@sema-agent/server 7.104.0 → 7.106.0

package/dist/fleet/fleet-bus.d.ts

@@ -54,7 +54,11 @@ export interface FleetTaskRow {
      *  🔴 与 `name` 分域:`name` 是**显示名**(源 `description ?? name`,模型自由文本);本键是**身份键**,
      *  消费端按串相等把「@某个名字」绑到这一行(同类型两个子代在 `agentType` 上不可分,在本键上可分)。
      *  ADDITIVE / tolerate-absent:**缺席 = 一次匿名委派**(不是「不知道它叫什么」)—— 7.25.0 之前本键在本仓
-     *  没有任何源,恒缺席。SECRET-SAFE:与 `name` 同一道边界(emit 前 redact)。 */
+     *  没有任何源,恒缺席。**VERBATIM,不过 `redactSecrets`**(S-546 B6①:本注此前写「与 `name` 同一道边界,emit 前
+     *  redact」,而三处铸点从本键到货起就是原样投 —— 见本文件 spawn / tick / terminal 三臂的行注与
+     *  `trace/core-keyset-guard.ts` 的 `spawnName` 记账):它是**身份键**,消费端按串相等绑行,脱敏会把两个合法队友名
+     *  改写成同一串;出生点校验过的字符集里也没有可脱敏的形。残余(已披露)= 有人把真凭据当队友名写进
+     *  `Agent({name})`,那一串原样上 fleet 面。展示名 `name` 照旧脱敏。 */
     agentName?: string;
     /** Owning principal (= the run's scope). The `/v1/fleet/stream` route filters to the caller's scope (owner-gated)
      *  unless the caller is fleet-wide (operator / trace-token). NOT rendered — a tenant-isolation field. */

package/dist/fleet-client.d.ts

@@ -1,9 +1,10 @@
 /**
  * Fleet worker-side wiring(announce/heartbeat + usage 批报;契约 = registry-core 0.1.48+
  * `/fleet`,center 端点 = sema-registry `/api/fleet/*`)。设计要点:
- *  - **可选分层(D3)**:仅当 center 已配置(sema-registry lane 的 baseUrl+token+worker)∧ `FLEET_ADVERTISE_ADDRESS`
- *    显式声明时才启动 —— 不配 center 的部署零行为变化。address 不自猜(k8s pod IP / docker alias / 127.0.0.1:port
- *    只有部署环境自己知道,故用显式 env)。
+ *  - **可选分层(D3),两条环各自有门(S-866 ④)**:客户端在中心车道配齐时启动(`centerLaneConfigured` —— baseUrl + 声明了
+ *    凭证 + worker,与租约管理器、用量累加器**同一只**谓词);**用量环**只要这三件;**公告环**(announce / 心跳 / 注销)另要
+ *    `FLEET_ADVERTISE_ADDRESS` 显式声明(可达性是运维的话,不自猜:k8s pod IP / docker alias / 127.0.0.1:port 只有部署环境自己
+ *    知道)。不配中心的部署零行为变化;配了中心而不公告的引擎只报用量、不注册(7.105.0 及以前它连用量都不报)。
  *  - **announce=注册=心跳同形状幂等 upsert**:boot 后(listen 之后)POST 一次 + 每 heartbeatMs 续。
  *    `ready` / `draining` 两字段由**同一只**就绪谓词的同一次读铸(S-740:`http/readiness.ts` 的 `readinessOf`,
  *    与 `/health.ready`、`GET /readyz`、计费提交门同源):`ready = verdict.ready`(= roster 已落 ∧ ¬draining),
@@ -74,8 +75,9 @@ export interface FleetClientOpts {
         worker: string;
     };
     instanceId: string;
-    /** Reachable base URL of THIS instance — the operator's explicit declaration (`FLEET_ADVERTISE_ADDRESS`). */
-    advertiseAddress: string;
+    /** Reachable base URL of THIS instance — the operator's explicit declaration (`FLEET_ADVERTISE_ADDRESS`).
+     *  S-866 ④:**缺席 = 公告环不装**(不注册、不心跳、不注销;`announceNow` 是空操作),用量环照装。 */
+    advertiseAddress?: string | undefined;
     version: string;
     /** S-740:就绪判(装配层接 `readinessOf(deployment)` —— HTTP 面读的同一个 deps 组)。每条公告现读**一次**,
      *  `ready` 与 `draining` 两字段都由这一次读铸(不会撕裂成 `ready:true` + `draining:true`)。 */
@@ -104,22 +106,25 @@ export interface FleetClient {
     stop: () => Promise<void>;
 }
 /**
- * Start the worker-side fleet loops. Caller has already gated on "center configured ∧ advertise address set"
- * (startFleetClientFromEnv below) — this function assumes a complete opts.
+ * Start the worker-side fleet loops. Caller has already gated on the center lane (startFleetClientFromEnv below).
+ * The announce loop runs iff `advertiseAddress` is present; the usage loop iff `usage` is present (S-866 ④: the two
+ * loops no longer share one gate).
  */
 export declare function startFleetClient(opts: FleetClientOpts): FleetClient;
 /**
- * Env/config gate (D3 可选分层): start ONLY when the sema-registry lane is configured (baseUrl + a DECLARED credential
- * + worker — S-651: declared, not "currently readable": a token file that is unreadable right now still starts the
- * client, every request re-reads it)
- * AND the operator explicitly declared this instance's reachable address. Anything missing → undefined (zero
- * behavior change for non-fleet deployments); worker missing is warned when the rest is present (half-configured).
+ * Env/config gate (D3 可选分层;S-866 ④ 两条环各自有门): start when the center lane is configured —
+ * {@link centerLaneConfigured}(baseUrl + a DECLARED credential + worker — S-651: declared, not "currently readable": a token
+ * file that is unreadable right now still starts the client, every request re-reads it), the SAME predicate the lease
+ * manager and the usage accumulator use. The usage loop needs nothing more; the announce loop additionally needs the
+ * operator's explicit reachable address (`FLEET_ADVERTISE_ADDRESS`; a malformed one refuses boot). Lane not configured →
+ * undefined (zero behavior change for non-fleet deployments); an address set while only the worker is missing is warned
+ * (half-configured announce).
  */
 export declare function startFleetClientFromEnv(cfg: {
     configCenter?: (CenterEndpoint & {
         worker?: string;
     }) | undefined;
 }, opts: Omit<FleetClientOpts, "center" | "advertiseAddress"> & {
-    advertiseAddress?: string;
+    advertiseAddress?: string | undefined;
 }): FleetClient | undefined;
 //# sourceMappingURL=fleet-client.d.ts.map

package/dist/fleet-client.js

@@ -1,6 +1,6 @@
 import { InstanceAnnouncement, UsageReport, DEFAULT_HEARTBEAT_MS } from "@sema-agent/settings-schema/fleet";
 import { buildDisplaySafeUrl } from "./trace/redact.js";
-import { centerFetch } from "./config-center/center-request.js";
+import { centerFetch, centerLaneConfigured } from "./config-center/center-request.js";
 export const FLEET_USAGE_KEY_CAP = 1024;
 export const FLEET_CLIENT_FETCH_TIMEOUT_MS = 5000;
 export class FleetUsageAccumulator {
@@ -81,8 +81,9 @@ export function startFleetClient(opts) {
     const send = (route, method, json) => centerFetch(opts.center, { kind: route }, { method, json, timeoutMs: FLEET_CLIENT_FETCH_TIMEOUT_MS, fetchImpl: f });
     let stopped = false;
     let failStreak = 0;
+    const address = opts.advertiseAddress;
     const announceOnce = async () => {
-        if (stopped)
+        if (stopped || address === undefined)
             return;
         try {
             const verdict = opts.readiness();
@@ -91,7 +92,7 @@ export function startFleetClient(opts) {
             const body = {
                 instanceId: opts.instanceId,
                 worker: opts.center.worker,
-                address: opts.advertiseAddress,
+                address,
                 version: opts.version,
                 ready: verdict.ready,
                 draining: !verdict.ready && verdict.reasons.includes("draining"),
@@ -153,9 +154,11 @@ export function startFleetClient(opts) {
             opts.logger?.warn("fleet_usage_report_failed", { error: err instanceof Error ? err.message : String(err), entries: entries.length });
         }
     };
-    void announceNow();
-    const hb = setInterval(() => void announceNow(), heartbeatMs);
-    hb.unref?.();
+    const announcing = address !== undefined;
+    if (announcing)
+        void announceNow();
+    const hb = announcing ? setInterval(() => void announceNow(), heartbeatMs) : undefined;
+    hb?.unref?.();
     const uw = opts.usage ? setInterval(() => void flushUsage(), usageWindowMs) : undefined;
     uw?.unref?.();
     let stopping = false;
@@ -163,13 +166,16 @@ export function startFleetClient(opts) {
         if (stopping)
             return;
         stopping = true;
-        clearInterval(hb);
+        if (hb)
+            clearInterval(hb);
         if (uw)
             clearInterval(uw);
         while (inFlight !== undefined)
             await inFlight;
         stopped = true;
         await flushUsage();
+        if (!announcing)
+            return;
         try {
             await send("fleet-instances", "DELETE", { instanceId: opts.instanceId, worker: opts.center.worker });
         }
@@ -180,23 +186,27 @@ export function startFleetClient(opts) {
 }
 export function startFleetClientFromEnv(cfg, opts) {
     const cc = cfg.configCenter;
-    const address = opts.advertiseAddress ?? process.env.FLEET_ADVERTISE_ADDRESS;
-    if (!cc?.baseUrl || !cc.credential.declared || !address)
-        return undefined;
-    let parsed;
-    try {
-        parsed = new URL(address);
-    }
-    catch {
-        parsed = undefined;
-    }
-    if (parsed === undefined || (parsed.protocol !== "http:" && parsed.protocol !== "https:")) {
-        throw new Error(`FLEET_ADVERTISE_ADDRESS must be a parseable http(s) base URL (e.g. "http://10.0.0.5:8090"); got "${buildDisplaySafeUrl(address)}" — the fleet center rejects any other shape on every announce`);
+    const raw = opts.advertiseAddress ?? process.env.FLEET_ADVERTISE_ADDRESS;
+    const address = raw === undefined || raw === "" ? undefined : raw;
+    if (address !== undefined && cc?.baseUrl && cc.credential.declared) {
+        let parsed;
+        try {
+            parsed = new URL(address);
+        }
+        catch {
+            parsed = undefined;
+        }
+        if (parsed === undefined || (parsed.protocol !== "http:" && parsed.protocol !== "https:")) {
+            throw new Error(`FLEET_ADVERTISE_ADDRESS must be a parseable http(s) base URL (e.g. "http://10.0.0.5:8090"); got "${buildDisplaySafeUrl(address)}" — the fleet center rejects any other shape on every announce`);
+        }
     }
-    if (!cc.worker) {
-        opts.logger?.warn("fleet_client_no_worker_scope", { note: "FLEET_ADVERTISE_ADDRESS set but SEMA_REGISTRY_WORKER missing — announce needs the worker (dispatch key); fleet client not started" });
+    if (!centerLaneConfigured(cfg)) {
+        if (address !== undefined && cc?.baseUrl && cc.credential.declared) {
+            opts.logger?.warn("fleet_client_no_worker_scope", { note: "FLEET_ADVERTISE_ADDRESS set but SEMA_REGISTRY_WORKER missing — announce needs the worker (dispatch key); fleet client not started" });
+        }
         return undefined;
     }
-    return startFleetClient({ ...opts, center: { baseUrl: cc.baseUrl, credential: cc.credential, worker: cc.worker }, advertiseAddress: address });
+    const lane = cfg.configCenter;
+    return startFleetClient({ ...opts, center: { baseUrl: lane.baseUrl, credential: lane.credential, worker: lane.worker }, advertiseAddress: address });
 }
 //# sourceMappingURL=fleet-client.js.map

package/dist/fleet-lease.d.ts

@@ -1,29 +1,3 @@
-/**
- * Fleet worker-side QUOTA-LEASE consumption(调度框架 D4=AP 模式的 worker 半场;
- * 契约 = registry-core `/fleet` QuotaLease + center `POST /api/fleet/leases`,center 侧已实装并经
- * chaos 测试验证)。
- *
- * ## 模型(roaming/CDN)
- * center 把某 principal 全局预算的一片(默认 $5 slice / 1h TTL)预授权给 ONE worker;worker 本地扣减
- * (`recordSpend`,零 per-call 往返),`shouldRenewLease`(任一维度 80% 或寿命 80%)提前后台续租;center 用
- * usage 批报事后单调对账(`/api/fleet/usage` 入库顺手 reconcile —— worker 不需要单独上报 consumed)。
- *
- * ## 协商式发现(谁走 lease?)
- * worker 不在本地解析 EntitlementBudget —— 首次 admit 向 center POST,center 用 resolveEntitlement 判:
- *   - 200 {lease}                     → 该 principal 是 lease-enforced,进入本地扣减周期;
- *   - 409 "principal is not lease-enforced" → 负缓存 {@link NOT_LEASE_TTL_MS},走既有本地 CostQuota 路径;
- *   - 409 `code:"quota_exhausted"`    → 提交拒绝(429,镜像 quotaExceeded 姿势),短缓存防打爆 center;
- *   - 网络/5xx                        → **fail-open 放行**(AP 哲学:center 短暂不可达绝不停集群;对账兜底,
- *                                       过花敞口 ≤ slice 尺寸 —— 正是 D4 承诺的 trade)。
- * 单飞(single-flight):同 principal 并发首触/续租只发一个 RTT。
- *
- * ## 边界(documented,非疏漏)
- * - lease 状态 **in-memory**:worker 重启丢本地 consumed → center 续租时用 reports+monotone guard 补账,
- *   敞口同样 ≤ slice(AP 设计内)。
- * - 409 判别靠 center 返回的结构化 code(两端常量);center 侧变更时此处同步。
- * - 全部 swallow-guarded:lease 面绝不 fault 任务提交路径。
- */
-import { QuotaLease } from "@sema-agent/settings-schema/fleet";
 import { type CenterEndpoint } from "./config-center/center-request.js";
 /** 负缓存 TTL:非 lease-enforced 的 principal 多久后再问一次 center(entitlement 升级为 lease 的收敛上界)。 */
 export declare const NOT_LEASE_TTL_MS: number;
@@ -33,8 +7,18 @@ export declare const EXHAUSTED_RETRY_MS: number;
  *  重新协商,一次多余 RTT,无正确性影响。 */
 export declare const LEASE_PRINCIPAL_CAP = 4096;
 /** 复审 O1:lease 协商 RTT 的硬上限——leaseDenied 在提交热路径同步 await 它,一个 accept-but-hang 的
- *  center 必须迅速塌成 fail-open 而不是拖垮提交。取 2.5s(远小于任何续租余量,略紧于 registry 的 8s)。 */
+ *  center 必须迅速塌成连接级失败臂而不是拖垮提交。取 2.5s(远小于任何续租余量,略紧于 registry 的 8s)。 */
 export declare const LEASE_FETCH_TIMEOUT_MS = 2500;
+/** S-866 ③:`closed` 姿态下连接级失败给调用方的重试窗(秒)。**固定短窗** —— 不猜中心何时恢复;503 可重试,下一次提交就是
+ *  下一次谈判(失败臂不缓存,中心一恢复即恢复)。 */
+export declare const LEASE_UNAVAILABLE_RETRY_SEC = 5;
+/** S-866 ③:租约连接级失败的两种姿态(= caps `centerWiring.failMode` 的词表;生效值由 `createFleetLeaseFromEnv` 从
+ *  `FLEET_LEASE_FAIL_CLOSED` 定)。加一种 = 下面按姿态穷举的 `Record` 当场编译红。 */
+export declare const LEASE_FAIL_MODES: readonly ["open", "closed"];
+export type LeaseFailMode = (typeof LEASE_FAIL_MODES)[number];
+/** S-866 ③:`lease_unavailable` 的两个成因(503 体 `reason` 的词表,与 caps `leaseHealth` 的两个失败词同名)。 */
+export declare const LEASE_UNAVAILABLE_CAUSES: readonly ["auth-rejected", "unreachable"];
+export type LeaseUnavailableCause = (typeof LEASE_UNAVAILABLE_CAUSES)[number];
 /** E4 定稿的 409 结构化字段(center verbatim → 我方 429 body verbatim 透传;人话归壳/web)。 */
 export type QuotaDenyDetail = {
     windowType?: "fiveHour" | "weekly" | "budget";
@@ -43,17 +27,6 @@ export type QuotaDenyDetail = {
     isEstimate?: boolean;
     pool?: string;
 };
-type PrincipalState = {
-    kind: "lease";
-    lease: QuotaLease;
-} | {
-    kind: "not-lease";
-    until: number;
-} | {
-    kind: "exhausted";
-    until: number;
-    detail?: QuotaDenyDetail;
-};
 export type LeaseAdmission = {
     ok: true;
 } | {
@@ -61,12 +34,47 @@ export type LeaseAdmission = {
     reason: "budget_exhausted";
     retryAfterSec: number;
     detail?: QuotaDenyDetail;
+} | {
+    ok: false;
+    reason: "lease_unavailable";
+    cause: LeaseUnavailableCause;
+    retryAfterSec: number;
 };
+/** 一次被拒的准入(HTTP 映射 `leaseRefusalOf` 的入参闭集)。 */
+export type LeaseRefusalAdmission = Extract<LeaseAdmission, {
+    ok: false;
+}>;
+/**
+ * S-866 ② —— **最近一次谈判怎么收尾的**(`issueOrRenew` 收尾写;新状态,本管理器只此一枚)。闭集:
+ *  · `none` —— 本进程还没谈判过;
+ *  · `ok` —— 中心给了合法答复(200 租约 / 409 not-lease / 409 耗尽 —— 耗尽也是「中心在判」);
+ *  · `auth-error` —— 中心 401 / 403 / 400,或这一次读凭证失败(请求根本没发);
+ *  · `unavailable` —— 不可达 / 5xx / 超时 / 坏体 / 其它码。
+ * caps `centerWiring.leaseHealth` 由它投影({@link FleetLeaseManager.snapshot})。
+ */
+export declare const LEASE_ADMIT_OUTCOMES: readonly ["none", "ok", "auth-error", "unavailable"];
+export type LeaseAdmitOutcome = (typeof LEASE_ADMIT_OUTCOMES)[number];
+/** S-866 ② caps `centerWiring.leaseHealth` 的词表。 */
+export declare const LEASE_HEALTH_WORDS: readonly ["ok", "auth-rejected", "unreachable", "unobserved"];
+export type LeaseHealth = (typeof LEASE_HEALTH_WORDS)[number];
+/** S-866 ② caps `centerWiring.caller.lease` 的词表(F-1 裁定:过期 / 耗尽而未续成 ⇒ `unobserved`)。 */
+export declare const CALLER_LEASE_WORDS: readonly ["enforced", "not-enforced", "exhausted", "unobserved"];
+export type CallerLease = (typeof CALLER_LEASE_WORDS)[number];
+/** `snapshot()` 的产物(纯数据):调用方这一刻的租约读数 + 管理器最近一次谈判的健康位。`retryAfterSec` 只随 `exhausted`。 */
+export interface LeaseSnapshot {
+    readonly leaseHealth: LeaseHealth;
+    readonly caller: {
+        readonly lease: CallerLease;
+        readonly retryAfterSec?: number;
+    };
+}
 export interface FleetLeaseOpts {
     /** S-651:凭证是**来源**(每次协商取一次值),不是构造期烧进 header 的字符串。 */
     center: CenterEndpoint & {
         worker: string;
     };
+    /** S-866 ③:连接级失败臂的姿态。**必填** —— 安全轴上没有「不知道该放还是该拒」这一形(缺省在配置层按部署姿态派生,不在这里猜)。 */
+    failMode: LeaseFailMode;
     fetchImpl?: typeof fetch;
     logger?: {
         info?(msg: string, meta?: Record<string, unknown>): void;
@@ -84,6 +92,10 @@ export declare class FleetLeaseManager {
     private readonly f;
     private readonly now;
     private failStreak;
+    /** S-866 ②:最近一次谈判的收尾({@link LeaseAdmitOutcome})。只在 `issueOrRenewInner` 的各收尾点写。 */
+    private lastAdmit;
+    /** S-866 ③ 生效姿态(caps `centerWiring.failMode` 读的就是它 —— 与执行的那一只同源)。 */
+    readonly failMode: LeaseFailMode;
     constructor(opts: FleetLeaseOpts);
     /**
      * Admission check for one billed submission. Fast path is synchronous-shaped (live lease / fresh negative
@@ -104,25 +116,38 @@ export declare class FleetLeaseManager {
         weightedTokens?: number;
         costMicroUsd?: number;
     }): void;
-    /** Test/observability hook: the current state kind for a principal (never exposes the token). */
-    peek(principal: string): PrincipalState["kind"] | undefined;
+    /**
+     * S-866 ② —— 调用方这一刻的租约读数(caps `centerWiring.caller` / `leaseHealth` 的唯一来源;7.105.0 的 `peek()` 退役:它只回 kind、
+     * 不看 `until`,过期条目照回原 kind)。**纯读**:不打中心、不写状态、不动 LRU 序(`Map.get` 不改插入序)—— caps 路由自己不 admit。
+     * 规则表(设计稿 v1.1 §2②,逐行钉在 `test/fleet-lease.test.ts`):
+     *  · principal 缺席 / 无条目(含被 LRU 逐出)⇒ `unobserved`;
+     *  · `not-lease` 且 `now < until` ⇒ `not-enforced`;到期 ⇒ `unobserved`;
+     *  · `exhausted` 且 `now < until` ⇒ `exhausted` + `retryAfterSec = ceil((until-now)/1000)`(只此一处来源);到期 ⇒ `unobserved`;
+     *  · `lease` 未到期 ∧ 各轴有余(= `!leaseExhausted`,与 `admit` 同一判据)⇒ `enforced`;到期或耗尽而尚未续成 ⇒ `unobserved`
+     *    (F-1 裁定:此刻额度没人在判 —— 过期条目每次 admit 都去重谈,重谈失败靠连接级臂的姿态决定放不放)。
+     * `leaseHealth` 按 `lastAdmit`({@link LEASE_HEALTH_BY_OUTCOME})。
+     */
+    snapshot(principal: string | undefined, now: number): LeaseSnapshot;
     /** 🔴 复审 O2(Opus)的鉴权失败臂,S-651 起两个入口共用(中心 401/403/400;凭证文件不可读):运维配置事故,
-     *  不是可用性事件。仍 fail-open(凭证抖一下不许把租户锁在门外),但**每次**都 warn + 专用计数,且**不缓存**。 */
-    private authFailOpen;
+     *  不是可用性事件。**每次**都 warn + 专用计数,且**不缓存**(配置一修好下一次谈判即恢复)。放不放行归姿态
+     *  ({@link connectionFailure},S-866 ③):open = 照旧放行(凭证抖一下不许把单用户锁在门外);closed = 拒。 */
+    private authFailure;
+    /** S-866 ③:两条连接级失败臂的**唯一**收尾 —— 按姿态穷举(加一种姿态 = 编译红)。 */
+    private connectionFailure;
     private set;
     private issueOrRenew;
     private issueOrRenewInner;
 }
 /**
- * Env/config gate(与 startFleetClientFromEnv 同 D3 分层姿势,但 lease 不需要 FLEET_ADVERTISE_ADDRESS ——
- * 它是出站消费面,不是入站可达性声明):sema-registry lane 配齐(baseUrl + **声明了**凭证 + worker)即启;任一缺失 →
- * undefined,非 fleet 部署零行为变化。S-651:按**声明**装、不按内容装 —— `SEMA_REGISTRY_TOKEN_FILE`(`CENTER_CREDENTIAL_ENV.tokenFile`)在场而
+ * Env/config gate:中心车道配齐({@link centerLaneConfigured} —— 与 fleet 用量环 / 用量累加器**同一只**谓词,S-866 ④)即启;
+ * 不需要 FLEET_ADVERTISE_ADDRESS(它是出站消费面,不是入站可达性声明)。缺任一件 → undefined,非 fleet 部署零行为变化。
+ * S-651:按**声明**装、不按内容装 —— `SEMA_REGISTRY_TOKEN_FILE`(`CENTER_CREDENTIAL_ENV.tokenFile`)在场而
  * 文件此刻不可读,管理器照样装上(每次协商取值,失败走响亮的鉴权失败臂;文件恢复即恢复)。
  */
 export declare function createFleetLeaseFromEnv(cfg: {
     configCenter?: (CenterEndpoint & {
         worker?: string;
     }) | undefined;
-}, opts: Omit<FleetLeaseOpts, "center">): FleetLeaseManager | undefined;
-export {};
+    fleetLeaseFailClosed: boolean;
+}, opts: Omit<FleetLeaseOpts, "center" | "failMode">): FleetLeaseManager | undefined;
 //# sourceMappingURL=fleet-lease.d.ts.map

package/dist/fleet-lease.js

@@ -1,10 +1,26 @@
 import { QuotaLease, leaseExhausted, shouldRenewLease } from "@sema-agent/settings-schema/fleet";
 import { CenterCredentialUnavailableError } from "./center-credential.js";
-import { centerFetch } from "./config-center/center-request.js";
+import { centerFetch, centerLaneConfigured } from "./config-center/center-request.js";
 export const NOT_LEASE_TTL_MS = 10 * 60 * 1000;
 export const EXHAUSTED_RETRY_MS = 30 * 1000;
 export const LEASE_PRINCIPAL_CAP = 4096;
 export const LEASE_FETCH_TIMEOUT_MS = 2500;
+export const LEASE_UNAVAILABLE_RETRY_SEC = 5;
+export const LEASE_FAIL_MODES = ["open", "closed"];
+export const LEASE_UNAVAILABLE_CAUSES = ["auth-rejected", "unreachable"];
+const LOUD_BY_FAIL_MODE = {
+    open: { authWarn: "fleet_lease_auth_error_fail_open", unreachableWarn: "fleet_lease_unavailable_fail_open", unreachableMetric: "fleet_lease_fail_open_total", consequence: "budget NOT enforced until fixed" },
+    closed: { authWarn: "fleet_lease_auth_error_fail_closed", unreachableWarn: "fleet_lease_unavailable_fail_closed", unreachableMetric: "fleet_lease_fail_closed_total", consequence: "billed submissions refused (503 fleet.lease_unavailable) until fixed" },
+};
+export const LEASE_ADMIT_OUTCOMES = ["none", "ok", "auth-error", "unavailable"];
+export const LEASE_HEALTH_WORDS = ["ok", "auth-rejected", "unreachable", "unobserved"];
+export const CALLER_LEASE_WORDS = ["enforced", "not-enforced", "exhausted", "unobserved"];
+const LEASE_HEALTH_BY_OUTCOME = {
+    none: "unobserved",
+    ok: "ok",
+    "auth-error": "auth-rejected",
+    unavailable: "unreachable",
+};
 export class FleetLeaseManager {
     opts;
     state = new Map();
@@ -12,10 +28,13 @@ export class FleetLeaseManager {
     f;
     now;
     failStreak = 0;
+    lastAdmit = "none";
+    failMode;
     constructor(opts) {
         this.opts = opts;
         this.f = opts.fetchImpl ?? fetch;
         this.now = opts.now ?? Date.now;
+        this.failMode = opts.failMode;
     }
     async admit(principal) {
         const now = this.now();
@@ -41,13 +60,42 @@ export class FleetLeaseManager {
         st.lease.consumed.weightedTokens += d.weightedTokens ?? 0;
         st.lease.consumed.costMicroUsd += d.costMicroUsd ?? 0;
     }
-    peek(principal) {
-        return this.state.get(principal)?.kind;
+    snapshot(principal, now) {
+        const leaseHealth = LEASE_HEALTH_BY_OUTCOME[this.lastAdmit];
+        const st = principal === undefined ? undefined : this.state.get(principal);
+        if (st === undefined)
+            return { leaseHealth, caller: { lease: "unobserved" } };
+        switch (st.kind) {
+            case "not-lease":
+                return { leaseHealth, caller: { lease: now < st.until ? "not-enforced" : "unobserved" } };
+            case "exhausted":
+                return { leaseHealth, caller: now < st.until ? { lease: "exhausted", retryAfterSec: Math.ceil((st.until - now) / 1000) } : { lease: "unobserved" } };
+            case "lease":
+                return { leaseHealth, caller: { lease: leaseExhausted(st.lease, now) ? "unobserved" : "enforced" } };
+            default: {
+                const unhandled = st;
+                throw new Error(`fleet lease: unknown principal state ${JSON.stringify(unhandled)}`);
+            }
+        }
     }
-    authFailOpen(principal, status, note) {
-        this.opts.logger?.warn?.("fleet_lease_auth_error_fail_open", { status, principal, note });
+    authFailure(principal, status, note) {
+        const loud = LOUD_BY_FAIL_MODE[this.failMode];
+        this.lastAdmit = "auth-error";
+        this.opts.logger?.warn?.(loud.authWarn, { status, principal, note: `${note} (${loud.consequence})` });
         this.opts.metrics?.inc("fleet_lease_auth_error_total", { status: String(status) });
-        return { ok: true };
+        return this.connectionFailure("auth-rejected");
+    }
+    connectionFailure(cause) {
+        switch (this.failMode) {
+            case "open":
+                return { ok: true };
+            case "closed":
+                return { ok: false, reason: "lease_unavailable", cause, retryAfterSec: LEASE_UNAVAILABLE_RETRY_SEC };
+            default: {
+                const unhandled = this.failMode;
+                throw new Error(`fleet lease: unknown fail mode ${String(unhandled)}`);
+            }
+        }
     }
     set(principal, st) {
         if (!this.state.has(principal) && this.state.size >= LEASE_PRINCIPAL_CAP) {
@@ -80,10 +128,12 @@ export class FleetLeaseManager {
                 if (this.failStreak > 0)
                     this.opts.logger?.info?.("fleet_lease_recovered", { after: this.failStreak });
                 this.failStreak = 0;
+                this.lastAdmit = "ok";
                 this.opts.metrics?.inc("fleet_lease_issued_total");
                 return { ok: true };
             }
             if (res.status === 409) {
+                this.lastAdmit = "ok";
                 const body = (await res.json().catch(() => ({})));
                 if (body.code === "quota_exhausted") {
                     const until = this.now() + EXHAUSTED_RETRY_MS;
@@ -103,26 +153,28 @@ export class FleetLeaseManager {
                 return { ok: true };
             }
             if (res.status === 401 || res.status === 403 || res.status === 400) {
-                return this.authFailOpen(principal, res.status, "center rejected the lease request — check the service token / worker id / center URL (budget NOT enforced until fixed)");
+                return this.authFailure(principal, res.status, "center rejected the lease request — check the service token / worker id / center URL");
             }
             throw new Error(`lease ${res.status}`);
         }
         catch (err) {
             if (err instanceof CenterCredentialUnavailableError) {
-                return this.authFailOpen(principal, "credential-unreadable", `${err.reason} — no lease request sent (budget NOT enforced until the credential is readable)`);
+                return this.authFailure(principal, "credential-unreadable", `${err.reason} — no lease request sent`);
             }
+            const loud = LOUD_BY_FAIL_MODE[this.failMode];
+            this.lastAdmit = "unavailable";
             this.failStreak += 1;
             if (this.failStreak === 1)
-                this.opts.logger?.warn?.("fleet_lease_unavailable_fail_open", { error: err instanceof Error ? err.message : String(err) });
-            this.opts.metrics?.inc("fleet_lease_fail_open_total");
-            return { ok: true };
+                this.opts.logger?.warn?.(loud.unreachableWarn, { error: err instanceof Error ? err.message : String(err), consequence: loud.consequence });
+            this.opts.metrics?.inc(loud.unreachableMetric);
+            return this.connectionFailure("unreachable");
         }
     }
 }
 export function createFleetLeaseFromEnv(cfg, opts) {
-    const cc = cfg.configCenter;
-    if (!cc?.baseUrl || !cc.credential.declared || !cc.worker)
+    if (!centerLaneConfigured(cfg))
         return undefined;
-    return new FleetLeaseManager({ ...opts, center: { baseUrl: cc.baseUrl, credential: cc.credential, worker: cc.worker } });
+    const cc = cfg.configCenter;
+    return new FleetLeaseManager({ ...opts, center: { baseUrl: cc.baseUrl, credential: cc.credential, worker: cc.worker }, failMode: cfg.fleetLeaseFailClosed ? "closed" : "open" });
 }
 //# sourceMappingURL=fleet-lease.js.map

package/dist/governance-http-status.d.ts

@@ -18,7 +18,6 @@ export declare const GOVERNANCE_HTTP_STATUS: {
     readonly "memory.admission_denied": 403;
     readonly "memory.admission_required": 503;
     readonly "memory.capture_optout_denied": 403;
-    readonly "config.tool_mount_denied": 400;
     readonly "config.locked_key": 400;
     readonly "usage.window_exhausted": null;
     readonly "config.compliance_required": null;

package/dist/governance-http-status.js

@@ -2,7 +2,6 @@ export const GOVERNANCE_HTTP_STATUS = {
     "memory.admission_denied": 403,
     "memory.admission_required": 503,
     "memory.capture_optout_denied": 403,
-    "config.tool_mount_denied": 400,
     "config.locked_key": 400,
     "usage.window_exhausted": null,
     "config.compliance_required": null,

package/dist/hosted-posture.d.ts

@@ -59,7 +59,7 @@
  * 一台多用户 / 团队机器只要运维**忘设** `REQUIRE_PRINCIPAL`,本判据就**看不见**它 —— 无论它有没有
  * 配签发方、受不受 reconciler 管。那台机器上:`principal` 缺席走单用户 `"default"` 赦免 ⇒ 全服无主会话
  * 被列给每一个调用方;上面四条能力授予面(hooks / `settings.env` / `cwd` / `additionalDirectories`)对每个
- * 调用方打开;写容纳面天花板与 `approverPosture` 留声两条腿(下文)也按单用户放行。
+ * 调用方打开;写容纳面天花板那条腿(下文)也按单用户放行。
  * `settings.env` 的射程要说准:适配器的 `env` 是**并**到 `process.env` 上的逐键覆盖(`plugins/remote-env-host.ts`
  * 的 `mergeEnv`),而 `task-settings.ts` 的 `cleanEnvMap` 没有任何键名拒集 ⇒ `PATH` / `LD_PRELOAD` /
  * `NODE_OPTIONS` 一视同仁。
@@ -101,22 +101,6 @@ export type TaskWriteFaceInput = TaskHostPostureScope & Readonly<Pick<ServiceCon
 export declare const HOST_POSTURE_REFUSED_CODE = "request.host_posture_refused";
 /** 射程判据读的键集(托管证据 + 车道)。 */
 export type TaskHostPostureScope = HostedPostureInput & Readonly<Pick<ServiceConfigFlat, "remoteExec">>;
-/**
- * **腿③(clay 裁定① 2026-09-22)** —— `approverPosture` 在这台部署上兑现吗?`false` ⇒ 调用点
- * **忽略 + 留声**(与 `task_hooks_ignored` / `task_cwd_ignored` / `task_shell_env_ignored` 同姿势)。
- *
- * 🔴 **为什么这一条不拒**(初版给了 422,当批撤回):这个键**零授权** —— 引擎只把它渲给模型,没有任何
- * 裁决腿读它(`http/wire-types.ts` 的字段注逐字,来源是 core 的 `ApproverPosture` 头注)。而续跑腿
- * **逐字重放盘上的体**,调用方**删不掉**它 ⇒ 一条 park 会被永久砖死;plan_review 驱动段(`drivePlanReview`)上更贵:
- * nonce 先烧、拒在其后才抛,运维重签再撞同一个拒 = 无限循环。本仓对这一类的成文结论逐字是
- * 「**砖死 resume 比降级糟**」(`boot/resolve-spec.ts` 顶部那段列了三处先例)。
- * ⇒ 把本批最硬的处置给族里**危害最小**的成员,方向是错的。
- *
- * ⚠️ 它**不是**没有危害:引擎据此把 bypass 指令渲给模型,而那段文字指示模型**改用 Bash 改文件**
- * 而不是用文件工具 ⇒ 写动作从**文件带**(core 写门 / `sensitiveWritePatterns` / `writeProtectedPaths`)
- * 挪到**shell 带**(`shellGate`)。所以它要被**忽略**,而不是原样过境;留声让运维看得见。
- */
-export declare function taskApproverPostureHonored(c: TaskHostPostureScope): boolean;
 /**
  * **腿②** —— 这条请求要掀开写围栏,这台部署给不给?返回拒因;`undefined` = 放行。
  *
@@ -129,4 +113,9 @@ export declare function taskApproverPostureHonored(c: TaskHostPostureScope): boo
  * 两条腿同射程、不同处置,射程只有一处答案。
  */
 export declare function taskWriteFaceRefusal(c: TaskWriteFaceInput): string | undefined;
+/**
+ * **腿④** —— 这条请求要让 host shell 继承整份用户环境(`inheritEnv:"all"`),这台部署给不给?返回拒因;`undefined` = 放行。
+ * 调用方只在值为 `"all"` 时问(`"scrub"` 就是缺省,任何部署都受理)。
+ */
+export declare function taskInheritEnvRefusal(c: TaskHostPostureScope): string | undefined;
 //# sourceMappingURL=hosted-posture.d.ts.map

package/dist/hosted-posture.js

@@ -22,22 +22,19 @@ function hostPostureDeclarationsHonored(c) {
         return true;
     return !buildHostedPosture(c).hosted;
 }
-export function taskApproverPostureHonored(c) {
-    return hostPostureDeclarationsHonored(c);
-}
 export function taskWriteFaceRefusal(c) {
     switch (c.taskWriteFaceEscalation) {
         case "allow":
             return undefined;
         case "refuse":
-            return (`permissionMode:"bypassPermissions" opens the WRITE containment face (TaskSpec.writeFace:"open") — the run could write outside the task root. ` +
+            return (`permissionMode:"bypassPermissions" opens the WRITE containment face (the engine's bypassPermissions mode writes outside the write roots) — the run could write outside the task root. ` +
                 `Refused because this deployment pins TASK_WRITE_FACE_ESCALATION=refuse (the operator's own declaration — it wins over any request, unconditionally). ` +
                 `Omit permissionMode:"bypassPermissions", or ask the operator for TASK_WRITE_FACE_ESCALATION=allow.`);
         case undefined:
             break;
         default: {
             const unhandled = c.taskWriteFaceEscalation;
-            return (`permissionMode:"bypassPermissions" opens the WRITE containment face (TaskSpec.writeFace:"open") — the run could write outside the task root. ` +
+            return (`permissionMode:"bypassPermissions" opens the WRITE containment face (the engine's bypassPermissions mode writes outside the write roots) — the run could write outside the task root. ` +
                 `Refused because this deployment carries an UNRECOGNISED TASK_WRITE_FACE_ESCALATION word (${String(unhandled)}) — a knob this build cannot interpret is never read as permission. ` +
                 `Set TASK_WRITE_FACE_ESCALATION to one of ${TASK_WRITE_FACE_ESCALATIONS.join(" | ")}, or unset it to let the deployment posture decide.`);
         }
@@ -45,8 +42,16 @@ export function taskWriteFaceRefusal(c) {
     if (hostPostureDeclarationsHonored(c))
         return undefined;
     const facts = buildHostedPosture(c);
-    return (`permissionMode:"bypassPermissions" opens the WRITE containment face (TaskSpec.writeFace:"open") — the run could write outside the task root. ` +
+    return (`permissionMode:"bypassPermissions" opens the WRITE containment face (the engine's bypassPermissions mode writes outside the write roots) — the run could write outside the task root. ` +
         `Refused because this deployment is HOSTED/multi-tenant (${hostedBecause(facts)}), so the task layer may only TIGHTEN the write face, never open it. ` +
         `Set TASK_WRITE_FACE_ESCALATION=allow if the DEPLOYMENT permits the task layer to open it, or omit permissionMode:"bypassPermissions".`);
 }
+export function taskInheritEnvRefusal(c) {
+    if (hostPostureDeclarationsHonored(c))
+        return undefined;
+    const facts = buildHostedPosture(c);
+    return (`inheritEnv:"all" hands the model-driven host shell this machine's WHOLE environment (credential-shaped variables included — the host lane scrubs them by default). ` +
+        `Refused because this deployment is HOSTED/multi-tenant (${hostedBecause(facts)}), so the task layer may not widen what the shell inherits. ` +
+        `Omit inheritEnv (or send "scrub"); "all" is honored only on a single-user deployment.`);
+}
 //# sourceMappingURL=hosted-posture.js.map

package/dist/http/admission.d.ts

@@ -54,7 +54,7 @@ export declare const MAX_OUTPUT_SCHEMA_CHARS = 32768;
 export declare function validateUserSkills(skills: unknown): string | null;
 export declare function createAdmission(ctx: {
     deps: FlatServiceDeps;
-    runnerFor: NonNullable<FlatServiceDeps["runnerFor"]>;
+    runnerFor: FlatServiceDeps["runnerFor"];
 } & Pick<RouteHelpers, "readJson">): {
     prepareSpec: (req: IncomingMessage, res: ServerResponse, bodyIn?: TaskRequestBody, onTypedFailure?: (err: HttpError) => void, legFacts?: {
         liveStream?: boolean;