@sema-agent/server 7.113.0 → 7.115.0

package/dist/config-types.d.ts

@@ -18,6 +18,7 @@ import type { InfraCostRates } from "./observability/cost-taxonomy.js";
 import type { Autonomy, CommandRule } from "./runtime-governance.js";
 import type { CenterCredentialSource } from "./center-credential.js";
 import type { GitApiKind } from "./git-api-kind.js";
+import type { MemoryEngineBackend, StoreBackend as StoreBackendWord } from "@sema-agent/settings-schema/execution-lanes";
 import { DRAIN_GRACE_FLOOR_MS } from "@sema-agent/settings-schema/fleet";
 /** [ref]:记忆向量面的 embedder 坐标(env `MEMORY_EMBEDDER_*` 解析结果;单一属主 = 本类型,
  *  `plugins/memory-embedder.ts` 的工厂直接消费它,不复制形状)。语义与三问见
@@ -54,13 +55,6 @@ export type RetentionMode = (typeof RETENTION_MODES)[number];
  */
 export declare const CONFIG_PROVIDER_WORDS: readonly ["local", "remote"];
 export type ConfigProviderWord = (typeof CONFIG_PROVIDER_WORDS)[number];
-/**
- * S-866 ① —— `DB_BACKEND` 的闭集词表(**一处**:`config.ts` 的枚举解析、配置目录的 enum 行、caps `store.declared` / `store.backend`
- * 三处共读;S-2 设计稿 v1 写的契约包 `STORE_ENGINES` 不存在,搬进契约包是 [ref] A-5 的另票)。`mysql` = 任一 MySQL 协议服务器
- * (MySQL / TiDB / MariaDB);`local` = 本机文件店;`memory` = 纯内存(显式 opt-out,或多租裸 boot 的缺省)。
- */
-export declare const DB_BACKEND_WORDS: readonly ["mysql", "pg", "local", "memory"];
-export type DbBackendWord = (typeof DB_BACKEND_WORDS)[number];
 /** [ref] §3/§4 —— sweep lane 的节律与灰度档(语义与三问见 {@link ServiceConfigFlat.retentionSweep})。 */
 export interface RetentionSweepConfig {
     /** `audit-only` = 照跑照判、只记 `audit_only` 行,**不调任何破坏性方法**;`enforce` = 真删。默认前者。 */
@@ -702,7 +696,7 @@ export interface ServiceConfigFlat {
      *     pg 部署的检索**恒 lexical**(词面 jaccard),向量列空转。配上这几键 = 该部署真正拿到语义检索。
      *  ② **半配为何拒启**:三键里少任何一件,「向量面」都无从组装。静默忽略的后果不是功能缺席,而是
      *     **operator 以为开了**——检索照常返回结果(词面档),质量差异只在最终答案里,任何日志都不报。
-     *     所以照 `MEMORY_SYNC_*` / `REQUIRED_ENVS_BY_LANE` 的同款姿势整拒并点名缺哪几键。
+     *     所以照 `MEMORY_SYNC_*` / [ref] 车道必需键(`laneRequiredEnv`)的同款姿势整拒并点名缺哪几键。
      *  ③ **维度守卫为何是拒启不是 warn**:向量列写错维度是**静默毒库**形([ref] 裁③)——错长度的向量
      *     既不会让 DB 报错(本仓 pg 记忆表的 embedding 是 `jsonb`,无维度约束),也不会让检索报错(维度
      *     不匹配的行只是悄悄退回词面档),只会让「向量面开着」这句话变成谎。所以坏 DIM(非正整数)在
@@ -1003,7 +997,7 @@ export interface ServiceConfigFlat {
      *  MYSQL_* replacement named (see RETIRED_ENVS in config.ts). `mysql` reads MYSQL_* coords only.
      *  TiDB itself stays fully supported (any MySQL-protocol engine works — memory no longer needs a VECTOR
      *  column since [ref] moved it onto the file engine). Env: DB_BACKEND. */
-    dbBackend: DbBackendWord;
+    dbBackend: StoreBackendWord;
     /** clay 拍(2026-07-27):operator 是否显式设了 DB_BACKEND。main.ts 的降级判据——**默认推导**的
      *  local(裸 boot)在 mkdir/ensure 失败时降级 memory + warn + gauge(auto-DB 不可达先例);
      *  **显式** DB_BACKEND=local 失败仍 fail-loud(operator 要了 durable,静默丢=丢数据)。 */
@@ -1330,6 +1324,25 @@ export interface ServiceConfigFlat {
      *  「只配 APPROVAL_NEVER_AUTO」这一形被判成"零门意图" ⇒ 落进单用户 allow-all 基线 ⇒ 那张表
      *  从未进入任何 policy。判定现在单源在 `hasOperatorGateIntent()`(与 inv#2 同文件)。 */
     approvalNeverAuto: string[];
+    /**
+     * 7.115.0 —— **运维的 allow 规则**(`APPROVAL_GRANT`,逗号分隔的工具名规则:精确名 / `mcp__<server>__*` / `a2a__<peer>__*`)。命中 = 带理由的
+     * 放行(core `decisionReason: "rule"`,运维替这些调用表了态 —— 回答没人表态的服务器工具 / A2A 技能调用;内置工具上引擎的写门、shell 检查照问);未命中 = 不表态。与请求腿的 `settings.permissions.allow` 是**同一种东西**:
+     * 同一只编译口(`permission-rule-list.ts` `createRuleListPolicy`)、同一只校验(`config.ts` `approvalGrantRefusal` → `unmatchableToolNamesRefusal`,
+     * 坏值拒启)。施加点 = 部署治理链的单一构造口(`deployment-governance.ts` → `runtime-governance.ts` `applyRuntimeGovernance` 的一片叶),
+     * 所以 HTTP 提交 / durable 续跑(含 leader worker 停驻后经 `/decide` 续跑的那一段)/ 停驻后台 agent 的跨副本赎回 / run-local 四条腿同装(leader worker 首跑与修复腿到不了),每次现取(不 memoize)。**不越过**任何一层的 deny / ask(折叠 deny > ask > allow)。
+     *
+     * ⚠️ 不是白名单:名字不叫 `…_ALLOW`,与会话规则的 `toolAllow`(「只许这些」)刻意分开 —— 本键只给出表态,不收窄任何东西。
+     *
+     * 三问:谁需要 = 在没有请求体的腿上接了 MCP 服务器的运维 —— `run-local`,以及 durable 续跑(每一次从持久化体重建,含 leader worker 停驻后经 `/decide`
+     * 续跑的那一段;A2A 不在射程:运维声明的对端恒带外发标记,那一问本键不放) —— core 7.40.0 起没人表态的服务器工具调用要问,无席 ⇒ 拒、有 durable 席 ⇒ 每次停驻等人,
+     * 这里是运维为自己接的服务器表态的唯一位置。**到不了**:leader worker 的首跑与修复腿(工具策略在 leader 编排里自己折出来 —— `leader/wire.ts` 的
+     * `combinePolicies(createDurableQuestionPolicy(), createDurableAskPolicy(…))` —— 不经上面那只构造口);这两条腿今天不挂 MCP / A2A,本键在那里没有对象。谁受伤 = 缺省空表,无人受伤 —— 设了宽规则
+     * (`mcp__<server>__*`,含那台服务器将来新增的工具)= 对**每一个租户、每一条腿**的那些调用都不再因「没人表态」而问人,风险随规则的宽度走
+     * (射程只到这一问:任何一层自己的问照旧压过它 —— 内置工具的精确名写进来,引擎的写门 / 形状层照问);补偿 = 本键就是
+     * core 7.40.0 那条收紧的补偿,deny / ask(`APPROVAL_DENY` / `APPROVAL_REQUIRE` / 请求 settings / 会话规则)照旧压过它。
+     * v1 只有 env 一个写入通道(无 config-center 座位,不进 settings-schema)。空表 = 本层不铸叶,折叠逐字与修前同。
+     */
+    approvalGrant: string[];
     /** [ref] D-G (HMAC = integrity, not identity; ✅ WIRED — the "SCAFFOLD, not yet wired" note here was STALE,
      *  corrected 2026-07-25: consumed by `verifyDirectDoorProof` → `verifyApprovalHmac`, reached from the live decide
      *  routes — the two `verifyDirectDoorProof(` call sites in `http/routes/approvals-assistant.ts`): the
@@ -2053,7 +2066,7 @@ export interface ServiceConfigFlat {
      *  404 there (P1-2: our own repos live on GitHub and were unreviewable). Unknown word = refuse boot. */
     gitApiKind: GitApiKind;
     /** S3-TOB 设计 §1.3:memory 持久面方言(env MEMORY_ENGINE_BACKEND,缺省 file)。boot-only。 */
-    memoryEngineBackend: "file" | "pg" | "tidb";
+    memoryEngineBackend: MemoryEngineBackend;
     /** CC `workflowSizeGuideline` (advisory, injected into the Workflow tool card via
      *  core `RunnerDeps.workflowLimits.sizeGuideline`). env WORKFLOW_SIZE_GUIDELINE; unset = absent =
      *  byte-compat (core treats missing/unrestricted identically). boot-only (per-task card snapshot). */
@@ -2107,7 +2120,7 @@ export type ServiceStoreConfig = Pick<ServiceConfigFlat, "sessionBackend" | "ses
 export type ServiceModelPlaneConfig = Pick<ServiceConfigFlat, "gatewayBaseUrl" | "gatewayApiKey" | "gatewayFallbackUrls" | "gatewayMaxRetries" | "anthropic" | "resilience" | "model" | "envModel" | "models" | "modelApiKeyEnv" | "modelApiKeys" | "modelRefusals" | "modelQuotaWeights" | "tiers" | "projects" | "roles" | "atModelAllowlist" | "cascadeLadder" | "degrade">;
 /** 组:approval(审批 / HITL 门)。`directDoorActive` 无 env 解析腿(装配层三域合取的产物),但语义上
  *  就是本组的门状态,故进组;`parseApprovalDomain` 的返回类型相应是 `Omit<…, "directDoorActive">`。 */
-export type ServiceApprovalConfig = Pick<ServiceConfigFlat, "approvalRequire" | "approvalDeny" | "approvalTimeoutSec" | "approvalAutoBudget" | "approvalNeverAuto" | "approvalHmacKeys" | "durableApproval" | "durableApprovalSource" | "streamAskWindowMsSource" | "directApprovalDoor" | "directDoorActive" | "resourceSuspend" | "resourceSuspendTtlSec" | "resourceSuspendTotalTokens" | "resourceSuspendTotalBudgetUsd" | "resourceSuspendMaxSlices" | "askQuestionEnabled" | "questionThrottle" | "toolApprovalEnabled" | "permissionRulesEnabled" | "permissionRulesEnabledExplicit" | "streamAskWindowMarginMs" | "streamApproval" | "unattendedApprovalPolicy" | "mcpElicitation" | "sensitiveWritePatterns" | "writeProtectedPaths" | "manualModeShellGate" | "permissionsDisableAutoMode" | "autoModeClassifierFallback" | "autoModeClassifierTimeoutMs" | "crossSessionInbound" | "crossSessionDialogExpiry">;
+export type ServiceApprovalConfig = Pick<ServiceConfigFlat, "approvalRequire" | "approvalDeny" | "approvalTimeoutSec" | "approvalAutoBudget" | "approvalNeverAuto" | "approvalGrant" | "approvalHmacKeys" | "durableApproval" | "durableApprovalSource" | "streamAskWindowMsSource" | "directApprovalDoor" | "directDoorActive" | "resourceSuspend" | "resourceSuspendTtlSec" | "resourceSuspendTotalTokens" | "resourceSuspendTotalBudgetUsd" | "resourceSuspendMaxSlices" | "askQuestionEnabled" | "questionThrottle" | "toolApprovalEnabled" | "permissionRulesEnabled" | "permissionRulesEnabledExplicit" | "streamAskWindowMarginMs" | "streamApproval" | "unattendedApprovalPolicy" | "mcpElicitation" | "sensitiveWritePatterns" | "writeProtectedPaths" | "manualModeShellGate" | "permissionsDisableAutoMode" | "autoModeClassifierFallback" | "autoModeClassifierTimeoutMs" | "crossSessionInbound" | "crossSessionDialogExpiry">;
 /** 组:memory(记忆面 + TOC 同步腿)。 */
 export type ServiceMemoryConfig = Pick<ServiceConfigFlat, "memoryEngineEnabled" | "memoryEngineDir" | "memoryEngineRemoteLaneAllowed" | "memoryEngineBackend" | "memoryScope" | "memoryPersistenceCapable" | "memorySync" | "memoryEmbedder" | "memoryOrgAdmissionMode" | "memoryDelegationEvidence" | "memoryProvenance" | "memoryCapturePolicy" | "memoryConsolidationDriver" | "memoryOrgDirectoryJson" | "memoryOrgGrantTtlMs" | "memoryOrgUnavailableBackoffMs" | "projectMemoryEnabled" | "syncImportLeaseStaleSec">;
 /** 组:auth(鉴权 / 身份 / 治理棒)。`commandPolicy` 只有 sema-registry 腿(无 env 标量形),故 env 解析

package/dist/config-types.js

@@ -2,7 +2,6 @@ import { DRAIN_GRACE_FLOOR_MS } from "@sema-agent/settings-schema/fleet";
 export const TASK_WRITE_FACE_ESCALATIONS = ["allow", "refuse"];
 export const RETENTION_MODES = ["audit-only", "enforce"];
 export const CONFIG_PROVIDER_WORDS = ["local", "remote"];
-export const DB_BACKEND_WORDS = ["mysql", "pg", "local", "memory"];
 export const MEMORY_CONSOLIDATION_MIN_INTERVAL_SEC = 300;
 export const MAX_TIMER_DELAY_MS = 2_147_483_647;
 export const AUTO_MODE_CLASSIFIER_TIMEOUT_BOUNDS = { minMs: 1_000, maxMs: MAX_TIMER_DELAY_MS };

package/dist/config.d.ts

@@ -1,5 +1,4 @@
 import { type Model, type PathRuleBases, type RuleBehavior } from "@sema-agent/core";
-import { type RemoteExecProvider } from "./execution-lane-caps.js";
 import { type Autonomy } from "./runtime-governance.js";
 import { type RunnerEnvNameAllowlistKnob, type ServerEnvNameAllowlistKnob } from "./env-name-allowlist-knobs.js";
 import type { ServiceConfig, ServiceConfigFlat, ServiceConfigGroups } from "./config-types.js";
@@ -252,21 +251,6 @@ export declare const configLkgEnabled: () => boolean;
 export declare const hostBackgroundShellEnabled: () => boolean;
 /** The `host` exec lane's spool-file stdio form; false ⇒ the pre-1.226 pipe fallback (read per exec). */
 export declare const hostExecSpoolEnabled: () => boolean;
-/**
- * 每条执行车道**必需的 env 键名**([ref] 的 fail-closed 拒启门按它点名缺件;见 `parseOrchestrationDomain`
- * 里那处 `REMOTE_EXEC` 校验)。
- *
- * 键集 = `RemoteExecProvider`(判别联合派生,`execution-lane-caps.ts`):配置面加一条 provider 臂而
- * 这里不加行 = **编译红**(codex R1-F2)。此前是 `Record<string, …>`,漏一行只表现为该词在 boot 期被判
- * 「不是执行车道」—— fail-closed 但把「新车道」讲成「拼错了」,运维照着报文永远查不到成因。
- *
- * 🔴 **S-599:提到模块顶层导出**(此前是 `parseOrchestrationDomain` 的函数内局部)。零语义变,动机是
- * 部署面需要**同一张表**:`deploy/sema-up/lib/lanes.json` 的每行必须登记它那条车道的必需键名,根 /
- * review compose 的 environment 白名单必须把**全部**车道的必需键透传出去 —— 那两处若各手抄一份名单,
- * 加一条车道就会静默分叉(选得到、起不来,而 config 的拒启报文里那个键在 compose 里根本不存在)。
- * 门 = `test/deploy-lanes-contract.test.ts`,它读的是本表而不是任何副本。
- */
-export declare const REQUIRED_ENVS_BY_LANE: Record<RemoteExecProvider, readonly string[]>;
 /** 名单型 env 旋钮的**唯一**解析器(规则全文见上方 `ENV_NAME_ALLOWLIST_KNOBS` 头注)。`undefined` = 没配(未设 / 空串)。
  *  服务侧旋钮要交本进程的姿态(③);runner 旋钮没有姿态,签名上就不收 —— 读者与行形由叶表的类型一起定,传错是编译红。 */
 export declare function parseEnvNameAllowlist(knob: ServerEnvNameAllowlistKnob, singleUserTurnkey: boolean): readonly string[] | undefined;
@@ -301,7 +285,8 @@ export declare function isRosterGateArmed(configCenter: ServiceConfig["configCen
  *   ① env 腿(`APPROVAL_REQUIRE`/`DENY`/`NEVER_AUTO`,下方)—— boot 拒启;
  *   ② 中心下发腿(`runtime.approvalRequire`,config-center/apply-effective.ts)—— 域级拒绝+保前值+warn
  *      (常驻进程不 crash);
- *   ③ per-request 腿(`settings.permissions.{ask,deny}`,task-settings.ts)—— 该请求 422。
+ *   ③ per-request 腿(`settings.permissions.{ask,deny}`,task-settings.ts;S-654 (c) 起 `allow` 同判)—— 该请求 422;
+ *   ④ env 腿 `APPROVAL_GRANT`(7.115.0,运维的 allow 规则,与 ③ 的 allow 桶同一个消费者 `rule-policy`)—— boot 拒启({@link approvalGrantRefusal})。
  *
  * 五种拼法:
  *   - CC 形规则条目(`Bash(ps:*)`/`Edit(src/**)`,[ref] [ref]§七 装机实测):CC 的权限规则 DSL 写法。这些
@@ -343,28 +328,50 @@ export interface UnmatchableToolName {
  * S-177(core 7.9.0 [ref])—— **这条名单条目喂给谁**,决定「永不匹配」这句话怎么判。两个消费者形态:
  *
  *  · `"tool-name-table"` —— 消费者按**整串工具名**比对(精确 ∪ covering):env `APPROVAL_*` 三键与
- *    中心下发 `runtime.approvalRequire`(消费者 `createDurableAskPolicy`),**以及**
- *    `settings.permissions.allow`(消费者 core 的 `createAllowDenyPolicy` 的 allow 位)。带括号的内容形
+ *    中心下发 `runtime.approvalRequire`(消费者 `createDurableAskPolicy`)。带括号的内容形
  *    在这里永远匹配不上任何活工具名 —— 与引擎的规则文法认不认得它**无关**,是这条腿的比对方式决定的,
  *    所以内容形照旧响亮拒 + 指路。
  *  · `"rule-policy"` —— 消费者是 core 的**规则编译器**(`createPermissionRulePolicy`):
- *    `settings.permissions.deny` 与 `.ask`(S-177 / core 7.9.0 起两张表都走编译器)。引擎自此**真的按内容
- *    匹配**它们(`Bash(rm -r:*)` / `Edit(~/.sema/**)`),所以本仓不许再替它拒 —— 判据整条交回 core 的
- *    `validatePermissionRules`,按这张表自己的 behavior 问。
- *
- * 🔴 **不对称不是特判,是从「消费者是谁」自然导出的**:`allow` 之所以豁免名字形与文法两族(退役名 /
- * 短名 / 反斜杠 / 超帽),是因为它是**白名单** —— 一个匹配不上的条目让白名单空掉 ⇒ 一切都不在白名单
- * ⇒ fail-CLOSED 且当场可见,那是可接受的另一种失败形;而内容形不同,它是一个 CC 用户为了**少弹窗**
- * 写下的拼法族错,静默代价是整只 Bash 不可用。
+ *    `settings.permissions.deny` / `.ask`(S-177 / core 7.9.0 起)与 `.allow`(S-654 (c) / 7.115.0 起;修前是
+ *    `createAllowDenyPolicy` 的名单位)。引擎**真的按内容匹配** deny / ask 的内容形(`Bash(rm -r:*)` /
+ *    `Edit(~/.sema/**)`),所以本仓不许再替它拒 —— 判据整条交回 core 的 `validatePermissionRules`,按这张表
+ *    自己的 behavior 问(allow 侧 core 只收工具名形,内容形由 core 判拒)。
+ *
+ * S-654 (c) 前这里还有一条「`allow` 豁免名字形与文法两族」的不对称,前提是 allow 为白名单(匹配不上 ⇒ 全拒,
+ * fail-closed 且当场可见);allow 改成规则后那条前提不在了(匹配不上 ⇒ 什么也不放行、照常问,写的人收不到信号),豁免随之删除。
  */
 export type RuleEntryConsumer = "tool-name-table" | "rule-policy";
-export declare function findUnmatchableToolNames(names: readonly string[], opts: {
-    consumer: RuleEntryConsumer;
-    behavior: RuleBehavior;
-    pathBases?: PathRuleBases;
-}): UnmatchableToolName[];
-/** {@link findUnmatchableToolNames} 的成句形——三条腿的文案同源(只有前缀/出口不同)。 */
-export declare function formatUnmatchableToolNames(source: string, bad: readonly UnmatchableToolName[]): string;
+/** {@link unmatchableToolNamesRefusal} 的判据入参:这张表喂给谁(名表 / 规则编译器)、按哪种态度问 core 的文法、路径基。 */
+export interface UnmatchableToolNameJudgment {
+    readonly consumer: RuleEntryConsumer;
+    readonly behavior: RuleBehavior;
+    readonly pathBases?: PathRuleBases;
+}
+/**
+ * 「这张表里有永远不会生效的条目」的**判据与拒因句,同一只函数**(返回 `undefined` = 通过;拒 ⇒ 句子 + 被点名的条目)。
+ * 五条腿全调它:env `APPROVAL_REQUIRE` / `APPROVAL_DENY` / `APPROVAL_NEVER_AUTO`(拒启)、中心下发 `governance.approvalRequire`(整组拒)、
+ * 请求体 `settings.permissions.{allow,ask,deny}`(422)、运维 `APPROVAL_GRANT`(拒启)。修前判据(`findUnmatchableToolNames`)与成句
+ * (`formatUnmatchableToolNames`)是两只导出,句子里那半句(「这些表都是整串逐字比对」)只对名表成立 —— 规则编译器的
+ * 三只桶(与 `APPROVAL_GRANT`)是按规则文法编、按 covering 匹配的,不是整串比对。
+ *
+ * 句子对两种消费者、三种态度都成立:每一条要么永远匹配不到活工具(退役名 / 无协议前缀的短名 / 缺段的 MCP 名 / 名表里的内容形),要么编不成
+ * 一条规则(core 文法的判词原样带出);名字按写的样子读,不做别名折叠、不补协议前缀。逐条的「为什么 / 怎么改」在 `→` 之后。
+ */
+export declare function unmatchableToolNamesRefusal(source: string, names: readonly string[], judgment: UnmatchableToolNameJudgment): {
+    readonly message: string;
+    readonly names: readonly string[];
+} | undefined;
+/**
+ * 7.115.0 —— 运维 allow 规则 `APPROVAL_GRANT` 的**拒启判据与拒因句**(同一只函数;`config-invariants.ts` 的 `…Refusal` 形:
+ * 返回句子 = 拒,`undefined` = 通过)。判据与请求腿的 `settings.permissions.allow` 是**同一只**:
+ *  ① 名字形与 core 文法 —— {@link unmatchableToolNamesRefusal},消费者 `rule-policy`、behavior `allow`(退役名 / 无前缀短名 / 缺段 MCP 名 /
+ *     反斜杠 / 超长 / 内容形与参数级的 allow;句子点名哪一条、为什么、怎么改);
+ *  ② 整表试编一次 —— 编的就是治理折叠里那一只(`runtime-governance.ts` {@link compileApprovalGrantLayers}),于是 core 的整表帽这类
+ *     只在编译时才抛的判据也在启动时响亮,而不是每个任务一次 500。
+ * 没有 `pathBases`:运维的规则不挂在任何一条任务的根上,而 allow 文法本来只收工具名形(路径形的 allow core 拒编,在 ① 里就拒了)。
+ * 坏值**不许**静默丢掉那一条后照常起:运维以为放行了,无人值守腿照旧拒 / 停驻,没有任何信号指回这里。
+ */
+export declare function approvalGrantRefusal(names: readonly string[]): string | undefined;
 /**
  * [ref] 件B/C/D —— 三条**部署治理声明**的 env 解析(auth 域的一段,fail-loud 全在这里)。
  *

package/dist/config.js

@@ -10,7 +10,7 @@ import { DEFAULT_ELICITATION_THROTTLE } from "./elicitation.js";
 import { isV2ScopeKey, memoryReplicationCoverage, replicationCovers } from "./memory-scope.js";
 import { DEFAULT_QUESTION_THROTTLE } from "./question.js";
 import { GIT_API_KINDS, isGitApiKind } from "./git-api-kind.js";
-import { CONFIG_PROVIDER_WORDS, DB_BACKEND_WORDS, RETENTION_MODES, MEMORY_CONSOLIDATION_MIN_INTERVAL_SEC, RESILIENCE_DEFAULTS, TASK_WRITE_FACE_ESCALATIONS, MAX_TIMER_DELAY_MS, AUTO_MODE_CLASSIFIER_TIMEOUT_BOUNDS, DRAIN_GRACE_FLOOR_MS, DRAIN_SECOND_SIGNAL_MIN_GAP_BOUNDS, DRAIN_SECOND_SIGNAL_MIN_GAP_DEFAULT_MS, FIRST_BYTE_TIMEOUT_BOUNDS } from "./config-types.js";
+import { CONFIG_PROVIDER_WORDS, RETENTION_MODES, MEMORY_CONSOLIDATION_MIN_INTERVAL_SEC, RESILIENCE_DEFAULTS, TASK_WRITE_FACE_ESCALATIONS, MAX_TIMER_DELAY_MS, AUTO_MODE_CLASSIFIER_TIMEOUT_BOUNDS, DRAIN_GRACE_FLOOR_MS, DRAIN_SECOND_SIGNAL_MIN_GAP_BOUNDS, DRAIN_SECOND_SIGNAL_MIN_GAP_DEFAULT_MS, FIRST_BYTE_TIMEOUT_BOUNDS } from "./config-types.js";
 import { resolveLocalDataRoot } from "./local-data-root.js";
 import { buildWriteProtectionPosture } from "./write-protection.js";
 import { normalizeSshFingerprint } from "./ssh-host-key.js";
@@ -18,8 +18,10 @@ import { buildReadFacePostureNotice, readFaceForPosture } from "./read-face-post
 import { THINKING_LEVELS, THINKING_FORMATS, buildModelCompat, isThinkingFormat, isThinkingTier } from "./model-compat.js";
 import {} from "./posture-source.js";
 import { CONTROL_AND_BIDI_STRIP_RE } from "./text-bidi.js";
-import { REMOTE_EXEC_PROVIDER_WORDS, executionLaneOf, isSingleMachineDefaultLane } from "./execution-lane-caps.js";
-import { AUTONOMY_MODES } from "./runtime-governance.js";
+import { bakeOperatorPrincipalsRefusal, bakeRunnerCredentialRefusal, halfOpenDirectDoorRefusal, leaderDurableStoreRefusal, operatorPrincipalsRequiredRefusal } from "./config-invariants.js";
+import { REMOTE_EXEC_PROVIDER_WORDS, executionLaneOf, executionLaneRequiredRefusal, isSingleMachineDefaultLane, laneRequiredEnv } from "./execution-lane-caps.js";
+import { MEMORY_ENGINE_BACKENDS, SESSION_BACKENDS, STORE_BACKENDS } from "@sema-agent/settings-schema/execution-lanes";
+import { APPROVAL_GRANT_SOURCE, AUTONOMY_MODES, compileApprovalGrantLayers } from "./runtime-governance.js";
 import { createCenterCredentialSource, readCenterCredentialDeclaration } from "./center-credential.js";
 import { parseCenterCredentialRenewLeadMs } from "./center-credential-renewer.js";
 import { modelProviderRefusal } from "./model-provider.js";
@@ -484,15 +486,6 @@ function boolEnv(name, def) {
 export const configLkgEnabled = () => boolEnv("CONFIG_LKG_ENABLED", true);
 export const hostBackgroundShellEnabled = () => boolEnv("HOST_BG_ENABLED", true);
 export const hostExecSpoolEnabled = () => boolEnv("HOST_EXEC_SPOOL_ENABLED", true);
-export const REQUIRED_ENVS_BY_LANE = {
-    e2b: ["E2B_API_KEY"],
-    k8s: ["K8S_SANDBOX_IMAGE"],
-    ssh: ["SSH_HOST", "SSH_USER", "SSH_PRIVATE_KEY"],
-    adb: ["ADB_SERIAL"],
-    host: [],
-    "local-docker": ["DOCKER_IMAGE"],
-    device: [],
-};
 function parseReadDenyPatternsEnv(raw) {
     let arr;
     try {
@@ -862,7 +855,7 @@ function parseStoreDomain(ctx) {
         !!(process.env.MYSQL_HOST || process.env.PG_HOST);
     const bareBoot = !dbBackendSet && !sqlSignal;
     const multiTenantBareBoot = bareBoot && requirePrincipal;
-    const dbBackend = enumEnv("DB_BACKEND", bareBoot ? (multiTenantBareBoot ? "memory" : "local") : "mysql", DB_BACKEND_WORDS);
+    const dbBackend = enumEnv("DB_BACKEND", bareBoot ? (multiTenantBareBoot ? "memory" : "local") : "mysql", STORE_BACKENDS);
     if (multiTenantBareBoot) {
         CONFIG_NOTICES.push({
             level: "warn",
@@ -873,7 +866,7 @@ function parseStoreDomain(ctx) {
         });
     }
     const sqlEngineExplicit = !!process.env.DB_BACKEND && dbBackend !== "local" && dbBackend !== "memory";
-    const sessionBackendRaw = enumEnv("SESSION_BACKEND", sqlEngineExplicit ? "mysql" : "memory", ["memory", "mysql", "auto"]);
+    const sessionBackendRaw = enumEnv("SESSION_BACKEND", sqlEngineExplicit ? "mysql" : "memory", SESSION_BACKENDS);
     const sessionBackend = sessionBackendRaw === "mysql" ? "tidb" : sessionBackendRaw;
     const localDataRoot = resolveLocalDataRoot(process.env, homedir());
     const dbHostSet = dbBackend === "pg" ? !!process.env.PG_HOST : !!process.env.MYSQL_HOST;
@@ -1233,14 +1226,16 @@ function uncompilableRuleGuidance(name, behavior, pathBases) {
     const issue = issues[0];
     if (issue === undefined)
         return undefined;
-    const ccGuidance = issue.code === "unsupported.bash_prefix" || issue.code === "unsupported.file_glob" ? ccRuleFormGuidance(name) : undefined;
-    if (ccGuidance !== undefined)
-        return ccGuidance;
+    if (behavior === "allow" && (issue.code === "unsupported.bash_prefix" || issue.code === "unsupported.file_glob" || issue.code === "invalid.allow_param_rule")) {
+        return (`${issue.code} — ${issue.message}. An allow rule list compiles tool-name rules only (an exact name, or mcp__<server>__* / ` +
+            `a2a__<peer>__* for every tool on that peer); a content-form standing approval lives in the persisted-rule store ` +
+            `(/v1/rules/cc-import, or keep the rule when you answer the call's card)`);
+    }
     return (`${issue.code} — core's rule grammar cannot compile this name (${issue.message}), so a table keyed by it matches nothing. ` +
         `Tool names carry no backslashes and are far shorter than the 512-character rule cap; check the spelling, and use ` +
         `mcp__<server>__* / a2a__<peer>__* for "every tool on that peer"`);
 }
-export function findUnmatchableToolNames(names, opts) {
+function findUnmatchableToolNames(names, opts) {
     const out = [];
     for (const name of names) {
         if (opts.consumer === "tool-name-table") {
@@ -1250,8 +1245,6 @@ export function findUnmatchableToolNames(names, opts) {
                 continue;
             }
         }
-        if (opts.behavior === "allow")
-            continue;
         const retired = RETIRED_TOOL_NAMES.get(name);
         if (retired !== undefined) {
             out.push({ name, guidance: retired });
@@ -1275,9 +1268,26 @@ export function findUnmatchableToolNames(names, opts) {
     }
     return out;
 }
-export function formatUnmatchableToolNames(source, bad) {
-    return (`${source} names tool(s) that can never match a live tool (these lists are RAW whole-name comparisons — core 5.0.0 RB-476 removed the alias/auto-prefix folds): ` +
+export function unmatchableToolNamesRefusal(source, names, judgment) {
+    const bad = findUnmatchableToolNames(names, judgment);
+    if (bad.length === 0)
+        return undefined;
+    const message = (`${source} has ${bad.length === 1 ? "an entry" : "entries"} that can never take effect — ${bad.length === 1 ? "it" : "each"} would never match a live tool or cannot be compiled into a rule ` +
+        `(names are read exactly as written: no alias folding, no protocol prefix added): ` +
         bad.map((b) => `${presentToolName(b.name)} → ${b.guidance}`).join("; ")).replace(CONTROL_AND_BIDI_STRIP_RE, "");
+    return { message, names: bad.map((b) => b.name) };
+}
+export function approvalGrantRefusal(names) {
+    const unmatchable = unmatchableToolNamesRefusal(APPROVAL_GRANT_SOURCE, names, { consumer: "rule-policy", behavior: "allow" });
+    if (unmatchable !== undefined)
+        return unmatchable.message;
+    try {
+        compileApprovalGrantLayers(names);
+    }
+    catch (e) {
+        return e instanceof Error ? e.message : String(e);
+    }
+    return undefined;
 }
 function streamApprovalConfig(gates) {
     const cfg = {
@@ -1344,9 +1354,9 @@ function parseApprovalDomain(ctx) {
     const dgHmacKeys = parseApprovalHmacKeys(process.env.APPROVAL_HMAC_KEYS, announceKeySetRejection("APPROVAL_HMAC_KEYS"));
     const durableApproval = postureOn("DURABLE_APPROVAL", infraReady);
     const rejectUnmatchableToolNames = (envName, names) => {
-        const bad = findUnmatchableToolNames(names, { consumer: "tool-name-table", behavior: "deny" });
-        if (bad.length > 0)
-            throw new Error(formatUnmatchableToolNames(envName, bad));
+        const unmatchable = unmatchableToolNamesRefusal(envName, names, { consumer: "tool-name-table", behavior: "deny" });
+        if (unmatchable !== undefined)
+            throw new Error(unmatchable.message);
         return names;
     };
     return {
@@ -1360,6 +1370,12 @@ function parseApprovalDomain(ctx) {
         resourceSuspendMaxSlices: nonNegativeIntEnv("RESOURCE_SUSPEND_MAX_SLICES", "跨片 slice 数上限"),
         approvalAutoBudget: clampEnvWithWarn("APPROVAL_AUTO_BUDGET", "0", 0, 10000),
         approvalNeverAuto: rejectUnmatchableToolNames("APPROVAL_NEVER_AUTO", csv("APPROVAL_NEVER_AUTO")),
+        approvalGrant: ((names) => {
+            const refusal = approvalGrantRefusal(names);
+            if (refusal !== undefined)
+                throw new Error(refusal);
+            return names;
+        })(csv("APPROVAL_GRANT")),
         approvalHmacKeys: dgHmacKeys,
         directApprovalDoor,
         sensitiveWritePatterns: ((raw) => {
@@ -1645,11 +1661,7 @@ function parseMemoryConsolidationDriver() {
 function parseMemoryDomain(ctx) {
     const { requirePrincipal } = ctx;
     const memoryEngineEnabled = parseMemoryEngineWord(env("MEMORY_ENGINE", "on"));
-    const memoryEngineBackendRaw = process.env.MEMORY_ENGINE_BACKEND ?? "file";
-    if (!["file", "pg", "tidb"].includes(memoryEngineBackendRaw)) {
-        throw new Error(`MEMORY_ENGINE_BACKEND must be file|pg|tidb, got "${memoryEngineBackendRaw}"`);
-    }
-    const memoryEngineBackend = memoryEngineBackendRaw;
+    const memoryEngineBackend = enumEnv("MEMORY_ENGINE_BACKEND", "file", MEMORY_ENGINE_BACKENDS);
     const memoryScope = process.env.MEMORY_SCOPE ?? (memoryEngineEnabled && !requirePrincipal ? "local" : undefined);
     const memorySyncUrl = process.env.MEMORY_SYNC_URL || undefined;
     const memorySyncToken = process.env.MEMORY_SYNC_TOKEN || undefined;
@@ -1865,12 +1877,12 @@ function parseOrchestrationDomain(ctx) {
     {
         const lane = process.env.REMOTE_EXEC;
         if (lane !== undefined && lane !== "") {
-            const required = Object.entries(REQUIRED_ENVS_BY_LANE).find(([word]) => word === lane)?.[1];
-            if (required === undefined) {
-                throw new Error(`REMOTE_EXEC="${lane}" is not an execution lane — valid: ${Object.keys(REQUIRED_ENVS_BY_LANE).join(" | ")}. ` +
+            const word = REMOTE_EXEC_PROVIDER_WORDS.find((w) => w === lane);
+            if (word === undefined) {
+                throw new Error(`REMOTE_EXEC="${lane}" is not an execution lane — valid: ${REMOTE_EXEC_PROVIDER_WORDS.join(" | ")}. ` +
                     `An unrecognized value used to fall through to the host/in-process lane silently; refusing to start instead (#157).`);
             }
-            const missing = required.filter((name) => !process.env[name]);
+            const missing = laneRequiredEnv(word).filter((name) => !process.env[name]);
             if (missing.length > 0) {
                 throw new Error(`REMOTE_EXEC=${lane} but required env ${missing.join(", ")} ${missing.length === 1 ? "is" : "are"} missing/empty — ` +
                     `refusing to start rather than silently downgrading to the host/in-process lane (#157; unset REMOTE_EXEC if you meant no sandbox lane).`);
@@ -2307,7 +2319,7 @@ const MODEL_PLANE_GROUP_KEYS = [
     "modelApiKeyEnv", "modelApiKeys", "modelRefusals", "modelQuotaWeights", "tiers", "projects", "roles", "atModelAllowlist", "cascadeLadder", "degrade",
 ];
 const APPROVAL_GROUP_KEYS = [
-    "approvalRequire", "approvalDeny", "approvalTimeoutSec", "approvalAutoBudget", "approvalNeverAuto",
+    "approvalRequire", "approvalDeny", "approvalTimeoutSec", "approvalAutoBudget", "approvalNeverAuto", "approvalGrant",
     "approvalHmacKeys", "durableApproval", "durableApprovalSource", "streamAskWindowMsSource", "directApprovalDoor", "directDoorActive", "resourceSuspend",
     "resourceSuspendTtlSec", "resourceSuspendTotalTokens", "resourceSuspendTotalBudgetUsd", "resourceSuspendMaxSlices", "askQuestionEnabled", "questionThrottle", "toolApprovalEnabled", "permissionRulesEnabled", "permissionRulesEnabledExplicit", "streamAskWindowMarginMs", "streamApproval", "unattendedApprovalPolicy", "mcpElicitation",
     "sensitiveWritePatterns", "writeProtectedPaths", "manualModeShellGate", "permissionsDisableAutoMode", "autoModeClassifierFallback", "autoModeClassifierTimeoutMs", "crossSessionInbound", "crossSessionDialogExpiry",
@@ -2407,54 +2419,39 @@ export function loadConfig() {
     const integrations = parseIntegrationsDomain({ requirePrincipal, configProvider });
     const { directApprovalDoor, durableApproval: dgDurable, approvalHmacKeys: dgHmacKeys } = approval;
     const { principalJwtPubkeys, principalJwtIss, principalJwtAud, operatorPrincipals: dgOperators, authTokens } = auth;
-    const { enabled: imageBakesEnabled, runnerPrincipal: bakeRunnerPrincipal } = orchestration.imageBakes;
     const directDoorActive = directApprovalDoor && dgDurable && dgHmacKeys.length > 0 && principalJwtPubkeys.length > 0 && !!principalJwtIss && !!principalJwtAud;
-    if (directApprovalDoor) {
-        const missing = [];
-        if (!dgDurable)
-            missing.push("DURABLE_APPROVAL=true (the direct door's crypto gate only exists on the durable /decide path)");
-        if (dgHmacKeys.length === 0)
-            missing.push("APPROVAL_HMAC_KEYS");
-        if (principalJwtPubkeys.length === 0)
-            missing.push("PRINCIPAL_JWT_PUBKEYS");
-        if (!principalJwtIss)
-            missing.push("PRINCIPAL_JWT_ISS");
-        if (!principalJwtAud)
-            missing.push("PRINCIPAL_JWT_AUD");
-        if (dgOperators.length === 0)
-            missing.push("OPERATOR_PRINCIPALS (else isOperator is true-for-all)");
-        if (!requirePrincipal)
-            missing.push("REQUIRE_PRINCIPAL=true (a direct door is multi-tenant; without it an absent principal is anonymous and the self-asserted header governs owner/quota checks)");
-        if (missing.length) {
-            throw new Error(`DIRECT_APPROVAL_DOOR=true but D-G anchors are missing: ${missing.join(", ")} — refusing to start a half-open direct door (design/80 D-G boot invariant)`);
-        }
+    const doorRefusal = halfOpenDirectDoorRefusal({
+        directApprovalDoor,
+        durableApproval: dgDurable,
+        approvalHmacKeys: dgHmacKeys,
+        principalJwtPubkeys,
+        principalJwtIss,
+        principalJwtAud,
+        requirePrincipal,
+        operatorPrincipals: dgOperators,
+    });
+    if (doorRefusal !== undefined) {
+        throw new Error(doorRefusal);
+    }
+    const operatorsRefusal = operatorPrincipalsRequiredRefusal({ durableApproval: dgDurable, requirePrincipal, operatorPrincipals: dgOperators });
+    if (operatorsRefusal !== undefined) {
+        throw new Error(operatorsRefusal);
+    }
+    const bakeOperatorsRefusal = bakeOperatorPrincipalsRefusal({ imageBakes: orchestration.imageBakes, operatorPrincipals: dgOperators });
+    if (bakeOperatorsRefusal !== undefined) {
+        throw new Error(bakeOperatorsRefusal);
+    }
+    const bakeRunnerRefusal = bakeRunnerCredentialRefusal({ imageBakes: orchestration.imageBakes, authTokens });
+    if (bakeRunnerRefusal !== undefined) {
+        throw new Error(bakeRunnerRefusal);
+    }
+    const leaderStoreRefusal = leaderDurableStoreRefusal({ leaderEnabled: orchestration.leaderEnabled, dbBackend: store.dbBackend });
+    if (leaderStoreRefusal !== undefined) {
+        throw new Error(leaderStoreRefusal);
     }
-    if (dgDurable && requirePrincipal && dgOperators.length === 0) {
-        throw new Error("DURABLE_APPROVAL=true + REQUIRE_PRINCIPAL=true but OPERATOR_PRINCIPALS is empty — on a multi-tenant worker the empty operator set makes isOperator() true-for-all, so every authenticated tenant could read every other tenant's pending-approval queue (GET /v1/approvals & siblings). Set OPERATOR_PRINCIPALS, or unset REQUIRE_PRINCIPAL if this is a single-tenant deployment (#157-① boot invariant)");
-    }
-    if (imageBakesEnabled && dgOperators.length === 0) {
-        throw new Error("IMAGE_BAKES_ENABLED=true but OPERATOR_PRINCIPALS is empty — the bake door runs build.sh on the privileged build host; an empty operator set makes isOperator() true-for-all (world-writable RCE). Set OPERATOR_PRINCIPALS or disable bakes (IMAGE-API-DESIGN.md §P2.4a boot invariant)");
-    }
-    if (imageBakesEnabled && !Object.values(authTokens).includes(bakeRunnerPrincipal)) {
-        throw new Error(`IMAGE_BAKES_ENABLED=true but no SERVICE_AUTH_TOKENS entry maps to the runner principal '${bakeRunnerPrincipal}' — the bake-runner authenticates by its credential (token-derived source), so a '<BAKE_RUNNER_TOKEN>=${bakeRunnerPrincipal}' SERVICE_AUTH_TOKENS entry is required or claim/ingest/heartbeat all 403 (IMAGE-API-DESIGN.md §P2.12 boot invariant)`);
-    }
-    if (orchestration.leaderEnabled && store.dbBackend !== "mysql" && store.dbBackend !== "pg") {
-        throw new Error(`LEADER_ENABLED=true but DB_BACKEND=${store.dbBackend} (no external SQL store) is refused: a leader run is an ` +
-            "N-worker fan-out lasting up to 24h that ends in a REAL git push, and without a durable store its registry is " +
-            "a per-process Map — a cross-replica GET 404s, a restart forgets the run, and a retried POST starts a SECOND " +
-            "push. Point the service at a durable store (DB_BACKEND=mysql|pg), or turn the leader off (unset LEADER_ENABLED) " +
-            "(#193 车4 件2 / staleness ledger P1-9+P1-10 boot invariant)");
-    }
-    if (orchestration.requireExecutionLane && orchestration.remoteExec === undefined) {
-        throw new Error(`REQUIRE_EXECUTION_LANE=true but NO execution lane is named on this deployment — refusing to start. ` +
-            `With no lane the engine falls back to its in-process stub environment, where at least the Bash tool is ` +
-            `not mounted, yet every task still returns status=completed — indistinguishable from "the model chose ` +
-            `not to use its tools". (What the roster actually keeps is a per-run fact: read the wiring_manifest ` +
-            `event and count entries whose mountedBy is "hands".) ` +
-            `Cause: REMOTE_EXEC is unset/empty AND CONFIG_PROVIDER is not "local". ` +
-            `Fix: set REMOTE_EXEC to one of ${REMOTE_EXEC_PROVIDER_WORDS.join(" | ")} (and that lane's required env), ` +
-            `or set CONFIG_PROVIDER=local to take the single-machine \`host\` default, ` +
-            `or unset REQUIRE_EXECUTION_LANE to keep running without hands on purpose.`);
+    const laneRequiredRefusal = executionLaneRequiredRefusal(orchestration);
+    if (laneRequiredRefusal !== undefined) {
+        throw new Error(laneRequiredRefusal);
     }
     {
         const envLaneDispatchable = !isRosterGateArmed(integrations.configCenter);

package/dist/deployment-governance.d.ts

@@ -11,6 +11,9 @@ export interface DeploymentGovernanceConfigView {
     readonly commandPolicy?: ServiceConfig["commandPolicy"];
     readonly manualModeShellGate?: ServiceConfig["manualModeShellGate"];
     readonly sensitiveWritePatterns: ServiceConfig["sensitiveWritePatterns"];
+    /** 7.115.0:运维的 allow 规则(`APPROVAL_GRANT`)—— 原串交给折叠属主编成叶(`runtime-governance.ts` `compileApprovalGrantLayers`)。
+     *  必填:三条消费腿的切面都要点名它,漏了是编译错,不是一条腿上静默没有这只旋钮。 */
+    readonly approvalGrant: ServiceConfig["approvalGrant"];
     /**
      * 本部署的**本地店根**(`LOCAL_DATA_ROOT → CONFIG_LOCAL_DIR → AGENT_DATA_DIR → ~/.ai-agent`)—— 在本口只喂
      * **誊本门**(`<localDataRoot>/sessions`)。S-133 起它**不再**当守卫集的 `dataRoot`(那是引擎记忆根,见
@@ -209,7 +212,7 @@ export declare class RelativeTargetLexicalEnv extends StubExecutionEnv {
  * core 的原因。env 只是编译期的占位(compilePatterns 不碰它),真裁决用的是每请求按 lane 铸的那一个。
  */
 export declare function assertGuardPatternsUsable(config: Pick<DeploymentGovernanceConfigView, "sensitiveWritePatterns">): void;
-/** 一条 boot 期运维告警的**载荷**(纯数据 ⇒ `build*`;打给谁、用哪只 logger 归消费腿)。 */
+/** 一条 boot 期运维告警 / 通告的**载荷**(纯数据 ⇒ `build*`;打给谁、用哪只 logger、哪一级归消费腿)。 */
 export interface OperatorWarning {
     readonly event: string;
     readonly fields: Record<string, unknown>;
@@ -230,15 +233,17 @@ export interface GateSeatView {
  * 此前是「这个部署一个门都没接」这个 misconfig 的**唯一**提示,而守卫集只挡那二十来个路径段、其余写
  * 目标照旧无裁决 —— 信号不能因为我们铺了基线就静默消失,所以由我们自己按同一判据说一次。
  *
- * 判据(与信号消失的条件逐字互补):守卫集在场 ∧ 这条腿的审批基线**没有席**(`absent`)∧ 单用户
- * auto-accept 基线不适用。三个量都是部署常量 ⇒ 消费腿在 boot 期说一次,不是每任务一次。
+ * 判据(与信号消失的条件逐字互补):**非门的部署叶在场**(守卫集,或 7.115.0 起运维的 allow 规则 `APPROVAL_GRANT` —— 两者都让
+ * `spec.toolPolicy` 在场、又都不是门:一个只拒守卫段,一个只表态 allow)∧ 这条腿的审批基线**没有席**(`absent`)∧ 单用户
+ * auto-accept 基线不适用。事件名 `tool_policy_only_sensitive_baseline` 是allow 规则之前定的,保留不改(运维的日志告警按它匹配),
+ * 哪一片叶在场写在 `detail` 与 `guardedPatterns` / `grantRules` 两个计数里。三个量都是部署常量 ⇒ 消费腿在 boot 期说一次,不是每任务一次。
  * S-694:席读的是喂审批基线的**同一只**({@link ApprovalSeat})—— `durable` / `live` 两形都有人服 ask、名单
  * 进策略,「守卫集是唯一的策略」这句话在它们上面不成立。今天真发的只剩 HTTP 腿「durable 关 ∧ 多租户」那一形。
  *
  * ⚠️ 单一属主([ref] 件三):HTTP 腿与 run-local 腿共用本判据与文案。两处各写一份 = 一处改了另一处
  * 没改,而两份都长得像对的 —— 那正是本文件存在的理由。
  */
-export declare function buildOnlySensitiveBaselineWarning(config: Pick<DeploymentGovernanceConfigView, "sensitiveWritePatterns">, seat: GateSeatView): OperatorWarning | undefined;
+export declare function buildOnlySensitiveBaselineWarning(config: Pick<DeploymentGovernanceConfigView, "sensitiveWritePatterns" | "approvalGrant">, seat: GateSeatView): OperatorWarning | undefined;
 /**
  * `applyRuntimeGovernance` 的 governance 实参预铸([ref] 件一)。
  *
@@ -253,6 +258,12 @@ export declare function buildOnlySensitiveBaselineWarning(config: Pick<Deploymen
  * 的读法因此不变。
  */
 export declare function createDeploymentGovernanceInputs(config: DeploymentGovernanceConfigView, pathAdjudication: PathAdjudication, roots: DeploymentGovernanceRoots): DeploymentGovernanceInputs;
+/**
+ * 7.115.0 —— 运维 allow 规则的**起服通告**载荷(纯数据 ⇒ `build*`;HTTP 腿与 run-local 腿各在装配时说一次,用 info 级)。
+ * 规则名不是秘密(它们是工具名),所以原样列出;空表 ⇒ `undefined`(不打)。运维只读面上同一个事实另有一处:
+ * `GET /v1/diagnostics/wiring` 的 `serverGates.approvalGrant`。
+ */
+export declare function buildApprovalGrantNotice(config: Pick<DeploymentGovernanceConfigView, "approvalGrant">): OperatorWarning | undefined;
 /**
  * 审批基线 —— `applyRuntimeGovernance` 那个 base 的 `toolPolicy` 座([ref] 件一)。**恒非
  * `undefined`**:治理层是 tighten-only 的叠加层,没有基线可叠时它自己也产不出「门在场」这件事。

package/dist/deployment-governance.js

@@ -61,7 +61,7 @@ export function assertGuardPatternsUsable(config) {
     }
 }
 export function buildOnlySensitiveBaselineWarning(config, seat) {
-    if (config.sensitiveWritePatterns.length === 0 || seat.singleUserAutoAcceptBaseline)
+    if ((config.sensitiveWritePatterns.length === 0 && config.approvalGrant.length === 0) || seat.singleUserAutoAcceptBaseline)
         return undefined;
     switch (seat.approvalSeat) {
         case "durable":
@@ -74,12 +74,17 @@ export function buildOnlySensitiveBaselineWarning(config, seat) {
             throw new Error(`approval seat "${String(unhandled)}" has no arm in the only-sensitive-baseline warning`);
         }
     }
+    const nonGateLayers = [
+        ...(config.sensitiveWritePatterns.length > 0 ? ["the sensitive-path DENY baseline (SENSITIVE_WRITE_PATTERNS)"] : []),
+        ...(config.approvalGrant.length > 0 ? ["the APPROVAL_GRANT allow rules"] : []),
+    ];
     return {
         event: "tool_policy_only_sensitive_baseline",
         fields: {
-            detail: "the sensitive-path DENY baseline (SENSITIVE_WRITE_PATTERNS) is this deployment's ONLY tool policy — writes outside the guarded segments are unadjudicated, and core's own UNGATED warning no longer fires because a policy is now always present",
+            detail: `${nonGateLayers.join(" and ")} ${nonGateLayers.length > 1 ? "are" : "is"} this deployment's ONLY tool policy and not a gate — writes outside the guarded segments are unadjudicated, and core's own UNGATED warning no longer fires because a policy is now always present`,
             remedy: "wire an approval face (DURABLE_APPROVAL / APPROVAL_REQUIRE with a store) or accept the single-user auto-accept baseline",
             guardedPatterns: config.sensitiveWritePatterns.length,
+            grantRules: config.approvalGrant.length,
         },
     };
 }
@@ -108,6 +113,19 @@ export function createDeploymentGovernanceInputs(config, pathAdjudication, roots
         commandPolicy: config.commandPolicy,
         ...(config.manualModeShellGate ? { manualModeShellGate: config.manualModeShellGate } : {}),
         ...(sensitivePathLayers ? { sensitivePathLayers } : {}),
+        ...(config.approvalGrant.length > 0 ? { approvalGrant: config.approvalGrant } : {}),
+    };
+}
+export function buildApprovalGrantNotice(config) {
+    if (config.approvalGrant.length === 0)
+        return undefined;
+    return {
+        event: "approval_grant_in_force",
+        fields: {
+            rules: config.approvalGrant.length,
+            names: [...config.approvalGrant],
+            note: "APPROVAL_GRANT states the allow for the tools these rules name on every leg it is installed on (HTTP submit, durable resume, cross-replica revival of parked background agents, run-local) — those calls are no longer asked for want of a statement; any layer's own deny or ask (approval lists, request settings, session rules, the engine's mode gates) still wins",
+        },
     };
 }
 export function createApprovalBaselinePolicy(config, seat) {

package/dist/env-facts.d.ts

@@ -1,4 +1,5 @@
 import type { ImageCapabilities } from "./plugins/store-contracts.js";
+import type { RemoteExecProvider } from "./execution-lane-caps.js";
 export interface SandboxEnvFacts {
     profile?: string;
     capabilities?: string[];
@@ -53,7 +54,8 @@ export declare function buildEnvFacts(opts: {
  *  codex 复审 medium:k8s 必须按**有效快照能力**分叉,不能只看车道名——s3Snapshot 未配=park-only,
  *  resume 是全新 pod 且**工作区不恢复**,「文件已从快照恢复」那句会让模型信赖不存在的文件(比缺席
  *  更糟的谎)。 */
-export declare function resumeFactsForLane(provider: "e2b" | "k8s" | "ssh" | "adb" | "local-docker" | "host" | "device" | undefined, caps?: {
+export declare function resumeFactsForLane(provider: RemoteExecProvider | undefined, // 车道词 = settings-schema 词表正本(经本仓读口取型,不手抄;表加词 ⇒ 下方穷举 switch 编译红)
+caps?: {
     k8sSnapshot?: boolean;
 }): SandboxEnvFacts["resumeFacts"] | undefined;
 /** Path-safe session segment: the session id can be CALLER-SUPPLIED (body.sessionId), so it must not be able to

package/dist/env-facts.js

@@ -42,8 +42,12 @@ export function resumeFactsForLane(provider, caps) {
         case "host":
         case undefined:
             return { scratch: "preserved" };
-        default:
+        case "local-docker":
             return undefined;
+        default: {
+            const unreachable = provider;
+            return unreachable;
+        }
     }
 }
 export function scratchpadSessionSegment(sessionId) {