@sema-agent/server 7.1.0 → 7.3.0

package/dist/boot/resolve-spec.js

@@ -42,19 +42,26 @@ import { applyRuntimeGovernance, stripDelegationTools } from "../runtime-governa
 import { HttpError, encodeCheckpointScope } from "../security.js";
 import { memorySpecForRequest } from "../memory-scope.js";
 import { mcpForScenario } from "../config-center/facade.js";
-import { normalizeAttachments, normalizeResilience, normalizeResumeAtMode, normalizeSuggestNextPrompts, promptProfileFromBody, resolveTaskLimits, retainBackgroundProcessesFromBody, taskAgentsSpecFragment, toolNameListFromBody } from "../spec-fields.js";
+import { normalizeAttachments, normalizeResilience, normalizeResumeAtMode, normalizeSuggestNextPrompts, promptProfileFromBody, resolveTaskLimits, retainBackgroundProcessesFromBody, taskAgentsSpecFragment, toolMaterializeStrategyFromBody, toolNameListFromBody } from "../spec-fields.js";
 import { cwdHonored, effectiveHostWorkspace, inProcessSingleUserLane, isValidCwd, parseAdditionalDirectories, satisfiedByProcessCwd, shellEnvMismatchCount } from "../task-cwd.js";
 import { resolveRequestMcp } from "../task-mcp.js";
 import { MAX_SETTINGS_OUTPUT_STYLE_CHARS, acceptAppendSystemPrompt, applyTaskSettings, coercePermissionMode, effectiveThinking, hasConstitutionAnchors, parseTaskSettings, providerDropsAppend, withPermissionMode } from "../task-settings.js";
 import { enableForkFromBody, normalizeRetainSubagentSessions, selfOrchestrationFromBody } from "../task-workflow.js";
 import { redactSecrets } from "../trace/redact.js";
+import { LexicalPathExecutionEnv } from "./lexical-path-env.js";
 /** #152([2703] 案二):durable 部署上的 AskUserQuestion 门。活体面(QuestionCoordinator)缺席 ⇒ 原形
  *  `createDurableQuestionPolicy()`(恒 ask ⇒ 恒 durable park)。在场 ⇒ **判决时**按活流上下文分腿:
- *  活流腿(bg/SSE,coordinator.runWithContext 包裹,ALS 判)allow——工具执行落到 RunnerDeps.onQuestion
- *  的 coordinator,问正在 tail 流的活人;无活流腿(sync /v1/tasks、verify/cascade)ask——durable park
- *  原语义逐字保留(此时执行只会拿到 headless 空答,park 才是把问题送到人面前的那条腿)。
- *  工具名字面量与 server.ts 的 pre-CAS 守卫同源("AskUserQuestion",core 未根导出常量)。 */
-function durableQuestionPolicy(live) {
+ *  活流腿(bg/SSE,coordinator.runWithContext 包裹且投递面此刻可达,ALS 判)allow——工具执行落到
+ *  RunnerDeps.onQuestion 的 coordinator,问正在 tail 流的活人;无活流腿(sync /v1/tasks、verify/cascade、
+ *  durable resume 驱动、断连后的 detach 腿)ask——durable park 原语义逐字保留(此时执行只会拿到 headless
+ *  空答,park 才是把问题送到人面前的那条腿)。
+ *  工具名字面量与 server.ts 的 pre-CAS 守卫同源("AskUserQuestion",core 未根导出常量)。
+ *  ⚠️ **单一属主**(复审 A2):AskUserQuestion 的 durable 判决只有这一处。任何需要「同参重建」这条判决的
+ *  地方(main.ts 的 parkedReviveInheritedGate 父约束链)必须调本工厂,不得自折 core 原形——两份拷贝里
+ *  只改一份正是本条 finding 的成因。**登记豁免一处**:leader worker 腿(src/leader/wire.ts provisionWorker)
+ *  自折 core 原形——该腿无活体问答面可装且 leader 不 import boot 层(分层),core 原形+sentinel 即其完整
+ *  语义;豁免注在彼处互指,接活体面之日必须并回本工厂。 */
+export function createDurableQuestionGate(live) {
     if (live === undefined)
         return createDurableQuestionPolicy();
     return {
@@ -102,7 +109,11 @@ export function createResolveSpec(ctx) {
         // allowedLanes ⇒ typed 403 `execution_lane_not_allowed`. Same caps car as the scenario ruling (zero extra
         // RTT); fail-open + audit on blip. "in-process" = fleet's REMOTE_EXEC-unset core stub lane
         // (named distinctly from the explicit `host` lane — same machine, different posture).
-        gateExecutionLane(await principalCaps?.executionRuling(auth?.principal), config.remoteExec?.provider ?? "in-process");
+        // #157 补痕交叉复审真发现(codex,2026-08-05):第三参不传就落 runtime-caps-resolver.ts 自己的私有
+        // `defaultLogger`(createLogger() 默认 minLevel="info")——与本部署真正按 config.logLevel 建的 `logger`
+        // 是两个独立实例,即便运维把 LOG_LEVEL 调到 debug 也打不到这条新增的一次性默认落痕行(补痕功能形同虚设)。
+        // 显式传本装配的真 logger,让该痕迹真的受部署日志级别管辖。
+        gateExecutionLane(await principalCaps?.executionRuling(auth?.principal), config.remoteExec?.provider ?? "in-process", logger);
         // Resolve an unknown name to "default" so the WHOLE bundle stays coherent — tools/prompt AND
         // skills/mcp fall back together. (selectScenario already falls back for tools/prompt; without
         // resolving here, skills/mcp would still be filtered by the raw unknown name → any skill/MCP tagged
@@ -553,6 +564,10 @@ export function createResolveSpec(ctx) {
             // [1144]/[1146] (core 1.328 R2): promptProfile 双形轴直通——纯呈现轴无租户门(deferTools 姿势);
             // 缺省不挂键(引擎缺省 simple);非法值由 HTTP 门 400,resume 重放 defensive DROP。
             ...(() => { const v = promptProfileFromBody(body.promptProfile); return v ? { promptProfile: v } : {}; })(),
+            // [2856]②(core 5.14.0):deferred 工具激活后的 schema 供给策略,per-task 位。core 侧读法是
+            // `spec.toolMaterializeStrategy ?? env ?? "static"` ⇒ **缺省不挂键**才能让进程级 env 继续说话;
+            // 挂一个「缺省值」上去会把 env 车道悄悄夺权。非法值由 HTTP 门 400,resume 重放 defensive DROP。
+            ...(() => { const v = toolMaterializeStrategyFromBody(body.toolMaterializeStrategy); return v ? { toolMaterializeStrategy: v } : {}; })(),
             // [922]①/[915]② (core 1.296): interactiveTools 三态旋钮直通——boolean 上 spec(壳 -p 恒 stamp false=
             // A3 类「headless 提问 park」根治腿;plan 显式 true 恒赢),undefined=core 自动判据(送达面探测)。
             // per-run 工具面选择无跨租户面 ⇒ 无租户门;非 boolean 由 HTTP 门 400,resume 重放 typeof 检查天然 DROP。
@@ -736,7 +751,7 @@ export function createResolveSpec(ctx) {
             // policy is LIVE-AWARE when the QuestionCoordinator is wired — a live-stream leg adjudicates `allow`
             // (the live human answers over the stream) instead of unconditionally parking; see durableQuestionPolicy.
             toolPolicy: durableEnabled
-                ? combinePolicies(durableQuestionPolicy(liveQuestionFace), createDurableAskPolicy({
+                ? combinePolicies(createDurableQuestionGate(liveQuestionFace), createDurableAskPolicy({
                     requireApproval: config.approvalRequire, deny: config.approvalDeny, autoBudget: config.approvalAutoBudget, neverAuto: config.approvalNeverAuto,
                     // The probe key is the CONTINUED session (auth.sessionId — the same id that keys the
                     // durable checkpoint /decide route). A fresh session (no body.sessionId) has no exemptions by
@@ -864,12 +879,24 @@ export function createResolveSpec(ctx) {
         const scratchpadDir = shellScratchpad ??
             (hostSemanticsLane && auth?.sessionId ? await ensureScratchpadDir(config.localDataRoot ?? localRoot, auth.sessionId) : undefined);
         if (effectiveSettings) {
-            // [816]/[820]① fs-write gate wiring — HOST-semantics lanes only: core's createFsWriteGatePolicy
-            // canonicalizes每一个 target/dir 走给定 env 的真实 fs(exists/canonicalPath/readLink,dist 亲读),所以
-            // env 必须就是 hand 工具真正写的那块盘。e2b/k8s/ssh/adb/local-docker 的沙箱 env 由 core 在 spec 之后
-            // 才铸(executionEnvFactory),这里给 worker 本机 env 会拿错误的 fs 裁决(symlink/exists 全答错)——
-            // 沙箱 lane 诚实不挂(gate=undefined ⇒ derive 回落 base 规则,pre-[816] 行为)。
-            // NodeExecutionEnv 构造是纯字段赋值(不 spawn)。
+            // [816]/[820]① fs-write gate wiring —— 两形,按 lane 分:
+            //
+            // ① HOST-semantics lane(REMOTE_EXEC 未设或 "host"):core 的 createFsWriteGatePolicy 把每一个
+            //    target/dir 交给给定 env 的**真实 fs**(exists/canonicalPath/readLink,dist 亲读),所以 env 必须
+            //    就是 hand 工具真正写的那块盘 —— 这里给 worker 本机的 NodeExecutionEnv(构造是纯字段赋值,不 spawn)。
+            //
+            // ② 沙箱 lane(e2b/k8s/ssh/adb/local-docker,#156):沙箱 env 由 core 在 spec **之后**才铸
+            //    (executionEnvFactory),spec 期把 worker 本机 env 递进去会拿**别人机器上的 fs 事实**裁决
+            //    (symlink/exists 全答错),而错误的 allow 比没有门更糟 —— 这就是 [816] 当年在这些 lane 上诚实
+            //    不挂门的理由(#153 的 ③ 号注把它记成余款)。过渡还款不是把本机 fs 递进去,而是换一个**没有 fs**
+            //    的裁决 env:LexicalPathExecutionEnv 只对 POSIX 绝对路径做词法归一,其余(相对路径/`~`/Windows 形)
+            //    一律「解析不出」⇒ core 落 ask。于是沙箱 lane 拿到「绝对路径按词法判、其余 fail-closed」的写门,
+            //    sensitivePatterns 的 deny 腿(按路径段词法匹配)与 isExempt 会话豁免探针(name-keyed,不做 fs
+            //    裁决)照常施加。**一个自动放行域都不铸**——两个候选域(cwd / scratchpad)各自的理由与代价写在
+            //    下面那条臂的注里,合起来的效果是 acceptEdits 在沙箱 lane 退化成与 default 同形(全 ask),与本段
+            //    ① 里 host factory lane 的哨兵先例同一个 fail-safe 方向。
+            //    已知残余面(symlink 形看不见)与终局 seam(core [2751] 给 HookToolContext 加只读 env 能力窄面,
+            //    排 174/#22 窗;到货后本过渡形整体退役换正解)成文在 lexical-path-env.ts 的文件头。
             //
             // 修5(三路复审 W4,cwd 基准漂移):gate 的 cwd 基准=与 hands 真跑处同源,分三形:
             //  · session 注册过 cwd(cwdHonored 已在注册处把关)⇒ 用它——与 host factory 的 effectiveHostWorkspace
@@ -881,6 +908,32 @@ export function createResolveSpec(ctx) {
             //    (hand 工具的书面契约形)与 scratchpad exempt 均不受影响。
             //  · provider 未设(in-process host / run-local)⇒ hands 就在本进程 cwd 跑(无 factory),process.cwd()
             //    正是真工作目录,保留。
+            // 两形**共有**的两件(都与 env/cwd 无关,故不随 lane 分叉——单一属主,两臂各抄一份正是漂移的成因):
+            const gateCommon = {
+                // ③ (core 1.295) sensitive-path write deny set:组合进 gate 腿的同一 combinePolicies 折叠
+                // (deny 恒赢 —— 豁免/acceptDirs 越不过;集合取舍 core 成文,server 只透传 config 旋钮:
+                // 缺省 = core RECOMMENDED_SENSITIVE_PATTERNS,SENSITIVE_WRITE_PATTERNS 显式替换/off 关闭)。
+                // 沙箱 lane 上它按**词法** key 的路径段匹配(#156)——glob 本就只看段名,不需要真 fs。
+                ...(config.sensitiveWritePatterns.length > 0 ? { sensitivePatterns: config.sensitiveWritePatterns } : {}),
+                // [1557]§四 的 shellGate 旧家已随 #153 搬到 applyRuntimeGovernance(governance 层无条件施加,
+                // 见上方 governedBase)——wiring 不再承运该旋钮,FsWriteGateWiring.shellGate 字段一并拆除。
+                // [841]① / core 1.294 exemption seam:gate 产 ask 前查同一只 approval_exemption 店(与 decide
+                // remember="session" 的授予、ask 政策层探针同店同 canonical toolName 键空间)——「本会话不再询问」
+                // 对 fs-write 门同 turn 即时生效(父+继承子任务,ask 路径不再重入)。has() reject ⇒ core 按
+                // 未豁免处理(fail-closed 照 ask),与店契约的调用方纪律一致;命中打 info 审计(对齐
+                // approval_exempted 的短路留痕,不记路径,路径留在 core 的 allow message 里)。探针是 name-keyed
+                // 的(不做任何 fs 裁决),所以沙箱 lane 照接不误。
+                ...(approvalExemptionStore && auth?.sessionId
+                    ? {
+                        isExempt: async (toolName) => {
+                            const hit = await approvalExemptionStore.has(auth.sessionId, toolName);
+                            if (hit)
+                                logger.info("fs_write_gate_exempted", { toolName, sessionId: auth.sessionId });
+                            return hit;
+                        },
+                    }
+                    : {}),
+            };
             const fsWriteGate = hostSemanticsLane
                 ? (() => {
                     const sessionCwd = auth?.sessionId ? effectiveHostWorkspace(perSessionCwd.get(auth.sessionId), {}) : undefined;
@@ -892,32 +945,37 @@ export function createResolveSpec(ctx) {
                         env: new NodeExecutionEnv({ cwd: gateCwd }),
                         cwd: gateCwd,
                         ...(scratchpadDir ? { scratchpadDir } : {}),
-                        // ③ (core 1.295) sensitive-path write deny set:组合进 gate 腿的同一 combinePolicies 折叠
-                        // (deny 恒赢 —— 豁免/acceptDirs 越不过;集合取舍 core 成文,server 只透传 config 旋钮:
-                        // 缺省 = core RECOMMENDED_SENSITIVE_PATTERNS,SENSITIVE_WRITE_PATTERNS 显式替换/off 关闭)。
-                        ...(config.sensitiveWritePatterns.length > 0 ? { sensitivePatterns: config.sensitiveWritePatterns } : {}),
-                        // [1557]§四 的 shellGate 旧家已随 #153 搬到 applyRuntimeGovernance(governance 层无条件施加,
-                        // 见上方 governedBase)——wiring 不再承运该旋钮,FsWriteGateWiring.shellGate 字段一并拆除。
-                        // [841]① / core 1.294 exemption seam:gate 产 ask 前查同一只 approval_exemption 店(与 decide
-                        // remember="session" 的授予、ask 政策层探针同店同 canonical toolName 键空间)——「本会话不再询问」
-                        // 对 fs-write 门同 turn 即时生效(父+继承子任务,ask 路径不再重入)。has() reject ⇒ core 按
-                        // 未豁免处理(fail-closed 照 ask),与店契约的调用方纪律一致;命中打 info 审计(对齐
-                        // approval_exempted 的短路留痕,不记路径,路径留在 core 的 allow message 里)。
-                        ...(approvalExemptionStore && auth?.sessionId
+                        ...gateCommon,
+                    };
+                })()
+                : // 沙箱 lane(#156):无 fs 的词法裁决 env,且**刻意不给** cwd 与 scratchpadDir —— 两者都是
+                    // 「自动放行域」,而在纯词法规则下一个放行域就是本设计唯一可能产生**错误 allow** 的地方
+                    // (词法看不见 symlink:域内一个指向域外的软链会被判成域内)。其余裁决只会是 ask 或 deny。
+                    //
+                    // ⚠️ 沙箱侧 scratchpad 的对应物**确实存在**(plugins/remote-scratchpad.ts:`/tmp/scratchpad/<sessionId>`,
+                    // e2b/k8s/local-docker/ssh 四 lane,由 factory 装饰器 lazy mkdir、并由下面的 envFacts 同源广告;
+                    // adb 无此约定)。这里**明知而不豁免**:host lane 的同一豁免是经真 fs canonicalize 过的(软链会被
+                    // 解到真身),词法版给不出同等保证,所以按 fail-closed 偏置落 ask。代价有界且可见——沙箱里写
+                    // scratchpad 会多一次询问,而不是任何功能坏掉;终局 seam(core [2751] 真 env 窄面)到货后应当把
+                    // 这条豁免按 host 同形补回。
+                    {
+                        env: new LexicalPathExecutionEnv(),
+                        ...gateCommon,
+                        // codex 复审 B(2026-08-05,dist 亲读+实测):core 的 canonicalizeTarget 把反斜杠 UNC 形在**入口**
+                        // 短路成 ok:true/key=原样——不经本 env,canon 便「成功」,gate 随后就咨询豁免探针;name-keyed
+                        // 命中即 allow,「非 POSIX 绝对形一律 ask」就被豁免会话越过(相对形/盘符形没这个洞:它们的
+                        // canon 失败先于豁免咨询)。沙箱臂因此给探针加 canonical-key 守门:只有 `/` 开头(=真经过
+                        // LexicalPathExecutionEnv 词法归一)的 key 才享豁免,其余落回 defaultWrite 的 ask。host 臂不加
+                        // (真 fs canonicalize 的 key 可信,[841]① 原契约不动)。
+                        ...(gateCommon.isExempt
                             ? {
-                                isExempt: async (toolName) => {
-                                    const hit = await approvalExemptionStore.has(auth.sessionId, toolName);
-                                    if (hit)
-                                        logger.info("fs_write_gate_exempted", { toolName, sessionId: auth.sessionId });
-                                    return hit;
-                                },
+                                isExempt: (toolName, canonicalPath) => canonicalPath.startsWith("/") ? gateCommon.isExempt(toolName) : false,
                             }
                             : {}),
                     };
-                })()
-                : undefined;
-            // [1248]②/codex F2 — the workflow ask leg's session-exemption probe, on EVERY lane (unlike fsWriteGate:
-            // the workflow gate is name-keyed, not fs-adjudicated). Same store + canonical toolName key space as the
+            // [1248]②/codex F2 — the workflow ask leg's session-exemption probe. Name-keyed and never fs-adjudicated,
+            // so it was on EVERY lane from day one (the fs gate has been too since #156, by a different route: a
+            // lexical env rather than no gate). Same store + canonical toolName key space as the
             // fs-gate probe — one remember="session" grant serves both; without it the durable lane re-parks every
             // later run_workflow call after an operator already granted "don't ask again this session".
             const workflowGate = approvalExemptionStore && auth?.sessionId
@@ -937,16 +995,16 @@ export function createResolveSpec(ctx) {
                 throw new HttpError(422, `settings are tighten-only and cannot loosen the deployment policy: ${e.message}`);
             }
         }
-        // subagent-hands follow-on (adversarial-review finding): core does NOT propagate
-        // handsReadOnly/shellGate to a delegated subagent (SubagentToolOptions has NO read-only knob; subagent.js's child
-        // runTask omits it). So a read-only (permissionMode=plan) parent that mounts the Task tool would let the CHILD get
-        // WRITABLE hands — now reachable because subRunner has an executionEnvFactory (the hands fix). That defeats plan
-        // mode's read-only contract (a within-tenant gap, not a cross-tenant breach). Until core propagates it (relayed),
-        // strip the delegation tools when this task is hands-read-only — a read-only run delegates nothing writable.
-        // `stripDelegationTools` (runtime-governance.ts, tested there) matches the subagent tool ("Agent", core 1.202
-        // canonical; legacy alias "Task") + Fork in CANONICAL space — the pre-1.202 raw `!== "Task"` filter here
-        // silently stopped matching when core renamed the tool (fail-open: a plan-mode parent could delegate a
-        // WRITABLE-hands child).
+        // subagent-hands follow-on (adversarial-review finding): a read-only (permissionMode=plan) parent that mounts
+        // the delegation tool used to let the CHILD get WRITABLE hands — reachable once subRunner grew an
+        // executionEnvFactory — which defeats plan mode's read-only contract. So a hands-read-only run mounts no
+        // delegation tool at all.
+        // 🔴 复审 2026-08-05 亲验安装包(core 5.13.x)后修口:当年那句「core 不把 handsReadOnly/shellGate 传给
+        // 子任务」**已过期** —— 子 spec 现在两者都继承(subagent.js / prepare-task.js 的 inheritedGateForChildren,
+        // 引文在 stripDelegationTools 的注释里)。本行因此是同向第二层(更严不更松),不是唯一防线;要拆得单独决定。
+        // `stripDelegationTools`(runtime-governance.ts,过滤器本体在那里被测钉住)按 core 单源常量
+        // `DEFAULT_SUBAGENT_TOOL_NAME`(="Agent")RAW 比对——5.0.0 RB-476 退役了折叠面,旧名 "Task"/"Fork" 在
+        // roster 层就 miss、不再需要归一(常量引用本身即防当年 1.202 改名时裸字符串失配的那类 fail-open)。
         if (governed.handsReadOnly === true && Array.isArray(governed.tools)) {
             governed = { ...governed, tools: stripDelegationTools(governed.tools) };
         }

package/dist/config-center/facade.d.ts

@@ -39,7 +39,7 @@
  * across a rename of this file's *contents*; a path rename (this move, 2026-07-29) does require the
  * importers to update, which was done in the same commit.
  */
-export { fetchEffective, fetchPrincipalCaps, ConfigCenterHttpError, fetchSkillContent, fetchPromptArtifact, fetchPromptBlob, } from "./http-client.js";
+export { fetchEffective, fetchPrincipalCaps, fetchPrincipalOrgMemory, ConfigCenterHttpError, fetchSkillContent, fetchPromptArtifact, fetchPromptBlob, } from "./http-client.js";
 export { mutateInPlace, applyEffective, applyRuntimeGates, applyRuntimeHot, resolveDefaultModelName, logEffectiveDiff, runtimeHasActiveGate, } from "./apply-effective.js";
 export { restartReasons, planeHasActiveTiers, modelPlaneChanged, type RestartSlice, type RestartSliceCtx, type RestartSignal, } from "./restart-signal.js";
 export { applyCenterSkills, resolveMcpServers, mcpForScenario } from "./skills-mcp.js";

package/dist/config-center/facade.js

@@ -39,7 +39,7 @@
  * across a rename of this file's *contents*; a path rename (this move, 2026-07-29) does require the
  * importers to update, which was done in the same commit.
  */
-export { fetchEffective, fetchPrincipalCaps, ConfigCenterHttpError, fetchSkillContent, fetchPromptArtifact, fetchPromptBlob, } from "./http-client.js";
+export { fetchEffective, fetchPrincipalCaps, fetchPrincipalOrgMemory, ConfigCenterHttpError, fetchSkillContent, fetchPromptArtifact, fetchPromptBlob, } from "./http-client.js";
 export { mutateInPlace, applyEffective, applyRuntimeGates, applyRuntimeHot, resolveDefaultModelName, logEffectiveDiff, runtimeHasActiveGate, } from "./apply-effective.js";
 export { restartReasons, planeHasActiveTiers, modelPlaneChanged, } from "./restart-signal.js";
 export { applyCenterSkills, resolveMcpServers, mcpForScenario } from "./skills-mcp.js";

package/dist/config-center/http-client.d.ts

@@ -41,6 +41,25 @@ export declare function fetchPrincipalCaps(baseUrl: string, token: string, princ
     orgMemory?: unknown;
     etag?: string;
 } | null>;
+/**
+ * design/170 件A —— 读 `?principal=` 响应里的 org 记忆解析段(org 目录腿的取数口)。
+ *
+ * 🔬 **为什么不复用 {@link fetchPrincipalCaps}**(复审车 D-2 修):C3「两张表失败域互不干扰」是在档
+ * 裁定,registry-core 的 `PrincipalCapsWire` 也正是为此把 org 段留成 `unknown`(「在本 schema 里校验
+ * 会把 org 段坏形连坐进 caps 腿」)。但隔离此前只做了**单向**:org 段坏不连坐 caps,caps 段坏却整体
+ * 连坐 org —— 治理面 `runtimeCaps`/`budget` 的一次值漂移会让整封 safeParse 失败、函数 throw,于是一个
+ * **形状完全正确**的 org 授权段读不出来,目录记 `fetch_failed`、准入铸瞬时拒。治理面的 fail-closed
+ * 极性是对的(它管的是「别静默放松治理」),但它不该决定 org 授权面的可用性。
+ *
+ * 所以这条腿用 {@link PrincipalOrgMemoryEnvelope} 只读它真正消费的两个字段:治理面漂移在这里是被
+ * `.passthrough()` 原样放过的未知键,不构成本腿的故障。段本身的形状校验仍在目录腿
+ * (`PrincipalOrgMemoryWire`),本腿保持薄透传不预判。
+ *
+ * 返回值三值语义:段键缺席 ⇒ `undefined`(旧 center 能力握手 ⇒ 目录判 `section_absent` 瞬时);
+ * 段在场 ⇒ 原值(空表 = 取数成功的负结果,与缺席不同格)。条件请求不适用(本腿恒不带 etag),
+ * 因此 304 在传输层就是 fail-loud。
+ */
+export declare function fetchPrincipalOrgMemory(baseUrl: string, token: string, principal: string, fetchImpl?: typeof fetch, worker?: string): Promise<unknown>;
 /** An HTTP error from a config-center fetch that carries the response status so callers can branch on it
  *  (e.g. translate a 404 to "unknown hash → undefined") WITHOUT parsing the message string. */
 export declare class ConfigCenterHttpError extends Error {

package/dist/config-center/http-client.js

@@ -1,7 +1,8 @@
 /**
  * config-center HTTP client — the transport calls the service makes against the config-center
- * (`fetchEffective`/`fetchPrincipalCaps`/`fetchSkillContent`/`fetchPromptArtifact`/`fetchPromptBlob`) plus
- * the shared HTTP-error type. Split out of `facade.ts` (design/158 A13, internal-lossless — the
+ * (`fetchEffective`/`fetchPrincipalCaps`/`fetchPrincipalOrgMemory`/`fetchSkillContent`/`fetchPromptArtifact`/
+ * `fetchPromptBlob`) plus the shared HTTP-error type. 后两条 `?principal=` 腿共用 `requestPrincipalView`
+ * 传输半场与 `assertPrincipalEcho` 回声核,只在**解析投影**上分家(见 `fetchPrincipalOrgMemory` 头注)。 Split out of `facade.ts` (design/158 A13, internal-lossless — the
  * facade re-exports every symbol below unchanged).
  */
 import { createHash } from "node:crypto";
@@ -72,44 +73,19 @@ export async function fetchEffective(baseUrl, token, etag, fetchImpl = fetch, wo
  * content-hashed (`p-<hash>`); an `if-none-match` poll is cheap. Mirrors `fetchEffective` (Bearer + 8s + scheme guard).
  */
 export async function fetchPrincipalCaps(baseUrl, token, principal, etag, fetchImpl = fetch, worker) {
-    const scheme = new URL(baseUrl).protocol;
-    if (scheme !== "http:" && scheme !== "https:")
-        throw new Error(`SEMA_REGISTRY_URL must be http(s), got "${scheme}"`);
-    // `?principal=<id>[&worker=<self>]` — worker authorizes the wpt_<self> caps-only path; harmless on a full token.
-    const params = new URLSearchParams({ principal });
-    if (worker)
-        params.set("worker", worker);
-    const url = `${baseUrl.replace(/\/+$/, "")}/api/config/effective?${params.toString()}`;
-    const res = await fetchImpl(url, {
-        headers: { authorization: `Bearer ${token}`, ...(etag ? { "if-none-match": etag } : {}) },
-        signal: AbortSignal.timeout(8000),
-    });
-    if (res.status === 304) {
-        // A 304 is only valid as a reply to OUR conditional. If we sent no etag and still got 304, center is
-        // misbehaving — DON'T treat it as "unchanged" (that surfaces undefined caps = no restriction = fail OPEN).
-        // Throw so the resolver fail-closes (review B). With an etag, 304 = genuine "unchanged" → null.
-        if (!etag)
-            throw new Error("config-center returned 304 to a non-conditional principal-caps request");
+    const raw = await requestPrincipalView(baseUrl, token, principal, etag, fetchImpl, worker);
+    if (raw === null)
         return null;
-    }
-    if (!res.ok)
-        throw new Error(`config-center principal-caps HTTP ${res.status}`);
     // 边界读=schema(clay 宪法 [2704] §2,同源锚=registry-core PrincipalCapsWire):治理面
     // runtimeCaps/budget 严格+passthrough(值漂移整体拒 ⇒ 本函数 throw ⇒ resolver fail-close,
     // 「outage 绝不静默 GRANT」同向);[565]/[580] fail-open 面与 orgMemory(C3 失败域隔离)在
     // schema 里保持宽读,归一/校验仍在下方与目录腿(极性不因 schema 化翻转)。
-    const parsedBody = PrincipalCapsWire.safeParse(await res.json());
+    const parsedBody = PrincipalCapsWire.safeParse(raw.json);
     if (!parsedBody.success) {
         throw new Error(`config-center principal-caps body failed schema validation: ${parsedBody.error.issues.map((i) => `${i.path.join(".")}: ${i.message}`).join("; ").slice(0, 600)}`);
     }
     const body = parsedBody.data;
-    // design/170 件A C8(响应 principal 回声核,串租户防线一行):center 两条 ?principal= 腿的 body 都
-    // 回带 principal——在场且与请求不符 = 中间层/LB 把别人的 caps 视图递了过来,弃用整响应(throw ⇒
-    // caps 腿 fail-close、org 目录腿记 unavailable)。键缺席 = 旧 center 形,按无证据容忍(回声核只拦
-    // 「有回声且对不上」的确定性错递,不把旧形升级成故障)。
-    if (body.principal !== undefined && body.principal !== principal) {
-        throw new Error(`config-center principal-caps response echoes principal ${JSON.stringify(body.principal)} but ${JSON.stringify(principal)} was requested — discarding the whole response (cross-tenant delivery defense)`);
-    }
+    assertPrincipalEcho(body.principal, principal);
     return {
         runtimeCaps: body.runtimeCaps ?? null,
         configured: Boolean(body.configured),
@@ -166,9 +142,82 @@ export async function fetchPrincipalCaps(baseUrl, token, principal, etag, fetchI
         // org 目录腿据此判 section_absent 瞬时;形状校验是 org-memory-admission 模块用 PrincipalOrgMemoryWire
         // 的事,本腿保持薄透传不预判)。
         ...("orgMemory" in body ? { orgMemory: body.orgMemory } : {}),
-        etag: res.headers.get("etag") ?? undefined,
+        etag: raw.etag, // 与提取共用件之前逐字等价:键恒在场,无 ETag 头时值为 undefined(消费端只读真值)
     };
 }
+/** design/170 件A C8(响应 principal 回声核):center 两条 `?principal=` 腿的 body 都回带 principal——
+ *  在场且与请求不符 = 中间层/LB 把别的 principal 的视图递了过来,弃用整响应(throw ⇒ caps 腿
+ *  fail-close、org 目录腿记 unavailable)。键缺席 = 旧 center 形,按无证据容忍(回声核只拦「有回声
+ *  且对不上」的确定性错递,不把旧形升级成故障)。两条腿共用同一道闸,不各写一遍。 */
+function assertPrincipalEcho(echoed, principal) {
+    if (echoed !== undefined && echoed !== principal) {
+        throw new Error(`config-center principal-caps response echoes principal ${JSON.stringify(echoed)} but ${JSON.stringify(principal)} was requested — discarding the whole response`);
+    }
+}
+/** 两条 `?principal=` 腿共用的**传输**半场:scheme 闸 / `?principal=[&worker=]` / Bearer / 8s 超时 /
+ *  304 语义。逐字来自原 {@link fetchPrincipalCaps} 函数体,提成共用件是为了第二条腿(org 段读取)
+ *  不必抄一遍传输纪律——抄一遍就等于给同一条边界立两套会各自漂移的规矩。
+ *  返回 `null` = 合法的 304(仅当我们真的发了条件请求);否则是**解析前**的 body 原值。 */
+async function requestPrincipalView(baseUrl, token, principal, etag, fetchImpl, worker) {
+    const scheme = new URL(baseUrl).protocol;
+    if (scheme !== "http:" && scheme !== "https:")
+        throw new Error(`SEMA_REGISTRY_URL must be http(s), got "${scheme}"`);
+    // `?principal=<id>[&worker=<self>]` — worker authorizes the wpt_<self> caps-only path; harmless on a full token.
+    const params = new URLSearchParams({ principal });
+    if (worker)
+        params.set("worker", worker);
+    const url = `${baseUrl.replace(/\/+$/, "")}/api/config/effective?${params.toString()}`;
+    const res = await fetchImpl(url, {
+        headers: { authorization: `Bearer ${token}`, ...(etag ? { "if-none-match": etag } : {}) },
+        signal: AbortSignal.timeout(8000),
+    });
+    if (res.status === 304) {
+        // A 304 is only valid as a reply to OUR conditional. If we sent no etag and still got 304, center is
+        // misbehaving — DON'T treat it as "unchanged" (that surfaces undefined caps = no restriction = fail OPEN).
+        // Throw so the resolver fail-closes (review B). With an etag, 304 = genuine "unchanged" → null.
+        if (!etag)
+            throw new Error("config-center returned 304 to a non-conditional principal-caps request");
+        return null;
+    }
+    if (!res.ok)
+        throw new Error(`config-center principal-caps HTTP ${res.status}`);
+    const responseEtag = res.headers.get("etag");
+    return { json: await res.json(), ...(responseEtag !== null ? { etag: responseEtag } : {}) };
+}
+/** 件A C3 失败域隔离的读取投影:org 目录腿只消费两个字段——`principal`(回声核)与 `orgMemory` 段
+ *  原值。用 `PrincipalCapsWire.pick()` 取子集(schema 属主仍是 registry-core,这里不复制形状定义,
+ *  `.passthrough()` 随 `_def` 一并继承)。 */
+const PrincipalOrgMemoryEnvelope = PrincipalCapsWire.pick({ principal: true, orgMemory: true });
+/**
+ * design/170 件A —— 读 `?principal=` 响应里的 org 记忆解析段(org 目录腿的取数口)。
+ *
+ * 🔬 **为什么不复用 {@link fetchPrincipalCaps}**(复审车 D-2 修):C3「两张表失败域互不干扰」是在档
+ * 裁定,registry-core 的 `PrincipalCapsWire` 也正是为此把 org 段留成 `unknown`(「在本 schema 里校验
+ * 会把 org 段坏形连坐进 caps 腿」)。但隔离此前只做了**单向**:org 段坏不连坐 caps,caps 段坏却整体
+ * 连坐 org —— 治理面 `runtimeCaps`/`budget` 的一次值漂移会让整封 safeParse 失败、函数 throw,于是一个
+ * **形状完全正确**的 org 授权段读不出来,目录记 `fetch_failed`、准入铸瞬时拒。治理面的 fail-closed
+ * 极性是对的(它管的是「别静默放松治理」),但它不该决定 org 授权面的可用性。
+ *
+ * 所以这条腿用 {@link PrincipalOrgMemoryEnvelope} 只读它真正消费的两个字段:治理面漂移在这里是被
+ * `.passthrough()` 原样放过的未知键,不构成本腿的故障。段本身的形状校验仍在目录腿
+ * (`PrincipalOrgMemoryWire`),本腿保持薄透传不预判。
+ *
+ * 返回值三值语义:段键缺席 ⇒ `undefined`(旧 center 能力握手 ⇒ 目录判 `section_absent` 瞬时);
+ * 段在场 ⇒ 原值(空表 = 取数成功的负结果,与缺席不同格)。条件请求不适用(本腿恒不带 etag),
+ * 因此 304 在传输层就是 fail-loud。
+ */
+export async function fetchPrincipalOrgMemory(baseUrl, token, principal, fetchImpl = fetch, worker) {
+    const raw = await requestPrincipalView(baseUrl, token, principal, undefined, fetchImpl, worker);
+    // etag 恒缺席 ⇒ 304 已在传输层 throw;这一支只为类型收口(不可达)。
+    if (raw === null)
+        throw new Error("config-center returned 304 to a non-conditional org-directory fetch");
+    const parsed = PrincipalOrgMemoryEnvelope.safeParse(raw.json);
+    if (!parsed.success) {
+        throw new Error(`config-center org-memory section failed schema validation: ${parsed.error.issues.map((i) => `${i.path.join(".")}: ${i.message}`).join("; ").slice(0, 600)}`);
+    }
+    assertPrincipalEcho(parsed.data.principal, principal);
+    return parsed.data.orgMemory;
+}
 /** An HTTP error from a config-center fetch that carries the response status so callers can branch on it
  *  (e.g. translate a 404 to "unknown hash → undefined") WITHOUT parsing the message string. */
 export class ConfigCenterHttpError extends Error {

package/dist/config-types.d.ts

@@ -21,6 +21,44 @@ export interface ScopedMcpServer {
  *  off (the control plane never mounts). The runner-facing facts (the runner principal, the build-host CACHE_BASE,
  *  the default base ref) live here so image-api injects only VETTED, server-fixed values into the build.sh argv —
  *  operator free-text never reaches the runner. */
+/** #151 车3(design/172 流内审批协议)的配置面。总开关默认 **false**;四个从属旋钮只在开关为真时生效
+ *  (语义与「谁需要 / 谁被伤 / 什么补偿」三问见 `ServiceConfigFlat.streamApproval` 的注)。 */
+export interface StreamApprovalConfig {
+    /** 协议总开关。`STREAM_APPROVAL_ENABLED`,默认 **false**。关 ⇒ 全链逐字现行为。
+     *  翻真要等回决端点(车4)与对账收敛器(车5)到位——在此之前是个不完整协议(有卡无正规回决口、
+     *  有 PARKING 无收敛器、跨副本回决无唤醒路径)。 */
+    enabled: boolean;
+    /** 开关为真时作为 `ToolApprovalCoordinator` 的 `ttlMs`(design/172 §3.3 的「配置窗默认」)。
+     *  `STREAM_ASK_WINDOW_MS`,默认 **60000**。`0` = 运维显式关窗 ⇒ 恒 park(§3.3 窗=0 语义)。
+     *  开关为假 ⇒ 本值不参与,窗保持既有 `DEFAULT_APPROVAL_TTL_MS`(5min)。 */
+    windowMs: number;
+    /** 开流重放(§5)每次最多投几张未决卡——**读面**的帽,超出只投最新的并记一次 warn,开流不失败。
+     *  `STREAM_APPROVAL_REPLAY_MAX`,默认 **50**。 */
+    replayMax: number;
+    /** 写侧准入门(§0 X-2)的 per-task 未决 ask 上限。超限 ⇒ 在落 pending/建 timer/发帧**之前**返回
+     *  `"unavailable"`(park 路由,**永不 deny**——过载 bypass 到 park 是 §3.3 的硬条款)。
+     *  `STREAM_APPROVAL_ADMIT_MAX_PER_TASK`,默认 **32**。消费点在刀 3b。 */
+    admitMaxPerTask: number;
+    /** 同上,per-owner(租户)维。`STREAM_APPROVAL_ADMIT_MAX_PER_OWNER`,默认 **256**。 */
+    admitMaxPerOwner: number;
+    /** #151 车5 §5 治理旋钮(全部 `numEnvBounded` 有界解析,§9 C6)—— 对账收敛器每 tick **每段**
+     *  (PARKING / 孤儿 STREAM_PENDING)最多处理的行数。超出的下轮接着扫(靠 `deferReconcile` 的队列
+     *  轮转保证「接着」是真的,不是永远同一批)。`STREAM_APPROVAL_RECONCILE_BATCH`,默认 **200**,
+     *  有界 [1, 10000]。 */
+    reconcileBatch: number;
+    /** 崩溃恢复扫描的**宽限**(§8 D-1.1):只有 `expiresAtMs + 本值 < now` 的孤儿 `STREAM_PENDING` 行才
+     *  被 reaper 代打 `expireAsk`。活属主进程里的窗到期竞争者在这个宽限内常态必胜 ⇒ reaper 退回纯崩溃
+     *  兜底,不与在场闭包抢(抢 = 制造挂死面)。`STREAM_APPROVAL_PENDING_GRACE_MS`,默认 **30000**,
+     *  有界 [0, 3600000]。 */
+    pendingGraceMs: number;
+    /** 判据 4(adhoc 腿)的窗后宽限。`STREAM_APPROVAL_ADHOC_GRACE_MS`,默认 **60000**,有界 [0, 86400000]。
+     *  🔴 跨旋钮不变量:必须 **< `orphanTtlMs`**(否则判据 5 的兜底会先于判据 4 触发,adhoc 腿拿到的
+     *  归因就成了 `orphan_ttl_exceeded`,归因诚实性失效)——boot 期校验,破坏形**拒启**。 */
+    adhocGraceMs: number;
+    /** 判据 5(遗孤最终可判)的上界,量 immutable 的 `createdAtMs`。`STREAM_APPROVAL_ORPHAN_TTL_MS`,
+     *  默认 **7d**,有界 [60000, 90d]。 */
+    orphanTtlMs: number;
+}
 export interface ImageBakeConfig {
     enabled: boolean;
     /** The dedicated operator principal the bake-runner authenticates as on the internal claim/ingest routes
@@ -717,14 +755,23 @@ export interface ServiceConfigFlat {
      *  recommended set (not a merge); `off` or an empty value = disabled (empty array); unset = core's recommended
      *  set. Deny composes deny-wins, so a session exemption / acceptEdits auto-allow never crosses it. */
     sensitiveWritePatterns: string[];
-    /** [1557]§四 opt-in (cli[1555]② finding, core[1556] suggested mechanism): CC manual-family permission modes
-     *  (default/auto/acceptEdits) gate every fs WRITE hand tool (Write/Edit/NotebookEdit) but never touched Bash —
-     *  a model can `echo -n '…' > file` straight past the write-approval card. `MANUAL_MODE_SHELL_GATE` opts a
-     *  deployment into ALSO tightening `TaskSpec.shellGate` on those same modes (core `bashReversibilityProbe`
-     *  under `"classify"` only asks on constructively-irreversible commands — shell redirects etc.).
+    /** [1557]§四 opt-in (cli[1555]② finding, core[1556] suggested mechanism): the CC manual-family permission
+     *  modes (default/auto/acceptEdits) gate every fs WRITE hand tool (Write/Edit/NotebookEdit) but never touched
+     *  Bash — a model can `echo -n '…' > file` straight past the write-approval card. `MANUAL_MODE_SHELL_GATE`
+     *  opts a deployment into ALSO tightening `TaskSpec.shellGate` (core `bashReversibilityProbe` under
+     *  `"classify"` asks on constructively-irreversible commands — shell redirects etc. — **plus** the boundary
+     *  case in the 🔴 note below; it is not a "constructive-irreversibility only" filter).
+     *  🔴 **施加点 = governance 层,无条件(#153 / [2713] 分单②;搬家前的旧描述已作废)**:与 `AUTONOMY`
+     *  同拍在 `applyRuntimeGovernance`(runtime-governance.ts)里施加,**不看客户端 settings/permissionMode
+     *  的在场性、不看落在哪个模式臂、不看执行 lane**。旧家挂在 task-settings 的 default/auto/acceptEdits 三臂
+     *  + host-lane fs-write wiring 上,等于让一个部署级旋钮的生死由客户端表态决定(print/headless 腿不 stamp
+     *  settings ⇒ 整块跳过;bypassPermissions 臂不回 shellGate;非 host lane wiring 不建 ⇒ 沙箱 lane 全失效)。
+     *  rank 合成:与 autonomy 派生值取大(`ask`→`"always"` 压过 `"classify"`),对 base 只升不降。
+     *  客户端 settings 折叠在其后、tighten-only,拿不掉这个值;SUP 路由姿态只会把它抬到 `"always"`。
      *  🔴 **语义随 core 版本演进(2026-07-31 核)**:`"classify"` 下「纯读自动放行」这句自 core 2.7.0 起
      *  **不再无条件成立** —— RB-412 给 classifier 加了 root 边界扫描,core 内部自铸 boundary
-     *  (`prepare-task.ts` 的 `shellReadBoundary`:roots=任务 root+additionalRoots,cwd=活 handsCwd),
+     *  (`prepare-task.ts` 的 `shellReadBoundary`:roots=任务 root+additionalRoots+additionalReadRoots,
+     *  cwd=活 handsCwd),
      *  **读到 roots 之外的路径同样会 ask**(server 侧零接线即得:我们只传 shellGate,边界是 core 自算的)。
      *  旧 core(<2.7.0)下仍是名字级判定=越界读放行,两者都能工作、后者更严 ⇒ floor 不因此抬。
      *  Absent/unset = `undefined` = **zero behavior change** (this is a tighten-ONLY opt-in, never a
@@ -790,6 +837,28 @@ export interface ServiceConfigFlat {
      *  cap → posture-gated like askQuestion (single-user turnkey → ON; multi-tenant opt-in);
      *  `TOOL_APPROVAL_ENABLED=true/false` overrides. Absent ⇒ core's headless auto-deny stands ([819]⑤ fail-closed). */
     toolApprovalEnabled: boolean;
+    /** #151 车2(design/172 §3.3 D3,窗长三元的安全余量):`ToolApprovalCoordinator` 的可选 `windowMarginMs`
+     *  构造项——有效窗 = `min(ttlMs, legRemainingMs − 本值)`,余量不足 ⇒ 不开窗直接走窗到期同路(park）。
+     *  仅在装配点把 `ToolApprovalRunContext.legDeadlineMonotonic` 传给协调器(车3 的活)时才实际生效——本
+     *  旋钮本身缺省对现行为零影响(D1)。`STREAM_ASK_WINDOW_MARGIN_MS`,默认 10000(10s）。ttl 概念沿用既有
+     *  `approvalTimeoutSec` 族,本旋钮不新增第二个 TTL 概念。 */
+    streamAskWindowMarginMs: number;
+    /** #151 车3(design/172 流内审批协议)总开关 + 四个从属旋钮。**协议整体默认 OFF**——开关关闭时全链
+     *  逐字现行为:不发 `approval_request` 帧、不落 `approval_asks` 行、窗 = 既有 `DEFAULT_APPROVAL_TTL_MS`
+     *  (5min)、`askStore` 不注入协调器。理由(三问):
+     *   - 谁需要 60s 窗:开了协议的部署——approver 就盯着流、秒级应答,窗短 ⇒ 少占一条活腿、更快落到可恢复
+     *     的 park 面。这是协议的设计意图,不是随手取的数。
+     *   - 谁被伤:①未 opt-in 的存量部署(把 5min 砍成 60s = 人离开工位 90 秒回来卡已经没了);②**park 设施
+     *     不在场**的部署——窗到期后 `"unavailable"` 没有降级目的地,core fail-closed deny,60s 会把
+     *     「人 90 秒后批准 = 放行」变成「拒绝」,是真行为回归。
+     *   - 补偿:把 60s 绑在**新旋钮 + 新开关**上,一个字不动 `DEFAULT_APPROVAL_TTL_MS`;两边都不伤,也不给
+     *     既有腿新增第二个 TTL 概念。
+     *
+     *  `STREAM_APPROVAL_ENABLED` / `STREAM_ASK_WINDOW_MS` / `STREAM_APPROVAL_REPLAY_MAX` /
+     *  `STREAM_APPROVAL_ADMIT_MAX_PER_TASK` / `STREAM_APPROVAL_ADMIT_MAX_PER_OWNER` /
+     *  `STREAM_APPROVAL_RECONCILE_BATCH` / `STREAM_APPROVAL_PENDING_GRACE_MS` /
+     *  `STREAM_APPROVAL_ADHOC_GRACE_MS` / `STREAM_APPROVAL_ORPHAN_TTL_MS`(后四键 = 车5 收敛器)。 */
+    streamApproval: StreamApprovalConfig;
     /** [824]① (clay A 案 = workflow 权限全面 CC parity): workflow 子 agent 的默认权限基线与主 LLM 同权(base `{}`)。
      *  安全论证:主 LLM 与子 agent 同 root 同信任域,主 LLM 本就能写这棵树([816] ask 门照管),单独钳子 agent 的
      *  安全增益≈0(只防绕路不防直路的门不是边界);实测产品代价=[814]A 死锁。`WORKFLOW_AGENTS_READONLY=true` =
@@ -906,7 +975,7 @@ export type ServiceStoreConfig = Pick<ServiceConfigFlat, "sessionBackend" | "ses
 export type ServiceModelPlaneConfig = Pick<ServiceConfigFlat, "gatewayBaseUrl" | "gatewayApiKey" | "gatewayFallbackUrls" | "gatewayMaxRetries" | "anthropic" | "resilience" | "model" | "models" | "modelApiKeyEnv" | "modelApiKeys" | "modelQuotaWeights" | "tiers" | "projects" | "roles" | "cascadeLadder" | "degrade">;
 /** 组:approval(审批 / HITL 门)。`directDoorActive` 无 env 解析腿(装配层三域合取的产物),但语义上
  *  就是本组的门状态,故进组;`parseApprovalDomain` 的返回类型相应是 `Omit<…, "directDoorActive">`。 */
-export type ServiceApprovalConfig = Pick<ServiceConfigFlat, "approvalRequire" | "approvalDeny" | "approvalTimeoutSec" | "approvalAutoBudget" | "approvalNeverAuto" | "approvalHmacKeys" | "durableApproval" | "directApprovalDoor" | "directDoorActive" | "resourceSuspend" | "resourceSuspendTtlSec" | "askQuestionEnabled" | "toolApprovalEnabled" | "mcpElicitation" | "sensitiveWritePatterns" | "manualModeShellGate">;
+export type ServiceApprovalConfig = Pick<ServiceConfigFlat, "approvalRequire" | "approvalDeny" | "approvalTimeoutSec" | "approvalAutoBudget" | "approvalNeverAuto" | "approvalHmacKeys" | "durableApproval" | "directApprovalDoor" | "directDoorActive" | "resourceSuspend" | "resourceSuspendTtlSec" | "askQuestionEnabled" | "toolApprovalEnabled" | "streamAskWindowMarginMs" | "streamApproval" | "mcpElicitation" | "sensitiveWritePatterns" | "manualModeShellGate">;
 /** 组:memory(记忆面 + TOC 同步腿)。 */
 export type ServiceMemoryConfig = Pick<ServiceConfigFlat, "memoryEngineEnabled" | "memoryEngineDir" | "memoryEngineRemoteLaneAllowed" | "memoryEngineBackend" | "memoryScope" | "memorySync" | "memoryOrgAdmissionMode" | "memoryOrgDirectoryJson" | "memoryOrgGrantTtlMs" | "memoryOrgUnavailableBackoffMs" | "projectMemoryEnabled" | "syncImportLeaseStaleSec">;
 /** 组:auth(鉴权 / 身份 / 治理棒)。`commandPolicy` 只有 sema-registry 腿(无 env 标量形),故 env 解析

package/dist/config.d.ts

@@ -60,6 +60,7 @@ export declare function drainConfigNotices(): Array<{
  *  (run-local historically did exactly that), so the drain lives beside the collectors, not in one entrypoint. */
 export declare function logConfigDiagnostics(logger: {
     warn: (event: string, fields?: Record<string, unknown>) => void;
+    info?: (event: string, fields?: Record<string, unknown>) => void;
     debug?: (event: string, fields?: Record<string, unknown>) => void;
 }): void;
 /** design/158 N8/N9 — the BOOLEAN member of this module's env-parser family (`env`/`env2`/`numEnv`/