@sema-agent/server 7.66.0 → 7.67.0

package/dist/http/routes/rules.js

@@ -5,8 +5,8 @@ import { createLogger } from "../../observability/logger.js";
 import { RULE_IMPORT_RETRY_AFTER_SEC, MAX_RULE_SCOPE_CHARS, parseRuleScope, serializeRuleScope } from "../../rules-consent.js";
 import { CONTROL_AND_BIDI_CHARS } from "../../text-bidi.js";
 import { HttpError } from "../../security.js";
-import { MAX_RULE_TEXT_CHARS } from "@sema-agent/core";
-import { PERSISTED_RULE_MATCHES, PERSISTED_RULE_TOOLS } from "../../permission-rule-vocab.js";
+import { MAX_RULE_TEXT_CHARS, RULE_BEHAVIORS } from "@sema-agent/core";
+import { PERSISTED_RULE_MATCHES, isPersistedRuleTool } from "../../permission-rule-vocab.js";
 const logger = createLogger();
 export const RULES_CC_IMPORT_PREPARE_PATH = "/v1/rules/cc-import/prepare";
 export const RULES_CC_IMPORT_REDEEM_PATH = "/v1/rules/cc-import/redeem";
@@ -46,7 +46,8 @@ const LocalImportRowSchema = z
     .object({
     rule: z.string().min(1).max(MAX_RULE_TEXT_CHARS),
     scope: z.string().min(1).max(MAX_RULE_SCOPE_CHARS),
-    tool: z.enum(PERSISTED_RULE_TOOLS),
+    behavior: z.enum(RULE_BEHAVIORS),
+    tool: z.string().min(1).max(190).refine(isPersistedRuleTool, { message: "not a tool the persisted-rule grammar speaks for" }),
     match: z.enum(PERSISTED_RULE_MATCHES),
     command: z.string().min(1).max(MAX_RULE_TEXT_CHARS),
     adds: z.array(LocalImportAddSchema).max(64),
@@ -58,16 +59,18 @@ const LocalImportPrepareBodySchema = z.object({ rows: z.array(LocalImportRowSche
 const LocalImportRedeemBodySchema = z.object({ ticket: TicketStringSchema }).strict();
 const RuleRevokeBodySchema = z
     .object({
+    behavior: z.enum(RULE_BEHAVIORS),
     rule: z.string().min(1).max(1024),
     scope: z.string().min(1).max(MAX_RULE_SCOPE_CHARS),
     principal: z.string().min(1).max(190).optional(),
 })
     .strict();
+const RULES_CURSOR_FORMAT = 2;
 const RulesCursorSchema = z
-    .object({ rev: z.number().int().nonnegative().safe(), principal: z.string(), scope: z.string(), after: z.string() })
+    .object({ v: z.literal(RULES_CURSOR_FORMAT), rev: z.number().int().nonnegative().safe(), principal: z.string(), scope: z.string(), after: z.string() })
     .strict();
 function encodeRulesCursor(c) {
-    return Buffer.from(JSON.stringify(c)).toString("base64url");
+    return Buffer.from(JSON.stringify({ v: RULES_CURSOR_FORMAT, ...c })).toString("base64url");
 }
 function decodeRulesCursor(raw) {
     try {
@@ -78,7 +81,7 @@ function decodeRulesCursor(raw) {
         return { ok: false, why: err instanceof Error ? err.message : String(err) };
     }
 }
-const rowKey = (r) => `${r.scope}\u0000${r.rule}`;
+const rowKey = (r) => `${r.scope}\u0000${r.rule}\u0000${r.behavior}`;
 export async function handleRules(req, res, url, ctx) {
     const miss = { fell: false };
     await handleRulesBody(req, res, url, ctx, miss);
@@ -132,7 +135,7 @@ async function handleRulesBody(req, res, url, ctx, miss) {
     if (isLocalPrepare) {
         const parsed = LocalImportPrepareBodySchema.safeParse(rawBody);
         if (!parsed.success) {
-            sendError(res, 400, "request.body_shape", "body must be {rows:[{rule,scope,tool,match,command,adds}]}");
+            sendError(res, 400, "request.body_shape", "body must be {rows:[{behavior,rule,scope,tool,match,command,adds}]}");
             return;
         }
         const prepared = await lane.prepareLocalImport(principal, parsed.data.rows);
@@ -241,7 +244,9 @@ async function handleRuleList(req, res, caller, lane, operatorPrincipals) {
         sendError(res, 400, "request.query_invalid", "the rules cursor was minted at a different revision — restart the listing", { rev: listing.rev });
         return;
     }
-    const matching = listing.rows.filter((r) => (filterKey === "" || r.scope === filterKey) && (cursor === undefined || rowKey(r) > cursor.after));
+    const matching = listing.rows
+        .filter((r) => (filterKey === "" || r.scope === filterKey) && (cursor === undefined || rowKey(r) > cursor.after))
+        .sort((x, y) => (rowKey(x) < rowKey(y) ? -1 : rowKey(x) > rowKey(y) ? 1 : 0));
     const page = matching.slice(0, limit);
     const last = page[page.length - 1];
     const nextCursor = matching.length > limit && last !== undefined
@@ -252,7 +257,7 @@ async function handleRuleList(req, res, caller, lane, operatorPrincipals) {
 async function handleRuleRevoke(res, rawBody, caller, lane, operatorPrincipals) {
     const parsed = RuleRevokeBodySchema.safeParse(rawBody);
     if (!parsed.success) {
-        sendError(res, 400, "request.body_shape", "body must be {rule, scope} with an optional principal");
+        sendError(res, 400, "request.body_shape", "body must be {behavior, rule, scope} with an optional principal");
         return;
     }
     const scope = parseRuleScope(parsed.data.scope);
@@ -265,7 +270,7 @@ async function handleRuleRevoke(res, rawBody, caller, lane, operatorPrincipals)
         sendError(res, 403, "auth.operator_only", "revoking another principal's rules is an operator-only action");
         return;
     }
-    const outcome = await lane.removeRule({ principal: target.principal, rule: parsed.data.rule, scope });
+    const outcome = await lane.removeRule({ principal: target.principal, behavior: parsed.data.behavior, rule: parsed.data.rule, scope });
     switch (outcome.status) {
         case "removed":
             sendJson(res, 200, { status: "removed", rev: outcome.rev, stillLive: outcome.stillLive });

package/dist/http/routes/tasks.js

@@ -231,20 +231,15 @@ async function handleTasksBody(req, res, url, ctx, miss) {
                     markChildrenStoppedByUserOnAbort(ac.signal, durableTaskId ?? prepared.spec.sessionId, prepared.auth?.principal);
                 let ledgerSink;
                 let ledgerTerminal = false;
-                if (detachOnDisconnect && durableTaskId && deps.runStore) {
-                    const rs = deps.runStore;
-                    const tid = durableTaskId;
-                    ledgerSink = createLedgerSink({ appendEvent: (seq, type, data) => rs.appendEvent(tid, seq, type, data), persistThinking: deps.config.traceThinking, onActivity: (kind, statusData) => recordTurnActivity(tid, kind, statusData) });
-                    usageKey = durableTaskId;
-                    if (usageKey)
-                        deps.modelUsage?.register(usageKey);
-                }
                 if (deps.checkpointStore && prepared.spec.sessionId) {
                     await deps.checkpointStore.putCtx(prepared.spec.sessionId, { body: prepared.body, memoryScope: prepared.auth?.memoryScope });
                 }
                 if (durableTaskId && deps.runStore) {
                     const rs = deps.runStore;
                     const tid = durableTaskId;
+                    ledgerSink = createLedgerSink({ appendEvent: (seq, type, data) => rs.appendEvent(tid, seq, type, data), persistThinking: deps.config.traceThinking, onActivity: (kind, statusData) => recordTurnActivity(tid, kind, statusData) });
+                    usageKey = tid;
+                    deps.modelUsage?.register(tid);
                     const owner = principal ?? null;
                     const abortFromVerb = () => {
                         cancelledViaVerb.add(tid);

package/dist/http/server.js

@@ -115,6 +115,7 @@ export function validateUserSkills(skills) {
     }
     return null;
 }
+const PROCESS_STARTED_AT_MS = Date.now() - Math.round(process.uptime() * 1000);
 const MAX_BODY = 8 * 1024 * 1024;
 const MAX_IMAGES_PER_REQUEST = 20;
 const MAX_IMAGE_BASE64_BYTES = 6 * 1024 * 1024;
@@ -323,6 +324,7 @@ export function createHttpServer(rawDeps) {
                 ...(deps.config.localDataRoot ? { dataRoot: deps.config.localDataRoot } : {}),
                 configHash,
                 pid: process.pid,
+                startedAt: PROCESS_STARTED_AT_MS,
                 port: deps.config.port,
                 ...(deps.config.directDoorActive ? { directDoorActive: true } : {}),
                 ...(restart ? { restartRequired: true, restart: { reasons: restart.reasons, version: restart.version, since: restart.since } } : {}),
@@ -2434,6 +2436,7 @@ const WORKER_SWAP_REDEEMABLE = {
     env_factory_missing: true,
     governed_unwired: true,
     origin_missing: true,
+    ledger_event_unknown: true,
     real_approval_damaged: false,
     real_approval_forged: false,
     read_face_damaged: false,

package/dist/observability/fail-open.d.ts

@@ -69,6 +69,10 @@ export declare const FAIL_OPEN_TAGS: {
         readonly cls: "F";
         readonly note: "elicitation_complete 面包屑持久化失败。同上——答案已经在壳手里,丢的是收尾渲染。";
     };
+    readonly "server.session-titler.gateway-unreachable": {
+        readonly cls: "F";
+        readonly note: "S-178(cli [6662] ① clay 裁定转达,`session-titler.ts logFailure`):自动会话标题那一次廉价模型调用失败(gateway 不可达 / 凭据缺失 / 超时)。标题是**纯装饰**——列表面回退 objectivePreview,零行为影响,门/裁决/账本一个字节不受它管。此前每个新会话首次同 cause 打一条 `warn`,于是一台没配模型 gateway 的单机部署在日志里被这条噪音刷屏,壳因此去关 `SESSION_AUTO_TITLE`(替上游压噪),而那是把一个部署级旋钮当消音器用。现在:逐次 `debug` + 本计数 + 一次性 warn(recorder 自己的),运维仍看得见「这台机器的 titler 一直在失败」,用户面零噪音。观测面另有 `session_title_total{outcome}` 逐次记账。";
+    };
     readonly "server.prompts.artifact-cache-write-failed": {
         readonly cls: "F";
         readonly note: "已验签的提示词工件回填本地缓存失败。工件本身已返回给调用方;代价是下次同 digest 还要再取一次网络。";

package/dist/observability/fail-open.js

@@ -60,6 +60,10 @@ export const FAIL_OPEN_TAGS = {
         cls: "F",
         note: "elicitation_complete 面包屑持久化失败。同上——答案已经在壳手里,丢的是收尾渲染。",
     },
+    "server.session-titler.gateway-unreachable": {
+        cls: "F",
+        note: "S-178(cli [6662] ① clay 裁定转达,`session-titler.ts logFailure`):自动会话标题那一次廉价模型调用失败(gateway 不可达 / 凭据缺失 / 超时)。标题是**纯装饰**——列表面回退 objectivePreview,零行为影响,门/裁决/账本一个字节不受它管。此前每个新会话首次同 cause 打一条 `warn`,于是一台没配模型 gateway 的单机部署在日志里被这条噪音刷屏,壳因此去关 `SESSION_AUTO_TITLE`(替上游压噪),而那是把一个部署级旋钮当消音器用。现在:逐次 `debug` + 本计数 + 一次性 warn(recorder 自己的),运维仍看得见「这台机器的 titler 一直在失败」,用户面零噪音。观测面另有 `session_title_total{outcome}` 逐次记账。",
+    },
     "server.prompts.artifact-cache-write-failed": {
         cls: "F",
         note: "已验签的提示词工件回填本地缓存失败。工件本身已返回给调用方;代价是下次同 digest 还要再取一次网络。",

package/dist/observability/metrics.js

@@ -260,7 +260,7 @@ export function createMetrics() {
     m.counter("stale_cache_conflict_total", "Warm session-cache entries evicted by a cross-instance write while cached (S25)");
     m.counter("breaker_writethrough_failed_total", "Circuit-breaker cross-replica write-through failures (LOW), by backend");
     m.counter("web_search_bad_payload_total", "Web-search provider responses whose results field was not an array (LOW), by provider");
-    m.counter("permission_denied_total", "Tool-gate denials by the LAYER whose verdict is the deny (core's DeniedBy: policy/hook/org/classifier/plan_mode/compliance/write_protection/ask_resolution; 'other' = this build cannot name the layer; label is `deniedBy` since server 7.64.0 — it was `source` over core's retired PermissionDeniedSource; goal B4 always-on deny meter)");
+    m.counter("permission_denied_total", "Tool-gate denials by the LAYER whose verdict is the deny (core's DeniedBy: policy/hook/org/classifier/plan_mode/compliance/write_protection/ask_resolution/persisted_rule; 'other' = this build cannot name the layer; label is `deniedBy` since server 7.64.0 — it was `source` over core's retired PermissionDeniedSource; goal B4 always-on deny meter)");
     m.counter("permission_rule_events_total", "Persisted allow-rule seam events by event (persisted_rule_allowed = a rule authorized a call with nobody asked; rule_store_unreadable = the store failed to read so the call was adjudicated with ZERO rules)");
     m.counter("compaction_events_total", "Compaction lifecycle events by outcome (started/completed/failed/skipped) and trigger");
     m.counter("hook_llm_calls_total", "prompt/agent hook entries that completed a model call (hooks 3b), by type");

package/dist/permission-rule-vocab.d.ts

@@ -1,29 +1,21 @@
+import type { RuleApprovalRecord } from "@sema-agent/core";
 /**
- * [ref] + [ref](core `e298c9e0`,随 7.2.x 提货生效;[ref])—— 规则车道**闭词表的单一属主**。
- *
- * 为什么要一个模块而不是各处各写一份 `z.enum([...])`:同一张词表此前在四处各抄一份字面量
- * (`approval-card.ts` 两腿的 offer schema、`http/routes/rules.ts` 的直通票口行形、
- * `plugins/permission-rule-store-sql.ts` 的 `rules_json` 读/写形),core 给 `PersistedRuleMatch` 加两员
- * (wildcard / subpath)、给 `PersistedRuleTool` 加 Read 时,四份抄件**没有一份**会编译红 —— zod 的 enum
- * 只是运行期的一个 Set,静默把一次上游语义扩张翻成一整类合法行的拒收([ref] 词表纪律说的正是这形:
- * 未知词必须是**编译**错,不是运行期一个安静的 false)。
+ * `PersistedRuleTool` **不再是闭词表**(core 7.9.0 / [ref]):工具名自 core 的**目录**派生
+ * (`pathTarget` 声明 ⇒ 路径文法;`Bash` ⇒ 命令文法),型是 `string`。于是本文件对它的处置从
+ * 「转录一份名单」换成「转 core 的**谓词**」——名单在 core 的目录里,抄一份的那天目录加一个带
+ * `pathTarget` 的工具,本仓会静默拒收一整类合法行(正是本文件顶注说的那个病)。
  *
- * 🔴 每张表都带一条**双向全等钉**(`Exact<>`):元组的成员并 ≡ core 的联合型。core 加员 ⇒ 这里编译红,
- * 由人裁定新词在每个消费面的处置(收 / 拒 / 剥),而不是让它在某一处静默落进「不认识」臂;本仓多写一个
- * core 没有的词 ⇒ 同样红(词表属主是 core,本仓只转录)。
- *
- * ⚠️ 转录**不是**判据:一个词在表里只说「这是 core 定义的一员」,不说「本仓每条腿都接受它」。逐腿的收窄
- * (例如卡编辑臂对 `subpath` 的拒)写在那条腿自己的穷举 `switch` 里,并各带理由。
+ * 谓词方向仍是 fail-CLOSED:`ruleToolGrammarOf` 认不出的名字**不是**一条可持久化规则的工具位
+ * (既非命令文法也非路径文法 ⇒ 这条行永远匹配不上任何调用),两只店与票口一律拒。
  */
-import type { RuleApprovalRecord } from "@sema-agent/core";
-/** `PersistedRuleTool`([ref] §2.2:`"Read"` 只说一种文法 —— `Read(//abs-dir/**)` 目录只读授权)。 */
-export declare const PERSISTED_RULE_TOOLS: readonly ["Bash", "Read"];
+export declare function isPersistedRuleTool(name: string): boolean;
 /**
- * `PersistedRuleMatch` 四员(core 顶注逐字):`exact` / `prefix`(历史 colon-star,永久兼容读、复合前缀形的
+ * `PersistedRuleMatch` 五员(core 顶注逐字):`exact` / `prefix`(历史 colon-star,永久兼容读、复合前缀形的
  * 唯一拼写)/ `wildcard`([ref] 尾 space-star,单命令体上与 prefix **同一谓词**,建议面自此铸它)/
- * `subpath`(Read 目录形,永不容纳任何命令)。
+ * `subpath`(Read 目录形,永不容纳任何命令)/ `path`(core 7.9.0 [ref]:路径族 deny/ask/allow 的模式文法
+ * —— `//abs`、`~/`、`/root-relative`、cwd 相对,段内 `*`、跨段 `**`)。
  */
-export declare const PERSISTED_RULE_MATCHES: readonly ["exact", "prefix", "wildcard", "subpath"];
+export declare const PERSISTED_RULE_MATCHES: readonly ["exact", "prefix", "wildcard", "subpath", "path"];
 /** [ref] §2.3 B3:batch offer 成员的判别位(`command` = 历史逐段 Bash 规则;`directoryRead` = cd 段铸的目录只读授权)。 */
 export declare const RULE_OFFER_BATCH_MEMBER_KINDS: readonly ["command", "directoryRead"];
 /** [ref] §3.5:一段「为什么仍未被覆盖」的闭三词集(`redirection` 永久逐次 / `no_rule_form` 无可覆盖形 / `cap_overflow` 去重+帽挤出)。 */
@@ -31,7 +23,7 @@ export declare const UNCOVERED_SEGMENT_REASONS: readonly ["redirection", "no_rul
 /** [ref] §3.3-5:卡编辑面的 breadth 警告码(记录 `edited.warnings` 存的就是这两个字面)。 */
 export declare const EDITED_RULE_BREADTH_WARNING_CODES: readonly ["broad_prefix", "compound_prefix"];
 /**
- * [ref] §4.5 / [ref] §3.5 —— 审批记录的**形版本号**(core `RuleApprovalRecord.schema`,本批 2→3)。
+ * [ref] §4.5 / [ref] §3.5 —— 审批记录的**形版本号**(core `RuleApprovalRecord.schema`,本批 3→4;[ref] 三态 behavior 进候选行)。
  * 类型绑 core 的字面型:core 再升号 ⇒ 这里编译红,两只 durable 店(SQL 双方言 + File)的 stale 判别与写侧钉
  * 同批随之;判别是**等式**(`!==`)不是下限 —— 旧号的行按 stale 信封交还(不迁移、不 widen、不丢行),
  * pending 卡短命,重触发即取新卡(B7/B8 既诺)。

package/dist/permission-rule-vocab.js

@@ -1,7 +1,8 @@
-export const PERSISTED_RULE_TOOLS = ["Bash", "Read"];
-const TOOLS_PIN = true;
-void TOOLS_PIN;
-export const PERSISTED_RULE_MATCHES = ["exact", "prefix", "wildcard", "subpath"];
+import { ruleToolGrammarOf } from "@sema-agent/core";
+export function isPersistedRuleTool(name) {
+    return ruleToolGrammarOf(name) !== undefined;
+}
+export const PERSISTED_RULE_MATCHES = ["exact", "prefix", "wildcard", "subpath", "path"];
 const MATCHES_PIN = true;
 void MATCHES_PIN;
 export const RULE_OFFER_BATCH_MEMBER_KINDS = ["command", "directoryRead"];
@@ -13,5 +14,5 @@ void REASONS_PIN;
 export const EDITED_RULE_BREADTH_WARNING_CODES = ["broad_prefix", "compound_prefix"];
 const WARNING_CODES_PIN = true;
 void WARNING_CODES_PIN;
-export const RULE_APPROVAL_RECORD_SCHEMA = 3;
+export const RULE_APPROVAL_RECORD_SCHEMA = 4;
 //# sourceMappingURL=permission-rule-vocab.js.map

package/dist/plugins/permission-rule-store-file.d.ts

@@ -1,6 +1,7 @@
-import { FileDurableRulePartitionProvider, type RuleApprovalRecord, type RuleApprovalRecordStore, type RuleScope, type StaleRuleApprovalRecord } from "@sema-agent/core";
+import { FileDurableRulePartitionProvider, type RuleApprovalRecord, type RuleApprovalRecordStore, type StaleRuleApprovalRecord } from "@sema-agent/core";
 import { type RuleImportTicket, type RuleTicketPurpose, type RuleTicketReclaimResult, type RuleTicketRedeemResult, type RuleTicketSnapshot } from "./permission-rule-store-sql.js";
 import type { PermissionRuleStoreBundle } from "../rules-consent.js";
+import { type RuleCandidate } from "@sema-agent/core";
 /**
  * `RuleApprovalRecordStore` 的 File 形。
  *
@@ -62,10 +63,7 @@ export declare class FileRuleImportTicketStore {
         principal: string;
         approvalId: string;
         purpose: RuleTicketPurpose;
-        candidates: ReadonlyArray<{
-            rule: string;
-            scope: RuleScope;
-        }>;
+        candidates: ReadonlyArray<RuleCandidate>;
         ttlMs: number;
     }): Promise<RuleImportTicket>;
     /** 一次性**认领**。五条否定项的判序与 SQL 形逐字相同(unknown → wrong-principal → wrong-purpose →

package/dist/plugins/permission-rule-store-file.js

@@ -6,12 +6,13 @@ import { FileDurableRulePartitionProvider, AppendLog, ensureDir, readJsonlRecord
 import { z } from "zod";
 import { buildRulePayloadHash } from "./permission-rule-store-sql.js";
 import { EDITED_RULE_BREADTH_WARNING_CODES, RULE_APPROVAL_RECORD_SCHEMA, UNCOVERED_SEGMENT_REASONS } from "../permission-rule-vocab.js";
+import { RULE_BEHAVIORS } from "@sema-agent/core";
 const RuleScopeSchema = z.union([
     z.object({ kind: z.literal("global") }).strict(),
     z.object({ kind: z.literal("project"), root: z.string().min(1) }).strict(),
 ]);
 const RuleDotSchema = z.object({ actor: z.string().min(1), counter: z.number().int().nonnegative().safe() }).strict();
-const RuleCandidateSchema = z.object({ rule: z.string(), scope: RuleScopeSchema }).strict();
+const RuleCandidateSchema = z.object({ behavior: z.enum(RULE_BEHAVIORS), rule: z.string(), scope: RuleScopeSchema }).strict();
 const RuleOffer2Schema = z.union([
     z.object({ kind: z.literal("single"), candidate: z.number().int().nonnegative().safe() }).strict(),
     z

package/dist/plugins/permission-rule-store-sql.d.ts

@@ -1,5 +1,5 @@
 import { z } from "zod";
-import { type PermissionRuleWriter, type DurableRulePartition, type DurableRulePartitionProvider, type RuleScope, type RuleSyncFrontier, type RuleApprovalRecord, type StaleRuleApprovalRecord, type RuleApprovalRecordStore, type RuleOwner } from "@sema-agent/core";
+import { type PermissionRuleWriter, type DurableRulePartition, type DurableRulePartitionProvider, type RuleScope, type RuleSyncFrontier, type RuleCandidate, type RuleApprovalRecord, type StaleRuleApprovalRecord, type RuleApprovalRecordStore, type RuleOwner } from "@sema-agent/core";
 import type { Pool as MySqlPool } from "mysql2/promise";
 import type { PgQueryFn } from "./pg-query.js";
 import { type SqlDriver } from "./sql-driver.js";
@@ -274,11 +274,14 @@ export declare const SQL_DB_NOW_MS: {
     readonly tidb: "CAST(UNIX_TIMESTAMP(NOW(3)) * 1000 AS SIGNED)";
     readonly pg: "(EXTRACT(EPOCH FROM clock_timestamp()) * 1000)::bigint";
 };
-/** prepare 时刻候选集的规范摘要(载荷绑定 F1 ④ 的判据)。纯数据 ⇒ `build*`。 */
-export declare function buildRulePayloadHash(candidates: ReadonlyArray<{
-    rule: string;
-    scope: RuleScope;
-}>): string;
+/** prepare 时刻候选集的规范摘要(载荷绑定 F1 ④ 的判据)。纯数据 ⇒ `build*`。
+ *
+ *  🔴 入参型收到 core 的 `RuleCandidate`(core 7.9.0 [ref] 起含 `behavior`)—— 规则的身份是
+ *  **(behavior, 文本, 作用域) 三元组**,而这道摘要正是「prepare 那一刻的候选集」与「redeem 那一刻的
+ *  候选集」之间的等式。此前的形参写成 `{rule, scope}` 二元组:序列化器吃的是整只对象所以运行期**恰好**
+ *  覆盖了 behavior,但那是巧合不是保证 —— 哪天有人从一个只有二元组的地方喂进来,一次把候选从 `deny`
+ *  改写成 `allow`(文本一个字节不动)在这道等式下就认不出来了。收到域型让机器替人守这一条。 */
+export declare function buildRulePayloadHash(candidates: ReadonlyArray<RuleCandidate>): string;
 /**
  * 票面三态协议的 SQL 实现。
  *
@@ -315,10 +318,7 @@ export declare class SqlRuleImportTicketStore {
         principal: string;
         approvalId: string;
         purpose: RuleTicketPurpose;
-        candidates: ReadonlyArray<{
-            rule: string;
-            scope: RuleScope;
-        }>;
+        candidates: ReadonlyArray<RuleCandidate>;
         ttlMs: number;
     }): Promise<RuleImportTicket>;
     /**

package/dist/plugins/permission-rule-store-sql.js

@@ -1,10 +1,10 @@
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { z } from "zod";
-import { applyTombstones, assertDeleteDeltaCarriesNoAdd, assertRedemptionNotQuarantined, assertWriteDeltaScopeDurable, foldDelta, parseAllowRuleText, screenRuleSyncState, PERMISSION_RULE_WRITER, RULE_SYNC_DROP_CODES, EMPTY_DURABLE_RULE_PARTITION, } from "@sema-agent/core";
+import { applyTombstones, assertDeleteDeltaCarriesNoAdd, assertRedemptionNotQuarantined, assertWriteDeltaScopeDurable, foldDelta, parseRuleText, readRowBehavior, screenRuleSyncState, PERMISSION_RULE_WRITER, RULE_BEHAVIORS, RULE_SYNC_DROP_CODES, EMPTY_DURABLE_RULE_PARTITION, } from "@sema-agent/core";
 import { dialectProtocolJsonEncoder } from "./sql-driver.js";
 import { isMissingColumnError } from "./sql-errors.js";
 import { canonicalJson } from "../canonical-json.js";
-import { EDITED_RULE_BREADTH_WARNING_CODES, PERSISTED_RULE_MATCHES, PERSISTED_RULE_TOOLS, RULE_APPROVAL_RECORD_SCHEMA, UNCOVERED_SEGMENT_REASONS } from "../permission-rule-vocab.js";
+import { EDITED_RULE_BREADTH_WARNING_CODES, PERSISTED_RULE_MATCHES, isPersistedRuleTool, RULE_APPROVAL_RECORD_SCHEMA, UNCOVERED_SEGMENT_REASONS } from "../permission-rule-vocab.js";
 export function writerOfSqlRuleStore(store) {
     const w = Reflect.get(store, PERMISSION_RULE_WRITER);
     if (w === null || typeof w !== "object")
@@ -24,10 +24,11 @@ const RuleDotSchema = z.object({ actor: z.string().min(1), counter: z.number().i
 const RuleAddSchema = z
     .object({ dot: RuleDotSchema, origin: z.enum(["user", "imported-cc", "starter"]), createdAt: z.string() })
     .strict();
-const PersistedAllowRuleSchema = z
+const PersistedRuleRowSchema = z
     .object({
+    behavior: z.string().optional(),
     rule: z.string(),
-    tool: z.enum(PERSISTED_RULE_TOOLS),
+    tool: z.string().min(1).refine(isPersistedRuleTool, { message: "not a tool the persisted-rule grammar speaks for" }),
     match: z.enum(PERSISTED_RULE_MATCHES),
     command: z.string(),
     scope: DurableRuleScopeSchema,
@@ -35,14 +36,15 @@ const PersistedAllowRuleSchema = z
 })
     .strict();
 const RuleTombstoneSchema = z
-    .object({ rule: z.string(), scope: DurableRuleScopeSchema, removedDots: z.array(RuleDotSchema).min(1), deletedBy: RuleDotSchema })
+    .object({ behavior: z.string().optional(), rule: z.string(), scope: DurableRuleScopeSchema, removedDots: z.array(RuleDotSchema).min(1), deletedBy: RuleDotSchema })
     .strict();
 const QUARANTINE_REASONS = new Set(Object.entries(RULE_SYNC_DROP_CODES)
     .filter(([, side]) => side.includes("local-quarantined"))
     .map(([code]) => code));
 const isQuarantineReason = (v) => typeof v === "string" && QUARANTINE_REASONS.has(v);
-const QuarantinedRuleAddSchema = z
+const QuarantinedRuleAddRowSchema = z
     .object({
+    behavior: z.string().optional(),
     rule: z.string(),
     scope: DurableRuleScopeSchema,
     add: RuleAddSchema,
@@ -50,8 +52,18 @@ const QuarantinedRuleAddSchema = z
     atMs: z.number().int().nonnegative().safe(),
 })
     .strict();
+function readBucketRowBehavior(raw, what, ownerKey) {
+    const behavior = readRowBehavior(raw);
+    if (behavior === undefined) {
+        throw new Error(`permission_rule bucket ${ownerKey} carries a ${what} whose behavior word is outside the closed set (${JSON.stringify(raw)}) — ` +
+            `refusing the whole bucket rather than reading a standing deny as "no rule"`);
+    }
+    return behavior;
+}
+const WritablePersistedRuleSchema = PersistedRuleRowSchema.extend({ behavior: z.enum(RULE_BEHAVIORS) });
+const WritableRuleTombstoneSchema = RuleTombstoneSchema.extend({ behavior: z.enum(RULE_BEHAVIORS) });
 const FrontierSchema = z.record(z.string(), z.number().int().nonnegative().safe());
-const RuleCandidateSchema = z.object({ rule: z.string(), scope: DurableRuleScopeSchema }).strict();
+const RuleCandidateSchema = z.object({ behavior: z.enum(RULE_BEHAVIORS), rule: z.string(), scope: DurableRuleScopeSchema }).strict();
 const RedeemedDotsSchema = z.record(z.string(), RuleDotSchema);
 const RuleEditedSchema = z
     .object({ index: z.number().int().nonnegative().safe(), text: z.string(), at: z.string(), warnings: z.array(z.enum(EDITED_RULE_BREADTH_WARNING_CODES)).optional() })
@@ -108,9 +120,9 @@ export const TIDB_PERMISSION_RULE_STATEMENTS = [
     state VARCHAR(32) NOT NULL,
     rev BIGINT NOT NULL DEFAULT 0,
     candidates_json LONGTEXT NOT NULL,
-    -- version:**数据格式版本**(= core \`RuleApprovalRecord.schema\`,本形恒 3 —— design/382 §3.5 由 2 升,
+    -- version:**数据格式版本**(= core \`RuleApprovalRecord.schema\`,本形恒 4 —— core 7.9.0 #625 由 3 升,
     -- 代码里的单点是 RULE_APPROVAL_RECORD_SCHEMA;OCC 守卫另在 rev,两轴禁混,schema-naming 门③ 白名单
-    -- 登记)。读侧对非 3 的行(含上一形的 2)交还 design/375 §4.5 的
+    -- 登记)。读侧对非 4 的行(含上一形的 3)交还 design/375 §4.5 的
     -- StaleRuleApprovalRecord 信封(identity 键 only)—— 本仓 SCHEMA POLICY 是删表重建,重建后的表
     -- 不该有这种行,这一臂是「未来再换形」的防御位,绝不静默 widen 成一条本形担保不了的记录。
     version INT NOT NULL,
@@ -263,7 +275,7 @@ export async function ensurePgPermissionRuleSchema(q) {
     rev BIGINT NOT NULL DEFAULT 0,
     candidates_json TEXT COLLATE "C" NOT NULL,
     -- version / offers_json / selected_offer:design/375 换形三列(MySQL 孪生的行内注写了理由:
-    -- version=数据格式版本恒 3(design/382 §3.5 由 2 升;单点 RULE_APPROVAL_RECORD_SCHEMA),非 3 的行(含 2)
+    -- version=数据格式版本恒 4(core 7.9.0 #625 由 3 升;单点 RULE_APPROVAL_RECORD_SCHEMA),非 4 的行(含 3)
     -- 读成 Stale 信封;offers_json=按 index 引用的 OPTION 结构,
     -- 禁存文本副本;selected_offer=确认的 OFFER index,与 ticket/redeemed_dots 的 CANDIDATE index
     -- 两空间分离)。
@@ -356,10 +368,18 @@ class SqlDurableRulePartition {
         const row = rows[0];
         if (row === undefined)
             return { ...EMPTY_BUCKET, rules: [], tombstones: [], quarantined: [] };
-        const rules = parseColumn(z.array(PersistedAllowRuleSchema), row.rules_json, "rules_json", this.ownerKey);
-        const tombstones = parseColumn(z.array(RuleTombstoneSchema), row.tombstones_json, "tombstones_json", this.ownerKey);
-        const quarantined = parseColumn(z.array(QuarantinedRuleAddSchema), row.quarantined_json, "quarantined_json", this.ownerKey);
+        const rulesRaw = parseColumn(z.array(PersistedRuleRowSchema), row.rules_json, "rules_json", this.ownerKey);
+        const tombstonesRaw = parseColumn(z.array(RuleTombstoneSchema), row.tombstones_json, "tombstones_json", this.ownerKey);
+        const quarantinedRaw = parseColumn(z.array(QuarantinedRuleAddRowSchema), row.quarantined_json, "quarantined_json", this.ownerKey);
         const observedVector = row.observed_vector_json === null || row.observed_vector_json === undefined ? undefined : parseColumn(FrontierSchema, row.observed_vector_json, "observed_vector_json", this.ownerKey);
+        const expected = buildRuleBucketChecksum({ rules: rulesRaw, tombstones: tombstonesRaw, quarantined: quarantinedRaw, ...(observedVector !== undefined ? { observedVector } : {}) });
+        if (String(row.checksum ?? "") !== expected) {
+            throw new Error(`permission_rule bucket ${this.ownerKey} failed its integrity check (stored ${String(row.checksum)}, computed ${expected}) — ` +
+                `refusing the whole bucket rather than reporting a partial rule set`);
+        }
+        const rules = rulesRaw.map((r) => ({ ...r, behavior: readBucketRowBehavior(r.behavior, "rule row", this.ownerKey) }));
+        const tombstones = tombstonesRaw.map((t) => ({ ...t, behavior: readBucketRowBehavior(t.behavior, "tombstone", this.ownerKey) }));
+        const quarantined = quarantinedRaw.map((q) => ({ ...q, behavior: readBucketRowBehavior(q.behavior, "quarantined row", this.ownerKey) }));
         const state = {
             actor: String(row.actor ?? ""),
             counter: Number(row.counter ?? 0),
@@ -369,13 +389,8 @@ class SqlDurableRulePartition {
             quarantined,
             ...(observedVector !== undefined ? { observedVector } : {}),
         };
-        const expected = buildRuleBucketChecksum({ rules, tombstones, quarantined, ...(observedVector !== undefined ? { observedVector } : {}) });
-        if (String(row.checksum ?? "") !== expected) {
-            throw new Error(`permission_rule bucket ${this.ownerKey} failed its integrity check (stored ${String(row.checksum)}, computed ${expected}) — ` +
-                `refusing the whole bucket rather than reporting a partial rule set`);
-        }
         const badTombstone = tombstones.find((t) => {
-            const parsed = parseAllowRuleText(t.rule);
+            const parsed = parseRuleText(t.rule, t.behavior);
             return "reject" in parsed || parsed.rule.rule !== t.rule;
         });
         if (badTombstone !== undefined) {
@@ -467,7 +482,7 @@ class SqlDurableRulePartition {
                 assertDeleteDeltaCarriesNoAdd(delta);
                 nextTombstones = [...cur.tombstones, delta.tombstone];
             }
-            const writable = z.object({ rules: z.array(PersistedAllowRuleSchema), tombstones: z.array(RuleTombstoneSchema) }).safeParse({ rules: nextRules, tombstones: nextTombstones });
+            const writable = z.object({ rules: z.array(WritablePersistedRuleSchema), tombstones: z.array(WritableRuleTombstoneSchema) }).safeParse({ rules: nextRules, tombstones: nextTombstones });
             if (!writable.success) {
                 throw new Error(`refusing to write a permission_rule bucket this backend could not read back: ${writable.error.message}`);
             }

package/dist/posture-source.d.ts

@@ -0,0 +1,57 @@
+/**
+ * S-167 → S-178 —— **一个部署级旋钮的值是谁定的**,四词闭集 + 一句运维指路。
+ *
+ * ## 为什么是一个共享件而不是每键一份
+ *
+ * S-167 给 `READ_FACE` 造了这套东西(值 + 来源 + 指路句),理由写在 `read-face-posture.ts` 的顶注里:
+ * 「缺席」这一态里塞着两件不同的事(单机 turnkey 没表态 vs 多租户就是要引擎默认),而把它们分开之后,
+ * **env 恒赢的判据**与**运维面「为什么这台机器是这个值」**才有真答案。S-178 把同一条律推到另外三个键
+ * (`STREAM_ASK_WINDOW_MS` / `DURABLE_APPROVAL` / `SESSION_AUTO_TITLE`)时,唯一诚实的做法是**抽这一份**
+ * ——四词表抄第二遍的那天,两份表会在加词时分家,而「这个值是谁定的」在运维面上是个是非题,不能有两个答案。
+ *
+ * ## 优先序(与 `config.ts` 的 `postureOn` 同形)
+ * `env 显式` > `center 发布` > `posture 派生` > `引擎/服务端默认`。
+ *
+ * ## 定界
+ * 本模块只说**来源**。值本身、以及「这台机器凭什么派生出这个值」那句话,由每个键自己给
+ * ({@link PostureKnobFacts.postureMeaning})——那句话是键专属的事实,共享它只会得到一句谁都不认的空话。
+ */
+/** 旋钮取值来源的闭集词表(顺序 = 优先序)。 */
+export declare const POSTURE_SOURCE_WORDS: readonly ["env", "center", "posture", "engine-default"];
+/** 一个旋钮的取值来源(闭集四词)。加词 ⇒ {@link postureSourceNote} 的穷举 switch 编译红。 */
+export type PostureSource = (typeof POSTURE_SOURCE_WORDS)[number];
+/** 一个旋钮报出「我是谁定的」所需要的三件事。 */
+export interface PostureKnobFacts {
+    /** 这台机器上占住这个键的 env 变量名(指路句要逐字点它,运维才知道去改哪个)。 */
+    readonly knob: string;
+    readonly source: PostureSource;
+    /**
+     * `posture` 那一臂**专属**的一句话:这台机器为什么派生出了这个值,以及怎么把它钉回去。
+     * 只在 `source === "posture"` 时被读到 —— 别的臂的句子是通用的(见 {@link postureSourceNote})。
+     */
+    readonly postureMeaning: string;
+}
+/** 运维指路句 —— **穷举 switch,无缺省臂**:四词闭集加一个成员这里就编译红。 */
+export declare function postureSourceNote(facts: PostureKnobFacts): string;
+/**
+ * 这个值是**运维显式表态**的吗?
+ *
+ * 🔴 S-178 施工时真踩(本批全量抓出):`hasOperatorGateIntent`(`src/approval.ts`)判「运维表达过门意图
+ * 没有」时读的是 `durableApproval` 这个**值** —— 那在本键进 posture 家族之前是对的(它只有显式设过才为
+ * 真),之后当场失真:单机 turnkey 上 posture 派生的 `true` 会被读成「运维要门」,于是 run-local 那条
+ * **结构上没有 durable 门**的腿在每次 boot 打一条补偿 warn,而它其实正处在「零门意图的既定姿势」里。
+ * 这与 S-167 头注①记的是**同一形**病(用一个会被 posture 铸出来的量当「有人表态过」的代理)。
+ *
+ * ⇒ 判据落到**来源**上,穷举 switch(四词闭集加员即编译红):`env`(这台机器的运维写下的)与 `center`
+ * (组织发布的)是表态;`posture`(姿态派生)与 `engine-default`(内建缺省)都**不是**「有人要求过」。
+ */
+export declare function isExplicitPosture(source: PostureSource): boolean;
+/** operator 诊断面的一行读数:值 + 来源 + 指路句。三个 S-178 旋钮与 S-167 的 readFace 同形。 */
+export interface PostureKnobReading<V> {
+    value: V;
+    source: PostureSource;
+    note: string;
+}
+/** 一行读数的铸点(纯数据 ⇒ `build*`)。 */
+export declare function buildPostureKnobReading<V>(value: V, facts: PostureKnobFacts): PostureKnobReading<V>;
+//# sourceMappingURL=posture-source.d.ts.map

package/dist/posture-source.js

@@ -0,0 +1,27 @@
+export const POSTURE_SOURCE_WORDS = ["env", "center", "posture", "engine-default"];
+export function postureSourceNote(facts) {
+    switch (facts.source) {
+        case "env":
+            return `pinned by this machine's ${facts.knob} env var (deployment sovereignty — it wins over any published value for this key)`;
+        case "center":
+            return `applied from the config-center (restart-to-apply); set ${facts.knob} on this machine to take the key back`;
+        case "posture":
+            return facts.postureMeaning;
+        case "engine-default":
+            return `not pinned by this deployment — the built-in default for ${facts.knob} is in force`;
+    }
+}
+export function isExplicitPosture(source) {
+    switch (source) {
+        case "env":
+        case "center":
+            return true;
+        case "posture":
+        case "engine-default":
+            return false;
+    }
+}
+export function buildPostureKnobReading(value, facts) {
+    return { value, source: facts.source, note: postureSourceNote(facts) };
+}
+//# sourceMappingURL=posture-source.js.map

package/dist/read-face-posture.d.ts

@@ -27,10 +27,14 @@
  * 两者在 core 里是并列机制(deny 表在 open 面上照样拦)。core 的 `config.read_face_deployment_clamped`
  * (只读挂载钳制)同样不受本件影响。
  */
-/** 档位来源的闭集词表(顺序 = 优先序:env > center > posture > 引擎默认)。 */
+import { type PostureSource } from "./posture-source.js";
+/**
+ * 档位来源的闭集词表 —— **S-178 起转 `posture-source.ts` 的共享件**(本模块只是给这一档取个本地名字,
+ * 不再持第二份词表:同一张四词表抄两遍的那天,两份会在加词时分家)。
+ */
 export declare const READ_FACE_SOURCE_WORDS: readonly ["env", "center", "posture", "engine-default"];
-/** 档位的来源(闭集四词)。加词 ⇒ {@link readFaceSourceNote} 的穷举 switch 编译红。 */
-export type ReadFaceSource = (typeof READ_FACE_SOURCE_WORDS)[number];
+/** 档位的来源(闭集四词)。加词 ⇒ {@link postureSourceNote} 的穷举 switch 编译红。 */
+export type ReadFaceSource = PostureSource;
 /** 一台 worker 的 READ 面档位事实(值 + 来源)。`ServiceConfigFlat` 结构上满足本形。 */
 export interface ReadFacePostureFacts {
     readonly readFace?: "open" | "roots" | undefined;
@@ -41,7 +45,8 @@ export interface ReadFacePostureFacts {
  * 单用户 turnkey ⇒ `open`;多租户 ⇒ 不铸(引擎默认 `roots`,server 不复制上游默认)。
  */
 export declare function readFaceForPosture(singleUserTurnkey: boolean): ReadFacePostureFacts;
-/** 运维指路句 —— **穷举 switch,无缺省臂**:四词闭集加一个成员这里就编译红。 */
+/** 本档的运维指路句 —— 骨架由共享件 {@link postureSourceNote} 给(四词穷举在那里,加词即编译红);
+ *  本函数只提供 `posture` 那一臂的**键专属**事实句。 */
 export declare function readFaceSourceNote(source: ReadFaceSource): string;
 /** operator 诊断面的投影(`GET /v1/diagnostics/wiring`)。`face:null` = 本部署没钉档,引擎默认接管。 */
 export declare function buildReadFaceWiring(facts: ReadFacePostureFacts): {

package/dist/read-face-posture.js

@@ -1,18 +1,14 @@
-export const READ_FACE_SOURCE_WORDS = ["env", "center", "posture", "engine-default"];
+import { POSTURE_SOURCE_WORDS, postureSourceNote } from "./posture-source.js";
+export const READ_FACE_SOURCE_WORDS = POSTURE_SOURCE_WORDS;
 export function readFaceForPosture(singleUserTurnkey) {
     return singleUserTurnkey ? { readFace: "open", readFaceSource: "posture" } : { readFaceSource: "engine-default" };
 }
 export function readFaceSourceNote(source) {
-    switch (source) {
-        case "env":
-            return "pinned by this machine's READ_FACE env var (deployment sovereignty — it wins over any published readFace domain)";
-        case "center":
-            return "applied from the config-center readFace domain (restart-to-apply); set READ_FACE on this machine to take the key back";
-        case "posture":
-            return "derived from the single-user turnkey posture (REQUIRE_PRINCIPAL is not set): reads outside the workspace roots are allowed by default — set READ_FACE=roots to pin the containing posture back";
-        case "engine-default":
-            return "not pinned by this deployment — the engine's own default (roots) is in force";
-    }
+    return postureSourceNote({
+        knob: "READ_FACE",
+        source,
+        postureMeaning: "derived from the single-user turnkey posture (REQUIRE_PRINCIPAL is not set): reads outside the workspace roots are allowed by default — set READ_FACE=roots to pin the containing posture back",
+    });
 }
 export function buildReadFaceWiring(facts) {
     return { face: facts.readFace ?? null, source: facts.readFaceSource, note: readFaceSourceNote(facts.readFaceSource) };