@sema-agent/server 7.71.0 → 7.73.0

package/dist/runs.d.ts

@@ -1,4 +1,4 @@
-import { defaultTaskRegistry, type CascadeConfig, type CheckpointToken, type Runner, type SubagentSteerHandle, type TaskResult, type TaskSpec, type TaskStream, type TerminalCause } from "@sema-agent/core";
+import { defaultTaskRegistry, type CascadeConfig, type CheckpointToken, type RunInternals, type Runner, type SubagentSteerHandle, type TaskResult, type TaskSpec, type TaskStream, type TerminalCause } from "@sema-agent/core";
 import type { SendUserFileEmitter } from "./capabilities/send-user-file-tool.js";
 import type { RunStore } from "./plugins/store-backend.js";
 import type { Metrics } from "./observability/metrics.js";
@@ -282,7 +282,21 @@ pendingEngineNotices?: readonly {
     message: string;
     detail?: Record<string, unknown>;
     sessionId?: unknown;
-}[]): Promise<void>;
+}[], 
+/**
+ * 🔴 **S-218:部署方铸的 TRUSTED run internals**(今天唯一成员 `workflowParkedResume`)。
+ *
+ * 它**不是** `TaskSpec` 字段、不是工具参数、不进请求体 —— 模型永远不能自己决定一次审批。铸点只有
+ * 一个:`/decide` 的 workflow 第三条车道(判据属主 = `parked-decide.ts` 的 `planWorkflowParkedDecide`
+ * 顶注 + `http/durable-run-leg.ts` 的 `TrustedRunInternals`)。本腿只负责把它摊进**下面那只**共享
+ * 供给座席,core 的 `prepareTask` 据它给 Workflow 工具挂 `parkedResume` dep。
+ *
+ * 位置在座席对象的**最后**:座席里那几位(onActivity/onForwardEvent/onTaskNotification/onSubagentSpawn)
+ * 是本腿自己的执行面供给,调用方无权覆盖它们 —— 真要撞名,撞的也只能是本腿自己新加的位,而那时
+ * `TrustedRunInternals` 的白名单会在编译期先红一次(它只开部署方可以决定的那一格)。
+ * 缺席 ⇒ 座席与本位存在之前逐字相同。
+ */
+trustedInternals?: Pick<RunInternals, "workflowParkedResume">): Promise<void>;
 /** How often a running instance refreshes its run's updated_at (liveness, independent of events).
  *  Must stay strictly below `runStaleSec` (asserted at startup AND on every hot config candidate) or the
  *  reaper would race live runs. [ref]:数值的单源是 `config-invariants.ts`(那条不变量的属主),两个消费面

package/dist/runs.js

@@ -160,7 +160,7 @@ export function evictIfConflict(runner, sessionId, result) {
         runner.sessions.evict?.(sessionId);
     }
 }
-export async function runInBackground(runner, spec, runStore, taskId, metrics, principal, verify, cascade, instrumentDegenerate, planCacheProbe, persistThinking = false, inflight, preemptable, steerable, modelUsage, elicitation, elicitOwner, captureTurnAnchor, fleetPublisher, captureUserMessageAnchor, question, workflowCompletionInbox, subagentSteer, completionDiagLog, sendUserFile, promptManifests, approval, parkCheckpointReader, pendingEngineNotices) {
+export async function runInBackground(runner, spec, runStore, taskId, metrics, principal, verify, cascade, instrumentDegenerate, planCacheProbe, persistThinking = false, inflight, preemptable, steerable, modelUsage, elicitation, elicitOwner, captureTurnAnchor, fleetPublisher, captureUserMessageAnchor, question, workflowCompletionInbox, subagentSteer, completionDiagLog, sendUserFile, promptManifests, approval, parkCheckpointReader, pendingEngineNotices, trustedInternals) {
     const startedAt = Date.now();
     metrics?.addGauge("runs_active", 1);
     fleetPublisher?.onStart();
@@ -311,6 +311,7 @@ export async function runInBackground(runner, spec, runStore, taskId, metrics, p
                         },
                     }
                     : {}),
+                ...(trustedInternals ?? {}),
             };
             const statusSeat = {
                 onStatusEvent: (e) => {

package/dist/runtime-caps-resolver.js

@@ -45,6 +45,8 @@ export function toCoreRuntimeCaps(ent) {
         caps.allowObservers = ent.allowObservers;
     if (typeof autoMode === "boolean")
         caps.autoMode = autoMode;
+    if (caps.autoMode === false)
+        caps.autoModeDenySource = "org";
     if (typeof ent.allowMemoryOptOut === "boolean")
         caps.allowMemoryOptOut = ent.allowMemoryOptOut;
     return Object.keys(caps).length ? caps : undefined;
@@ -142,7 +144,7 @@ export function createPrincipalEntitlementsClient(opts) {
                 catch {
                     e = new Error("center fetch failed with an unstringifiable rejection reason");
                 }
-                const entry = { caps: { allowWorkflows: false, allowFork: false, autoMode: false }, expiresAt: now() + denyTtlMs };
+                const entry = { caps: { allowWorkflows: false, allowFork: false, autoMode: false, autoModeDenySource: "org" }, expiresAt: now() + denyTtlMs };
                 if (!recordDeny)
                     readMintedDeny.add(entry);
                 putCache(principal, entry);
@@ -231,7 +233,7 @@ export function applyLocalAutoModeDeny(base, deny) {
     if (!deny)
         return base;
     if (base === undefined)
-        return () => ({ autoMode: false });
-    return async (principal) => ({ ...(await base(principal)), autoMode: false });
+        return () => ({ autoMode: false, autoModeDenySource: "local" });
+    return async (principal) => ({ ...(await base(principal)), autoMode: false, autoModeDenySource: "local" });
 }
 //# sourceMappingURL=runtime-caps-resolver.js.map

package/dist/spec-fields.d.ts

@@ -96,7 +96,8 @@ export declare function taskAgentsSpecFragment(raw: unknown, requirePrincipal: b
 export declare function retainBackgroundProcessesFromBody(raw: unknown, requirePrincipal: boolean | undefined, warn: (event: string, fields: Record<string, unknown>) => void): true | undefined;
 /** [ref]② — body.{excludeTools,deferTools} → `TaskSpec.{excludeTools,deferTools}`(core 1.314 工具面
  *  控制批)。语义:excludeTools=roster 真卸载(schema 字节不上 wire,manifest 如实收窄);deferTools=
- *  [ref] 延迟披露(占位上 wire,ToolSearch 激活 materialize)。两位 tighten-only(core 继承不变量:
+ *  [ref] 延迟披露(占位上 wire,ToolSearch 激活 materialize;**core 7.15.0 [ref] 起它是唯一不受那道
+ *  10% 阈值门的延迟来源** —— 按字面恒延迟、不计量,引擎自选的候选集才受门)。两位 tighten-only(core 继承不变量:
  *  union 进全部子 spawn 路径),per-run 工具面收窄无跨租户面 ⇒ 无租户门(interactiveTools 同姿势)。
  *  DEFENSIVE(resume 重放不过 HTTP 400 门):非数组 ⇒ undefined;项非非空字符串 ⇒ 逐项 DROP;空数组 ⇒
  *  undefined(不挂键=core 缺省,byte-compat)。HTTP 门另有 fail-loud 400(提交面邻居姿势)。 */
@@ -109,7 +110,8 @@ export declare function toolNameListFromBody(raw: unknown): string[] | undefined
  *  **呈现**轴,它与 `deferMode` / `deferTools` 的延迟披露轴**无耦合** —— 上一行提 deferTools 只是在借它
  *  的「无租户门」姿势作类比。「引擎缺省 simple」这句本身在 core 5.40.0 上仍逐字为真
  *  (`core/types.d.ts:133`:default "simple"),本批亲验未变。
- *  真正的 defer 轴对表(core 5.40.0 起 `deferMode:"auto"` 不再 sweep 内建)记在
+ *  真正的 defer 轴对表(core 5.40.0 起 `deferMode:"auto"` 不再 sweep 内建;7.15.0 起它不再是第二道门,
+ *  只是把候选集拓宽后走同一道阈值门)记在
  *  `src/capabilities/tool-defer.ts` 的头注 —— 别把两根轴的结论写到一处。
  *  DEFENSIVE(resume 重放不过 HTTP 400 门):非法值 ⇒ undefined;提交面另有 fail-loud 400(邻居姿势)。 */
 export declare function promptProfileFromBody(raw: unknown): "simple" | "classic" | undefined;

package/dist/task-a2a.js

@@ -1,4 +1,5 @@
-import { resolveComplianceDenies, TOOL_WIRE_NAME_MAX_CHARS } from "@sema-agent/core";
+import { resolveComplianceDenies } from "@sema-agent/core";
+import { isUsableWireName } from "./wire-name-bound.js";
 import { HttpError } from "./security.js";
 export const MAX_REQUEST_A2A_PEERS = 32;
 export function a2aInjectionHonored(config) {
@@ -19,7 +20,7 @@ function normalizeA2aPeer(e) {
     if (!e || typeof e !== "object")
         return null;
     const o = e;
-    if (typeof o.name !== "string" || o.name.length === 0 || o.name.length > TOOL_WIRE_NAME_MAX_CHARS)
+    if (!isUsableWireName(o.name))
         return null;
     if (typeof o.url !== "string" || !HTTP_URL_RE.test(o.url))
         return null;

package/dist/task-mcp.js

@@ -1,4 +1,5 @@
-import { mcpInjectionDroppedNotice, resolveComplianceDenies, TOOL_WIRE_NAME_MAX_CHARS } from "@sema-agent/core";
+import { mcpInjectionDroppedNotice, resolveComplianceDenies } from "@sema-agent/core";
+import { isUsableWireName } from "./wire-name-bound.js";
 import { HttpError } from "./security.js";
 import { CONTENT_ORIGIN_WORDS, describeBadContentOrigin, isContentOriginWord } from "./mcp-content-origin.js";
 import { readMcpSourceLabel } from "./mcp-source-label.js";
@@ -26,7 +27,7 @@ function normalizeServer(e, noteBadOrigin) {
     if (!e || typeof e !== "object")
         return bad("entry");
     const o = e;
-    if (typeof o.name !== "string" || o.name.length === 0 || o.name.length > TOOL_WIRE_NAME_MAX_CHARS)
+    if (!isUsableWireName(o.name))
         return bad("name");
     const t = o.transport;
     if (!t || typeof t !== "object")

package/dist/tool-approval.d.ts

@@ -126,11 +126,16 @@ export interface ToolApprovalFrame {
     requiresRealApproval?: true;
     /**
      * **S-125③/[ref]**(core 7.5.0;**ADDITIVE**,`"tool_approval"` only)—— 这只 ask 的**出身**:
-     * 谁提的这一问,一个 core 闭集词(`ASK_ORIGINS` **11 员**,core 7.9.0 现值:content_question /
-     * unresolvable / org_unavailable / org_rule / rule_store_unavailable / hook / ask_rule /
+     * 谁提的这一问,一个 core 闭集词(`ASK_ORIGINS` **11 员**,core 7.14.0 现值:content_question /
+     * ancestor_marked / org_unavailable / org_rule / rule_store_unavailable / hook / ask_rule /
      * denial_limit_fallback / shell_gate_tighten / safety_tighten / policy)。引擎在门上盖章(core d.ts:
      * 「engine-stamped at the gate, never a policy's claim」),`AskRequest.origin` 逐字透传。
      *
+     * ⚠️ **core 7.14.0 [ref] C2 BREAKING**:`unresolvable` → `ancestor_marked`,**无别名**。server 侧零形变
+     * (本键一直是 `string` 逐字透传),但**消费端的 switch 要改词**;7.14.0 之前 park 下来、行上存着
+     * `unresolvable` 的老记录,在 core 每一道 `isAskOrigin` 筛上自此都是非成员(投影处不回显 ⇒ 本键缺席),
+     * 而那一行的 `org` 事实不受影响。
+     *
      * 🔴 **echo-only,零消费**:自动车道的资格判据全在 core(`classifierMayAnswer` 的闭表),server
      * **不许**据本键自铸第二张资格表 —— 那是同一语义面两个写者(源头修复纪律),与
      * `denialLimitFallback` 顶注那条「不据 autoDenyAfterMs 自铸第二只定时器」同一条禁令。
@@ -144,26 +149,26 @@ export interface ToolApprovalFrame {
      */
     origin?: string;
     /**
-     * **S-185 / [ref]**(core 7.10.0;**ADDITIVE**,`"tool_approval"` only)—— 这一问**为什么**到了人手上:
-     * 分类器被咨询过、而它**跑不了**。`cause` = core 的闭集词
-     * (`AUTO_MODE_UNAVAILABLE_CAUSES`;core 7.12.0 起 = `error` / `timeout`),`AskRequest.classifierUnavailable`
-     * 逐字透传。core 7.12.0 / [ref] 起 ask 上这一位只由**策略层自声明**铸(引擎自己的那份改骑 deny —— 全文
-     * 在 `approval-card.ts` 同名键的顶注)。
-     *
-     * 🔴 **缺席 ≠「分类器好着呢」**:缺席同时覆盖三形 —— 分类器答上了 / 这只 ask 没资格走分类器
-     * (`classifierMayAnswer` 的闭表)/ 本部署压根没接分类器。消费端**禁**把缺席读成对分类器健康的断言。
-     * 另注:`parse_error`(分类器跑了但答得出格)**不盖这一位** —— 那是另一句话,core 顶注逐字。
-     *
-     * 🔴 **不枚举词表**(值形是 `{cause: string}` 而不是本仓自铸的联合):词表单一属主在 core,抄一份会把
-     * core 加的新词吞成缺席。窄读只判「对象 ∧ `cause` 非空串 ∧ 无多余成员」(`readClassifierUnavailable`,
-     * 帧与卡的**唯一**铸造点 ⇒ 两面结构性同值)。
-     *
-     * 🔴 **echo-only,零消费**:熔断/超时的处置全在 core 的分类器站,server 不许据本键自铸第二套回落判据
-     * —— 同 `origin` / `denialLimitFallback` 两条顶注的同一条禁令(同一语义面两个写者)。
+     * **[ref] C3**(core 7.14.0;**ADDITIVE**,`"tool_approval"` only)—— `origin: "rule_store_unavailable"`
+     * 的**机制判别位**:持久规则车道这一次**读不下来的是哪一半**。core 闭二词
+     * (`RULE_STORE_UNREADABLE_KINDS`):`"store"` = 接上的规则店读不了(读失败 / 超时);`"call"` = 店读到了,
+     * 但**这条命令**按人的 deny/ask 行读不出来(收紧 lexer 的 `unreadable`:展开里含规则词、引号没闭、语法
+     * 错——具体那句在 `message` 里)。`AskRequest.ruleStoreUnreadable` 逐字透传。
+     *
+     * 🔴 **在场 ⇔ `origin === "rule_store_unavailable"`**(core 顶注逐字)。两词对审批人是两件事:`store`
+     * 指向「去看规则店 / 网络」,`call` 指向「这条命令的写法让规则判不了」——一个 origin 词对这两件事同形。
+     * 缺席 = 车道把店和这条命令都读通了,**或**本部署没接规则车道;消费端禁把缺席读成对规则店健康的断言。
+     *
+     * 🔴 **不枚举词表**(值形是 `string` 而不是本仓自铸的联合):词表单一属主在 core
+     * (`isRuleStoreUnreadable` 是它的成员判),抄一份会把 core 加的新词吞成缺席 —— 与 {@link origin} 逐字同规。
+     *
+     * 🔴 **echo-only,零消费**:策略自声明的值在 core 的**唯一**盖章点就被抹掉了,server 不重算、不再筛第二遍,
+     * 更不许据本键自铸第二张车道资格表 —— 同 `origin` / `denialLimitFallback` 两条顶注的同一条禁令。
+     *
+     * ⚰️ 本键的前任 `classifierUnavailable`(S-185 / [ref])随 core 7.14.0 [ref] **整族退役**:引擎那份事实改骑
+     * `GateDisposition.denied.cause`(`tool_end.gate` / `permissionDenied.gate`),ask 面自此没有这一位。
      */
-    classifierUnavailable?: {
-        cause: string;
-    };
+    ruleStoreUnreadable?: string;
     /**
      * **E-14**([ref]② Trojan Source 族;**ADDITIVE**,`"tool_approval"` only)—— 这只 ask 的**工具输入**
      * (`AskRequest.args`)里含 bidi 控制符(LRM/RLM、嵌入/覆写、隔离符;字符类属主 `text-bidi.ts`)。

package/dist/tool-approval.js

@@ -8,7 +8,7 @@ import { approvalPayloadFingerprint } from "./plugins/approval-payload-fingerpri
 import { createLogger } from "./observability/logger.js";
 import { recordFailOpen } from "./observability/fail-open.js";
 import { deriveAskId, deriveBatchId, MAX_DECISION_NOTE_CHARS } from "./approval-ask-machine.js";
-import { ApprovalCardEnvelopeSchema, MAX_RULE_OFFERS, buildApprovalCard, buildApprovalCardEnvelope, buildApprovalRequestFrame, buildRevokeFrame, readDenialLimitFallback, readClassifierUnavailable, readProbeCause, readRuleEvidence, readRuleOffersAbsence, RuleOfferRawSchema, backfillLegacyBatchMemberKind, screenUncoveredDetailSeat, } from "./approval-card.js";
+import { ApprovalCardEnvelopeSchema, MAX_RULE_OFFERS, buildApprovalCard, buildApprovalCardEnvelope, buildApprovalRequestFrame, buildRevokeFrame, readDenialLimitFallback, readProbeCause, readRuleEvidence, readRuleOffersAbsence, RuleOfferRawSchema, backfillLegacyBatchMemberKind, screenUncoveredDetailSeat, } from "./approval-card.js";
 import { projectAskTerminalClaimTruth } from "./plugins/approval-ask-store-sql.js";
 import { governanceAskMarksFor, runWithGovernanceAskScope } from "./governance-ask-marks.js";
 const defaultLogger = createLogger();
@@ -844,7 +844,7 @@ export class ToolApprovalCoordinator {
             ...(ruleLaneMaterial !== undefined ? { ruleOffers: ruleLaneMaterial.offers } : {}),
             ...((a) => (a !== undefined ? { ruleOffersAbsence: a } : {}))(readRuleOffersAbsence(req)),
             ...((f) => (f !== undefined ? { denialLimitFallback: f } : {}))(readDenialLimitFallback(req)),
-            ...((c) => (c !== undefined ? { classifierUnavailable: c } : {}))(readClassifierUnavailable(req)),
+            ...(typeof req.ruleStoreUnreadable === "string" && req.ruleStoreUnreadable.length > 0 ? { ruleStoreUnreadable: req.ruleStoreUnreadable } : {}),
             ...((c) => (c !== undefined ? { probeCause: c } : {}))(readProbeCause(req)),
             ...((c) => (c !== undefined ? { ruleEvidence: c } : {}))(readRuleEvidence(req)),
             ...(bounded.omitted ? { argsOmitted: true } : { args: bounded.args }),

package/dist/trace/core-keyset-guard.d.ts

@@ -17,7 +17,7 @@
  * ⑨⑩([ref],2026-08-31)把两个最大的 wire 面也纳入:TaskSpec 按「server 有无写点」记 Wired/Unwired,
  * TaskResult 按「转发/摘除」记 Forwarded/Stripped —— 谁改 resolve-spec.ts / runs.ts 的发射点谁同步本文件。
  */
-import type { TaskNotificationPayload, SemaProvenance, BackgroundChildEvent, RosterEntry, AskRequest, CheckpointSummary, TaskEvent, TraceEvent, MailboxMessage, MailboxAppendMessage, TaskSpec, TaskResult, WiringManifest, GateOutcome, Settlement, PausedCause } from "@sema-agent/core";
+import type { TaskNotificationPayload, SemaProvenance, BackgroundChildEvent, RosterEntry, AskRequest, CheckpointSummary, TaskEvent, TraceEvent, MailboxMessage, MailboxAppendMessage, TaskSpec, TaskResult, WiringManifest, GateOutcome, GateDisposition, Settlement, PausedCause, WorkflowRun } from "@sema-agent/core";
 import type { ToolApprovalFrame } from "../tool-approval.js";
 /** 编译期断言:T 必须收敛到 never(有残余键 = tsc 红)。
  *  🔴 **导出**([ref] U1/U2):本仓「词表闭集,未处置成员=编译红」的钉法只许有**一个**形 ——
@@ -43,7 +43,7 @@ type _GuardBgNotifReverse = AssertAllKeysHandled<Exclude<BgNotifProjected | BgNo
 type RosterProjected = "name" | "agentId" | "sessionId" | "toolUseId" | "owner" | "scope" | "sessionScoped" | "rootSessionId" | "model" | "modelFallback" | "createdAt";
 type _GuardRoster = AssertAllKeysHandled<Exclude<keyof RosterEntry, RosterProjected>>;
 type _GuardRosterReverse = AssertAllKeysHandled<Exclude<RosterProjected, keyof RosterEntry>>;
-type AskProjected = "toolName" | "toolCallId" | "args" | "message" | "sourceTaskId" | "fromSubagent" | "sourceAgentName" | "delegation" | "ruleOffers" | "ruleOffersAbsence" | "persistedRuleShadowed" | "probeCause" | "ruleEvidence" | "requiresRealApproval" | "denialLimitFallback" | "origin" | "classifierUnavailable";
+type AskProjected = "toolName" | "toolCallId" | "args" | "message" | "sourceTaskId" | "fromSubagent" | "sourceAgentName" | "delegation" | "ruleOffers" | "ruleOffersAbsence" | "persistedRuleShadowed" | "probeCause" | "ruleEvidence" | "requiresRealApproval" | "denialLimitFallback" | "origin" | "ruleStoreUnreadable";
 type AskExcluded = "preview" | "principal" | "riskAxes" | "boundInputHash" | "isDelegatedChild" | "probeReason" | "hasBidiControls" | "previewWithheld" | "execCwd";
 type _GuardAsk = AssertAllKeysHandled<Exclude<keyof AskRequest, AskProjected | AskExcluded>>;
 type _GuardAskReverse = AssertAllKeysHandled<Exclude<AskProjected | AskExcluded, keyof AskRequest>>;
@@ -103,7 +103,7 @@ type _GuardWiringRulesReverse = AssertAllKeysHandled<Exclude<WiringRulesHandled,
 type WiringModelGateHandled = "class" | "removed" | "restore";
 type _GuardWiringModelGate = AssertAllKeysHandled<Exclude<keyof WiringSection<"modelGate">, WiringModelGateHandled>>;
 type _GuardWiringModelGateReverse = AssertAllKeysHandled<Exclude<WiringModelGateHandled, keyof WiringSection<"modelGate">>>;
-type WiringAutoModeHandled = "armed" | "reason";
+type WiringAutoModeHandled = "armed" | "reason" | "deniedSource";
 type _GuardWiringAutoMode = AssertAllKeysHandled<Exclude<keyof WiringSection<"autoMode">, WiringAutoModeHandled>>;
 type _GuardWiringAutoModeReverse = AssertAllKeysHandled<Exclude<WiringAutoModeHandled, keyof WiringSection<"autoMode">>>;
 type WiringGovernanceHandled = "audience" | "lockedConfig" | "compliance" | "memoryAdmission" | "retention";
@@ -117,7 +117,7 @@ type _GuardPermissionTraceReverse = AssertAllKeysHandled<Exclude<PermissionTrace
 /** `T` 非 `never` 时收敛到 `never`(空集 ⇒ 残留 `"EMPTY"` ⇒ tsc 红)。 */
 type AssertNonEmpty<T> = [T] extends [never] ? "EMPTY" : never;
 type _GuardPermissionTraceNonEmpty = AssertAllKeysHandled<AssertNonEmpty<PermissionTraceKind>>;
-type SummaryProjected = "sessionId" | "scope" | "createdAt" | "gateKind" | "severity" | "spentMicroUsd" | "deadline" | "hasBidiControls" | "requiresRealApproval" | "denialLimitFallback" | "origin" | "classifierUnavailable";
+type SummaryProjected = "sessionId" | "scope" | "createdAt" | "gateKind" | "severity" | "spentMicroUsd" | "deadline" | "hasBidiControls" | "requiresRealApproval" | "denialLimitFallback" | "origin" | "ruleStoreUnreadable";
 type SummaryExcluded = "token" | "toolInput" | "toolName" | "toolCallId" | "preview" | "principal" | "sourceTaskId" | "contentKind" | "restoreMode" | "checkpointId" | "previewWithheld";
 type _GuardInboxSummary = AssertAllKeysHandled<Exclude<keyof CheckpointSummary, SummaryProjected | SummaryExcluded>>;
 type _GuardInboxSummaryReverse = AssertAllKeysHandled<Exclude<SummaryProjected | SummaryExcluded, keyof CheckpointSummary>>;
@@ -138,12 +138,20 @@ type SettlementWhoKeys = Settlement["who"] extends infer W ? (W extends object ?
 type GateOutcomeProjected = "disposition" | "settlement" | "origin";
 type _GuardGateOutcome = AssertAllKeysHandled<Exclude<keyof GateOutcome, GateOutcomeProjected>>;
 type _GuardGateOutcomeReverse = AssertAllKeysHandled<Exclude<GateOutcomeProjected, keyof GateOutcome>>;
+type GateDispositionKeys = GateDisposition extends infer D ? (D extends object ? keyof D : never) : never;
+type GateDispositionProjected = "kind" | "deniedBy" | "cause";
+type _GuardGateDisposition = AssertAllKeysHandled<Exclude<GateDispositionKeys, GateDispositionProjected>>;
+type _GuardGateDispositionReverse = AssertAllKeysHandled<Exclude<GateDispositionProjected, GateDispositionKeys>>;
 type SettlementProjected = "kind" | "who" | "when" | "note";
 type _GuardSettlement = AssertAllKeysHandled<Exclude<SettlementKeys, SettlementProjected>>;
 type _GuardSettlementReverse = AssertAllKeysHandled<Exclude<SettlementProjected, SettlementKeys>>;
 type SettlementWhoProjected = "party" | "approver" | "window";
 type _GuardSettlementWho = AssertAllKeysHandled<Exclude<SettlementWhoKeys, SettlementWhoProjected>>;
 type _GuardSettlementWhoReverse = AssertAllKeysHandled<Exclude<SettlementWhoProjected, SettlementWhoKeys>>;
+type WorkflowRunForwarded = "id" | "scope" | "status" | "startedAt" | "endedAt" | "createdAt" | "rev" | "name" | "description" | "result" | "error" | "errorCode" | "agentFailures" | "stats" | "phases" | "agents" | "groups";
+type WorkflowRunStripped = "sourceTaskId" | "originatingSessionId" | "effectiveArgs" | "budgetOvershoot" | "timeoutInterruption" | "resultFull" | "completionId" | "resume" | "journalSkips";
+type _GuardWorkflowRun = AssertAllKeysHandled<Exclude<keyof WorkflowRun, WorkflowRunForwarded | WorkflowRunStripped>>;
+type _GuardWorkflowRunReverse = AssertAllKeysHandled<Exclude<WorkflowRunForwarded | WorkflowRunStripped, keyof WorkflowRun>>;
 export type CoreKeysetGuards = [
     _GuardNotification,
     _GuardNotificationReverse,
@@ -208,10 +216,14 @@ export type CoreKeysetGuards = [
     _GuardPausedCauseReverse,
     _GuardGateOutcome,
     _GuardGateOutcomeReverse,
+    _GuardGateDisposition,
+    _GuardGateDispositionReverse,
     _GuardSettlement,
     _GuardSettlementReverse,
     _GuardSettlementWho,
-    _GuardSettlementWhoReverse
+    _GuardSettlementWhoReverse,
+    _GuardWorkflowRun,
+    _GuardWorkflowRunReverse
 ];
 export {};
 //# sourceMappingURL=core-keyset-guard.d.ts.map

package/dist/trace/project.d.ts

@@ -119,7 +119,62 @@ export declare function toolStartEventData(ev: {
     eventId?: string;
     parentToolCallId?: string;
 }): Record<string, unknown>;
+/**
+ * 🔴 **筛子是一只总函数**(S-239,codex 对抗复审 r1 [medium] 亲核复现后修)—— 上面纪律②许诺的
+ * 「坏形 ⇒ report + withhold,**不抛**」此前是靠**逐条枚举**坏形兑现的,枚举不到的那些照样抛:
+ * `projectSettlement` 对 `note` / `who.approver` 先 `redactSecrets` 再截断,而 `redactSecrets` 在 ≥2^23
+ * 的单段上爆回溯栈(`RangeError`,S-102/S-106 登记的既有上界,见 `redact.ts` 该行顶注),两条叶各能抛一次。
+ *
+ * 抛出去的代价按腿算,而且一条比一条重:写腿落账那处的 `.catch` 看不到**同步**投影期的异常;读腿上它
+ * 直接逃出 `formatEvent` / 投影函数 —— 账本裸回放腿的那一次会当场断流(那一行不上帧、游标不前进、后面的
+ * `done` 永远到不了、重连恒复现同一处),而 `gate-outcome-defective` 那一格还不涨。
+ *
+ * ⇒ 兑现方式从「枚举」换成**结构**:任何逃出投影的异常同走既有的那一口 report + withhold。规则因此变少
+ * (不是「守住已知的 N 种坏形」而是「坏字节一律 withhold」),上面那几道具名形门留着只为**诊断串更准**。
+ * ⛔ **刻意不动**「先脱敏后截断」的次序:截断在前会把跨界的密钥切成半截明文留在输出里,而且它只治
+ * `note` 一条叶(`approver` 同病)—— 那是给一个类打两个特判,正是本仓要消掉的形。
+ */
 export declare function screenedGate(v: unknown): GateOutcome | undefined;
+/**
+ * 🔴 **耐久行的**门记录读口(7.72.0;`screenedGate` 的读腿孪生)—— 先把本仓自己写过的**旧拼法**读成它
+ * 今天的名字({@link RETIRED_ASK_ORIGIN_SPELLINGS}),再走与写腿**同一只**筛子。
+ *
+ * 为什么读腿要多这一步而写腿不要:读到的字节可能是**本仓上一个版本**写下的(账本回放、park 行的
+ * `resolvedOutcome`),而 core 7.14.0 [ref] C2 把 `ASK_ORIGINS` 的一个词改了名 —— 不认旧拼法,那些行就整条
+ * withhold,连 `disposition` / `settlement`(谁拒的、人怎么结的)一起在回放面上消失。写腿面对的则是**当下**
+ * 引擎铸的记录,它铸不出退役词,所以那里出现退役词 = producer 契约漂了 = 要 report + withhold 的事。
+ *
+ * 不改原对象(调用方与账本共享引用):归一时换一只信封,原记录一个字节不动。
+ */
+export declare function screenedStoredGate(v: unknown): GateOutcome | undefined;
+/**
+ * 🔴 **账本裸回放面的读腿一步**(S-239)—— `GET /v1/runs/:id/events`(`http/routes/runs.ts` 的
+ * `formatEvent`)对每一行走这一口,把行上的 `GateOutcome` 交给**同一只** {@link screenedStoredGate}。
+ *
+ * ## 它补的是哪一格
+ * 7.72.0 把耐久读边界收成一只筛子,但点名的读腿只有两条({@link toolResultFieldsOf} 的投影回放、
+ * `/decide` 幂等回放体)。**账本裸回放**是第三条,而它此前只过 `redactLedgerEventData` —— 那只函数
+ * 对 `tool_end` 型**逐字不动**(它管的是 `done.result` / `failed.errorMessage` / park 行三族)。
+ * 于是同一条账本行在本仓三张读面上有**两种**读法:
+ *  · 本仓 7.64.0–7.71.0 自己写下的 `origin:"unresolvable"` —— 投影面读成今天的名字,裸回放面原样
+ *    透出一个 core 今天判**非成员**的词(消费端按闭集分派 ⇒ 落进它的 default 臂);
+ *  · 第三方 producer / 坏世代写下的集外词与破不变量的记录 —— 投影面整条 withhold + 计数,裸回放面
+ *    直接上 wire,而 `gate-outcome-defective` 那一格不涨(运维看不见有 producer 在发坏记录)。
+ *
+ * ## 为什么是这一形(而不是在路由里加一只筛)
+ * 筛子仍然只有一只,归一表仍然只有一张 —— 本函数只是把**第三条读腿**接到它上面,规则因此从
+ * 「三条读腿里有两条筛」回到「凡耐久读腿上的 `GateOutcome` 一律过 `screenedStoredGate`,零例外」。
+ * 它按**型**分派而不是按调用点,所以将来第二个携带 `GateOutcome` 的账本型只需把
+ * {@link GATE_BEARING_LEDGER_EVENT_TYPE} 扩成词表,读腿一行都不用改。
+ *
+ * ## 与写腿的关系(别再走回头路)
+ * 写腿的对偶是 `redactLedgerEventData`(三孪生 store 的 `appendEvent` 落库前),它**不该**长出本函数
+ * 这一步:归一只认读腿,写腿保持严格(理由全文见 {@link RETIRED_ASK_ORIGIN_SPELLINGS} 的边界划清二)。
+ * 两只函数因此是「共用的脱敏汇点 + 读腿独有的筛」这一层关系,不是同一只函数的两种模式。
+ *
+ * 不改原对象(调用方与账本共享引用):有变更时换一只信封,原记录一个字节不动。
+ */
+export declare function screenedStoredEventData(type: string, data: unknown): unknown;
 /** The durable `tool_end` payload (shared by both append sites). E1: the model-facing `output` is UNTRUSTED RAW
  *  from core (file/shell/API bodies) — core only SIZE-bounds it (`truncated`), REDACTION is ours (same contract as
  *  `tool_start.args`); never re-fed to a model. E2: identity. Absent `output` ⇒ the tool produced no content body.

package/dist/trace/project.js

@@ -86,7 +86,19 @@ export function toolStartEventData(ev) {
     return { toolCallId: ev.toolCallId, toolName: ev.toolName, ...(ev.label !== undefined ? { label: ev.label } : {}), args: redactDeep(ev.args), ...identityFields(ev) };
 }
 const SETTLEMENT_NOTE_MAX = 500;
+const RETIRED_ASK_ORIGIN_SPELLINGS = {
+    unresolvable: "ancestor_marked",
+};
 export function screenedGate(v) {
+    try {
+        return screenedGateOrThrow(v);
+    }
+    catch (e) {
+        recordFailOpen("server.trace.gate-outcome-defective", `projection threw: ${e instanceof Error ? `${e.name}: ${e.message}` : "non-Error throw"}`);
+        return undefined;
+    }
+}
+function screenedGateOrThrow(v) {
     if (v === null || typeof v !== "object")
         return undefined;
     const g = v;
@@ -96,6 +108,7 @@ export function screenedGate(v) {
         return undefined;
     }
     const shapeDefect = (d.kind === "denied" && typeof d.deniedBy !== "string" && "disposition.deniedBy is not a string") ||
+        (d.kind === "denied" && d.cause !== undefined && typeof d.cause !== "string" && "disposition.cause is not a string") ||
         (g.settlement !== undefined && (g.settlement === null || typeof g.settlement !== "object") && "settlement is not an object") ||
         (g.settlement !== undefined && g.settlement !== null && typeof g.settlement.kind !== "string" && "settlement.kind is not a string") ||
         (g.origin !== undefined && typeof g.origin !== "string" && "origin is not a string") ||
@@ -115,11 +128,37 @@ export function screenedGate(v) {
         return undefined;
     }
     return {
-        disposition: d.kind === "denied" ? { kind: "denied", deniedBy: d.deniedBy } : { kind: "allowed" },
+        disposition: d.kind === "denied"
+            ? { kind: "denied", deniedBy: d.deniedBy, ...(d.cause === undefined ? {} : { cause: d.cause }) }
+            : { kind: "allowed" },
         ...(settlement === undefined ? {} : { settlement }),
         ...(g.origin === undefined ? {} : { origin: g.origin }),
     };
 }
+export function screenedStoredGate(v) {
+    if (v === null || typeof v !== "object")
+        return undefined;
+    const g = v;
+    const renamed = typeof g.origin === "string" ? RETIRED_ASK_ORIGIN_SPELLINGS[g.origin] : undefined;
+    return screenedGate(renamed === undefined ? g : { ...g, origin: renamed });
+}
+const GATE_BEARING_LEDGER_EVENT_TYPE = "tool_end";
+export function screenedStoredEventData(type, data) {
+    if (type !== GATE_BEARING_LEDGER_EVENT_TYPE)
+        return data;
+    if (data === null || typeof data !== "object" || Array.isArray(data))
+        return data;
+    const d = data;
+    if (d.gate === undefined)
+        return data;
+    const gate = screenedStoredGate(d.gate);
+    if (gate === undefined) {
+        const withheld = { ...d };
+        delete withheld.gate;
+        return withheld;
+    }
+    return { ...d, gate };
+}
 const SETTLEMENT_PARTIES = new Set(["person", "engine", "host", "none"]);
 function projectSettlement(st) {
     const whoV = st.who;
@@ -329,7 +368,10 @@ export function wiringManifestEventData(ev) {
         const reason = str(autoIn.reason);
         if (armed === undefined || reason === undefined)
             return undefined;
-        return armed === (reason === "armed") ? { armed, reason } : undefined;
+        if (armed !== (reason === "armed"))
+            return undefined;
+        const deniedSource = str(autoIn.deniedSource);
+        return { armed, reason, ...(deniedSource === undefined ? {} : { deniedSource }) };
     })();
     const toolsIn = m.tools;
     const tools = toolsIn === undefined ? undefined : Value.Check(ToolRoster, toolsIn) ? toolsIn : (recordFailOpen("server.trace.tool-roster-malformed", "wiring_manifest.tools did not fit core ToolRoster"), undefined);
@@ -514,7 +556,7 @@ export function toolCallFieldsOf(d) {
     };
 }
 export function toolResultFieldsOf(d) {
-    const gate = d.gate === undefined ? undefined : screenedGate(d.gate);
+    const gate = d.gate === undefined ? undefined : screenedStoredGate(d.gate);
     return {
         callId: String(d.toolCallId ?? ""),
         ...(typeof d.label === "string" ? { label: d.label } : {}),

package/dist/usage-analytics.d.ts

@@ -26,6 +26,11 @@ export interface UsageRow {
     stats?: {
         tokens?: number;
         modelUsage?: Record<string, UsageModelEntry>;
+        /** core 7.14.0 [ref] C-b(`TaskResult.stats.usageMissing`):这一行的用量数字是**下界**不是测量值
+         *  —— 至少有一轮模型没报用量,或整条结果是宿主/编排车道自铸的(一个模型轮都没跑过)。
+         *  `true` 或缺席,**永不 `false`**;缺席 ⇔ 每轮都报了用量。fold 侧翻成既有的
+         *  {@link UsageTotals.estimated}(见 `foldRow`),**不开第二条不精确轴**。 */
+        usageMissing?: true;
     };
 }
 /**
@@ -57,17 +62,30 @@ export interface UsageTotals {
      *  ②有 per-model echo 行**缺数值键**(该键按 0 计入,总量偏低;成本键缺席时尤其:少算 ≠ 免费);
      *  ③(S10/V2-⑤)有行的 {@link UsageModelEntry.usageBasis} 缺席或非本读端认识的分量制——存量行某族
      *  历史上把 cache 计入 inputTokens,tokensIn 求和会**双算**,口径不可分辨。
-     *  三者都只表达「别把这个总数当精确值」,消费端一视同仁。 */
+     *  ④(7.72.0 / core 7.14.0 [ref] C-b)有行自陈 `stats.usageMissing` —— 那一行的数字是**下界**:至少一轮
+   *  模型没报用量,或整条结果是宿主自铸的零结果(取消打断 / 零执行的治理拒绝)。`tokens: 0` 在那种行上读作
+   *  「未知」而不是「免费」。
+   *  四者都只表达「别把这个总数当精确值」,消费端一视同仁。 */
     estimated: boolean;
 }
 /** GET /v1/usage/summary — 窗内总量。 */
 export declare function usageSummary(rows: UsageRow[]): UsageTotals;
 export type UsageMetric = "tasks" | "tokensIn" | "tokensOut" | "costUsd";
 export type UsageGranularity = "hour" | "day";
-/** GET /v1/usage/series — 时间序列(UTC 桶;空桶不发行,消费方按需补零)。 */
+/**
+ * GET /v1/usage/series — 时间序列(UTC 桶;空桶不发行,消费方按需补零)。
+ *
+ * 🔴 **行带 `estimated`**(S-228):与 {@link usageSummary} / {@link usageBreakdown} **同轴同谓词** ——
+ * 三个读面的桶都是同一只 {@link UsageTotals},由同一条 {@link foldRow} 折出来,所以「这个数字不精确」
+ * 的四个来源(旧行 fallback / per-model echo 缺键 / 缺 `usageBasis` 的 legacy 口径 / 行自陈
+ * `usageMissing` 的下界)在三面上是**同一句话**。修前只有 series 的出口把这一位扔了:桶里塞进一条
+ * 「没量到」的行,折线与一段真的低消耗在 wire 上逐字同形 —— 而那两件事的处置相反。
+ * 不新开判据、不加第二条轴:出口多投一个已经算好的位。
+ */
 export declare function usageSeries(rows: UsageRow[], metric: UsageMetric, granularity: UsageGranularity): Array<{
     t: string;
     v: number;
+    estimated: boolean;
 }>;
 export type UsageDimension = "principal" | "model";
 /** GET /v1/usage/breakdown — 按维度分桶。dimension=model 时按 per-model echo 展开(一行可贡献多个 model 桶;

package/dist/usage-analytics.js

@@ -17,8 +17,13 @@ function foldModelEntry(t, d) {
     if (d.usageBasis !== "uncached-components-v1")
         t.estimated = true;
 }
+function markRowLowerBound(t, row) {
+    if (row.stats?.usageMissing === true)
+        t.estimated = true;
+}
 function foldRow(t, row) {
     t.tasks += 1;
+    markRowLowerBound(t, row);
     const mu = row.stats?.modelUsage;
     if (mu && Object.keys(mu).length > 0) {
         for (const d of Object.values(mu))
@@ -49,7 +54,7 @@ export function usageSeries(rows, metric, granularity) {
     }
     return [...buckets.entries()]
         .sort((a, b) => a[0] - b[0])
-        .map(([b, t]) => ({ t: new Date(b).toISOString(), v: metric === "costUsd" ? round6(t.costUsd) : t[metric] }));
+        .map(([b, t]) => ({ t: new Date(b).toISOString(), v: metric === "costUsd" ? round6(t.costUsd) : t[metric], estimated: t.estimated }));
 }
 export function usageBreakdown(rows, dimension) {
     const buckets = new Map();
@@ -70,6 +75,7 @@ export function usageBreakdown(rows, dimension) {
                 const t = bucket(model);
                 t.tasks += 1;
                 foldModelEntry(t, d);
+                markRowLowerBound(t, r);
             }
         }
         else {
@@ -92,6 +98,8 @@ export function projectUsageStats(result) {
         const mu = stats.modelUsage;
         if (mu && typeof mu === "object" && !Array.isArray(mu))
             out.modelUsage = mu;
+        if (stats.usageMissing === true)
+            out.usageMissing = true;
         return out;
     }
     catch {

package/dist/wire-name-bound.d.ts

@@ -0,0 +1,14 @@
+/**
+ * 这个申报名能用吗 —— 四个收口共用的**那一只**谓词。
+ *
+ * 严判:非串、空串、超 `TOOL_WIRE_NAME_MAX_CHARS` 一律不可用。本层不做截断/规范化 —— 截短一个名字
+ * 就是**换一个身份**(core 自己 7.13.0 起正是为此把截断改成拒),而被换掉身份的那台 server 上挂的
+ * allowTools / toolFaces 收窄声明会一起对不上号。
+ */
+export declare function isUsableWireName(v: unknown): v is string;
+/**
+ * 坏名的**可打印**摘要(进 warn 元数据)——中和 + 截长,绝不把任意长度的申报串原样回显进日志。
+ * 长度如实带上:运维要的是「我那个名字长了多少」,不是一屏乱码。
+ */
+export declare function describeBadWireName(v: unknown): string;
+//# sourceMappingURL=wire-name-bound.d.ts.map

package/dist/wire-name-bound.js

@@ -0,0 +1,13 @@
+import { TOOL_WIRE_NAME_MAX_CHARS } from "@sema-agent/core";
+export function isUsableWireName(v) {
+    return typeof v === "string" && v.length > 0 && v.length <= TOOL_WIRE_NAME_MAX_CHARS;
+}
+export function describeBadWireName(v) {
+    if (typeof v !== "string")
+        return v === null ? "null" : Array.isArray(v) ? "array" : typeof v;
+    if (v.length === 0)
+        return "empty";
+    const head = v.length > 32 ? `${JSON.stringify(v.slice(0, 32))}…` : JSON.stringify(v);
+    return `${head} (${v.length} chars > ${TOOL_WIRE_NAME_MAX_CHARS})`;
+}
+//# sourceMappingURL=wire-name-bound.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/server",
-  "version": "7.71.0",
+  "version": "7.73.0",
   "description": "Sema Server — the server/API implementation layer for Sema, wiring core, registry, model providers, and cloud agent execution. Built on @sema-agent/core.",
   "type": "module",
   "license": "BUSL-1.1",
@@ -54,7 +54,7 @@
     "build:binary:run-local:darwin-arm64": "bun build --compile --target=bun-darwin-arm64 src/run-local.ts --outfile dist/run-local-darwin-arm64"
   },
   "dependencies": {
-    "@sema-agent/core": "7.13.0",
+    "@sema-agent/core": "7.16.0",
     "@sema-agent/settings-schema": "1.10.0",
     "e2b": "^2.28.0",
     "libsodium-wrappers": "^0.8.4",