@sema-agent/server 7.92.2 → 7.93.0

package/dist/http/wire-types.d.ts

@@ -6,7 +6,7 @@
  * cut: ONLY TaskRequestBody (its field types are inline or core imports — no other server.ts-local satellites);
  * sibling request/response shapes can migrate here later on the same pattern.
  */
-import type { A2aServerSpec, AgentDefinition, McpServerSpec, SkillSpec } from "@sema-agent/core";
+import type { A2aServerSpec, AgentDefinition, ApproverPosture, McpServerSpec, SkillSpec } from "@sema-agent/core";
 import type { SettingsPermissionMode } from "../task-settings.js";
 import type { wiringManifestFaceEventData } from "../trace/project.js";
 export interface TaskRequestBody {
@@ -316,6 +316,22 @@ export interface TaskRequestBody {
      *  `SETTINGS_PERMISSION_MODES`(受理腿 `isSettingsPermissionMode` 与两句 400 文案同读那一份)。
      *  改前这里是第 6 份手抄的五词联合 —— 加/退一个模式时 wire 型面与受理腿会各走各的。 */
     permissionMode?: SettingsPermissionMode;
+    /**
+     * **#1000**(core 7.26.0 `TaskSpec.approverPosture`;CC-116 装配口)—— 宿主对这个 run 的**审批姿态声明**:
+     * 「这些卡由我自己自动答」。一个词(`"bypass"`),闭集属主在 core(`ApproverPosture` / `APPROVER_POSTURES`)。
+     *
+     * 🔴 **它不授权任何东西,也不是一只门**(core 头注逐字:"a statement about who answers this run's approval
+     * cards, never an instruction to the gate";引擎只把它**渲**给模型,没有任何裁决腿读它)。所以它与
+     * {@link permissionMode} 的 `"bypassPermissions"` **不是**一回事,也不能互相派生:后者选的是**门的形状**
+     * (且只能收紧、deny-wins),前者只说「谁来答卡」。两者在语义上同族,声明它而不开 `bypassPermissions`
+     * 只是对模型说了一句与实际不符的话 —— 见契约文档那一段的「谁受伤」。
+     *
+     * 🔴 **本仓零判据、原样过境**(`boot/resolve-spec.ts` 写点):词的拒绝逻辑属引擎
+     * (`refuseInvalidApproverPosture` 响亮拒一个不认识的词),server **不加第二道门** —— 在下游再判一次就是
+     * 同一语义面的第二个判官(源头修复纪律 [ref]),而且本仓抄一份词表的那天 core 加第二个词就会被静默 400 掉。
+     * 型也从 core 的 `ApproverPosture` 派生(不抄字面联合)。
+     */
+    approverPosture?: ApproverPosture;
     /** MF-30 memory PAUSE (shell-host contract, option B per-request — clay 2026-06-27): `false` makes THIS run
      *  read-only over long-term memory (`TaskSpec.memory.writeScope:null` — the [ref] memory ENGINE materializes/
      *  reads but its harvest commits nothing). Absent/`true` ⇒ normal read+write. The shell's `/memory` pause carries

package/dist/observability/metrics.js

@@ -1,5 +1,6 @@
 import { DENIED_BY_VALUES } from "@sema-agent/core";
 import { buildPermissionRuleEventsHelp } from "./permission-rule-events.js";
+import { MCP_PROBE_OUTCOMES } from "../capabilities/mcp-probe.js";
 const DEFAULT_BUCKETS = [0.05, 0.1, 0.25, 0.5, 1, 2.5, 5, 10, 30, 60];
 function labelKey(labels) {
     return Object.keys(labels)
@@ -214,6 +215,7 @@ export function createMetrics() {
     m.counter("http_requests_total", "HTTP requests by route/method/status");
     m.histogram("http_request_duration_seconds", "HTTP request duration");
     m.counter("rate_limited_total", "Requests rejected by the rate limiter");
+    m.counter("mcp_probe_total", `No-run MCP status face outcomes by outcome (${MCP_PROBE_OUTCOMES.join("/")} — see src/capabilities/mcp-probe.ts MCP_PROBE_OUTCOMES; rate_limited has TWO causes: the per-identity fixed window AND the replica-wide in-flight cap, which can refuse caller B because of caller A)`);
     m.counter("tasks_total", "Finished tasks by terminal status");
     m.counter("task_tokens_total", "Total model tokens consumed by tasks");
     m.histogram("task_duration_seconds", "Async run wall-clock duration");

package/dist/permission-rule-vocab.d.ts

@@ -1,4 +1,4 @@
-import type { RemoveResult, RuleApprovalRecord, RuleBehavior } from "@sema-agent/core";
+import type { RuleApprovalRecord, RuleBehavior } from "@sema-agent/core";
 /**
  * `PersistedRuleTool` **不再是闭词表**(core 7.9.0 / [ref]):工具名自 core 的**目录**派生
  * (`pathTarget` 声明 ⇒ 路径文法;`Bash` ⇒ 命令文法),型是 `string`。于是本文件对它的处置从
@@ -61,13 +61,13 @@ export declare const RULE_APPROVAL_RECORD_SCHEMA: RuleApprovalRecord["schema"];
  * `"unknown"` = **回答这一问的那次读回没做成** —— 这个域唯一不肯说的那句话是「看不见 ⇒ 没有」,
  * 第三个词就是它的反面。
  *
- * 🔴 **型从 core 的导出型派生,不是抄一份字面联合**:`RemovalLiveness` 本身没有从包根导出
- * (亲验 `dist/index.d.ts`:只导 `RemoveResult`),而 `RemoveResult` 的 removed 臂上就带着它 ⇒ 从那里
- * `Extract` 出来。抄一份 `"yes"|"no"|"unknown"` 的下场与本文件顶注说的那一族一样:core 加第四个词
- * (或改掉某一个)时,抄件不会红。派生形则**编译期**先红在每一处穷举上。
- * (已向 core 请托把这只型放上包根导出面;到货后本行换成直接 import,词表值零变化。)
+ * 🔴 **型从 core 的包根导出接过来,本仓零抄**(core 7.26.0 S-538 ⓐ:`RemovalLiveness` 随请托上了导出面)。
+ * 上一版是 `Extract<RemoveResult, {status:"removed"}>["stillLive"]` —— 那是派生而非手抄(值不会漂),但它把
+ * 一只**独立的闭集**寄生在某一个臂的形状上:core 哪天给 `removed` 臂改名、或让这只词表先在别的臂上落地,
+ * 派生式就会指向一个与词表无关的东西。现在两者同名同源。
+ * 🔴 **运行期词表 `REMOVAL_LIVENESS_WORDS` 刻意不 re-export**:本仓对这三个词零运行期判据(值由 core 在两只
+ * 200 体上原样透传,分支全走编译期穷尽),开一扇没人走的门只会让台账多一行「引用而不消费」的例外。
+ * 哪天真要判「这个串在不在表里」,那时从 core 直接读它。
  */
-export type RemovalLiveness = Extract<RemoveResult, {
-    status: "removed";
-}>["stillLive"];
+export type { RemovalLiveness } from "@sema-agent/core";
 //# sourceMappingURL=permission-rule-vocab.d.ts.map

package/dist/plugins/remote-env-host.d.ts

@@ -134,6 +134,11 @@ export declare class RemoteHostExecutionEnv implements RemoteExecutionEnv, Sched
      * ② 把读拉进来会让 teardown 去等一次可能**永不 settle** 的读(workspace 里的 FIFO / 特殊文件),
      *    把 destroy 挂死 —— 拿一条新的可用性病换一条不存在的正确性收益。
      * 判据因此是一句话:**「可能建路径或改路径的那些面」进在飞集合**,不是「过了 fsReady 的都进」。
+     *
+     * ── 不止文件面(S-541)─────────────────────────────────────────────────────────────────────────
+     * 判据是「会不会建/改路径」,**不是**「在不在 `env` 的文件面上」。后台 shell 的 `launch`(`makeBgDriver`)
+     * 在 spool 根下 `mkdir` 一棵子树,而它整段期间 `bgManager.hasShells()` 还是 false(`shells.set` 在
+     * `await launch(ctx)` 之后)⇒ 同一条竞态的另一张脸,同一只集合治。见那处头注。
      */
     private withInflightFs;
     /**

package/dist/plugins/remote-env-host.js

@@ -213,45 +213,47 @@ export class RemoteHostExecutionEnv {
     makeBgDriver() {
         const self = this;
         return {
-            async launch(command, options, ctx) {
-                const ready = await self.shellReady();
-                if (!ready.ok)
-                    throw new BackgroundShellError("spawn_failed", ready.error.message);
-                const dir = path.join(self.ensureSpoolRoot(), "bg-" + randomBytes(8).toString("hex"));
-                await fs.mkdir(dir, { recursive: true });
-                const outPath = path.join(dir, "out");
-                const errPath = path.join(dir, "err");
-                const outFh = await fs.open(outPath, "w");
-                const errFh = await fs.open(errPath, "w");
-                let child;
-                try {
-                    const sh = hostShell();
-                    child = spawn(sh.shell, [...sh.args, command], {
-                        cwd: self.resolve(options?.cwd ?? self.cwd),
-                        env: self.mergeEnv(options?.env),
-                        ...spawnGroupOptions(),
-                        stdio: ["ignore", outFh.fd, errFh.fd],
-                    });
-                }
-                catch (e) {
+            launch(command, options, ctx) {
+                return self.withInflightFs(async () => {
+                    const ready = await self.shellReady();
+                    if (!ready.ok)
+                        throw new BackgroundShellError("spawn_failed", ready.error.message);
+                    const dir = path.join(self.ensureSpoolRoot(), "bg-" + randomBytes(8).toString("hex"));
+                    await fs.mkdir(dir, { recursive: true });
+                    const outPath = path.join(dir, "out");
+                    const errPath = path.join(dir, "err");
+                    const outFh = await fs.open(outPath, "w");
+                    const errFh = await fs.open(errPath, "w");
+                    let child;
+                    try {
+                        const sh = hostShell();
+                        child = spawn(sh.shell, [...sh.args, command], {
+                            cwd: self.resolve(options?.cwd ?? self.cwd),
+                            env: self.mergeEnv(options?.env),
+                            ...spawnGroupOptions(),
+                            stdio: ["ignore", outFh.fd, errFh.fd],
+                        });
+                    }
+                    catch (e) {
+                        await outFh.close().catch(() => { });
+                        await errFh.close().catch(() => { });
+                        await fs.rm(dir, { recursive: true, force: true }).catch(() => { });
+                        throw new BackgroundShellError("spawn_failed", e instanceof Error ? e.message : String(e), e);
+                    }
+                    const pid = child.pid;
+                    if (pid != null) {
+                        child.on("close", (code, signal) => ctx.onTerminal(false, code ?? (signal ? 128 + (signalNumber(signal) ?? 9) : 0)));
+                        child.on("error", () => ctx.onTerminal(true));
+                        child.unref();
+                    }
                     await outFh.close().catch(() => { });
                     await errFh.close().catch(() => { });
-                    await fs.rm(dir, { recursive: true, force: true }).catch(() => { });
-                    throw new BackgroundShellError("spawn_failed", e instanceof Error ? e.message : String(e), e);
-                }
-                const pid = child.pid;
-                if (pid != null) {
-                    child.on("close", (code, signal) => ctx.onTerminal(false, code ?? (signal ? 128 + (signalNumber(signal) ?? 9) : 0)));
-                    child.on("error", () => ctx.onTerminal(true));
-                    child.unref();
-                }
-                await outFh.close().catch(() => { });
-                await errFh.close().catch(() => { });
-                if (pid == null) {
-                    await fs.rm(dir, { recursive: true, force: true }).catch(() => { });
-                    throw new BackgroundShellError("spawn_failed", "host background spawn produced no pid");
-                }
-                return { pid, dir, outPath, errPath, stdoutCursor: 0, stderrCursor: 0 };
+                    if (pid == null) {
+                        await fs.rm(dir, { recursive: true, force: true }).catch(() => { });
+                        throw new BackgroundShellError("spawn_failed", "host background spawn produced no pid");
+                    }
+                    return { pid, dir, outPath, errPath, stdoutCursor: 0, stderrCursor: 0 };
+                });
             },
             async read(state) {
                 if (state.mem) {

package/dist/request-key-closure.js

@@ -19,7 +19,7 @@ export function keyClosureClause(names, label) {
 }
 const TASK_BODY_DECLARED_KEYS = [
     "a2aPeers", "acceptPartialRestore", "additionalDirectories", "additionalReadDirectories", "agents",
-    "appendSystemPrompt", "attachmentIds", "attachments", "capabilitiesNeeded", "cascade", "clientContext",
+    "appendSystemPrompt", "approverPosture", "attachmentIds", "attachments", "capabilitiesNeeded", "cascade", "clientContext",
     "compaction", "compactionModel", "council", "cwd", "debate", "deferTools", "deviceId", "enableFork",
     "excludeAllTools", "excludeTools",
     "finalVerification", "forwardSubagentEvents", "images", "interactiveTools", "jobId", "limits", "maxCostUsd",

package/dist/rules-consent.d.ts

@@ -1,5 +1,5 @@
 import { type DirectWritableRuleBehavior, type RemovalLiveness } from "./permission-rule-vocab.js";
-import { type RuleOwner, type ImportPreview, type RedeemedBatchMember, type ImportedSettingsLayer, type PersistedRule, type RuleBehavior, type RuleCandidate, type EffectivePermissionRule, type RemoveResult, type EditedRuleTextPrecheck, type RuleScope, type RuleOffer } from "@sema-agent/core";
+import { type RuleOwner, type ImportPreview, type RedeemedBatchMember, type ImportedSettingsLayer, type PersistedRule, type RuleBehavior, type RuleCandidate, type EffectivePermissionRule, type RemoveResult, type RuleWriteCommitted, type EditedRuleTextPrecheck, type RuleScope, type RuleOffer } from "@sema-agent/core";
 import type { DurableRulePartitionProvider, PermissionRuleStoreProvider, RuleApprovalRecordStore } from "@sema-agent/core";
 import { type RuleImportTicket, type RuleTicketPurpose, type RuleTicketReclaimResult, type RuleTicketRedeemResult, type RuleTicketSnapshot } from "./plugins/permission-rule-store-sql.js";
 /**
@@ -615,10 +615,14 @@ export type RuleWritten =
  *  才是谎 —— 亲读 core 的 `AddResult`,`added` 臂只有 `{status, rev, dot}`,**刻意**不带行(头注:之后
  *  落地的撤销是「`list()` 答的普通后续事件」),而本仓的行形带着 `status: "live"` 这一格,给一行已经
  *  不在的规则铸它就是第二个谎。 */
+/** 🔴 `"unknown"`(7.93.0 合并复审 codex 验真后加):引擎已确认 `added`(`rev` 在手),而**写后读回本身抛了**
+ *  (店读不出来)。「写没写」有答案、「现在站不站着」没人观察 —— 与撤销口 `no-op` + `unknown` 同词同义:
+ *  **不要重试**(重发只会 `no-op`),用 `GET /v1/rules` 对账。此前这一形落域外通用 500 `internal.error`,
+ *  与「写前读库失败」(零写,重发安全)走同一个异常出口 —— 两种强度一句话,正是 `committed` 要拆开的那对。 */
  | {
     status: "persisted" | "no-op";
     rev: number;
-    stillLive: Extract<RemovalLiveness, "no">;
+    stillLive: Exclude<RemovalLiveness, "yes">;
     row?: undefined;
 }
 /** 裁定性不收(内容判据 / 方向判据)。`detail` 是给人看的那一半,`reason` 是给客户端分流的那一半。 */
@@ -627,11 +631,24 @@ export type RuleWritten =
     reason: LocalImportRefusalCode;
     detail: string;
 }
-/** **不知道落没落**:店在这一条上出了状况(core 的 `failed` 两种强度)。如实编,禁猜(端点侧 503 +
- *  指路 `GET /v1/rules` 对账)。**「写落了随后被撤」不在本臂** —— 那一形有答案,见上面 `stillLive:"no"`。 */
+/** 终态写失败。`detail` 是给人看的那一半;`committed`({@link RuleWriteCommitted},core 的两词闭集)是
+ *  给机器分流的那一半 —— 它回答的是**调用方下一步该做什么**。
+ *
+ *  🔴 **词从 core 的 `AddResult.failed` 原样接过来,不从报文里猜**(core 7.26.0 [ref])。此前本臂叫
+ *  `indeterminate` 且只带 `detail`:core 把「店自己答了、确知零写」与「apply 抛了、落没落不知道」两种强度
+ *  **只写在散文里**,本仓于是把两者一律折成「不确定」+ 端点 503「retry」。代价是那句 retry 对两种强度**一句
+ *  都不对**:`"no"` 的那半确知零写、重发同一份体是安全的(而旧文案让客户端以为要先对账);`"unknown"` 的那半
+ *  可能已经落了,而盲重试会**再铸一枚 dot**、把刚被人撤掉的收紧重新立起来(core `AddResult.failed` 头注逐字
+ *  警告过这条路)——那正是本臂最需要说清的一句话,旧形却把它和安全的那半说成了同一句。
+ *
+ *  🔴 臂名随词改成 core 的 `failed`(不再叫 `indeterminate`):拿到判别位之后,「不确定」对 `"no"` 这半是
+ *  **假的**,而一个名字与它所含的一半相反的臂,下一个读它的人一定读错。两个词表合成一个,规则少一条。
+ *
+ *  **「写落了随后被撤」不在本臂** —— 那一形有答案,见上面 `stillLive:"no"`。 */
  | {
-    status: "indeterminate";
+    status: "failed";
     detail: string;
+    committed: RuleWriteCommitted;
 };
 export interface RuleConsentLane {
     /** 卡道兑付口:一次 ask 决议携规则确认 ⇒ prepare→confirm→redeem 一气呵成。 */

package/dist/rules-consent.js

@@ -736,7 +736,14 @@ export function createRuleConsentLane(stores, opts) {
                 adds: [],
             };
             const rowOf = (rows) => rows.find((r) => sameWireRuleIdentity(r, { behavior: input.behavior, rule: written.rule.rule, scope: row.scope }));
-            const before = await lane.listRules(input.principal);
+            let before;
+            try {
+                before = await lane.listRules(input.principal);
+            }
+            catch (e) {
+                localImportLogger.warn("direct_rule_write_pre_read_failed", { behavior: input.behavior, err: e instanceof Error ? e.message : String(e) });
+                return { status: "failed", detail: `the rule store could not be read before writing: ${e instanceof Error ? e.message : String(e)}`, committed: "no" };
+            }
             const standing = rowOf(before.rows);
             if (standing !== undefined)
                 return { status: "no-op", rev: before.rev, stillLive: "yes", row: standing };
@@ -750,15 +757,22 @@ export function createRuleConsentLane(stores, opts) {
                 case "no-op":
                     break;
                 case "failed":
-                    return { status: "indeterminate", detail: added.error };
+                    return { status: "failed", detail: added.error, committed: added.committed };
                 default: {
                     const unknown = added;
                     throw new Error(`unknown addPersistedRule outcome: ${JSON.stringify(unknown)}`);
                 }
             }
-            const readBack = await lane.listRules(input.principal);
-            const landed = rowOf(readBack.rows);
             const status = added.status === "no-op" ? "no-op" : "persisted";
+            let readBack;
+            try {
+                readBack = await lane.listRules(input.principal);
+            }
+            catch (e) {
+                localImportLogger.warn("direct_rule_write_read_back_failed", { behavior: input.behavior, scope: row.scope, rev: added.rev, wrote: status === "persisted", err: e instanceof Error ? e.message : String(e) });
+                return { status, rev: added.rev, stillLive: "unknown" };
+            }
+            const landed = rowOf(readBack.rows);
             if (landed === undefined) {
                 localImportLogger.warn("direct_rule_write_vanished_before_read_back", {
                     behavior: input.behavior,

package/dist/task-mcp.d.ts

@@ -41,6 +41,38 @@ export declare const MAX_REQUEST_MCP_SERVERS = 32;
  * 有界点名两头都占:该说的仍然说得出,量级钉死在与挂载同阶。
  */
 export declare const MAX_REQUEST_MCP_DROP_NAMES = 32;
+/**
+ * S-481 —— 一条 `mcpServers[]` 条目在 wire 上的**键闭集**,与它两种传输各自的键闭集。
+ *
+ * ## 属主为什么在这里
+ * 这个文件就是「请求腿的 MCP 条目形」的家({@link normalizeServer} 逐键读的正是这些)。S-481 的探测口
+ * ({@link import("./capabilities/mcp-probe.js").readMcpProbeBody})要的是**同一个**词表 —— 它在自己那边
+ * 再写一份就是一份手抄投影([ref]:任何仓第一排查点),而两份哪天分岔,窄的那一份会把**合法**的键当成
+ * 拼写错误 400 掉。
+ *
+ * ## 🔴 两向钉在 core 的 `McpServerSpec` 上(不是手抄)
+ * 下面六道编译期门:型上多一个键而表没跟 ⇒ 红;表里写一个型上没有的词(改名 / 拼错 / 删键后的残条目)
+ * ⇒ 也红。于是这三张表是从 core 的型**派生**出来的数据,而不是誰记得去同步的清单。
+ *
+ * ## 两个消费点的处置**刻意不同**(同一张表,不同的门)
+ *  · 提交腿({@link normalizeServer})对词表外的键**宽容**(读不认识的键就当没有)—— 那条腿要能安全地
+ *    重放存量 body,一个 4xx 打在 resume 上会永久砖死一条 parked 任务(本仓三处 `opts.leg` 先例);
+ *  · 探测口**响亮拒**(400,点名 `mcpServers[i].<键>`)—— 它问的是「这台到底能不能用」,把一个拼错的键
+ *    悄悄忽略再回一份好看的名单,正是那条面要根除的假答案。
+ * 两个门,一个词表。表在这里,门在各自的腿上。
+ */
+export declare const MCP_SERVER_ENTRY_KEYS: readonly ["allowTools", "contentOrigin", "elicitation", "name", "source", "toolAxes", "toolFaces", "transport"];
+/** `transport.kind:"stdio"` 的键闭集(两向钉在 core 那一支上)。 */
+export declare const STDIO_MCP_TRANSPORT_KEYS: readonly ["args", "command", "env", "kind"];
+/** `transport.kind:"http"` 的键闭集(同上)。 */
+export declare const HTTP_MCP_TRANSPORT_KEYS: readonly ["headers", "kind", "principalHeader", "url"];
+/** 条目层:`{}` 与缺席等价的可选 Record 键。 */
+export declare const MCP_ENTRY_EMPTY_RECORD_KEYS: readonly ["toolAxes", "toolFaces"];
+/** 条目层:`[]` 与缺席等价的可选数组键。 */
+export declare const MCP_ENTRY_EMPTY_ARRAY_KEYS: readonly ["allowTools"];
+/** 传输层(两种合起来):`{}` / `[]` 与缺席等价的键。 */
+export declare const MCP_TRANSPORT_EMPTY_RECORD_KEYS: readonly ["env", "headers"];
+export declare const MCP_TRANSPORT_EMPTY_ARRAY_KEYS: readonly ["args"];
 /**
  * Does THIS deployment honor caller-supplied per-request MCP servers? TRUE for a SINGLE-USER deployment
  * (`requirePrincipal !== true`) — the requester is the super-admin of their own worker, so their `.mcp.json` is

package/dist/task-mcp.js

@@ -8,6 +8,13 @@ import { readMcpToolFaces } from "./mcp-tool-faces.js";
 import { isToolAxisIrreversibility, isToolEffect } from "./tool-axis-words.js";
 export const MAX_REQUEST_MCP_SERVERS = 32;
 export const MAX_REQUEST_MCP_DROP_NAMES = MAX_REQUEST_MCP_SERVERS;
+export const MCP_SERVER_ENTRY_KEYS = ["allowTools", "contentOrigin", "elicitation", "name", "source", "toolAxes", "toolFaces", "transport"];
+export const STDIO_MCP_TRANSPORT_KEYS = ["args", "command", "env", "kind"];
+export const HTTP_MCP_TRANSPORT_KEYS = ["headers", "kind", "principalHeader", "url"];
+export const MCP_ENTRY_EMPTY_RECORD_KEYS = ["toolAxes", "toolFaces"];
+export const MCP_ENTRY_EMPTY_ARRAY_KEYS = ["allowTools"];
+export const MCP_TRANSPORT_EMPTY_RECORD_KEYS = ["env", "headers"];
+export const MCP_TRANSPORT_EMPTY_ARRAY_KEYS = ["args"];
 export function mcpInjectionHonored(config) {
     if (config.lockedConfigKeys?.includes("mcp") === true)
         return false;

package/dist/tool-approval.d.ts

@@ -124,6 +124,27 @@ export interface ToolApprovalFrame {
      *  本键让 live-only 部署(店缺席、帧无卡)也能读到出身位;安全类标记不得依赖店在场([ref] 结构性
      *  缺口成文)。消费语义(cli 挂点已预埋):在场 ⇒ 一切自动放行让位(含记住的规则与 bypass 姿态)。 */
     requiresRealApproval?: true;
+    /**
+     * **[ref]**(core 7.26.0;**ADDITIVE**,`"tool_approval"` only)—— **这一问没有任何规则能清掉**
+     * (`AskRequest.mandated`:org / 治理层、保护判官、hook 的筛查权、被祖先的应答者裁决的问…… 由引擎在闸站
+     * 盖章,策略方不可自填、只可收紧)。壳据它渲染「规则清不掉这一问」,并让**声明了自动应答姿态**的席位知道
+     * 哪些卡它不该自动答。
+     *
+     * 🔴 **别拿 `ruleOffersAbsence:"mandated"` 顶替它**(core 头注逐字警告过这条路):那只键回答的是**规则报价
+     * 车道**有什么可给,而那条车道对它不说话的工具、**没接规则店的部署**(本仓的 live-only 形)、装不下规则的
+     * 任务都是结构性沉默 —— 它的缺席**不是**断言。本键是这一问**自己**的属性,凡强制皆在场。读错的代价 core
+     * 实测过:同一条根外读命令在 shell 工具上是强制问、在 monitor 工具上看起来是普通问。
+     *
+     * 🔴 **它不是 `requiresRealApproval`**:强制只说「没有规则能清掉」,**不**说「没有应答者可以答」——
+     * 一个人、一只 hook、一张一揽子 `onAsk:"allow"` 席照常答得了强制卡。两键别互推。
+     *
+     * 🔴 **真才带,缺席绝不编 `false`**(`governanceForced` / `requiresRealApproval` 同形)。缺席同时覆盖
+     * 「不是强制」「老引擎」「这是一张从 park 行上重铸的耐久卡」三形 —— **耐久面上本仓不造孪生座**:core 的
+     * 寄存行(`PendingAction`)没有这一位(KL-997a 亲读登记),行上强制表现为 `ruleOffersAbsence:"mandated"`
+     * 且无 `ruleOffers`;在 `card_json` 侧自铸一个就是本仓成了这个事实的第二个源(而 park 那侧根本没有输入)。
+     * 🔴 echo-only:server 不据它做任何裁决(强制的判定属主在 core 的闸站)。
+     */
+    mandated?: true;
     /**
      * **S-125③/[ref]**(core 7.5.0;**ADDITIVE**,`"tool_approval"` only)—— 这只 ask 的**出身**:
      * 谁提的这一问,一个 core 闭集词(`ASK_ORIGINS` **11 员**,core 7.14.0 现值:content_question /
@@ -179,7 +200,7 @@ export interface ToolApprovalFrame {
      *
      * 🔴 **原样回传**(core 契约 `shell.read_boundary.grant_candidate_is_the_grant`):`dir` 是绝对、已做词法
      * 折叠、用读边界自己的拼法写的串;**显示的串就是要加的串**。壳可以为了好看渲一个缩短形,回传必须是
-     * 本键里的原串。⇒ 本仓的姿势是「整只逐字带,或整只丢」,**绝不截**(见 `MAX_READ_ROOT_CANDIDATE_DIR`)。
+     * 本键里的原串。⇒ 本仓的姿势是「整只逐字带,或整只丢」,**绝不截**(界见 core 的 `READ_ROOT_CANDIDATE_DIR_MAX`)。
      *
      * 🔴 **echo-only,零判读**:server 不从命令文本重推目录,也不复核它真不真能清掉这只 ask —— core 已经
      * 把提议的根放回读边界又走了一遍才递出来,下游再判一遍就是同一事实的第二个判官(与 `origin` /

package/dist/tool-approval.js

@@ -854,6 +854,7 @@ export class ToolApprovalCoordinator {
             message: typeof req.message === "string" ? redactDeep(req.message) : "",
             ...(governanceForced ? { governanceForced: true } : {}),
             ...(req.requiresRealApproval === true ? { requiresRealApproval: true } : {}),
+            ...(req.mandated === true ? { mandated: true } : {}),
             ...(typeof req.origin === "string" && req.origin.length > 0 ? { origin: req.origin } : {}),
             ...(typeof req.persistedRuleShadowed === "string" && req.persistedRuleShadowed !== ""
                 ? { persistedRuleShadowed: redactSecrets(req.persistedRuleShadowed).slice(0, MAX_RULE_TEXT_CHARS) }

package/dist/trace/core-keyset-guard.d.ts

@@ -26,7 +26,7 @@ import type { ToolApprovalFrame } from "../tool-approval.js";
  *  本文件只有类型、不产 JS,所以被 `import type` 引用不新增任何运行期边。 */
 export type AssertAllKeysHandled<T extends never> = T;
 type NotificationProjected = "task_id" | "task_type" | "toolUseId" | "status" | "summary" | "result" | "output_file" | "usage" | "sessionId" | "seq" | "lines" | "stoppedBy" | "source" | "exitCode" | "partial" | "diagnostics" | "recentSteps" | "editedFiles" | "resumable" | "completionId" | "error" | "errorCode" | "apiFailure" | "agentMessage" | "_sema_provenance";
-type NotificationExcluded = "peer" | "crossSessionMessage" | "crossSessionNotice";
+type NotificationExcluded = (typeof import("./wire-projection-faces.js").WIRE_PROJECTION_FACES)["task_notification"]["excluded"][number];
 type _GuardNotification = AssertAllKeysHandled<Exclude<keyof TaskNotificationPayload, NotificationProjected | NotificationExcluded>>;
 type _GuardNotificationReverse = AssertAllKeysHandled<Exclude<NotificationProjected | NotificationExcluded, keyof TaskNotificationPayload>>;
 type ProvenanceProjected = "kind" | "from" | "taskId" | "seq" | "agentType";
@@ -43,7 +43,7 @@ type _GuardBgNotifReverse = AssertAllKeysHandled<Exclude<BgNotifProjected | BgNo
 type RosterProjected = "name" | "agentId" | "sessionId" | "toolUseId" | "owner" | "scope" | "sessionScoped" | "rootSessionId" | "model" | "modelFallback" | "createdAt";
 type _GuardRoster = AssertAllKeysHandled<Exclude<keyof RosterEntry, RosterProjected>>;
 type _GuardRosterReverse = AssertAllKeysHandled<Exclude<RosterProjected, keyof RosterEntry>>;
-type AskProjected = "toolName" | "toolCallId" | "args" | "message" | "sourceTaskId" | "fromSubagent" | "sourceAgentName" | "delegation" | "ruleOffers" | "ruleOffersAbsence" | "persistedRuleShadowed" | "probeCause" | "ruleEvidence" | "requiresRealApproval" | "denialLimitFallback" | "origin" | "ruleStoreUnreadable" | "readRootCandidate";
+type AskProjected = "toolName" | "toolCallId" | "args" | "message" | "sourceTaskId" | "fromSubagent" | "sourceAgentName" | "delegation" | "ruleOffers" | "ruleOffersAbsence" | "persistedRuleShadowed" | "probeCause" | "ruleEvidence" | "requiresRealApproval" | "denialLimitFallback" | "origin" | "ruleStoreUnreadable" | "readRootCandidate" | "mandated";
 type AskExcluded = "preview" | "principal" | "riskAxes" | "boundInputHash" | "isDelegatedChild" | "probeReason" | "hasBidiControls" | "previewWithheld" | "execCwd";
 type _GuardAsk = AssertAllKeysHandled<Exclude<keyof AskRequest, AskProjected | AskExcluded>>;
 type _GuardAskReverse = AssertAllKeysHandled<Exclude<AskProjected | AskExcluded, keyof AskRequest>>;
@@ -134,7 +134,7 @@ type SummaryProjected = "sessionId" | "scope" | "createdAt" | "gateKind" | "seve
 type SummaryExcluded = "token" | "toolInput" | "toolName" | "toolCallId" | "preview" | "principal" | "sourceTaskId" | "contentKind" | "restoreMode" | "checkpointId" | "previewWithheld";
 type _GuardInboxSummary = AssertAllKeysHandled<Exclude<keyof CheckpointSummary, SummaryProjected | SummaryExcluded>>;
 type _GuardInboxSummaryReverse = AssertAllKeysHandled<Exclude<SummaryProjected | SummaryExcluded, keyof CheckpointSummary>>;
-type TaskSpecWired = "objective" | "principal" | "images" | "sessionId" | "requireExistingSession" | "oneShot" | "clientContext" | "resumeAt" | "resumeAtMode" | "model" | "compactionModel" | "thinking" | "systemPrompt" | "appendSystemPrompt" | "promptProvider" | "memory" | "suggestNextPrompts" | "restoreFiles" | "acceptPartialRestore" | "rewindFilesTo" | "tools" | "excludeTools" | "deferTools" | "toolMaterializeStrategy" | "promptProfile" | "toolPolicy" | "onAsk" | "onQuestion" | "hooks" | "durableApproval" | "resourceSuspend" | "resilience" | "finalVerification" | "checkpointStore" | "handsReadOnly" | "memoryPersistenceCapable" | "additionalDirectories" | "additionalReadDirectories" | "enablePlanMode" | "interactiveTools" | "enableFork" | "shellGate" | "writeFace" | "mcp" | "a2a" | "skills" | "backgroundScope" | "envFacts" | "limits" | "configOverrides" | "forwardSubagentEvents" | "retainSubagentSessions" | "retainBackgroundProcesses" | "outputSchema" | "outputRetries" | "compaction" | "attachments" | "selfOrchestration" | "getApiKeyAndHeaders" | "interactionPosture" | "agents" | "taskId" | "signal" | "preemptSignal" | "modelRole" | "enableBlockedReport" | "maxSuspends" | "autoModeRequested" | "skillListingBudgetFraction" | "skillListingMaxDescChars" | "excludeAllTools";
+type TaskSpecWired = "objective" | "principal" | "images" | "sessionId" | "requireExistingSession" | "oneShot" | "clientContext" | "resumeAt" | "resumeAtMode" | "model" | "compactionModel" | "thinking" | "systemPrompt" | "appendSystemPrompt" | "promptProvider" | "memory" | "suggestNextPrompts" | "restoreFiles" | "acceptPartialRestore" | "rewindFilesTo" | "tools" | "excludeTools" | "deferTools" | "toolMaterializeStrategy" | "promptProfile" | "toolPolicy" | "onAsk" | "onQuestion" | "hooks" | "durableApproval" | "resourceSuspend" | "resilience" | "finalVerification" | "checkpointStore" | "handsReadOnly" | "memoryPersistenceCapable" | "additionalDirectories" | "additionalReadDirectories" | "enablePlanMode" | "interactiveTools" | "enableFork" | "shellGate" | "writeFace" | "mcp" | "a2a" | "skills" | "backgroundScope" | "envFacts" | "limits" | "configOverrides" | "forwardSubagentEvents" | "retainSubagentSessions" | "retainBackgroundProcesses" | "outputSchema" | "outputRetries" | "compaction" | "attachments" | "selfOrchestration" | "getApiKeyAndHeaders" | "interactionPosture" | "agents" | "approverPosture" | "taskId" | "signal" | "preemptSignal" | "modelRole" | "enableBlockedReport" | "maxSuspends" | "autoModeRequested" | "skillListingBudgetFraction" | "skillListingMaxDescChars" | "excludeAllTools";
 type TaskSpecUnwired = "actor" | "roles" | "lspManager" | "tracer" | "readFace" | "readDenyPatterns" | "interactiveQuestionFallback" | "alwaysLoadTools" | "restoreGatedTools" | "deferSelfResolve" | "basePolicyForResumeEdit" | "lspDiagnostics" | "streamingToolExecution" | "toolResultThresholdChars";
 type _GuardTaskSpec = AssertAllKeysHandled<Exclude<keyof TaskSpec, TaskSpecWired | TaskSpecUnwired>>;
 type _GuardTaskSpecReverse = AssertAllKeysHandled<Exclude<TaskSpecWired | TaskSpecUnwired, keyof TaskSpec>>;

package/dist/trace/project.d.ts

@@ -11,6 +11,17 @@
  * `output` (+ `truncated`) — redacted + size-bounded at append (runs.ts) and read straight off the event here (the
  * old session-join `toolOutput` hook is gone, there's a real source now); `eventId`/`parentToolCallId` (§E2) ride
  * each content event, additive / tolerate-absent.
+ *
+ * 🔴 **本族 `*EventData` 构造器的入参型不是白名单**(S-545 起,别再照旧读法维护它)。
+ * 每只构造器的形参型是**这条投影的本地入参形**,故意比 core 的分支型松:三条腿里有两条(durable 账本 /
+ * resume 回放)手里只有磁盘上的 `Record<string, unknown>`,窄值型在那里结构上不成立,所以 `unknown` +
+ * 内部逐层窄化是**有意**的,不是欠账;核过的 core 键在场性由投影体自己的条件展开臂决定。
+ * 「这一版 core 的键有没有真的上 wire」这件事的判据**不在形参型上** —— 它在
+ * `trace/wire-projection-faces.ts` 的登记表 + `test/wire-whitelist-exhaustiveness.test.ts`:门把 core 型的
+ * 键集从**安装态 `.d.ts`** 机器派生出来,喂一枚全键 fixture 真跑一遍本族每只构造器,再拿**投影体**的键集
+ * 双向对账(多投一枚 / 漏投一枚各自一条变异负控)。旧形只比形参签名,于是「入参型里写着但投影体里从来
+ * 没有」这一类(`human_input.principal` 就是一例)与「忘了投」逐字同形 —— 那正是被替掉的盲区。
+ * 新加一只构造器 ⇒ 同批往登记表加一行,否则普查格红。
  */
 import type { GateOutcome, McpDelivered, TaskResult, SystemInjectionPriority } from "@sema-agent/core";
 import type { RunEvent, RunRecord } from "../plugins/store-contracts.js";
@@ -650,6 +661,19 @@ export declare function workspaceChangedEventData(ev: {
  * 都红不了(2026-09-04 实测:该钉 26/26 全绿,红出 `autoMode` 的是编译期门)。段级 + 成员级的**编译期**门在
  * `core-keyset-guard.ts` ⑥b —— 那才是「core 加了段/加了成员」的可靠红点,两道并用缺一不可。
  */
+/**
+ * 🔴 **`wiring_manifest.mcp[]` 一行上 wire 的形 —— 全仓唯一属主**(S-481 从 {@link wiringManifestEventData}
+ * 的内联 IIFE **逐字**提出来,零行为变化;既有钉在 `test/wiring-manifest-projection.test.ts`)。
+ *
+ * 为什么必须是一只具名函数:S-481 又开了两条读面(`GET /v1/capabilities/mcp` /
+ * `POST /v1/capabilities/mcp/probe`),它们发的是**同一种**行。留在内联里,那两条面只能各自再挑一遍键
+ * —— 而契约 §G.7 第 3 条(`error` 远端原话**有意不投**,理由是「再脱一遍就是同一语义面的第二个写者」)
+ * 这种**裁定**一旦有两个实现,下一个人只会改到其中一个。
+ *
+ * 逐条目挑键(不是整只判形):`name` / `status` 缺一 ⇒ 丢**这一条**;数组本身非数组 ⇒ 整段缺席。
+ * 逐键判据与失败方向的理由全在下面各行的注里,`liveness` 那一格的裁定在 §G.7 第 2bis 条。
+ */
+export declare function projectWiringManifestMcpRows(mcpIn: unknown): Array<Record<string, unknown>> | undefined;
 /**
  * `tool_roster_delta`(core 7.8.0 [ref] ⑪ 新 `TaskEvent` 臂)—— **运行期**名册变更:整只变更后名册
  * (`delta.roster`)+ 一段只有持有 `fromDigest` 的消费者才用得上的摘要。

package/dist/trace/project.js

@@ -371,6 +371,45 @@ export function workspaceChangedEventData(ev) {
         ...identityFields(ev),
     };
 }
+export function projectWiringManifestMcpRows(mcpIn) {
+    const str = (v) => (typeof v === "string" && v.length > 0 ? v : undefined);
+    const num = (v) => (typeof v === "number" && Number.isFinite(v) ? v : undefined);
+    const sec = (v) => (typeof v === "object" && v !== null && !Array.isArray(v) ? { ...v } : undefined);
+    if (!Array.isArray(mcpIn))
+        return undefined;
+    const rows = [];
+    for (const raw of mcpIn) {
+        const e = sec(raw);
+        if (e === undefined)
+            continue;
+        const name = str(e.name);
+        const status = str(e.status);
+        if (name === undefined || status === undefined)
+            continue;
+        const liveness = (() => {
+            const rec = sec(e.liveness);
+            if (rec === undefined)
+                return undefined;
+            const state = str(rec.state);
+            const observedAt = num(rec.observedAt);
+            if (state === undefined || !MCP_LIVENESS_STATES.includes(state) || observedAt === undefined)
+                return undefined;
+            const errorCode = str(rec.errorCode);
+            return { state, observedAt, ...(errorCode === undefined ? {} : { errorCode }) };
+        })();
+        rows.push({
+            name,
+            status,
+            ...(num(e.toolCount) !== undefined ? { toolCount: e.toolCount } : {}),
+            ...(str(e.source) !== undefined ? { source: e.source } : {}),
+            ...(str(e.errorCode) !== undefined ? { errorCode: e.errorCode } : {}),
+            ...(typeof e.delivered === "string" && MCP_DELIVERY_VERDICTS.includes(e.delivered) ? { delivered: e.delivered } : {}),
+            ...(num(e.httpStatus) !== undefined ? { httpStatus: e.httpStatus } : {}),
+            ...(liveness !== undefined ? { liveness } : {}),
+        });
+    }
+    return rows;
+}
 export function toolRosterDeltaEventData(ev) {
     if (!Value.Check(ToolRosterDelta, ev.delta)) {
         recordFailOpen("server.trace.tool-roster-malformed", "tool_roster_delta.delta did not fit core ToolRosterDelta");
@@ -495,43 +534,7 @@ export function wiringManifestEventData(ev) {
             return dropProjectedFace("wiring_manifest.writeProtection.targetView is outside core WRITE_PROTECTION_TARGET_VIEWS");
         return { targetView };
     })();
-    const mcpIn = m.mcp;
-    const mcp = (() => {
-        if (!Array.isArray(mcpIn))
-            return undefined;
-        const rows = [];
-        for (const raw of mcpIn) {
-            const e = sec(raw);
-            if (e === undefined)
-                continue;
-            const name = str(e.name);
-            const status = str(e.status);
-            if (name === undefined || status === undefined)
-                continue;
-            const liveness = (() => {
-                const rec = sec(e.liveness);
-                if (rec === undefined)
-                    return undefined;
-                const state = str(rec.state);
-                const observedAt = num(rec.observedAt);
-                if (state === undefined || !MCP_LIVENESS_STATES.includes(state) || observedAt === undefined)
-                    return undefined;
-                const errorCode = str(rec.errorCode);
-                return { state, observedAt, ...(errorCode === undefined ? {} : { errorCode }) };
-            })();
-            rows.push({
-                name,
-                status,
-                ...(num(e.toolCount) !== undefined ? { toolCount: e.toolCount } : {}),
-                ...(str(e.source) !== undefined ? { source: e.source } : {}),
-                ...(str(e.errorCode) !== undefined ? { errorCode: e.errorCode } : {}),
-                ...(typeof e.delivered === "string" && MCP_DELIVERY_VERDICTS.includes(e.delivered) ? { delivered: e.delivered } : {}),
-                ...(num(e.httpStatus) !== undefined ? { httpStatus: e.httpStatus } : {}),
-                ...(liveness !== undefined ? { liveness } : {}),
-            });
-        }
-        return rows;
-    })();
+    const mcp = projectWiringManifestMcpRows(m.mcp);
     return {
         ...(num(m.schemaVersion) !== undefined ? { schemaVersion: m.schemaVersion } : {}),
         ...(str(legIn.kind) !== undefined ? { leg: { kind: legIn.kind } } : {}),