@sema-agent/server 7.100.0 → 7.101.0

package/dist/boot/config-center.js

@@ -18,10 +18,18 @@ import { createConfigProvider, raceBootFetch, BOOT_FETCH_DEFERRED } from "../con
 import { executionLaneCaps, executionLaneOf } from "../execution-lane-caps.js";
 import { createKeyResolver } from "../key-resolver.js";
 import { ensureSealedKeyStore, reportExecutionPublicKey } from "../sealed-key.js";
-import { applyEffective, applyCenterReadFace, mutateInPlace, logEffectiveDiff, applyCenterSkills, resolveMcpServers, resolveA2aPeers, restartReasons, modelPlaneChanged, fetchPromptArtifact } from "../config-center/facade.js";
+import { applyEffective, applyCenterReadFace, mutateInPlace, logEffectiveDiff, applyCenterSkills, resolveMcpServers, resolveA2aPeers, restartReasons, modelPlaneChanged, withModelPlaneOf, buildEnvOnlyModelPlane, fetchPromptArtifact } from "../config-center/facade.js";
 import { createMcpRevocationLedger, enabledMcpEntries } from "../config-center/mcp-revocation.js";
 import { SHA256_HEX_RE } from "../digest-form.js";
-import { createConfigApplyLedger, refusedGroups } from "../config-center/apply-ledger.js";
+import { createConfigApplyLedger, modelPlaneCommitted, refusedGroups } from "../config-center/apply-ledger.js";
+function lkgReadNote(scope) {
+    switch (scope) {
+        case "whole":
+            return "booting from the persisted last-known-good (all restart-to-apply faces included) — the live pull continues in the background and reconciles on arrival";
+        case "model-plane":
+            return "the live candidate's model plane was refused at boot — the persisted last-known-good supplies the model plane only (catalog and the collab templates that reference it); every other group and every restart-to-apply face stays the live candidate's";
+    }
+}
 export async function createConfigCenterRuntime(ctx) {
     const { config, logger, metrics, localRoot } = ctx;
     let ccEtag;
@@ -114,6 +122,18 @@ export async function createConfigCenterRuntime(ctx) {
         : undefined;
     const rosterGateArmed = isRosterGateArmed(cc);
     const modelReadyState = { ready: !rosterGateArmed };
+    const warnDroppedEntries = (r, phase) => {
+        for (const d of r.droppedEntries ?? []) {
+            logger.warn("config_entry_dropped", {
+                domain: d.domain,
+                entry: d.entry,
+                error: d.error,
+                version: r.effective.version,
+                phase,
+                note: "this one entry failed its domain schema and was dropped on its own — the rest of the candidate applies (per-entry tolerance); fix the named entry to bring it back",
+            });
+        }
+    };
     const markRosterLanded = (eff) => {
         if (!modelReadyState.ready && (eff.models?.models ?? []).some((m) => m.enabled !== false)) {
             modelReadyState.ready = true;
@@ -312,7 +332,7 @@ export async function createConfigCenterRuntime(ctx) {
     };
     if (configProvider) {
         const dryRun = cc?.dryRun ?? false;
-        const bootFromLkg = async (why) => {
+        const bootFromLkg = async (why, scope) => {
             if (!lkgEnabled || dryRun)
                 return null;
             const identity = currentIdentity();
@@ -344,7 +364,7 @@ export async function createConfigCenterRuntime(ctx) {
                 logger.warn("config_lkg_unusable", { path: lkgPath, reason: "center credential identity changed while the LKG was being read — not used", note: "env fallback serves; the current identity's next pull re-establishes its own LKG" });
                 return null;
             }
-            logger.info("config_loaded_lkg", { path: lkgPath, savedAt: read.lkg.savedAt, why, note: "booting from the persisted last-known-good (all restart-to-apply faces included) — the live pull continues in the background and reconciles on arrival" });
+            logger.info("config_loaded_lkg", { path: lkgPath, savedAt: read.lkg.savedAt, why, scope, note: lkgReadNote(scope) });
             const lkgEffective = read.lkg.effective;
             candidateIdentity.set(lkgEffective, identity);
             bindValidator(read.lkg.etag, identity);
@@ -353,18 +373,31 @@ export async function createConfigCenterRuntime(ctx) {
         const bootApplyLkgInline = async (lkgR) => {
             const lkgGen = generationOf(lkgR.effective.version);
             applyLedger.seenTarget(lkgGen, lkgR.effective.version);
-            applyEffective(config, lkgR.effective, logger, { leg: "boot", sealedKeys, generation: lkgGen, report: (rep) => applyLedger.recordApply(rep) });
+            let lkgReport;
+            applyEffective(config, lkgR.effective, logger, {
+                leg: "boot",
+                sealedKeys,
+                generation: lkgGen,
+                report: (rep) => {
+                    lkgReport = rep;
+                    applyLedger.recordApply(rep);
+                },
+            });
             applyLedger.applied(lkgGen, lkgR.effective.version);
             await adoptCenterPrompts(lkgR.effective, "boot-lkg");
-            markRosterLanded(lkgR.effective);
+            const lkgPlane = modelPlaneCommitted(lkgReport);
+            if (lkgPlane)
+                markRosterLanded(lkgR.effective);
             effective = lkgR.effective;
-            appliedPlaneEff = lkgR.effective;
+            if (lkgPlane)
+                appliedPlaneEff = lkgR.effective;
             latestEffective = lkgR.effective;
             if (lkgR.etag !== undefined)
                 ccEtag = lkgR.etag;
             const cfgModels = (lkgR.effective.models?.models ?? []).filter((m) => m.enabled !== false).length;
             logger.info("config_loaded", { source: "lkg", version: lkgR.effective.version, worker: cc?.worker ?? "(global)", models: cfgModels });
         };
+        let bootApplyPhase = false;
         try {
             const bootFetch = pullEffective(configProvider, undefined);
             const raced = await raceBootFetch(bootFetch, config.configBootFetchBudgetMs);
@@ -372,7 +405,7 @@ export async function createConfigCenterRuntime(ctx) {
             if (raced === BOOT_FETCH_DEFERRED) {
                 bootConfigPending = bootFetch;
                 bootFetch.catch(() => { });
-                lkgFallback = await bootFromLkg("boot fetch deferred (budget exceeded)");
+                lkgFallback = await bootFromLkg("boot fetch deferred (budget exceeded)", "whole");
                 lkgBooted = lkgFallback !== null;
                 logger.warn("config_boot_fetch_deferred", {
                     source: configProvider.kind,
@@ -394,11 +427,13 @@ export async function createConfigCenterRuntime(ctx) {
             }
             const r = raced === BOOT_FETCH_DEFERRED ? null : raced;
             if (r) {
+                bootApplyPhase = true;
                 const bootPromptsRaw = r.effective.prompts;
                 const bootPromptsOk = bootPromptsRaw === undefined || validatePromptsDomain(bootPromptsRaw).ok;
                 let bootClean = (r.domainErrors ?? []).length === 0 && bootPromptsOk;
                 for (const de of r.domainErrors ?? [])
                     logger.warn("config_domain_invalid", { domain: de.domain, error: de.error, note: "tolerated at BOOT (corrupt file → schema defaults; dangling ref → reported as-is); the refresh path rejects such a candidate whole and keeps the LKG (§9.5-5)" });
+                warnDroppedEntries(r, "boot");
                 if (dryRun) {
                     logEffectiveDiff(config, r.effective, logger);
                     if (bootClean)
@@ -423,9 +458,23 @@ export async function createConfigCenterRuntime(ctx) {
                     if (bootClean)
                         ccEtag = r.etag;
                     await adoptCenterPrompts(r.effective, "boot");
-                    markRosterLanded(r.effective);
-                    effective = r.effective;
-                    appliedPlaneEff = r.effective;
+                    let bootPlaneEff = modelPlaneCommitted(bootReport) ? r.effective : undefined;
+                    if (bootPlaneEff === undefined) {
+                        const lkgPlane = await bootFromLkg("boot candidate's model plane was refused", "model-plane");
+                        if (lkgPlane) {
+                            let planeReport;
+                            applyEffective(config, withModelPlaneOf(r.effective, lkgPlane.effective), logger, { leg: "boot", sealedKeys, generation: bootGen, report: (rep) => (planeReport = rep) });
+                            if (modelPlaneCommitted(planeReport)) {
+                                bootPlaneEff = lkgPlane.effective;
+                                logger.warn("config_model_plane_from_lkg", { version: r.effective.version, lkgVersion: lkgPlane.effective.version, note: "the live candidate's model plane was refused at boot — serving the LKG's model plane (catalog and the collab templates that reference it) with the live candidate's other groups; the refresh cadence re-judges the candidate" });
+                            }
+                        }
+                    }
+                    if (bootPlaneEff !== undefined)
+                        markRosterLanded(bootPlaneEff);
+                    effective = bootPlaneEff === r.effective ? r.effective : withModelPlaneOf(r.effective, bootPlaneEff ?? buildEnvOnlyModelPlane());
+                    if (bootPlaneEff !== undefined)
+                        appliedPlaneEff = bootPlaneEff;
                     if (bootClean)
                         latestEffective = r.effective;
                     if (bootClean && !lkgBooted)
@@ -435,23 +484,30 @@ export async function createConfigCenterRuntime(ctx) {
                     logger.info("config_loaded", { source: configProvider.kind, version: r.effective.version, worker: cc?.worker ?? "(global)", models: cfgModels, ...cfgDir });
                     if (configProvider.kind === "local" && cfgModels === 0) {
                         const modelsDomainErr = (r.domainErrors ?? []).find((de) => de.domain === "models");
+                        const modelsDropped = (r.droppedEntries ?? []).filter((d) => d.domain === "models");
                         const totalModels = (r.effective.models?.models ?? []).length;
                         logger.warn("config_local_no_models", {
                             ...cfgDir,
                             ...(modelsDomainErr ? { domainError: modelsDomainErr.error } : {}),
+                            ...(modelsDropped.length > 0 ? { droppedEntries: modelsDropped.map((d) => d.entry) } : {}),
                             hint: modelsDomainErr
                                 ? "config.d/models.json 在场但 models 域判形失败落 default(真因见本行 domainError)— 模型继续走 env 兜底"
-                                : totalModels > 0
-                                    ? `config.d/models.json 有 ${totalModels} 条模型但全部 enabled:false — 模型继续走 env 兜底`
-                                    : "config.d/models.json 空或 CONFIG_LOCAL_DIR 指错目录(选目录旋钮是 CONFIG_LOCAL_DIR,不是 LOCAL_DATA_ROOT)— 模型继续走 env 兜底",
+                                : modelsDropped.length > 0 && totalModels === 0
+                                    ? "config.d/models.json 的条目全部被逐条丢弃(逐条真因见 config_entry_dropped)— 模型继续走 env 兜底"
+                                    : totalModels > 0
+                                        ? `config.d/models.json 有 ${totalModels} 条模型但全部 enabled:false — 模型继续走 env 兜底`
+                                        : "config.d/models.json 空或 CONFIG_LOCAL_DIR 指错目录(选目录旋钮是 CONFIG_LOCAL_DIR,不是 LOCAL_DATA_ROOT)— 模型继续走 env 兜底",
                         });
                     }
                 }
             }
         }
         catch (err) {
-            logger.warn("config_source_unreachable_using_env", { source: configProvider.kind, err: String(err) });
-            const lkgFallback = await bootFromLkg(`boot fetch failed: ${String(err).slice(0, 120)}`);
+            if (bootApplyPhase)
+                logger.warn("config_apply_refused", { source: configProvider.kind, err: String(err), note: "the pulled candidate failed to apply at boot — falling back to the LKG / env; this is not a reachability failure" });
+            else
+                logger.warn("config_source_unreachable_using_env", { source: configProvider.kind, err: String(err) });
+            const lkgFallback = await bootFromLkg(`${bootApplyPhase ? "boot apply refused" : "boot fetch failed"}: ${String(err).slice(0, 120)}`, "whole");
             if (lkgFallback) {
                 lkgBooted = true;
                 try {
@@ -696,6 +752,7 @@ export async function createConfigCenterRuntime(ctx) {
                                             ...(r.domainErrors ?? []).map((de) => ({ domain: de.domain, error: de.error })),
                                             ...(promptsGate.ok ? [] : [{ domain: "prompts", error: promptsGate.error }]),
                                         ],
+                                        ...(r.droppedEntries !== undefined ? { droppedEntries: r.droppedEntries } : {}),
                                         lkgVersion: latestEffective?.version ?? "(env)",
                                         note: "candidate rejected whole (§9.5-5) — live config keeps the last-known-good; fix the named files to unblock",
                                     });
@@ -703,6 +760,7 @@ export async function createConfigCenterRuntime(ctx) {
                                 return "ok";
                             }
                             lastRejectedCandidate = undefined;
+                            warnDroppedEntries(r, "refresh");
                             if (ccRef?.dryRun) {
                                 logEffectiveDiff(config, r.effective, logger);
                                 ccEtag = r.etag;
@@ -730,10 +788,13 @@ export async function createConfigCenterRuntime(ctx) {
                                 mcpRevocations.applyEnabledEntries(enabledMcpEntries(r.effective.mcp));
                                 applyLiveReadFace(r.effective, swapRunnerDeps, "refresh");
                                 applyLedger.applied(tickGen, r.effective.version);
-                                appliedPlaneEff = r.effective;
+                                const tickPlane = modelPlaneCommitted(applyReport);
+                                if (tickPlane)
+                                    appliedPlaneEff = r.effective;
                                 planeDeferredNoHandoff = undefined;
                                 await adoptCenterPrompts(r.effective, "refresh");
-                                markRosterLanded(r.effective);
+                                if (tickPlane)
+                                    markRosterLanded(r.effective);
                                 const fullyApplied = applyReport?.fullyApplied !== false;
                                 if (!fullyApplied) {
                                     ccEtag = undefined;
@@ -826,10 +887,12 @@ export async function createConfigCenterRuntime(ctx) {
                         logger.warn("config_boot_deferred_candidate_rejected", {
                             version: r.effective.version,
                             errors: [...(r.domainErrors ?? []).map((de) => ({ domain: de.domain, error: de.error })), ...(promptsGate.ok ? [] : [{ domain: "prompts", error: promptsGate.error }])],
+                            ...(r.droppedEntries !== undefined ? { droppedEntries: r.droppedEntries } : {}),
                             note: "late boot pull carried an invalid candidate — env fallback keeps serving; the refresh cadence re-judges the same tree (etag not advanced)",
                         });
                         return;
                     }
+                    warnDroppedEntries(r, "boot-deferred");
                     if (ccRef?.dryRun) {
                         logEffectiveDiff(config, r.effective, logger);
                         ccEtag = r.etag;
@@ -856,10 +919,13 @@ export async function createConfigCenterRuntime(ctx) {
                     ceilingVerdict?.judge();
                     applyLiveReadFace(r.effective, swapRunnerDeps, "boot-deferred");
                     applyLedger.applied(lateGen, r.effective.version);
-                    appliedPlaneEff = r.effective;
+                    const latePlane = modelPlaneCommitted(applyReportLate);
+                    if (latePlane)
+                        appliedPlaneEff = r.effective;
                     planeDeferredNoHandoff = undefined;
                     await adoptCenterPrompts(r.effective, "boot-deferred");
-                    markRosterLanded(r.effective);
+                    if (latePlane)
+                        markRosterLanded(r.effective);
                     const fullyAppliedLate = applyReportLate?.fullyApplied !== false;
                     if (!fullyAppliedLate) {
                         ccEtag = undefined;

package/dist/boot/execution-env.js

@@ -29,6 +29,24 @@ function boundedSessionSetter(map, maxEntries) {
             map.delete(map.keys().next().value);
     };
 }
+function forwardedSandboxEnvKeys(remoteExec) {
+    switch (remoteExec.provider) {
+        case "e2b":
+            return Object.keys(remoteExec.sandboxEnv ?? {}).sort();
+        case "local-docker":
+            return Object.keys(remoteExec.env ?? {}).sort();
+        case "k8s":
+        case "ssh":
+        case "adb":
+        case "host":
+        case "device":
+            return [];
+        default: {
+            const unreachable = remoteExec;
+            throw new Error(`unhandled remote-exec provider: ${String(unreachable.provider)}`);
+        }
+    }
+}
 const MAX_CWD_SESSIONS = 4096;
 export function createSessionScopedRegistries(maxEntries = MAX_CWD_SESSIONS) {
     const perSessionCwd = new Map();
@@ -275,7 +293,7 @@ export function createExecutionEnv(ctx) {
             config.remoteExec.provider === "local-docker";
         const suspendable = config.remoteExec.provider === "e2b" ||
             (config.remoteExec.provider === "k8s" && !!config.remoteExec.s3Snapshot);
-        const sandboxEnvKeys = config.remoteExec.provider === "e2b" ? Object.keys(config.remoteExec.sandboxEnv ?? {}) : [];
+        const sandboxEnvKeys = forwardedSandboxEnvKeys(config.remoteExec);
         logger.info("remote_exec_enabled", { provider: config.remoteExec.provider, isolated, suspendable, ...(sandboxEnvKeys.length > 0 ? { sandboxEnvKeys } : {}) });
         if (!isolated)
             logger.warn("remote_exec_real_system", { provider: config.remoteExec.provider, note: "non-isolated target — actions are permanent; rely on the policy gate + HITL (design/61 §5)" });
@@ -290,7 +308,7 @@ export function createExecutionEnv(ctx) {
         })
         :
             lspProvider === "host" && config.lspHostEnabled && config.requirePrincipal !== true
-                ? createHostLspManager((event, fields) => logger.info(event, fields))
+                ? createHostLspManager(config, (event, fields) => logger.info(event, fields))
                 : undefined;
     if (lspManager)
         logger.info("lsp_enabled", { provider: lspProvider });

package/dist/boot/parked-revive-gate.js

@@ -29,6 +29,7 @@ export function createParkedReviveInheritedGate(deps) {
             : { env: createHostAdjudicationEnv(config, localRoot), ...homeBase };
         const rootSessionId = row.rootSessionId;
         const baseline = createApprovalBaselinePolicy(config, {
+            kind: "durable",
             question,
             ...(approvalExemptionStore && rootSessionId
                 ? {

package/dist/boot/reapers.js

@@ -120,6 +120,7 @@ export function startReapers(ctx) {
             pendingGraceMs: config.streamApproval.pendingGraceMs,
             adhocGraceMs: config.streamApproval.adhocGraceMs,
             orphanTtlMs: config.streamApproval.orphanTtlMs,
+            unattendedPolicy: config.unattendedApprovalPolicy,
             ...(toolApproval ? { emitRevoke: (frame, target) => void toolApproval.emitRevoke(frame, target) } : {}),
         });
     })();

package/dist/boot/resolve-spec.js

@@ -17,7 +17,8 @@ import { composeHooks, createTaskHooks } from "../hooks/hook-runner.js";
 import { HOST_POSTURE_REFUSED_CODE, taskApproverPostureHonored, taskWriteFaceRefusal } from "../hosted-posture.js";
 import { headerStr } from "../http/principal-gate.js";
 import { explicitOperatorOk } from "../http/server.js";
-import { isModelAllowlisted, matchCatalogModel, modelSupportsImages, resolveTaskModel, terminalCatalogName } from "../model-select.js";
+import { isModelAllowlisted, matchCatalogModel, modelSupportsImages, refusedCatalogEntry, resolveTaskModel, selectableCatalog, terminalCatalogName } from "../model-select.js";
+import { modelUnavailableMessage } from "../model-entry-refusal.js";
 import { PerTaskImageRegistry, resolveSandboxImageRef } from "../per-task-image.js";
 import { isRemoteScratchpadLane, remoteScratchpadDirFor } from "../plugins/remote-scratchpad.js";
 import { bindAttachmentsForTask } from "../plugins/task-attachment-store.js";
@@ -43,7 +44,10 @@ import { memoryFaceMounted } from "../memory-scope.js";
 export function createResolveSpec(ctx) {
     const { config, logger, metrics, localRoot, scenarios, principalCaps, centerRuntimeCapsResolver, getCenterPrompts, getKeyResolver, taskAttachmentStore, perSessionCwd, setSessionCwd, setSessionShellEnv, fenceSessionOwner, hookLlm, hookAgent, fleetBus, hookWakeBus, noteSessionShellGate, resumeAnchorStore, ownerAware, taskLimitCaps, taskTimeoutSec, selectEnvTool, sendUserFileToolSpec, memoryEngine, durableEnabled, approvalExemptionStore, checkpointStore, deploymentHooks, imageIndex, perTaskImage, sessionEnvSelection, liveQuestionFace, approverSeat, lockedKeys, } = ctx;
     assertGuardPatternsUsable(config);
-    const onlySensitiveBaseline = buildOnlySensitiveBaselineWarning(config, { durableEnabled, singleUserAutoAcceptBaseline: singleUserAutoAcceptBaselineApplies(config) });
+    const onlySensitiveBaseline = buildOnlySensitiveBaselineWarning(config, {
+        approvalSeat: durableEnabled ? "durable" : "absent",
+        singleUserAutoAcceptBaseline: singleUserAutoAcceptBaselineApplies(config),
+    });
     const realTaskRootOf = (auth) => {
         if (isSandboxPathAdjudicationLane(config.remoteExec?.provider))
             return undefined;
@@ -217,8 +221,16 @@ export function createResolveSpec(ctx) {
         if (rawAddReadDirs !== undefined && !cwdHonored(config)) {
             logger.warn("task_additional_read_directories_ignored", { honored: false, sessionId: auth?.sessionId ?? null });
         }
-        const wireCatalog = expandTiers(config.models, config.tiers) ?? config.models;
-        const picked = resolveTaskModel(body.model ?? parsedSettings.settings?.model, objective, wireCatalog, config.atModelAllowlist);
+        const wireCatalog = selectableCatalog(config.models, config.tiers, config.modelRefusals);
+        const picked = resolveTaskModel(body.model ?? parsedSettings.settings?.model, objective, wireCatalog, config.atModelAllowlist, config.modelRefusals);
+        if (picked.unavailable !== undefined) {
+            const { requested, name, refusal, source } = picked.unavailable;
+            if (opts?.leg === "fresh") {
+                throw new HttpError(400, modelUnavailableMessage(source === "mention" ? "@-mention" : "model", requested.slice(0, 120), name, refusal), { code: "request.model_unavailable" });
+            }
+            metrics.inc("task_model_unavailable_fallback_total");
+            logger.warn("task_model_unavailable_fallback", { requested: requested.slice(0, 120), name, code: refusal.code, source, fallback: picked.model, sessionId: auth?.sessionId ?? null });
+        }
         if (picked.notAllowed !== undefined) {
             const { requested, resolved, source } = picked.notAllowed;
             if (opts?.leg === "fresh") {
@@ -340,7 +352,11 @@ export function createResolveSpec(ctx) {
             ...((() => {
                 if (typeof body.compactionModel !== "string" || body.compactionModel.length === 0)
                     return {};
-                const cm = matchCatalogModel(body.compactionModel, wireCatalog);
+                const cm = matchCatalogModel(body.compactionModel, wireCatalog, config.modelRefusals);
+                const refusedCm = cm === undefined ? refusedCatalogEntry(body.compactionModel, config.modelRefusals) : undefined;
+                if (refusedCm !== undefined && opts?.leg === "fresh") {
+                    throw new HttpError(400, modelUnavailableMessage("compactionModel", body.compactionModel.slice(0, 120), refusedCm.name, refusedCm.refusal), { code: "request.model_unavailable" });
+                }
                 if (cm === undefined) {
                     if (opts?.leg === "fresh") {
                         throw new HttpError(400, `unknown compactionModel "${body.compactionModel.slice(0, 120)}" — not in the configured catalog (name, tier word, or id; a catalog refresh may have removed it mid-request)`);
@@ -349,8 +365,8 @@ export function createResolveSpec(ctx) {
                     logger.warn("compaction_model_unknown_fallback", { requested: body.compactionModel.slice(0, 120), sessionId: auth?.sessionId ?? null });
                     return {};
                 }
-                if (!isModelAllowlisted(cm, wireCatalog, config.atModelAllowlist)) {
-                    const terminal = terminalCatalogName(cm, wireCatalog) ?? cm;
+                if (!isModelAllowlisted(cm, wireCatalog, config.atModelAllowlist, config.modelRefusals)) {
+                    const terminal = terminalCatalogName(cm, wireCatalog, config.modelRefusals) ?? cm;
                     if (opts?.leg === "fresh") {
                         throw new HttpError(400, `compactionModel "${body.compactionModel.slice(0, 120)}" is not in this deployment's @-mention allowlist (it resolves to catalog model "${terminal}") — the allowlist is configured by the operator (config-center models.atModelAllowlist)`, { code: "request.model_not_allowed" });
                     }
@@ -414,6 +430,7 @@ export function createResolveSpec(ctx) {
             promptProvider: centerDecls ? centerPromptProvider(centerDecls, scenarioName) : cap.promptProvider,
             toolPolicy: toolPolicyForHands(hands, durableEnabled
                 ? createApprovalBaselinePolicy(config, {
+                    kind: "durable",
                     question: liveQuestionFace,
                     ...(approvalExemptionStore && auth?.sessionId
                         ? {
@@ -423,7 +440,7 @@ export function createResolveSpec(ctx) {
                         : {}),
                 })
                 : singleUserAutoAcceptBaselineApplies(config)
-                    ? createApprovalBaselinePolicy(config)
+                    ? createApprovalBaselinePolicy(config, { kind: "absent" })
                     : undefined),
             ...(durableEnabled
                 ? {

package/dist/boot/runner-deps.js

@@ -11,9 +11,11 @@ import { resolveServedSession } from "../orchestration/workflow-completion-inbox
 import { defaultEngineNoticeRouter } from "../trace/engine-notice-wire.js";
 import { WorkflowNotifyGate } from "../orchestration/workflow-notify-journal.js";
 import { makeLoadProjectMemory, makeProbeInstructionSources } from "../project-memory.js";
+import { createInstructionSourceSeat } from "../instruction-source-notice.js";
 import { workflowModelAllowlistFor } from "../task-workflow.js";
 import { buildCrossSessionInboundLayers, crossSessionDialogExpiryOf } from "../cross-session-settings.js";
 import { createPeerDirectory } from "../peer-directory.js";
+import { targetOutsideStoreInIncident } from "../memory-store-refusal.js";
 export function createRunnerDepsOnAsk(toolApproval) {
     if (!toolApproval)
         return undefined;
@@ -188,8 +190,10 @@ export function createRunnerDeps(ctx) {
                 metrics.inc("memory_harvest_total", { ok: String(report.ok), phase: info.phase, incident: report.incident?.kind ?? "none" });
                 if (report.patches)
                     metrics.inc("memory_harvest_patches_total", { phase: info.phase }, (report.patches.add ?? 0) + (report.patches.update ?? 0));
-                if (report.incident)
-                    logger.warn("memory_harvest_incident", { kind: report.incident.kind, phase: info.phase });
+                if (report.incident) {
+                    const code = targetOutsideStoreInIncident(report.incident);
+                    logger.warn("memory_harvest_incident", { kind: report.incident.kind, phase: info.phase, ...(code !== undefined ? { code } : {}) });
+                }
                 const byCode = new Map();
                 for (const r of [...(report.rejections ?? []), ...(report.inboundFindings ?? [])])
                     byCode.set(r.code, (byCode.get(r.code) ?? 0) + 1);
@@ -209,7 +213,9 @@ export function createRunnerDeps(ctx) {
         fileHistoryStore: fileHistoryStore ? fileHistoryStore : undefined,
         permissionRuleStore: permissionRuleStore ? permissionRuleStore : undefined,
         onBackgroundChildEvent: fleetBackgroundChildPublisher(fleetBus, (msg, fields) => logger.info(msg, fields)),
-        loadProjectMemory: config.requirePrincipal !== true && config.projectMemoryEnabled ? makeLoadProjectMemory({ logger }) : undefined,
+        loadProjectMemory: config.requirePrincipal !== true && config.projectMemoryEnabled
+            ? makeLoadProjectMemory({ logger, instructionSource: createInstructionSourceSeat(sessionStore, sharedRunnerDeps.onNotice) })
+            : undefined,
         probeInstructionSources: config.remoteExec?.provider === "host" && config.requirePrincipal !== true && config.projectMemoryEnabled
             ? makeProbeInstructionSources()
             : undefined,

package/dist/boot/stage-02-registry-pull.js

@@ -1,8 +1,17 @@
 import { createUnpricedCeilingVerdict } from "./unpriced-ceiling-verdict.js";
 import { createConfigCenterRuntime } from "./config-center.js";
+import { defaultModelRefusal, refusedNameMintedRefusal } from "../model-entry-refusal.js";
 export async function runStage02(ctx) {
     const { config, localRoot, logger, metrics } = ctx;
     const configCenter = await createConfigCenterRuntime({ config, logger, metrics, localRoot });
+    const noDefaultModel = defaultModelRefusal(config, "env");
+    if (noDefaultModel !== undefined) {
+        throw new Error(noDefaultModel);
+    }
+    const mintedRefused = refusedNameMintedRefusal(config);
+    if (mintedRefused !== undefined) {
+        throw new Error(mintedRefused);
+    }
     await configCenter.applyLocalRemoteExec();
     const ceilingVerdict = createUnpricedCeilingVerdict({ config, logger });
     ceilingVerdict.judge();

package/dist/boot/stores.js

@@ -24,6 +24,8 @@ import { assertDeviceAuditRebindEventSchema, ensurePgDeviceSchema, ensureTiDBDev
 import { mysqlDriver, pgDriver } from "../plugins/sql-driver.js";
 import { assertCloudSnapshotBlobPosture, openStoreBackendWithFallback } from "../plugins/store-backend.js";
 import { createMemoryEngineIncidentSink } from "../memory-incident-sink.js";
+import { announceLockedLegacyMemoryLayers } from "../memory-layer-legacy-lock.js";
+import { createEngineNoticeForwarder } from "./runner-deps.js";
 import { buildMemoryRemoteLaneWarn, memoryEngineBackendFor, memoryEngineRemoteLanePosture, memoryEngineRootFor, memoryMountRootOf } from "../memory-scope.js";
 import { assertToolResultProvenanceSchema } from "../plugins/tool-result-store-sql.js";
 import { assertPermissionRuleApprovalSchema, assertPermissionRuleTicketSchema } from "../plugins/permission-rule-store-sql.js";
@@ -186,6 +188,8 @@ export async function openStores(ctx) {
     }
     else {
         memoryEngine = memoryEngineBackendFor(config, undefined, createMemoryEngineIncidentSink({ logger, metrics }));
+        if (memoryEngine)
+            announceLockedLegacyMemoryLayers(memoryMountRootOf(memoryEngine.backend, memoryEngine.root), createEngineNoticeForwarder(logger));
         if (memoryEngine && process.env.LOCAL_DATA_ROOT && !config.memoryEngineDir) {
             logger.warn("memory_engine_dir_defaulted", {
                 root: memoryEngine.root,

package/dist/config-catalog.js

@@ -7,6 +7,7 @@ import { REMOTE_EXEC_PROVIDER_WORDS } from "./execution-lane-caps.js";
 import { CENTER_READ_FACE_LIVE_KEYS } from "./config-center/read-face.js";
 import { MODEL_PROVIDER_WORDS } from "./model-provider.js";
 import { buildDisplaySafeUrl } from "./trace/redact.js";
+import { describeAllowlistPostures } from "./env-name-allowlist-knobs.js";
 export const CATALOG_VALUE_TYPES = ["boolean", "number", "string", "enum", "csv", "json", "path", "url", "secret", "opaque"];
 export const CATALOG_TIMINGS = ["hot", "restart", "deploy", "inert"];
 export const CATALOG_DANGER_AXES = ["security", "billing", "data"];
@@ -125,7 +126,7 @@ export const CONFIG_CATALOG = [
     r("DOCKER_NETWORK", "orchestration", "enum", "local-docker 容器网络模式", { enumValues: ["none", "bridge", "host"], staticDefault: "bridge", danger: SEC }),
     r("DOCKER_PATH", "orchestration", "path", "docker 二进制路径"),
     r("DOCKER_PIDS_LIMIT", "orchestration", "number", "local-docker fork-bomb 背栓(--pids-limit;非法值回 adapter 默认 512+warn)", { danger: SEC, derivedDefaultNote: "缺席 ⇒ adapter 默认 512" }),
-    r("DOCKER_SANDBOX_ENV", "orchestration", "csv", "转发进容器的本进程 env **名字**表(值只在 worker env,不进 spec/center)", { danger: SEC }),
+    r("DOCKER_SANDBOX_ENV", "orchestration", "secret", "local-docker 车道每条 docker exec 以 -e 注入的本进程 env 点名表(NAME,NAME;点到的键从 worker env 原样取,值不进 spec/center/日志;与 LSP_ENV_ALLOW / E2B_SANDBOX_ENV 同一只解析器与「点名放行」谓词:形错 / 点名名单型旋钮拒启且不回显值;本进程环境里没有的名按序号 warn、不转发;只在本车道被选中时求值;原文按凭据类对待:只回在场位、不进任何子进程)", { danger: SEC }),
     r("DRAIN_GRACE_MS", "limitsHttp", "number", "SIGTERM 优雅排空窗(ms;期间新计费提交 503+Retry-After)。出厂默认是**服务器部署**的取值;壳自 spawn 的引擎会被壳注入更短的窗 ⇒ 排壳形关机预算时以本行的 effectiveValue(= 本进程实际生效值)为准,不照抄 staticDefault", { staticDefault: String(10 * 60 * 1000), configKey: "drainGraceMs", center: cLimits("drainGraceMs") }),
     r("DURABLE_APPROVAL", "approval", "boolean", "durable suspend/resume HITL(需 SQL 店;决定 checkpointStore 与 /v1/approvals 面的存在性)", { danger: SEC, derivedDefaultNote: "posture 三态(S-178):显式词恒赢,缺席 = 单用户(REQUIRE_PRINCIPAL≠true)且有耐久店 ⇒ on / 多租户或无耐久店 ⇒ off;生效来源见 GET /v1/diagnostics/wiring 的 serverGates.durableApproval.source", configKey: "durableApproval" }),
     r("E2B_ALLOW_NET", "orchestration", "boolean", "e2b 沙箱出网许可", { danger: SEC, derivedDefaultNote: "缺席 ⇒ 不铸键(adapter 默认允许)" }),
@@ -136,7 +137,7 @@ export const CONFIG_CATALOG = [
     r("E2B_LIVENESS_MS", "orchestration", "number", "e2b 单命令静默活性上限(长静默构建请调大;后台+轮询仍是首选)", { derivedDefaultNote: "缺席 ⇒ adapter 默认 120s" }),
     r("E2B_MOUNT_PATH", "orchestration", "path", "e2b 工作区根(resume 用当前值,改前先 drain 挂起任务)"),
     r("E2B_ORPHAN_RECLAIM", "orchestration", "boolean", "崩溃遗留沙盒回收腿(boot 一次+周期;判据保守,拿不准恒不杀)", { staticDefault: "true", danger: BILL }),
-    r("E2B_SANDBOX_ENV", "orchestration", "csv", "转发进 e2b 沙箱的本进程 env 名字表(值不进 spec/center/事件日志)", { danger: SEC }),
+    r("E2B_SANDBOX_ENV", "orchestration", "secret", "转发进 e2b 沙箱的本进程 env 点名表(NAME,NAME;点到的键从 worker env 原样取,值不进 spec/center/事件日志;与 LSP_ENV_ALLOW / DOCKER_SANDBOX_ENV 同一只解析器与「点名放行」谓词:形错 / 点名名单型旋钮拒启且不回显值;本进程环境里没有的名按序号 warn、不转发;只在本车道被选中时求值;原文按凭据类对待:只回在场位、不进任何子进程)", { danger: SEC }),
     r("E2B_SANDBOX_MAX_MS", "orchestration", "number", "e2b 沙箱最长存活(ms)", { staticDefault: "3600000", danger: BILL }),
     r("E2B_TEMPLATE", "orchestration", "string", "e2b 模板名(缺省 adapter 基础模板)"),
     r("E2B_TIMEOUT_MS", "orchestration", "number", "e2b 单命令总超时(ms)"),
@@ -208,6 +209,7 @@ export const CONFIG_CATALOG = [
     r("LOCKED_CONFIG_KEYS", "auth", "csv", "管理员锁定层声明(词表=core 闭集注册表,未知键拒启)", { danger: SEC, configKey: "lockedConfigKeys" }),
     r("LOG_LEVEL", "observability", "string", "日志档位", { staticDefault: "info", configKey: "logLevel" }),
     r("LSP_ENABLED", "orchestration", "boolean", "LSP 沙箱腿 opt-in(需烤好的 LSP 模板;host 腿另有 LSP_HOST_ENABLED)", { staticDefault: "false", configKey: "lspEnabled" }),
+    r("LSP_ENV_ALLOW", "orchestration", "secret", `host 腿语言服务器子进程 env 的点名放行名单(点到的键从服务 env 原样放回、部署方显式承担;没点到的照剥;与 host shell inheritEnv:[names] 同一只谓词;形错 / 点名名单型旋钮(自己或两只沙箱名单)拒启且不回显值;本进程环境里没有的名按序号 warn、不放行、不回显;多租户姿态(忽略时起服 warn 一次):${describeAllowlistPostures()};原文按凭据类对待:只回在场位、不进任何子进程,生效名单见起服披露行 allowed)`, { danger: SEC, derivedDefaultNote: "缺席 / 空串 ⇒ 空名单 = 全剥(7.100.0 行为)" }),
     r("LSP_HOST_ENABLED", "orchestration", "boolean", "LSP host 腿开关(本机 language server,优雅降级)", { staticDefault: "true", configKey: "lspHostEnabled" }),
     r("MANUAL_MODE_SHELL_GATE", "approval", "enum", "手动模式 shell 门收紧腿(off=no-op 非放松 —— 本键只有收紧半场;拼错拒启)", { danger: SEC, enumValues: ["always", "classify", "off"], echoWords: ["always", "classify"], resolve: (c) => c.manualModeShellGate ?? null, derivedDefaultNote: "off/未设 ⇒ 本键不贡献任何东西(归一成键缺席)⇒ 回显 null;真姿态只有 always/classify 两个" }),
     r("MAX_PRINCIPAL_COST_USD", "limitsHttp", "number", "per-principal 窗内成本天花板(0=关)", { staticDefault: "0", danger: BILL, configKey: "maxPrincipalCostUsd", center: cLimits("maxPrincipalCostUsd") }),
@@ -453,7 +455,7 @@ export const CONFIG_CATALOG = [
     r("UNREACHED_ASK_TTL_MS", "approval", "number", "零活流铸造的 ask 悬挂窗(ms;[60s,24h] 拒启带界)", { staticDefault: "3600000" }),
     r("USAGE_WINDOWS", "orchestration", "opaque", "部署级治理窗(JSON 数组;滑动窗内跨任务 token/$ 预算,key=principal)", { danger: BILL }),
     r("WEB_SEARCH_API_KEY", "orchestration", "secret", "web search 后端 API 凭据(brave/tavily)", { danger: [...SEC, ...BILL] }),
-    r("WEB_SEARCH_ENDPOINT", "orchestration", "url", "web search 后端 endpoint 覆写(searxng 实例地址;brave 下可指向 Brave 兼容网关的完整搜索 URL,如 Nólë;空 = 未设;不是 scheme://host 形的绝对 URL ⇒ 拒启)"),
+    r("WEB_SEARCH_ENDPOINT", "orchestration", "url", "web search 后端 endpoint 覆写(searxng 实例地址;brave 下可指向 Brave 兼容网关的完整搜索 URL,如 Nólë;空 = 未设;不是 scheme://host 形的绝对 URL、或带 userinfo(user[:password]@host —— 运行时 fetch 本就拒这一形)⇒ 拒启)"),
     r("WEB_SEARCH_MAX_RESULTS", "orchestration", "number", "web search 单次结果数上限(非数 / < 1 ⇒ 拒启;> 20 夹到 20)", { derivedDefaultNote: "缺席/空 ⇒ backend 默认 10" }),
     r("WEB_SEARCH_PROBE_ON_BOOT", "orchestration", "boolean", "boot 期 web search 连通性探测(只认 true/1;含糊值当没开——猜错方向是凭空出网)", { staticDefault: "false" }),
     r("WEB_SEARCH_PROVIDER", "orchestration", "enum", "web search 工具后端(设合法词=装配 WebSearch;其它/缺席=不装配)", { enumValues: WEB_SEARCH_PROVIDERS, danger: SEC, resolve: (_c, env) => webSearchProviderFromEnv(env) ?? null }),

package/dist/config-center/apply-effective.d.ts

@@ -67,6 +67,31 @@ export type ApplyEffectiveOpts = ApplyLeg & {
     }) => void;
 };
 export declare function applyEffective(config: ServiceConfig, eff: EffectiveConfig, logger: Logger | undefined, opts: ApplyEffectiveOpts): boolean;
+/**
+ * 🔴 **模型面组由哪些 effective 域组成 —— 唯一定义**(7.101.0 验修轮 V1 / codex V-1;OA 验修轮 V2 的以点改面)。
+ *
+ * collab 在组里:模板带模型引用,新模板配旧目录(或旧模板配新目录)就是一次混代发布。此前「模型面」散在三处各写一份 ——
+ * 世代账的键表只列 models 域的落点、stage 的 collab 闸按「模型面没被拒」ad hoc 门住、boot 按组回落 LKG 的合成只换
+ * `models` 域 —— 最后那份漏了 collab,于是 boot 回落时 LKG 的目录配上了被拒候选的模板(与 refresh 腿同态不同答)。
+ * 读者一律从这里派生,禁手抄:
+ *  · stage:{@link stageModelPlane} 产出组内**每个**域的产物({@link ModelPlaneStages} 按本表映射),组被拒 ⇒ 一个域都没有;
+ *  · 世代账:整组拒的 `keys` 与落地的 `applied` 都由 {@link MODEL_PLANE_SURFACES} 按本表派生({@link modelPlaneGroupReport});
+ *  · boot 按组回落 LKG 的合成文档与 restart 基线:{@link withModelPlaneOf}(`boot/config-center.ts`)。
+ * (与 `config.ts` 的配置组视图 `MODEL_PLANE_GROUP_KEYS` 不是一回事:那是 `ServiceConfig` 的分节视图;这里是「中心热应用的
+ * 模型面这一组包含哪些 effective 域」。)
+ */
+export declare const MODEL_PLANE_DOMAINS: readonly ["models", "collab"];
+export type ModelPlaneDomain = (typeof MODEL_PLANE_DOMAINS)[number];
+/** 模型面组在 effective 上的那一切片(组内各域;`models` 必在、`collab` 可缺席 —— 与 `EffectiveConfig` 同形)。 */
+export type ModelPlaneOf = Pick<EffectiveConfig, ModelPlaneDomain>;
+/**
+ * `target` 换上 `source` 的**整个模型面**(组内每个域都取 `source` 的;`source` 缺席的域在结果里同样缺席,不留 `target` 的),
+ * 其余域原样是 `target` 的。boot 按组回落 LKG 的两处(回落 apply 的合成文档、restart 对照基线)都走这一只 —— 禁在调用点
+ * 手写 `{ ...x, models, collab }`(漏一个域正是 V1 的病形)。纯数据:不改两个入参。
+ */
+export declare function withModelPlaneOf<E extends EffectiveConfig>(target: E, source: ModelPlaneOf): E;
+/** 「没有中心模型面」—— 组拒且无 LKG 时进程真正服务的那一代(env 表:没有目录、没有中心 collab 模板)。纯数据,每次新铸。 */
+export declare function buildEnvOnlyModelPlane(): ModelPlaneOf;
 /**
  * UNIFORM presence semantics across the center gates (center `f95438a` adopted this from our sentinel flag —
  * SERVICE-INTEGRATION「Runtime 治理/限额闸」): every gate field is center `.optional()`, so