@sema-agent/server 7.105.0 → 7.107.0

package/deploy/sema-up/kube-up.sh

@@ -29,6 +29,7 @@ PROJECT="${PROJECT:-sema}"
 REGION="${REGION:-global}"
 KUBE_MODE="${KUBE_MODE:?KUBE_MODE 未设置(existing|k3s)}"
 DRY_RUN="${DRY_RUN:-false}"
+USERS_GIVEN="${USERS:+1}"   # S-600:显式给没给(缺省 single 之前记下;决策见下方 users_decide)
 USERS="${USERS:-single}"
 REGISTRY_ENABLED="${REGISTRY_ENABLED:-true}"
 GIT_MODE="${GIT_MODE:-none}"
@@ -45,6 +46,10 @@ flag_enum "--users(USERS)" "$USERS" $FLAG_WORDS_USERS
 flag_bool "--registry(REGISTRY_ENABLED)" "$REGISTRY_ENABLED"
 flag_enum "--git(GIT_MODE)" "$GIT_MODE" $FLAG_WORDS_GIT
 flag_enum "--region(REGION)" "$REGION" $FLAG_WORDS_REGION
+# S-600:租户形 = 显式 USERS ∨ 上一次落下的部署事实 ∨ single(规则与拒句在 lib/flagshape.sh 的 users_decide)——
+# 在动集群之前判,不带旗的重跑不会把多租部署降成单用户。
+ENVF="$WORK/.env"
+users_decide "$USERS_GIVEN"
 
 # ── 0. kubeconfig / 工具解析 ─────────────────────────────────────────────────────
 if [ "$KUBE_MODE" = "k3s" ]; then
@@ -124,13 +129,12 @@ if [ "$REGISTRY_ENABLED" = "true" ] && [ -z "${SEMA_REGISTRY_IMAGE:-}" ]; then
   die "registry=true(默认)需要 SEMA_REGISTRY_IMAGE。下一步:--registry-image=<仓>/sema-registry:<tag>,或 --registry=false"
 fi
 
-ENVF="$WORK/.env"
 if [ "$DRY_RUN" = "true" ]; then
   {
     echo "══════ kube-up dry-run(不写文件、不动集群)══════"
     echo " 集群: $NODES 节点(mode=$KUBE_MODE,kubeconfig=$KUBECONFIG)"
     echo " SC: ${STORAGE_CLASS:-默认($DEFAULT_SC)} kata: $KATA_OK(否=沙箱 runc 降级)"
-    echo " 形态: pg×$PG_INSTANCES($PG_AA) server×$SERVER_REPLICAS registry=$REGISTRY_ENABLED git=$GIT_MODE"
+    echo " 形态: pg×$PG_INSTANCES($PG_AA) server×$SERVER_REPLICAS registry=$REGISTRY_ENABLED git=$GIT_MODE users=$USERS"
     echo " 将执行: CNPG operator $CNPG_VERSION → helm upgrade --install sema-stack -n $NAMESPACE"
     echo "        → runner-token 复制 → MinIO 建桶 → $([ "$GIT_MODE" = provision ] && printf 'Gitea 引导(管理员/token/OAuth)→ ')smoke → summary"
     echo " 凭据: $ENVF $([ -f "$ENVF" ] && echo '(已存在:只补缺不轮换)' || echo '(将新建)')"
@@ -158,6 +162,7 @@ mkdir -p "$WORK"; chmod 700 "$WORK" 2>/dev/null || true
 touch "$ENVF"; chmod 600 "$ENVF"
 setk MINIO_PASSWORD "$(openssl rand -hex 24)"
 setk SERVICE_AUTH_TOKEN "$(openssl rand -hex 24)"
+resetk REQUIRE_PRINCIPAL "$(principal_of_users "$USERS")"   # S-600:部署事实(下次不带旗重跑据此沿用租户形)
 NEW_REG_PW=false NEW_GIT_PW=false
 if [ "$REGISTRY_ENABLED" = "true" ]; then
   setk_new REGISTRY_ADMIN_PASSWORD "$(openssl rand -hex 24)" && NEW_REG_PW=true
@@ -191,7 +196,7 @@ helm_values() { # helm_values <giteaBaseUrl> <oauthId> <oauthSecret>
   V_MODEL_GATEWAY="$MODEL_GATEWAY_BASEURL" V_MODEL_ID="$MODEL_ID" \
   V_SERVER_IMAGE="$SEMA_SERVER_IMAGE" V_REPLICAS="$SERVER_REPLICAS" \
   V_PG_INSTANCES="$PG_INSTANCES" V_PG_AA="$PG_AA" V_SC="$STORAGE_CLASS" \
-  V_RT_CLASS="$RUNTIME_CLASS" V_REQ_PRINCIPAL="$([ "$USERS" = multi ] && echo true || echo false)" \
+  V_RT_CLASS="$RUNTIME_CLASS" V_REQ_PRINCIPAL="$(principal_of_users "$USERS")" \
   V_PKG_SOURCE="$([ "$REGION" = "global" ] && echo global || echo '')" \
   V_REG_ENABLED="$REGISTRY_ENABLED" V_REG_IMAGE="${SEMA_REGISTRY_IMAGE:-}" \
   V_REG_PW="${REGISTRY_ADMIN_PASSWORD:-}" V_REG_SS="${REGISTRY_SESSION_SECRET:-}" V_REG_PT="${REGISTRY_PULL_TOKEN:-}" \

package/deploy/sema-up/lib/flagshape.sh

@@ -18,6 +18,35 @@
 # ── 词表(单一属主)──────────────────────────────────────────────────────────────────────────────
 FLAG_WORDS_PROFILE="full-single data-center local-plus full-cluster"
 FLAG_WORDS_USERS="single multi"
+# 租户形 ⇒ 容器上 REQUIRE_PRINCIPAL 的值 —— 这条翻译的**唯一**定义(S-600,7.105.0 从 sema-up.sh 搬来):sema-up 的 compose 生成段 /
+# 事实核对,kube-up 的 helm values,cluster-up 的渲染清单与 helm values 同调这一只(修前 kube-up 另写一份同义翻译,S-619 D5;
+# cluster-up 一份都没有 ⇒ --users=multi 在 --kube=machines 路径上被静默丢成单用户)。只认两词,别的词先过 flag_enum。
+principal_of_users() { [ "$1" = "multi" ] && echo true || echo false; }
+
+# users_decide <显式给了 USERS 吗(1 / 空)> —— kube 两条装配路径(kube-up / cluster-up)的租户形决策,与 sema-up 的
+# compose 档同一条规则:**决策 = 显式 USERS ∨ 上一次落在 $ENVF 的部署事实 REQUIRE_PRINCIPAL ∨ single**;显式值与事实
+# 不一致 ⇒ 拒并点名两处(不静默把一台多租部署降成单用户,也不静默把单用户升成多租)。事实 → 租户词只经
+# principal_of_users 反查(两词逐个过正向比,不另写反表);认不出的事实值 ⇒ 拒。设 USERS。
+# S-600 codex 一轮 [high]:machines 路径开始认 --users 之后,一次不带旗的重跑会拿缺省 single 把多租部署的
+# REQUIRE_PRINCIPAL 翻回 false(kube-up 路径此前就同形)—— 事实由两只脚本各自在写凭据的同一处 resetk 落盘。
+# 调用方先 source lib/envf.sh 并定好 ENVF(文件可以还不存在 = 首装,无事实)。
+users_decide() {
+  local given="$1" fact fact_users="" u
+  fact="$(envf_get REQUIRE_PRINCIPAL)" || exit 1
+  [ -n "$fact" ] || return 0
+  for u in $FLAG_WORDS_USERS; do [ "$(principal_of_users "$u")" = "$fact" ] && fact_users="$u"; done
+  if [ -z "$fact_users" ]; then
+    log "⛔ 部署事实 $ENVF 里 REQUIRE_PRINCIPAL=$(flag_show "$fact"):本工具只读自己写出的两形 $(principal_of_users multi) / $(principal_of_users single)"
+    log "   ↳ 下一步:改成 REQUIRE_PRINCIPAL=$(principal_of_users multi)(多人)或 REQUIRE_PRINCIPAL=$(principal_of_users single)(单人),再重跑"
+    exit 1
+  fi
+  if [ -z "$given" ]; then USERS="$fact_users"; return 0; fi
+  if [ "$USERS" != "$fact_users" ]; then
+    log "⛔ 部署事实冲突:$ENVF 里 REQUIRE_PRINCIPAL=$fact(= --users=$fact_users),本次 --users=$USERS 要写 REQUIRE_PRINCIPAL=$(principal_of_users "$USERS")"
+    log "   ↳ 下一步:不带 --users 重跑即沿用这台部署的租户形;真要改租户形,先确认身份隔离的影响,再把 $ENVF 里那一行改掉后重跑"
+    exit 1
+  fi
+}
 FLAG_WORDS_REGION="auto cn global"
 FLAG_WORDS_GIT="none provision connect"
 # kube 路径:单机两态走 kube-up.sh,machines(多机 ssh 装配)走 cluster-up.sh。

package/deploy/sema-up/lib/parse-machines.py

@@ -80,7 +80,10 @@ def main(path):
 
     emit("PROFILE", top.get("profile"))
     emit("REGION", top.get("region", "auto"))
-    emit("USERS", top.get("users", "single"))
+    # S-600(codex 一轮 [high]):不写 users 就**不发射** —— 修前缺省发射 single,等于替运维表了态,sema-up 于是把它当显式旗,
+    # 盖掉 `.env` 里上一次落下的部署事实(多租部署不带旗重跑 ⇒ 被降成单用户,或撞事实冲突拒)。缺省归 sema-up 的决策
+    # (显式旗 ∨ 部署事实 ∨ 表缺省 single),不在解析器里另立一份。
+    emit("USERS", top.get("users"))
     # server 镜像(registry 引用;海外=docker.io/<ns>/sema-server:<tag>)
     emit("SEMA_SERVER_IMAGE", top.get("server_image"))
     emit("MACHINE_COUNT", str(len(machines)))

package/deploy/sema-up/sema-up.sh

@@ -339,20 +339,21 @@ fi
   "full-cluster:k8s 准生产——3 机 ssh 装配 / 已有集群 kubeconfig / 本机装 k3s" \
   "local-plus:本机只跑 agent,连一个已经部署好的 data-center 数据面")
 # ── 两个决策(租户形 / 车道)同一条规则:决策 = 显式旗 ∨ 部署事实 ∨ 表缺省 ─────────────────────
-# 「部署事实」只对 compose 的 agent 档成立(`.env` 就是它们的部署状态;kube 路径的状态在 helm values 里,
-# data-center 不起 agent)。事实 → 决策词只经属主翻译,本脚本不抄第二份:
+# 「部署事实」= 同一只 `$WORK/.env`:compose 的 agent 档由本脚本写,full-cluster 由 kube-up / cluster-up 在写凭据的同一处
+# 写(S-600;修前 kube 两条路径不落这条事实 ⇒ 不带旗重跑拿缺省 single 把多租部署降回单用户);data-center 不起 agent。事实 → 决策词只经属主翻译,本脚本不抄第二份:
 #   · REQUIRE_PRINCIPAL → --users:只认 sema-up 自己写出的两形 true / false(别的写法 ⇒ 拒;不复刻 server 的布尔词表);
 #   · REMOTE_EXEC → --sandbox:`lanes choice-of`(车道表是唯一属主;表里没有的落盘值 ⇒ 拒并列在役词),见车道块。
 # 不带旗重跑 ⇒ 沿用事实(多租部署重跑不必再带 --users=multi);显式旗与事实不一致 ⇒ fact_conflict 拒并点名两处。
 # 🔴 为什么缺省不能先于事实(合并复审两条真案):把表缺省当成意图去和事实比,合法的无旗重跑就被拒;
 # 反过来若只比不拒,保留的多租 `.env` 在缺省 single 下会被车道表判成 host —— 容器拿到 REQUIRE_PRINCIPAL=true ∧ host。
-# 租户形 ⇒ 容器上 REQUIRE_PRINCIPAL 的值 —— 本脚本内**唯一**一处这条翻译。正向(生成段 setk、事实核对)与反向
-# (事实 → --users 缺省)都经它:反向是拿两个租户词逐个过这只函数去比,不另写一张反表(与车道的 `lanes choice-of`
-# 同一姿势)。⚠️ kube 路径另有一处同义翻译(`kube-up.sh` 的 V_REQ_PRINCIPAL,v7.95.1 既有,登记 DEBTS)。
-principal_of_users() { [ "$1" = "multi" ] && echo true || echo false; }
+# 租户形 ⇒ 容器上 REQUIRE_PRINCIPAL 的值:`principal_of_users`(lib/flagshape.sh,三只脚本共用的唯一定义;S-600 起 kube-up /
+# cluster-up 也调它)。正向(生成段 setk、事实核对)与反向(事实 → --users 缺省)都经它:反向是拿两个租户词逐个过这只函数去比,
+# 不另写一张反表(与车道的 `lanes choice-of` 同一姿势)。
 USERS_DEF="single" RP_FACT="" RP_FACT_SRC=""
 case "$PROFILE" in
-  full-single|local-plus)
+  # S-600:full-cluster 也读 —— kube-up / cluster-up 在写凭据的同一处把 REQUIRE_PRINCIPAL 落进同一只 .env(它们自己
+  # 单独跑时也按同一条规则判,见 lib/flagshape.sh 的 users_decide)。
+  full-single|local-plus|full-cluster)
     deploy_fact REQUIRE_PRINCIPAL; RP_FACT="$FACT_VAL" RP_FACT_SRC="$FACT_SRC"
     if [ -n "$RP_FACT" ]; then
       USERS_DEF=""
@@ -470,8 +471,9 @@ if [ "$PROFILE" = "full-cluster" ]; then
   case "$KUBE_MODE" in
     machines)
       [ "${MACHINE_COUNT:-0}" -ge 1 ] || { log "⛔ --kube=machines 需要 -f machines.yaml(机器清单);模板见 deploy/sema-up/machines.example.yaml"; exit 1; }
-      $DRY_RUN && { log "dry-run:将经 cluster-up.sh 对 ${MACHINE_COUNT} 台机器做 k3s HA 装配(ssh)+ helm/render 装栈;不执行"; exit 0; }
-      WORK="$WORK" REGION="$REGION" PROJECT="$PROJECT" \
+      $DRY_RUN && { log "dry-run:将经 cluster-up.sh 对 ${MACHINE_COUNT} 台机器做 k3s HA 装配(ssh)+ helm/render 装栈(users=$USERS);不执行"; exit 0; }
+      # S-600:租户形交给 cluster-up(修前不传 ⇒ 这条路径上的主 worker 恒单用户姿态,--users=multi 被静默丢)。
+      WORK="$WORK" REGION="$REGION" PROJECT="$PROJECT" USERS="$USERS" \
         MODEL_GATEWAY_BASEURL="$GATEWAY" MODEL_ID="$MODEL" MODEL_API_KEY="${MODEL_KEY:-${MODEL_API_KEY:-}}" \
         exec "$HERE/cluster-up.sh"
       ;;

package/deploy/sema-up/stack/sema-stack-cluster.yaml

@@ -1,5 +1,5 @@
 # sema-stack(full-cluster 形态,Phase 1b as-built;cluster-up.sh 渲染 __占位符__ 后 apply)
-# 占位符:__MINIO_PW__ __SVC_TOKEN__ __MODEL_KEY__ __MODEL_GATEWAY__ __MODEL_ID__
+# 占位符:__MINIO_PW__ __SVC_TOKEN__ __MODEL_KEY__ __MODEL_GATEWAY__ __MODEL_ID__ __REQUIRE_PRINCIPAL__
 #         __SERVER_IMAGE__ __SERVER_PULL_POLICY__(tar 预灌=Never / registry 拉取=IfNotPresent)
 # 前置(cluster-up.sh 负责):Longhorn 默认 SC、kata-deploy(runtimeclass kata-qemu)、CNPG operator 1.30、
 #         runner token 跨 ns 复制成 sema/sema-runner-token-copy、MinIO 建桶 sema-pg-backup
@@ -169,6 +169,8 @@ spec:
             - { name: MODEL_ID, value: "__MODEL_ID__" }
             - { name: MODEL_API_KEY, valueFrom: { secretKeyRef: { name: sema-server-env, key: MODEL_API_KEY } } }
             - { name: MODEL_VISION, value: "false" }
+            # S-600:租户姿态与 chart 主 worker 同值(cluster-up 由 --users 渲:multi ⇒ true,否则 false);修前整块缺席 ⇒ 恒单用户
+            - { name: REQUIRE_PRINCIPAL, value: "__REQUIRE_PRINCIPAL__" }
             - { name: SANDBOX_PKG_SOURCE, value: "__PKG_SOURCE__" }
             - { name: REMOTE_EXEC, value: k8s }
             # S-599:显式表态「这台有手」(车道被改没了 ⇒ 拒启,不是安静的无手 worker)

package/dist/approval-card.d.ts

@@ -415,7 +415,7 @@ type ToolApprovalPark = Extract<CorePendingAction, {
  *
  * 什么时候经本函数 —— 一句话:**筛点在 core;server 只在「读的是持久层原字节、中间没有 core 投影」的地方亲手调 core 的那一只筛**。
  * inbox 行读 core `CheckpointSummary.{mandate,origin}`(core `summarizeCheckpoint` 已用同一只 `isPersistedRuleMandate` / `isAskOrigin`
- * 筛过)⇒ 那一面直投、不经本函数(与 `ruleStoreUnreadable` 同一条法理);运维队列行读的是 park 行 `pendingAction` 子树的原字节
+ * 筛过)⇒ 那一面直投、不经本函数;运维队列行读的是 park 行 `pendingAction` 子树的原字节
  * (两店 `listPending`,中间没有 core 投影)⇒ 经本函数 —— 于是 inbox 行与队列行对同一张 park 行(含手改行 / 世代差的集外词)逐字同答。
  *
  * **不抄词表**([ref]):闭集判定 = core 的成员筛({@link CLOSED_WORD_SEAT_GUARDS});值型 = core 寄存行上那一座的型。本仓对这些词

package/dist/approval.d.ts

@@ -136,7 +136,12 @@ export interface DurableAskOptions {
     neverAuto?: string[];
     /** Per-session approval-exemption probe ("本会话不再询问"): consulted ONLY for require-listed
      *  tools, AFTER deny/neverAuto (both always win) and BEFORE the budget path. Canonical-space toolName.
-     *  A rejected promise is treated as NOT exempt (fail-closed → ask) at the call site below. */
+     *  A rejected promise is treated as NOT exempt (fail-closed → ask) at the call site below.
+     *  🔴 S-877 候裁 16:会话授权**两个读位、一只店、按问句的作者分**(收车档 ⑩ 16):本探针兑现**本仓自己的问**(名单门)
+     *  —— 在它自己的层上「不问」,于是委派子代经父约束链继承到的同一问也不问;引擎自装的问(模式写门 / 形状层)由审批席
+     *  (`ToolApprovalCoordinator.standingGrantSettles`)兑现。本探针**不能**退役:子代的继承问到达祖先审批席时 core 盖
+     *  `mandated`(`ruleClearanceOf` 的 inheritedUnresolved / ancestorResolved 门),席的判据依约不退役它 —— 只有本层的
+     *  「不问」够得着继承链(钉 test/parked-decide-leg.test.ts「[候裁② 修]remember 全链行为」)。 */
     exempt?: (canonicalToolName: string) => Promise<boolean>;
     /** Audit hook — fired when an exemption short-circuits the ask (the `approval_exempted` log line). */
     onExempted?: (canonicalToolName: string, rawToolName: string) => void;

package/dist/approval.js

@@ -1,5 +1,5 @@
 import { isNamespacedCoveringRuleName, namespacedRuleNameCovers } from "@sema-agent/core";
-import { operatorAsk } from "./operator-ask.js";
+import { operatorAlwaysHumanAsk, operatorAsk } from "./operator-ask.js";
 import { ASK_USER_QUESTION_TOOL_NAME } from "./approval-content-kind.js";
 import { isExplicitPosture } from "./posture-source.js";
 import { handsOnWorkerFilePlane } from "./execution-lane-caps.js";
@@ -85,11 +85,11 @@ export function createDurableAskPolicy(opts) {
             if (deny(toolName))
                 return { action: "deny", message: `tool "${req.toolName}" is denied by policy` };
             if (neverAuto(toolName))
-                return operatorAsk(`APPROVAL_NEVER_AUTO(${toolName})`, `human approval required to run "${req.toolName}"`);
+                return operatorAlwaysHumanAsk(`APPROVAL_NEVER_AUTO(${toolName})`, `human approval required to run "${req.toolName}"`);
             if (require(toolName)) {
                 const remEarly = req.budget?.resourceRemainingMicroUsd;
                 if (remEarly !== undefined && remEarly <= 0) {
-                    return operatorAsk("RESOURCE_SUSPEND budget exhausted", `durable resource budget exhausted — human approval required to run "${req.toolName}"`);
+                    return operatorAlwaysHumanAsk("RESOURCE_SUSPEND budget exhausted", `durable resource budget exhausted — human approval required to run "${req.toolName}"`);
                 }
                 if (opts.exempt && toolName !== ASK_USER_QUESTION_TOOL_NAME) {
                     return (async () => {
@@ -115,7 +115,7 @@ export function createDurableAskPolicy(opts) {
     function decideRequired(req, toolName) {
         const rem = req.budget?.resourceRemainingMicroUsd;
         if (rem !== undefined && rem <= 0) {
-            return operatorAsk("RESOURCE_SUSPEND budget exhausted", `durable resource budget exhausted — human approval required to run "${req.toolName}"`);
+            return operatorAlwaysHumanAsk("RESOURCE_SUSPEND budget exhausted", `durable resource budget exhausted — human approval required to run "${req.toolName}"`);
         }
         if (toolName !== ASK_USER_QUESTION_TOOL_NAME && budget > 0 && autoApproved < budget) {
             autoApproved++;

package/dist/auth-bridge.d.ts

@@ -2,6 +2,20 @@ import { type AuthBridgeErrorCode, type VerifiedIdentity } from "@sema-agent/set
 import type { Logger } from "./observability/logger.js";
 import type { Metrics } from "./observability/metrics.js";
 export type { VerifiedIdentity } from "@sema-agent/settings-schema/api/auth-bridge";
+/**
+ * S-866 ② —— 鉴权桥 issuer 的**唯一**取值(装配 `boot/stage-09-leader.ts` 与 caps `centerWiring.issuer` 同读,不各写一份回退):
+ * 显式 `AUTH_BRIDGE_ISSUER`(`config.authBridgeIssuer`)恒赢 ⇒ `source:"explicit"`;缺席则回退中心基址 `configCenter.baseUrl`
+ * (配了中心即默认开桥)⇒ `source:"fallback"`;两者都没有 ⇒ `undefined`(桥不装)。
+ */
+export declare function authBridgeIssuerOf(config: {
+    readonly authBridgeIssuer?: string | undefined;
+    readonly configCenter?: {
+        readonly baseUrl: string;
+    } | undefined;
+}): {
+    readonly issuer: string;
+    readonly source: "explicit" | "fallback";
+} | undefined;
 export interface RegistryJwtVerifierOptions {
     /** R4 — 期望 iss(registry 的 SSO_ISSUER;默认=SEMA_REGISTRY_URL,双侧去尾斜杠比较)。 */
     issuer: string;

package/dist/auth-bridge.js

@@ -1,6 +1,13 @@
 import { createPublicKey, verify as cryptoVerify } from "node:crypto";
 import { AUTH_BRIDGE_ALGS, DEFAULT_CLOCK_SKEW_SEC, DEFAULT_JWKS_REFRESH_MIN_INTERVAL_SEC, DEFAULT_OFFLINE_GRACE_SEC, REGISTRY_JWKS_PATH, RegistryJwks, classifyTimeClaims, jwksWithinOfflineGrace, shouldForceJwksRefresh, toVerifiedIdentity, } from "@sema-agent/settings-schema/api/auth-bridge";
 import { buildDisplaySafeUrl } from "./trace/redact.js";
+export function authBridgeIssuerOf(config) {
+    if (config.authBridgeIssuer !== undefined)
+        return { issuer: config.authBridgeIssuer, source: "explicit" };
+    if (config.configCenter !== undefined)
+        return { issuer: config.configCenter.baseUrl, source: "fallback" };
+    return undefined;
+}
 const DEFAULT_JWKS_TTL_SEC = 15 * 60;
 const MAX_JWKS_BYTES = 256 * 1024;
 const MAX_TOKEN_CHARS = 16 * 1024;

package/dist/auto-mode-face.d.ts

@@ -1,3 +1,47 @@
+/**
+ * [ref] ④(黑板 [ref]/[ref]/[ref],core [ref] 合修)—— auto 模式的**可自查读面**:`/v1/capabilities`
+ * 的 `permissionModeAuto.{armed, reason, model}` 三键怎么算。
+ *
+ * ## 病根一句话
+ * 壳 07-21 起默认点亮 `permissionMode:"auto"`,而引擎半场从未接通:core 旧武装式是「org 授予」极性
+ * (`runtimeCaps.autoMode === true ∧ deps.autoMode`),server 的授予路径只有 center ⇒ 无 center 的本地部署
+ * auto **永不武装** = default + 静态白名单(真实用户诊断,六断言全成立)。core [ref] 把谓词换成 CC 250 的
+ * 「用户开 + org 拒」极性;core 7.34.0([ref])再把意图收成**一个键** —— 模式词本身:
+ *
+ *     armed ⟺ TaskSpec.permissionMode === "auto" ∧ RunnerDeps.autoMode !== undefined ∧ RuntimeCaps.autoMode !== false
+ *
+ * 任一合取项落空 ⇒ 引擎把这条腿折成 `default` 并发 `config.permission_mode_unavailable`
+ * (`by: "face_absent" | "operator_deny"`;码名按 core `ENGINE_NOTICE_CODES` 亲读)。
+ *
+ * 本模块按**server 侧可知的同三项**算一份「若此刻提交会不会武装」的裁决,供壳(cli `sema doctor permissions`)
+ * 与人自查。三项分别对应三个未武装原因(判序 = 谓词的合取序,先判到的先报):
+ *  · `mode_not_auto`        —— 本次意图不是 auto(`?permissionMode=` 查询串给的;缺席 = 按 auto 意图答);
+ *  · `deployment_incapable` —— 装配面没挂 `RunnerDeps.autoMode` 分类器席位(生产装配恒挂;桩/一次性 CLI 不挂);
+ *  · `org_denied`           —— per-principal caps 的 `autoMode === false` 且本地 deny 未设(center 显式 deny、center
+ *                              硬失败的 fail-closed 拒项);
+ *  · `local_denied`         —— 本地 `PERMISSIONS_DISABLE_AUTO_MODE=true`(catalog/settings 键 `permissions.disableAutoMode`);
+ *  · `settings_denied`      —— settings 层 `permissions.disableAutoMode` 取 `"disable"` 或 `true`([ref]:两套已发布拼写同义)
+ *                              折掉本 run 的 auto([ref] 第六员;run 级面产,
+ *                              capabilities 查询串不带 settings ⇒ 本面不产);
+ *  · `resolver_fault`       —— resolver 抛错(core 同形全拒:autoMode:false + onError phase config)。
+ *
+ * 🔴 S-877(core 7.34.0 提货):「这台机器上装的 core 用哪套武装极性」的**安装包探针**(按文本扫
+ * `dist/core/runner/prepare-task.js` 找 `autoModeRequested`)整只退役 —— 7.34.0 起那个键被引擎按名拒,探针的主判
+ * 恒假、佐证恒真 ⇒ 矛盾臂 fatal,整台 server 起服即拒(S-878 探针 7.34.0 读数的 13 只红文件同一根因)。
+ * 极性不再是运行期要猜的事实:本仓把 core **精确钉版**(`package.json`,`test/core-dependency-floor.test.ts` 承重),
+ * 钉住的那一版的武装谓词就是上面那一行,由类型面(`TaskSpec.permissionMode` / `RunnerDeps.autoMode` /
+ * `RuntimeCaps.autoMode`)与 core CHANGELOG 同时陈述。⇒ 旧式臂(「org 授予」极性)与 `engineArmsOnIntent` 座一并删,
+ * 规则集少一整支;**不再读任何 dist 文本**。
+ *
+ * ## 闭集纪律([ref])
+ * 六词是 core [ref] seam ⑤ + [ref] PM 裁定的闭集;`AUTO_MODE_UNARMED_REASON_SEMANTICS` 是 `Record<Reason, string>` 锁步表——
+ * 词表加员而语义表不加、或反之,都是编译红。本面**不**给壳发 prose(机器码上 wire,人话归壳),语义表只
+ * 服务于文档/测试对拍。
+ *
+ * ## 判据不是「授权了」
+ * `entitlementSource`(既有位)说的是「center 源在不在」;`armed` 说的是「按三态谓词此刻会不会武装」。
+ * 两者刻意并存:前者告诉壳有没有组织面,后者告诉壳这台机器上 auto 到底是不是 default 的别名。
+ */
 import { type RunnerDeps, type RuntimeCaps } from "@sema-agent/core";
 import type { SettingsPermissionMode } from "./task-settings.js";
 /**
@@ -37,53 +81,19 @@ export declare const AUTO_MODE_UNARMED_REASONS: readonly ["mode_not_auto", "depl
 export type AutoModeUnarmedReason = (typeof AUTO_MODE_UNARMED_REASONS)[number];
 /** 锁步表:词表与语义一一对应(加员/删员任一侧不同步 = tsc 红)。语义只供文档/测试,不上 wire。 */
 export declare const AUTO_MODE_UNARMED_REASON_SEMANTICS: {
-    readonly mode_not_auto: "本次意图不是 auto(壳发的 permissionMode 不是 \"auto\";座缺席)——只属意图武装式,旧式 core 不读模式";
-    readonly deployment_incapable: "装配面没挂 RunnerDeps.autoMode 分类器席位(本部署/本进程形不具备分类器);旧式 core 下另含「无 center 源 = 零授予路径」";
-    readonly org_denied: "per-principal caps.autoMode === false 且本地 deny 未设:center 显式 deny / center 硬失败 fail-closed 拒项;旧式 core 下另含「center 在场但未授予」";
+    readonly mode_not_auto: "本次意图不是 auto(壳发的 permissionMode 不是 \"auto\")";
+    readonly deployment_incapable: "装配面没挂 RunnerDeps.autoMode 分类器席位(本部署/本进程形不具备分类器)";
+    readonly org_denied: "per-principal caps.autoMode === false 且本地 deny 未设:center 显式 deny / center 硬失败 fail-closed 拒项";
     readonly local_denied: "本地 catalog 键 PERMISSIONS_DISABLE_AUTO_MODE=true(center/settings 键名 permissions.disableAutoMode)把 caps.autoMode 折成 false";
     readonly settings_denied: "settings 层 permissions.disableAutoMode 取 disable 或 true(两套已发布拼写同义;用户/managed 层 kill-switch)把本 run 折成非 auto —— capabilities 查询串不带 settings,本词由 run 级面产([6128] PM 裁定第六员)";
     readonly resolver_fault: "per-principal caps resolver 抛错/答非记录(core 同形全拒:autoMode:false + onError phase config)";
 };
-/**
- * 安装包探针:**这台机器上装的 core 用哪套武装极性**。
- *
- * 判据([ref] 改,原先用「854b202b 同批的运行时导出 `mailboxCrossProcessMountVerdict`」作代理 —— 那是 385 片2a 的
- * mailbox 面,与 auto 武装**语义无关**,只是恰好同一个 dist;core 若把 [ref] 单独发一个补丁版,代理就答错):
- *
- *  · **主判(语义精确)= [ref] 自己的座**:武装点 `dist/core/runner/prepare-task.js` 里是否出现 `autoModeRequested`。
- *    亲验(2026-09-03,`git grep autoModeRequested` 两 ref 对拍):v7.2.0 全树**零**处提及,854b202b 起 prepare-task
- *    有 8 处 —— 单调、且探的就是「武装点读不读意图座」这件事本身。dist 未 mangle(属性名从不被 tsc/esbuild 改名),
- *    d.ts 不参与判断(类型面运行期探不到,读 js 才是「引擎真这么跑」)。
- *  · **佐证(只在主判为 false 时读)= 同批到货的运行时导出** `mailboxCrossProcessMountVerdict`(包内随发的
- *    `node_modules/@sema-agent/core/test/export-surface.snapshot.json`(core 包内随发),core `files` 字段含它 —— 消费账本门 A 的同一真源)。
- *    - 座缺席 ∧ 标记缺席 ⇒ 就是 npm 7.2.0 那一档 ⇒ `false`(旧式臂,兼容形);
- *    - 座缺席 ∧ 标记**在场** ⇒ **矛盾**:dist 已是 854b202b 之后,而武装点不再提这个座名(core 重构/换文件)
- *      ⇒ 判据失效,**抛**(不猜。静默回落旧式臂正是「854 之后的部署悄悄退回 org 授予极性」那一形)。
- *    - 座在场 ⇒ `true`,不看佐证([ref] 单发的补丁版合法)。
- *
- * 🔴 不用 `import * as core`(消费账本门禁命名空间导入:每个消费名必须可按名对账);两个文件都经主入口 resolve
- * 定位(package `exports` 映射不暴露这些子路径)。**任何读不到 = 抛**,由 boot 装配点承接成拒启(见
- * {@link coreArmsAutoOnIntent})。
- *
- * @param distDir 测试注入的假 `dist/` 根;生产不传(从安装的 core 主入口解)。
- */
-export declare function coreArmsAutoOnIntentProbe(distDir?: string): boolean;
-/**
- * {@link coreArmsAutoOnIntentProbe} 的**惰性记忆化**访问器 —— 生产装配点(`main.ts` 的 `autoModeFace` 组装,
- * 早于 `server.listen`)调一次,探针抛就是**boot 期响亮拒启**并带指路。
- *
- * 🔴 为什么必须惰性([ref]):此前是模块顶层 `const … = coreArmsAutoOnIntentProbe()`,而 `main.ts` 顶部 import 本模块
- * ⇒ 探针在 **import 期**求值,读不到快照就在任何日志器/诊断存在之前把整台 server 抛死(一个 npm 安装瑕疵 =
- * 一台起不来且没有遗言的机器)。惰性之后,同一条失败落在 boot 装配点,遗言完整、退出码照旧。
- */
-export declare function coreArmsAutoOnIntent(): boolean;
-/** 装配面交给读面的四件事实(`main.ts` 从 runnerDeps / 合成后的 caps resolver / 到货位取,读面不自算)。 */
+/** 装配面交给读面的三件事实(`main.ts` 从 runnerDeps / 合成后的 caps resolver 取,读面不自算)。
+ *  S-877:第四件「引擎半场到货位」(`engineArmsOnIntent`,安装包探针)随极性探针一起退役。 */
 export interface AutoModeFaceDeps {
     /** `RunnerDeps.autoMode !== undefined`——**读**装配点那一位,不写字面 true(与 parked-revive 的
      *  `autoModeSeatMounted` 同一纪律:席位哪天改成有条件挂载,这里不能静默错供)。 */
     readonly seatMounted: boolean;
-    /** {@link coreArmsAutoOnIntent}(生产装配递探针访问器;测试可递 true 走正控)。false ⇒ `deployment_incapable`。 */
-    readonly engineArmsOnIntent: boolean;
     /** 合成后的 per-principal caps resolver(= 递给 `RunnerDeps.runtimeCapsResolver` 的同一只:center 客户端
      *  → observer env 基线 → memory grant → 本地 auto deny,单一属主 boot/runtime-caps.ts)。缺席 = 无任何
      *  per-principal 源(无 center、无本地 deny)⇒ caps undefined ⇒ 三态之「缺席=不阻」。 */
@@ -115,7 +125,6 @@ export type AutoModeVerdict = {
 export declare function judgeAutoModeArming(face: AutoModeFaceDeps | undefined, input: {
     readonly requestedMode: SettingsPermissionMode | undefined;
     readonly principal: string | undefined;
-    readonly entitlementSource: boolean;
     /** 本地 `PERMISSIONS_DISABLE_AUTO_MODE`(= catalog/settings 键 `permissions.disableAutoMode`)是否置 true —— caps false 时分词
      *  `local_denied` / `org_denied`(seam ⑤;两者对壳的指路不同:改本机 env vs 找组织)。 */
     readonly localDeny: boolean;

package/dist/auto-mode-face.js

@@ -1,7 +1,3 @@
-import { createRequire } from "node:module";
-import { readFileSync } from "node:fs";
-import { dirname, join } from "node:path";
-import { z } from "zod";
 import { classifierSeatModel } from "@sema-agent/core";
 import { resolveMainModel } from "./model-select.js";
 export function classifierRouteFor(deps) {
@@ -15,65 +11,17 @@ export function classifierRouteFor(deps) {
 }
 export const AUTO_MODE_UNARMED_REASONS = ["mode_not_auto", "deployment_incapable", "org_denied", "local_denied", "settings_denied", "resolver_fault"];
 export const AUTO_MODE_UNARMED_REASON_SEMANTICS = {
-    mode_not_auto: "本次意图不是 auto(壳发的 permissionMode 不是 \"auto\";座缺席)——只属意图武装式,旧式 core 不读模式",
-    deployment_incapable: "装配面没挂 RunnerDeps.autoMode 分类器席位(本部署/本进程形不具备分类器);旧式 core 下另含「无 center 源 = 零授予路径」",
-    org_denied: "per-principal caps.autoMode === false 且本地 deny 未设:center 显式 deny / center 硬失败 fail-closed 拒项;旧式 core 下另含「center 在场但未授予」",
+    mode_not_auto: "本次意图不是 auto(壳发的 permissionMode 不是 \"auto\")",
+    deployment_incapable: "装配面没挂 RunnerDeps.autoMode 分类器席位(本部署/本进程形不具备分类器)",
+    org_denied: "per-principal caps.autoMode === false 且本地 deny 未设:center 显式 deny / center 硬失败 fail-closed 拒项",
     local_denied: "本地 catalog 键 PERMISSIONS_DISABLE_AUTO_MODE=true(center/settings 键名 permissions.disableAutoMode)把 caps.autoMode 折成 false",
     settings_denied: "settings 层 permissions.disableAutoMode 取 disable 或 true(两套已发布拼写同义;用户/managed 层 kill-switch)把本 run 折成非 auto —— capabilities 查询串不带 settings,本词由 run 级面产([6128] PM 裁定第六员)",
     resolver_fault: "per-principal caps resolver 抛错/答非记录(core 同形全拒:autoMode:false + onError phase config)",
 };
-function armingProbeFailure(what) {
-    return new Error(`auto-mode arming probe cannot decide (${what}). This probe answers ONE question — does the INSTALLED @sema-agent/core arm ` +
-        `auto mode from the task's INTENT seat (core #521: spec.autoModeRequested ∧ seat ∧ caps !== false), or from the older ` +
-        `"org grants it" polarity (runtimeCaps.autoMode === true ∧ seat)? The two polarities are OPPOSITE on the permission axis, ` +
-        `so guessing would silently put this deployment on the wrong one — either arming runs the org never granted, or reporting ` +
-        `"not armed" at /v1/capabilities while the engine really is arming (#157: no silent fail-open on the permission axis). ` +
-        `Refusing to start instead. Fix: reinstall the engine (rm -rf node_modules && npm ci) so the package ships its full dist, ` +
-        `or — if core moved/renamed the arming site — update the probe in src/auto-mode-face.ts to read the new one.`);
-}
-export function coreArmsAutoOnIntentProbe(distDir) {
-    const dist = distDir ?? dirname(createRequire(import.meta.url).resolve("@sema-agent/core"));
-    const armingSite = join(dist, "core", "runner", "prepare-task.js");
-    let armingSrc;
-    try {
-        armingSrc = readFileSync(armingSite, "utf8");
-    }
-    catch (err) {
-        throw armingProbeFailure(`the engine's arming site is unreadable at ${armingSite}: ${err instanceof Error ? err.message : String(err)}`);
-    }
-    if (armingSrc.includes(CORE_AUTO_MODE_INTENT_SEAT))
-        return true;
-    const snapPath = join(dist, "..", "test", "export-surface.snapshot.json");
-    let snap;
-    try {
-        const parsed = ExportSurfaceSnapshotSchema.safeParse(JSON.parse(readFileSync(snapPath, "utf8")));
-        if (!parsed.success)
-            throw new Error(`export-surface snapshot shape mismatch: ${parsed.error.issues.map((i) => i.path.join(".") + ":" + i.message).join("; ")}`);
-        snap = parsed.data;
-    }
-    catch (err) {
-        throw armingProbeFailure(`the arming seat is absent from ${armingSite} and the corroborating export-surface snapshot is unreadable at ${snapPath}: ${err instanceof Error ? err.message : String(err)}`);
-    }
-    if (!snap.exports || typeof snap.exports !== "object")
-        throw armingProbeFailure(`core export-surface snapshot malformed at ${snapPath}`);
-    if (typeof snap.exports.mailboxCrossProcessMountVerdict === "string") {
-        throw armingProbeFailure(`contradiction — the installed core's export surface is at/after the batch that shipped #521, but its arming site ` +
-            `(${armingSite}) never names \`${CORE_AUTO_MODE_INTENT_SEAT}\`, so the engine either moved the arming site or renamed the seat`);
-    }
-    return false;
-}
-const CORE_AUTO_MODE_INTENT_SEAT = "autoModeRequested";
-let armsOnIntentMemo;
-const ExportSurfaceSnapshotSchema = z.object({ exports: z.record(z.string(), z.string()).optional() }).passthrough();
-export function coreArmsAutoOnIntent() {
-    if (armsOnIntentMemo === undefined)
-        armsOnIntentMemo = coreArmsAutoOnIntentProbe();
-    return armsOnIntentMemo;
-}
 export async function judgeAutoModeArming(face, input) {
     const route = face?.seatMounted ? face.classifierModel?.() : undefined;
     const model = route !== undefined ? { model: route } : {};
-    if (face?.engineArmsOnIntent && input.requestedMode !== undefined && input.requestedMode !== "auto")
+    if (input.requestedMode !== undefined && input.requestedMode !== "auto")
         return { armed: false, reason: "mode_not_auto", ...model };
     if (face === undefined || !face.seatMounted)
         return { armed: false, reason: "deployment_incapable" };
@@ -84,18 +32,8 @@ export async function judgeAutoModeArming(face, input) {
     catch (err) {
         return { armed: false, reason: "resolver_fault", ...model, fault: err instanceof Error ? err.message : String(err) };
     }
-    const deniedWord = input.localDeny ? "local_denied" : "org_denied";
-    if (face.engineArmsOnIntent) {
-        if (caps?.autoMode === false)
-            return { armed: false, reason: deniedWord, ...model };
-        return { armed: true, ...model };
-    }
-    if (caps?.autoMode === true)
-        return { armed: true, ...model };
     if (caps?.autoMode === false)
-        return { armed: false, reason: deniedWord, ...model };
-    if (!input.entitlementSource)
-        return { armed: false, reason: "deployment_incapable", ...model };
-    return { armed: false, reason: "org_denied", ...model };
+        return { armed: false, reason: input.localDeny ? "local_denied" : "org_denied", ...model };
+    return { armed: true, ...model };
 }
 //# sourceMappingURL=auto-mode-face.js.map

package/dist/bench/s1/live-deps.d.ts

@@ -35,6 +35,7 @@
  *    `infraFailed` (EXCLUDED) — NEVER a fabricated uniform delivered=false loss for the whole TEAM column.
  */
 import { type TaskSpec } from "@sema-agent/core";
+import { type UnattendedLeg } from "../../unattended-permission-mode.js";
 import type { ProfileDeps, SoloImplSpec, SupImplSpec } from "./arms.js";
 import type { TrapSpec } from "./tasks.js";
 /** Live runtime config — the SAME base model + budget every arm runs on (the §3.2 fairness root). */
@@ -92,8 +93,14 @@ export declare function buildLiveDeps(rt: LiveRuntimeConfig, trap: TrapSpec, see
 /** The per-cell base TaskSpec every arm's leaf projects from. EXPORTED so the shape test measures the REAL spec
  *  handed to the runner (the BUDGET-MATCH anchor is spec.limits, not the harness's own RowBudget echo). */
 export declare function benchBaseSpec(rt: LiveRuntimeConfig, cellId: string): (objective: string) => TaskSpec;
-/** Project a `SoloImplSpec` (budget already stamped by the harness, all keys in `limits`) onto the bench base TaskSpec. */
-export declare function toTaskSpec(base: (objective: string) => TaskSpec, impl: SoloImplSpec): TaskSpec;
+/**
+ * Project a `SoloImplSpec` (budget already stamped by the harness, all keys in `limits`) onto the bench base TaskSpec.
+ * 🔴 7.106.0 合并复审 X3:SOLO 是**无人值守腿**(verify→fix 跑在一只不接 `onAsk` 的 Runner 上,没有审批席)⇒ 经 `withUnattendedLeg` 接
+ * 与 TEAM 的 leader worker 同一条腿(模式 = `UNATTENDED_PERMISSION_MODE`、写面 roots、写保护拒层)。修前裸 spec ⇒ core 7.34.0「缺席 =
+ * default」让写与非只读命令 headless 拒、终态照旧 completed —— SOLO 与 TEAM 的比较混进了权限差异。SUP 不走这里:它有耐久审批席
+ * (checkpoint suspend),它的问要人答,bypass 会把 SUP 的门放掉。
+ */
+export declare function toTaskSpec(base: (objective: string) => TaskSpec, impl: SoloImplSpec, leg: UnattendedLeg): TaskSpec;
 /** Project a `SupImplSpec` onto the bench base TaskSpec PLUS the durable wiring (checkpointStore + ask policy). */
 export declare function toSupTaskSpec(base: (objective: string) => TaskSpec, impl: SupImplSpec, trap: TrapSpec): TaskSpec;
 //# sourceMappingURL=live-deps.d.ts.map

package/dist/bench/s1/live-deps.js

@@ -1,6 +1,7 @@
 import { outwardPlane } from "../../terminal.js";
 import { Runner, runWithVerification, resumeWithVerification, runRepairLoop, combinePolicies, createDurableQuestionPolicy, QUESTION_AWAITS_RESUME, } from "@sema-agent/core";
 import { loadConfig } from "../../config.js";
+import { createUnattendedLeg, unattendedPermissionMode, withUnattendedLeg } from "../../unattended-permission-mode.js";
 import { createBrain } from "../../brain.js";
 import { buildPricing } from "../../budget.js";
 import { RemoteContainerExecutionEnv } from "../../plugins/remote-env-e2b.js";
@@ -57,7 +58,7 @@ function buildBrainIngredients(rt) {
     if (!p || ((p.inputPer1M ?? 0) === 0 && (p.outputPer1M ?? 0) === 0)) {
         throw new Error(`s1 live: zero pricing for ${rt.modelId} — C1 cost axis would be a fabricated $0 (set MODEL_COST_INPUT/OUTPUT)`);
     }
-    return { brain, models: config.models, roles: config.roles, pricing };
+    return { brain, models: config.models, roles: config.roles, pricing, unattendedPermissionMode: unattendedPermissionMode(config) };
 }
 const sh = (env) => async (cmd) => {
     const r = await env.exec(`bash -lc ${JSON.stringify(cmd)}`);
@@ -167,8 +168,9 @@ function graderTransport(grader) {
     };
 }
 export function buildLiveDeps(rt, trap, seed, cellId) {
-    const { brain, models, roles, pricing } = buildBrainIngredients(rt);
+    const { brain, models, roles, pricing, unattendedPermissionMode: leaderMode } = buildBrainIngredients(rt);
     const baseSpec = benchBaseSpec(rt, cellId);
+    const soloLeg = createUnattendedLeg(leaderMode, {});
     const state = {};
     const ensureWorker = async () => {
         if (!state.worker) {
@@ -206,7 +208,7 @@ export function buildLiveDeps(rt, trap, seed, cellId) {
     const deps = {
         runWithVerification: async (implSpec) => {
             const { runner } = await ensureWorker();
-            return runWithVerification(runner, toTaskSpec(baseSpec, implSpec), { maxRounds: rt.maxRounds ?? 2 });
+            return runWithVerification(runner, toTaskSpec(baseSpec, implSpec, soloLeg), { maxRounds: rt.maxRounds ?? 2 });
         },
         runWithVerificationSup: async (implSpec) => {
             const { runner } = await ensureWorker();
@@ -282,7 +284,7 @@ export function buildLiveDeps(rt, trap, seed, cellId) {
                     rmSync(tmp, { recursive: true, force: true });
                 }
             };
-            return runLeaderForTrap(rt, brain, models, roles, pricing, trap, cellId, captureIntegratedTreeToBundle);
+            return runLeaderForTrap(rt, brain, models, roles, pricing, leaderMode, trap, cellId, captureIntegratedTreeToBundle);
         },
         runOracle: () => runOracle(false),
     };
@@ -298,21 +300,24 @@ export function benchBaseSpec(rt, cellId) {
         limits: { maxTokens: rt.maxTokens ?? 8000, maxCostUsd: rt.maxCostUsd ?? 1.0, maxTurns: rt.maxTurns ?? 12 },
     });
 }
-export function toTaskSpec(base, impl) {
+function projectImplBudget(base, impl) {
     return { ...base(impl.objective), limits: { ...impl.limits } };
 }
+export function toTaskSpec(base, impl, leg) {
+    return withUnattendedLeg(projectImplBudget(base, impl), leg);
+}
 export function toSupTaskSpec(base, impl, trap) {
     const requireApproval = trap.gatedTools ?? ["Bash"];
     const neverAuto = trap.neverAuto ?? [];
     return {
-        ...toTaskSpec(base, impl),
+        ...projectImplBudget(base, impl),
         checkpointStore: impl.checkpointStore,
         durableApproval: { scope: impl.durableApprovalScope },
         toolPolicy: combinePolicies(createDurableQuestionPolicy(), createDurableAskPolicy({ requireApproval, ...(neverAuto.length > 0 ? { neverAuto } : {}) })),
         onQuestion: QUESTION_AWAITS_RESUME,
     };
 }
-async function runLeaderForTrap(rt, brain, models, roles, pricing, trap, cellId, importIntegratedTreeToWorker) {
+async function runLeaderForTrap(rt, brain, models, roles, pricing, leaderMode, trap, cellId, importIntegratedTreeToWorker) {
     const { mkdtempSync, rmSync, writeFileSync, mkdirSync } = await import("node:fs");
     const { execFileSync, spawn } = await import("node:child_process");
     const { tmpdir } = await import("node:os");
@@ -365,7 +370,7 @@ async function runLeaderForTrap(rt, brain, models, roles, pricing, trap, cellId,
     process.env.LEADER_ENABLED = "true";
     process.env.LEADER_WORKER_BUDGET_USD = String((rt.maxCostUsd ?? 1.0) / 2);
     const run = createLeaderRunner({
-        brain, models, roles, pricing, e2bApiKey: rt.e2bApiKey, workspace: W,
+        brain, models, roles, pricing, unattendedPermissionMode: leaderMode, e2bApiKey: rt.e2bApiKey, workspace: W,
         ...(s1DebugGit() ? { logger: { warn: (m, x) => console.error(`[S1_DEBUG_LEADER warn] ${m}`, x ? JSON.stringify(x).slice(0, 300) : ""), info: (m, x) => console.error(`[S1_DEBUG_LEADER info] ${m}`, x ? JSON.stringify(x).slice(0, 200) : "") } } : {}),
     });
     const teamSeedWrite = (trap.seedFiles ?? [])

package/dist/boot/budget-tracing.js

@@ -2,6 +2,7 @@ import { createBrain, createDegradeRouteWatch } from "../brain.js";
 import { ModelUsageTracker, PromptManifestTracker, buildPricing, createSideQueryAccountant, createTracer } from "../budget.js";
 import { FleetUsageAccumulator } from "../fleet-client.js";
 import { createFleetLeaseFromEnv } from "../fleet-lease.js";
+import { centerLaneConfigured } from "../config-center/center-request.js";
 import { CostQuota } from "../observability/cost-quota.js";
 import { buildQuotaBounds } from "./limit-sync.js";
 import { assembleFileHistory } from "../file-history-capture.js";
@@ -25,12 +26,12 @@ export function createBudgetAndTracing(ctx) {
         : new CostQuota(bounds.limitMicroUsd, bounds.windowMs);
     const modelUsageTracker = new ModelUsageTracker();
     const promptManifestTracker = new PromptManifestTracker();
-    const fleetUsage = config.configCenter && process.env.FLEET_ADVERTISE_ADDRESS ? new FleetUsageAccumulator() : undefined;
+    const fleetUsage = centerLaneConfigured(config) ? new FleetUsageAccumulator() : undefined;
     const fleetLease = createFleetLeaseFromEnv(config, { logger, metrics });
     const tracer = createTracer(metrics, costQuota, modelUsageTracker, fleetUsage, fleetLease, (m) => config.modelQuotaWeights[m] ?? 1, promptManifestTracker);
     const sideQueryAccounting = createSideQueryAccountant(metrics, costQuota, fleetUsage, fleetLease, (m) => config.modelQuotaWeights[m] ?? 1);
     const toolResultStore = backend?.toolResult ? backend.toolResult() : undefined;
-    const sessionPolicyStore = backend ? backend.sessionPolicy() : undefined;
+    const sessionPolicyStore = backend ? backend.sessionPolicy(logger) : undefined;
     const { store: fileHistoryStore, erasure: fileHistoryErasure } = assembleFileHistory(backend);
     return {
         brain, degradeRouteWatch, pricing, counterDegradeHook, costQuota, modelUsageTracker, promptManifestTracker,