@sema-agent/server 7.92.2 → 7.93.1

package/dist/http/routes/rules.js

@@ -3,7 +3,7 @@ import { sendJson, sendError, httpErrorCode } from "../send.js";
 import { gatedPrincipal, explicitOperatorOk } from "../principal-gate.js";
 import { assertNever } from "../route-ctx.js";
 import { createLogger } from "../../observability/logger.js";
-import { RULE_IMPORT_RETRY_AFTER_SEC, MAX_RULE_SCOPE_CHARS, parseRuleScope, sameWireRuleIdentity, serializeRuleScope } from "../../rules-consent.js";
+import { RULE_IMPORT_RETRY_AFTER_SEC, MAX_RULE_SCOPE_CHARS, parseRuleScope, serializeRuleScope } from "../../rules-consent.js";
 import { CONTROL_AND_BIDI_CHARS } from "../../text-bidi.js";
 import { HttpError } from "../../security.js";
 import { MAX_RULE_TEXT_CHARS, RULE_BEHAVIORS } from "@sema-agent/core";
@@ -246,6 +246,40 @@ async function handleRuleList(res, search, caller, lane, operatorPrincipals) {
         : undefined;
     sendJson(res, 200, { rules: page, rev: listing.rev, ...(nextCursor !== undefined ? { nextCursor } : {}) });
 }
+function sendRuleWriteFailure(res, verb, committed) {
+    switch (verb) {
+        case "write":
+            switch (committed) {
+                case "no":
+                    sendError(res, 503, "state.rule_write_failed", "this rule was not written and nothing landed in the store — send the same request again", { committed });
+                    return;
+                case "unknown":
+                    sendError(res, 503, "state.rule_write_failed", "this write may or may not have landed — reconcile with GET /v1/rules before sending it again", { committed });
+                    return;
+                default: {
+                    const unknownWord = committed;
+                    throw new Error(`unknown rule-write committed word: ${JSON.stringify(unknownWord)}`);
+                }
+            }
+        case "revoke":
+            switch (committed) {
+                case "no":
+                    sendError(res, 503, "state.rule_remove_failed", "this rule was not revoked and nothing landed in the store — send the same request again", { committed });
+                    return;
+                case "unknown":
+                    sendError(res, 503, "state.rule_remove_failed", "this revocation may or may not have landed — reconcile with GET /v1/rules before sending it again", { committed });
+                    return;
+                default: {
+                    const unknownWord = committed;
+                    throw new Error(`unknown rule-remove committed word: ${JSON.stringify(unknownWord)}`);
+                }
+            }
+        default: {
+            const unknownVerb = verb;
+            throw new Error(`unknown rule write verb: ${JSON.stringify(unknownVerb)}`);
+        }
+    }
+}
 async function handleRuleWrite(res, rawBody, caller, lane, operatorPrincipals) {
     const parsed = RuleIdentityBodySchema.safeParse(rawBody);
     if (!parsed.success) {
@@ -282,9 +316,9 @@ async function handleRuleWrite(res, rawBody, caller, lane, operatorPrincipals) {
                 detail: written.detail,
             });
             return;
-        case "indeterminate":
-            logger.info("rule write indeterminate", { detail: written.detail });
-            sendError(res, 503, "state.rule_write_failed", "this write could not be confirmed as a standing rule — retry, then reconcile with GET /v1/rules");
+        case "failed":
+            logger.info("rule write failed", { detail: written.detail, committed: written.committed });
+            sendRuleWriteFailure(res, "write", written.committed);
             return;
         default: {
             const unknown = written;
@@ -313,16 +347,12 @@ async function handleRuleRevoke(res, rawBody, caller, lane, operatorPrincipals)
         case "removed":
             sendJson(res, 200, { status: "removed", rev: outcome.rev, stillLive: outcome.stillLive });
             return;
-        case "no-op": {
-            const stillLive = (await lane.listRules(target.principal)).rows.some((r) => sameWireRuleIdentity(r, { behavior: parsed.data.behavior, rule: parsed.data.rule, scope: serializeRuleScope(scope) }))
-                ? "yes"
-                : "no";
-            sendJson(res, 200, { status: "no-op", rev: outcome.rev, stillLive });
+        case "no-op":
+            sendJson(res, 200, { status: "no-op", rev: outcome.rev, stillLive: outcome.stillLive });
             return;
-        }
         case "failed":
-            logger.info("rule revoke failed", { error: outcome.error });
-            sendError(res, 503, "state.rule_remove_failed", "the rule could not be revoked right now — retry, then reconcile with GET /v1/rules");
+            logger.info("rule revoke failed", { error: outcome.error, committed: outcome.committed });
+            sendRuleWriteFailure(res, "revoke", outcome.committed);
             return;
         default: {
             const unknown = outcome;

package/dist/http/routes/runs.js

@@ -2,7 +2,7 @@ import { persistedPlaneOf } from "../../terminal.js";
 import { memoRedactedRead, memoRedactTerminalResult, redactErrorMessage, redactHead, redactLedgerEventData, redactTerminalResult } from "../../observability/run-terminal.js";
 import { isModelTextLedgerEventType } from "../../trace/ledger-events.js";
 import { z } from "zod";
-import { uuidv7, mintCheckpointToken, CheckpointError, validatePendingSteer } from "@sema-agent/core";
+import { uuidv7, mintCheckpointToken, CheckpointError, validatePendingSteer, TASK_OUTPUT_REPLAY_KINDS } from "@sema-agent/core";
 import { isTerminalRunStatus, isParkedRunStatus, runProvenElsewhere } from "../../plugins/store-contracts.js";
 import { LIVE_RUN_GATE_KINDS, TERMINAL_PARK_GATE_KINDS } from "../../plugins/checkpoint-store-sql.js";
 import { redactSecrets } from "../../trace/redact.js";
@@ -1058,8 +1058,9 @@ export async function handleRunVerbs(req, res, match, ctx) {
         const g14 = (() => {
             const d = out.details;
             const replay = d?.details?.replay;
-            if (replay === "cursor" || replay === "full")
+            if (typeof replay === "string" && TASK_OUTPUT_REPLAY_KINDS.includes(replay)) {
                 return { cursorSemantics: replay };
+            }
             return {};
         })();
         sendJson(res, 200, { taskId: runId, target, content: out.content, output: out.details, ...g14 });

package/dist/http/routes/tasks.js

@@ -47,7 +47,7 @@ function sendSubmitResult(res, resp) {
         : raw;
     sendJson(res, 200, body);
 }
-const MULTI_ATTEMPT_NO_EVENT_CHANNEL_NOTICE = "verify / cascade ran with their normal multi-attempt semantics, but the synchronous /v1/tasks endpoint has no event channel — no status/progress frames exist to replay on this shape. For observable events submit via POST /v1/runs and read GET /v1/runs/:id/events.";
+const MULTI_ATTEMPT_NO_EVENT_CHANNEL_NOTICE = "verify / cascade ran with their normal multi-attempt semantics, but the synchronous /v1/tasks endpoint has no event channel — no status/progress frames exist to replay on this shape. For status / progress / delegated-child frames and the terminal done, submit via POST /v1/runs and read GET /v1/runs/:id/events; note that verify / cascade legs carry no per-turn stream there either (no wiring_manifest / text / turn_end frames — the engine runs those legs as result-returning attempts).";
 export async function handleTasks(req, res, match, ctx) {
     const { deps } = ctx;
     const { idemCache, inflightRuns, cancelledViaVerb, steerableRuns, counters } = ctx.registry;

package/dist/http/wire-types.d.ts

@@ -6,7 +6,7 @@
  * cut: ONLY TaskRequestBody (its field types are inline or core imports — no other server.ts-local satellites);
  * sibling request/response shapes can migrate here later on the same pattern.
  */
-import type { A2aServerSpec, AgentDefinition, McpServerSpec, SkillSpec } from "@sema-agent/core";
+import type { A2aServerSpec, AgentDefinition, ApproverPosture, McpServerSpec, SkillSpec } from "@sema-agent/core";
 import type { SettingsPermissionMode } from "../task-settings.js";
 import type { wiringManifestFaceEventData } from "../trace/project.js";
 export interface TaskRequestBody {
@@ -316,6 +316,22 @@ export interface TaskRequestBody {
      *  `SETTINGS_PERMISSION_MODES`(受理腿 `isSettingsPermissionMode` 与两句 400 文案同读那一份)。
      *  改前这里是第 6 份手抄的五词联合 —— 加/退一个模式时 wire 型面与受理腿会各走各的。 */
     permissionMode?: SettingsPermissionMode;
+    /**
+     * **#1000**(core 7.26.0 `TaskSpec.approverPosture`;CC-116 装配口)—— 宿主对这个 run 的**审批姿态声明**:
+     * 「这些卡由我自己自动答」。一个词(`"bypass"`),闭集属主在 core(`ApproverPosture` / `APPROVER_POSTURES`)。
+     *
+     * 🔴 **它不授权任何东西,也不是一只门**(core 头注逐字:"a statement about who answers this run's approval
+     * cards, never an instruction to the gate";引擎只把它**渲**给模型,没有任何裁决腿读它)。所以它与
+     * {@link permissionMode} 的 `"bypassPermissions"` **不是**一回事,也不能互相派生:后者选的是**门的形状**
+     * (且只能收紧、deny-wins),前者只说「谁来答卡」。两者在语义上同族,声明它而不开 `bypassPermissions`
+     * 只是对模型说了一句与实际不符的话 —— 见契约文档那一段的「谁受伤」。
+     *
+     * 🔴 **本仓零判据、原样过境**(`boot/resolve-spec.ts` 写点):词的拒绝逻辑属引擎
+     * (`refuseInvalidApproverPosture` 响亮拒一个不认识的词),server **不加第二道门** —— 在下游再判一次就是
+     * 同一语义面的第二个判官(源头修复纪律 [ref]),而且本仓抄一份词表的那天 core 加第二个词就会被静默 400 掉。
+     * 型也从 core 的 `ApproverPosture` 派生(不抄字面联合)。
+     */
+    approverPosture?: ApproverPosture;
     /** MF-30 memory PAUSE (shell-host contract, option B per-request — clay 2026-06-27): `false` makes THIS run
      *  read-only over long-term memory (`TaskSpec.memory.writeScope:null` — the [ref] memory ENGINE materializes/
      *  reads but its harvest commits nothing). Absent/`true` ⇒ normal read+write. The shell's `/memory` pause carries

package/dist/observability/metrics.js

@@ -1,5 +1,6 @@
 import { DENIED_BY_VALUES } from "@sema-agent/core";
 import { buildPermissionRuleEventsHelp } from "./permission-rule-events.js";
+import { MCP_PROBE_OUTCOMES } from "../capabilities/mcp-probe.js";
 const DEFAULT_BUCKETS = [0.05, 0.1, 0.25, 0.5, 1, 2.5, 5, 10, 30, 60];
 function labelKey(labels) {
     return Object.keys(labels)
@@ -214,6 +215,7 @@ export function createMetrics() {
     m.counter("http_requests_total", "HTTP requests by route/method/status");
     m.histogram("http_request_duration_seconds", "HTTP request duration");
     m.counter("rate_limited_total", "Requests rejected by the rate limiter");
+    m.counter("mcp_probe_total", `No-run MCP status face outcomes by outcome (${MCP_PROBE_OUTCOMES.join("/")} — see src/capabilities/mcp-probe.ts MCP_PROBE_OUTCOMES; rate_limited has TWO causes: the per-identity fixed window AND the replica-wide in-flight cap, which can refuse caller B because of caller A)`);
     m.counter("tasks_total", "Finished tasks by terminal status");
     m.counter("task_tokens_total", "Total model tokens consumed by tasks");
     m.histogram("task_duration_seconds", "Async run wall-clock duration");

package/dist/permission-rule-vocab.d.ts

@@ -1,4 +1,4 @@
-import type { RemoveResult, RuleApprovalRecord, RuleBehavior } from "@sema-agent/core";
+import type { RuleApprovalRecord, RuleBehavior } from "@sema-agent/core";
 /**
  * `PersistedRuleTool` **不再是闭词表**(core 7.9.0 / [ref]):工具名自 core 的**目录**派生
  * (`pathTarget` 声明 ⇒ 路径文法;`Bash` ⇒ 命令文法),型是 `string`。于是本文件对它的处置从
@@ -61,13 +61,13 @@ export declare const RULE_APPROVAL_RECORD_SCHEMA: RuleApprovalRecord["schema"];
  * `"unknown"` = **回答这一问的那次读回没做成** —— 这个域唯一不肯说的那句话是「看不见 ⇒ 没有」,
  * 第三个词就是它的反面。
  *
- * 🔴 **型从 core 的导出型派生,不是抄一份字面联合**:`RemovalLiveness` 本身没有从包根导出
- * (亲验 `dist/index.d.ts`:只导 `RemoveResult`),而 `RemoveResult` 的 removed 臂上就带着它 ⇒ 从那里
- * `Extract` 出来。抄一份 `"yes"|"no"|"unknown"` 的下场与本文件顶注说的那一族一样:core 加第四个词
- * (或改掉某一个)时,抄件不会红。派生形则**编译期**先红在每一处穷举上。
- * (已向 core 请托把这只型放上包根导出面;到货后本行换成直接 import,词表值零变化。)
+ * 🔴 **型从 core 的包根导出接过来,本仓零抄**(core 7.26.0 S-538 ⓐ:`RemovalLiveness` 随请托上了导出面)。
+ * 上一版是 `Extract<RemoveResult, {status:"removed"}>["stillLive"]` —— 那是派生而非手抄(值不会漂),但它把
+ * 一只**独立的闭集**寄生在某一个臂的形状上:core 哪天给 `removed` 臂改名、或让这只词表先在别的臂上落地,
+ * 派生式就会指向一个与词表无关的东西。现在两者同名同源。
+ * 🔴 **运行期词表 `REMOVAL_LIVENESS_WORDS` 刻意不 re-export**:本仓对这三个词零运行期判据(值由 core 在两只
+ * 200 体上原样透传,分支全走编译期穷尽),开一扇没人走的门只会让台账多一行「引用而不消费」的例外。
+ * 哪天真要判「这个串在不在表里」,那时从 core 直接读它。
  */
-export type RemovalLiveness = Extract<RemoveResult, {
-    status: "removed";
-}>["stillLive"];
+export type { RemovalLiveness } from "@sema-agent/core";
 //# sourceMappingURL=permission-rule-vocab.d.ts.map

package/dist/plugins/remote-env-host.d.ts

@@ -134,6 +134,11 @@ export declare class RemoteHostExecutionEnv implements RemoteExecutionEnv, Sched
      * ② 把读拉进来会让 teardown 去等一次可能**永不 settle** 的读(workspace 里的 FIFO / 特殊文件),
      *    把 destroy 挂死 —— 拿一条新的可用性病换一条不存在的正确性收益。
      * 判据因此是一句话:**「可能建路径或改路径的那些面」进在飞集合**,不是「过了 fsReady 的都进」。
+     *
+     * ── 不止文件面(S-541)─────────────────────────────────────────────────────────────────────────
+     * 判据是「会不会建/改路径」,**不是**「在不在 `env` 的文件面上」。后台 shell 的 `launch`(`makeBgDriver`)
+     * 在 spool 根下 `mkdir` 一棵子树,而它整段期间 `bgManager.hasShells()` 还是 false(`shells.set` 在
+     * `await launch(ctx)` 之后)⇒ 同一条竞态的另一张脸,同一只集合治。见那处头注。
      */
     private withInflightFs;
     /**

package/dist/plugins/remote-env-host.js

@@ -213,45 +213,47 @@ export class RemoteHostExecutionEnv {
     makeBgDriver() {
         const self = this;
         return {
-            async launch(command, options, ctx) {
-                const ready = await self.shellReady();
-                if (!ready.ok)
-                    throw new BackgroundShellError("spawn_failed", ready.error.message);
-                const dir = path.join(self.ensureSpoolRoot(), "bg-" + randomBytes(8).toString("hex"));
-                await fs.mkdir(dir, { recursive: true });
-                const outPath = path.join(dir, "out");
-                const errPath = path.join(dir, "err");
-                const outFh = await fs.open(outPath, "w");
-                const errFh = await fs.open(errPath, "w");
-                let child;
-                try {
-                    const sh = hostShell();
-                    child = spawn(sh.shell, [...sh.args, command], {
-                        cwd: self.resolve(options?.cwd ?? self.cwd),
-                        env: self.mergeEnv(options?.env),
-                        ...spawnGroupOptions(),
-                        stdio: ["ignore", outFh.fd, errFh.fd],
-                    });
-                }
-                catch (e) {
+            launch(command, options, ctx) {
+                return self.withInflightFs(async () => {
+                    const ready = await self.shellReady();
+                    if (!ready.ok)
+                        throw new BackgroundShellError("spawn_failed", ready.error.message);
+                    const dir = path.join(self.ensureSpoolRoot(), "bg-" + randomBytes(8).toString("hex"));
+                    await fs.mkdir(dir, { recursive: true });
+                    const outPath = path.join(dir, "out");
+                    const errPath = path.join(dir, "err");
+                    const outFh = await fs.open(outPath, "w");
+                    const errFh = await fs.open(errPath, "w");
+                    let child;
+                    try {
+                        const sh = hostShell();
+                        child = spawn(sh.shell, [...sh.args, command], {
+                            cwd: self.resolve(options?.cwd ?? self.cwd),
+                            env: self.mergeEnv(options?.env),
+                            ...spawnGroupOptions(),
+                            stdio: ["ignore", outFh.fd, errFh.fd],
+                        });
+                    }
+                    catch (e) {
+                        await outFh.close().catch(() => { });
+                        await errFh.close().catch(() => { });
+                        await fs.rm(dir, { recursive: true, force: true }).catch(() => { });
+                        throw new BackgroundShellError("spawn_failed", e instanceof Error ? e.message : String(e), e);
+                    }
+                    const pid = child.pid;
+                    if (pid != null) {
+                        child.on("close", (code, signal) => ctx.onTerminal(false, code ?? (signal ? 128 + (signalNumber(signal) ?? 9) : 0)));
+                        child.on("error", () => ctx.onTerminal(true));
+                        child.unref();
+                    }
                     await outFh.close().catch(() => { });
                     await errFh.close().catch(() => { });
-                    await fs.rm(dir, { recursive: true, force: true }).catch(() => { });
-                    throw new BackgroundShellError("spawn_failed", e instanceof Error ? e.message : String(e), e);
-                }
-                const pid = child.pid;
-                if (pid != null) {
-                    child.on("close", (code, signal) => ctx.onTerminal(false, code ?? (signal ? 128 + (signalNumber(signal) ?? 9) : 0)));
-                    child.on("error", () => ctx.onTerminal(true));
-                    child.unref();
-                }
-                await outFh.close().catch(() => { });
-                await errFh.close().catch(() => { });
-                if (pid == null) {
-                    await fs.rm(dir, { recursive: true, force: true }).catch(() => { });
-                    throw new BackgroundShellError("spawn_failed", "host background spawn produced no pid");
-                }
-                return { pid, dir, outPath, errPath, stdoutCursor: 0, stderrCursor: 0 };
+                    if (pid == null) {
+                        await fs.rm(dir, { recursive: true, force: true }).catch(() => { });
+                        throw new BackgroundShellError("spawn_failed", "host background spawn produced no pid");
+                    }
+                    return { pid, dir, outPath, errPath, stdoutCursor: 0, stderrCursor: 0 };
+                });
             },
             async read(state) {
                 if (state.mem) {

package/dist/plugins/store-backend.js

@@ -8,6 +8,7 @@ import { FileOutcomeSink } from "./file-outcome-sink.js";
 import { TiDBWorkflowRunStore, TiDBWorkflowCompletionInbox, TiDBWorkflowNotifyJournalStore, TiDBWorkflowAgentSessionIndex, PgWorkflowRunStore, PgWorkflowCompletionInbox, PgWorkflowNotifyJournalStore, PgWorkflowAgentSessionIndex } from "./workflow-run-store-sql.js";
 import { FileRunStore } from "./file-run-store.js";
 import { StoreBootRefusalError } from "./store-contracts.js";
+import { acquireLocalBackendWithWait } from "./store-lock-wait.js";
 import { NO_SQL_MIGRATIONS, runSqlOneTimeMigrations } from "./one-time-migrations.js";
 import { LocalSessionStore } from "./local-session-store.js";
 import { LocalCheckpointStore } from "./local-checkpoint-store.js";
@@ -215,7 +216,7 @@ class LocalBackend {
         this.onWarn = onWarn;
         this.onError = onError;
         try {
-            this.fileBackend = new FileStorageBackend({
+            this.fileBackend = acquireLocalBackendWithWait(() => new FileStorageBackend({
                 root,
                 ...(config.fileHistory !== undefined ? { fileHistory: config.fileHistory } : {}),
                 onCorruptRead: (info) => this.onWarn?.("file_store_corrupt_read", {
@@ -228,7 +229,7 @@ class LocalBackend {
                         "layer (deployment policy / hooks / shell gate still applied); session repo = a listing silently omitted " +
                         "rows; file-history = a rewind boundary or scope read as missing. Inspect the named path before deciding.",
                 }),
-            });
+            }), config.storeLockWaitMs, (fields) => this.onWarn?.("store_dir_lock_wait", { ...fields }));
         }
         catch (e) {
             if (e instanceof AdoptionError)

package/dist/plugins/store-lock-wait.d.ts

@@ -0,0 +1,23 @@
+/** 轮询节拍。250ms:比人感知门槛粗、比最短真等待窗(壳重启窗 1-3s)细一个数量级。 */
+export declare const STORE_LOCK_POLL_MS = 250;
+/** 进入等待腿时的**一次性**披露(不刷屏:结构上只在第一次撞锁时调一次,不是靠一个 flag 挡)。 */
+export type StoreLockWaitSink = (fields: {
+    readonly ownerPid: number;
+    readonly dir: string;
+    readonly waitMs: number;
+}) => void;
+/** 时钟两面。`sleep` 是**同步**的(理由见顶注);两面都是形参,判据不靠真时间。 */
+export interface StoreLockWaitClock {
+    now(): number;
+    sleep(ms: number): void;
+}
+/**
+ * 取数据根(= 跑一次 `construct()`);撞上活持锁人且窗为正 ⇒ 在窗内反复重取,到窗仍取不到 ⇒ 原码 fatal。
+ *
+ * @param construct 取数据根的那一次构造(本仓唯一调用点:`store-backend.ts` 的 local 臂,它在那里构造 `FileStorageBackend`)。
+ *                  **必须**可重入:core 先取锁后建店,取不到时零副作用(顶注已亲读核实)。
+ * @param waitMs    `STORE_LOCK_WAIT_MS`。`> 0` 才等;`0` / 非数 ⇒ 7.93.0 的当场拒逐字同形。
+ * @param onWait    进入等待腿的一次性披露口。
+ */
+export declare function acquireLocalBackendWithWait<T>(construct: () => T, waitMs: number, onWait: StoreLockWaitSink, clock?: StoreLockWaitClock): T;
+//# sourceMappingURL=store-lock-wait.d.ts.map

package/dist/plugins/store-lock-wait.js

@@ -0,0 +1,39 @@
+import { dirname } from "node:path";
+import { FileStoreLockError } from "@sema-agent/core";
+export const STORE_LOCK_POLL_MS = 250;
+const REAL_CLOCK = {
+    now: () => performance.now(),
+    sleep: (ms) => void Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms),
+};
+function liveOwnerPidOf(err) {
+    if (!(err instanceof FileStoreLockError))
+        return undefined;
+    if (err.code !== "store.dir_in_use")
+        return undefined;
+    return err.ownerPid;
+}
+export function acquireLocalBackendWithWait(construct, waitMs, onWait, clock = REAL_CLOCK) {
+    let startedAt;
+    for (;;) {
+        try {
+            return construct();
+        }
+        catch (err) {
+            const ownerPid = liveOwnerPidOf(err);
+            if (ownerPid === undefined || !(waitMs > 0))
+                throw err;
+            const lockErr = err;
+            if (startedAt === undefined) {
+                startedAt = clock.now();
+                onWait({ ownerPid, dir: dirname(lockErr.lockPath), waitMs });
+            }
+            const waitedMs = clock.now() - startedAt;
+            if (waitedMs >= waitMs) {
+                throw new FileStoreLockError(lockErr.code, `${lockErr.message} — waited ${Math.round(waitedMs)}ms for it to release the directory ` +
+                    `(STORE_LOCK_WAIT_MS=${waitMs}); it is still holding it`, lockErr.lockPath, lockErr.ownerPid);
+            }
+            clock.sleep(Math.min(STORE_LOCK_POLL_MS, waitMs - waitedMs));
+        }
+    }
+}
+//# sourceMappingURL=store-lock-wait.js.map

package/dist/request-key-closure.js

@@ -19,7 +19,7 @@ export function keyClosureClause(names, label) {
 }
 const TASK_BODY_DECLARED_KEYS = [
     "a2aPeers", "acceptPartialRestore", "additionalDirectories", "additionalReadDirectories", "agents",
-    "appendSystemPrompt", "attachmentIds", "attachments", "capabilitiesNeeded", "cascade", "clientContext",
+    "appendSystemPrompt", "approverPosture", "attachmentIds", "attachments", "capabilitiesNeeded", "cascade", "clientContext",
     "compaction", "compactionModel", "council", "cwd", "debate", "deferTools", "deviceId", "enableFork",
     "excludeAllTools", "excludeTools",
     "finalVerification", "forwardSubagentEvents", "images", "interactiveTools", "jobId", "limits", "maxCostUsd",

package/dist/rules-consent.d.ts

@@ -1,5 +1,5 @@
 import { type DirectWritableRuleBehavior, type RemovalLiveness } from "./permission-rule-vocab.js";
-import { type RuleOwner, type ImportPreview, type RedeemedBatchMember, type ImportedSettingsLayer, type PersistedRule, type RuleBehavior, type RuleCandidate, type EffectivePermissionRule, type RemoveResult, type EditedRuleTextPrecheck, type RuleScope, type RuleOffer } from "@sema-agent/core";
+import { type RuleOwner, type ImportPreview, type RedeemedBatchMember, type ImportedSettingsLayer, type PersistedRule, type RuleBehavior, type RuleCandidate, type EffectivePermissionRule, type RemoveResult, type RuleWriteCommitted, type EditedRuleTextPrecheck, type RuleScope, type RuleOffer } from "@sema-agent/core";
 import type { DurableRulePartitionProvider, PermissionRuleStoreProvider, RuleApprovalRecordStore } from "@sema-agent/core";
 import { type RuleImportTicket, type RuleTicketPurpose, type RuleTicketReclaimResult, type RuleTicketRedeemResult, type RuleTicketSnapshot } from "./plugins/permission-rule-store-sql.js";
 /**
@@ -615,10 +615,14 @@ export type RuleWritten =
  *  才是谎 —— 亲读 core 的 `AddResult`,`added` 臂只有 `{status, rev, dot}`,**刻意**不带行(头注:之后
  *  落地的撤销是「`list()` 答的普通后续事件」),而本仓的行形带着 `status: "live"` 这一格,给一行已经
  *  不在的规则铸它就是第二个谎。 */
+/** 🔴 `"unknown"`(7.93.0 合并复审 codex 验真后加):引擎已确认 `added`(`rev` 在手),而**写后读回本身抛了**
+ *  (店读不出来)。「写没写」有答案、「现在站不站着」没人观察 —— 与撤销口 `no-op` + `unknown` 同词同义:
+ *  **不要重试**(重发只会 `no-op`),用 `GET /v1/rules` 对账。此前这一形落域外通用 500 `internal.error`,
+ *  与「写前读库失败」(零写,重发安全)走同一个异常出口 —— 两种强度一句话,正是 `committed` 要拆开的那对。 */
  | {
     status: "persisted" | "no-op";
     rev: number;
-    stillLive: Extract<RemovalLiveness, "no">;
+    stillLive: Exclude<RemovalLiveness, "yes">;
     row?: undefined;
 }
 /** 裁定性不收(内容判据 / 方向判据)。`detail` 是给人看的那一半,`reason` 是给客户端分流的那一半。 */
@@ -627,11 +631,24 @@ export type RuleWritten =
     reason: LocalImportRefusalCode;
     detail: string;
 }
-/** **不知道落没落**:店在这一条上出了状况(core 的 `failed` 两种强度)。如实编,禁猜(端点侧 503 +
- *  指路 `GET /v1/rules` 对账)。**「写落了随后被撤」不在本臂** —— 那一形有答案,见上面 `stillLive:"no"`。 */
+/** 终态写失败。`detail` 是给人看的那一半;`committed`({@link RuleWriteCommitted},core 的两词闭集)是
+ *  给机器分流的那一半 —— 它回答的是**调用方下一步该做什么**。
+ *
+ *  🔴 **词从 core 的 `AddResult.failed` 原样接过来,不从报文里猜**(core 7.26.0 [ref])。此前本臂叫
+ *  `indeterminate` 且只带 `detail`:core 把「店自己答了、确知零写」与「apply 抛了、落没落不知道」两种强度
+ *  **只写在散文里**,本仓于是把两者一律折成「不确定」+ 端点 503「retry」。代价是那句 retry 对两种强度**一句
+ *  都不对**:`"no"` 的那半确知零写、重发同一份体是安全的(而旧文案让客户端以为要先对账);`"unknown"` 的那半
+ *  可能已经落了,而盲重试会**再铸一枚 dot**、把刚被人撤掉的收紧重新立起来(core `AddResult.failed` 头注逐字
+ *  警告过这条路)——那正是本臂最需要说清的一句话,旧形却把它和安全的那半说成了同一句。
+ *
+ *  🔴 臂名随词改成 core 的 `failed`(不再叫 `indeterminate`):拿到判别位之后,「不确定」对 `"no"` 这半是
+ *  **假的**,而一个名字与它所含的一半相反的臂,下一个读它的人一定读错。两个词表合成一个,规则少一条。
+ *
+ *  **「写落了随后被撤」不在本臂** —— 那一形有答案,见上面 `stillLive:"no"`。 */
  | {
-    status: "indeterminate";
+    status: "failed";
     detail: string;
+    committed: RuleWriteCommitted;
 };
 export interface RuleConsentLane {
     /** 卡道兑付口:一次 ask 决议携规则确认 ⇒ prepare→confirm→redeem 一气呵成。 */

package/dist/rules-consent.js

@@ -736,7 +736,14 @@ export function createRuleConsentLane(stores, opts) {
                 adds: [],
             };
             const rowOf = (rows) => rows.find((r) => sameWireRuleIdentity(r, { behavior: input.behavior, rule: written.rule.rule, scope: row.scope }));
-            const before = await lane.listRules(input.principal);
+            let before;
+            try {
+                before = await lane.listRules(input.principal);
+            }
+            catch (e) {
+                localImportLogger.warn("direct_rule_write_pre_read_failed", { behavior: input.behavior, err: e instanceof Error ? e.message : String(e) });
+                return { status: "failed", detail: `the rule store could not be read before writing: ${e instanceof Error ? e.message : String(e)}`, committed: "no" };
+            }
             const standing = rowOf(before.rows);
             if (standing !== undefined)
                 return { status: "no-op", rev: before.rev, stillLive: "yes", row: standing };
@@ -750,15 +757,22 @@ export function createRuleConsentLane(stores, opts) {
                 case "no-op":
                     break;
                 case "failed":
-                    return { status: "indeterminate", detail: added.error };
+                    return { status: "failed", detail: added.error, committed: added.committed };
                 default: {
                     const unknown = added;
                     throw new Error(`unknown addPersistedRule outcome: ${JSON.stringify(unknown)}`);
                 }
             }
-            const readBack = await lane.listRules(input.principal);
-            const landed = rowOf(readBack.rows);
             const status = added.status === "no-op" ? "no-op" : "persisted";
+            let readBack;
+            try {
+                readBack = await lane.listRules(input.principal);
+            }
+            catch (e) {
+                localImportLogger.warn("direct_rule_write_read_back_failed", { behavior: input.behavior, scope: row.scope, rev: added.rev, wrote: status === "persisted", err: e instanceof Error ? e.message : String(e) });
+                return { status, rev: added.rev, stillLive: "unknown" };
+            }
+            const landed = rowOf(readBack.rows);
             if (landed === undefined) {
                 localImportLogger.warn("direct_rule_write_vanished_before_read_back", {
                     behavior: input.behavior,

package/dist/run-local.js

@@ -17,6 +17,7 @@ import { taskWallClockSec } from "./task-workflow.js";
 import { applyCatalogToSource } from "./capabilities/center-prompts.js";
 import { validatePromptsDomain, CORE_ENGINE_VERSION } from "./prompts-domain-validate.js";
 import { buildUnpricedCeilingNotice, loadConfig, logConfigDiagnostics, parseNumOrFailNonNegative } from "./config.js";
+import { acquireLocalBackendWithWait } from "./plugins/store-lock-wait.js";
 import { createConfigProvider } from "./config-provider.js";
 import { applyEffective, applyCenterReadFace, resolveMcpServers, mcpForScenario, resolveA2aPeers, a2aForScenario } from "./config-center/facade.js";
 import { hostExecutionEnvFactory } from "./plugins/remote-env-host.js";
@@ -253,7 +254,7 @@ export async function runLocal(argv, deps = {}) {
     const pricing = buildPricing(config.models);
     let fileBackend;
     try {
-        fileBackend = new FileStorageBackend({
+        fileBackend = acquireLocalBackendWithWait(() => new FileStorageBackend({
             root,
             ...(config.fileHistory !== undefined ? { fileHistory: config.fileHistory } : {}),
             onCorruptRead: (info) => logger.warn("file_store_corrupt_read", {
@@ -266,7 +267,7 @@ export async function runLocal(argv, deps = {}) {
                     "layer (deployment policy / hooks / shell gate still applied); session repo = a listing silently omitted " +
                     "rows; file-snapshot = a snapshot or scope read as missing. Inspect the named path before deciding.",
             }),
-        });
+        }), config.storeLockWaitMs, (fields) => logger.warn("store_dir_lock_wait", { ...fields }));
     }
     catch (e) {
         printErr(`cannot open local data dir ${root}: ${e instanceof Error ? e.message : String(e)}`);

package/dist/task-mcp.d.ts

@@ -41,6 +41,38 @@ export declare const MAX_REQUEST_MCP_SERVERS = 32;
  * 有界点名两头都占:该说的仍然说得出,量级钉死在与挂载同阶。
  */
 export declare const MAX_REQUEST_MCP_DROP_NAMES = 32;
+/**
+ * S-481 —— 一条 `mcpServers[]` 条目在 wire 上的**键闭集**,与它两种传输各自的键闭集。
+ *
+ * ## 属主为什么在这里
+ * 这个文件就是「请求腿的 MCP 条目形」的家({@link normalizeServer} 逐键读的正是这些)。S-481 的探测口
+ * ({@link import("./capabilities/mcp-probe.js").readMcpProbeBody})要的是**同一个**词表 —— 它在自己那边
+ * 再写一份就是一份手抄投影([ref]:任何仓第一排查点),而两份哪天分岔,窄的那一份会把**合法**的键当成
+ * 拼写错误 400 掉。
+ *
+ * ## 🔴 两向钉在 core 的 `McpServerSpec` 上(不是手抄)
+ * 下面六道编译期门:型上多一个键而表没跟 ⇒ 红;表里写一个型上没有的词(改名 / 拼错 / 删键后的残条目)
+ * ⇒ 也红。于是这三张表是从 core 的型**派生**出来的数据,而不是誰记得去同步的清单。
+ *
+ * ## 两个消费点的处置**刻意不同**(同一张表,不同的门)
+ *  · 提交腿({@link normalizeServer})对词表外的键**宽容**(读不认识的键就当没有)—— 那条腿要能安全地
+ *    重放存量 body,一个 4xx 打在 resume 上会永久砖死一条 parked 任务(本仓三处 `opts.leg` 先例);
+ *  · 探测口**响亮拒**(400,点名 `mcpServers[i].<键>`)—— 它问的是「这台到底能不能用」,把一个拼错的键
+ *    悄悄忽略再回一份好看的名单,正是那条面要根除的假答案。
+ * 两个门,一个词表。表在这里,门在各自的腿上。
+ */
+export declare const MCP_SERVER_ENTRY_KEYS: readonly ["allowTools", "contentOrigin", "elicitation", "name", "source", "toolAxes", "toolFaces", "transport"];
+/** `transport.kind:"stdio"` 的键闭集(两向钉在 core 那一支上)。 */
+export declare const STDIO_MCP_TRANSPORT_KEYS: readonly ["args", "command", "env", "kind"];
+/** `transport.kind:"http"` 的键闭集(同上)。 */
+export declare const HTTP_MCP_TRANSPORT_KEYS: readonly ["headers", "kind", "principalHeader", "url"];
+/** 条目层:`{}` 与缺席等价的可选 Record 键。 */
+export declare const MCP_ENTRY_EMPTY_RECORD_KEYS: readonly ["toolAxes", "toolFaces"];
+/** 条目层:`[]` 与缺席等价的可选数组键。 */
+export declare const MCP_ENTRY_EMPTY_ARRAY_KEYS: readonly ["allowTools"];
+/** 传输层(两种合起来):`{}` / `[]` 与缺席等价的键。 */
+export declare const MCP_TRANSPORT_EMPTY_RECORD_KEYS: readonly ["env", "headers"];
+export declare const MCP_TRANSPORT_EMPTY_ARRAY_KEYS: readonly ["args"];
 /**
  * Does THIS deployment honor caller-supplied per-request MCP servers? TRUE for a SINGLE-USER deployment
  * (`requirePrincipal !== true`) — the requester is the super-admin of their own worker, so their `.mcp.json` is

package/dist/task-mcp.js

@@ -8,6 +8,13 @@ import { readMcpToolFaces } from "./mcp-tool-faces.js";
 import { isToolAxisIrreversibility, isToolEffect } from "./tool-axis-words.js";
 export const MAX_REQUEST_MCP_SERVERS = 32;
 export const MAX_REQUEST_MCP_DROP_NAMES = MAX_REQUEST_MCP_SERVERS;
+export const MCP_SERVER_ENTRY_KEYS = ["allowTools", "contentOrigin", "elicitation", "name", "source", "toolAxes", "toolFaces", "transport"];
+export const STDIO_MCP_TRANSPORT_KEYS = ["args", "command", "env", "kind"];
+export const HTTP_MCP_TRANSPORT_KEYS = ["headers", "kind", "principalHeader", "url"];
+export const MCP_ENTRY_EMPTY_RECORD_KEYS = ["toolAxes", "toolFaces"];
+export const MCP_ENTRY_EMPTY_ARRAY_KEYS = ["allowTools"];
+export const MCP_TRANSPORT_EMPTY_RECORD_KEYS = ["env", "headers"];
+export const MCP_TRANSPORT_EMPTY_ARRAY_KEYS = ["args"];
 export function mcpInjectionHonored(config) {
     if (config.lockedConfigKeys?.includes("mcp") === true)
         return false;

package/dist/tool-approval.d.ts

@@ -124,6 +124,27 @@ export interface ToolApprovalFrame {
      *  本键让 live-only 部署(店缺席、帧无卡)也能读到出身位;安全类标记不得依赖店在场([ref] 结构性
      *  缺口成文)。消费语义(cli 挂点已预埋):在场 ⇒ 一切自动放行让位(含记住的规则与 bypass 姿态)。 */
     requiresRealApproval?: true;
+    /**
+     * **[ref]**(core 7.26.0;**ADDITIVE**,`"tool_approval"` only)—— **这一问没有任何规则能清掉**
+     * (`AskRequest.mandated`:org / 治理层、保护判官、hook 的筛查权、被祖先的应答者裁决的问…… 由引擎在闸站
+     * 盖章,策略方不可自填、只可收紧)。壳据它渲染「规则清不掉这一问」,并让**声明了自动应答姿态**的席位知道
+     * 哪些卡它不该自动答。
+     *
+     * 🔴 **别拿 `ruleOffersAbsence:"mandated"` 顶替它**(core 头注逐字警告过这条路):那只键回答的是**规则报价
+     * 车道**有什么可给,而那条车道对它不说话的工具、**没接规则店的部署**(本仓的 live-only 形)、装不下规则的
+     * 任务都是结构性沉默 —— 它的缺席**不是**断言。本键是这一问**自己**的属性,凡强制皆在场。读错的代价 core
+     * 实测过:同一条根外读命令在 shell 工具上是强制问、在 monitor 工具上看起来是普通问。
+     *
+     * 🔴 **它不是 `requiresRealApproval`**:强制只说「没有规则能清掉」,**不**说「没有应答者可以答」——
+     * 一个人、一只 hook、一张一揽子 `onAsk:"allow"` 席照常答得了强制卡。两键别互推。
+     *
+     * 🔴 **真才带,缺席绝不编 `false`**(`governanceForced` / `requiresRealApproval` 同形)。缺席同时覆盖
+     * 「不是强制」「老引擎」「这是一张从 park 行上重铸的耐久卡」三形 —— **耐久面上本仓不造孪生座**:core 的
+     * 寄存行(`PendingAction`)没有这一位(KL-997a 亲读登记),行上强制表现为 `ruleOffersAbsence:"mandated"`
+     * 且无 `ruleOffers`;在 `card_json` 侧自铸一个就是本仓成了这个事实的第二个源(而 park 那侧根本没有输入)。
+     * 🔴 echo-only:server 不据它做任何裁决(强制的判定属主在 core 的闸站)。
+     */
+    mandated?: true;
     /**
      * **S-125③/[ref]**(core 7.5.0;**ADDITIVE**,`"tool_approval"` only)—— 这只 ask 的**出身**:
      * 谁提的这一问,一个 core 闭集词(`ASK_ORIGINS` **11 员**,core 7.14.0 现值:content_question /
@@ -179,7 +200,7 @@ export interface ToolApprovalFrame {
      *
      * 🔴 **原样回传**(core 契约 `shell.read_boundary.grant_candidate_is_the_grant`):`dir` 是绝对、已做词法
      * 折叠、用读边界自己的拼法写的串;**显示的串就是要加的串**。壳可以为了好看渲一个缩短形,回传必须是
-     * 本键里的原串。⇒ 本仓的姿势是「整只逐字带,或整只丢」,**绝不截**(见 `MAX_READ_ROOT_CANDIDATE_DIR`)。
+     * 本键里的原串。⇒ 本仓的姿势是「整只逐字带,或整只丢」,**绝不截**(界见 core 的 `READ_ROOT_CANDIDATE_DIR_MAX`)。
      *
      * 🔴 **echo-only,零判读**:server 不从命令文本重推目录,也不复核它真不真能清掉这只 ask —— core 已经
      * 把提议的根放回读边界又走了一遍才递出来,下游再判一遍就是同一事实的第二个判官(与 `origin` /