@sema-agent/server 7.71.0 → 7.72.0

package/dist/observability/tool-trace.d.ts

@@ -15,7 +15,8 @@ import type { Metrics } from "./metrics.js";
  * (`policy/hook/safety/shellGate/planMode/classifier/org`)换成八词
  * (`policy/hook/org/classifier/plan_mode/compliance/write_protection/ask_resolution`)。仪表盘/告警规则要改。
  *
- * 🔴 **第二个计数器 `auto_mode_classifier_unavailable_total{cause}`(server 7.70.0,core 7.12.0 [ref])**
+ * 🔴 **第二个计数器 `auto_mode_classifier_deny_cause_total{cause}`(server 7.70.0 生为
+ * `auto_mode_classifier_unavailable_total`,core 7.12.0 [ref];**7.72.0 / core 7.14.0 [ref] 改名、换座、换词**,见本段末)**
  * —— 分类器**停摆**的常开信号。7.12.0 之前这件事有两条可观测路:熔断跳闸时的
  * `auto_mode_breaker_open_total`,以及「`unavailable` 的 ask 会走到人面前」(审批 inbox 里看得见)。
  * 该版把熔断族整族退役、又把 `unavailable` 改成**当场 deny** ⇒ 两条路同时没了,而
@@ -26,6 +27,22 @@ import type { Metrics } from "./metrics.js";
  * 两个计数刻意**不合并成一个标签**:它们答两个问题(「谁拒的」vs「这次拒是不是因为分类器停摆、哪一类」),
  * 而运维对停摆要立刻动手(改配置 / 等重试 / 看后端),对安全拦截不要。
  * ⛔ 纯计量:不改任何裁决、不新开观察面、事实缺席时**不铸**(缺席 ≠ 「分类器好着呢」,只是这次拒不是它)。
+ *
+ * 🔴 **7.72.0(core 7.14.0 [ref] C-a)—— 同一只计数器换了名、换了座、也换了词表,运维面 BREAKING**:
+ *  · **名**(合并复审 R2):`auto_mode_classifier_unavailable_total` ⇒ `auto_mode_classifier_deny_cause_total`,
+ *    **无别名** —— 一只也数 `parse_error`(分类器跑了、答得出格)的计数器再叫 unavailable 就是名不副实;
+ *    与下面两条是同一次运维 BREAKING,只痛一次。
+ *  · **座**:`payload.classifierUnavailable.cause`(整族退役)⇒ `payload.gate.disposition.cause`。同一条
+ *    门记录的三张脸(`tool_end.gate` / 本观察者的 `payload.gate` / 行的 `resolvedOutcome`)core 一次铸、
+ *    三处投,所以这一位与 `deniedBy` 现在**读自同一只对象**——两个标签不可能再各说各话。
+ *  · **词表**:`AUTO_MODE_UNAVAILABLE_CAUSES`(`error` / `timeout` = 分类器**为什么**没跑成)
+ *    ⇒ `CLASSIFIER_DENY_CAUSES`(`unavailable` / `parse_error` = **这次 deny 是什么形**)。
+ *    ⚠️ 两代不是同一个问题的两组词:`unavailable` 覆盖了旧的 error+timeout 两格(「为什么」降级成散文,
+ *    只在 deny 句与 `auto_mode.classified` 诊断帧上),而 `parse_error`(分类器跑了、但答得出格 ⇒ 为安全
+ *    起见拦下)是**旧计数器根本数不到**的一格。看板/告警的 `cause=` 过滤要改,按旧词 by-cause 分组的
+ *    历史序列与新序列**不可直接拼**。
+ *  · **计数总量方向**:新座只在「分类器那一轮没有裁决」时在场(`<block>yes` 的真裁决恒缺席),与旧座的
+ *    「分类器停摆」同向;多出来的那一格是 `parse_error`,它也确实是「分类器没正常工作」的一种。
  */
 export declare function createPermissionDeniedMeter(metrics: Pick<Metrics, "inc">): Hooks;
 /**

package/dist/observability/tool-trace.js

@@ -1,4 +1,4 @@
-import { isAutoModeUnavailableCause, isDeniedBy } from "@sema-agent/core";
+import { isClassifierDenyCause, isDeniedBy } from "@sema-agent/core";
 import { redactSecrets } from "../trace/redact.js";
 function deniedByLabel(gate) {
     const d = gate.disposition;
@@ -8,9 +8,10 @@ export function createPermissionDeniedMeter(metrics) {
     return {
         permissionDenied(payload) {
             metrics.inc("permission_denied_total", { deniedBy: deniedByLabel(payload.gate) });
-            const cause = payload.classifierUnavailable?.cause;
+            const disposition = payload.gate?.disposition;
+            const cause = disposition?.kind === "denied" ? disposition.cause : undefined;
             if (cause !== undefined) {
-                metrics.inc("auto_mode_classifier_unavailable_total", { cause: isAutoModeUnavailableCause(cause) ? cause : "other" });
+                metrics.inc("auto_mode_classifier_deny_cause_total", { cause: isClassifierDenyCause(cause) ? cause : "other" });
             }
         },
     };

package/dist/parked-decide.js

@@ -132,8 +132,9 @@ export function planWorkflowParkedDecide(origin, req) {
         runId: origin.runId,
         outcome: buildParkedResumeOutcome(req),
         message: `The human approval that workflow run "${origin.runId}" parked on (agent callKey "${origin.agent.callKey}") has been ${verdict}. ` +
-            `Resume that run now by calling Workflow with resumeFromRunId: "${origin.runId}" — the decision is already held by the deployment ` +
-            `and will be applied to the parked agent; completed steps replay from the journal. Do not re-issue the original call.`,
+            `Resume that run now: re-invoke Workflow with the SAME script source you launched it from (script / name / scriptPath) ` +
+            `AND resumeFromRunId: "${origin.runId}" — the decision is already held by the deployment and will be applied to the parked ` +
+            `agent; completed steps replay from the journal. Do not re-issue the original call.`,
     };
 }
 export async function decideParkedAgent(deps, req, match) {

package/dist/plugins/e2b-orphan-reclaim.d.ts

@@ -10,10 +10,10 @@
  * memory `capability-probe-fail-direction`;误杀的代价是杀死一个活任务的手,漏杀的代价只是钱):
  *   a. `metadata.semaManaged !== "1"`         → 非我方铸造,provider 侧 query 过滤已排除;防御性重验。
  *   b. `metadata.taskId` 缺席                 → 病态形(factory 恒打标),不杀 + failOpen 留痕。
- *   c. run 行在场:
- *        LIVE 词(running/suspended/needs_review)→ 活,跳过;
- *        TERMINAL 词                           → 孤儿,kill;
- *        两表皆不中的词                        → 词表纪律([ref]):不杀 + failOpen(新词先安全后收编)。
+ *   c. run 行在场(词 → 类问 `RUN_STATUS_CLASS` 属主,S-221):
+ *        类 live / parked(行还能再动)        → 活,跳过;
+ *        类 succeeded / unsuccessful(终局)   → 孤儿,kill;
+ *        属主表外的词(类 undefined)          → 词表纪律([ref]):不杀 + failOpen(新词先安全后收编)。
  *   d. 行不存在:
  *        startedAt 距今 < GRACE                → create→行落库窗口,跳过(防误杀新沙盒);
  *        ≥ GRACE                              → 真孤儿,kill(单库 fleet 方向下行跨副本可见)。

package/dist/plugins/e2b-orphan-reclaim.js

@@ -1,10 +1,13 @@
 import { recordFailOpen } from "../observability/fail-open.js";
+import { runStatusClassOf } from "./store-contracts.js";
 export const E2B_ORPHAN_GRACE_MS = 10 * 60 * 1000;
 export const SEMA_MANAGED_METADATA_KEY = "semaManaged";
-const LIVE_STATUSES = new Set(["running", "suspended", "needs_review"]);
-const TERMINAL_STATUSES = new Set(["completed", "blocked", "failed"]);
-const _statusesCovered = true;
-void _statusesCovered;
+const CLASS_VERDICT = {
+    live: "live",
+    parked: "live",
+    succeeded: "kill",
+    unsuccessful: "kill",
+};
 export async function reclaimOrphanE2bSandboxes(deps) {
     const now = deps.now ?? Date.now;
     const graceMs = deps.graceMs ?? E2B_ORPHAN_GRACE_MS;
@@ -29,28 +32,15 @@ export async function reclaimOrphanE2bSandboxes(deps) {
             if (run === undefined) {
                 verdict = now() - sbx.startedAt.getTime() < graceMs ? "grace" : "kill";
             }
-            else if (LIVE_STATUSES.has(run.status)) {
-                verdict = "live";
-            }
-            else if (TERMINAL_STATUSES.has(run.status)) {
-                verdict = "kill";
-            }
             else {
-                verdict = "unknown";
+                const cls = runStatusClassOf(run.status);
+                verdict = cls === undefined ? "unknown" : CLASS_VERDICT[cls];
             }
         }
         catch {
             verdict = "unknown";
         }
-        if (verdict === "live")
-            summary.skippedLive++;
-        else if (verdict === "grace")
-            summary.skippedGrace++;
-        else if (verdict === "unknown") {
-            summary.skippedUnknown++;
-            recordFailOpen("server.e2b.orphan-skip-unknown");
-        }
-        else {
+        if (verdict === "kill") {
             try {
                 await deps.provider.kill(sbx.sandboxId);
                 summary.reclaimed++;
@@ -61,6 +51,14 @@ export async function reclaimOrphanE2bSandboxes(deps) {
                 deps.logger?.warn("e2b_orphan_kill_failed", { sandboxId: sbx.sandboxId, taskId, error: e instanceof Error ? e.message : String(e) });
             }
         }
+        else if (verdict === "live")
+            summary.skippedLive++;
+        else if (verdict === "grace")
+            summary.skippedGrace++;
+        else {
+            summary.skippedUnknown++;
+            recordFailOpen("server.e2b.orphan-skip-unknown");
+        }
     }
     if (summary.reclaimed > 0 || summary.killFailed > 0) {
         deps.logger?.info("e2b_orphan_reclaim_round", { ...summary });

package/dist/plugins/store-contracts.d.ts

@@ -147,6 +147,33 @@ export declare const RUN_STATUS_CLASS: {
 export type UnsuccessfulRunStatus = {
     [K in RunRecord["status"]]: (typeof RUN_STATUS_CLASS)[K] extends "unsuccessful" ? K : never;
 }[RunRecord["status"]];
+/**
+ * 一个状态词的类;**表里没有的词 ⇒ `undefined`**。
+ *
+ * 🔴 形参是 `string` 而不是 `RunRecord["status"]`(S-221):本函数的**全部工作**就是「这个词在不在表里」,
+ * 把入参收成闭集等于在签名上宣称「传进来的一定是表内词」,而下一行的 `undefined` 臂正是为了不是的那些 ——
+ * 签名与实现自相矛盾时,消费点只能靠 `as RunRecord["status"]` 硬转把窄读口(`{ status: string }`,
+ * 三形 store 共同面)喂进来,而那正是本文件头注点名的 `rowToRun` 裸 cast 的同一条病。闭集词照样能传
+ * (联合 ⊂ string),编译期的执法点在上面那张表的双向钉,不在这里。
+ *
+ * 导出面(S-221):`plugins/e2b-orphan-reclaim.ts` 的三臂判决(还能再动 / 终局 / 读不懂)需要的正是
+ * 「类 + unknown」这一对,而不是三条 boolean 谓词各问一遍 —— 它此前因此自带了第二份词表。
+ *
+ * 🔴 查的是 **null 原型**的那只表,不是 `RUN_STATUS_CLASS` 本身(codex 对抗复审 r1 [high],亲验后修):
+ * 普通对象字面量的查表**穿原型链** —— `status` 落在 `constructor` / `toString` / `__proto__` /
+ * `hasOwnProperty` / `valueOf` 上时查到的是 `Object.prototype` 的成员而不是 `undefined`,于是
+ * 「读不懂的词」这一臂被整条绕过。亲验读数(修前):`runStatusClassOf("constructor")` 返回
+ * `function Object`。这类值是**真可达**的(`rowToRun` 把无约束的 SQL 文本列裸 cast 成本联合),而消费点
+ * 据此做的是不可逆动作。修在此处一次,而不是在每个消费点各写一句 `Object.hasOwn` —— 后者要靠每个消费点
+ * 各记得一次,属主只有一个。
+ *
+ * 🔴 运行期未知词是**真可达**的([ref] codex R1 真缺陷,红先复现过):`plugins/run-store-sql.ts` 的
+ * `rowToRun` 把无约束的 SQL 文本列**裸 cast** 成本联合,滚动升级里一个更新的副本写入的新状态词会被
+ * 旧副本读到。三张派生判据对 `undefined` 一律答 `false`(保守方向,逐条理由见各自头注)——不是静默
+ * 兜底,而是「本进程读不懂这个词,少动一次远好过错杀」的显式表态;真正的执法点是上面那张表的编译期
+ * 双向钉,新词进词表的**那一刻**就红。
+ */
+export declare function runStatusClassOf(status: string): RunStatusClass | undefined;
 /**
  * 「这一行已经走到**终局**了吗」——终局 = 成功 or 非成功(completed / failed / blocked);
  * 非终局 = running / suspended / needs_review(后两者都还能再动)。

package/dist/plugins/store-contracts.js

@@ -7,8 +7,9 @@ export const RUN_STATUS_CLASS = {
     suspended: "parked",
     needs_review: "parked",
 };
-function runStatusClassOf(status) {
-    return RUN_STATUS_CLASS[status];
+const RUN_STATUS_CLASS_LOOKUP = Object.assign(Object.create(null), RUN_STATUS_CLASS);
+export function runStatusClassOf(status) {
+    return RUN_STATUS_CLASS_LOOKUP[status];
 }
 export function isTerminalRunStatus(status) {
     const cls = runStatusClassOf(status);

package/dist/run-cancel-context.js

@@ -30,7 +30,7 @@ export function mintCancelledResult(args) {
         sessionId: args.sessionId,
         terminal: { kind: "failed", code: CANCELLED_CODE, message: args.message },
         result: "",
-        stats: { turns: 0, tokens: 0 },
+        stats: { turns: 0, tokens: 0, usageMissing: true },
         ...(ctx ? { cancelContext: ctx } : {}),
     };
 }

package/dist/run-local.js

@@ -15,7 +15,7 @@ import { ForkRoutingSessionStore } from "./plugins/fork-routing-session-store.js
 import { taskWallClockSec } from "./task-workflow.js";
 import { applyCatalogToSource } from "./capabilities/center-prompts.js";
 import { validatePromptsDomain, CORE_ENGINE_VERSION } from "./prompts-domain-validate.js";
-import { loadConfig, logConfigDiagnostics, parseNumOrFailNonNegative } from "./config.js";
+import { buildUnpricedCeilingNotice, loadConfig, logConfigDiagnostics, parseNumOrFailNonNegative } from "./config.js";
 import { createConfigProvider } from "./config-provider.js";
 import { applyEffective, applyCenterReadFace, resolveMcpServers, mcpForScenario, resolveA2aPeers, a2aForScenario } from "./config-center/facade.js";
 import { hostExecutionEnvFactory } from "./plugins/remote-env-host.js";
@@ -198,6 +198,9 @@ export async function runLocal(argv, deps = {}) {
     catch (err) {
         logger.warn("config_source_unreachable_using_env", { source: configProvider.kind, err: String(err) });
     }
+    const unpricedCeiling = buildUnpricedCeilingNotice(config.models, config);
+    if (unpricedCeiling)
+        logger.warn(unpricedCeiling.event, unpricedCeiling.fields);
     try {
         const fileRx = await loadRemoteExec(root);
         if (fileRx?.provider === "host") {

package/dist/runs.d.ts

@@ -1,4 +1,4 @@
-import { defaultTaskRegistry, type CascadeConfig, type CheckpointToken, type Runner, type SubagentSteerHandle, type TaskResult, type TaskSpec, type TaskStream, type TerminalCause } from "@sema-agent/core";
+import { defaultTaskRegistry, type CascadeConfig, type CheckpointToken, type RunInternals, type Runner, type SubagentSteerHandle, type TaskResult, type TaskSpec, type TaskStream, type TerminalCause } from "@sema-agent/core";
 import type { SendUserFileEmitter } from "./capabilities/send-user-file-tool.js";
 import type { RunStore } from "./plugins/store-backend.js";
 import type { Metrics } from "./observability/metrics.js";
@@ -282,7 +282,21 @@ pendingEngineNotices?: readonly {
     message: string;
     detail?: Record<string, unknown>;
     sessionId?: unknown;
-}[]): Promise<void>;
+}[], 
+/**
+ * 🔴 **S-218:部署方铸的 TRUSTED run internals**(今天唯一成员 `workflowParkedResume`)。
+ *
+ * 它**不是** `TaskSpec` 字段、不是工具参数、不进请求体 —— 模型永远不能自己决定一次审批。铸点只有
+ * 一个:`/decide` 的 workflow 第三条车道(判据属主 = `parked-decide.ts` 的 `planWorkflowParkedDecide`
+ * 顶注 + `http/durable-run-leg.ts` 的 `TrustedRunInternals`)。本腿只负责把它摊进**下面那只**共享
+ * 供给座席,core 的 `prepareTask` 据它给 Workflow 工具挂 `parkedResume` dep。
+ *
+ * 位置在座席对象的**最后**:座席里那几位(onActivity/onForwardEvent/onTaskNotification/onSubagentSpawn)
+ * 是本腿自己的执行面供给,调用方无权覆盖它们 —— 真要撞名,撞的也只能是本腿自己新加的位,而那时
+ * `TrustedRunInternals` 的白名单会在编译期先红一次(它只开部署方可以决定的那一格)。
+ * 缺席 ⇒ 座席与本位存在之前逐字相同。
+ */
+trustedInternals?: Pick<RunInternals, "workflowParkedResume">): Promise<void>;
 /** How often a running instance refreshes its run's updated_at (liveness, independent of events).
  *  Must stay strictly below `runStaleSec` (asserted at startup AND on every hot config candidate) or the
  *  reaper would race live runs. [ref]:数值的单源是 `config-invariants.ts`(那条不变量的属主),两个消费面

package/dist/runs.js

@@ -160,7 +160,7 @@ export function evictIfConflict(runner, sessionId, result) {
         runner.sessions.evict?.(sessionId);
     }
 }
-export async function runInBackground(runner, spec, runStore, taskId, metrics, principal, verify, cascade, instrumentDegenerate, planCacheProbe, persistThinking = false, inflight, preemptable, steerable, modelUsage, elicitation, elicitOwner, captureTurnAnchor, fleetPublisher, captureUserMessageAnchor, question, workflowCompletionInbox, subagentSteer, completionDiagLog, sendUserFile, promptManifests, approval, parkCheckpointReader, pendingEngineNotices) {
+export async function runInBackground(runner, spec, runStore, taskId, metrics, principal, verify, cascade, instrumentDegenerate, planCacheProbe, persistThinking = false, inflight, preemptable, steerable, modelUsage, elicitation, elicitOwner, captureTurnAnchor, fleetPublisher, captureUserMessageAnchor, question, workflowCompletionInbox, subagentSteer, completionDiagLog, sendUserFile, promptManifests, approval, parkCheckpointReader, pendingEngineNotices, trustedInternals) {
     const startedAt = Date.now();
     metrics?.addGauge("runs_active", 1);
     fleetPublisher?.onStart();
@@ -311,6 +311,7 @@ export async function runInBackground(runner, spec, runStore, taskId, metrics, p
                         },
                     }
                     : {}),
+                ...(trustedInternals ?? {}),
             };
             const statusSeat = {
                 onStatusEvent: (e) => {

package/dist/runtime-caps-resolver.js

@@ -45,6 +45,8 @@ export function toCoreRuntimeCaps(ent) {
         caps.allowObservers = ent.allowObservers;
     if (typeof autoMode === "boolean")
         caps.autoMode = autoMode;
+    if (caps.autoMode === false)
+        caps.autoModeDenySource = "org";
     if (typeof ent.allowMemoryOptOut === "boolean")
         caps.allowMemoryOptOut = ent.allowMemoryOptOut;
     return Object.keys(caps).length ? caps : undefined;
@@ -142,7 +144,7 @@ export function createPrincipalEntitlementsClient(opts) {
                 catch {
                     e = new Error("center fetch failed with an unstringifiable rejection reason");
                 }
-                const entry = { caps: { allowWorkflows: false, allowFork: false, autoMode: false }, expiresAt: now() + denyTtlMs };
+                const entry = { caps: { allowWorkflows: false, allowFork: false, autoMode: false, autoModeDenySource: "org" }, expiresAt: now() + denyTtlMs };
                 if (!recordDeny)
                     readMintedDeny.add(entry);
                 putCache(principal, entry);
@@ -231,7 +233,7 @@ export function applyLocalAutoModeDeny(base, deny) {
     if (!deny)
         return base;
     if (base === undefined)
-        return () => ({ autoMode: false });
-    return async (principal) => ({ ...(await base(principal)), autoMode: false });
+        return () => ({ autoMode: false, autoModeDenySource: "local" });
+    return async (principal) => ({ ...(await base(principal)), autoMode: false, autoModeDenySource: "local" });
 }
 //# sourceMappingURL=runtime-caps-resolver.js.map

package/dist/task-a2a.js

@@ -1,4 +1,5 @@
-import { resolveComplianceDenies, TOOL_WIRE_NAME_MAX_CHARS } from "@sema-agent/core";
+import { resolveComplianceDenies } from "@sema-agent/core";
+import { isUsableWireName } from "./wire-name-bound.js";
 import { HttpError } from "./security.js";
 export const MAX_REQUEST_A2A_PEERS = 32;
 export function a2aInjectionHonored(config) {
@@ -19,7 +20,7 @@ function normalizeA2aPeer(e) {
     if (!e || typeof e !== "object")
         return null;
     const o = e;
-    if (typeof o.name !== "string" || o.name.length === 0 || o.name.length > TOOL_WIRE_NAME_MAX_CHARS)
+    if (!isUsableWireName(o.name))
         return null;
     if (typeof o.url !== "string" || !HTTP_URL_RE.test(o.url))
         return null;

package/dist/task-mcp.js

@@ -1,4 +1,5 @@
-import { mcpInjectionDroppedNotice, resolveComplianceDenies, TOOL_WIRE_NAME_MAX_CHARS } from "@sema-agent/core";
+import { mcpInjectionDroppedNotice, resolveComplianceDenies } from "@sema-agent/core";
+import { isUsableWireName } from "./wire-name-bound.js";
 import { HttpError } from "./security.js";
 import { CONTENT_ORIGIN_WORDS, describeBadContentOrigin, isContentOriginWord } from "./mcp-content-origin.js";
 import { readMcpSourceLabel } from "./mcp-source-label.js";
@@ -26,7 +27,7 @@ function normalizeServer(e, noteBadOrigin) {
     if (!e || typeof e !== "object")
         return bad("entry");
     const o = e;
-    if (typeof o.name !== "string" || o.name.length === 0 || o.name.length > TOOL_WIRE_NAME_MAX_CHARS)
+    if (!isUsableWireName(o.name))
         return bad("name");
     const t = o.transport;
     if (!t || typeof t !== "object")

package/dist/tool-approval.d.ts

@@ -126,11 +126,16 @@ export interface ToolApprovalFrame {
     requiresRealApproval?: true;
     /**
      * **S-125③/[ref]**(core 7.5.0;**ADDITIVE**,`"tool_approval"` only)—— 这只 ask 的**出身**:
-     * 谁提的这一问,一个 core 闭集词(`ASK_ORIGINS` **11 员**,core 7.9.0 现值:content_question /
-     * unresolvable / org_unavailable / org_rule / rule_store_unavailable / hook / ask_rule /
+     * 谁提的这一问,一个 core 闭集词(`ASK_ORIGINS` **11 员**,core 7.14.0 现值:content_question /
+     * ancestor_marked / org_unavailable / org_rule / rule_store_unavailable / hook / ask_rule /
      * denial_limit_fallback / shell_gate_tighten / safety_tighten / policy)。引擎在门上盖章(core d.ts:
      * 「engine-stamped at the gate, never a policy's claim」),`AskRequest.origin` 逐字透传。
      *
+     * ⚠️ **core 7.14.0 [ref] C2 BREAKING**:`unresolvable` → `ancestor_marked`,**无别名**。server 侧零形变
+     * (本键一直是 `string` 逐字透传),但**消费端的 switch 要改词**;7.14.0 之前 park 下来、行上存着
+     * `unresolvable` 的老记录,在 core 每一道 `isAskOrigin` 筛上自此都是非成员(投影处不回显 ⇒ 本键缺席),
+     * 而那一行的 `org` 事实不受影响。
+     *
      * 🔴 **echo-only,零消费**:自动车道的资格判据全在 core(`classifierMayAnswer` 的闭表),server
      * **不许**据本键自铸第二张资格表 —— 那是同一语义面两个写者(源头修复纪律),与
      * `denialLimitFallback` 顶注那条「不据 autoDenyAfterMs 自铸第二只定时器」同一条禁令。
@@ -144,26 +149,26 @@ export interface ToolApprovalFrame {
      */
     origin?: string;
     /**
-     * **S-185 / [ref]**(core 7.10.0;**ADDITIVE**,`"tool_approval"` only)—— 这一问**为什么**到了人手上:
-     * 分类器被咨询过、而它**跑不了**。`cause` = core 的闭集词
-     * (`AUTO_MODE_UNAVAILABLE_CAUSES`;core 7.12.0 起 = `error` / `timeout`),`AskRequest.classifierUnavailable`
-     * 逐字透传。core 7.12.0 / [ref] 起 ask 上这一位只由**策略层自声明**铸(引擎自己的那份改骑 deny —— 全文
-     * 在 `approval-card.ts` 同名键的顶注)。
-     *
-     * 🔴 **缺席 ≠「分类器好着呢」**:缺席同时覆盖三形 —— 分类器答上了 / 这只 ask 没资格走分类器
-     * (`classifierMayAnswer` 的闭表)/ 本部署压根没接分类器。消费端**禁**把缺席读成对分类器健康的断言。
-     * 另注:`parse_error`(分类器跑了但答得出格)**不盖这一位** —— 那是另一句话,core 顶注逐字。
-     *
-     * 🔴 **不枚举词表**(值形是 `{cause: string}` 而不是本仓自铸的联合):词表单一属主在 core,抄一份会把
-     * core 加的新词吞成缺席。窄读只判「对象 ∧ `cause` 非空串 ∧ 无多余成员」(`readClassifierUnavailable`,
-     * 帧与卡的**唯一**铸造点 ⇒ 两面结构性同值)。
-     *
-     * 🔴 **echo-only,零消费**:熔断/超时的处置全在 core 的分类器站,server 不许据本键自铸第二套回落判据
-     * —— 同 `origin` / `denialLimitFallback` 两条顶注的同一条禁令(同一语义面两个写者)。
+     * **[ref] C3**(core 7.14.0;**ADDITIVE**,`"tool_approval"` only)—— `origin: "rule_store_unavailable"`
+     * 的**机制判别位**:持久规则车道这一次**读不下来的是哪一半**。core 闭二词
+     * (`RULE_STORE_UNREADABLE_KINDS`):`"store"` = 接上的规则店读不了(读失败 / 超时);`"call"` = 店读到了,
+     * 但**这条命令**按人的 deny/ask 行读不出来(收紧 lexer 的 `unreadable`:展开里含规则词、引号没闭、语法
+     * 错——具体那句在 `message` 里)。`AskRequest.ruleStoreUnreadable` 逐字透传。
+     *
+     * 🔴 **在场 ⇔ `origin === "rule_store_unavailable"`**(core 顶注逐字)。两词对审批人是两件事:`store`
+     * 指向「去看规则店 / 网络」,`call` 指向「这条命令的写法让规则判不了」——一个 origin 词对这两件事同形。
+     * 缺席 = 车道把店和这条命令都读通了,**或**本部署没接规则车道;消费端禁把缺席读成对规则店健康的断言。
+     *
+     * 🔴 **不枚举词表**(值形是 `string` 而不是本仓自铸的联合):词表单一属主在 core
+     * (`isRuleStoreUnreadable` 是它的成员判),抄一份会把 core 加的新词吞成缺席 —— 与 {@link origin} 逐字同规。
+     *
+     * 🔴 **echo-only,零消费**:策略自声明的值在 core 的**唯一**盖章点就被抹掉了,server 不重算、不再筛第二遍,
+     * 更不许据本键自铸第二张车道资格表 —— 同 `origin` / `denialLimitFallback` 两条顶注的同一条禁令。
+     *
+     * ⚰️ 本键的前任 `classifierUnavailable`(S-185 / [ref])随 core 7.14.0 [ref] **整族退役**:引擎那份事实改骑
+     * `GateDisposition.denied.cause`(`tool_end.gate` / `permissionDenied.gate`),ask 面自此没有这一位。
      */
-    classifierUnavailable?: {
-        cause: string;
-    };
+    ruleStoreUnreadable?: string;
     /**
      * **E-14**([ref]② Trojan Source 族;**ADDITIVE**,`"tool_approval"` only)—— 这只 ask 的**工具输入**
      * (`AskRequest.args`)里含 bidi 控制符(LRM/RLM、嵌入/覆写、隔离符;字符类属主 `text-bidi.ts`)。

package/dist/tool-approval.js

@@ -8,7 +8,7 @@ import { approvalPayloadFingerprint } from "./plugins/approval-payload-fingerpri
 import { createLogger } from "./observability/logger.js";
 import { recordFailOpen } from "./observability/fail-open.js";
 import { deriveAskId, deriveBatchId, MAX_DECISION_NOTE_CHARS } from "./approval-ask-machine.js";
-import { ApprovalCardEnvelopeSchema, MAX_RULE_OFFERS, buildApprovalCard, buildApprovalCardEnvelope, buildApprovalRequestFrame, buildRevokeFrame, readDenialLimitFallback, readClassifierUnavailable, readProbeCause, readRuleEvidence, readRuleOffersAbsence, RuleOfferRawSchema, backfillLegacyBatchMemberKind, screenUncoveredDetailSeat, } from "./approval-card.js";
+import { ApprovalCardEnvelopeSchema, MAX_RULE_OFFERS, buildApprovalCard, buildApprovalCardEnvelope, buildApprovalRequestFrame, buildRevokeFrame, readDenialLimitFallback, readProbeCause, readRuleEvidence, readRuleOffersAbsence, RuleOfferRawSchema, backfillLegacyBatchMemberKind, screenUncoveredDetailSeat, } from "./approval-card.js";
 import { projectAskTerminalClaimTruth } from "./plugins/approval-ask-store-sql.js";
 import { governanceAskMarksFor, runWithGovernanceAskScope } from "./governance-ask-marks.js";
 const defaultLogger = createLogger();
@@ -844,7 +844,7 @@ export class ToolApprovalCoordinator {
             ...(ruleLaneMaterial !== undefined ? { ruleOffers: ruleLaneMaterial.offers } : {}),
             ...((a) => (a !== undefined ? { ruleOffersAbsence: a } : {}))(readRuleOffersAbsence(req)),
             ...((f) => (f !== undefined ? { denialLimitFallback: f } : {}))(readDenialLimitFallback(req)),
-            ...((c) => (c !== undefined ? { classifierUnavailable: c } : {}))(readClassifierUnavailable(req)),
+            ...(typeof req.ruleStoreUnreadable === "string" && req.ruleStoreUnreadable.length > 0 ? { ruleStoreUnreadable: req.ruleStoreUnreadable } : {}),
             ...((c) => (c !== undefined ? { probeCause: c } : {}))(readProbeCause(req)),
             ...((c) => (c !== undefined ? { ruleEvidence: c } : {}))(readRuleEvidence(req)),
             ...(bounded.omitted ? { argsOmitted: true } : { args: bounded.args }),

package/dist/trace/core-keyset-guard.d.ts

@@ -17,7 +17,7 @@
  * ⑨⑩([ref],2026-08-31)把两个最大的 wire 面也纳入:TaskSpec 按「server 有无写点」记 Wired/Unwired,
  * TaskResult 按「转发/摘除」记 Forwarded/Stripped —— 谁改 resolve-spec.ts / runs.ts 的发射点谁同步本文件。
  */
-import type { TaskNotificationPayload, SemaProvenance, BackgroundChildEvent, RosterEntry, AskRequest, CheckpointSummary, TaskEvent, TraceEvent, MailboxMessage, MailboxAppendMessage, TaskSpec, TaskResult, WiringManifest, GateOutcome, Settlement, PausedCause } from "@sema-agent/core";
+import type { TaskNotificationPayload, SemaProvenance, BackgroundChildEvent, RosterEntry, AskRequest, CheckpointSummary, TaskEvent, TraceEvent, MailboxMessage, MailboxAppendMessage, TaskSpec, TaskResult, WiringManifest, GateOutcome, GateDisposition, Settlement, PausedCause } from "@sema-agent/core";
 import type { ToolApprovalFrame } from "../tool-approval.js";
 /** 编译期断言:T 必须收敛到 never(有残余键 = tsc 红)。
  *  🔴 **导出**([ref] U1/U2):本仓「词表闭集,未处置成员=编译红」的钉法只许有**一个**形 ——
@@ -43,7 +43,7 @@ type _GuardBgNotifReverse = AssertAllKeysHandled<Exclude<BgNotifProjected | BgNo
 type RosterProjected = "name" | "agentId" | "sessionId" | "toolUseId" | "owner" | "scope" | "sessionScoped" | "rootSessionId" | "model" | "modelFallback" | "createdAt";
 type _GuardRoster = AssertAllKeysHandled<Exclude<keyof RosterEntry, RosterProjected>>;
 type _GuardRosterReverse = AssertAllKeysHandled<Exclude<RosterProjected, keyof RosterEntry>>;
-type AskProjected = "toolName" | "toolCallId" | "args" | "message" | "sourceTaskId" | "fromSubagent" | "sourceAgentName" | "delegation" | "ruleOffers" | "ruleOffersAbsence" | "persistedRuleShadowed" | "probeCause" | "ruleEvidence" | "requiresRealApproval" | "denialLimitFallback" | "origin" | "classifierUnavailable";
+type AskProjected = "toolName" | "toolCallId" | "args" | "message" | "sourceTaskId" | "fromSubagent" | "sourceAgentName" | "delegation" | "ruleOffers" | "ruleOffersAbsence" | "persistedRuleShadowed" | "probeCause" | "ruleEvidence" | "requiresRealApproval" | "denialLimitFallback" | "origin" | "ruleStoreUnreadable";
 type AskExcluded = "preview" | "principal" | "riskAxes" | "boundInputHash" | "isDelegatedChild" | "probeReason" | "hasBidiControls" | "previewWithheld" | "execCwd";
 type _GuardAsk = AssertAllKeysHandled<Exclude<keyof AskRequest, AskProjected | AskExcluded>>;
 type _GuardAskReverse = AssertAllKeysHandled<Exclude<AskProjected | AskExcluded, keyof AskRequest>>;
@@ -103,7 +103,7 @@ type _GuardWiringRulesReverse = AssertAllKeysHandled<Exclude<WiringRulesHandled,
 type WiringModelGateHandled = "class" | "removed" | "restore";
 type _GuardWiringModelGate = AssertAllKeysHandled<Exclude<keyof WiringSection<"modelGate">, WiringModelGateHandled>>;
 type _GuardWiringModelGateReverse = AssertAllKeysHandled<Exclude<WiringModelGateHandled, keyof WiringSection<"modelGate">>>;
-type WiringAutoModeHandled = "armed" | "reason";
+type WiringAutoModeHandled = "armed" | "reason" | "deniedSource";
 type _GuardWiringAutoMode = AssertAllKeysHandled<Exclude<keyof WiringSection<"autoMode">, WiringAutoModeHandled>>;
 type _GuardWiringAutoModeReverse = AssertAllKeysHandled<Exclude<WiringAutoModeHandled, keyof WiringSection<"autoMode">>>;
 type WiringGovernanceHandled = "audience" | "lockedConfig" | "compliance" | "memoryAdmission" | "retention";
@@ -117,7 +117,7 @@ type _GuardPermissionTraceReverse = AssertAllKeysHandled<Exclude<PermissionTrace
 /** `T` 非 `never` 时收敛到 `never`(空集 ⇒ 残留 `"EMPTY"` ⇒ tsc 红)。 */
 type AssertNonEmpty<T> = [T] extends [never] ? "EMPTY" : never;
 type _GuardPermissionTraceNonEmpty = AssertAllKeysHandled<AssertNonEmpty<PermissionTraceKind>>;
-type SummaryProjected = "sessionId" | "scope" | "createdAt" | "gateKind" | "severity" | "spentMicroUsd" | "deadline" | "hasBidiControls" | "requiresRealApproval" | "denialLimitFallback" | "origin" | "classifierUnavailable";
+type SummaryProjected = "sessionId" | "scope" | "createdAt" | "gateKind" | "severity" | "spentMicroUsd" | "deadline" | "hasBidiControls" | "requiresRealApproval" | "denialLimitFallback" | "origin" | "ruleStoreUnreadable";
 type SummaryExcluded = "token" | "toolInput" | "toolName" | "toolCallId" | "preview" | "principal" | "sourceTaskId" | "contentKind" | "restoreMode" | "checkpointId" | "previewWithheld";
 type _GuardInboxSummary = AssertAllKeysHandled<Exclude<keyof CheckpointSummary, SummaryProjected | SummaryExcluded>>;
 type _GuardInboxSummaryReverse = AssertAllKeysHandled<Exclude<SummaryProjected | SummaryExcluded, keyof CheckpointSummary>>;
@@ -138,6 +138,10 @@ type SettlementWhoKeys = Settlement["who"] extends infer W ? (W extends object ?
 type GateOutcomeProjected = "disposition" | "settlement" | "origin";
 type _GuardGateOutcome = AssertAllKeysHandled<Exclude<keyof GateOutcome, GateOutcomeProjected>>;
 type _GuardGateOutcomeReverse = AssertAllKeysHandled<Exclude<GateOutcomeProjected, keyof GateOutcome>>;
+type GateDispositionKeys = GateDisposition extends infer D ? (D extends object ? keyof D : never) : never;
+type GateDispositionProjected = "kind" | "deniedBy" | "cause";
+type _GuardGateDisposition = AssertAllKeysHandled<Exclude<GateDispositionKeys, GateDispositionProjected>>;
+type _GuardGateDispositionReverse = AssertAllKeysHandled<Exclude<GateDispositionProjected, GateDispositionKeys>>;
 type SettlementProjected = "kind" | "who" | "when" | "note";
 type _GuardSettlement = AssertAllKeysHandled<Exclude<SettlementKeys, SettlementProjected>>;
 type _GuardSettlementReverse = AssertAllKeysHandled<Exclude<SettlementProjected, SettlementKeys>>;
@@ -208,6 +212,8 @@ export type CoreKeysetGuards = [
     _GuardPausedCauseReverse,
     _GuardGateOutcome,
     _GuardGateOutcomeReverse,
+    _GuardGateDisposition,
+    _GuardGateDispositionReverse,
     _GuardSettlement,
     _GuardSettlementReverse,
     _GuardSettlementWho,

package/dist/trace/project.d.ts

@@ -120,6 +120,18 @@ export declare function toolStartEventData(ev: {
     parentToolCallId?: string;
 }): Record<string, unknown>;
 export declare function screenedGate(v: unknown): GateOutcome | undefined;
+/**
+ * 🔴 **耐久行的**门记录读口(7.72.0;`screenedGate` 的读腿孪生)—— 先把本仓自己写过的**旧拼法**读成它
+ * 今天的名字({@link RETIRED_ASK_ORIGIN_SPELLINGS}),再走与写腿**同一只**筛子。
+ *
+ * 为什么读腿要多这一步而写腿不要:读到的字节可能是**本仓上一个版本**写下的(账本回放、park 行的
+ * `resolvedOutcome`),而 core 7.14.0 [ref] C2 把 `ASK_ORIGINS` 的一个词改了名 —— 不认旧拼法,那些行就整条
+ * withhold,连 `disposition` / `settlement`(谁拒的、人怎么结的)一起在回放面上消失。写腿面对的则是**当下**
+ * 引擎铸的记录,它铸不出退役词,所以那里出现退役词 = producer 契约漂了 = 要 report + withhold 的事。
+ *
+ * 不改原对象(调用方与账本共享引用):归一时换一只信封,原记录一个字节不动。
+ */
+export declare function screenedStoredGate(v: unknown): GateOutcome | undefined;
 /** The durable `tool_end` payload (shared by both append sites). E1: the model-facing `output` is UNTRUSTED RAW
  *  from core (file/shell/API bodies) — core only SIZE-bounds it (`truncated`), REDACTION is ours (same contract as
  *  `tool_start.args`); never re-fed to a model. E2: identity. Absent `output` ⇒ the tool produced no content body.

package/dist/trace/project.js

@@ -86,6 +86,9 @@ export function toolStartEventData(ev) {
     return { toolCallId: ev.toolCallId, toolName: ev.toolName, ...(ev.label !== undefined ? { label: ev.label } : {}), args: redactDeep(ev.args), ...identityFields(ev) };
 }
 const SETTLEMENT_NOTE_MAX = 500;
+const RETIRED_ASK_ORIGIN_SPELLINGS = {
+    unresolvable: "ancestor_marked",
+};
 export function screenedGate(v) {
     if (v === null || typeof v !== "object")
         return undefined;
@@ -96,6 +99,7 @@ export function screenedGate(v) {
         return undefined;
     }
     const shapeDefect = (d.kind === "denied" && typeof d.deniedBy !== "string" && "disposition.deniedBy is not a string") ||
+        (d.kind === "denied" && d.cause !== undefined && typeof d.cause !== "string" && "disposition.cause is not a string") ||
         (g.settlement !== undefined && (g.settlement === null || typeof g.settlement !== "object") && "settlement is not an object") ||
         (g.settlement !== undefined && g.settlement !== null && typeof g.settlement.kind !== "string" && "settlement.kind is not a string") ||
         (g.origin !== undefined && typeof g.origin !== "string" && "origin is not a string") ||
@@ -115,11 +119,20 @@ export function screenedGate(v) {
         return undefined;
     }
     return {
-        disposition: d.kind === "denied" ? { kind: "denied", deniedBy: d.deniedBy } : { kind: "allowed" },
+        disposition: d.kind === "denied"
+            ? { kind: "denied", deniedBy: d.deniedBy, ...(d.cause === undefined ? {} : { cause: d.cause }) }
+            : { kind: "allowed" },
         ...(settlement === undefined ? {} : { settlement }),
         ...(g.origin === undefined ? {} : { origin: g.origin }),
     };
 }
+export function screenedStoredGate(v) {
+    if (v === null || typeof v !== "object")
+        return undefined;
+    const g = v;
+    const renamed = typeof g.origin === "string" ? RETIRED_ASK_ORIGIN_SPELLINGS[g.origin] : undefined;
+    return screenedGate(renamed === undefined ? g : { ...g, origin: renamed });
+}
 const SETTLEMENT_PARTIES = new Set(["person", "engine", "host", "none"]);
 function projectSettlement(st) {
     const whoV = st.who;
@@ -329,7 +342,10 @@ export function wiringManifestEventData(ev) {
         const reason = str(autoIn.reason);
         if (armed === undefined || reason === undefined)
             return undefined;
-        return armed === (reason === "armed") ? { armed, reason } : undefined;
+        if (armed !== (reason === "armed"))
+            return undefined;
+        const deniedSource = str(autoIn.deniedSource);
+        return { armed, reason, ...(deniedSource === undefined ? {} : { deniedSource }) };
     })();
     const toolsIn = m.tools;
     const tools = toolsIn === undefined ? undefined : Value.Check(ToolRoster, toolsIn) ? toolsIn : (recordFailOpen("server.trace.tool-roster-malformed", "wiring_manifest.tools did not fit core ToolRoster"), undefined);
@@ -514,7 +530,7 @@ export function toolCallFieldsOf(d) {
     };
 }
 export function toolResultFieldsOf(d) {
-    const gate = d.gate === undefined ? undefined : screenedGate(d.gate);
+    const gate = d.gate === undefined ? undefined : screenedStoredGate(d.gate);
     return {
         callId: String(d.toolCallId ?? ""),
         ...(typeof d.label === "string" ? { label: d.label } : {}),

package/dist/usage-analytics.d.ts

@@ -26,6 +26,11 @@ export interface UsageRow {
     stats?: {
         tokens?: number;
         modelUsage?: Record<string, UsageModelEntry>;
+        /** core 7.14.0 [ref] C-b(`TaskResult.stats.usageMissing`):这一行的用量数字是**下界**不是测量值
+         *  —— 至少有一轮模型没报用量,或整条结果是宿主/编排车道自铸的(一个模型轮都没跑过)。
+         *  `true` 或缺席,**永不 `false`**;缺席 ⇔ 每轮都报了用量。fold 侧翻成既有的
+         *  {@link UsageTotals.estimated}(见 `foldRow`),**不开第二条不精确轴**。 */
+        usageMissing?: true;
     };
 }
 /**
@@ -57,7 +62,10 @@ export interface UsageTotals {
      *  ②有 per-model echo 行**缺数值键**(该键按 0 计入,总量偏低;成本键缺席时尤其:少算 ≠ 免费);
      *  ③(S10/V2-⑤)有行的 {@link UsageModelEntry.usageBasis} 缺席或非本读端认识的分量制——存量行某族
      *  历史上把 cache 计入 inputTokens,tokensIn 求和会**双算**,口径不可分辨。
-     *  三者都只表达「别把这个总数当精确值」,消费端一视同仁。 */
+     *  ④(7.72.0 / core 7.14.0 [ref] C-b)有行自陈 `stats.usageMissing` —— 那一行的数字是**下界**:至少一轮
+   *  模型没报用量,或整条结果是宿主自铸的零结果(取消打断 / 零执行的治理拒绝)。`tokens: 0` 在那种行上读作
+   *  「未知」而不是「免费」。
+   *  四者都只表达「别把这个总数当精确值」,消费端一视同仁。 */
     estimated: boolean;
 }
 /** GET /v1/usage/summary — 窗内总量。 */

package/dist/usage-analytics.js

@@ -17,8 +17,13 @@ function foldModelEntry(t, d) {
     if (d.usageBasis !== "uncached-components-v1")
         t.estimated = true;
 }
+function markRowLowerBound(t, row) {
+    if (row.stats?.usageMissing === true)
+        t.estimated = true;
+}
 function foldRow(t, row) {
     t.tasks += 1;
+    markRowLowerBound(t, row);
     const mu = row.stats?.modelUsage;
     if (mu && Object.keys(mu).length > 0) {
         for (const d of Object.values(mu))
@@ -70,6 +75,7 @@ export function usageBreakdown(rows, dimension) {
                 const t = bucket(model);
                 t.tasks += 1;
                 foldModelEntry(t, d);
+                markRowLowerBound(t, r);
             }
         }
         else {
@@ -92,6 +98,8 @@ export function projectUsageStats(result) {
         const mu = stats.modelUsage;
         if (mu && typeof mu === "object" && !Array.isArray(mu))
             out.modelUsage = mu;
+        if (stats.usageMissing === true)
+            out.usageMissing = true;
         return out;
     }
     catch {