。clay 批 TINYINT(1) 归一先例:PG 侧统一 SMALLINT。
      has_bidi_controls SMALLINT,
+     -- execution_outcome / execution_at_ms(S-160;core 7.7.0 #602):语义、两轴的分工、CAS 与冲突的
+     -- 「记录物理不可变」由来见 MySQL 孪生(tidb-pool.ts 同两列的行内注)。载荷是 core 的 GateOutcome
+     -- JSON ⇒ 与同表 outcome 列同取 JSONB(协议信封无损,IS NULL 谓词两方言同义)。
+     execution_outcome JSONB,
+     execution_at_ms   BIGINT,
      PRIMARY KEY (token)
    )`,
     `CREATE INDEX IF NOT EXISTS idx_checkpoint_status_deadline ON checkpoint (status, deadline)`,

package/dist/plugins/tidb-pool.js

@@ -266,6 +266,17 @@ export const SCHEMA_STATEMENTS = [
      -- (缺席 = 没检出 ≠ 干净),一个 0 会把「没检出」谎成「已确认干净」。老行(本列诞生前 park 的)
      -- NULL ⇒ 读口省键。clay 批 2026-07-26 TINYINT(1) 归一先例:布尔列 TiDB 侧 TINYINT(1)。
      has_bidi_controls TINYINT(1) NULL,
+     -- execution_outcome / execution_at_ms(S-160;core 7.7.0 #602 的耐久半场):**决定被怎么处置了**的
+     -- 结算记录 —— resume 腿上那次调用的 tool_end 帧携带的 GateOutcome,与 outcome 列(决定本身,不可变)
+     -- 是两个轴:一个人批了(outcome 里 disposition=allowed),部署自己的复核在 post-CAS 否了他改过的参数
+     -- (execution_outcome 里 denied/policy)—— 流断了之后从行重建这条 run 的消费者,此前只读得到前半句。
+     -- 写口是 recordExecutionOutcome 的 CAS(status='resolved' AND execution_outcome IS NULL),**恰好一次**;
+     -- 第二次写同一份记录是幂等,写不同的一份是 checkpoint.execution_outcome_conflict(记录物理不可变 ——
+     -- 两份不同的执行记录意味着同一个已决动作被结算了两次,那是引擎缺陷,不是店可以吸收的条件)。
+     -- 缺席只有一个含义:**未知**,绝不是「放行过」(读面单口 core executionVerdict(cp))。
+     -- 两列同生同灭(stamp 在场 ⇔ 记录在场);reopen 见到记录即拒(已结算的动作不可重开)。
+     execution_outcome JSON   NULL,
+     execution_at_ms   BIGINT NULL,
      PRIMARY KEY (token),
      KEY idx_checkpoint_status_deadline (status, deadline),
      KEY idx_checkpoint_session_status (session_id, status)

package/dist/task-mcp.d.ts

@@ -110,11 +110,21 @@ export declare function assertRequestMcpUnlocked(bodyMcp: unknown, lockedKeys: R
  */
 export declare function assertRequestMcpContentOrigin(bodyMcp: unknown): void;
 /**
- * Merge GATED per-request MCP servers OVER the deployment baseline (center/config). The baseline WINS on a name
- * clash — a caller can ADD servers but can never SHADOW a configured one (the security baseline is authoritative,
- * same posture as `mergeUserSkills`). Returns the baseline unchanged when there is nothing to add.
+ * The ONE predicate for "this MCP server name belongs to the deployment": the scenario baseline (what mounted for
+ * this scenario) ∪ every name the deployment DECLARED (`CenterMcp.reservedNames` — mounted or not, any scenario).
+ * A caller can ADD servers but can never SHADOW or REFILL a deployment-declared one: a center entry that was skipped
+ * (disabled / missing env ref / malformed `toolFaces`) still occupies its name, otherwise "skipped" would silently
+ * mean "free for the caller to remount without the operator's `allowTools` / `toolFaces`" (车CF codex r2 [high]).
+ * Same posture as `mergeUserSkills`.
  */
-export declare function mergeRequestMcp(baseline: McpServerSpec[] | undefined, gated: McpServerSpec[]): McpServerSpec[] | undefined;
+export declare function deploymentClosedMcpNames(baseline: McpServerSpec[] | undefined, reservedNames: readonly string[]): ReadonlySet<string>;
+/**
+ * Merge GATED per-request MCP servers OVER the deployment baseline (center/config). Names closed by the deployment
+ * ({@link deploymentClosedMcpNames}) are dropped from `gated`. `reservedNames` has NO default: a security predicate's
+ * input is never implied — a caller with no deployment declaration passes `[]` and says so. Returns the baseline unchanged
+ * when nothing is added.
+ */
+export declare function mergeRequestMcp(baseline: McpServerSpec[] | undefined, gated: McpServerSpec[], reservedNames: readonly string[]): McpServerSpec[] | undefined;
 /**
  * The single entry point the spec-builder calls: compute the effective `TaskSpec.mcp` = deployment baseline + the
  * caller's gated per-request servers. Off the honored lane (or with no caller servers) returns the baseline
@@ -127,6 +137,10 @@ export declare function resolveRequestMcp(baseline: McpServerSpec[] | undefined,
     };
     requirePrincipal?: boolean;
     lockedConfigKeys?: readonly LockedKey[];
+    /** The deployment's declared-name set rides on the same config object the gate reads (one owner, no second arg). */
+    mcpServers?: {
+        reservedNames: readonly string[];
+    };
 }, logger?: {
     info?(m: string, meta?: unknown): void;
     warn(m: string, meta?: unknown): void;

package/dist/task-mcp.js

@@ -2,6 +2,7 @@ import { resolveComplianceDenies } from "@sema-agent/core";
 import { HttpError } from "./security.js";
 import { CONTENT_ORIGIN_WORDS, describeBadContentOrigin, isContentOriginWord } from "./mcp-content-origin.js";
 import { readMcpSourceLabel } from "./mcp-source-label.js";
+import { readMcpToolFaces } from "./mcp-tool-faces.js";
 export const MAX_REQUEST_MCP_SERVERS = 32;
 export function mcpInjectionHonored(config) {
     if (config.lockedConfigKeys?.includes("mcp") === true)
@@ -79,6 +80,11 @@ function normalizeServer(e, noteBadOrigin) {
             noteBadOrigin(spec.name, o.contentOrigin);
     }
     Object.assign(spec, readMcpSourceLabel(spec.name, o.source));
+    const faces = readMcpToolFaces(o.toolFaces);
+    if (!faces.ok)
+        return null;
+    if (faces.faces !== undefined)
+        spec.toolFaces = faces.faces;
     return spec;
 }
 export function validateRequestMcp(raw) {
@@ -124,11 +130,14 @@ export function assertRequestMcpContentOrigin(bodyMcp) {
             ` (omit the key entirely for the default: this server's tools classify as external content)`, { code: "request.field_invalid" });
     }
 }
-export function mergeRequestMcp(baseline, gated) {
+export function deploymentClosedMcpNames(baseline, reservedNames) {
+    return new Set([...(baseline ?? []).map((s) => s.name), ...reservedNames]);
+}
+export function mergeRequestMcp(baseline, gated, reservedNames) {
     if (gated.length === 0)
         return baseline;
-    const taken = new Set((baseline ?? []).map((s) => s.name));
-    const add = gated.filter((s) => !taken.has(s.name));
+    const closed = deploymentClosedMcpNames(baseline, reservedNames);
+    const add = gated.filter((s) => !closed.has(s.name));
     return add.length === 0 ? baseline : [...(baseline ?? []), ...add];
 }
 export function resolveRequestMcp(baseline, bodyMcp, config, logger) {
@@ -153,6 +162,16 @@ export function resolveRequestMcp(baseline, bodyMcp, config, logger) {
             note: "declaration DROPPED — these servers keep the pre-378 default (external content, session gets marked); the servers themselves still mount",
         });
     }
-    return mergeRequestMcp(baseline, v.ok);
+    const reservedNames = config.mcpServers?.reservedNames ?? [];
+    const closed = deploymentClosedMcpNames(baseline, reservedNames);
+    const blocked = v.ok.filter((s) => closed.has(s.name)).map((s) => s.name);
+    if (blocked.length > 0) {
+        logger?.warn("mcp_injection_dropped", {
+            reason: "name_reserved_by_deployment",
+            dropped: blocked,
+            note: "these names are declared by the deployment (center/config) — mounted or skipped, a caller can neither shadow nor refill them; rename the request-side server",
+        });
+    }
+    return mergeRequestMcp(baseline, v.ok, reservedNames);
 }
 //# sourceMappingURL=task-mcp.js.map

package/dist/tool-approval.js

@@ -1,6 +1,6 @@
 import { contentKindOf } from "./approval-content-kind.js";
 import { AsyncLocalStorage } from "node:async_hooks";
-import { uuidv7, MAX_RULE_TEXT_CHARS, parseAllowRuleText } from "@sema-agent/core";
+import { uuidv7, MAX_RULE_TEXT_CHARS, parseAllowRuleText, pathConfinableWriteToolNames } from "@sema-agent/core";
 import { precheckCardRuleText } from "./rules-consent.js";
 import { redactDeep, redactSecrets } from "./trace/redact.js";
 import { hasBidiControls } from "./text-bidi.js";
@@ -69,7 +69,7 @@ class ApprovalStoreDeadlineError extends Error {
         this.name = "ApprovalStoreDeadlineError";
     }
 }
-const FS_WRITE_TOOLS = new Set(["Write", "Edit", "NotebookEdit"]);
+const FS_WRITE_TOOLS = pathConfinableWriteToolNames();
 function sessionAllowCategory(toolName) {
     return FS_WRITE_TOOLS.has(toolName) ? "fs-write" : `tool:${toolName}`;
 }

package/dist/trace/core-keyset-guard.d.ts

@@ -31,7 +31,7 @@ type _GuardRoster = AssertAllKeysHandled<Exclude<keyof RosterEntry, RosterProjec
 type AskProjected = "toolName" | "toolCallId" | "args" | "message" | "sourceTaskId" | "fromSubagent" | "sourceAgentName" | "delegation" | "ruleOffers" | "ruleOffersAbsence" | "persistedRuleShadowed" | "probeCause" | "ruleEvidence" | "requiresRealApproval" | "denialLimitFallback" | "origin";
 type AskExcluded = "preview" | "principal" | "riskAxes" | "boundInputHash" | "isDelegatedChild" | "probeReason" | "hasBidiControls" | "previewWithheld" | "execCwd";
 type _GuardAsk = AssertAllKeysHandled<Exclude<keyof AskRequest, AskProjected | AskExcluded>>;
-type TaskEventHandled = "text_delta" | "reasoning_delta" | "tool_start" | "tool_end" | "turn_end" | "compacted" | "diagnostics" | "message_committed" | "status" | "task_notification" | "task_progress" | "steering_injected" | "workspace_changed" | "done" | "context_usage" | "compaction_outcome" | "human_input" | "wiring_manifest" | "text_end";
+type TaskEventHandled = "text_delta" | "reasoning_delta" | "tool_start" | "tool_end" | "turn_end" | "compacted" | "diagnostics" | "message_committed" | "status" | "task_notification" | "task_progress" | "steering_injected" | "workspace_changed" | "done" | "context_usage" | "compaction_outcome" | "human_input" | "wiring_manifest" | "text_end" | "tool_roster_delta";
 type _GuardTaskEvent = AssertAllKeysHandled<Exclude<TaskEvent["type"], TaskEventHandled>>;
 type MailboxProjected = "seq" | "from" | "content" | "sentAt" | "hopChain" | "peerMeta";
 type _GuardMailbox = AssertAllKeysHandled<Exclude<keyof MailboxMessage, MailboxProjected>>;
@@ -49,7 +49,7 @@ type SummaryProjected = "sessionId" | "scope" | "createdAt" | "gateKind" | "seve
 type SummaryExcluded = "token" | "toolInput" | "toolName" | "toolCallId" | "preview" | "principal" | "sourceTaskId" | "contentKind" | "restoreMode" | "checkpointId" | "previewWithheld";
 type _GuardInboxSummary = AssertAllKeysHandled<Exclude<keyof CheckpointSummary, SummaryProjected | SummaryExcluded>>;
 type TaskSpecWired = "objective" | "principal" | "images" | "sessionId" | "requireExistingSession" | "oneShot" | "clientContext" | "resumeAt" | "resumeAtMode" | "model" | "compactionModel" | "thinking" | "systemPrompt" | "appendSystemPrompt" | "promptProvider" | "memory" | "suggestNextPrompts" | "restoreFiles" | "acceptPartialRestore" | "rewindFilesTo" | "tools" | "excludeTools" | "deferTools" | "toolMaterializeStrategy" | "promptProfile" | "toolPolicy" | "onAsk" | "onQuestion" | "hooks" | "durableApproval" | "resourceSuspend" | "resilience" | "finalVerification" | "checkpointStore" | "handsReadOnly" | "memoryPersistenceCapable" | "additionalDirectories" | "additionalReadDirectories" | "enablePlanMode" | "interactiveTools" | "enableFork" | "shellGate" | "mcp" | "a2a" | "skills" | "backgroundScope" | "envFacts" | "limits" | "configOverrides" | "forwardSubagentEvents" | "retainSubagentSessions" | "retainBackgroundProcesses" | "outputSchema" | "outputRetries" | "compaction" | "attachments" | "selfOrchestration" | "getApiKeyAndHeaders" | "interactionPosture" | "agents" | "taskId" | "signal" | "preemptSignal" | "modelRole" | "enableBlockedReport" | "maxSuspends" | "autoModeRequested";
-type TaskSpecUnwired = "actor" | "roles" | "lspManager" | "tracer" | "readFace" | "readDenyPatterns" | "interactiveQuestionFallback" | "alwaysLoadTools" | "restoreGatedTools" | "deferSelfResolve" | "basePolicyForResumeEdit" | "lspDiagnostics" | "streamingToolExecution" | "toolResultThresholdChars";
+type TaskSpecUnwired = "excludeAllTools" | "actor" | "roles" | "lspManager" | "tracer" | "readFace" | "readDenyPatterns" | "interactiveQuestionFallback" | "alwaysLoadTools" | "restoreGatedTools" | "deferSelfResolve" | "basePolicyForResumeEdit" | "lspDiagnostics" | "streamingToolExecution" | "toolResultThresholdChars";
 type _GuardTaskSpec = AssertAllKeysHandled<Exclude<keyof TaskSpec, TaskSpecWired | TaskSpecUnwired>>;
 type _GuardTaskSpecReverse = AssertAllKeysHandled<Exclude<TaskSpecWired | TaskSpecUnwired, keyof TaskSpec>>;
 type TaskResultForwarded = "taskId" | "runId" | "sessionId" | "terminal" | "model" | "effectiveReasoning" | "result" | "salvagedOutput" | "remoteEnvFailures" | "apiFailure" | "retryAfterMs" | "degraded" | "structuredOutput" | "rewindNotes" | "haltedOnUserRejection" | "haltedByUser" | "strandedHumanAnswers" | "pendingApproval" | "approvalWaitedMs" | "effectiveReadFace" | "effectiveReadDenyPatterns" | "effectiveMemoryScopes" | "stats" | "editedFiles";

package/dist/trace/project.d.ts

@@ -407,6 +407,27 @@ export declare function workspaceChangedEventData(ev: {
  * 都红不了(2026-09-04 实测:该钉 26/26 全绿,红出 `autoMode` 的是编译期门)。段级 + 成员级的**编译期**门在
  * `core-keyset-guard.ts` ⑥b —— 那才是「core 加了段/加了成员」的可靠红点,两道并用缺一不可。
  */
+/**
+ * `tool_roster_delta`(core 7.8.0 [ref] ⑪ 新 `TaskEvent` 臂)—— **运行期**名册变更:整只变更后名册
+ * (`delta.roster`)+ 一段只有持有 `fromDigest` 的消费者才用得上的摘要。
+ *
+ * 契约里唯一的硬话是失败方向:`fromDigest` 对不上**不是拒绝** —— 携带的整只名册无论如何都是新状态,
+ * 消费端记一次 skew 后按快照重同步。所以本构造器**不**替消费端判 digest,只判「这一帧的载荷是不是
+ * core 说的那个形」。
+ *
+ * 判形与 {@link wiringManifestEventData} 的 `tools` 段同一条姿势(理由逐字见那里):属主是 core 的
+ * typebox schema `ToolRosterDelta`,过了整只透传,没过 ⇒ **整帧不发** + F 类留痕。半张名册变更帧比
+ * 不发更坏:消费端会据它把没读到的行当成「这只工具被卸了」。
+ *
+ * ⚠️ **如实披露(core 7.8.0 自述)**:7.8.0 的 runtask **还没有**推这条帧([ref] S3 才接线),座位与
+ * 类型先到货。本臂因此是**前瞻接线**:core 开始推的那一版,server 这一侧零改动即到达消费端;在那之前
+ * 它永不触发。消费端在那一版之前**不得**依赖本帧(core 契约原文)。
+ */
+export declare function toolRosterDeltaEventData(ev: {
+    delta?: unknown;
+    eventId?: unknown;
+    parentToolCallId?: unknown;
+}): Record<string, unknown> | undefined;
 export declare function wiringManifestEventData(ev: {
     manifest?: unknown;
     eventId?: unknown;

package/dist/trace/project.js

@@ -1,5 +1,6 @@
 import { redactErrorMessage } from "../observability/run-terminal-log.js";
-import { MCP_DELIVERY_VERDICTS, screenGateOutcome } from "@sema-agent/core";
+import { MCP_DELIVERY_VERDICTS, screenGateOutcome, ToolRoster, ToolRosterDelta } from "@sema-agent/core";
+import { Value } from "typebox/value";
 import { recordFailOpen } from "../observability/fail-open.js";
 import { redactSecrets, redactDeep } from "./redact.js";
 import { injectionTierOrAbsent } from "./injection-tier.js";
@@ -94,6 +95,15 @@ export function screenedGate(v) {
         recordFailOpen("server.trace.gate-outcome-defective", "disposition is not one of the two arms");
         return undefined;
     }
+    const shapeDefect = (d.kind === "denied" && typeof d.deniedBy !== "string" && "disposition.deniedBy is not a string") ||
+        (g.settlement !== undefined && (g.settlement === null || typeof g.settlement !== "object") && "settlement is not an object") ||
+        (g.settlement !== undefined && g.settlement !== null && typeof g.settlement.kind !== "string" && "settlement.kind is not a string") ||
+        (g.origin !== undefined && typeof g.origin !== "string" && "origin is not a string") ||
+        undefined;
+    if (shapeDefect !== undefined) {
+        recordFailOpen("server.trace.gate-outcome-defective", shapeDefect);
+        return undefined;
+    }
     const defects = screenGateOutcome(g);
     if (defects.length > 0) {
         recordFailOpen("server.trace.gate-outcome-defective", defects.join("; "));
@@ -250,6 +260,13 @@ export function workspaceChangedEventData(ev) {
         ...identityFields(ev),
     };
 }
+export function toolRosterDeltaEventData(ev) {
+    if (!Value.Check(ToolRosterDelta, ev.delta)) {
+        recordFailOpen("server.trace.tool-roster-malformed", "tool_roster_delta.delta did not fit core ToolRosterDelta");
+        return undefined;
+    }
+    return { delta: ev.delta, ...identityFields(ev) };
+}
 export function wiringManifestEventData(ev) {
     const str = (v) => (typeof v === "string" && v.length > 0 ? v : undefined);
     const bool = (v) => (typeof v === "boolean" ? v : undefined);
@@ -314,6 +331,8 @@ export function wiringManifestEventData(ev) {
             return undefined;
         return armed === (reason === "armed") ? { armed, reason } : undefined;
     })();
+    const toolsIn = m.tools;
+    const tools = toolsIn === undefined ? undefined : Value.Check(ToolRoster, toolsIn) ? toolsIn : (recordFailOpen("server.trace.tool-roster-malformed", "wiring_manifest.tools did not fit core ToolRoster"), undefined);
     const mcpIn = m.mcp;
     const mcp = (() => {
         if (!Array.isArray(mcpIn))
@@ -352,6 +371,7 @@ export function wiringManifestEventData(ev) {
         ...(permissionRules !== undefined ? { permissionRules } : {}),
         ...(modelGate !== undefined ? { modelGate } : {}),
         ...(autoMode !== undefined ? { autoMode } : {}),
+        ...(tools !== undefined ? { tools } : {}),
         ...(mcp !== undefined ? { mcp } : {}),
         ...identityFields(ev),
     };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/server",
-  "version": "7.65.0",
+  "version": "7.66.0",
   "description": "Sema Server — the server/API implementation layer for Sema, wiring core, registry, model providers, and cloud agent execution. Built on @sema-agent/core.",
   "type": "module",
   "license": "BUSL-1.1",
@@ -54,8 +54,8 @@
     "build:binary:run-local:darwin-arm64": "bun build --compile --target=bun-darwin-arm64 src/run-local.ts --outfile dist/run-local-darwin-arm64"
   },
   "dependencies": {
-    "@sema-agent/core": "7.6.2",
-    "@sema-agent/settings-schema": "1.8.0",
+    "@sema-agent/core": "7.8.0",
+    "@sema-agent/settings-schema": "1.9.0",
     "e2b": "^2.28.0",
     "libsodium-wrappers": "^0.8.4",
     "mysql2": "^3.22.4",
@@ -69,7 +69,7 @@
     "sharp": "^0.35.3"
   },
   "devDependencies": {
-    "@sema-agent/sdk": "8.4.0",
+    "@sema-agent/sdk": "8.5.0",
     "@types/libsodium-wrappers": "^0.7.14",
     "@types/node": "22.10.2",
     "@types/pg": "^8.20.0",