@sema-agent/server 7.131.0 → 7.133.0

package/dist/config-invariants.js

@@ -34,19 +34,28 @@ export function halfOpenDirectDoorRefusal(v) {
     if (!v.principalJwtAud)
         missing.push("PRINCIPAL_JWT_AUD");
     if (v.operatorPrincipals.length === 0)
-        missing.push("OPERATOR_PRINCIPALS (else isOperator is true-for-all)");
+        missing.push("OPERATOR_PRINCIPALS (an empty list means no operator, and the direct door's operator faces need named operators)");
     if (!v.requirePrincipal)
         missing.push("REQUIRE_PRINCIPAL=true (a direct door is multi-tenant; without it an absent principal is anonymous and the self-asserted header governs owner/quota checks)");
     return missing.length > 0 ? `DIRECT_APPROVAL_DOOR=true but D-G anchors are missing: ${missing.join(", ")} — refusing to start a half-open direct door (design/80 D-G boot invariant)` : undefined;
 }
 export function operatorPrincipalsRequiredRefusal(v) {
     return v.durableApproval === true && v.requirePrincipal && v.operatorPrincipals.length === 0
-        ? "DURABLE_APPROVAL=true + REQUIRE_PRINCIPAL=true but OPERATOR_PRINCIPALS is empty — on a multi-tenant worker the empty operator set makes isOperator() true-for-all, so every authenticated tenant could read every other tenant's pending-approval queue (GET /v1/approvals & siblings). Set OPERATOR_PRINCIPALS, or unset REQUIRE_PRINCIPAL if this is a single-tenant deployment (#157-① boot invariant)"
+        ? "DURABLE_APPROVAL=true + REQUIRE_PRINCIPAL=true but OPERATOR_PRINCIPALS is empty — an empty operator list means no operator, so nobody could operate this multi-tenant worker's approval queue (list any owner's pending via GET /v1/approvals & siblings, decide any approval). Set OPERATOR_PRINCIPALS, or unset REQUIRE_PRINCIPAL if this is a single-tenant deployment (#157-① boot invariant)"
         : undefined;
 }
+export function operatorSingleUserRefusal(v) {
+    if (v.operatorSingleUser !== true)
+        return undefined;
+    if (v.requirePrincipal)
+        return "OPERATOR_SINGLE_USER=true but REQUIRE_PRINCIPAL=true — the declaration makes every caller an operator, which only fits a single-user deployment; a multi-tenant worker names its operators in OPERATOR_PRINCIPALS. Unset OPERATOR_SINGLE_USER, or unset REQUIRE_PRINCIPAL if this is a single-user deployment";
+    if (v.operatorPrincipals.length > 0)
+        return "OPERATOR_SINGLE_USER=true but OPERATOR_PRINCIPALS is also set — the two answer the same question (who is an operator) in two ways. Keep one: OPERATOR_SINGLE_USER=true (every caller of this single-user deployment) or OPERATOR_PRINCIPALS (only the named principals)";
+    return undefined;
+}
 export function bakeOperatorPrincipalsRefusal(v) {
     return v.imageBakes.enabled && v.operatorPrincipals.length === 0
-        ? "IMAGE_BAKES_ENABLED=true but OPERATOR_PRINCIPALS is empty — the bake door runs build.sh on the privileged build host; an empty operator set makes isOperator() true-for-all (world-writable RCE). Set OPERATOR_PRINCIPALS or disable bakes (IMAGE-API-DESIGN.md §P2.4a boot invariant)"
+        ? "IMAGE_BAKES_ENABLED=true but OPERATOR_PRINCIPALS is empty — the bake door runs build.sh on the privileged build host and needs named operators: with an empty list nobody can use it, and the single-user operator declaration would open it to every caller (world-writable RCE). Set OPERATOR_PRINCIPALS or disable bakes (IMAGE-API-DESIGN.md §P2.4a boot invariant)"
         : undefined;
 }
 export function bakeRunnerCredentialRefusal(v) {
@@ -64,6 +73,15 @@ export function leaderDurableStoreRefusal(v) {
             "(#193 车4 件2 / staleness ledger P1-9+P1-10 boot invariant)"
         : undefined;
 }
+export function workflowParkDecisionDomainRefusal(v) {
+    const sqlStore = (v.dbBackend === "mysql" && v.tidb !== undefined) || (v.dbBackend === "pg" && v.pg !== undefined);
+    return sqlStore && v.selfOrchestrationEnabled && v.workflowRunStoreBackend !== "auto"
+        ? `DB_BACKEND=${v.dbBackend} with self-orchestration on and WORKFLOW_RUN_STORE=${v.workflowRunStoreBackend} is refused before any schema migration runs (the database was not touched) ` +
+            "[workflow-park-decision-domain]: a workflow approval decision is written in the same atomic step that checks the delivering run still holds the host session, so on a SQL backend it lives in the database " +
+            "with the session claims and is reaped with the workflow records — which this setting keeps off the database. " +
+            "Leave WORKFLOW_RUN_STORE=auto (unset it: the workflow records go to the same database), or turn self-orchestration off (SELF_ORCHESTRATION_ENABLED=false)"
+        : undefined;
+}
 export function centerIdentityRefusal(v) {
     const webBaseUrl = v.webAdmin?.webBaseUrl;
     if (webBaseUrl === undefined)
@@ -125,6 +143,13 @@ export const CONFIG_CROSS_INVARIANTS = [
         bootAnchor: { file: "src/config.ts", marker: "CROSS-INVARIANT:operator-principals-required" },
         check: ({ next }) => operatorPrincipalsRequiredRefusal(next),
     },
+    {
+        id: "operator-single-user",
+        keys: ["operatorSingleUser", "requirePrincipal", "operatorPrincipals"],
+        restartReason: "operator-principals",
+        bootAnchor: { file: "src/config.ts", marker: "CROSS-INVARIANT:operator-single-user" },
+        check: ({ next }) => operatorSingleUserRefusal(next),
+    },
     {
         id: "bake-operator-principals",
         keys: ["imageBakes", "operatorPrincipals"],
@@ -183,6 +208,13 @@ export const CONFIG_CROSS_INVARIANTS = [
         bootAnchor: { file: "src/config.ts", marker: "CROSS-INVARIANT:leader-durable-store" },
         check: ({ next }) => leaderDurableStoreRefusal(next),
     },
+    {
+        id: "workflow-park-decision-domain",
+        keys: ["selfOrchestrationEnabled", "workflowRunStoreBackend", "dbBackend", "tidb", "pg"],
+        restartReason: "workflow-orchestration",
+        bootAnchor: { file: "src/config.ts", marker: "CROSS-INVARIANT:workflow-park-decision-domain" },
+        check: ({ next }) => workflowParkDecisionDomainRefusal(next),
+    },
     {
         id: "device-durable-store",
         keys: ["remoteExec", "dbBackend", "tidb", "pg"],

package/dist/config-lkg.d.ts

@@ -1,8 +1,8 @@
 import { type MigrationReceipt } from "@sema-agent/settings-schema/one-time-migrations";
-import type { PromptsDomainFaces } from "./prompts-domain-validate.js";
-/** 落盘信封。`effective`/`etag` 逐字=当时的 fetchEffective 返回(JSON verbatim 面)。`formatVersion` 的语义见头注(4 = 载荷是 settings-schema 11 的形)。 */
+import type { PublishedPromptArtifact } from "@sema-agent/core";
+/** 落盘信封。`effective`/`etag` 逐字=当时的 fetchEffective 返回(JSON verbatim 面)。`formatVersion` 的语义见头注(5 = 载荷的 prompts 是中心层唯一的那种 wire 形)。 */
 export interface PersistedLkg {
-    formatVersion: 4;
+    formatVersion: 5;
     savedAt: string;
     worker: string;
     /** 拉到这份候选时所用凭证的身份(`center-credential.ts`;摘要形,不含凭证原文)。 */
@@ -48,10 +48,10 @@ export declare function lkgReadDenyRows(configLkgPath: string | undefined): {
 /** 原子落盘一个干净候选(tmp+rename,0600)。BEST-EFFORT:失败=一条 warn 的素材(调用方发),绝不
  *  影响在飞的应用链——LKG 缓存丢失的代价只是下次冷启动回到 env 兜底。 */
 export declare function saveLkg(path: string, worker: string | undefined, identity: string, effective: Record<string, unknown>, etag: string | undefined): Promise<void>;
-/** 一次读回做过的一次性迁移(调用方响亮打一行 `config_lkg_migrated`,并按 4 写回原位):`fromFormat` = 盘上的版本号;`note` = 信封层的说明
- *  (2 → 3 那一步,{@link migrateV2Lkg});`receipts` = 载荷层 settings-schema 迁移的收据(只点名坐标与处置,不带值)。 */
+/** 一次读回做过的一次性迁移(调用方响亮打一行 `config_lkg_migrated`,并按 5 写回原位):`fromFormat` = 盘上的版本号;`note` = 信封层的说明
+ *  (2 → 3 那一步 {@link migrateV2Lkg} / 4 → 5 那一步 {@link migrateV4Lkg});`receipts` = 载荷层 settings-schema 迁移的收据(只点名坐标与处置,不带值)。 */
 export interface LkgReadMigration {
-    readonly fromFormat: 2 | 3 | 4;
+    readonly fromFormat: 2 | 3 | 4 | 5;
     readonly note?: string;
     readonly receipts: readonly MigrationReceipt[];
 }
@@ -59,12 +59,12 @@ export interface LkgReadMigration {
  * 读盘上 LKG。返回 undefined 的所有情形都「安静地回 env 兜底」(调用方 warn 点名 reason):
  * 文件缺席/JSON 坏/信封形不对/worker 或凭证身份不匹配(防同名文件跨 worker / 跨账号串包;`CONFIG_LKG_PATH`
  * 单一路径时这是唯一的一道)/载荷有迁不动的旧形({@link migrateLkgPayload})/prompts 面复判失败。
- * `migrated`:读回时做过一次性迁移(信封 2 → 3 或载荷的 settings-schema 迁移)—— 调用方响亮打一行,并把交回的 4 写回原位。
- * `prompts`:候选判官对这份载荷 prompts 面交出的已判形值(`undefined` = 载荷不带 prompts 键)—— 调用方采纳 prompts 直接用它。
+ * `migrated`:读回时做过一次性迁移(信封 2 → 3 / 4 → 5 或载荷的 settings-schema 迁移)—— 调用方响亮打一行,并把交回的 5 写回原位。
+ * `prompts`:候选判官对这份载荷 prompts 面交出的中心层(引擎 verify 过的发布形 artifact;`undefined` = 载荷不带 prompts 键)—— 调用方采纳直接用它。
  */
 export declare function loadLkg(path: string, worker: string | undefined, identity: string): Promise<{
     lkg: PersistedLkg;
-    prompts: PromptsDomainFaces | undefined;
+    prompts: PublishedPromptArtifact | undefined;
     migrated?: LkgReadMigration;
 } | {
     lkg?: undefined;

package/dist/config-lkg.js

@@ -27,7 +27,7 @@ export function lkgReadDenyRows(configLkgPath) {
     return [{ pattern: configLkgPath, caseSensitive: false }];
 }
 export async function saveLkg(path, worker, identity, effective, etag) {
-    const body = { formatVersion: 4, savedAt: new Date().toISOString(), worker: worker ?? "global", identity, ...(etag !== undefined ? { etag } : {}), effective };
+    const body = { formatVersion: 5, savedAt: new Date().toISOString(), worker: worker ?? "global", identity, ...(etag !== undefined ? { etag } : {}), effective };
     const tmp = `${path}.${randomBytes(6).toString("hex")}.tmp`;
     await fs.mkdir(dirname(path), { recursive: true });
     await fs.writeFile(tmp, JSON.stringify(body), { mode: 0o600 });
@@ -54,7 +54,7 @@ export async function loadLkg(path, worker, identity) {
     const formatVersion = p.formatVersion;
     if (formatVersion === 1)
         return { reason: "pre-identity LKG (formatVersion 1) — not read back: it cannot prove whose credential fetched it (S-651); the next clean candidate rewrites it" };
-    if (formatVersion !== 2 && formatVersion !== 3 && formatVersion !== 4)
+    if (formatVersion !== 2 && formatVersion !== 3 && formatVersion !== 4 && formatVersion !== 5)
         return { reason: `unknown formatVersion ${String(formatVersion)}` };
     if (typeof p.worker !== "string" || p.worker !== (worker ?? "global"))
         return { reason: `worker mismatch (file=${String(p.worker)})` };
@@ -71,14 +71,20 @@ export async function loadLkg(path, worker, identity) {
         envelope = v2.lkg;
         note = v2.migrated;
     }
+    if (formatVersion !== 5) {
+        const v4 = migrateV4Lkg(envelope, formatVersion);
+        if (v4.lkg === undefined)
+            return v4;
+        note = note === undefined ? v4.migrated : `${note}; ${v4.migrated}`;
+    }
     const payload = migrateLkgPayload(envelope.effective);
     if ("refused" in payload)
         return { reason: payload.refused };
     const judged = lkgPayloadJudged(payload.effective, envelope.etag);
     if ("problem" in judged)
         return { reason: judged.problem };
-    const lkg = { ...envelope, formatVersion: 4, effective: payload.effective };
-    const migrated = formatVersion !== 4 || payload.receipts.length > 0;
+    const lkg = { ...envelope, formatVersion: 5, effective: payload.effective };
+    const migrated = formatVersion !== 5 || payload.receipts.length > 0;
     return migrated ? { lkg, prompts: judged.prompts, migrated: { fromFormat: formatVersion, ...(note !== undefined ? { note } : {}), receipts: payload.receipts } } : { lkg, prompts: judged.prompts };
 }
 export function migrateLkgPayload(effective) {
@@ -93,6 +99,16 @@ export function migrateLkgPayload(effective) {
     }
     return { effective: m.effective, receipts: m.receipts };
 }
+function migrateV4Lkg(lkg, fromFormat) {
+    if (Object.hasOwn(lkg.effective, "prompts")) {
+        return {
+            reason: `formatVersion ${fromFormat} LKG carries a prompts face` +
+                " — written before 7.132.0, so it is the retired two-axis wire (declarations / v1 catalog) the engine no longer reads; not read back: " +
+                "the center's next candidate (republished as {schemaVersion: 2, artifact}) rewrites it",
+        };
+    }
+    return { lkg, migrated: `formatVersion ${fromFormat} → 5 (one-time): the payload carries no prompts face, read back unchanged` };
+}
 const RETIRED_CATALOG_COORDINATE = /^models\.(0|[1-9][0-9]*)$/;
 function migrateDroppedIdentityRow(row) {
     if (row === null || typeof row !== "object")

package/dist/config-provider.d.ts

@@ -1,4 +1,4 @@
-import { type DroppedConfigEntry, type RetiredDomainFinding, type UnreadConfigFile } from "./web-admin-client/read-warnings.js";
+import { type DroppedConfigEntry, type RetiredDomainFinding, type UnreadConfigFile, type UnreadConfigKey } from "./web-admin-client/read-warnings.js";
 import { FileConfigStore } from "@sema-agent/settings-schema/node";
 import { type EffectiveConfig as AgentConfigEffective, type EffectiveReadWarning } from "@sema-agent/settings-schema";
 import { fetchEffective as remoteFetchEffective, fetchSkillContent as remoteFetchSkillContent, type EffectiveConfig } from "./web-admin-client/facade.js";
@@ -28,6 +28,7 @@ import type { ConfigProviderWord } from "./config-types.js";
 /** `retiredDomains`(S-1456):带事实的退役域文档(契约包的墓碑)—— 读腿不抛,交成发现,候选判官以成因 `retired_domain` 整拒这份候选(与域判形失败
  *  同一条回落链、同一行拒判);缺席 = 没有。远端腿:那一键不进 effective、其余域照读;本地腿:契约读腿在读便携域之前就拒,交出的候选只有版本
  *  (这棵树的内容版本,哈希含退役文件 ⇒ 改 / 删它版本即变),内容是空的 effective(被整拒,不会被应用)。 */
+/** `unreadKeys`:本地读腿读了那份文件、却结构上不读其中一键(`prompts.json` 的 `workers`)—— 同 `unreadFiles`,不进候选门,调用方一键一行 `config_unread_key`。 */
 export type FetchEffectiveResult = {
     effective: EffectiveConfig;
     etag?: string;
@@ -37,6 +38,7 @@ export type FetchEffectiveResult = {
     }>;
     droppedEntries?: DroppedConfigEntry[];
     unreadFiles?: UnreadConfigFile[];
+    unreadKeys?: UnreadConfigKey[];
     retiredDomains?: RetiredDomainFinding[];
     readWarnings: readonly EffectiveReadWarning[];
     credentialIdentity?: string;
@@ -125,6 +127,9 @@ export interface ConfigProviderInput {
      *  `process.cwd()`,而工厂只在 `CONFIG_PROVIDER === "local"` 字面上递它 ⇒ 另一条走到 local 的路上配置源读 cwd、
      *  合成步读 localRoot,两个根分家。一个远程源也收它:`remote` 而无中心 URL 的形照样落回 local。 */
     localDir: string;
+    /** S-163:本地配置源的属主声明(`CONFIG_LOCAL_OWNER_UID`,配置席 `configLocalOwnerUid`)—— 每拍读 `config.d` 之前的目录信任判官与起服那一次判同一个值。
+     *  **必填**(值可以是 `undefined` = 没声明):两个生产构造点都必须递,漏递 = 起服判过、每拍却按「没声明」判 ⇒ 每一拍都拒(tsc 在这里挡)。 */
+    localOwnerUid: number | undefined;
     /** S-1556:远程配置源的技能正文盘缓存目录(见 {@link ConfigProvider.skillBodyCacheDir});本地配置源不认它(正文本就在盘上)。缺席 = 不落盘。 */
     skillBodyCacheDir?: string;
 }
@@ -163,7 +168,9 @@ export declare class LocalConfigProvider implements ConfigProvider {
     /** [ref]b 可观测性:config_loaded 日志要能回答「到底读的哪个目录」——复验实录:只设 LOCAL_DATA_ROOT 时
      *  config.d 静默读不到且 0 模型无告警(CONFIG_LOCAL_DIR 才是本 lane 的选目录旋钮)。 */
     readonly root: string;
-    constructor(root: string, store?: FileConfigStore);
+    constructor(root: string, store?: FileConfigStore, trust?: {
+        readonly declaredOwnerUid: number | undefined;
+    });
     fetchEffective(etag: string | undefined): Promise<FetchEffectiveResult>;
     fetchSkillContent(contentHash: string): Promise<string | undefined>;
 }

package/dist/config-provider.js

@@ -2,7 +2,8 @@ import { readMcpSourceLabel } from "./mcp-source-label.js";
 import { createHmac, randomBytes } from "node:crypto";
 import { retiredDomainFindingOf, splitFoldedReadWarnings, withDroppedCatalogEntries } from "./web-admin-client/read-warnings.js";
 import { FileConfigStore } from "@sema-agent/settings-schema/node";
-import { danglingRefs, emptyEffective, findSkillContent, renderRefIssue, skillContentHash, } from "@sema-agent/settings-schema";
+import { assertLocalConfigDirTrusted } from "./config-dir-trust.js";
+import { danglingRefs, emptyEffective, findSkillContent, promptArtifactFor, renderRefIssue, skillContentHash, } from "@sema-agent/settings-schema";
 import { redactSecrets } from "./trace/redact.js";
 import { fetchEffective as remoteFetchEffective, fetchSkillContent as remoteFetchSkillContent, WebAdminHttpError, } from "./web-admin-client/facade.js";
 import { homedir } from "node:os";
@@ -75,12 +76,15 @@ export class LocalConfigProvider {
     store;
     root;
     #injectedStore;
-    constructor(root, store) {
+    #declaredOwnerUid;
+    constructor(root, store, trust = { declaredOwnerUid: undefined }) {
         this.root = root;
         this.#injectedStore = store;
         this.store = store ?? new FileConfigStore(root);
+        this.#declaredOwnerUid = trust.declaredOwnerUid;
     }
     async fetchEffective(etag) {
+        await assertLocalConfigDirTrusted({ root: this.root, declaredOwnerUid: this.#declaredOwnerUid });
         const readWarnings = [];
         const store = this.#injectedStore ??
             new FileConfigStore(this.root, {
@@ -120,6 +124,7 @@ export class LocalConfigProvider {
         const droppedEntries = folded.droppedEntries.map(redactDroppedEntry);
         const errors = [...domainErrors.map((de) => ({ domain: de.domain, error: redactConfigError(de.error) })), ...parseErrors, ...refErrors];
         this.#servedSkills = eff.skills;
+        const unreadKeys = localUnreadPromptKeys(eff.prompts);
         return {
             effective: withDroppedCatalogEntries(mapToServiceEffective(eff, eff.version), folded.droppedCatalogEntries),
             etag: tag,
@@ -127,6 +132,7 @@ export class LocalConfigProvider {
             ...(errors.length > 0 ? { domainErrors: errors } : {}),
             ...(droppedEntries.length > 0 ? { droppedEntries } : {}),
             ...(folded.unreadFiles.length > 0 ? { unreadFiles: folded.unreadFiles } : {}),
+            ...(unreadKeys.length > 0 ? { unreadKeys } : {}),
             ...(retired !== undefined ? { retiredDomains: [retired] } : {}),
         };
     }
@@ -134,6 +140,14 @@ export class LocalConfigProvider {
         return findSkillContent(this.#servedSkills, contentHash);
     }
 }
+function localUnreadPromptKeys(prompts) {
+    const names = prompts?.workers === undefined ? [] : Object.keys(prompts.workers);
+    return names.length === 0 ? [] : [{ file: "prompts.json", domain: "prompts", key: "workers", names }];
+}
+function localPromptsWire(prompts, version) {
+    const artifact = prompts === undefined ? undefined : promptArtifactFor(prompts, null);
+    return artifact === undefined ? {} : { prompts: { schemaVersion: 2, artifact: { ...artifact, sourceRevision: `local:r${version}` } } };
+}
 export function mapToServiceEffective(eff, version) {
     return {
         version,
@@ -216,9 +230,7 @@ export function mapToServiceEffective(eff, version) {
                 };
             }),
         },
-        ...(eff.prompts?.catalog !== undefined
-            ? { prompts: { schemaVersion: 1, catalog: eff.prompts.catalog } }
-            : {}),
+        ...localPromptsWire(eff.prompts, version),
         scenarios: {
             scenarios: (eff.scenarios.scenarios ?? []).map((sc) => ({
                 name: sc.name,
@@ -237,7 +249,7 @@ export function mapToServiceEffective(eff, version) {
 export function createConfigProvider(input) {
     return configProviderKind(input) === "remote" && input.webAdmin !== undefined
         ? new RemoteConfigProvider(input.webAdmin, {}, input.skillBodyCacheDir)
-        : new LocalConfigProvider(input.localDir);
+        : new LocalConfigProvider(input.localDir, undefined, { declaredOwnerUid: input.localOwnerUid });
 }
 export function configLocalRoot(config) {
     return config.configLocalDir ?? process.env.AGENT_DATA_DIR ?? join(homedir(), ".ai-agent");

package/dist/config-types.d.ts

@@ -19,6 +19,7 @@ import type { InfraCostRates } from "./observability/cost-taxonomy.js";
 import type { Autonomy, CommandRule } from "./runtime-governance.js";
 import type { CenterCredentialSource } from "./center-credential.js";
 import type { GitApiKind } from "./git-api-kind.js";
+import type { CustomPkgSource } from "./sandbox-pkg-source.js";
 import type { MemoryEngineBackend, StoreBackend as StoreBackendWord } from "@sema-agent/settings-schema/execution-lanes";
 import { DRAIN_GRACE_FLOOR_MS } from "@sema-agent/settings-schema/fleet";
 import type { AtMention } from "@sema-agent/settings-schema";
@@ -148,6 +149,35 @@ export declare const FIRST_BYTE_TIMEOUT_BOUNDS: {
     readonly minMs: 0;
     readonly maxMs: 2147483647;
 };
+/**
+ * 整数合法域(闭区间)的**一种说法**:device 车道的数值旋钮(`DEVICE_RECONNECT_GRACE_MS` / `DEVICE_MAX_INFLIGHT_PER_DEVICE` /
+ * `DEVICE_DELIVERY_TIMEOUT_MS` / `DEVICE_EXEC_TIMEOUT_MS`)、汇聚端创建时对 helloAck 六个数值位的校验、协议文档与配置目录的合法域句,
+ * 都问这一只判据、读这一句话 —— 判据与说法各只有一处。`max === Number.MAX_SAFE_INTEGER` 读作「无上界」(JSON 数字在 2^53−1 内精确)。
+ */
+export interface WholeNumberBounds {
+    readonly min: number;
+    readonly max: number;
+}
+/** `value` 是落在 `bounds` 内的安全整数(NaN / ±Infinity / 小数 / 非数 / 越界全否)。 */
+export declare function inWholeNumberBounds(bounds: WholeNumberBounds, value: unknown): value is number;
+/** 合法域的一句话:`an integer in [0, 2147483647]` / `an integer ≥ 1`(无上界时)。拒句与协议文档读同一句。 */
+export declare function wholeNumberBoundsRule(bounds: WholeNumberBounds): string;
+/**
+ * device 车道两根**不上 helloAck** 的数值旋钮的合法域(上 helloAck 的另两根 —— `DEVICE_RECONNECT_GRACE_MS` / `DEVICE_MAX_INFLIGHT_PER_DEVICE` ——
+ * 的界属协议,见 `device-ws-protocol.ts` 的 `DEVICE_HELLO_ACK_BOUNDS`)。解析器(`config.ts`)与配置目录行共读这一处。
+ *
+ *  · `DEVICE_DELIVERY_TIMEOUT_MS`(等 per-device 在途槽的上限):下界 `0` = 不排队,槽满即 `device.busy`,是真含义;
+ *  · `DEVICE_EXEC_TIMEOUT_MS`(指令级默认超时,进每条指令帧的 `timeoutMs`):下界 `1` —— `0` 会让每条没自带超时的指令出生即超时;
+ *  · 两者上界 = {@link MAX_TIMER_DELAY_MS}:排队计时与指令级超时都从这两个数起算 `setTimeout` 的 delay,更大的值被 Node 折成 1 ms。
+ */
+export declare const DEVICE_DELIVERY_TIMEOUT_BOUNDS: {
+    readonly min: 0;
+    readonly max: 2147483647;
+};
+export declare const DEVICE_EXEC_TIMEOUT_BOUNDS: {
+    readonly min: 1;
+    readonly max: 2147483647;
+};
 /**
  * S-220 —— **`resilience` 块缺省的唯一属主**(S-202 的单源从一根扩到整族)。
  *
@@ -1107,9 +1137,9 @@ export interface ServiceConfigFlat {
         keyPrefix?: string;
         presignTtlSec?: number;
     };
-    /** (a)(clay 拍 a+c,2026-07-27)SQL 默认店的 per-blob 帽显式覆写(字节)。未设 ⇒ SqlBlobBackend
-     *  的方言默认(tidb=6MiB=TiDB 默认 txn-entry-size-limit 真库实测矮墙,pg=不设帽);设了 ⇒ 两方言
-     *  都生效(调高过 entry/packet 限的部署放宽用)。软旋钮:坏值=undefined 走默认。 */
+    /** (a)(clay 拍 a+c,2026-07-27)SQL 默认店的 per-blob 帽显式覆写(字节)。未设 ⇒ `sqlBlobDefaultCapBytes`
+     *  按**将要写入的那条连接**报的两堵墙推导(MySQL 协议 = 单行上限 − 64 KiB 与 ⌊(包墙 `max_allowed_packet` − 1 KiB) ÷ 2⌋ 取小;
+     *  pg 连接两堵都没有 = 不设帽);设了 ⇒ 两方言都生效(调高过 entry/packet 限的部署放宽用)。软旋钮:坏值=undefined 走默认。 */
     snapshotBlobSqlMaxBytes?: number;
     /** (c) 的显式逃生口:云形(mysql|pg 后端)缺 MinIO 本应 boot fail-loud(bytes-in-DB 撞包墙已两役
      *  实证,大字节归对象存储);`SNAPSHOT_BLOB_ALLOW_SQL_BYTES=true` 显式接受 SQL 店 + (a) 的帽
@@ -1273,11 +1303,16 @@ export interface ServiceConfigFlat {
     retentionSweep: RetentionSweepConfig;
     /** Tool names that require operator approval before running (F4). Empty = no approval gate. */
     approvalRequire: string[];
-    /** Principals allowed to act as OPERATORS on the F4 approval queue (`/v1/approvals`): list ANY
-     *  owner's pending + decide (approve/deny). A non-operator principal may only LIST ITS OWN pending and
-     *  CANNOT decide (a requester approving its own high-risk op would defeat the gate). **Empty/unset =
-     *  legacy behavior** (the shared service token IS the operator boundary — back-compat). */
+    /** Principals allowed to act as OPERATORS (`OPERATOR_PRINCIPALS`): every operator face reads it through the one reading
+     *  `explicitOperatorOk` (`http/principal-gate.ts`) — e.g. the F4 approval queue (`/v1/approvals`): list ANY owner's pending +
+     *  decide. A non-operator principal may only LIST ITS OWN pending. **Empty = no one is an operator** (S-1050: the old
+     *  "empty = everyone on the approval queue" reading is gone); a single-user deployment that wants to be its own operator
+     *  declares {@link operatorSingleUser}. */
     operatorPrincipals: string[];
+    /** `OPERATOR_SINGLE_USER=true` —— 单用户形显式声明「这台部署的每个调用方都是运维」(S-1050,[ref] ① 裁 A)。缺席 = 不声明(没人是,除非在名单里)。
+     *  只在单用户形(`REQUIRE_PRINCIPAL` 未开)且名单为空时成立 —— 否则拒启(`config-invariants.ts` 的 `operator-single-user`:一个事实一个来源)。
+     *  env 独有(没有中心写位),起服冻结。读法只有 `explicitOperatorOk` / `operatorRosterPresent` 两只。 */
+    operatorSingleUser?: boolean;
     /**
      * DESIGN-278 §5 S2([ref])—— `GET /v1/config/catalog`(配置目录自描述端点)的显式旋钮。
      * 默认 **ON**(设计稿 §0.5:合规部署可关)。端点本身已是 operator-only(`explicitOperatorOk`,
@@ -1470,8 +1505,10 @@ export interface ServiceConfigFlat {
     /** SVC-1: the durable WorkflowRunStore backend for BACKGROUND workflow runs.
      *  `auto` (DEFAULT) = the SQL-backed cross-replica store when a SQL backend is configured, else the
      *  crash-safe `FileWorkflowRunStore` ledger under `localDataRoot/workflows` (dispatch: main.ts, keyed off
-     *  `sqlWorkflowRunStore` presence). `file` = force the file ledger even with SQL present (single-replica
-     *  pinning). Either durable form means a background run's record SURVIVES a restart, which is what lets the
+     *  `sqlWorkflowRunStore` presence). `file` = force the file ledger — on the local backend only: with a SQL backend
+     *  and SELF_ORCHESTRATION_ENABLED, `file` / `memory` are refused at start (the workflow park decision store must
+     *  live where the session claims live and be reaped with the records; no store does both off the database —
+     *  `parkDecisionStoreRefusal`). Either durable form means a background run's record SURVIVES a restart, which is what lets the
      *  at-least-once completion notify re-derive a run's terminal state after a crash. `memory` = the ephemeral
      *  `InMemoryWorkflowRunStore` (process-local; no crash recovery, no notify journal) — an explicit opt-out for
      *  a single-instance/ephemeral deployment. ([ref]: the old docblock claimed `file` was the default and
@@ -1526,14 +1563,12 @@ export interface ServiceConfigFlat {
      *  tools for a declared `plan` itself, and no plan entry clamps the hands (only `AUTONOMY=read-only` does). */
     planModeEnabled: boolean;
     /**
-     * [ref]⑥(core 5.56 `Hooks.timeoutMs` 座)—— **每一只 hook 席位单次调用的时间上限**(ms)。
-     * `HOOKS_TIMEOUT_MS`;**缺席 = 不铸键**,由 core 自默认(600s = CC 自己的数;server 不复制上游默认)。
+     * `HOOKS_TIMEOUT_MS` —— 请求 `settings.hooks` 那张 mods 注册(`settings.hooks`)每个 handler 的时间预算(ms;一个事件跑一遍本请求的钩子条目)。
+     * **缺席 = 不铸键**;唯一读法 = `hooks/hook-runner.ts` 的 `settingsHooksBudgetMs`(未设 ⇒ 600000,单条命令超时的上限;这只数是引擎的钟,不是钩子子进程的墙钟)。
      *
-     * 🔴 `0` 是有效值(core 契约逐字:写下零的部署说了一件事 —— 每个席位立即到期),不是「未设」;
+     * 🔴 `0` 是有效值(引擎按字面:零预算,下一个定时器拍就到期),不是「未设」;
      * 坏值(非整数 / 负 / 超 `setTimeout` 32 位上限)**拒启**,解析见 config.ts `parseHooksTimeoutEnv`。
-     * 施加点 = `main.ts` 的 `deploymentHooks`(server 车道)与 `run-local.ts` 的同名记录(CLI 本地车道,
-     * merge-rescan 745 补折:该腿今日仅同步计数器席位、折上为防倒退)。server 车道一处施加两条腿同时
-     * 生效:既是 `RunnerDeps.hooks`,又是 `resolve-spec` 折进 task hooks 的部署基线。
+     * 部署座的两张观察注册(拒绝计量 / 工具追踪)不读它(同步返回,用引擎缺省)。
      */
     hooksTimeoutMs?: number;
     /** SVC-2 (adversarial-review): the workflow_journal GC retention — the reaper purges journal rows older than
@@ -1604,6 +1639,11 @@ export interface ServiceConfigFlat {
      *  nothing (the pre-2026-07-13 unset behavior — byte-identical sandbox). Operator env `SANDBOX_PKG_SOURCE`;
      *  per-region via the registry effective-config (shell B3) later. */
     sandboxPkgSource?: string;
+    /** The explicit addresses of `SANDBOX_PKG_SOURCE=custom` (`SEMA_APT_MIRROR` / `SEMA_PIP_INDEX` / `SEMA_UV_INDEX` / `SEMA_UV_PY_MIRROR` /
+     *  `SEMA_NPM_REGISTRY` / `SEMA_NODE_MIRROR`), read and judged ONCE at load by `customPkgSourceFromEnv` (a value with userinfo — or a shape
+     *  the URL judge cannot call credential-free — refuses startup) and handed to the sandbox lanes' env composer from here: the lane never
+     *  reads `process.env` for them again. Present iff the profile is `custom` AND at least one address is set. */
+    sandboxPkgSourceCustom?: CustomPkgSource;
     /** Auto-generate a session title at first submit (one cheap-model call per
      *  session; fills a NULL title only — a title the user set via `PATCH /v1/sessions/:id` is never overwritten).
      *  Default ON; `SESSION_AUTO_TITLE=false` opts out. */
@@ -1635,7 +1675,7 @@ export interface ServiceConfigFlat {
      *  `deriveSettingsPolicy` 的 fs-write gate 闭包里,而那个闭包只在 default/auto/acceptEdits 三臂被调用 ⇒
      *  `bypassPermissions` / `permissionMode` 键缺席(headless `-p` 的默认姿势)/ body 连 settings 都没有
      *  这三形整条 DENY 腿不建(邻仓 46 格真机矩阵实证)。裁决 env 仍按 lane 分形(host 真 fs / 沙箱
-     *  `DeferredSandboxPathEnv` 代理),与 fs-write ask 门同一份、单点构造。
+     *  `DeferredSandboxPathEnv` 代理),单点构造(resolve-spec 的 `pathAdjudication`)。
      *  折叠仍是 deny-wins(tightenTaskSpec ⇒ combinePolicies),所以会话豁免 / acceptEdits 自动 allow /
      *  客户端 settings allow 一律越不过它;非守卫目标该 policy 返回 `action:"allow"`(core 的 ToolPolicy
      *  没有「无意见」第三态;这个 allow 在 combinePolicies 的 deny/ask 优先折叠里不构成一票,故在折叠
@@ -1741,6 +1781,11 @@ export interface ServiceConfigFlat {
      *  不静默吞)。`"never"` = 不设期限。**未设 ⇒ 不铸键**,由引擎落它自己的缺省(`"5m"`)——本仓不复制上游
      *  缺省值。词表外 boot 拒启。⚠️ CC 同名键还有第二个消费面(远端审批对话框停靠时长),本旋钮今天不驱动它。 */
     crossSessionDialogExpiry?: CrossSessionDialogExpiry;
+    /** [ref] §10.2 —— principal 收件箱(`principal.inbox`)的消费方声明:独占读它的那只助理的 agent handle
+     *  (`PRINCIPAL_INBOX_ASSISTANT`)→ core `RunnerDeps.principalInboxConsumer: { assistant }`。**它就是跨主体投递车道的开关**:
+     *  在场 ⇒ 装配挂投递门(`org-delivery-gate.ts`)与受理口 `POST /v1/principal-inbox/messages`,前提(耐久 mailbox / org 成员
+     *  目录 / 配额店)缺一拒启;缺席 ⇒ 不铸座、不挂门(收件箱这条车道整条不存在)。判形归 core `principalInboxConsumerOf`。 */
+    principalInboxAssistant?: string;
     /** [ref]④ defer face (EXPERIMENTAL, default OFF): mark the default scenario's LONG-TAIL first-party tools
      *  (today = SelectEnvironment only) `defer:true` (core tool-disclosure: the model sees a placeholder until it
      *  ToolSearch-loads the schema). Assessment says the win is marginal for us (spec.tools total ≈4.2k tokens, of
@@ -2102,6 +2147,12 @@ export interface ServiceConfigFlat {
     };
     /** Expire pending approvals older than this (seconds). 0 disables the reaper. */
     approvalTimeoutSec: number;
+    /**
+     * 审批账本(问账三形 + local 审计账)的保留窗(ms):一问结了且最后一次动静早于 `now − 本值`,它的全部记录由维护 tick 整问删掉;
+     * 没结的问永不按龄删。`0` = 不删(永久保留)。缺省 30 天;正值下限 1 天(低于即钳 + 点名);负值 / 非整数拒启。
+     * 律、节律与下限的理由一处成文在 `approval-ask-retention.ts`。`APPROVAL_ASK_RETENTION_MS`。
+     */
+    approvalAskRetentionMs: number;
     /** Background reaper interval (seconds) for stale runs / expired approvals / rate windows. */
     reapIntervalSec: number;
     /** TTL (seconds) for offloaded tool results in the durable store. Must comfortably exceed a run's
@@ -2198,6 +2249,10 @@ export interface ServiceConfigFlat {
     configProvider?: ConfigProviderWord;
     /** Root dir holding `config.d/<domain>.json` for the local config source. Env: CONFIG_LOCAL_DIR. */
     configLocalDir?: string;
+    /** 本地配置源的目录信任判官(`config-dir-trust.ts`)多信的那一个属主 uid —— 本服务用户与 root 之外,`config.d` 及其路径上的目录与文档还可以属于谁
+     *  (userns-remap 的 bind-mount 呈现为未映射 uid、运维用户持有的配置)。只放宽属主判据,模式判据照校。缺席 = 只信本服务用户与 root。
+     *  Env: CONFIG_LOCAL_OWNER_UID(形错拒启;解析口 `parseConfigLocalOwnerUid`)。 */
+    configLocalOwnerUid?: number;
 }
 /** 组:store(持久化)—— DB 引擎三态、session 后端、SQL coords、快照 BLOB / SendUserFile 对象存储。 */
 export type ServiceStoreConfig = Pick<ServiceConfigFlat, "sessionBackend" | "sessionCacheTtlSec" | "storeProbeIntervalMs" | "storeLockWaitMs" | "dbBackend" | "dbBackendExplicit" | "localDataRoot" | "runStoreStrictHydrate" | "tidb" | "pg" | "dbQueryTimeoutMs" | "snapshotBlobStore" | "snapshotBlobSqlMaxBytes" | "snapshotBlobAllowSql" | "fileHistory" | "fileHistoryCapture" | "sendUserFile">;
@@ -2205,7 +2260,7 @@ export type ServiceStoreConfig = Pick<ServiceConfigFlat, "sessionBackend" | "ses
 export type ServiceModelPlaneConfig = Pick<ServiceConfigFlat, "gatewayBaseUrl" | "gatewayApiKey" | "gatewayFallbackUrls" | "gatewayMaxRetries" | "anthropic" | "resilience" | "model" | "envModel" | "models" | "modelApiKeyEnv" | "modelApiKeys" | "modelRefusals" | "droppedCatalogEntries" | "modelQuotaWeights" | "tiers" | "projects" | "roles" | "atMention" | "cascadeLadder" | "degrade">;
 /** 组:approval(审批 / HITL 门)。`directDoorActive` 无 env 解析腿(装配层三域合取的产物),但语义上
  *  就是本组的门状态,故进组;`parseApprovalDomain` 的返回类型相应是 `Omit<…, "directDoorActive">`。 */
-export type ServiceApprovalConfig = Pick<ServiceConfigFlat, "approvalRequire" | "approvalDeny" | "approvalTimeoutSec" | "approvalAutoBudget" | "approvalNeverAuto" | "approvalGrant" | "approvalHmacKeys" | "durableApproval" | "durableApprovalSource" | "streamAskWindowMsSource" | "directApprovalDoor" | "directDoorActive" | "resourceSuspend" | "resourceSuspendTtlSec" | "resourceSuspendTotalTokens" | "resourceSuspendTotalBudgetUsd" | "resourceSuspendMaxSlices" | "askQuestionEnabled" | "questionThrottle" | "toolApprovalEnabled" | "permissionRulesEnabled" | "permissionRulesEnabledExplicit" | "streamAskWindowMarginMs" | "streamApproval" | "unattendedApprovalPolicy" | "mcpElicitation" | "sensitiveWritePatterns" | "writeProtectedPaths" | "manualModeShellGate" | "permissionsDisableAutoMode" | "autoModeClassifierFallback" | "autoModeClassifierTimeoutMs" | "crossSessionInbound" | "crossSessionDialogExpiry">;
+export type ServiceApprovalConfig = Pick<ServiceConfigFlat, "approvalRequire" | "approvalDeny" | "approvalTimeoutSec" | "approvalAskRetentionMs" | "approvalAutoBudget" | "approvalNeverAuto" | "approvalGrant" | "approvalHmacKeys" | "durableApproval" | "durableApprovalSource" | "streamAskWindowMsSource" | "directApprovalDoor" | "directDoorActive" | "resourceSuspend" | "resourceSuspendTtlSec" | "resourceSuspendTotalTokens" | "resourceSuspendTotalBudgetUsd" | "resourceSuspendMaxSlices" | "askQuestionEnabled" | "questionThrottle" | "toolApprovalEnabled" | "permissionRulesEnabled" | "permissionRulesEnabledExplicit" | "streamAskWindowMarginMs" | "streamApproval" | "unattendedApprovalPolicy" | "mcpElicitation" | "sensitiveWritePatterns" | "writeProtectedPaths" | "manualModeShellGate" | "permissionsDisableAutoMode" | "autoModeClassifierFallback" | "autoModeClassifierTimeoutMs" | "crossSessionInbound" | "crossSessionDialogExpiry" | "principalInboxAssistant">;
 /** 组:memory(记忆面 + TOC 同步腿)。 */
 export type ServiceMemoryConfig = Pick<ServiceConfigFlat, "memoryEngineEnabled" | "memoryEngineDir" | "memoryEngineRemoteLaneAllowed" | "memoryEngineBackend" | "memoryScope" | "memoryPersistenceCapable" | "memorySync" | "memoryEmbedder" | "memoryOrgAdmissionMode" | "memoryDelegationEvidence" | "memoryProvenance" | "memoryCapturePolicy" | "memoryConsolidationDriver" | "memoryOrgDirectoryJson" | "memoryOrgGrantTtlMs" | "memoryOrgUnavailableBackoffMs" | "projectMemoryEnabled" | "syncImportLeaseStaleSec">;
 /** 组:auth(鉴权 / 身份 / 治理棒)。`commandPolicy` 只有 web-admin 腿(无 env 标量形),故 env 解析
@@ -2214,15 +2269,15 @@ export type ServiceMemoryConfig = Pick<ServiceConfigFlat, "memoryEngineEnabled"
  *  三者都是 operator 在配置面写下的**治理声明**(与 autonomy/commandPolicy 同族),不是存储旋钮
  *  ——`retentionPolicy` 尤其容易被误归 store 组:它的消费点是 core 的启动期能力校验与将来的调度面,
  *  config 这一层它只是一句声明。 */
-export type ServiceAuthConfig = Pick<ServiceConfigFlat, "authToken" | "authTokens" | "allowUnauthedWrites" | "corsOrigins" | "principalHeader" | "requirePrincipal" | "autonomy" | "commandPolicy" | "compliancePosture" | "lockedConfigKeys" | "configCatalogEnabled" | "retentionPolicy" | "retentionSweep" | "operatorPrincipals" | "principalJwtPubkeys" | "principalJwtIss" | "principalJwtAud" | "authBridgeIssuer" | "principalJwtMaxTtlSec" | "bindHost" | "bindHostSource">;
+export type ServiceAuthConfig = Pick<ServiceConfigFlat, "authToken" | "authTokens" | "allowUnauthedWrites" | "corsOrigins" | "principalHeader" | "requirePrincipal" | "autonomy" | "commandPolicy" | "compliancePosture" | "lockedConfigKeys" | "configCatalogEnabled" | "retentionPolicy" | "retentionSweep" | "operatorPrincipals" | "operatorSingleUser" | "principalJwtPubkeys" | "principalJwtIss" | "principalJwtAud" | "authBridgeIssuer" | "principalJwtMaxTtlSec" | "bindHost" | "bindHostSource">;
 /** 组:orchestration(编排 + 执行车道 + 沙箱面 + workflow/后台 agent 存留)。 */
-export type ServiceOrchestrationConfig = Pick<ServiceConfigFlat, "remoteExec" | "remoteExecHomeDir" | "requireExecutionLane" | "worktreeIsolation" | "leaderEnabled" | "leaderFanoutEnabled" | "routerEnabled" | "selfOrchestrationEnabled" | "selfOrchestrationModels" | "selfOrchestrationWorkerIsolation" | "forkEnabled" | "experimentalObserverAgents" | "schedulerEnabled" | "schedulerSessionWakeup" | "schedulerSessionLifetime" | "schedulerStorePath" | "planModeEnabled" | "hooksTimeoutMs" | "workflowRunStoreBackend" | "workflowOrphanGraceMs" | "workflowJournalRetentionMs" | "workflowRunRetentionMs" | "usageWindows" | "workflowAgentsReadOnly" | "workflowSizeGuideline" | "backgroundAgentRetentionMs" | "backgroundAgentStaleRunningMs" | "backgroundAgentParkClaimStaleMs" | "delegationEntryCaps" | "rosterRetentionMs" | "leaderRunStaleMs" | "scratchpadSweepTtlMs" | "sandboxPkgSource" | "sessionAutoTitle" | "sessionAutoTitleSource" | "selectEnvironmentTool" | "envFactsEnabled" | "toolDeferLongtail" | "lspEnabled" | "lspHostEnabled" | "lspEnvAllow" | "imageBakes" | "readFace" | "readFaceSource" | "taskWriteFaceEscalation" | "readDenyPatterns" | "readDenyBuiltinTiers" | "readDenyBuiltinExclude" | "agentConfigDir" | "configLkgPath" | "configLkgEnabled">;
+export type ServiceOrchestrationConfig = Pick<ServiceConfigFlat, "remoteExec" | "remoteExecHomeDir" | "requireExecutionLane" | "worktreeIsolation" | "leaderEnabled" | "leaderFanoutEnabled" | "routerEnabled" | "selfOrchestrationEnabled" | "selfOrchestrationModels" | "selfOrchestrationWorkerIsolation" | "forkEnabled" | "experimentalObserverAgents" | "schedulerEnabled" | "schedulerSessionWakeup" | "schedulerSessionLifetime" | "schedulerStorePath" | "planModeEnabled" | "hooksTimeoutMs" | "workflowRunStoreBackend" | "workflowOrphanGraceMs" | "workflowJournalRetentionMs" | "workflowRunRetentionMs" | "usageWindows" | "workflowAgentsReadOnly" | "workflowSizeGuideline" | "backgroundAgentRetentionMs" | "backgroundAgentStaleRunningMs" | "backgroundAgentParkClaimStaleMs" | "delegationEntryCaps" | "rosterRetentionMs" | "leaderRunStaleMs" | "scratchpadSweepTtlMs" | "sandboxPkgSource" | "sandboxPkgSourceCustom" | "sessionAutoTitle" | "sessionAutoTitleSource" | "selectEnvironmentTool" | "envFactsEnabled" | "toolDeferLongtail" | "lspEnabled" | "lspHostEnabled" | "lspEnvAllow" | "imageBakes" | "readFace" | "readFaceSource" | "taskWriteFaceEscalation" | "readDenyPatterns" | "readDenyBuiltinTiers" | "readDenyBuiltinExclude" | "agentConfigDir" | "configLkgPath" | "configLkgEnabled">;
 /** 组:limitsHttp(HTTP 面 + 各类上限/配额/回收窗)。 */
 export type ServiceLimitsHttpConfig = Pick<ServiceConfigFlat, "port" | "attachmentOrphanGraceMs" | "workspaceFileMaxBytes" | "attachmentMaxBytes" | "attachmentMimeAllowlist" | "attachmentUnboundTtlMs" | "infraCostRates" | "drainGraceMs" | "drainSecondSignalMinGapMs" | "sighupIdleGraceMs" | "parentPid" | "engineAutoExit" | "engineLingerMs" | "engineOrphanLingerMs" | "rateLimitPerMin" | "maxTaskCostUsd" | "maxTaskTokens" | "maxPrincipalCostUsd" | "costQuotaWindowSec" | "reapIntervalSec" | "runStaleSec" | "toolResultTtlSec">;
 /** 组:observability(可观测)。 */
 export type ServiceObservabilityConfig = Pick<ServiceConfigFlat, "metricsToken" | "traceToken" | "toolTrace" | "traceThinking" | "logLevel" | "otel">;
 /** 组:integrations(外部集成)。`mcpServers` / `a2aPeers` 由 web-admin 适配器填(无 env 腿),归本组。 */
-export type ServiceIntegrationsConfig = Pick<ServiceConfigFlat, "pluginsAllowHosts" | "mcpServers" | "a2aPeers" | "a2aServe" | "configBootFetchBudgetMs" | "gitApiBaseUrl" | "gitApiToken" | "gitApiKind" | "defaultScenario" | "skillsDir" | "centerCredentialRenewLeadMs" | "webAdmin" | "fleetLeaseFailClosed" | "fleetGeneration" | "fleetScope" | "fleetAdvertiseAddress" | "fleetLeaseOutageMaxMs" | "configProvider" | "configLocalDir">;
+export type ServiceIntegrationsConfig = Pick<ServiceConfigFlat, "pluginsAllowHosts" | "mcpServers" | "a2aPeers" | "a2aServe" | "configBootFetchBudgetMs" | "gitApiBaseUrl" | "gitApiToken" | "gitApiKind" | "defaultScenario" | "skillsDir" | "centerCredentialRenewLeadMs" | "webAdmin" | "fleetLeaseFailClosed" | "fleetGeneration" | "fleetScope" | "fleetAdvertiseAddress" | "fleetLeaseOutageMaxMs" | "configProvider" | "configLocalDir" | "configLocalOwnerUid">;
 /** 九个组槽。每组恒在场(`loadConfig` / `attachConfigGroups` 装好才交出配置),故不可选——新代码写
  *  `config.modelPlane.model` 不需要 `?.`(可选组会把 `Model` 污染成 `Model | undefined`)。 */
 export interface ServiceConfigGroups {

package/dist/config-types.js

@@ -15,6 +15,14 @@ export function fleetScopeOf(raw) {
 export const CENTER_BASE_URL_RULE = "设了就必须是可解析的 http(s) URL,且不带凭据 / query / fragment(基址后面要拼路径);坏形拒启(没接中心也拒),拒句只点名规则,不回显 scheme";
 export const FLEET_LEASE_OUTAGE_MAX_DEFAULT_MS = 86_400_000;
 export const FIRST_BYTE_TIMEOUT_BOUNDS = { minMs: 0, maxMs: MAX_TIMER_DELAY_MS };
+export function inWholeNumberBounds(bounds, value) {
+    return typeof value === "number" && Number.isSafeInteger(value) && value >= bounds.min && value <= bounds.max;
+}
+export function wholeNumberBoundsRule(bounds) {
+    return bounds.max === Number.MAX_SAFE_INTEGER ? `an integer ≥ ${bounds.min}` : `an integer in [${bounds.min}, ${bounds.max}]`;
+}
+export const DEVICE_DELIVERY_TIMEOUT_BOUNDS = { min: 0, max: MAX_TIMER_DELAY_MS };
+export const DEVICE_EXEC_TIMEOUT_BOUNDS = { min: 1, max: MAX_TIMER_DELAY_MS };
 export const RESILIENCE_DEFAULTS = {
     firstTokenTimeoutMs: { env: "MODEL_FIRST_TOKEN_TIMEOUT_MS", value: 600_000 },
     idleTimeoutMs: { env: "MODEL_IDLE_TIMEOUT_MS", value: 300_000 },

package/dist/config.d.ts

@@ -288,6 +288,11 @@ export declare function isRosterGateArmed(webAdmin: ServiceConfig["webAdmin"]):
 export interface UnmatchableToolName {
     name: string;
     guidance: string;
+    /**
+     * 这一条为什么永远不生效 —— 机读位的 `reason`(`entry-problems.ts`):引擎名字判官的判词 `retired` / `unmintable_segment` / `unprefixed_namespace`、引擎规则文法的码原样(`invalid.*` /
+     * `unsupported.*`)、近似名 `near_miss`、名表消费者的 CC 规则形 `cc_rule_form`。句子里的 `guidance` 给人读,本字给机器读;两者在同一处同时铸。
+     */
+    reason: string;
 }
 /**
  * S-177(core 7.9.0 [ref])—— **这条名单条目喂给谁**,决定「永不匹配」这句话怎么判。三个消费者形态:
@@ -327,6 +332,14 @@ export declare function unmatchableToolNamesRefusal(source: string, names: reado
     readonly message: string;
     readonly names: readonly string[];
 } | undefined;
+/**
+ * {@link unmatchableToolNamesRefusal} 的本体:判一遍,句子(点名有界)与**全部**坏条目(每条带 `reason`)同时交出 —— 需要机读位的调用方(请求的 `settings.permissions.deny` / `ask` 的 422 与存体预判)读 `bad`,
+ * 只要句子与条目名的调用方(env / 中心下发的拒启)读上面那只薄壳。判据与句子只此一份。
+ */
+export declare function judgeUnmatchableToolNames(source: string, names: readonly string[], judgment: UnmatchableToolNameJudgment): {
+    readonly message: string;
+    readonly bad: readonly UnmatchableToolName[];
+} | undefined;
 /**
  * 运维 allow 表 `APPROVAL_GRANT` 的**拒启判据与拒因句**(同一只函数;`config-invariants.ts` 的 `…Refusal` 形:返回句子 = 拒,`undefined` = 通过)。
  * 7.117.0(core 7.42.0)起这张表整份投 `RunnerDeps.allowedTools`(引擎 allow 层的部署成员,构造时读一次),判据是**引擎的读法**,与请求的两张