@sema-agent/server 7.104.0 → 7.106.0

package/dist/key-resolver.d.ts

@@ -1,27 +1,79 @@
 import type { Model } from "@sema-agent/core";
-import { type SealedKeyPoison } from "./sealed-key.js";
+/** 托管密钥解不开的三个成因(**托管**失败;密文形错归 S-704 `config.model_entry_invalid`,旧词 `unsupported_alg` 已随之退役)。 */
+export type SealedCustodyPoisonReason = "sealed_decrypt_failed" | "stale_ciphertext" | "no_key_store";
+/** 毒丸成因全集(闭集;拒句按它穷举)。 */
+export type ModelKeyPoisonReason = SealedCustodyPoisonReason | "env_missing";
+/**
+ * 毒丸 —— **只带诊断**(来源身份 + 成因 + 检测时刻),从不带密文、明文或变量的值(每一个序列化面平凡地零秘密)。
+ *  · `source:"sealed"`:`publicKeyId` = 密文指向的钥匙对;`errKind` = 解封失败的错误**类名**(不是消息;消息在植入那一刻已进日志)。
+ *  · `source:"env"`:`apiKeyEnv` = 目录声明的变量**名**。
+ */
+export type ModelKeyPoison = {
+    readonly modelKeyPoison: true;
+    readonly source: "sealed";
+    readonly reason: SealedCustodyPoisonReason;
+    readonly publicKeyId: string;
+    readonly errKind?: string;
+    /** ISO timestamp of the apply that detected the failure. */
+    readonly at: string;
+} | {
+    readonly modelKeyPoison: true;
+    readonly source: "env";
+    readonly reason: "env_missing";
+    readonly apiKeyEnv: string;
+    /** ISO timestamp of the resolve that detected the absence. */
+    readonly at: string;
+};
+/** `config.modelApiKeys` 里能植的那一种(env 来源的毒丸由链现判,不进表)。 */
+export type SealedCustodyPoison = Extract<ModelKeyPoison, {
+    source: "sealed";
+}>;
+/** 铸毒丸(纯数据 ⇒ 加上标记与检测时刻)。重载让调用方拿到它那一种的窄型。 */
+export declare function modelKeyPoison(p: {
+    source: "sealed";
+    reason: SealedCustodyPoisonReason;
+    publicKeyId: string;
+    errKind?: string;
+}): SealedCustodyPoison;
+export declare function modelKeyPoison(p: {
+    source: "env";
+    reason: "env_missing";
+    apiKeyEnv: string;
+}): ModelKeyPoison;
+export declare function isModelKeyPoison(v: unknown): v is ModelKeyPoison;
+/** 毒丸的来源身份(托管 ⇒ `publicKeyId`;env ⇒ 变量名)—— 指纹与日志的读口,穷举 switch。 */
+export declare function modelKeyPoisonIdentity(p: ModelKeyPoison): string;
+/**
+ * The task-level fail-loud face of a poison pill: thrown by the key resolver on EVERY brain call that would otherwise
+ * authenticate this model, so an unusable declared key fails the task visibly instead of silently burning the gateway
+ * account. Carries the poison (diagnosis only) — nothing secret, by construction of {@link ModelKeyPoison}.
+ */
+export declare class ModelKeyPoisonedError extends Error {
+    readonly poison: ModelKeyPoison;
+    readonly reason: ModelKeyPoisonReason;
+    readonly at: string;
+    constructor(modelName: string, poison: ModelKeyPoison);
+}
 /**
  * Build a per-model API-key resolver for `TaskSpec.getApiKeyAndHeaders` from the catalog's
  * name → env-var-NAME map (sema-registry `apiKeyEnv`). core threads this per brain call — and per cascade
  * rung — so each model/rung authenticates with its OWN upstream account/key.
  *
- * Additive by construction: a model absent from the map — or whose env var is unset — returns
- * `undefined`, so core falls back to the brain's construction-time gateway key (today's behavior, no
- * regression). When no per-model keys are configured at all this returns `undefined`, leaving the spec
- * field unset so core's default path is byte-for-byte unchanged.
+ * A model absent from BOTH maps returns `undefined`, so core falls back to the brain's construction-time
+ * gateway key — that is the operator's choice (the entry declared no key of its own). A model that DECLARED
+ * a key it cannot get (poisoned sealed key, or an `apiKeyEnv` whose variable is missing / empty in this
+ * process) THROWS {@link ModelKeyPoisonedError} — never `undefined` (S-896). When no per-model keys are
+ * configured at all this returns `undefined`, leaving the spec field unset so core's default path is
+ * byte-for-byte unchanged.
  *
  * Only the api KEY is per-model; the base URL stays brain-owned ([ref]) — core's seam carries
- * `{ apiKey, headers? }`, not a baseUrl. Same-account-rotation could round-robin inside this function.
+ * `{ apiKey, headers? }`, not a baseUrl.
  *
  * `modelApiKeys` (sealed-box custody) carries per-model entries unsealed from `ModelEntry.sealedApiKey` —
- * resolved FIRST (sealed outranks the env-NAME reference, the registry-core mutual-exclusion ruling). Each
- * entry is either the PLAINTEXT key (successful unseal) or a `SealedKeyPoison` marker (unseal FAILED at
- * apply time): a poisoned model THROWS `SealedKeyPoisonedError` on every resolve — task-level fail-loud —
- * because returning `undefined` here means "use the gateway key", and a broken sealed key must NEVER
- * silently burn the shared gateway account (the core invariant of the poison-pill fix; a poisoned model
- * skips its env reference too, same mutual-exclusion as a healthy sealed key). The maps are disjoint by
- * construction in applyEffective (a sealed model never lands in modelApiKeyEnv); the ordering here is
- * belt-and-suspenders. 🔴 Plaintext values are live secrets: memory-only, never log them.
+ * resolved FIRST (sealed outranks the env-NAME reference, the registry-core mutual-exclusion ruling; a
+ * poisoned sealed model skips its env reference too). The maps are disjoint by construction in
+ * applyEffective (a sealed model never lands in modelApiKeyEnv); the ordering here is belt-and-suspenders.
+ * 🔴 Plaintext values are live secrets: memory-only, never log them.
  */
 /** The ONE field the per-model key plane keys on. The resolver's parameter is deliberately this minimal
  *  named ref (not the full core `Model`): full models are structural supersets and pass unchanged, while
@@ -29,12 +81,14 @@ import { type SealedKeyPoison } from "./sealed-key.js";
  *  can mint `{ name }` legally instead of forcing it through an `as never` escape hatch (B1). Contravariance
  *  keeps the resolver assignable wherever `(model: Model) => …` is expected. */
 export type ModelKeyRef = Pick<Model, "name">;
-export declare function createKeyResolver(modelApiKeyEnv: Record<string, string>, env?: NodeJS.ProcessEnv, modelApiKeys?: Record<string, string | SealedKeyPoison>): ((model: ModelKeyRef) => Promise<{
+export declare function createKeyResolver(modelApiKeyEnv: Record<string, string>, env?: NodeJS.ProcessEnv, modelApiKeys?: Record<string, string | SealedCustodyPoison>): ((model: ModelKeyRef) => Promise<{
     apiKey: string;
 } | undefined>) | undefined;
+/** 「这只模型声明的钥匙来源今天拿不到」⇒ 那一只毒丸;拿得到 / 没声明 ⇒ `undefined`。能力面的配对标注据它答 `"unknown"`(判别,不是 catch)。 */
+export declare function modelKeyPoisonOf(modelName: string, modelApiKeyEnv: Record<string, string>, env?: NodeJS.ProcessEnv, modelApiKeys?: Record<string, string | SealedCustodyPoison>): ModelKeyPoison | undefined;
 /**
  * The ONE per-model key chain, synchronous: **sealed custody → env-NAME reference → (caller's) gateway key**,
- * with a poisoned sealed entry THROWING instead of returning undefined. `createKeyResolver` is the async
+ * with a declared-but-unusable source THROWING instead of returning undefined. `createKeyResolver` is the async
  * `getApiKeyAndHeaders` face of exactly this function — every other consumer must call it rather than
  * re-implement a subset of the chain.
  *
@@ -42,8 +96,9 @@ export declare function createKeyResolver(modelApiKeyEnv: Record<string, string>
  * 降级目标(按互斥契约**永不**落 modelApiKeyEnv)于是静默拿网关 key 打自己的网关(错 key 打上游),毒丸更
  * 被当成"没配 key"。链只有一条,重复实现就会长出这种半条链的偏差,故此处抽出同步内核共用。
  *
- * `undefined` = this model has no per-model key ⇒ the CALLER's gateway/default credential applies (the
- * additive contract). An empty env value counts as unset (unchanged from the original inline chain).
+ * `undefined` = this model DECLARED no per-model key ⇒ the CALLER's gateway/default credential applies (the
+ * additive contract). A declared env reference whose variable is missing or empty throws (S-896; 7.105.0 and
+ * earlier answered `undefined` there — the silent gateway fallback this family removes).
  */
-export declare function resolveModelApiKey(modelName: string, modelApiKeyEnv: Record<string, string>, env?: NodeJS.ProcessEnv, modelApiKeys?: Record<string, string | SealedKeyPoison>): string | undefined;
+export declare function resolveModelApiKey(modelName: string, modelApiKeyEnv: Record<string, string>, env?: NodeJS.ProcessEnv, modelApiKeys?: Record<string, string | SealedCustodyPoison>): string | undefined;
 //# sourceMappingURL=key-resolver.d.ts.map

package/dist/key-resolver.js

@@ -1,4 +1,46 @@
-import { isSealedKeyPoison, SealedKeyPoisonedError } from "./sealed-key.js";
+export function modelKeyPoison(p) {
+    const at = new Date().toISOString();
+    if (p.source === "sealed")
+        return { modelKeyPoison: true, source: "sealed", reason: p.reason, publicKeyId: p.publicKeyId, ...(p.errKind ? { errKind: p.errKind } : {}), at };
+    return { modelKeyPoison: true, source: "env", reason: p.reason, apiKeyEnv: p.apiKeyEnv, at };
+}
+export function isModelKeyPoison(v) {
+    return typeof v === "object" && v !== null && v.modelKeyPoison === true;
+}
+export function modelKeyPoisonIdentity(p) {
+    switch (p.source) {
+        case "sealed":
+            return p.publicKeyId;
+        case "env":
+            return p.apiKeyEnv;
+    }
+}
+function poisonedMessage(modelName, p) {
+    switch (p.reason) {
+        case "sealed_decrypt_failed":
+        case "stale_ciphertext":
+        case "no_key_store":
+            return (`sealed api key for model "${modelName}" is unusable (${p.reason}; publicKeyId "${modelKeyPoisonIdentity(p)}"; detected ${p.at}) — ` +
+                `refusing the gateway-key fallback. Fix custody: re-paste the key in the web UI (it seals against the newest registered public key), ` +
+                `or restore this host's private key for that id / complete the rotation so the ciphertext targets a held key.`);
+        case "env_missing":
+            return (`api key for model "${modelName}" is unusable (env_missing: the catalog entry declares apiKeyEnv "${modelKeyPoisonIdentity(p)}" but this service's environment ` +
+                `has no non-empty ${modelKeyPoisonIdentity(p)}; detected ${p.at}) — refusing the gateway-key fallback. Set ${modelKeyPoisonIdentity(p)} in the environment of the ` +
+                `process that runs this service (and restart it), or drop apiKeyEnv from the catalog entry to authenticate this model with the deployment's gateway key on purpose.`);
+    }
+}
+export class ModelKeyPoisonedError extends Error {
+    poison;
+    reason;
+    at;
+    constructor(modelName, poison) {
+        super(poisonedMessage(modelName, poison));
+        this.name = "ModelKeyPoisonedError";
+        this.poison = poison;
+        this.reason = poison.reason;
+        this.at = poison.at;
+    }
+}
 export function createKeyResolver(modelApiKeyEnv, env = process.env, modelApiKeys = {}) {
     if (Object.keys(modelApiKeyEnv).length === 0 && Object.keys(modelApiKeys).length === 0)
         return undefined;
@@ -7,15 +49,31 @@ export function createKeyResolver(modelApiKeyEnv, env = process.env, modelApiKey
         return apiKey ? { apiKey } : undefined;
     };
 }
-export function resolveModelApiKey(modelName, modelApiKeyEnv, env = process.env, modelApiKeys = {}) {
+function chainLookup(modelName, modelApiKeyEnv, env, modelApiKeys) {
     const sealed = modelApiKeys[modelName];
-    if (isSealedKeyPoison(sealed))
-        throw new SealedKeyPoisonedError(modelName, sealed);
+    if (isModelKeyPoison(sealed))
+        return { kind: "poison", poison: sealed };
     if (sealed)
-        return sealed;
+        return { kind: "key", key: sealed };
     const envName = modelApiKeyEnv[modelName];
     if (!envName)
-        return undefined;
-    return env[envName] || undefined;
+        return { kind: "undeclared" };
+    const value = env[envName];
+    return value ? { kind: "key", key: value } : { kind: "poison", poison: modelKeyPoison({ source: "env", reason: "env_missing", apiKeyEnv: envName }) };
+}
+export function modelKeyPoisonOf(modelName, modelApiKeyEnv, env = process.env, modelApiKeys = {}) {
+    const r = chainLookup(modelName, modelApiKeyEnv, env, modelApiKeys);
+    return r.kind === "poison" ? r.poison : undefined;
+}
+export function resolveModelApiKey(modelName, modelApiKeyEnv, env = process.env, modelApiKeys = {}) {
+    const r = chainLookup(modelName, modelApiKeyEnv, env, modelApiKeys);
+    switch (r.kind) {
+        case "key":
+            return r.key;
+        case "poison":
+            throw new ModelKeyPoisonedError(modelName, r.poison);
+        case "undeclared":
+            return undefined;
+    }
 }
 //# sourceMappingURL=key-resolver.js.map

package/dist/leader/leader.d.ts

@@ -16,6 +16,7 @@ import { type RunnerLike, type WorkerReport } from "./fanout.js";
 import { type ExecStreamLike } from "./diffout.js";
 import { type MergeDeps, type MergeResult } from "./merge.js";
 import { type TaskSpec, type VerifyConfig, type CheckpointToken, type TerminalCause, type ToolSpec, type RepairTerminal, type OracleTier, type RepairResult } from "@sema-agent/core";
+import { type UnattendedLeg } from "../unattended-permission-mode.js";
 /** [ref] Slice 6: drive a worker's resource-suspend auto-resume to a terminal (or bound) state. Exported
  *  for unit tests. Loops `resume(token, slice)` WHILE the result's terminal cause is a park on a
  *  `resource_limit` gate. Exits on: a terminal cause that is not a park, a park on any OTHER gate
@@ -67,6 +68,11 @@ export interface ProvisionedWorker {
 export interface LeaderDeps {
     /** Plan a task into N disjoint-file sub-tasks (MVP: simple/hand-authored; adaptive replan = scale). */
     plan: (task: string) => Promise<SubtaskSpec[]>;
+    /** S-877 候裁 15 / 18 —— 本车道有手的 run 并进的无人值守腿(模式 = 运维旋钮 `UNATTENDED_PERMISSION_MODE`、写面 roots、模式释放写保护时的
+     *  写保护拒层),由 `wire.ts` 经 `createUnattendedLeg` 铸一次递进来。本文件自己起的有手 run(模块门修复)与 `repair-wire.ts` 的单代理修复环按
+     *  `sub.spec` 起 run、不经 provisionWorker —— 两处都经 `withUnattendedLeg` 并进这一份。**必填**(缺席 = core「Absent = default」⇒ 无人可答的腿上
+     *  写与非只读命令被当场拒,codex F1 的病)。 */
+    unattendedLeg: UnattendedLeg;
     /** Provision a leader-owned worker (its env seeded with base at `branch` + an env-bound runner). */
     provisionWorker: (sub: SubtaskSpec) => Promise<ProvisionedWorker>;
     /** Ephemeral no-creds integration sandbox + the credentialed Coordinator push (merge(b) deps). */

package/dist/leader/leader.js

@@ -4,6 +4,7 @@ import { pullDiff } from "./diffout.js";
 import { mergeBranches } from "./merge.js";
 import { Runner, runWithVerification, resumeWithVerification } from "@sema-agent/core";
 import { pausedCauseOf, outwardPlane } from "../terminal.js";
+import { withUnattendedLeg } from "../unattended-permission-mode.js";
 const MAX_RESUME_SLICES = 200;
 export async function autoResumeOnResource(initial, signal, resume, maxSlices = MAX_RESUME_SLICES) {
     let vr = initial;
@@ -200,7 +201,7 @@ export async function runLeaderTask(task, durableBaseSha, deps) {
                     }
                     deps.logger?.info?.("module_repair", { workerId: r.workerId, attempt: attempt + 1, reason: redactHead(verdict.reason ?? "", 500) });
                     try {
-                        const rr = await w.runner.runTaskStream({ ...sub.spec, objective: deps.moduleGate.repairObjective(sub, safeVerdictReason), sessionId: `${w.sessionId}-r${attempt + 1}` }).result();
+                        const rr = await w.runner.runTaskStream(withUnattendedLeg({ ...sub.spec, objective: deps.moduleGate.repairObjective(sub, safeVerdictReason), sessionId: `${w.sessionId}-r${attempt + 1}` }, deps.unattendedLeg)).result();
                         if (r.stats && rr?.stats)
                             r.stats = { ...r.stats, tokens: (r.stats.tokens ?? 0) + (rr.stats.tokens ?? 0), costMicroUsd: (r.stats.costMicroUsd ?? 0) + (rr.stats.costMicroUsd ?? 0) };
                     }

package/dist/leader/repair-wire.js

@@ -2,6 +2,7 @@ import { runRepairLoop, delimitUntrusted, } from "@sema-agent/core";
 import { mkRepairOracle } from "./repair-oracle.js";
 import { outwardPlane } from "../terminal.js";
 import { redactHead } from "../observability/run-terminal.js";
+import { withUnattendedLeg } from "../unattended-permission-mode.js";
 function statusForTerminal(t) {
     return t === "fixed" || t === "candidate_only" ? "completed" : "failed";
 }
@@ -86,7 +87,7 @@ export function attachRepairLoopDeps(deps, resolve) {
     deps.repairLoop = {
         run: async (solo, sub) => {
             const cfg = await resolve(solo, sub);
-            const implSpec = { ...sub.spec, sessionId: solo.sessionId };
+            const implSpec = withUnattendedLeg({ ...sub.spec, sessionId: solo.sessionId }, deps.unattendedLeg);
             return runRepairLoopForLeader(solo, implSpec, cfg);
         },
     };

package/dist/leader/wire.d.ts

@@ -1,4 +1,4 @@
-import { type Brain, type Model, type ModelRoles, type ModelPricing, type TaskSpec, type ExecutionEnvFactory, type RemoteExecutionEnv, type ToolResultStore, type SessionStore, type ExecutionEnv, type RunnerDeps } from "@sema-agent/core";
+import { type Brain, type Model, type ModelRoles, type ModelPricing, type TaskSpec, type ExecutionEnvFactory, type RemoteExecutionEnv, type ToolResultStore, type SessionStore, type ExecutionEnv, type RunnerDeps, type PermissionMode } from "@sema-agent/core";
 import type { CheckpointStoreFull } from "../plugins/store-backend.js";
 import { type LeaderDeps, type LeaderResult } from "./leader.js";
 import { type DeploymentPostureSeats } from "../boot/runner-deps.js";
@@ -19,6 +19,14 @@ export interface LeaderWireConfig {
      *  REMOTE_EXEC (e2b or k8s/Kata) — workers and the integration sandbox run on envs from THIS factory.
      *  Requires `s3` (diff-out is the worker's self-upload; there is no leader-held env to pull from). */
     envFactory?: ExecutionEnvFactory;
+    /**
+     * S-877 候裁 15 → B —— 本车道**有手**的每一条 run(worker 两车道、集成沙箱修复、模块门修复、单代理修复环)的
+     * `TaskSpec.permissionMode`。**必填**:缺席 = core「Absent = `default`」⇒ 写与非只读命令在无人可答的这条腿上被
+     * headless 当场拒(codex F1 的病);必填让每一个构造本配置的地方都得表态,不许静默落回那一形。
+     * 唯一取值点 = `boot/leader.ts` 调 `unattendedPermissionMode(config)`(`src/unattended-permission-mode.ts`,与 run-local 同一只);
+     * 本文件经 `createUnattendedLeg` / `withUnattendedLeg` 铸并(模式 + 写面 roots + 候裁 18 的写保护拒层)。planner 路由无手,不读。
+     */
+    unattendedPermissionMode: PermissionMode;
     /** Durable suspend/resume for SUB-WORKERS ([ref] C4): when the seat yields a value, that worker task carries
      *  the durable question/ask policy + checkpoint store, so a gated ask/AskUserQuestion SUSPENDS the worker
      *  (checkpoint + paused env) instead of failing — the trigger replan-lite C4 arbitrates on. Mirrors main.ts's

package/dist/leader/wire.js

@@ -5,6 +5,7 @@ import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { tmpdir } from "node:os";
 import { Runner, combinePolicies, createDurableQuestionPolicy, QUESTION_AWAITS_RESUME, delimitUntrusted, hasDestroy, } from "@sema-agent/core";
+import { createUnattendedLeg, withUnattendedLeg } from "../unattended-permission-mode.js";
 import { RemoteContainerExecutionEnv } from "../plugins/remote-env-e2b.js";
 import { E2B_SANDBOX_HOME } from "../execution-lane-caps.js";
 import { createDurableAskPolicy } from "../approval.js";
@@ -138,6 +139,7 @@ export function createLeaderRunner(cfg) {
     const onNoticeSeat = createEngineNoticeSeat(cfg.logger);
     const governanceSeat = cfg.governance ?? {};
     const deploymentPostureSeat = () => cfg.deploymentPosture?.() ?? {};
+    const unattendedLeg = () => createUnattendedLeg(cfg.unattendedPermissionMode, deploymentPostureSeat());
     const tracerSeat = cfg.tracer ? { tracer: cfg.tracer } : {};
     const usageWindowSeat = cfg.usageWindows && cfg.usageWindowStore ? { usageWindows: cfg.usageWindows, usageWindowStore: cfg.usageWindowStore } : {};
     const promptSourceSeat = cfg.promptSource ? { promptSource: cfg.promptSource } : {};
@@ -169,12 +171,12 @@ export function createLeaderRunner(cfg) {
                         delimitUntrusted("FAILING OUTPUT (untrusted)", errorText),
                     ].join("\n");
                     const res = await runner
-                        .runTaskStream({
+                        .runTaskStream(withUnattendedLeg({
                         objective,
                         ...principalSpec(),
                         sessionId: `leader-repair-${Date.now()}-${round}`,
                         limits: { maxCostUsd: repairBudgetUsd, maxWalltimeMs: Math.max(300_000, Math.floor(leaderTimeoutMs / 2)) },
-                    })
+                    }, unattendedLeg()))
                         .result();
                     if (res.terminal.kind !== "completed")
                         throw new Error(`repair round ${round} did not complete (status=${outwardPlane(res.terminal).status})`);
@@ -243,6 +245,7 @@ export function createLeaderRunner(cfg) {
         const provisionWorker = async (sub) => {
             const sessionId = `leader-${sub.workerId}-${Date.now()}`;
             const durable = cfg.durable?.();
+            const resumeCtx = { body: { objective: sub.spec.objective }, unattendedLeg: true };
             let durableSpec = {};
             if (durable) {
                 const d = durable;
@@ -252,7 +255,7 @@ export function createLeaderRunner(cfg) {
                     durableApproval: { scope: "_leader", ...(d.ttlMs ? { ttlMs: d.ttlMs } : {}) },
                     onQuestion: QUESTION_AWAITS_RESUME,
                 };
-                await d.checkpointStore.putCtx(sessionId, { body: { objective: sub.spec.objective } }).catch((e) => {
+                await d.checkpointStore.putCtx(sessionId, resumeCtx).catch((e) => {
                     cfg.logger?.warn?.("leader_putctx_failed", { workerId: sub.workerId, err: redactHead(e instanceof Error ? e.message : String(e), 2000) });
                 });
             }
@@ -287,7 +290,7 @@ export function createLeaderRunner(cfg) {
                 runner.runTaskStream = (spec, resume) => {
                     const stream = orig(spec, resume);
                     const iv = setInterval(() => {
-                        void d.checkpointStore.putCtx(sessionId, { body: { objective: sub.spec.objective } }).catch(() => { });
+                        void d.checkpointStore.putCtx(sessionId, resumeCtx).catch(() => { });
                     }, 45_000);
                     iv.unref?.();
                     void stream.result().then(() => clearInterval(iv), () => clearInterval(iv));
@@ -322,7 +325,7 @@ export function createLeaderRunner(cfg) {
                         }),
                     })),
                     fetchDiff: () => fetchUploadedDiff(getUrl),
-                    spec: { ...workerLimits, ...sub.spec, ...durableSpec, ...resourceSpec, ...principalSpec(), objective: `${sub.spec.objective}${uploadStepSuffix(W)}` },
+                    spec: withUnattendedLeg({ ...workerLimits, ...sub.spec, ...durableSpec, ...resourceSpec, ...principalSpec(), objective: `${sub.spec.objective}${uploadStepSuffix(W)}` }, unattendedLeg()),
                 };
             }
             if (!cfg.e2bApiKey)
@@ -337,7 +340,7 @@ export function createLeaderRunner(cfg) {
                 runner: keepCtxWarm(new Runner({ brain: cfg.brain, models: cfg.models, roles: cfg.roles, pricing: cfg.pricing, ...onNoticeSeat, ...governanceSeat, ...deploymentPostureSeat(), ...tracerSeat, ...usageWindowSeat, ...promptSourceSeat, ...onErrorSeat, ...(cfg.toolResultStore ? { toolResultStore: cfg.toolResultStore } : {}), ...(cfg.sessionStore ? { sessionStore: cfg.sessionStore } : {}), executionEnv: env })),
                 diffEnv: env,
                 destroy: () => env.destroy().then(() => { }),
-                spec: { ...workerLimits, ...sub.spec, ...durableSpec, ...resourceSpec, ...principalSpec() },
+                spec: withUnattendedLeg({ ...workerLimits, ...sub.spec, ...durableSpec, ...resourceSpec, ...principalSpec() }, unattendedLeg()),
             };
         };
         const provisionIntegrationSandbox = async () => {
@@ -379,6 +382,7 @@ export function createLeaderRunner(cfg) {
         const deps = {
             plan,
             provisionWorker,
+            unattendedLeg: unattendedLeg(),
             provisionIntegrationSandbox,
             push,
             testCmd: body.testCmd,

package/dist/observability/fail-open.d.ts

@@ -25,6 +25,10 @@ export declare const FAIL_OPEN_TAGS: {
         readonly cls: "F";
         readonly note: "S-297(`http/routes/sessions.ts lastLegMcpFor`,`/mcp` 面板的可选键 `lastLegMcp`):按会话取最近 run 的索引读 / 那条 run 的账本读**抛错或超期** ⇒ 该键缺席,面板本体照常 200。放行的最坏后果=这一屏少一格「上一次真挂上了什么」(壳退回翻账本),不是门、不是权限、不是凭证 —— 而反方向(让附加键的读失败打掉整张面板)会给一口此前零 MCP 配置下根本不碰账本的**既有**读面新加一条挂掉的理由。缺席本就是本键 wire 上的一等状态(消费端必须会读),所以这条兜底不产生任何新的消费端形态;计数让「某台部署的账本一直读不出来」显形。";
     };
+    readonly "server.unattended-leg.mode-releases-protective-asks": {
+        readonly cls: "P-DEBT";
+        readonly note: "S-877 四续 ⑧(候裁 18 D 的已披露残余,`unattended-permission-mode.ts` 的 `createUnattendedLeg`):无人值守腿(leader worker / 修复腿 / run-local / 续跑重挂)的旋钮 `UNATTENDED_PERMISSION_MODE` 缺省 `bypassPermissions` 释放六类保护问(`probe` / `tool_marks_mcp` / `tool_marks_a2a` / `transcript_write` / `rule_unreadable` / `artifact_shared_read`;写保护一类已改拒)—— 7.105.0 这些腿上它们照问、无人答即拒。放行的最坏后果=无人值守的写 / 读 / MCP·A2A 标记工具调用不再被这几道保护问拦下,`rule_unreadable` 是「规则店读不出照放」(安全轴 fail-open 方向)。core 对这几类没有拒座;S-906(core 7.37.0 按类作答)到货后本臂与旋钮一并硬删。计数 = 铸出的这类腿条数,detail = `mode=<词> released=<类…>`。";
+    };
     readonly "server.workflow-park-index.sync-failed": {
         readonly cls: "P-DEBT";
         readonly note: "S-185 车CM(codex r1-F2 [high],验真后登记):workflow 出身 park 的 join 索引(`workflow_agent_session` / local 账本)在**一次成功的 run 写之后**同步失败 ⇒ 该次同步被吞,重试要等这条 run 的**下一次**写。而 park 恰好常常是这条 run 的**最后**一次写(park = run 终局 `failed`)⇒ 那条 park 可能永久 join 不到,`/decide` 结构性退回本批之前的行为(409 `conflict.resume_context_unavailable`)——**方向是 fail-closed**(不误配、不伪造、不放行任何东西),丢的是「人能不能把这条批准送出去」这个能力。归 P 类的理由是它决定**车道选择**(缺行 ⇒ 选中 legacy 腿),归 DEBT 的理由是真正的解要一条**按子代 checkpoint 键的耐久决议回执 + 重启期回填**(与 codex r1-F3 同一件欠账,另车)。计数非零 = 有 park 因此决不掉,运维要按 detail 里的 runId 去查。";
@@ -259,7 +263,11 @@ export declare const FAIL_OPEN_TAGS: {
     };
     readonly "server.run-terminal.redact-threw": {
         readonly cls: "F";
-        readonly note: "三个发射座(errorMessage 终态文案 / 诊断文本 diag / 工件 artifact,probe 前缀判别;普查 56 行;补丁头 patch-head 那座随 7.83.0 / S-113 的 redactPatchHead 一并退役):S-105 最终轮 [medium]:终态 errorMessage/blockedReason/remoteEnvFailures[].message 脱敏抛出(RangeError:关键字/前缀臂那一形已由 S-219 的 atLeast 铸点闭掉,仍能抛的是 JSON 秘密字段臂的转义对循环,既有未闭,S-106)⇒ 落固定占位 «redacted:oversized»——绝不落原文(安全轴 fail-closed),也绝不阻断终态翻转与 claim 释放(可用性)。方向刻意:一条超大错误体不得把 run 卡在 running。";
+        readonly note: "三个发射座(errorMessage 终态文案 / 诊断文本 diag / 工件 artifact,probe 前缀判别;普查 56 行;补丁头 patch-head 那座随 7.83.0 / S-113 的 redactPatchHead 一并退役):S-105 最终轮 [medium]:终态 errorMessage/blockedReason/remoteEnvFailures[].message 脱敏抛出(RangeError:关键字/前缀臂那一形由 S-219 的 atLeast 铸点闭掉;JSON 秘密字段臂的转义对循环与 PEM 栅栏臂的标签交替循环由 S-265 换成手写线性扫描器闭掉 —— 已知形全部闭掉,本臂留作结构性兜底,计数恒零是证据、不归零即新形)⇒ 落固定占位 «redacted:oversized»——绝不落原文(安全轴 fail-closed),也绝不阻断终态翻转与 claim 释放(可用性)。方向刻意:一条超大错误体不得把 run 卡在 running。";
+    };
+    readonly "server.run-terminal.provider-echo-shaped": {
+        readonly cls: "F";
+        readonly note: "S-283(7.105.0,`observability/run-terminal.ts` 的 `admitProviderEcho`,唯一判决口;S-889 起动作与 core #1204 源头闸同一条;S-877 / core 7.35.0 起谓词读 core 包根 `isProviderEchoShape`,core brain 写侧先判(越界 ⇒ trace `brain.echo_dropped`)⇒ 真 brain 链上本 tag 零命中,命中只剩存量行与不经 core brain 写侧的 producer):模型服务商回声、引擎逐字转交的不透明 id(`apiFailure.requestId` / `responseModel`,以及账本孪生 `turn_end.responseModel`、子代通告 `task_notification.apiFailure.requestId` 与 `POST /v1/side-query` 200 体的 `responseModel`;铸点 + 账本汇点两口)越出形状(字符串、长度 1–128、每个码元是可见 ASCII 0x21–0x7E;非串值在外)⇒ **缺席**(键删掉 / 不铸)+ 计数;空串 = 服务商什么都没说 ⇒ 缺席、**不计数**(S-877,core `providerEchoReading` 的读法)。方向是 **fail-closed**(越界字节不上 wire / 不落库 / 不进日志),不截断、不过脱敏器(不透明 id,脱敏会改坏它 —— 与 S-270 structuredOutput 同方向)。放行的最坏后果 = 这枚 id / 模型名在 wire 上缺席(`apiFailure` 留 `{}` = 「provider 故障、无可补充标签」,core 契约原句),运维拿不到它去服务商那边对单;detail 只带座位 / 原长或类型,**不带值**。计数非零 = 这台部署接的端点(或中间网关)在回显越界字节,运维按座位去查那一跳;读面不改写存量行,存量越界行每次回放各计一次。";
     };
     readonly "server.run-terminal.redact-capped": {
         readonly cls: "F";

package/dist/observability/fail-open.js

@@ -16,6 +16,10 @@ export const FAIL_OPEN_TAGS = {
         cls: "F",
         note: "S-297(`http/routes/sessions.ts lastLegMcpFor`,`/mcp` 面板的可选键 `lastLegMcp`):按会话取最近 run 的索引读 / 那条 run 的账本读**抛错或超期** ⇒ 该键缺席,面板本体照常 200。放行的最坏后果=这一屏少一格「上一次真挂上了什么」(壳退回翻账本),不是门、不是权限、不是凭证 —— 而反方向(让附加键的读失败打掉整张面板)会给一口此前零 MCP 配置下根本不碰账本的**既有**读面新加一条挂掉的理由。缺席本就是本键 wire 上的一等状态(消费端必须会读),所以这条兜底不产生任何新的消费端形态;计数让「某台部署的账本一直读不出来」显形。",
     },
+    "server.unattended-leg.mode-releases-protective-asks": {
+        cls: "P-DEBT",
+        note: "S-877 四续 ⑧(候裁 18 D 的已披露残余,`unattended-permission-mode.ts` 的 `createUnattendedLeg`):无人值守腿(leader worker / 修复腿 / run-local / 续跑重挂)的旋钮 `UNATTENDED_PERMISSION_MODE` 缺省 `bypassPermissions` 释放六类保护问(`probe` / `tool_marks_mcp` / `tool_marks_a2a` / `transcript_write` / `rule_unreadable` / `artifact_shared_read`;写保护一类已改拒)—— 7.105.0 这些腿上它们照问、无人答即拒。放行的最坏后果=无人值守的写 / 读 / MCP·A2A 标记工具调用不再被这几道保护问拦下,`rule_unreadable` 是「规则店读不出照放」(安全轴 fail-open 方向)。core 对这几类没有拒座;S-906(core 7.37.0 按类作答)到货后本臂与旋钮一并硬删。计数 = 铸出的这类腿条数,detail = `mode=<词> released=<类…>`。",
+    },
     "server.workflow-park-index.sync-failed": {
         cls: "P-DEBT",
         note: "S-185 车CM(codex r1-F2 [high],验真后登记):workflow 出身 park 的 join 索引(`workflow_agent_session` / local 账本)在**一次成功的 run 写之后**同步失败 ⇒ 该次同步被吞,重试要等这条 run 的**下一次**写。而 park 恰好常常是这条 run 的**最后**一次写(park = run 终局 `failed`)⇒ 那条 park 可能永久 join 不到,`/decide` 结构性退回本批之前的行为(409 `conflict.resume_context_unavailable`)——**方向是 fail-closed**(不误配、不伪造、不放行任何东西),丢的是「人能不能把这条批准送出去」这个能力。归 P 类的理由是它决定**车道选择**(缺行 ⇒ 选中 legacy 腿),归 DEBT 的理由是真正的解要一条**按子代 checkpoint 键的耐久决议回执 + 重启期回填**(与 codex r1-F3 同一件欠账,另车)。计数非零 = 有 park 因此决不掉,运维要按 detail 里的 runId 去查。",
@@ -250,7 +254,11 @@ export const FAIL_OPEN_TAGS = {
     },
     "server.run-terminal.redact-threw": {
         cls: "F",
-        note: "三个发射座(errorMessage 终态文案 / 诊断文本 diag / 工件 artifact,probe 前缀判别;普查 56 行;补丁头 patch-head 那座随 7.83.0 / S-113 的 redactPatchHead 一并退役):S-105 最终轮 [medium]:终态 errorMessage/blockedReason/remoteEnvFailures[].message 脱敏抛出(RangeError:关键字/前缀臂那一形已由 S-219 的 atLeast 铸点闭掉,仍能抛的是 JSON 秘密字段臂的转义对循环,既有未闭,S-106)⇒ 落固定占位 «redacted:oversized»——绝不落原文(安全轴 fail-closed),也绝不阻断终态翻转与 claim 释放(可用性)。方向刻意:一条超大错误体不得把 run 卡在 running。",
+        note: "三个发射座(errorMessage 终态文案 / 诊断文本 diag / 工件 artifact,probe 前缀判别;普查 56 行;补丁头 patch-head 那座随 7.83.0 / S-113 的 redactPatchHead 一并退役):S-105 最终轮 [medium]:终态 errorMessage/blockedReason/remoteEnvFailures[].message 脱敏抛出(RangeError:关键字/前缀臂那一形由 S-219 的 atLeast 铸点闭掉;JSON 秘密字段臂的转义对循环与 PEM 栅栏臂的标签交替循环由 S-265 换成手写线性扫描器闭掉 —— 已知形全部闭掉,本臂留作结构性兜底,计数恒零是证据、不归零即新形)⇒ 落固定占位 «redacted:oversized»——绝不落原文(安全轴 fail-closed),也绝不阻断终态翻转与 claim 释放(可用性)。方向刻意:一条超大错误体不得把 run 卡在 running。",
+    },
+    "server.run-terminal.provider-echo-shaped": {
+        cls: "F",
+        note: "S-283(7.105.0,`observability/run-terminal.ts` 的 `admitProviderEcho`,唯一判决口;S-889 起动作与 core #1204 源头闸同一条;S-877 / core 7.35.0 起谓词读 core 包根 `isProviderEchoShape`,core brain 写侧先判(越界 ⇒ trace `brain.echo_dropped`)⇒ 真 brain 链上本 tag 零命中,命中只剩存量行与不经 core brain 写侧的 producer):模型服务商回声、引擎逐字转交的不透明 id(`apiFailure.requestId` / `responseModel`,以及账本孪生 `turn_end.responseModel`、子代通告 `task_notification.apiFailure.requestId` 与 `POST /v1/side-query` 200 体的 `responseModel`;铸点 + 账本汇点两口)越出形状(字符串、长度 1–128、每个码元是可见 ASCII 0x21–0x7E;非串值在外)⇒ **缺席**(键删掉 / 不铸)+ 计数;空串 = 服务商什么都没说 ⇒ 缺席、**不计数**(S-877,core `providerEchoReading` 的读法)。方向是 **fail-closed**(越界字节不上 wire / 不落库 / 不进日志),不截断、不过脱敏器(不透明 id,脱敏会改坏它 —— 与 S-270 structuredOutput 同方向)。放行的最坏后果 = 这枚 id / 模型名在 wire 上缺席(`apiFailure` 留 `{}` = 「provider 故障、无可补充标签」,core 契约原句),运维拿不到它去服务商那边对单;detail 只带座位 / 原长或类型,**不带值**。计数非零 = 这台部署接的端点(或中间网关)在回显越界字节,运维按座位去查那一跳;读面不改写存量行,存量越界行每次回放各计一次。",
     },
     "server.run-terminal.redact-capped": { cls: "F", note: "S-107:终态自由文本(errorMessage/blockedReason/remoteEnvFailures[].message/error 列/done·failed 行)长度 > REDACT_INPUT_CAP(64KB)⇒ 整段换 «redacted:oversized»(fail-closed 取证丢弃,不截断不扫);计数=多少条终态文案被整段丢弃" },
     "server.run-terminal.artifact-capped": { cls: "F", note: "S-107:leader_run 行上的工件字节(salvaged[].patch / candidatePatch.patch / merge.candidatePatch / merge.rej)长度 > ARTIFACT_INPUT_CAP(256KB)⇒ 整份换 «redacted:oversized-artifact»(fail-closed 取证丢弃;原字节仍在 worker 分支/merge 咽喉);计数=多少份工件被整份丢弃" },

package/dist/observability/metrics.js

@@ -215,6 +215,7 @@ export function createMetrics() {
     m.counter("http_requests_total", "HTTP requests by route/method/status");
     m.histogram("http_request_duration_seconds", "HTTP request duration");
     m.counter("rate_limited_total", "Requests rejected by the rate limiter");
+    m.counter("brain_echo_dropped_total", "Provider echo fields (response request-id header / reported model name) the engine's brain dropped at write time for failing the echo shape (visible ASCII, 1-128 chars), by field (requestId|responseModel); non-zero = the endpoint or a gateway in front of it echoes out-of-shape bytes");
     m.counter("mcp_probe_total", `No-run MCP status face outcomes by outcome (${MCP_PROBE_OUTCOMES.join("/")} — see src/capabilities/mcp-probe.ts MCP_PROBE_OUTCOMES; rate_limited has TWO causes: the per-identity fixed window AND the replica-wide in-flight cap, which can refuse caller B because of caller A)`);
     m.counter("tasks_total", "Finished tasks by terminal status");
     m.counter("task_tokens_total", "Total model tokens consumed by tasks");
@@ -241,7 +242,7 @@ export function createMetrics() {
     m.counter("task_model_not_allowlisted_resume_total", "Resumed legs whose model/compactionModel is outside the @-mention allowlist (allowed to keep running by design — the allowlist gates fresh picks only)");
     m.counter("task_model_unavailable_fallback_total", "Resumed legs whose explicit model pick names a catalog entry that is unavailable on this deployment (no brain mounted for its provider / entry fails its schema) — the leg runs on the default model; fresh submits get 400 request.model_unavailable");
     m.counter("prompt_constitution_total", "Prompt assembly constitution mode per task (core 1.243 提示词主权): steady state = core; provider-assembled/replaced/legacy warrant eyes");
-    m.counter("rewind_snapshot_failed_total", "Per-turn rewind file snapshots that failed, by the engine's FileHistoryResult.error.code (snapshot_failed/aborted/…; `unknown` = the disclosure text carried no readable code). COARSE on purpose — whether a failure is permanent (the same file will fail every turn until the deployment changes) is counted by file_history_permanent_failure_total instead, from the typed error object rather than from prose");
+    m.counter("rewind_snapshot_failed_total", "Per-turn rewind file snapshots that failed, by the engine's FileHistoryResult.error.code (snapshot_failed/aborted/…; `unknown` = the text carried no word of that closed set, e.g. the boundary-timeout arm). COARSE on purpose — whether a failure is permanent (the same file will fail every turn until the deployment changes) is counted by file_history_permanent_failure_total instead, from the typed error object rather than from prose");
     m.counter("verifications_total", "Tasks run through the verification gate (1.44), by final verdict");
     m.counter("cascade_total", "Tasks run through the model cascade (1.45), by outcome (passed/exhausted)");
     m.counter("degenerate_total", "Degenerate-output failures (1.59), by salvage class (a/b/unknown)");
@@ -296,6 +297,7 @@ export function createMetrics() {
     m.counter("fleet_lease_exhausted_total", "Fleet trace-lease requests rejected because the pool was exhausted");
     m.counter("fleet_lease_auth_error_total", "Fleet trace-lease auth failures");
     m.counter("fleet_lease_fail_open_total", "Fleet trace-lease fail-open grants (lease store unavailable)");
+    m.counter("fleet_lease_fail_closed_total", "Fleet quota-lease refusals because the center was unreachable / 5xx / timed out / answered malformed while FLEET_LEASE_FAIL_CLOSED is in effect (billed submissions answered 503 fleet.lease_unavailable)");
     m.counter("metric_label_overflow_total", "Label values collapsed to 'other' by the cardinality guard, by label");
     m.counter("remote_env_exec_idle_timeout_total", "Remote-env exec idle timeouts, by provider");
     m.counter("remote_env_file_timeout_total", "Remote-env file-op timeouts, by provider");

package/dist/observability/permission-rule-events.d.ts

@@ -4,7 +4,7 @@ export declare const PERMISSION_RULE_EVENT_TABLE: readonly [{
     readonly meaning: "a persisted allow rule authorized the call and nobody was asked";
 }, {
     readonly event: "rule_store_unreadable";
-    readonly meaning: "the rule store failed to read, so the call was adjudicated with ZERO rules (expect an approval storm whose cause is the store, not the model)";
+    readonly meaning: "the rule store failed to read, so the failed partition's rows were SKIPPED for that read (core C-R172: no store card; its allow rows clear nothing and its deny rows protect nothing until a read succeeds — expect extra cards and missing refusals whose cause is the store, not the model)";
 }, {
     readonly event: "read_only_allowed";
     readonly meaning: "the engine's read-only shell verdict cleared an ask that was NOT an operator-written rule (core decisionReason \"read_only\"; an operator-declared ask carries matchedAskRule and is never cleared this way)";

package/dist/observability/permission-rule-events.js

@@ -6,7 +6,7 @@ export const PERMISSION_RULE_EVENT_TABLE = [
     },
     {
         event: "rule_store_unreadable",
-        meaning: "the rule store failed to read, so the call was adjudicated with ZERO rules (expect an approval storm whose cause is the store, not the model)",
+        meaning: "the rule store failed to read, so the failed partition's rows were SKIPPED for that read (core C-R172: no store card; its allow rows clear nothing and its deny rows protect nothing until a read succeeds — expect extra cards and missing refusals whose cause is the store, not the model)",
     },
     {
         event: "read_only_allowed",