@sema-agent/server 7.116.1 → 7.118.0

package/dist/boot/parked-revive-gate.js

@@ -10,7 +10,7 @@ function hostGateCwd(config, localRoot) {
     return join(config.localDataRoot ?? localRoot, "parked-revive-unrooted");
 }
 export function createParkedReviveInheritedGate(deps) {
-    const { config, question, approvalExemptionStore, logger, localRoot, approverSeat, memoryEngineRoot } = deps;
+    const { config, question, logger, localRoot, approverSeat, memoryEngineRoot } = deps;
     const slots = deps.slots ?? sandboxPathEnvSlots;
     return async (row, identity) => {
         const metadata = await chainMetadataOf(deps, row, identity);
@@ -26,17 +26,7 @@ export function createParkedReviveInheritedGate(deps) {
                 ...homeBase,
             }
             : { env: createHostAdjudicationEnv(config, localRoot), ...homeBase };
-        const rootSessionId = row.rootSessionId;
-        const baseline = createApprovalBaselinePolicy(config, {
-            kind: "durable",
-            question,
-            ...(approvalExemptionStore && rootSessionId
-                ? {
-                    exempt: (toolName) => approvalExemptionStore.has(rootSessionId, toolName),
-                    onExempted: (toolName, rawToolName) => logger.info("approval_exempted", { sessionId: rootSessionId, toolName, rawToolName, leg: "parked_revive" }),
-                }
-                : {}),
-        });
+        const baseline = createApprovalBaselinePolicy(config, { kind: "durable", question });
         const governed = applyRuntimeGovernance({ objective: "", toolPolicy: baseline }, createDeploymentGovernanceInputs(config, pathAdjudication, { engineDataRoot: memoryEngineRoot }));
         return {
             parentConstraints: [

package/dist/boot/resolve-spec.js

@@ -1,6 +1,6 @@
 import { realpathSync } from "node:fs";
 import { join } from "node:path";
-import { NodeExecutionEnv, QUESTION_AWAITS_RESUME, WRITE_EXEMPT_DIR_COVERS_ROOT_CODE, deriveAskEffective, expandTiers, modePolicyOf, resolveAskSeamForm, tightenTaskSpec } from "@sema-agent/core";
+import { NodeExecutionEnv, QUESTION_AWAITS_RESUME, WRITE_EXEMPT_DIR_COVERS_ROOT_CODE, deriveAskEffective, expandTiers, modePolicyOf, resolveAskSeamForm } from "@sema-agent/core";
 import { cappedCeiling } from "../budget.js";
 import { centerPromptProvider, centerIdentityAssembled } from "../capabilities/center-prompts.js";
 import { SessionEnvironmentSelection, selectEnvironmentTool } from "../capabilities/select-environment-tool.js";
@@ -10,7 +10,7 @@ import { stampHandsLane, toolPolicyForHands } from "../capabilities/hands-lane.j
 import { buildNoticeLaneFacts, shouldDiscloseNoPersistentMemory, withNoPersistentMemoryNotice } from "../capabilities/memory-notice.js";
 import { applyLongtailDefer } from "../capabilities/tool-defer.js";
 import { assertGuardPatternsUsable, buildApprovalGrantNotice, buildOnlySensitiveBaselineWarning, createApprovalBaselinePolicy, createDeploymentGovernanceInputs } from "../deployment-governance.js";
-import { singleUserAutoAcceptBaselineApplies } from "../approval.js";
+import { gateIntentUnserviceableReason, singleUserAutoAcceptBaselineApplies } from "../approval.js";
 import { acceptShellScratchpadDir, buildEnvFacts, egressForRemoteExec, ensureScratchpadDir, resumeFactsForLane, scratchpadCoveringTaskRoot } from "../env-facts.js";
 import { FleetEventBus } from "../fleet/fleet-bus.js";
 import { composeHooks, createTaskHooks } from "../hooks/hook-runner.js";
@@ -24,9 +24,10 @@ import { isRemoteScratchpadLane, remoteScratchpadDirFor } from "../plugins/remot
 import { bindAttachmentsForTask } from "../plugins/task-attachment-store.js";
 import { resourceSuspendOptIn } from "../resource-suspend.js";
 import { isIsolatedExecEnv, routeServiceTask, supPostureOverrides } from "../router/route-orchestration.js";
+import { tightenGoverned } from "../governance-overrides.js";
 import { gateExecutionLane } from "../runtime-caps-resolver.js";
 import { applyRuntimeGovernance, stripDelegationTools } from "../runtime-governance.js";
-import { HttpError, encodeCheckpointScope } from "../security.js";
+import { HttpError, createCodedHttpError, encodeCheckpointScope } from "../security.js";
 import { memoryProjectKeyFor, memorySpecForRequest } from "../memory-scope.js";
 import { inheritEnvFieldIssue, singleMemberOffFieldIssue } from "../request-value-closure.js";
 import { a2aForScenario, mcpForScenario } from "../config-center/facade.js";
@@ -35,6 +36,7 @@ import { cwdHonored, deviceCwdHonored, effectiveHostWorkspace, inProcessSingleUs
 import { assertRequestA2aUnlocked, resolveRequestA2a } from "../task-a2a.js";
 import { assertRequestMcpContentOrigin, assertRequestMcpUnlocked, resolveRequestMcp } from "../task-mcp.js";
 import { MAX_SETTINGS_OUTPUT_STYLE_CHARS, acceptAppendSystemPrompt, applyTaskSettings, effectivePermissionMode, effectiveThinking, hasConstitutionAnchors, parseTaskSettings, taskHooksHonored, providerDropsAppend, settingsPermissionBucketIssue, withPermissionMode } from "../task-settings.js";
+import { skillDenyInertEntryOf } from "../rule-entry-list.js";
 import { enableForkFromBody, normalizeRetainSubagentSessions, selfOrchestrationFromBody } from "../task-workflow.js";
 import { redactSecrets } from "../trace/redact.js";
 import { DeferredSandboxPathEnv, isSandboxPathAdjudicationLane, sandboxPathEnvSlots } from "./deferred-sandbox-path-env.js";
@@ -63,6 +65,9 @@ export function createResolveSpec(ctx) {
     if (approvalGrantNotice)
         logger.info(approvalGrantNotice.event, approvalGrantNotice.fields);
     const resolveSpec = async (body, req, auth, opts) => {
+        const seatRefusal = gateIntentUnserviceableReason(config, checkpointStore !== undefined);
+        if (seatRefusal !== undefined)
+            throw createCodedHttpError(501, "capability.checkpoint_store_required", seatRefusal);
         assertRequestMcpUnlocked(body.mcpServers, lockedKeys);
         if (opts?.leg === "fresh")
             assertRequestMcpContentOrigin(body.mcpServers);
@@ -104,6 +109,11 @@ export function createResolveSpec(ctx) {
             if (bucketIssue)
                 throw new HttpError(400, bucketIssue.message, { code: "request.field_invalid", extra: bucketIssue.fields });
         }
+        {
+            const skillDeny = skillDenyInertEntryOf(body);
+            if (skillDeny !== undefined)
+                throw new HttpError(400, skillDeny.message, { code: "request.field_invalid" });
+        }
         assertRequestA2aUnlocked(body.a2aPeers, lockedKeys);
         const gated = await gateScenarioAndAppend(body, auth, opts);
         const effMode = effectivePermissionMode(body, gated.parsedSettings.settings);
@@ -313,7 +323,7 @@ export function createResolveSpec(ctx) {
             return false;
         if (headerStr(req?.headers["x-detach-on-disconnect"]) === "true")
             return false;
-        const askForm = resolveAskSeamForm({}, approverSeat !== undefined ? { onAsk: approverSeat } : {});
+        const askForm = resolveAskSeamForm(body.approvalReach !== undefined ? { approvalReach: body.approvalReach } : {}, approverSeat !== undefined ? { onAsk: approverSeat } : {});
         return deriveAskEffective(askForm.form, "unresolved") === "human_reachable";
     };
     const assembleSpecLiteral = (body, auth, req, opts, parts, effMode) => {
@@ -362,6 +372,7 @@ export function createResolveSpec(ctx) {
             ...(() => { const v = toolMaterializeStrategyFromBody(body.toolMaterializeStrategy); return v ? { toolMaterializeStrategy: v } : {}; })(),
             ...(typeof body.interactiveTools === "boolean" ? { interactiveTools: body.interactiveTools } : {}),
             ...(declaresInteractivePosture(body, req, opts) ? { interactionPosture: "interactive" } : {}),
+            ...(body.approvalReach !== undefined ? { approvalReach: body.approvalReach } : {}),
             ...(typeof body.oneShot === "boolean" ? { oneShot: body.oneShot } : {}),
             resilience: normalizeResilience(body.resilience, explicitOperatorOk(auth?.principal, config.operatorPrincipals)),
             finalVerification: cap.finalVerification === true || body.finalVerification === true ? true : undefined,
@@ -449,16 +460,7 @@ export function createResolveSpec(ctx) {
             a2a: resolveRequestA2a(a2aForScenario(config.a2aPeers, scenarioName), body.a2aPeers, config, logger),
             promptProvider: centerDecls ? centerPromptProvider(centerDecls, scenarioName) : cap.promptProvider,
             toolPolicy: toolPolicyForHands(hands, durableEnabled
-                ? createApprovalBaselinePolicy(config, {
-                    kind: "durable",
-                    question: liveQuestionFace,
-                    ...(approvalExemptionStore && auth?.sessionId
-                        ? {
-                            exempt: (toolName) => approvalExemptionStore.has(auth.sessionId, toolName),
-                            onExempted: (toolName, rawToolName) => logger.info("approval_exempted", { sessionId: auth.sessionId, toolName, rawToolName }),
-                        }
-                        : {}),
-                })
+                ? createApprovalBaselinePolicy(config, { kind: "durable", question: liveQuestionFace })
                 : singleUserAutoAcceptBaselineApplies(config)
                     ? createApprovalBaselinePolicy(config, { kind: "absent" })
                     : undefined),
@@ -590,7 +592,7 @@ export function createResolveSpec(ctx) {
                         ...(e.detail !== undefined ? { extra: { writeExemptDirCoversRoot: e.detail } } : {}),
                     });
                 }
-                throw new HttpError(422, `settings are tighten-only and cannot loosen the deployment policy: ${e.message}`);
+                throw new HttpError(422, `request settings cannot be applied as written: ${e.message}`);
             }
         }
         if (governed.handsReadOnly === true && Array.isArray(governed.tools)) {
@@ -667,7 +669,7 @@ export function createResolveSpec(ctx) {
             });
             logger.info("orchestration_routed", { mode: decision.mode, reason: decision.reason, sessionId: auth?.sessionId ?? null });
             if (decision.mode === "supervisor") {
-                return tightenTaskSpec(governed, supPostureOverrides());
+                return tightenGoverned(governed, supPostureOverrides());
             }
         }
         return governed;

package/dist/boot/runner-deps.d.ts

@@ -236,7 +236,7 @@ export interface RunnerDepsCtx {
 }
 /** [ref] A10 留档发现②:main runner `RunnerDeps` 与 main.ts subRunner 字面量之间此前手工重复
  * 的 ~15 个键,类型标注见 {@link createSharedRunnerDeps} 头注。 */
-export type SharedRunnerDeps = Pick<RunnerDeps, "brain" | "readFace" | "readDenyPatterns" | "readDenyBuiltinTiers" | "readDenyBuiltinExclude" | "memoryDelegationEvidence" | "memoryProvenance" | "memoryCapturePolicy" | "delegationEntryCaps" | "crossSessionInbound" | "crossSessionDialogExpiry" | "writeProtectedPaths" | "models" | "roles" | "tiers" | "pricing" | "tracer" | "promptSource" | "executionEnvFactory" | "lspManager" | "backgroundAgentStore" | "mailboxStore" | "rosterStore" | "hooks" | "toolResultStore" | "checkpointStore" | "hands" | "sessionPolicyStore" | "usageWindows" | "usageWindowStore" | "memoryScopeAdmission" | "deploymentMemoryScopes" | "sharedMemoryStores" | "compliancePostureResolver" | "lockedConfig" | "retentionPolicy" | "onNotice" | "mcpRevocations">;
+export type SharedRunnerDeps = Pick<RunnerDeps, "brain" | "readFace" | "readDenyPatterns" | "readDenyBuiltinTiers" | "readDenyBuiltinExclude" | "memoryDelegationEvidence" | "memoryProvenance" | "memoryCapturePolicy" | "delegationEntryCaps" | "crossSessionInbound" | "crossSessionDialogExpiry" | "writeProtectedPaths" | "allowedTools" | "models" | "roles" | "tiers" | "pricing" | "tracer" | "promptSource" | "executionEnvFactory" | "lspManager" | "backgroundAgentStore" | "mailboxStore" | "rosterStore" | "hooks" | "toolResultStore" | "checkpointStore" | "hands" | "sessionPolicyStore" | "usageWindows" | "usageWindowStore" | "memoryScopeAdmission" | "deploymentMemoryScopes" | "sharedMemoryStores" | "compliancePostureResolver" | "lockedConfig" | "retentionPolicy" | "onNotice" | "mcpRevocations">;
 /**
  * [ref] A10 留档发现②(review 2026-07-29,[ref]§三族A 同源修补的延续):main runner 的
  * `RunnerDeps` 字面量(下方 `createRunnerDeps`)与 `main.ts` 里 subRunner 的 `new Runner({...})`
@@ -311,8 +311,10 @@ export declare function createEngineNoticeSeat(logger: {
  * 「键为 undefined」与「键缺席」对引擎逐字等价)。**不复制引擎缺省**(`roots`/`static-face`/`carry`/`open`/
  * CC parity 20/200 一个都不抄):上游改缺省之日起本仓不会成为第二份真源。
  */
-export type DeploymentPostureSeats = Pick<RunnerDeps, "readFace" | "readDenyPatterns" | "readDenyBuiltinTiers" | "readDenyBuiltinExclude" | "memoryDelegationEvidence" | "memoryProvenance" | "memoryCapturePolicy" | "delegationEntryCaps" | "crossSessionInbound" | "crossSessionDialogExpiry" | "writeProtectedPaths">;
-export declare function buildDeploymentPostureSeats(config: Pick<ServiceConfig, keyof DeploymentPostureSeats>): DeploymentPostureSeats;
+export type DeploymentPostureSeats = Pick<RunnerDeps, "readFace" | "readDenyPatterns" | "readDenyBuiltinTiers" | "readDenyBuiltinExclude" | "memoryDelegationEvidence" | "memoryProvenance" | "memoryCapturePolicy" | "delegationEntryCaps" | "crossSessionInbound" | "crossSessionDialogExpiry" | "writeProtectedPaths" | "allowedTools">;
+/** 本族读的配置切面:席名与 config 键同名的那几席 + 运维 allow 表(席 `allowedTools` ← config `approvalGrant`,env 名 `APPROVAL_GRANT` 不改)。 */
+export type DeploymentPostureConfig = Pick<ServiceConfig, Exclude<keyof DeploymentPostureSeats, "allowedTools"> | "approvalGrant">;
+export declare function buildDeploymentPostureSeats(config: DeploymentPostureConfig): DeploymentPostureSeats;
 export declare function createSharedRunnerDeps(ctx: SharedRunnerDepsCtx): SharedRunnerDeps;
 export declare function createRunnerDeps(ctx: RunnerDepsCtx): RunnerDeps;
 //# sourceMappingURL=runner-deps.d.ts.map

package/dist/boot/runner-deps.js

@@ -9,14 +9,14 @@ import { createHardenedVmRunner } from "../orchestration/hardened-vm-runner.js";
 import { createWorkerHardenedVmRunner } from "../orchestration/hardened-vm-worker-runner.js";
 import { WorkflowAgentRegistry } from "../orchestration/workflow-agent-steer.js";
 import { resolveServedSession } from "../orchestration/workflow-completion-inbox.js";
-import { defaultEngineNoticeRouter } from "../trace/engine-notice-wire.js";
+import { defaultEngineNoticeRouter, presentNoticeDetail } from "../trace/engine-notice-wire.js";
 import { WorkflowNotifyGate } from "../orchestration/workflow-notify-journal.js";
 import { makeLoadProjectMemory, makeProbeInstructionSources } from "../project-memory.js";
 import { createInstructionSourceSeat } from "../instruction-source-notice.js";
 import { workflowModelAllowlistFor } from "../task-workflow.js";
 import { buildCrossSessionInboundLayers, crossSessionDialogExpiryOf } from "../cross-session-settings.js";
 import { createPeerDirectory } from "../peer-directory.js";
-import { targetOutsideStoreInIncident } from "../memory-store-refusal.js";
+import { storeFormRefusalInIncident } from "../memory-store-refusal.js";
 import { coreFileHistoryCaptureSeat } from "../file-history-capture.js";
 import { rewindFailureCode } from "../file-history-disclosure.js";
 export function createRunnerDepsOnAsk(toolApproval) {
@@ -41,7 +41,8 @@ const PROMPT_CACHE_BREAK_LEVELS = new Map(Object.entries(PROMPT_CACHE_BREAK_CAUS
 const CEILING_ORIGINS = new Set(["walltime", "turns"]);
 export function createEngineNoticeForwarder(logger, router = defaultEngineNoticeRouter, metrics) {
     return (notice) => {
-        logger.warn("engine_notice", { code: notice.code, message: notice.message, ...(notice.detail !== undefined ? { detail: notice.detail } : {}) });
+        const detail = presentNoticeDetail(notice.code, notice.detail);
+        logger.warn("engine_notice", { code: notice.code, message: notice.message, ...(detail !== undefined ? { detail } : {}) });
         if (metrics !== undefined && notice.code === "task.interrupt_unconsumed") {
             const origin = notice.detail?.origin;
             if (typeof origin === "string" && CEILING_ORIGINS.has(origin))
@@ -68,6 +69,7 @@ export function buildDeploymentPostureSeats(config) {
         crossSessionInbound: Object.keys(crossSessionLayers).length > 0 ? crossSessionLayers : undefined,
         crossSessionDialogExpiry: crossSessionDialogExpiryOf(config),
         writeProtectedPaths: config.writeProtectedPaths?.entries,
+        allowedTools: config.approvalGrant.length > 0 ? config.approvalGrant : undefined,
     };
     return seats;
 }
@@ -195,7 +197,7 @@ export function createRunnerDeps(ctx) {
                 if (report.patches)
                     metrics.inc("memory_harvest_patches_total", { phase: info.phase }, (report.patches.add ?? 0) + (report.patches.update ?? 0));
                 if (report.incident) {
-                    const code = targetOutsideStoreInIncident(report.incident);
+                    const code = storeFormRefusalInIncident(report.incident);
                     logger.warn("memory_harvest_incident", { kind: report.incident.kind, phase: info.phase, ...(code !== undefined ? { code } : {}) });
                 }
                 const byCode = new Map();

package/dist/boot/stage-07-capability-layer.js

@@ -64,7 +64,7 @@ export async function runStage07(ctx) {
                 newId: uuidv7,
             });
             if (converged > 0)
-                logger.warn("user_input_ledger_crash_converged", { converged, note: "steers accepted with 200 \"applied\" by a previous process that ended before its run settled were converged as cause:crashed; each session's next run announces them (task.user_steer_undrained) and GET /v1/sessions/:id lists them under userInputUndrained" });
+                logger.warn("user_input_ledger_crash_converged", { converged, note: "steers accepted with 200 \"applied\" by a previous process that ended before its run settled were converged as cause:crashed; each session's next run announces them (task.user_steer_undrained, or task.user_followup_undrained for steers queued with priority later) and GET /v1/sessions/:id lists them under userInputUndrained" });
             return ledger;
         })()
         : undefined;
@@ -166,7 +166,7 @@ export async function runStage07(ctx) {
     const parkedReviveSurface = checkpointStore && backgroundAgentStore && builtinDefaultScenario ? createParkedReviveSurface(builtinDefaultScenario) : undefined;
     const parkedReviveInheritedGate = parkedReviveSurface && config.durableApproval
         ? createParkedReviveInheritedGate({
-            config, question, approvalExemptionStore, logger, localRoot,
+            config, question, logger, localRoot,
             memoryEngineRoot: memoryEngine?.root,
             approverSeat: createRunnerDepsOnAsk(toolApproval),
             ...(runnerDeps.runtimeCapsResolver ? { resolveRuntimeCaps: runnerDeps.runtimeCapsResolver } : {}),

package/dist/brain.d.ts

@@ -11,7 +11,8 @@ import { type RestartSliceCtx } from "./config-center/restart-signal.js";
  */
 export declare const FAST_FAIL_MAX_RETRIES = 2;
 /**
- * Build the external "Brain" (LLM) from config.
+ * Build the external "Brain" (LLM) from config — and hand out, from the same assembly, the one reading that only the assembly knows: which
+ * reactive-degrade target the shell welded ({@link BrainAssembly.degradeRoute}). {@link createBrain} is the projection for callers that need only the brain.
  *
  * Composition (A1 + the 1.38 resilience stack, ordered timeout-innermost → breaker → failover-outermost):
  *   - **Tiered timeouts** (1.38; re-cut by core 7.33.0 along the segments of a call) are passed into each
@@ -39,6 +40,16 @@ export declare const FAST_FAIL_MAX_RETRIES = 2;
  * transport's header / body clocks off too). The Model itself (id / contextWindow / maxTokens / provider) flows
  * per-request through `Runner({ models })`.
  */
+export declare function createBrainAssembly(config: ServiceConfig, deps?: {
+    fetchImpl?: typeof fetch;
+    breakerState?: BreakerState;
+}): BrainAssembly;
+/** {@link createBrainAssembly} 的产物:组好的 brain + 它的降级壳席(只有组装本身知道壳焊的是哪一只)。 */
+export interface BrainAssembly {
+    readonly brain: Brain;
+    readonly degradeRoute: DegradeRouteWatch;
+}
+/** 只要 brain 的调用方(`run-local` / 旁路 lane / 测试台架)的投影 —— 与 {@link createBrainAssembly} 同一次组装。 */
 export declare function createBrain(config: ServiceConfig, deps?: {
     fetchImpl?: typeof fetch;
     breakerState?: BreakerState;
@@ -84,16 +95,14 @@ export declare function degradeCredentialIdentityOf(config: Pick<ServiceConfig,
  * 没有焊壳(车道没开 / 没有目标)⇒ `null`。在场 ↔ 缺席的翻转因此自然是一次变化。
  */
 export declare function degradeRouteFingerprint(config: DegradeRoutePlane): unknown;
-/** `degrade-route` 片的席:boot 焊进去的那一只 vs 活配置此刻的同一只目标(`restartReasons` 的 `degradeRoute` 两侧读数)。 */
+/**
+ * `degrade-route` 片的席:boot 焊进去的那一只 vs 活配置此刻的同一只目标(`restartReasons` 的 `degradeRoute` 两侧读数)。`baked` 在 {@link createBrainAssembly}
+ * 焊壳的那一处算好、随装配产物交出 —— 不再有「紧随 createBrain 再捕获一次」的第二个出处。与 boot/memory-consolidation.ts `createConsolidationValveWatch` 同形
+ * (`{ read(): { baked, current } }`)。
+ */
 export interface DegradeRouteWatch {
     read(): NonNullable<RestartSliceCtx["degradeRoute"]>;
 }
-/**
- * `create*`:返回带捕获状态(组壳那一刻的指纹)的活对象。**须在 {@link createBrain} 的同一时刻、同一份 config 上调**
- * (生产:boot/budget-tracing.ts 紧随 createBrain)—— 否则 `baked` 就不是壳真焊进去的那一只。与 boot/memory-consolidation.ts
- * `createConsolidationValveWatch` 同形(`{ read(): { baked, current } }`)。
- */
-export declare function createDegradeRouteWatch(config: DegradeRoutePlane): DegradeRouteWatch;
 /**
  * S-753 复审(opus F2 + codex C1)—— **failover 拓扑 × 首字节段没有部署窗**的启动期披露(纯数据,`build*`;告警由 boot 出)。
  *

package/dist/brain.js

@@ -38,7 +38,7 @@ function constructRouteBrain(label, sourceUrls, construct) {
     }
 }
 const DEFAULT_RESILIENCE = buildDefaultResilience();
-export function createBrain(config, deps = {}) {
+export function createBrainAssembly(config, deps = {}) {
     const { fetchImpl, breakerState } = deps;
     const r = config.resilience ?? DEFAULT_RESILIENCE;
     const timeouts = {
@@ -95,11 +95,13 @@ export function createBrain(config, deps = {}) {
     let brain = anthropicBrain
         ? createRoutingBrain({ anthropic: anthropicBrain }, { fallback: gatewayBrain })
         : gatewayBrain;
+    let degradeBaked = null;
     if (config.degrade?.reactive) {
         const degradeTo = config.degrade.to;
         const fallbackModel = degradeTargetOf(config);
         if (fallbackModel) {
             const credential = degradeCredentialIdentityOf(config, fallbackModel);
+            degradeBaked = degradeWeldFingerprint(config, fallbackModel, credential);
             const ownEnvRef = credential.apiKeyEnv !== undefined ? { [fallbackModel.name]: credential.apiKeyEnv } : {};
             const ownSealed = credential.sealed !== undefined ? { [fallbackModel.name]: credential.sealed } : {};
             const fbOwnApiKey = () => resolveModelApiKey(fallbackModel.name, ownEnvRef, process.env, ownSealed);
@@ -139,7 +141,10 @@ export function createBrain(config, deps = {}) {
             });
         }
     }
-    return createModelReachBrain(brain);
+    return { brain: createModelReachBrain(brain), degradeRoute: { read: () => ({ baked: degradeBaked, current: degradeRouteFingerprint(config) }) } };
+}
+export function createBrain(config, deps = {}) {
+    return createBrainAssembly(config, deps).brain;
 }
 export function degradeTargetOf(config) {
     return config.degrade?.reactive ? config.models?.[config.degrade.to] : undefined;
@@ -159,7 +164,9 @@ export function degradeRouteFingerprint(config) {
     const target = degradeTargetOf(config);
     if (target === undefined || config.degrade === undefined)
         return null;
-    const credential = degradeCredentialIdentityOf(config, target);
+    return degradeWeldFingerprint(config, target, degradeCredentialIdentityOf(config, target));
+}
+function degradeWeldFingerprint(config, target, credential) {
     return {
         model: catalogEntryFingerprint(target),
         endpoint: openaiRouteBaseUrl(target.baseUrl, config.gatewayBaseUrl) ?? null,
@@ -174,10 +181,6 @@ function sealedIdentityFingerprint(sealed) {
         return { poisoned: modelKeyPoisonIdentity(sealed), reason: sealed.reason };
     return { digest: createHash("sha256").update(sealed, "utf8").digest("hex").slice(0, 16) };
 }
-export function createDegradeRouteWatch(config) {
-    const baked = degradeRouteFingerprint(config);
-    return { read: () => ({ baked, current: degradeRouteFingerprint(config) }) };
-}
 export function buildFailoverFirstByteNotice(config) {
     const r = config.resilience ?? DEFAULT_RESILIENCE;
     const fallbacks = config.gatewayFallbackUrls.length;

package/dist/capabilities/hands-lane.d.ts

@@ -33,6 +33,31 @@ export interface HandsRunnerPair {
 }
 /** 按场景表态取 Runner。**穷举 switch**:`ScenarioHands` 加词而此处不改 = 编译错(无 default 臂)。 */
 export declare function pickHandsRunner(hands: ScenarioHands, pair: HandsRunnerPair): Runner;
+/**
+ * core 手带 band 的工具名**全集** —— 「挂 executionEnvFactory 才出现、不挂就消失」的那一批。
+ *
+ * 两段来源,都不是拍脑袋:
+ *  · `handBandEffects()`(core 7.8.0 B1 起的导出面;此前是手抄表常量 `HAND_TOOL_EFFECTS`)—— band 的
+ *    effect 表,由**静态工具目录**按 `mountedBy.includes("hands")` 派生。名册单源之后这张表不再是一张
+ *    手抄名表,加/退工具由目录一处说了算。
+ *  · 下方锚定补集 —— `createHandsToolkit` / 手带块还会铸但**不在** effect 表里的 5 名(实测差集,见
+ *    test/scenario-hands-lane.test.ts 的对表格:它用真 Runner 跑「有手 roster ∖ 无手 roster」,与本常量逐名对账,
+ *    core 加/改 band 成员时红,防漂移)。
+ *
+ * ⚠️ 本全集是**观测口径**(用于防漂移对账),**不是** deny 名单 —— deny 用下面的
+ * {@link HANDS_EXCLUSIVE_TOOL_NAMES},理由见那里。
+ *
+ * 🚨 [ref] P0(2026-08-09):派生时必须过滤 core 的 `RETIRED_TOOL_NAMES` —— core 5.21.0 的
+ * `HAND_TOOL_EFFECTS` 里残留已退役的 `MultiEdit`,而 core `prepare-task` 的策略名审计见退役名
+ * **无条件 throw**(`config.legacy_tool_name`);不过滤,deny 名单一进 `spec.toolPolicy`,
+ * `hands: none` 三场景(scan/code-review/team)在**所有部署**上零 turn 全灭。core 5.21.1 已删
+ * 那条死条目([ref]),这道 filter 是结构性防御:将来 core 再退役任何 band 名都不会重演
+ * (test/scenario-hands-lane.test.ts 格7/格8 双钉:真 Runner 过审计 + 零交集门)。
+ * filter 打在**整表**(effect 表 + 锚定补集)之后 —— caret floor 下装置会解析到更新的 core,
+ * 补集名哪天被退役,只滤前半就是同一次故障换个名字(codex 复审 finding,2026-08-09)。
+ * S-1047(core 7.41.0 #1156):判据换成 core 导出的**那一只** `judgeRuleToolName`(策略名审计、会话规则店、本仓写口与配置表同调)——
+ * 修前这里直读 `RETIRED_TOOL_NAMES` 表,是本仓第三份「这是不是旧名」的手写判据。名册 = 空集(这张 deny 名单不挂在任何一跑的名册上判)。
+ */
 export declare const HANDS_BAND_TOOL_NAMES: readonly string[];
 /**
  * band 里**只有手才可能出现**的那批(= deny 名单)。

package/dist/capabilities/hands-lane.js

@@ -1,4 +1,5 @@
 import { handBandEffects, judgeRuleToolName, combinePolicies, createAllowDenyPolicy } from "@sema-agent/core";
+import { NO_DECLARED_TOOL_NAMES } from "../namespaced-rule-name.js";
 export function withoutExecutionEnv(deps) {
     const { executionEnvFactory: _handsDropped, ...rest } = deps;
     return rest;
@@ -11,7 +12,6 @@ export function pickHandsRunner(hands, pair) {
             return pair.handsless;
     }
 }
-const NO_DECLARED_TOOL_NAMES = new Set();
 export const HANDS_BAND_TOOL_NAMES = Object.freeze([
     ...handBandEffects().keys(),
     "SendMessage",

package/dist/capabilities/mcp-probe.d.ts

@@ -79,7 +79,7 @@ export declare const MCP_PROBE_MAX_INFLIGHT = 32;
  *
  * 🔴 **不是新旋钮**:没有 env、不进 config-catalog、部署方改不了它 —— 「不新铸旋钮」这条要求管的是
  * **旋钮**,不是常量。数值与既有 `GET /v1/sessions/:id/mcp` 面板的物化上界同阶(那边 10s),而**名字刻意
- * 独立**:本仓 `sessions.ts` 的四枚同族时限逐字写着理由 ——「两条腿的物化成本不同族,将来任一侧调窗时不该
+ * 独立**:本仓 `sessions.ts` 的同族时限(MCP / A2A / memory-status 各一枚)逐字写着理由 ——「两条腿的物化成本不同族,将来任一侧调窗时不该
  * 被另一侧的名字绑架」。那边界的是**整次物化**,这边界的是**每台的裁决**,连语义都不是一回事。
  *
  * ⚠️ core 的硬条款(d.ts 逐字):`timeoutMs` 界**裁决**不界**拨号** —— 被时钟放弃的那次拨号仍在跑,
@@ -99,7 +99,7 @@ export declare const MCP_PROBE_VERDICT_TIMEOUT_MS = 10000;
  * 与 core 自己成文的走查时长公式**逐字同形**(d.ts:"its own duration is those per-dial times summed over
  * `ceil(n / concurrency)` rounds"),所以在一台**对端会答或会失败**的部署上这口钟结构上摸不到 —— 摸到它
  * 就是真有一台对端在卡发送。读数:1 台 ⇒ 14s;32 台 ⇒ 44s。
- * 兄弟先例:`GET /v1/sessions/:id/mcp` 面板的 `MCP_MATERIALIZE_TIMEOUT_MS`(那边界的也是整次物化,但它是
+ * 兄弟先例:`GET /v1/sessions/:id/mcp` 面板的 `MCP_DIAL_DEADLINE_MS`(`http/mcp-dial-deadline.ts`;那边界的也是整次物化,但它是
  * 一个定值;本面的申报条数由调用方决定,所以定值在这里就是那个「与所问无关的宽限」)。
  * **纯数据** ⇒ `build*`。
  */

package/dist/config-catalog.js

@@ -11,6 +11,7 @@ import { MODEL_PROVIDER_WORDS } from "./model-provider.js";
 import { buildDisplaySafeUrl } from "./trace/redact.js";
 import { describeAllowlistPostures } from "./env-name-allowlist-knobs.js";
 import { buildOutboundProxyPosture } from "./outbound-dispatcher.js";
+import { modelSupportsImages } from "./model-select.js";
 export const CATALOG_VALUE_TYPES = ["boolean", "number", "string", "enum", "csv", "json", "path", "url", "secret", "opaque"];
 export const CATALOG_TIMINGS = ["hot", "restart", "deploy", "inert"];
 export const CATALOG_DANGER_AXES = ["security", "billing", "data"];
@@ -58,7 +59,7 @@ export const CONFIG_CATALOG = [
     r("ANTHROPIC_VERSION", "modelPlane", "string", "Anthropic API version 头(缺省由 SDK 定)"),
     r("APPROVAL_AUTO_BUDGET", "approval", "number", "每 run-leg 自动放行的普通门控工具调用数上限(0=关;防审批循环的熔断,不是安全 ask 的帽)", { staticDefault: "0", danger: SEC, configKey: "approvalAutoBudget" }),
     r("APPROVAL_DENY", "approval", "csv", "始终拒绝的工具名单(装配期拒不可匹配名)", { danger: SEC, configKey: "approvalDeny" }),
-    r("APPROVAL_GRANT", "approval", "csv", "运维的 allow 规则(工具名规则:精确名 / mcp__<server>__* / a2a__<peer>__*;命中 = 带理由放行,不再为这些调用出「没人表态」卡(不放掉任何一层自己的问);HTTP 提交 / durable 续跑 / 停驻后台 agent 赎回 / run-local 四腿同装(leader worker 首跑与修复腿到不了);不越过任何一层的 deny / ask;不是白名单;坏值拒启)", { danger: SEC, configKey: "approvalGrant", derivedDefaultNote: "缺席 = 空表(本层不表态,折叠与未设逐字同)" }),
+    r("APPROVAL_GRANT", "approval", "csv", "运维的 allow 表(引擎 allow 层的部署成员 RunnerDeps.allowedTools,每只 Runner 同一席:HTTP 提交 / 续跑 / 停驻赎回 / run-local / leader 一律;规则文法 = 引擎的:工具名 / mcp__<server>__* / a2a__<peer>__* / Bash(<命令>) / Bash(<前缀>:*) / Read(//<dir>/**);命中 = 免问,清普通问与没人表态两类,内置工具也在内;清不掉任何一层的 deny / ask 规则、APPROVAL_NEVER_AUTO、shell 地板、写保护、治理、hook 的问、plan;不是白名单;引擎读成空的条目 / 服务器段铸不出 ⇒ 拒启)", { danger: SEC, configKey: "approvalGrant", derivedDefaultNote: "缺席 = 空表(本层不表态,折叠与未设逐字同)" }),
     r("APPROVAL_HMAC_KEYS", "approval", "secret", "直连门(D-G)HMAC 完整性密钥集(空=直连门不激活)", { danger: SEC }),
     r("APPROVAL_NEVER_AUTO", "approval", "csv", "永不被 AUTO_BUDGET 自动放行的工具集(不可逆动作恒要人)", { danger: SEC, configKey: "approvalNeverAuto" }),
     r("APPROVAL_REQUIRE", "approval", "csv", "必须人审的工具名单(F4 门;center 腿热:refresh 拍整表换代,无 checkpoint 店的部署发非空名单 ⇒ 审批组整组拒)", { danger: SEC, configKey: "approvalRequire", center: cGov("approvalRequire") }),
@@ -318,7 +319,7 @@ export const CONFIG_CATALOG = [
         },
     }),
     r("MODEL_VERIFIER", "modelPlane", "string", "verify 门的异构 verifier(须命中目录;typo 回 default 并 boot warn=自评自批)", { derivedDefaultNote: "缺席/不在目录 ⇒ default(=implementer,去相关性失效警告)" }),
-    r("MODEL_VISION", "modelPlane", "boolean", "主模型 vision 声明(false 让 model_no_vision 预检真拦)", { staticDefault: "true", resolve: (c) => (Array.isArray(c.model.input) ? c.model.input.includes("image") : true), center: cModels("models[].vision") }),
+    r("MODEL_VISION", "modelPlane", "boolean", "主模型 vision 声明(false = 明说不收图:带图请求的图被换成占位句交给模型,提交时计数并告警)", { staticDefault: "true", resolve: (c) => modelSupportsImages(c.model), center: cModels("models[].vision") }),
     r("MYSQL_DATABASE", "store", "string", "MySQL 协议库名(选中该引擎时必填)", { danger: DATA }),
     r("MYSQL_HOST", "store", "string", "MySQL 协议主机(在场即算 SQL 信号,参与 DB_BACKEND 默认推导)", { danger: DATA }),
     r("MYSQL_PASSWORD", "store", "secret", "MySQL 协议口令", { danger: SEC }),

package/dist/config-center/apply-effective.d.ts

@@ -81,7 +81,7 @@ export declare function applyEffective(config: ServiceConfig, eff: EffectiveConf
  * 读者一律从这里派生,禁手抄:
  *  · stage:{@link stageModelPlane} 产出组内**每个**域的产物({@link ModelPlaneStages} 按本表映射),组被拒 ⇒ 一个域都没有;
  *  · 世代账:整组拒的 `keys` 与落地的 `applied` 都由 {@link MODEL_PLANE_SURFACES} 按本表派生({@link modelPlaneGroupReport});
- *  · boot 按组回落 LKG 的合成文档与 restart 基线:{@link withModelPlaneOf}(`boot/config-center.ts`)。
+ *  · boot 按组回落 LKG 的合成文档:{@link withModelPlaneOf}(`boot/config-center.ts`)。
  * (与 `config.ts` 的配置组视图 `MODEL_PLANE_GROUP_KEYS` 不是一回事:那是 `ServiceConfig` 的分节视图;这里是「中心热应用的
  * 模型面这一组包含哪些 effective 域」。)
  */
@@ -91,29 +91,19 @@ export type ModelPlaneDomain = (typeof MODEL_PLANE_DOMAINS)[number];
 export type ModelPlaneOf = Pick<EffectiveConfig, ModelPlaneDomain>;
 /**
  * `target` 换上 `source` 的**整个模型面**(组内每个域都取 `source` 的;`source` 缺席的域在结果里同样缺席,不留 `target` 的),
- * 其余域原样是 `target` 的。boot 按组回落 LKG 的两处(回落 apply 的合成文档、restart 对照基线)都走这一只 —— 禁在调用点
+ * 其余域原样是 `target` 的。boot 按组回落 LKG 的合成文档(回落 apply 的入参)走这一只 —— 禁在调用点
  * 手写 `{ ...x, models, collab }`(漏一个域正是 V1 的病形)。纯数据:不改两个入参。
  */
 export declare function withModelPlaneOf<E extends EffectiveConfig>(target: E, source: ModelPlaneOf): E;
-/**
- * **boot 快照**(restart 片的对照基线,`boot/config-center.ts` 的 `effective`)= 本次 boot 读到的那份(`read`:拉到的候选,或读回的盘上 LKG)
- * 换上**真落地**的模型面 —— `appliedPlane` 是模型面组真落地的那一代(`read` 自己 / 按组回落的 LKG),`undefined` = 组被拒且没有可用的上一代
- * (进程服务的是 env 表 ⇒「没有中心模型面」)。其余域恒是 `read` 的。
- *
- * boot 的两条落地路径(候选拉取、整份 LKG 读回)都经这一只,禁在调用点各写一份:S-789 的病形正是这句只在候选路径上成立(2d09c8e6),
- * LKG 读回路径把被拒的 LKG 目录记成基线 ⇒ 修好的目录换掉降级目标时零 `degrade-route`,boot 焊死的降级壳永远指着 env 端点。
- * S-794 起 `degrade-route` 片不再读快照的目录(改读降级壳 boot 焊的那只目标 vs 活配置,brain.ts `createDegradeRouteWatch`)——今天没有
- * 重启片读快照的模型面;本函数保证的是快照本身说真话(进程真在服务的那一代),不让下一个读它的片重演 S-789。
- * 纯数据:不改入参;模型面就是 `read` 自己那一代 ⇒ 原样交回(同一引用)。
- */
-export declare function bootSnapshotOf<E extends EffectiveConfig>(read: E, appliedPlane: ModelPlaneOf | undefined): E;
 /**
  * E-1(7.103.1 修复轮,opus 腿):boot 读到的这一代**整套落地**了吗 —— 只有整套落地的那一代才可以成为 LKG(`latestEffective` /
  * 盘上 LKG 候选)、才让它的 ETag 做条件请求(§9.5-2 + codex R2-F1)。三件同判,缺一不算:读腿没报坏域(`domainErrors`)、
  * prompts 面过候选门同一只判形、apply 报告没有被整拒的组(`fullyApplied`;报告缺席 = 没 apply,dry-run 只判前两件)。
- * boot 的两条落地路径(候选拉取、整份 LKG 读回)都调这一只,禁在调用点各写一份(此前候选路径三件、LKG 路径只抄了一件)。
+ * boot 的两条落地路径(候选拉取、整份 LKG 读回)与 refresh / 迟到 boot 两腿的 apply 之后都调这一只,禁在调用点各写一份(此前候选路径三件、LKG 路径只抄了一件,
+ * refresh / 迟到 boot 两腿各内联了第三件)。
  * LKG 读回路径上前两件在上游已有门(`loadLkg` 的载荷复判拒坏 prompts;读回不产 `domainErrors`),这里同判是同一条规则的同一只谓词,
- * 不是第二道门。refresh / 迟到 boot 两腿的候选门在 apply **之前**整拒坏域与坏 prompts(拒的是整份候选,不只是 LKG 推进),不走本谓词。
+ * 不是第二道门。refresh / 迟到 boot 两腿的候选门在 apply **之前**整拒坏域与坏 prompts(拒的是整份候选,不只是 LKG 推进),所以到 apply 之后那两腿调本谓词时
+ * 前两件恒真、实判的是 `fullyApplied` 一件 —— 调它是为了「干净落地」只有这一个读法,不是再加一道门。
  */
 export declare function fullyLandedForLkg(read: {
     readonly effective: EffectiveConfig;

package/dist/config-center/apply-effective.js

@@ -207,12 +207,6 @@ function takeModelPlaneDomain(out, source, d) {
     else
         out[d] = v;
 }
-function buildEnvOnlyModelPlane() {
-    return { models: { models: [], roles: {} } };
-}
-export function bootSnapshotOf(read, appliedPlane) {
-    return appliedPlane === read ? read : withModelPlaneOf(read, appliedPlane ?? buildEnvOnlyModelPlane());
-}
 export function fullyLandedForLkg(read, report) {
     const prompts = read.effective.prompts;
     return (read.domainErrors ?? []).length === 0 && (prompts === undefined || validatePromptsDomain(prompts).ok) && report?.fullyApplied !== false;

package/dist/config-center/facade.d.ts

@@ -48,7 +48,7 @@
  * importers to update, which was done in the same commit.
  */
 export { fetchEffective, fetchPrincipalCaps, fetchPrincipalOrgMemory, ConfigCenterHttpError, fetchSkillContent, fetchPromptArtifact, fetchPromptBlob, } from "./http-client.js";
-export { mutateInPlace, applyEffective, type ApplyReport, applyRuntimeGates, applyRuntimeHot, resolveDefaultModelName, logEffectiveDiff, MODEL_PLANE_DOMAINS, type ModelPlaneDomain, type ModelPlaneOf, withModelPlaneOf, bootSnapshotOf, fullyLandedForLkg, } from "./apply-effective.js";
+export { mutateInPlace, applyEffective, type ApplyReport, applyRuntimeGates, applyRuntimeHot, resolveDefaultModelName, logEffectiveDiff, MODEL_PLANE_DOMAINS, type ModelPlaneDomain, type ModelPlaneOf, withModelPlaneOf, fullyLandedForLkg, } from "./apply-effective.js";
 export { restartReasons, modelPlaneChanged, type RestartSlice, type RestartSliceCtx, type EngineRestartSignal, } from "./restart-signal.js";
 export { applyCenterSkills, resolveMcpServers, mcpForScenario, resolveA2aPeers, a2aForScenario } from "./skills-mcp.js";
 export { applyCenterReadFace, CENTER_READ_FACE_LIVE_KEYS, type CenterReadFaceApply, type CenterReadFaceReport, type ReadFaceBaseline } from "./read-face.js";

package/dist/config-center/facade.js

@@ -1,5 +1,5 @@
 export { fetchEffective, fetchPrincipalCaps, fetchPrincipalOrgMemory, ConfigCenterHttpError, fetchSkillContent, fetchPromptArtifact, fetchPromptBlob, } from "./http-client.js";
-export { mutateInPlace, applyEffective, applyRuntimeGates, applyRuntimeHot, resolveDefaultModelName, logEffectiveDiff, MODEL_PLANE_DOMAINS, withModelPlaneOf, bootSnapshotOf, fullyLandedForLkg, } from "./apply-effective.js";
+export { mutateInPlace, applyEffective, applyRuntimeGates, applyRuntimeHot, resolveDefaultModelName, logEffectiveDiff, MODEL_PLANE_DOMAINS, withModelPlaneOf, fullyLandedForLkg, } from "./apply-effective.js";
 export { restartReasons, modelPlaneChanged, } from "./restart-signal.js";
 export { applyCenterSkills, resolveMcpServers, mcpForScenario, resolveA2aPeers, a2aForScenario } from "./skills-mcp.js";
 export { applyCenterReadFace, CENTER_READ_FACE_LIVE_KEYS } from "./read-face.js";

package/dist/config-center/restart-signal.d.ts

@@ -6,7 +6,7 @@ export type RestartSlice = "skills" | "mcp" | "a2a" | "scenarios" | "degrade-rou
  *  EffectiveConfig. Absent/empty = that lane is off ⇒ its slice is inert (null on both sides). */
 export interface RestartSliceCtx {
     /** S-794:反应式降级壳的两侧读数 —— `baked` = createBrain 组壳那一刻焊进去的目标路由指纹,`current` = 同一只
-     *  指纹函数(brain.ts `degradeRouteFingerprint`)对本拍活配置再读一次(读法见 brain.ts `createDegradeRouteWatch`)。
+     *  指纹函数(brain.ts `degradeRouteFingerprint`)对本拍活配置再读一次(`baked` 的出处见 brain.ts `createBrainAssembly`)。
      *  缺席 = 调用方没有递席(单元调用)⇒ `degrade-route` 片恒不签;车道没开 / 没焊壳在席内表达为两侧同为 null。
      *  (此前的 `reactiveDegradeTo` 位只剩「阀门开着」一义,已并进本席 —— 一位不留两义。) */
     degradeRoute?: {

package/dist/config-types.d.ts

@@ -1325,22 +1325,18 @@ export interface ServiceConfigFlat {
      *  从未进入任何 policy。判定现在单源在 `hasOperatorGateIntent()`(与 inv#2 同文件)。 */
     approvalNeverAuto: string[];
     /**
-     * 7.115.0 —— **运维的 allow 规则**(`APPROVAL_GRANT`,逗号分隔的工具名规则:精确名 / `mcp__<server>__*` / `a2a__<peer>__*`)。命中 = 带理由的
-     * 放行(core `decisionReason: "rule"`,运维替这些调用表了态 —— 回答没人表态的服务器工具 / A2A 技能调用;内置工具上引擎的写门、shell 检查照问);未命中 = 不表态。与请求腿的 `settings.permissions.allow` 是**同一种东西**:
-     * 同一只编译口(`permission-rule-list.ts` `createRuleListPolicy`)、同一只校验(`config.ts` `approvalGrantRefusal` → `unmatchableToolNamesRefusal`,
-     * 坏值拒启)。施加点 = 部署治理链的单一构造口(`deployment-governance.ts` → `runtime-governance.ts` `applyRuntimeGovernance` 的一片叶),
-     * 所以 HTTP 提交 / durable 续跑(含 leader worker 停驻后经 `/decide` 续跑的那一段)/ 停驻后台 agent 的跨副本赎回 / run-local 四条腿同装(leader worker 首跑与修复腿到不了),每次现取(不 memoize)。**不越过**任何一层的 deny / ask(折叠 deny > ask > allow)。
-     *
-     * ⚠️ 不是白名单:名字不叫 `…_ALLOW`,与会话规则的 `toolAllow`(「只许这些」)刻意分开 —— 本键只给出表态,不收窄任何东西。
-     *
-     * 三问:谁需要 = 在没有请求体的腿上接了 MCP 服务器的运维 —— `run-local`,以及 durable 续跑(每一次从持久化体重建,含 leader worker 停驻后经 `/decide`
-     * 续跑的那一段;A2A 不在射程:运维声明的对端恒带外发标记,那一问本键不放) —— core 7.40.0 起没人表态的服务器工具调用要问,无席 ⇒ 拒、有 durable 席 ⇒ 每次停驻等人,
-     * 这里是运维为自己接的服务器表态的唯一位置。**到不了**:leader worker 的首跑与修复腿(工具策略在 leader 编排里自己折出来 —— `leader/wire.ts` 的
-     * `combinePolicies(createDurableQuestionPolicy(), createDurableAskPolicy(…))` —— 不经上面那只构造口);这两条腿今天不挂 MCP / A2A,本键在那里没有对象。谁受伤 = 缺省空表,无人受伤 —— 设了宽规则
-     * (`mcp__<server>__*`,含那台服务器将来新增的工具)= 对**每一个租户、每一条腿**的那些调用都不再因「没人表态」而问人,风险随规则的宽度走
-     * (射程只到这一问:任何一层自己的问照旧压过它 —— 内置工具的精确名写进来,引擎的写门 / 形状层照问);补偿 = 本键就是
-     * core 7.40.0 那条收紧的补偿,deny / ask(`APPROVAL_DENY` / `APPROVAL_REQUIRE` / 请求 settings / 会话规则)照旧压过它。
-     * v1 只有 env 一个写入通道(无 config-center 座位,不进 settings-schema)。空表 = 本层不铸叶,折叠逐字与修前同。
+     * **运维的 allow 表**(`APPROVAL_GRANT`,逗号分隔的 allow 规则)—— 7.117.0(core 7.42.0)起是引擎 allow 层的**部署成员** `RunnerDeps.allowedTools`:
+     * 经部署姿态座席族(`boot/runner-deps.ts` `buildDeploymentPostureSeats`)交给本进程造的每一只 Runner(boot / run-local / leader),Runner 构造时读一次。
+     * 命中 = 免问(core `decisionReason: "deployment_rule"`),清「普通问 + 没人表态」两类,内置工具也在内;清不掉任何一层的 deny、ask 规则、运维的强制类
+     * (`APPROVAL_NEVER_AUTO` / `MANUAL_MODE_SHELL_GATE=always` / 写保护 / 治理)、hook 的问、plan 的问。文法 = 引擎的(工具名 / 协议名覆盖形 / `Bash(...)` 命令规则 /
+     * `Read(//dir/**)`);坏值拒启(`config.ts` `approvalGrantRefusal`:不是字符串表 / 协议名对端段铸不出 / 引擎读成空的条目)。
+     *
+     * ⚠️ 不是白名单:名字不叫 `…_ALLOW`,与会话规则的 `toolAllow`(「只许这些」)刻意分开 —— 本键只放,不收窄任何东西。
+     *
+     * 三问(7.117.0 语义变宽):谁需要 = 没有请求体的腿(`run-local` / leader)上接了 MCP 服务器、或想一句话放掉自家某只工具的运维;谁受伤 = 表里写了内置工具名的部署
+     * (7.115.0–7.116.x 本键只回答「没人表态」,`Bash` / `Write` 写进来什么也不放;本版起这两只不再问);补偿 = 起服行 `approval_grant_in_force` 的 note 写着当前效果、
+     * `GET /v1/diagnostics/wiring` 的 `serverGates.approvalGrant`、`MIGRATION.md` 升级前必读一段;要某只工具必须问,用上面那几只本键清不掉的旋钮。
+     * v1 只有 env 一个写入通道(无 config-center 座位,不进 settings-schema)= 进程常量,与 Runner 席位的寿命一致。空表 = 席位缺席(引擎读作「部署没有 allow 规则」)。
      */
     approvalGrant: string[];
     /** [ref] D-G (HMAC = integrity, not identity; ✅ WIRED — the "SCAFFOLD, not yet wired" note here was STALE,