@sema-agent/server 7.133.0 → 7.135.0

package/dist/boot/memory-consolidation.d.ts

@@ -11,10 +11,10 @@ type ConsolidationSeatOptions = ReturnType<typeof resolveMemoryConsolidationDriv
 export type ConsolidationSeatLabel = "explicit" | "role:consolidate" | "role:summarize";
 /** {@link buildConsolidationValveAudit} 的告警名闭集(事件名进日志 ⇒ 运维可按名过滤/告警)。 */
 export type ConsolidationValveWarningTag = "memory_consolidation_valve_unreachable" | "memory_consolidation_run_credential_gated";
-/** {@link resolveConsolidationValve} 的起服提示名闭集(S-824 / [ref];事件名进日志 ⇒ 运维可按名过滤/告警)。 */
+/** {@link resolveConsolidationValve} 的起服提示名闭集([ref] / [ref];事件名进日志 ⇒ 运维可按名过滤/告警)。 */
 export type ConsolidationValveNoticeTag = "memory_consolidation_default_off_no_cheap_model" | "memory_consolidation_on_main_model";
 /**
- * 阀门判决(S-824 / [ref])。`build*`/`create*` 之外的第三种:纯数据,由 {@link resolveConsolidationValve} 产出。
+ * 阀门判决([ref] / [ref])。`build*`/`create*` 之外的第三种:纯数据,由 {@link resolveConsolidationValve} 产出。
  * 阀门开关的**唯一**属主:座解析、操作面、引擎面两席、审计告警、武装日志全读 `enabled`,不再各读一次表态。
  */
 export interface ConsolidationValve {
@@ -22,7 +22,7 @@ export interface ConsolidationValve {
     /** 这一位是谁定的:运维的显式词(`explicit`),还是出厂缺省派生(`derived`)。 */
     readonly source: "explicit" | "derived";
     /**
-     * 这一判决**随目录变**吗(S-824 codex 车内复审 F2)。真 = 派生判决读了整理座落在谁身上(未设 ∧ 结构上跑得起来),
+     * 这一判决**随目录变**吗([ref] codex 车内复审 F2)。真 = 派生判决读了整理座落在谁身上(未设 ∧ 结构上跑得起来),
      * 中心热改 roles / 档位就可能翻它 ⇒ 要有一份重启读数盯着({@link createConsolidationValveWatch})。显式词、以及结构上
      * 跑不起来的派生关 ⇒ 假(目录怎么改都翻不动)。
      */
@@ -34,7 +34,7 @@ export interface ConsolidationValve {
     };
 }
 /**
- * 整理座若开,会落在哪只模型上 —— **相对主模型**(S-824 的「便宜模型在场」判据;{@link consolidationSeatBillingOf} 产出)。
+ * 整理座若开,会落在哪只模型上 —— **相对主模型**([ref] 的「便宜模型在场」判据;{@link consolidationSeatBillingOf} 产出)。
  *  · `own-model`   = 座解到的目录条目**不是**主模型那一条(按条目身份 = 对象引用判,不比 id 串;`MODEL_CHEAP_ID`,或目录的
  *                    consolidate / summarize / flash 档位绑定);
  *  · `main-model`  = 座解到主模型那一条本身(env 角色表在 `MODEL_CHEAP_ID` 缺席 —— 或与 `MODEL_ID` 同 id、不铸 cheap 槽 —— 时把
@@ -80,7 +80,7 @@ export interface ConsolidationDriverSeat {
  */
 export declare function resolveConsolidationDriverSeat(deps: MemoryConsolidationDriverDeps): ConsolidationDriverSeat;
 /**
- * S-668 波 0([ref] §3)—— 整理驱动席的 **restart 读数**。过渡件:**波 1 转热后删**(那时每轮 run 起手
+ * [ref] 波 0([ref] §3)—— 整理驱动席的 **restart 读数**。过渡件:**波 1 转热后删**(那时每轮 run 起手
  * 现取当前代的席,不再有 boot 烤死的席,这只表也就没有要比的东西了)。
  *
  * ## 为什么要它
@@ -152,7 +152,7 @@ export declare function createPerScopeSingleFlight<T>(): (scope: string, run: ()
  *
  * 阀门关着 ⇒ 整条门不判(缺省姿态,[ref]「缺席不在律内」)。
  *
- * 🔴 S-824 起判据拆成「判官 + 拒启包装」两半:判官 {@link consolidationDriverUnwirable} 是三条臂的**唯一**
+ * 🔴 [ref] 起判据拆成「判官 + 拒启包装」两半:判官 {@link consolidationDriverUnwirable} 是三条臂的**唯一**
  * 属主,拒启包装只在阀门开着时把它的拒因抛出去;出厂缺省派生({@link resolveConsolidationValve})读同一只判官决定
  * 「结构上跑不起来 ⇒ 缺省恒关」—— 两处读一只,不是两份三臂。
  */
@@ -180,7 +180,7 @@ export type ConsolidationUnwirable = "no-memory-engine" | "no-control-plane" | "
  */
 export declare function consolidationDriverUnwirable(input: ConsolidationWiringFacts): ConsolidationUnwirable | undefined;
 /**
- * 整理座若开会落在哪只模型上(S-824 的「便宜模型在场」判据)—— **问 core 的同一只解析器**,不抄 role 链
+ * 整理座若开会落在哪只模型上([ref] 的「便宜模型在场」判据)—— **问 core 的同一只解析器**,不抄 role 链
  * ({@link seatLabel} 注里同一条理由:抄一份就是第二真源,而 `ROLE_TIER_DEFAULTS` 的 flash 缺省会让手抄版答错)。
  *
  * 为什么不按 env `MODEL_CHEAP_ID` 的拼写判:它只是供座的一条路。env 角色表在它缺席时把 summarize 指回
@@ -201,7 +201,7 @@ export declare function consolidationDriverUnwirable(input: ConsolidationWiringF
  */
 export declare function consolidationSeatBillingOf(plane: ConsolidationSeatPlane): ConsolidationSeatBilling;
 /**
- * 🔴 S-824 / clay **[ref]** —— **阀门判决**:开不开、谁定的、起服时要说什么。阀门开关的**唯一**属主(stage-06 的座解析 /
+ * 🔴 [ref] / clay **[ref]** —— **阀门判决**:开不开、谁定的、起服时要说什么。阀门开关的**唯一**属主(stage-06 的座解析 /
  * 操作面 / 引擎面两席 / 审计告警 / 武装日志全读它的 `enabled`)。
  *
  *  · **显式词恒赢**:`off` ⇒ 关、零提示、**零探针**(一眼都不看角色表 —— off = 零装配零探针那句承诺);`on` ⇒ 开
@@ -214,7 +214,7 @@ export declare function consolidationSeatBillingOf(plane: ConsolidationSeatPlane
  *      座不落主模型({@link consolidationSeatBillingOf} = `own-model`)⇒ **开**;
  *      否则(落主模型 / 解不出)⇒ **关** + 一行 `memory_consolidation_default_off_no_cheap_model`(点名 `MODEL_CHEAP_ID`,
  *      出路 = 配便宜模型,或显式 `off` 静音)。
- *  · **半配拒启**(`MEMORY_EMBEDDER_*` 同族,S-824 起判定点挪到这里):scope 表 / 节律配了而阀门最终**没开** ⇒ 拒启,
+ *  · **半配拒启**(`MEMORY_EMBEDDER_*` 同族,[ref] 起判定点挪到这里):scope 表 / 节律配了而阀门最终**没开** ⇒ 拒启,
  *    拒因说清「为什么没开」。在 `loadConfig` 判会把「未设 + scope + 便宜模型在场」这台本该派生成开的部署当场拒掉。
  *
  * ⚠️ **起服判一次**(restart-to-apply):判决落在 boot 第 4 段的装配点 {@link createConsolidationValve} —— 目录已应用
@@ -239,7 +239,7 @@ export declare function resolveConsolidationValve(input: {
  * baked = boot 判决的投影,current = 此刻拿活配置**重判**一次的投影(`plane` 给活引用的 getter,refresh 就地换代后现取)。
  *  · 判决翻了(派生开 → 关:主模型被挪到整理座那一条上,或座被挪回主模型;派生关 → 开:目录给整理座绑上别的模型 / 目录迟到)
  *    ⇒ 两侧不等 ⇒ 签重启(重启后 boot 重判)。修前是两臂:开时只盯座位指纹、关时只盯「会不会开」—— 只动主模型的那一形零信号。
- *  · 开着而座漂了(中心改了座会解到的那只模型)⇒ 座位指纹不等 ⇒ 签(S-668 波 0 的既有信号,显式 on 同走这一臂)。
+ *  · 开着而座漂了(中心改了座会解到的那只模型)⇒ 座位指纹不等 ⇒ 签([ref] 波 0 的既有信号,显式 on 同走这一臂)。
  *  · 关着而目录怎么变都不翻 ⇒ 两侧同为 `{ valve: "off" }` ⇒ 不签(主模型换代而判决不翻,不造一次什么都不改变的重启)。
  * 主模型条目是判决的**输入**(它决定开 / 关),不进投影本身 —— 进了就会在每一次主模型换代时签一次不翻判决的重启。
  * 显式 off / 结构上跑不起来的派生关 ⇒ `undefined`(判决不随目录变,没有可盯的东西)。
@@ -283,7 +283,7 @@ export interface ConsolidationValveInput {
  *
  * 两个入口各调它一次:HTTP 服务第 4 段经 {@link createConsolidationValve};`run-local` 在记忆引擎接线之后直接调(它没有整理座 ——
  * 不挂手动口、不接 `RunnerDeps` 的整理两席 —— 判决本身对它没有用处,要的只是拒因)。修前这道拒只长在 HTTP 那条装配链上
- * (S-824 从 `loadConfig` 挪过来时 `run-local` 没跟上):共享 `.env` 上同一组键,HTTP 服务拒启、`run-local` 带着零效果的 scope 表
+ * ([ref] 从 `loadConfig` 挪过来时 `run-local` 没跟上):共享 `.env` 上同一组键,HTTP 服务拒启、`run-local` 带着零效果的 scope 表
  * 静默起跑。判据只有这一只 ⇒ 两个入口对同一份 env 同判同句(未设 + 便宜模型在场 ⇒ 两边都派生开、都照起)。
  */
 export declare function judgeConsolidationValve(input: ConsolidationValveInput): {
@@ -312,7 +312,7 @@ export declare function judgeConsolidationValve(input: ConsolidationValveInput):
  * 反过来说,**沉默**同样不行:那正是「设了但没生效」病族,而这一形连能力位都是诚实的假,唯一缺的
  * 就是一句把因果说清楚的话。
  *
- * ## 只审**显式**开的阀门(S-824 / [ref] 起)
+ * ## 只审**显式**开的阀门([ref] / [ref] 起)
  *
  * 两条告警的前提都是「运维**显式**拧了 on」(上面那句原话)——它们是一次**表态**够不着的诊断。出厂缺省**派生**开的
  * 那台(配了便宜模型的单用户部署)没有表态可审:引擎面的自动整理照跑(不走这两个口),手动口是一件它没要过的东西。
@@ -360,7 +360,7 @@ export declare function buildStopDetailAudit(input: {
     untrustedDetail: string;
 };
 /**
- * S-362 / S-399 —— **`RunnerDeps.autoRunOnRecommendation` 武装席的装配不变量**(D1 的姊妹门)。
+ * [ref] / [ref] —— **`RunnerDeps.autoRunOnRecommendation` 武装席的装配不变量**(D1 的姊妹门)。
  *
  * 与 {@link assertConsolidationDriverWirable} 刻意**分家**而不是加第四臂:那道门问「阀门这根旋钮
  * (`MEMORY_CONSOLIDATION_DRIVER`)开着而这台机器结构上跑不了」,本门问「武装这根旋钮
@@ -377,7 +377,7 @@ export declare function buildStopDetailAudit(input: {
  * ## 判据取的是**结构事实**,不是一个手抄的布尔
  *
  * `memoryConsolidationWired` 由调用点从**它刚刚铸出来的那只 `RunnerDeps`** 上读(`deps.memoryConsolidation
- * !== undefined`),不是在这里写一个常量 —— S-399 把两席接上之后,本门**自动**从「恒拒」变成「阀门开着
+ * !== undefined`),不是在这里写一个常量 —— [ref] 把两席接上之后,本门**自动**从「恒拒」变成「阀门开着
  * 就放行」,没有人需要记得回来改一个数。
  *
  * 🔴 **core 的拒绝谓词是两个析取项,本门只覆盖第一个**(对抗复审 F5 [low],验真后如实登记):
@@ -500,7 +500,7 @@ export declare function createMemoryConsolidationFaces(store: {
      *  🔴 这只引擎是四只 operator 面里**真读名册**的那只:`consolidationEligibility` 第四臂
      *  (engine.js `listCaptureOptOutSessions`)拿它筛掉 opt-out 会话的贡献条目 —— SQL 部署上漏喂
      *  = 驱动器读文件空名册 ⇒ 蒸馏器放大用户明说不要记的内容(S-5 真实失效形;全站同批注入律,
-     *  机器钉 capture-optout-lane ②)。S-215 起 local 车道在引擎接线时也供(core 文件三腿,同一只控制面);
+     *  机器钉 capture-optout-lane ②)。[ref] 起 local 车道在引擎接线时也供(core 文件三腿,同一只控制面);
      *  缺席 ⇒ 记忆面暗(引擎未接线),与 Runner 同本。 */
     captureRecordStore?: SessionCaptureRecordStore;
     /** core 7.50.0:整理跑的**写判官座**(必填 —— 缺席不是「没有规则」,core 也拒)。操作面不判任何东西,只把它原样递给驱动动词:

package/dist/boot/parked-revive-gate.d.ts

@@ -7,7 +7,7 @@ import type { ApprovalExemptionStore } from "../plugins/approval-exemption-store
 /** 本腿读的配置切面(`ServiceConfig` 结构满足)。两个构造口各自的切面 + lane 判别式读的 `remoteExec`。 */
 export interface ParkedReviveGateConfigView extends DeploymentGovernanceConfigView, ApprovalBaselineConfigView {
     readonly remoteExec?: ServiceConfig["remoteExec"];
-    /** S-213④:`executionLaneHomeDir` 读的运维声明(切面必须点名本腿消费的每一个字段,否则窄视图字面量会静默丢掉旋钮)。 */
+    /** [ref]④:`executionLaneHomeDir` 读的运维声明(切面必须点名本腿消费的每一个字段,否则窄视图字面量会静默丢掉旋钮)。 */
     readonly remoteExecHomeDir?: ServiceConfig["remoteExecHomeDir"];
     /** host 腿裁决 env 的 cwd 占位根(见下方 `hostGateCwd`)。 */
     readonly localDataRoot?: ServiceConfig["localDataRoot"];
@@ -63,7 +63,7 @@ export interface ParkedReviveGateDeps {
     readonly autoModeSeatMounted?: boolean;
     /** [ref]:父 run 的 auto 意图(core 7.34.0 起 = 父腿的 `permissionMode === "auto"`,旧键 `autoModeRequested` 已退役)——
      *  意图武装式下重建 decider 的第三项。⚠️ 今日**本仓无读口**(RunRecord 无 body),生产装配不递 ⇒ 恒缺席。
-     *  S-877 登记:core 7.34.0 起子代 checkpoint 的数据半持久 `inheritedGate.permissionMode`(链在 spawn 时的**生效**模式),
+     *  [ref] 登记:core 7.34.0 起子代 checkpoint 的数据半持久 `inheritedGate.permissionMode`(链在 spawn 时的**生效**模式),
      *  这一座可改读它 —— 接线不在本次提货单内,见 7.106.0 收车档「未闭环」。 */
     readonly parentAutoModeIntent?: ((row: BackgroundAgentRecord) => boolean) | undefined;
     readonly logger: {
@@ -115,7 +115,7 @@ export type RebuiltParentConstraint = NonNullable<RebuiltInheritedGate["parentCo
  * (core 对这三个都是 seed 兜底)。
  *
  * 时点语义(成文进 docs/ASSISTANT-WIRE-CONTRACT.md,免运维当 bug 报):
- *  · toolPolicy 轴 = **当前** config(与 resume 重折一致)。S-877(core 7.35.0 #1200)起部署治理层经 `wrapToolPolicy` 携带内层 `projection`
+ *  · toolPolicy 轴 = **当前** config(与 resume 重折一致)。[ref](core 7.35.0 [ref])起部署治理层经 `wrapToolPolicy` 携带内层 `projection`
  *    ⇒ 父链那一层的**内容**进了 `cpv1` 摘要:挂起期间改了治理 config(收紧或放松)⇒ 重建链摘要对不上 ⇒ core pre-CAS 响亮拒、卡留 pending
  *    (此前那一层 opaque,收紧与放松都按当前 config 兑现;特征化钉 test/parked-revive-e2e.test.ts 已随之翻);
  *  · shellGate 轴 = core 取 max(live, park 时 seed)—— 收紧兑现、放松**不**兑现(fail-safe)。

package/dist/boot/parked-revive-gate.js

@@ -4,7 +4,8 @@ import { recordFailOpen } from "../observability/fail-open.js";
 import { decodeCheckpointScope } from "../security.js";
 import { createApprovalBaselinePolicy, createDeploymentGovernanceInputs, } from "../deployment-governance.js";
 import { applyRuntimeGovernance } from "../runtime-governance.js";
-import { DeferredSandboxPathEnv, isSandboxPathAdjudicationLane, sandboxPathEnvSlots } from "./deferred-sandbox-path-env.js";
+import { DeferredSandboxPathEnv, sandboxPathEnvSlots } from "./deferred-sandbox-path-env.js";
+import { DEPLOYMENT_SHAPE_PREDICATES } from "../deployment-shape.js";
 import { executionLaneHomeDir } from "../execution-lane-caps.js";
 import { createDeploymentListExemption } from "../approval.js";
 function hostGateCwd(config, localRoot) {
@@ -17,7 +18,7 @@ export function createParkedReviveInheritedGate(deps) {
         const metadata = await chainMetadataOf(deps, row, identity);
         const laneHome = executionLaneHomeDir(config);
         const homeBase = laneHome !== undefined ? { taskHome: laneHome } : {};
-        const pathAdjudication = isSandboxPathAdjudicationLane(config.remoteExec?.provider)
+        const pathAdjudication = DEPLOYMENT_SHAPE_PREDICATES.sandboxPathAdjudication.holds(config)
             ? {
                 env: new DeferredSandboxPathEnv({
                     sessionId: row.sessionId,

package/dist/boot/read-deny-anchor-audit.js

@@ -1,9 +1,9 @@
-import { compileReadDeny, readDenyPatternRun } from "@sema-agent/core";
+import { compileReadDeny, readDenyRowAnchor } from "@sema-agent/core";
 import { echoCallerText } from "../caller-text-echo.js";
 export const READ_DENY_AUDIT_MAX_NAMED_ROWS = 20;
 const NAMED_ROW_ECHO_CHARS = 200;
 function isAnchoredCanonicalRow(canonical) {
-    return readDenyPatternRun(canonical).homeAnchored || canonical.startsWith("/");
+    return readDenyRowAnchor(canonical) !== "none";
 }
 export function auditReadDenyAnchoring(ctx) {
     if (ctx.rows === undefined || ctx.rows.length === 0)

package/dist/boot/reapers.d.ts

@@ -70,12 +70,12 @@ export interface ReapersCtx {
     subRunner: Runner;
     runStore: ReturnType<StoreBackend["run"]> | undefined;
     checkpointStore: CheckpointStoreFull | undefined;
-    /** S-1280:checkpoint 店的 park 提交观察层(stage-06 与店同一处铸;在场 ⇔ 有 checkpoint 店)。对账收敛器订阅它,在停车行提交那一拍收口 PARKING。 */
+    /** [ref]:checkpoint 店的 park 提交观察层(stage-06 与店同一处铸;在场 ⇔ 有 checkpoint 店)。对账收敛器订阅它,在停车行提交那一拍收口 PARKING。 */
     parkCommits: ParkCommitWatch | undefined;
     rateLimiter: RateLimiter | RateLimiterStore | undefined;
     costQuota: CostQuota | CostQuotaStore | undefined;
     toolResultStore: ToolResultStoreFull | undefined;
-    /** S-589:文件历史的**擦除脸**(后端在即在,与 `FILE_HISTORY_CAPTURE` 无关)—— 本段只用它的孤儿 blob GC。 */
+    /** [ref]:文件历史的**擦除脸**(后端在即在,与 `FILE_HISTORY_CAPTURE` 无关)—— 本段只用它的孤儿 blob GC。 */
     fileHistoryErasure: FileHistoryErasureFace | undefined;
     taskAttachmentStore: TaskAttachmentStore | undefined;
     imageBakes: ImageBake | undefined;
@@ -103,9 +103,9 @@ export interface ReapersCtx {
      *  (`boot/permission-rules-audit.ts` 的 `DormantRuleCounter` 是同一条判据的先例)。
      *  生产传的仍是整只束(结构上满足这个窄口)。 */
     permissionRuleStores: PermissionRuleRetentionSweeper | undefined;
-    /** S-928 用户输入受理账本(stage-07 装配;缺席 = 无 backend)。每拍在 reapStale **之后**收敛一次(同一条腿串行,理由见 tick 里那一行)。 */
+    /** [ref] 用户输入受理账本(stage-07 装配;缺席 = 无 backend)。每拍在 reapStale **之后**收敛一次(同一条腿串行,理由见 tick 里那一行)。 */
     userInputLedger: Pick<UserInputLedger, "converge"> | undefined;
-    /** S-280 直连门 nonce 的消费记录店 —— 本 tick 只用它的**到期清扫**一手。行至多活 ~150 秒(= 证明还能被
+    /** [ref] 直连门 nonce 的消费记录店 —— 本 tick 只用它的**到期清扫**一手。行至多活 ~150 秒(= 证明还能被
      *  受理的最后一刻),所以存量是「到达率 × TTL」而不是历史总量,清扫无需分批。无 backend 的 env-only
      *  部署 ⇒ undefined ⇒ 本腿零调用(那种部署也没有 durable 审批门)。 */
     approvalNonceStore: ApprovalNonceStore | undefined;

package/dist/boot/resolve-spec.d.ts

@@ -57,7 +57,7 @@ export interface ResolveSpecCtx {
         backend: MemoryBackend;
         root: string;
     } | undefined;
-    /** S-640:记忆同步腿(开 `MEMORY_SYNC_*` 且记忆引擎接线时在场)—— 项目层准备一步把本任务的项目层交给它跟踪(`memory-project-layer.ts`)。 */
+    /** [ref]:记忆同步腿(开 `MEMORY_SYNC_*` 且记忆引擎接线时在场)—— 项目层准备一步把本任务的项目层交给它跟踪(`memory-project-layer.ts`)。 */
     memorySyncRunner: MemorySyncRunner | undefined;
     durableEnabled: boolean;
     /** [ref] ([ref] 案二):活体 AskUserQuestion 面(QuestionCoordinator 的判决探针切面)。在场(=

package/dist/boot/resolve-spec.js

@@ -19,23 +19,24 @@ import { explicitOperatorOk } from "../http/server.js";
 import { isAtMentionable, matchCatalogModel, modelSupportsImages, refusedCatalogEntry, resolveTaskModel, selectableCatalog, terminalCatalogName } from "../model-select.js";
 import { echoModelRef, modelUnavailableMessage } from "../model-entry-refusal.js";
 import { PerTaskImageRegistry, resolveSandboxImageRef } from "../per-task-image.js";
-import { isRemoteScratchpadLane, remoteScratchpadDirFor } from "../plugins/remote-scratchpad.js";
+import { remoteScratchpadDirFor } from "../plugins/remote-scratchpad.js";
 import { bindAttachmentsForTask } from "../plugins/task-attachment-store.js";
 import { resourceSuspendOptIn } from "../resource-suspend.js";
-import { isIsolatedExecEnv, routeServiceTask, supPostureOverrides } from "../router/route-orchestration.js";
+import { routeServiceTask, supPostureOverrides } from "../router/route-orchestration.js";
 import { tightenGoverned } from "../governance-overrides.js";
 import { gateExecutionLane } from "../runtime-caps-resolver.js";
 import { applyRuntimeGovernance } from "../runtime-governance.js";
 import { HttpError, createCodedHttpError, encodeCheckpointScope } from "../security.js";
-import { sessionFaceReadOf } from "../session-incarnation.js";
+import { headReadOf, sessionFaceOfHead } from "../session-incarnation.js";
 import { memorySpecForRequest } from "../memory-scope.js";
 import { createMemoryProjectLayers } from "../memory-project-layer.js";
 import { inheritEnvFieldIssue, singleMemberOffFieldIssue } from "../request-value-closure.js";
 import { a2aForScenario, mcpForScenario } from "../web-admin-client/facade.js";
 import { normalizeAttachments, normalizeResilience, normalizeResumeAtMode, normalizeSuggestNextPrompts, promptProfileFromBody, resolveTaskLimits, retainBackgroundProcessesFromBody, taskAgentsSpecFragment, toolMaterializeStrategyFromBody, allowToolsSpecFragment, toolNameListFromBody } from "../spec-fields.js";
 import { isAbsoluteHostPath } from "@sema-agent/settings-schema";
-import { cwdHonored, deviceCwdHonored, effectiveHostWorkspace, inProcessSingleUserLane, parseAdditionalDirectories, satisfiedByProcessCwd, shellEnvMismatchCount } from "../task-cwd.js";
-import { assertRequestA2aUnlocked, resolveRequestA2a } from "../task-a2a.js";
+import { effectiveHostWorkspace, parseAdditionalDirectories, satisfiedByProcessCwd, shellEnvMismatchCount } from "../task-cwd.js";
+import { DEPLOYMENT_SHAPE_PREDICATES } from "../deployment-shape.js";
+import { assertRequestA2aPeerUrls, assertRequestA2aUnlocked, resolveRequestA2a } from "../task-a2a.js";
 import { assertRequestMcpEntries, assertRequestMcpUnlocked, resolveRequestMcp } from "../task-mcp.js";
 import { storedToolAxesRereadM19 } from "../stored-request-tool-axes-m19.js";
 import { storedHooksRereadM20 } from "../stored-request-hooks-m20.js";
@@ -45,7 +46,7 @@ import { entryProblemsFacts } from "../entry-problems.js";
 import { inertToolListEntryOf } from "../rule-entry-list.js";
 import { TENANCY_WALL_CLOCK_BASE_SEC, enableForkFromBody, normalizeRetainSubagentSessions, selfOrchestrationFromBody } from "../task-workflow.js";
 import { redactSecrets } from "../trace/redact.js";
-import { DeferredSandboxPathEnv, isSandboxPathAdjudicationLane, sandboxPathEnvSlots } from "./deferred-sandbox-path-env.js";
+import { DeferredSandboxPathEnv, sandboxPathEnvSlots } from "./deferred-sandbox-path-env.js";
 import { executionLaneHomeDir, executionLaneOf, laneWiresExecutionEnv } from "../execution-lane-caps.js";
 import { effectiveMemoryPersistenceCapable } from "./memory-boundary.js";
 import { withUnattendedLeg } from "../unattended-permission-mode.js";
@@ -53,17 +54,17 @@ import { fieldConflictFacts } from "../field-conflict.js";
 export function createResolveSpec(ctx) {
     const { config, logger, metrics, localRoot, scenarios, principalCaps, centerRuntimeCapsResolver, getKeyResolver, taskAttachmentStore, perSessionCwd, setSessionCwd, setSessionShellEnv, fenceSessionOwner, hookLlm, hookAgent, fleetBus, hookWakeBus, resumeAnchorStore, ownerAware, taskLimitCaps, taskTimeoutSec, selectEnvTool, sendUserFileToolSpec, memoryEngine, memorySyncRunner, durableEnabled, approvalExemptionStore, checkpointStore, imageIndex, perTaskImage, sessionEnvSelection, liveQuestionFace, approverSeat, lockedKeys, } = ctx;
     const scenarioGate = createScenarioGate({ config, scenarios, principalCaps, logger }, "enforce");
-    const readSessionFace = sessionFaceReadOf(ownerAware);
+    const sessionHeadOf = headReadOf(ownerAware);
     assertGuardPatternsUsable(config);
     const onlySensitiveBaseline = buildOnlySensitiveBaselineWarning(config, {
         approvalSeat: durableEnabled ? "durable" : "absent",
         singleUserAutoAcceptBaseline: singleUserAutoAcceptBaselineApplies(config),
     });
     const realTaskRootOf = (auth) => {
-        if (isSandboxPathAdjudicationLane(config.remoteExec?.provider))
+        if (DEPLOYMENT_SHAPE_PREDICATES.sandboxPathAdjudication.holds(config))
             return undefined;
         const sessionCwd = auth?.sessionId ? effectiveHostWorkspace(perSessionCwd.get(auth.sessionId), {}) : undefined;
-        return sessionCwd ?? (config.remoteExec === undefined ? process.cwd() : undefined);
+        return sessionCwd ?? (executionLaneOf(config.remoteExec?.provider) === "in-process" ? process.cwd() : undefined);
     };
     const memoryProjectLayers = createMemoryProjectLayers({ backend: memoryEngine?.backend, syncRunner: memorySyncRunner, log: logger });
     if (onlySensitiveBaseline)
@@ -85,7 +86,7 @@ export function createResolveSpec(ctx) {
                 localDataRoot: config.localDataRoot ?? localRoot,
                 sessionId: auth?.sessionId,
                 requirePrincipal: config.requirePrincipal,
-                cwdHonored: cwdHonored(config),
+                callerOwnsWorkerDisk: DEPLOYMENT_SHAPE_PREDICATES.callerOwnsWorkerDisk.holds(config),
             });
             if (conflict) {
                 throw new HttpError(400, `cwd "${conflict.cwd.asSpelled}" is inside this session's scratchpad "${conflict.scratchpadDir.asSpelled}" — the scratchpad is the fs-write gate's EXEMPT directory, so a task rooted there would auto-approve every write under its own root and the engine refuses to build the gate at all (config.write_exempt_dir_covers_root). Point cwd at the project directory instead (or send no cwd and let the session keep the one it has): this session registers the cwd you send, so a task that happens not to mount the write gate would still leave every LATER task on this session rooted in the exemption. A workflow that really is meant to write without prompts says so with a knob that means it (a permission mode, an open write face) and still keeps its root outside the scratchpad — those knobs do not lift this refusal, because the conflict is between two fields of this request, not a permission level.`, { code: "request.field_conflict", extra: { ...fieldConflictFacts("scratchpad_root", body.scratchpadDir === conflict.scratchpadDir.asSpelled ? ["cwd", "scratchpadDir"] : ["cwd"]), cwd: conflict.cwd, scratchpadDir: conflict.scratchpadDir } });
@@ -139,6 +140,8 @@ export function createResolveSpec(ctx) {
             }
         }
         assertRequestA2aUnlocked(body.a2aPeers, lockedKeys);
+        if (opts?.leg === "fresh")
+            assertRequestA2aPeerUrls(body.a2aPeers);
         const gated = await gateScenarioAndAppend(body, auth, opts);
         const effMode = effectivePermissionMode(body, gated.parsedSettings.settings);
         if (effMode !== undefined && modePolicyOf(effMode).writeFace === "open") {
@@ -162,7 +165,7 @@ export function createResolveSpec(ctx) {
     const gateScenarioAndAppend = async (body, auth, opts) => {
         const scenarioName = await scenarioGate(auth?.principal, body.scenario);
         gateExecutionLane(await principalCaps?.executionRuling(auth?.principal), executionLaneOf(config.remoteExec?.provider), logger);
-        const cap = selectScenario(scenarios, scenarioName)(body, auth?.principal, auth?.sessionId !== undefined ? { sessionId: auth.sessionId, delegationRoot: { sessionId: auth.sessionId, incarnation: (await readSessionFace?.(auth.sessionId))?.incarnation ?? null } } : {});
+        const cap = selectScenario(scenarios, scenarioName)(body, auth?.principal, auth?.sessionId !== undefined ? { sessionId: auth.sessionId, delegationRoot: { sessionId: auth.sessionId, incarnation: (sessionHeadOf === undefined ? undefined : sessionFaceOfHead(auth.sessionId, await sessionHeadOf(auth.sessionId)))?.incarnation ?? null } } : {});
         const acceptedAppend = acceptAppendSystemPrompt(body.appendSystemPrompt, (detail) => logger.warn("append_system_prompt_dropped", { detail, sessionId: auth?.sessionId ?? null }));
         const objective = typeof body.objective === "string" ? body.objective : "";
         const parsedSettings = parseTaskSettings(body.settings, opts?.leg === "fresh" || !taskHooksHonored(config) ? {} : { storedHooksReread: storedHooksRereadM20(new Date().toISOString().slice(0, 10)) });
@@ -216,14 +219,14 @@ export function createResolveSpec(ctx) {
     };
     const bindSettingsCwdEnvAndModel = (body, auth, gated, opts) => {
         const { objective, parsedSettings } = gated;
-        const cwdWriteGate = cwdHonored(config) || deviceCwdHonored(config);
+        const cwdWriteGate = DEPLOYMENT_SHAPE_PREDICATES.callerCwd.holds(config);
         const execLane = executionLaneOf(config.remoteExec?.provider);
         if (auth?.sessionId)
             fenceSessionOwner(auth.sessionId, auth.principal ?? null);
         if (typeof body.cwd === "string" && body.cwd.length > 0 && auth?.sessionId) {
             if (cwdWriteGate && isAbsoluteHostPath(body.cwd))
                 setSessionCwd(auth.sessionId, body.cwd);
-            else if (inProcessSingleUserLane(config) && isAbsoluteHostPath(body.cwd) && satisfiedByProcessCwd(body.cwd, realpathSync))
+            else if (DEPLOYMENT_SHAPE_PREDICATES.inProcessSingleUser.holds(config) && isAbsoluteHostPath(body.cwd) && satisfiedByProcessCwd(body.cwd, realpathSync))
                 logger.debug("task_cwd_inherited", { lane: execLane, sessionId: auth.sessionId });
             else
                 logger.warn("task_cwd_ignored", { honored: cwdWriteGate, lane: execLane, sessionId: auth.sessionId });
@@ -231,7 +234,7 @@ export function createResolveSpec(ctx) {
         if (parsedSettings.settings?.shellEnv && auth?.sessionId) {
             if (cwdWriteGate)
                 setSessionShellEnv(auth.sessionId, parsedSettings.settings.shellEnv);
-            else if (inProcessSingleUserLane(config)) {
+            else if (DEPLOYMENT_SHAPE_PREDICATES.inProcessSingleUser.holds(config)) {
                 const requested = parsedSettings.settings.shellEnv;
                 const mismatched = shellEnvMismatchCount(requested, process.env);
                 if (mismatched === 0)
@@ -273,13 +276,14 @@ export function createResolveSpec(ctx) {
             }, settingsHooksBudgetMs(config));
         })();
         const rawAddDirs = body.additionalDirectories;
-        const additionalDirectories = cwdHonored(config) ? parseAdditionalDirectories(rawAddDirs) : undefined;
-        if (rawAddDirs !== undefined && !cwdHonored(config)) {
+        const callerOwnsWorkerDisk = DEPLOYMENT_SHAPE_PREDICATES.callerOwnsWorkerDisk.holds(config);
+        const additionalDirectories = callerOwnsWorkerDisk ? parseAdditionalDirectories(rawAddDirs) : undefined;
+        if (rawAddDirs !== undefined && !callerOwnsWorkerDisk) {
             logger.warn("task_additional_directories_ignored", { honored: false, sessionId: auth?.sessionId ?? null });
         }
         const rawAddReadDirs = body.additionalReadDirectories;
-        const additionalReadDirectories = cwdHonored(config) ? parseAdditionalDirectories(rawAddReadDirs) : undefined;
-        if (rawAddReadDirs !== undefined && !cwdHonored(config)) {
+        const additionalReadDirectories = callerOwnsWorkerDisk ? parseAdditionalDirectories(rawAddReadDirs) : undefined;
+        if (rawAddReadDirs !== undefined && !callerOwnsWorkerDisk) {
             logger.warn("task_additional_read_directories_ignored", { honored: false, sessionId: auth?.sessionId ?? null });
         }
         const wireCatalog = selectableCatalog(config.models, config.tiers, config.modelRefusals);
@@ -316,7 +320,7 @@ export function createResolveSpec(ctx) {
         if (typeof body.resumeAt === "string" && body.resumeAt.length > 0) {
             if (!auth?.sessionId)
                 throw new HttpError(422, "resumeAt requires a session to branch (resume_at.no_session)", { code: "resume_at.no_session" });
-            if (!resumeAnchorStore || !ownerAware.getLeafId)
+            if (!resumeAnchorStore || !sessionHeadOf)
                 throw new HttpError(501, "resume-at is not available on this worker (no session-store backend for the anchor map)");
             resumeAtEntryId = await resumeAnchorStore.resolve(auth.sessionId, body.resumeAt, auth.principal ?? null);
             if (resumeAtEntryId === undefined)
@@ -326,7 +330,7 @@ export function createResolveSpec(ctx) {
         if (resumeAtEntryId === undefined && typeof body.rewindFilesTo === "string" && body.rewindFilesTo.length > 0) {
             if (!auth?.sessionId)
                 throw new HttpError(422, "rewindFilesTo requires a session (rewind_files_to.no_session)", { code: "rewind_files_to.no_session" });
-            if (!resumeAnchorStore || !ownerAware.getLeafId)
+            if (!resumeAnchorStore || !sessionHeadOf)
                 throw new HttpError(501, "rewind-files-to is not available on this worker (no session-store backend for the anchor map)");
             rewindFilesToEntryId = await resumeAnchorStore.resolve(auth.sessionId, body.rewindFilesTo, auth.principal ?? null);
             if (rewindFilesToEntryId === undefined)
@@ -358,6 +362,7 @@ export function createResolveSpec(ctx) {
             ...buildPromptSeats(scenarioName, cap.prompt, typeof body.systemPrompt === "string" ? body.systemPrompt : undefined),
             appendSystemPrompt: acceptedAppend,
             ...(body.outputStyle !== undefined ? { outputStyle: body.outputStyle } : {}),
+            ...(body.projectMemory !== undefined ? { projectMemory: body.projectMemory } : {}),
             sessionId: auth?.sessionId,
             principal: auth?.principal,
             images: body.images,
@@ -520,7 +525,7 @@ export function createResolveSpec(ctx) {
     };
     const foldGovernanceAndSettings = async (body, auth, spec, gated) => {
         const { acceptedAppend, parsedSettings } = gated;
-        const hostSemanticsLane = !isSandboxPathAdjudicationLane(config.remoteExec?.provider);
+        const hostSemanticsLane = !DEPLOYMENT_SHAPE_PREDICATES.sandboxPathAdjudication.holds(config);
         const laneHomeBase = () => {
             const home = executionLaneHomeDir(config);
             return home !== undefined ? { taskHome: home } : {};
@@ -618,7 +623,7 @@ export function createResolveSpec(ctx) {
             perTaskImage.set(auth.sessionId, resolved.ref);
             resolvedImageCaps = resolved.capabilities;
         }
-        const remoteScratchpadDir = !hostSemanticsLane && isRemoteScratchpadLane(config.remoteExec?.provider)
+        const remoteScratchpadDir = !hostSemanticsLane && DEPLOYMENT_SHAPE_PREDICATES.remoteScratchpad.holds(config)
             ? remoteScratchpadDirFor(auth?.sessionId)
             : undefined;
         const declaredScratchpadDir = scratchpadDir ?? remoteScratchpadDir;
@@ -638,9 +643,8 @@ export function createResolveSpec(ctx) {
         if (facts)
             governed = { ...governed, envFacts: facts };
         if (config.routerEnabled) {
-            const isolatedExecEnv = isIsolatedExecEnv(config.remoteExec?.provider, config.remoteExec?.provider === "k8s" ? config.remoteExec.runtimeClass : undefined);
             const decision = routeServiceTask({
-                isolatedExecEnv,
+                vmIsolatedExecEnv: DEPLOYMENT_SHAPE_PREDICATES.vmIsolatedHands.holds(config),
                 hasExecutionEnv: laneWiresExecutionEnv(executionLaneOf(config.remoteExec?.provider)),
                 ...(config.autonomy ? { autonomy: config.autonomy } : {}),
             });

package/dist/boot/runner-deps.d.ts

@@ -9,7 +9,7 @@
  * `Runner.swapDeps` 换进,见 boot/stage-08-reapers.ts)。
  * `getRunStore()` 是唯一的晚绑取值(runStore 在本段之后才构造),原文靠同作用域前向引用。
  */
-import { type CacheBreakFinding, type RunnerDeps, type WorkflowRunStore, type AskOutcome } from "@sema-agent/core";
+import { type CacheBreakFinding, type CrossBoundaryPosture, type RunnerDeps, type WorkflowRunStore, type AskOutcome } from "@sema-agent/core";
 import type { createBrain } from "../brain.js";
 import type { buildPricing, createTracer } from "../budget.js";
 import type { ServiceConfig } from "../config.js";
@@ -62,12 +62,12 @@ export declare function createRunnerDepsOnAsk(toolApproval: ToolApprovalCoordina
  *  `memory-tools-not-mounted` / `shared-memory-not-mounted`(core 7.52.0 起一只铸点 `announceMemoryNotMounted`,词在
  *  announce-once-ledger 的表行)/ `file-history-no-store` / `file-history-no-env`(prepare-file-history 的 `livenessArm` 变量,core 7.30 起
  *  就在 —— 只认字面量的旧扫描看不见它们,两词一直被标 `classificationKnown:false`、指标折 `unknown`,本版随扫描改读两种写法一并收进表)。
- *  S-877:第五词 `shell-gate-off` 随 core 7.34.0 的 off 车道一起退役(引擎侧零发射点),同批删 —— 它唯一的本仓消费者
+ *  [ref]:第五词 `shell-gate-off` 随 core 7.34.0 的 off 车道一起退役(引擎侧零发射点),同批删 —— 它唯一的本仓消费者
  *  (「本 session 显式 bypass ⇒ 降级 info」那条回查腿与 `boot/session-shell-gate-registry.ts` 登记簿)一并删干净。所以这是「按实现亲读」的开集快照,不是 core 类型闭集——词表外的值原样进日志并标
  *  `classificationKnown:false`(指标标签折 `unknown`),不吞不编;与安装包的锁步由 test/boot-runner-deps-shared-base.test.ts
  *  的 dist 扫描格钉住(两种发射写法都读;读不出词的经变量发射点本身红;core 加词/收进 d.ts 那天先红)。 */
 export declare const CONFIG_ADVISORY_CLASSIFICATIONS: ReadonlySet<string>;
-/** S-386:core 的 [ref] 前缀缓存**断裂**探测器交给宿主的根因**闭集**,以及每个词的日志级别。
+/** [ref]:core 的 [ref] 前缀缓存**断裂**探测器交给宿主的根因**闭集**,以及每个词的日志级别。
  *  闭集**不抄词**:词源直接取 core 公开导出的 `CacheBreakFinding["cause"]`(`@sema-agent/core` 根导出,
  *  `dist/index.d.ts`;实现在 `dist/core/cache-break-detector.d.ts`),于是 core 加词/删词 ⇒
  *  `Record<PromptCacheBreakCause, …>` 少键/多键 = **编译错**(CLAUDE.md [ref]「词表是闭集 + 穷举」)。
@@ -108,14 +108,14 @@ export interface RunnerDepsCtx {
     toolApproval: ToolApprovalCoordinator | undefined;
     sessionStore: ReturnType<typeof createSessionStore>;
     /**
-     * B-060(test [ref] 核心发现①)—— **一条部署腿上的每一只 Runner 看同一只检查点店**。
+     * [ref](test [ref] 核心发现①)—— **一条部署腿上的每一只 Runner 看同一只检查点店**。
      *
      * 本键从「差异键」升进{@link createSharedRunnerDeps 共享基座}。修前它**只**挂在 subRunner 上,主
      * runner 靠 per-task `spec.checkpointStore` 拿店 —— 而 core 的 `run_workflow` 是挂在**主** Runner
-     * (`prepare-caps-and-workflow.js` 的 `runner: runnerSelf`;⚠️ S-516:这里**不写 dist 行号** ——
-     * B-060 票据当年引的那组坐标每版都在漂,复核一律按符号名搜)上的。
+     * (`prepare-caps-and-workflow.js` 的 `runner: runnerSelf`;⚠️ [ref]:这里**不写 dist 行号** ——
+     * [ref] 票据当年引的那组坐标每版都在漂,复核一律按符号名搜)上的。
      *
-     * ⚠️ **B-060 当初写下的病理有一半已被 core 7.14.0 消解,如实订正**([ref] 的 `CheckpointSeat` 重构):
+     * ⚠️ **[ref] 当初写下的病理有一半已被 core 7.14.0 消解,如实订正**([ref] 的 `CheckpointSeat` 重构):
      *  · **7.13.0 及以前**:`orchestration/workflow-primitives.js` 只在父侧
      *    `parentCheckpointStoreDisabled === true` 时给子代盖 `"disabled"`,**不把父侧真店透传给子代**
      *    ⇒ 子代的 `resolveCheckpointStore(spec, deps)` 落到主 runner 这一格 = `undefined`
@@ -164,9 +164,9 @@ export interface RunnerDepsCtx {
      *  `memoryEngineDir`:引擎从它解出每条腿的唯一豁免根(守卫集不再收 `dataRoot`)。开引擎时与 `memoryEngine.root` 同一只。 */
     engineDataRoot: string;
     /**
-     * S-399(core 7.21.1)—— 记忆整理的**已解析座**(`boot/memory-consolidation.ts` 的
+     * [ref](core 7.21.1)—— 记忆整理的**已解析座**(`boot/memory-consolidation.ts` 的
      * `resolveConsolidationDriverSeat` 产物),在场 **iff** 整理阀门开着(`resolveConsolidationValve` 的判决:
-     * `MEMORY_CONSOLIDATION_DRIVER=on`,或未设而 S-824 / [ref] 出厂缺省派生成开)且记忆引擎接了线。
+     * `MEMORY_CONSOLIDATION_DRIVER=on`,或未设而 [ref] / [ref] 出厂缺省派生成开)且记忆引擎接了线。
      *
      * 🔴 **一座两用,不是两次装配**:同一只座同时喂 admin 阀门的操作面引擎与这里的引擎面两席
      * (`RunnerDeps.memoryConsolidation` + `memoryConsolidationDriver`)。第二次解析会让「谁在花钱」
@@ -174,12 +174,12 @@ export interface RunnerDepsCtx {
      * 缺席 ⇒ 两席都**不写键** ⇒ 引擎那半场对 7.20.x 逐字节不变。
      */
     consolidationSeat: ConsolidationDriverSeat | undefined;
-    /** [ref]②([ref] §2.1b,core 7.0.2 [ref] 件2)/ S-215:会话 capture opt-out 记录的**按平面取用源**
+    /** [ref]②([ref] §2.1b,core 7.0.2 [ref] 件2)/ [ref]:会话 capture opt-out 记录的**按平面取用源**
      *  (`backend.sessionCaptureRecords()`,main.ts 取**一次**、与四只 operator 面引擎同一只源 —— 全站同批
      *  注入律,机器钉 = test/memory-capture-optout-lane.test.ts ②)。在场 ⇒ `capture:"off"` 声明与中途翻转
      *  verb 真持久;缺席 ⇒ core 读作「无店」,而 core 的 `captureCarrierUnsupported` 判据是**席位在不在**
      *  (不是「文件形能不能用」),叠上 `isRemoteExecutionEnv` 的接口形鸭子判 ⇒ 两条 ingress 都拒
-     *  `config.memory_capture_unsupported`。S-215 起三条车道都供(SQL 双方言 twin / local 的控制面文件三腿),
+     *  `config.memory_capture_unsupported`。[ref] 起三条车道都供(SQL 双方言 twin / local 的控制面文件三腿),
      *  所以缺席今天只剩一个成因:**记忆面暗**的 local 部署(那时 core 的 capture 腿本就不参与)。 */
     sessionCaptureRecords: SessionCaptureRecordSource | undefined;
     memorySyncRunner: MemorySyncRunner | undefined;
@@ -201,7 +201,7 @@ export interface RunnerDepsCtx {
     runtimeCapsResolver: RunnerDeps["runtimeCapsResolver"];
     /** [ref] per-edited-file rewind history (core `RunnerDeps.fileHistoryStore`; replaces the retired E19
      *  whole-tree snapshot seat — core 94632197 renamed the seat, not a coexistence). WIRING IS THE OPT-IN.
-     *  S-724:值 = `assembleFileHistory` 的店(后端在即在,与旋钮无关 —— 旋钮关的部署照样还原已存历史)。 */
+     *  [ref]:值 = `assembleFileHistory` 的店(后端在即在,与旋钮无关 —— 旋钮关的部署照样还原已存历史)。 */
     fileHistoryStore: ReturnType<StoreBackend["fileHistory"]> | undefined;
     /** [ref] 车二:持久化权限规则店 provider(core `RunnerDeps.permissionRuleStore`)。缺席 ⇒ 引擎的
      *  `permissionRules.storeWired` 如实报 false、`AskRequest.ruleOffers` 不铸(诚实缺席)。 */
@@ -241,7 +241,7 @@ export interface RunnerDepsCtx {
 }
 /** [ref] A10 留档发现②:main runner `RunnerDeps` 与 main.ts subRunner 字面量之间此前手工重复
  * 的 ~15 个键,类型标注见 {@link createSharedRunnerDeps} 头注。 */
-export type SharedRunnerDeps = Pick<RunnerDeps, "brain" | "readFace" | "readDenyPatterns" | "readDenyBuiltinTiers" | "readDenyBuiltinExclude" | "memoryDelegationEvidence" | "memoryProvenance" | "memoryCapturePolicy" | "delegationEntryCaps" | "crossSessionInbound" | "crossSessionDialogExpiry" | "writeProtectedPaths" | "memoryEngineDir" | "allowedTools" | "models" | "roles" | "tiers" | "pricing" | "tracer" | "promptSource" | "executionEnvFactory" | "lspManager" | "backgroundAgentStore" | "mailboxStore" | "rosterStore" | "mods" | "toolResultStore" | "checkpointStore" | "hands" | "sessionPolicyStore" | "usageWindows" | "usageWindowStore" | "memoryScopeAdmission" | "deploymentMemoryScopes" | "sharedMemoryStores" | "compliancePostureResolver" | "lockedConfig" | "retentionPolicy" | "onNotice" | "mcpRevocations">;
+export type SharedRunnerDeps = Pick<RunnerDeps, "brain" | "readFace" | "readDenyPatterns" | "readDenyBuiltinTiers" | "readDenyBuiltinExclude" | "memoryDelegationEvidence" | "memoryProvenance" | "memoryCapturePolicy" | "delegationEntryCaps" | "crossSessionInbound" | "crossSessionDialogExpiry" | "writeProtectedPaths" | "memoryEngineDir" | "allowedTools" | "crossBoundaryPosture" | "models" | "roles" | "tiers" | "pricing" | "tracer" | "promptSource" | "executionEnvFactory" | "lspManager" | "backgroundAgentStore" | "mailboxStore" | "rosterStore" | "mods" | "toolResultStore" | "checkpointStore" | "hands" | "sessionPolicyStore" | "usageWindows" | "usageWindowStore" | "memoryScopeAdmission" | "deploymentMemoryScopes" | "sharedMemoryStores" | "compliancePostureResolver" | "lockedConfig" | "retentionPolicy" | "onNotice" | "mcpRevocations">;
 /**
  * [ref] A10 留档发现②(review 2026-07-29,[ref]§三族A 同源修补的延续):main runner 的
  * `RunnerDeps` 字面量(下方 `createRunnerDeps`)与 `main.ts` 里 subRunner 的 `new Runner({...})`
@@ -316,10 +316,23 @@ export declare function createEngineNoticeSeat(logger: {
  * 「键为 undefined」与「键缺席」对引擎逐字等价)。**不复制引擎缺省**(`roots`/`static-face`/`carry`/`open`/
  * CC parity 20/200 一个都不抄):上游改缺省之日起本仓不会成为第二份真源。
  */
-export type DeploymentPostureSeats = Pick<RunnerDeps, "readFace" | "readDenyPatterns" | "readDenyBuiltinTiers" | "readDenyBuiltinExclude" | "memoryDelegationEvidence" | "memoryProvenance" | "memoryCapturePolicy" | "delegationEntryCaps" | "crossSessionInbound" | "crossSessionDialogExpiry" | "writeProtectedPaths" | "allowedTools" | "agentConfigDir">;
+export type DeploymentPostureSeats = Pick<RunnerDeps, "readFace" | "readDenyPatterns" | "readDenyBuiltinTiers" | "readDenyBuiltinExclude" | "memoryDelegationEvidence" | "memoryProvenance" | "memoryCapturePolicy" | "delegationEntryCaps" | "crossSessionInbound" | "crossSessionDialogExpiry" | "writeProtectedPaths" | "allowedTools" | "agentConfigDir" | "crossBoundaryPosture">;
 /** 本族读的配置切面:席名与 config 键同名的那几席 + 运维 allow 表(席 `allowedTools` ← config `approvalGrant`,env 名 `APPROVAL_GRANT` 不改)
- *  + LKG 覆写路径(`readDenyPatterns` 席并入它派生的读拒行,`lkgReadDenyRows`)。 */
-export type DeploymentPostureConfig = Pick<ServiceConfig, Exclude<keyof DeploymentPostureSeats, "allowedTools"> | "approvalGrant" | "configLkgPath">;
+ *  + LKG 覆写路径(`readDenyPatterns` 席并入它派生的读拒行,`lkgReadDenyRows`)+ 主体门(席 `crossBoundaryPosture` ← config `requirePrincipal`)。 */
+export type DeploymentPostureConfig = Pick<ServiceConfig, Exclude<keyof DeploymentPostureSeats, "allowedTools" | "crossBoundaryPosture"> | "approvalGrant" | "configLkgPath" | "requirePrincipal">;
+/**
+ * 设备车道发射闸的**部署姿态**(core 7.54.0 [ref] O9b:`RunnerDeps.crossBoundaryPosture`)—— 由主体门派生,不是第二根旋钮:
+ * `REQUIRE_PRINCIPAL=true`(每个请求带一个经认证的主体 = 多个租户共用这台 worker)⇒ `"multi_tenant"`;否则 ⇒ `"single_user"`。
+ * 映射是一张以 core 闭集为键的表 {@link CROSS_BOUNDARY_POSTURE_REQUIRES_PRINCIPAL}(`satisfies Record<CrossBoundaryPosture, boolean>`):core 给姿态加第三个词 ⇒ 表缺键、编译红,
+ * 由人判它对应哪种部署 —— 不会被一个 `? :` 静默吞掉。
+ * 律:**每一台 worker 显式声明、同一舰队同值**(主体门本就是舰队级配置)—— 缺席时 core 对宿主父腿不启站,并在每条武装腿铸 operator 通告
+ * `config.cross_boundary_posture_undeclared`;本仓因此从不留空。取值点只有 {@link buildDeploymentPostureSeats} 一处。
+ */
+export declare const CROSS_BOUNDARY_POSTURE_REQUIRES_PRINCIPAL: {
+    readonly multi_tenant: true;
+    readonly single_user: false;
+};
+export declare function crossBoundaryPostureOf(requirePrincipal: boolean): CrossBoundaryPosture;
 export declare function buildDeploymentPostureSeats(config: DeploymentPostureConfig): DeploymentPostureSeats;
 /**
  * 部署读拒行**进场**的唯一告知点(非锚定行一行 `read_deny_unanchored_rows`;判据与行形在 `read-deny-anchor-audit.ts`)。律:**一份读拒行的值第一次装进 Runner 席时点名一次** ——

package/dist/boot/runner-deps.js

@@ -18,6 +18,7 @@ import { buildCrossSessionInboundLayers, crossSessionDialogExpiryOf } from "../c
 import { createPeerDirectory } from "../peer-directory.js";
 import { storeFormRefusalInIncident } from "../memory-store-refusal.js";
 import { coreFileHistoryCaptureSeat } from "../file-history-capture.js";
+import { DEPLOYMENT_SHAPE_PREDICATES } from "../deployment-shape.js";
 import { rewindFailureCode } from "../file-history-disclosure.js";
 export function createRunnerDepsOnAsk(toolApproval) {
     if (!toolApproval)
@@ -58,6 +59,14 @@ export function createEngineNoticeSeat(logger, router = defaultEngineNoticeRoute
     const warn = logger?.warn?.bind(logger);
     return warn ? { onNotice: createEngineNoticeForwarder({ warn }, router) } : {};
 }
+export const CROSS_BOUNDARY_POSTURE_REQUIRES_PRINCIPAL = { multi_tenant: true, single_user: false };
+export function crossBoundaryPostureOf(requirePrincipal) {
+    for (const w of Object.keys(CROSS_BOUNDARY_POSTURE_REQUIRES_PRINCIPAL)) {
+        if (CROSS_BOUNDARY_POSTURE_REQUIRES_PRINCIPAL[w] === requirePrincipal)
+            return w;
+    }
+    throw new Error(`cross-boundary posture table has no word for requirePrincipal=${requirePrincipal} (the table must map both values)`);
+}
 export function buildDeploymentPostureSeats(config) {
     const crossSessionLayers = buildCrossSessionInboundLayers(config);
     const lkgRows = lkgReadDenyRows(config.configLkgPath);
@@ -76,6 +85,7 @@ export function buildDeploymentPostureSeats(config) {
         crossSessionDialogExpiry: crossSessionDialogExpiryOf(config),
         writeProtectedPaths: config.writeProtectedPaths?.entries,
         allowedTools: config.approvalGrant.length > 0 ? config.approvalGrant : undefined,
+        crossBoundaryPosture: crossBoundaryPostureOf(config.requirePrincipal),
     };
     return seats;
 }
@@ -226,10 +236,10 @@ export function createRunnerDeps(ctx) {
         fileHistoryCapture: coreFileHistoryCaptureSeat(fileHistoryStore, config.fileHistoryCapture),
         permissionRuleStore: permissionRuleStore ? permissionRuleStore : undefined,
         onBackgroundChildEvent: fleetBackgroundChildPublisher(fleetBus, (msg, fields) => logger.info(msg, fields)),
-        loadProjectMemory: config.requirePrincipal !== true && config.projectMemoryEnabled
+        loadProjectMemory: !DEPLOYMENT_SHAPE_PREDICATES.multiTenant.holds(config) && config.projectMemoryEnabled
             ? makeLoadProjectMemory({ logger, instructionSource: createInstructionSourceSeat(sessionStore, sharedRunnerDeps.onNotice) })
             : undefined,
-        probeInstructionSources: config.remoteExec?.provider === "host" && config.requirePrincipal !== true && config.projectMemoryEnabled
+        probeInstructionSources: DEPLOYMENT_SHAPE_PREDICATES.callerOwnsWorkerDisk.holds(config) && config.projectMemoryEnabled
             ? makeProbeInstructionSources()
             : undefined,
         ...selfOrchestrationDeps,

package/dist/boot/session-faces.d.ts

@@ -42,7 +42,7 @@ export interface SessionFacesCtx {
     approvalExemptionStore: ReturnType<StoreBackend["approvalExemption"]> | undefined;
     sessionPolicyStore: ReturnType<StoreBackend["sessionPolicy"]> | undefined;
     taskAttachmentStore: TaskAttachmentStore | undefined;
-    /** S-589:文件历史的**擦除脸**(后端在即在,与 `FILE_HISTORY_CAPTURE` 无关;只有删除类动词)。E21 删除读它,
+    /** [ref]:文件历史的**擦除脸**(后端在即在,与 `FILE_HISTORY_CAPTURE` 无关;只有删除类动词)。E21 删除读它,
      *  不读捕获脸 —— 关掉捕获的部署照样要删得掉已捕获的文件字节(旋钮只管写入,从不管擦除)。 */
     fileHistoryErasure: FileHistoryErasureFace | undefined;
     workflowCompletionInbox: WorkflowCompletionInbox | undefined;
@@ -56,10 +56,10 @@ export interface SessionFacesCtx {
      *  (`boot/stores.ts` 同段铸);缺席 = 本部署无耐久 mailbox ⇒ 无箱可退役。 */
     mailboxStore: RunnerDeps["mailboxStore"];
     mailboxRecipientLifecycle: MailboxRecipientLifecycle | undefined;
-    /** S-790 件B:后台子代的耐久店(与 `RunnerDeps.backgroundAgentStore` 同实例)—— 删除协调器据它枚举以本会话为根的子代并结束
+    /** [ref] 件B:后台子代的耐久店(与 `RunnerDeps.backgroundAgentStore` 同实例)—— 删除协调器据它枚举以本会话为根的子代并结束
      *  它们(E21 级联的一条腿,做完才删元数据)。缺席 = 本部署没有耐久后台子代(纯内存 dev);那一形只剩本进程登记表里的活行,照样停。 */
     backgroundAgentStore: RunnerDeps["backgroundAgentStore"];
-    /** S-965:用户输入受理账本的**店**(E21 级联的一条腿:该会话的受理行随会话删)。与受理 / 收敛 / 告知读的是同一只(stage-07 取一次)。
+    /** [ref]:用户输入受理账本的**店**(E21 级联的一条腿:该会话的受理行随会话删)。与受理 / 收敛 / 告知读的是同一只(stage-07 取一次)。
      *  缺席 = 本部署没装账本(env-only:没有 backend / run 店)⇒ 无行可删。 */
     userInputLedgerStore: UserInputLedgerStore | undefined;
     /** k8s 车道工作区空间的回收座(配了构建缓存卷或快照存储时在场;与托管留存 sweep 同一只)—— E21 级联的一条腿:会话删了 =