@sema-agent/server 7.98.0 → 7.100.0

package/dist/boot/leader.js

@@ -1,6 +1,7 @@
 import { createLeaderEndpoint } from "../leader/endpoint.js";
 import { createLeaderRunner } from "../leader/wire.js";
 import { buildDeploymentPostureSeats } from "./runner-deps.js";
+import { hasApprovalListIntent } from "../approval.js";
 export function leaderK8sMinioGap(leaderEnabled, leaderProvider, hasS3) {
     if (!(leaderEnabled && leaderProvider === "k8s" && !hasS3))
         return null;
@@ -67,16 +68,18 @@ export function createLeaderFace(ctx) {
             ...(toolResultStore ? { toolResultStore } : {}),
             ...(leaderProvider === "k8s" ? { workspace: "/workspace" } : {}),
             sessionStore,
-            ...(checkpointStore && config.approvalRequire.length > 0
+            ...(checkpointStore
                 ? {
-                    durable: {
-                        checkpointStore,
-                        requireApproval: config.approvalRequire,
-                        deny: config.approvalDeny,
-                        autoBudget: config.approvalAutoBudget,
-                        neverAuto: config.approvalNeverAuto,
-                        ...(config.approvalTimeoutSec > 0 ? { ttlMs: config.approvalTimeoutSec * 1000 } : {}),
-                    },
+                    durable: () => hasApprovalListIntent(config)
+                        ? {
+                            checkpointStore,
+                            requireApproval: config.approvalRequire,
+                            deny: config.approvalDeny,
+                            autoBudget: config.approvalAutoBudget,
+                            neverAuto: config.approvalNeverAuto,
+                            ...(config.approvalTimeoutSec > 0 ? { ttlMs: config.approvalTimeoutSec * 1000 } : {}),
+                        }
+                        : undefined,
                 }
                 : {}),
         }), {

package/dist/boot/memory-consolidation.d.ts

@@ -1,3 +1,4 @@
+import type { RestartSliceCtx } from "../config-center/restart-signal.js";
 import { type ConsolidationDriverRunRow, type ConsolidationRunReceipt, type MemoryBackend, type MemoryConsolidationDriverDeps, type RunMemoryConsolidationOptions, type SessionCaptureRecordStore } from "@sema-agent/core";
 /** D3 投影的座标签闭集。`role:<name>` 里的 name 只可能是 core 的 role 链两跳之一。 */
 export type ConsolidationSeatLabel = "explicit" | "role:consolidate" | "role:summarize";
@@ -30,6 +31,43 @@ export interface ConsolidationDriverSeat {
  * (探针只构造闭包、不发任何请求、无副作用。)
  */
 export declare function resolveConsolidationDriverSeat(deps: MemoryConsolidationDriverDeps): ConsolidationDriverSeat;
+/**
+ * S-668 波 0([ref] §3)—— 整理驱动席的 **restart 读数**。过渡件:**波 1 转热后删**(那时每轮 run 起手
+ * 现取当前代的席,不再有 boot 烤死的席,这只表也就没有要比的东西了)。
+ *
+ * ## 为什么要它
+ *
+ * 席位在 boot 期解析一次(本模块头注「座在启动期解析一次」),core 的解析器把它选中的那只 `Model` 对象焊进
+ * chat 闭包。refresh 拍对模型面的热换(`mutateInPlace` + `swapDeps`)换的是目录里的**值**,够不到那只对象
+ * ⇒ 中心改了 roles / 档位绑定 / 那条目录条目之后,整理跑仍打 boot 那一代。修前没有任何一片签它 —— 它唯一
+ * 沾边的 `models-tiers` 片在生产上恒被摘除(今已退役)—— 于是这块是「静默冷」:既不热应用、也不报重启。
+ *
+ * ## 读法:问 core 的**同一只**解析器,不抄它的 role 链
+ *
+ * 席位 = `consolidate → summarize(含 flash 档位缺省)` 那条链对「env 角色底 + 中心目录 + 档位表」解出来的
+ * 那只 Model;本层抄一份链就是第二真源({@link seatLabel} 注里同一条理由)。做法:拿活配置调
+ * `resolveMemoryConsolidationDriver`,brain 与 per-model 凭据席都换成探针,再调一次它交回的 `chat` ——
+ * core 的 chat 第一件事就是拿**它选中的那只 Model** 问凭据席(`deps.getApiKeyAndHeaders?.(resolved)`,在
+ * 第一个 await 之前同步求值),探针在那一刻记下它并抛停:零请求、零副作用。
+ * ⚠️ 这一步依赖 core chat 闭包的**行为次序**:哪天 core 改成先做别的再问凭据席,探针就截不到 —— 那一刻本函数
+ * **响亮抛**(boot 期抛 = 阀门开着的部署拒启,句子说清原因),不退化成「读不到就当没变」(那正是本件要消灭的
+ * 静默)。钉:test/memory-consolidation-driver.test.ts 的探针格对真 core 跑,提货批当场红。
+ *
+ * ## 指纹里有什么
+ *
+ * 整只 Model 减掉 `cost`:整理跑只读 usage 的 token 数、零处读价目(core 7.29.0 的 driver 实现零 `cost` /
+ * `pricing` 读点),纯改价不该造一次重启。解不出来(中心撤掉了 consolidate / summarize 两跳)⇒ 记成
+ * `{ unresolvable: <core 原句> }`,与 boot 那只不等 ⇒ 签重启;重启会在 D1 拒启、把同一句原句写进拒因 ——
+ * 那正是运维该看见的话,比「这台还在用一只中心已经撤掉的席」诚实。
+ */
+export interface ConsolidationSeatWatch {
+    /** boot 烤进去的席 vs 活配置此刻会解出的席(`restartReasons` 的 `memory-consolidation` 片两侧读数)。 */
+    read(): NonNullable<RestartSliceCtx["consolidationSeat"]>;
+}
+/** 解席的输入面 = boot 期真席用的同三件(活引用:refresh 就地换代,`read()` 每次现取)。 */
+export type ConsolidationSeatPlane = Pick<MemoryConsolidationDriverDeps, "models" | "tiers" | "roles">;
+/** `create*`:返回带捕获状态(boot 那只指纹)的活对象。须在真席解析的**同一时刻**调(同一份输入)。 */
+export declare function createConsolidationSeatWatch(plane: () => ConsolidationSeatPlane): ConsolidationSeatWatch;
 /**
  * **每 scope 单飞**(codex 交叉复审 [high],验真后修)—— 同一 scope 上在飞的那一轮被后来者**并入**,
  * 而不是各起一轮。`create*`:返回带状态的活对象。

package/dist/boot/memory-consolidation.js

@@ -16,6 +16,41 @@ export function resolveConsolidationDriverSeat(deps) {
     }
     return { options, seat: seatLabel(deps), model: options.model };
 }
+export function createConsolidationSeatWatch(plane) {
+    const baked = consolidationSeatFingerprint(plane());
+    return { read: () => ({ baked, current: consolidationSeatFingerprint(plane()) }) };
+}
+function consolidationSeatFingerprint(plane) {
+    const stop = new Error("consolidation seat probe: stopped before any request");
+    const refuse = () => {
+        throw stop;
+    };
+    const probeBrain = { stream: refuse, complete: refuse };
+    const seen = {};
+    let options;
+    try {
+        options = resolveMemoryConsolidationDriver({
+            ...plane,
+            brain: probeBrain,
+            getApiKeyAndHeaders: (model) => {
+                seen.model = model;
+                throw stop;
+            },
+        });
+    }
+    catch (err) {
+        return { unresolvable: err instanceof Error ? err.message : String(err) };
+    }
+    void options.chat({ system: "", user: "", maxTokens: 1, temperature: 0 }).catch(() => undefined);
+    if (seen.model === undefined) {
+        throw new Error("MEMORY_CONSOLIDATION_DRIVER=on, but the consolidation seat's restart probe could not observe which model the " +
+            "engine's seat resolver chose (the resolved chat seat no longer asks the per-model credential seat before its " +
+            "first await) — refusing rather than leave this seat's restart signal blind. This is an engine-pickup defect " +
+            "in boot/memory-consolidation.ts (createConsolidationSeatWatch), not a deployment setting.");
+    }
+    const { cost: _cost, ...route } = seen.model;
+    return route;
+}
 function seatLabel(deps) {
     if (deps.memoryConsolidationDriver?.chat !== undefined)
         return "explicit";

package/dist/boot/org-memory.d.ts

@@ -54,7 +54,8 @@ export interface OrgMemoryAdmissionWiring {
     /** §7 第二消费者收编:同一个目录实例也喂 memory-policy 面的 `org:` 属主门(`ServiceDeps.orgMemoryDirectory`)。
      *  **同实例**是这条收编的全部意义——「谁属于 org:acme」在一个进程里必须只有一个答案,两面共享同一份
      *  TTL 缓存/退避窗/gen 高水位;各建各的目录会让准入门与策略面在吊销窗内公开分歧。缺席=无目录源
-     *  (单用户/无 center 且无 env 表)⇒ 策略面逐字保持收编前的 operator-only 行为。 */
+     *  (单用户/无 center 且无 env 表)⇒ 策略面逐字保持收编前的 operator-only 行为。
+     *  远程腿的这一个实例内部按中心凭证身份分箱([ref] E-15):两面问到的是同一身份的同一箱。 */
     directory: OrgMemoryDirectory | undefined;
 }
 /** 依赖收窄到真实消费面(warn/inc 各一手)——接口隔离让测试用真形字面量,零铸形([ref] §1)。 */

package/dist/boot/org-memory.js

@@ -1,4 +1,5 @@
 import { fetchPrincipalOrgMemory } from "../config-center/http-client.js";
+import { createIdentityBins } from "../center-credential.js";
 import { createMemoryScopeAdmission, createOrgMemoryDirectory, parseOrgDirectoryStatic } from "../org-memory-admission.js";
 const ORG_PREFIX = "org:";
 function collectDeploymentOrgScopes(config) {
@@ -25,11 +26,14 @@ export function createOrgMemoryAdmissionWiring(opts) {
         });
     }
     const directory = centerLeg !== undefined
-        ? createOrgMemoryDirectory({
-            fetchSection: (principal) => fetchPrincipalOrgMemory(centerLeg.baseUrl, centerLeg.token, principal, fetch, centerLeg.worker),
-            grantTtlMs: config.memoryOrgGrantTtlMs,
-            unavailableBackoffMs: config.memoryOrgUnavailableBackoffMs,
-        })
+        ? (() => {
+            const directoryNow = createIdentityBins(centerLeg.credential, (credential) => createOrgMemoryDirectory({
+                fetchSection: (principal) => fetchPrincipalOrgMemory({ baseUrl: centerLeg.baseUrl, credential }, principal, fetch, centerLeg.worker),
+                grantTtlMs: config.memoryOrgGrantTtlMs,
+                unavailableBackoffMs: config.memoryOrgUnavailableBackoffMs,
+            }));
+            return { lookup: (principal) => directoryNow().lookup(principal) };
+        })()
         : staticJson !== undefined
             ? createOrgMemoryDirectory({
                 staticTable: parseOrgDirectoryStatic(staticJson),

package/dist/boot/resolve-spec.d.ts

@@ -79,7 +79,6 @@ export interface ResolveSpecCtx {
      */
     approverSeat: RunnerDepsOnAsk | undefined;
     approvalExemptionStore: ReturnType<StoreBackend["approvalExemption"]> | undefined;
-    singleUserAutoAcceptBaseline: boolean;
     checkpointStore: ReturnType<NonNullable<StoreBackend["checkpoint"]>> | undefined;
     deploymentHooks: NonNullable<RunnerDeps["hooks"]>;
     imageIndex: ReturnType<NonNullable<StoreBackend["imageIndex"]>> | undefined;

package/dist/boot/resolve-spec.js

@@ -10,6 +10,7 @@ import { stampHandsLane, toolPolicyForHands } from "../capabilities/hands-lane.j
 import { buildNoticeLaneFacts, shouldDiscloseNoPersistentMemory, withNoPersistentMemoryNotice } from "../capabilities/memory-notice.js";
 import { applyLongtailDefer } from "../capabilities/tool-defer.js";
 import { assertGuardPatternsUsable, buildOnlySensitiveBaselineWarning, createApprovalBaselinePolicy, createDeploymentGovernanceInputs } from "../deployment-governance.js";
+import { singleUserAutoAcceptBaselineApplies } from "../approval.js";
 import { acceptShellScratchpadDir, buildEnvFacts, egressForRemoteExec, ensureScratchpadDir, resumeFactsForLane, scratchpadCoveringTaskRoot } from "../env-facts.js";
 import { FleetEventBus } from "../fleet/fleet-bus.js";
 import { composeHooks, createTaskHooks } from "../hooks/hook-runner.js";
@@ -40,9 +41,9 @@ import { executionLaneCaps, executionLaneHomeDir, executionLaneOf } from "../exe
 import { effectiveMemoryPersistenceCapable } from "./memory-boundary.js";
 import { memoryFaceMounted } from "../memory-scope.js";
 export function createResolveSpec(ctx) {
-    const { config, logger, metrics, localRoot, scenarios, principalCaps, centerRuntimeCapsResolver, getCenterPrompts, getKeyResolver, taskAttachmentStore, perSessionCwd, setSessionCwd, setSessionShellEnv, fenceSessionOwner, hookLlm, hookAgent, fleetBus, hookWakeBus, noteSessionShellGate, resumeAnchorStore, ownerAware, taskLimitCaps, taskTimeoutSec, selectEnvTool, sendUserFileToolSpec, memoryEngine, durableEnabled, approvalExemptionStore, singleUserAutoAcceptBaseline, checkpointStore, deploymentHooks, imageIndex, perTaskImage, sessionEnvSelection, liveQuestionFace, approverSeat, lockedKeys, } = ctx;
+    const { config, logger, metrics, localRoot, scenarios, principalCaps, centerRuntimeCapsResolver, getCenterPrompts, getKeyResolver, taskAttachmentStore, perSessionCwd, setSessionCwd, setSessionShellEnv, fenceSessionOwner, hookLlm, hookAgent, fleetBus, hookWakeBus, noteSessionShellGate, resumeAnchorStore, ownerAware, taskLimitCaps, taskTimeoutSec, selectEnvTool, sendUserFileToolSpec, memoryEngine, durableEnabled, approvalExemptionStore, checkpointStore, deploymentHooks, imageIndex, perTaskImage, sessionEnvSelection, liveQuestionFace, approverSeat, lockedKeys, } = ctx;
     assertGuardPatternsUsable(config);
-    const onlySensitiveBaseline = buildOnlySensitiveBaselineWarning(config, { durableEnabled, singleUserAutoAcceptBaseline });
+    const onlySensitiveBaseline = buildOnlySensitiveBaselineWarning(config, { durableEnabled, singleUserAutoAcceptBaseline: singleUserAutoAcceptBaselineApplies(config) });
     const realTaskRootOf = (auth) => {
         if (isSandboxPathAdjudicationLane(config.remoteExec?.provider))
             return undefined;
@@ -421,7 +422,7 @@ export function createResolveSpec(ctx) {
                         }
                         : {}),
                 })
-                : singleUserAutoAcceptBaseline
+                : singleUserAutoAcceptBaselineApplies(config)
                     ? createApprovalBaselinePolicy(config)
                     : undefined),
             ...(durableEnabled

package/dist/boot/runner-deps.d.ts

@@ -5,8 +5,8 @@
  * `deps-literal-shape-gate` 的顶层条件展开门覆盖面不变);新增的只有 import 与包壳。
  *
  * ⚠️ **位置即契约**:必须晚于 stores/exec-env/coordinators/workflow 段(所有键都是它们的产物),
- * 且早于 `new Runner(runnerDeps)` —— Runner 构造会冻结 tier 展开后的私有目录副本
- * (`runnerTierFrozen` 判据就取自构造那一刻的 `config.tiers`)。
+ * 且早于 `new Runner(runnerDeps)` —— Runner 构造时展开 tier 表成私有目录副本(之后的换代经
+ * `Runner.swapDeps` 换进,见 boot/stage-08-reapers.ts)。
  * `getRunStore()` 是唯一的晚绑取值(runStore 在本段之后才构造),原文靠同作用域前向引用。
  */
 import { type CacheBreakFinding, type RunnerDeps, type WorkflowRunStore, type AskOutcome } from "@sema-agent/core";

package/dist/boot/runtime-caps.js

@@ -1,4 +1,5 @@
-import { applyGovernedVerdictAbsenceWarning, applyLocalAutoModeDeny, applyMemoryOptOutGrant, applyObserverEnvOptIn, centerEntitlementSourceWired, createPrincipalEntitlementsClient, scopedTokenNeedsWorker, } from "../runtime-caps-resolver.js";
+import { applyGovernedVerdictAbsenceWarning, applyLocalAutoModeDeny, applyMemoryOptOutGrant, applyObserverEnvOptIn, centerEntitlementSourceWired, createPrincipalEntitlementsClient, } from "../runtime-caps-resolver.js";
+import { scopedTokenNeedsWorker } from "../center-credential.js";
 export function assertMemoryCapturePolicyWirable(input) {
     if (input.policy !== "governed")
         return;
@@ -36,15 +37,14 @@ export function createRuntimeCaps(ctx) {
             reason: "MEMORY_CAPTURE_POLICY=governed with NO local memory_optout_grant table: the only verdict source is the config center, and `allowMemoryOptOut` is an OPTIONAL entitlement key — for any principal whose caps omit it the verdict is ABSENT and core refuses that session's memory.capture:\"off\" (memory.capture_optout_denied, fail-closed). ANONYMOUS/system runs are worse off still: the center source is per-principal and is never consulted without an identity, so on this shape a principal-less run can never obtain a verdict at all. Verify the center emits allowMemoryOptOut for every principal, or wire a SQL backend (DB_BACKEND=mysql|pg) so the grant table answers (its deployment-default row also covers anonymous runs).",
         });
     }
-    if (centerEntitlementSourceWired(config) && config.configCenter && scopedTokenNeedsWorker(config.configCenter.token, config.configCenter.worker)) {
+    if (centerEntitlementSourceWired(config) && config.configCenter && scopedTokenNeedsWorker(config.configCenter.credential.read(), config.configCenter.worker)) {
         logger.warn("runtime_caps_scoped_token_no_worker", {
             reason: "SEMA_REGISTRY_TOKEN is a worker-scoped wpt_ token but SEMA_REGISTRY_WORKER is unset → center 403s per-principal caps → ALL workflow self-orchestration will be fail-closed denied. Set SEMA_REGISTRY_WORKER (the orchestrator normally injects it) or use the full SERVICE_PULL_TOKEN.",
         });
     }
     const principalCaps = centerEntitlementSourceWired(config) && config.configCenter
         ? createPrincipalEntitlementsClient({
-            baseUrl: config.configCenter.baseUrl,
-            token: config.configCenter.token,
+            center: config.configCenter,
             ...(config.configCenter.worker ? { worker: config.configCenter.worker } : {}),
             onError: (err, principal) => logger.warn("runtime_caps_resolve_failed", { principal, err: String(err) }),
         })

package/dist/boot/stage-05-execution-env.d.ts

@@ -5,7 +5,7 @@ export declare function runStage05(ctx: Awaited<ReturnType<typeof runStage04>>):
     dropSessionScoped: (sid: string) => void;
     executionEnvFactory: import("@sema-agent/core").ExecutionEnvFactory | undefined;
     fenceSessionOwner: (sid: string, owner: string | null) => void;
-    lspManager: import("../lsp/manager.js").E2bLspManager | import("@sema-agent/core").NodeLspManager | undefined;
+    lspManager: import("@sema-agent/core").NodeLspManager | import("../lsp/manager.js").E2bLspManager | undefined;
     perSessionCwd: Map<string, string>;
     perTaskImage: import("../per-task-image.js").PerTaskImageRegistry;
     sendUserFileTaskEnvs: import("../capabilities/sandbox-file-send.js").TaskEnvRegistry | undefined;

package/dist/boot/stage-06-runners.d.ts

@@ -13,6 +13,7 @@ export declare function runStage06(ctx: Awaited<ReturnType<typeof runStage05>>):
     approvalAskAudit: import("../approval-ask-audit-store.js").FileApprovalAskAuditStore | undefined;
     centerRuntimeCapsResolver: ((principal: string | undefined) => Promise<import("@sema-agent/core").RuntimeCaps | undefined>) | undefined;
     checkpointStore: import("../plugins/store-backend.js").CheckpointStoreFull | undefined;
+    consolidationSeatWatch: import("./memory-consolidation.js").ConsolidationSeatWatch | undefined;
     durableEnabled: boolean;
     elicitation: import("../elicitation.js").ElicitationCoordinator | undefined;
     fleetBus: import("../fleet/fleet-bus.js").FleetEventBus;
@@ -33,7 +34,6 @@ export declare function runStage06(ctx: Awaited<ReturnType<typeof runStage05>>):
     retentionLaneStore: import("../plugins/retention-lane-store-sql.js").RetentionLaneStore | undefined;
     runner: Runner;
     runnerDeps: import("@sema-agent/core").RunnerDeps;
-    runnerTierFrozen: boolean;
     runtimeCapsPeekResolver: import("../runtime-caps-resolver.js").EntitlementsResolverFn | undefined;
     sendFileLedger: import("../plugins/send-file-ledger.js").SendFileLedger | undefined;
     sendUserFileEmitter: import("../capabilities/send-user-file-tool.js").SendUserFileEmitter | undefined;
@@ -66,7 +66,7 @@ export declare function runStage06(ctx: Awaited<ReturnType<typeof runStage05>>):
     dropSessionScoped: (sid: string) => void;
     executionEnvFactory: import("@sema-agent/core").ExecutionEnvFactory | undefined;
     fenceSessionOwner: (sid: string, owner: string | null) => void;
-    lspManager: import("../lsp/manager.js").E2bLspManager | import("@sema-agent/core").NodeLspManager | undefined;
+    lspManager: import("@sema-agent/core").NodeLspManager | import("../lsp/manager.js").E2bLspManager | undefined;
     perSessionCwd: Map<string, string>;
     perTaskImage: import("../per-task-image.js").PerTaskImageRegistry;
     sendUserFileTaskEnvs: import("../capabilities/sandbox-file-send.js").TaskEnvRegistry | undefined;

package/dist/boot/stage-06-runners.js

@@ -10,7 +10,7 @@ import { workflowModelAllowlistFor } from "../task-workflow.js";
 import { backendOwnsControlPlane } from "../memory-operator-faces.js";
 import { createHookLlm, buildHookFailureText } from "../hooks/hook-llm.js";
 import { assertRetentionLaneWirable } from "./retention-lane.js";
-import { assertConsolidationDriverWirable, buildConsolidationValveAudit, createMemoryConsolidationFaces, resolveConsolidationDriverSeat } from "./memory-consolidation.js";
+import { assertConsolidationDriverWirable, buildConsolidationValveAudit, createConsolidationSeatWatch, createMemoryConsolidationFaces, resolveConsolidationDriverSeat } from "./memory-consolidation.js";
 import { createPerModelAuthSeat } from "./side-query-lane.js";
 import { createWorkflowOrchestration } from "./workflow-orchestration.js";
 import { createLiveCoordinators } from "./coordinators.js";
@@ -72,6 +72,7 @@ export function runStage06(ctx) {
             getApiKeyAndHeaders: createPerModelAuthSeat(() => configCenter.getKeyResolver()),
         })
         : undefined;
+    const consolidationSeatWatch = consolidationSeat ? createConsolidationSeatWatch(() => ({ models: config.models, tiers: config.tiers, roles: config.roles })) : undefined;
     const memoryConsolidationFaces = consolidationSeat && memoryEngine
         ? createMemoryConsolidationFaces(memoryEngine, {
             seat: consolidationSeat,
@@ -130,7 +131,6 @@ export function runStage06(ctx) {
     });
     const runner = new Runner(runnerDeps);
     const handslessRunner = new Runner(withoutExecutionEnv(runnerDeps));
-    const runnerTierFrozen = Object.keys(config.tiers).length > 0;
     const { hookModelFor, hookLlm } = createHookLlm({ config, getKeyResolver: () => configCenter.getKeyResolver(), metrics });
     const hookAgentRunner = new Runner({ ...runnerDeps, sessionStore: new TtlSessionStore({ defaultTtlDays: 1 / 24 }) });
     const agentHookCall = async ({ prompt, model, timeoutMs, system }) => {
@@ -212,6 +212,6 @@ export function runStage06(ctx) {
     };
     const subRunner = new Runner(subRunnerDeps);
     const handslessSubRunner = new Runner(withoutExecutionEnv(subRunnerDeps));
-    return { ...ctx, approvalAskAudit, centerRuntimeCapsResolver, checkpointStore, durableEnabled, elicitation, fleetBus, governanceSeams, handslessRunner, handslessSubRunner, hookAgent, hookAgentRunner, hookLlm, mcpRevocations, memoryConsolidationFaces, memoryOptOutGrantStore, orgMemoryAdmission, outcomeSink, principalCaps, question, retentionExecutor, retentionLaneStore, runner, runnerDeps, runnerTierFrozen, runtimeCapsPeekResolver, sendFileLedger, sendUserFileEmitter, sendUserFileToolSpec, sessionShellGateRegistry, sessionTitler, sharedMemoryStore, sqlWorkflowRunStore, streamApprovalGate, subRunner, subRunnerSessions, subagentSteerRegistry, toolApproval, workflowAgentRegistry, workflowAgentSessionIndex, workflowCompletionInbox, workflowJournalStore, workflowModelAllowlistSnapshot, workflowNotifyGate, workflowNotifyJournal, workflowRecoverOpts, workflowRunStore, workflowsCapable };
+    return { ...ctx, approvalAskAudit, centerRuntimeCapsResolver, checkpointStore, consolidationSeatWatch, durableEnabled, elicitation, fleetBus, governanceSeams, handslessRunner, handslessSubRunner, hookAgent, hookAgentRunner, hookLlm, mcpRevocations, memoryConsolidationFaces, memoryOptOutGrantStore, orgMemoryAdmission, outcomeSink, principalCaps, question, retentionExecutor, retentionLaneStore, runner, runnerDeps, runtimeCapsPeekResolver, sendFileLedger, sendUserFileEmitter, sendUserFileToolSpec, sessionShellGateRegistry, sessionTitler, sharedMemoryStore, sqlWorkflowRunStore, streamApprovalGate, subRunner, subRunnerSessions, subagentSteerRegistry, toolApproval, workflowAgentRegistry, workflowAgentSessionIndex, workflowCompletionInbox, workflowJournalStore, workflowModelAllowlistSnapshot, workflowNotifyGate, workflowNotifyJournal, workflowRecoverOpts, workflowRunStore, workflowsCapable };
 }
 //# sourceMappingURL=stage-06-runners.js.map

package/dist/boot/stage-07-capability-layer.d.ts

@@ -17,7 +17,6 @@ export declare function runStage07(ctx: Awaited<ReturnType<typeof runStage06>>):
     scenarioDetails: Record<string, import("../capabilities/scenarios.js").ScenarioDetail>;
     scenarios: Record<string, import("../capabilities/scenarios.js").Scenario>;
     selectEnvTool: import("@sema-agent/core").ToolSpec<import("@sema-agent/core").TSchema> | undefined;
-    singleUserAutoAcceptBaseline: boolean;
     taskLimitCaps: {
         timeoutSec: number | undefined;
         maxOutputTokens: number | undefined;
@@ -28,6 +27,7 @@ export declare function runStage07(ctx: Awaited<ReturnType<typeof runStage06>>):
     approvalAskAudit: import("../approval-ask-audit-store.js").FileApprovalAskAuditStore | undefined;
     centerRuntimeCapsResolver: ((principal: string | undefined) => Promise<import("@sema-agent/core").RuntimeCaps | undefined>) | undefined;
     checkpointStore: import("../plugins/store-backend.js").CheckpointStoreFull | undefined;
+    consolidationSeatWatch: import("./memory-consolidation.js").ConsolidationSeatWatch | undefined;
     durableEnabled: boolean;
     elicitation: import("../elicitation.js").ElicitationCoordinator | undefined;
     fleetBus: import("../fleet/fleet-bus.js").FleetEventBus;
@@ -48,7 +48,6 @@ export declare function runStage07(ctx: Awaited<ReturnType<typeof runStage06>>):
     retentionLaneStore: import("../plugins/retention-lane-store-sql.js").RetentionLaneStore | undefined;
     runner: import("@sema-agent/core").Runner;
     runnerDeps: import("@sema-agent/core").RunnerDeps;
-    runnerTierFrozen: boolean;
     runtimeCapsPeekResolver: import("../runtime-caps-resolver.js").EntitlementsResolverFn | undefined;
     sendFileLedger: import("../plugins/send-file-ledger.js").SendFileLedger | undefined;
     sendUserFileEmitter: import("../capabilities/send-user-file-tool.js").SendUserFileEmitter | undefined;
@@ -81,7 +80,7 @@ export declare function runStage07(ctx: Awaited<ReturnType<typeof runStage06>>):
     dropSessionScoped: (sid: string) => void;
     executionEnvFactory: import("@sema-agent/core").ExecutionEnvFactory | undefined;
     fenceSessionOwner: (sid: string, owner: string | null) => void;
-    lspManager: import("../lsp/manager.js").E2bLspManager | import("@sema-agent/core").NodeLspManager | undefined;
+    lspManager: import("@sema-agent/core").NodeLspManager | import("../lsp/manager.js").E2bLspManager | undefined;
     perSessionCwd: Map<string, string>;
     perTaskImage: import("../per-task-image.js").PerTaskImageRegistry;
     sendUserFileTaskEnvs: import("../capabilities/sandbox-file-send.js").TaskEnvRegistry | undefined;

package/dist/boot/stage-07-capability-layer.js

@@ -6,7 +6,7 @@ import { parseCapEnv, parseNumOrFailNonNegative } from "../config.js";
 import { ensureChildSessionDurableWithPromotion } from "../plugins/session-store.js";
 import { webSearchConfigFromEnv, createWebSearchBackend, shouldProbeWebSearchOnBoot } from "../plugins/web-search.js";
 import { createAuthorizer } from "../security.js";
-import { assertGateIntentServiceable, buildForceDurableGateInertNotice, buildNoResponderBootWarns, hasOperatorGateIntent } from "../approval.js";
+import { buildForceDurableGateInertNotice, buildNoResponderBootWarns, gateIntentUnserviceableReason, singleUserAutoAcceptBaselineApplies } from "../approval.js";
 import { executionLaneOf } from "../execution-lane-caps.js";
 import { loadDeploymentSkills } from "../capabilities/skills.js";
 import { createRepoClient } from "../capabilities/repo-tools.js";
@@ -46,9 +46,9 @@ export async function runStage07(ctx) {
         maxOutputTokens: capEnv("TASK_MAX_OUTPUT_TOKENS_MAX"),
         maxTurns: capEnv("TASK_MAX_TURNS_MAX"),
     };
-    const operatorGateIntent = hasOperatorGateIntent(config);
-    assertGateIntentServiceable(config, checkpointStore !== undefined);
-    const singleUserAutoAcceptBaseline = config.requirePrincipal !== true && !operatorGateIntent;
+    const gateRefusal = gateIntentUnserviceableReason(config, checkpointStore !== undefined);
+    if (gateRefusal !== undefined)
+        throw new Error(gateRefusal);
     await reclaimOrphansAtBoot(runStore, checkpointStore, logger);
     const imageIndex = backend?.imageIndex ? backend.imageIndex() : undefined;
     const selectEnvTool = config.selectEnvironmentTool && config.remoteExec?.provider === "k8s" && imageIndex
@@ -79,7 +79,7 @@ export async function runStage07(ctx) {
         approvalFaceWired: toolApproval !== undefined || durableEnabled,
     }))
         logger.warn(w.event, w.fields);
-    if (singleUserAutoAcceptBaseline) {
+    if (singleUserAutoAcceptBaselineApplies(config)) {
         logger.info("tool_policy_single_user_default", {
             posture: "adjudicated auto-accept — ALL write/hand/MCP tool surfaces auto-allowed (core per-surface UNGATED enumeration suppressed for single-user turnkey)",
             tighten: "APPROVAL_REQUIRE / AUTONOMY / commandPolicy (re-surfaces + gates specific surfaces)",
@@ -155,6 +155,6 @@ export async function runStage07(ctx) {
     const builtinScenarioNames = Object.keys(scenarioDetails);
     configCenter.applyCenterScenarios({ scenarioDeps, scenarios, scenarioDetails, builtinScenarioNames });
     logger.info("capabilities", { skills: skills.length, scenarios: Object.keys(scenarios), repoTools: Boolean(repoClient) });
-    return { ...ctx, approvalExemptionStore, approvalNonceStore, authorize, imageBakes, imageIndex, parkedReviveInheritedGate, parkedReviveTool, rateLimiter, resumeAnchorStore, runStore, scenarioDetails, scenarios, selectEnvTool, singleUserAutoAcceptBaseline, taskLimitCaps, taskTimeoutSec, webSearchProvider: webSearchCfg?.provider };
+    return { ...ctx, approvalExemptionStore, approvalNonceStore, authorize, imageBakes, imageIndex, parkedReviveInheritedGate, parkedReviveTool, rateLimiter, resumeAnchorStore, runStore, scenarioDetails, scenarios, selectEnvTool, taskLimitCaps, taskTimeoutSec, webSearchProvider: webSearchCfg?.provider };
 }
 //# sourceMappingURL=stage-07-capability-layer.js.map

package/dist/boot/stage-08-reapers.d.ts

@@ -2,7 +2,7 @@
  * 装配第 8 段 —— **后台 reaper**(§3-8)。
  * 维护 tick(startReapers)+ 托管留存 lane(独立定时器)+ OTLP 导出 + 限额座换代口 + 五只 boot Runner 的
  * 原子换代闭包 + config-center 刷新环与 key resolver 首建。
- * ⚠️ 位置即契约:刷新环必须在 `new Runner` 之后(runnerTierFrozen 与构造函数读同一 config 代际);
+ * ⚠️ 位置即契约:刷新环必须在 `new Runner` 之后(它要五只 boot Runner 的换代口 `swapRunnerDeps`);
  * key resolver 首建读的必须是 boot apply 之后的 config。
  * 🔴 `runDenySweep` 的 holder 住在 `late-binds.ts`(赋值点在第十段的 server 之后)。
  */
@@ -30,7 +30,6 @@ export declare function runStage08(ctx: Awaited<ReturnType<typeof runStage07>>):
     scenarioDetails: Record<string, import("../capabilities/scenarios.js").ScenarioDetail>;
     scenarios: Record<string, import("../index.js").Scenario>;
     selectEnvTool: import("@sema-agent/core").ToolSpec<import("@sema-agent/core").TSchema> | undefined;
-    singleUserAutoAcceptBaseline: boolean;
     taskLimitCaps: {
         timeoutSec: number | undefined;
         maxOutputTokens: number | undefined;
@@ -41,6 +40,7 @@ export declare function runStage08(ctx: Awaited<ReturnType<typeof runStage07>>):
     approvalAskAudit: import("../approval-ask-audit-store.js").FileApprovalAskAuditStore | undefined;
     centerRuntimeCapsResolver: ((principal: string | undefined) => Promise<import("@sema-agent/core").RuntimeCaps | undefined>) | undefined;
     checkpointStore: import("../plugins/store-backend.js").CheckpointStoreFull | undefined;
+    consolidationSeatWatch: import("./memory-consolidation.js").ConsolidationSeatWatch | undefined;
     durableEnabled: boolean;
     elicitation: import("../elicitation.js").ElicitationCoordinator | undefined;
     fleetBus: import("../fleet/fleet-bus.js").FleetEventBus;
@@ -61,7 +61,6 @@ export declare function runStage08(ctx: Awaited<ReturnType<typeof runStage07>>):
     retentionLaneStore: import("../plugins/retention-lane-store-sql.js").RetentionLaneStore | undefined;
     runner: Runner;
     runnerDeps: import("@sema-agent/core").RunnerDeps;
-    runnerTierFrozen: boolean;
     runtimeCapsPeekResolver: import("../runtime-caps-resolver.js").EntitlementsResolverFn | undefined;
     sendFileLedger: import("../plugins/send-file-ledger.js").SendFileLedger | undefined;
     sendUserFileEmitter: import("../capabilities/send-user-file-tool.js").SendUserFileEmitter | undefined;
@@ -94,7 +93,7 @@ export declare function runStage08(ctx: Awaited<ReturnType<typeof runStage07>>):
     dropSessionScoped: (sid: string) => void;
     executionEnvFactory: import("@sema-agent/core").ExecutionEnvFactory | undefined;
     fenceSessionOwner: (sid: string, owner: string | null) => void;
-    lspManager: import("../lsp/manager.js").E2bLspManager | import("@sema-agent/core").NodeLspManager | undefined;
+    lspManager: import("@sema-agent/core").NodeLspManager | import("../lsp/manager.js").E2bLspManager | undefined;
     perSessionCwd: Map<string, string>;
     perTaskImage: import("../per-task-image.js").PerTaskImageRegistry;
     sendUserFileTaskEnvs: import("../capabilities/sandbox-file-send.js").TaskEnvRegistry | undefined;

package/dist/boot/stage-08-reapers.js

@@ -5,7 +5,7 @@ import { startRetentionLane, RETENTION_LEASE_TTL_FACTOR } from "./retention-lane
 import { createLimitSync } from "./limit-sync.js";
 import { runDenySweep } from "./late-binds.js";
 export function runStage08(ctx) {
-    const { approvalNonceStore, backend, backgroundAgentStore, ceilingVerdict, checkpointStore, config, configCenter, costQuota, fileHistoryErasure, handslessRunner, handslessSubRunner, hookAgentRunner, imageBakes, instanceId, localRoot, logger, mailboxStore, metrics, permissionRuleStores, pricing, rateLimiter, retentionExecutor, retentionLaneStore, rosterStore, runStore, runner, runnerTierFrozen, sqlWorkflowRunStore, subRunner, taskAttachmentStore, toolApproval, toolResultStore, workflowJournalStore, workflowNotifyGate, workflowNotifyJournal, workflowRecoverOpts, worktreeReap } = ctx;
+    const { approvalNonceStore, backend, backgroundAgentStore, ceilingVerdict, checkpointStore, config, configCenter, consolidationSeatWatch, costQuota, fileHistoryErasure, handslessRunner, handslessSubRunner, hookAgentRunner, imageBakes, instanceId, localRoot, logger, mailboxStore, metrics, permissionRuleStores, pricing, rateLimiter, retentionExecutor, retentionLaneStore, rosterStore, runStore, runner, sqlWorkflowRunStore, subRunner, taskAttachmentStore, toolApproval, toolResultStore, workflowJournalStore, workflowNotifyGate, workflowNotifyJournal, workflowRecoverOpts, worktreeReap } = ctx;
     const reaper = startReapers({
         config, logger, metrics, localRoot, backend, subRunner, runStore, checkpointStore,
         rateLimiter, costQuota, toolResultStore, fileHistoryErasure, taskAttachmentStore, imageBakes, worktreeReap,
@@ -71,7 +71,7 @@ export function runStage08(ctx) {
             }
         }
     };
-    configCenter.startRefreshLoop({ runnerTierFrozen, pricing, limitSync, swapRunnerDeps, ceilingVerdict });
+    configCenter.startRefreshLoop({ pricing, limitSync, swapRunnerDeps, ceilingVerdict, checkpointStorePresent: checkpointStore !== undefined, ...(consolidationSeatWatch !== undefined ? { consolidationSeat: consolidationSeatWatch } : {}) });
     configCenter.initKeyResolver();
     return { ...ctx, otelExporter, reaper, retentionLaneStarted };
 }

package/dist/boot/stage-09-leader.d.ts

@@ -64,7 +64,6 @@ export declare function runStage09(ctx: Awaited<ReturnType<typeof runStage08>>):
     scenarioDetails: Record<string, import("../capabilities/scenarios.js").ScenarioDetail>;
     scenarios: Record<string, import("../index.js").Scenario>;
     selectEnvTool: import("@sema-agent/core").ToolSpec<import("@sema-agent/core").TSchema> | undefined;
-    singleUserAutoAcceptBaseline: boolean;
     taskLimitCaps: {
         timeoutSec: number | undefined;
         maxOutputTokens: number | undefined;
@@ -75,6 +74,7 @@ export declare function runStage09(ctx: Awaited<ReturnType<typeof runStage08>>):
     approvalAskAudit: import("../approval-ask-audit-store.js").FileApprovalAskAuditStore | undefined;
     centerRuntimeCapsResolver: ((principal: string | undefined) => Promise<import("@sema-agent/core").RuntimeCaps | undefined>) | undefined;
     checkpointStore: import("../plugins/store-backend.js").CheckpointStoreFull | undefined;
+    consolidationSeatWatch: import("./memory-consolidation.js").ConsolidationSeatWatch | undefined;
     durableEnabled: boolean;
     elicitation: import("../elicitation.js").ElicitationCoordinator | undefined;
     fleetBus: import("../fleet/fleet-bus.js").FleetEventBus;
@@ -95,7 +95,6 @@ export declare function runStage09(ctx: Awaited<ReturnType<typeof runStage08>>):
     retentionLaneStore: import("../plugins/retention-lane-store-sql.js").RetentionLaneStore | undefined;
     runner: import("@sema-agent/core").Runner;
     runnerDeps: import("@sema-agent/core").RunnerDeps;
-    runnerTierFrozen: boolean;
     runtimeCapsPeekResolver: import("../runtime-caps-resolver.js").EntitlementsResolverFn | undefined;
     sendFileLedger: import("../plugins/send-file-ledger.js").SendFileLedger | undefined;
     sendUserFileEmitter: import("../capabilities/send-user-file-tool.js").SendUserFileEmitter | undefined;
@@ -128,7 +127,7 @@ export declare function runStage09(ctx: Awaited<ReturnType<typeof runStage08>>):
     dropSessionScoped: (sid: string) => void;
     executionEnvFactory: import("@sema-agent/core").ExecutionEnvFactory | undefined;
     fenceSessionOwner: (sid: string, owner: string | null) => void;
-    lspManager: import("../lsp/manager.js").E2bLspManager | import("@sema-agent/core").NodeLspManager | undefined;
+    lspManager: import("@sema-agent/core").NodeLspManager | import("../lsp/manager.js").E2bLspManager | undefined;
     perSessionCwd: Map<string, string>;
     perTaskImage: import("../per-task-image.js").PerTaskImageRegistry;
     sendUserFileTaskEnvs: import("../capabilities/sandbox-file-send.js").TaskEnvRegistry | undefined;

package/dist/boot/stage-10-http-server.d.ts

@@ -64,7 +64,6 @@ export declare function runStage10(ctx: Awaited<ReturnType<typeof runStage09>>):
     scenarioDetails: Record<string, import("../capabilities/scenarios.js").ScenarioDetail>;
     scenarios: Record<string, import("../index.js").Scenario>;
     selectEnvTool: import("@sema-agent/core").ToolSpec<import("@sema-agent/core").TSchema> | undefined;
-    singleUserAutoAcceptBaseline: boolean;
     taskLimitCaps: {
         timeoutSec: number | undefined;
         maxOutputTokens: number | undefined;
@@ -75,6 +74,7 @@ export declare function runStage10(ctx: Awaited<ReturnType<typeof runStage09>>):
     approvalAskAudit: import("../approval-ask-audit-store.js").FileApprovalAskAuditStore | undefined;
     centerRuntimeCapsResolver: ((principal: string | undefined) => Promise<import("@sema-agent/core").RuntimeCaps | undefined>) | undefined;
     checkpointStore: import("../plugins/store-backend.js").CheckpointStoreFull | undefined;
+    consolidationSeatWatch: import("./memory-consolidation.js").ConsolidationSeatWatch | undefined;
     durableEnabled: boolean;
     elicitation: import("../elicitation.js").ElicitationCoordinator | undefined;
     fleetBus: import("../fleet/fleet-bus.js").FleetEventBus;
@@ -95,7 +95,6 @@ export declare function runStage10(ctx: Awaited<ReturnType<typeof runStage09>>):
     retentionLaneStore: import("../plugins/retention-lane-store-sql.js").RetentionLaneStore | undefined;
     runner: import("@sema-agent/core").Runner;
     runnerDeps: import("@sema-agent/core").RunnerDeps;
-    runnerTierFrozen: boolean;
     runtimeCapsPeekResolver: import("../runtime-caps-resolver.js").EntitlementsResolverFn | undefined;
     sendFileLedger: import("../plugins/send-file-ledger.js").SendFileLedger | undefined;
     sendUserFileEmitter: import("../capabilities/send-user-file-tool.js").SendUserFileEmitter | undefined;
@@ -128,7 +127,7 @@ export declare function runStage10(ctx: Awaited<ReturnType<typeof runStage09>>):
     dropSessionScoped: (sid: string) => void;
     executionEnvFactory: import("@sema-agent/core").ExecutionEnvFactory | undefined;
     fenceSessionOwner: (sid: string, owner: string | null) => void;
-    lspManager: import("../lsp/manager.js").E2bLspManager | import("@sema-agent/core").NodeLspManager | undefined;
+    lspManager: import("@sema-agent/core").NodeLspManager | import("../lsp/manager.js").E2bLspManager | undefined;
     perSessionCwd: Map<string, string>;
     perTaskImage: import("../per-task-image.js").PerTaskImageRegistry;
     sendUserFileTaskEnvs: import("../capabilities/sandbox-file-send.js").TaskEnvRegistry | undefined;

package/dist/boot/stage-10-http-server.js

@@ -23,7 +23,7 @@ import { bindServerLateSeats } from "./late-binds.js";
 import { serviceVersion } from "../service-version.js";
 import { buildDisplaySafeUrl } from "../trace/redact.js";
 export async function runStage10(ctx) {
-    const { approvalAskAudit, approvalExemptionStore, approvalNonceStore, authorize, backend, backgroundAgentStore, brain, breakerState, centerRuntimeCapsResolver, checkpointStore, config, configCenter, costQuota, deploymentHooks, deviceLane, drainState, durableEnabled, elicitation, fenceSessionOwner, fileHistoryStore, fleetBus, fleetLease, fleetUsage, governanceSeams, handslessRunner, hookAgent, hookLlm, hookWakeBus, imageBakes, imageIndex, instanceId, instrumentDegenerate, leaderEndpoint, localRoot, logger, lspManager, mcpRevocations, memoryBundleFaces, memoryComplianceFaces, memoryConsolidationFaces, memoryEngine, memoryExportBackend, memoryOptOutGrantStore, memoryOriginFaces, memoryPosture, memorySyncCursors, metrics, modelUsageTracker, orgMemoryAdmission, otelExporter, outcomeSink, ownerAware, parkedReviveInheritedGate, parkedReviveTool, perSessionCwd, perTaskImage, planCacheProbe, pricing, principalCaps, promptManifestTracker, purgeSession, question, rateLimiter, reaper, registryJwtVerifier, resumeAnchorStore, retentionLaneStarted, retentionLaneStore, ruleConsent, runStore, runner, runnerDeps, runtimeCapsPeekResolver, scenarioDetails, scenarios, selectEnvTool, sendFileLedger, sendUserFileEmitter, sendUserFileToolSpec, sessionAudit, sessionEnvSelection, sessionMemoryStatusFace, sessionPolicyStore, sessionShellGateRegistry, sessionTitler, sessionWatchRegistry, setSessionCwd, setSessionShellEnv, sharedMemoryStore, sideQueryAccounting, singleUserAutoAcceptBaseline, sqlEngineFacts, sqlWorkflowRunStore, staticWiring, storeBackendDegraded, subRunner, subagentSteerRegistry, taskAttachmentStore, taskLimitCaps, taskTimeoutSec, toolApproval, toolResultStore, usageWindowStore, webSearchProvider, workflowAgentRegistry, workflowAgentSessionIndex, workflowCompletionInbox, workflowJournalStore, workflowModelAllowlistSnapshot, workflowNotifyGate, workflowNotifyJournal, workflowRecoverOpts, workflowRunStore, workflowsCapable } = ctx;
+    const { approvalAskAudit, approvalExemptionStore, approvalNonceStore, authorize, backend, backgroundAgentStore, brain, breakerState, centerRuntimeCapsResolver, checkpointStore, config, configCenter, costQuota, deploymentHooks, deviceLane, drainState, durableEnabled, elicitation, fenceSessionOwner, fileHistoryStore, fleetBus, fleetLease, fleetUsage, governanceSeams, handslessRunner, hookAgent, hookLlm, hookWakeBus, imageBakes, imageIndex, instanceId, instrumentDegenerate, leaderEndpoint, localRoot, logger, lspManager, mcpRevocations, memoryBundleFaces, memoryComplianceFaces, memoryConsolidationFaces, memoryEngine, memoryExportBackend, memoryOptOutGrantStore, memoryOriginFaces, memoryPosture, memorySyncCursors, metrics, modelUsageTracker, orgMemoryAdmission, otelExporter, outcomeSink, ownerAware, parkedReviveInheritedGate, parkedReviveTool, perSessionCwd, perTaskImage, planCacheProbe, pricing, principalCaps, promptManifestTracker, purgeSession, question, rateLimiter, reaper, registryJwtVerifier, resumeAnchorStore, retentionLaneStarted, retentionLaneStore, ruleConsent, runStore, runner, runnerDeps, runtimeCapsPeekResolver, scenarioDetails, scenarios, selectEnvTool, sendFileLedger, sendUserFileEmitter, sendUserFileToolSpec, sessionAudit, sessionEnvSelection, sessionMemoryStatusFace, sessionPolicyStore, sessionShellGateRegistry, sessionTitler, sessionWatchRegistry, setSessionCwd, setSessionShellEnv, sharedMemoryStore, sideQueryAccounting, sqlEngineFacts, sqlWorkflowRunStore, staticWiring, storeBackendDegraded, subRunner, subagentSteerRegistry, taskAttachmentStore, taskLimitCaps, taskTimeoutSec, toolApproval, toolResultStore, usageWindowStore, webSearchProvider, workflowAgentRegistry, workflowAgentSessionIndex, workflowCompletionInbox, workflowJournalStore, workflowModelAllowlistSnapshot, workflowNotifyGate, workflowNotifyJournal, workflowRecoverOpts, workflowRunStore, workflowsCapable } = ctx;
     const stores = {
         runStore,
         resumeAnchorStore: resumeAnchorStore ? resumeAnchorStore : undefined,
@@ -171,7 +171,7 @@ export async function runStage10(ctx) {
         hookLlm, hookAgent, fleetBus, hookWakeBus, resumeAnchorStore, ownerAware, taskLimitCaps, taskTimeoutSec,
         noteSessionShellGate: sessionShellGateRegistry.note,
         selectEnvTool, sendUserFileToolSpec, memoryEngine, durableEnabled, approvalExemptionStore,
-        singleUserAutoAcceptBaseline, checkpointStore, deploymentHooks, imageIndex, perTaskImage,
+        checkpointStore, deploymentHooks, imageIndex, perTaskImage,
         sessionEnvSelection,
         lockedKeys: governanceSeams.lockedKeys,
         liveQuestionFace: question,

package/dist/capabilities/center-plugins.d.ts

@@ -78,8 +78,20 @@ export interface ApplyPluginsResult {
     /** 本轮拉取失败、沿用上次成功物化的插件名。 */
     lkgUsed: string[];
 }
-/** 总入口(条款 3/7/8):逐条物化 + 装载 + 让位合并。materialize 盘位 = `<cacheRoot>/<name>/live`
- *  (成功后原子 rename 替换,失败保留旧盘位 = LKG)。 */
+/**
+ * 装载器**会物化**的插件(按声明序)—— 每条声明过**同一只**判定 {@link validatePluginDecl},只留 `ok` 的
+ * `{name, url, sha?}`。restart 指纹(`config-center/restart-signal.ts` 的 skills 片,S-668 波 0)读的就是它:
+ * 装载器不读的字段(notes / version)、整条跳过的声明(`enabled:false` / marketplace 源 / 白名单外 host / 坏形)
+ * 在这里一并消失,于是「重启之后什么都不会变」的发布不签重启(codex 对抗复审 r1 [medium]);顺序保留 ——
+ * 撞名让位按声明序,对调两条是真变化。`allowHosts` 与装载时同一份(部署事实 `PLUGINS_ALLOW_HOSTS`)。
+ */
+export declare function materializablePlugins(eff: {
+    plugins?: unknown;
+}, allowHosts: readonly string[]): Array<{
+    name: string;
+    url: string;
+    sha?: string;
+}>;
 export declare function applyCenterPlugins(baseline: LoadedSkill[], eff: {
     plugins?: unknown;
 }, opts: {

package/dist/capabilities/center-plugins.js

@@ -113,12 +113,20 @@ export function resolvePluginSkillsRoot(cloneRoot) {
     }
     return { ok: true, dir: candidate };
 }
+function declaredPlugins(eff) {
+    if (Array.isArray(eff.plugins))
+        return eff.plugins;
+    const wrapped = eff.plugins?.plugins;
+    return Array.isArray(wrapped) ? wrapped : [];
+}
+export function materializablePlugins(eff, allowHosts) {
+    return declaredPlugins(eff).flatMap((decl) => {
+        const v = validatePluginDecl(decl, allowHosts);
+        return v.ok ? [{ name: v.name, url: v.url, ...(v.sha !== undefined ? { sha: v.sha } : {}) }] : [];
+    });
+}
 export async function applyCenterPlugins(baseline, eff, opts) {
-    const declared = Array.isArray(eff.plugins)
-        ? (eff.plugins)
-        : Array.isArray(eff.plugins?.plugins)
-            ? (eff.plugins.plugins)
-            : [];
+    const declared = declaredPlugins(eff);
     const out = { skills: [...baseline], failures: [], letGo: [], lkgUsed: [] };
     if (declared.length === 0)
         return out;

package/dist/capabilities/center-prompts.d.ts

@@ -55,6 +55,9 @@ export declare function applyCatalogToSource(source: {
     /** codex-2 F2(restart-owed disable):撤下写盘失败后重启,内存 prev 丢了但持久态还 active——
      *  以 source 自身的 live candidate 为准判「欠 disable」,不是只看内存 prev。 */
     current?(): unknown;
+    /** S-651(codex 修复验证轮 V1):本箱**持久记录**是 active —— 即使那份 artifact 此刻加载不出(活候选为空)。
+     *  「欠撤下」的真源是持久记录;活候选只是它能加载时的影子。缺席 = 调用方不掌握持久记录(沿用前两条判据)。 */
+    persistedActive?(): boolean;
 }, next: PromptsDomainFaces | undefined, prev: PromptsDomainFaces | undefined, log: {
     info: (msg: string, meta?: Record<string, unknown>) => void;
     warn: (msg: string, meta?: Record<string, unknown>) => void;