@sema-agent/server 7.105.0 → 7.107.0

package/dist/boot/stores.js

@@ -37,6 +37,7 @@ import { resolveStreamApprovalGate } from "../tool-approval.js";
 import { buildMemoryBoundaryLaneFacts, buildMemoryWriteBoundaryAudit, effectiveMemoryPersistenceCapable } from "./memory-boundary.js";
 import { buildMemoryPosture } from "../memory-posture.js";
 import { establishSqlEnginePosture } from "../sql-engine-posture.js";
+import { buildStorePosture } from "../store-posture.js";
 import { buildDisplaySafeUrl } from "../trace/redact.js";
 const DARK_REASON_PROSE = {
     engine_off: () => "MEMORY_ENGINE=off",
@@ -46,16 +47,17 @@ const DARK_REASON_PROSE = {
 export async function openStores(ctx) {
     const { config, logger, metrics, localRoot } = ctx;
     let backend;
-    let storeBackendDegraded = false;
+    let storeDegradedReason;
     const wantDb = config.sessionBackend === "tidb" ||
         config.dbBackend === "local" ||
         (config.sessionBackend === "auto" && !!(config.tidb || config.pg));
     if (wantDb) {
         const opened = await openStoreBackendWithFallback(config, logger);
         backend = opened.backend;
-        storeBackendDegraded = opened.degraded;
+        storeDegradedReason = opened.degradedReason;
     }
-    metrics.setGauge("store_backend_degraded", storeBackendDegraded ? 1 : 0);
+    const storePosture = buildStorePosture({ declared: config.dbBackend, assembled: backend?.kind, degradedReason: storeDegradedReason });
+    metrics.setGauge("store_backend_degraded", storePosture.degradedReason !== undefined ? 1 : 0);
     {
         const mysqlPool = backend?.mysqlPool?.();
         const pgPool = backend?.pgPool?.();
@@ -442,7 +444,7 @@ export async function openStores(ctx) {
             .startRefresh()
         : undefined;
     return {
-        backend, storeBackendDegraded, memoryEngine, memorySyncCursors, rosterStore, backgroundAgentStore, mailboxRecipientLifecycle,
+        backend, storePosture, memoryEngine, memorySyncCursors, rosterStore, backgroundAgentStore, mailboxRecipientLifecycle,
         taskAttachmentStore, mailboxStore, memoryExportBackend, memorySyncRunner, sessionStore, breakerState,
         usageWindowStore, memoryPosture, taskListLane, sqlEngineFacts,
     };

package/dist/brain.d.ts

@@ -1,5 +1,6 @@
 import { type Brain, type BreakerState, type Model } from "@sema-agent/core";
 import type { ServiceConfig } from "./config-types.js";
+import { type SealedCustodyPoison } from "./key-resolver.js";
 import { type RestartSliceCtx } from "./config-center/restart-signal.js";
 /**
  * 配了快切层(failover ≥2 路 / 断路器)时,**每路**的重试上限。
@@ -49,6 +50,25 @@ export type DegradeRoutePlane = Pick<ServiceConfig, "degrade" | "models" | "gate
  * 车道没开(非 reactive)或表里没有叫 `degrade.to` 的条目 ⇒ `undefined`(createBrain 不装降级壳)。
  */
 export declare function degradeTargetOf(config: Pick<ServiceConfig, "degrade" | "models">): Model | undefined;
+/**
+ * S-795(R1):降级壳里目标自有凭据的**身份**(不是值)—— 与目标那只 Model 同一代,在 createBrain 组壳那一刻冻结。
+ *  · `apiKeyEnv` —— 那一代给目标配的 env 变量**名**;壳每跳按这个名字现读值(同名轮换仍热;变量被删 ⇒ S-896 起 `env_missing` 毒丸,跳响亮拒 —— 7.105.0 及以前是「与自有凭据缺席同一臂」、落网关 key 档)。
+ *  · `sealed` —— 那一代托管密钥的解封产物(明文,或解不开时的毒丸;与 `config.modelApiKeys` 的值同型)。托管密钥的身份是它的密文;
+ *    本进程的托管店在 boot 读一次、此后不变(`ensureSealedKeyStore`),同一密文恒解出同一产物 —— 所以持有那一代的产物就是持有
+ *    那一代的身份(壳里没有密文与托管店,也不需要)。重贴 = 新 key = 新身份,要重启才进壳 —— `degrade-route` 指纹带它的身份摘要,
+ *    所以重贴会签。🔴 明文是活秘密:只活在壳的闭包里,指纹只取摘要({@link degradeRouteFingerprint}),绝不进日志 / 序列化面。
+ * 目标没有自有凭据 ⇒ `{}`。两张表至多一个条目有效(registry-core 互斥:带 sealedApiKey 的条目不落 modelApiKeyEnv)。
+ */
+export interface DegradeCredentialIdentity {
+    readonly apiKeyEnv?: string;
+    readonly sealed?: string | SealedCustodyPoison;
+}
+/**
+ * S-795:读出 `target`(降级壳焊的那只目标,{@link degradeTargetOf})此刻的凭据身份 —— **唯一**读法:createBrain 组壳时冻结它,
+ * `degrade-route` 指纹的两侧读数与启动摘要同读它。查表的键与序与修前 `fbOwnApiKey` 同:目标真名、再 `degrade.to`(后者可能是
+ * `default` 别名,两张 key 表按真名索引、env 车道的目录则反过来);每个名字上托管密钥压过 env 引用(key-resolver 的序)。
+ */
+export declare function degradeCredentialIdentityOf(config: Pick<ServiceConfig, "degrade" | "modelApiKeyEnv" | "modelApiKeys">, target: Pick<Model, "name">): DegradeCredentialIdentity;
 /**
  * S-794:降级壳的**路由指纹**(纯数据)—— `degrade-route` 重启片 `baked` / `current` 两侧读数的唯一读法。
  *
@@ -57,8 +77,10 @@ export declare function degradeTargetOf(config: Pick<ServiceConfig, "degrade" |
  *  · 那只 Model 经 `catalogEntryFingerprint`(与 swap 门同一张热字段减法:单价**数值**热、在场性不热;其余字段一律算 —— deny-list,
  *    漂移的失败形是多签一次,绝不漏签);
  *  · 有效端点根(S-623 同一只解析器 `openaiRouteBaseUrl(baseUrl, gatewayBaseUrl)`);
- *  · 它配的凭据**身份**:`apiKeyEnv`(变量名,不是值)与托管密钥**在场位**(不取值:值是热的,且是秘密)。两次查表的键与
- *    `fbOwnApiKey` 同(目标的真名,再 `degrade.to`)。
+ *  · 它配的凭据**身份**({@link degradeCredentialIdentityOf},壳冻结的同一只):`apiKeyEnv`(变量名,不是值;值热、同名轮换不签)与
+ *    托管密钥的**身份摘要**(S-795 R1 起壳冻结那一代的 key ⇒ 重贴 = 新身份,必须签;车QU codex r1 [high] F2:修前只有在场位,同端点
+ *    重贴不签、旧 key 一直发到人工重启)。摘要 = 明文 sha256 前 16 位十六进制(与 center-credential.ts「token 自身摘要身份」同一种
+ *    做法;同一明文重新封一次 = 同一把 key ⇒ 不签);毒丸 = 它的 `publicKeyId` + 成因(不含检测时刻 —— 每次 apply 都会重铸)。
  * 没有焊壳(车道没开 / 没有目标)⇒ `null`。在场 ↔ 缺席的翻转因此自然是一次变化。
  */
 export declare function degradeRouteFingerprint(config: DegradeRoutePlane): unknown;

package/dist/brain.js

@@ -2,6 +2,8 @@ import { adjudicateModelRoute, createAnthropicBrain, createCircuitBreakerBrain,
 import { routeKeyOf } from "@sema-agent/core";
 import { buildDefaultResilience } from "./config-types.js";
 import { resolveModelApiKey } from "./key-resolver.js";
+import { createHash } from "node:crypto";
+import { isModelKeyPoison, modelKeyPoisonIdentity } from "./key-resolver.js";
 import { dispatchBrainLane } from "./model-provider.js";
 import { openaiRouteBaseUrl } from "./model-route-endpoint.js";
 import { catalogEntryFingerprint } from "./config-center/restart-signal.js";
@@ -96,8 +98,10 @@ export function createBrain(config, deps = {}) {
         const degradeTo = config.degrade.to;
         const fallbackModel = degradeTargetOf(config);
         if (fallbackModel) {
-            const fbOwnApiKey = () => resolveModelApiKey(fallbackModel.name, config.modelApiKeyEnv ?? {}, process.env, config.modelApiKeys ?? {}) ??
-                resolveModelApiKey(degradeTo, config.modelApiKeyEnv ?? {}, process.env, config.modelApiKeys ?? {});
+            const credential = degradeCredentialIdentityOf(config, fallbackModel);
+            const ownEnvRef = credential.apiKeyEnv !== undefined ? { [fallbackModel.name]: credential.apiKeyEnv } : {};
+            const ownSealed = credential.sealed !== undefined ? { [fallbackModel.name]: credential.sealed } : {};
+            const fbOwnApiKey = () => resolveModelApiKey(fallbackModel.name, ownEnvRef, process.env, ownSealed);
             const anthropicLaneHop = dispatchBrainLane(fallbackModel.provider, anthropicBrain !== undefined) === "anthropic";
             const fallback = anthropicLaneHop && anthropicBrain
                 ?
@@ -139,18 +143,36 @@ export function createBrain(config, deps = {}) {
 export function degradeTargetOf(config) {
     return config.degrade?.reactive ? config.models?.[config.degrade.to] : undefined;
 }
+export function degradeCredentialIdentityOf(config, target) {
+    for (const name of config.degrade === undefined ? [target.name] : [target.name, config.degrade.to]) {
+        const sealed = config.modelApiKeys?.[name];
+        if (sealed !== undefined)
+            return { sealed };
+        const apiKeyEnv = config.modelApiKeyEnv?.[name];
+        if (apiKeyEnv !== undefined)
+            return { apiKeyEnv };
+    }
+    return {};
+}
 export function degradeRouteFingerprint(config) {
     const target = degradeTargetOf(config);
     if (target === undefined || config.degrade === undefined)
         return null;
-    const to = config.degrade.to;
+    const credential = degradeCredentialIdentityOf(config, target);
     return {
         model: catalogEntryFingerprint(target),
         endpoint: openaiRouteBaseUrl(target.baseUrl, config.gatewayBaseUrl) ?? null,
-        apiKeyEnv: config.modelApiKeyEnv?.[target.name] ?? config.modelApiKeyEnv?.[to] ?? null,
-        sealedKey: config.modelApiKeys?.[target.name] !== undefined || config.modelApiKeys?.[to] !== undefined,
+        apiKeyEnv: credential.apiKeyEnv ?? null,
+        sealedKey: sealedIdentityFingerprint(credential.sealed),
     };
 }
+function sealedIdentityFingerprint(sealed) {
+    if (sealed === undefined)
+        return null;
+    if (isModelKeyPoison(sealed))
+        return { poisoned: modelKeyPoisonIdentity(sealed), reason: sealed.reason };
+    return { digest: createHash("sha256").update(sealed, "utf8").digest("hex").slice(0, 16) };
+}
 export function createDegradeRouteWatch(config) {
     const baked = degradeRouteFingerprint(config);
     return { read: () => ({ baked, current: degradeRouteFingerprint(config) }) };
@@ -203,11 +225,8 @@ export function brainSummary(config) {
             if (dispatchBrainLane(target.provider, config.anthropic !== undefined) === "anthropic") {
                 return { reactiveDegradeRoutePairing: "anthropic-lane", reactiveDegradeRouteRefusal: null };
             }
-            const declaresOwnCredential = config.modelApiKeyEnv?.[target.name] !== undefined ||
-                config.modelApiKeyEnv?.[config.degrade.to] !== undefined ||
-                config.modelApiKeys?.[target.name] !== undefined ||
-                config.modelApiKeys?.[config.degrade.to] !== undefined ||
-                hasAuthCarrier(target.headers);
+            const credential = degradeCredentialIdentityOf(config, target);
+            const declaresOwnCredential = credential.apiKeyEnv !== undefined || credential.sealed !== undefined || hasAuthCarrier(target.headers);
             if (declaresOwnCredential) {
                 return { reactiveDegradeRoutePairing: "per-model-declared", reactiveDegradeRouteRefusal: null };
             }

package/dist/budget.js

@@ -100,6 +100,9 @@ export function createTracer(metrics, costQuota, modelUsage, fleetUsage, fleetLe
         else if (e.kind === "tool.call") {
             metrics.inc("tool_calls_total", { name: toolName(e.name), ok: String(e.ok) });
         }
+        else if (e.kind === "brain.echo_dropped") {
+            metrics.inc("brain_echo_dropped_total", { field: e.field });
+        }
         else if (e.kind === "task.degraded") {
             metrics.inc("degraded_total", { reason: e.reason });
         }

package/dist/capabilities/center-wiring.d.ts

@@ -0,0 +1,64 @@
+/**
+ * S-866 ②(设计稿 v1.1 §2②)—— caps `centerWiring`:「这台引擎**此刻**是不是真的接着中心,调用者的额度是不是真的在执行」。
+ *
+ * 7.105.0 及以前这几件事只有日志和 gauge 知道:拉取、租约、用量三条腿各自沉默 —— 租约鉴权失败 / 中心不可达一律放行,调用方
+ * 与运维面板都读不出「额度现在没人在判」。本键把它们收成一个读面(调用方面;运维面仍是 `/health` 与 `GET /v1/diagnostics/wiring`)。
+ *
+ * ## 形与 present-iff
+ * 整个键只在接了中心(`config.configCenter` 在场)时出现;`lease:"absent"`(中心三件不齐 ⇒ 没装租约管理器)时 `leaseHealth` /
+ * `failMode` / `caller` 三键缺席。「键缺席」于是两义:老 worker / 没接中心 —— 同一体的 `version` 能分。
+ *  · `effectivePull` = 最近一次实拉成功(`lastPull === "ok"`;LKG 起服 / 从未成功 / 最近一拍失败 = false);
+ *  · `effectiveRevision` = 与 `/health.configAppliedVersion` 同一只 ledger 视图(`config-center/pull-state.ts`);
+ *  · `lease` / `leaseHealth` / `failMode` / `caller` = 租约管理器的 `snapshot()` 与生效姿态(与执行的那一只同源);
+ *  · `usageReport` = 用量环装没装(装配事实:累加器与环同一只谓词 `centerLaneConfigured`);
+ *  · `issuer` = 鉴权桥 issuer 显式 / 回退(`authBridgeIssuerOf`;接了中心 ⇒ 桥恒装 ⇒ 没有 `none` 这一词)。
+ * caps 路由自己**不 admit**(不打中心):读的是最近一次谈判留下的状态。
+ */
+import type { CenterPullView } from "../config-center/pull-state.js";
+import type { CallerLease, FleetLeaseManager, LeaseFailMode, LeaseHealth, LeaseSnapshot } from "../fleet-lease.js";
+import type { ServiceConfig } from "../config.js";
+/** `issuer` 的词表(两词:接了中心 ⇒ 桥恒装,`none` 结构上到不了,闭集里不留死词)。 */
+export declare const CENTER_ISSUER_WORDS: readonly ["explicit", "fallback"];
+export type CenterIssuer = (typeof CENTER_ISSUER_WORDS)[number];
+/** caps `centerWiring` 的形(纯数据)。 */
+export interface CenterWiring {
+    readonly effectivePull: boolean;
+    readonly effectiveRevision: {
+        readonly version: number;
+        readonly updatedAt: string;
+    } | null;
+    readonly lease: "configured" | "absent";
+    readonly leaseHealth?: LeaseHealth;
+    readonly failMode?: LeaseFailMode;
+    readonly usageReport: boolean;
+    readonly issuer: CenterIssuer;
+    readonly caller?: {
+        readonly lease: CallerLease;
+        readonly retryAfterSec?: number;
+    };
+}
+/** 投影的全部输入(纯数据;一次读取的快照)。 */
+export interface CenterWiringFacts {
+    readonly pull: CenterPullView;
+    /** 缺席 = 没装租约管理器(`lease:"absent"`)。 */
+    readonly lease: {
+        readonly failMode: LeaseFailMode;
+        readonly snapshot: LeaseSnapshot;
+    } | undefined;
+    readonly usageReport: boolean;
+    readonly issuer: CenterIssuer;
+}
+/** 输入 → caps 投影(纯函数,`build*` = 纯数据)。 */
+export declare function buildCenterWiring(f: CenterWiringFacts): CenterWiring;
+/**
+ * 读面工厂(`create*`:返回的是闭包)。stage-10 装配一次,caps 路由按请求调(入参 = 该请求的已验 principal,与租约门同键)。
+ * 没接中心 ⇒ `undefined`(键整个缺席)。`now` 注入只给测试(与租约管理器同钟才判得出过期);生产缺省 `Date.now`。
+ */
+export declare function createCenterWiringReader(a: {
+    readonly config: Pick<ServiceConfig, "configCenter" | "authBridgeIssuer">;
+    readonly pullState: () => CenterPullView;
+    readonly fleetLease: Pick<FleetLeaseManager, "snapshot" | "failMode"> | undefined;
+    readonly usageReport: boolean;
+    readonly now?: () => number;
+}): ((principal: string | undefined) => CenterWiring) | undefined;
+//# sourceMappingURL=center-wiring.d.ts.map

package/dist/capabilities/center-wiring.js

@@ -0,0 +1,24 @@
+import { authBridgeIssuerOf } from "../auth-bridge.js";
+export const CENTER_ISSUER_WORDS = ["explicit", "fallback"];
+export function buildCenterWiring(f) {
+    const base = { effectivePull: f.pull.lastPull === "ok", effectiveRevision: f.pull.effectiveRevision, usageReport: f.usageReport, issuer: f.issuer };
+    if (f.lease === undefined)
+        return { ...base, lease: "absent" };
+    return { ...base, lease: "configured", leaseHealth: f.lease.snapshot.leaseHealth, failMode: f.lease.failMode, caller: f.lease.snapshot.caller };
+}
+export function createCenterWiringReader(a) {
+    if (a.config.configCenter === undefined)
+        return undefined;
+    const issuer = authBridgeIssuerOf(a.config);
+    if (issuer === undefined)
+        throw new Error("center wiring: a configured center always yields an auth-bridge issuer (explicit or fallback)");
+    const now = a.now ?? Date.now;
+    const lease = a.fleetLease;
+    return (principal) => buildCenterWiring({
+        pull: a.pullState(),
+        lease: lease === undefined ? undefined : { failMode: lease.failMode, snapshot: lease.snapshot(principal, now()) },
+        usageReport: a.usageReport,
+        issuer: issuer.source,
+    });
+}
+//# sourceMappingURL=center-wiring.js.map

package/dist/capabilities/composite-members.d.ts

@@ -0,0 +1,89 @@
+/**
+ * S-129 ③ 残余(车QX)—— `GET /v1/capabilities` **复合能力位的成员闭集**(单点)。
+ *
+ * ## 病
+ * 能力位的**顶层键**早有闭集(契约附录 B.1,`test/capabilities-doc-appendix.test.ts` 双向对拍),wire 变更清单
+ * (`scripts/wire-changes-server.mjs`)也 diff 它;可**值是对象**的那些位,其成员(`executionLane.isolated`、`store.sql`、
+ * `centerWiring.caller` …)不在任何闭集里 —— 7.106.0 新加的 `executionLane.isolated` 在清单里不可见,发车帖与 CAPABILITY 登记只能
+ * 人工抄。本表把「成员」立成与顶层键同级的闭集,契约附录 B.1a(`taskSettings` 在 B.2、`permissionModeAuto` 在 B.2b —— 同一闭集的
+ * 分段)是它的文档面,清单生成器 diff 那几段。
+ *
+ * ## 一条规则:什么算「复合能力位」
+ * caps 应答字面量里,**值的类型含具名成员对象臂**的顶层键。判据只看类型,不看名字:
+ *  · `false` / `null` / `undefined` 臂剥掉再看(`fleet: {…} | false`、`writeProtection: {…} | null`、present-iff 的
+ *    `centerWiring?: {…}` 都算复合位,成员 = 对象臂的键);
+ *  · 判别联合逐臂取键的**并集**(`permissionModeAuto` 展开的 `AutoModeVerdict`:`reason` 只在 `armed:false` 臂上,照样是成员 ——
+ *    `keyof (A | B)` 只给公共键,会漏掉它);
+ *  · **不算**:标量 / 字面词(`readFace`、`fileHistoryCapture`)· 数组(`workflowModels`:成员是数据,不是键)· **自由映射**
+ *    (`Record<string, …>`:键集不是闭集,「成员」无从登记 —— 它的键在 wire 上是数据,消费方按值读,不按键名分派;今天 caps
+ *    字面量里没有这种位,规则先写明,免得哪天有人为它开特例)。
+ *  · 只登记**一层**:成员本身若又是对象(`store.sql`、`centerWiring.effectiveRevision` / `caller`),它的内部形写在附录 B.1a 的
+ *    「值形」列,不进本表(二层成员不登记 = 已披露的欠账:它们的增删今天仍只在「值形」列的人读文字里)。
+ *
+ * ## 两个半场(都必须双向)
+ *  · **编译期**:{@link gateCompositeMembers} 包在 caps 路由的应答字面量外,按字面量**自己的推断型**对本表做双向差 ——
+ *    字面量上长出一个未登记的复合位 / 成员 ⇒ tsc 红(正向);表里登记了字面量不再铸的位 / 成员(退役、改名、拼错)⇒ tsc 红
+ *    (反向)。红的时候错误里逐条点名 `<cap>.<member>` 与方向。判据是推断型而不是某个具名接口:内联字面量(`fleet`、
+ *    `taskSettings` …)、投影函数的返回型(`ExecutionLaneCapability` …)、展开进来的类型(`...autoMode`)一律被看见,新长出来的
+ *    复合位也被看见 —— 「值是对象」这条规则由类型自己执行,不靠人记得来登记。
+ *  · **文档**:`test/capabilities-doc-appendix.test.ts` 把本表与附录 B.1a / B.2 / B.2b 的成员行双向对拍(缺行 / 多行逐条点名)。
+ *
+ * 为什么编译期门借一只恒等函数而不是 `AssertAllKeysHandled` 类型别名:被判的是 `handleCapabilities` 里一个**表达式**的推断型,
+ * 模块级给不出它的名字;而把字面量挪成局部常量会让它离开 `sendJson(…)` 的实参子树 —— `test/config-url-display-safe.test.ts`
+ * 的出口扫描器按「出口调用的实参子树」找 URL 字段,挪出去它就对整只 caps 体失明。恒等函数运行期零行为(原样返回入参)。
+ */
+import type { NamedKeysOf } from "../request-key-closure.js";
+/**
+ * 复合能力位 → 成员(闭集,一位一行;成员按字面量 / 投影型里的声明序)。改这张表 = 改 wire 契约:同批改附录 B.1a(或 B.2 /
+ * B.2b)与 CHANGELOG。present-iff 的位与成员照样登记(在场律写在附录的「在场律」列)。
+ */
+export declare const COMPOSITE_CAPABILITY_MEMBERS: {
+    readonly deviceExecutor: readonly ["enabled", "protocolVersion", "maxInflightPerDevice", "wsPath", "management"];
+    readonly fleet: readonly ["stream", "sessionScope", "observe", "resume", "bgNotifyFailClosed", "steerPriority", "hookFailureNotice"];
+    readonly memoryEngine: readonly ["backend", "vectorMode"];
+    readonly store: readonly ["declared", "backend", "durable", "degradedReason", "sql"];
+    readonly centerWiring: readonly ["effectivePull", "effectiveRevision", "lease", "leaseHealth", "failMode", "usageReport", "issuer", "caller"];
+    readonly webSearch: readonly ["backend"];
+    readonly background: readonly ["listFace", "exitFaces"];
+    readonly taskSettings: readonly ["permissions", "permissionMode", "model", "outputStyle", "env", "hooks"];
+    readonly permissionModeAuto: readonly ["accepted", "classifierSeat", "entitlementSource", "armed", "reason", "model"];
+    readonly writeProtection: readonly ["armed", "rows", "replaced"];
+    readonly executionLane: readonly ["provider", "toolsOnThisHost", "isolated"];
+    readonly retention: readonly ["mode", "maxAgeDays"];
+    readonly workflowsGate: readonly ["engineCan", "denial"];
+    readonly sealedKey: readonly ["alg", "publicKeyId", "publicKey"];
+};
+type CompositeTable = typeof COMPOSITE_CAPABILITY_MEMBERS;
+/** 值的**具名成员对象臂**(标量 / 字面词 / `false` / `null` / `undefined` / 数组 / 函数臂剥掉)。 */
+type ObjectArmsOf<V> = V extends readonly unknown[] ? never : V extends (...args: never[]) => unknown ? never : V extends object ? V : never;
+/** 联合逐臂取键的并集(`keyof (A | B)` 只给公共键,判别联合的臂专有键会漏)。 */
+type KeysOfUnion<T> = T extends unknown ? keyof T : never;
+/** 一个能力位值的成员键;自由映射(键集含 `string`)⇒ `never`(不算复合位,见头注)。 */
+type MemberKeysOf<V> = string extends KeysOfUnion<ObjectArmsOf<V>> ? never : KeysOfUnion<ObjectArmsOf<V>>;
+/** 应答体里的复合位(索引签名剥掉 —— `...deps.capabilities` 展开进来的 `Record<string, unknown>` 不是具名键)。 */
+type CompositeKeysOf<Body> = {
+    [K in keyof NamedKeysOf<Body>]-?: [MemberKeysOf<Body[K & keyof Body]>] extends [never] ? never : K;
+}[keyof NamedKeysOf<Body>];
+/** 正向:字面量铸了、表没登记 —— 整只复合位(`<cap>`)或已登记位上的成员(`<cap>.<member>`)。 */
+type CompositeMembersUnregistered<Body> = Exclude<CompositeKeysOf<Body>, keyof CompositeTable> | {
+    [C in CompositeKeysOf<Body> & keyof CompositeTable]: `${C & string}.${Exclude<MemberKeysOf<Body[C & keyof Body]>, CompositeTable[C][number]> & string}`;
+}[CompositeKeysOf<Body> & keyof CompositeTable];
+/** 反向:表登记了、字面量不再铸 —— 退役 / 改名 / 拼错的残条目。 */
+type CompositeMembersPhantom<Body> = Exclude<keyof CompositeTable, CompositeKeysOf<Body>> | {
+    [C in keyof CompositeTable & CompositeKeysOf<Body>]: `${C & string}.${Exclude<CompositeTable[C][number], MemberKeysOf<Body[C & keyof Body]>> & string}`;
+}[keyof CompositeTable & CompositeKeysOf<Body>];
+/** 表与应答体的**双向**漂移(正向 ∪ 反向;`never` = 一致)。导出给测试做类型负控。 */
+export type CompositeMembersDrift<Body> = CompositeMembersUnregistered<Body> | CompositeMembersPhantom<Body>;
+/** 漂移非空 ⇒ 一个多出来的必填键,错误信息里逐条点名 `<cap>.<member>` 与方向。 */
+type CompositeMembersGate<Body> = [CompositeMembersDrift<Body>] extends [never] ? object : {
+    readonly "S-129 composite capability member drift (src/capabilities/composite-members.ts)": {
+        readonly [K in CompositeMembersDrift<Body>]: K extends CompositeMembersUnregistered<Body> ? "字面量铸了、表没登记" : "表登记了、字面量没铸";
+    };
+};
+/**
+ * caps 应答字面量的**编译期**成员闭集门(见头注「两个半场」)。运行期是恒等函数:原样返回入参,零行为。
+ * 用法:`sendJson(res, 200, gateCompositeMembers({ …应答字面量… }))`。
+ */
+export declare function gateCompositeMembers<Body extends CompositeMembersGate<Body>>(body: Body): Body;
+export {};
+//# sourceMappingURL=composite-members.d.ts.map

package/dist/capabilities/composite-members.js

@@ -0,0 +1,20 @@
+export const COMPOSITE_CAPABILITY_MEMBERS = {
+    deviceExecutor: ["enabled", "protocolVersion", "maxInflightPerDevice", "wsPath", "management"],
+    fleet: ["stream", "sessionScope", "observe", "resume", "bgNotifyFailClosed", "steerPriority", "hookFailureNotice"],
+    memoryEngine: ["backend", "vectorMode"],
+    store: ["declared", "backend", "durable", "degradedReason", "sql"],
+    centerWiring: ["effectivePull", "effectiveRevision", "lease", "leaseHealth", "failMode", "usageReport", "issuer", "caller"],
+    webSearch: ["backend"],
+    background: ["listFace", "exitFaces"],
+    taskSettings: ["permissions", "permissionMode", "model", "outputStyle", "env", "hooks"],
+    permissionModeAuto: ["accepted", "classifierSeat", "entitlementSource", "armed", "reason", "model"],
+    writeProtection: ["armed", "rows", "replaced"],
+    executionLane: ["provider", "toolsOnThisHost", "isolated"],
+    retention: ["mode", "maxAgeDays"],
+    workflowsGate: ["engineCan", "denial"],
+    sealedKey: ["alg", "publicKeyId", "publicKey"],
+};
+export function gateCompositeMembers(body) {
+    return body;
+}
+//# sourceMappingURL=composite-members.js.map

package/dist/capabilities/execution-lane.d.ts

@@ -5,6 +5,9 @@ export interface ExecutionLaneCapability {
     /** 工具跑的那台机器就是本进程这台吗(= server 盘上的绝对路径对模型的工具有没有意义)。
      *  属主 = `task-cwd.ts` 的 {@link toolsRunOnThisHost},与 `skills[].baseDir` 的铸点同一只函数。 */
     readonly toolsOnThisHost: boolean;
+    /** S-281:手在不在 OS 级隔离边界里(容器 / microVM / Kata pod)。**present-iff 本车道有手**(能力表 `coreRemoteExecutionEnv`);
+     *  值 = {@link laneIsolated}(能力表 `isolation` 位,与 boot `remote_exec_enabled.isolated` 同一只)。见头注 S-281 段。 */
+    readonly isolated?: boolean;
 }
 /**
  * 部署席 → 消费端窄投影。形照 `projectWebSearchCapability` / `projectSqlEngineCapability`:

package/dist/capabilities/execution-lane.js

@@ -1,9 +1,12 @@
 import { toolsRunOnThisHost } from "../task-cwd.js";
-import { executionLaneOf } from "../execution-lane-caps.js";
+import { executionLaneCaps, executionLaneOf, laneIsolated } from "../execution-lane-caps.js";
 export function projectExecutionLaneCapability(config) {
+    const lane = executionLaneOf(config.remoteExec?.provider);
+    const handsWired = executionLaneCaps(lane).coreRemoteExecutionEnv === "supported";
     return {
-        provider: executionLaneOf(config.remoteExec?.provider),
+        provider: lane,
         toolsOnThisHost: toolsRunOnThisHost(config),
+        ...(handsWired ? { isolated: laneIsolated(lane) } : {}),
     };
 }
 //# sourceMappingURL=execution-lane.js.map

package/dist/config-catalog.d.ts

@@ -1,5 +1,5 @@
 import type { ServiceConfig, ServiceConfigGroups } from "./config-types.js";
-import type { ConfigKnobRecord } from "./config.js";
+import type { ConfigKnobRecord, RetiredEnvWire } from "./config.js";
 import type { RestartSlice } from "./config-center/restart-signal.js";
 export declare const CATALOG_VALUE_TYPES: readonly ["boolean", "number", "string", "enum", "csv", "json", "path", "url", "secret", "opaque"];
 export type CatalogValueType = (typeof CATALOG_VALUE_TYPES)[number];
@@ -40,7 +40,7 @@ export interface ConfigCatalogSpec {
      * 🔴 `enumValues` 一直是**两义**的:它既是行对外宣告的「你可以写哪些词」([ref] 件⑤/⑧ 两条钉逐字锚
      * 这一义:窄了=少宣告一档、宽了=宣告一个 boot 会拒的词),又被回显校验当成「实算值合不合法」的闭集。
      * 两义在**多数**行上碰巧同集,于是差别只活在散文里 —— `MANUAL_MODE_SHELL_GATE` 的
-     * `derivedDefaultNote` 写着「真姿态只有 always/classify 两个」,`MODEL_DEFAULT_THINKING` 写着
+     * `derivedDefaultNote` 写着「真姿态只有 always 一个」(S-877 前是 always/classify 两个),`MODEL_DEFAULT_THINKING` 写着
      * 「缺席/off ⇒ 不铸」,而**没有任何一条腿读那两句话**:`off` 照样留在回显闭集里,回显校验对它放行。
      *
      * ⇒ 把那半句散文变成一处**校验腿真读的声明**:`sanitizeEnumValue` 问 `echoWords ?? enumValues`,
@@ -87,8 +87,6 @@ export interface ConfigCatalogRowCenter {
     readonly timing: Exclude<CatalogTiming, "deploy">;
     readonly restartSlice?: RestartSlice;
     readonly restartReason?: string;
-    /** settings-schema 现行 DOMAINS 里真有这个域(false = 设计稿 ⚪ 成因 b「该片暂无配置中心写腿」)。 */
-    readonly domainExists: boolean;
     /** center 的最近一份 effective **当前在管**本键(没有配置管道 ⇒ 恒 false)。 */
     readonly managedNow: boolean;
     /** center 写**现在真的在生效**(在管 ∧ 未被 env 占位压住;env-wins 族 env 占位 ⇒ false = ⚪ 成因 a)。 */
@@ -142,10 +140,16 @@ export interface ConfigCatalogInputs {
     /** boot 装配的生效事实({@link CatalogBootFacts})。 */
     readonly boot: CatalogBootFacts;
     readonly knobs: readonly ConfigKnobRecord[];
-    /** settings-schema 现行 DOMAINS(调用方传入 —— 本模块保持纯数据层,零包依赖)。 */
+    /** settings-schema 现行 DOMAINS(调用方传入,原样上 wire 的 `centerDomains` 列表)。🔴 7.106.0 起本注改真:本模块**不是**零包依赖 ——
+     *  它值级 import 了 core 与契约包(词表 / 中心凭证键名 / S-866 ⑤a 的 `DOMAIN_SCHEMAS` 座位门);这一格照旧由调用方传,
+     *  只因为它是 wire 上的一段列表、由路由决定取哪一份。 */
     readonly centerDomains: readonly string[];
     /** config-center 当前在管的 ServiceConfig 键集(缺席 = 没有配置管道)。 */
     readonly centerManagedKeys?: ReadonlySet<string> | undefined;
+    /** S-885:退役 env 墓碑表的投影 —— 调用方传 `config.ts` 的 `buildRetiredEnvWire()`(同一张 `RETIRED_ENVS`,不手抄)。**必填**:
+     *  本模块不能值引 config.ts(`server-secret-env.ts` 值引本模块 ⇒ config → server-secret-env → config-catalog → config 成环,
+     *  干净进程直接 import 本模块即 TDZ 崩;codex r1 F2)⇒ 由调用方注入,缺了就是编译错而不是一张静默空表。 */
+    readonly retired: readonly RetiredEnvWire[];
 }
 export interface ConfigCatalogWire {
     readonly catalogVersion: 1;
@@ -160,12 +164,38 @@ export interface ConfigCatalogWire {
         readonly centerManaged: number;
     };
     readonly rows: readonly ConfigCatalogRow[];
+    /** S-885(7.106.0)—— 退役 env 墓碑表(`config.ts` 的 `RETIRED_ENVS`,在场即拒启)的投影,**恒在场**(可为空数组)。与 `rows` 分开:
+     *  rows 是「本进程会读的 env」,这里是「本进程会拒的旧名」—— 一个名字不会同时在两处(墓碑名没有读取点)。 */
+    readonly retired: readonly RetiredEnvWire[];
 }
 /**
  * 目录表(按名排序 —— 卫生格执法)。语义句以读取点实现为准(不信注释纪律:本表成文时逐键对过
  * config.ts / boot / plugins 的真实读取臂;后续漂移由 D1 对账门逼着回到这里补行)。
  */
 export declare const CONFIG_CATALOG: readonly ConfigCatalogSpec[];
+/**
+ * S-866 ⑤a —— **目录座位加载期门**(类修:一次把「目录声称了契约里没有的中心写位」整类关掉)。
+ *
+ * 行上的 `center` 座位说的是「中心能发布这个键」。它必须对得上契约包 `@sema-agent/settings-schema` 的 `DOMAIN_SCHEMAS`:
+ * ① 域在场;② `path` 在该域的 zod 形里解析得出(`a.b` 逐段进对象;`xs[].c` = 进数组元素)。任一不成立 ⇒ **抛**(模块加载即抛:
+ * 进程起不来、每个 import 本模块的测试当场红)—— 不是 warn、不是标一个 `false` 位上 wire(7.105.0 及以前那只 `domainExists`
+ * 位就是后一种:它只看域不看路径,而 `models` 是真域,于是 `models.degrade` 这个不存在的成员被报成「中心可写」)。
+ *
+ * 解析只认 zod 的结构外衣(optional / nullable / default / catch / readonly / effects·管道 / lazy)与对象 / 数组两种容器;认不出的节点 = 解析不出
+ * (fail-closed:宁可多拒一个座位,也不放过一个假座位)。
+ *
+ * 🔴 S-909(7.106.0 合并复审 opus 腿 L-1):**只走 zod 公开面**。契约包今天是 zod 3.25、本仓是 zod 4 —— 读 zod 私有定义字段(类型判别名 /
+ * 内层 schema / lazy getter)的旧写法在契约包升 zod 4 那天会让 `models[].…` 整族座位解析不出,模块 import 期整只抛。两大版没有一个能同时
+ * 公开读到的「这是什么节点」判别位(v4 的 `.def.type` 在 v3 上不存在),`instanceof` 也跨不了两份 zod 的类身份 ⇒ 按两大版**同名的公开访问器**
+ * 认形,规则三条(见 {@link zodObjectShapeOf} / {@link isZodArrayFace} / {@link ZOD_WRAPPER_FACES})。钉:`test/config-catalog-zod-public-face.test.ts`。
+ */
+export declare function assertCenterSeatsResolvable(specs: readonly {
+    readonly name: string;
+    readonly center?: {
+        readonly domain: string;
+        readonly path: string;
+    } | undefined;
+}[]): void;
 /** `build*` 命名(工厂纪律):产物是纯数据(wire 投影),零方法零捕获行为。 */
 export declare function buildConfigCatalog(inputs: ConfigCatalogInputs): ConfigCatalogWire;
 //# sourceMappingURL=config-catalog.d.ts.map