@sema-agent/server 7.131.0 → 7.133.0

package/dist/boot/resolve-spec.d.ts

@@ -1,5 +1,4 @@
-import { type MemoryBackend, type RunnerDeps } from "@sema-agent/core";
-import type { PromptsDomainFaces } from "../prompts-domain-validate.js";
+import { type MemoryBackend } from "@sema-agent/core";
 import { SessionEnvironmentSelection, selectEnvironmentTool } from "../capabilities/select-environment-tool.js";
 import { sendUserFileTool } from "../capabilities/send-user-file-tool.js";
 import { selectScenario } from "../capabilities/scenarios.js";
@@ -17,6 +16,7 @@ import type { StoreBackend } from "../plugins/store-backend.js";
 import { type TaskAttachmentStore } from "../plugins/task-attachment-store.js";
 import { type createPrincipalEntitlementsClient } from "../runtime-caps-resolver.js";
 import { type OwnerAwareSessionStore } from "../security.js";
+import type { MemorySyncRunner } from "../memory-sync-client.js";
 import type { RunnerDepsOnAsk } from "./runner-deps.js";
 type PrincipalCaps = ReturnType<typeof createPrincipalEntitlementsClient>;
 /** `resolveSpec` 原先从 `main()` 闭包里拿到的全部 boot 局部量。 */
@@ -28,8 +28,6 @@ export interface ResolveSpecCtx {
     scenarios: Record<string, ReturnType<typeof selectScenario>>;
     principalCaps: PrincipalCaps | undefined;
     centerRuntimeCapsResolver: PrincipalCaps["resolveRuntimeCaps"] | undefined;
-    /** 活引用(adoptCenterPrompts 每次采用换引用)—— 见文件头「位置即契约」。 */
-    getCenterPrompts: () => PromptsDomainFaces | undefined;
     /** 活引用(registry 热应用换引用)—— 见文件头「位置即契约」。 */
     getKeyResolver: () => ReturnType<typeof createKeyResolver>;
     taskAttachmentStore: TaskAttachmentStore | undefined;
@@ -59,6 +57,8 @@ export interface ResolveSpecCtx {
         backend: MemoryBackend;
         root: string;
     } | undefined;
+    /** S-640:记忆同步腿(开 `MEMORY_SYNC_*` 且记忆引擎接线时在场)—— 项目层准备一步把本任务的项目层交给它跟踪(`memory-project-layer.ts`)。 */
+    memorySyncRunner: MemorySyncRunner | undefined;
     durableEnabled: boolean;
     /** [ref] ([ref] 案二):活体 AskUserQuestion 面(QuestionCoordinator 的判决探针切面)。在场(=
      *  ASK_QUESTION_ENABLED)时 durable question 门按活流上下文分腿、spec 不再 stamp QUESTION_AWAITS_RESUME
@@ -77,7 +77,6 @@ export interface ResolveSpecCtx {
     approverSeat: RunnerDepsOnAsk | undefined;
     approvalExemptionStore: ReturnType<StoreBackend["approvalExemption"]> | undefined;
     checkpointStore: ReturnType<NonNullable<StoreBackend["checkpoint"]>> | undefined;
-    deploymentHooks: NonNullable<RunnerDeps["hooks"]>;
     imageIndex: ReturnType<NonNullable<StoreBackend["imageIndex"]>> | undefined;
     perTaskImage: PerTaskImageRegistry;
     sessionEnvSelection: SessionEnvironmentSelection;

package/dist/boot/resolve-spec.js

@@ -1,25 +1,23 @@
 import { realpathSync } from "node:fs";
 import { join } from "node:path";
-import { NodeExecutionEnv, QUESTION_AWAITS_RESUME, WRITE_EXEMPT_DIR_COVERS_ROOT_CODE, deriveAskEffective, expandTiers, modePolicyOf, resolveAskSeamForm } from "@sema-agent/core";
+import { NodeExecutionEnv, QUESTION_AWAITS_RESUME, deriveAskEffective, expandTiers, modePolicyOf, resolveAskSeamForm } from "@sema-agent/core";
 import { cappedCeiling } from "../budget.js";
 import { recordFailOpen } from "../observability/fail-open.js";
-import { centerPromptProvider, centerIdentityAssembled } from "../capabilities/center-prompts.js";
 import { SessionEnvironmentSelection, selectEnvironmentTool } from "../capabilities/select-environment-tool.js";
 import { sendUserFileTool } from "../capabilities/send-user-file-tool.js";
-import { createScenarioGate, mergeUserSkills, selectScenario } from "../capabilities/scenarios.js";
+import { buildExcludeToolsSeat, buildPromptSeats, createScenarioGate, mergeUserSkills, selectScenario } from "../capabilities/scenarios.js";
 import { stampHandsLane, toolPolicyForHands } from "../capabilities/hands-lane.js";
-import { buildNoticeLaneFacts, noPersistentMemoryNotice, withNoPersistentMemoryNotice } from "../capabilities/memory-notice.js";
 import { applyLongtailDefer } from "../capabilities/tool-defer.js";
 import { assertGuardPatternsUsable, buildApprovalGrantNotice, buildOnlySensitiveBaselineWarning, createApprovalBaselinePolicy, createDeploymentGovernanceInputs } from "../deployment-governance.js";
 import { createDeploymentListExemption, gateIntentUnserviceableReason, singleUserAutoAcceptBaselineApplies } from "../approval.js";
 import { acceptShellScratchpadDir, buildEnvFacts, egressForRemoteExec, ensureScratchpadDir, resumeFactsForLane, scratchpadCoveringTaskRoot } from "../env-facts.js";
 import { FleetEventBus } from "../fleet/fleet-bus.js";
-import { composeHooks, createTaskHooks } from "../hooks/hook-runner.js";
+import { createSettingsHooksRegistration, settingsHooksBudgetMs } from "../hooks/hook-runner.js";
 import { HOST_POSTURE_REFUSED_CODE, taskInheritEnvRefusal, taskWriteFaceRefusal } from "../hosted-posture.js";
 import { headerStr } from "../http/principal-gate.js";
 import { explicitOperatorOk } from "../http/server.js";
 import { isAtMentionable, matchCatalogModel, modelSupportsImages, refusedCatalogEntry, resolveTaskModel, selectableCatalog, terminalCatalogName } from "../model-select.js";
-import { modelUnavailableMessage } from "../model-entry-refusal.js";
+import { echoModelRef, modelUnavailableMessage } from "../model-entry-refusal.js";
 import { PerTaskImageRegistry, resolveSandboxImageRef } from "../per-task-image.js";
 import { isRemoteScratchpadLane, remoteScratchpadDirFor } from "../plugins/remote-scratchpad.js";
 import { bindAttachmentsForTask } from "../plugins/task-attachment-store.js";
@@ -29,7 +27,9 @@ import { tightenGoverned } from "../governance-overrides.js";
 import { gateExecutionLane } from "../runtime-caps-resolver.js";
 import { applyRuntimeGovernance } from "../runtime-governance.js";
 import { HttpError, createCodedHttpError, encodeCheckpointScope } from "../security.js";
-import { memoryProjectKeyFor, memorySpecForRequest } from "../memory-scope.js";
+import { sessionFaceReadOf } from "../session-incarnation.js";
+import { memorySpecForRequest } from "../memory-scope.js";
+import { createMemoryProjectLayers } from "../memory-project-layer.js";
 import { inheritEnvFieldIssue, singleMemberOffFieldIssue } from "../request-value-closure.js";
 import { a2aForScenario, mcpForScenario } from "../web-admin-client/facade.js";
 import { normalizeAttachments, normalizeResilience, normalizeResumeAtMode, normalizeSuggestNextPrompts, promptProfileFromBody, resolveTaskLimits, retainBackgroundProcessesFromBody, taskAgentsSpecFragment, toolMaterializeStrategyFromBody, allowToolsSpecFragment, toolNameListFromBody } from "../spec-fields.js";
@@ -39,18 +39,21 @@ import { assertRequestA2aUnlocked, resolveRequestA2a } from "../task-a2a.js";
 import { assertRequestMcpEntries, assertRequestMcpUnlocked, resolveRequestMcp } from "../task-mcp.js";
 import { storedToolAxesRereadM19 } from "../stored-request-tool-axes-m19.js";
 import { storedHooksRereadM20 } from "../stored-request-hooks-m20.js";
-import { MAX_SETTINGS_OUTPUT_STYLE_CHARS, REQUEST_SETTINGS_REFUSAL_PREFIX, acceptAppendSystemPrompt, applyTaskSettings, effectivePermissionMode, effectiveThinking, hasConstitutionAnchors, parseTaskSettings, taskHooksHonored, providerDropsAppend, settingsPermissionBucketIssue, withPermissionMode } from "../task-settings.js";
+import { MAX_SETTINGS_OUTPUT_STYLE_CHARS, REQUEST_SETTINGS_REFUSAL_PREFIX, SETTINGS_RULE_REFUSAL_CODE, SettingsRuleRefusalError, acceptAppendSystemPrompt, applyTaskSettings, createWorkflowAskPolicy, effectivePermissionMode, effectiveThinking, parseTaskSettings, taskHooksHonored, settingsPermissionBucketIssue } from "../task-settings.js";
+import { tightenOnlySeatIssue } from "../tighten-only-seats.js";
+import { entryProblemsFacts } from "../entry-problems.js";
 import { inertToolListEntryOf } from "../rule-entry-list.js";
 import { TENANCY_WALL_CLOCK_BASE_SEC, enableForkFromBody, normalizeRetainSubagentSessions, selfOrchestrationFromBody } from "../task-workflow.js";
 import { redactSecrets } from "../trace/redact.js";
 import { DeferredSandboxPathEnv, isSandboxPathAdjudicationLane, sandboxPathEnvSlots } from "./deferred-sandbox-path-env.js";
-import { executionLaneCaps, executionLaneHomeDir, executionLaneOf } from "../execution-lane-caps.js";
+import { executionLaneHomeDir, executionLaneOf, laneWiresExecutionEnv } from "../execution-lane-caps.js";
 import { effectiveMemoryPersistenceCapable } from "./memory-boundary.js";
 import { withUnattendedLeg } from "../unattended-permission-mode.js";
-import { memoryFaceMounted } from "../memory-scope.js";
+import { fieldConflictFacts } from "../field-conflict.js";
 export function createResolveSpec(ctx) {
-    const { config, logger, metrics, localRoot, scenarios, principalCaps, centerRuntimeCapsResolver, getCenterPrompts, getKeyResolver, taskAttachmentStore, perSessionCwd, setSessionCwd, setSessionShellEnv, fenceSessionOwner, hookLlm, hookAgent, fleetBus, hookWakeBus, resumeAnchorStore, ownerAware, taskLimitCaps, taskTimeoutSec, selectEnvTool, sendUserFileToolSpec, memoryEngine, durableEnabled, approvalExemptionStore, checkpointStore, deploymentHooks, imageIndex, perTaskImage, sessionEnvSelection, liveQuestionFace, approverSeat, lockedKeys, } = ctx;
+    const { config, logger, metrics, localRoot, scenarios, principalCaps, centerRuntimeCapsResolver, getKeyResolver, taskAttachmentStore, perSessionCwd, setSessionCwd, setSessionShellEnv, fenceSessionOwner, hookLlm, hookAgent, fleetBus, hookWakeBus, resumeAnchorStore, ownerAware, taskLimitCaps, taskTimeoutSec, selectEnvTool, sendUserFileToolSpec, memoryEngine, memorySyncRunner, durableEnabled, approvalExemptionStore, checkpointStore, imageIndex, perTaskImage, sessionEnvSelection, liveQuestionFace, approverSeat, lockedKeys, } = ctx;
     const scenarioGate = createScenarioGate({ config, scenarios, principalCaps, logger }, "enforce");
+    const readSessionFace = sessionFaceReadOf(ownerAware);
     assertGuardPatternsUsable(config);
     const onlySensitiveBaseline = buildOnlySensitiveBaselineWarning(config, {
         approvalSeat: durableEnabled ? "durable" : "absent",
@@ -62,6 +65,7 @@ export function createResolveSpec(ctx) {
         const sessionCwd = auth?.sessionId ? effectiveHostWorkspace(perSessionCwd.get(auth.sessionId), {}) : undefined;
         return sessionCwd ?? (config.remoteExec === undefined ? process.cwd() : undefined);
     };
+    const memoryProjectLayers = createMemoryProjectLayers({ backend: memoryEngine?.backend, syncRunner: memorySyncRunner, log: logger });
     if (onlySensitiveBaseline)
         logger.warn(onlySensitiveBaseline.event, onlySensitiveBaseline.fields);
     const approvalGrantNotice = buildApprovalGrantNotice(config);
@@ -84,7 +88,7 @@ export function createResolveSpec(ctx) {
                 cwdHonored: cwdHonored(config),
             });
             if (conflict) {
-                throw new HttpError(400, `cwd "${conflict.cwd.asSpelled}" is inside this session's scratchpad "${conflict.scratchpadDir.asSpelled}" — the scratchpad is the fs-write gate's EXEMPT directory, so a task rooted there would auto-approve every write under its own root and the engine refuses to build the gate at all (config.write_exempt_dir_covers_root). Point cwd at the project directory instead (or send no cwd and let the session keep the one it has): this session registers the cwd you send, so a task that happens not to mount the write gate would still leave every LATER task on this session rooted in the exemption. A workflow that really is meant to write without prompts says so with a knob that means it (a permission mode, an open write face) and still keeps its root outside the scratchpad — those knobs do not lift this refusal, because the conflict is between two fields of this request, not a permission level.`, { code: "request.field_conflict", extra: { cwd: conflict.cwd, scratchpadDir: conflict.scratchpadDir } });
+                throw new HttpError(400, `cwd "${conflict.cwd.asSpelled}" is inside this session's scratchpad "${conflict.scratchpadDir.asSpelled}" — the scratchpad is the fs-write gate's EXEMPT directory, so a task rooted there would auto-approve every write under its own root and the engine refuses to build the gate at all (config.write_exempt_dir_covers_root). Point cwd at the project directory instead (or send no cwd and let the session keep the one it has): this session registers the cwd you send, so a task that happens not to mount the write gate would still leave every LATER task on this session rooted in the exemption. A workflow that really is meant to write without prompts says so with a knob that means it (a permission mode, an open write face) and still keeps its root outside the scratchpad — those knobs do not lift this refusal, because the conflict is between two fields of this request, not a permission level.`, { code: "request.field_conflict", extra: { ...fieldConflictFacts("scratchpad_root", body.scratchpadDir === conflict.scratchpadDir.asSpelled ? ["cwd", "scratchpadDir"] : ["cwd"]), cwd: conflict.cwd, scratchpadDir: conflict.scratchpadDir } });
             }
         }
         const offFieldIssue = singleMemberOffFieldIssue(body);
@@ -112,6 +116,11 @@ export function createResolveSpec(ctx) {
             if (bucketIssue)
                 throw new HttpError(400, bucketIssue.message, { code: "request.field_invalid", extra: bucketIssue.fields });
         }
+        {
+            const seatIssue = tightenOnlySeatIssue(body.settings);
+            if (seatIssue)
+                throw new HttpError(400, seatIssue.message, { code: "request.field_invalid", extra: seatIssue.fields });
+        }
         {
             const replay = opts?.leg === "resume";
             const inertList = inertToolListEntryOf(body, replay ? ["deny"] : undefined);
@@ -139,8 +148,9 @@ export function createResolveSpec(ctx) {
         }
         const lane = bindSettingsCwdEnvAndModel(body, auth, gated, opts);
         const anchors = await resolveHistoryAnchors(body, auth);
-        const spec = assembleSpecLiteral(body, auth, req, opts, { ...gated, ...lane, ...anchors }, effMode);
-        const folded = await foldGovernanceAndSettings(body, auth, spec, gated, effMode);
+        const projectKey = memoryEngine ? await memoryProjectLayers.prepare(config, auth?.memoryScope, realTaskRootOf(auth)) : undefined;
+        const spec = assembleSpecLiteral(body, auth, req, opts, { ...gated, ...lane, ...anchors, projectKey }, effMode);
+        const folded = await foldGovernanceAndSettings(body, auth, spec, gated);
         const final = await applyImageFactsAndRouting(body, auth, folded.governed, {
             scenarioName: gated.scenarioName,
             scratchpadDir: folded.scratchpadDir,
@@ -152,20 +162,10 @@ export function createResolveSpec(ctx) {
     const gateScenarioAndAppend = async (body, auth, opts) => {
         const scenarioName = await scenarioGate(auth?.principal, body.scenario);
         gateExecutionLane(await principalCaps?.executionRuling(auth?.principal), executionLaneOf(config.remoteExec?.provider), logger);
-        const cap = selectScenario(scenarios, scenarioName)(body, auth?.principal, auth?.sessionId !== undefined ? { sessionId: auth.sessionId } : {});
-        const centerDecls = getCenterPrompts()?.declarations;
-        const appendLessPack = centerDecls
-            ? centerIdentityAssembled(centerDecls, scenarioName, hasConstitutionAnchors)
-            : providerDropsAppend(cap.promptProvider, typeof body.systemPrompt === "string" ? body.systemPrompt : undefined);
-        const acceptedAppend = acceptAppendSystemPrompt(body.appendSystemPrompt, (detail) => logger.warn("append_system_prompt_dropped", { detail, sessionId: auth?.sessionId ?? null }), appendLessPack);
+        const cap = selectScenario(scenarios, scenarioName)(body, auth?.principal, auth?.sessionId !== undefined ? { sessionId: auth.sessionId, delegationRoot: { sessionId: auth.sessionId, incarnation: (await readSessionFace?.(auth.sessionId))?.incarnation ?? null } } : {});
+        const acceptedAppend = acceptAppendSystemPrompt(body.appendSystemPrompt, (detail) => logger.warn("append_system_prompt_dropped", { detail, sessionId: auth?.sessionId ?? null }));
         const objective = typeof body.objective === "string" ? body.objective : "";
         const parsedSettings = parseTaskSettings(body.settings, opts?.leg === "fresh" || !taskHooksHonored(config) ? {} : { storedHooksReread: storedHooksRereadM20(new Date().toISOString().slice(0, 10)) });
-        if (opts?.leg === "fresh" && appendLessPack) {
-            const riderPresent = typeof body.appendSystemPrompt === "string" && body.appendSystemPrompt.length > 0;
-            if (riderPresent || parsedSettings.settings?.outputStyle) {
-                throw new HttpError(400, `${riderPresent ? "appendSystemPrompt" : "settings.outputStyle"} is not supported when the effective prompt is already assembled (constitution anchors in systemPrompt, or a center assembled-identity pack for this scenario): the assembler's pass-through path cannot mount the append slot — fold it into the assembled prompt instead`);
-            }
-        }
         if (parsedSettings.deferred.length > 0) {
             logger.warn("task_settings_deferred", { fields: parsedSettings.deferred, sessionId: auth?.sessionId ?? null });
         }
@@ -212,7 +212,7 @@ export function createResolveSpec(ctx) {
                 }
             }
         }
-        return { scenarioName, cap, hands: cap.hands, centerDecls, appendLessPack, acceptedAppend, objective, parsedSettings, attachmentNotice };
+        return { scenarioName, cap, hands: cap.hands, acceptedAppend, objective, parsedSettings, attachmentNotice };
     };
     const bindSettingsCwdEnvAndModel = (body, auth, gated, opts) => {
         const { objective, parsedSettings } = gated;
@@ -250,7 +250,7 @@ export function createResolveSpec(ctx) {
                 logger.warn("task_hooks_ignored", { honored: false, sessionId: auth?.sessionId ?? null });
                 return undefined;
             }
-            return createTaskHooks(hc, {
+            return createSettingsHooksRegistration(hc, {
                 logger,
                 sessionId: auth?.sessionId ?? "",
                 cwd: (auth?.sessionId ? perSessionCwd.get(auth.sessionId) : undefined) ?? process.cwd(),
@@ -270,7 +270,7 @@ export function createResolveSpec(ctx) {
                             : false,
                     }
                     : {}),
-            });
+            }, settingsHooksBudgetMs(config));
         })();
         const rawAddDirs = body.additionalDirectories;
         const additionalDirectories = cwdHonored(config) ? parseAdditionalDirectories(rawAddDirs) : undefined;
@@ -287,22 +287,22 @@ export function createResolveSpec(ctx) {
         if (picked.unavailable !== undefined) {
             const { requested, name, refusal, source } = picked.unavailable;
             if (opts?.leg === "fresh") {
-                throw new HttpError(400, modelUnavailableMessage(source === "mention" ? "@-mention" : "model", requested.slice(0, 120), name, refusal), { code: "request.model_unavailable" });
+                throw new HttpError(400, modelUnavailableMessage(source === "mention" ? "@-mention" : "model", requested, name, refusal), { code: "request.model_unavailable" });
             }
             metrics.inc("task_model_unavailable_fallback_total");
-            logger.warn("task_model_unavailable_fallback", { requested: requested.slice(0, 120), name, code: refusal.code, source, fallback: picked.model, sessionId: auth?.sessionId ?? null });
+            logger.warn("task_model_unavailable_fallback", { requested: echoModelRef(requested), name, code: refusal.code, source, fallback: picked.model, sessionId: auth?.sessionId ?? null });
         }
         if (picked.notAllowed !== undefined) {
             const { requested, resolved, source } = picked.notAllowed;
             if (opts?.leg === "fresh") {
-                throw new HttpError(400, `model "${requested.slice(0, 120)}" is not @-mentionable on this deployment (it resolves to catalog model "${resolved}") — which models can be @-mentioned is configured by the operator (models.atMention)`, { code: "request.model_not_allowed" });
+                throw new HttpError(400, `model "${echoModelRef(requested)}" is not @-mentionable on this deployment (it resolves to catalog model "${resolved}") — which models can be @-mentioned is configured by the operator (models.atMention)`, { code: "request.model_not_allowed" });
             }
             metrics.inc("task_model_not_allowlisted_resume_total");
-            logger.warn("task_model_not_allowlisted_resume", { requested: requested.slice(0, 120), resolved, source, sessionId: auth?.sessionId ?? null, note: "resumed leg keeps running the model it was started on — the allowlist gates fresh picks only" });
+            logger.warn("task_model_not_allowlisted_resume", { requested: echoModelRef(requested), resolved, source, sessionId: auth?.sessionId ?? null, note: "resumed leg keeps running the model it was started on — the allowlist gates fresh picks only" });
         }
         if (picked.unknownExplicit !== undefined) {
             metrics.inc("task_model_unknown_fallback_total");
-            logger.warn("task_model_unknown_fallback", { requested: picked.unknownExplicit.slice(0, 120), fallback: picked.model, sessionId: auth?.sessionId ?? null });
+            logger.warn("task_model_unknown_fallback", { requested: echoModelRef(picked.unknownExplicit), fallback: picked.model, sessionId: auth?.sessionId ?? null });
         }
         if (Array.isArray(body.images) && body.images.length > 0 && !modelSupportsImages(wireCatalog[picked.model])) {
             metrics.inc("images_omitted_total", { model: picked.model });
@@ -351,10 +351,11 @@ export function createResolveSpec(ctx) {
         return deriveAskEffective(askForm.form, "unresolved") === "human_reachable";
     };
     const assembleSpecLiteral = (body, auth, req, opts, parts, effMode) => {
-        const { scenarioName, cap, hands, centerDecls, acceptedAppend, parsedSettings, attachmentNotice, taskHooks, additionalDirectories, additionalReadDirectories, wireCatalog, picked, resumeAtEntryId, rewindFilesToEntryId, s4DefaultScopes, } = parts;
+        const { scenarioName, cap, hands, acceptedAppend, parsedSettings, attachmentNotice, taskHooks, additionalDirectories, additionalReadDirectories, wireCatalog, picked, resumeAtEntryId, rewindFilesToEntryId, s4DefaultScopes, projectKey, } = parts;
+        const storedToolAxes = opts?.leg === "fresh" ? undefined : storedToolAxesRereadM19(new Date().toISOString().slice(0, 10));
         const spec = {
             objective: attachmentNotice ? `${picked.cleanedObjective}\n\n${attachmentNotice}` : picked.cleanedObjective,
-            systemPrompt: typeof body.systemPrompt === "string" ? body.systemPrompt : undefined,
+            ...buildPromptSeats(scenarioName, cap.prompt, typeof body.systemPrompt === "string" ? body.systemPrompt : undefined),
             appendSystemPrompt: acceptedAppend,
             ...(body.outputStyle !== undefined ? { outputStyle: body.outputStyle } : {}),
             sessionId: auth?.sessionId,
@@ -392,7 +393,7 @@ export function createResolveSpec(ctx) {
                 ? { retainBackgroundProcesses: true }
                 : {}),
             ...(body.excludeAllTools === true ? { excludeAllTools: true } : {}),
-            ...(() => { const v = toolNameListFromBody(body.excludeTools); return v ? { excludeTools: v } : {}; })(),
+            ...buildExcludeToolsSeat(cap.excludeTools, toolNameListFromBody(body.excludeTools)),
             ...allowToolsSpecFragment(body.allowTools),
             ...(() => { const v = toolNameListFromBody(body.deferTools); return v ? { deferTools: v } : {}; })(),
             ...(() => { const v = promptProfileFromBody(body.promptProfile); return v ? { promptProfile: v } : {}; })(),
@@ -401,10 +402,10 @@ export function createResolveSpec(ctx) {
             ...(declaresInteractivePosture(body, req, opts) ? { interactionPosture: "interactive" } : {}),
             ...(body.approvalReach !== undefined ? { approvalReach: body.approvalReach } : {}),
             ...(typeof body.oneShot === "boolean" ? { oneShot: body.oneShot } : {}),
-            resilience: normalizeResilience(body.resilience, explicitOperatorOk(auth?.principal, config.operatorPrincipals)),
+            resilience: normalizeResilience(body.resilience, explicitOperatorOk(auth?.principal, config)),
             finalVerification: cap.finalVerification === true || body.finalVerification === true ? true : undefined,
             attachments: normalizeAttachments(body.attachments),
-            ...(taskHooks ? { hooks: composeHooks(deploymentHooks, taskHooks) } : {}),
+            ...(taskHooks ? { mods: [taskHooks] } : {}),
             model: picked.model,
             ...((() => {
                 if (typeof body.compactionModel !== "string" || body.compactionModel.length === 0)
@@ -412,23 +413,23 @@ export function createResolveSpec(ctx) {
                 const cm = matchCatalogModel(body.compactionModel, wireCatalog, config.modelRefusals);
                 const refusedCm = cm === undefined ? refusedCatalogEntry(body.compactionModel, config.modelRefusals) : undefined;
                 if (refusedCm !== undefined && opts?.leg === "fresh") {
-                    throw new HttpError(400, modelUnavailableMessage("compactionModel", body.compactionModel.slice(0, 120), refusedCm.name, refusedCm.refusal), { code: "request.model_unavailable" });
+                    throw new HttpError(400, modelUnavailableMessage("compactionModel", body.compactionModel, refusedCm.name, refusedCm.refusal), { code: "request.model_unavailable" });
                 }
                 if (cm === undefined) {
                     if (opts?.leg === "fresh") {
-                        throw new HttpError(400, `unknown compactionModel "${body.compactionModel.slice(0, 120)}" — not in the configured catalog (name, tier word, or id; a catalog refresh may have removed it mid-request)`);
+                        throw new HttpError(400, `unknown compactionModel "${echoModelRef(body.compactionModel)}" — not in the configured catalog (name, tier word, or id; a catalog refresh may have removed it mid-request)`);
                     }
                     metrics.inc("task_model_unknown_fallback_total");
-                    logger.warn("compaction_model_unknown_fallback", { requested: body.compactionModel.slice(0, 120), sessionId: auth?.sessionId ?? null });
+                    logger.warn("compaction_model_unknown_fallback", { requested: echoModelRef(body.compactionModel), sessionId: auth?.sessionId ?? null });
                     return {};
                 }
                 if (!isAtMentionable(cm, wireCatalog, config.atMention, config.modelRefusals)) {
                     const terminal = terminalCatalogName(cm, wireCatalog, config.modelRefusals) ?? cm;
                     if (opts?.leg === "fresh") {
-                        throw new HttpError(400, `compactionModel "${body.compactionModel.slice(0, 120)}" is not @-mentionable on this deployment (it resolves to catalog model "${terminal}") — which models can be @-mentioned is configured by the operator (models.atMention)`, { code: "request.model_not_allowed" });
+                        throw new HttpError(400, `compactionModel "${echoModelRef(body.compactionModel)}" is not @-mentionable on this deployment (it resolves to catalog model "${terminal}") — which models can be @-mentioned is configured by the operator (models.atMention)`, { code: "request.model_not_allowed" });
                     }
                     metrics.inc("task_model_not_allowlisted_resume_total");
-                    logger.warn("task_model_not_allowlisted_resume", { requested: body.compactionModel.slice(0, 120), resolved: terminal, source: "compaction", sessionId: auth?.sessionId ?? null, note: "resumed leg keeps the compaction model it was started with — the allowlist gates fresh picks only" });
+                    logger.warn("task_model_not_allowlisted_resume", { requested: echoModelRef(body.compactionModel), resolved: terminal, source: "compaction", sessionId: auth?.sessionId ?? null, note: "resumed leg keeps the compaction model it was started with — the allowlist gates fresh picks only" });
                 }
                 return { compactionModel: cm };
             })()),
@@ -471,7 +472,7 @@ export function createResolveSpec(ctx) {
             })(),
             ...(config.requirePrincipal !== true ? { backgroundScope: "session" } : {}),
             memory: memoryEngine
-                ? memorySpecForRequest(auth?.memoryScope, memoryProjectKeyFor(config, auth?.memoryScope, realTaskRootOf(auth)), body.memoryWrite, s4DefaultScopes, { multiTenant: config.requirePrincipal === true }, { memory: body.memory, memoryCapture: body.memoryCapture })
+                ? memorySpecForRequest(auth?.memoryScope, projectKey, body.memoryWrite, s4DefaultScopes, { multiTenant: config.requirePrincipal === true }, { memory: body.memory, memoryCapture: body.memoryCapture })
                 : undefined,
             ...((v) => (v !== undefined ? { memoryPersistenceCapable: v } : {}))(effectiveMemoryPersistenceCapable(config)),
             tools: ((base) => {
@@ -483,9 +484,8 @@ export function createResolveSpec(ctx) {
             ...(() => { const v = toolNameListFromBody(body.userInvokedSkills); return v ? { userInvokedSkills: v } : {}; })(),
             ...(parsedSettings.settings?.skillListingBudgetFraction !== undefined ? { skillListingBudgetFraction: parsedSettings.settings.skillListingBudgetFraction } : {}),
             ...(parsedSettings.settings?.skillListingMaxDescChars !== undefined ? { skillListingMaxDescChars: parsedSettings.settings.skillListingMaxDescChars } : {}),
-            mcp: resolveRequestMcp(mcpForScenario(config.mcpServers, scenarioName), body.mcpServers, config, logger, opts?.onNotice !== undefined ? { sessionId: auth?.sessionId, emit: opts.onNotice } : undefined, opts?.leg === "fresh" ? undefined : storedToolAxesRereadM19(new Date().toISOString().slice(0, 10))),
-            a2a: resolveRequestA2a(a2aForScenario(config.a2aPeers, scenarioName), body.a2aPeers, config, logger),
-            promptProvider: centerDecls ? centerPromptProvider(centerDecls, scenarioName) : cap.promptProvider,
+            mcp: resolveRequestMcp(mcpForScenario(config.mcpServers, scenarioName), body.mcpServers, config, logger, opts?.onNotice !== undefined ? { sessionId: auth?.sessionId, emit: opts.onNotice } : undefined, storedToolAxes),
+            a2a: resolveRequestA2a(a2aForScenario(config.a2aPeers, scenarioName), body.a2aPeers, config, logger, opts?.leg === "fresh" ? "fresh" : "resume", storedToolAxes),
             toolPolicy: toolPolicyForHands(hands, durableEnabled
                 ? createApprovalBaselinePolicy(config, {
                     kind: "durable",
@@ -518,8 +518,8 @@ export function createResolveSpec(ctx) {
         };
         return spec;
     };
-    const foldGovernanceAndSettings = async (body, auth, spec, gated, effMode) => {
-        const { appendLessPack, acceptedAppend, parsedSettings } = gated;
+    const foldGovernanceAndSettings = async (body, auth, spec, gated) => {
+        const { acceptedAppend, parsedSettings } = gated;
         const hostSemanticsLane = !isSandboxPathAdjudicationLane(config.remoteExec?.provider);
         const laneHomeBase = () => {
             const home = executionLaneHomeDir(config);
@@ -546,12 +546,7 @@ export function createResolveSpec(ctx) {
             };
         const governedBase = applyRuntimeGovernance(spec, createDeploymentGovernanceInputs(config, pathAdjudication));
         let governed = governedBase;
-        let effectiveSettings = effMode ? withPermissionMode(parsedSettings.settings, effMode) : parsedSettings.settings;
-        if (appendLessPack && effectiveSettings?.outputStyle) {
-            logger.warn("output_style_dropped", { detail: "the effective prompt pack cannot mount the append slot (already-assembled systemPrompt or center assembled-identity declaration)", sessionId: auth?.sessionId ?? null });
-            const { outputStyle: _dropped, ...rest } = effectiveSettings;
-            effectiveSettings = Object.keys(rest).length > 0 ? rest : undefined;
-        }
+        let effectiveSettings = parsedSettings.settings;
         if (effectiveSettings?.outputStyle && acceptedAppend && acceptedAppend.length + 2 + effectiveSettings.outputStyle.length > MAX_SETTINGS_OUTPUT_STYLE_CHARS) {
             logger.warn("output_style_dropped", { detail: `combined append carriers exceed the ${MAX_SETTINGS_OUTPUT_STYLE_CHARS} cap (rider ${acceptedAppend.length} + style ${effectiveSettings.outputStyle.length}) — style dropped (pre-cap stored body on a resume leg?)`, sessionId: auth?.sessionId ?? null });
             const { outputStyle: _dropped2, ...rest2 } = effectiveSettings;
@@ -567,74 +562,30 @@ export function createResolveSpec(ctx) {
                 ? await ensureScratchpadDir(config.localDataRoot ?? localRoot, auth.sessionId, (msg, meta) => logger.warn(msg, { ...(meta ?? {}), sessionId: auth.sessionId }))
                 : undefined);
         if (effectiveSettings) {
-            const gateCommon = {
-                ...(approvalExemptionStore && auth?.sessionId
-                    ? {
-                        isExempt: async (toolName) => {
-                            const hit = await approvalExemptionStore.has(auth.sessionId, toolName);
-                            if (hit)
-                                logger.info("fs_write_gate_exempted", { toolName, sessionId: auth.sessionId });
-                            return hit;
-                        },
-                    }
-                    : {}),
+            const ruleBases = {
+                ...(pathAdjudication.taskRoot !== undefined ? { taskRoot: pathAdjudication.taskRoot } : {}),
+                ...(pathAdjudication.taskHome !== undefined ? { taskHome: pathAdjudication.taskHome } : {}),
             };
-            const fsWriteGate = hostSemanticsLane
-                ? {
-                    env: pathAdjudication.env,
-                    ...(pathAdjudication.cwd !== undefined ? { cwd: pathAdjudication.cwd } : {}),
-                    ...(pathAdjudication.taskRoot !== undefined ? { taskRoot: pathAdjudication.taskRoot } : {}),
-                    ...(pathAdjudication.taskHome !== undefined ? { taskHome: pathAdjudication.taskHome } : {}),
-                    ...(scratchpadDir ? { scratchpadDir } : {}),
-                    ...gateCommon,
-                }
-                :
-                    (() => {
-                        const sandboxScratchpadDir = isRemoteScratchpadLane(config.remoteExec?.provider) ? remoteScratchpadDirFor(auth?.sessionId) : undefined;
-                        return {
-                            env: pathAdjudication.env,
-                            ...(pathAdjudication.taskHome !== undefined ? { taskHome: pathAdjudication.taskHome } : {}),
-                            ...gateCommon,
-                            ...(sandboxScratchpadDir ? { scratchpadDir: sandboxScratchpadDir } : {}),
-                            ...(gateCommon.isExempt
-                                ? {
-                                    isExempt: (toolName, canonicalPath) => canonicalPath.startsWith("/") ? gateCommon.isExempt(toolName) : false,
-                                }
-                                : {}),
-                        };
-                    })();
-            const workflowGate = approvalExemptionStore && auth?.sessionId
-                ? {
-                    isExempt: async (toolName) => {
-                        const hit = await approvalExemptionStore.has(auth.sessionId, toolName);
-                        if (hit)
-                            logger.info("workflow_gate_exempted", { toolName, sessionId: auth.sessionId });
-                        return hit;
-                    },
-                }
-                : undefined;
             try {
-                governed = applyTaskSettings(governedBase, effectiveSettings, fsWriteGate, workflowGate);
+                governed = applyTaskSettings(governedBase, effectiveSettings, ruleBases);
             }
             catch (e) {
-                if (e.code === WRITE_EXEMPT_DIR_COVERS_ROOT_CODE) {
-                    throw new HttpError(400, e.message, {
-                        code: "request.field_conflict",
-                        ...(e.detail !== undefined ? { extra: { writeExemptDirCoversRoot: e.detail } } : {}),
-                    });
-                }
+                if (e instanceof SettingsRuleRefusalError)
+                    throw new HttpError(422, `${REQUEST_SETTINGS_REFUSAL_PREFIX}${e.message}`, { code: SETTINGS_RULE_REFUSAL_CODE, extra: { ...entryProblemsFacts(e.problems) } });
                 throw new HttpError(422, `${REQUEST_SETTINGS_REFUSAL_PREFIX}${e.message}`);
             }
         }
-        const notice = noPersistentMemoryNotice({
-            memoryFaceMounted: memoryFaceMounted(governed.memory),
-            declaredCapable: effectiveMemoryPersistenceCapable(config),
-            hands: gated.hands,
-            handsReadOnly: governed.handsReadOnly === true,
-            ...buildNoticeLaneFacts(executionLaneOf(config.remoteExec?.provider)),
-        });
-        if (notice !== "silent") {
-            governed = { ...governed, promptProvider: withNoPersistentMemoryNotice(governed.promptProvider, notice) };
+        if (governed.selfOrchestration === true) {
+            governed = tightenGoverned(governed, {
+                toolPolicy: createWorkflowAskPolicy(approvalExemptionStore && auth?.sessionId
+                    ? async (toolName) => {
+                        const hit = await approvalExemptionStore.has(auth.sessionId, toolName);
+                        if (hit)
+                            logger.info("workflow_gate_exempted", { toolName, sessionId: auth.sessionId });
+                        return hit;
+                    }
+                    : undefined),
+            });
         }
         return { governed, scratchpadDir, hostSemanticsLane };
     };
@@ -645,13 +596,13 @@ export function createResolveSpec(ctx) {
         let resolvedImageCaps;
         if (taskImageProfile !== undefined) {
             if (config.remoteExec?.provider !== "k8s") {
-                throw new HttpError(400, "sandboxImageProfile is only supported on the k8s sandbox backend");
+                throw createCodedHttpError(501, "capability.k8s_lane_required", "sandboxImageProfile is only supported on the k8s sandbox backend");
             }
             if (!imageIndex) {
-                throw new HttpError(400, "sandboxImageProfile requires the image index (web-admin backend not configured)");
+                throw createCodedHttpError(501, "capability.image_index_required", "sandboxImageProfile requires the sandbox-image-pool, which needs a SQL store backend (DB_BACKEND=mysql|pg) — this deployment's store wires no image index");
             }
             if (!auth?.sessionId) {
-                throw new HttpError(400, "sandboxImageProfile requires a resolved session");
+                throw createCodedHttpError(400, "request.precondition_unmet", "sandboxImageProfile requires a resolved session");
             }
             const capsNeeded = Array.isArray(body.capabilitiesNeeded)
                 ? body.capabilitiesNeeded.filter((c) => typeof c === "string")
@@ -659,11 +610,11 @@ export function createResolveSpec(ctx) {
             const resolved = await resolveSandboxImageRef({
                 profile: taskImageProfile,
                 ...(capsNeeded && capsNeeded.length > 0 ? { capabilitiesNeeded: capsNeeded } : {}),
-                viewer: { operator: explicitOperatorOk(auth.principal, config.operatorPrincipals), tenantId: auth.principal ?? null },
+                viewer: { operator: explicitOperatorOk(auth.principal, config), tenantId: auth.principal ?? null },
                 index: imageIndex,
             });
             if (!resolved.ok)
-                throw new HttpError(resolved.status, resolved.message);
+                throw createCodedHttpError(resolved.status, resolved.errorCode, resolved.message);
             perTaskImage.set(auth.sessionId, resolved.ref);
             resolvedImageCaps = resolved.capabilities;
         }
@@ -690,7 +641,7 @@ export function createResolveSpec(ctx) {
             const isolatedExecEnv = isIsolatedExecEnv(config.remoteExec?.provider, config.remoteExec?.provider === "k8s" ? config.remoteExec.runtimeClass : undefined);
             const decision = routeServiceTask({
                 isolatedExecEnv,
-                hasExecutionEnv: executionLaneCaps(executionLaneOf(config.remoteExec?.provider)).coreRemoteExecutionEnv === "supported",
+                hasExecutionEnv: laneWiresExecutionEnv(executionLaneOf(config.remoteExec?.provider)),
                 ...(config.autonomy ? { autonomy: config.autonomy } : {}),
             });
             logger.info("orchestration_routed", { mode: decision.mode, reason: decision.reason, sessionId: auth?.sessionId ?? null });

package/dist/boot/runner-deps.d.ts

@@ -56,13 +56,16 @@ import type { MailboxRecipientLifecycle } from "../plugins/mailbox-recipient-lif
 export type RunnerDepsOnAsk = (req: Parameters<ToolApprovalCoordinator["ask"]>[0], signal?: AbortSignal) => Promise<AskOutcome>;
 export declare function createRunnerDepsOnAsk(toolApproval: ToolApprovalCoordinator | undefined): RunnerDepsOnAsk | undefined;
 /** [ref] 件⑤:core `onError(phase:"config")` 的 `classification` 已知词表。⚠️ core d.ts(`RunnerDeps.onError` 注)只登记了
- *  prompt-cache 相的五词,config 相的词**只在 dist js 出现**(7.35.0 亲扫 dist 下全部 js 的 `phase: "config"` 发射点:四词——
- *  `interaction-posture-refused`(prepare-config-doors)/ `memory-tools-not-mounted` / `shared-memory-not-mounted`
- *  (prepare-defer-classify / prepare-project-context)/ `sandbox-admission-unavailable`(prepare-policy-chain));
+ *  prompt-cache 相的五词,config 相的词**只在 dist js 出现**,发射点有两种写法:字面量(`classification: "<词>"`)与经变量 / 表行发射
+ *  (`classification: <变量>` 取自同文件的字面量初值,或 `classification: <表>.classification` 取自同文件的表行)。7.52.0 亲扫六词 ——
+ *  `interaction-posture-refused`(prepare-config-doors,字面量)/ `sandbox-admission-unavailable`(prepare-policy-chain,字面量)/
+ *  `memory-tools-not-mounted` / `shared-memory-not-mounted`(core 7.52.0 起一只铸点 `announceMemoryNotMounted`,词在
+ *  announce-once-ledger 的表行)/ `file-history-no-store` / `file-history-no-env`(prepare-file-history 的 `livenessArm` 变量,core 7.30 起
+ *  就在 —— 只认字面量的旧扫描看不见它们,两词一直被标 `classificationKnown:false`、指标折 `unknown`,本版随扫描改读两种写法一并收进表)。
  *  S-877:第五词 `shell-gate-off` 随 core 7.34.0 的 off 车道一起退役(引擎侧零发射点),同批删 —— 它唯一的本仓消费者
  *  (「本 session 显式 bypass ⇒ 降级 info」那条回查腿与 `boot/session-shell-gate-registry.ts` 登记簿)一并删干净。所以这是「按实现亲读」的开集快照,不是 core 类型闭集——词表外的值原样进日志并标
  *  `classificationKnown:false`(指标标签折 `unknown`),不吞不编;与安装包的锁步由 test/boot-runner-deps-shared-base.test.ts
- *  的 dist 扫描格钉住(core 加词/收进 d.ts 那天先红)。 */
+ *  的 dist 扫描格钉住(两种发射写法都读;读不出词的经变量发射点本身红;core 加词/收进 d.ts 那天先红)。 */
 export declare const CONFIG_ADVISORY_CLASSIFICATIONS: ReadonlySet<string>;
 /** S-386:core 的 [ref] 前缀缓存**断裂**探测器交给宿主的根因**闭集**,以及每个词的日志级别。
  *  闭集**不抄词**:词源直接取 core 公开导出的 `CacheBreakFinding["cause"]`(`@sema-agent/core` 根导出,
@@ -218,14 +221,15 @@ export interface RunnerDepsCtx {
      * 的「差异键」注释块逐条列了 sessionStore / checkpointStore / 四个座位,**都没提 hands**
      * —— 也就是说它不是一次有理由的分歧,是漏配(与本函数头注记的 [ref]§三族A 同一个病族)。
      * 由**调用方**给值(而不是在基座里按 `config` 现算):两条腿的判据本就不同(HTTP 腿按
-     * `configProvider === "local"` 分 branded/非 branded,run-local 恒是 Sema 本地形),
+     * 品牌判官 `isBrandedDeployment`(`capabilities/brand-identity.ts`)分 branded/非 branded,run-local 恒是 Sema 本地形),
      * 各自算一次、传进来一次,两只 Runner 自动同源。
      */
     hands: RunnerDeps["hands"];
     executionEnvFactory: RunnerDeps["executionEnvFactory"];
     lspManager: RunnerDeps["lspManager"];
     fleetBus: FleetEventBus;
-    deploymentHooks: NonNullable<RunnerDeps["hooks"]>;
+    /** 部署座的 mods 注册(stage-05 `createDeploymentMods` 铸、起服自证过)—— 共享基座 ⇒ 主 / handless / hookAgent / sub 每一只 Runner 同一份。 */
+    deploymentMods: NonNullable<RunnerDeps["mods"]>;
     workflowRunStore: WorkflowRunStore | undefined;
     workflowJournalStore: ServiceWorkflowJournalStore | undefined;
     workflowAgentRegistry: WorkflowAgentRegistry | undefined;
@@ -237,7 +241,7 @@ export interface RunnerDepsCtx {
 }
 /** [ref] A10 留档发现②:main runner `RunnerDeps` 与 main.ts subRunner 字面量之间此前手工重复
  * 的 ~15 个键,类型标注见 {@link createSharedRunnerDeps} 头注。 */
-export type SharedRunnerDeps = Pick<RunnerDeps, "brain" | "readFace" | "readDenyPatterns" | "readDenyBuiltinTiers" | "readDenyBuiltinExclude" | "memoryDelegationEvidence" | "memoryProvenance" | "memoryCapturePolicy" | "delegationEntryCaps" | "crossSessionInbound" | "crossSessionDialogExpiry" | "writeProtectedPaths" | "memoryEngineDir" | "allowedTools" | "models" | "roles" | "tiers" | "pricing" | "tracer" | "promptSource" | "executionEnvFactory" | "lspManager" | "backgroundAgentStore" | "mailboxStore" | "rosterStore" | "hooks" | "toolResultStore" | "checkpointStore" | "hands" | "sessionPolicyStore" | "usageWindows" | "usageWindowStore" | "memoryScopeAdmission" | "deploymentMemoryScopes" | "sharedMemoryStores" | "compliancePostureResolver" | "lockedConfig" | "retentionPolicy" | "onNotice" | "mcpRevocations">;
+export type SharedRunnerDeps = Pick<RunnerDeps, "brain" | "readFace" | "readDenyPatterns" | "readDenyBuiltinTiers" | "readDenyBuiltinExclude" | "memoryDelegationEvidence" | "memoryProvenance" | "memoryCapturePolicy" | "delegationEntryCaps" | "crossSessionInbound" | "crossSessionDialogExpiry" | "writeProtectedPaths" | "memoryEngineDir" | "allowedTools" | "models" | "roles" | "tiers" | "pricing" | "tracer" | "promptSource" | "executionEnvFactory" | "lspManager" | "backgroundAgentStore" | "mailboxStore" | "rosterStore" | "mods" | "toolResultStore" | "checkpointStore" | "hands" | "sessionPolicyStore" | "usageWindows" | "usageWindowStore" | "memoryScopeAdmission" | "deploymentMemoryScopes" | "sharedMemoryStores" | "compliancePostureResolver" | "lockedConfig" | "retentionPolicy" | "onNotice" | "mcpRevocations">;
 /**
  * [ref] A10 留档发现②(review 2026-07-29,[ref]§三族A 同源修补的延续):main runner 的
  * `RunnerDeps` 字面量(下方 `createRunnerDeps`)与 `main.ts` 里 subRunner 的 `new Runner({...})`
@@ -264,7 +268,7 @@ export type SharedRunnerDeps = Pick<RunnerDeps, "brain" | "readFace" | "readDeny
  *    属性,比再抽一层共享基座更强的同源保证),不重复收纳进这里。
  */
 /** 基座真实消费的窄面(Pick)——subRunner 调用点(main.ts)只需凑这 13 个字段,不必造全量 ctx。 */
-export type SharedRunnerDepsCtx = Pick<RunnerDepsCtx, "config" | "brain" | "pricing" | "tracer" | "promptSource" | "executionEnvFactory" | "lspManager" | "backgroundAgentStore" | "mailboxStore" | "rosterStore" | "deploymentHooks" | "toolResultStore" | "checkpointStore" | "sessionPolicyStore" | "hands" | "usageWindowStore" | "orgMemoryAdmission" | "sharedMemoryStores" | "logger" | "governanceSeams" | "mcpRevocations" | "metrics" | "engineDataRoot">;
+export type SharedRunnerDepsCtx = Pick<RunnerDepsCtx, "config" | "brain" | "pricing" | "tracer" | "promptSource" | "executionEnvFactory" | "lspManager" | "backgroundAgentStore" | "mailboxStore" | "rosterStore" | "deploymentMods" | "toolResultStore" | "checkpointStore" | "sessionPolicyStore" | "hands" | "usageWindowStore" | "orgMemoryAdmission" | "sharedMemoryStores" | "logger" | "governanceSeams" | "mcpRevocations" | "metrics" | "engineDataRoot">;
 /** 转发席只需要 `inc` —— 刻意窄到这一个动词,免得把整只 Metrics 拖进这条纯转发腿。 */
 export interface EngineNoticeMetricsSeat {
     inc: (name: string, labels?: Record<string, string>) => void;
@@ -317,6 +321,13 @@ export type DeploymentPostureSeats = Pick<RunnerDeps, "readFace" | "readDenyPatt
  *  + LKG 覆写路径(`readDenyPatterns` 席并入它派生的读拒行,`lkgReadDenyRows`)。 */
 export type DeploymentPostureConfig = Pick<ServiceConfig, Exclude<keyof DeploymentPostureSeats, "allowedTools"> | "approvalGrant" | "configLkgPath">;
 export declare function buildDeploymentPostureSeats(config: DeploymentPostureConfig): DeploymentPostureSeats;
+/**
+ * 部署读拒行**进场**的唯一告知点(非锚定行一行 `read_deny_unanchored_rows`;判据与行形在 `read-deny-anchor-audit.ts`)。律:**一份读拒行的值第一次装进 Runner 席时点名一次** ——
+ * 三条入口都经这里:server 起服与 run-local 经 {@link createSharedRunnerDeps}(server 的主 / 子 Runner 各展开一次共享基座、同一份 config ⇒ 只说一次),中心热换在换席成功之后
+ * (`boot/web-admin.ts` `applyLiveReadFace`;换席抛 ⇒ config 回滚、不到这里)。值没变 ⇒ 不重复说(只改 face 的热换、同一 config 的第二只 Runner);值变了(热换 A → B → A)⇒ 每次都说。
+ * 喂的是 `config.readDenyPatterns`(运维 ∪ 中心 read-face 的行),不是座席族并入 LKG 派生行之后的那一份 —— 派生行是根锚。绝不抛(纯诊断面)。
+ */
+export declare function announceReadDenyRows(config: Pick<ServiceConfig, "readDenyPatterns">, logger: Pick<Logger, "warn">): void;
 export declare function createSharedRunnerDeps(ctx: SharedRunnerDepsCtx): SharedRunnerDeps;
 export declare function createRunnerDeps(ctx: RunnerDepsCtx): RunnerDeps;
 //# sourceMappingURL=runner-deps.d.ts.map

package/dist/boot/runner-deps.js

@@ -1,6 +1,7 @@
 import { createFileWorkflowScriptStore } from "@sema-agent/core";
 import { join } from "node:path";
 import { lkgReadDenyRows } from "../config-lkg.js";
+import { auditReadDenyAnchoring } from "./read-deny-anchor-audit.js";
 import { fleetBackgroundChildPublisher, FleetEventBus } from "../fleet/fleet-bus.js";
 import { createMemoryEngineIncidentSink } from "../memory-incident-sink.js";
 import { assertAutoConsolidationWirable } from "./memory-consolidation.js";
@@ -24,6 +25,8 @@ export function createRunnerDepsOnAsk(toolApproval) {
     return (req, signal) => toolApproval.ask(req, signal);
 }
 export const CONFIG_ADVISORY_CLASSIFICATIONS = new Set([
+    "file-history-no-env",
+    "file-history-no-store",
     "interaction-posture-refused",
     "memory-tools-not-mounted",
     "sandbox-admission-unavailable",
@@ -76,7 +79,16 @@ export function buildDeploymentPostureSeats(config) {
     };
     return seats;
 }
+const announcedReadDenyRows = new WeakMap();
+export function announceReadDenyRows(config, logger) {
+    const key = JSON.stringify(config.readDenyPatterns ?? null);
+    if (announcedReadDenyRows.get(config) === key)
+        return;
+    announcedReadDenyRows.set(config, key);
+    auditReadDenyAnchoring({ rows: config.readDenyPatterns, logger });
+}
 export function createSharedRunnerDeps(ctx) {
+    announceReadDenyRows(ctx.config, ctx.logger);
     const shared = {
         brain: ctx.brain,
         onNotice: createEngineNoticeForwarder(ctx.logger, defaultEngineNoticeRouter, ctx.metrics),
@@ -92,7 +104,7 @@ export function createSharedRunnerDeps(ctx) {
         backgroundAgentStore: ctx.backgroundAgentStore ? ctx.backgroundAgentStore : undefined,
         mailboxStore: ctx.mailboxStore ? ctx.mailboxStore : undefined,
         rosterStore: ctx.rosterStore ? ctx.rosterStore : undefined,
-        hooks: ctx.deploymentHooks,
+        mods: ctx.deploymentMods,
         hands: ctx.hands,
         toolResultStore: ctx.toolResultStore,
         checkpointStore: ctx.checkpointStore ? ctx.checkpointStore : undefined,
@@ -168,6 +180,7 @@ export function createRunnerDeps(ctx) {
                 logger,
             })
             : undefined,
+        principalInboxConsumer: config.principalInboxAssistant !== undefined ? { assistant: config.principalInboxAssistant } : undefined,
         onTaskOutcome: outcomeSink
             ? (o) => {
                 metrics.inc("task_outcomes_total", { status: o.status, green: String(o.oracle?.green ?? "unknown") });
@@ -226,7 +239,7 @@ export function createRunnerDeps(ctx) {
                 return;
             }
             if (ctx.phase === "prompt-constitution") {
-                logger.warn("prompt_provider_needs_upgrade", { sessionId: ctx.sessionId, info: String(err) });
+                logger.warn("prompt_composition_warning", { sessionId: ctx.sessionId, info: String(err) });
                 return;
             }
             if (ctx.phase === "rewind") {