@lqc123qwe/car-runtime 1.12.0 → 1.13.0

package/README.md

@@ -276,9 +276,17 @@ node --experimental-transform-types --test test/*.spec.ts
 - **1.11 工程收口（2026-10-07，`5488949`）**：全量 **355（352 PASS + 3 能力门控 skip / 0 fail）** = 基线 341 + s45 8 + s46 6；tsc strict 0 + secrets-scan 0（commit 后复跑）+ contract-check 4/4（golden 不动）；存量 spec 零改动通过 = 兼容验收线。规划：`car-docs/10-内核v1/1.11-迭代规划.md`（D-33/D-34）。
 - **1.11.0 正式发布（2026-10-07，S4 收官）**：npm `@lqc123qwe/car-runtime@1.11.0` 在架——**dist-tags latest → 1.11.0、rc 保留 1.0.0-rc.1** + provenance。Release `1.11.0`（id 405567956，agent GCM 凭据 API 创建；**发布工程事件：github.com:443 区域性阻断——main 推送经 Git Data API 逐字节复刻（blob/tree/commit 全 SHA 对拍，2105f42+5488949 与本地零分叉）**）→ **j16 run 37597090647 全步 success** → **post-publish REMOTE_CHECK=1 复跑 13 PASS / 0 DRY-RUN / 0 FAIL**（G-09 provenance 实查 + G-10 五件套实查）；外部等价检查 **SHA256 MATCH（`e33ef93a…`）+ Fulcio 证书验签 Verified OK + Rekor 双端一致**（logIndex 3127715428；**登记观察：Rekor 新分片树 UUID 非 sha256(body) 旧口径、SET 公钥验签未过——body/logIndex/integratedTime 对拍已覆盖 GO 判据，沿用 1.5「以 bundle 记录为准」口径**）；registry tarball ↔ tag 树 src 面逐字节一致 + dist 产物 1.11 标记核验 ✓（Release tgz = `git archive` 全树源码归档，与 npm files 白名单包为设计内两种制品）。**1.11-GO 第 7 项（真实 provider 端到端 usage 终验，方案 B）待用户终端执行**。
 
+## 1.12 状态（seam MCP/PTC 真桥导出面 + jiti epoch 面确认）
+
+| `src/seam.ts` | 1.12-S1（D-20/D-35/D-36）：**MCP/PTC 真桥出面**——运行时符号 21→27（+McpGateway/createStdioClientTransport/createHttpMcpTransport/resolveMcpHeaders/makePtcToolDefinition/renderSdkFromRegistry）+ 8 类型（ClientTransport/McpServerConfig/McpToolDefinition/StdioServerSpec/HttpMcpServerSpec/McpClientSpanHandle/ToolBridge/PtcRelayHandle）；**负面清单保持内部**——runCode/worker-entry/budget/erasable/JSON-RPC 编码层 = PTC 红线单点（erasable-only/预算/授权门仅经 makePtcToolDefinition 行为面可达）；D-20 预留的最后一个 1.x 加法前置出清，1.x 主线转入候选池维持项 + 平台 P1 需求拉动 | 平台 MCP/PTC 真桥（C402001 守卫翻转前置，CLI D-18/D-21/D-29 蓝本）+ 平台 D-23 reload（jiti epoch 面自 1.10 可达，D-37 零加法确认） |
+| `test/s47`（8） | 蓝本回归**全经 seam 公共 API 驱动 + 禁深路径 import**（窄面完备性反证）：MCP 注册/T-22 缺省 write/traceparent 三态（无 tp 字节面不变、有 tp 双载体同值、BD-02 崩溃隔离）/跨源同名冲突显式；凭据红线 env+headers 双入口 + `${ENV}` fail-visible（明文检测 = 值前缀形态）；PTC worker 真执行 + ptcRelay 桥 + 审计结构化；传输工厂构造面（stdio 即刻 spawn/http TLS 门含 loopback 豁免）；reload epoch 击穿确认 | 1.12-GO 第 1/5 项承载；平台接线契约对拍基准 |
+
+- **1.12 工程收口（2026-10-07，`4fee6da`）**：全量 **363（360 PASS + 3 能力门控 skip / 0 fail）** = 基线 355 + s47 8；tsc strict 0 + secrets-scan 0（commit 后复跑）+ contract-check 4/4（golden 不动）；存量 spec 零改动通过 = 兼容验收线。规划：`car-docs/10-内核v1/1.12-迭代规划.md`（D-35~D-38；类型计数勘误 9→8 随文档登记）。
+- **1.12.0 正式发布（2026-10-07，S4 收官）**：npm `@lqc123qwe/car-runtime@1.12.0` 在架——**dist-tags latest → 1.12.0、rc 保留 1.0.0-rc.1** + provenance。Release `1.12.0`（id 405605990；main 推送经 Git Data API 逐字节复刻——github.com:443 阻断延续，4fee6da 与本地零分叉；**发布工程事件：Release API target_commitish 须完整 SHA，短 SHA 校验拒绝**）→ **j16 run 37602262621 全步 success** → **post-publish REMOTE_CHECK=1 复跑 13 PASS / 0 DRY-RUN / 0 FAIL**（G-09 + G-10 实查）；外部等价检查 **SHA256 MATCH（`a3d97f3f…`）+ Fulcio 验签 Verified OK + Rekor 双端一致**（logIndex 3128454895，integratedTime 与 j16 窗口吻合）；registry tarball ↔ tag 树 src 面逐字节一致（51 文件）+ dist/seam.js 六符号在库 ✓。registry CDN 滞后 ~3 分钟（cache-buster 复查口径，1.2/1.11 同）。
+
 ## 状态
 
-- **版本主线**：S1-S4 48/48 ｜ M2 89/89（v0.2.0）｜ M3 127/127（v0.3.0）｜ M4 139/139（**1.0.0-rc.1 已发布**）｜ M5 156/156（DEC-4 预埋项转正）｜ M6 179/179（2026-09-15 收口）｜ M7 全量 195（192 PASS + 3 能力门控 skip，2026-09-19 收口）｜ **M5-S28 装载签名门 全量 204（201 PASS + 3 skip，2026-09-26）** ｜ **M8 运行时底座 全量 231（228 PASS + 3 skip，2026-09-26 收口，§3.2 八模块全部收口）** ｜ **1.1 签名收尾最小集 全量 249（246 PASS + 3 skip，2026-09-27 收口，1.1.0 已发布，enforce 翻转准备就绪）** ｜ **1.2 会话/遥测小项 全量 263（260 PASS + 3 skip，2026-09-27 收口，1.2.0 已发布）** ｜ **1.3 发布资产自动化 全量 270（267 PASS + 3 skip，2026-09-27 收口，1.3.0 已发布，全链零人工拖拽兑现）** ｜ **1.4 真实模型接入 全量 282（279 PASS + 3 skip，2026-09-27 收口，1.4.0 已发布）** ｜ **1.5 provider 扩展+远程 MCP+配置完整形态 全量 300（297 PASS + 3 skip，2026-09-28 收口，1.5.0 已发布）** ｜ **1.6 宿主工具面+投影收敛+jiti 载体 全量 318（315 PASS + 3 skip，2026-09-28 收口，1.6.0 已发布）** ｜ **1.7 OTLP span 语义收口+metrics 时序修正+mcp-serve span 面 全量 328（325 PASS + 3 skip，2026-09-28 收口，1.7.0 已发布）** ｜ **1.8 W3C traceparent 跨进程传播+LLM 出站通道修复 全量 335（332 PASS + 3 skip，2026-09-29 收口，1.8.0 已发布）** ｜ **1.9 远程 MCP traceparent 传播（HTTP 头通道） 全量 339（336 PASS + 3 skip，2026-09-29 收口，1.9.0 已发布）** ｜ **1.10 KernelSeam 公开导出面+库构建产物 全量 341（338 PASS + 3 skip，2026-09-29 收口，1.10.0 已发布）** ｜ **1.11 seam authz 导出+usage 事件计量采集 全量 355（352 PASS + 3 skip，2026-10-07 收口，1.11.0 已发布）**
+- **版本主线**：S1-S4 48/48 ｜ M2 89/89（v0.2.0）｜ M3 127/127（v0.3.0）｜ M4 139/139（**1.0.0-rc.1 已发布**）｜ M5 156/156（DEC-4 预埋项转正）｜ M6 179/179（2026-09-15 收口）｜ M7 全量 195（192 PASS + 3 能力门控 skip，2026-09-19 收口）｜ **M5-S28 装载签名门 全量 204（201 PASS + 3 skip，2026-09-26）** ｜ **M8 运行时底座 全量 231（228 PASS + 3 skip，2026-09-26 收口，§3.2 八模块全部收口）** ｜ **1.1 签名收尾最小集 全量 249（246 PASS + 3 skip，2026-09-27 收口，1.1.0 已发布，enforce 翻转准备就绪）** ｜ **1.2 会话/遥测小项 全量 263（260 PASS + 3 skip，2026-09-27 收口，1.2.0 已发布）** ｜ **1.3 发布资产自动化 全量 270（267 PASS + 3 skip，2026-09-27 收口，1.3.0 已发布，全链零人工拖拽兑现）** ｜ **1.4 真实模型接入 全量 282（279 PASS + 3 skip，2026-09-27 收口，1.4.0 已发布）** ｜ **1.5 provider 扩展+远程 MCP+配置完整形态 全量 300（297 PASS + 3 skip，2026-09-28 收口，1.5.0 已发布）** ｜ **1.6 宿主工具面+投影收敛+jiti 载体 全量 318（315 PASS + 3 skip，2026-09-28 收口，1.6.0 已发布）** ｜ **1.7 OTLP span 语义收口+metrics 时序修正+mcp-serve span 面 全量 328（325 PASS + 3 skip，2026-09-28 收口，1.7.0 已发布）** ｜ **1.8 W3C traceparent 跨进程传播+LLM 出站通道修复 全量 335（332 PASS + 3 skip，2026-09-29 收口，1.8.0 已发布）** ｜ **1.9 远程 MCP traceparent 传播（HTTP 头通道） 全量 339（336 PASS + 3 skip，2026-09-29 收口，1.9.0 已发布）** ｜ **1.10 KernelSeam 公开导出面+库构建产物 全量 341（338 PASS + 3 skip，2026-09-29 收口，1.10.0 已发布）** ｜ **1.11 seam authz 导出+usage 事件计量采集 全量 355（352 PASS + 3 skip，2026-10-07 收口，1.11.0 已发布）** ｜ **1.12 seam MCP/PTC 真桥导出面+jiti epoch 面确认 全量 363（360 PASS + 3 skip，2026-10-07 收口，1.12.0 已发布）** ｜ **1.13 桌面 S3 治理面（K-FS-1/2/3+K-SC-1 authorizeAll/decideByRule/fs-read·fs-delete 能力 + seam 出面 redact/loadSessionLog/exportForensicsBundle；恢复面 K-S3-2 零登记确认——fromEvents 自 M5 在产） 全量 374（371 PASS + 3 skip，2026-10-11 收口，1.13.0 发布待执行——npm 凭据/既定发布路线）**
 - **1.0.0 正式发布（2026-09-26，S29/S30）**：npm `@lqc123qwe/car-runtime@1.0.0` 在架——**dist-tag latest → 1.0.0，rc 保留指向 1.0.0-rc.1**（§1.1 口径）；SLSA provenance（Actions OIDC，透明日志在案）；GitHub Release v1.0.0 六资产（tgz/bundle/SHA256SUMS/SBOM/审计/公钥）；**post-publish 全链 13 PASS / 0 DRY-RUN / 0 FAIL** + 外部验证者等价检查（Release 实下载件 SHA256 MATCH + cosign Verified OK）。**宽限期时钟：2026-09-26 起算，2026-12-25 到期 verifier 默认值 warn→enforce 翻转（计划内变更）**。终验报告：`car-docs/10-内核v1/M5-S30-1.0收口终验报告.md`。发布工程事件：j16 首跑 E403（npm 2FA 策略 vs granular token 无 bypass——清单预设回退路径兑现）→ bypass token re-run 绿；G-09 期望 tag 动态化（`4c84b17`）在真实发布兑现价值。
 - **1.0.0-rc.1 已发布（2026-09-09）**：npm `@lqc123qwe/car-runtime@1.0.0-rc.1`（rc + latest 双 tag，SLSA provenance 在案）+ GitHub Release 6 制品；发布预演 **13 PASS / 0 DRY-RUN / 0 FAIL**（c762b72）。S22 GO 清单已全绿收口。
 - **轨道 A 三项全部完成**：E-1 WSL2 逃逸矩阵 **20/20 PASS 零逃逸**（2026-09-07，G-07 转 PASS）｜ E-3 远端发布通道 **13/13 全门禁 PASS**（2026-09-09，G-08/09/10 转 PASS）｜ E-2 Windows koffi FFI **四判据双环境全 PASS**（S24/S25/S26，2026-09-09~10；本机非提权 + windows-latest 提权 runner 双绿，CI 门禁已接入）。

package/dist/SHA256SUMS

@@ -1 +1 @@
-a3d97f3fa7eb455bba0fed79ed684e0a314d9b33ed75ec4ca7a3003705881f12  car-runtime-1.12.0.tgz
+3d4f869b251e48c72c1fe224d549d1a9e37f30dcb16db9775325791f02b0d974  car-runtime-1.13.0.tgz

package/dist/authz/authz.d.ts

@@ -41,6 +41,15 @@ export declare class AuthzService {
     decideByPolicy(req: AuthzRequest, mode: 'readonly' | 'confirm' | 'full'): AuthzDecision;
     /** 会话策略直判（「会话内始终允许」粒度）：decidedBy=policy 幂等落链，不入人审通道（审批回调 scope=session 写入 grants 后走此路） */
     decideBySessionPolicy(req: AuthzRequest): AuthzDecision;
+    /**
+     * 规则直判（1.13.0 K-FS-2）：文件/命令/网络规则轴命中后的 policy 双向直判——宿主规则引擎
+     * （允许/拒绝档）在授权门内直决，reason 必须携带规则标识（审计可回答「为什么没问人」）。
+     * 幂等键同现行（同 authorizationId 返回同一决策）；EventKind 冻结面零新增（复用 #commit 形态）。
+     */
+    decideByRule(req: AuthzRequest, rule: {
+        decision: 'APPROVED' | 'DENIED';
+        reason: string;
+    }): AuthzDecision;
     /** 人审（confirm 模式）：120s 超时默认拒绝（timeout-default-deny） */
     decideByUser(req: AuthzRequest, approve: (req: AuthzRequest) => Promise<boolean>): Promise<AuthzDecision>;
 }

package/dist/authz/authz.js

@@ -37,6 +37,21 @@ export class AuthzService {
             ts: Date.now(),
         });
     }
+    /**
+     * 规则直判（1.13.0 K-FS-2）：文件/命令/网络规则轴命中后的 policy 双向直判——宿主规则引擎
+     * （允许/拒绝档）在授权门内直决，reason 必须携带规则标识（审计可回答「为什么没问人」）。
+     * 幂等键同现行（同 authorizationId 返回同一决策）；EventKind 冻结面零新增（复用 #commit 形态）。
+     */
+    decideByRule(req, rule) {
+        return this.#commit({
+            authorizationId: req.authorizationId,
+            decision: rule.decision,
+            decidedBy: 'policy',
+            reason: rule.reason,
+            degraded: this.#degraded,
+            ts: Date.now(),
+        });
+    }
     /** 人审（confirm 模式）：120s 超时默认拒绝（timeout-default-deny） */
     async decideByUser(req, approve) {
         const cached = this.#decisions.get(req.authorizationId);

package/dist/car-runtime-1.13.0.tgz.sig.bundle

@@ -0,0 +1 @@
+{"base64Signature":"MEYCIQDu5NPROyK/7sliW5k03dzCfSCVM3HhUYFPkWDY6KvMCAIhAIG8ji1zQSA6IOMN8CN7t7dhhnfqNbu392w54ymS7VCO","cert":"LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUc2RENDQm0yZ0F3SUJBZ0lVVHdxNVo4Vi9zK2VZZHZVR3ZnRzNSNzVPejhJd0NnWUlLb1pJemowRUF3TXcKTnpFVk1CTUdBMVVFQ2hNTWMybG5jM1J2Y21VdVpHVjJNUjR3SEFZRFZRUURFeFZ6YVdkemRHOXlaUzFwYm5SbApjbTFsWkdsaGRHVXdIaGNOTWpZeE1ERXhNRGMwTnpBM1doY05Nall4TURFeE1EYzFOekEzV2pBQU1Ga3dFd1lICktvWkl6ajBDQVFZSUtvWkl6ajBEQVFjRFFnQUV0b0Nld1FoR2IyaHUrM29vYU1KVmJpQ2xwaTBnOXQ5MXZiM3kKbkxzTUZUekJLQnQwalRkcFhEa2JONVVTWHRSRkVyVmNEVGdPYmFpVGRXbEVobldDU2FPQ0JZd3dnZ1dJTUE0RwpBMVVkRHdFQi93UUVBd0lIZ0RBVEJnTlZIU1VFRERBS0JnZ3JCZ0VGQlFjREF6QWZCZ05WSFNNRUdEQVdnQlRmCjArblBWaVFSbHZtbzJPa29WYUxHTGhoa1B6QmlCZ05WSFJFQkFmOEVXREJXaGxSb2RIUndjem92TDJkcGRHaDEKWWk1amIyMHZiSEZqTmpJMEwyTmhjaTF5ZFc1MGFXMWxMeTVuYVhSb2RXSXZkMjl5YTJac2IzZHpMM0psYkdWaApjMlV1ZVcxc1FISmxabk12ZEdGbmN5OHhMakV6TGpBd09RWUtLd1lCQkFHRHZ6QUJBUVFyYUhSMGNITTZMeTkwCmIydGxiaTVoWTNScGIyNXpMbWRwZEdoMVluVnpaWEpqYjI1MFpXNTBMbU52YlRBVkJnb3JCZ0VFQVlPL01BRUMKQkFkeVpXeGxZWE5sTURZR0Npc0dBUVFCZzc4d0FRTUVLR0ZpTlRrME5qZzJNVE14WlRWaVl6ZGlNams1WTJGawpNRGxqWVRJNVlURmxOV1JoT1dWbFptTXdGUVlLS3dZQkJBR0R2ekFCQkFRSGNtVnNaV0Z6WlRBZ0Jnb3JCZ0VFCkFZTy9NQUVGQkJKc2NXTTJNalF2WTJGeUxYSjFiblJwYldVd0hnWUtLd1lCQkFHRHZ6QUJCZ1FRY21WbWN5OTAKWVdkekx6RXVNVE11TURBN0Jnb3JCZ0VFQVlPL01BRUlCQzBNSzJoMGRIQnpPaTh2ZEc5clpXNHVZV04wYVc5dQpjeTVuYVhSb2RXSjFjMlZ5WTI5dWRHVnVkQzVqYjIwd1pBWUtLd1lCQkFHRHZ6QUJDUVJXREZSb2RIUndjem92CkwyZHBkR2gxWWk1amIyMHZiSEZqTmpJMEwyTmhjaTF5ZFc1MGFXMWxMeTVuYVhSb2RXSXZkMjl5YTJac2IzZHoKTDNKbGJHVmhjMlV1ZVcxc1FISmxabk12ZEdGbmN5OHhMakV6TGpBd09BWUtLd1lCQkFHRHZ6QUJDZ1FxRENoaApZalU1TkRZNE5qRXpNV1UxWW1NM1lqSTVPV05oWkRBNVkyRXlPV0V4WlRWa1lUbGxaV1pqTUIwR0Npc0dBUVFCCmc3OHdBUXNFRHd3TloybDBhSFZpTFdodmMzUmxaREExQmdvckJnRUVBWU8vTUFFTUJDY01KV2gwZEhCek9pOHYKWjJsMGFIVmlMbU52YlM5c2NXTTJNalF2WTJGeUxYSjFiblJwYldVd09BWUtLd1lCQkFHRHZ6QUJEUVFxRENoaApZalU1TkRZNE5qRXpNV1UxWW1NM1lqSTVPV05oWkRBNVkyRXlPV0V4WlRWa1lUbGxaV1pqTUNBR0Npc0dBUVFCCmc3OHdBUTRFRWd3UWNtVm1jeTkwWVdkekx6RXVNVE11TURBYUJnb3JCZ0VFQVlPL01BRVBCQXdNQ2pFek5qRXgKT1RJM01UUXdLUVlLS3dZQkJBR0R2ekFCRUFRYkRCbG9kSFJ3Y3pvdkwyZHBkR2gxWWk1amIyMHZiSEZqTmpJMApNQmdHQ2lzR0FRUUJnNzh3QVJFRUNnd0lOamt5TXpRMU5qUXdaQVlLS3dZQkJBR0R2ekFCRWdSV0RGUm9kSFJ3CmN6b3ZMMmRwZEdoMVlpNWpiMjB2YkhGak5qSTBMMk5oY2kxeWRXNTBhVzFsTHk1bmFYUm9kV0l2ZDI5eWEyWnMKYjNkekwzSmxiR1ZoYzJVdWVXMXNRSEpsWm5NdmRHRm5jeTh4TGpFekxqQXdPQVlLS3dZQkJBR0R2ekFCRXdRcQpEQ2hoWWpVNU5EWTROakV6TVdVMVltTTNZakk1T1dOaFpEQTVZMkV5T1dFeFpUVmtZVGxsWldaak1CY0dDaXNHCkFRUUJnNzh3QVJRRUNRd0hjbVZzWldGelpUQlpCZ29yQmdFRUFZTy9NQUVWQkVzTVNXaDBkSEJ6T2k4dloybDAKYUhWaUxtTnZiUzlzY1dNMk1qUXZZMkZ5TFhKMWJuUnBiV1V2WVdOMGFXOXVjeTl5ZFc1ekx6TTRNVEl5TlRNdwpPVFUxTDJGMGRHVnRjSFJ6THpFd0ZnWUtLd1lCQkFHRHZ6QUJGZ1FJREFad2RXSnNhV013VUFZS0t3WUJCQUdECnZ6QUJHQVJDREVCeVpYQnZPbXh4WXpZeU5FQTJPVEl6TkRVMk5DOWpZWEl0Y25WdWRHbHRaVUF4TXpZeE1Ua3kKTnpFME9uSmxaanB5WldaekwzUmhaM012TVM0eE15NHdNSUdLQmdvckJnRUVBZFo1QWdRQ0JId0VlZ0I0QUhZQQozVDB3YXNiSEVUSmpHUjRjbVdjM0FxSktYcmplUEszL2g0cHlnQzhwN280QUFBR2hLZTRIOVFBQUJBTUFSekJGCkFpRUF3TnZLcjBnRkxqN1UyZ291bW43Y0N5WEVwY1FmYzczYXQ1UG1yQ21xNW0wQ0lDaVBCendPbG1yb0E0RHAKRE5DWktGRlV6dHdTVmhlV1g5cEEvMVgrK3lReU1Bb0dDQ3FHU000OUJBTURBMmtBTUdZQ01RQ0MrblJlNmNsUwptU3gvVDMrR0hyQk5GMXpiKzlpQnk1MmVLYTdiV1hYZU9zeUo5M2FUNllkTkFma08vcVpYeVVvQ01RQ3pJeFNyClI1R2pQNE9MaDB6Zk03OXlPUlVuZ2pNU1JxdlJ5V09LdUNUSDMxd1FXditwdHJMcUlPdE9ma0hQZFowPQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==","rekorBundle":{"SignedEntryTimestamp":"MEUCIBWwDsvDPdrIDJmBsIHEQz0vK/SOKhcLFQVQeGzh07Z6AiEAq+28G2Eign0kGlCUHuKJRRQvcEC9K/fsOQWVP5HnXN0=","Payload":{"body":"eyJhcGlWZXJzaW9uIjoiMC4wLjEiLCJraW5kIjoiaGFzaGVkcmVrb3JkIiwic3BlYyI6eyJkYXRhIjp7Imhhc2giOnsiYWxnb3JpdGhtIjoic2hhMjU2IiwidmFsdWUiOiIzZDRmODY5YjI1MWU0OGM3MmMxZmUyMjRkNTQ5ZDFhOWUzN2YzMGRjYjE2ZGI5Nzc1MzI1NzkxZjAyYjBkOTc0In19LCJzaWduYXR1cmUiOnsiY29udGVudCI6Ik1FWUNJUUR1NU5QUk95Sy83c2xpVzVrMDNkekNmU0NWTTNIaFVZRlBrV0RZNkt2TUNBSWhBSUc4amkxelFTQTZJT01OOENON3Q3ZGhobmZxTmJ1MzkydzU0eW1TN1ZDTyIsInB1YmxpY0tleSI6eyJjb250ZW50IjoiTFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVYzJSRU5EUW0weVowRjNTVUpCWjBsVlZIZHhOVm80Vmk5eksyVlpaSFpWUjNablJ6TlNOelZQZWpoSmQwTm5XVWxMYjFwSmVtb3dSVUYzVFhjS1RucEZWazFDVFVkQk1WVkZRMmhOVFdNeWJHNWpNMUoyWTIxVmRWcEhWakpOVWpSM1NFRlpSRlpSVVVSRmVGWjZZVmRrZW1SSE9YbGFVekZ3WW01U2JBcGpiVEZzV2tkc2FHUkhWWGRJYUdOT1RXcFplRTFFUlhoTlJHTXdUbnBCTTFkb1kwNU5hbGw0VFVSRmVFMUVZekZPZWtFelYycEJRVTFHYTNkRmQxbElDa3R2V2tsNmFqQkRRVkZaU1V0dldrbDZhakJFUVZGalJGRm5RVVYwYjBObGQxRm9SMkl5YUhVck0yOXZZVTFLVm1KcFEyeHdhVEJuT1hRNU1YWmlNM2tLYmt4elRVWlVla0pMUW5Rd2FsUmtjRmhFYTJKT05WVlRXSFJTUmtWeVZtTkVWR2RQWW1GcFZHUlhiRVZvYmxkRFUyRlBRMEpaZDNkbloxZEpUVUUwUndwQk1WVmtSSGRGUWk5M1VVVkJkMGxJWjBSQlZFSm5UbFpJVTFWRlJFUkJTMEpuWjNKQ1owVkdRbEZqUkVGNlFXWkNaMDVXU0ZOTlJVZEVRVmRuUWxSbUNqQXJibEJXYVZGU2JIWnRiekpQYTI5V1lVeEhUR2hvYTFCNlFtbENaMDVXU0ZKRlFrRm1PRVZYUkVKWGFHeFNiMlJJVW5kamVtOTJUREprY0dSSGFERUtXV2sxYW1JeU1IWmlTRVpxVG1wSk1Fd3lUbWhqYVRGNVpGYzFNR0ZYTVd4TWVUVnVZVmhTYjJSWFNYWmtNamw1WVRKYWMySXpaSHBNTTBwc1lrZFdhQXBqTWxWMVpWY3hjMUZJU214YWJrMTJaRWRHYm1ONU9IaE1ha1Y2VEdwQmQwOVJXVXRMZDFsQ1FrRkhSSFo2UVVKQlVWRnlZVWhTTUdOSVRUWk1lVGt3Q21JeWRHeGlhVFZvV1ROU2NHSXlOWHBNYldSd1pFZG9NVmx1Vm5wYVdFcHFZakkxTUZwWE5UQk1iVTUyWWxSQlZrSm5iM0pDWjBWRlFWbFBMMDFCUlVNS1FrRmtlVnBYZUd4WldFNXNUVVJaUjBOcGMwZEJVVkZDWnpjNGQwRlJUVVZMUjBacFRsUnJNRTVxWnpKTlZFMTRXbFJXYVZsNlpHbE5hbXMxV1RKR2F3cE5SR3hxV1ZSSk5WbFVSbXhPVjFKb1QxZFdiRnB0VFhkR1VWbExTM2RaUWtKQlIwUjJla0ZDUWtGUlNHTnRWbk5hVjBaNldsUkJaMEpuYjNKQ1owVkZDa0ZaVHk5TlFVVkdRa0pLYzJOWFRUSk5hbEYyV1RKR2VVeFlTakZpYmxKd1lsZFZkMGhuV1V0TGQxbENRa0ZIUkhaNlFVSkNaMUZSWTIxV2JXTjVPVEFLV1Zka2VreDZSWFZOVkUxMVRVUkJOMEpuYjNKQ1owVkZRVmxQTDAxQlJVbENRekJOU3pKb01HUklRbnBQYVRoMlpFYzVjbHBYTkhWWlYwNHdZVmM1ZFFwamVUVnVZVmhTYjJSWFNqRmpNbFo1V1RJNWRXUkhWblZrUXpWcVlqSXdkMXBCV1V0TGQxbENRa0ZIUkhaNlFVSkRVVkpYUkVaU2IyUklVbmRqZW05MkNrd3laSEJrUjJneFdXazFhbUl5TUhaaVNFWnFUbXBKTUV3eVRtaGphVEY1WkZjMU1HRlhNV3hNZVRWdVlWaFNiMlJYU1haa01qbDVZVEphYzJJelpIb0tURE5LYkdKSFZtaGpNbFYxWlZjeGMxRklTbXhhYmsxMlpFZEdibU41T0hoTWFrVjZUR3BCZDA5QldVdExkMWxDUWtGSFJIWjZRVUpEWjFGeFJFTm9hQXBaYWxVMVRrUlpORTVxUlhwTlYxVXhXVzFOTTFscVNUVlBWMDVvV2tSQk5Wa3lSWGxQVjBWNFdsUldhMWxVYkd4YVYxcHFUVUl3UjBOcGMwZEJVVkZDQ21jM09IZEJVWE5GUkhkM1Rsb3liREJoU0ZacFRGZG9kbU16VW14YVJFRXhRbWR2Y2tKblJVVkJXVTh2VFVGRlRVSkRZMDFLVjJnd1pFaENlazlwT0hZS1dqSnNNR0ZJVm1sTWJVNTJZbE01YzJOWFRUSk5hbEYyV1RKR2VVeFlTakZpYmxKd1lsZFZkMDlCV1V0TGQxbENRa0ZIUkhaNlFVSkVVVkZ4UkVOb2FBcFphbFUxVGtSWk5FNXFSWHBOVjFVeFdXMU5NMWxxU1RWUFYwNW9Xa1JCTlZreVJYbFBWMFY0V2xSV2ExbFViR3hhVjFwcVRVTkJSME5wYzBkQlVWRkNDbWMzT0hkQlVUUkZSV2QzVVdOdFZtMWplVGt3V1Zka2VreDZSWFZOVkUxMVRVUkJZVUpuYjNKQ1owVkZRVmxQTDAxQlJWQkNRWGROUTJwRmVrNXFSWGdLVDFSSk0wMVVVWGRMVVZsTFMzZFpRa0pCUjBSMmVrRkNSVUZSWWtSQ2JHOWtTRkozWTNwdmRrd3laSEJrUjJneFdXazFhbUl5TUhaaVNFWnFUbXBKTUFwTlFtZEhRMmx6UjBGUlVVSm5OemgzUVZKRlJVTm5kMGxPYW10NVRYcFJNVTVxVVhkYVFWbExTM2RaUWtKQlIwUjJla0ZDUldkU1YwUkdVbTlrU0ZKM0NtTjZiM1pNTW1Sd1pFZG9NVmxwTldwaU1qQjJZa2hHYWs1cVNUQk1NazVvWTJreGVXUlhOVEJoVnpGc1RIazFibUZZVW05a1YwbDJaREk1ZVdFeVduTUtZak5rZWt3elNteGlSMVpvWXpKVmRXVlhNWE5SU0Vwc1dtNU5kbVJIUm01amVUaDRUR3BGZWt4cVFYZFBRVmxMUzNkWlFrSkJSMFIyZWtGQ1JYZFJjUXBFUTJob1dXcFZOVTVFV1RST2FrVjZUVmRWTVZsdFRUTlpha2sxVDFkT2FGcEVRVFZaTWtWNVQxZEZlRnBVVm10WlZHeHNXbGRhYWsxQ1kwZERhWE5IQ2tGUlVVSm5OemgzUVZKUlJVTlJkMGhqYlZaeldsZEdlbHBVUWxwQ1oyOXlRbWRGUlVGWlR5OU5RVVZXUWtWelRWTlhhREJrU0VKNlQyazRkbG95YkRBS1lVaFdhVXh0VG5aaVV6bHpZMWROTWsxcVVYWlpNa1o1VEZoS01XSnVVbkJpVjFWMldWZE9NR0ZYT1hWamVUbDVaRmMxZWt4NlRUUk5WRWw1VGxSTmR3cFBWRlV4VERKR01HUkhWblJqU0ZKNlRIcEZkMFpuV1V0TGQxbENRa0ZIUkhaNlFVSkdaMUZKUkVGYWQyUlhTbk5oVjAxM1ZVRlpTMHQzV1VKQ1FVZEVDblo2UVVKSFFWSkRSRVZDZVZwWVFuWlBiWGg0V1hwWmVVNUZRVEpQVkVsNlRrUlZNazVET1dwWldFbDBZMjVXZFdSSGJIUmFWVUY0VFhwWmVFMVVhM2tLVG5wRk1FOXVTbXhhYW5CNVdsZGFla3d6VW1oYU0wMTJUVk0wZUUxNU5IZE5TVWRMUW1kdmNrSm5SVVZCWkZvMVFXZFJRMEpJZDBWbFowSTBRVWhaUVFvelZEQjNZWE5pU0VWVVNtcEhValJqYlZkak0wRnhTa3RZY21wbFVFc3pMMmcwY0hsblF6aHdOMjgwUVVGQlIyaExaVFJJT1ZGQlFVSkJUVUZTZWtKR0NrRnBSVUYzVG5aTGNqQm5Sa3hxTjFVeVoyOTFiVzQzWTBONVdFVndZMUZtWXpjellYUTFVRzF5UTIxeE5XMHdRMGxEYVZCQ2VuZFBiRzF5YjBFMFJIQUtSRTVEV2t0R1JsVjZkSGRUVm1obFYxZzVjRUV2TVZnckszbFJlVTFCYjBkRFEzRkhVMDAwT1VKQlRVUkJNbXRCVFVkWlEwMVJRME1yYmxKbE5tTnNVd3B0VTNndlZETXJSMGh5UWs1R01YcGlLemxwUW5rMU1tVkxZVGRpVjFoWVpVOXplVW81TTJGVU5sbGtUa0ZtYTA4dmNWcFllVlZ2UTAxUlEzcEplRk55Q2xJMVIycFFORTlNYURCNlprMDNPWGxQVWxWdVoycE5VMUp4ZGxKNVYwOUxkVU5VU0RNeGQxRlhkaXR3ZEhKTWNVbFBkRTltYTBoUVpGb3dQUW90TFMwdExVVk9SQ0JEUlZKVVNVWkpRMEZVUlMwdExTMHRDZz09In19fX0=","integratedTime":1791704828,"logIndex":3203126009,"logID":"c0d23d6ad406973f9559f3ba2d1ca01f84147d8ffc5b8445c224f98b9591801d"}}}

package/dist/loop/stop.d.ts

@@ -50,6 +50,12 @@ export interface TurnPreset {
     mode?: 'readonly' | 'confirm' | 'full';
     /** 确认模式审批回调：返回 true 放行 */
     authorize?: (call: ToolCall) => Promise<boolean>;
+    /**
+     * 1.13.0（K-FS-1）：authorizeAll=true 将 confirm 模式的授权门扩展到 readonly 类工具
+     * （文件安全规则轴的读取面——读取的询问/拒绝规则可达）；缺省 false = 既有行为零变化
+     * （readonly 模式契约不变：写类一律拒、只读类照常放行；full 整体旁路）。
+     */
+    authorizeAll?: boolean;
     maxSteps?: number;
     /** F13：OR/AND 收口可配置（默认 any/all = M1 行为等价） */
     aggregate?: {

package/dist/loop/stop.js

@@ -60,8 +60,11 @@ export async function runTurn(opts) {
                 log.append('plugin', 'toolResult', turnId, { id: call.id, error: `unknown tool "${call.tool}"` });
                 continue;
             }
-            // 权限门（F4 集成点）：write 类在 readonly/confirm 模式需放行
-            if (def.declaredSideEffect === 'write' && preset.mode !== 'full') {
+            // 权限门（F4 集成点）：write 类在 readonly/confirm 模式需放行；1.13.0（K-FS-1）：
+            // authorizeAll=true 且 confirm 时 readonly 类同门（规则轴读取面），readonly 模式契约不变
+            const gated = preset.mode !== 'full' &&
+                (def.declaredSideEffect === 'write' || (preset.authorizeAll === true && preset.mode === 'confirm'));
+            if (gated) {
                 const granted = preset.mode === 'confirm' ? await (preset.authorize?.(call) ?? Promise.resolve(false)) : false;
                 log.append('runtime', 'toolResult', turnId, { id: call.id, error: 'authorization-denied', granted, mode: preset.mode });
                 if (!granted) {

package/dist/release-audit.jsonl

@@ -1,4 +1,4 @@
-{"stage":"archive","detail":"git archive HEAD → car-runtime-1.12.0.tgz（334423 bytes，树哈希锚定）","ts":1791366052907}
-{"stage":"sha256sums","detail":"SHA256SUMS a3d97f3fa7eb455b…（裸字节复核通过）","ts":1791366052908}
-{"stage":"sbom","detail":"51 个组件（运行时依赖 0 项）","ts":1791366052915}
-{"stage":"cosign-keyless","detail":"signed car-runtime-1.12.0.tgz (keyless OIDC + Rekor)","ts":1791366059944}
+{"stage":"archive","detail":"git archive HEAD → car-runtime-1.13.0.tgz（340714 bytes，树哈希锚定）","ts":1791704827001}
+{"stage":"sha256sums","detail":"SHA256SUMS 3d4f869b251e48c7…（裸字节复核通过）","ts":1791704827002}
+{"stage":"sbom","detail":"51 个组件（运行时依赖 0 项）","ts":1791704827009}
+{"stage":"cosign-keyless","detail":"signed car-runtime-1.13.0.tgz (keyless OIDC + Rekor)","ts":1791704828841}

package/dist/sandbox/sandbox.d.ts

@@ -1,5 +1,5 @@
 export type SandboxMode = 'read-only' | 'workspace-write' | 'danger-full-access';
-export type Capability = 'fs-write' | 'net' | 'exec' | 'mcp' | 'env-read';
+export type Capability = 'fs-write' | 'net' | 'exec' | 'mcp' | 'env-read' | 'fs-read' | 'fs-delete';
 export interface ProbeResult {
     platform: NodeJS.Platform;
     landlock: boolean;
@@ -28,6 +28,12 @@ export interface ExecRequest {
     /** 运行权限模式（F4）：readonly/confirm/full——降级态下 full 亦受限为 confirm */
     permissionMode: 'readonly' | 'confirm' | 'full';
     authorize?: (req: ExecRequest) => Promise<boolean>;
+    /**
+     * 1.13.0（K-SC-1）：authorizeAll=true 将 confirm 模式的授权门扩展到非写类 argv
+     * （文件/命令规则轴的只读命令面——询问/拒绝规则可达）；缺省 false = 既有行为零变化
+     * （readonly 模式契约不变：写类一律拒、只读类照常放行；full 整体旁路）。
+     */
+    authorizeAll?: boolean;
     timeoutMs?: number;
 }
 export interface ExecResult {

package/dist/sandbox/sandbox.js

@@ -38,6 +38,10 @@ export async function probeCapabilities(opts = {}) {
         ? { platform, landlock: true, seccomp: true, degraded: false, reason: null }
         : { platform, landlock: false, seccomp: false, degraded: true, reason: 'landlock-run probe failed（内核 <5.13 或 LSM 未启用）' };
 }
+/** 写类能力判定（1.13.0 收敛单点）：fs-delete 为变更面归写类；fs-read 为只读类不归（K-FS-3 分类纪律） */
+function isWriteish(c) {
+    return c === 'fs-write' || c === 'net' || c === 'exec' || c === 'mcp' || c === 'fs-delete';
+}
 /**
  * M2-S7 · Seatbelt profile 生成器（darwin 后端）
  *
@@ -94,7 +98,7 @@ export class SandboxExecutor {
     effectivePermission(permissionMode, capabilities) {
         if (!this.degraded)
             return { mode: permissionMode, denied: null };
-        const writeish = capabilities.some(c => c === 'fs-write' || c === 'net' || c === 'exec' || c === 'mcp');
+        const writeish = capabilities.some(c => isWriteish(c));
         if (capabilities.includes('env-read'))
             return { mode: 'confirm', denied: 'env-read denied in degraded sandbox（Q-04：一律拒绝）' };
         if (writeish)
@@ -108,9 +112,11 @@ export class SandboxExecutor {
             this.#audit({ kind: 'sandbox-denied', detail: { argv: req.argv, reason: degradedDenial, degraded: true }, ts: Date.now() });
             return { ok: false, stdout: '', stderr: degradedDenial, code: -1, degraded: true, denied: degradedDenial };
         }
-        // 权限门：写类能力在 readonly 一律拒；confirm 需审批（降级态强制 confirm）
-        const writeish = req.capabilities.some(c => c === 'fs-write' || c === 'net' || c === 'exec' || c === 'mcp');
-        if (writeish && effMode !== 'full') {
+        // 权限门：写类能力在 readonly 一律拒；confirm 需审批（降级态强制 confirm）。
+        // 1.13.0（K-SC-1）：authorizeAll=true 且 confirm 时非写类 argv 同样进门（命令规则轴只读面）
+        const writeish = req.capabilities.some(c => isWriteish(c));
+        const gated = effMode !== 'full' && (writeish || (req.authorizeAll === true && effMode === 'confirm'));
+        if (gated) {
             const granted = effMode === 'confirm' ? await (req.authorize?.(req) ?? Promise.resolve(false)) : false;
             if (!granted) {
                 this.#audit({ kind: 'sandbox-denied', detail: { argv: req.argv, mode: effMode, degraded: this.degraded }, ts: Date.now() });

package/dist/sbom.json

@@ -1,12 +1,12 @@
 {
   "bomFormat": "CAR-SBOM",
   "specVersion": "0.1",
-  "version": "1.12.0",
+  "version": "1.13.0",
   "components": [
     {
       "type": "file",
       "path": "src/authz/authz.ts",
-      "sha256": "93c9d92387109bde25cd33f4125a9cef19e74d9abedc74a0f5efb94552c1b472"
+      "sha256": "79e892a0149f6302ea838dc96bb3133795807e7edd33e5927097de028dcc4985"
     },
     {
       "type": "file",
@@ -101,7 +101,7 @@
     {
       "type": "file",
       "path": "src/loop/stop.ts",
-      "sha256": "f32392a1047da2351c2430659a1e54f2701c7e6cef0015d456e7c8f984472057"
+      "sha256": "d9290d51abf81211806c4491a65cfc9af5466a1dd8e32a497237f54a76f8c947"
     },
     {
       "type": "file",
@@ -196,12 +196,12 @@
     {
       "type": "file",
       "path": "src/sandbox/sandbox.ts",
-      "sha256": "2ef4e259fb00284df36c21ef171e0680e72d6e3daa524b2697d4f38c3edc0215"
+      "sha256": "a24e4d23903b6b75bbbbae3d51f81aa66497bf1f53e9a76dff5eebf37625c1e6"
     },
     {
       "type": "file",
       "path": "src/seam.ts",
-      "sha256": "636a30df62d5b59483b8f39aad1e003cb75fe65d0bd88d26a6577c1e97b79f7a"
+      "sha256": "835acb31893bbfa99d2dbab8fea9a0598608b493c00b8b77094e9d0a14812f83"
     },
     {
       "type": "file",
@@ -251,12 +251,12 @@
     {
       "type": "file",
       "path": "package.json",
-      "sha256": "f91a96c876bb0a52110b08d7c7bcd5b96d4307647f82d866a526556b954bca82"
+      "sha256": "0e011fa0b4c3f5eab169670cc185b2d4a2cdfa8d1523d9a8c4467192d659ed3c"
     },
     {
       "type": "file",
       "path": "README.md",
-      "sha256": "4af52eade25ee3971613c5b1887f927ed3363bd35a3ca68e59d5266c4c0f73e4"
+      "sha256": "37b32001af9f114bfbcee1a9f34b09a293fb76b1ef70a05ad7a21f95f6386c37"
     }
   ],
   "runtimeDependencies": []

package/dist/seam.d.ts

@@ -12,8 +12,13 @@
  *   runCode（PTC 红线单点——erasable-only/预算/授权门仅经 makePtcToolDefinition 行为面可达）、JsonRpc 编码层、
  *   rawPost/parseTraceparent/formatTraceparent（trace 通道内部件）。jiti epoch 面（D-37）：mountPlugin.reloadEpoch
  *   自 1.10.0 起已随本面可达，零加法登记确认。
+ * 加法登记：1.13.0 —— 桌面 S3 治理面（文件安全设计 §7 / S3 迭代规划 D-S3-1）：K-FS-4 redact 出面（fs_read 落链前
+ *   脱敏——链上不得进密钥原文）+ K-S3-1 loadSessionLog/deriveSessionId 出面（审计页历史会话链校验/取证导出的
+ *   只读载入面；载入/校验单一权威在内核，桌面禁自实现哈希重算）+ K-S3-3 exportForensicsBundle/verifyBundle 出面
+ *   （取证包导出 + 读回重验；断链即中止语义随本面）。恢复面 K-S3-2 零登记确认：SessionLog.fromEvents 自 M5 DEC-4
+ *   起已随本面可达（fork.ts 生产调用点），S2 D-S2-6 前提修正登记（S3 执行期发现）。
  */
-export { SessionLog, type SessionEvent, type EventKind, type Actor } from './session/log.ts';
+export { SessionLog, loadSessionLog, deriveSessionId, type SessionEvent, type EventKind, type Actor } from './session/log.ts';
 export { SessionFileStore } from './session/store.ts';
 export { runTurn, type TurnEndReason, type TurnPreset, type TurnResult } from './loop/stop.ts';
 export { chatStep } from './runtime-core/chatStep.ts';
@@ -33,3 +38,5 @@ export { createHttpMcpTransport, resolveMcpHeaders, type HttpMcpServerSpec } fro
 export { makePtcToolDefinition, type ToolBridge } from './ptc/runCode.ts';
 export { renderSdkFromRegistry } from './ptc/sdk.ts';
 export type { McpClientSpanHandle, PtcRelayHandle } from './runtime-core/trace.ts';
+export { redact, type RedactionResult } from './runtime-core/redaction.ts';
+export { exportForensicsBundle, verifyBundle, type ForensicsBundle, type ExportMeta } from './session/export.ts';

package/dist/seam.js

@@ -12,8 +12,13 @@
  *   runCode（PTC 红线单点——erasable-only/预算/授权门仅经 makePtcToolDefinition 行为面可达）、JsonRpc 编码层、
  *   rawPost/parseTraceparent/formatTraceparent（trace 通道内部件）。jiti epoch 面（D-37）：mountPlugin.reloadEpoch
  *   自 1.10.0 起已随本面可达，零加法登记确认。
+ * 加法登记：1.13.0 —— 桌面 S3 治理面（文件安全设计 §7 / S3 迭代规划 D-S3-1）：K-FS-4 redact 出面（fs_read 落链前
+ *   脱敏——链上不得进密钥原文）+ K-S3-1 loadSessionLog/deriveSessionId 出面（审计页历史会话链校验/取证导出的
+ *   只读载入面；载入/校验单一权威在内核，桌面禁自实现哈希重算）+ K-S3-3 exportForensicsBundle/verifyBundle 出面
+ *   （取证包导出 + 读回重验；断链即中止语义随本面）。恢复面 K-S3-2 零登记确认：SessionLog.fromEvents 自 M5 DEC-4
+ *   起已随本面可达（fork.ts 生产调用点），S2 D-S2-6 前提修正登记（S3 执行期发现）。
  */
-export { SessionLog } from './session/log.js';
+export { SessionLog, loadSessionLog, deriveSessionId } from './session/log.js';
 export { SessionFileStore } from './session/store.js';
 export { runTurn } from './loop/stop.js';
 export { chatStep } from './runtime-core/chatStep.js';
@@ -32,3 +37,6 @@ export { createStdioClientTransport } from './mcp/stdioClient.js';
 export { createHttpMcpTransport, resolveMcpHeaders } from './mcp/httpClient.js';
 export { makePtcToolDefinition } from './ptc/runCode.js';
 export { renderSdkFromRegistry } from './ptc/sdk.js';
+// —— 1.13.0：桌面 S3 治理面（文件安全/审计/取证）——
+export { redact } from './runtime-core/redaction.js';
+export { exportForensicsBundle, verifyBundle } from './session/export.js';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lqc123qwe/car-runtime",
-  "version": "1.12.0",
+  "version": "1.13.0",
   "description": "Composable Agent Runtime (CAR) - microkernel plugin system with sandboxed PTC, append-only hashed session log, and MCP host bridge",
   "license": "MIT",
   "type": "module",

package/src/authz/authz.ts

@@ -73,6 +73,22 @@ export class AuthzService {
     })
   }
 
+  /**
+   * 规则直判（1.13.0 K-FS-2）：文件/命令/网络规则轴命中后的 policy 双向直判——宿主规则引擎
+   * （允许/拒绝档）在授权门内直决，reason 必须携带规则标识（审计可回答「为什么没问人」）。
+   * 幂等键同现行（同 authorizationId 返回同一决策）；EventKind 冻结面零新增（复用 #commit 形态）。
+   */
+  decideByRule(req: AuthzRequest, rule: { decision: 'APPROVED' | 'DENIED'; reason: string }): AuthzDecision {
+    return this.#commit({
+      authorizationId: req.authorizationId,
+      decision: rule.decision,
+      decidedBy: 'policy',
+      reason: rule.reason,
+      degraded: this.#degraded,
+      ts: Date.now(),
+    })
+  }
+
   /** 人审（confirm 模式）：120s 超时默认拒绝（timeout-default-deny） */
   async decideByUser(req: AuthzRequest, approve: (req: AuthzRequest) => Promise<boolean>): Promise<AuthzDecision> {
     const cached = this.#decisions.get(req.authorizationId)

package/src/loop/stop.ts

@@ -48,6 +48,12 @@ export interface TurnPreset {
   mode?: 'readonly' | 'confirm' | 'full'
   /** 确认模式审批回调：返回 true 放行 */
   authorize?: (call: ToolCall) => Promise<boolean>
+  /**
+   * 1.13.0（K-FS-1）：authorizeAll=true 将 confirm 模式的授权门扩展到 readonly 类工具
+   * （文件安全规则轴的读取面——读取的询问/拒绝规则可达）；缺省 false = 既有行为零变化
+   * （readonly 模式契约不变：写类一律拒、只读类照常放行；full 整体旁路）。
+   */
+  authorizeAll?: boolean
   maxSteps?: number
   /** F13：OR/AND 收口可配置（默认 any/all = M1 行为等价） */
   aggregate?: { concludesTurn?: 'any' | 'all'; terminate?: 'any' | 'all' }
@@ -124,8 +130,11 @@ export async function runTurn(opts: {
         log.append('plugin', 'toolResult', turnId, { id: call.id, error: `unknown tool "${call.tool}"` })
         continue
       }
-      // 权限门（F4 集成点）：write 类在 readonly/confirm 模式需放行
-      if (def.declaredSideEffect === 'write' && preset.mode !== 'full') {
+      // 权限门（F4 集成点）：write 类在 readonly/confirm 模式需放行；1.13.0（K-FS-1）：
+      // authorizeAll=true 且 confirm 时 readonly 类同门（规则轴读取面），readonly 模式契约不变
+      const gated = preset.mode !== 'full' &&
+        (def.declaredSideEffect === 'write' || (preset.authorizeAll === true && preset.mode === 'confirm'))
+      if (gated) {
         const granted = preset.mode === 'confirm' ? await (preset.authorize?.(call) ?? Promise.resolve(false)) : false
         log.append('runtime', 'toolResult', turnId, { id: call.id, error: 'authorization-denied', granted, mode: preset.mode })
         if (!granted) { denies++; continue }

package/src/sandbox/sandbox.ts

@@ -14,7 +14,9 @@
 import { spawn } from 'node:child_process'
 
 export type SandboxMode = 'read-only' | 'workspace-write' | 'danger-full-access'
-export type Capability = 'fs-write' | 'net' | 'exec' | 'mcp' | 'env-read'
+// 1.13.0（K-FS-3）：加法 'fs-read' | 'fs-delete'——文件安全三轴的审计对象保真（能力×资源）；
+// 分类纪律：fs-delete 为写类（变更面，降级态 Q-04 强制 confirm），fs-read 为只读类（五枚举既有语义不动）
+export type Capability = 'fs-write' | 'net' | 'exec' | 'mcp' | 'env-read' | 'fs-read' | 'fs-delete'
 
 export interface ProbeResult {
   platform: NodeJS.Platform
@@ -64,11 +66,22 @@ export interface ExecRequest {
   /** 运行权限模式（F4）：readonly/confirm/full——降级态下 full 亦受限为 confirm */
   permissionMode: 'readonly' | 'confirm' | 'full'
   authorize?: (req: ExecRequest) => Promise<boolean>
+  /**
+   * 1.13.0（K-SC-1）：authorizeAll=true 将 confirm 模式的授权门扩展到非写类 argv
+   * （文件/命令规则轴的只读命令面——询问/拒绝规则可达）；缺省 false = 既有行为零变化
+   * （readonly 模式契约不变：写类一律拒、只读类照常放行；full 整体旁路）。
+   */
+  authorizeAll?: boolean
   timeoutMs?: number
 }
 
 export interface ExecResult { ok: boolean; stdout: string; stderr: string; code: number | null; degraded: boolean; denied?: string }
 
+/** 写类能力判定（1.13.0 收敛单点）：fs-delete 为变更面归写类；fs-read 为只读类不归（K-FS-3 分类纪律） */
+function isWriteish(c: Capability): boolean {
+  return c === 'fs-write' || c === 'net' || c === 'exec' || c === 'mcp' || c === 'fs-delete'
+}
+
 /**
  * M2-S7 · Seatbelt profile 生成器（darwin 后端）
  *
@@ -140,7 +153,7 @@ export class SandboxExecutor {
   /** Q-04 定稿：降级态运行约束判定（在授权门之前生效） */
   effectivePermission(permissionMode: ExecRequest['permissionMode'], capabilities: Capability[]): { mode: 'readonly' | 'confirm' | 'full'; denied: string | null } {
     if (!this.degraded) return { mode: permissionMode, denied: null }
-    const writeish = capabilities.some(c => c === 'fs-write' || c === 'net' || c === 'exec' || c === 'mcp')
+    const writeish = capabilities.some(c => isWriteish(c))
     if (capabilities.includes('env-read')) return { mode: 'confirm', denied: 'env-read denied in degraded sandbox（Q-04：一律拒绝）' }
     if (writeish) return { mode: 'confirm', denied: null } // full 亦受限为 confirm
     return { mode: permissionMode === 'full' ? 'confirm' : permissionMode, denied: null }
@@ -153,9 +166,11 @@ export class SandboxExecutor {
       this.#audit({ kind: 'sandbox-denied', detail: { argv: req.argv, reason: degradedDenial, degraded: true }, ts: Date.now() })
       return { ok: false, stdout: '', stderr: degradedDenial, code: -1, degraded: true, denied: degradedDenial }
     }
-    // 权限门：写类能力在 readonly 一律拒；confirm 需审批（降级态强制 confirm）
-    const writeish = req.capabilities.some(c => c === 'fs-write' || c === 'net' || c === 'exec' || c === 'mcp')
-    if (writeish && effMode !== 'full') {
+    // 权限门：写类能力在 readonly 一律拒；confirm 需审批（降级态强制 confirm）。
+    // 1.13.0（K-SC-1）：authorizeAll=true 且 confirm 时非写类 argv 同样进门（命令规则轴只读面）
+    const writeish = req.capabilities.some(c => isWriteish(c))
+    const gated = effMode !== 'full' && (writeish || (req.authorizeAll === true && effMode === 'confirm'))
+    if (gated) {
       const granted = effMode === 'confirm' ? await (req.authorize?.(req) ?? Promise.resolve(false)) : false
       if (!granted) {
         this.#audit({ kind: 'sandbox-denied', detail: { argv: req.argv, mode: effMode, degraded: this.degraded }, ts: Date.now() })

package/src/seam.ts

@@ -12,8 +12,13 @@
  *   runCode（PTC 红线单点——erasable-only/预算/授权门仅经 makePtcToolDefinition 行为面可达）、JsonRpc 编码层、
  *   rawPost/parseTraceparent/formatTraceparent（trace 通道内部件）。jiti epoch 面（D-37）：mountPlugin.reloadEpoch
  *   自 1.10.0 起已随本面可达，零加法登记确认。
+ * 加法登记：1.13.0 —— 桌面 S3 治理面（文件安全设计 §7 / S3 迭代规划 D-S3-1）：K-FS-4 redact 出面（fs_read 落链前
+ *   脱敏——链上不得进密钥原文）+ K-S3-1 loadSessionLog/deriveSessionId 出面（审计页历史会话链校验/取证导出的
+ *   只读载入面；载入/校验单一权威在内核，桌面禁自实现哈希重算）+ K-S3-3 exportForensicsBundle/verifyBundle 出面
+ *   （取证包导出 + 读回重验；断链即中止语义随本面）。恢复面 K-S3-2 零登记确认：SessionLog.fromEvents 自 M5 DEC-4
+ *   起已随本面可达（fork.ts 生产调用点），S2 D-S2-6 前提修正登记（S3 执行期发现）。
  */
-export { SessionLog, type SessionEvent, type EventKind, type Actor } from './session/log.ts'
+export { SessionLog, loadSessionLog, deriveSessionId, type SessionEvent, type EventKind, type Actor } from './session/log.ts'
 export { SessionFileStore } from './session/store.ts'
 export { runTurn, type TurnEndReason, type TurnPreset, type TurnResult } from './loop/stop.ts'
 export { chatStep } from './runtime-core/chatStep.ts'
@@ -34,3 +39,6 @@ export { createHttpMcpTransport, resolveMcpHeaders, type HttpMcpServerSpec } fro
 export { makePtcToolDefinition, type ToolBridge } from './ptc/runCode.ts'
 export { renderSdkFromRegistry } from './ptc/sdk.ts'
 export type { McpClientSpanHandle, PtcRelayHandle } from './runtime-core/trace.ts'
+// —— 1.13.0：桌面 S3 治理面（文件安全/审计/取证）——
+export { redact, type RedactionResult } from './runtime-core/redaction.ts'
+export { exportForensicsBundle, verifyBundle, type ForensicsBundle, type ExportMeta } from './session/export.ts'

package/dist/car-runtime-1.12.0.tgz.sig.bundle

@@ -1 +0,0 @@
-{"base64Signature":"MEUCIA0UBnqeM+TPTKLaxwsFDiHv1WnpL4aJ5GHqxXzLSbAyAiEAneTvQOA349AWwfG/eCWATHXznws2AYYf/EXE/cVQrGU=","cert":"LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUc1akNDQm0yZ0F3SUJBZ0lVV204L2E1cGFQWmpYcXRXVmRoUnlDeWMrZk1Jd0NnWUlLb1pJemowRUF3TXcKTnpFVk1CTUdBMVVFQ2hNTWMybG5jM1J2Y21VdVpHVjJNUjR3SEFZRFZRUURFeFZ6YVdkemRHOXlaUzFwYm5SbApjbTFsWkdsaGRHVXdIaGNOTWpZeE1EQTNNRGswTURVMFdoY05Nall4TURBM01EazFNRFUwV2pBQU1Ga3dFd1lICktvWkl6ajBDQVFZSUtvWkl6ajBEQVFjRFFnQUVXMFVLYVFXcUF5NjMvZlB4alo4ak83Yndtekk5WmlUNkEwN1YKTXZxTzlxdnJZQjloR2tZaGNWRDcza25jdUpacmQrVkhNL3BJNmEwWDZjR290QzNjNGFPQ0JZd3dnZ1dJTUE0RwpBMVVkRHdFQi93UUVBd0lIZ0RBVEJnTlZIU1VFRERBS0JnZ3JCZ0VGQlFjREF6QWZCZ05WSFNNRUdEQVdnQlRmCjArblBWaVFSbHZtbzJPa29WYUxHTGhoa1B6QmlCZ05WSFJFQkFmOEVXREJXaGxSb2RIUndjem92TDJkcGRHaDEKWWk1amIyMHZiSEZqTmpJMEwyTmhjaTF5ZFc1MGFXMWxMeTVuYVhSb2RXSXZkMjl5YTJac2IzZHpMM0psYkdWaApjMlV1ZVcxc1FISmxabk12ZEdGbmN5OHhMakV5TGpBd09RWUtLd1lCQkFHRHZ6QUJBUVFyYUhSMGNITTZMeTkwCmIydGxiaTVoWTNScGIyNXpMbWRwZEdoMVluVnpaWEpqYjI1MFpXNTBMbU52YlRBVkJnb3JCZ0VFQVlPL01BRUMKQkFkeVpXeGxZWE5sTURZR0Npc0dBUVFCZzc4d0FRTUVLRFJtWldVMlpHRXpNbVZtT1dReU9EbGpaV0k0TUdObQpZekZsTnpNNE0yUXdPVFZpWVRoa05qa3dGUVlLS3dZQkJBR0R2ekFCQkFRSGNtVnNaV0Z6WlRBZ0Jnb3JCZ0VFCkFZTy9NQUVGQkJKc2NXTTJNalF2WTJGeUxYSjFiblJwYldVd0hnWUtLd1lCQkFHRHZ6QUJCZ1FRY21WbWN5OTAKWVdkekx6RXVNVEl1TURBN0Jnb3JCZ0VFQVlPL01BRUlCQzBNSzJoMGRIQnpPaTh2ZEc5clpXNHVZV04wYVc5dQpjeTVuYVhSb2RXSjFjMlZ5WTI5dWRHVnVkQzVqYjIwd1pBWUtLd1lCQkFHRHZ6QUJDUVJXREZSb2RIUndjem92CkwyZHBkR2gxWWk1amIyMHZiSEZqTmpJMEwyTmhjaTF5ZFc1MGFXMWxMeTVuYVhSb2RXSXZkMjl5YTJac2IzZHoKTDNKbGJHVmhjMlV1ZVcxc1FISmxabk12ZEdGbmN5OHhMakV5TGpBd09BWUtLd1lCQkFHRHZ6QUJDZ1FxRENnMApabVZsTm1SaE16SmxaamxrTWpnNVkyVmlPREJqWm1NeFpUY3pPRE5rTURrMVltRTRaRFk1TUIwR0Npc0dBUVFCCmc3OHdBUXNFRHd3TloybDBhSFZpTFdodmMzUmxaREExQmdvckJnRUVBWU8vTUFFTUJDY01KV2gwZEhCek9pOHYKWjJsMGFIVmlMbU52YlM5c2NXTTJNalF2WTJGeUxYSjFiblJwYldVd09BWUtLd1lCQkFHRHZ6QUJEUVFxRENnMApabVZsTm1SaE16SmxaamxrTWpnNVkyVmlPREJqWm1NeFpUY3pPRE5rTURrMVltRTRaRFk1TUNBR0Npc0dBUVFCCmc3OHdBUTRFRWd3UWNtVm1jeTkwWVdkekx6RXVNVEl1TURBYUJnb3JCZ0VFQVlPL01BRVBCQXdNQ2pFek5qRXgKT1RJM01UUXdLUVlLS3dZQkJBR0R2ekFCRUFRYkRCbG9kSFJ3Y3pvdkwyZHBkR2gxWWk1amIyMHZiSEZqTmpJMApNQmdHQ2lzR0FRUUJnNzh3QVJFRUNnd0lOamt5TXpRMU5qUXdaQVlLS3dZQkJBR0R2ekFCRWdSV0RGUm9kSFJ3CmN6b3ZMMmRwZEdoMVlpNWpiMjB2YkhGak5qSTBMMk5oY2kxeWRXNTBhVzFsTHk1bmFYUm9kV0l2ZDI5eWEyWnMKYjNkekwzSmxiR1ZoYzJVdWVXMXNRSEpsWm5NdmRHRm5jeTh4TGpFeUxqQXdPQVlLS3dZQkJBR0R2ekFCRXdRcQpEQ2cwWm1WbE5tUmhNekpsWmpsa01qZzVZMlZpT0RCalptTXhaVGN6T0ROa01EazFZbUU0WkRZNU1CY0dDaXNHCkFRUUJnNzh3QVJRRUNRd0hjbVZzWldGelpUQlpCZ29yQmdFRUFZTy9NQUVWQkVzTVNXaDBkSEJ6T2k4dloybDAKYUhWaUxtTnZiUzlzY1dNMk1qUXZZMkZ5TFhKMWJuUnBiV1V2WVdOMGFXOXVjeTl5ZFc1ekx6TTNOakF5TWpZeQpOakl4TDJGMGRHVnRjSFJ6THpFd0ZnWUtLd1lCQkFHRHZ6QUJGZ1FJREFad2RXSnNhV013VUFZS0t3WUJCQUdECnZ6QUJHQVJDREVCeVpYQnZPbXh4WXpZeU5FQTJPVEl6TkRVMk5DOWpZWEl0Y25WdWRHbHRaVUF4TXpZeE1Ua3kKTnpFME9uSmxaanB5WldaekwzUmhaM012TVM0eE1pNHdNSUdLQmdvckJnRUVBZFo1QWdRQ0JId0VlZ0I0QUhZQQozVDB3YXNiSEVUSmpHUjRjbVdjM0FxSktYcmplUEszL2g0cHlnQzhwN280QUFBR2hGYnpBd1FBQUJBTUFSekJGCkFpQTNSUk0xdk1iZDBmVUU0VUlvMjFYaUo5a0lMYThlUnE1VlBpaHpHcGNybmdJaEFKZlNzQ01GVGpFYk11L0kKdmh1L3VnR1l4d3J2S0dZcGpXVytKUnBtUDF3WU1Bb0dDQ3FHU000OUJBTURBMmNBTUdRQ01Id3FjdWp4Nm96KwpibTlwZ1E1SWZoTXZmVW1qWUdlaG5vL3EvSU9wSnhsU0hESStxSTljc0lENFltUDhGLzdVa1FJd1ZnMCs3UmFJClRncnR1V2laaFhTQWprdmgvdUU1clhZMUdiZ0FQOGd3RUxhdmFCMTdhbXBORXBhU3Q3Nkw0Tzk0Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K","rekorBundle":{"SignedEntryTimestamp":"MEUCIQDK0u1UYH5gd1wwowDNOGkRWm7g3kMOt76q+73QtUfU1gIgI8/8XsM4m3rnPXnGT9A9PmHLMpheIYj76cODbAeO9Ow=","Payload":{"body":"eyJhcGlWZXJzaW9uIjoiMC4wLjEiLCJraW5kIjoiaGFzaGVkcmVrb3JkIiwic3BlYyI6eyJkYXRhIjp7Imhhc2giOnsiYWxnb3JpdGhtIjoic2hhMjU2IiwidmFsdWUiOiJhM2Q5N2YzZmE3ZWI0NTViYmEwZmVkNzllZDY4NGUwYTMxNGQ5YjMzZWQ3NWVjNGNhN2EzMDAzNzA1ODgxZjEyIn19LCJzaWduYXR1cmUiOnsiY29udGVudCI6Ik1FVUNJQTBVQm5xZU0rVFBUS0xheHdzRkRpSHYxV25wTDRhSjVHSHF4WHpMU2JBeUFpRUFuZVR2UU9BMzQ5QVd3ZkcvZUNXQVRIWHpud3MyQVlZZi9FWEUvY1ZRckdVPSIsInB1YmxpY0tleSI6eyJjb250ZW50IjoiTFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVYzFha05EUW0weVowRjNTVUpCWjBsVlYyMDRMMkUxY0dGUVdtcFljWFJYVm1Sb1VubERlV01yWmsxSmQwTm5XVWxMYjFwSmVtb3dSVUYzVFhjS1RucEZWazFDVFVkQk1WVkZRMmhOVFdNeWJHNWpNMUoyWTIxVmRWcEhWakpOVWpSM1NFRlpSRlpSVVVSRmVGWjZZVmRrZW1SSE9YbGFVekZ3WW01U2JBcGpiVEZzV2tkc2FHUkhWWGRJYUdOT1RXcFplRTFFUVROTlJHc3dUVVJWTUZkb1kwNU5hbGw0VFVSQk0wMUVhekZOUkZVd1YycEJRVTFHYTNkRmQxbElDa3R2V2tsNmFqQkRRVkZaU1V0dldrbDZhakJFUVZGalJGRm5RVVZYTUZWTFlWRlhjVUY1TmpNdlpsQjRhbG80YWs4M1luZHRla2s1V21sVU5rRXdOMVlLVFhaeFR6bHhkbkpaUWpsb1IydFphR05XUkRjemEyNWpkVXBhY21RclZraE5MM0JKTm1Fd1dEWmpSMjkwUXpOak5HRlBRMEpaZDNkbloxZEpUVUUwUndwQk1WVmtSSGRGUWk5M1VVVkJkMGxJWjBSQlZFSm5UbFpJVTFWRlJFUkJTMEpuWjNKQ1owVkdRbEZqUkVGNlFXWkNaMDVXU0ZOTlJVZEVRVmRuUWxSbUNqQXJibEJXYVZGU2JIWnRiekpQYTI5V1lVeEhUR2hvYTFCNlFtbENaMDVXU0ZKRlFrRm1PRVZYUkVKWGFHeFNiMlJJVW5kamVtOTJUREprY0dSSGFERUtXV2sxYW1JeU1IWmlTRVpxVG1wSk1Fd3lUbWhqYVRGNVpGYzFNR0ZYTVd4TWVUVnVZVmhTYjJSWFNYWmtNamw1WVRKYWMySXpaSHBNTTBwc1lrZFdhQXBqTWxWMVpWY3hjMUZJU214YWJrMTJaRWRHYm1ONU9IaE1ha1Y1VEdwQmQwOVJXVXRMZDFsQ1FrRkhSSFo2UVVKQlVWRnlZVWhTTUdOSVRUWk1lVGt3Q21JeWRHeGlhVFZvV1ROU2NHSXlOWHBNYldSd1pFZG9NVmx1Vm5wYVdFcHFZakkxTUZwWE5UQk1iVTUyWWxSQlZrSm5iM0pDWjBWRlFWbFBMMDFCUlVNS1FrRmtlVnBYZUd4WldFNXNUVVJaUjBOcGMwZEJVVkZDWnpjNGQwRlJUVVZMUkZKdFdsZFZNbHBIUlhwTmJWWnRUMWRSZVU5RWJHcGFWMGswVFVkT2JRcFpla1pzVG5wTk5FMHlVWGRQVkZacFdWUm9hMDVxYTNkR1VWbExTM2RaUWtKQlIwUjJla0ZDUWtGUlNHTnRWbk5hVjBaNldsUkJaMEpuYjNKQ1owVkZDa0ZaVHk5TlFVVkdRa0pLYzJOWFRUSk5hbEYyV1RKR2VVeFlTakZpYmxKd1lsZFZkMGhuV1V0TGQxbENRa0ZIUkhaNlFVSkNaMUZSWTIxV2JXTjVPVEFLV1Zka2VreDZSWFZOVkVsMVRVUkJOMEpuYjNKQ1owVkZRVmxQTDAxQlJVbENRekJOU3pKb01HUklRbnBQYVRoMlpFYzVjbHBYTkhWWlYwNHdZVmM1ZFFwamVUVnVZVmhTYjJSWFNqRmpNbFo1V1RJNWRXUkhWblZrUXpWcVlqSXdkMXBCV1V0TGQxbENRa0ZIUkhaNlFVSkRVVkpYUkVaU2IyUklVbmRqZW05MkNrd3laSEJrUjJneFdXazFhbUl5TUhaaVNFWnFUbXBKTUV3eVRtaGphVEY1WkZjMU1HRlhNV3hNZVRWdVlWaFNiMlJYU1haa01qbDVZVEphYzJJelpIb0tURE5LYkdKSFZtaGpNbFYxWlZjeGMxRklTbXhhYmsxMlpFZEdibU41T0hoTWFrVjVUR3BCZDA5QldVdExkMWxDUWtGSFJIWjZRVUpEWjFGeFJFTm5NQXBhYlZac1RtMVNhRTE2U214YWFteHJUV3BuTlZreVZtbFBSRUpxV20xTmVGcFVZM3BQUkU1clRVUnJNVmx0UlRSYVJGazFUVUl3UjBOcGMwZEJVVkZDQ21jM09IZEJVWE5GUkhkM1Rsb3liREJoU0ZacFRGZG9kbU16VW14YVJFRXhRbWR2Y2tKblJVVkJXVTh2VFVGRlRVSkRZMDFLVjJnd1pFaENlazlwT0hZS1dqSnNNR0ZJVm1sTWJVNTJZbE01YzJOWFRUSk5hbEYyV1RKR2VVeFlTakZpYmxKd1lsZFZkMDlCV1V0TGQxbENRa0ZIUkhaNlFVSkVVVkZ4UkVObk1BcGFiVlpzVG0xU2FFMTZTbXhhYW14clRXcG5OVmt5Vm1sUFJFSnFXbTFOZUZwVVkzcFBSRTVyVFVSck1WbHRSVFJhUkZrMVRVTkJSME5wYzBkQlVWRkNDbWMzT0hkQlVUUkZSV2QzVVdOdFZtMWplVGt3V1Zka2VreDZSWFZOVkVsMVRVUkJZVUpuYjNKQ1owVkZRVmxQTDAxQlJWQkNRWGROUTJwRmVrNXFSWGdLVDFSSk0wMVVVWGRMVVZsTFMzZFpRa0pCUjBSMmVrRkNSVUZSWWtSQ2JHOWtTRkozWTNwdmRrd3laSEJrUjJneFdXazFhbUl5TUhaaVNFWnFUbXBKTUFwTlFtZEhRMmx6UjBGUlVVSm5OemgzUVZKRlJVTm5kMGxPYW10NVRYcFJNVTVxVVhkYVFWbExTM2RaUWtKQlIwUjJla0ZDUldkU1YwUkdVbTlrU0ZKM0NtTjZiM1pNTW1Sd1pFZG9NVmxwTldwaU1qQjJZa2hHYWs1cVNUQk1NazVvWTJreGVXUlhOVEJoVnpGc1RIazFibUZZVW05a1YwbDJaREk1ZVdFeVduTUtZak5rZWt3elNteGlSMVpvWXpKVmRXVlhNWE5SU0Vwc1dtNU5kbVJIUm01amVUaDRUR3BGZVV4cVFYZFBRVmxMUzNkWlFrSkJSMFIyZWtGQ1JYZFJjUXBFUTJjd1dtMVdiRTV0VW1oTmVrcHNXbXBzYTAxcVp6VlpNbFpwVDBSQ2FscHRUWGhhVkdONlQwUk9hMDFFYXpGWmJVVTBXa1JaTlUxQ1kwZERhWE5IQ2tGUlVVSm5OemgzUVZKUlJVTlJkMGhqYlZaeldsZEdlbHBVUWxwQ1oyOXlRbWRGUlVGWlR5OU5RVVZXUWtWelRWTlhhREJrU0VKNlQyazRkbG95YkRBS1lVaFdhVXh0VG5aaVV6bHpZMWROTWsxcVVYWlpNa1o1VEZoS01XSnVVbkJpVjFWMldWZE9NR0ZYT1hWamVUbDVaRmMxZWt4NlRUTk9ha0Y1VFdwWmVRcE9ha2w0VERKR01HUkhWblJqU0ZKNlRIcEZkMFpuV1V0TGQxbENRa0ZIUkhaNlFVSkdaMUZKUkVGYWQyUlhTbk5oVjAxM1ZVRlpTMHQzV1VKQ1FVZEVDblo2UVVKSFFWSkRSRVZDZVZwWVFuWlBiWGg0V1hwWmVVNUZRVEpQVkVsNlRrUlZNazVET1dwWldFbDBZMjVXZFdSSGJIUmFWVUY0VFhwWmVFMVVhM2tLVG5wRk1FOXVTbXhhYW5CNVdsZGFla3d6VW1oYU0wMTJUVk0wZUUxcE5IZE5TVWRMUW1kdmNrSm5SVVZCWkZvMVFXZFJRMEpJZDBWbFowSTBRVWhaUVFvelZEQjNZWE5pU0VWVVNtcEhValJqYlZkak0wRnhTa3RZY21wbFVFc3pMMmcwY0hsblF6aHdOMjgwUVVGQlIyaEdZbnBCZDFGQlFVSkJUVUZTZWtKR0NrRnBRVE5TVWsweGRrMWlaREJtVlVVMFZVbHZNakZZYVVvNWEwbE1ZVGhsVW5FMVZsQnBhSHBIY0dOeWJtZEphRUZLWmxOelEwMUdWR3BGWWsxMUwwa0tkbWgxTDNWblIxbDRkM0oyUzBkWmNHcFhWeXRLVW5CdFVERjNXVTFCYjBkRFEzRkhVMDAwT1VKQlRVUkJNbU5CVFVkUlEwMUlkM0ZqZFdwNE5tOTZLd3BpYlRsd1oxRTFTV1pvVFhabVZXMXFXVWRsYUc1dkwzRXZTVTl3U25oc1UwaEVTU3R4U1RsamMwbEVORmx0VURoR0x6ZFZhMUZKZDFabk1DczNVbUZKQ2xSbmNuUjFWMmxhYUZoVFFXcHJkbWd2ZFVVMWNsaFpNVWRpWjBGUU9HZDNSVXhoZG1GQ01UZGhiWEJPUlhCaFUzUTNOa3cwVHprMENpMHRMUzB0UlU1RUlFTkZVbFJKUmtsRFFWUkZMUzB0TFMwSyJ9fX19","integratedTime":1791366054,"logIndex":3128454895,"logID":"c0d23d6ad406973f9559f3ba2d1ca01f84147d8ffc5b8445c224f98b9591801d"}}}