@sema-agent/server 7.68.0 → 7.70.0

package/dist/parked-decide.js

@@ -1,5 +1,45 @@
 import { defaultSubagentTailBus } from "./fleet/subagent-tail-bus.js";
 import { backgroundScopesForCheckpointScope, decodeCheckpointScope } from "./security.js";
+export async function findParkOrigin(sources, cp) {
+    if (sources.agentStore !== undefined) {
+        let match;
+        try {
+            match = await findParkedAgentForCheckpoint(sources.agentStore, cp);
+        }
+        catch (e) {
+            quiet(sources.warn, "parked_decide_probe_failed", { error: e instanceof Error ? e.message : String(e) });
+        }
+        if (match !== undefined)
+            return { kind: "background", handle: match.handle, row: match.row };
+    }
+    const index = sources.workflowIndex;
+    const runStore = sources.workflowRunStore;
+    if (index === undefined || runStore === undefined)
+        return undefined;
+    try {
+        const row = await index.findByAgentSession(cp.sessionId);
+        if (row === null)
+            return undefined;
+        const run = await runStore.get(row.runId);
+        if (run === null)
+            return undefined;
+        const agent = (run.agents ?? []).find((a) => a.sessionId === cp.sessionId && a.status === "parked");
+        if (agent === undefined || agent.parkedCheckpointToken !== cp.token)
+            return undefined;
+        return { kind: "workflow", runId: row.runId, run, agent };
+    }
+    catch (e) {
+        quiet(sources.warn, "workflow_park_probe_failed", { error: e instanceof Error ? e.message : String(e) });
+        return undefined;
+    }
+}
+function quiet(warn, event, fields) {
+    try {
+        warn?.(event, fields);
+    }
+    catch {
+    }
+}
 export async function findParkedAgentForCheckpoint(agentStore, cp) {
     for (const scope of backgroundScopesForCheckpointScope(cp.scope)) {
         const parked = await agentStore.listByScope(scope, { status: "parked" });
@@ -25,21 +65,61 @@ function mintReviveArgs(row, knownAgentTypes) {
         ...(row.agentType !== undefined && knownAgentTypes.has(row.agentType) ? { subagent_type: row.agentType } : {}),
     };
 }
-export async function decideParkedAgent(deps, req) {
-    let match;
-    try {
-        match = await findParkedAgentForCheckpoint(deps.agentStore, { token: req.token, scope: req.scope, sessionId: req.sessionId });
+export function buildParkedResumeOutcome(req) {
+    const pa = req.pendingAction;
+    const persistedCallId = pa?.kind === "tool_approval" ? (pa.toolCallId ?? "") : "";
+    const persistedHash = pa?.kind === "tool_approval" ? (pa.boundInputHash ?? "") : "";
+    return {
+        gate: "policy_ask",
+        boundCallId: req.binding?.boundCallId ?? persistedCallId,
+        boundInputHash: req.binding?.boundInputHash ?? persistedHash,
+        decision: req.decision === "approve" ? "allow" : "deny",
+        ...(req.decision === "approve" && req.binding?.updatedInput !== undefined ? { updatedInput: req.binding.updatedInput } : {}),
+        ...(req.answer !== undefined ? { answer: req.answer } : {}),
+        ...(req.reason !== undefined ? { reason: req.reason } : {}),
+        hostDecision: req.hostDecision,
+    };
+}
+export function planWorkflowParkedDecide(origin, req) {
+    if (req.grantRemember !== undefined) {
+        return {
+            ok: false,
+            deny: {
+                status: 400,
+                body: {
+                    error: "remember:\"session\" is not supported for a parked WORKFLOW agent: this lane's 200 means the decision was handed to the host's next turn, not that the engine committed it — an exemption granted here could outlive a decision the engine later rejects. Re-issue the decide without `remember`.",
+                    errorCode: "decide.workflow_remember_unsupported",
+                    runId: origin.runId,
+                },
+            },
+        };
     }
-    catch (e) {
-        try {
-            deps.warn?.("parked_decide_probe_failed", { error: e instanceof Error ? e.message : String(e) });
-        }
-        catch {
-        }
-        return undefined;
+    const hostSessionId = origin.run.originatingSessionId;
+    if (hostSessionId === undefined || hostSessionId === "") {
+        return {
+            ok: false,
+            deny: {
+                status: 409,
+                body: {
+                    error: "this parked workflow agent's run carries no originating session — the deployment has nowhere to deliver the decision (a directly-started workflow, not a Workflow tool call)",
+                    errorCode: "decide.workflow_host_unknown",
+                    runId: origin.runId,
+                },
+            },
+        };
     }
-    if (match === undefined)
-        return undefined;
+    const verdict = req.decision === "approve" ? "APPROVED" : "DENIED";
+    return {
+        ok: true,
+        hostSessionId,
+        runId: origin.runId,
+        outcome: buildParkedResumeOutcome(req),
+        message: `The human approval that workflow run "${origin.runId}" parked on (agent callKey "${origin.agent.callKey}") has been ${verdict}. ` +
+            `Resume that run now by calling Workflow with resumeFromRunId: "${origin.runId}" — the decision is already held by the deployment ` +
+            `and will be applied to the parked agent; completed steps replay from the journal. Do not re-issue the original call.`,
+    };
+}
+export async function decideParkedAgent(deps, req, match) {
     const row = match.row;
     const rememberRoot = req.grantRemember !== undefined ? (row.rootSessionId ?? row.parentSessionId) : undefined;
     if (req.grantRemember !== undefined && rememberRoot === undefined) {
@@ -81,19 +161,7 @@ export async function decideParkedAgent(deps, req) {
         catch {
         }
     }
-    const pa = req.pendingAction;
-    const persistedCallId = pa?.kind === "tool_approval" ? (pa.toolCallId ?? "") : "";
-    const persistedHash = pa?.kind === "tool_approval" ? (pa.boundInputHash ?? "") : "";
-    const outcome = {
-        gate: "policy_ask",
-        boundCallId: req.binding?.boundCallId ?? persistedCallId,
-        boundInputHash: req.binding?.boundInputHash ?? persistedHash,
-        decision: req.decision === "approve" ? "allow" : "deny",
-        ...(req.decision === "approve" && req.binding?.updatedInput !== undefined ? { updatedInput: req.binding.updatedInput } : {}),
-        ...(req.answer !== undefined ? { answer: req.answer } : {}),
-        ...(req.reason !== undefined ? { reason: req.reason } : {}),
-        hostDecision: req.hostDecision,
-    };
+    const outcome = buildParkedResumeOutcome(req);
     const ctx = {
         toolCallId: `drv-${ticket.claimId}`,
         reviveClaim: {

package/dist/plugins/pg-pool.js

@@ -266,6 +266,14 @@ export const PG_SCHEMA_STATEMENTS = [
    )`,
     `CREATE INDEX IF NOT EXISTS idx_wfrun_scope_created ON workflow_run (scope, created_at_ms)`,
     `CREATE INDEX IF NOT EXISTS idx_wfrun_scope_status ON workflow_run (scope, status)`,
+    `CREATE TABLE IF NOT EXISTS workflow_agent_session (
+     session_id VARCHAR(190) COLLATE "C" NOT NULL,
+     run_id     VARCHAR(191) COLLATE "C" NOT NULL,
+     agent_key  VARCHAR(191) COLLATE "C" NOT NULL,
+     scope      VARCHAR(190) COLLATE "C" NOT NULL,
+     PRIMARY KEY (session_id)
+   )`,
+    `CREATE INDEX IF NOT EXISTS idx_wfagentsess_run ON workflow_agent_session (run_id)`,
     `CREATE TABLE IF NOT EXISTS workflow_completion_inbox (
      seq            BIGSERIAL,
      session_id     VARCHAR(190) COLLATE "C" NOT NULL,

package/dist/plugins/store-backend.d.ts

@@ -71,7 +71,8 @@ export type ServiceFileHistoryStore = FileHistoryStore & {
 /** SVC-2 (core CORE-7) WorkflowJournalStore — core's interface PLUS the service `deleteByRun` (GC extra). tidb/pg =
  *  durable SQL twins (cross-replica resume journal); local = the service {@link FileWorkflowJournalStore}
  *  (single-box but RESTART-durable crash-safe JSONL, replacing core's InMemory). The shared equivalence suite keeps
- *  all three byte-matched (scope guard / idempotent-per-ordinal / oversize skip-journal). */
+ *  all three byte-matched (scope guard / idempotent-per-ordinal / oversize **refusal** —— S-194 / core 7.12.0
+ *  [ref] 起两臂一律抛 `workflow.journal_oversize`,判长口径归 core `assertJournalEntryFits` 单一属主). */
 export type ServiceWorkflowJournalStore = WorkflowJournalStore & {
     /** codex R1-H2(journal 读面界):分页+单行字节门的投影读——SQL 端 LIMIT/OFFSET 定行数、LENGTH 门
      *  定单行(超 maxResultBytes 的行 resultJson=null 只回 resultBytes,读面标 truncated)。HTTP 读面
@@ -238,6 +239,11 @@ export interface StoreBackend {
     /** 1.108 review fix (lens③ HIGH): the notify-JOURNAL twin — third leg of the same axis (a SQL run store +
      *  inbox with a replica-LOCAL File journal stranded a dead replica's un-acked notify forever). */
     notifyJournal?(): import("../orchestration/workflow-notify-journal.js").WorkflowNotifyJournalStore;
+    /** S-185 车CM:workflow 出身 park 的**有界 join** 索引(子会话 id → 它所属的 workflow run)。
+     *  与 `workflowRun`/`completionInbox`/`notifyJournal` 同一条轴 —— SQL 后端 = 跨副本双生;`local` 车道
+     *  缺席**是一个真答案**:那里的索引家在 run 店同一间屋子里(`LocalWorkflowAgentSessionIndex`,文件账本
+     *  或纯内存),不需要经过 backend。契约与单写者纪律的属主 = orchestration/workflow-agent-session-index.ts。 */
+    workflowAgentSessionIndex?(): import("../orchestration/workflow-agent-session-index.js").WorkflowAgentSessionIndex;
     /** Cloud-only stores below are OPTIONAL: the `local` (in-memory/file) backend omits them (it has no core
      *  in-memory twin carrying the service extras, and these are fleet/multi-replica concepts), so a local HTTP
      *  service degrades EXACTLY like today's no-DB env (the consumers gate on `backend?.X?.()`). TiDB/PG provide all. */

package/dist/plugins/store-backend.js

@@ -4,7 +4,7 @@ import { AdoptionError, FileStorageBackend, FileSessionRepo } from "@sema-agent/
 import { FileWorkflowJournalStore } from "@sema-agent/core";
 import { TiDBOutcomeLedger, PgOutcomeLedger } from "./outcome-ledger-sql.js";
 import { FileOutcomeSink } from "./file-outcome-sink.js";
-import { TiDBWorkflowRunStore, TiDBWorkflowCompletionInbox, TiDBWorkflowNotifyJournalStore, PgWorkflowRunStore, PgWorkflowCompletionInbox, PgWorkflowNotifyJournalStore } from "./workflow-run-store-sql.js";
+import { TiDBWorkflowRunStore, TiDBWorkflowCompletionInbox, TiDBWorkflowNotifyJournalStore, TiDBWorkflowAgentSessionIndex, PgWorkflowRunStore, PgWorkflowCompletionInbox, PgWorkflowNotifyJournalStore, PgWorkflowAgentSessionIndex } from "./workflow-run-store-sql.js";
 import { FileRunStore, RunStoreStrictHydrateError } from "./file-run-store.js";
 import { LocalSessionStore } from "./local-session-store.js";
 import { LocalCheckpointStore } from "./local-checkpoint-store.js";
@@ -145,6 +145,7 @@ class TiDBBackend {
     workflowRun(onWarn) { return new TiDBWorkflowRunStore(this.pool, onWarn); }
     completionInbox(onWarn) { return new TiDBWorkflowCompletionInbox(this.pool, onWarn); }
     notifyJournal() { return new TiDBWorkflowNotifyJournalStore(this.pool); }
+    workflowAgentSessionIndex() { return new TiDBWorkflowAgentSessionIndex(this.pool); }
     sharedMemoryStore(authorizer) { return new TiDBSharedMemoryStore(this.pool, authorizer); }
     checkpoint(logger) { return new TiDBCheckpointStore(this.pool, logger); }
     toolResult() { return new TiDBToolResultStore(this.pool); }
@@ -191,6 +192,7 @@ class PgBackend {
     workflowRun(onWarn) { return new PgWorkflowRunStore(this.pool, onWarn); }
     completionInbox(onWarn) { return new PgWorkflowCompletionInbox(this.pool, onWarn); }
     notifyJournal() { return new PgWorkflowNotifyJournalStore(this.pool); }
+    workflowAgentSessionIndex() { return new PgWorkflowAgentSessionIndex(this.pool); }
     sharedMemoryStore(authorizer) { return new PgSharedMemoryStore(this.pool, authorizer); }
     checkpoint(logger) { return new PgCheckpointStore(this.pool, logger); }
     toolResult() { return new PgToolResultStore(this.pool); }

package/dist/plugins/tidb-pool.js

@@ -446,6 +446,14 @@ export const SCHEMA_STATEMENTS = [
      PRIMARY KEY (id),
      KEY idx_wfrun_scope_created (scope, created_at_ms),
      KEY idx_wfrun_scope_status (scope, status)
+   ) COLLATE utf8mb4_bin`,
+    `CREATE TABLE IF NOT EXISTS workflow_agent_session (
+     session_id VARCHAR(190) NOT NULL,
+     run_id     VARCHAR(191) NOT NULL,
+     agent_key  VARCHAR(191) NOT NULL,
+     scope      VARCHAR(190) NOT NULL,
+     PRIMARY KEY (session_id),
+     KEY idx_wfagentsess_run (run_id)
    ) COLLATE utf8mb4_bin`,
     `CREATE TABLE IF NOT EXISTS workflow_completion_inbox (
      seq            BIGINT       NOT NULL AUTO_INCREMENT,

package/dist/plugins/workflow-journal-store-sql.d.ts

@@ -57,7 +57,7 @@ export declare class SqlWorkflowJournalStore implements WorkflowJournalStore {
     /** Record one agent's result. Idempotent per (run_id, ordinal): the PK upsert OVERWRITES (last-write-wins), so a
      *  resumed run re-appending its replayed prefix verbatim leaves no duplicate. callKeyOrdinal is the SOLE ordinal
      *  source (core's parser — a malformed key collapses to 0, matching InMemory). Throws on a REAL failure
-     *  (LOAD-BEARING), EXCEPT an oversize result is skip-journaled (see below) rather than throwing the workflow dead. */
+     *  (LOAD-BEARING) — an oversize entry included, on BOTH arms (S-194 / core 7.12.0 [ref]; see below). */
     append(runId: string, scope: string, entry: WorkflowJournalEntry): Promise<void>;
     /** Entries for `runId` IF its recorded scope === `scope`, ASCENDING by ordinal; otherwise EMPTY. CORE-9 audit
      *  BLOCKER: scope in the WHERE (twin of WorkflowRunStore) — the LLM controls `resumeFromRunId`, so a cross-scope

package/dist/plugins/workflow-journal-store-sql.js

@@ -1,5 +1,6 @@
 import { callKeyOrdinal } from "@sema-agent/core";
-import { oversizeJournalResult } from "@sema-agent/core";
+import { assertJournalEntryFits } from "@sema-agent/core";
+import { journalEntryOfRow, journalRowPayloadOf } from "../orchestration/workflow-journal-entry.js";
 import { mysqlDriver, pgDriver } from "./sql-driver.js";
 const DEFAULT_RESUME_CLAIM_TTL_MS = 60 * 60 * 1000;
 export class SqlWorkflowJournalStore {
@@ -13,16 +14,15 @@ export class SqlWorkflowJournalStore {
         return this.db.dialect === "tidb" ? tidb : pg;
     }
     async append(runId, scope, entry) {
-        const serialized = JSON.stringify(entry.result);
-        if (oversizeJournalResult(serialized))
-            return;
+        assertJournalEntryFits(entry);
+        const serialized = journalRowPayloadOf(entry);
         await this.db.query(this.q("INSERT INTO workflow_journal (run_id, ordinal, scope, call_key, result, created_at_ms) VALUES (?,?,?,?,?,?) " +
             "ON DUPLICATE KEY UPDATE call_key = VALUES(call_key), result = VALUES(result)", "INSERT INTO workflow_journal (run_id, ordinal, scope, call_key, result, created_at_ms) VALUES ($1,$2,$3,$4,$5,$6) " +
             "ON CONFLICT (run_id, ordinal) DO UPDATE SET call_key = EXCLUDED.call_key, result = EXCLUDED.result"), [runId, callKeyOrdinal(entry.callKey), scope, entry.callKey, serialized, Date.now()]);
     }
     async load(runId, scope) {
         const { rows } = await this.db.query(this.q("SELECT call_key, result FROM workflow_journal WHERE run_id = ? AND scope = ? ORDER BY ordinal ASC", "SELECT call_key, result FROM workflow_journal WHERE run_id = $1 AND scope = $2 ORDER BY ordinal ASC"), [runId, scope]);
-        return rows.map((r) => ({ callKey: String(r.call_key), result: JSON.parse(String(r.result)) }));
+        return rows.map((r) => journalEntryOfRow(String(r.call_key), String(r.result)));
     }
     locator(runId, _scope) {
         return `/v1/workflows/${runId}/journal`;

package/dist/plugins/workflow-run-store-sql.d.ts

@@ -59,6 +59,7 @@ import type { Pool as PgPool } from "pg";
 import { summarizeWorkflowRun, type WorkflowRunStore } from "@sema-agent/core";
 import { type WorkflowCompletionInbox, type WorkflowCompletionInboxEntry } from "../orchestration/workflow-completion-inbox.js";
 import type { WorkflowNotifyJournalStore, WorkflowNotifyJournalEntry } from "../orchestration/workflow-notify-journal.js";
+import type { WorkflowAgentSessionIndex, WorkflowAgentSessionRow } from "../orchestration/workflow-agent-session-index.js";
 import { type SqlDriver } from "./sql-driver.js";
 type WorkflowRun = Parameters<WorkflowRunStore["put"]>[1];
 /** Row cap guard: a run blob beyond this is NOT stored on update (the prior revision stays) — TiDB's
@@ -153,6 +154,29 @@ export declare class SqlWorkflowNotifyJournalStore implements WorkflowNotifyJour
     reapAcked(before: number): Promise<number>;
     get(runId: string): Promise<WorkflowNotifyJournalEntry | null>;
 }
+/**
+ * S-185 车CM —— **workflow 出身 park 的有界 join 索引** SQL 双生(契约与纪律的唯一属主 =
+ * {@link import("../orchestration/workflow-agent-session-index.js").WorkflowAgentSessionIndex} 的文件头,
+ * 这里只记方言差)。行是 `WorkflowRun` 的派生投影,写者只有一个(Journaling 装饰器的写观察点)。
+ *
+ * ── 方言差,保持显式 ──────────────────────────────────────────────────────────────────────────
+ *   - `?` 占位 vs `$n`,且 `syncRun` 的删除腿在 PG 上要按 `params.length` 记位(与 `listByScope` 同因)。
+ *   - 「删掉这条 run 里已不在 rows 里的旧行」:TiDB `session_id NOT IN (?,?,…)`(动态占位数)vs
+ *     PG `session_id <> ALL($n::text[])`(数组绑定)—— 两边同一件事,语句结构不同(reap 的批删同先例)。
+ *   - upsert:TiDB `REPLACE INTO`(整行替换)vs PG `INSERT … ON CONFLICT (session_id) DO UPDATE`。
+ *   - schema 属主同店内其余表:TiDB DDL 在 tidb-pool.ts,PG DDL 在 pg-pool.ts(店不建表)。
+ *
+ * 🔴 **写序**:先 upsert 再删。反过来(先删后 upsert)会在两条语句之间留出一个**索引行不存在**的窗口,
+ * 而这期间进来的 `/decide` 会诚实 miss ⇒ 一次本可受理的批准被退回。先 upsert 的最坏形是窗口内多一条
+ * 旧行(读口按 session_id 精确查,取 run 后还要逐字比对赎回键 ⇒ 多余的行只会 miss,不会错配)。
+ */
+export declare class SqlWorkflowAgentSessionIndex implements WorkflowAgentSessionIndex {
+    private readonly db;
+    constructor(db: SqlDriver);
+    private q;
+    syncRun(runId: string, rows: readonly WorkflowAgentSessionRow[]): Promise<void>;
+    findByAgentSession(sessionId: string): Promise<WorkflowAgentSessionRow | null>;
+}
 /** MySQL-protocol (TiDB) bindings — historical class names preserved; `onWarn` is an ADDITIVE optional 2nd
  *  ctor arg (existing 1-arg call sites are unaffected — see {@link SqlWorkflowRunStore}'s C5 trace channel). */
 export declare class TiDBWorkflowRunStore extends SqlWorkflowRunStore {
@@ -175,5 +199,11 @@ export declare class PgWorkflowCompletionInbox extends SqlWorkflowCompletionInbo
 export declare class PgWorkflowNotifyJournalStore extends SqlWorkflowNotifyJournalStore {
     constructor(pool: PgPool);
 }
+export declare class TiDBWorkflowAgentSessionIndex extends SqlWorkflowAgentSessionIndex {
+    constructor(pool: MySqlPool);
+}
+export declare class PgWorkflowAgentSessionIndex extends SqlWorkflowAgentSessionIndex {
+    constructor(pool: PgPool);
+}
 export {};
 //# sourceMappingURL=workflow-run-store-sql.d.ts.map

package/dist/plugins/workflow-run-store-sql.js

@@ -277,6 +277,36 @@ export class SqlWorkflowNotifyJournalStore {
         };
     }
 }
+export class SqlWorkflowAgentSessionIndex {
+    db;
+    constructor(db) {
+        this.db = db;
+    }
+    q(tidb, pg) {
+        return this.db.dialect === "tidb" ? tidb : pg;
+    }
+    async syncRun(runId, rows) {
+        for (const r of rows) {
+            await this.db.query(this.q("REPLACE INTO workflow_agent_session (session_id, run_id, agent_key, scope) VALUES (?,?,?,?)", `INSERT INTO workflow_agent_session (session_id, run_id, agent_key, scope) VALUES ($1,$2,$3,$4)
+             ON CONFLICT (session_id) DO UPDATE SET run_id = EXCLUDED.run_id, agent_key = EXCLUDED.agent_key, scope = EXCLUDED.scope`), [r.sessionId, r.runId, r.agentKey, r.scope]);
+        }
+        const keep = rows.map((r) => r.sessionId);
+        if (this.db.dialect === "tidb") {
+            const holes = keep.map(() => "?").join(",");
+            await this.db.query(`DELETE FROM workflow_agent_session WHERE run_id = ?${keep.length > 0 ? ` AND session_id NOT IN (${holes})` : ""}`, [runId, ...keep]);
+        }
+        else {
+            await this.db.query(`DELETE FROM workflow_agent_session WHERE run_id = $1${keep.length > 0 ? " AND session_id <> ALL($2::text[])" : ""}`, keep.length > 0 ? [runId, keep] : [runId]);
+        }
+    }
+    async findByAgentSession(sessionId) {
+        const { rows } = await this.db.query(this.q("SELECT session_id, run_id, agent_key, scope FROM workflow_agent_session WHERE session_id = ?", "SELECT session_id, run_id, agent_key, scope FROM workflow_agent_session WHERE session_id = $1"), [sessionId]);
+        const r = rows[0];
+        if (!r)
+            return null;
+        return { sessionId: String(r.session_id), runId: String(r.run_id), agentKey: String(r.agent_key), scope: String(r.scope) };
+    }
+}
 export class TiDBWorkflowRunStore extends SqlWorkflowRunStore {
     constructor(pool, onWarn) {
         super(mysqlDriver(pool), onWarn);
@@ -307,4 +337,14 @@ export class PgWorkflowNotifyJournalStore extends SqlWorkflowNotifyJournalStore
         super(pgDriver(pool));
     }
 }
+export class TiDBWorkflowAgentSessionIndex extends SqlWorkflowAgentSessionIndex {
+    constructor(pool) {
+        super(mysqlDriver(pool));
+    }
+}
+export class PgWorkflowAgentSessionIndex extends SqlWorkflowAgentSessionIndex {
+    constructor(pool) {
+        super(pgDriver(pool));
+    }
+}
 //# sourceMappingURL=workflow-run-store-sql.js.map

package/dist/posture-source.d.ts

@@ -13,8 +13,16 @@
  * `env 显式` > `center 发布` > `posture 派生` > `引擎/服务端默认`。
  *
  * ## 定界
- * 本模块只说**来源**。值本身、以及「这台机器凭什么派生出这个值」那句话,由每个键自己给
- * ({@link PostureKnobFacts.postureMeaning})——那句话是键专属的事实,共享它只会得到一句谁都不认的空话。
+ * 本模块只说**来源**。值本身、以及**两条键专属臂**的句子——「这台机器凭什么派生出这个值」
+ * ({@link PostureKnobFacts.postureMeaning})与「组织发布的值在这台机器上怎么生效」
+ * ({@link PostureKnobFacts.centerMeaning})——由每个键自己给。那两句话是键专属的事实,共享它们只会
+ * 得到一句谁都不认的空话,或者更坏:一句**对某些键是假的**话。
+ *
+ * 🔴 `centerMeaning` 是 G-7(test [ref])的修复面,成因是一次真的过期断言:这一臂原本硬编码
+ * 「applied from the config-center (**restart-to-apply**)」,而 S-174(core 7.10.0 [ref])之后
+ * `readFace.face` 是**热换席**(`Runner.swapDeps({readFace})`,下一拍 refresh 当场换进全部 Runner,
+ * `read-face` 重启片也不再为它签理由)——运维照那句话去滚动重启一片 fleet,重启的是一个已经生效的变更。
+ * 生效时机是**键**的事实,不是四词表的属性,所以它跟 `postureMeaning` 一样归键。
  */
 /** 旋钮取值来源的闭集词表(顺序 = 优先序)。 */
 export declare const POSTURE_SOURCE_WORDS: readonly ["env", "center", "posture", "engine-default"];
@@ -25,13 +33,25 @@ export interface PostureKnobFacts {
     /** 这台机器上占住这个键的 env 变量名(指路句要逐字点它,运维才知道去改哪个)。 */
     readonly knob: string;
     readonly source: PostureSource;
+    /**
+     * `center` 那一臂**专属**的一句话:组织发布的这个值在这台机器上**怎么生效**(热换席?等重启?
+     * 还是这个键根本没有 center 腿?),以及怎么把这个键取回来。只在 `source === "center"` 时被读到。
+     *
+     * 🔴 为什么归键而不是共享(G-7 的成因):生效时机是键的事实。同一句「restart-to-apply」对
+     * `readFace.face` 是假的(S-174 热换席),对三个 S-178 旋钮则连触发条件都没有(`config.ts` 的
+     * `postureSourceOfKnob` / `postureSourceOfNumEnv` 只产 env/posture/engine-default,center 写不到
+     * 它们)—— 一句共享的硬编码必然对其中一类说谎。
+     */
+    readonly centerMeaning: string;
     /**
      * `posture` 那一臂**专属**的一句话:这台机器为什么派生出了这个值,以及怎么把它钉回去。
      * 只在 `source === "posture"` 时被读到 —— 别的臂的句子是通用的(见 {@link postureSourceNote})。
      */
     readonly postureMeaning: string;
 }
-/** 运维指路句 —— **穷举 switch,无缺省臂**:四词闭集加一个成员这里就编译红。 */
+/** 运维指路句 —— **穷举 switch,无缺省臂**:四词闭集加一个成员这里就编译红。
+ *  两条**通用**臂(`env` / `engine-default`)的句子在这里写死并点名旋钮;两条**键专属**臂
+ *  (`center` / `posture`)原样取键给的那句话(理由见 {@link PostureKnobFacts} 的两个字段注)。 */
 export declare function postureSourceNote(facts: PostureKnobFacts): string;
 /**
  * 这个值是**运维显式表态**的吗?

package/dist/posture-source.js

@@ -4,7 +4,7 @@ export function postureSourceNote(facts) {
         case "env":
             return `pinned by this machine's ${facts.knob} env var (deployment sovereignty — it wins over any published value for this key)`;
         case "center":
-            return `applied from the config-center (restart-to-apply); set ${facts.knob} on this machine to take the key back`;
+            return facts.centerMeaning;
         case "posture":
             return facts.postureMeaning;
         case "engine-default":

package/dist/read-face-posture.d.ts

@@ -46,7 +46,14 @@ export interface ReadFacePostureFacts {
  */
 export declare function readFaceForPosture(singleUserTurnkey: boolean): ReadFacePostureFacts;
 /** 本档的运维指路句 —— 骨架由共享件 {@link postureSourceNote} 给(四词穷举在那里,加词即编译红);
- *  本函数只提供 `posture` 那一臂的**键专属**事实句。 */
+ *  本函数提供两条**键专属**臂(`center` / `posture`)的事实句。
+ *
+ *  🔴 `center` 那句话的事实来源是 S-174(core 7.10.0 [ref]):`RunnerDeps.readFace` 进了 core 的可换席
+ *  闭集 `SWAPPABLE_DEP_SEATS` ⇒ 组织发布/撤回一个档位,**下一拍 refresh 当场换进全部 Runner**,
+ *  `config-center/restart-signal.ts` 的 `read-face` 片也不再为它签重启理由(判据同源 =
+ *  `CENTER_READ_FACE_LIVE_KEYS`,由 core 的 `isSwappableDepSeat` 派生)。本句此前逐字写着
+ *  「(restart-to-apply)」—— G-7 抓获的那条过期断言,方向恰好是「让运维为一个已生效的变更重启 fleet」。
+ *  ⚠️ 只说 `face` 这一席:三个 deny 键仍是 boot-baked,那半场的话不在这条读面上(它们没有来源位)。 */
 export declare function readFaceSourceNote(source: ReadFaceSource): string;
 /** operator 诊断面的投影(`GET /v1/diagnostics/wiring`)。`face:null` = 本部署没钉档,引擎默认接管。 */
 export declare function buildReadFaceWiring(facts: ReadFacePostureFacts): {

package/dist/read-face-posture.js

@@ -7,6 +7,7 @@ export function readFaceSourceNote(source) {
     return postureSourceNote({
         knob: "READ_FACE",
         source,
+        centerMeaning: "published by the config-center and applied HOT — the containment FACE is a swappable engine seat (core 7.10.0), so the next refresh (or POST /v1/admin/config/refresh) swaps it into every Runner with NO restart; set READ_FACE on this machine to take the key back",
         postureMeaning: "derived from the single-user turnkey posture (REQUIRE_PRINCIPAL is not set): reads outside the workspace roots are allowed by default — set READ_FACE=roots to pin the containing posture back",
     });
 }

package/dist/router/route-orchestration.js

@@ -1,4 +1,5 @@
 import {} from "@sema-agent/core";
+import { operatorAsk } from "../operator-ask.js";
 export function routeOrchestration(s) {
     if (s.explicitMode)
         return { mode: s.explicitMode, reason: `explicit:${s.explicitMode}` };
@@ -40,7 +41,7 @@ export function isIsolatedExecEnv(provider, runtimeClass) {
 }
 const WRITE_HAND_TOOLS = new Set(["Edit", "Write", "NotebookEdit"]);
 export function supPostureOverrides() {
-    const ask = (toolName) => ({ action: "ask", message: `${toolName} gated by supervisor routing (capability-danger task)`, decisionReason: "rule" });
+    const ask = (toolName) => operatorAsk(`supervisor routing(capability-danger:${toolName})`, `${toolName} gated by supervisor routing (capability-danger task)`);
     const writeGate = {
         check: (req) => (WRITE_HAND_TOOLS.has(req.toolName) ? ask(req.toolName) : { action: "allow" }),
     };

package/dist/run-cancel-context.d.ts

@@ -1,4 +1,4 @@
-import type { RunCancelContext } from "./plugins/store-contracts.js";
+import type { PersistedTaskResult, RunCancelContext } from "./plugins/store-contracts.js";
 /**
  * @param taskId  这条 run 的账本 id(turn 活性登记的键)。
  * @param startedAtMs 这条 run 起跑的墙钟时刻(epoch ms):取消腿手上有行就用行的 `createdAt`,
@@ -10,4 +10,53 @@ import type { RunCancelContext } from "./plugins/store-contracts.js";
  *          断言「我看过现场,什么都没有」,而事实是「我什么都没看见」)。
  */
 export declare function buildCancelContext(taskId: string, startedAtMs: number, nowMs?: number): RunCancelContext | undefined;
+/**
+ * 🔴 **用户取消的机器码 —— 全仓单源**(合并重扫 [5])。
+ *
+ * run 行的 `errorCode` 列、因由臂上的 `terminal.code`、`tasks_total{status}` 的 metrics 标签、fleet 行的
+ * 终态词,是**同一个词**;同一个词就该同一个来源。此前仓里是「一个词两只常量 + 十余处字面量」
+ * (`approval-reconciler.ts` 另有一份 `CANCELLED_ERROR_CODE`),改它的值会让 recordDone / fleet 标签 /
+ * reconciler 的 VOID 判据 / cancel 端点的幂等判据静默分叉。
+ *
+ * 机器门(新写者当场红):`test/cancel-terminal-single-owner.test.ts` 的 G2/G3。
+ */
+export declare const CANCELLED_CODE = "cancelled";
+/**
+ * S-104 —— **取消终局的唯一铸点**。三条用户取消腿(sync stream 的断连支与 cancel-verb 支、durable bg 腿)
+ * 都从这里出结果,于是「一次取消在账本/wire 上长什么样」只有一份口径。
+ *
+ * ## 两种到达形,一条规则
+ * `engineResult` 在场与否 = 「引擎有没有给出终局」,不是两条规则:
+ *  · **在场**(现行常态):**跑起来之后**的 `signal.aborted` 被 core 当成流内事件优雅收尾 —— 流照常
+ *    发 `done`,`terminal` 是一条**不带码**的 `failed`。这里在**它**之上补标,不另造一份结果(另造会把
+ *    引擎已经算出的 `stats` / `result` / `editedFiles` 全丢掉)。
+ *  · **缺席**:根本没读到 done —— 客户端断连后迭代器早收,或**开跑之前**就已经立起的旗
+ *    (亲核 core 7.11.2 `dist/core/runner/runtask.js:623-626`:`runLocked` 入口对已 aborted 的 signal
+ *    抛 `AbortError`)⇒ 合成一条诚实的取消终局。
+ *
+ * ## 「只补空座」纪律(与 core 的 `amendTerminal` 同规),而且**补码与补快照同进同退**
+ *  · 引擎给的终局**不是无码的 failed**(它完成了 / 阻塞了 / 自己带了码)⇒ **整只原样返回**。
+ *    这一条是本车自查轮逮住的自造缺陷:首版只让**补码**受这条纪律管、快照却无条件挂,于是「取消动词
+ *    到了、但活其实已经干完了」会产出一条 `completed` 却带着取消便签的终局 —— 契约 §5.3 逐字写着
+ *    「只在用户取消形上铸」,两个方向的读者都会读错。一次与 abort 赛跑的真失败(`brain.network`)同理:
+ *    贴成 `cancelled` 会把故障统计洗白。
+ *  · `cancelContext`:已经有快照就不重铸(重铸会把「上一条引擎事件多久以前」重新计时)。
+ *
+ * ## 为什么不判「这条 failed 是不是 abort 形」
+ * 判据在**调用点**:调用点问的是「本腿这次是不是被取消动词打中了」(`cancelCtrl.signal.aborted` /
+ * `cancelledViaVerb`),那是 server 自己的事实。让本函数去嗅 `terminal.message` 的字面就是再造事实
+ * —— [ref] 二那次事故的同一个形。
+ */
+export declare function mintCancelledResult(args: {
+    /** 这条 run 的账本 id(活性登记的键;账本不在场时给空串,快照按「证不出」处理)。 */
+    taskId: string;
+    /** 会话 id(合成形要写进结果;引擎给了结果时不用)。 */
+    sessionId: string;
+    /** 本腿起跑的墙钟时刻(epoch ms)。语义与缺席纪律见 {@link buildCancelContext}。 */
+    startedAtMs: number;
+    /** 合成形的失败文案(引擎给了终局时不用)。 */
+    message: string;
+    /** 引擎给出的终局(在场 ⇒ 在它之上补标)。 */
+    engineResult?: PersistedTaskResult;
+}): PersistedTaskResult;
 //# sourceMappingURL=run-cancel-context.d.ts.map

package/dist/run-cancel-context.js

@@ -12,4 +12,26 @@ export function buildCancelContext(taskId, startedAtMs, nowMs = Date.now()) {
         ...(elapsedMs !== undefined ? { elapsedMs } : {}),
     };
 }
+export const CANCELLED_CODE = "cancelled";
+export function mintCancelledResult(args) {
+    const ctx = args.taskId === "" ? undefined : buildCancelContext(args.taskId, args.startedAtMs);
+    const engine = args.engineResult;
+    if (engine !== undefined) {
+        if (engine.terminal.kind !== "failed" || engine.terminal.code !== undefined)
+            return engine;
+        return {
+            ...engine,
+            terminal: { ...engine.terminal, code: CANCELLED_CODE },
+            ...(engine.cancelContext === undefined && ctx !== undefined ? { cancelContext: ctx } : {}),
+        };
+    }
+    return {
+        taskId: args.taskId,
+        sessionId: args.sessionId,
+        terminal: { kind: "failed", code: CANCELLED_CODE, message: args.message },
+        result: "",
+        stats: { turns: 0, tokens: 0 },
+        ...(ctx ? { cancelContext: ctx } : {}),
+    };
+}
 //# sourceMappingURL=run-cancel-context.js.map

package/dist/run-local.d.ts

@@ -96,17 +96,25 @@ export interface LocalApproverIo {
 /**
  * [ref] 件三:**onAsk 座**(§0 潜雷 / §5 锁 6)。
  *
- * 🔴 为什么这个座位是接治理链的**同窗必做项**:run-local 有 checkpointStore(file backend),所以
- * `AUTONOMY=ask` ⇒ `shellGate:"always"` ⇒ Bash 进 `irreversibleTools` ⇒ park lane effective ⇒ **每一次
- * shell 调用都 durable park 成一张永远没人 resume 的 checkpoint**,任务挂起、CLI 退 1。一次性 CLI 里
- * 没有任何赎回腿,那不是「等人来批」,是卡死。core 的 `isLiveApproverSeat(onAsk)` 为真时 `suspendAsk`
- * 早退(prepare-task dist 亲读),ask 于是落回本回调 —— 把 park 换成「问人 / 当场拒」的唯一正当接法。
+ * 🔴 为什么这个座位是接治理链的**同窗必做项**(成因,留档):彼时 run-local 的主 runner 带着
+ * checkpointStore(file backend),于是 `AUTONOMY=ask` ⇒ `shellGate:"always"` ⇒ Bash 进
+ * `irreversibleTools` ⇒ park lane effective ⇒ **每一次 shell 调用都 durable park 成一张永远没人 resume
+ * 的 checkpoint**,任务挂起、CLI 退 1。一次性 CLI 里没有任何赎回腿,那不是「等人来批」,是卡死。
+ * core 的 `isLiveApproverSeat(onAsk)` 为真时 `suspendAsk` 早退(prepare-task dist 亲读),ask 于是落回
+ * 本回调 —— 把 park 换成「问人 / 当场拒」的正当接法。
+ *
+ * 🔴 **本席不是那颗雷的唯一防线,也从来不该是**(B-060 批 codex 交叉复审 [medium] 的教训):它只挡
+ * **审批**那条车道;core 的**平台/资源停驻**(`suspendForPlatformLimit`)由「店在不在」一位武装,
+ * 压根不经过 onAsk。所以自 B-060 起本腿的结构性防线是**整条腿不接 checkpointStore**(装配点在
+ * `createSharedRunnerDeps` 调用处,理由全文在那里),本席退回它本来的职责:**给 TTY 前的人一次真的
+ * 问答**。两道并存不是冗余 —— 一道管「谁来答」,一道管「答不了时会不会留下无人兑付的行」。
  *
  * ⛔ **不在 toolPolicy 层做 ask→deny 映射**:core 自己就有 headless auto-deny 的语义与文案,在策略层
  * 复刻一份 = 同源谎(两处判据日后各改各的)。裁决归 core,座位归这里。
  *
  * 🔴 非 TTY 臂答 `false`(真 deny),**绝不答 `"unavailable"`**:后者被 core 读成「席位够不到」并**改道
- * `suspendAsk`**(dist `core/hooks.js:296` 的 `approverUnavailable` 重投),上面那颗雷会原样回来。
+ * `suspendAsk`**(dist `core/hooks.js:296` 的 `approverUnavailable` 重投)。今天本腿无店 ⇒ 那条改道无处
+ * 可去(fail-closed 拒),但这一条仍是本席的契约:答案是「不批」,不是「找不到人」。
  */
 export declare function createLocalApprover(io: LocalApproverIo): OnAsk;
 /** 默认的 TTY 问人器:一问一答,回答写 **stderr**(stdout 是任务结果的专用管道,别污染它)。

package/dist/run-local.js

@@ -190,7 +190,7 @@ export async function runLocal(argv, deps = {}) {
                 config.mcpServers = resolveMcpServers(effective.mcp, logger);
             if (effective?.a2a)
                 config.a2aPeers = resolveA2aPeers(effective.a2a, logger);
-            applyCenterReadFace(config, r.effective, logger);
+            applyCenterReadFace(config, r.effective, logger, { phase: "boot" });
             logger.info("config_loaded", { source: configProvider.kind, version: r.effective.version });
         }
     }
@@ -387,6 +387,7 @@ export async function runLocal(argv, deps = {}) {
             ...(config.hooksTimeoutMs !== undefined ? { timeoutMs: config.hooksTimeoutMs } : {}),
         },
         toolResultStore: fileBackend.toolResultStore,
+        checkpointStore: undefined,
         sessionPolicyStore: fileBackend.sessionPolicyStore,
         usageWindowStore: config.usageWindows ? fileBackend.usageWindowStore : undefined,
         orgMemoryAdmission,
@@ -397,7 +398,6 @@ export async function runLocal(argv, deps = {}) {
         ...sharedRunnerDeps,
         sessionStore,
         ...(memoryEngine ? { memoryBackend: memoryEngine.backend, memoryEngineDir: memoryEngine.root } : {}),
-        checkpointStore: fileBackend.checkpointStore,
         onError: engineOnError,
         onAsk,
         ...(config.projectMemoryEnabled