@sema-agent/server 7.105.0 → 7.106.0

package/dist/http/resume-legs.js

@@ -37,6 +37,7 @@ import { createCapabilitiesLocal } from "./routes/capabilities.js";
 import { gatedPrincipal, explicitOperatorOk } from "./principal-gate.js";
 import { buildActiveRunConflict, resumeEntryForGate } from "./active-run-conflict.js";
 import { commitPlacement, devicePlacementErrorBody } from "./device-placement.js";
+import { commitSessionInheritEnv } from "./session-inherit-env.js";
 import { ASK_USER_QUESTION_TOOL_NAME } from "../approval-content-kind.js";
 import { readResumeCtx, resumeCtxCorruptAnswer } from "./resume-ctx-read.js";
 import { httpErrorCode } from "./send.js";
@@ -265,6 +266,7 @@ export function createResumeLegs(ctx) {
                     sessionFaceOf: deps.sessionStorage?.sessionFaceOf ? deps.sessionStorage.sessionFaceOf.bind(deps.sessionStorage) : sessionFaceUnavailable,
                     ...(deps.parkedKnownAgentTypes ? { knownAgentTypes: deps.parkedKnownAgentTypes } : {}),
                     ...(deps.parkedReviveInheritedGate ? { rebuildInheritedGate: deps.parkedReviveInheritedGate } : {}),
+                    ...(deps.toolApproval ? { approverSeatFor: deps.toolApproval.boundUnattendedAsk } : {}),
                     ...(deps.logger ? { warn: parkWarn } : {}),
                 }, parkedReq, { handle: origin.handle, row: origin.row }));
                 void ctxPromise.catch(() => { });
@@ -297,7 +299,7 @@ export function createResumeLegs(ctx) {
         if (!ctx)
             return { status: 409, body: { error: "resume context missing — cannot rebuild task config", errorCode: "conflict.resume_context_unavailable" } };
         const auth = { sessionId: cp.sessionId, principal: decodeCheckpointScope(cp.scope), memoryScope: ctx.memoryScope };
-        const resolved = await resolveResumeSpecOrBlocked(ctx.body, req, auth);
+        const resolved = await resolveResumeSpecOrBlocked(ctx, req, auth);
         if (!resolved.ok)
             return resolved.answer;
         const { spec, engineNotices } = resolved;
@@ -329,14 +331,18 @@ export function createResumeLegs(ctx) {
     }
     const ONE_SHOT_HISTORY_KEYS = ["resumeAt", "restoreFiles", "acceptPartialRestore", "rewindFilesTo", "rewindFiles"];
     const ONE_SHOT_HISTORY_STRIP = Object.fromEntries(ONE_SHOT_HISTORY_KEYS.map((k) => [k, undefined]));
-    const resolveResumeSpec = async (body, req, auth) => {
+    const resolveResumeSpec = async (ctx, req, auth) => {
         const engineNotices = [];
-        const spec = await deps.resolveSpec({ ...body, ...ONE_SHOT_HISTORY_STRIP }, req, auth, { leg: "resume", onNotice: (n) => engineNotices.push(n) });
+        const spec = await deps.resolveSpec({ ...ctx.body, ...ONE_SHOT_HISTORY_STRIP }, req, auth, {
+            leg: "resume",
+            onNotice: (n) => engineNotices.push(n),
+            ...(ctx.unattendedLeg === true ? { unattendedLeg: true } : {}),
+        });
         return { spec, engineNotices };
     };
-    const resolveResumeSpecOrBlocked = async (body, req, auth) => {
+    const resolveResumeSpecOrBlocked = async (ctx, req, auth) => {
         try {
-            const { spec, engineNotices } = await resolveResumeSpec(body, req, auth);
+            const { spec, engineNotices } = await resolveResumeSpec(ctx, req, auth);
             return { ok: true, spec, engineNotices };
         }
         catch (e) {
@@ -427,7 +433,7 @@ export function createResumeLegs(ctx) {
         if (deps.toolApproval && taskId) {
             const toolApproval = deps.toolApproval;
             resumeTaskConfig.onAsk = approvalLeg.windowZero
-                ? (askReq) => Promise.resolve(toolApproval.unattendedAskOutcome({ taskId, owner: principal ?? null, toolName: askReq.toolName }))
+                ? toolApproval.boundUnattendedAsk({ owner: principal ?? null, taskId, sessionId })
                 : toolApproval.boundAsk({
                     owner: principal ?? null,
                     taskId,
@@ -491,6 +497,7 @@ export function createResumeLegs(ctx) {
             deps.modelUsage?.register(taskId);
             resumeManifestLease = deps.promptManifests?.register(taskId) ?? 0;
         }
+        commitSessionInheritEnv(deps, sessionId, resumeCtx.ctx.body);
         if (args.onResumeCommitted)
             await args.onResumeCommitted();
         let unregisterEngineNotice;
@@ -1061,7 +1068,7 @@ export function createResumeLegs(ctx) {
             return { status: 409, body: { error: "resume context missing — cannot rebuild task config", errorCode: "conflict.resume_context_unavailable" } };
         const ctx = ctxRead.ctx;
         const auth = { sessionId: cp.sessionId, principal: decodeCheckpointScope(cp.scope), memoryScope: ctx.memoryScope };
-        const resolved = await resolveResumeSpecOrBlocked(ctx.body, req, auth);
+        const resolved = await resolveResumeSpecOrBlocked(ctx, req, auth);
         if (!resolved.ok)
             return resolved.answer;
         const { spec, engineNotices } = resolved;
@@ -1093,7 +1100,7 @@ export function createResumeLegs(ctx) {
         if (windowDenial)
             return { status: windowDenial.status, body: windowDenial.body };
         const auth = { sessionId, principal, memoryScope: ctx.memoryScope };
-        const resolved = await resolveResumeSpecOrBlocked(ctx.body, req, auth);
+        const resolved = await resolveResumeSpecOrBlocked(ctx, req, auth);
         if (!resolved.ok)
             return resolved.answer;
         const { spec, engineNotices } = resolved;
@@ -1167,7 +1174,7 @@ export function createResumeLegs(ctx) {
             return { status: 409, body: { error: "resume context missing — cannot rebuild task config", errorCode: "conflict.resume_context_unavailable" } };
         const ctx = ctxRead.ctx;
         const auth = { sessionId: cp.sessionId, principal: decodeCheckpointScope(cp.scope), memoryScope: ctx.memoryScope };
-        const resolved = await resolveResumeSpecOrBlocked(ctx.body, req, auth);
+        const resolved = await resolveResumeSpecOrBlocked(ctx, req, auth);
         if (!resolved.ok)
             return resolved.answer;
         const { spec, engineNotices } = resolved;
@@ -1267,7 +1274,8 @@ export function createResumeLegs(ctx) {
         }
         const approvedMode = decision === "approve" && effMode === "plan" ? (permissionModeAfter ?? "default") : undefined;
         const resumeBody = approvedMode === undefined ? ctx.body : { ...ctx.body, permissionMode: approvedMode };
-        const resolved = await resolveResumeSpecOrBlocked(resumeBody, req, auth);
+        const rebuildCtx = { ...ctx, body: resumeBody };
+        const resolved = await resolveResumeSpecOrBlocked(rebuildCtx, req, auth);
         if (!resolved.ok)
             return resolved.answer;
         const { spec, engineNotices } = resolved;
@@ -1279,7 +1287,7 @@ export function createResumeLegs(ctx) {
             ...(editedPlan !== undefined ? { editedPlan } : {}),
             ...(reason ? { reason } : {}),
         };
-        const out = await driveResumeIntoRunLog({ runner: runnerFor(spec), token, sessionId: cp.sessionId, principal: auth.principal, fleetScope: resumeFleetScope(req, auth), taskConfig, resumeObjective, outcome, verifyRounds, resumeCtx: { sessionId, ctx: { ...ctx, body: resumeBody } }, ...(engineNotices.length > 0 ? { engineNotices } : {}), ...(acceptEarly === true ? { acceptEarly: true } : {}), ...(req !== undefined ? { callerInitiated: true } : {}) });
+        const out = await driveResumeIntoRunLog({ runner: runnerFor(spec), token, sessionId: cp.sessionId, principal: auth.principal, fleetScope: resumeFleetScope(req, auth), taskConfig, resumeObjective, outcome, verifyRounds, resumeCtx: { sessionId, ctx: rebuildCtx }, ...(engineNotices.length > 0 ? { engineNotices } : {}), ...(acceptEarly === true ? { acceptEarly: true } : {}), ...(req !== undefined ? { callerInitiated: true } : {}) });
         return out;
     }
     const routeCtxBase = {

package/dist/http/route-ctx.d.ts

@@ -147,6 +147,15 @@ export interface CheckpointCtx {
     body: TaskRequestBody;
     /** 提交时这条会话绑定的记忆域(重建 `RequestAuth` 用);缺席 = 没有记忆面。 */
     memoryScope?: string;
+    /**
+     * 🔴 S-877 候裁 18(codex r3 F1)—— 这条会话的 run 是**无人值守腿**铸的(今天唯一的写者 = leader worker 的 durable 块,
+     * `leader/wire.ts`),**服务端写、不来自请求体**(`body` 是提交体;本位是它的兄弟键,客户端够不着)。
+     * 续跑家族据此请 `resolveSpec` 带 `unattendedLeg: true`,由它按续跑 Runner 的同名座经 `createUnattendedLeg` / `withUnattendedLeg`
+     * 重挂整条腿(模式 = 旋钮、写面 roots、模式释放写保护时的写保护拒层)—— 拒层是活闭包、进不了 checkpoint,而 core 在 spec 不说
+     * 模式时取 checkpoint 记下的那一个(`seat ?? recorded`),不重挂 = 续跑落 bypass 而拒层缺席。写回口(`DriveResumeArgs.resumeCtx`)
+     * 传原 ctx / 其展开 ⇒ 标随行。缺席 = 不是无人值守腿(HTTP 提交腿;7.106.0 前落盘的行 —— 那时这些腿不铸模式,checkpoint 里也没有)。
+     */
+    unattendedLeg?: true;
 }
 /** B4①(命名化):`driveResumeIntoRunLog` 的入参形(resume 家族共用)——原为 9 成员内联匿名对象。 */
 export interface DriveResumeArgs {

package/dist/http/routes/approvals-assistant.js

@@ -347,7 +347,6 @@ export async function handleApprovalsAssistant(req, res, match, ctx) {
                     ...(s.mandate !== undefined ? { mandate: s.mandate } : {}),
                     ...(s.denialLimitFallback !== undefined ? { denialLimitFallback: s.denialLimitFallback } : {}),
                     ...(s.origin !== undefined ? { origin: s.origin } : {}),
-                    ...(s.ruleStoreUnreadable !== undefined ? { ruleStoreUnreadable: s.ruleStoreUnreadable } : {}),
                     objective,
                     input,
                 };

package/dist/http/routes/capabilities.js

@@ -1,9 +1,9 @@
 import { expandTiers, reasoningEffortLevelsOf, routePairingStatus } from "@sema-agent/core";
 import { isModelAllowlisted, selectableCatalog } from "../../model-select.js";
-import { resolveModelApiKey } from "../../key-resolver.js";
-import { isSealedKeyPoison, projectSealedKeyCapability } from "../../sealed-key.js";
+import { modelKeyPoisonOf, resolveModelApiKey } from "../../key-resolver.js";
+import { projectSealedKeyCapability } from "../../sealed-key.js";
 import { cwdHonored, deviceCwdHonored } from "../../task-cwd.js";
-import { taskApproverPostureHonored, taskWriteFaceRefusal } from "../../hosted-posture.js";
+import { taskWriteFaceRefusal } from "../../hosted-posture.js";
 import { autonomyOverrides } from "../../runtime-governance.js";
 import { DEVICE_PROTOCOL_VERSION, DEVICE_WS_PATH } from "../../device-ws-protocol.js";
 import { a2aInjectionHonored } from "../../task-a2a.js";
@@ -16,9 +16,10 @@ import { fileHistoryCaptureOf } from "../../file-history-capture.js";
 import { resolveStreamApprovalGate } from "../../tool-approval.js";
 import { projectMemoryEngineCapability } from "../../memory-posture.js";
 import { projectWriteProtectionCapability } from "../../write-protection.js";
-import { projectSqlEngineCapability } from "../../sql-engine-posture.js";
+import { projectStoreCapability } from "../../store-posture.js";
 import { projectWebSearchCapability } from "../../plugins/web-search.js";
 import { projectExecutionLaneCapability } from "../../capabilities/execution-lane.js";
+import { gateCompositeMembers } from "../../capabilities/composite-members.js";
 import { projectApprovalsStreamLiveCapability } from "../../capabilities/approvals-push.js";
 import { workflowModelAllowlistFor, selfOrchestrationDenial } from "../../task-workflow.js";
 import { centerEntitlementSourceWired } from "../../runtime-caps-resolver.js";
@@ -27,7 +28,7 @@ import { coercePermissionModeStrict, SETTINGS_PERMISSION_MODE_WORDS } from "../.
 import { gatedPrincipal, sendPrincipalRefusal } from "../principal-gate.js";
 import { sessionBackgroundFacesAvailable } from "./background.js";
 function routePairingOf(deps, name, m) {
-    if (isSealedKeyPoison(deps.config.modelApiKeys?.[name]))
+    if (modelKeyPoisonOf(name, deps.config.modelApiKeyEnv ?? {}, process.env, deps.config.modelApiKeys ?? {}) !== undefined)
         return "unknown";
     const key = resolveModelApiKey(name, deps.config.modelApiKeyEnv ?? {}, process.env, deps.config.modelApiKeys ?? {});
     return routePairingStatus(deps.routeJudgeBrain ?? {}, m, key !== undefined ? { apiKey: key } : undefined);
@@ -65,11 +66,11 @@ export async function handleCapabilities(req, res, match, ctx) {
                 return;
             }
             const entitlementSource = centerEntitlementSourceWired(deps.config);
-            const { fault: autoModeFault, ...autoMode } = await judgeAutoModeArming(deps.autoModeFace, { requestedMode, principal: gatedPrincipal(req, deps.config), entitlementSource, localDeny: deps.config.permissionsDisableAutoMode });
+            const { fault: autoModeFault, ...autoMode } = await judgeAutoModeArming(deps.autoModeFace, { requestedMode, principal: gatedPrincipal(req, deps.config), localDeny: deps.config.permissionsDisableAutoMode });
             if (autoModeFault !== undefined)
                 deps.logger?.warn("auto_mode_face_resolver_fault", { fault: autoModeFault });
             const rulesLaneReachable = Boolean(deps.ruleConsent) && gatedPrincipal(req, deps.config) !== undefined;
-            sendJson(res, 200, {
+            sendJson(res, 200, gateCompositeMembers({
                 ...deps.capabilities,
                 asyncRuns: Boolean(deps.runStore),
                 artifacts: Boolean(deps.runStore),
@@ -88,7 +89,8 @@ export async function handleCapabilities(req, res, match, ctx) {
                 memory: false,
                 memoryWrite: false,
                 memoryEngine: projectMemoryEngineCapability(deps.memoryPosture),
-                sql: projectSqlEngineCapability(deps.sqlEngineFacts?.()),
+                store: projectStoreCapability(deps.storePosture ?? { declared: deps.config.dbBackend, backend: "memory" }, deps.sqlEngineFacts?.()),
+                centerWiring: deps.centerWiring?.(gatedPrincipal(req, deps.config)),
                 webSearch: projectWebSearchCapability(deps.webSearchProvider),
                 sessionBackgroundable: Boolean(deps.runStore),
                 runMemoryCaptureOptOut: Boolean(deps.runStore),
@@ -125,7 +127,7 @@ export async function handleCapabilities(req, res, match, ctx) {
                     accepted: true,
                     classifierSeat: deps.autoModeFace?.seatMounted === true,
                     entitlementSource,
-                    intentArming: deps.autoModeFace?.engineArmsOnIntent === true,
+                    intentArming: true,
                     ...autoMode,
                 },
                 readFace: deps.config.readFace ?? null,
@@ -141,7 +143,6 @@ export async function handleCapabilities(req, res, match, ctx) {
                 projectContext: cwdHonored(deps.config),
                 callerCwd: cwdHonored(deps.config) || deviceCwdHonored(deps.config),
                 taskWriteFaceOpen: taskWriteFaceRefusal(deps.config) === undefined && autonomyOverrides(deps.config.autonomy).writeFace !== "roots",
-                taskApproverPosture: taskApproverPostureHonored(deps.config),
                 executionLane: projectExecutionLaneCapability(deps.config),
                 mcpInjection: mcpInjectionHonored(deps.config),
                 a2a: true,
@@ -200,7 +201,7 @@ export async function handleCapabilities(req, res, match, ctx) {
                 manualCompact: Boolean(deps.runStore),
                 configCatalog: deps.config.configCatalogEnabled === true && deps.config.operatorPrincipals.length > 0,
                 sealedKey: projectSealedKeyCapability(deps.sealedKeyPublic),
-            });
+            }));
             return;
         }
         case "capability-mcp": {

package/dist/http/routes/config-catalog.js

@@ -2,7 +2,7 @@ import { DOMAINS } from "@sema-agent/settings-schema";
 import { sendJson, sendError } from "../send.js";
 import { gatedPrincipal, explicitOperatorOk, sendPrincipalRefusal } from "../principal-gate.js";
 import { assertNever } from "../route-ctx.js";
-import { configKnobTable } from "../../config.js";
+import { buildRetiredEnvWire, configKnobTable } from "../../config.js";
 import { buildConfigCatalog } from "../../config-catalog.js";
 export const CONFIG_CATALOG_PATH = "/v1/config/catalog";
 const OPERATOR_ONLY_MESSAGE = "the config catalog is operator-only: the caller principal is not in OPERATOR_PRINCIPALS (an empty list means NO one is an operator — configure it to enable this endpoint)";
@@ -27,6 +27,7 @@ export async function handleConfigCatalog(req, res, match, ctx) {
                 knobs: configKnobTable(),
                 centerDomains: DOMAINS,
                 centerManagedKeys: deps.configCenterManagedKeys?.(),
+                retired: buildRetiredEnvWire(),
             }));
             return;
         }

package/dist/http/routes/diagnostics.js

@@ -1,5 +1,6 @@
 import { buildPostureKnobReading } from "../../posture-source.js";
 import { buildReadFaceWiring } from "../../read-face-posture.js";
+import { projectExecutionLaneCapability } from "../../capabilities/execution-lane.js";
 import { resolveStreamApprovalGate } from "../../tool-approval.js";
 import { sendJson, sendError } from "../send.js";
 import { gatedPrincipal, explicitOperatorOk, isLoopbackAddress, verifiedIdentitySource } from "../principal-gate.js";
@@ -104,6 +105,7 @@ export async function handleDiagnostics(req, res, match, ctx) {
                 sqlEngine: deps.sqlEngineFacts?.() ?? null,
                 writeProtection: deps.writeProtection ?? null,
                 readFace: buildReadFaceWiring(deps.config),
+                executionLane: projectExecutionLaneCapability(deps.config),
                 configApply: deps.configApplyState?.() ?? null,
                 mcpRevocations: deps.mcpRevocationState?.() ?? null,
                 serverGates: buildServerWiringGates({

package/dist/http/routes/tasks.js

@@ -22,6 +22,7 @@ import { buildApprovalPreamble, buildApprovalPreambleSseFrames } from "../../app
 import { createApprovalCardEmitter, resolveApprovalLeg, resolveStreamApprovalGate } from "../../tool-approval.js";
 import { buildActiveRunConflict, toDoneFrameResult } from "../active-run-conflict.js";
 import { commitPlacement, devicePlacementErrorBody } from "../device-placement.js";
+import { commitSessionInheritEnv } from "../session-inherit-env.js";
 import { headerStr, gatedPrincipal, explicitOperatorOk } from "../principal-gate.js";
 import { failOpenTagForDroppedFrame, recordFailOpen } from "../../observability/fail-open.js";
 import { buildSyncSubmitBody } from "../sync-submit-body.js";
@@ -248,6 +249,7 @@ export async function handleTasks(req, res, match, ctx) {
                     }
                     durableTaskId = tid;
                 }
+                commitSessionInheritEnv(deps, prepared.spec.sessionId, prepared.body);
                 if (prepared.spec.sessionId)
                     markChildrenStoppedByUserOnAbort(ac.signal, durableTaskId ?? prepared.spec.sessionId, prepared.auth?.principal);
                 let ledgerSink;
@@ -633,7 +635,7 @@ export async function handleTasks(req, res, match, ctx) {
                     if (deps.toolApproval) {
                         const toolApproval = deps.toolApproval;
                         prepared.spec.onAsk = windowZero
-                            ? (askReq) => Promise.resolve(toolApproval.unattendedAskOutcome({ taskId: askTaskId, owner: askOwner, toolName: askReq.toolName }))
+                            ? toolApproval.boundUnattendedAsk({ owner: askOwner, taskId: askTaskId, ...(prepared.spec.sessionId ? { sessionId: prepared.spec.sessionId } : {}) })
                             : toolApproval.boundAsk({
                                 owner: askOwner,
                                 taskId: askTaskId,
@@ -795,6 +797,7 @@ export async function handleTasks(req, res, match, ctx) {
                     deps.sessionTitler?.maybeTitle(prepared.spec.sessionId, prepared.spec.objective, typeof prepared.spec.model === "string" ? prepared.spec.model : prepared.spec.model?.id);
                     durableTaskId = tid;
                 }
+                commitSessionInheritEnv(deps, prepared.spec.sessionId, prepared.body);
                 if (deps.checkpointStore && prepared.spec.sessionId) {
                     await deps.checkpointStore.putCtx(prepared.spec.sessionId, { body: prepared.body, memoryScope: prepared.auth?.memoryScope });
                 }

package/dist/http/server.d.ts

@@ -104,11 +104,15 @@ export interface ServiceCoreDeps {
      *  缺席(桩)⇒ 只走结构化日志终点,行为逐字不变。
      *  ⚠️ 7.69.0(R-1)起 **resume 家族也递这一位** —— 四条 resume 腿收敛到 `resolveResumeSpec` 一只 resolver,
      *  通告口接一次、四腿同得(见 http/server.ts 的 `resolveResumeSpec` 顶注);此处旧注写作「resume 家族缺席」
-     *  已过期,按新行为改。 */
+     *  已过期,按新行为改。
+     *  `opts.unattendedLeg`(S-877 候裁 18,codex r3 F1):续跑家族在 ctx 带无人值守标(`CheckpointCtx.unattendedLeg`)时递 `true` ——
+     *  装配器在**全部折叠之后**经 `createUnattendedLeg` / `withUnattendedLeg` 重挂那条腿(表 / 根取续跑 Runner 的同名座)。只由续跑腿
+     *  按服务端写的 ctx 位递,绝不从请求体读。 */
     resolveSpec: (body: TaskRequestBody, req: IncomingMessage | undefined, auth?: RequestAuth, opts?: {
         leg?: "fresh" | "resume";
         liveStream?: boolean;
         onNotice?: (notice: EngineNotice) => void;
+        unattendedLeg?: true;
     }) => TaskSpec | Promise<TaskSpec>;
     /**
      * [ref] 场景 hands lane 选路:按 `resolveSpec` 刚产出的 TaskSpec 取本任务的执行 Runner。
@@ -339,6 +343,12 @@ export interface ServiceSeamDeps {
      * 所以三者的在场性是同一个事实;族内 501 谓词因此可以是「三件齐」这一句话。
      */
     deviceEnrollment?: import("../device-enrollment.js").DeviceEnrollment;
+    /**
+     * S-895 × 7.106.0 合并复审 X1:host 车道会话登记簿的 `inheritEnv` **写口**(`boot/execution-env.ts` 的 `setSessionInheritEnv`)。
+     * 唯一调用者 = `http/session-inherit-env.ts` 的 `commitSessionInheritEnv`(四个 run 认领点在认领之后调;判据与残余见那只文件)。
+     * 缺席 = 本部署不是 host 车道(没有工厂读这一格)⇒ 提交点 no-op。装配 = `boot/stage-10-http-server.ts`(host 车道才给)。
+     */
+    bindSessionInheritEnv?: import("./session-inherit-env.js").SessionInheritEnvCommitCtx["bindSessionInheritEnv"];
     /** Audit回溯: current context (+ summary) for a session, plus its owner. Enables GET /v1/sessions/:id. */
     sessionAudit?: (sessionId: string) => Promise<({
         owner: string | null;
@@ -651,8 +661,14 @@ export interface ServiceDeploymentDeps {
      *  main.ts passes the effective store label (`durable(pg)` / `durable(mysql)` / `durable(local)` / "memory",
      *  same derivation as the boot `listening` log). Absent → fall back to the raw config enum. */
     sessionStoreLabel?: string;
-    /** S5 (SILENT-FALLBACK P0-b): true when the boot auto-probe degraded the store backend to in-memory. */
-    storeDegraded?: boolean;
+    /** S5 → S-866 ①:持久化姿态的**唯一**装配值(`store-posture.ts`,`boot/stores.ts` 铸):`/health` 的 `storeDegraded` / `durable:false`
+     *  (present-iff `degradedReason` 在场)与 caps `store` 同读它,gauge `store_backend_degraded` 在装配点读同一只。
+     *  缺席 = 这个进程不是由 composition root 装起来的(测试夹具形)⇒ `/health` 不带降级位、caps `store` 取诚实下限
+     *  (`declared` = 配置词,`backend:"memory"` —— 本面不知道任何装出来的后端)。 */
+    storePosture?: import("../store-posture.js").StorePosture;
+    /** S-866 ②:caps `centerWiring` 的读面(`capabilities/center-wiring.ts` `createCenterWiringReader`;入参 = 请求的已验 principal)。
+     *  缺席 = 没接中心(或测试夹具)⇒ 键整个缺席。 */
+    centerWiring?: (principal: string | undefined) => import("../capabilities/center-wiring.js").CenterWiring;
     /**
      * Graceful drain — shared mutable state between main.ts (flips `draining` on SIGTERM) and this server:
      *  • while `draining`, NEW model-running submissions (the billable submit paths) get 503 + Retry-After, so an
@@ -754,7 +770,7 @@ export interface ServiceDeploymentDeps {
     /** S-131:SQL 引擎姿态的 **live getter**(`sql-engine-posture.ts` 的单一推导点 —— boot 期借一条池连接
      *  触发驱动的连接初始化,读的是 `SET` 之后**回读复核**过的真值)。两个读面共用:
      *  `GET /v1/diagnostics/wiring` 的 `sqlEngine` 段(operator-only,全量含版本)与 `GET /v1/capabilities`
-     *  的 `sql` 位(窄投影)。getter 而不是快照:池重连后驱动会重新初始化并刷新事实,快照会说谎。
+     *  的 `store.sql` 位(窄投影;7.106.0 前是顶层 `sql`,S-866 ①)。getter 而不是快照:池重连后驱动会重新初始化并刷新事实,快照会说谎。
      *  缺席 / 返回 null = 本部署没有 SQL 后端(env-only worker、local 文件后端)—— 诚实缺席,不铸空壳。 */
     sqlEngineFacts?: () => import("../plugins/sql-driver.js").SqlEngineFacts | null;
     /** S-138:**写保护名表**的姿态(`write-protection.ts` 的 boot 期单一推导点 —— 与递给每只 Runner 的

package/dist/http/session-inherit-env.d.ts

@@ -0,0 +1,37 @@
+/**
+ * S-895 × 7.106.0 合并复审 X1(gpt-6 腿 A F1 [high],验证腿 B verified)—— 请求键 `inheritEnv` 的**会话绑定唯一提交点**。
+ *
+ * ── 分界(与 `device-placement.ts` 的首绑写协议同一句判据)──────────────────────────────────────────────────
+ * 凡需要「这条会话此刻归我这条 run」才成立的事,排在 run 认领之后;其余全排在建任何东西之前。`inheritEnv` 的三道判
+ * (值形 / 车道 / 射程)是**读**,住在 `resolveSpec`(两腿同判,任何副作用之前);而「本会话的 host 工厂下一次造环境按哪个词」
+ * 是**写**,它只属于一条**被受理**的 run —— 修前它写在 `resolveSpec` 的最后一步,仍先于路由层的拒(`/v1/tasks/stream` 的
+ * verify / cascade 400 `request.field_conflict`、会话占用 409、`/v1/runs` 的建行 409、placement 拒、续跑的 CAS 输 / 配额 429 …),
+ * 一条被拒的 `"all"` 于是把同会话上一条已受理的 `"scrub"` 放宽成整份继承。
+ *
+ * ── 调用点(类级机器门钉住:`test/inherit-env-request-key.test.ts`「X1 类级机器门」)───────────────────────────
+ * 四个 run 认领点在认领(与 placement 提交)成功之后、起跑之前各调一次 —— 流式提交 / 同步提交(`routes/tasks.ts`)、durable 建行腿
+ * (`durable-run-leg.ts`,`/v1/runs` · A2A · `/decide` 第三车道共用)、续跑驱动腿(`resume-legs.ts` 的 `driveResumeLeg`,markResuming
+ * 赢或 wake 新行建成之后)。无 run 店的部署没有认领这回事:调用点落在认领段**之后**的同一位置,等价于「起跑前、一切拒之后」。
+ * 写的值 = 受理时那条请求体的键(续跑腿 = 盘上那条体的键);缺席 = 清掉(缺省清洗;理由在 `setSessionInheritEnv` 顶注)。
+ *
+ * ── 残余(如实,S-908)──────────────────────────────────────────────────────────────────────────────────────
+ * 登记簿仍按**会话**键控、host 工厂在 run 起跑那一刻现读(core `ExecutionEnvFactoryContext` 只带 sessionId / taskId,没有 per-run 座)。
+ * 有 run 店的部署上认领本身串行化同会话的 run(`task_active` 唯一键),「写 → 读」落在同一条认领窗里;没有 run 店的部署上同会话
+ * 并发受理的两条 run 仍是「最后写者赢」。续跑腿在 markResuming 赢之后写,core 的 pre-CAS 守卫(D-1 绑定 / 过期 token)之后才拒的续跑
+ * 已写下**那条 park 任务自己**盘上的值(不是别的请求的),下一条受理的 run 照写覆盖。根治 = core 的 per-run 座(S-908)。
+ * 射程只在单用户 host 部署(`"all"` 的射程门)⇒ 写者恒是同一主人。
+ */
+import type { TaskInheritEnv } from "../request-value-closure.js";
+/** 提交点的依赖 —— 逐字取自 `ServiceDeps` 的同名键(同一只 deps 对象喂进来)。 */
+export interface SessionInheritEnvCommitCtx {
+    /** host 车道会话登记簿的写口(`boot/execution-env.ts` 的 `setSessionInheritEnv`);缺席 = 本部署不是 host 车道 ⇒ 没有消费点。 */
+    bindSessionInheritEnv?: ((sessionId: string, policy: TaskInheritEnv | undefined) => void) | undefined;
+}
+/**
+ * 在 run 认领之后调用:把受理的那条请求的 `inheritEnv`(缺席 = 清)写进本会话的绑定。`sessionId` 缺席(不接 authorizer 的嵌入形)⇒
+ * 不写 —— `"all"` 在那一形已被 `resolveSpec` 响亮拒,`"scrub"` / 缺席与工厂缺省同形。
+ */
+export declare function commitSessionInheritEnv(ctx: SessionInheritEnvCommitCtx, sessionId: string | undefined, body: {
+    readonly inheritEnv?: TaskInheritEnv | undefined;
+}): void;
+//# sourceMappingURL=session-inherit-env.d.ts.map

package/dist/http/session-inherit-env.js

@@ -0,0 +1,6 @@
+export function commitSessionInheritEnv(ctx, sessionId, body) {
+    if (sessionId === undefined || ctx.bindSessionInheritEnv === undefined)
+        return;
+    ctx.bindSessionInheritEnv(sessionId, body.inheritEnv);
+}
+//# sourceMappingURL=session-inherit-env.js.map

package/dist/http/wire-types.d.ts

@@ -6,7 +6,7 @@
  * cut: ONLY TaskRequestBody (its field types are inline or core imports — no other server.ts-local satellites);
  * sibling request/response shapes can migrate here later on the same pattern.
  */
-import type { A2aServerSpec, AgentDefinition, ApproverPosture, McpServerSpec, SkillSpec } from "@sema-agent/core";
+import type { A2aServerSpec, AgentDefinition, McpServerSpec, SkillSpec } from "@sema-agent/core";
 import type { SettingsPermissionMode } from "../task-settings.js";
 import type { wiringManifestFaceEventData } from "../trace/project.js";
 import type { buildSyncSubmitBody } from "./sync-submit-body.js";
@@ -197,8 +197,9 @@ export interface TaskRequestBody {
      *  这条 run 零历史店调用:编辑照常落盘,但不做首次触碰备份、不铸回合边界、不做 fork 携带;委派出去的子代继承
      *  (core `ParentSpecSeat` 从本位铸,本仓零接线)。`wiring_manifest.fileHistory` 报 `"disabled"`。
      *  同一个提交里再要还原(`restoreFiles` / `rewindFilesTo` / 退役 `rewindFiles`)= 体内矛盾 ⇒ **受理时** 400
-     *  `request.field_conflict`(`request-value-closure.ts` 的 `FILE_HISTORY_DISABLED_NO_RESTORE`):core 的 `rewind.capture_disabled`
-     *  落在会话按 `resumeAt` 分叉之后、拒后不回滚,所以本层在副作用之前拒。续跑腿不过这道门。
+     *  `request.field_conflict`(`request-value-closure.ts` 的 `FILE_HISTORY_DISABLED_NO_RESTORE`):立门时 core 的 `rewind.capture_disabled`
+     *  落在会话按 `resumeAt` 分叉之后、拒后不回滚,所以本层在副作用之前拒(S-865 / core 7.35.0 #1195 起 core 在分叉**之前**拒,
+     *  本层 400 照旧有效)。续跑腿不过这道门。
      *  ⚠️ 拼写门**两腿同判、响亮拒**:fresh 400 `request.field_invalid`;resume 重放同判(与 `memoryCapture` / `memory`
      *  同一张单成员闭集表,`request-value-closure.ts` 的 `singleMemberOffFieldIssue`)。
      *  Rides the persisted body onto resume legs —— 它是这条 run 的策略,不是一次性历史动作(与 `rewindFilesTo` 不同,续跑不剥)。 */
@@ -330,31 +331,6 @@ export interface TaskRequestBody {
      *  `SETTINGS_PERMISSION_MODES`(受理腿 `isSettingsPermissionMode` 与两句 400 文案同读那一份)。
      *  改前这里是第 6 份手抄的五词联合 —— 加/退一个模式时 wire 型面与受理腿会各走各的。 */
     permissionMode?: SettingsPermissionMode;
-    /**
-     * **#1000**(core 7.26.0 `TaskSpec.approverPosture`;CC-116 装配口)—— 宿主对这个 run 的**审批姿态声明**:
-     * 「这些卡由我自己自动答」。一个词(`"bypass"`),闭集属主在 core(`ApproverPosture` / `APPROVER_POSTURES`)。
-     *
-     * 🔴 **它不授权任何东西,也不是一只门**(core 头注逐字:"a statement about who answers this run's approval
-     * cards, never an instruction to the gate";引擎只把它**渲**给模型,没有任何裁决腿读它)。所以它与
-     * {@link permissionMode} 的 `"bypassPermissions"` **不是**一回事,也不能互相派生:后者选的是**门的形状**
-     * (且只能收紧、deny-wins),前者只说「谁来答卡」。两者在语义上同族,声明它而不开 `bypassPermissions`
-     * 只是对模型说了一句与实际不符的话 —— 见契约文档那一段的「谁受伤」。
-     *
-     * 🔴 **值域上本仓零判据**(`boot/resolve-spec.ts` 写点):词的拒绝逻辑属引擎
-     * (`refuseInvalidApproverPosture` 响亮拒一个不认识的词),server **不抄词表、不加第二道值域门** ——
-     * 在下游再判一次就是同一语义面的第二个判官(源头修复纪律 [ref]),而且本仓抄一份词表的那天 core 加
-     * 第二个词就会被静默 400 掉。型也从 core 的 `ApproverPosture` 派生(不抄字面联合)。
-     *
-     * 🔴 **但「原样过境」自 7.95.0(S-591 腿③)起不再成立 —— 它有一道**准入**闸**:本键是一句**宿主姿态
-     * 声明**(「这个 run 的审批卡由宿主自己自动答」),而在**托管 / 多租**部署上提交方**不是**宿主。
-     * 所以托管形上它被**忽略 + 留声**(`task_approver_posture_ignored`,`honored:false`),与同族的
-     * `settings.hooks` / `cwd` / `settings.env` 三条逐字同姿势;单用户 turnkey 与 device 车道照旧过境
-     * (射程判据单点 = `src/hosted-posture.ts` 的 `taskApproverPostureHonored`)。
-     * ⚠️ **刻意不是 400/422**:本键零授权,而续跑腿逐字重放盘上的体、调用方删不掉它 ⇒ 拒会把一条 parked
-     * 任务永久砖死(clay 裁定① 2026-09-22;本仓成文结论「砖死 resume 比降级糟」)。
-     * ⇒ 这一条与「值域零判据」**不矛盾**:值域仍归引擎,本仓判的是**这台部署认不认这句声明**。
-     */
-    approverPosture?: ApproverPosture;
     /** MF-30 memory PAUSE (shell-host contract, option B per-request — clay 2026-06-27): `false` makes THIS run
      *  read-only over long-term memory (`TaskSpec.memory.writeScope:null` — the [ref] memory ENGINE materializes/
      *  reads but its harvest commits nothing). Absent/`true` ⇒ normal read+write. The shell's `/memory` pause carries
@@ -418,6 +394,21 @@ export interface TaskRequestBody {
      *  (a caller can't point a shared/cloud worker at an arbitrary host path). Validated absolute (prepareSpec 400s a
      *  relative cwd — it would silently resolve against the SERVICE process cwd). */
     cwd?: string;
+    /**
+     * S-895(7.106.0,core [ref] [ref] ②)—— 模型驱动的 host shell **继承多少用户环境**,由调用方按请求声明。
+     * 闭集两词(词表外 ⇒ 400 `request.field_invalid`,两腿同判,判据属主 `request-value-closure.ts` 的 `inheritEnvFieldIssue`):
+     *  · `"all"` —— 整份继承(`{ ...process.env }` 逐字原样,CC 交互形);只在**单用户**部署兑现,射程 = 写容纳面那一只
+     *    `hostPostureDeclarationsHonored`(`hosted-posture.ts`)⇒ 托管部署(`REQUIRE_PRINCIPAL=true`)响亮拒
+     *    422 `request.host_posture_refused`;
+     *  · `"scrub"` —— 缺省清洗(剥凭据形变量),**任何车道、任何部署**都受理(它就是缺省;7.106.0 合并复审 X7)。
+     * **缺席 = 缺省清洗**:不带键的请求把本会话的绑定清掉(不继承上一条请求的声明 —— 这一位是「本条请求要什么」,
+     * 粘到下一条上就是替一个没说话的请求放宽)。名单形(`string[]`)**不上 wire**(那是嵌入方构造执行环境的选项)。
+     * 🔒 **只有 host 车道有消费点**:别的车道(e2b / k8s / local-docker / ssh / adb / device / in-process)带 `"all"` ⇒
+     * 400 `request.field_invalid`「applies to the host lane only」,不静默忽略、不映射到别的车道的 env 名单;`"scrub"` 在那些车道上照受理(无消费点,无害)。
+     * Rides the persisted body onto resume legs:重放照射程与车道重判(部署由单用户改托管后 revive ⇒ 同一只拒,
+     * resume-legs 折成 `409 resume_blocked_by_policy`)。
+     */
+    inheritEnv?: "all" | "scrub";
     /**
      * S-470(device lane 首绑写协议,design `device-executor-lane-v2` §4.3.2)—— 这条**根会话**要执行在
      * 哪台已注册的员工设备上(`POST /v1/devices/enroll` 返回的 `dev_<ulid>`)。

package/dist/index.d.ts

@@ -26,5 +26,6 @@ export type { TaskRequestBody } from "./http/wire-types.js";
 export { createHttpServer, type ServiceDeps, type RequestAuth, type FlatServiceDeps, type ServiceDepGroups, type ServiceCoreDeps, type ServiceStoreDeps, type ServiceCoordinatorDeps, type ServiceSeamDeps, type ServiceObservabilityDeps, type ServiceGovernanceDeps, type ServiceDeploymentDeps, type ServiceKnobDeps, } from "./http/server.js";
 export { createSideQueryLane, createPerModelKeyBrain, type KeyResolver, type SideQueryLane, type SideQueryLaneCtx } from "./boot/side-query-lane.js";
 export { createKeyResolver, resolveModelApiKey, type ModelKeyRef } from "./key-resolver.js";
-export { isSealedKeyPoison, SealedKeyPoisonedError, type SealedKeyPoison, type SealedKeyPoisonReason } from "./sealed-key.js";
+export { isModelKeyPoison, ModelKeyPoisonedError, type ModelKeyPoison, type ModelKeyPoisonReason } from "./key-resolver.js";
+export { RETIRED_ENVS, type RetiredEnv, type RetiredEnvKind, type RetiredEnvWire } from "./config.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.js

@@ -23,5 +23,6 @@ export { memoryScopeFor, memoryEngineBackendFor } from "./memory-scope.js";
 export { createHttpServer, } from "./http/server.js";
 export { createSideQueryLane, createPerModelKeyBrain } from "./boot/side-query-lane.js";
 export { createKeyResolver, resolveModelApiKey } from "./key-resolver.js";
-export { isSealedKeyPoison, SealedKeyPoisonedError } from "./sealed-key.js";
+export { isModelKeyPoison, ModelKeyPoisonedError } from "./key-resolver.js";
+export { RETIRED_ENVS } from "./config.js";
 //# sourceMappingURL=index.js.map

package/dist/key-resolver.d.ts

@@ -1,27 +1,79 @@
 import type { Model } from "@sema-agent/core";
-import { type SealedKeyPoison } from "./sealed-key.js";
+/** 托管密钥解不开的三个成因(**托管**失败;密文形错归 S-704 `config.model_entry_invalid`,旧词 `unsupported_alg` 已随之退役)。 */
+export type SealedCustodyPoisonReason = "sealed_decrypt_failed" | "stale_ciphertext" | "no_key_store";
+/** 毒丸成因全集(闭集;拒句按它穷举)。 */
+export type ModelKeyPoisonReason = SealedCustodyPoisonReason | "env_missing";
+/**
+ * 毒丸 —— **只带诊断**(来源身份 + 成因 + 检测时刻),从不带密文、明文或变量的值(每一个序列化面平凡地零秘密)。
+ *  · `source:"sealed"`:`publicKeyId` = 密文指向的钥匙对;`errKind` = 解封失败的错误**类名**(不是消息;消息在植入那一刻已进日志)。
+ *  · `source:"env"`:`apiKeyEnv` = 目录声明的变量**名**。
+ */
+export type ModelKeyPoison = {
+    readonly modelKeyPoison: true;
+    readonly source: "sealed";
+    readonly reason: SealedCustodyPoisonReason;
+    readonly publicKeyId: string;
+    readonly errKind?: string;
+    /** ISO timestamp of the apply that detected the failure. */
+    readonly at: string;
+} | {
+    readonly modelKeyPoison: true;
+    readonly source: "env";
+    readonly reason: "env_missing";
+    readonly apiKeyEnv: string;
+    /** ISO timestamp of the resolve that detected the absence. */
+    readonly at: string;
+};
+/** `config.modelApiKeys` 里能植的那一种(env 来源的毒丸由链现判,不进表)。 */
+export type SealedCustodyPoison = Extract<ModelKeyPoison, {
+    source: "sealed";
+}>;
+/** 铸毒丸(纯数据 ⇒ 加上标记与检测时刻)。重载让调用方拿到它那一种的窄型。 */
+export declare function modelKeyPoison(p: {
+    source: "sealed";
+    reason: SealedCustodyPoisonReason;
+    publicKeyId: string;
+    errKind?: string;
+}): SealedCustodyPoison;
+export declare function modelKeyPoison(p: {
+    source: "env";
+    reason: "env_missing";
+    apiKeyEnv: string;
+}): ModelKeyPoison;
+export declare function isModelKeyPoison(v: unknown): v is ModelKeyPoison;
+/** 毒丸的来源身份(托管 ⇒ `publicKeyId`;env ⇒ 变量名)—— 指纹与日志的读口,穷举 switch。 */
+export declare function modelKeyPoisonIdentity(p: ModelKeyPoison): string;
+/**
+ * The task-level fail-loud face of a poison pill: thrown by the key resolver on EVERY brain call that would otherwise
+ * authenticate this model, so an unusable declared key fails the task visibly instead of silently burning the gateway
+ * account. Carries the poison (diagnosis only) — nothing secret, by construction of {@link ModelKeyPoison}.
+ */
+export declare class ModelKeyPoisonedError extends Error {
+    readonly poison: ModelKeyPoison;
+    readonly reason: ModelKeyPoisonReason;
+    readonly at: string;
+    constructor(modelName: string, poison: ModelKeyPoison);
+}
 /**
  * Build a per-model API-key resolver for `TaskSpec.getApiKeyAndHeaders` from the catalog's
  * name → env-var-NAME map (sema-registry `apiKeyEnv`). core threads this per brain call — and per cascade
  * rung — so each model/rung authenticates with its OWN upstream account/key.
  *
- * Additive by construction: a model absent from the map — or whose env var is unset — returns
- * `undefined`, so core falls back to the brain's construction-time gateway key (today's behavior, no
- * regression). When no per-model keys are configured at all this returns `undefined`, leaving the spec
- * field unset so core's default path is byte-for-byte unchanged.
+ * A model absent from BOTH maps returns `undefined`, so core falls back to the brain's construction-time
+ * gateway key — that is the operator's choice (the entry declared no key of its own). A model that DECLARED
+ * a key it cannot get (poisoned sealed key, or an `apiKeyEnv` whose variable is missing / empty in this
+ * process) THROWS {@link ModelKeyPoisonedError} — never `undefined` (S-896). When no per-model keys are
+ * configured at all this returns `undefined`, leaving the spec field unset so core's default path is
+ * byte-for-byte unchanged.
  *
  * Only the api KEY is per-model; the base URL stays brain-owned ([ref]) — core's seam carries
- * `{ apiKey, headers? }`, not a baseUrl. Same-account-rotation could round-robin inside this function.
+ * `{ apiKey, headers? }`, not a baseUrl.
  *
  * `modelApiKeys` (sealed-box custody) carries per-model entries unsealed from `ModelEntry.sealedApiKey` —
- * resolved FIRST (sealed outranks the env-NAME reference, the registry-core mutual-exclusion ruling). Each
- * entry is either the PLAINTEXT key (successful unseal) or a `SealedKeyPoison` marker (unseal FAILED at
- * apply time): a poisoned model THROWS `SealedKeyPoisonedError` on every resolve — task-level fail-loud —
- * because returning `undefined` here means "use the gateway key", and a broken sealed key must NEVER
- * silently burn the shared gateway account (the core invariant of the poison-pill fix; a poisoned model
- * skips its env reference too, same mutual-exclusion as a healthy sealed key). The maps are disjoint by
- * construction in applyEffective (a sealed model never lands in modelApiKeyEnv); the ordering here is
- * belt-and-suspenders. 🔴 Plaintext values are live secrets: memory-only, never log them.
+ * resolved FIRST (sealed outranks the env-NAME reference, the registry-core mutual-exclusion ruling; a
+ * poisoned sealed model skips its env reference too). The maps are disjoint by construction in
+ * applyEffective (a sealed model never lands in modelApiKeyEnv); the ordering here is belt-and-suspenders.
+ * 🔴 Plaintext values are live secrets: memory-only, never log them.
  */
 /** The ONE field the per-model key plane keys on. The resolver's parameter is deliberately this minimal
  *  named ref (not the full core `Model`): full models are structural supersets and pass unchanged, while
@@ -29,12 +81,14 @@ import { type SealedKeyPoison } from "./sealed-key.js";
  *  can mint `{ name }` legally instead of forcing it through an `as never` escape hatch (B1). Contravariance
  *  keeps the resolver assignable wherever `(model: Model) => …` is expected. */
 export type ModelKeyRef = Pick<Model, "name">;
-export declare function createKeyResolver(modelApiKeyEnv: Record<string, string>, env?: NodeJS.ProcessEnv, modelApiKeys?: Record<string, string | SealedKeyPoison>): ((model: ModelKeyRef) => Promise<{
+export declare function createKeyResolver(modelApiKeyEnv: Record<string, string>, env?: NodeJS.ProcessEnv, modelApiKeys?: Record<string, string | SealedCustodyPoison>): ((model: ModelKeyRef) => Promise<{
     apiKey: string;
 } | undefined>) | undefined;
+/** 「这只模型声明的钥匙来源今天拿不到」⇒ 那一只毒丸;拿得到 / 没声明 ⇒ `undefined`。能力面的配对标注据它答 `"unknown"`(判别,不是 catch)。 */
+export declare function modelKeyPoisonOf(modelName: string, modelApiKeyEnv: Record<string, string>, env?: NodeJS.ProcessEnv, modelApiKeys?: Record<string, string | SealedCustodyPoison>): ModelKeyPoison | undefined;
 /**
  * The ONE per-model key chain, synchronous: **sealed custody → env-NAME reference → (caller's) gateway key**,
- * with a poisoned sealed entry THROWING instead of returning undefined. `createKeyResolver` is the async
+ * with a declared-but-unusable source THROWING instead of returning undefined. `createKeyResolver` is the async
  * `getApiKeyAndHeaders` face of exactly this function — every other consumer must call it rather than
  * re-implement a subset of the chain.
  *
@@ -42,8 +96,9 @@ export declare function createKeyResolver(modelApiKeyEnv: Record<string, string>
  * 降级目标(按互斥契约**永不**落 modelApiKeyEnv)于是静默拿网关 key 打自己的网关(错 key 打上游),毒丸更
  * 被当成"没配 key"。链只有一条,重复实现就会长出这种半条链的偏差,故此处抽出同步内核共用。
  *
- * `undefined` = this model has no per-model key ⇒ the CALLER's gateway/default credential applies (the
- * additive contract). An empty env value counts as unset (unchanged from the original inline chain).
+ * `undefined` = this model DECLARED no per-model key ⇒ the CALLER's gateway/default credential applies (the
+ * additive contract). A declared env reference whose variable is missing or empty throws (S-896; 7.105.0 and
+ * earlier answered `undefined` there — the silent gateway fallback this family removes).
  */
-export declare function resolveModelApiKey(modelName: string, modelApiKeyEnv: Record<string, string>, env?: NodeJS.ProcessEnv, modelApiKeys?: Record<string, string | SealedKeyPoison>): string | undefined;
+export declare function resolveModelApiKey(modelName: string, modelApiKeyEnv: Record<string, string>, env?: NodeJS.ProcessEnv, modelApiKeys?: Record<string, string | SealedCustodyPoison>): string | undefined;
 //# sourceMappingURL=key-resolver.d.ts.map