@sema-agent/server 7.114.0 → 7.115.0

package/dist/boot/shutdown.js

@@ -2,11 +2,18 @@ import { Runner } from "@sema-agent/core";
 import { writeCrashLast, clearCrashLast, readCrashLast } from "./crash-last.js";
 import { createSighupIdleHandler } from "../sighup-idle.js";
 import { createParentWatch } from "../parent-watch.js";
+import { setTimeout as delay } from "node:timers/promises";
+import { HOST_BG_KILL_GRACE_MS } from "../plugins/remote-env-host.js";
 import { installProcessExitBoundary } from "./exit-boundary.js";
 import { createEngineLeaseTracker } from "./engine-lease.js";
 import { writeExitLast, readExitLast, clearExitLast } from "./exit-last.js";
 import { isScriptRealmRejection, describeRejectionReason } from "../orchestration/hardened-vm-runner.js";
 const HARD_STOP_GRACE_MS = 10_000;
+export function backgroundGraceRemainingMs(a) {
+    if (a.softStopped <= 0)
+        return 0;
+    return Math.max(0, Math.min(a.softStoppedAt + a.graceMs, a.deadlineMs) - a.now);
+}
 export function installShutdownHandlers(ctx) {
     const { config, logger, server, reaper, fleetReconcile, retentionLane, releaseRetentionLease, otelExporter, breakerState, costQuota, rateLimiter, runner, subRunner, lspManager, workflowNotifyJournal, fleetClient, backend, drainState, storeLiveProbe, configCenter, version, deviceHub, toolApproval, parkCommits, } = ctx;
     const dataRoot = config.localDataRoot;
@@ -102,7 +109,10 @@ export function installShutdownHandlers(ctx) {
         subRunner.sessions.dispose();
         void lspManager?.dispose?.();
         void workflowNotifyJournal?.close?.();
-        exitBoundary.reapChildProcessesEarly();
+        const backgroundSoftStopped = exitBoundary.reapChildProcessesEarly();
+        const softStoppedAt = Date.now();
+        const backgroundGraceMs = backgroundGraceRemainingMs({ softStopped: backgroundSoftStopped, softStoppedAt, now: softStoppedAt, graceMs: HOST_BG_KILL_GRACE_MS, deadlineMs: graceDeadlineMs });
+        const backgroundGrace = backgroundGraceMs > 0 ? delay(backgroundGraceMs) : Promise.resolve();
         const drained = approvalDrain
             .then(() => parkCommits?.quiesce(graceDeadlineMs))
             .then((q) => {
@@ -120,6 +130,7 @@ export function installShutdownHandlers(ctx) {
             void Promise.all([retentionTeardown, ledgerStopped])
                 .then(() => (backend ? backend.close() : Promise.resolve()))
                 .then(() => routingStopped)
+                .finally(() => backgroundGrace)
                 .finally(() => process.exit(0));
         });
         const finalExit = setTimeout(() => { logger.warn("hard_shutdown_final_deadline", { afterMs: 15_000 }); process.exit(0); }, 15_000);

package/dist/capabilities/composite-members.d.ts

@@ -46,6 +46,7 @@ export declare const COMPOSITE_CAPABILITY_MEMBERS: {
     readonly webSearch: readonly ["backend"];
     readonly background: readonly ["listFace", "exitFaces"];
     readonly taskSettings: readonly ["permissions", "permissionMode", "model", "outputStyle", "env", "hooks"];
+    readonly settings: readonly ["permissions"];
     readonly permissionModeAuto: readonly ["accepted", "classifierSeat", "entitlementSource", "armed", "reason", "model"];
     readonly writeProtection: readonly ["armed", "rows", "replaced"];
     readonly executionLane: readonly ["provider", "toolsOnThisHost", "isolated"];

package/dist/capabilities/composite-members.js

@@ -7,6 +7,7 @@ export const COMPOSITE_CAPABILITY_MEMBERS = {
     webSearch: ["backend"],
     background: ["listFace", "exitFaces"],
     taskSettings: ["permissions", "permissionMode", "model", "outputStyle", "env", "hooks"],
+    settings: ["permissions"],
     permissionModeAuto: ["accepted", "classifierSeat", "entitlementSource", "armed", "reason", "model"],
     writeProtection: ["armed", "rows", "replaced"],
     executionLane: ["provider", "toolsOnThisHost", "isolated"],

package/dist/config-catalog.js

@@ -58,6 +58,7 @@ export const CONFIG_CATALOG = [
     r("ANTHROPIC_VERSION", "modelPlane", "string", "Anthropic API version 头(缺省由 SDK 定)"),
     r("APPROVAL_AUTO_BUDGET", "approval", "number", "每 run-leg 自动放行的普通门控工具调用数上限(0=关;防审批循环的熔断,不是安全 ask 的帽)", { staticDefault: "0", danger: SEC, configKey: "approvalAutoBudget" }),
     r("APPROVAL_DENY", "approval", "csv", "始终拒绝的工具名单(装配期拒不可匹配名)", { danger: SEC, configKey: "approvalDeny" }),
+    r("APPROVAL_GRANT", "approval", "csv", "运维的 allow 规则(工具名规则:精确名 / mcp__<server>__* / a2a__<peer>__*;命中 = 带理由放行,不再为这些调用出「没人表态」卡(不放掉任何一层自己的问);HTTP 提交 / durable 续跑 / 停驻后台 agent 赎回 / run-local 四腿同装(leader worker 首跑与修复腿到不了);不越过任何一层的 deny / ask;不是白名单;坏值拒启)", { danger: SEC, configKey: "approvalGrant", derivedDefaultNote: "缺席 = 空表(本层不表态,折叠与未设逐字同)" }),
     r("APPROVAL_HMAC_KEYS", "approval", "secret", "直连门(D-G)HMAC 完整性密钥集(空=直连门不激活)", { danger: SEC }),
     r("APPROVAL_NEVER_AUTO", "approval", "csv", "永不被 AUTO_BUDGET 自动放行的工具集(不可逆动作恒要人)", { danger: SEC, configKey: "approvalNeverAuto" }),
     r("APPROVAL_REQUIRE", "approval", "csv", "必须人审的工具名单(F4 门;center 腿热:refresh 拍整表换代,无 checkpoint 店的部署发非空名单 ⇒ 审批组整组拒)", { danger: SEC, configKey: "approvalRequire", center: cGov("approvalRequire") }),
@@ -156,7 +157,7 @@ export const CONFIG_CATALOG = [
     r("HOST_BG_DEFAULT_TIMEOUT_SEC", "orchestration", "number", "host 后台 shell 缺省超时(秒)", { staticDefault: "300" }),
     r("HOST_BG_ENABLED", "orchestration", "boolean", "host 车道后台 shell 开关", { staticDefault: "true" }),
     r("HOST_BG_FILE_CAP", "orchestration", "number", "host 后台 shell 磁盘护栏(字节;失控输出被 reap)", { staticDefault: String(64 * 1024 * 1024) }),
-    r("HOST_BG_KILL_GRACE_MS", "orchestration", "number", "host 后台 shell SIGTERM→SIGKILL 宽限(ms);会话删除 / 会话停止口在软停与硬收之间等同一只", { staticDefault: "1000" }),
+    r("HOST_BG_KILL_GRACE_MS", "orchestration", "number", "host 后台 shell SIGTERM→SIGKILL 宽限(ms);会话删除 / 会话停止口在软停与硬收之间等同一只,受控退出(SIGTERM / SIGINT)在软停之后、退出之前也等一次(封顶在停机宽限窗内)", { staticDefault: "1000" }),
     r("HOST_BG_MAX_CONCURRENT", "orchestration", "number", "host 后台 shell 并发帽", { staticDefault: "8" }),
     r("HOST_BG_MAX_TIMEOUT_SEC", "orchestration", "number", "host 后台 shell 超时上限(秒)", { staticDefault: "1800" }),
     r("HOST_BG_MEM_CAP", "orchestration", "number", "host 后台 shell 内存流护栏(字节)", { staticDefault: String(8 * 1024 * 1024) }),

package/dist/config-center/apply-effective.js

@@ -1,6 +1,6 @@
 import { resolveActiveTiers } from "@sema-agent/settings-schema";
 import { modelKeyPoison } from "../key-resolver.js";
-import { applyAutoCompactWindow, buildModelCostKey, findUnmatchableToolNames, formatUnmatchableToolNames, parseAutonomy } from "../config.js";
+import { applyAutoCompactWindow, buildModelCostKey, parseAutonomy, unmatchableToolNamesRefusal } from "../config.js";
 import { buildModelCompat, readModelCompat } from "../model-compat.js";
 import { buildModelHeadersKey } from "../model-entry-headers.js";
 import { validateCommandRules } from "../runtime-governance.js";
@@ -9,7 +9,7 @@ import { stageLimits } from "./stage-limits.js";
 import { APPROVAL_GROUP_KEYS, BATCH1_LIMIT_KEYS } from "./hot-keys-registry.js";
 import { buildDisplaySafeUrl } from "../trace/redact.js";
 import { crossInvariant } from "../config-invariants.js";
-import { DEFAULT_MODEL_MISSING_CODE, REFUSED_NAME_MINTED_CODE, judgeCatalogEntries, mintedRefusedNames, refusalEventOf, refusalWarnFields, malformedDroppedCarrierRefusal } from "../model-entry-refusal.js";
+import { DEFAULT_MODEL_MISSING_CODE, REFUSED_NAME_MINTED_CODE, judgeCatalogEntries, mintedRefusedNames, refusalEventOf, refusalWarnFields, refusedNameLogField, refusedNamesLogFields, malformedDroppedCarrierRefusal } from "../model-entry-refusal.js";
 import { judgeModelRouteEndpoint } from "../model-route-endpoint.js";
 import { gateIntentUnserviceableReason } from "../approval.js";
 import { refusedGroups } from "./apply-ledger.js";
@@ -314,7 +314,7 @@ function stageModelPlane(config, eff, logger, sealedKeys) {
         if (usable.length > 0) {
             picked = resolveDefaultModelName(eff, (n) => models[n] !== undefined, usable[0].name, (source, name) => logger?.warn("sema_registry_default_dangling", {
                 source,
-                name,
+                ...(Object.hasOwn(verdict.refused, name) ? refusedNameLogField("name", name) : { name }),
                 ...(Object.hasOwn(verdict.refused, name) ? { unavailable: verdict.refused[name].code } : {}),
                 hint: "explicit default names a model that is not in the usable catalog (not enabled, or unavailable on this host — see `unavailable`) — falling to the next source",
             }));
@@ -327,7 +327,7 @@ function stageModelPlane(config, eff, logger, sealedKeys) {
                 continue;
             }
             const refusal = Object.hasOwn(verdict.refused, target) ? verdict.refused[target] : undefined;
-            logger?.warn("sema_registry_tier_binding_unavailable", { tier, model: target, ...(refusal !== undefined ? { code: refusal.code } : {}), hint: "this tier binding names a model that is not in this generation's usable catalog — the binding is dropped (the tier word falls to the next lower bound tier, core's ladder); fix the entry or rebind the tier" });
+            logger?.warn("sema_registry_tier_binding_unavailable", { tier, ...(refusal !== undefined ? refusedNameLogField("model", target) : { model: target }), ...(refusal !== undefined ? { code: refusal.code } : {}), hint: "this tier binding names a model that is not in this generation's usable catalog — the binding is dropped (the tier word falls to the next lower bound tier, core's ladder); fix the entry or rebind the tier" });
         }
         const nextView = { ...config, models, tiers: activeTiers, modelRefusals: verdict.refused };
         const noDefault = crossInvariant("default-model-resolvable").check({ live: config, next: nextView });
@@ -343,7 +343,7 @@ function stageModelPlane(config, eff, logger, sealedKeys) {
             const target = typeof spec === "string" ? spec : spec !== null && typeof spec === "object" && "model" in spec && typeof spec.model === "string" ? spec.model : undefined;
             const refusal = target !== undefined && Object.hasOwn(verdict.refused, target) ? verdict.refused[target] : undefined;
             if (refusal !== undefined) {
-                logger?.warn("sema_registry_role_binding_unavailable", { role, model: target, code: refusal.code, hint: ROLE_BINDING_UNAVAILABLE_HINT });
+                logger?.warn("sema_registry_role_binding_unavailable", { role, ...refusedNameLogField("model", target), code: refusal.code, hint: ROLE_BINDING_UNAVAILABLE_HINT });
             }
         }
         const atModelAllowlist = stageAtModelAllowlist(eff.models?.atModelAllowlist, models, logger);
@@ -357,7 +357,7 @@ function stageModelPlane(config, eff, logger, sealedKeys) {
             roles,
             activeTiers,
             atModelAllowlist,
-            infoLine: { count: usable.length, ...(Object.keys(verdict.refused).length > 0 ? { unavailable: Object.keys(verdict.refused) } : {}), default: defaultModel.id, defaultSource: picked.source, roles: Object.keys(roles), tiers: Object.keys(activeTiers), atModelAllowlist: atModelAllowlist.length, sealedKeys: Object.values(modelApiKeys).filter((v) => typeof v === "string").length, sealedPoisoned: Object.values(modelApiKeys).filter((v) => typeof v !== "string").length },
+            infoLine: { count: usable.length, ...(Object.keys(verdict.refused).length > 0 ? refusedNamesLogFields("unavailable", Object.keys(verdict.refused)) : {}), default: defaultModel.id, defaultSource: picked.source, roles: Object.keys(roles), tiers: Object.keys(activeTiers), atModelAllowlist: atModelAllowlist.length, sealedKeys: Object.values(modelApiKeys).filter((v) => typeof v === "string").length, sealedPoisoned: Object.values(modelApiKeys).filter((v) => typeof v !== "string").length },
         };
         return { stages: { models: plane, collab: stageCollabDomain(eff) }, defaultName: picked.name, refused: verdict.refused };
     }
@@ -476,13 +476,13 @@ function stageApprovalRequire(raw) {
         return { ok: false, detail, reason: detail, names: nonString.map((e) => `[${e.i}]`), kept: KEPT_WOULD_REMOVE_GATE };
     }
     const names = raw.filter((n) => typeof n === "string").map((n) => n.trim()).filter((n) => n.length > 0);
-    const bad = findUnmatchableToolNames(names, { consumer: "tool-name-table", behavior: "deny" });
-    if (bad.length > 0) {
+    const unmatchable = unmatchableToolNamesRefusal("published governance.approvalRequire", names, { consumer: "tool-name-table", behavior: "deny" });
+    if (unmatchable !== undefined) {
         return {
             ok: false,
-            detail: formatUnmatchableToolNames("published governance.approvalRequire", bad),
-            reason: `published governance.approvalRequire has ${bad.length} entr${bad.length === 1 ? "y" : "ies"} that match no live tool (retired name / incomplete MCP name / CC-form rule) — the offending entries are named in the sema_registry_approval_require_invalid log line`,
-            names: bad.map((b) => b.name),
+            detail: unmatchable.message,
+            reason: `published governance.approvalRequire has ${unmatchable.names.length} entr${unmatchable.names.length === 1 ? "y" : "ies"} that match no live tool (retired name / incomplete MCP name / CC-form rule) — the offending entries are named in the sema_registry_approval_require_invalid log line`,
+            names: unmatchable.names,
             kept: KEPT_WOULD_MATCH_NOTHING,
         };
     }

package/dist/config-provider.d.ts

@@ -35,6 +35,22 @@ export type FetchEffectiveResult = {
     readWarnings: readonly EffectiveReadWarning[];
     credentialIdentity?: string;
 } | null;
+/**
+ * 引号段 = **一条规则**:先过 `redactSecrets`;文本里没有引号字符(`"` / `'`)⇒ 原样返回;有 ⇒ 从**第一个**引号到**最后一个**引号(含两端,
+ * 两种引号不分种类)整段换成**一个**指纹;`"` 的个数是奇数、或 `'` 的个数是奇数(落单 / 句子被截断)⇒ 从第一个引号遮到**文末**。
+ * 本函数不辨认任何一个引号是「开头」「收尾」「转义」还是「撇号」—— 生产方原文插值的值自己带引号时,句子里没有信号能把「值里的引号」与「值的边界」
+ * 分开,逐个辨认边界的读法每补一条豁免就多一种漏形。
+ *
+ * 为什么是超集:
+ *  · 配对读法(`/"[^"]*"|'[^']*'/g`)遮住的每一段都夹在两个引号之间,因此落在「第一个引号 … 最后一个引号」之内;
+ *  · 生产方放进引号里的值(不论值里带几个引号、怎么转义、撇号在哪)也都落在这一段之内 —— 值左边至少有一个引号、右边至少有一个引号;
+ *  · 引号个数不成对时遮到文末,只会更宽。
+ * 代价:两个操作数之间的固定词与第一个操作数之后的句子不再可读(例:`roster "#…" (not in the models catalog)`,原句里 `references unknown model`
+ * 一并进了指纹);首个引号之前的部分(引用完整性腿拼在前面的坐标 `rosters.0.models.0: `、固定句头)与末个引号之后的句尾仍是明文。
+ * 仍不覆盖:生产方**不加引号**直接插值的值(本函数看不见值在哪);句子被截断、而两种引号的个数恰好都是偶数的形。真收法在消息生产方给出结构化操作数、
+ * 不回声值(上游 settings-schema)。
+ */
+export declare function redactConfigError(text: string): string;
 /** Sentinel returned by {@link raceBootFetch} when the boot pull outlived its budget — the caller
  *  starts serving on the env fallback and the SAME promise settles in the background (never cancelled). */
 export declare const BOOT_FETCH_DEFERRED: unique symbol;

package/dist/config-provider.js

@@ -8,8 +8,17 @@ import { fetchEffective as remoteFetchEffective, fetchSkillContent as remoteFetc
 import { homedir } from "node:os";
 import { join } from "node:path";
 const OPERAND_FINGERPRINT_KEY = randomBytes(16);
-function redactConfigError(text) {
-    return redactSecrets(text).replace(/"[^"]*"|'[^']*'/g, (m) => `"#${createHmac("sha256", OPERAND_FINGERPRINT_KEY).update(m.slice(1, -1)).digest("hex").slice(0, 8)}"`);
+export function redactConfigError(text) {
+    const s = redactSecrets(text);
+    const first = s.search(/["']/);
+    if (first === -1)
+        return s;
+    const count = (q) => s.split(q).length - 1;
+    const fingerprint = (operand) => `"#${createHmac("sha256", OPERAND_FINGERPRINT_KEY).update(operand).digest("hex").slice(0, 8)}"`;
+    if (count('"') % 2 === 1 || count("'") % 2 === 1)
+        return `${s.slice(0, first)}${fingerprint(s.slice(first + 1))}`;
+    const last = Math.max(s.lastIndexOf('"'), s.lastIndexOf("'"));
+    return `${s.slice(0, first)}${fingerprint(s.slice(first + 1, last))}${s.slice(last + 1)}`;
 }
 export const BOOT_FETCH_DEFERRED = Symbol("boot-fetch-deferred");
 export function raceBootFetch(fetch, budgetMs) {

package/dist/config-types.d.ts

@@ -1324,6 +1324,25 @@ export interface ServiceConfigFlat {
      *  「只配 APPROVAL_NEVER_AUTO」这一形被判成"零门意图" ⇒ 落进单用户 allow-all 基线 ⇒ 那张表
      *  从未进入任何 policy。判定现在单源在 `hasOperatorGateIntent()`(与 inv#2 同文件)。 */
     approvalNeverAuto: string[];
+    /**
+     * 7.115.0 —— **运维的 allow 规则**(`APPROVAL_GRANT`,逗号分隔的工具名规则:精确名 / `mcp__<server>__*` / `a2a__<peer>__*`)。命中 = 带理由的
+     * 放行(core `decisionReason: "rule"`,运维替这些调用表了态 —— 回答没人表态的服务器工具 / A2A 技能调用;内置工具上引擎的写门、shell 检查照问);未命中 = 不表态。与请求腿的 `settings.permissions.allow` 是**同一种东西**:
+     * 同一只编译口(`permission-rule-list.ts` `createRuleListPolicy`)、同一只校验(`config.ts` `approvalGrantRefusal` → `unmatchableToolNamesRefusal`,
+     * 坏值拒启)。施加点 = 部署治理链的单一构造口(`deployment-governance.ts` → `runtime-governance.ts` `applyRuntimeGovernance` 的一片叶),
+     * 所以 HTTP 提交 / durable 续跑(含 leader worker 停驻后经 `/decide` 续跑的那一段)/ 停驻后台 agent 的跨副本赎回 / run-local 四条腿同装(leader worker 首跑与修复腿到不了),每次现取(不 memoize)。**不越过**任何一层的 deny / ask(折叠 deny > ask > allow)。
+     *
+     * ⚠️ 不是白名单:名字不叫 `…_ALLOW`,与会话规则的 `toolAllow`(「只许这些」)刻意分开 —— 本键只给出表态,不收窄任何东西。
+     *
+     * 三问:谁需要 = 在没有请求体的腿上接了 MCP 服务器的运维 —— `run-local`,以及 durable 续跑(每一次从持久化体重建,含 leader worker 停驻后经 `/decide`
+     * 续跑的那一段;A2A 不在射程:运维声明的对端恒带外发标记,那一问本键不放) —— core 7.40.0 起没人表态的服务器工具调用要问,无席 ⇒ 拒、有 durable 席 ⇒ 每次停驻等人,
+     * 这里是运维为自己接的服务器表态的唯一位置。**到不了**:leader worker 的首跑与修复腿(工具策略在 leader 编排里自己折出来 —— `leader/wire.ts` 的
+     * `combinePolicies(createDurableQuestionPolicy(), createDurableAskPolicy(…))` —— 不经上面那只构造口);这两条腿今天不挂 MCP / A2A,本键在那里没有对象。谁受伤 = 缺省空表,无人受伤 —— 设了宽规则
+     * (`mcp__<server>__*`,含那台服务器将来新增的工具)= 对**每一个租户、每一条腿**的那些调用都不再因「没人表态」而问人,风险随规则的宽度走
+     * (射程只到这一问:任何一层自己的问照旧压过它 —— 内置工具的精确名写进来,引擎的写门 / 形状层照问);补偿 = 本键就是
+     * core 7.40.0 那条收紧的补偿,deny / ask(`APPROVAL_DENY` / `APPROVAL_REQUIRE` / 请求 settings / 会话规则)照旧压过它。
+     * v1 只有 env 一个写入通道(无 config-center 座位,不进 settings-schema)。空表 = 本层不铸叶,折叠逐字与修前同。
+     */
+    approvalGrant: string[];
     /** [ref] D-G (HMAC = integrity, not identity; ✅ WIRED — the "SCAFFOLD, not yet wired" note here was STALE,
      *  corrected 2026-07-25: consumed by `verifyDirectDoorProof` → `verifyApprovalHmac`, reached from the live decide
      *  routes — the two `verifyDirectDoorProof(` call sites in `http/routes/approvals-assistant.ts`): the
@@ -2101,7 +2120,7 @@ export type ServiceStoreConfig = Pick<ServiceConfigFlat, "sessionBackend" | "ses
 export type ServiceModelPlaneConfig = Pick<ServiceConfigFlat, "gatewayBaseUrl" | "gatewayApiKey" | "gatewayFallbackUrls" | "gatewayMaxRetries" | "anthropic" | "resilience" | "model" | "envModel" | "models" | "modelApiKeyEnv" | "modelApiKeys" | "modelRefusals" | "modelQuotaWeights" | "tiers" | "projects" | "roles" | "atModelAllowlist" | "cascadeLadder" | "degrade">;
 /** 组:approval(审批 / HITL 门)。`directDoorActive` 无 env 解析腿(装配层三域合取的产物),但语义上
  *  就是本组的门状态,故进组;`parseApprovalDomain` 的返回类型相应是 `Omit<…, "directDoorActive">`。 */
-export type ServiceApprovalConfig = Pick<ServiceConfigFlat, "approvalRequire" | "approvalDeny" | "approvalTimeoutSec" | "approvalAutoBudget" | "approvalNeverAuto" | "approvalHmacKeys" | "durableApproval" | "durableApprovalSource" | "streamAskWindowMsSource" | "directApprovalDoor" | "directDoorActive" | "resourceSuspend" | "resourceSuspendTtlSec" | "resourceSuspendTotalTokens" | "resourceSuspendTotalBudgetUsd" | "resourceSuspendMaxSlices" | "askQuestionEnabled" | "questionThrottle" | "toolApprovalEnabled" | "permissionRulesEnabled" | "permissionRulesEnabledExplicit" | "streamAskWindowMarginMs" | "streamApproval" | "unattendedApprovalPolicy" | "mcpElicitation" | "sensitiveWritePatterns" | "writeProtectedPaths" | "manualModeShellGate" | "permissionsDisableAutoMode" | "autoModeClassifierFallback" | "autoModeClassifierTimeoutMs" | "crossSessionInbound" | "crossSessionDialogExpiry">;
+export type ServiceApprovalConfig = Pick<ServiceConfigFlat, "approvalRequire" | "approvalDeny" | "approvalTimeoutSec" | "approvalAutoBudget" | "approvalNeverAuto" | "approvalGrant" | "approvalHmacKeys" | "durableApproval" | "durableApprovalSource" | "streamAskWindowMsSource" | "directApprovalDoor" | "directDoorActive" | "resourceSuspend" | "resourceSuspendTtlSec" | "resourceSuspendTotalTokens" | "resourceSuspendTotalBudgetUsd" | "resourceSuspendMaxSlices" | "askQuestionEnabled" | "questionThrottle" | "toolApprovalEnabled" | "permissionRulesEnabled" | "permissionRulesEnabledExplicit" | "streamAskWindowMarginMs" | "streamApproval" | "unattendedApprovalPolicy" | "mcpElicitation" | "sensitiveWritePatterns" | "writeProtectedPaths" | "manualModeShellGate" | "permissionsDisableAutoMode" | "autoModeClassifierFallback" | "autoModeClassifierTimeoutMs" | "crossSessionInbound" | "crossSessionDialogExpiry">;
 /** 组:memory(记忆面 + TOC 同步腿)。 */
 export type ServiceMemoryConfig = Pick<ServiceConfigFlat, "memoryEngineEnabled" | "memoryEngineDir" | "memoryEngineRemoteLaneAllowed" | "memoryEngineBackend" | "memoryScope" | "memoryPersistenceCapable" | "memorySync" | "memoryEmbedder" | "memoryOrgAdmissionMode" | "memoryDelegationEvidence" | "memoryProvenance" | "memoryCapturePolicy" | "memoryConsolidationDriver" | "memoryOrgDirectoryJson" | "memoryOrgGrantTtlMs" | "memoryOrgUnavailableBackoffMs" | "projectMemoryEnabled" | "syncImportLeaseStaleSec">;
 /** 组:auth(鉴权 / 身份 / 治理棒)。`commandPolicy` 只有 sema-registry 腿(无 env 标量形),故 env 解析

package/dist/config.d.ts

@@ -285,7 +285,8 @@ export declare function isRosterGateArmed(configCenter: ServiceConfig["configCen
  *   ① env 腿(`APPROVAL_REQUIRE`/`DENY`/`NEVER_AUTO`,下方)—— boot 拒启;
  *   ② 中心下发腿(`runtime.approvalRequire`,config-center/apply-effective.ts)—— 域级拒绝+保前值+warn
  *      (常驻进程不 crash);
- *   ③ per-request 腿(`settings.permissions.{ask,deny}`,task-settings.ts)—— 该请求 422。
+ *   ③ per-request 腿(`settings.permissions.{ask,deny}`,task-settings.ts;S-654 (c) 起 `allow` 同判)—— 该请求 422;
+ *   ④ env 腿 `APPROVAL_GRANT`(7.115.0,运维的 allow 规则,与 ③ 的 allow 桶同一个消费者 `rule-policy`)—— boot 拒启({@link approvalGrantRefusal})。
  *
  * 五种拼法:
  *   - CC 形规则条目(`Bash(ps:*)`/`Edit(src/**)`,[ref] [ref]§七 装机实测):CC 的权限规则 DSL 写法。这些
@@ -327,28 +328,50 @@ export interface UnmatchableToolName {
  * S-177(core 7.9.0 [ref])—— **这条名单条目喂给谁**,决定「永不匹配」这句话怎么判。两个消费者形态:
  *
  *  · `"tool-name-table"` —— 消费者按**整串工具名**比对(精确 ∪ covering):env `APPROVAL_*` 三键与
- *    中心下发 `runtime.approvalRequire`(消费者 `createDurableAskPolicy`),**以及**
- *    `settings.permissions.allow`(消费者 core 的 `createAllowDenyPolicy` 的 allow 位)。带括号的内容形
+ *    中心下发 `runtime.approvalRequire`(消费者 `createDurableAskPolicy`)。带括号的内容形
  *    在这里永远匹配不上任何活工具名 —— 与引擎的规则文法认不认得它**无关**,是这条腿的比对方式决定的,
  *    所以内容形照旧响亮拒 + 指路。
  *  · `"rule-policy"` —— 消费者是 core 的**规则编译器**(`createPermissionRulePolicy`):
- *    `settings.permissions.deny` 与 `.ask`(S-177 / core 7.9.0 起两张表都走编译器)。引擎自此**真的按内容
- *    匹配**它们(`Bash(rm -r:*)` / `Edit(~/.sema/**)`),所以本仓不许再替它拒 —— 判据整条交回 core 的
- *    `validatePermissionRules`,按这张表自己的 behavior 问。
- *
- * 🔴 **不对称不是特判,是从「消费者是谁」自然导出的**:`allow` 之所以豁免名字形与文法两族(退役名 /
- * 短名 / 反斜杠 / 超帽),是因为它是**白名单** —— 一个匹配不上的条目让白名单空掉 ⇒ 一切都不在白名单
- * ⇒ fail-CLOSED 且当场可见,那是可接受的另一种失败形;而内容形不同,它是一个 CC 用户为了**少弹窗**
- * 写下的拼法族错,静默代价是整只 Bash 不可用。
+ *    `settings.permissions.deny` / `.ask`(S-177 / core 7.9.0 起)与 `.allow`(S-654 (c) / 7.115.0 起;修前是
+ *    `createAllowDenyPolicy` 的名单位)。引擎**真的按内容匹配** deny / ask 的内容形(`Bash(rm -r:*)` /
+ *    `Edit(~/.sema/**)`),所以本仓不许再替它拒 —— 判据整条交回 core 的 `validatePermissionRules`,按这张表
+ *    自己的 behavior 问(allow 侧 core 只收工具名形,内容形由 core 判拒)。
+ *
+ * S-654 (c) 前这里还有一条「`allow` 豁免名字形与文法两族」的不对称,前提是 allow 为白名单(匹配不上 ⇒ 全拒,
+ * fail-closed 且当场可见);allow 改成规则后那条前提不在了(匹配不上 ⇒ 什么也不放行、照常问,写的人收不到信号),豁免随之删除。
  */
 export type RuleEntryConsumer = "tool-name-table" | "rule-policy";
-export declare function findUnmatchableToolNames(names: readonly string[], opts: {
-    consumer: RuleEntryConsumer;
-    behavior: RuleBehavior;
-    pathBases?: PathRuleBases;
-}): UnmatchableToolName[];
-/** {@link findUnmatchableToolNames} 的成句形——三条腿的文案同源(只有前缀/出口不同)。 */
-export declare function formatUnmatchableToolNames(source: string, bad: readonly UnmatchableToolName[]): string;
+/** {@link unmatchableToolNamesRefusal} 的判据入参:这张表喂给谁(名表 / 规则编译器)、按哪种态度问 core 的文法、路径基。 */
+export interface UnmatchableToolNameJudgment {
+    readonly consumer: RuleEntryConsumer;
+    readonly behavior: RuleBehavior;
+    readonly pathBases?: PathRuleBases;
+}
+/**
+ * 「这张表里有永远不会生效的条目」的**判据与拒因句,同一只函数**(返回 `undefined` = 通过;拒 ⇒ 句子 + 被点名的条目)。
+ * 五条腿全调它:env `APPROVAL_REQUIRE` / `APPROVAL_DENY` / `APPROVAL_NEVER_AUTO`(拒启)、中心下发 `governance.approvalRequire`(整组拒)、
+ * 请求体 `settings.permissions.{allow,ask,deny}`(422)、运维 `APPROVAL_GRANT`(拒启)。修前判据(`findUnmatchableToolNames`)与成句
+ * (`formatUnmatchableToolNames`)是两只导出,句子里那半句(「这些表都是整串逐字比对」)只对名表成立 —— 规则编译器的
+ * 三只桶(与 `APPROVAL_GRANT`)是按规则文法编、按 covering 匹配的,不是整串比对。
+ *
+ * 句子对两种消费者、三种态度都成立:每一条要么永远匹配不到活工具(退役名 / 无协议前缀的短名 / 缺段的 MCP 名 / 名表里的内容形),要么编不成
+ * 一条规则(core 文法的判词原样带出);名字按写的样子读,不做别名折叠、不补协议前缀。逐条的「为什么 / 怎么改」在 `→` 之后。
+ */
+export declare function unmatchableToolNamesRefusal(source: string, names: readonly string[], judgment: UnmatchableToolNameJudgment): {
+    readonly message: string;
+    readonly names: readonly string[];
+} | undefined;
+/**
+ * 7.115.0 —— 运维 allow 规则 `APPROVAL_GRANT` 的**拒启判据与拒因句**(同一只函数;`config-invariants.ts` 的 `…Refusal` 形:
+ * 返回句子 = 拒,`undefined` = 通过)。判据与请求腿的 `settings.permissions.allow` 是**同一只**:
+ *  ① 名字形与 core 文法 —— {@link unmatchableToolNamesRefusal},消费者 `rule-policy`、behavior `allow`(退役名 / 无前缀短名 / 缺段 MCP 名 /
+ *     反斜杠 / 超长 / 内容形与参数级的 allow;句子点名哪一条、为什么、怎么改);
+ *  ② 整表试编一次 —— 编的就是治理折叠里那一只(`runtime-governance.ts` {@link compileApprovalGrantLayers}),于是 core 的整表帽这类
+ *     只在编译时才抛的判据也在启动时响亮,而不是每个任务一次 500。
+ * 没有 `pathBases`:运维的规则不挂在任何一条任务的根上,而 allow 文法本来只收工具名形(路径形的 allow core 拒编,在 ① 里就拒了)。
+ * 坏值**不许**静默丢掉那一条后照常起:运维以为放行了,无人值守腿照旧拒 / 停驻,没有任何信号指回这里。
+ */
+export declare function approvalGrantRefusal(names: readonly string[]): string | undefined;
 /**
  * [ref] 件B/C/D —— 三条**部署治理声明**的 env 解析(auth 域的一段,fail-loud 全在这里)。
  *

package/dist/config.js

@@ -21,7 +21,7 @@ import { CONTROL_AND_BIDI_STRIP_RE } from "./text-bidi.js";
 import { bakeOperatorPrincipalsRefusal, bakeRunnerCredentialRefusal, halfOpenDirectDoorRefusal, leaderDurableStoreRefusal, operatorPrincipalsRequiredRefusal } from "./config-invariants.js";
 import { REMOTE_EXEC_PROVIDER_WORDS, executionLaneOf, executionLaneRequiredRefusal, isSingleMachineDefaultLane, laneRequiredEnv } from "./execution-lane-caps.js";
 import { MEMORY_ENGINE_BACKENDS, SESSION_BACKENDS, STORE_BACKENDS } from "@sema-agent/settings-schema/execution-lanes";
-import { AUTONOMY_MODES } from "./runtime-governance.js";
+import { APPROVAL_GRANT_SOURCE, AUTONOMY_MODES, compileApprovalGrantLayers } from "./runtime-governance.js";
 import { createCenterCredentialSource, readCenterCredentialDeclaration } from "./center-credential.js";
 import { parseCenterCredentialRenewLeadMs } from "./center-credential-renewer.js";
 import { modelProviderRefusal } from "./model-provider.js";
@@ -1226,14 +1226,16 @@ function uncompilableRuleGuidance(name, behavior, pathBases) {
     const issue = issues[0];
     if (issue === undefined)
         return undefined;
-    const ccGuidance = issue.code === "unsupported.bash_prefix" || issue.code === "unsupported.file_glob" ? ccRuleFormGuidance(name) : undefined;
-    if (ccGuidance !== undefined)
-        return ccGuidance;
+    if (behavior === "allow" && (issue.code === "unsupported.bash_prefix" || issue.code === "unsupported.file_glob" || issue.code === "invalid.allow_param_rule")) {
+        return (`${issue.code} — ${issue.message}. An allow rule list compiles tool-name rules only (an exact name, or mcp__<server>__* / ` +
+            `a2a__<peer>__* for every tool on that peer); a content-form standing approval lives in the persisted-rule store ` +
+            `(/v1/rules/cc-import, or keep the rule when you answer the call's card)`);
+    }
     return (`${issue.code} — core's rule grammar cannot compile this name (${issue.message}), so a table keyed by it matches nothing. ` +
         `Tool names carry no backslashes and are far shorter than the 512-character rule cap; check the spelling, and use ` +
         `mcp__<server>__* / a2a__<peer>__* for "every tool on that peer"`);
 }
-export function findUnmatchableToolNames(names, opts) {
+function findUnmatchableToolNames(names, opts) {
     const out = [];
     for (const name of names) {
         if (opts.consumer === "tool-name-table") {
@@ -1243,8 +1245,6 @@ export function findUnmatchableToolNames(names, opts) {
                 continue;
             }
         }
-        if (opts.behavior === "allow")
-            continue;
         const retired = RETIRED_TOOL_NAMES.get(name);
         if (retired !== undefined) {
             out.push({ name, guidance: retired });
@@ -1268,9 +1268,26 @@ export function findUnmatchableToolNames(names, opts) {
     }
     return out;
 }
-export function formatUnmatchableToolNames(source, bad) {
-    return (`${source} names tool(s) that can never match a live tool (these lists are RAW whole-name comparisons — core 5.0.0 RB-476 removed the alias/auto-prefix folds): ` +
+export function unmatchableToolNamesRefusal(source, names, judgment) {
+    const bad = findUnmatchableToolNames(names, judgment);
+    if (bad.length === 0)
+        return undefined;
+    const message = (`${source} has ${bad.length === 1 ? "an entry" : "entries"} that can never take effect — ${bad.length === 1 ? "it" : "each"} would never match a live tool or cannot be compiled into a rule ` +
+        `(names are read exactly as written: no alias folding, no protocol prefix added): ` +
         bad.map((b) => `${presentToolName(b.name)} → ${b.guidance}`).join("; ")).replace(CONTROL_AND_BIDI_STRIP_RE, "");
+    return { message, names: bad.map((b) => b.name) };
+}
+export function approvalGrantRefusal(names) {
+    const unmatchable = unmatchableToolNamesRefusal(APPROVAL_GRANT_SOURCE, names, { consumer: "rule-policy", behavior: "allow" });
+    if (unmatchable !== undefined)
+        return unmatchable.message;
+    try {
+        compileApprovalGrantLayers(names);
+    }
+    catch (e) {
+        return e instanceof Error ? e.message : String(e);
+    }
+    return undefined;
 }
 function streamApprovalConfig(gates) {
     const cfg = {
@@ -1337,9 +1354,9 @@ function parseApprovalDomain(ctx) {
     const dgHmacKeys = parseApprovalHmacKeys(process.env.APPROVAL_HMAC_KEYS, announceKeySetRejection("APPROVAL_HMAC_KEYS"));
     const durableApproval = postureOn("DURABLE_APPROVAL", infraReady);
     const rejectUnmatchableToolNames = (envName, names) => {
-        const bad = findUnmatchableToolNames(names, { consumer: "tool-name-table", behavior: "deny" });
-        if (bad.length > 0)
-            throw new Error(formatUnmatchableToolNames(envName, bad));
+        const unmatchable = unmatchableToolNamesRefusal(envName, names, { consumer: "tool-name-table", behavior: "deny" });
+        if (unmatchable !== undefined)
+            throw new Error(unmatchable.message);
         return names;
     };
     return {
@@ -1353,6 +1370,12 @@ function parseApprovalDomain(ctx) {
         resourceSuspendMaxSlices: nonNegativeIntEnv("RESOURCE_SUSPEND_MAX_SLICES", "跨片 slice 数上限"),
         approvalAutoBudget: clampEnvWithWarn("APPROVAL_AUTO_BUDGET", "0", 0, 10000),
         approvalNeverAuto: rejectUnmatchableToolNames("APPROVAL_NEVER_AUTO", csv("APPROVAL_NEVER_AUTO")),
+        approvalGrant: ((names) => {
+            const refusal = approvalGrantRefusal(names);
+            if (refusal !== undefined)
+                throw new Error(refusal);
+            return names;
+        })(csv("APPROVAL_GRANT")),
         approvalHmacKeys: dgHmacKeys,
         directApprovalDoor,
         sensitiveWritePatterns: ((raw) => {
@@ -2296,7 +2319,7 @@ const MODEL_PLANE_GROUP_KEYS = [
     "modelApiKeyEnv", "modelApiKeys", "modelRefusals", "modelQuotaWeights", "tiers", "projects", "roles", "atModelAllowlist", "cascadeLadder", "degrade",
 ];
 const APPROVAL_GROUP_KEYS = [
-    "approvalRequire", "approvalDeny", "approvalTimeoutSec", "approvalAutoBudget", "approvalNeverAuto",
+    "approvalRequire", "approvalDeny", "approvalTimeoutSec", "approvalAutoBudget", "approvalNeverAuto", "approvalGrant",
     "approvalHmacKeys", "durableApproval", "durableApprovalSource", "streamAskWindowMsSource", "directApprovalDoor", "directDoorActive", "resourceSuspend",
     "resourceSuspendTtlSec", "resourceSuspendTotalTokens", "resourceSuspendTotalBudgetUsd", "resourceSuspendMaxSlices", "askQuestionEnabled", "questionThrottle", "toolApprovalEnabled", "permissionRulesEnabled", "permissionRulesEnabledExplicit", "streamAskWindowMarginMs", "streamApproval", "unattendedApprovalPolicy", "mcpElicitation",
     "sensitiveWritePatterns", "writeProtectedPaths", "manualModeShellGate", "permissionsDisableAutoMode", "autoModeClassifierFallback", "autoModeClassifierTimeoutMs", "crossSessionInbound", "crossSessionDialogExpiry",

package/dist/deployment-governance.d.ts

@@ -11,6 +11,9 @@ export interface DeploymentGovernanceConfigView {
     readonly commandPolicy?: ServiceConfig["commandPolicy"];
     readonly manualModeShellGate?: ServiceConfig["manualModeShellGate"];
     readonly sensitiveWritePatterns: ServiceConfig["sensitiveWritePatterns"];
+    /** 7.115.0:运维的 allow 规则(`APPROVAL_GRANT`)—— 原串交给折叠属主编成叶(`runtime-governance.ts` `compileApprovalGrantLayers`)。
+     *  必填:三条消费腿的切面都要点名它,漏了是编译错,不是一条腿上静默没有这只旋钮。 */
+    readonly approvalGrant: ServiceConfig["approvalGrant"];
     /**
      * 本部署的**本地店根**(`LOCAL_DATA_ROOT → CONFIG_LOCAL_DIR → AGENT_DATA_DIR → ~/.ai-agent`)—— 在本口只喂
      * **誊本门**(`<localDataRoot>/sessions`)。S-133 起它**不再**当守卫集的 `dataRoot`(那是引擎记忆根,见
@@ -209,7 +212,7 @@ export declare class RelativeTargetLexicalEnv extends StubExecutionEnv {
  * core 的原因。env 只是编译期的占位(compilePatterns 不碰它),真裁决用的是每请求按 lane 铸的那一个。
  */
 export declare function assertGuardPatternsUsable(config: Pick<DeploymentGovernanceConfigView, "sensitiveWritePatterns">): void;
-/** 一条 boot 期运维告警的**载荷**(纯数据 ⇒ `build*`;打给谁、用哪只 logger 归消费腿)。 */
+/** 一条 boot 期运维告警 / 通告的**载荷**(纯数据 ⇒ `build*`;打给谁、用哪只 logger、哪一级归消费腿)。 */
 export interface OperatorWarning {
     readonly event: string;
     readonly fields: Record<string, unknown>;
@@ -230,15 +233,17 @@ export interface GateSeatView {
  * 此前是「这个部署一个门都没接」这个 misconfig 的**唯一**提示,而守卫集只挡那二十来个路径段、其余写
  * 目标照旧无裁决 —— 信号不能因为我们铺了基线就静默消失,所以由我们自己按同一判据说一次。
  *
- * 判据(与信号消失的条件逐字互补):守卫集在场 ∧ 这条腿的审批基线**没有席**(`absent`)∧ 单用户
- * auto-accept 基线不适用。三个量都是部署常量 ⇒ 消费腿在 boot 期说一次,不是每任务一次。
+ * 判据(与信号消失的条件逐字互补):**非门的部署叶在场**(守卫集,或 7.115.0 起运维的 allow 规则 `APPROVAL_GRANT` —— 两者都让
+ * `spec.toolPolicy` 在场、又都不是门:一个只拒守卫段,一个只表态 allow)∧ 这条腿的审批基线**没有席**(`absent`)∧ 单用户
+ * auto-accept 基线不适用。事件名 `tool_policy_only_sensitive_baseline` 是allow 规则之前定的,保留不改(运维的日志告警按它匹配),
+ * 哪一片叶在场写在 `detail` 与 `guardedPatterns` / `grantRules` 两个计数里。三个量都是部署常量 ⇒ 消费腿在 boot 期说一次,不是每任务一次。
  * S-694:席读的是喂审批基线的**同一只**({@link ApprovalSeat})—— `durable` / `live` 两形都有人服 ask、名单
  * 进策略,「守卫集是唯一的策略」这句话在它们上面不成立。今天真发的只剩 HTTP 腿「durable 关 ∧ 多租户」那一形。
  *
  * ⚠️ 单一属主([ref] 件三):HTTP 腿与 run-local 腿共用本判据与文案。两处各写一份 = 一处改了另一处
  * 没改,而两份都长得像对的 —— 那正是本文件存在的理由。
  */
-export declare function buildOnlySensitiveBaselineWarning(config: Pick<DeploymentGovernanceConfigView, "sensitiveWritePatterns">, seat: GateSeatView): OperatorWarning | undefined;
+export declare function buildOnlySensitiveBaselineWarning(config: Pick<DeploymentGovernanceConfigView, "sensitiveWritePatterns" | "approvalGrant">, seat: GateSeatView): OperatorWarning | undefined;
 /**
  * `applyRuntimeGovernance` 的 governance 实参预铸([ref] 件一)。
  *
@@ -253,6 +258,12 @@ export declare function buildOnlySensitiveBaselineWarning(config: Pick<Deploymen
  * 的读法因此不变。
  */
 export declare function createDeploymentGovernanceInputs(config: DeploymentGovernanceConfigView, pathAdjudication: PathAdjudication, roots: DeploymentGovernanceRoots): DeploymentGovernanceInputs;
+/**
+ * 7.115.0 —— 运维 allow 规则的**起服通告**载荷(纯数据 ⇒ `build*`;HTTP 腿与 run-local 腿各在装配时说一次,用 info 级)。
+ * 规则名不是秘密(它们是工具名),所以原样列出;空表 ⇒ `undefined`(不打)。运维只读面上同一个事实另有一处:
+ * `GET /v1/diagnostics/wiring` 的 `serverGates.approvalGrant`。
+ */
+export declare function buildApprovalGrantNotice(config: Pick<DeploymentGovernanceConfigView, "approvalGrant">): OperatorWarning | undefined;
 /**
  * 审批基线 —— `applyRuntimeGovernance` 那个 base 的 `toolPolicy` 座([ref] 件一)。**恒非
  * `undefined`**:治理层是 tighten-only 的叠加层,没有基线可叠时它自己也产不出「门在场」这件事。

package/dist/deployment-governance.js

@@ -61,7 +61,7 @@ export function assertGuardPatternsUsable(config) {
     }
 }
 export function buildOnlySensitiveBaselineWarning(config, seat) {
-    if (config.sensitiveWritePatterns.length === 0 || seat.singleUserAutoAcceptBaseline)
+    if ((config.sensitiveWritePatterns.length === 0 && config.approvalGrant.length === 0) || seat.singleUserAutoAcceptBaseline)
         return undefined;
     switch (seat.approvalSeat) {
         case "durable":
@@ -74,12 +74,17 @@ export function buildOnlySensitiveBaselineWarning(config, seat) {
             throw new Error(`approval seat "${String(unhandled)}" has no arm in the only-sensitive-baseline warning`);
         }
     }
+    const nonGateLayers = [
+        ...(config.sensitiveWritePatterns.length > 0 ? ["the sensitive-path DENY baseline (SENSITIVE_WRITE_PATTERNS)"] : []),
+        ...(config.approvalGrant.length > 0 ? ["the APPROVAL_GRANT allow rules"] : []),
+    ];
     return {
         event: "tool_policy_only_sensitive_baseline",
         fields: {
-            detail: "the sensitive-path DENY baseline (SENSITIVE_WRITE_PATTERNS) is this deployment's ONLY tool policy — writes outside the guarded segments are unadjudicated, and core's own UNGATED warning no longer fires because a policy is now always present",
+            detail: `${nonGateLayers.join(" and ")} ${nonGateLayers.length > 1 ? "are" : "is"} this deployment's ONLY tool policy and not a gate — writes outside the guarded segments are unadjudicated, and core's own UNGATED warning no longer fires because a policy is now always present`,
             remedy: "wire an approval face (DURABLE_APPROVAL / APPROVAL_REQUIRE with a store) or accept the single-user auto-accept baseline",
             guardedPatterns: config.sensitiveWritePatterns.length,
+            grantRules: config.approvalGrant.length,
         },
     };
 }
@@ -108,6 +113,19 @@ export function createDeploymentGovernanceInputs(config, pathAdjudication, roots
         commandPolicy: config.commandPolicy,
         ...(config.manualModeShellGate ? { manualModeShellGate: config.manualModeShellGate } : {}),
         ...(sensitivePathLayers ? { sensitivePathLayers } : {}),
+        ...(config.approvalGrant.length > 0 ? { approvalGrant: config.approvalGrant } : {}),
+    };
+}
+export function buildApprovalGrantNotice(config) {
+    if (config.approvalGrant.length === 0)
+        return undefined;
+    return {
+        event: "approval_grant_in_force",
+        fields: {
+            rules: config.approvalGrant.length,
+            names: [...config.approvalGrant],
+            note: "APPROVAL_GRANT states the allow for the tools these rules name on every leg it is installed on (HTTP submit, durable resume, cross-replica revival of parked background agents, run-local) — those calls are no longer asked for want of a statement; any layer's own deny or ask (approval lists, request settings, session rules, the engine's mode gates) still wins",
+        },
     };
 }
 export function createApprovalBaselinePolicy(config, seat) {

package/dist/fleet/fleet-bus.d.ts

@@ -1,6 +1,5 @@
 import type { TaskNotificationPayload, TerminalCause, WorkflowRun } from "@sema-agent/core";
-import type { RunRecord, UnsuccessfulRunStatus } from "../plugins/store-contracts.js";
-import type { AssertAllKeysHandled } from "../trace/core-keyset-guard.js";
+import type { RunRecord } from "../plugins/store-contracts.js";
 /** [ref] 幽灵行案的单源判别:一条 `task_notification` 只有在 **agent 族 × 终态** 时才允许打
  *  `onChildTerminal`(fleet「subagent 树」只渲 agent 子代)。`background_bash`/`monitor`/`external`
  *  不属 agent fleet 树——它们此前每条都打,fleet-bus 的「无 tick 无 claim」臂给 b\* 与 m\* handle 合成
@@ -674,24 +673,4 @@ export declare function isTerminalFleetStatus(status: FleetTaskStatus): boolean;
 export declare function runStatusToFleet(status: RunStatusForFleet, opts?: {
     awaitingPlanApproval?: boolean;
 }): FleetTaskStatus;
-/**
- * S-213③ —— **编译期同源钉**:fleet 的 `"failed"` 桶必须恰好收下 `RUN_STATUS_CLASS` 判为「非成功终局」
- * 的每一个 core 词。
- *
- * 这个词的病史:`blocked` 曾在本仓有**两个独立写者**且答案互斥 —— 本文件读它为「非成功终局(agent
- * 放弃)⇒ 行离场」,而 `observability/run-terminal.ts` 读它为「治理判决,不是失败 ⇒ 不打行」。两处
- * 各自穷举、各自正确地编译,结果是一条 `report_blocked` 的 run 在面板上离场、在引擎日志里一个字都没有。
- * 语义收归 `plugins/store-contracts.ts` 的那张表之后,本行不再自持判断:表把某个词挪出/挪进
- * `unsuccessful`(或 core 新增一个非成功终态)而上面的 switch 没跟上 ⇒ 下面这条收不敛到 `never` ⇒ tsc 红。
- * (`"error"` 是 server 自有别名、不在那张表的辖域内,故不在本钉的两边出现。)
- */
-type FleetUnsuccessfulBucket = "failed" | "blocked";
-type _GuardFleetUnsuccessfulBucket = AssertAllKeysHandled<Exclude<UnsuccessfulRunStatus, FleetUnsuccessfulBucket>>;
-/** 反向门(与 `core-keyset-guard.ts` 的 `_Guard*Reverse` 同形):桶里留了一个表**不再**判为非成功终局的
- *  词同样红 —— 只有正向门时,把 `blocked` 挪回 `succeeded` 而 switch 照旧塞进 failed 桶,并集覆盖、
- *  差集门一声不吭(本批实测:只加正向门时该变异 tsc rc=0)。两道钉一起加。 */
-type _GuardFleetUnsuccessfulBucketReverse = AssertAllKeysHandled<Exclude<FleetUnsuccessfulBucket, UnsuccessfulRunStatus>>;
-/** 占位使用(防 noUnusedLocals 形 lint;类型别名本身零运行时)。 */
-export type FleetVocabGuards = [_GuardFleetUnsuccessfulBucket, _GuardFleetUnsuccessfulBucketReverse];
-export {};
 //# sourceMappingURL=fleet-bus.d.ts.map