@sema-agent/server 7.97.0 → 7.99.0

package/dist/boot/config-center.js

@@ -10,8 +10,9 @@ import { applyCenterPlugins } from "../capabilities/center-plugins.js";
 import { applyCatalogToSource, withPromptArtifactBackfill } from "../capabilities/center-prompts.js";
 import { validatePromptsDomain, CORE_ENGINE_VERSION } from "../prompts-domain-validate.js";
 import { centerScenarios, centerScenarioDetails } from "../capabilities/scenarios.js";
-import { configLkgEnabled } from "../config.js";
-import { defaultLkgPath, defaultSkillCacheDir, saveLkg, loadLkg } from "../config-lkg.js";
+import { configLkgEnabled, isRosterGateArmed } from "../config.js";
+import { defaultLkgPath, defaultSkillCacheDir, saveLkg, loadLkg, legacyV1LkgPath, migrateV1Lkg } from "../config-lkg.js";
+import { answerStillCurrent, centerStateBin, credentialIdentityNow } from "../center-credential.js";
 import { centerManagedConfigKeys } from "../config-center/apply-effective.js";
 import { createConfigProvider, raceBootFetch, BOOT_FETCH_DEFERRED } from "../config-provider.js";
 import { executionLaneCaps, executionLaneOf } from "../execution-lane-caps.js";
@@ -53,6 +54,43 @@ export async function createConfigCenterRuntime(ctx) {
     let bootSkillStale = false;
     let pendingRestart;
     const cc = config.configCenter;
+    const bootCredential = cc?.credential.read();
+    if (cc !== undefined && bootCredential !== undefined && !bootCredential.ok) {
+        logger.error("center_credential_unreadable", {
+            key: "SEMA_REGISTRY_TOKEN_FILE",
+            reason: bootCredential.reason,
+            effect: "every center request fails its own failure arm until the file is readable (config pull keeps env/LKG-less boot, caps fail-closed, lease takes the loud auth-error arm); no on-disk LKG / prompt state is read back (credential identity unknown)",
+        });
+    }
+    const currentIdentity = () => (cc === undefined ? undefined : credentialIdentityNow(cc.credential));
+    const candidateIdentity = new WeakMap();
+    const candidateIdentityOf = (eff) => candidateIdentity.get(eff);
+    const validatorIdentity = new Map();
+    const bindValidator = (etag, identity) => {
+        if (etag === undefined)
+            return;
+        validatorIdentity.delete(etag);
+        validatorIdentity.set(etag, identity);
+        const oldest = validatorIdentity.keys().next();
+        if (validatorIdentity.size > 16 && oldest.done !== true)
+            validatorIdentity.delete(oldest.value);
+    };
+    const pullEffective = async (provider, etag) => {
+        if (provider.kind === "local")
+            return provider.fetchEffective(etag);
+        const before = currentIdentity();
+        const conditional = etag !== undefined && before !== undefined && validatorIdentity.get(etag) === before ? etag : undefined;
+        const r = await provider.fetchEffective(conditional);
+        const used = r === null ? before : r.credentialIdentity;
+        if (cc === undefined || !answerStillCurrent(cc.credential, used)) {
+            throw new Error("center credential identity changed while the effective pull was in flight — response discarded; the next pull runs under the current credential");
+        }
+        if (r !== null) {
+            candidateIdentity.set(r.effective, used);
+            bindValidator(r.etag, used);
+        }
+        return r;
+    };
     let sealedKeys;
     try {
         sealedKeys = await ensureSealedKeyStore(join(config.localDataRoot ?? localRoot, "sealed-key"), logger);
@@ -70,11 +108,11 @@ export async function createConfigCenterRuntime(ctx) {
     const configProvider = cc || config.configProvider === "local"
         ? createConfigProvider({
             ...(config.configProvider ? { provider: config.configProvider } : {}),
-            ...(cc ? { configCenter: { baseUrl: cc.baseUrl, token: cc.token, worker: cc.worker, dryRun: cc.dryRun } } : {}),
+            ...(cc ? { configCenter: { baseUrl: cc.baseUrl, credential: cc.credential, worker: cc.worker, dryRun: cc.dryRun } } : {}),
             ...(config.configProvider === "local" ? { localDir: localRoot } : {}),
         })
         : undefined;
-    const rosterGateArmed = cc !== undefined && !cc.dryRun && process.env.CONFIG_REQUIRE_ROSTER === "true";
+    const rosterGateArmed = isRosterGateArmed(cc);
     const modelReadyState = { ready: !rosterGateArmed };
     const markRosterLanded = (eff) => {
         if (!modelReadyState.ready && (eff.models?.models ?? []).some((m) => m.enabled !== false)) {
@@ -88,41 +126,106 @@ export async function createConfigCenterRuntime(ctx) {
         if (!pendingCatalogFaces)
             return;
         const { target } = pendingCatalogFaces;
-        if (await applyCatalogToSource(promptSource, target, centerPrompts, logger, phase)) {
+        if (await applyCatalogToSource(catalogSource, target, centerPrompts, logger, phase)) {
             centerPrompts = target;
             pendingCatalogFaces = undefined;
         }
     };
     const promptEpochDir = join(config.localDataRoot ?? localRoot, "prompt-epoch");
-    const promptStateDir = join(promptEpochDir, "state", cc?.worker === undefined ? "global" : `worker-${createHash("sha256").update(cc.worker).digest("hex").slice(0, 16)}`);
-    const withByDigestBackfill = (inner) => cc?.baseUrl ? withPromptArtifactBackfill(inner, (d) => fetchPromptArtifact(cc.baseUrl, cc.token, d), logger) : inner;
+    const promptStateRoot = join(promptEpochDir, "state");
+    let promptStateIdentity = currentIdentity();
+    const promptStateBin = () => (cc === undefined ? "global" : promptStateIdentity === undefined ? undefined : centerStateBin(cc.worker, promptStateIdentity));
+    const storePerBin = (make) => {
+        const stores = new Map();
+        return (bin) => {
+            const hit = stores.get(bin);
+            if (hit !== undefined)
+                return hit;
+            const made = make(bin);
+            stores.set(bin, made);
+            return made;
+        };
+    };
+    const fileStateStoreFor = storePerBin((bin) => new FilePromptSourceStateStore(join(promptStateRoot, bin)));
+    const binnedPromptStateStore = (storeFor) => ({
+        load: async () => {
+            const bin = promptStateBin();
+            return bin === undefined ? undefined : storeFor(bin).load();
+        },
+        save: async (state) => {
+            const bin = promptStateBin();
+            if (bin === undefined)
+                throw new Error("center credential identity unknown (credential unreadable at adoption) — prompt source state not persisted");
+            await storeFor(bin).save(state);
+        },
+    });
+    let promptPersisted;
+    const recordingStateStore = (inner) => ({
+        load: async () => {
+            promptPersisted = await inner.load();
+            return promptPersisted;
+        },
+        save: async (state) => {
+            await inner.save(state);
+            promptPersisted = state;
+        },
+    });
+    const withByDigestBackfill = (inner) => cc?.baseUrl ? withPromptArtifactBackfill(inner, (d) => fetchPromptArtifact(cc, d), logger) : inner;
     const promptSource = (() => {
         try {
+            const bootBin = promptStateBin();
+            if (bootBin !== undefined)
+                fileStateStoreFor(bootBin);
             return new CenterPromptSource({
                 store: withByDigestBackfill(new FilePromptArtifactStore(promptEpochDir)),
-                stateStore: new FilePromptSourceStateStore(promptStateDir),
+                stateStore: recordingStateStore(binnedPromptStateStore(fileStateStoreFor)),
                 engineVersion: CORE_ENGINE_VERSION,
             });
         }
         catch (e) {
             logger.warn("center_prompts_store_unwritable", { dir: promptEpochDir, err: String(e), note: "file-backed prompt-epoch store unavailable — memory fallback (catalog candidate not restart-durable); built-ins/declaration axis unaffected" });
-            return new CenterPromptSource({ store: withByDigestBackfill(new MemoryPromptArtifactStore()), stateStore: new MemoryPromptSourceStateStore(), engineVersion: CORE_ENGINE_VERSION });
+            return new CenterPromptSource({
+                store: withByDigestBackfill(new MemoryPromptArtifactStore()),
+                stateStore: recordingStateStore(binnedPromptStateStore(storePerBin(() => new MemoryPromptSourceStateStore()))),
+                engineVersion: CORE_ENGINE_VERSION,
+            });
         }
     })();
-    if (configProvider && !cc?.dryRun) {
+    const catalogSource = {
+        applySnapshot: (raw) => promptSource.applySnapshot(raw),
+        applyDisabled: (sourceRevision) => promptSource.applyDisabled(sourceRevision),
+        current: () => promptSource.current(),
+        persistedActive: () => promptPersisted?.state === "active",
+    };
+    const rebasePromptState = async (identity, phase) => {
+        promptStateIdentity = identity;
+        centerPrompts = undefined;
+        pendingCatalogFaces = undefined;
+        promptPersisted = undefined;
         try {
             await promptSource.restore();
         }
         catch (e) {
-            logger.warn("center_prompts_catalog_restore_failed", { err: String(e), note: "disk LKG unavailable — catalog candidate absent until the next adopt; declaration axis and built-ins unaffected" });
+            logger.warn("center_prompts_catalog_restore_failed", { phase, err: String(e), note: "the persisted catalog state for this credential identity could not be loaded — catalog candidate absent until the next adopt; declaration axis and built-ins unaffected" });
         }
-    }
+        if (cc !== undefined && identity !== undefined && currentIdentity() !== identity) {
+            promptStateIdentity = undefined;
+            await promptSource.restore();
+            logger.warn("center_prompts_catalog_identity_changed", { phase, note: "the center credential changed while the persisted catalog state was being read — that state is not used; the current identity's next candidate re-establishes it" });
+        }
+    };
+    if (configProvider && !cc?.dryRun)
+        await rebasePromptState(promptStateIdentity, "boot");
     const adoptCenterPrompts = async (eff, phase) => {
+        const adoptedIdentity = candidateIdentityOf(eff);
+        if (adoptedIdentity !== undefined && adoptedIdentity !== promptStateIdentity) {
+            await rebasePromptState(adoptedIdentity, phase);
+        }
         const raw = eff?.prompts;
         if (raw === undefined) {
             if (centerPrompts)
                 logger.info("center_prompts_cleared", { phase, note: "effective carries no prompts key (publish gate off) — built-in providers resume" });
-            const cleared = await applyCatalogToSource(promptSource, undefined, centerPrompts, logger, phase);
+            const cleared = await applyCatalogToSource(catalogSource, undefined, centerPrompts, logger, phase);
             if (cleared) {
                 centerPrompts = undefined;
                 pendingCatalogFaces = undefined;
@@ -148,7 +251,7 @@ export async function createConfigCenterRuntime(ctx) {
                 note: "new tasks assemble the new pack (epoch re-pins at the next task boundary); in-flight sessions stay pinned",
             });
         }
-        const transitioned = await applyCatalogToSource(promptSource, v.value, centerPrompts, logger, phase);
+        const transitioned = await applyCatalogToSource(catalogSource, v.value, centerPrompts, logger, phase);
         if (transitioned) {
             centerPrompts = v.value;
             pendingCatalogFaces = undefined;
@@ -159,7 +262,7 @@ export async function createConfigCenterRuntime(ctx) {
     };
     let bootConfigPending;
     const lkgEnabled = configProvider?.kind === "remote" && configLkgEnabled();
-    const lkgPath = process.env.CONFIG_LKG_PATH ?? defaultLkgPath(cc?.worker);
+    const lkgPathFor = (identity) => process.env.CONFIG_LKG_PATH ?? defaultLkgPath(cc?.worker, identity);
     const lkgSurvivesRestart = lkgEnabled && process.env.CONFIG_LKG_DURABLE === "true";
     let lkgBooted = false;
     let bootLkgCandidate;
@@ -170,9 +273,15 @@ export async function createConfigCenterRuntime(ctx) {
             return true;
         if (!lkgEnabled)
             return false;
+        const identity = candidateIdentityOf(effectiveObj);
+        if (identity === undefined) {
+            logger.warn("config_lkg_save_failed", { err: "candidate carries no credential identity", note: "LKG NOT written (the bin is keyed by the identity that fetched the candidate) — handoff NOT confirmed" });
+            return false;
+        }
+        const lkgPath = lkgPathFor(identity);
         try {
             if (effectiveObj.skills && config.configCenter) {
-                await applyCenterSkills([], effectiveObj.skills, config.configCenter.baseUrl, config.configCenter.token, logger, undefined, defaultSkillCacheDir());
+                await applyCenterSkills([], effectiveObj.skills, config.configCenter, logger, undefined, defaultSkillCacheDir());
             }
             const enabledSkills = (effectiveObj.skills?.skills ?? []).filter((m) => m.enabled !== false);
             const cacheDir = defaultSkillCacheDir();
@@ -193,7 +302,7 @@ export async function createConfigCenterRuntime(ctx) {
                 }
             }
             lastPrewarmBodiesVerified = true;
-            await saveLkg(lkgPath, cc?.worker, effectiveObj, etag);
+            await saveLkg(lkgPath, cc?.worker, identity, effectiveObj, etag);
             return lkgSurvivesRestart;
         }
         catch (err) {
@@ -206,14 +315,40 @@ export async function createConfigCenterRuntime(ctx) {
         const bootFromLkg = async (why) => {
             if (!lkgEnabled || dryRun)
                 return null;
-            const read = await loadLkg(lkgPath, cc?.worker);
+            const identity = currentIdentity();
+            if (identity === undefined) {
+                logger.warn("config_lkg_unusable", { reason: "center credential unreadable — credential identity unknown, no LKG bin is read back", note: "env fallback serves; the live pull retries on the refresh cadence once the credential is readable" });
+                return null;
+            }
+            const lkgPath = lkgPathFor(identity);
+            const legacy = await migrateV1Lkg({ legacyPath: process.env.CONFIG_LKG_PATH ?? legacyV1LkgPath(cc?.worker), binPath: lkgPath, worker: cc?.worker, identity });
+            switch (legacy.outcome) {
+                case "none":
+                    break;
+                case "migrated":
+                    logger.info("config_lkg_migrated", { from: legacy.from, retiredTo: legacy.retiredTo, to: lkgPath, note: "formatVersion 1 LKG (pull-token identity = this worker) migrated once into this credential identity's bin; the old file was renamed, not deleted" });
+                    if (legacy.retireError !== undefined)
+                        logger.warn("config_lkg_legacy_not_retired", { path: legacy.from, reason: legacy.retireError, note: "the bin was written and is used; only the old file's rename / copy failed" });
+                    break;
+                case "not-migrated":
+                    logger.warn("config_lkg_unusable", { path: legacy.path, reason: legacy.reason, note: "env fallback serves; the cache rewrites on the next clean candidate" });
+                    return null;
+            }
+            const read = await loadLkg(lkgPath, cc?.worker, identity);
             if (!read.lkg) {
                 if (read.reason !== "absent")
                     logger.warn("config_lkg_unusable", { path: lkgPath, reason: read.reason, note: "ignoring the on-disk LKG — env fallback serves; the cache rewrites on the next clean candidate" });
                 return null;
             }
+            if (currentIdentity() !== identity) {
+                logger.warn("config_lkg_unusable", { path: lkgPath, reason: "center credential identity changed while the LKG was being read — not used", note: "env fallback serves; the current identity's next pull re-establishes its own LKG" });
+                return null;
+            }
             logger.info("config_loaded_lkg", { path: lkgPath, savedAt: read.lkg.savedAt, why, note: "booting from the persisted last-known-good (all restart-to-apply faces included) — the live pull continues in the background and reconciles on arrival" });
-            return { effective: read.lkg.effective, ...(read.lkg.etag !== undefined ? { etag: read.lkg.etag } : {}) };
+            const lkgEffective = read.lkg.effective;
+            candidateIdentity.set(lkgEffective, identity);
+            bindValidator(read.lkg.etag, identity);
+            return { effective: lkgEffective, ...(read.lkg.etag !== undefined ? { etag: read.lkg.etag } : {}) };
         };
         const bootApplyLkgInline = async (lkgR) => {
             const lkgGen = generationOf(lkgR.effective.version);
@@ -231,7 +366,7 @@ export async function createConfigCenterRuntime(ctx) {
             logger.info("config_loaded", { source: "lkg", version: lkgR.effective.version, worker: cc?.worker ?? "(global)", models: cfgModels });
         };
         try {
-            const bootFetch = configProvider.fetchEffective(undefined);
+            const bootFetch = pullEffective(configProvider, undefined);
             const raced = await raceBootFetch(bootFetch, config.configBootFetchBudgetMs);
             let lkgFallback = null;
             if (raced === BOOT_FETCH_DEFERRED) {
@@ -327,6 +462,8 @@ export async function createConfigCenterRuntime(ctx) {
                 }
             }
         }
+        if (!dryRun && cc !== undefined && currentIdentity() !== promptStateIdentity)
+            await rebasePromptState(currentIdentity(), "boot-end");
     }
     const readFaceBaseline = { ...(config.readFace !== undefined ? { readFace: config.readFace } : {}), readFaceSource: config.readFaceSource };
     const readFaceEnvHeld = applyCenterReadFace(config, effective ?? { version: 0, updatedAt: "", models: { models: [], roles: {} } }, effective ? logger : undefined).envHeld;
@@ -438,7 +575,7 @@ export async function createConfigCenterRuntime(ctx) {
         },
         async applyCenterCapabilities(skills) {
             if (effective?.skills && config.configCenter) {
-                skills = await applyCenterSkills(skills, effective.skills, config.configCenter.baseUrl, config.configCenter.token, logger, undefined, configLkgEnabled() ? defaultSkillCacheDir() : undefined);
+                skills = await applyCenterSkills(skills, effective.skills, config.configCenter, logger, undefined, configLkgEnabled() ? defaultSkillCacheDir() : undefined);
             }
             if (effective?.plugins) {
                 const pluginOut = await applyCenterPlugins(skills, effective, {
@@ -458,7 +595,7 @@ export async function createConfigCenterRuntime(ctx) {
             }
             if (bootLkgCandidate && lkgEnabled) {
                 const bootPublished = await persistLkgDurable(bootLkgCandidate.effective, bootLkgCandidate.etag).catch((err) => {
-                    logger.warn("config_lkg_save_failed", { path: lkgPath, err: String(err), note: "boot LKG persist failed — retained for the per-tick retry" });
+                    logger.warn("config_lkg_save_failed", { err: String(err), note: "boot LKG persist failed — retained for the per-tick retry" });
                     return false;
                 });
                 {
@@ -521,7 +658,7 @@ export async function createConfigCenterRuntime(ctx) {
                             metrics.inc("models_tiers_plane_deferred_stuck_total");
                             logger.warn("models_tiers_deferred_no_handoff", { version: planeDeferredNoHandoff.version, since: planeDeferredNoHandoff.since, note: "candidate still retained without a next-boot handoff — mount restart-surviving LKG storage + CONFIG_LKG_DURABLE=true, or restart manually after ensuring the candidate is re-pulled at boot" });
                         }
-                        const r = arrival !== undefined ? arrival.result : await configProvider.fetchEffective(ccEtag);
+                        const r = arrival !== undefined ? arrival.result : await pullEffective(configProvider, ccEtag);
                         if (r === null && planeDeferredNoHandoff) {
                             const skillsDebt = (planeDeferredNoHandoff.blocked ?? []).includes("skills");
                             const promoted = lkgSurvivesRestart || skillsDebt ? await persistLkgDurable(planeDeferredNoHandoff.candidate, planeDeferredNoHandoff.candidateEtag) : false;
@@ -793,7 +930,15 @@ export async function createConfigCenterRuntime(ctx) {
                 };
                 if (bootConfigPending) {
                     const arrivalGen = reserveArrivalGeneration();
-                    void bootConfigPending.then((r) => void (lkgBooted ? runTick({ result: r, ordinal: arrivalGen }) : deferredBootApply(r, arrivalGen)), () => { });
+                    const continueArrival = (r) => void (lkgBooted ? runTick({ result: r, ordinal: arrivalGen }) : deferredBootApply(r, arrivalGen));
+                    void bootConfigPending.then((r) => {
+                        if (r !== null && configProvider.kind === "remote" && candidateIdentityOf(r.effective) !== currentIdentity()) {
+                            logger.warn("config_boot_arrival_identity_changed", { note: "the late boot pull landed under a center credential that is no longer current — not adopted; re-pulling once under the current credential" });
+                            void pullEffective(configProvider, undefined).then(continueArrival, (err) => logger.warn("config_boot_arrival_repull_failed", { err: String(err), note: "the refresh cadence retries under the current credential" }));
+                            return;
+                        }
+                        continueArrival(r);
+                    }, () => { });
                 }
             }
         },

package/dist/boot/org-memory.d.ts

@@ -54,7 +54,8 @@ export interface OrgMemoryAdmissionWiring {
     /** §7 第二消费者收编:同一个目录实例也喂 memory-policy 面的 `org:` 属主门(`ServiceDeps.orgMemoryDirectory`)。
      *  **同实例**是这条收编的全部意义——「谁属于 org:acme」在一个进程里必须只有一个答案,两面共享同一份
      *  TTL 缓存/退避窗/gen 高水位;各建各的目录会让准入门与策略面在吊销窗内公开分歧。缺席=无目录源
-     *  (单用户/无 center 且无 env 表)⇒ 策略面逐字保持收编前的 operator-only 行为。 */
+     *  (单用户/无 center 且无 env 表)⇒ 策略面逐字保持收编前的 operator-only 行为。
+     *  远程腿的这一个实例内部按中心凭证身份分箱([ref] E-15):两面问到的是同一身份的同一箱。 */
     directory: OrgMemoryDirectory | undefined;
 }
 /** 依赖收窄到真实消费面(warn/inc 各一手)——接口隔离让测试用真形字面量,零铸形([ref] §1)。 */

package/dist/boot/org-memory.js

@@ -1,4 +1,5 @@
 import { fetchPrincipalOrgMemory } from "../config-center/http-client.js";
+import { createIdentityBins } from "../center-credential.js";
 import { createMemoryScopeAdmission, createOrgMemoryDirectory, parseOrgDirectoryStatic } from "../org-memory-admission.js";
 const ORG_PREFIX = "org:";
 function collectDeploymentOrgScopes(config) {
@@ -25,11 +26,14 @@ export function createOrgMemoryAdmissionWiring(opts) {
         });
     }
     const directory = centerLeg !== undefined
-        ? createOrgMemoryDirectory({
-            fetchSection: (principal) => fetchPrincipalOrgMemory(centerLeg.baseUrl, centerLeg.token, principal, fetch, centerLeg.worker),
-            grantTtlMs: config.memoryOrgGrantTtlMs,
-            unavailableBackoffMs: config.memoryOrgUnavailableBackoffMs,
-        })
+        ? (() => {
+            const directoryNow = createIdentityBins(centerLeg.credential, (credential) => createOrgMemoryDirectory({
+                fetchSection: (principal) => fetchPrincipalOrgMemory({ baseUrl: centerLeg.baseUrl, credential }, principal, fetch, centerLeg.worker),
+                grantTtlMs: config.memoryOrgGrantTtlMs,
+                unavailableBackoffMs: config.memoryOrgUnavailableBackoffMs,
+            }));
+            return { lookup: (principal) => directoryNow().lookup(principal) };
+        })()
         : staticJson !== undefined
             ? createOrgMemoryDirectory({
                 staticTable: parseOrgDirectoryStatic(staticJson),

package/dist/boot/resolve-spec.js

@@ -25,7 +25,7 @@ import { isIsolatedExecEnv, routeServiceTask, supPostureOverrides } from "../rou
 import { gateExecutionLane } from "../runtime-caps-resolver.js";
 import { applyRuntimeGovernance, stripDelegationTools } from "../runtime-governance.js";
 import { HttpError, encodeCheckpointScope } from "../security.js";
-import { memorySpecForRequest } from "../memory-scope.js";
+import { memoryProjectKeyFor, memorySpecForRequest } from "../memory-scope.js";
 import { singleMemberOffFieldIssue } from "../request-value-closure.js";
 import { a2aForScenario, mcpForScenario } from "../config-center/facade.js";
 import { normalizeAttachments, normalizeResilience, normalizeResumeAtMode, normalizeSuggestNextPrompts, promptProfileFromBody, resolveTaskLimits, retainBackgroundProcessesFromBody, taskAgentsSpecFragment, toolMaterializeStrategyFromBody, toolNameListFromBody } from "../spec-fields.js";
@@ -43,6 +43,12 @@ export function createResolveSpec(ctx) {
     const { config, logger, metrics, localRoot, scenarios, principalCaps, centerRuntimeCapsResolver, getCenterPrompts, getKeyResolver, taskAttachmentStore, perSessionCwd, setSessionCwd, setSessionShellEnv, fenceSessionOwner, hookLlm, hookAgent, fleetBus, hookWakeBus, noteSessionShellGate, resumeAnchorStore, ownerAware, taskLimitCaps, taskTimeoutSec, selectEnvTool, sendUserFileToolSpec, memoryEngine, durableEnabled, approvalExemptionStore, singleUserAutoAcceptBaseline, checkpointStore, deploymentHooks, imageIndex, perTaskImage, sessionEnvSelection, liveQuestionFace, approverSeat, lockedKeys, } = ctx;
     assertGuardPatternsUsable(config);
     const onlySensitiveBaseline = buildOnlySensitiveBaselineWarning(config, { durableEnabled, singleUserAutoAcceptBaseline });
+    const realTaskRootOf = (auth) => {
+        if (isSandboxPathAdjudicationLane(config.remoteExec?.provider))
+            return undefined;
+        const sessionCwd = auth?.sessionId ? effectiveHostWorkspace(perSessionCwd.get(auth.sessionId), {}) : undefined;
+        return sessionCwd ?? (config.remoteExec === undefined ? process.cwd() : undefined);
+    };
     if (onlySensitiveBaseline)
         logger.warn(onlySensitiveBaseline.event, onlySensitiveBaseline.fields);
     const resolveSpec = async (body, req, auth, opts) => {
@@ -391,7 +397,7 @@ export function createResolveSpec(ctx) {
             })(),
             ...(config.requirePrincipal !== true ? { backgroundScope: "session" } : {}),
             memory: memoryEngine
-                ? memorySpecForRequest(auth?.memoryScope, body.memoryWrite, s4DefaultScopes, { multiTenant: config.requirePrincipal === true }, { memory: body.memory, memoryCapture: body.memoryCapture })
+                ? memorySpecForRequest(auth?.memoryScope, memoryProjectKeyFor(config, auth?.memoryScope, realTaskRootOf(auth)), body.memoryWrite, s4DefaultScopes, { multiTenant: config.requirePrincipal === true }, { memory: body.memory, memoryCapture: body.memoryCapture })
                 : undefined,
             ...((v) => (v !== undefined ? { memoryPersistenceCapable: v } : {}))(effectiveMemoryPersistenceCapable(config)),
             tools: ((base) => {
@@ -450,8 +456,7 @@ export function createResolveSpec(ctx) {
         };
         const pathAdjudication = hostSemanticsLane
             ? (() => {
-                const sessionCwd = auth?.sessionId ? effectiveHostWorkspace(perSessionCwd.get(auth.sessionId), {}) : undefined;
-                const realRoot = sessionCwd ?? (config.remoteExec === undefined ? process.cwd() : undefined);
+                const realRoot = realTaskRootOf(auth);
                 const gateCwd = realRoot ?? join(config.localDataRoot ?? localRoot, "fs-write-gate-unrooted");
                 return {
                     env: new NodeExecutionEnv({ cwd: gateCwd }),

package/dist/boot/runtime-caps.js

@@ -1,4 +1,5 @@
-import { applyGovernedVerdictAbsenceWarning, applyLocalAutoModeDeny, applyMemoryOptOutGrant, applyObserverEnvOptIn, centerEntitlementSourceWired, createPrincipalEntitlementsClient, scopedTokenNeedsWorker, } from "../runtime-caps-resolver.js";
+import { applyGovernedVerdictAbsenceWarning, applyLocalAutoModeDeny, applyMemoryOptOutGrant, applyObserverEnvOptIn, centerEntitlementSourceWired, createPrincipalEntitlementsClient, } from "../runtime-caps-resolver.js";
+import { scopedTokenNeedsWorker } from "../center-credential.js";
 export function assertMemoryCapturePolicyWirable(input) {
     if (input.policy !== "governed")
         return;
@@ -36,15 +37,14 @@ export function createRuntimeCaps(ctx) {
             reason: "MEMORY_CAPTURE_POLICY=governed with NO local memory_optout_grant table: the only verdict source is the config center, and `allowMemoryOptOut` is an OPTIONAL entitlement key — for any principal whose caps omit it the verdict is ABSENT and core refuses that session's memory.capture:\"off\" (memory.capture_optout_denied, fail-closed). ANONYMOUS/system runs are worse off still: the center source is per-principal and is never consulted without an identity, so on this shape a principal-less run can never obtain a verdict at all. Verify the center emits allowMemoryOptOut for every principal, or wire a SQL backend (DB_BACKEND=mysql|pg) so the grant table answers (its deployment-default row also covers anonymous runs).",
         });
     }
-    if (centerEntitlementSourceWired(config) && config.configCenter && scopedTokenNeedsWorker(config.configCenter.token, config.configCenter.worker)) {
+    if (centerEntitlementSourceWired(config) && config.configCenter && scopedTokenNeedsWorker(config.configCenter.credential.read(), config.configCenter.worker)) {
         logger.warn("runtime_caps_scoped_token_no_worker", {
             reason: "SEMA_REGISTRY_TOKEN is a worker-scoped wpt_ token but SEMA_REGISTRY_WORKER is unset → center 403s per-principal caps → ALL workflow self-orchestration will be fail-closed denied. Set SEMA_REGISTRY_WORKER (the orchestrator normally injects it) or use the full SERVICE_PULL_TOKEN.",
         });
     }
     const principalCaps = centerEntitlementSourceWired(config) && config.configCenter
         ? createPrincipalEntitlementsClient({
-            baseUrl: config.configCenter.baseUrl,
-            token: config.configCenter.token,
+            center: config.configCenter,
             ...(config.configCenter.worker ? { worker: config.configCenter.worker } : {}),
             onError: (err, principal) => logger.warn("runtime_caps_resolve_failed", { principal, err: String(err) }),
         })

package/dist/brain.js

@@ -2,7 +2,8 @@ import { adjudicateModelRoute, createAnthropicBrain, createCircuitBreakerBrain,
 import { routeKeyOf } from "@sema-agent/core";
 import { buildDefaultResilience } from "./config-types.js";
 import { resolveModelApiKey } from "./key-resolver.js";
-import { catalogBrainLane } from "./model-provider.js";
+import { dispatchBrainLane } from "./model-provider.js";
+import { openaiRouteBaseUrl } from "./model-route-endpoint.js";
 import { buildDisplaySafeRefusal, buildDisplaySafeUrl } from "./trace/redact.js";
 function isOffDeploymentRoot(baseUrl, config) {
     if (!baseUrl)
@@ -10,11 +11,17 @@ function isOffDeploymentRoot(baseUrl, config) {
     const entry = routeKeyOf(baseUrl);
     if (entry === "")
         return false;
-    return ![config.gatewayBaseUrl, ...config.gatewayFallbackUrls].some((u) => routeKeyOf(u) === entry);
+    return !deploymentGatewayRoots(config).some((u) => routeKeyOf(u) === entry);
+}
+function deploymentGatewayRoots(config) {
+    return config.gatewayBaseUrl !== undefined ? [config.gatewayBaseUrl, ...config.gatewayFallbackUrls] : [];
+}
+function deploymentGatewayKey(config) {
+    return config.gatewayBaseUrl !== undefined ? config.gatewayApiKey : undefined;
 }
 function degradeDeclaredRoot(fallbackBaseUrl, config) {
-    const armed = Boolean(config.gatewayApiKey) && isOffDeploymentRoot(fallbackBaseUrl, config);
-    return armed ? config.gatewayBaseUrl : (fallbackBaseUrl || config.gatewayBaseUrl);
+    const armed = Boolean(deploymentGatewayKey(config)) && isOffDeploymentRoot(fallbackBaseUrl, config);
+    return armed ? config.gatewayBaseUrl : openaiRouteBaseUrl(fallbackBaseUrl, config.gatewayBaseUrl);
 }
 export const FAST_FAIL_MAX_RETRIES = 2;
 function constructRouteBrain(label, sourceUrls, construct) {
@@ -41,12 +48,12 @@ export function createBrain(config, deps = {}) {
         : fastFailTopology
             ? { maxRetries: FAST_FAIL_MAX_RETRIES }
             : {};
-    const routes = [config.gatewayBaseUrl, ...config.gatewayFallbackUrls];
+    const routes = deploymentGatewayRoots(config);
     const openaiBrains = routes.map((baseUrl, i) => {
         const brain = constructRouteBrain(i === 0 ? "gateway route" : `gateway fallback route[${i - 1}]`, [baseUrl], () => createOpenAIBrain({
             baseUrl,
             get apiKey() {
-                return config.gatewayApiKey;
+                return deploymentGatewayKey(config);
             },
             ...retryCap,
             fetchImpl,
@@ -62,7 +69,11 @@ export function createBrain(config, deps = {}) {
             })
             : brain;
     });
-    const gatewayBrain = openaiBrains.length > 1 ? createFailoverBrain(openaiBrains) : openaiBrains[0];
+    const gatewayBrain = openaiBrains.length === 0
+        ? constructRouteBrain("openai route (no gateway declared)", [], () => createOpenAIBrain({ ...retryCap, fetchImpl, ...timeouts }))
+        : openaiBrains.length > 1
+            ? createFailoverBrain(openaiBrains)
+            : openaiBrains[0];
     const anthropicCfg = config.anthropic;
     const anthropicBrain = anthropicCfg
         ? constructRouteBrain("anthropic route", [anthropicCfg.baseUrl], () => createAnthropicBrain({
@@ -86,9 +97,8 @@ export function createBrain(config, deps = {}) {
         if (fallbackModel) {
             const fbOwnApiKey = () => resolveModelApiKey(fallbackModel.name, config.modelApiKeyEnv ?? {}, process.env, config.modelApiKeys ?? {}) ??
                 resolveModelApiKey(degradeTo, config.modelApiKeyEnv ?? {}, process.env, config.modelApiKeys ?? {});
-            const fallbackLane = catalogBrainLane(fallbackModel.provider);
-            const anthropicLaneHop = fallbackLane === "anthropic" && anthropicBrain !== undefined;
-            const fallback = fallbackLane === "anthropic" && anthropicBrain
+            const anthropicLaneHop = dispatchBrainLane(fallbackModel.provider, anthropicBrain !== undefined) === "anthropic";
+            const fallback = anthropicLaneHop && anthropicBrain
                 ?
                     anthropicBrain
                 : constructRouteBrain(`degrade target "${degradeTo}"`, [fallbackModel.baseUrl, config.gatewayBaseUrl], () => createOpenAIBrain({
@@ -96,7 +106,7 @@ export function createBrain(config, deps = {}) {
                         return degradeDeclaredRoot(fallbackModel.baseUrl, config);
                     },
                     get apiKey() {
-                        return config.gatewayApiKey || undefined;
+                        return deploymentGatewayKey(config) || undefined;
                     },
                     ...(config.gatewayMaxRetries !== undefined ? { maxRetries: config.gatewayMaxRetries } : {}),
                     fetchImpl,
@@ -129,8 +139,10 @@ export function brainSummary(config) {
     const r = config.resilience ?? DEFAULT_RESILIENCE;
     const hasFailover = config.gatewayFallbackUrls.length > 0;
     const breakerActive = r.circuitBreaker && hasFailover;
+    const degradeTarget = config.degrade?.reactive ? config.models?.[config.degrade.to] : undefined;
+    const degradeEndpoint = degradeTarget ? openaiRouteBaseUrl(degradeTarget.baseUrl, config.gatewayBaseUrl) : undefined;
     return {
-        gateway: buildDisplaySafeUrl(config.gatewayBaseUrl),
+        gateway: buildDisplaySafeUrl(config.gatewayBaseUrl ?? "") || null,
         gatewayFallbacks: config.gatewayFallbackUrls.length,
         failover: hasFailover,
         anthropicRoute: Boolean(config.anthropic),
@@ -147,14 +159,12 @@ export function brainSummary(config) {
                 : "engine-default",
         circuitBreakerNoop: r.circuitBreaker && !hasFailover ? "needs ≥2 gateway routes" : null,
         reactiveDegradeTo: config.degrade?.reactive && config.models?.[config.degrade.to] ? config.degrade.to : null,
-        reactiveDegradeBaseUrl: config.degrade?.reactive && config.models?.[config.degrade.to]
-            ? buildDisplaySafeUrl(config.models[config.degrade.to].baseUrl || config.gatewayBaseUrl)
-            : null,
+        reactiveDegradeBaseUrl: buildDisplaySafeUrl(degradeEndpoint ?? "") || null,
         ...((() => {
             const target = config.degrade?.reactive ? config.models?.[config.degrade.to] : undefined;
             if (!target)
                 return { reactiveDegradeRoutePairing: null, reactiveDegradeRouteRefusal: null };
-            if (catalogBrainLane(target.provider) === "anthropic" && config.anthropic) {
+            if (dispatchBrainLane(target.provider, config.anthropic !== undefined) === "anthropic") {
                 return { reactiveDegradeRoutePairing: "anthropic-lane", reactiveDegradeRouteRefusal: null };
             }
             const declaresOwnCredential = config.modelApiKeyEnv?.[target.name] !== undefined ||
@@ -165,12 +175,12 @@ export function brainSummary(config) {
             if (declaresOwnCredential) {
                 return { reactiveDegradeRoutePairing: "per-model-declared", reactiveDegradeRouteRefusal: null };
             }
-            const verdict = adjudicateModelRoute({ id: target.id, baseUrl: target.baseUrl }, resolveRouteCredential({ ...(config.gatewayApiKey ? { configApiKey: config.gatewayApiKey } : {}) }), { baseUrl: degradeDeclaredRoot(target.baseUrl, config) });
+            const verdict = adjudicateModelRoute({ id: target.id, baseUrl: target.baseUrl }, resolveRouteCredential(((key) => (key ? { configApiKey: key } : {}))(deploymentGatewayKey(config))), { baseUrl: degradeDeclaredRoot(target.baseUrl, config) });
             return verdict.ok
                 ? { reactiveDegradeRoutePairing: `ok:${verdict.posture}`, reactiveDegradeRouteRefusal: null }
                 : {
                     reactiveDegradeRoutePairing: `broken:${verdict.code}`,
-                    reactiveDegradeRouteRefusal: buildDisplaySafeRefusal(routeRefusalText(verdict), [target.baseUrl ?? "", degradeDeclaredRoot(target.baseUrl, config)]),
+                    reactiveDegradeRouteRefusal: buildDisplaySafeRefusal(routeRefusalText(verdict), [target.baseUrl ?? "", degradeDeclaredRoot(target.baseUrl, config) ?? ""]),
                 };
         })()),
     };

package/dist/capabilities/center-prompts.d.ts

@@ -55,6 +55,9 @@ export declare function applyCatalogToSource(source: {
     /** codex-2 F2(restart-owed disable):撤下写盘失败后重启,内存 prev 丢了但持久态还 active——
      *  以 source 自身的 live candidate 为准判「欠 disable」,不是只看内存 prev。 */
     current?(): unknown;
+    /** S-651(codex 修复验证轮 V1):本箱**持久记录**是 active —— 即使那份 artifact 此刻加载不出(活候选为空)。
+     *  「欠撤下」的真源是持久记录;活候选只是它能加载时的影子。缺席 = 调用方不掌握持久记录(沿用前两条判据)。 */
+    persistedActive?(): boolean;
 }, next: PromptsDomainFaces | undefined, prev: PromptsDomainFaces | undefined, log: {
     info: (msg: string, meta?: Record<string, unknown>) => void;
     warn: (msg: string, meta?: Record<string, unknown>) => void;

package/dist/capabilities/center-prompts.js

@@ -55,7 +55,7 @@ export async function applyCatalogToSource(source, next, prev, log, phase) {
             log.warn("center_prompts_catalog_apply_failed", { phase, code: r.code, reason: r.reason, note: "validate passed but the source apply failed (disk/state) — declaration axis and built-ins unaffected; candidate unchanged; the transition retries on the next refresh tick" });
             return false;
         }
-        if (prev?.catalog || source.current?.() !== undefined) {
+        if (prev?.catalog || source.current?.() !== undefined || source.persistedActive?.() === true) {
             await source.applyDisabled(`${phase}:catalog-absent`);
             log.info("center_prompts_catalog_disabled", { phase, note: "catalog axis withdrawn — core candidate cleared (does not revive offline)" });
         }