@sema-agent/server 7.134.0 → 7.136.0

package/dist/principal-jwt.d.ts

@@ -5,7 +5,7 @@ import { type ApprovalEnvelope } from "./approval-hmac.js";
  *
  * 它回答的是**一跳**:签发方(issuer)与判定这份 token 的那口钟可以差多少(exp/nbf 门的宽限)。
  *
- * 🔴 它**不**回答「两台副本之间差多少」:S-280 的消费记录不再靠任何钟差上界活着 —— 受理窗的判定、
+ * 🔴 它**不**回答「两台副本之间差多少」:[ref] 的消费记录不再靠任何钟差上界活着 —— 受理窗的判定、
  * 落地后的复核、到期清扫三处读的是**同一口钟**(消费记录店自己的钟,见
  * `plugins/approval-nonce-store.ts` 的 `nowMs()`)。曾经由本常量推导出的那个「副本间钟差」常量已
  * 整条删除:它是一条**猜出来的**上界,没有任何一条腿强制它,而正确的修法是根本不需要这个数。
@@ -36,7 +36,7 @@ export declare function verifyPrincipalJwt(token: string, keys: PrincipalJwtKey[
  *
  * 第三槽在两种门上是**同一条规则**「这份决定作用在哪份内容上」:动作门填被批工具调用的 `boundInputHash`
  * (core 铸);非动作门 `plan_review` 的 `edit` 填**修订后的计划**的哈希(计划随本次请求一起提交,签名器手上
- * 就有原文),`approve` / `reject` 不作用于任何新内容 ⇒ null。B-121(test 黑盒发现,验真后修):此前 edit 也填
+ * 就有原文),`approve` / `reject` 不作用于任何新内容 ⇒ null。[ref](test 黑盒发现,验真后修):此前 edit 也填
  * null,于是为「只改 README」签出的证明可以拿去提交任意 `editedPlan`——签名只护住了 decision/reason,没护住
  * 决定真正落地的那份内容。`cnf.bnd` 与 HMAC 都吃第三槽,所以 JWT 与信封同时绑住它;不匹配 ⇒
  * `401 principal_unbound`(既有码,cnf.bnd 不符)。旧注记「计划哈希被拒」说的是 approve(worker 没有可哈希的
@@ -51,7 +51,7 @@ export declare function editedPlanBinding(editedPlan: string): string;
 /**
  * JWT `cnf.bnd` = **「这份身份凭据被签发去决哪一张卡」**(动作身份),故只哈希前三位。
  *
- * 🔴 **与 HMAC 信封的分工**(S-433 F1 立此,属主注在 `approval-hmac.ts` 顶):HMAC 绑的是**「决了什么」**
+ * 🔴 **与 HMAC 信封的分工**([ref] F1 立此,属主注在 `approval-hmac.ts` 顶):HMAC 绑的是**「决了什么」**
  * —— `decision` / `reason` / `permissionModeAfter` 这些**会改变后果**的字段全在那一把里。所以「同一张卡上
  * 把 approve 的档偷偷调宽」只由 HMAC 拦;本函数**刻意不跟着加位**:决定内容改了 `cnf.bnd` 不该变(否则
  * 一份合法 JWT 会被绑死在一个它签发时还不知道的值上,而 `permissionModeAfter` 恰恰是决裁那一刻才定的)。
@@ -97,7 +97,7 @@ export type DirectDoorProofResult = {
  * verify principal → bind → mac-present → mac-valid (so a non-operator never gets a MAC oracle, an unverified
  * caller never reaches the operator list).
  *
- * 🔴 `opts.nowSec`(S-280 / 合并复审 R2):受理窗要按**哪口钟**判。非动作门(plan_review)的反重放是
+ * 🔴 `opts.nowSec`([ref] / 合并复审 R2):受理窗要按**哪口钟**判。非动作门(plan_review)的反重放是
  * 一条**消费记录**,而那条记录的生死由**消费记录店的钟**决定 —— 所以那条腿必须把店钟喂进来
  * (`floor(店钟/1000)`),否则「还受理 ⇒ 记录还在」就退化成「两台副本的钟差不多」这条没人声明过的假设。
  * 缺席 = 本机墙钟,这对动作门(`/decide`)是对的:它的反重放是 checkpointToken 的一次性,不牵扯第二台
@@ -110,7 +110,7 @@ export type DirectDoorProofResult = {
  * {sessionId, nonce, <content hash>, decision, reason}. Pass `actionBinding:false` for a non-action gate; the default
  * (true) keeps the /decide tool-approval contract byte-identical. The THIRD slot carries one rule on both gates —
  * "the content this decision acts on": the bound tool input for /decide, `editedPlanBinding(editedPlan)` for a
- * plan_review `edit` (B-121), null for approve/reject. Binding approve/reject to a hash of the EXISTING plan was
+ * plan_review `edit` ([ref]), null for approve/reject. Binding approve/reject to a hash of the EXISTING plan was
  * rejected (the plan artifact lives in a profile ref store; the worker has no TOCTOU original) — that ruling never
  * covered `edit`, whose content arrives with the request.
  */
@@ -119,7 +119,7 @@ export declare function verifyDirectDoorProof(proof: {
     mac?: string;
     kid?: string;
 }, 
-/** 🔴 **命名类型,不是结构等价的内联字面**(S-433 F1 [high] 的**根因**,验真后修):本位此前是一份手抄的
+/** 🔴 **命名类型,不是结构等价的内联字面**([ref] F1 [high] 的**根因**,验真后修):本位此前是一份手抄的
  *  五字段内联形 —— 结构类型让**多带一个字段的调用方**照样编译通过,而下面那次手抄再把它**丢掉**,于是
  *  `approval-hmac.ts` 上新增的签名位在这条唯一的真实验签链上**静默失效**,tsc 一个字都不响。
  *  用 {@link ApprovalEnvelope} 之后,信封的形只有**一个**声明点,新增一位自动到达验签器。 */

package/dist/project-identity.d.ts

@@ -19,7 +19,7 @@ export type ProjectIdentity = {
 export declare function resolveProjectIdentity(taskRoot: string): ProjectIdentity;
 /**
  * 退役 `repo:` 键的**唯一**铸点([ref] ①:`repo:` + sha256 hex 前 24;`root` 为 realpath 字符串,不加尾斜杠、不折大小写)。
- * S-640 起它只是一次性迁移的来源(`memory-project-layer.ts` 把这一层的条目折进新键;窗见 `plugins/one-time-migrations.ts` 登记表)。
+ * [ref] 起它只是一次性迁移的来源(`memory-project-layer.ts` 把这一层的条目折进新键;窗见 `plugins/one-time-migrations.ts` 登记表)。
  */
 export declare function mintRepoScopeKey(projectRoot: string): string;
 /** 这把键是不是本仓铸的项目键族(现行 `userrepo:` 或退役的 `repo:`)—— 运维不许把它们点名成全局层 / 同步层。 */
@@ -38,7 +38,7 @@ export declare function assertProjectLayerOwnable(scope: string, envName: string
  */
 export declare function normalizeGitRemoteUrl(url: string): string | undefined;
 /**
- * 任务根 → 项目层身份(S-640):当前档(`r` 优先,没有 origin 退 `p`)+ 本 checkout 的低档(`r` 档时 = 它的 `p` 档)。
+ * 任务根 → 项目层身份([ref]):当前档(`r` 优先,没有 origin 退 `p`)+ 本 checkout 的低档(`r` 档时 = 它的 `p` 档)。
  * 缺席形与 {@link resolveProjectIdentity} 同;git 配置在而读不了 ⇒ `unreadable`。
  */
 export declare function projectLayerIdentityOf(taskRoot: string): {
@@ -54,7 +54,7 @@ export interface ProjectLayerOfTask {
     readonly foldFrom: readonly string[];
 }
 /**
- * 任务根 → 项目层(S-640:`userrepo:<属主段>/<档>.<摘要>`,属主 = `owner`,调用方由 `projectLayerOwnerOf(全局层)` 求得)。
+ * 任务根 → 项目层([ref]:`userrepo:<属主段>/<档>.<摘要>`,属主 = `owner`,调用方由 `projectLayerOwnerOf(全局层)` 求得)。
  * `foldFrom` = 同一 checkout 能推出的旧层:退役 `repo:<同一路径哈希>`(一次性迁移,窗见 `plugins/one-time-migrations.ts` 登记表 M25)
  * + 当前档是 `r` 时它的 `p` 档(常设律)。
  * `taskRoot === undefined` = 调用方**此刻不知道**任务根在本机哪里(根在沙箱/设备盘上;或 host 车道会话没登记 cwd、手落在 factory 现铸的

package/dist/project-memory.d.ts

@@ -25,7 +25,7 @@ interface ProjectMemoryCtx {
  *  every CLAUDE file it finds, per directory level up the ancestor chain, whereas this loader reads one root and
  *  takes the single first hit. */
 declare const INSTRUCTION_FILE_CHAIN: readonly ["CLAUDE.md", ".claude/CLAUDE.md", "AGENTS.md", ".claude/AGENTS.md"];
-/** 一个链成员(相对项目根的拼写)。导出给 S-961 的 wire 段与它的值闭集登记(`trace/self-minted-wire.ts`)—— 链长一员,两处 tsc 跟着红。 */
+/** 一个链成员(相对项目根的拼写)。导出给 [ref] 的 wire 段与它的值闭集登记(`trace/self-minted-wire.ts`)—— 链长一员,两处 tsc 跟着红。 */
 export type InstructionChainMember = (typeof INSTRUCTION_FILE_CHAIN)[number];
 /** Recover (root, rel) for a path the LOADER declared — every declared path is `root + one chain member`.
  *  The probe needs this to re-run the loader's parent-directory symlink gate each round (self-review: the probe
@@ -49,14 +49,14 @@ export declare function instructionChainCoordinates(absPath: string, p?: Platfor
  * `phase: "post-compact"` forces a re-read (core re-renders the prefix there anyway). No entry for
  * sessionless one-shot runs. (post-clear never arrives from core — [ref] — so it is not a cache key here.)
  *
- * S-690 — source-change notice: with `instructionSource` wired, every prepare of a non-subagent session that WALKED the
+ * [ref] — source-change notice: with `instructionSource` wired, every prepare of a non-subagent session that WALKED the
  * instruction chain hands the chain member it selected (`null` = none) to {@link announceInstructionSource}, which
  * compares it with the session's persisted baseline. A prepare stopped by a pre-walk gate (hands-less, a cwd that is not
  * an absolute local directory) is "not applicable", not "none" — it never reaches the mint (O6, see `LoadOutcome`). The member is the one the snapshot carries — a cache hit answers the cached pick, so
  * the notice follows what the model actually reads, not the disk (a same-process edit changes nothing until the
  * snapshot is re-read: restart, post-compact, or a new session).
  *
- * S-961 — the same statement (same predicate, same member) also settles the calling LEG's `wiring_manifest.instructions`
+ * [ref] — the same statement (same predicate, same member) also settles the calling LEG's `wiring_manifest.instructions`
  * segment through {@link settleLegInstructionStatement} (`instruction-selection.ts`): the leg scope is the run identity
  * the ctx does not carry, and the first call inside a leg's scope whose `ctx.sessionId` equals the leg's session is that
  * leg's own prepare (a session-less adhoc leg falls back to plain first-call; [ref] X1). The segment projects
@@ -70,7 +70,7 @@ export declare function makeLoadProjectMemory(opts: {
     maxBytes?: number;
     /** TEST-ONLY: shrink the snapshot-cache bound so the settle-time trim is observable without 256 sessions. */
     cacheMax?: number;
-    /** S-690: the baseline store + notice exit. Absent ⇒ no source-change notice (the session store has no baseline face). */
+    /** [ref]: the baseline store + notice exit. Absent ⇒ no source-change notice (the session store has no baseline face). */
     instructionSource?: InstructionSourceSeat;
 }): (ctx: ProjectMemoryCtx) => Promise<string | null | ProjectMemoryLoad>;
 /**

package/dist/read-face-posture.d.ts

@@ -1,5 +1,5 @@
 /**
- * S-167(clay 裁定 2,[ref] 转达 / [ref] ②)—— **READ 容纳面档位的来源**(单一属主)。
+ * [ref](clay 裁定 2,[ref] 转达 / [ref] ②)—— **READ 容纳面档位的来源**(单一属主)。
  *
  * ## 它解决的问题
  *
@@ -20,7 +20,7 @@
  * ## 优先序(与 `config.ts` 的 `postureOn` 同形)
  * `env 显式` > `center 发布` > `lane 声明` > `posture 派生` > `引擎默认`。env 恒赢的论证逐字见 `web-admin-client/read-face.ts`
  * 头注①(READ 容纳面描述的是**这台机器的磁盘上有什么**,组织的下发面不知道)。
- * 🔴 **`lane` 一臂(S-1492,clay 裁 [ref])**:隔离型执行车道(`e2b` / `k8s` / `local-docker`)的契约行**显式声明**读面缺省 `open`
+ * 🔴 **`lane` 一臂([ref],clay 裁 [ref])**:隔离型执行车道(`e2b` / `k8s` / `local-docker`)的契约行**显式声明**读面缺省 `open`
  * (`execution-lane-caps.ts` 的 `laneReadFaceDefault`;沙箱内部就是模型的整个世界)。运维没写 `READ_FACE` 时,车道声明比整机 posture 更具体 ⇒ 排在它前面;
  * 声明 `roots` 的车道(`host` / `ssh` / `adb` / `device` / 未设车道)不替运维声明缺省,回到既有的 posture 派生,**一个字节不变**。
  * 缺席这一态的派生**只有一只函数**({@link readFaceDefaultFor}),且读的是**最终生效的车道**(`loadConfig` 装配完 `remoteExec` 之后一次;
@@ -39,7 +39,7 @@
 import { type LaneReadFaceDefault, type RemoteExecProvider } from "./execution-lane-caps.js";
 import { type PostureSource } from "./posture-source.js";
 /**
- * 档位来源的闭集词表 —— **S-178 起转 `posture-source.ts` 的共享件**(本模块只是给这一档取个本地名字,
+ * 档位来源的闭集词表 —— **[ref] 起转 `posture-source.ts` 的共享件**(本模块只是给这一档取个本地名字,
  * 不再持第二份词表:同一张四词表抄两遍的那天,两份会在加词时分家)。
  */
 export declare const READ_FACE_SOURCE_WORDS: readonly ["env", "center", "lane", "posture", "engine-default"];
@@ -77,7 +77,7 @@ export declare function settleDerivedReadFace(seat: ReadFaceDeploymentSeat, sing
 /** 本档的运维指路句 —— 骨架由共享件 {@link postureSourceNote} 给(四词穷举在那里,加词即编译红);
  *  本函数提供两条**键专属**臂(`center` / `posture`)的事实句。
  *
- *  🔴 `center` 那句话的事实来源是 S-174(core 7.10.0 [ref]):`RunnerDeps.readFace` 进了 core 的可换席
+ *  🔴 `center` 那句话的事实来源是 [ref](core 7.10.0 [ref]):`RunnerDeps.readFace` 进了 core 的可换席
  *  闭集 `SWAPPABLE_DEP_SEATS` ⇒ 组织发布/撤回一个档位,**下一拍 refresh 当场换进全部 Runner**,
  *  `web-admin-client/restart-signal.ts` 的 `read-face` 片也不再为它签重启理由(判据同源 =
  *  `CENTER_READ_FACE_LIVE_KEYS`,由 core 的 `isSwappableDepSeat` 派生)。本句此前逐字写着
@@ -92,10 +92,10 @@ export declare function buildReadFaceWiring(facts: ReadFacePostureFacts): {
     note: string;
 };
 /**
- * S-176 —— 派生的档位(`posture` 单机 ⇒ open,或 S-1492 的 `lane` 隔离车道 ⇒ open)在 **boot 期推送面**的那一行(`config.ts` 经既有 `CONFIG_NOTICES` 以 info 级排空)。
+ * [ref] —— 派生的档位(`posture` 单机 ⇒ open,或 [ref] 的 `lane` 隔离车道 ⇒ open)在 **boot 期推送面**的那一行(`config.ts` 经既有 `CONFIG_NOTICES` 以 info 级排空)。
  *
- * 为什么要有:S-167 的补偿项是「升级即放开,得让运维看得见并知道怎么钉回」,可此前唯一看得见的是**拉取**面
- * (`GET /v1/diagnostics/wiring`)—— 只对会去拉的人成立。单机 boot 日志里零字。S-1492 的 `lane` 臂同一个补偿:多租户沙箱部署升级后读面从 `roots` 变 `open`,
+ * 为什么要有:[ref] 的补偿项是「升级即放开,得让运维看得见并知道怎么钉回」,可此前唯一看得见的是**拉取**面
+ * (`GET /v1/diagnostics/wiring`)—— 只对会去拉的人成立。单机 boot 日志里零字。[ref] 的 `lane` 臂同一个补偿:多租户沙箱部署升级后读面从 `roots` 变 `open`,
  * 指路句带挂载告诫与钉回出路。
  * 为什么只在 `posture` / `lane` 两词上说:另外三词都不是「没人表态、服务替它选了一个更宽的档」——`env` 是运维自己写的,
  * `engine-default` 是本服务没铸(引擎默认接管),`center` 在 boot 这一拍还没到货(它有自己的换席通告)。

package/dist/request-declaration-refusal.d.ts

@@ -0,0 +1,94 @@
+/**
+ * **请求体里「声明列表」(`mcpServers` · `a2aPeers`)这一类受理座的拒绝骨架** —— 列表级 / 条目级 / 键值级的拒形、拒句尾、撞帽机读位,在这里铸一处。
+ *
+ * ## 为什么在这里
+ * 两张列表是同一个问题的两个实例:调用方随请求带一份「我要挂这些外部服务」的声明,受理口要回答「这份声明能不能原样用」。答案的**形**一样 ——
+ *  ① **列表**:在场却不是数组 / 超过挂载上限 / 某一条不是对象 ⇒ `400 request.field_invalid`(整份拒而不是挂前 N 条 / 摘掉读不出的那条:一份被悄悄截短的声明,在发送方那里读起来是「生效了」);
+ *     超上限用撞帽的唯一铸点({@link limitRefusal}),拒体带机读位一组键(`field` · `reason:"over_cap"` · `count` · `cap`);
+ *  ② **键名**:条目层的词表外键 ⇒ `400 request.body_shape` + `unknownKeys`(句子由各座自己写 —— 受理键表与嵌套层是座位自己的事);
+ *  ③ **键值**:每个受理键一只判官 ⇒ `400 request.field_invalid`,句子 `<坐标>.<键路径> (<subject> "<名>") is not a usable declaration — <判官原因句>. …`,不回显值;
+ *     判官答「URL 带凭据」时拒体另带机读位 `field` / `reason`({@link urlCredentialFacts})。
+ * 第一处坏形即答:先列表、后条目;条目里先键名、后键值。各座只写**自己的**两件事:受理键表 + 键值判官表(以及它自己的词表外键句)。拒形、句尾、撞帽句不在座位文件里手拼 ——
+ * 两份手拼的拒形迟早分岔(`a2aPeers` 上线时就是缺了这一整套,坏形换回 200 + 运维 warn,调用方以为声明生效了)。
+ *
+ * ## 射程
+ * 纯值域、与租户车道无关;只在 fresh 提交腿上问(`boot/resolve-spec.ts` 的 `opts.leg`):重放存量 body 的腿走宽容读器,一个 4xx 打在 resume 上会永久砖死一条 parked 任务。
+ */
+import { type UrlCredential } from "@sema-agent/settings-schema";
+import { type LimitFacts } from "./limit-refusal.js";
+import { type UrlCredentialFacts } from "./url-credential-refusal.js";
+/** 一座声明列表的名字与上限、以及拒句里要用的称呼(座位的常量,铸点只读)。 */
+export interface DeclarationSeat {
+    /** 请求体里这张列表的键,也是机读坐标的根(`mcpServers` | `a2aPeers`)。 */
+    readonly list: string;
+    /** 挂载上限(条数;超过 ⇒ 撞帽拒)。 */
+    readonly cap: number;
+    /** 一条声明所声明的东西(拒句里的单数名词:`server` | `peer`)。 */
+    readonly subject: string;
+    /** 「一条声明」的整称(`an MCP server declaration`)。 */
+    readonly declaration: string;
+    /** 「多条声明」的整称(`MCP server declarations`)。 */
+    readonly declarations: string;
+}
+/** 一次拒绝:码 + 句 + 词表外的键名表(只在闭集那一形上在场)+ 机读位(撞帽 / URL 带凭据两形上在场)。受理口(同步 400)与探测口(`POST …/probe`)原样转述同一份。 */
+export interface DeclarationRefusal {
+    readonly errorCode: "request.body_shape" | "request.field_invalid";
+    readonly message: string;
+    /** 词表外的键,全路径形(已清洗 + 截长 + 排序 + 封顶)。 */
+    readonly unknownKeys?: readonly string[];
+    /** 撞帽:`field` · `reason:"over_cap"` · `count` · `cap`;URL 带凭据:`field` · `reason`(判官的拒因词)。 */
+    readonly facts?: UrlCredentialFacts | LimitFacts;
+}
+/** 一处键值坏形:键路径(相对条目)+ 判官的原因句;答「URL 带凭据」时另带判官的答案(⇒ 拒体带机读位)。 */
+export interface DeclarationKeyIssue {
+    readonly path: string;
+    readonly reason: string;
+    readonly credential?: UrlCredential;
+}
+/** 受理键 → 判官。`at` 是这一条的体内坐标(`a2aPeers[2]`),座位需要写绝对坐标的出路句时用。缺席(`undefined`)恒合法 = 真「没声明」;在场的 `null` 不是缺席。 */
+export type DeclarationKeyJudge<E extends Record<string, unknown> = Record<string, unknown>> = (entry: E, at: string) => DeclarationKeyIssue | undefined;
+/** 读不出名字的条目用的占位(非空:一条连名字都读不出的条目仍然要被说出来)。 */
+export declare const MALFORMED_NAME = "<malformed>";
+/** 条目的**申报名**(拿不到名字时的占位)—— 拒句、丢弃点、通告同读一只。 */
+export declare function declaredName(e: unknown): string;
+/** `name` 键的判官(两座同读:申报名线长界与首尾空白的唯一判官在契约包 {@link isUsableWireName})。 */
+export declare function declarationNameIssue(entry: Record<string, unknown>): DeclarationKeyIssue | undefined;
+/** 列表级拒句的收尾句:说清「为什么整份被拒、而不是只按读得出的那部分办」与出路(空列表 = 什么都不声明)。 */
+export declare const LIST_REFUSAL_TAIL: string;
+/** 列表级的一处坏形 → 拒(码恒 `request.field_invalid`)。`head` 只说位置与形的**种类**,不回显值。 */
+export declare function declarationListRefusal(head: string): DeclarationRefusal;
+/**
+ * 一处键值坏形**怎么被说出来**:体内坐标(`<条目坐标>.<键路径>`)+ 判官的原因句(只剥控制与双向字符,不回显值)。受理口的拒句与读器的丢弃因(请求腿运维 warn 的 `field` / `reason`)读**这一只** ——
+ * 原因只来自判官表,组句只在这里(两边各写一份,迟早分岔)。
+ */
+export declare function declarationIssueFacts(at: string, issue: DeclarationKeyIssue): {
+    readonly field: string;
+    readonly reason: string;
+};
+/**
+ * 列表条数撞帽**怎么被说出来**:坐标 = 列表键(`a2aPeers`)+ 撞帽铸点({@link limitRefusal})的头一句(`<列表> has N entries — at most M are accepted`)。受理口的撞帽拒句以同一句开头(接拒句尾),
+ * 读器的丢弃因读这一只 —— 与 {@link declarationIssueFacts} 同族:`reason` 只有一种内容 = 句子;机读词(`over_cap`)留在拒体的 `facts`,不进日志的 `reason`。
+ */
+export declare function declarationOverCapFacts(seat: DeclarationSeat, count: number): {
+    readonly field: string;
+    readonly reason: string;
+};
+/**
+ * 一条条目不是对象(`null` / 原始值 / 数组)的头一句:`<条目坐标> is <值的种类>, not <整称> (an object)`;是对象 ⇒ `undefined`。列表级拒({@link requestDeclarationRefusal})与读器的丢弃因读同一只,
+ * 「什么算对象」只在这里判。
+ */
+export declare function declarationEntryNotObject(seat: DeclarationSeat, entry: unknown, at: string): string | undefined;
+/** 一处键值坏形 → 拒。**所有键同一个形**;条目名过唯一的回显清洗,读不出名字的条目用占位,坐标与原因句由 {@link declarationIssueFacts} 铸。 */
+export declare function declarationFieldRefusal(seat: DeclarationSeat, entry: Record<string, unknown>, at: string, issue: DeclarationKeyIssue): DeclarationRefusal;
+/** 一条条目的键值判官表按受理键序问一遍,第一处坏形即返回。 */
+export declare function judgeDeclarationKeys<K extends string, E extends Record<string, unknown>>(seat: DeclarationSeat, entry: E, at: string, keys: readonly K[], judges: {
+    readonly [P in K]: DeclarationKeyJudge<E>;
+}): DeclarationRefusal | undefined;
+/**
+ * 一张声明列表「能不能原样用」的回答者骨架:列表级(缺席 / `null` ⇒ 没声明;不是数组 / 超上限 / 条目不是对象)在这里,条目级交座位的 `judgeEntry`(词表外的键 → 键值)。
+ * `undefined` = 能原样用(或没声明;各门自己定缺席的意思)。
+ */
+export declare function requestDeclarationRefusal(seat: DeclarationSeat, list: unknown, judgeEntry: (entry: Record<string, unknown>, at: string) => DeclarationRefusal | undefined): DeclarationRefusal | undefined;
+/** 受理口的转述:有答案 ⇒ 同步 400(码 / 句 / `unknownKeys` / 机读位原样);没有 ⇒ 什么也不做。 */
+export declare function throwDeclarationRefusal(refusal: DeclarationRefusal | undefined): void;
+//# sourceMappingURL=request-declaration-refusal.d.ts.map

package/dist/request-declaration-refusal.js

@@ -0,0 +1,78 @@
+import { describeBadWireName, describeValueShape, isUsableWireName, stripControlAndBidi } from "@sema-agent/settings-schema";
+import { createCodedHttpError } from "./security.js";
+import { limitRefusal } from "./limit-refusal.js";
+import { echoKeyName } from "./request-key-closure.js";
+import { urlCredentialFacts } from "./url-credential-refusal.js";
+export const MALFORMED_NAME = "<malformed>";
+export function declaredName(e) {
+    return e && typeof e === "object" && typeof e.name === "string" && e.name !== ""
+        ? String(e.name)
+        : MALFORMED_NAME;
+}
+export function declarationNameIssue(entry) {
+    return isUsableWireName(entry.name) ? undefined : { path: "name", reason: `must be a non-empty string within the wire-name length bound — got ${describeBadWireName(entry.name)}` };
+}
+export const LIST_REFUSAL_TAIL = "The request is refused rather than acting on part of the list: declarations that silently did not apply would read as in effect to whoever sent them. " +
+    "Fix the list (an empty list declares none).";
+export function declarationListRefusal(head) {
+    return { errorCode: "request.field_invalid", message: `${head}. ${LIST_REFUSAL_TAIL}` };
+}
+function entryRefusalTail(subject) {
+    return (`The request is refused rather than mounting the ${subject} without it: a declaration that silently did not apply would leave the ${subject} running differently from what you declared. ` +
+        "Fix the entry (an optional key may also be omitted).");
+}
+export function declarationIssueFacts(at, issue) {
+    return { field: `${at}.${issue.path}`, reason: stripControlAndBidi(issue.reason) };
+}
+export function declarationOverCapFacts(seat, count) {
+    const capped = limitRefusal(seat.list, "entries", count, seat.cap);
+    return { field: capped.facts.field, reason: capped.message };
+}
+export function declarationEntryNotObject(seat, entry, at) {
+    return entry === null || typeof entry !== "object" || Array.isArray(entry) ? `${at} is ${describeValueShape(entry)}, not ${seat.declaration} (an object)` : undefined;
+}
+export function declarationFieldRefusal(seat, entry, at, issue) {
+    const name = echoKeyName("", declaredName(entry));
+    const { field, reason } = declarationIssueFacts(at, issue);
+    return {
+        errorCode: "request.field_invalid",
+        message: `${field} (${seat.subject} "${name}") is not a usable declaration — ${reason}. ${entryRefusalTail(seat.subject)}`,
+        ...(issue.credential === undefined ? {} : { facts: urlCredentialFacts(`${at}.${issue.path}`, issue.credential) }),
+    };
+}
+export function judgeDeclarationKeys(seat, entry, at, keys, judges) {
+    for (const key of keys) {
+        const issue = judges[key](entry, at);
+        if (issue !== undefined)
+            return declarationFieldRefusal(seat, entry, at, issue);
+    }
+    return undefined;
+}
+export function requestDeclarationRefusal(seat, list, judgeEntry) {
+    if (list === undefined || list === null)
+        return undefined;
+    if (!Array.isArray(list))
+        return declarationListRefusal(`${seat.list} is ${describeValueShape(list)}, not an array of ${seat.declarations}`);
+    if (list.length > seat.cap) {
+        const capped = limitRefusal(seat.list, "entries", list.length, seat.cap, { tail: LIST_REFUSAL_TAIL });
+        return { errorCode: "request.field_invalid", message: capped.message, facts: capped.facts };
+    }
+    for (let i = 0; i < list.length; i++) {
+        const entry = list[i];
+        const at = `${seat.list}[${i}]`;
+        const notObject = declarationEntryNotObject(seat, entry, at);
+        if (notObject !== undefined)
+            return declarationListRefusal(notObject);
+        const refusal = judgeEntry(entry, at);
+        if (refusal !== undefined)
+            return refusal;
+    }
+    return undefined;
+}
+export function throwDeclarationRefusal(refusal) {
+    if (refusal === undefined)
+        return;
+    const extra = { ...(refusal.unknownKeys === undefined ? {} : { unknownKeys: [...refusal.unknownKeys] }), ...(refusal.facts ?? {}) };
+    throw createCodedHttpError(400, refusal.errorCode, refusal.message, Object.keys(extra).length === 0 ? undefined : extra);
+}
+//# sourceMappingURL=request-declaration-refusal.js.map

package/dist/request-image-urls.d.ts

@@ -0,0 +1,6 @@
+import { type UrlCredentialRefusal } from "./url-credential-refusal.js";
+/** 请求体 `images` 的 URL 座:任一条目的串值 `url` 带凭据 ⇒ 拒(整句 + 机读位),列表序第一处即答;没有 ⇒ `undefined`。`images` 不是数组 / 缺席 ⇒ `undefined`(形归受理口别的门)。 */
+export declare function requestImageUrlRefusal(images: unknown): UrlCredentialRefusal | undefined;
+/** fresh 提交腿的 `images` URL 门:{@link requestImageUrlRefusal} 有答案 ⇒ 同步 400(码 / 句 / 机读位原样)。 */
+export declare function assertRequestImageUrls(bodyImages: unknown): void;
+//# sourceMappingURL=request-image-urls.d.ts.map

package/dist/request-image-urls.js

@@ -0,0 +1,27 @@
+import { createCodedHttpError } from "./security.js";
+import { findUrlCredential } from "@sema-agent/settings-schema";
+import { buildRequestUrlCredentialRefusal } from "./url-credential-refusal.js";
+function inlineImageExit(at) {
+    return `${at} can carry the image bytes inline: send { "data": <base64>, "mimeType": "image/png" | "image/jpeg" | "image/gif" | "image/webp" } instead of a URL that holds the credential`;
+}
+export function requestImageUrlRefusal(images) {
+    if (!Array.isArray(images))
+        return undefined;
+    for (const [i, image] of images.entries()) {
+        if (image === null || typeof image !== "object")
+            continue;
+        const url = image.url;
+        const found = typeof url === "string" ? findUrlCredential(url) : undefined;
+        if (found === undefined)
+            continue;
+        const at = `images[${i}]`;
+        return buildRequestUrlCredentialRefusal(`${at}.url`, found, inlineImageExit(at));
+    }
+    return undefined;
+}
+export function assertRequestImageUrls(bodyImages) {
+    const refusal = requestImageUrlRefusal(bodyImages);
+    if (refusal !== undefined)
+        throw createCodedHttpError(400, "request.field_invalid", refusal.message, refusal.facts);
+}
+//# sourceMappingURL=request-image-urls.js.map

package/dist/request-key-closure.d.ts

@@ -17,6 +17,11 @@ export declare function scanKeyClosure(bag: object, prefix: string, accepted: Re
     unknown: string[];
     unsupported: string[];
 }): void;
+/** {@link scanKeyClosure} 的名字形:键名已经由调用方读成一张表(请求入口的快照只带词表外的键**名**,值不读),分拣规则同一条。 */
+export declare function scanKeyNames(names: readonly string[], prefix: string, accepted: ReadonlySet<string>, tolerated: ReadonlySet<string>, into: {
+    unknown: string[];
+    unsupported: string[];
+}): void;
 /** 一张分类表的文案片段(封顶后只报数)。 */
 export declare function keyClosureClause(names: string[], label: string): string;
 /**
@@ -32,7 +37,7 @@ declare const TASK_BODY_SCENARIO_KEYS: readonly ["repo"];
 export type ScenarioBodyKey = (typeof TASK_BODY_SCENARIO_KEYS)[number];
 /** 剥掉索引签名,只留**具名**键 —— `TaskRequestBody` 上那条 `[k: string]: unknown` 会让
  *  `keyof` 退化成 `string`,双向门就永远恒真(零判别力)。
- *  🔴 **导出**(S-405):姊妹门 `request-value-closure.ts` 的双向钉要同一个剥法 —— 抄第二份 = 两处哪天
+ *  🔴 **导出**([ref]):姊妹门 `request-value-closure.ts` 的双向钉要同一个剥法 —— 抄第二份 = 两处哪天
  *  分岔(一边看得见索引签名、一边看不见)谁都发现不了,而两边的判别力都建立在「剥干净了」这句话上。 */
 export type NamedKeysOf<T> = {
     [K in keyof T as string extends K ? never : number extends K ? never : K]: T[K];

package/dist/request-key-closure.js

@@ -5,7 +5,10 @@ export function echoKeyName(prefix, key) {
     return `${prefix}${echoCallerText(key)}`;
 }
 export function scanKeyClosure(bag, prefix, accepted, tolerated, into) {
-    for (const k of Object.keys(bag)) {
+    scanKeyNames(Object.keys(bag), prefix, accepted, tolerated, into);
+}
+export function scanKeyNames(names, prefix, accepted, tolerated, into) {
+    for (const k of names) {
         if (accepted.has(k))
             continue;
         (tolerated.has(k) ? into.unsupported : into.unknown).push(echoKeyName(prefix, k));
@@ -23,7 +26,7 @@ const TASK_BODY_DECLARED_KEYS = [
     "excludeAllTools", "excludeTools", "fileHistory",
     "finalVerification", "forwardSubagentEvents", "images", "inheritEnv", "interactiveTools", "jobId", "limits", "maxCostUsd",
     "maxTokens", "mcpServers", "memory", "memoryCapture", "memoryWrite", "model", "objective", "oneShot", "outputRetries", "outputStyle",
-    "outputSchema", "permissionMode", "projectId", "promptProfile", "reasoningEffort", "requireExistingSession",
+    "outputSchema", "permissionMode", "projectId", "projectMemory", "promptProfile", "reasoningEffort", "requireExistingSession",
     "resilience", "restoreFiles", "resumeAt", "resumeAtMode", "retainBackgroundProcesses", "retainSubagentSessions",
     "rewindFiles", "rewindFilesTo", "sandboxImageProfile", "scenario", "scratchpadDir", "selfOrchestration",
     "sessionId", "settings", "skills", "suggestNextPrompts", "systemPrompt", "taskId", "toolMaterializeStrategy",

package/dist/request-value-closure.d.ts

@@ -9,9 +9,9 @@
  * 于是坏值有且只有一种正确处置:**响亮拒**。按 truthiness 读成任一态都是灾难的一半 ——
  * 一个敲错的隐私/收紧请求被静默丢掉(用户以为关了,其实没关),或者一个敲错的键把功能静默关掉。
  *
- * 🔴 **判别是「值域恰好是一个关断词」,不是「值域恰好是一个字面量」**(S-724 加 `fileHistory` 时定形):
+ * 🔴 **判别是「值域恰好是一个关断词」,不是「值域恰好是一个字面量」**([ref] 加 `fileHistory` 时定形):
  * 当年的反例是 `approverPosture`(值域也只有一个词 `"bypass"`,但它是一句**姿态声明**、闭集属主在 core,本仓刻意零判据);
- * 那个请求键已随 core 7.34.0 退役(S-877,[ref] 裁 ③),判别式的理由不变 —— 一个非关断的单字面量键不属于本表。
+ * 那个请求键已随 core 7.34.0 退役([ref],[ref] 裁 ③),判别式的理由不变 —— 一个非关断的单字面量键不属于本表。
  * 关断词全集 {@link OffSwitchWord} 是 core 的两种关断拼法,新增第三种拼法 = 加一个词(并逐键重判)。
  *
  * ## 为什么是一只判据函数,不是每处一抄
@@ -25,9 +25,9 @@
  * **不可逆方向**的静默降级 —— 一条旧 worker 持久化的 `memoryCapture:'OFF'` 会在 resume 时静默恢复采集。
  *
  * 两腿各抄一份判据 + 一份文案,就是同一条 wire 语义上的**两个写者**;`memoryCapture` 从 [ref] 起正是这么长的
- * (`http/admission.ts` 与 `boot/resolve-spec.ts` 各一份逐字手抄的 150 字文案)。S-405 给这一族添第二个键
+ * (`http/admission.ts` 与 `boot/resolve-spec.ts` 各一份逐字手抄的 150 字文案)。[ref] 给这一族添第二个键
  * (`memory`)时把它收成**一张表、一只判据、一处文案属主**:新增一个同形键 = 加一行,而不是四处改。
- * S-724 加第三个键 `fileHistory` 正是这么加的 —— 一行(带它自己的关断词),零处改判据。
+ * [ref] 加第三个键 `fileHistory` 正是这么加的 —— 一行(带它自己的关断词),零处改判据。
  * 文案的冻结职责随之从「桶扫描」搬到 `test/api-error-text-freeze.test.ts` 的常量锚格(与 `RUN_NOT_FOUND_MESSAGE` /
  * `PERSIST_RULE_*` 两格同形、同理由)。
  *
@@ -43,21 +43,24 @@ import type { TaskRequestBody } from "./http/wire-types.js";
 /** [ref] §2.1([ref]):`memoryCapture` 的拼写门文案。**wire 可见文本** —— 改一个字就是对端契约漂移
  *  (SDK/壳/文档锚它),字节冻结在 `test/api-error-text-freeze.test.ts` 的常量锚格。 */
 export declare const MEMORY_CAPTURE_SPELLING_MESSAGE = "memoryCapture must be the string 'off' when present (the session-level memory-capture opt-out declaration; absent = capture as usual \u2014 there is no 'on' spelling)";
-/** core [ref] r5 §5 W3(S-405):请求级「记忆整面关」`memory` 的拼写门文案。同上,wire 可见、字节冻结。
+/** core [ref] r5 §5 W3([ref]):请求级「记忆整面关」`memory` 的拼写门文案。同上,wire 可见、字节冻结。
  *  文案刻意点明 capture 的分工 —— 两个键都在记忆轴上、形又一模一样,拿错的人要在同一条回执里读到该用哪个。 */
 export declare const MEMORY_OFF_SPELLING_MESSAGE = "memory must be the string 'off' when present (the request-level declaration that this run mounts no memory face at all; absent = memory as usual \u2014 there is no 'on' spelling; to keep memory mounted but stop this session's content from entering long-term memory, send memoryCapture: 'off' instead)";
-/** S-724(core 7.31.0 #1048):请求级「文件历史关断」`fileHistory` 的拼写门文案。同上,wire 可见、字节冻结。
+/** [ref](core 7.31.0 [ref]):请求级「文件历史关断」`fileHistory` 的拼写门文案。同上,wire 可见、字节冻结。
  *  唯一词是 core 的拼法 `'disabled'`(与 `checkpointStore` 同),**不是**记忆族的 `'off'` —— 句子点名它,
  *  顺带说清同一提交里不能再要还原(那一对的拒句是下面的 {@link FILE_HISTORY_DISABLED_NO_RESTORE})。 */
 export declare const FILE_HISTORY_OFF_SPELLING_MESSAGE = "fileHistory must be the string 'disabled' when present (the request-level declaration that this run records no file history \u2014 no backup of an edited file, and no file restore in the same request; absent = the deployment's setting \u2014 there is no 'enabled' spelling)";
+/** 7.135.0(core 7.55.0):请求级「这一条 run 不读部署的项目上下文」`projectMemory` 的拼写门文案。同上,wire 可见、字节冻结。
+ *  唯一词是 core 的拼法 `'disabled'`(与 `fileHistory` 同族同拼法)—— 第四个同形键,按本表的规则加一行,不另判。 */
+export declare const PROJECT_MEMORY_OFF_SPELLING_MESSAGE = "projectMemory must be the string 'disabled' when present (the request-level declaration that this run reads none of the deployment's project context \u2014 no project instruction files and no project layer; absent = the deployment's project context as usual \u2014 there is no 'on' spelling)";
 /**
- * S-724 b′(主会话裁,车PW codex r1 [high] 复现后)—— `fileHistory: "disabled"` 与还原**同体**的拒句(`request.field_conflict`)。
+ * [ref] b′(主会话裁,车PW codex r1 [high] 复现后)—— `fileHistory: "disabled"` 与还原**同体**的拒句(`request.field_conflict`)。
  * 与 `tool-approval.ts` 的 `READ_ROOT_GRANT_ALLOW_ONLY` **同一族**:「只看体就能判的矛盾,在裁决之前响亮说」。
  * 这一对是调用方自己写出的矛盾(关掉这条 run 的文件历史,又要从文件历史还原);core 也拒(`rewind.capture_disabled`)。立门时(7.104.0)
  * core 的拒落在 prepare 的**会话分叉之后**(`prepare-acquire-reconcile` 先按 `resumeAt` 把活动分支移过去,`prepare-file-history` 才判),
  * 且拒后不回滚 —— 所以本层在任何副作用之前拒。**这不是替 core 再判一次「捕获关了能不能还原」**:判的是体里两个键
  * 能不能共存,不看部署、不看店。
- * ⚠️ S-865 / S-877(core 7.35.0 #1195):core 起把只看请求体就判得出的拒因(本码在内)挪到**会话 acquire 之前**的请求门
+ * ⚠️ [ref] / [ref](core 7.35.0 [ref]):core 起把只看请求体就判得出的拒因(本码在内)挪到**会话 acquire 之前**的请求门
  * (`runner/file-history-request.js`),被拒的请求会话日志逐字节不动 —— 本门当年防的那个副作用在引擎侧已不存在。本门的 400
  * 照旧有效(core wire 单:「the at-accept 400 stays valid」),退不退(退则 fresh 腿改落 core 的 422 `rewind.capture_disabled`)
  * 列 7.106.0 收车档候裁。
@@ -94,6 +97,10 @@ declare const SINGLE_MEMBER_OFF_FIELDS: readonly [{
     readonly field: "fileHistory";
     readonly word: "disabled";
     readonly message: "fileHistory must be the string 'disabled' when present (the request-level declaration that this run records no file history — no backup of an edited file, and no file restore in the same request; absent = the deployment's setting — there is no 'enabled' spelling)";
+}, {
+    readonly field: "projectMemory";
+    readonly word: "disabled";
+    readonly message: "projectMemory must be the string 'disabled' when present (the request-level declaration that this run reads none of the deployment's project context — no project instruction files and no project layer; absent = the deployment's project context as usual — there is no 'on' spelling)";
 }];
 /** 一次值闭集裁决的产物:出问题的键名(机读)+ 一句 wire 文案。 */
 export interface SingleMemberOffFieldIssue {

package/dist/request-value-closure.js

@@ -1,6 +1,7 @@
 export const MEMORY_CAPTURE_SPELLING_MESSAGE = "memoryCapture must be the string 'off' when present (the session-level memory-capture opt-out declaration; absent = capture as usual — there is no 'on' spelling)";
 export const MEMORY_OFF_SPELLING_MESSAGE = "memory must be the string 'off' when present (the request-level declaration that this run mounts no memory face at all; absent = memory as usual — there is no 'on' spelling; to keep memory mounted but stop this session's content from entering long-term memory, send memoryCapture: 'off' instead)";
 export const FILE_HISTORY_OFF_SPELLING_MESSAGE = "fileHistory must be the string 'disabled' when present (the request-level declaration that this run records no file history — no backup of an edited file, and no file restore in the same request; absent = the deployment's setting — there is no 'enabled' spelling)";
+export const PROJECT_MEMORY_OFF_SPELLING_MESSAGE = "projectMemory must be the string 'disabled' when present (the request-level declaration that this run reads none of the deployment's project context — no project instruction files and no project layer; absent = the deployment's project context as usual — there is no 'on' spelling)";
 export const FILE_HISTORY_DISABLED_NO_RESTORE = "fileHistory: 'disabled' cannot ride with a file restore (restoreFiles, rewindFilesTo, or the retired rewindFiles) — the request turns this run's file history off and asks to restore files from it in the same breath; the engine would refuse it (rewind.capture_disabled) only after the session had already been branched at resumeAt, which it does not undo, so it is refused here, before any side effect. Drop fileHistory to restore, or drop the restore to run without file history";
 export function fileHistoryRestoreConflict(body) {
     return body.fileHistory === "disabled" && fileHistoryRestoreKeysInBody(body).length > 0;
@@ -19,6 +20,7 @@ const SINGLE_MEMBER_OFF_FIELDS = [
     { field: "memoryCapture", word: "off", message: MEMORY_CAPTURE_SPELLING_MESSAGE },
     { field: "memory", word: "off", message: MEMORY_OFF_SPELLING_MESSAGE },
     { field: "fileHistory", word: "disabled", message: FILE_HISTORY_OFF_SPELLING_MESSAGE },
+    { field: "projectMemory", word: "disabled", message: PROJECT_MEMORY_OFF_SPELLING_MESSAGE },
 ];
 export function singleMemberOffFieldIssue(raw) {
     if (raw === null || raw === undefined || typeof raw !== "object" || Array.isArray(raw))

package/dist/router/route-orchestration.d.ts

@@ -28,9 +28,11 @@ export interface RoutingContext {
     /** The mounted tools can EGRESS / take IRREVERSIBLE EXTERNAL actions that ESCAPE any sandbox (git push, curl,
      *  a real-target deploy). Egress harm is real even inside an isolated sandbox. */
     canEgress: boolean;
-    /** The execution env strongly ISOLATES side effects (k8s/Kata/e2b sandbox, torn down after the task) — vs a
-     *  non-isolated `host`/`ssh` lane where write/exec harm is real. */
-    isolatedExecEnv: boolean;
+    /** The execution env isolates side effects at the VM level (a separate kernel: e2b microVM, k8s on Kata/gVisor; torn
+     *  down after the task) — vs a shared-kernel container or a real `host`/`ssh` machine where write/exec harm is real.
+     *  [ref]: NOT the OS-level `executionLane.isolated` (a runc container counts there) — the deployment-shape row
+     *  `vmIsolatedHands` (`deployment-shape.ts`) answers this one. */
+    vmIsolatedExecEnv: boolean;
     /** The task delegates / fans out / is long-horizon (the leader/team path, or a long wall-clock) ⇒ the (b)
      *  goal-keeping + ask-aggregation value applies. */
     delegatedOrLongHorizon: boolean;
@@ -47,7 +49,7 @@ export declare function deriveRoutingSignals(ctx: RoutingContext): RoutingSignal
  * Service-facing convenience: map a /v1/tasks task's DETERMINISTIC facts → a routing decision (the service signal
  * derivation + {@link deriveRoutingSignals} + {@link routeOrchestration} in one tested call; main.ts's resolveSpec
  * calls this). Signal mapping:
- *  - `isolatedExecEnv` ⟺ a sandboxed remote-exec backend (`e2b`/`k8s` Kata) — `ssh`/`host`/`adb` are NOT isolated.
+ *  - `vmIsolatedExecEnv` ⟺ a VM-isolated remote-exec backend (`e2b`/`k8s` Kata) — `ssh`/`host`/`adb` are NOT isolated.
  *  - hand tools (write_file/bash) are mounted only when an executionEnv exists AND the autonomy does not clamp the hands
  *    read-only (read off {@link autonomyOverrides} — the one place an autonomy word becomes a hands clamp; `plan` is the
  *    engine's plan mode, whose hands stay mounted and are gated at call time, so it is not read-only here).
@@ -55,21 +57,14 @@ export declare function deriveRoutingSignals(ctx: RoutingContext): RoutingSignal
  *  - `delegatedOrLongHorizon` is false on the single-task path (the (b) value lives on the /v1/leader path).
  */
 export declare function routeServiceTask(input: {
-    /** RESOLVED isolation — computed by {@link isIsolatedExecEnv} (NOT a bare provider name: a `k8s` worker can run
-     *  plain runc, which is NOT VM-isolated — review HIGH). */
-    isolatedExecEnv: boolean;
+    /** RESOLVED VM-level isolation — the deployment-shape row `vmIsolatedHands` (NOT a bare provider name: a `k8s` worker
+     *  can run plain runc, which is NOT VM-isolated — review HIGH). */
+    vmIsolatedExecEnv: boolean;
     /** An executionEnv is configured (hand tools are mountable). */
     hasExecutionEnv: boolean;
     /** The resolved autonomy for the task. */
     autonomy?: Autonomy;
 }): RoutingDecision;
-/**
- * Resolve whether a task's execution env STRONGLY isolates side effects (a VM/kernel boundary the sandbox tears
- * down). FAIL-CLOSED (review HIGH): a `k8s` backend is isolated ONLY with a VM-isolation `runtimeClass`
- * (kata-x or gvisor) — a runc downgrade (`runtimeClass: ""` / `runc` / unknown) is NOT isolated (shared kernel,
- * container escape). `e2b` is a Firecracker microVM (isolated). `host`/`ssh`/`adb` and anything unknown ⇒ NOT isolated.
- */
-export declare function isIsolatedExecEnv(provider?: string, runtimeClass?: string): boolean;
 /**
  * The TaskSpec overrides for the SUP prevention posture (mode=supervisor). Applied via `tightenTaskSpec`
  * (tighten-only — composes with the deployment baseline, never loosens):
@@ -78,11 +73,11 @@ export declare function isIsolatedExecEnv(provider?: string, runtimeClass?: stri
  *    leaves a non-isolated SUP task able to mutate the real fs via write tools ungated). The worker's existing
  *    approval machinery (durable suspend / poll) enforces the `ask` — same precondition as `shellGate:"always"`.
  *
- * 🔴 S-897(7.106.0,[ref]):这些 ask 是**部署**(运维开的 `ROUTER_ENABLED` 路由)写下的门 ⇒ 盖 core 的部署出身位
+ * 🔴 [ref](7.106.0,[ref]):这些 ask 是**部署**(运维开的 `ROUTER_ENABLED` 路由)写下的门 ⇒ 盖 core 的部署出身位
  * `authoredBy:"deployment"`,经**唯一**盖位函数(`operator-ask.ts` 的 `withDeploymentAuthorship`,经 `operatorAlwaysHumanAsk`
  * 取用 —— 治理层 ask、`APPROVAL_NEVER_AUTO` / 预算耗尽 ask 同一只)。修前:写工具的 ask 只自报 `matchedAskRule`(非强制卡),
  * shellGate always 的 shell ask 是 core 自铸的、没有出身位 ⇒ 卡上只剩单个强制词(`operator_always`;读边界探针命中时是
- * `probe_mandate`,它把 always 藏在后面)⇒ bypass 下壳按那一个词放行(cli L-758 的规则面)。盖了之后 core 判 `mandated`、
+ * `probe_mandate`,它把 always 藏在后面)⇒ bypass 下壳按那一个词放行(cli [ref] 的规则面)。盖了之后 core 判 `mandated`、
  * 不铸 `mandate` 词(表外的门)⇒ 活卡与 park 行两腿都读成「另有门在」,壳出卡。
  * shell 那一问的出身只能由**策略的** ask 带进去(core 的 shell 座铸的 ask 没有出身位的写口)⇒ 策略对 shell 工具也问一次,
  * core 把它与 shellGate always 折成同一只 ask(不是两问)。

package/dist/router/route-orchestration.js

@@ -11,7 +11,7 @@ export function routeOrchestration(s) {
 }
 export function deriveRoutingSignals(ctx) {
     const readOnly = ctx.autonomy === "read-only";
-    const dangerousCapability = !readOnly && (ctx.canEgress || (ctx.canWriteOrExec && !ctx.isolatedExecEnv));
+    const dangerousCapability = !readOnly && (ctx.canEgress || (ctx.canWriteOrExec && !ctx.vmIsolatedExecEnv));
     return {
         dangerousCapability,
         needsGoalKeeping: ctx.delegatedOrLongHorizon,
@@ -23,20 +23,10 @@ export function routeServiceTask(input) {
         ...(input.autonomy ? { autonomy: input.autonomy } : {}),
         canWriteOrExec: input.hasExecutionEnv && !readOnlyHands,
         canEgress: false,
-        isolatedExecEnv: input.isolatedExecEnv,
+        vmIsolatedExecEnv: input.vmIsolatedExecEnv,
         delegatedOrLongHorizon: false,
     }));
 }
-const VM_ISOLATION_CLASSES = new Set(["kata", "kata-qemu", "kata-clh", "kata-fc", "gvisor", "runsc"]);
-export function isIsolatedExecEnv(provider, runtimeClass) {
-    if (provider === "e2b")
-        return true;
-    if (provider === "k8s") {
-        const rc = (runtimeClass ?? "").trim().toLowerCase();
-        return rc.startsWith("kata") || VM_ISOLATION_CLASSES.has(rc);
-    }
-    return false;
-}
 const WRITE_HAND_TOOLS = new Set(["Edit", "Write", "NotebookEdit"]);
 const SHELL_TOOLS = new Set(COARSE_SHELL_TOOLS);
 export function supPostureOverrides() {