@sema-agent/server 7.101.1 → 7.103.0

package/dist/background-session-reap.d.ts

@@ -0,0 +1,58 @@
+import { type BackgroundShellHardKillReceipt } from "@sema-agent/core";
+import type { Logger } from "./observability/logger.js";
+/** 受据四词的计数(日志汇总行与调用方读数共用)。 */
+export interface HardKillTally {
+    killed: number;
+    alreadyGone: number;
+    retainedSkipped: number;
+    /** 没有同步硬收落地(普通 kill 已派)—— 「未确认」,不是失败。 */
+    unconfirmed: number;
+}
+/**
+ * 受据的**唯一读者**:逐行一条 `background_shell_hard_kill`(`{ taskId, type, outcome, reason, owner?, retained? }` —— 不带
+ * pid / shellId:core 契约「pid 不出 env」,受据上本来就没有),返回四词计数。本函数自己不抛;注入形 logger 若抛,异常**原样上抛**
+ * 给调用方(kill 已在调用前落地,受据不丢):退出边界与 E21 级联各自在外层 try 里 warn / `console.error`(生产 sink 不抛,
+ * `observability/logger.ts` 的 `emit` 已包),停止口则让它走全局 500 —— 不在这里写静默的空 catch([ref] 棘轮)。
+ * `outcome` 按 core 闭集穷举分派:集外词 = 编译红(`never` 臂),不是运行期的静默默认。
+ */
+export declare function reportHardKillReceipts(logger: Pick<Logger, "info"> | undefined, receipts: readonly BackgroundShellHardKillReceipt[], reason: string): HardKillTally;
+/** {@link reapSessionBackgroundHard} 的读数。 */
+export interface SessionHardReap {
+    /** 软面①(core 会话锚 `reapSessionBackground`)直接收到的行数(core 口径:不含受委托子代连带收掉的孙行)。 */
+    reaped: number;
+    /** 软面②(TaskStop 面)发出的行数:硬面将收、而会话锚没收的仍在跑的 shell 行(`includeRetained:true` 时的 retain 行 / 本会话 run 的
+     *  非会话驻留行)。 */
+    softStopped: number;
+    /** 硬面逐行受据(只有 shell 行:`background_bash` / `monitor`)。 */
+    receipts: BackgroundShellHardKillReceipt[];
+    tally: HardKillTally;
+}
+/**
+ * **会话级收敛 —— 一只函数,「软 → 宽限 → 硬」**(车OL O1 / O2):
+ *  ① 软面:core 会话锚 `reapSessionBackground(sessionId, scope)`(本会话会话驻留、非 retain 的行走 env 梯子;同时结算本会话的后台
+ *     agent / workflow),再 {@link softStopRemaining}(硬面将收、会话锚没收的仍在跑的 shell 行,逐行 TaskStop 软面);
+ *  ② 宽限:{@link awaitSoftStopGraces} —— 硬面不早于它将重访的任何一行的「软停时刻 + `HOST_BG_KILL_GRACE_MS`」(host 梯子的属主常量,
+ *     `plugins/remote-env-host.ts` 导出,不另抄;不分车道)。本次刚软停的行 ⇒ 等满一次宽限;几十毫秒前被另一次收敛 / 模型 TaskStop 软停
+ *     的行 ⇒ 等它剩下的那段;都不在宽限内 ⇒ 不等。同一会话两次重叠收敛(壳先打停止口、别处再 DELETE)因此都不早于前者软停 + 宽限,
+ *     不需要按会话单飞;
+ *  ③ 硬面:`killAllBackgroundShellsNow({ sessionId, scope, includeRetained, reason })`(会话过滤 = 会话锚自己的键:本会话的会话驻留行
+ *     + run 的 task id 就是会话 id 的 run 行;同一个 id 在别的 scope 是别的会话;别的会话的行永远不碰)—— 宽限里跑完处理器的进程答
+ *     `already_gone`,屏蔽 / 没跑完的在这一枪组 SIGKILL(与 host 梯子自己到点的那一枪同拍,两枪都是组 SIGKILL,幂等)。同拍是设计内的:
+ *     两枪谁先是同一毫秒的定时器次序。硬面先打 ⇒ `killed`;梯子先打、引擎还没收割组长 ⇒ 硬面那一枪落在只剩僵尸的组上:darwin EPERM ⇒
+ *     `no_pgid`(未确认)、linux ⇒ `killed`;已收割 ⇒ `already_gone`。受据按观察答(S-769 车PA 删了「已硬收过」闩:组信号任一成员收到即
+ *     成功,闩在部分送达时把活着读成没了),本函数也不为「让硬面先打」挪任何一拍。
+ *
+ * `scope` = 会话行属主 `owner ?? "default"`(与 core 注册铸值 `spec.principal ?? "default"` 同源 —— 缺席 scope 在 core 的
+ * `canAccess` 上 fail-closed、一行都收不到,[ref] 钉过这一病)。
+ *
+ * 两处调用(见文件头 ①),都 `await`:E21 删除级联 `includeRetained:false`(显式活服务照留);停止口照传请求体。应答在硬面之后发,
+ * 代价 = 有 shell 行刚被软停的会话,DELETE / 停止口的应答慢到最后一行的「软停 + 宽限」(通常一次宽限;操作员旋钮 `HOST_BG_KILL_GRACE_MS`,缺省 1000;要几乎不等写 `1` ——
+ * `numEnvOr` 把 `0` 读作缺席、回落缺省,与它供的其余执行车道旋钮同一条语义)。
+ * 受委托帮手的 shell 挂在帮手自己的会话上,本函数碰不到(core KL-1107a / #1109,候 core)。
+ * 注册表是**进程内**的:只收本副本上的行(多副本部署里别的副本上的行由那个副本自己的出口收)。
+ */
+export declare function reapSessionBackgroundHard(sessionId: string, scope: string, opts: {
+    includeRetained: boolean;
+    reason: string;
+}, logger: Pick<Logger, "info" | "warn"> | undefined): Promise<SessionHardReap>;
+//# sourceMappingURL=background-session-reap.d.ts.map

package/dist/background-session-reap.js

@@ -0,0 +1,90 @@
+import { setTimeout as delay } from "node:timers/promises";
+import { defaultTaskRegistry } from "@sema-agent/core";
+import { HOST_BG_KILL_GRACE_MS } from "./plugins/remote-env-host.js";
+export function reportHardKillReceipts(logger, receipts, reason) {
+    const tally = { killed: 0, alreadyGone: 0, retainedSkipped: 0, unconfirmed: 0 };
+    for (const r of receipts) {
+        switch (r.outcome) {
+            case "killed":
+                tally.killed++;
+                break;
+            case "already_gone":
+                tally.alreadyGone++;
+                break;
+            case "retained_skipped":
+                tally.retainedSkipped++;
+                break;
+            case "no_pgid":
+                tally.unconfirmed++;
+                break;
+            default: {
+                const unreachable = r.outcome;
+                return unreachable;
+            }
+        }
+        logger?.info("background_shell_hard_kill", {
+            taskId: r.taskId,
+            type: r.type,
+            outcome: r.outcome,
+            reason,
+            ...(r.owner !== undefined ? { owner: r.owner } : {}),
+            ...(r.retained === true ? { retained: true } : {}),
+        });
+    }
+    return tally;
+}
+const SOFT_STOP_LIST_LIMIT = 500;
+const isShellRow = (type) => type === "background_bash" || type === "monitor";
+function softStopRemaining(access, includeRetained, logger) {
+    const rows = defaultTaskRegistry
+        .list(access, { limit: SOFT_STOP_LIST_LIMIT })
+        .filter((r) => r.status === "running" && isShellRow(r.type) && (r.retained !== true || includeRetained));
+    for (const r of rows) {
+        const failed = (fields) => logger?.warn("session_background_soft_stop_failed", { taskId: r.task_id, type: r.type, ...fields, note: "the hard face right after the grace still stops this row" });
+        defaultTaskRegistry.markStopSource(r.task_id, "system");
+        void defaultTaskRegistry.stopTask(r.task_id, access).then((res) => {
+            if (res.isError === true)
+                failed({ error: res.details.code ?? res.details.error ?? "stop_failed" });
+        }, (err) => failed({ error: err instanceof Error ? err.name : "stop threw" }));
+    }
+    return rows.map((r) => r.task_id);
+}
+async function awaitSoftStopGraces(access, softStop) {
+    const honored = new Set();
+    let notBefore = 0;
+    const honor = (taskId, softStoppedAt) => {
+        if (honored.has(taskId))
+            return;
+        honored.add(taskId);
+        notBefore = Math.max(notBefore, softStoppedAt + HOST_BG_KILL_GRACE_MS);
+    };
+    for (const id of softStop.stoppedNow)
+        honor(id, softStop.at);
+    for (;;) {
+        const now = Date.now();
+        const rows = defaultTaskRegistry.list(access, { limit: SOFT_STOP_LIST_LIMIT });
+        for (const r of rows) {
+            if (r.status === "killed" && isShellRow(r.type))
+                honor(r.task_id, Math.min(r.updatedAt, now));
+        }
+        if (softStop.anchorReaped > 0 && rows.length >= SOFT_STOP_LIST_LIMIT)
+            notBefore = Math.max(notBefore, softStop.at + HOST_BG_KILL_GRACE_MS);
+        if (notBefore <= now)
+            return;
+        await delay(notBefore - now);
+    }
+}
+export async function reapSessionBackgroundHard(sessionId, scope, opts, logger) {
+    const access = { owner: sessionId, sessionId, scope };
+    const reaped = defaultTaskRegistry.reapSessionBackground(sessionId, scope);
+    const stoppedNow = softStopRemaining(access, opts.includeRetained, logger);
+    const at = Date.now();
+    await awaitSoftStopGraces(access, { at, stoppedNow, anchorReaped: reaped });
+    const softStopped = stoppedNow.length;
+    const receipts = defaultTaskRegistry.killAllBackgroundShellsNow({ sessionId, scope, includeRetained: opts.includeRetained, reason: opts.reason });
+    const tally = reportHardKillReceipts(logger, receipts, opts.reason);
+    if (reaped > 0 || softStopped > 0 || receipts.length > 0)
+        logger?.info("session_background_reaped", { sessionId, reaped, softStopped, reason: opts.reason, includeRetained: opts.includeRetained, ...tally });
+    return { reaped, softStopped, receipts, tally };
+}
+//# sourceMappingURL=background-session-reap.js.map

package/dist/bake-runner/main.d.ts

@@ -11,7 +11,24 @@ interface RunnerEnv {
     idlePollMs: number;
     minFreeGb: number;
     shutdownGraceMs: number;
+    /** `BAKE_ENV_ALLOW` 的生效名单(点到、且本进程环境里真有的名;缺省空 = 子进程 env 全剥)。 */
+    envAllow: readonly string[];
 }
+/**
+ * bake-runner 的 **env 契约**(本进程只读这些;成文另见 USAGE.md §9.7):
+ *  · 必填:`IMAGE_API_BASE`(image-api 根,尾斜杠去掉)、`BAKE_RUNNER_TOKEN`(claim / heartbeat 的运维主体 bearer;不进日志、不进子进程)。
+ *  · `BAKE_RUNNER_ID`(缺省 `bake-runner-<HOSTNAME>`)、`RECIPE_REF`(缺省 `HEAD` = 用现成 checkout)、`RECIPE_DIR`(缺省 `/opt/recipes`)、
+ *    `BUILD_SH_PATH`(缺省 `e2b-template/dev-sandbox/build.sh`)、`BAKE_DATA_DIR`(缺省 `/data`)、`LOG_LEVEL`(缺省 info)。
+ *  · 数值四键(`parseNumOrFailNonNegative`,非数 / 负数拒启):`BAKE_HEARTBEAT_MS`(30000)、`BAKE_IDLE_POLL_MS`(5000)、
+ *    `IMAGE_BAKE_MIN_FREE_GB`(20)、`BAKE_SHUTDOWN_GRACE_MS`(5000)。
+ *  · `BAKE_ENV_ALLOW=NAME,NAME`(7.103.0,S-684 残余):本进程 spawn 的每一只子进程组(build.sh 与 git fetch / docker push /
+ *    docker image inspect / df)的 env 缺省 = 本进程 env 剥密(runner 自己的 `BAKE_RUNNER_TOKEN` 在内);名单点到的键从本进程 env **原样**
+ *    放回(部署方显式承担 —— 例如配方脚本真要一枚 `*_PASSWORD` 做 registry 登录)。与服务侧 `LSP_ENV_ALLOW` **同一只**解析器
+ *    (`config.ts` `parseEnvNameAllowlist`)与同一只放行谓词:形错(空段 / 尾逗号 / 非变量名形 / 点名任一只名单型旋钮)⇒ **拒启**,拒句点名
+ *    旋钮与段号、不回显值;本进程环境里没有的名 ⇒ 起服 `config_env_entry_rejected` 只报序号、不放行;旋钮原文本身按凭据类,不进子进程。
+ *    没有多租户姿态(构建宿主守护进程没有主体 / 租户);生效名单见起服行 `bake_runner_start.envAllow`(只键名)。
+ *    ⚠️ 这不是服务配置目录里的键(目录 `BAKE_*` 行是服务侧 bake API 的旋钮),服务进程不读它。
+ */
 declare function loadEnv(): RunnerEnv;
 /** The real image-api HTTP client. Authenticates claim/heartbeat with the runner bearer; ingest additionally
  *  carries the per-bake ingest secret header (so image-api can reject a stale/rogue runner — §P2.4e). */
@@ -33,8 +50,9 @@ declare function makeApiClient(env: RunnerEnv, log: BakeRunnerLogger): ImageApiC
 declare const liveGroupPgids: Set<number>;
 declare function killLiveGroupsSync(): void;
 /** The real child spawner: `setsid`-style detached process GROUP so a cancel/deadline kill signals the whole tree
- *  (channel-close / a plain kill of the immediate child does NOT stop a detached build — §P2.11). */
-declare function makeSpawner(): ChildSpawner;
+ *  (channel-close / a plain kill of the immediate child does NOT stop a detached build — §P2.11).
+ *  `envAllow` = `BAKE_ENV_ALLOW`'s effective list (the build.sh group's env = scrubbed ∪ these names). */
+declare function makeSpawner(envAllow: readonly string[]): ChildSpawner;
 /**
  * 有界、整组击杀、进簿的 `sh -c` —— **本进程唯一的 host exec 面**(C5)。
  *
@@ -42,7 +60,7 @@ declare function makeSpawner(): ChildSpawner;
  * 成功 ⇒ `{ stdout }`。多出来的两件：① `timeoutMs` 到点整组 SIGKILL 并 reject；② 它的组在 {@link liveGroupPgids}
  * 里，于是关机梯子的 ④(`process.exit`)经退出边界收得到它 —— 旧形下一只挂死的 `docker push` 是看不见也杀不死的。
  */
-export declare function execGroup(cmd: string, timeoutMs: number): Promise<{
+export declare function execGroup(cmd: string, timeoutMs: number, envAllow: readonly string[]): Promise<{
     stdout: string;
 }>;
 /** The real host ops: fs manifest read, df /data, recipe checkout, and the thin docker-push big-blob retry. */

package/dist/bake-runner/main.js

@@ -1,7 +1,9 @@
 import { spawn } from "node:child_process";
 import { readFile } from "node:fs/promises";
 import { createLogger } from "../observability/logger.js";
-import { parseNumOrFailNonNegative } from "../config.js";
+import { logConfigDiagnostics, parseEnvNameAllowlist, parseNumOrFailNonNegative } from "../config.js";
+import { installSecretEnvScrubRecorder } from "../observability/secret-env-scrub.js";
+import { hostSubprocessEnv } from "../server-secret-env.js";
 import { shellQuote as shellSafe } from "../plugins/remote-shell.js";
 import { BakeRunner, } from "./runner.js";
 const BAKE_CLAIM_INGEST_FETCH_TIMEOUT_MS = 30_000;
@@ -29,6 +31,7 @@ function loadEnv() {
         idlePollMs: parseNumOrFailNonNegative("BAKE_IDLE_POLL_MS", process.env.BAKE_IDLE_POLL_MS || "5000"),
         minFreeGb: parseNumOrFailNonNegative("IMAGE_BAKE_MIN_FREE_GB", process.env.IMAGE_BAKE_MIN_FREE_GB || "20"),
         shutdownGraceMs: parseNumOrFailNonNegative("BAKE_SHUTDOWN_GRACE_MS", process.env.BAKE_SHUTDOWN_GRACE_MS || "5000"),
+        envAllow: parseEnvNameAllowlist("BAKE_ENV_ALLOW") ?? [],
     };
 }
 function makeApiClient(env, log) {
@@ -119,7 +122,7 @@ function spawnGroupChild(opts) {
         cwd: opts.cwd,
         detached: true,
         stdio: ["ignore", "pipe", "pipe"],
-        env: process.env,
+        env: hostSubprocessEnv({ site: "server.bake-runner.spawn-env", allow: opts.envAllow }),
     });
     const pgid = child.pid ?? -1;
     pruneEmptyGroups();
@@ -158,15 +161,16 @@ function groupHasMembers(pgid) {
         return err.code === "EPERM";
     }
 }
-function makeSpawner() {
-    return { spawn: (opts) => spawnGroupChild(opts) };
+function makeSpawner(envAllow) {
+    return { spawn: (opts) => spawnGroupChild({ ...opts, envAllow }) };
 }
-export async function execGroup(cmd, timeoutMs) {
+export async function execGroup(cmd, timeoutMs, envAllow) {
     let stdout = "";
     let stderr = "";
     const append = (buf, line) => (buf.length >= BAKE_HOST_EXEC_OUTPUT_CAP ? buf : `${buf}${line}\n`);
     const child = spawnGroupChild({
         argv: ["/bin/sh", "-c", cmd],
+        envAllow,
         onStdoutLine: (l) => {
             stdout = append(stdout, l);
         },
@@ -216,7 +220,7 @@ function makeHostOps(env) {
             return JSON.parse(await readFile(path, "utf8"));
         },
         async dfData() {
-            const { stdout } = await execGroup(`df -P -BG ${shellSafe(env.dataDir)}`, BAKE_HOST_PROBE_TIMEOUT_MS);
+            const { stdout } = await execGroup(`df -P -BG ${shellSafe(env.dataDir)}`, BAKE_HOST_PROBE_TIMEOUT_MS, env.envAllow);
             return stdout;
         },
         async checkoutRecipe(ref) {
@@ -224,10 +228,10 @@ function makeHostOps(env) {
                 const dir = shellSafe(env.recipeDir);
                 try {
                     await execGroup(`git -C ${dir} fetch --depth 1 origin ${shellSafe(ref)} && ` +
-                        `git -C ${dir} checkout --quiet --detach FETCH_HEAD`, BAKE_RECIPE_CHECKOUT_TIMEOUT_MS);
+                        `git -C ${dir} checkout --quiet --detach FETCH_HEAD`, BAKE_RECIPE_CHECKOUT_TIMEOUT_MS, env.envAllow);
                 }
                 catch {
-                    await execGroup(`git -C ${dir} fetch origin && git -C ${dir} checkout --quiet --detach ${shellSafe(ref)}`, BAKE_RECIPE_CHECKOUT_TIMEOUT_MS);
+                    await execGroup(`git -C ${dir} fetch origin && git -C ${dir} checkout --quiet --detach ${shellSafe(ref)}`, BAKE_RECIPE_CHECKOUT_TIMEOUT_MS, env.envAllow);
                 }
             }
             return env.recipeDir;
@@ -235,8 +239,8 @@ function makeHostOps(env) {
         async dockerPushRetry(tag, attempts) {
             for (let i = 0; i < attempts; i++) {
                 try {
-                    await execGroup(`docker push ${shellSafe(tag)}`, BAKE_DOCKER_PUSH_TIMEOUT_MS);
-                    const { stdout } = await execGroup(`docker image inspect ${shellSafe(tag)} --format '{{index .RepoDigests 0}}'`, BAKE_HOST_PROBE_TIMEOUT_MS);
+                    await execGroup(`docker push ${shellSafe(tag)}`, BAKE_DOCKER_PUSH_TIMEOUT_MS, env.envAllow);
+                    const { stdout } = await execGroup(`docker image inspect ${shellSafe(tag)} --format '{{index .RepoDigests 0}}'`, BAKE_HOST_PROBE_TIMEOUT_MS, env.envAllow);
                     const repoDigest = stdout.trim();
                     const digest = repoDigest.includes("@") ? repoDigest.slice(repoDigest.indexOf("@") + 1) : null;
                     return { ok: true, digest };
@@ -259,16 +263,19 @@ function makeClock() {
 async function main() {
     const env = loadEnv();
     const log = createLogger(process.env.LOG_LEVEL || "info");
+    logConfigDiagnostics(log);
+    installSecretEnvScrubRecorder({ logger: log });
     log.info("bake_runner_start", {
         imageApiBase: env.imageApiBase,
         runnerId: env.runnerId,
         recipeRef: env.recipeRef,
         heartbeatMs: env.heartbeatMs,
         minFreeGb: env.minFreeGb,
+        envAllow: env.envAllow,
     });
     const runner = new BakeRunner({
         api: makeApiClient(env, log),
-        spawner: makeSpawner(),
+        spawner: makeSpawner(env.envAllow),
         host: makeHostOps(env),
         clock: makeClock(),
         log,

package/dist/boot/config-center.d.ts

@@ -1,15 +1,17 @@
+import { type ModelRefusalsSignal } from "@sema-agent/settings-schema";
 import { CenterPromptSource, type SwappableDeps } from "@sema-agent/core";
 import { buildPricing } from "../budget.js";
 import { type PromptsDomainFaces } from "../prompts-domain-validate.js";
 import { type Scenario, type ScenarioDeps, type ScenarioDetail } from "../capabilities/scenarios.js";
 import type { LoadedSkill } from "../capabilities/skills.js";
 import { type ServiceConfig } from "../config.js";
+import { type CenterCredentialHealthView } from "../center-credential-renewer.js";
 import { type ModelKeyRef } from "../key-resolver.js";
 import type { Logger } from "../observability/logger.js";
 import type { Metrics } from "../observability/metrics.js";
 import type { UnpricedCeilingVerdict } from "./unpriced-ceiling-verdict.js";
 import type { ConsolidationSeatWatch } from "./memory-consolidation.js";
-import { type RestartSignal } from "../config-center/facade.js";
+import { type EngineRestartSignal } from "../config-center/facade.js";
 import { type ConfigApplyLedgerView } from "../config-center/apply-ledger.js";
 import type { LimitSync } from "./limit-sync.js";
 export interface ConfigCenterRuntimeCtx {
@@ -27,6 +29,8 @@ export interface CenterScenarioOverlayTargets {
     /** overlay 前捕获的六内建名(centerScenarioDetails 的 shadow 判据)。 */
     builtinScenarioNames: string[];
 }
+/** S-740 / S-741 / S-768:config-center 持有的三样自报状态(fleet 心跳读它们)—— 闭集:加一样 = 写口与订阅方一起表态。 */
+export type SelfReportChange = "roster_landed" | "restart_signal" | "model_refusals";
 /** 跨段可变状态的**唯一**对外读口 + 三个原位动作。字段语义见各方法上的注释。 */
 export interface ConfigCenterRuntime {
     /** 配置源形态;`undefined` = 纯 env 部署(本运行时的所有分支不存在)。 */
@@ -64,8 +68,10 @@ export interface ConfigCenterRuntime {
         consolidationSeat?: ConsolidationSeatWatch;
         checkpointStorePresent: boolean;
     }): void;
-    /** [ref]-2:停刷新环(hardShutdown 收尾链;幂等,未起环时 no-op)。 */
+    /** [ref]-2:停刷新环(hardShutdown 收尾链;幂等,未起环时 no-op)。S-698:中心凭证续签器的定时器同停(同一条收尾链)。 */
     stopRefreshLoop(): void;
+    /** S-698:`/health.centerCredential` 的取值口 —— 凭证来源的健康态 + 续签器状态;都健康 / 没有中心 ⇒ `undefined`(键缺席)。 */
+    centerCredentialState(): CenterCredentialHealthView | undefined;
     /** [ref](core 5.50 [ref]):mid-turn MCP 撤销台账读口,喂 `RunnerDeps.mcpRevocations` 席。
      *  **取走即声明接线**——调用本方法后,restart 信号的 mcp 片对纯删除向豁免(台账即时承接);
      *  不取 ⇒ 旧 restart 语义逐字保留(fail-closed)。 */
@@ -83,8 +89,19 @@ export interface ConfigCenterRuntime {
     /** boot ready 门:布防(`CONFIG_REQUIRE_ROSTER=true`,远程 registry 非 dryRun)且 roster 未落地 =
      *  计费提交 503 + /health ready:false。缺省未布防 ⇒ 恒 true。 */
     modelReady(): boolean;
-    /** /health.restart(orchestrator 自动重启信号)。 */
-    restartState(): RestartSignal | undefined;
+    /** S-740 / S-741:本副本**自报状态**里由 config-center 持有的那两样 —— roster 落地(`modelReady` 翻真,one-way latch)与
+     *  restart 信号(`restartState()` 出现 / 消失 / 变)—— 任一翻转的那一拍通知订阅者。装配层接 fleet 心跳的 `announceNow`,
+     *  让中心在翻转当刻就知道本副本可路由 / 要重启(不等下一拍心跳;draining 那一样由收尾链直调 `announceNow`,同一个触发)。
+     *  在状态**写定之后**调用,同步、逐个,入参 = 这一次翻的是哪一样(闭集 {@link SelfReportChange});不回放(订阅方在订阅前已读过
+     *  当刻值)。同一拍两样都翻 ⇒ 通知两次(心跳侧 `announceNow` 单飞合并,见 fleet-client)。订阅者抛错只 warn
+     *  (`self_report_listener_failed`),不打断配置拍、不吞后一个订阅者。 */
+    onSelfReportChange(listener: (changed: SelfReportChange) => void): void;
+    /** /health.restart 与 fleet 心跳 `restart` 的**同一只**取值口(orchestrator 自动重启信号;settings-schema `RestartSignal` 形)。 */
+    restartState(): EngineRestartSignal | undefined;
+    /** S-768:`/health.modelRefusals` 与 fleet 心跳 `modelRefusals` 的**同一只**取值口(settings-schema 6.2.0 `ModelRefusalsSignal` 形:
+     *  名 → 码 + 组拒码)。描述**最近一次被判的那份中心候选目录**(每次候选 apply 的报告 `ApplyReport.modelRefusals` 投影;组拒时就是被拒
+     *  的那份 —— 引擎自己的拒因表不换代)。没有可报的拒 / 没有配置管道 / 还没判过候选 ⇒ `undefined`(键缺席)。值变了 ⇒ 通知自报订阅者。 */
+    modelRefusalsState(): ModelRefusalsSignal | undefined;
     /** /health.modelPlaneDeferred:被扣着、还没有 next-boot handoff 的候选(codex R18 起的状态机)。S-668 波 0 起
      *  模型面不再 defer,键名保留,今天承载的是 durable LKG 发布债与 skills 债(见 `planeDeferredNoHandoff`)。 */
     planeDeferredState(): {

package/dist/boot/config-center.js

@@ -3,7 +3,9 @@ import { readFile as fsReadFile } from "node:fs/promises";
 import { homedir } from "node:os";
 import { join } from "node:path";
 import { loadRemoteExec } from "@sema-agent/settings-schema/node";
-import { skillContentHash } from "@sema-agent/settings-schema";
+import { CENTER_CREDENTIAL_ENV, skillContentHash } from "@sema-agent/settings-schema";
+import { stableStringify } from "@sema-agent/settings-schema/hash";
+import { buildModelRefusalsSignal } from "../model-entry-refusal.js";
 import { CenterPromptSource, FilePromptArtifactStore, FilePromptSourceStateStore, MemoryPromptArtifactStore, MemoryPromptSourceStateStore, } from "@sema-agent/core";
 import { buildPricing } from "../budget.js";
 import { applyCenterPlugins } from "../capabilities/center-plugins.js";
@@ -12,7 +14,8 @@ import { validatePromptsDomain, CORE_ENGINE_VERSION } from "../prompts-domain-va
 import { centerScenarios, centerScenarioDetails } from "../capabilities/scenarios.js";
 import { configLkgEnabled, isRosterGateArmed } from "../config.js";
 import { defaultLkgPath, defaultSkillCacheDir, saveLkg, loadLkg, legacyV1LkgPath, migrateV1Lkg } from "../config-lkg.js";
-import { answerStillCurrent, centerStateBin, credentialIdentityNow } from "../center-credential.js";
+import { answerStillCurrent, centerStateBin, credentialIdentityNow, judgeCenterCredentialAtBoot } from "../center-credential.js";
+import { buildCenterCredentialHealthView, createCenterCredentialRenewer } from "../center-credential-renewer.js";
 import { centerManagedConfigKeys } from "../config-center/apply-effective.js";
 import { createConfigProvider, raceBootFetch, BOOT_FETCH_DEFERRED } from "../config-provider.js";
 import { executionLaneCaps, executionLaneOf } from "../execution-lane-caps.js";
@@ -61,15 +64,18 @@ export async function createConfigCenterRuntime(ctx) {
     let planeDeferredNoHandoff;
     let bootSkillStale = false;
     let pendingRestart;
+    let modelRefusals;
     const cc = config.configCenter;
     const bootCredential = cc?.credential.read();
-    if (cc !== undefined && bootCredential !== undefined && !bootCredential.ok) {
-        logger.error("center_credential_unreadable", {
-            key: "SEMA_REGISTRY_TOKEN_FILE",
-            reason: bootCredential.reason,
-            effect: "every center request fails its own failure arm until the file is readable (config pull keeps env/LKG-less boot, caps fail-closed, lease takes the loud auth-error arm); no on-disk LKG / prompt state is read back (credential identity unknown)",
-        });
+    const bootVerdict = bootCredential === undefined ? undefined : judgeCenterCredentialAtBoot(bootCredential);
+    if (bootVerdict?.verdict === "refuse")
+        throw new Error(bootVerdict.sentence);
+    if (bootVerdict?.verdict === "loud") {
+        logger.error("center_credential_unreadable", { key: CENTER_CREDENTIAL_ENV.tokenFile, failure: bootVerdict.failure, reason: bootVerdict.reason, effect: bootVerdict.effect });
     }
+    const credentialRenewer = cc !== undefined && cc.credential.origin.from === "file"
+        ? createCenterCredentialRenewer({ source: cc.credential, centerUrl: cc.baseUrl, leadMs: config.centerCredentialRenewLeadMs, logger })
+        : undefined;
     const currentIdentity = () => (cc === undefined ? undefined : credentialIdentityNow(cc.credential));
     const candidateIdentity = new WeakMap();
     const candidateIdentityOf = (eff) => candidateIdentity.get(eff);
@@ -134,12 +140,41 @@ export async function createConfigCenterRuntime(ctx) {
             });
         }
     };
+    const selfReportListeners = [];
+    const notifySelfReport = (changed) => {
+        for (const listener of selfReportListeners) {
+            try {
+                listener(changed);
+            }
+            catch (err) {
+                logger.warn("self_report_listener_failed", { changed, error: err instanceof Error ? err.message : String(err), note: "a self-report subscriber threw; the state change stands regardless and the next fleet heartbeat carries it" });
+            }
+        }
+    };
     const markRosterLanded = (eff) => {
         if (!modelReadyState.ready && (eff.models?.models ?? []).some((m) => m.enabled !== false)) {
             modelReadyState.ready = true;
             logger.info("model_roster_landed", { note: "ready gate open — billable submissions accepted" });
+            notifySelfReport("roster_landed");
         }
     };
+    const publishRestart = (next) => {
+        const prev = pendingRestart;
+        pendingRestart = next;
+        const same = prev === undefined || next === undefined ? prev === next : prev.version === next.version && prev.since === next.since && prev.reasons.length === next.reasons.length && prev.reasons.every((r, i) => r === next.reasons[i]);
+        if (!same)
+            notifySelfReport("restart_signal");
+    };
+    const publishModelRefusals = (next) => {
+        const same = stableStringify(modelRefusals ?? null) === stableStringify(next ?? null);
+        modelRefusals = next;
+        if (!same)
+            notifySelfReport("model_refusals");
+    };
+    const recordApply = (rep) => {
+        applyLedger.recordApply(rep);
+        publishModelRefusals(buildModelRefusalsSignal(rep.modelRefusals));
+    };
     let centerPrompts;
     let pendingCatalogFaces;
     const retryPendingCatalog = async (phase) => {
@@ -380,7 +415,7 @@ export async function createConfigCenterRuntime(ctx) {
                 generation: lkgGen,
                 report: (rep) => {
                     lkgReport = rep;
-                    applyLedger.recordApply(rep);
+                    recordApply(rep);
                 },
             });
             applyLedger.applied(lkgGen, lkgR.effective.version);
@@ -449,7 +484,7 @@ export async function createConfigCenterRuntime(ctx) {
                         generation: bootGen,
                         report: (rep) => {
                             bootReport = rep;
-                            applyLedger.recordApply(rep);
+                            recordApply(rep);
                         },
                     });
                     applyLedger.applied(bootGen, r.effective.version);
@@ -566,7 +601,11 @@ export async function createConfigCenterRuntime(ctx) {
         getKeyResolver: () => keyResolver,
         getCenterPrompts: () => centerPrompts,
         modelReady: () => modelReadyState.ready,
+        onSelfReportChange: (listener) => {
+            selfReportListeners.push(listener);
+        },
         restartState: () => pendingRestart,
+        modelRefusalsState: () => modelRefusals,
         planeDeferredState: () => planeDeferredNoHandoff,
         configApplyState: () => (configProvider ? applyLedger.view() : undefined),
         centerManagedKeys: () => (configProvider ? centerManagedConfigKeys(latestEffective) : undefined),
@@ -663,7 +702,7 @@ export async function createConfigCenterRuntime(ctx) {
                     if (liveSkillMiss)
                         bootSkillStale = true;
                     if (liveSkillMiss && (bootPublished || (!lkgSurvivesRestart && lastPrewarmBodiesVerified))) {
-                        pendingRestart = { restartRequired: true, reasons: ["skills"], version: bootLkgCandidate.effective.version, since: Date.now() };
+                        publishRestart({ reasons: ["skills"], version: bootLkgCandidate.effective.version, since: Date.now() });
                         logger.warn("config_boot_skill_stale_restart", { version: bootLkgCandidate.effective.version, durableHandoff: bootPublished, note: bootPublished ? "live skill application incomplete but the durable LKG carries the full candidate — skills restart published (the next boot reads the complete LKG)" : "live skill application incomplete on a non-durable deployment but every enabled body is verified in the cache — skills restart published (transient failure proven repaired; the restarted process re-pulls live)" });
                     }
                     else if (liveSkillMiss || (!bootPublished && lkgSurvivesRestart)) {
@@ -719,14 +758,14 @@ export async function createConfigCenterRuntime(ctx) {
                             const promoted = lkgSurvivesRestart || skillsDebt ? await persistLkgDurable(planeDeferredNoHandoff.candidate, planeDeferredNoHandoff.candidateEtag) : false;
                             const skillsProofPromotion = !promoted && !lkgSurvivesRestart && skillsDebt && lastPrewarmBodiesVerified;
                             if (skillsProofPromotion) {
-                                pendingRestart = { restartRequired: true, reasons: ["skills"], version: planeDeferredNoHandoff.version, since: Date.now() };
+                                publishRestart({ reasons: ["skills"], version: planeDeferredNoHandoff.version, since: Date.now() });
                                 logger.info("config_boot_skill_debt_promoted", { version: planeDeferredNoHandoff.version, note: "skill bodies verified on a source-confirmed-current candidate — the withheld skills restart is now published (non-durable lane, repair proven)" });
                                 planeDeferredNoHandoff = undefined;
                             }
                             else if (promoted) {
                                 const promotedReasons = [...new Set(planeDeferredNoHandoff.blocked ?? [])];
                                 if (promotedReasons.length > 0) {
-                                    pendingRestart = { restartRequired: true, reasons: promotedReasons, version: planeDeferredNoHandoff.version, since: Date.now() };
+                                    publishRestart({ reasons: promotedReasons, version: planeDeferredNoHandoff.version, since: Date.now() });
                                 }
                                 logger.info("models_tiers_deferred_promoted", { version: planeDeferredNoHandoff.version, reasons: promotedReasons, note: promotedReasons.length > 0 ? "handoff persistence recovered on a source-confirmed-current candidate — the withheld restart signal is now published" : "boot publication retry completed — LKG now durable, no restart needed (nothing was withheld)" });
                                 planeDeferredNoHandoff = undefined;
@@ -775,7 +814,7 @@ export async function createConfigCenterRuntime(ctx) {
                                     generation: tickGen,
                                     report: (rep) => {
                                         applyReport = rep;
-                                        applyLedger.recordApply(rep);
+                                        recordApply(rep);
                                     },
                                     ...(planeChanged ? { swapPlane: swapRunnerDeps } : {}),
                                 });
@@ -826,13 +865,13 @@ export async function createConfigCenterRuntime(ctx) {
                                     }
                                 }
                                 if (reasons.length === 0) {
-                                    pendingRestart = undefined;
+                                    publishRestart(undefined);
                                 }
                                 else if (!pendingRestart || pendingRestart.reasons.join(",") !== reasons.join(",")) {
-                                    pendingRestart = { restartRequired: true, reasons, version: r.effective.version, since: Date.now() };
+                                    publishRestart({ reasons, version: r.effective.version, since: Date.now() });
                                 }
                                 else {
-                                    pendingRestart = { ...pendingRestart, version: r.effective.version };
+                                    publishRestart({ ...pendingRestart, version: r.effective.version });
                                 }
                                 logger.info("sema_registry_refreshed", {
                                     version: r.effective.version,
@@ -907,7 +946,7 @@ export async function createConfigCenterRuntime(ctx) {
                         generation: lateGen,
                         report: (rep) => {
                             applyReportLate = rep;
-                            applyLedger.recordApply(rep);
+                            recordApply(rep);
                         },
                         ...(planeChangedLate ? { swapPlane: swapRunnerDeps } : {}),
                     });
@@ -949,7 +988,7 @@ export async function createConfigCenterRuntime(ctx) {
                         logger.warn("restart_candidate_publication_incomplete", { version: r.effective.version, blockedReasons: blocked, note: "late-boot candidate publication incomplete on a durable-declared deployment — restart signal withheld; retried every tick" });
                     }
                     if (reasons.length > 0)
-                        pendingRestart = { restartRequired: true, reasons, version: r.effective.version, since: Date.now() };
+                        publishRestart({ reasons, version: r.effective.version, since: Date.now() });
                     logger.info("config_loaded_deferred", { source: configProvider.kind, version: r.effective.version, models: (r.effective.models?.models ?? []).filter((m) => m.enabled !== false).length, ...(reasons.length > 0 ? { restartRequired: true, restartReasons: reasons } : {}) });
                 };
                 if (bootConfigPending) {
@@ -971,6 +1010,10 @@ export async function createConfigCenterRuntime(ctx) {
                 clearInterval(ccTimer);
                 ccTimer = undefined;
             }
+            credentialRenewer?.stop();
+        },
+        centerCredentialState() {
+            return cc === undefined ? undefined : buildCenterCredentialHealthView(cc.credential.health(), credentialRenewer);
         },
     };
 }

package/dist/boot/exit-boundary.js

@@ -1,6 +1,8 @@
 import { defaultTaskRegistry } from "@sema-agent/core";
+import { reportHardKillReceipts } from "../background-session-reap.js";
 import { liveHostForegroundChildCount, reapHostForegroundChildren } from "../plugins/host-platform.js";
 import { liveEphemeralHostWorkspaceCount, reapEphemeralHostWorkspaces } from "../plugins/host-workspace-registry.js";
+const PROCESS_EXIT_INCLUDES_RETAINED = false;
 export function installProcessExitBoundary({ logger }) {
     const reapOwnChildProcesses = () => {
         try {
@@ -22,6 +24,15 @@ export function installProcessExitBoundary({ logger }) {
             logger.warn("shutdown_foreground_reap_failed", { err: String(err) });
         }
     };
+    const reapBackgroundHard = () => {
+        try {
+            const receipts = defaultTaskRegistry.killAllBackgroundShellsNow({ includeRetained: PROCESS_EXIT_INCLUDES_RETAINED, reason: "process_exit" });
+            reportHardKillReceipts(logger, receipts, "process_exit");
+        }
+        catch (err) {
+            logger.warn("shutdown_background_hard_kill_failed", { err: String(err) });
+        }
+    };
     const reapOwnHostWorkspaces = () => {
         try {
             const { removed, failed } = reapEphemeralHostWorkspaces();
@@ -42,6 +53,12 @@ export function installProcessExitBoundary({ logger }) {
         catch (err) {
             console.error("shutdown_exit_boundary_child_reap_threw", err);
         }
+        try {
+            reapBackgroundHard();
+        }
+        catch (err) {
+            console.error("shutdown_exit_boundary_background_hard_kill_threw", err);
+        }
         try {
             reapOwnHostWorkspaces();
         }

package/dist/boot/runner-deps.js

@@ -180,6 +180,7 @@ export function createRunnerDeps(ctx) {
         onAsk: createRunnerDepsOnAsk(toolApproval),
         autoMode: {
             ...(config.autoModeClassifierFallback !== undefined ? { classifierFallback: config.autoModeClassifierFallback } : {}),
+            ...(config.autoModeClassifierTimeoutMs !== undefined ? { timeoutMs: config.autoModeClassifierTimeoutMs } : {}),
         },
         sessionStore,
         memoryBackend: memoryEngine ? memoryEngine.backend : undefined,

package/dist/boot/runtime-caps.js

@@ -1,5 +1,6 @@
 import { applyGovernedVerdictAbsenceWarning, applyLocalAutoModeDeny, applyMemoryOptOutGrant, applyObserverEnvOptIn, centerEntitlementSourceWired, createPrincipalEntitlementsClient, } from "../runtime-caps-resolver.js";
 import { scopedTokenNeedsWorker } from "../center-credential.js";
+import { CENTER_CREDENTIAL_ENV } from "@sema-agent/settings-schema";
 export function assertMemoryCapturePolicyWirable(input) {
     if (input.policy !== "governed")
         return;
@@ -13,7 +14,7 @@ export function assertMemoryCapturePolicyWirable(input) {
         `refusal would read as an entitlement denial rather than the misconfiguration it is. This version has TWO verdict sources ` +
         `— wire either one: (1) the \`memory_optout_grant\` table on a SQL store backend (DB_BACKEND=mysql|pg; the table is ` +
         `created by the central ensureSchema and administered through /v1/admin/memory-optout), or (2) a config center that ` +
-        `EMITS \`allowMemoryOptOut\` in each principal's entitlement caps (SEMA_REGISTRY_URL + SEMA_REGISTRY_TOKEN, ` +
+        `EMITS \`allowMemoryOptOut\` in each principal's entitlement caps (SEMA_REGISTRY_URL + ${CENTER_CREDENTIAL_ENV.token}, ` +
         `SEMA_REGISTRY_DRY_RUN off — dry-run observes without applying, so it is not a source; and note the key is OPTIONAL in ` +
         `the entitlement schema: a center that never emits it leaves every verdict absent, i.e. every opt-out still refused). ` +
         `Or set MEMORY_CAPTURE_POLICY=open (opt-outs take effect; only an explicit per-principal false denies) or ` +
@@ -39,7 +40,7 @@ export function createRuntimeCaps(ctx) {
     }
     if (centerEntitlementSourceWired(config) && config.configCenter && scopedTokenNeedsWorker(config.configCenter.credential.read(), config.configCenter.worker)) {
         logger.warn("runtime_caps_scoped_token_no_worker", {
-            reason: "SEMA_REGISTRY_TOKEN is a worker-scoped wpt_ token but SEMA_REGISTRY_WORKER is unset → center 403s per-principal caps → ALL workflow self-orchestration will be fail-closed denied. Set SEMA_REGISTRY_WORKER (the orchestrator normally injects it) or use the full SERVICE_PULL_TOKEN.",
+            reason: `${CENTER_CREDENTIAL_ENV.token} is a worker-scoped wpt_ token but SEMA_REGISTRY_WORKER is unset → center 403s per-principal caps → ALL workflow self-orchestration will be fail-closed denied. Set SEMA_REGISTRY_WORKER (the orchestrator normally injects it) or use the full SERVICE_PULL_TOKEN.`,
         });
     }
     const principalCaps = centerEntitlementSourceWired(config) && config.configCenter