@sema-agent/server 7.98.0 → 7.100.0

package/dist/boot/config-center.js

@@ -11,16 +11,17 @@ import { applyCatalogToSource, withPromptArtifactBackfill } from "../capabilitie
 import { validatePromptsDomain, CORE_ENGINE_VERSION } from "../prompts-domain-validate.js";
 import { centerScenarios, centerScenarioDetails } from "../capabilities/scenarios.js";
 import { configLkgEnabled, isRosterGateArmed } from "../config.js";
-import { defaultLkgPath, defaultSkillCacheDir, saveLkg, loadLkg } from "../config-lkg.js";
+import { defaultLkgPath, defaultSkillCacheDir, saveLkg, loadLkg, legacyV1LkgPath, migrateV1Lkg } from "../config-lkg.js";
+import { answerStillCurrent, centerStateBin, credentialIdentityNow } from "../center-credential.js";
 import { centerManagedConfigKeys } from "../config-center/apply-effective.js";
 import { createConfigProvider, raceBootFetch, BOOT_FETCH_DEFERRED } from "../config-provider.js";
 import { executionLaneCaps, executionLaneOf } from "../execution-lane-caps.js";
 import { createKeyResolver } from "../key-resolver.js";
 import { ensureSealedKeyStore, reportExecutionPublicKey } from "../sealed-key.js";
-import { applyEffective, applyCenterReadFace, mutateInPlace, logEffectiveDiff, applyCenterSkills, resolveMcpServers, resolveA2aPeers, restartReasons, modelPlaneChanged, planeHasActiveTiers, fetchPromptArtifact } from "../config-center/facade.js";
+import { applyEffective, applyCenterReadFace, mutateInPlace, logEffectiveDiff, applyCenterSkills, resolveMcpServers, resolveA2aPeers, restartReasons, modelPlaneChanged, fetchPromptArtifact } from "../config-center/facade.js";
 import { createMcpRevocationLedger, enabledMcpEntries } from "../config-center/mcp-revocation.js";
 import { SHA256_HEX_RE } from "../digest-form.js";
-import { createConfigApplyLedger } from "../config-center/apply-ledger.js";
+import { createConfigApplyLedger, refusedGroups } from "../config-center/apply-ledger.js";
 export async function createConfigCenterRuntime(ctx) {
     const { config, logger, metrics, localRoot } = ctx;
     let ccEtag;
@@ -53,6 +54,43 @@ export async function createConfigCenterRuntime(ctx) {
     let bootSkillStale = false;
     let pendingRestart;
     const cc = config.configCenter;
+    const bootCredential = cc?.credential.read();
+    if (cc !== undefined && bootCredential !== undefined && !bootCredential.ok) {
+        logger.error("center_credential_unreadable", {
+            key: "SEMA_REGISTRY_TOKEN_FILE",
+            reason: bootCredential.reason,
+            effect: "every center request fails its own failure arm until the file is readable (config pull keeps env/LKG-less boot, caps fail-closed, lease takes the loud auth-error arm); no on-disk LKG / prompt state is read back (credential identity unknown)",
+        });
+    }
+    const currentIdentity = () => (cc === undefined ? undefined : credentialIdentityNow(cc.credential));
+    const candidateIdentity = new WeakMap();
+    const candidateIdentityOf = (eff) => candidateIdentity.get(eff);
+    const validatorIdentity = new Map();
+    const bindValidator = (etag, identity) => {
+        if (etag === undefined)
+            return;
+        validatorIdentity.delete(etag);
+        validatorIdentity.set(etag, identity);
+        const oldest = validatorIdentity.keys().next();
+        if (validatorIdentity.size > 16 && oldest.done !== true)
+            validatorIdentity.delete(oldest.value);
+    };
+    const pullEffective = async (provider, etag) => {
+        if (provider.kind === "local")
+            return provider.fetchEffective(etag);
+        const before = currentIdentity();
+        const conditional = etag !== undefined && before !== undefined && validatorIdentity.get(etag) === before ? etag : undefined;
+        const r = await provider.fetchEffective(conditional);
+        const used = r === null ? before : r.credentialIdentity;
+        if (cc === undefined || !answerStillCurrent(cc.credential, used)) {
+            throw new Error("center credential identity changed while the effective pull was in flight — response discarded; the next pull runs under the current credential");
+        }
+        if (r !== null) {
+            candidateIdentity.set(r.effective, used);
+            bindValidator(r.etag, used);
+        }
+        return r;
+    };
     let sealedKeys;
     try {
         sealedKeys = await ensureSealedKeyStore(join(config.localDataRoot ?? localRoot, "sealed-key"), logger);
@@ -70,7 +108,7 @@ export async function createConfigCenterRuntime(ctx) {
     const configProvider = cc || config.configProvider === "local"
         ? createConfigProvider({
             ...(config.configProvider ? { provider: config.configProvider } : {}),
-            ...(cc ? { configCenter: { baseUrl: cc.baseUrl, token: cc.token, worker: cc.worker, dryRun: cc.dryRun } } : {}),
+            ...(cc ? { configCenter: { baseUrl: cc.baseUrl, credential: cc.credential, worker: cc.worker, dryRun: cc.dryRun } } : {}),
             ...(config.configProvider === "local" ? { localDir: localRoot } : {}),
         })
         : undefined;
@@ -88,41 +126,106 @@ export async function createConfigCenterRuntime(ctx) {
         if (!pendingCatalogFaces)
             return;
         const { target } = pendingCatalogFaces;
-        if (await applyCatalogToSource(promptSource, target, centerPrompts, logger, phase)) {
+        if (await applyCatalogToSource(catalogSource, target, centerPrompts, logger, phase)) {
             centerPrompts = target;
             pendingCatalogFaces = undefined;
         }
     };
     const promptEpochDir = join(config.localDataRoot ?? localRoot, "prompt-epoch");
-    const promptStateDir = join(promptEpochDir, "state", cc?.worker === undefined ? "global" : `worker-${createHash("sha256").update(cc.worker).digest("hex").slice(0, 16)}`);
-    const withByDigestBackfill = (inner) => cc?.baseUrl ? withPromptArtifactBackfill(inner, (d) => fetchPromptArtifact(cc.baseUrl, cc.token, d), logger) : inner;
+    const promptStateRoot = join(promptEpochDir, "state");
+    let promptStateIdentity = currentIdentity();
+    const promptStateBin = () => (cc === undefined ? "global" : promptStateIdentity === undefined ? undefined : centerStateBin(cc.worker, promptStateIdentity));
+    const storePerBin = (make) => {
+        const stores = new Map();
+        return (bin) => {
+            const hit = stores.get(bin);
+            if (hit !== undefined)
+                return hit;
+            const made = make(bin);
+            stores.set(bin, made);
+            return made;
+        };
+    };
+    const fileStateStoreFor = storePerBin((bin) => new FilePromptSourceStateStore(join(promptStateRoot, bin)));
+    const binnedPromptStateStore = (storeFor) => ({
+        load: async () => {
+            const bin = promptStateBin();
+            return bin === undefined ? undefined : storeFor(bin).load();
+        },
+        save: async (state) => {
+            const bin = promptStateBin();
+            if (bin === undefined)
+                throw new Error("center credential identity unknown (credential unreadable at adoption) — prompt source state not persisted");
+            await storeFor(bin).save(state);
+        },
+    });
+    let promptPersisted;
+    const recordingStateStore = (inner) => ({
+        load: async () => {
+            promptPersisted = await inner.load();
+            return promptPersisted;
+        },
+        save: async (state) => {
+            await inner.save(state);
+            promptPersisted = state;
+        },
+    });
+    const withByDigestBackfill = (inner) => cc?.baseUrl ? withPromptArtifactBackfill(inner, (d) => fetchPromptArtifact(cc, d), logger) : inner;
     const promptSource = (() => {
         try {
+            const bootBin = promptStateBin();
+            if (bootBin !== undefined)
+                fileStateStoreFor(bootBin);
             return new CenterPromptSource({
                 store: withByDigestBackfill(new FilePromptArtifactStore(promptEpochDir)),
-                stateStore: new FilePromptSourceStateStore(promptStateDir),
+                stateStore: recordingStateStore(binnedPromptStateStore(fileStateStoreFor)),
                 engineVersion: CORE_ENGINE_VERSION,
             });
         }
         catch (e) {
             logger.warn("center_prompts_store_unwritable", { dir: promptEpochDir, err: String(e), note: "file-backed prompt-epoch store unavailable — memory fallback (catalog candidate not restart-durable); built-ins/declaration axis unaffected" });
-            return new CenterPromptSource({ store: withByDigestBackfill(new MemoryPromptArtifactStore()), stateStore: new MemoryPromptSourceStateStore(), engineVersion: CORE_ENGINE_VERSION });
+            return new CenterPromptSource({
+                store: withByDigestBackfill(new MemoryPromptArtifactStore()),
+                stateStore: recordingStateStore(binnedPromptStateStore(storePerBin(() => new MemoryPromptSourceStateStore()))),
+                engineVersion: CORE_ENGINE_VERSION,
+            });
         }
     })();
-    if (configProvider && !cc?.dryRun) {
+    const catalogSource = {
+        applySnapshot: (raw) => promptSource.applySnapshot(raw),
+        applyDisabled: (sourceRevision) => promptSource.applyDisabled(sourceRevision),
+        current: () => promptSource.current(),
+        persistedActive: () => promptPersisted?.state === "active",
+    };
+    const rebasePromptState = async (identity, phase) => {
+        promptStateIdentity = identity;
+        centerPrompts = undefined;
+        pendingCatalogFaces = undefined;
+        promptPersisted = undefined;
         try {
             await promptSource.restore();
         }
         catch (e) {
-            logger.warn("center_prompts_catalog_restore_failed", { err: String(e), note: "disk LKG unavailable — catalog candidate absent until the next adopt; declaration axis and built-ins unaffected" });
+            logger.warn("center_prompts_catalog_restore_failed", { phase, err: String(e), note: "the persisted catalog state for this credential identity could not be loaded — catalog candidate absent until the next adopt; declaration axis and built-ins unaffected" });
         }
-    }
+        if (cc !== undefined && identity !== undefined && currentIdentity() !== identity) {
+            promptStateIdentity = undefined;
+            await promptSource.restore();
+            logger.warn("center_prompts_catalog_identity_changed", { phase, note: "the center credential changed while the persisted catalog state was being read — that state is not used; the current identity's next candidate re-establishes it" });
+        }
+    };
+    if (configProvider && !cc?.dryRun)
+        await rebasePromptState(promptStateIdentity, "boot");
     const adoptCenterPrompts = async (eff, phase) => {
+        const adoptedIdentity = candidateIdentityOf(eff);
+        if (adoptedIdentity !== undefined && adoptedIdentity !== promptStateIdentity) {
+            await rebasePromptState(adoptedIdentity, phase);
+        }
         const raw = eff?.prompts;
         if (raw === undefined) {
             if (centerPrompts)
                 logger.info("center_prompts_cleared", { phase, note: "effective carries no prompts key (publish gate off) — built-in providers resume" });
-            const cleared = await applyCatalogToSource(promptSource, undefined, centerPrompts, logger, phase);
+            const cleared = await applyCatalogToSource(catalogSource, undefined, centerPrompts, logger, phase);
             if (cleared) {
                 centerPrompts = undefined;
                 pendingCatalogFaces = undefined;
@@ -148,7 +251,7 @@ export async function createConfigCenterRuntime(ctx) {
                 note: "new tasks assemble the new pack (epoch re-pins at the next task boundary); in-flight sessions stay pinned",
             });
         }
-        const transitioned = await applyCatalogToSource(promptSource, v.value, centerPrompts, logger, phase);
+        const transitioned = await applyCatalogToSource(catalogSource, v.value, centerPrompts, logger, phase);
         if (transitioned) {
             centerPrompts = v.value;
             pendingCatalogFaces = undefined;
@@ -159,7 +262,7 @@ export async function createConfigCenterRuntime(ctx) {
     };
     let bootConfigPending;
     const lkgEnabled = configProvider?.kind === "remote" && configLkgEnabled();
-    const lkgPath = process.env.CONFIG_LKG_PATH ?? defaultLkgPath(cc?.worker);
+    const lkgPathFor = (identity) => process.env.CONFIG_LKG_PATH ?? defaultLkgPath(cc?.worker, identity);
     const lkgSurvivesRestart = lkgEnabled && process.env.CONFIG_LKG_DURABLE === "true";
     let lkgBooted = false;
     let bootLkgCandidate;
@@ -170,9 +273,15 @@ export async function createConfigCenterRuntime(ctx) {
             return true;
         if (!lkgEnabled)
             return false;
+        const identity = candidateIdentityOf(effectiveObj);
+        if (identity === undefined) {
+            logger.warn("config_lkg_save_failed", { err: "candidate carries no credential identity", note: "LKG NOT written (the bin is keyed by the identity that fetched the candidate) — handoff NOT confirmed" });
+            return false;
+        }
+        const lkgPath = lkgPathFor(identity);
         try {
             if (effectiveObj.skills && config.configCenter) {
-                await applyCenterSkills([], effectiveObj.skills, config.configCenter.baseUrl, config.configCenter.token, logger, undefined, defaultSkillCacheDir());
+                await applyCenterSkills([], effectiveObj.skills, config.configCenter, logger, undefined, defaultSkillCacheDir());
             }
             const enabledSkills = (effectiveObj.skills?.skills ?? []).filter((m) => m.enabled !== false);
             const cacheDir = defaultSkillCacheDir();
@@ -193,7 +302,7 @@ export async function createConfigCenterRuntime(ctx) {
                 }
             }
             lastPrewarmBodiesVerified = true;
-            await saveLkg(lkgPath, cc?.worker, effectiveObj, etag);
+            await saveLkg(lkgPath, cc?.worker, identity, effectiveObj, etag);
             return lkgSurvivesRestart;
         }
         catch (err) {
@@ -206,19 +315,45 @@ export async function createConfigCenterRuntime(ctx) {
         const bootFromLkg = async (why) => {
             if (!lkgEnabled || dryRun)
                 return null;
-            const read = await loadLkg(lkgPath, cc?.worker);
+            const identity = currentIdentity();
+            if (identity === undefined) {
+                logger.warn("config_lkg_unusable", { reason: "center credential unreadable — credential identity unknown, no LKG bin is read back", note: "env fallback serves; the live pull retries on the refresh cadence once the credential is readable" });
+                return null;
+            }
+            const lkgPath = lkgPathFor(identity);
+            const legacy = await migrateV1Lkg({ legacyPath: process.env.CONFIG_LKG_PATH ?? legacyV1LkgPath(cc?.worker), binPath: lkgPath, worker: cc?.worker, identity });
+            switch (legacy.outcome) {
+                case "none":
+                    break;
+                case "migrated":
+                    logger.info("config_lkg_migrated", { from: legacy.from, retiredTo: legacy.retiredTo, to: lkgPath, note: "formatVersion 1 LKG (pull-token identity = this worker) migrated once into this credential identity's bin; the old file was renamed, not deleted" });
+                    if (legacy.retireError !== undefined)
+                        logger.warn("config_lkg_legacy_not_retired", { path: legacy.from, reason: legacy.retireError, note: "the bin was written and is used; only the old file's rename / copy failed" });
+                    break;
+                case "not-migrated":
+                    logger.warn("config_lkg_unusable", { path: legacy.path, reason: legacy.reason, note: "env fallback serves; the cache rewrites on the next clean candidate" });
+                    return null;
+            }
+            const read = await loadLkg(lkgPath, cc?.worker, identity);
             if (!read.lkg) {
                 if (read.reason !== "absent")
                     logger.warn("config_lkg_unusable", { path: lkgPath, reason: read.reason, note: "ignoring the on-disk LKG — env fallback serves; the cache rewrites on the next clean candidate" });
                 return null;
             }
+            if (currentIdentity() !== identity) {
+                logger.warn("config_lkg_unusable", { path: lkgPath, reason: "center credential identity changed while the LKG was being read — not used", note: "env fallback serves; the current identity's next pull re-establishes its own LKG" });
+                return null;
+            }
             logger.info("config_loaded_lkg", { path: lkgPath, savedAt: read.lkg.savedAt, why, note: "booting from the persisted last-known-good (all restart-to-apply faces included) — the live pull continues in the background and reconciles on arrival" });
-            return { effective: read.lkg.effective, ...(read.lkg.etag !== undefined ? { etag: read.lkg.etag } : {}) };
+            const lkgEffective = read.lkg.effective;
+            candidateIdentity.set(lkgEffective, identity);
+            bindValidator(read.lkg.etag, identity);
+            return { effective: lkgEffective, ...(read.lkg.etag !== undefined ? { etag: read.lkg.etag } : {}) };
         };
         const bootApplyLkgInline = async (lkgR) => {
             const lkgGen = generationOf(lkgR.effective.version);
             applyLedger.seenTarget(lkgGen, lkgR.effective.version);
-            applyEffective(config, lkgR.effective, logger, { sealedKeys, generation: lkgGen, report: (rep) => applyLedger.recordApply(rep) });
+            applyEffective(config, lkgR.effective, logger, { leg: "boot", sealedKeys, generation: lkgGen, report: (rep) => applyLedger.recordApply(rep) });
             applyLedger.applied(lkgGen, lkgR.effective.version);
             await adoptCenterPrompts(lkgR.effective, "boot-lkg");
             markRosterLanded(lkgR.effective);
@@ -231,7 +366,7 @@ export async function createConfigCenterRuntime(ctx) {
             logger.info("config_loaded", { source: "lkg", version: lkgR.effective.version, worker: cc?.worker ?? "(global)", models: cfgModels });
         };
         try {
-            const bootFetch = configProvider.fetchEffective(undefined);
+            const bootFetch = pullEffective(configProvider, undefined);
             const raced = await raceBootFetch(bootFetch, config.configBootFetchBudgetMs);
             let lkgFallback = null;
             if (raced === BOOT_FETCH_DEFERRED) {
@@ -274,6 +409,7 @@ export async function createConfigCenterRuntime(ctx) {
                     applyLedger.seenTarget(bootGen, r.effective.version);
                     let bootReport;
                     applyEffective(config, r.effective, logger, {
+                        leg: "boot",
                         sealedKeys,
                         generation: bootGen,
                         report: (rep) => {
@@ -327,6 +463,8 @@ export async function createConfigCenterRuntime(ctx) {
                 }
             }
         }
+        if (!dryRun && cc !== undefined && currentIdentity() !== promptStateIdentity)
+            await rebasePromptState(currentIdentity(), "boot-end");
     }
     const readFaceBaseline = { ...(config.readFace !== undefined ? { readFace: config.readFace } : {}), readFaceSource: config.readFaceSource };
     const readFaceEnvHeld = applyCenterReadFace(config, effective ?? { version: 0, updatedAt: "", models: { models: [], roles: {} } }, effective ? logger : undefined).envHeld;
@@ -337,8 +475,10 @@ export async function createConfigCenterRuntime(ctx) {
     let keyResolver;
     const mcpRevocations = createMcpRevocationLedger((ev) => logger.info("mcp_revocation_ledger", { ...(ev.revoked.length > 0 ? { revoked: ev.revoked } : {}), ...(ev.restored.length > 0 ? { restored: ev.restored } : {}) }));
     let mcpRevocationWired = false;
-    const restartCtx = () => ({
+    const restartCtx = (consolidationSeat) => ({
         ...(config.degrade?.reactive ? { reactiveDegradeTo: config.degrade.to } : {}),
+        pluginsAllowHosts: config.pluginsAllowHosts,
+        ...(consolidationSeat !== undefined ? { consolidationSeat } : {}),
         ...(readFaceEnvHeld.length > 0 ? { readFaceEnvHeld } : {}),
         ...(mcpRevocationWired && mcpRevocations.hasBaseline() ? { mcpRevocationLive: true } : {}),
     });
@@ -348,10 +488,6 @@ export async function createConfigCenterRuntime(ctx) {
         const { faceChanged } = applyCenterReadFace(config, eff, logger, { phase: "live", baseline: readFaceBaseline });
         if (!faceChanged)
             return;
-        if (swap === undefined) {
-            logger.warn("read_face_swap_unwired", { face: config.readFace ?? null, phase, note: "the center's read FACE changed but no Runner swap door was wired — the value landed in config while the engine keeps the seat it booted with" });
-            return;
-        }
         try {
             swap({ readFace: config.readFace });
             logger.info("read_face_swapped", { from: before ?? null, to: config.readFace ?? null, phase, note: "hot seat (core swapDeps) — legs that already prepared keep the face they prepared under" });
@@ -438,7 +574,7 @@ export async function createConfigCenterRuntime(ctx) {
         },
         async applyCenterCapabilities(skills) {
             if (effective?.skills && config.configCenter) {
-                skills = await applyCenterSkills(skills, effective.skills, config.configCenter.baseUrl, config.configCenter.token, logger, undefined, configLkgEnabled() ? defaultSkillCacheDir() : undefined);
+                skills = await applyCenterSkills(skills, effective.skills, config.configCenter, logger, undefined, configLkgEnabled() ? defaultSkillCacheDir() : undefined);
             }
             if (effective?.plugins) {
                 const pluginOut = await applyCenterPlugins(skills, effective, {
@@ -458,7 +594,7 @@ export async function createConfigCenterRuntime(ctx) {
             }
             if (bootLkgCandidate && lkgEnabled) {
                 const bootPublished = await persistLkgDurable(bootLkgCandidate.effective, bootLkgCandidate.etag).catch((err) => {
-                    logger.warn("config_lkg_save_failed", { path: lkgPath, err: String(err), note: "boot LKG persist failed — retained for the per-tick retry" });
+                    logger.warn("config_lkg_save_failed", { err: String(err), note: "boot LKG persist failed — retained for the per-tick retry" });
                     return false;
                 });
                 {
@@ -507,7 +643,7 @@ export async function createConfigCenterRuntime(ctx) {
             }
         },
         startRefreshLoop(a) {
-            const { runnerTierFrozen, pricing, limitSync, swapRunnerDeps, ceilingVerdict } = a;
+            const { pricing, limitSync, swapRunnerDeps, ceilingVerdict, consolidationSeat, checkpointStorePresent } = a;
             if (configProvider) {
                 const ccRef = config.configCenter;
                 let refreshInFlight = false;
@@ -521,18 +657,18 @@ export async function createConfigCenterRuntime(ctx) {
                             metrics.inc("models_tiers_plane_deferred_stuck_total");
                             logger.warn("models_tiers_deferred_no_handoff", { version: planeDeferredNoHandoff.version, since: planeDeferredNoHandoff.since, note: "candidate still retained without a next-boot handoff — mount restart-surviving LKG storage + CONFIG_LKG_DURABLE=true, or restart manually after ensuring the candidate is re-pulled at boot" });
                         }
-                        const r = arrival !== undefined ? arrival.result : await configProvider.fetchEffective(ccEtag);
+                        const r = arrival !== undefined ? arrival.result : await pullEffective(configProvider, ccEtag);
                         if (r === null && planeDeferredNoHandoff) {
                             const skillsDebt = (planeDeferredNoHandoff.blocked ?? []).includes("skills");
                             const promoted = lkgSurvivesRestart || skillsDebt ? await persistLkgDurable(planeDeferredNoHandoff.candidate, planeDeferredNoHandoff.candidateEtag) : false;
-                            const skillsProofPromotion = !promoted && !lkgSurvivesRestart && skillsDebt && lastPrewarmBodiesVerified && planeDeferredNoHandoff.planeDeferred !== true;
+                            const skillsProofPromotion = !promoted && !lkgSurvivesRestart && skillsDebt && lastPrewarmBodiesVerified;
                             if (skillsProofPromotion) {
                                 pendingRestart = { restartRequired: true, reasons: ["skills"], version: planeDeferredNoHandoff.version, since: Date.now() };
                                 logger.info("config_boot_skill_debt_promoted", { version: planeDeferredNoHandoff.version, note: "skill bodies verified on a source-confirmed-current candidate — the withheld skills restart is now published (non-durable lane, repair proven)" });
                                 planeDeferredNoHandoff = undefined;
                             }
                             else if (promoted) {
-                                const promotedReasons = [...new Set([...(planeDeferredNoHandoff.blocked ?? []), ...(planeDeferredNoHandoff.planeDeferred ? ["models-tiers"] : [])])];
+                                const promotedReasons = [...new Set(planeDeferredNoHandoff.blocked ?? [])];
                                 if (promotedReasons.length > 0) {
                                     pendingRestart = { restartRequired: true, reasons: promotedReasons, version: planeDeferredNoHandoff.version, since: Date.now() };
                                 }
@@ -573,18 +709,17 @@ export async function createConfigCenterRuntime(ctx) {
                             }
                             else {
                                 const planeChanged = modelPlaneChanged(appliedPlaneEff, r.effective);
-                                const planeDeferred = swapRunnerDeps === undefined && (runnerTierFrozen || planeHasActiveTiers(r.effective)) && planeChanged;
                                 let applyReport;
                                 const committed = applyEffective(config, r.effective, logger, {
-                                    teamsOnly: true,
+                                    leg: "hot",
+                                    checkpointStorePresent,
                                     sealedKeys,
                                     generation: tickGen,
                                     report: (rep) => {
                                         applyReport = rep;
                                         applyLedger.recordApply(rep);
                                     },
-                                    ...(planeDeferred ? { deferModelPlane: true } : {}),
-                                    ...(swapRunnerDeps !== undefined && planeChanged ? { swapPlane: swapRunnerDeps } : {}),
+                                    ...(planeChanged ? { swapPlane: swapRunnerDeps } : {}),
                                 });
                                 if (!committed)
                                     return "ok";
@@ -595,57 +730,37 @@ export async function createConfigCenterRuntime(ctx) {
                                 mcpRevocations.applyEnabledEntries(enabledMcpEntries(r.effective.mcp));
                                 applyLiveReadFace(r.effective, swapRunnerDeps, "refresh");
                                 applyLedger.applied(tickGen, r.effective.version);
-                                if (planeDeferred) {
-                                    logger.warn("models_tiers_plane_deferred", { version: r.effective.version, note: "tier-frozen Runner: the changed model plane (models/roles/tiers/default) is NOT hot-applied — admission stays on the Runner's generation; restart applies the new plane (models-tiers restart signal rides /health)" });
-                                }
-                                else {
-                                    appliedPlaneEff = r.effective;
-                                    planeDeferredNoHandoff = undefined;
-                                }
+                                appliedPlaneEff = r.effective;
+                                planeDeferredNoHandoff = undefined;
                                 await adoptCenterPrompts(r.effective, "refresh");
-                                if (!planeDeferred)
-                                    markRosterLanded(r.effective);
+                                markRosterLanded(r.effective);
                                 const fullyApplied = applyReport?.fullyApplied !== false;
                                 if (!fullyApplied) {
+                                    ccEtag = undefined;
+                                    const refused = applyReport ? refusedGroups(applyReport) : [];
                                     logger.warn("config_candidate_partially_applied", {
                                         version: r.effective.version,
-                                        rejected: applyReport?.limits.rejected?.keys ?? [],
+                                        rejected: refused.flatMap((g) => g.keys),
+                                        groups: refused.map((g) => g.group),
                                         note: "a group of this candidate was refused — the live config keeps serving the prior values for it; the LKG and the ETag stay on the last FULLY applied generation (this tree is re-judged next tick)",
                                     });
                                     return "ok";
                                 }
                                 const lkgPersisted = await persistLkgDurable(r.effective, r.etag);
-                                const reasons = restartReasons(effective, r.effective, restartCtx());
-                                if (swapRunnerDeps !== undefined) {
-                                    const mi = reasons.indexOf("models-tiers");
-                                    if (mi >= 0)
-                                        reasons.splice(mi, 1);
-                                }
+                                const reasons = restartReasons(effective, r.effective, restartCtx(consolidationSeat?.read()));
                                 const skillsChangeDetected = reasons.includes("skills");
                                 if (bootSkillStale && !skillsChangeDetected)
                                     reasons.push("skills");
-                                if (planeDeferred) {
-                                    if (lkgPersisted) {
-                                        if (!reasons.includes("models-tiers"))
-                                            reasons.push("models-tiers");
-                                        planeDeferredNoHandoff = undefined;
-                                    }
-                                    else {
-                                        const blocked = reasons.splice(0, reasons.length);
-                                        planeDeferredNoHandoff = { version: r.effective.version, since: planeDeferredNoHandoff?.since ?? Date.now(), ...(blocked.length > 0 ? { blocked } : {}), planeDeferred: true, candidate: r.effective, ...(r.etag !== undefined ? { candidateEtag: r.etag } : {}) };
-                                        logger.warn("models_tiers_deferred_no_handoff", { version: r.effective.version, blockedReasons: blocked, note: "plane deferred but no NEXT-BOOT handoff (LKG disabled/unwritable, or storage not declared restart-surviving — set CONFIG_LKG_DURABLE=true) — the WHOLE restart signal is withheld (it would loop); the old generation keeps serving" });
-                                    }
-                                }
-                                else if (lkgSurvivesRestart && !lkgPersisted) {
+                                if (lkgSurvivesRestart && !lkgPersisted) {
                                     const blocked = reasons.splice(0, reasons.length);
-                                    planeDeferredNoHandoff = { version: r.effective.version, since: planeDeferredNoHandoff?.since ?? Date.now(), blocked, candidate: r.effective, ...(r.etag !== undefined ? { candidateEtag: r.etag } : {}) };
+                                    planeDeferredNoHandoff = { version: r.effective.version, since: Date.now(), blocked, candidate: r.effective, ...(r.etag !== undefined ? { candidateEtag: r.etag } : {}) };
                                     logger.warn("restart_candidate_publication_incomplete", { version: r.effective.version, blockedReasons: blocked, note: "durable LKG declared but the candidate's publication is incomplete (skill bodies unverified) — restart signal withheld; retried every tick until the cache completes" });
                                 }
-                                else if (!planeDeferred && !lkgSurvivesRestart && bootSkillStale && !skillsChangeDetected && !lastPrewarmBodiesVerified) {
+                                else if (!lkgSurvivesRestart && bootSkillStale && !skillsChangeDetected && !lastPrewarmBodiesVerified) {
                                     const i = reasons.indexOf("skills");
                                     if (i >= 0) {
                                         reasons.splice(i, 1);
-                                        planeDeferredNoHandoff = { version: r.effective.version, since: planeDeferredNoHandoff?.since ?? Date.now(), blocked: ["skills"], candidate: r.effective, ...(r.etag !== undefined ? { candidateEtag: r.etag } : {}) };
+                                        planeDeferredNoHandoff = { version: r.effective.version, since: Date.now(), blocked: ["skills"], candidate: r.effective, ...(r.etag !== undefined ? { candidateEtag: r.etag } : {}) };
                                         logger.warn("config_boot_skill_debt_withheld", { version: r.effective.version, note: "boot skill debt still unproven on a non-durable deployment (body cache does not verify) — skills restart withheld this tick; re-verified each tick and published once the bodies prove fetchable" });
                                     }
                                 }
@@ -660,7 +775,7 @@ export async function createConfigCenterRuntime(ctx) {
                                 }
                                 logger.info("sema_registry_refreshed", {
                                     version: r.effective.version,
-                                    note: "collab + runtime governance + limits + models/roles/roster hot-applied; skills/mcp/runtime-gates(approvalRequire)/scenarios are restart-to-apply",
+                                    note: "collab + runtime governance (incl. approvalRequire) + limits + models/roles/roster hot-applied; skills/mcp/a2a/scenarios are restart-to-apply",
                                     ...(pendingRestart ? { restartRequired: true, restartReasons: pendingRestart.reasons } : {}),
                                 });
                                 latestEffective = r.effective;
@@ -721,18 +836,17 @@ export async function createConfigCenterRuntime(ctx) {
                         return;
                     }
                     const planeChangedLate = modelPlaneChanged(appliedPlaneEff, r.effective);
-                    const planeDeferredLate = swapRunnerDeps === undefined && (runnerTierFrozen || planeHasActiveTiers(r.effective)) && planeChangedLate;
                     let applyReportLate;
                     const committedLate = applyEffective(config, r.effective, logger, {
-                        teamsOnly: true,
+                        leg: "hot",
+                        checkpointStorePresent,
                         sealedKeys,
                         generation: lateGen,
                         report: (rep) => {
                             applyReportLate = rep;
                             applyLedger.recordApply(rep);
                         },
-                        ...(planeDeferredLate ? { deferModelPlane: true } : {}),
-                        ...(swapRunnerDeps !== undefined && planeChangedLate ? { swapPlane: swapRunnerDeps } : {}),
+                        ...(planeChangedLate ? { swapPlane: swapRunnerDeps } : {}),
                     });
                     if (!committedLate)
                         return;
@@ -742,20 +856,18 @@ export async function createConfigCenterRuntime(ctx) {
                     ceilingVerdict?.judge();
                     applyLiveReadFace(r.effective, swapRunnerDeps, "boot-deferred");
                     applyLedger.applied(lateGen, r.effective.version);
-                    if (planeDeferredLate)
-                        logger.warn("models_tiers_plane_deferred", { version: r.effective.version, note: "tier-frozen Runner (env tiers): the late-boot center model plane is NOT hot-applied — restart applies it" });
-                    else {
-                        appliedPlaneEff = r.effective;
-                        planeDeferredNoHandoff = undefined;
-                    }
+                    appliedPlaneEff = r.effective;
+                    planeDeferredNoHandoff = undefined;
                     await adoptCenterPrompts(r.effective, "boot-deferred");
-                    if (!planeDeferredLate)
-                        markRosterLanded(r.effective);
+                    markRosterLanded(r.effective);
                     const fullyAppliedLate = applyReportLate?.fullyApplied !== false;
                     if (!fullyAppliedLate) {
+                        ccEtag = undefined;
+                        const refusedLate = applyReportLate ? refusedGroups(applyReportLate) : [];
                         logger.warn("config_candidate_partially_applied", {
                             version: r.effective.version,
-                            rejected: applyReportLate?.limits.rejected?.keys ?? [],
+                            rejected: refusedLate.flatMap((g) => g.keys),
+                            groups: refusedLate.map((g) => g.group),
                             note: "late-boot candidate had a refused group — the LKG/ETag stay on the last FULLY applied generation; the refresh cadence re-judges the same tree",
                         });
                         return;
@@ -764,27 +876,10 @@ export async function createConfigCenterRuntime(ctx) {
                     latestEffective = r.effective;
                     ccEtag = r.etag;
                     const lkgPersistedLate = await persistLkgDurable(r.effective, r.etag);
-                    const reasons = restartReasons(undefined, r.effective, restartCtx());
-                    if (swapRunnerDeps !== undefined) {
-                        const miLate = reasons.indexOf("models-tiers");
-                        if (miLate >= 0)
-                            reasons.splice(miLate, 1);
-                    }
-                    if (planeDeferredLate) {
-                        if (lkgPersistedLate) {
-                            if (!reasons.includes("models-tiers"))
-                                reasons.push("models-tiers");
-                            planeDeferredNoHandoff = undefined;
-                        }
-                        else {
-                            const blocked = reasons.splice(0, reasons.length);
-                            planeDeferredNoHandoff = { version: r.effective.version, since: planeDeferredNoHandoff?.since ?? Date.now(), ...(blocked.length > 0 ? { blocked } : {}), planeDeferred: true, candidate: r.effective, ...(r.etag !== undefined ? { candidateEtag: r.etag } : {}) };
-                            logger.warn("models_tiers_deferred_no_handoff", { version: r.effective.version, blockedReasons: blocked, note: "late-boot plane deferred but no NEXT-BOOT handoff (see CONFIG_LKG_DURABLE) — the WHOLE restart signal is withheld (it would loop); old generation keeps serving" });
-                        }
-                    }
-                    else if (planeDeferredLate === false && lkgSurvivesRestart && !lkgPersistedLate) {
+                    const reasons = restartReasons(undefined, r.effective, restartCtx(consolidationSeat?.read()));
+                    if (lkgSurvivesRestart && !lkgPersistedLate) {
                         const blocked = reasons.splice(0, reasons.length);
-                        planeDeferredNoHandoff = { version: r.effective.version, since: planeDeferredNoHandoff?.since ?? Date.now(), blocked, candidate: r.effective, ...(r.etag !== undefined ? { candidateEtag: r.etag } : {}) };
+                        planeDeferredNoHandoff = { version: r.effective.version, since: Date.now(), blocked, candidate: r.effective, ...(r.etag !== undefined ? { candidateEtag: r.etag } : {}) };
                         logger.warn("restart_candidate_publication_incomplete", { version: r.effective.version, blockedReasons: blocked, note: "late-boot candidate publication incomplete on a durable-declared deployment — restart signal withheld; retried every tick" });
                     }
                     if (reasons.length > 0)
@@ -793,7 +888,15 @@ export async function createConfigCenterRuntime(ctx) {
                 };
                 if (bootConfigPending) {
                     const arrivalGen = reserveArrivalGeneration();
-                    void bootConfigPending.then((r) => void (lkgBooted ? runTick({ result: r, ordinal: arrivalGen }) : deferredBootApply(r, arrivalGen)), () => { });
+                    const continueArrival = (r) => void (lkgBooted ? runTick({ result: r, ordinal: arrivalGen }) : deferredBootApply(r, arrivalGen));
+                    void bootConfigPending.then((r) => {
+                        if (r !== null && configProvider.kind === "remote" && candidateIdentityOf(r.effective) !== currentIdentity()) {
+                            logger.warn("config_boot_arrival_identity_changed", { note: "the late boot pull landed under a center credential that is no longer current — not adopted; re-pulling once under the current credential" });
+                            void pullEffective(configProvider, undefined).then(continueArrival, (err) => logger.warn("config_boot_arrival_repull_failed", { err: String(err), note: "the refresh cadence retries under the current credential" }));
+                            return;
+                        }
+                        continueArrival(r);
+                    }, () => { });
                 }
             }
         },

package/dist/boot/execution-env.d.ts

@@ -1,4 +1,3 @@
-import { NodeLspManager } from "@sema-agent/core";
 import { TaskEnvRegistry } from "../capabilities/sandbox-file-send.js";
 import { SessionEnvironmentSelection } from "../capabilities/select-environment-tool.js";
 import type { ServiceConfig } from "../config.js";
@@ -67,6 +66,6 @@ export declare function createExecutionEnv(ctx: ExecutionEnvCtx): {
     executionEnvFactory: import("@sema-agent/core").ExecutionEnvFactory | undefined;
     worktreeReap: (() => Promise<void>) | undefined;
     sendUserFileTaskEnvs: TaskEnvRegistry | undefined;
-    lspManager: import("../lsp/manager.js").E2bLspManager | NodeLspManager | undefined;
+    lspManager: import("@sema-agent/core").NodeLspManager | import("../lsp/manager.js").E2bLspManager | undefined;
 };
 //# sourceMappingURL=execution-env.d.ts.map

package/dist/boot/execution-env.js

@@ -1,6 +1,6 @@
 import { existsSync } from "node:fs";
 import { join } from "node:path";
-import { NodeLspManager } from "@sema-agent/core";
+import { createHostLspManager } from "../host-lsp-manager.js";
 import { sandboxSendLaneEnabled, TaskEnvRegistry } from "../capabilities/sandbox-file-send.js";
 import { SessionEnvironmentSelection } from "../capabilities/select-environment-tool.js";
 import { createE2bLspManager } from "../lsp/e2b-manager.js";
@@ -290,7 +290,7 @@ export function createExecutionEnv(ctx) {
         })
         :
             lspProvider === "host" && config.lspHostEnabled && config.requirePrincipal !== true
-                ? new NodeLspManager({ log: (event, fields) => logger.info(event, fields) })
+                ? createHostLspManager((event, fields) => logger.info(event, fields))
                 : undefined;
     if (lspManager)
         logger.info("lsp_enabled", { provider: lspProvider });