@sema-agent/server 7.132.0 → 7.133.0

package/dist/capability-facts.d.ts

@@ -22,7 +22,7 @@ import type { FlatServiceDeps } from "./http/server.js";
 import type { ServiceConfig } from "./config.js";
 import type { OwnerAwareSessionStore } from "./security.js";
 import type { ServiceFileHistoryStore } from "./plugins/store-backend.js";
-import { resolveStreamApprovalGate } from "./tool-approval.js";
+import { resolveStreamApprovalGate, type ApprovalFrameFamily } from "./tool-approval.js";
 import { type WorkspaceSyncCapability } from "./workspace-space.js";
 import type { WorkspaceCacheCapability } from "./workspace-cache.js";
 /** why 闭集:词 → 给运维看的一句义(诊断 / 测试读它;wire 上的拒句由各门自写)。 */
@@ -56,7 +56,8 @@ export declare const CAPABILITY_FACT_WHY: {
     readonly image_index_absent: "no image index is wired (SQL backends only)";
     readonly shared_memory_store_absent: "no shared memory store provider is wired";
     readonly org_memory_directory_absent: "no org memory directory (membership fold) is wired";
-    readonly operator_principals_empty: "OPERATOR_PRINCIPALS is empty, so no caller can ever be an operator";
+    readonly org_delivery_gate_absent: "no organization delivery gate is mounted (PRINCIPAL_INBOX_ASSISTANT is unset: the deployment declares no principal-inbox consumer)";
+    readonly operator_principals_empty: `no operator roster (OPERATOR_PRINCIPALS is empty and OPERATOR_SINGLE_USER is not declared), so no caller can ever be an operator; ${string}`;
     readonly adoption_store_absent: "no adoption log store is wired (SQL backends only)";
     readonly memory_bundle_faces_absent: "the memory engine's governance bundle faces are not wired";
     readonly memory_compliance_faces_absent: "the memory engine's provenance/erasure faces are not wired";
@@ -73,6 +74,7 @@ export declare const CAPABILITY_FACT_WHY: {
     readonly ask_question_disabled: "AskUserQuestion live HITL is off (ASK_QUESTION_ENABLED)";
     readonly tool_approval_disabled: "live tool approval is off (TOOL_APPROVAL_ENABLED)";
     readonly stream_approval_disabled: "the stream approval protocol is off (STREAM_APPROVAL_ENABLED)";
+    readonly read_root_grant_posture_refused: "this is not a single-user host-lane deployment (REMOTE_EXEC=host without REQUIRE_PRINCIPAL), the only posture that honors a read-directory grant";
     readonly background_agent_store_absent: "no background-agent store is wired";
     readonly sendfile_ledger_absent: "no SendUserFile ledger is wired";
     readonly workflow_engine_absent: "the workflow engine is not available on this worker";
@@ -199,6 +201,27 @@ type ActiveStreamApproval = Extract<ReturnType<typeof resolveStreamApprovalGate>
 export declare function streamApproval(d: Pick<Deps, "toolApproval" | "config" | "backend" | "checkpointStore">): Fact<StreamApprovalWhy, {
     askStore: ActiveStreamApproval["askStore"];
 }>;
+/**
+ * 读根授权(「Yes, and add directory」)这台部署**受理不受理** —— `GET /v1/capabilities` 的 `approvalReadRootGrant` 位,与
+ * `POST /v1/tool-approvals/:id/respond` 对应答体 `readRootGrant` 的受理门**读同一只**(位说不受理而口照收,就是「位说 X、行为不是 X」)。
+ *
+ * 判据 = 单用户 host 车道姿态 {@link cwdHonored}(与调用方 `cwd` / 附加目录同一条信任边界):授权把一个**宿主目录**加进本 run 的读目录,
+ * 只有「这台机器一个可信主人」的姿态才有这个授权的语义;多租户与云上 / 容器车道的读面另有归宿(沙箱内的读面档位见 `READ_FACE`)。
+ * 消费方的选项可见条件是**合取**:卡上有 `readRootCandidate`(逐卡位,引擎铸)∧ 本位为真。位缺席 = 老 server(不受理)。
+ * 没有别的端点按本位判可用与否 —— 它只管应答体里的这一键。
+ */
+export declare function readRootGrant(d: Pick<Deps, "config">): Fact<"read_root_grant_posture_refused">;
+/**
+ * 审批开卡帧的族 —— `GET /v1/capabilities` 的 `approvalFrameFamilies` 位。**值族投影**(出形是闭集词数组,不是 `{ available }`;同
+ * `engineCapabilityBits` 一类),入参是 {@link streamApproval} **已求出的那一份事实**而不是 deps:一次请求里 `streamApproval` 位与本位读同一次判据求值
+ * (判据读活配置与 backend,两次求值在开关热改的窗口里会撕出 `streamApproval:true` 配旧族的应答;也多取一次 ask 店)。
+ *  · 流内审批在场(呈卡协议上场)⇒ `["approval_request"]`;
+ *  · 活卡协调器在、协议没上场(开关关 / 无 store backend / 无 park 设施)⇒ `["tool_approval"]`;
+ *  · 活卡协调器缺席 ⇒ `[]`(没有审批卡可呈)。
+ * 对 why 闭集穷举:`streamApproval` 的拒因多一个 ⇒ 这里编译红,逼着给新拒因定族。三条执行腿选族读的是同一只判据的 `active`,
+ * 与本映射的「在场 ⇒ 呈卡族」是同一条规则(真腿对拍钉在 `test/stream-approval-on-e2e.test.ts`)。没有端点按它拒:它是消费方分派帧族的读点,`streamApproval` 的词义不变。
+ */
+export declare function approvalFrameFamilies(stream: ReturnType<typeof streamApproval>): readonly ApprovalFrameFamily[];
 export declare function deviceLane(d: Pick<Deps, "deviceHub">): Fact<"device_hub_absent", {
     hub: Store<"deviceHub">;
 }>;
@@ -232,12 +255,19 @@ export declare function sharedMemoryRead(d: Pick<Deps, "sharedMemoryStore" | "or
     provider: Store<"sharedMemoryStore">;
     directory: Store<"orgMemoryDirectory">;
 }>;
-/** operator 名单非空。空名单下 `explicitOperatorOk` 对任何身份恒假 ⇒ 这一族的口对谁都打不通 = 部署不可用(不是鉴权拒)。
+/** 跨主体投递门在座(`POST /v1/principal-inbox/messages` 的可用性门与能力位 `principalInboxDelivery` 同读这一只)。门的装配本身是
+ *  一道合取(收件箱消费方声明 ∧ 耐久 mailbox ∧ org 成员目录 ∧ 配额店,缺一拒启 —— `boot/stage-06-runners.ts`),
+ *  所以这里只判「门在不在」:在 ⟺ 那四件都在。 */
+export declare function principalInboxDelivery(d: Pick<Deps, "orgDeliveryGate">): Fact<"org_delivery_gate_absent", {
+    gate: Store<"orgDeliveryGate">;
+}>;
+/** 这台部署有运维名册(名单非空 ∨ 单用户声明 `OPERATOR_SINGLE_USER`;唯一读法 `operatorRosterPresent`)。没有时 `explicitOperatorOk` 对任何身份恒假
+ *  ⇒ 这一族的口对谁都打不通 = 部署不可用(不是鉴权拒)。
  *
  * operator 族的复合事实**先判名单、再判设施**:门序是「身份 → 名单空(501)→ 授权(403)→ 设施缺席(501)」——
  * 名单空时没有人过得了授权,不先判它,这一形就永远答成 403;设施缺席则留在授权之后答(不对非 operator 透露部署形态)。 */
 export declare function operatorLane(d: {
-    readonly config: Pick<ServiceConfig, "operatorPrincipals">;
+    readonly config: Pick<ServiceConfig, "operatorPrincipals" | "operatorSingleUser">;
 }): Fact<"operator_principals_empty">;
 type AdoptionCapableBackend = Store<"backend"> & {
     adoptionLog(): ReturnType<NonNullable<Store<"backend">["adoptionLog"]>>;

package/dist/capability-facts.js

@@ -1,4 +1,6 @@
+import { buildOperatorRosterWayOut, operatorRosterPresent } from "./http/principal-gate.js";
 import { mcpInjectionHonored } from "./task-mcp.js";
+import { cwdHonored } from "./task-cwd.js";
 import { resolveStreamApprovalGate } from "./tool-approval.js";
 import { selfOrchestrationDenial } from "./task-workflow.js";
 import { centerEntitlementSourceWired } from "./runtime-caps-resolver.js";
@@ -34,7 +36,8 @@ export const CAPABILITY_FACT_WHY = {
     image_index_absent: "no image index is wired (SQL backends only)",
     shared_memory_store_absent: "no shared memory store provider is wired",
     org_memory_directory_absent: "no org memory directory (membership fold) is wired",
-    operator_principals_empty: "OPERATOR_PRINCIPALS is empty, so no caller can ever be an operator",
+    org_delivery_gate_absent: "no organization delivery gate is mounted (PRINCIPAL_INBOX_ASSISTANT is unset: the deployment declares no principal-inbox consumer)",
+    operator_principals_empty: `no operator roster (OPERATOR_PRINCIPALS is empty and OPERATOR_SINGLE_USER is not declared), so no caller can ever be an operator; ${buildOperatorRosterWayOut()}`,
     adoption_store_absent: "no adoption log store is wired (SQL backends only)",
     memory_bundle_faces_absent: "the memory engine's governance bundle faces are not wired",
     memory_compliance_faces_absent: "the memory engine's provenance/erasure faces are not wired",
@@ -51,6 +54,7 @@ export const CAPABILITY_FACT_WHY = {
     ask_question_disabled: "AskUserQuestion live HITL is off (ASK_QUESTION_ENABLED)",
     tool_approval_disabled: "live tool approval is off (TOOL_APPROVAL_ENABLED)",
     stream_approval_disabled: "the stream approval protocol is off (STREAM_APPROVAL_ENABLED)",
+    read_root_grant_posture_refused: "this is not a single-user host-lane deployment (REMOTE_EXEC=host without REQUIRE_PRINCIPAL), the only posture that honors a read-directory grant",
     background_agent_store_absent: "no background-agent store is wired",
     sendfile_ledger_absent: "no SendUserFile ledger is wired",
     workflow_engine_absent: "the workflow engine is not available on this worker",
@@ -211,6 +215,25 @@ export function streamApproval(d) {
         }
     }
 }
+export function readRootGrant(d) {
+    return cwdHonored(d.config) ? YES : no("read_root_grant_posture_refused");
+}
+export function approvalFrameFamilies(stream) {
+    if (stream.available)
+        return ["approval_request"];
+    switch (stream.why) {
+        case "tool_approval_disabled":
+            return [];
+        case "stream_approval_disabled":
+        case "store_backend_absent":
+        case "checkpoint_store_absent":
+            return ["tool_approval"];
+        default: {
+            const unhandled = stream.why;
+            throw new Error(`unhandled stream-approval why: ${JSON.stringify(unhandled)}`);
+        }
+    }
+}
 export function deviceLane(d) {
     return d.deviceHub !== undefined ? yes({ hub: d.deviceHub }) : no("device_hub_absent");
 }
@@ -252,8 +275,11 @@ export function sharedMemoryRead(d) {
         return no("org_memory_directory_absent");
     return yes({ provider: d.sharedMemoryStore, directory: d.orgMemoryDirectory });
 }
+export function principalInboxDelivery(d) {
+    return d.orgDeliveryGate !== undefined ? yes({ gate: d.orgDeliveryGate }) : no("org_delivery_gate_absent");
+}
 export function operatorLane(d) {
-    return d.config.operatorPrincipals.length > 0 ? YES : no("operator_principals_empty");
+    return operatorRosterPresent(d.config) ? YES : no("operator_principals_empty");
 }
 export function adoption(d) {
     const lane = operatorLane(d);

package/dist/center-config-tier.d.ts

@@ -0,0 +1,69 @@
+/**
+ * S-667 —— **中心配置档位的唯一属主**:「在用的中心配置是谁的」+「换人之后降到了无中心配置档没有」+ 两态通告。
+ *
+ * ## 律
+ * 凭证身份(凭据文件里的主体,`center-credential.ts` 的 `identity`)变化的那一刻,server 自己:
+ *  1. 把在用的中心配置降到「无中心配置」档 —— 每个中心下发的热面回 env 底、中心提示词层撤下、Runner 的模型表换回 env 表;
+ *  2. 当场发起一次拉取(不等下一个 60s 拍);
+ *  3. 通告 {@link CenterIdentityNoticeCode} `center_identity_demoted`;新身份的候选落地 ⇒ 通告 `center_identity_landed`。
+ * 拉取成功之前**不回退**到上一个人的任何东西(盘上 LKG 是按身份分箱的,新身份的箱里没有上一个人的;内存里的在用候选在降档时已清)。
+ * 不采「壳重启引擎」:读凭据文件的那一刻引擎自己就判得出,壳只能猜;本机引擎多会话共享,重启会打断别的会话正在跑的 run。
+ *
+ * ## 本模块只管状态与词,不管动作
+ * 降档的动作(换活配置、换 Runner 席、撤提示词层、拉取)在 `boot/web-admin.ts`,那里是活配置与单飞拍的属主;本模块是纯状态机:
+ *  · `committed(identity)` —— 一份中心候选(或「无中心配置」候选自己,身份缺席)提交了:记下在用配置的身份;降档态下第一份带身份的提交 = 换上了;
+ *  · `drifted(identity)` —— 此刻凭证的身份与参照身份(在用配置的,或已降档时在等的)不一致吗(只有存在参照且「凭证身份读得出」才可能为真);
+ *  · `demote(awaiting)` / `retarget(awaiting)` —— 记下降档、改在等的身份;
+ *  · `notice()` —— 最近一条通告(`/health.centerIdentityNotice` 的取值口读它)。
+ *
+ * ## 通告的面
+ * 通告是**最近一条**,不是事件日志:`/health.centerIdentityNotice = { code, message, at, retained? }`(无鉴权面 —— 只有闭集码、冻结句、时刻,
+ * 不带身份、不带令牌、不带路径);从未换过人 ⇒ 键缺席。消费端按 `at` 判断「这一条我转述过没有」。日志轴另有同名事件
+ * (`center_identity_demoted` warn / `center_identity_landed` info)。
+ * 这两只码**不在** core 的 `EngineNotice` 码册里(那是 core 的闭集,受众与归属键由 core 定;进该册要 core 加行)—— 它们是本服务自铸的 `/health` 值,
+ * 登记在 `trace/self-minted-wire.ts` 的 `centerIdentityNotice`,契约 §0.4 成文。
+ */
+import type { ConfigApplyGroup } from "./web-admin-client/apply-ledger.js";
+/** 两态通告码(闭集)。新增一个 = `CENTER_IDENTITY_NOTICE_MESSAGE` 与 `SELF_MINTED_WIRE.centerIdentityNotice` 当场编译红。 */
+export declare const CENTER_IDENTITY_NOTICE_CODES: readonly ["center_identity_demoted", "center_identity_landed"];
+export type CenterIdentityNoticeCode = (typeof CENTER_IDENTITY_NOTICE_CODES)[number];
+/**
+ * 每个码的**冻结句**(wire 可见 —— `test/api-notice-text-freeze.test.ts` §8 逐字冻;改一个字节要同步契约与消费端)。
+ * 句子是定句:不带身份、不带版本号、不带路径,免鉴权面上读到它不泄露任何东西。映射型逐码穷举。
+ */
+export declare const CENTER_IDENTITY_NOTICE_MESSAGE: {
+    readonly center_identity_demoted: "The center credential now belongs to another account: this engine dropped the previous account's center configuration and runs on its base configuration (no center layer) until the new account's configuration is pulled.";
+    readonly center_identity_landed: "The new account's center configuration was pulled and is now in force.";
+};
+/** 一条通告(wire 形:`/health.centerIdentityNotice` 就是这个对象)。 */
+export interface CenterIdentityNotice {
+    readonly code: CenterIdentityNoticeCode;
+    readonly message: string;
+    /** 铸这条通告的时刻(ms epoch)。 */
+    readonly at: number;
+    /**
+     * 只在 `center_identity_demoted` 上、且非空时在场:降档**没能降到底**的组 —— 该组被整拒(例:env 的审批名单在这台部署上无处可服务),活值仍是上一个人下发的。
+     * 冻结句说「回了基础配置」,这一键让它对这几组如实:成员是世代账的组闭集(`ConfigApplyGroup`)。缺席 = 每个热面都已回 env 底。
+     */
+    readonly retained?: readonly ConfigApplyGroup[];
+}
+export interface CenterConfigTier {
+    /** 一份候选提交了(含部分应用)。`identity` = 拉到它的凭证身份;缺席 = 本地腿候选 / 「无中心配置」候选自己(没有中心配置在服务)。
+     *  降档态下第一份带身份的提交 ⇒ 铸并返回 `center_identity_landed`;其余返回 undefined。 */
+    committed(identity: string | undefined): CenterIdentityNotice | undefined;
+    /**
+     * 此刻凭证的身份与「参照身份」不一致吗 —— 参照 = 在用中心配置的身份;已降档则是降档在等的那个身份。没有参照(没有中心配置在服务、也没降过档)/
+     * 凭证身份读不出(`undefined`)⇒ 恒假:降无可降,读不出不是换了人。
+     */
+    drifted(identity: string | undefined): boolean;
+    /** 记下降档(此后没有中心配置在服务,在等 `awaiting` 这个身份的候选)并铸 `center_identity_demoted`;`retained` = 没能降到底的组(空 / 缺席 = 全降到底)。 */
+    demote(awaiting: string, retained?: readonly ConfigApplyGroup[]): CenterIdentityNotice;
+    /** 已降档态下凭证又换了人:只改「在等谁」,不再铸通告(还是同一次降档 —— 新身份的候选没落地)。 */
+    retarget(awaiting: string): void;
+    /** 最近一条通告;从未铸过 ⇒ undefined。 */
+    notice(): CenterIdentityNotice | undefined;
+    /** 是否在降档态(降过、新身份的候选还没落地)。 */
+    isDemoted(): boolean;
+}
+export declare function createCenterConfigTier(now?: () => number): CenterConfigTier;
+//# sourceMappingURL=center-config-tier.d.ts.map

package/dist/center-config-tier.js

@@ -0,0 +1,42 @@
+export const CENTER_IDENTITY_NOTICE_CODES = ["center_identity_demoted", "center_identity_landed"];
+export const CENTER_IDENTITY_NOTICE_MESSAGE = {
+    center_identity_demoted: "The center credential now belongs to another account: this engine dropped the previous account's center configuration and runs on its base configuration (no center layer) until the new account's configuration is pulled.",
+    center_identity_landed: "The new account's center configuration was pulled and is now in force.",
+};
+export function createCenterConfigTier(now = Date.now) {
+    let inForce;
+    let awaiting;
+    let demoted = false;
+    let last;
+    const mint = (code, retained = []) => {
+        last = { code, message: CENTER_IDENTITY_NOTICE_MESSAGE[code], at: now(), ...(retained.length > 0 ? { retained: [...retained] } : {}) };
+        return last;
+    };
+    return {
+        committed(identity) {
+            inForce = identity;
+            if (!demoted || identity === undefined)
+                return undefined;
+            demoted = false;
+            awaiting = undefined;
+            return mint("center_identity_landed");
+        },
+        drifted(identity) {
+            const reference = demoted ? awaiting : inForce;
+            return reference !== undefined && identity !== undefined && identity !== reference;
+        },
+        demote(next, retained) {
+            inForce = undefined;
+            awaiting = next;
+            demoted = true;
+            return mint("center_identity_demoted", retained);
+        },
+        retarget(next) {
+            if (demoted)
+                awaiting = next;
+        },
+        notice: () => last,
+        isDemoted: () => demoted,
+    };
+}
+//# sourceMappingURL=center-config-tier.js.map

package/dist/checkpoint-identity.d.ts

@@ -0,0 +1,16 @@
+/** `checkpointId` 的长度上界(见本文件头注第 2 条)。 */
+export declare const MAX_CHECKPOINT_ID_CHARS = 128;
+/** 持久层读出的 `checkpointId` 过信任边界:是串、非空、不超长、不含 token(大小写不敏感)⇒ 原值;否则 `undefined`。判据全文见本文件头注。 */
+export declare function trustedCheckpointId(raw: unknown, token: unknown): string | undefined;
+/** 带 `checkpointId` 当 join 键的两类 durable 读面(计数 detail 的 `face`)。 */
+export type DurableCheckpointFace = "approvals-queue" | "assistant-inbox";
+/**
+ * durable 读面的一行 → 它的身份片段,**由调用方原样展开进行投影**(`...durableRowIdentity(face, raw, token)`):读得出可信值 ⇒ `{ checkpointId }`;
+ * 读不出 ⇒ `{}`(这一行**照列**,键缺席)+ 计一次(见本文件头注「durable 面的 join 键」)。
+ * `raw === undefined` = 行上没有这一格(`why=absent`,老行);在场却没过信任边界(非串 / 空串 / 超长 / 含 token / 读不出)= `why=untrusted`。
+ * 三处读面(两只店的 `listPending` + 收件 handler)只经这一只 —— 读法、计数、缺席形各只有一份。
+ */
+export declare function durableRowIdentity(face: DurableCheckpointFace, raw: unknown, token: unknown): {
+    readonly checkpointId?: string;
+};
+//# sourceMappingURL=checkpoint-identity.d.ts.map

package/dist/checkpoint-identity.js

@@ -0,0 +1,19 @@
+import { recordFailOpen } from "./observability/fail-open.js";
+export const MAX_CHECKPOINT_ID_CHARS = 128;
+export function trustedCheckpointId(raw, token) {
+    if (typeof raw !== "string" || raw === "" || raw.length > MAX_CHECKPOINT_ID_CHARS)
+        return undefined;
+    const secret = token === undefined || token === null ? "" : String(token).toLowerCase();
+    if (secret !== "" && raw.toLowerCase().includes(secret))
+        return undefined;
+    return raw;
+}
+export function durableRowIdentity(face, raw, token) {
+    const id = trustedCheckpointId(raw, token);
+    if (id === undefined) {
+        recordFailOpen("server.approvals.durable-row-checkpoint-id-missing", `face=${face} why=${raw === undefined ? "absent" : "untrusted"}`);
+        return {};
+    }
+    return { checkpointId: id };
+}
+//# sourceMappingURL=checkpoint-identity.js.map

package/dist/config-catalog.d.ts

@@ -93,7 +93,23 @@ export interface ConfigCatalogRowCenter {
     /** center 写**现在真的在生效**(在管 ∧ 未被 env 占位压住;env-wins 族 env 占位 ⇒ false = ⚪ 成因 a)。 */
     readonly effectiveNow: boolean;
 }
-export interface ConfigCatalogRow {
+/**
+ * 行上**对 `effectiveValue` 的判词位**(闭集;S-527 收成一族)—— 每一位**只在为真时铸 `true`、恒不铸 `false`**,缺席 = 这一格没有这件事
+ * (不是「不知道」)。净化器({@link sanitizeValue})一次读出值与判词,行投影原样铺平 —— 判词位只有这一种形,第三个判词位加进本闭集即受同一条约束。
+ *  · `effectiveValueInvalid`(S-100,additive)—— 本行的实算值**落在它自己宣告的回显闭集之外**(`echoWords ?? enumValues`,S-201①),
+ *    或它的实算腿回了一个本行没有声明映射的布尔。在场时 `effectiveValue` 恒 `null`:回显一个集外值等于目录在教消费方写一个写回去就非法的词,
+ *    而**静默丢**会让「配错了」与「真的没设」在 wire 上同形([ref] 响亮臂)。只服务闭集族(`type:"enum"`)。
+ *  · `effectiveValueWithheld`(S-527,additive)—— `type:"url"` 行:展示铸点对这一格(单值)或其中任一项(列表)判了扣下(`failedClosed`:
+ *    位置律本会显示的一段 —— 整段 query / 一个路径段 —— 因为里面有一条凭据形而不出门)。判决的属主是铸点,目录不另判;
+ *    标准位置律(userinfo 落地、query 每个值成记号)对每一行同样成立,不是扣下;值整只成占位 = 这一行的展示律显示不了这个值
+ *    (通用 url 行:不是层级式 URL;两只出网代理行的展示律更窄 —— 只显示 `scheme://host[:port]`,形不干净整只占位,`outbound-dispatcher.ts` `displayProxyUrl`),也不是本位。
+ */
+export type CatalogValueVerdict = "effectiveValueInvalid" | "effectiveValueWithheld";
+/** 判词位的行内形({@link CatalogValueVerdict} 每一员都是只取 `true` 的可选键)。 */
+export type CatalogValueVerdicts = {
+    readonly [K in CatalogValueVerdict]?: true;
+};
+export interface ConfigCatalogRow extends CatalogValueVerdicts {
     readonly name: string;
     readonly domain: CatalogDomain;
     readonly type: CatalogValueType;
@@ -105,15 +121,6 @@ export interface ConfigCatalogRow {
     readonly staticDefault?: string;
     readonly derivedDefaultNote?: string;
     readonly effectiveValue: CatalogValue;
-    /**
-     * S-100(additive;**只在真非法时铸,恒不铸 `false`**)—— 本行的实算值**落在它自己宣告的
-     * 回显闭集之外**(`echoWords ?? enumValues`,S-201①),或它的实算腿回了一个本行没有声明映射的布尔。
-     *
-     * 在场时 `effectiveValue` 恒 `null`:回显一个集外值等于目录在教消费方写一个写回去就非法的词,
-     * 而**静默丢**会让「配错了」与「真的没设」在 wire 上同形([ref] 响亮臂)。
-     * 缺席 = 这一格没问题(不是「不知道」)。
-     */
-    readonly effectiveValueInvalid?: true;
     readonly valueClass: "plain" | "secret" | "opaque";
     readonly danger: readonly CatalogDangerAxis[];
     readonly center?: ConfigCatalogRowCenter;

package/dist/config-catalog.js

@@ -5,15 +5,17 @@ import { CENTER_CREDENTIAL_RENEW_LEAD_DEFAULT_MS, CENTER_CREDENTIAL_RENEW_LEAD_M
 import { SANDBOX_IPV6_DEFAULT, SANDBOX_IPV6_WORDS } from "./sandbox-egress-policy.js";
 import { WORKSPACE_CACHE_DEFAULT, WORKSPACE_CACHE_MOUNT_DEFAULT, WORKSPACE_CACHE_SIZE_DEFAULT, WORKSPACE_CACHE_WORDS } from "./workspace-cache.js";
 import { WORKSPACE_PERSIST_DEFAULT, WORKSPACE_PERSIST_WORDS, WORKSPACE_SNAPSHOT_KEEP_DEFAULT, WORKSPACE_SNAPSHOT_KEEP_RANGE, WORKSPACE_SNAPSHOT_TIMEOUT_MS_DEFAULT, WORKSPACE_SNAPSHOT_TIMEOUT_MS_RANGE } from "./workspace-space.js";
+import { APPROVAL_ASK_RETENTION_DEFAULT_MS, APPROVAL_ASK_RETENTION_FLOOR_MS } from "./approval-ask-retention.js";
 import { LIVENESS_MS_DEFAULT } from "./exec-bounds.js";
 import { THINKING_FORMATS } from "./model-compat.js";
-import { AUTO_MODE_CLASSIFIER_TIMEOUT_BOUNDS, CENTER_BASE_URL_RULE, CONFIG_PROVIDER_WORDS, DRAIN_SECOND_SIGNAL_MIN_GAP_BOUNDS, DRAIN_SECOND_SIGNAL_MIN_GAP_DEFAULT_MS, FIRST_BYTE_TIMEOUT_BOUNDS, FLEET_LEASE_OUTAGE_MAX_DEFAULT_MS, RESILIENCE_DEFAULTS, TASK_WRITE_FACE_ESCALATIONS } from "./config-types.js";
+import { AUTO_MODE_CLASSIFIER_TIMEOUT_BOUNDS, CENTER_BASE_URL_RULE, CONFIG_PROVIDER_WORDS, DRAIN_SECOND_SIGNAL_MIN_GAP_BOUNDS, DRAIN_SECOND_SIGNAL_MIN_GAP_DEFAULT_MS, DEVICE_DELIVERY_TIMEOUT_BOUNDS, DEVICE_EXEC_TIMEOUT_BOUNDS, FIRST_BYTE_TIMEOUT_BOUNDS, FLEET_LEASE_OUTAGE_MAX_DEFAULT_MS, RESILIENCE_DEFAULTS, TASK_WRITE_FACE_ESCALATIONS } from "./config-types.js";
+import { DEVICE_HELLO_ACK_BOUNDS } from "./device-ws-protocol.js";
 import { webSearchProviderFromEnv, WEB_SEARCH_PROVIDERS } from "./plugins/web-search.js";
 import { AUTONOMY_MODES } from "./runtime-governance.js";
 import { REMOTE_EXEC_PROVIDER_WORDS } from "./execution-lane-caps.js";
 import { MEMORY_ENGINE_BACKENDS, SESSION_BACKENDS, STORE_BACKENDS } from "@sema-agent/settings-schema/execution-lanes";
 import { MODEL_PROVIDER_WORDS } from "./model-provider.js";
-import { buildDisplaySafeUrl } from "./trace/redact.js";
+import { buildDisplaySafeUrlChecked } from "./trace/redact.js";
 import { describeAllowlistPostures } from "./env-name-allowlist-knobs.js";
 import { buildOutboundProxyPosture } from "./outbound-dispatcher.js";
 import { modelImageInput, modelReasoningDecl } from "./model-select.js";
@@ -64,6 +66,7 @@ export const CONFIG_CATALOG = [
     r("ANTHROPIC_CACHE_BREAKPOINTS", "modelPlane", "boolean", "Anthropic 路线 prompt-cache breakpoints 开关", { staticDefault: "true" }),
     r("ANTHROPIC_MAX_RETRIES", "modelPlane", "number", "Anthropic 路线 SDK 每次调用重试上限", { derivedDefaultNote: "缺席 ⇒ 不传引擎,core/SDK 默认当家" }),
     r("ANTHROPIC_VERSION", "modelPlane", "string", "Anthropic API version 头(缺省由 SDK 定)"),
+    r("APPROVAL_ASK_RETENTION_MS", "approval", "number", `审批账本(问账 SQL / local 文件两形 + local 审计账)的保留窗(ms):一问结了且最后一次动静早于 now − 本值 ⇒ 维护 tick 整问删掉(没结的问永不按龄删;留下的记录逐字节不变;删了就打 approval_ask_retention_swept 读数行);0 = 不删(永久保留);正值下限 ${APPROVAL_ASK_RETENTION_FLOOR_MS}(低于即钳 + 告警);负值 / 非整数拒启`, { staticDefault: String(APPROVAL_ASK_RETENTION_DEFAULT_MS), danger: DATA, configKey: "approvalAskRetentionMs" }),
     r("APPROVAL_AUTO_BUDGET", "approval", "number", "每 run-leg 自动放行的普通门控工具调用数上限(0=关;防审批循环的熔断,不是安全 ask 的帽)", { staticDefault: "0", danger: SEC, configKey: "approvalAutoBudget" }),
     r("APPROVAL_DENY", "approval", "csv", "始终拒绝的工具名单(装配期拒不可匹配名)", { danger: SEC, configKey: "approvalDeny" }),
     r("APPROVAL_GRANT", "approval", "csv", "运维的 allow 表(引擎 allow 层的部署成员 RunnerDeps.allowedTools,每只 Runner 同一席:HTTP 提交 / 续跑 / 停驻赎回 / run-local / leader 一律;规则文法 = 引擎的:工具名 / mcp__<server>__* / a2a__<peer>__* / Bash(<命令>) / Bash(<前缀>:*) / Read(//<dir>/**);命中 = 免问,清普通问与没人表态两类,内置工具也在内;清不掉任何一层的 deny / ask 规则、APPROVAL_NEVER_AUTO、shell 地板、写保护、治理、hook 的问、plan;不是白名单;引擎读成空的条目 / 服务器段铸不出 ⇒ 拒启)", { danger: SEC, configKey: "approvalGrant", derivedDefaultNote: "缺席 = 空表(本层不表态,折叠与未设逐字同)" }),
@@ -103,6 +106,7 @@ export const CONFIG_CATALOG = [
     r("CONFIG_LKG_ENABLED", "integrations", "boolean", "last-known-good 配置盘缓存读写开关(仅远程 provider 有意义)", { staticDefault: "true", configKey: "configLkgEnabled" }),
     r("CONFIG_LKG_PATH", "integrations", "path", "LKG 落盘路径(设了 ⇒ 派生一条读拒行 = 这条绝对路径:根锚定,只守这一个文件,经符号链接的目录时引擎沿链连目标一起守;大小写不敏感;用户仓里同尾的路径读得到;空串拒启)", { derivedDefaultNote: "缺席 ⇒ 配置根(SEMA_CONFIG_DIR,缺省 ~/.sema)下按 worker + 凭证身份分箱派生", configKey: "configLkgPath" }),
     r("CONFIG_LOCAL_DIR", "integrations", "path", "本地配置源根(config.d/<domain>.json);兼作数据根回落链一环", { configKey: "configLocalDir", danger: DATA }),
+    r("CONFIG_LOCAL_OWNER_UID", "integrations", "number", "本地配置源读之前的目录信任判官多信的那一个属主 uid(本服务用户与 root 之外 —— userns-remap 的 bind-mount、运维用户持有的配置);只放宽属主判据,组 / 他人可写照拒;形错拒启", { configKey: "configLocalOwnerUid", danger: SEC, derivedDefaultNote: "缺席 = config.d 路径上的目录与文档只许属于本服务用户或 root" }),
     r("CONFIG_PROVIDER", "integrations", "enum", "配置源双模选择(闭集,逐字比较;认不出的词 ⇒ 拒启,S-841)", { enumValues: CONFIG_PROVIDER_WORDS, derivedDefaultNote: `缺席:${WEB_ADMIN_ENV.url} 在场 ⇒ remote,否则纯 env(无管道)`, configKey: "configProvider" }),
     r("CONFIG_REQUIRE_ROSTER", "integrations", "boolean", "远程 registry 非 dryRun 时布防 ready 门:roster 未落地 ⇒ 计费提交 503 + /health ready:false(严格 'true')", { staticDefault: "false" }),
     r("CORS_ORIGIN", "auth", "csv", "CORS 白名单(单值 v1 兼容回显;多值按请求 Origin 匹配 + Vary;未设=无 CORS 面)", { danger: SEC, configKey: "corsOrigins" }),
@@ -114,12 +118,12 @@ export const CONFIG_CATALOG = [
     r("DEFAULT_SCENARIO", "integrations", "string", "出厂缺省场景(编码产品出厂态;通用中性 persona 用 default 显式选回);必须是本部署在册的场景名(内建 ∪ web-admin 声明的),不在册 ⇒ 拒启", { staticDefault: "code", configKey: "defaultScenario" }),
     r("DELEGATION_MAX_CONCURRENT", "orchestration", "number", "委派入口并发帽", { derivedDefaultNote: "缺席 ⇒ 不铸键,core 自缺省(CC parity 20)" }),
     r("DELEGATION_MAX_PER_SESSION", "orchestration", "number", "委派入口每会话累计帽", { derivedDefaultNote: "缺席 ⇒ 不铸键,core 自缺省(CC parity 200)" }),
-    r("DEVICE_DELIVERY_TIMEOUT_MS", "orchestration", "number", "device 车道等在途槽上限(ms;到期 device.busy)", { derivedDefaultNote: "缺席 ⇒ adapter 默认 10s" }),
+    r("DEVICE_DELIVERY_TIMEOUT_MS", "orchestration", "number", `device 车道等在途槽上限(ms;到期 device.busy;0 = 槽满时只给一个定时器拍、随即 busy;须为 [${DEVICE_DELIVERY_TIMEOUT_BOUNDS.min}, ${DEVICE_DELIVERY_TIMEOUT_BOUNDS.max}] 内规范十进制整数,其余拒启)`, { derivedDefaultNote: "缺席 ⇒ adapter 默认 10s" }),
     r("DEVICE_ENROLL_TOKEN_TTL_SEC", "orchestration", "number", "enrollment token 有效期(整秒,自 DB now 起算;域 [1,86400],坏值拒启)", { danger: SEC, derivedDefaultNote: "缺席 ⇒ 签发点默认 900(15min)" }),
-    r("DEVICE_EXEC_TIMEOUT_MS", "orchestration", "number", "device 车道指令级默认超时(ms;per-command 可收紧)", { derivedDefaultNote: "缺席 ⇒ adapter 默认 1800s" }),
-    r("DEVICE_MAX_INFLIGHT_PER_DEVICE", "orchestration", "number", "per-device 在途上限(超额云侧排队)", { derivedDefaultNote: "缺席 ⇒ 4(§11-O3 裁定值)" }),
+    r("DEVICE_EXEC_TIMEOUT_MS", "orchestration", "number", `device 车道指令级默认超时(ms;命令自带 timeout 时用命令自己的,没自带的用本值;须为 [${DEVICE_EXEC_TIMEOUT_BOUNDS.min}, ${DEVICE_EXEC_TIMEOUT_BOUNDS.max}] 内规范十进制整数,其余拒启 —— 0 会让每条没自带超时的指令在派发时被汇聚端拒)`, { derivedDefaultNote: "缺席 ⇒ adapter 默认 1800s" }),
+    r("DEVICE_MAX_INFLIGHT_PER_DEVICE", "orchestration", "number", `per-device 在途上限(超额云侧排队;原值进 helloAck.maxInflight;须为 ≥ ${DEVICE_HELLO_ACK_BOUNDS.maxInflight.min} 的规范十进制整数,其余拒启 —— 0 会让每次派发都 device.busy)`, { derivedDefaultNote: "缺席 ⇒ 4(§11-O3 裁定值)" }),
     r("DEVICE_MAX_PREAUTH_PER_REMOTE", "orchestration", "number", "未鉴权握手的 per-remote 并发帽(正整数或字面 off;XFF/NAT 形用 off+全局帽)", { danger: SEC, derivedDefaultNote: "缺席 ⇒ 8" }),
-    r("DEVICE_RECONNECT_GRACE_MS", "orchestration", "number", "device 断连后在途不判丢的窗(ms;同 epoch 重连续接)", { derivedDefaultNote: "缺席 ⇒ adapter 默认 120s" }),
+    r("DEVICE_RECONNECT_GRACE_MS", "orchestration", "number", `device 断连后在途不判丢的窗(ms;同 epoch 重连续接;原值进 helloAck.reconnectGraceMs;须为 [${DEVICE_HELLO_ACK_BOUNDS.reconnectGraceMs.min}, ${DEVICE_HELLO_ACK_BOUNDS.reconnectGraceMs.max}] 内规范十进制整数,其余拒启)`, { derivedDefaultNote: "缺席 ⇒ adapter 默认 120s" }),
     r("DEVICE_SUPERSEDE", "orchestration", "enum", "同 deviceId 二连的顶替策略", { enumValues: ["stale_only", "deny"], staticDefault: "stale_only", danger: SEC }),
     r("DIRECT_APPROVAL_DOOR", "approval", "boolean", "直连 /decide 门(无 BFF 的桌面/CLI 客户端;开 ⇒ 要求签名 JWT+HMAC 信封,principal 头降级不可信)", { staticDefault: "false", danger: SEC, configKey: "directApprovalDoor" }),
     r("DOCKER_COMMAND_TIMEOUT_MS", "orchestration", "number", "local-docker 车道单命令超时(ms)"),
@@ -257,12 +261,12 @@ export const CONFIG_CATALOG = [
     r("MEMORY_ORG_UNAVAILABLE_BACKOFF_MS", "memory", "number", "org 目录取数失败退避窗(ms)", { staticDefault: "10000", configKey: "memoryOrgUnavailableBackoffMs" }),
     r("MEMORY_PERSISTENCE_CAPABLE", "memory", "enum", "本部署能否把「记住 X」落到持久处的自我声明(三态;未知词拒启)", { enumValues: ["on", "off"], derivedDefaultNote: "缺席 ⇒ 键不上 TaskSpec,core 按 roster 推断", configKey: "memoryPersistenceCapable", booleanEnum: { true: "on", false: "off" } }),
     r("MEMORY_PROVENANCE", "memory", "enum", "已暴露会话的记忆写处置(carry=带 origin 标记照写;off=关)", { enumValues: ["off", "carry"], staticDefault: "carry", danger: SEC, configKey: "memoryProvenance" }),
-    r("MEMORY_SCOPE", "memory", "string", "单用户部署的记忆 scope 名", { derivedDefaultNote: "缺席:引擎开 ∧ 单用户 ⇒ local;其余 ⇒ 缺席(记忆暗)", configKey: "memoryScope" }),
+    r("MEMORY_SCOPE", "memory", "string", "单用户部署的记忆 scope 名(全局层;也是项目层 `userrepo:<属主>/…` 的属主 —— `user:<P>` 取 P,其余取名字本身;本服务铸的项目键族拒启)", { derivedDefaultNote: "缺席:引擎开 ∧ 单用户 ⇒ local;其余 ⇒ 缺席(记忆暗)", configKey: "memoryScope" }),
     r("MEMORY_SYNC_MAX_PULL_ENTRIES", "memory", "number", "TOC 同步单轮 pull 条数帽(设了必须 ≥1 整数)", { derivedDefaultNote: "缺席 ⇒ 键缺席,core 默认" }),
     r("MEMORY_SYNC_MAX_PUSH_ENTRIES", "memory", "number", "TOC 同步单轮 push 条数帽(设了必须 ≥1 整数)", { derivedDefaultNote: "缺席 ⇒ 键缺席,core 默认" }),
-    r("MEMORY_SYNC_SCOPE", "memory", "string", "TOC 同步 scope 覆写", { derivedDefaultNote: "缺席 ⇒ = MEMORY_SCOPE,仅当它已是 typed 键;非 typed 键拒启(S-964)" }),
+    r("MEMORY_SYNC_SCOPE", "memory", "string", "TOC 同步 scope 覆写(本服务铸的项目键族 `userrepo:` / `repo:` 拒启:项目层由同步腿按属主自己选)", { derivedDefaultNote: "缺席 ⇒ = MEMORY_SCOPE,仅当它已是 typed 键;非 typed 键拒启(S-964)" }),
     r("MEMORY_SYNC_TOKEN", "memory", "secret", "TOC 同步中心面的 Bearer(URL 设了它必须在,半配拒启)", { danger: SEC }),
-    r("MEMORY_SYNC_URL", "memory", "url", "TOC 同步中心地址(设了=开;file 记忆形专用,DB 后端配了拒启;同步只覆盖一层 ⇒ 单用户任务不按项目键控、写家落全局层 MEMORY_SCOPE(S-512 让位,启动通知 `memory_project_scope_yields_to_sync`))"),
+    r("MEMORY_SYNC_URL", "memory", "url", "TOC 同步中心地址(设了=开;file 记忆形专用,DB 后端配了拒启;同步覆盖同步层与同属主的项目层 `userrepo:<属主>/…` ⇒ 同步层与 MEMORY_SCOPE 同属主时单用户任务照常按项目键控并随同步推拉;不同属主 ⇒ 写家落全局层,启动通知 `memory_project_scope_yields_to_sync`)"),
     r("METRICS_TOKEN", "observability", "secret", "/metrics 只读令牌", { danger: SEC }),
     r("MINIO_ACCESS_KEY", "store", "secret", "对象存储 access key(快照 blob/leader 工作区/公链签发共用)", { danger: SEC }),
     r("MINIO_BUCKET", "store", "string", "leader 工作区快照桶", { derivedDefaultNote: "缺席 ⇒ workspaces" }),
@@ -351,7 +355,8 @@ export const CONFIG_CATALOG = [
     r("MYSQL_PORT", "store", "number", "MySQL 协议端口", { staticDefault: "3306" }),
     r("MYSQL_USER", "store", "string", "MySQL 协议用户", { danger: DATA }),
     r("NO_PROXY", "limitsHttp", "csv", "不走代理的目标(小写 `no_proxy` 同认且优先);语法 = undici 的:逗号或空白分隔,`host` 精确且含其子域、`.host` / `*.host` 后缀、`host:port` 限端口、`*` 全直连;**回环 / 未指定地址目标无论写没写都直连**(本仓的无条件规则,不是 NO_PROXY 的一条);boot 冻结", { danger: SEC, derivedDefaultNote: "缺席 ⇒ 除回环外一律按 HTTP(S)_PROXY 走", resolve: (_c, env) => buildOutboundProxyPosture(env).noProxy }),
-    r("OPERATOR_PRINCIPALS", "auth", "csv", "operator 名单(operator lane 全族门;审批队列上空名单=旧行为 token 即 operator,explicitOperatorOk 族空名单=谁都不是)", { danger: SEC, configKey: "operatorPrincipals" }),
+    r("OPERATOR_PRINCIPALS", "auth", "csv", "operator 名单(全部运维面同一条读法:名单内的验过主体是运维;空名单 = 谁都不是;与 OPERATOR_SINGLE_USER 互斥)", { danger: SEC, configKey: "operatorPrincipals" }),
+    r("OPERATOR_SINGLE_USER", "auth", "boolean", "单用户形当自己运维的显式声明(true ⇒ 这台部署的每个调用方在全部运维面都是运维;只在 REQUIRE_PRINCIPAL 未开且 OPERATOR_PRINCIPALS 为空时成立,否则拒启;起服冻结)", { staticDefault: "false", danger: SEC, configKey: "operatorSingleUser" }),
     r("OTEL_EXPORTER_OTLP_ENDPOINT", "observability", "url", "OTLP 出口(设了=开 otel)"),
     r("OTEL_EXPORTER_OTLP_HEADERS", "observability", "secret", "OTLP 出口头(k=v CSV;常载鉴权头 ⇒ 按凭据处置)", { danger: SEC }),
     r("OTEL_EXPORT_INTERVAL_MS", "observability", "number", "OTLP 批报周期(ms)", { staticDefault: "15000" }),
@@ -368,6 +373,7 @@ export const CONFIG_CATALOG = [
     r("PLUGINS_ALLOW_HOSTS", "integrations", "csv", "plugins 域 clone host 白名单", { staticDefault: "github.com", danger: SEC, configKey: "pluginsAllowHosts" }),
     r("PORT", "limitsHttp", "number", "监听端口(0=随机,测试用)", { staticDefault: "8090", configKey: "port" }),
     r("PRINCIPAL_HEADER", "auth", "string", "principal 头名(跨仓冻结默认)", { staticDefault: "x-agent-principal", danger: SEC, configKey: "principalHeader" }),
+    r("PRINCIPAL_INBOX_ASSISTANT", "approval", "string", "principal 收件箱的消费方声明(独占读它的助理 agent handle)= 跨主体投递车道开关:在场 ⇒ 挂投递门与 POST /v1/principal-inbox/messages(耐久 mailbox / org 成员目录 / 配额店缺一拒启);空白 handle 拒启", { danger: SEC, configKey: "principalInboxAssistant", derivedDefaultNote: "缺席 ⇒ 不铸座、不挂门(跨主体投递整条不存在)", resolve: (c) => c.principalInboxAssistant ?? null }),
     r("PRINCIPAL_JWT_AUD", "auth", "string", "直连 principal JWT 期望 aud", { danger: SEC, configKey: "principalJwtAud" }),
     r("PRINCIPAL_JWT_ISS", "auth", "string", "直连 principal JWT 期望 iss", { danger: SEC, configKey: "principalJwtIss" }),
     r("PRINCIPAL_JWT_MAX_TTL_SEC", "auth", "number", "接受的 principal JWT 最长寿命(秒;0=不设帽;负值拒启 —— 收紧意图不许翻成最松)", { staticDefault: "120", danger: SEC, configKey: "principalJwtMaxTtlSec" }),
@@ -384,7 +390,7 @@ export const CONFIG_CATALOG = [
     r("REAP_INTERVAL_SEC", "limitsHttp", "number", "reaper 周期(秒)", { staticDefault: "60", configKey: "reapIntervalSec" }),
     r("REAP_RUN_STALE_SEC", "limitsHttp", "number", "run 活性判陈旧阈(秒)", { staticDefault: "120", configKey: "runStaleSec", center: cLimits("runStaleSec") }),
     r("REMOTE_EXEC", "orchestration", "enum", "执行车道选择(点名而配不齐/认不出 ⇒ 拒启,绝不静默降级到 host/stub)", { enumValues: REMOTE_EXEC_PROVIDER_WORDS, danger: SEC, derivedDefaultNote: "缺席:CONFIG_PROVIDER=local ⇒ host;其余 ⇒ 进程内 stub(手带整族不挂;残余名册看活体 wiring_manifest 里 mountedBy=hands 的条目数,不按工具名点。想让这一形拒启见 REQUIRE_EXECUTION_LANE)", configKey: "remoteExec", resolve: (c) => c.remoteExec?.provider ?? null }),
-    r("REMOTE_EXEC_HOME_DIR", "orchestration", "path", "执行环境的 home 目录(`~/` 形权限规则的基、引擎家锚拒读行的落点;core ExecutionEnv.homeDir 座)。local-docker / ssh 车道在每只执行环境开起来时与它的 $HOME 对证,不一致或问不出 ⇒ 那只环境不开", { danger: SEC, derivedDefaultNote: "缺席:host/in-process ⇒ os.homedir();e2b ⇒ /home/user;k8s/local-docker/ssh/adb/device ⇒ 无(`~/` 规则 422 响亮拒;泄内容的递归读全 shell 面真人问、只读面拒;起服 warn execution_lane_home_undeclared)", configKey: "remoteExecHomeDir", resolve: (c) => c.remoteExecHomeDir ?? null }),
+    r("REMOTE_EXEC_HOME_DIR", "orchestration", "path", "执行环境的 home 目录(`~/` 形权限规则的基、引擎家锚拒读行的落点;core ExecutionEnv.homeDir 座)。声明优先:不声明时 k8s / local-docker / ssh / adb 车道建环境那一拍实测执行环境自己的 $HOME 填引擎手里的座(`~/` 形规则的下单门仍只认声明);k8s / local-docker / ssh 车道的声明会在每只执行环境开起来时与它的 $HOME 对证(同一只判官、同一句拒),不一致或问不出 ⇒ 那只环境不开", { danger: SEC, derivedDefaultNote: "缺席:host/in-process ⇒ os.homedir();e2b ⇒ /home/user;k8s/local-docker/ssh/adb ⇒ 建环境时实测 $HOME(实测缺席 ⇒ 那只环境的座缺席:泄内容的递归读全 shell 面真人问、只读面拒,并响 warn execution_lane_home_undeclared);device ⇒ 无(设备协议没有家目录读数:起服 warn execution_lane_home_undeclared);`~/` 形规则的下单门恒只认声明(无声明即 422 响亮拒)", configKey: "remoteExecHomeDir", resolve: (c) => c.remoteExecHomeDir ?? null }),
     r("REQUIRE_EXECUTION_LANE", "orchestration", "boolean", "开了之后:REMOTE_EXEC 未点名 ∧ CONFIG_PROVIDER≠local ⇒ **拒启**并点名该设什么。默认关 = 照旧启动,但执行环境是进程内 stub、**零手带工具**(手带整族不挂;活体读数:mountedBy=hands 条目 10 → 0),名册里其余工具照常执行,任务仍回 status=completed —— 凡需要手的请求,与「模型不肯用工具」在用户面同形。判据 = 活体 wiring_manifest 里 mountedBy=hands 的条目数,不按工具名点;名册总条数随 core 版本走,不写死。托管/云部署推荐开(docs/DEPLOY-PREREQS.md)", { staticDefault: "false", danger: SEC, configKey: "requireExecutionLane" }),
     r("REQUIRE_PRINCIPAL", "auth", "boolean", "多租户开关(posture 判别位:true ⇒ CC 能力族默认收紧)", { staticDefault: "false", danger: SEC, configKey: "requirePrincipal" }),
     r("RESOURCE_SUSPEND", "approval", "boolean", "durable 路径 opt-in core resourceSuspend(预算/preempt ⇒ 可恢复挂起)", { staticDefault: "false", configKey: "resourceSuspend" }),
@@ -449,7 +455,7 @@ export const CONFIG_CATALOG = [
     r("SIGHUP_IDLE_GRACE_MS", "limitsHttp", "number", "SIGHUP 空闲关停窗(ms;共享引擎形防误杀)", { staticDefault: "120000", configKey: "sighupIdleGraceMs" }),
     r("SKILLS_DIR", "integrations", "path", "出厂 skill 目录(设了就整个替换包内 skills/,不叠加;配置源的技能再按名盖上)", { derivedDefaultNote: "缺席 ⇒ 包内 skills/(相对模块解析,不是 cwd)", configKey: "skillsDir" }),
     r("SNAPSHOT_BLOB_ALLOW_SQL_BYTES", "store", "boolean", "云形缺 MinIO 时显式接受 SQL 店放快照字节(严格 'true';安全姿势开关不收宽松真值)", { staticDefault: "false", danger: DATA, configKey: "snapshotBlobAllowSql" }),
-    r("SNAPSHOT_BLOB_SQL_MAX_BYTES", "store", "number", "SQL 店单 blob 帽(字节)", { derivedDefaultNote: "缺席:mysql 引擎 ⇒ 库报的单行上限与 max_allowed_packet ÷ 2 取小(两堵墙各自读不到时按该库族文档缺省);pg ⇒ 不设", configKey: "snapshotBlobSqlMaxBytes" }),
+    r("SNAPSHOT_BLOB_SQL_MAX_BYTES", "store", "number", "SQL 店单 blob 帽(字节)", { derivedDefaultNote: "缺席:mysql 引擎 ⇒ 写入那条连接报的单行上限与 max_allowed_packet ÷ 2 取小(两堵墙各自读不到时按该库族文档缺省);pg ⇒ 不设", configKey: "snapshotBlobSqlMaxBytes" }),
     r("SSH_HOST", "orchestration", "string", "ssh 车道目标主机(必需件)"),
     r("SSH_HOST_FINGERPRINT", "orchestration", "string", "主机密钥指纹校验(坏值拒启;仅 ssh 车道被选中时求值)", { danger: SEC }),
     r("SSH_KNOWN_HOSTS", "orchestration", "path", "known_hosts 路径(坏路径拒启)", { danger: SEC }),
@@ -495,7 +501,7 @@ export const CONFIG_CATALOG = [
     r("WORKFLOW_JOURNAL_RETENTION_MS", "orchestration", "number", "workflow_journal GC 保留期(ms)", { staticDefault: String(7 * 24 * 60 * 60 * 1000), danger: DATA, configKey: "workflowJournalRetentionMs" }),
     r("WORKFLOW_ORPHAN_GRACE_MS", "orchestration", "number", "running workflow 判崩溃孤儿的年龄阈(ms)", { staticDefault: String(24 * 60 * 60 * 1000), configKey: "workflowOrphanGraceMs" }),
     r("WORKFLOW_RUN_RETENTION_MS", "orchestration", "number", "TERMINAL workflow_run 行保留期(ms;SQL twins)", { staticDefault: String(30 * 24 * 60 * 60 * 1000), danger: DATA, configKey: "workflowRunRetentionMs" }),
-    r("WORKFLOW_RUN_STORE", "orchestration", "enum", "后台 workflow run 店后端(auto=有 SQL 用 SQL,否则 File)", { enumValues: ["auto", "file", "memory"], staticDefault: "auto", configKey: "workflowRunStoreBackend" }),
+    r("WORKFLOW_RUN_STORE", "orchestration", "enum", "后台 workflow run 店后端(auto=有 SQL 用 SQL,否则 File;SQL 后端上配 file / memory 且开了自编排 ⇒ 起服拒:workflow 子代的审批决定行要与会话认领同库)", { enumValues: ["auto", "file", "memory"], staticDefault: "auto", configKey: "workflowRunStoreBackend" }),
     r("WORKFLOW_SIZE_GUIDELINE", "orchestration", "enum", "Workflow 工具卡的规模建议(advisory;typo 拒启)", { enumValues: ["small", "medium", "large", "unrestricted"], configKey: "workflowSizeGuideline" }),
     r("WORKFLOW_TOTAL_TIMEOUT_MS", "orchestration", "number", "workflow 脚本总时限(ms;0/负不是禁用 —— 无禁用臂)", { staticDefault: "3600000" }),
     r("WORKSPACE_CACHE", "orchestration", "enum", "k8s 按工作区空间的构建缓存卷:volume = 每个空间(会话住客)一只 PVC(ws-cache-<摘要>,标签 sema.space,StorageClass 用集群缺省),挂到 WORKSPACE_CACHE_MOUNT,并在 pod env 注入工具缓存闭表(GRADLE_USER_HOME / MAVEN_OPTS / npm_config_cache / PIP_CACHE_DIR / UV_CACHE_DIR / GOMODCACHE;Rust 依赖缓存不盖 —— Cargo 没有只放下载缓存的 env;K8S_SANDBOX_ENV 同名显式值胜);卷在快照之外、可丢,pod 删卷留;卷拿不到(建不成 / 快照时限内没绑定)⇒ run 照起、无卷无缓存 env,fail-open 计数 + 一行 workspace_cache_unavailable;off = 不建卷。前提:会话店读得出会话住客(内存会话店 × volume ⇒ 拒启);委派子代不挂卷;词表外拒启", { enumValues: WORKSPACE_CACHE_WORDS, staticDefault: WORKSPACE_CACHE_DEFAULT }),
@@ -597,29 +603,40 @@ function primitiveConfigValue(config, key) {
         return v;
     return undefined;
 }
+const INVALID = { value: null, effectiveValueInvalid: true };
 function sanitizeEnumValue(spec, v) {
     const words = spec.echoWords ?? spec.enumValues;
     if (v === null)
         return { value: null };
     if (words === undefined)
-        return { value: null, invalid: true };
+        return INVALID;
     if (typeof v === "boolean") {
         const word = spec.booleanEnum?.[v ? "true" : "false"];
         if (word === null)
             return { value: null };
-        return word !== undefined && words.includes(word) ? { value: word } : { value: null, invalid: true };
+        return word !== undefined && words.includes(word) ? { value: word } : INVALID;
     }
     if (typeof v === "string")
-        return words.includes(v) ? { value: v } : { value: null, invalid: true };
-    return { value: null, invalid: true };
+        return words.includes(v) ? { value: v } : INVALID;
+    return INVALID;
 }
+function displayUrlItems(raws, dropEmpty) {
+    const checked = raws.map((raw) => buildDisplaySafeUrlChecked(raw));
+    const texts = checked.map((c) => c.text);
+    return { value: dropEmpty ? texts.filter((t) => t.length > 0) : texts, ...withheldIf(checked.some((c) => c.failedClosed)) };
+}
+const withheldIf = (withheld) => (withheld ? { effectiveValueWithheld: true } : {});
 function sanitizeValue(spec, v) {
     const type = spec.type;
     if (type === "url") {
-        if (typeof v === "string")
-            return { value: v.includes(",") ? v.split(",").map((s) => buildDisplaySafeUrl(s.trim())).filter((s) => s.length > 0) : buildDisplaySafeUrl(v) };
+        if (typeof v === "string") {
+            if (v.includes(","))
+                return displayUrlItems(v.split(",").map((s) => s.trim()), true);
+            const shown = buildDisplaySafeUrlChecked(v);
+            return { value: shown.text, ...withheldIf(shown.failedClosed) };
+        }
         if (Array.isArray(v))
-            return { value: v.map((s) => buildDisplaySafeUrl(s)) };
+            return displayUrlItems(v, false);
         return { value: v };
     }
     if (type === "csv" && typeof v === "string")
@@ -651,21 +668,19 @@ export function buildConfigCatalog(inputs) {
         const centerRestartSlice = seat?.restartSlice;
         const centerEffective = seat !== undefined && managedNow && centerTiming === "hot" && (seat.precedence === "center-wins" || !envHeld);
         const effectiveLane = centerEffective ? "center" : envHeld ? "env" : "default";
-        let effectiveValue;
-        let effectiveValueInvalid;
+        let cell;
         if (valueClass === "secret") {
-            effectiveValue = { present: envHeld };
+            cell = { value: { present: envHeld } };
         }
         else if (valueClass === "opaque") {
-            effectiveValue = envHeld ? { present: true, length: raw.length } : { present: false };
+            cell = { value: envHeld ? { present: true, length: raw.length } : { present: false } };
         }
         else {
             const resolved = spec.resolve !== undefined ? spec.resolve(config, env, boot) : spec.configKey !== undefined ? primitiveConfigValue(config, spec.configKey) : undefined;
             const picked = resolved !== undefined ? resolved : knob !== undefined ? knob.value : envHeld ? raw : spec.staticDefault ?? null;
-            const sanitized = sanitizeValue(spec, picked);
-            effectiveValue = sanitized.value;
-            effectiveValueInvalid = sanitized.invalid;
+            cell = sanitizeValue(spec, picked);
         }
+        const { value: effectiveValue, ...verdicts } = cell;
         return {
             name: spec.name,
             domain: spec.domain,
@@ -678,7 +693,7 @@ export function buildConfigCatalog(inputs) {
             ...(spec.staticDefault !== undefined ? { staticDefault: spec.staticDefault } : {}),
             ...(spec.derivedDefaultNote !== undefined ? { derivedDefaultNote: spec.derivedDefaultNote } : {}),
             effectiveValue,
-            ...(effectiveValueInvalid === true ? { effectiveValueInvalid } : {}),
+            ...verdicts,
             valueClass,
             danger: spec.danger ?? [],
             ...(seat !== undefined && centerTiming !== undefined

package/dist/config-d-migration.d.ts

@@ -1,4 +1,6 @@
-import { type ConfigDirectoryMigration } from "@sema-agent/settings-schema/node";
+import { type ConfigDirectoryDocument, type ConfigDirectoryMigration } from "@sema-agent/settings-schema/node";
+/** 本地读腿读的那几份(便携域 + 退役域 + remote-exec 文档)= 迁移的覆盖面 = 目录信任判官(`config-dir-trust.ts`)判的文档名单。取契约的表与文档名,不手抄。 */
+export declare const LOCAL_READER_DOCUMENTS: readonly ConfigDirectoryDocument[];
 /** 一次起服迁移的结果:契约的结果闭集,外加本仓入口的两形(目录不在 ⇒ 不调;调用抛 ⇒ 失败)。纯数据。 */
 export type ConfigDirMigration = {
     readonly kind: "no-config-dir";

package/dist/config-d-migration.js

@@ -3,7 +3,7 @@ import { join } from "node:path";
 import { RETIRED_DOMAINS, formatConfigPath, isRetiredDomainName } from "@sema-agent/settings-schema";
 import { PORTABLE_DOMAINS, migrateConfigDirectory, nodeConfigDirectoryIo } from "@sema-agent/settings-schema/node";
 import { REMOTE_EXEC_DOCUMENT } from "@sema-agent/settings-schema/remote-exec";
-const READ_BACK_DOCUMENTS = [...PORTABLE_DOMAINS, ...Object.keys(RETIRED_DOMAINS).filter(isRetiredDomainName), REMOTE_EXEC_DOCUMENT];
+export const LOCAL_READER_DOCUMENTS = [...PORTABLE_DOMAINS, ...Object.keys(RETIRED_DOMAINS).filter(isRetiredDomainName), REMOTE_EXEC_DOCUMENT];
 const errnoOf = (err) => (err instanceof Error && "code" in err && typeof err.code === "string" ? err.code : undefined);
 export async function migrateLocalConfigDirectory(root) {
     const dir = join(root, "config.d");
@@ -16,7 +16,7 @@ export async function migrateLocalConfigDirectory(root) {
             return { kind: "no-config-dir", dir };
     }
     try {
-        return { ...(await migrateConfigDirectory(dir, { documents: READ_BACK_DOCUMENTS, io: nodeConfigDirectoryIo })), dir };
+        return { ...(await migrateConfigDirectory(dir, { documents: LOCAL_READER_DOCUMENTS, io: nodeConfigDirectoryIo })), dir };
     }
     catch (err) {
         return { kind: "threw", dir, reason: `${err instanceof Error ? err.message : String(err)}${errnoOf(err) !== undefined ? ` (${errnoOf(err)})` : ""}` };