@sema-agent/server 7.135.0 → 7.136.0

package/dist/brain.js

@@ -6,6 +6,7 @@ import { createHash } from "node:crypto";
 import { isModelKeyPoison, modelKeyPoisonIdentity } from "./key-resolver.js";
 import { anthropicRouteRoot, brainLaneFor, mountRoutes, routeTableOf } from "./model-provider.js";
 import { openaiRouteBaseUrl } from "./model-route-endpoint.js";
+import { anthropicLaneCredentialOf } from "./model-route-gap.js";
 import { catalogEntryFingerprint } from "./web-admin-client/restart-signal.js";
 import { buildDisplaySafeRefusal, buildDisplaySafeUrl } from "./trace/redact.js";
 import { createModelReachBrain } from "./model-unreachable-notice.js";
@@ -82,9 +83,7 @@ export function createBrainAssembly(config, deps = {}) {
             ? createFailoverBrain(openaiBrains)
             : openaiBrains[0];
     const brainRoutes = mountRoutes(config, (anthropicCfg) => constructRouteBrain("anthropic route", [anthropicCfg.baseUrl], () => createAnthropicBrain({
-        ...(anthropicCfg.authToken
-            ? { headers: { Authorization: `Bearer ${anthropicCfg.authToken}` } }
-            : { apiKey: anthropicCfg.apiKey }),
+        ...anthropicCredentialFields(anthropicLaneCredentialOf(anthropicCfg)),
         baseUrl: anthropicRouteRoot(anthropicCfg),
         version: anthropicCfg.version,
         cacheBreakpoints: anthropicCfg.cacheBreakpoints,
@@ -139,6 +138,16 @@ export function createBrainAssembly(config, deps = {}) {
     }
     return { brain: createModelReachBrain(brain), degradeRoute: { read: () => ({ baked: degradeBaked, current: degradeRouteFingerprint(config) }) } };
 }
+function anthropicCredentialFields(credential) {
+    if (credential === undefined)
+        return {};
+    switch (credential.kind) {
+        case "x-api-key":
+            return { apiKey: credential.value };
+        case "bearer":
+            return { headers: { Authorization: `Bearer ${credential.value}` } };
+    }
+}
 export function createBrain(config, deps = {}) {
     return createBrainAssembly(config, deps).brain;
 }

package/dist/budget.d.ts

@@ -8,7 +8,7 @@
 import { type Model, type ModelPricing, type TracerHook } from "@sema-agent/core";
 import type { Metrics } from "./observability/metrics.js";
 import type { QuotaTracker } from "./observability/cost-quota.js";
-import type { FleetUsageAccumulator } from "./fleet-client.js";
+import type { FleetUsageBins } from "./fleet-client.js";
 import type { FleetLeaseManager } from "./fleet-lease.js";
 import { type PromptManifestTracker } from "./observability/prompt-manifest.js";
 /** ③ Per-model pricing keyed by model id (core falls back to each Model.cost when a model is absent).
@@ -108,7 +108,7 @@ export { type PromptManifestRecord, promptManifestRecordOf, configAssembledRecor
  * fires for EVERY call (top-level + async + council sub-tasks) → `model_cost_micro_usd_total` is the authoritative
  * spend, and (when a {@link ModelUsageTracker} is supplied) the per-task `modelUsage` echo's source.
  */
-export declare function createTracer(metrics: Pick<Metrics, "inc" | "observe">, costQuota?: QuotaTracker, modelUsage?: ModelUsageTracker, fleetUsage?: Pick<FleetUsageAccumulator, "record">, fleetLease?: Pick<FleetLeaseManager, "recordSpend">, quotaWeightFor?: (model: string) => number, promptManifests?: PromptManifestTracker): TracerHook;
+export declare function createTracer(metrics: Pick<Metrics, "inc" | "observe">, costQuota?: QuotaTracker, modelUsage?: ModelUsageTracker, fleetUsage?: Pick<FleetUsageBins, "record" | "pinExecution">, fleetLease?: Pick<FleetLeaseManager, "recordSpend" | "pinExecution">, quotaWeightFor?: (model: string) => number, promptManifests?: PromptManifestTracker): TracerHook;
 /**
  * [ref] side-query 记账 seam(codex R3 high:sideQuery 不走 core tracer——brain.stream 直调不发
  * brain.call——createTracer 的四路 sink(costQuota/model_cost 指标/fleetUsage 批报/fleetLease 本地扣减)
@@ -121,7 +121,7 @@ export declare function createTracer(metrics: Pick<Metrics, "inc" | "observe">,
  * (保守,绝不少收);根修=core 在 SideQueryResult 上回权威 costMicroUsd(已提货 core)。model 标签/
  * weight 键用**路由身份 r.model**(池配置有界)非 servedModel(provider 上报,无界)。
  */
-export declare function createSideQueryAccountant(metrics: Pick<Metrics, "inc">, costQuota?: QuotaTracker, fleetUsage?: Pick<FleetUsageAccumulator, "record">, fleetLease?: Pick<FleetLeaseManager, "recordSpend">, quotaWeightFor?: (model: string) => number): (principal: string | undefined, r: {
+export declare function createSideQueryAccountant(metrics: Pick<Metrics, "inc">, costQuota?: QuotaTracker, fleetUsage?: Pick<FleetUsageBins, "record">, fleetLease?: Pick<FleetLeaseManager, "recordSpend">, quotaWeightFor?: (model: string) => number): (principal: string | undefined, r: {
     model: string;
     usage?: {
         input?: number;

package/dist/budget.js

@@ -77,6 +77,10 @@ export function createTracer(metrics, costQuota, modelUsage, fleetUsage, fleetLe
     const modelId = cardinalityGuard(256, () => metrics.inc("metric_label_overflow_total", { label: "model" }));
     const providerName = cardinalityGuard(64, () => metrics.inc("metric_label_overflow_total", { label: "provider" }));
     return (e) => {
+        if (e.kind === "task.start") {
+            fleetUsage?.pinExecution();
+            fleetLease?.pinExecution();
+        }
         if (e.kind === "brain.call") {
             metrics.inc("brain_calls_total", { provider: providerName(e.provider ?? "unknown"), model: modelId(e.model) });
             if (e.costMicroUsd) {

package/dist/capabilities/mcp-probe.d.ts

@@ -33,7 +33,7 @@
  *    在 core 那边没有任何期限(core `docs/KNOWN-LIMITS.md`)—— 那一形上本面同样没有期限,补偿只有限速与缓存。
  */
 import { type McpServerSpec } from "@sema-agent/core";
-import type { UrlCredentialFacts } from "../url-credential.js";
+import type { DeclarationRefusal } from "../request-declaration-refusal.js";
 /**
  * 本面的**拒码闭集**(设计稿 §2 的四枚)。闭集写成型,是为了让 {@link MCP_PROBE_HTTP_STATUS} 那张表
  * 「漏一枚 = 编译红」—— [ref] 的安全轴纪律:词表是闭集,未处置的成员必须是编译错误而不是运行期惊喜。
@@ -158,8 +158,9 @@ export interface McpProbeRefusal {
     readonly message: string;
     /** `request.body_shape` 专用:词表外 / 本面不接线的键,全路径形(已清洗+截断+排序+封顶)。 */
     readonly unknownKeys?: readonly string[];
-    /** [ref]:申报的 `transport.url` 带凭据 ⇒ `field` + `reason`(与提交腿同一只回答者交回的同一组机读位,原样转述)。 */
-    readonly facts?: UrlCredentialFacts;
+    /** 申报超上限 ⇒ 撞帽机读位一组键(`field` · `reason:"over_cap"` · `count` · `cap`);申报的 `transport.url` 带凭据 ⇒ `field` + `reason` ——
+     *  与提交腿同一只回答者交回的同一组机读位,原样转述。 */
+    readonly facts?: DeclarationRefusal["facts"];
 }
 /**
  * `POST …/probe` 的体读器:闭形、逐条点名、零静默丢。成功 ⇒ 交给 core 的 `specs`(**原样**转发被读出来的
@@ -167,7 +168,7 @@ export interface McpProbeRefusal {
  *
  * ## 申报「能不能原样用」:问提交腿 fresh 门**同一只**回答者,不另判
  * 本面只判自己那一层(体是对象、顶层只受理 `mcpServers`、这个键必填);`mcpServers` 本身 —— 列表的形、上限、每条的键名与键值 —— 全部交给
- * `task-mcp.ts` 的 `requestMcpDeclarationRefusal`,拒(码 + 句 + `unknownKeys` + url 带凭据那一形的 `field` / `reason`)原样转述:同一份申报在两扇门上只有一个答案,零拨号之前就给。
+ * `task-mcp.ts` 的 `requestMcpDeclarationRefusal`,拒(码 + 句 + `unknownKeys` + 撞帽 / url 带凭据两形的机读位)原样转述:同一份申报在两扇门上只有一个答案,零拨号之前就给。
  * 回答者受理的申报由**同一只**读器(`validateRequestMcp`)交回,读器的产物就是申报本身(只差判官自己的合法归一),经 `toCoreMcpServerSpec`
  * 得到的就是一条任务提交会交给引擎的那一份 —— 本面拨的正是它。读器只在回答者受理之后才跑,所以它对重放存量 body 才有的降级留痕
  * (`source` 写坏的 F 类丢弃)不会在一次被拒的探测上虚记。

package/dist/capability-facts.d.ts

@@ -23,6 +23,7 @@ import type { ServiceConfig } from "./config.js";
 import type { OwnerAwareSessionStore } from "./security.js";
 import type { ServiceFileHistoryStore } from "./plugins/store-backend.js";
 import { resolveStreamApprovalGate, type ApprovalFrameFamily } from "./tool-approval.js";
+import { type SyncBlobHistoryStore } from "./session-sync.js";
 import { type WorkspaceSyncCapability } from "./workspace-space.js";
 import type { WorkspaceCacheCapability } from "./workspace-cache.js";
 /** why 闭集:词 → 给运维看的一句义(诊断 / 测试读它;wire 上的拒句由各门自写)。 */
@@ -171,13 +172,8 @@ export declare function sessionSync(d: Pick<Deps, "backend" | "sessionStorage" |
     sessionStorage: SyncSessionStore;
     historyStore: ServiceFileHistoryStore;
 }>;
-/** blob 两面齐备的文件历史店(marker 门,不做名字探测:local 的引擎文件店带一只同名私有助手)。 */
-export type SyncBlobHistoryStore = ServiceFileHistoryStore & {
-    readonly syncBlobFaces: true;
-} & {
-    [P in "putBlob" | "getBlob"]-?: NonNullable<ServiceFileHistoryStore[P]>;
-};
-/** 会话同步的**文件历史半族**:对话半族 ∧ 文件历史店有 blob 搬运面(只有 SQL 两只店有)。 */
+/** 会话同步的**文件历史半族**:对话半族 ∧ 文件历史店有 blob 搬运面(只有 SQL 两只店有)。「店有没有 blob 两面」只在 `syncBlobFacesOf` 判一次(marker 门,不做名字探测),
+ *  blob 取值口 `blobGetterOf` 读的是同一只 —— 本事实为真 ⟺ 取值口通到 `historyStore.getBlob`。 */
 export declare function sessionSyncFileHistory(d: Pick<Deps, "backend" | "sessionStorage" | "fileHistoryStore" | "sessionPolicyStore">): Fact<SessionSyncWhy | "sync_blob_faces_absent", {
     historyStore: SyncBlobHistoryStore;
 }>;

package/dist/capability-facts.js

@@ -4,7 +4,7 @@ import { DEPLOYMENT_SHAPE_PREDICATES } from "./deployment-shape.js";
 import { presentedApprovalFrameFamily, resolveStreamApprovalGate } from "./tool-approval.js";
 import { selfOrchestrationDenial } from "./task-workflow.js";
 import { centerEntitlementSourceWired } from "./runtime-caps-resolver.js";
-import { overwriteWipeIncapable } from "./session-sync.js";
+import { overwriteWipeIncapable, syncBlobFacesOf } from "./session-sync.js";
 import { WORKSPACE_PERSIST_DEFAULT, WORKSPACE_SNAPSHOT_KEEP_DEFAULT, workspaceSnapshotTimeoutOf } from "./workspace-space.js";
 import { headReadOf } from "./session-incarnation.js";
 export const CAPABILITY_FACT_WHY = {
@@ -172,10 +172,8 @@ export function sessionSyncFileHistory(d) {
     const sync = sessionSync(d);
     if (!sync.available)
         return sync;
-    const fs = sync.historyStore;
-    return fs.syncBlobFaces === true && typeof fs.putBlob === "function" && typeof fs.getBlob === "function"
-        ? yes({ historyStore: fs })
-        : no("sync_blob_faces_absent");
+    const faces = syncBlobFacesOf(sync.historyStore);
+    return faces !== undefined ? yes({ historyStore: faces }) : no("sync_blob_faces_absent");
 }
 export function checkpointPark(d) {
     return d.checkpointStore !== undefined ? yes({ checkpointStore: d.checkpointStore }) : no("checkpoint_store_absent");

package/dist/center-credential.d.ts

@@ -97,9 +97,6 @@ export type CenterCredentialSourceSpec = Exclude<WebAdminCredentialDeclaration,
  * 路径(之后 cwd 变了也读同一个文件 —— 纯契约不碰 `node:path`,这一步归读方)。
  */
 export declare function readCenterCredentialDeclaration(env?: Readonly<Record<string, string | undefined>>): WebAdminCredentialDeclaration;
-/** 拉取令牌形的身份 = worker(拉取令牌代表 worker,不是人)。种类判别与 formatVersion 1 LKG 的一次性迁移
- *  (`config-lkg.ts` `migrateV1Lkg`:v1 信封只记 worker,只有这一形的身份推得出来)共用这一只。 */
-export declare function pullTokenIdentity(worker: string | undefined): string;
 /**
  * 凭证来源工厂(活对象:文件形每次取值读盘并记健康态)。`worker` = `SEMA_WEB_ADMIN_WORKER`(拉取令牌形的身份)。
  * `readFile` / `now` 只为测试注入。
@@ -161,6 +158,23 @@ export declare function answerStillCurrent(source: CenterCredentialSource, usedI
  *    中心答复;缓存 / 在飞 / 条件请求的校验子全在箱里,换了人结构上够不着上一个人的。
  *  · 请求发出之后才换人:答复到达时由 {@link answerStillCurrent} 判丢弃(请求装配侧,见 http-client.ts)。
  * 旧身份的箱不淘汰(量级 = 进程生命期内出现过的身份数):换回来的身份在 TTL 内照常命中它自己的缓存。
+ * 取箱口两只({@link IdentityBins}):`now`(此刻身份)与 `accounting`(记账身份:执行开始时钉下的那个,[ref])。
  */
-export declare function createIdentityBins<T>(source: CenterCredentialSource, make: (pinned: CenterCredentialSource) => T): () => T;
+export declare function createIdentityBins<T>(source: CenterCredentialSource, make: (pinned: CenterCredentialSource) => T): IdentityBins<T>;
+/**
+ * 同一只分箱规则的两个取箱口(箱表、钉住的凭证、惰建都只有一份):
+ *  · `now` —— 此刻凭证身份的箱(缓存 / 在飞去重 / 用量环上报这一类「此刻是谁就替谁办」的读者);
+ *  · `accounting` —— **记账身份**的箱([ref]:花费扣减、用量记账):这次执行开始时钉下的身份({@link pinAccountingIdentity});不在执行里 / 没钉 ⇒ 同 `now`。
+ *    在飞调用完成时凭证换了人或暂时读不到,都不改它记在谁的箱里。
+ */
+export interface IdentityBins<T> {
+    now(): T;
+    accounting(): T;
+}
+/**
+ * [ref] —— 把这次执行的**记账身份**钉在此刻(执行的第一帧 `task.start` 由 tracer 调;每个凭证来源每次执行至多钉一次,先到为准 ——
+ * 同一执行里子任务的 `task.start` 不改它)。此刻身份未知(凭证读不到)⇒ **不钉**:不把这次执行记到「身份未知」的无主箱,它的记账按记账那一刻的身份。
+ * 不在执行作用域里(`withPrincipal` 之外)⇒ 无动作。
+ */
+export declare function pinAccountingIdentity(source: CenterCredentialSource): void;
 //# sourceMappingURL=center-credential.d.ts.map

package/dist/center-credential.js

@@ -2,6 +2,7 @@ import { readFileSync } from "node:fs";
 import { createHash } from "node:crypto";
 import { resolve as resolvePath } from "node:path";
 import { looksLikeJwt } from "@sema-agent/settings-schema/api/auth-bridge";
+import { currentExecutionPins } from "./observability/principal-context.js";
 import { WEB_ADMIN_ENV, judgeWebAdminCredentialDeclaration, parseWebAdminCredentialFile } from "@sema-agent/settings-schema";
 export class CenterCredentialUnavailableError extends Error {
     reason;
@@ -37,7 +38,7 @@ function classify(bearer, worker) {
         return { ok: true, kind: "user-jwt", bearer, identity: userTokenIdentity(bearer) };
     return { ok: true, kind: "pull-token", bearer, identity: pullTokenIdentity(worker), workerScoped: bearer.startsWith("wpt_") };
 }
-export function pullTokenIdentity(worker) {
+function pullTokenIdentity(worker) {
     return `pull-token:${worker ?? "global"}`;
 }
 const NONE = { ok: true, kind: "none", identity: "none" };
@@ -178,14 +179,28 @@ export function answerStillCurrent(source, usedIdentity) {
 }
 export function createIdentityBins(source, make) {
     const bins = new Map();
-    return () => {
-        const identity = credentialIdentityNow(source);
+    const binOf = (identity) => {
         if (bins.has(identity))
             return bins.get(identity);
         const made = make(pinCredential(source, identity));
         bins.set(identity, made);
         return made;
     };
+    return {
+        now: () => binOf(credentialIdentityNow(source)),
+        accounting: () => binOf(accountingIdentityOf(source)),
+    };
+}
+export function pinAccountingIdentity(source) {
+    const pins = currentExecutionPins();
+    if (pins === undefined || pins.has(source))
+        return;
+    const identity = credentialIdentityNow(source);
+    if (identity !== undefined)
+        pins.set(source, identity);
+}
+function accountingIdentityOf(source) {
+    return currentExecutionPins()?.get(source) ?? credentialIdentityNow(source);
 }
 function pinCredential(source, identity) {
     return {

package/dist/config-catalog.js

@@ -4,7 +4,8 @@ import { WEB_ADMIN_ENV, DOMAIN_SCHEMAS, buildRetiredEnvWire } from "@sema-agent/
 import { CENTER_CREDENTIAL_RENEW_LEAD_DEFAULT_MS, CENTER_CREDENTIAL_RENEW_LEAD_MAX_MS, CENTER_CREDENTIAL_RENEW_LEAD_MIN_MS } from "./center-credential-renewer.js";
 import { SANDBOX_IPV6_DEFAULT, SANDBOX_IPV6_WORDS } from "./sandbox-egress-policy.js";
 import { WORKSPACE_CACHE_DEFAULT, WORKSPACE_CACHE_MOUNT_DEFAULT, WORKSPACE_CACHE_SIZE_DEFAULT, WORKSPACE_CACHE_WORDS } from "./workspace-cache.js";
-import { WORKSPACE_PERSIST_DEFAULT, WORKSPACE_PERSIST_WORDS, WORKSPACE_SNAPSHOT_KEEP_DEFAULT, WORKSPACE_SNAPSHOT_KEEP_RANGE, WORKSPACE_SNAPSHOT_TIMEOUT_MS_DEFAULT, WORKSPACE_SNAPSHOT_TIMEOUT_MS_RANGE } from "./workspace-space.js";
+import { SESSION_SNAPSHOT_BUCKET_DEFAULT, WORKSPACE_SNAPSHOT_BUCKET_DEFAULT } from "./object-store-buckets.js";
+import { WORKSPACE_PERSIST_DEFAULT, WORKSPACE_PERSIST_WORDS, WORKSPACE_SNAPSHOT_KEEP_DEFAULT, WORKSPACE_SNAPSHOT_KEEP_RANGE, WORKSPACE_SNAPSHOT_PREFIX_DEFAULT, WORKSPACE_SNAPSHOT_TIMEOUT_MS_DEFAULT, WORKSPACE_SNAPSHOT_TIMEOUT_MS_RANGE } from "./workspace-space.js";
 import { APPROVAL_ASK_RETENTION_DEFAULT_MS, APPROVAL_ASK_RETENTION_FLOOR_MS } from "./approval-ask-retention.js";
 import { LIVENESS_MS_DEFAULT } from "./exec-bounds.js";
 import { THINKING_FORMATS } from "./model-compat.js";
@@ -60,8 +61,8 @@ export const CONFIG_CATALOG = [
     r("ADB_SERIAL", "orchestration", "string", "adb 车道目标设备 serial(REMOTE_EXEC=adb 的必需件,缺 ⇒ 拒启)"),
     r("AGENT_DATA_DIR", "store", "path", "本机数据根回落链一环(LOCAL_DATA_ROOT → CONFIG_LOCAL_DIR → AGENT_DATA_DIR → ~/.ai-agent);记忆引擎缺省根同链", { danger: DATA, derivedDefaultNote: "缺席 ⇒ 链上下一环,最终 ~/.ai-agent" }),
     r("ALLOW_UNAUTHED_WRITES", "auth", "boolean", "无 service token 时仍接受任务提交(本地开发逃生口;缺省 fail-closed 拒提交)", { staticDefault: "false", danger: SEC, configKey: "allowUnauthedWrites" }),
-    r("ANTHROPIC_API_KEY", "modelPlane", "secret", "Anthropic 协议路线的 x-api-key 凭据(与 AUTH_TOKEN 二选一,AUTH_TOKEN 优先;与 BASE_URL 同在时可推断 provider)", { danger: [...SEC, ...BILL] }),
-    r("ANTHROPIC_AUTH_TOKEN", "modelPlane", "secret", "Anthropic 兼容生态的 Bearer 凭据(设了则不发 x-api-key)", { danger: [...SEC, ...BILL] }),
+    r("ANTHROPIC_API_KEY", "modelPlane", "secret", "Anthropic 协议路线的 x-api-key 凭据(只发 x-api-key 头;与 ANTHROPIC_AUTH_TOKEN 互斥 —— 同设拒启,机读码 `config.anthropic_credential_conflict`;与 BASE_URL 同在时可推断 provider)", { danger: [...SEC, ...BILL] }),
+    r("ANTHROPIC_AUTH_TOKEN", "modelPlane", "secret", "Anthropic 兼容生态的 Bearer 凭据(只发 Authorization: Bearer 头;与 ANTHROPIC_API_KEY 互斥 —— 同设拒启,机读码 `config.anthropic_credential_conflict`)", { danger: [...SEC, ...BILL] }),
     r("ANTHROPIC_BASE_URL", "modelPlane", "url", "Anthropic 协议路线 base URL(与凭据同在且 MODEL_PROVIDER 未设 ⇒ 推断 provider=anthropic 并 boot notice;S-475:带 userinfo 拒启,机读码 `config.gateway_url_userinfo`;S-483:解析不动/不透明形拒启,机读码 `config.model_route_url_invalid`;S-514:带 `#fragment` 拒启,机读码 `config.model_route_url_fragment` —— fragment 从不上线,后缀会落进被丢弃的那一半)"),
     r("ANTHROPIC_CACHE_BREAKPOINTS", "modelPlane", "boolean", "Anthropic 路线 prompt-cache breakpoints 开关", { staticDefault: "true" }),
     r("ANTHROPIC_MAX_RETRIES", "modelPlane", "number", "Anthropic 路线 SDK 每次调用重试上限", { derivedDefaultNote: "缺席 ⇒ 不传引擎,core/SDK 默认当家" }),
@@ -236,10 +237,10 @@ export const CONFIG_CATALOG = [
     r("MAX_TASK_COST_USD", "limitsHttp", "number", "单任务成本天花板(0=关)", { staticDefault: "0", danger: BILL, configKey: "maxTaskCostUsd", center: cLimits("maxTaskCostUsd") }),
     r("MAX_TASK_TOKENS", "limitsHttp", "number", "单任务 token 天花板(per-slice 窗;0=关)", { staticDefault: "0", danger: BILL, configKey: "maxTaskTokens", center: cLimits("maxTaskTokens") }),
     r("MCP_ELICITATION_ENABLED", "approval", "boolean", "入站 MCP elicitation HITL(per-server opt-in 另有一道)", { staticDefault: "false", danger: SEC }),
-    r("MCP_ELICITATION_MAX_CONCURRENT", "approval", "number", "elicitation 每 run 并发帽", { derivedDefaultNote: "缺席 ⇒ core 出厂窗(DEFAULT_ELICITATION_THROTTLE)" }),
-    r("MCP_ELICITATION_MAX_TOTAL", "approval", "number", "elicitation 每 run 总量帽", { derivedDefaultNote: "缺席 ⇒ core 出厂窗" }),
-    r("MCP_ELICITATION_MIN_INTERVAL_MS", "approval", "number", "elicitation per-server 最小间隔(ms)", { derivedDefaultNote: "缺席 ⇒ core 出厂窗" }),
-    r("MCP_ELICITATION_TTL_MS", "approval", "number", "elicitation 无人应答释放窗(ms)", { derivedDefaultNote: "缺席 ⇒ core 出厂窗" }),
+    r("MCP_ELICITATION_MAX_CONCURRENT", "approval", "number", "elicitation 每 run 并发帽", { derivedDefaultNote: "缺席 ⇒ 本服务出厂窗(DEFAULT_ELICITATION_THROTTLE)" }),
+    r("MCP_ELICITATION_MAX_TOTAL", "approval", "number", "elicitation 每 run 总量帽", { derivedDefaultNote: "缺席 ⇒ 本服务出厂窗(DEFAULT_ELICITATION_THROTTLE)" }),
+    r("MCP_ELICITATION_MIN_INTERVAL_MS", "approval", "number", "elicitation per-server 最小间隔(ms)", { derivedDefaultNote: "缺席 ⇒ 本服务出厂窗(DEFAULT_ELICITATION_THROTTLE)" }),
+    r("MCP_ELICITATION_TTL_MS", "approval", "number", "elicitation 无人应答释放窗(ms)", { derivedDefaultNote: "缺席 ⇒ 本服务出厂窗(DEFAULT_ELICITATION_THROTTLE)" }),
     r("MEMORY_AUTO_CONSOLIDATION", "memory", "enum", "记忆自动整理部署席(on=每个建议任务后整库整理跑,记忆内容自动外流到整理模型;off=显式关,胜过引擎缺省;未设=读引擎具名缺省)", { enumValues: ["on", "off"], derivedDefaultNote: "缺席 ⇒ 引擎具名缺省(**本版装的引擎是开**)——不配不等于关;前置=整理阀门开着(MEMORY_CONSOLIDATION_DRIVER=on,或未设而出厂缺省派生成开)", danger: SEC, resolve: (c) => c.memoryConsolidationDriver.autoRunOnRecommendation, booleanEnum: { true: "on", false: "off" } }),
     r("MEMORY_CAPTURE_POLICY", "memory", "enum", "记忆 capture 姿态(open=声明按面值;governed=按 per-principal verdict;capture-required=恒采)", { enumValues: ["open", "governed", "capture-required"], staticDefault: "open", danger: SEC, configKey: "memoryCapturePolicy" }),
     r("MEMORY_CONSOLIDATION_DRIVER", "memory", "enum", "记忆折叠阀门(off=零装配零探针,两 admin 口 404 族;on=座解析 + 两 admin 口 + 引擎面整理两席)", { enumValues: ["on", "off"], derivedDefaultNote: "缺席 ⇒ 起服时派生:整理座不落主模型(MODEL_CHEAP_ID 在场且异于 MODEL_ID,或目录给 consolidate / summarize / flash 档位绑了别的模型)⇒ on;落主模型 ⇒ off + 起服 warn memory_consolidation_default_off_no_cheap_model;结构上跑不起来(无记忆引擎 / pg·tidb 记忆后端 / MEMORY_PROVENANCE=off)⇒ 恒 off 零提示。显式 on 而落主模型 ⇒ 照开 + warn memory_consolidation_on_main_model(按主模型计费)", danger: BILL, resolve: (_c, _env, boot) => (boot.memoryConsolidationValve === undefined ? undefined : boot.memoryConsolidationValve.enabled ? "on" : "off") }),
@@ -416,6 +417,7 @@ export const CONFIG_CATALOG = [
     r("SCHEDULER_SESSION_WAKEUP", "orchestration", "boolean", "session 唤醒 host-signal(无常驻 daemon 的壳注 false)", { staticDefault: "true", configKey: "schedulerSessionWakeup" }),
     r("SCHEDULER_STORE_PATH", "orchestration", "path", "scheduler 共享店路径(server 写者与壳 daemon 读者必须一致)", { derivedDefaultNote: "缺席 ⇒ SEMA_CONFIG_DIR(~/.sema)/scheduled_tasks.json", configKey: "schedulerStorePath" }),
     r("SCRATCHPAD_SWEEP_TTL_MS", "limitsHttp", "number", "per-session scratchpad 目录 sweep TTL(ms;≤0=关,<1m 夹到 1m 点名)", { staticDefault: String(7 * 24 * 60 * 60 * 1000), danger: DATA, configKey: "scratchpadSweepTtlMs" }),
+    r("SEALED_KEY_DIR", "store", "path", "模型钥匙保管目录(sealed 形的 X25519 钥匙对 `<publicKeyId>.json` 与停驻行封签子目录 `checkpoint-ctx-keys/`;文件 0600、目录 0700)。sealed 条目绑定钥匙身份(publicKeyId),共享同一份 config.d 的每台引擎都须持钥:数据根不同的多台引擎指向同一目录 ⇒ 同一把钥。绝对路径(相对路径拒启);设了 ⇒ 唯一保管目录,起服在它上面建不了保管店 ⇒ 拒启", { danger: [...SEC, ...DATA], derivedDefaultNote: "缺席 ⇒ <数据根>/sealed-key(建不了只告警,sealed 模型逐个 no_key_store)", configKey: "sealedKeyDir" }),
     r("SELECT_ENVIRONMENT_TOOL", "orchestration", "boolean", "SelectEnvironment 工具挂载(另需 k8s+镜像目录活链)", { staticDefault: "true", configKey: "selectEnvironmentTool" }),
     r("SELF_ORCHESTRATION_ENABLED", "orchestration", "boolean", "run_workflow 自编排(硬化 vm 沙箱)", { derivedDefaultNote: "posture 三态:缺席 = 单用户 ⇒ on / 多租户 ⇒ off", configKey: "selfOrchestrationEnabled" }),
     r("SELF_ORCHESTRATION_MODELS", "orchestration", "csv", "workflow agent({modelName}) 显式词表(恒赢;缺席单用户=目录键全集/多租户 fail-closed)", { configKey: "selfOrchestrationModels" }),
@@ -449,7 +451,7 @@ export const CONFIG_CATALOG = [
     r("SESSION_EVENTS_MAX_CONNS", "limitsHttp", "number", "session SSE 并发连接帽", { derivedDefaultNote: "缺席 ⇒ 256" }),
     r("SESSION_EVENTS_MAX_PROBES", "limitsHttp", "number", "session SSE 共享探针数帽", { derivedDefaultNote: "缺席 ⇒ 512" }),
     r("SESSION_EVENTS_WARM_MS", "limitsHttp", "number", "session SSE 温探针间隔(ms)", { derivedDefaultNote: "缺席 ⇒ 2000" }),
-    r("SESSION_SNAPSHOT_BUCKET", "store", "string", "快照 blob 桶(兼 SendUserFile 私桶)", { derivedDefaultNote: "缺席 ⇒ session-snapshots" }),
+    r("SESSION_SNAPSHOT_BUCKET", "store", "string", "快照 blob 桶(兼 SendUserFile 私桶)", { derivedDefaultNote: `缺席 ⇒ ${SESSION_SNAPSHOT_BUCKET_DEFAULT}` }),
     r("SESSION_SNAPSHOT_PREFIX", "store", "string", "快照 blob key 前缀", { derivedDefaultNote: "缺席 ⇒ blobs/(MinioBlobBackend 默认)" }),
     r("SESSION_SNAPSHOT_TTL_SEC", "store", "number", "快照 presign TTL(秒;坏值省略走默认,绝不 NaN 签名)", { derivedDefaultNote: "缺席 ⇒ 3600(MinioBlobBackend 默认)" }),
     r("SIGHUP_IDLE_GRACE_MS", "limitsHttp", "number", "SIGHUP 空闲关停窗(ms;共享引擎形防误杀)", { staticDefault: "120000", configKey: "sighupIdleGraceMs" }),
@@ -509,10 +511,10 @@ export const CONFIG_CATALOG = [
     r("WORKSPACE_CACHE_SIZE", "orchestration", "string", "k8s 构建缓存卷的大小(PVC 申请量,k8s quantity 形如 20Gi / 500Mi;形不合拒启;只在 WORKSPACE_CACHE=volume 时读)", { staticDefault: WORKSPACE_CACHE_SIZE_DEFAULT }),
     r("WORKSPACE_FILE_MAX_BYTES", "limitsHttp", "number", "已随 workspace 浏览面退役(S-15):值照常校验/落值,应用于空(重启也不生效)", { envTiming: "inert", configKey: "workspaceFileMaxBytes", center: cLimits("workspaceFileMaxBytes", { timing: "inert" }) }),
     r("WORKSPACE_PERSIST", "orchestration", "enum", "k8s 工作区跨轮保留:space(缺省)= 每条 run 结束把 /workspace 快照进本会话住客的空间、下一条 run 开始恢复最近一份(上一条还在保存 ⇒ 下一条等它存完,最多等一个上传时限,见 USAGE §9.3b);off = 每轮新建。space(含缺省)却没配快照存储(MINIO_* 三键)⇒ 不生效,起服一行 workspace_persist_unavailable 点名缺键;前提:会话店读得出会话住客(local / SQL 会话店),内存会话店 × space(含缺省,且配了快照存储)⇒ 拒启(出路 WORKSPACE_PERSIST=off);词表外拒启", { enumValues: WORKSPACE_PERSIST_WORDS, staticDefault: WORKSPACE_PERSIST_DEFAULT, danger: DATA }),
-    r("WORKSPACE_SNAPSHOT_BUCKET", "orchestration", "string", "k8s 工作区快照桶", { derivedDefaultNote: "缺席 ⇒ workspaces" }),
+    r("WORKSPACE_SNAPSHOT_BUCKET", "orchestration", "string", "k8s 工作区快照桶(server 不建桶:配了对象存储时起服核它在不在,缺〔404 + NoSuchBucket〕⇒ 窗内重试、到窗拒启并点名本旋钮;证明不了〔连不上 / 403 / 5xx〕不拒,走 fail-open 兜底口;运行期读 latest 得 NoSuchBucket ⇒ 该 run 连沙箱失败,不读成空间头一回)", { derivedDefaultNote: `缺席 ⇒ ${WORKSPACE_SNAPSHOT_BUCKET_DEFAULT}` }),
     r("WORKSPACE_SNAPSHOT_EXCLUDE", "orchestration", "csv", "k8s 工作区快照的排除表(相对工作区根的 tar 排除模式,逗号分隔,如 build,.gradle,node_modules/.cache;每项一个 --exclude=./<项>,run 末快照与停驻挂起同一张表 —— 排除的目录恢复后不在,构建产物本就可再生;项形闭:相对路径段,不含 .. / 前导 / / 空白 / 引号,整体通配(只由 * / ? 组成的项,* 会让快照一个顶层项都不剩)也拒,坏项拒启并点名第几项;不读项目 .gitignore)", { derivedDefaultNote: "缺席 = 不排除(上传命令与旧版逐字同)" }),
     r("WORKSPACE_SNAPSHOT_KEEP", "orchestration", "number", `k8s 工作区每个空间(会话住客)保留的快照份数(整数 [${WORKSPACE_SNAPSHOT_KEEP_RANGE.min}, ${WORKSPACE_SNAPSHOT_KEEP_RANGE.max}];写新快照后删最老的;域外拒启)`, { staticDefault: String(WORKSPACE_SNAPSHOT_KEEP_DEFAULT), danger: DATA }),
-    r("WORKSPACE_SNAPSHOT_PREFIX", "orchestration", "string", "k8s 工作区快照 key 前缀"),
+    r("WORKSPACE_SNAPSHOT_PREFIX", "orchestration", "string", "k8s 工作区快照 key 前缀:`/` 分隔的一段或多段普通 key 段(kata、libA/ws;每段以字母或数字开头,其后字母数字 . _ -);空段 / . / .. / 前导或尾随 / / 其它字符 ⇒ 拒启并点名第几段(config.workspace_snapshot_prefix_invalid)", { derivedDefaultNote: `缺席 ⇒ ${WORKSPACE_SNAPSHOT_PREFIX_DEFAULT}` }),
     r("WORKSPACE_SNAPSHOT_TIMEOUT_MS", "orchestration", "number", `k8s 工作区快照的时限(毫秒,整数 [${WORKSPACE_SNAPSHOT_TIMEOUT_MS_RANGE.min}, ${WORKSPACE_SNAPSHOT_TIMEOUT_MS_RANGE.max}];域外拒启):一个数管四处 —— run 末上传与连沙箱时恢复的墙钟上界、空间结束时回收座一次调用的绝对截止(卷与对象都在内)、下一条 run 等上一条存完的最长等待(提交围栏的存活上界);大文件读写的墙钟也是它。大工作区(构建目录 GB 级)撞上界 ⇒ 调大它或配 WORKSPACE_SNAPSHOT_EXCLUDE`, { staticDefault: String(WORKSPACE_SNAPSHOT_TIMEOUT_MS_DEFAULT) }),
     r("WORKSPACE_SNAPSHOT_TTL_SEC", "orchestration", "number", "k8s 工作区快照 presign TTL(秒)"),
     r("WORKTREE_ALLOWED_ROOTS", "orchestration", "csv", "worktree 隔离纵深白名单(缺省 = [repoRoot])", { danger: SEC }),

package/dist/config-d-migration.js

@@ -19,7 +19,7 @@ export async function migrateLocalConfigDirectory(root) {
         return { ...(await migrateConfigDirectory(dir, { documents: LOCAL_READER_DOCUMENTS, io: nodeConfigDirectoryIo })), dir };
     }
     catch (err) {
-        return { kind: "threw", dir, reason: `${err instanceof Error ? err.message : String(err)}${errnoOf(err) !== undefined ? ` (${errnoOf(err)})` : ""}` };
+        return { kind: "threw", dir, reason: err instanceof Error ? err.message : String(err) };
     }
 }
 export function logConfigDirMigration(log, m) {

package/dist/config-invariants.d.ts

@@ -34,7 +34,7 @@ import type { ServiceConfigFlat } from "./config-types.js";
  */
 export declare const LIVENESS_HEARTBEAT_MS = 30000;
 /** 闭集:新增一条不变量必须在这里加词(拼错 = 编译红,而不是运行期悄悄不判)。 */
-export type CrossInvariantId = "run-stale-heartbeat" | "bind-posture" | "bake-runner-credential" | "direct-door-anchors" | "operator-principals-required" | "operator-single-user" | "bake-operator-principals" | "sensitive-write-patterns" | "leader-host-lane" | "multi-tenant-shared-lane" | "leader-durable-store" | "device-durable-store" | "device-durable-approval" | "model-provider-word" | "gateway-url-userinfo" | "model-route-endpoint" | "default-model-resolvable" | "refused-names-not-minted" | "require-execution-lane" | "center-one-identity" | "workflow-park-decision-domain";
+export type CrossInvariantId = "run-stale-heartbeat" | "bind-posture" | "bake-runner-credential" | "direct-door-anchors" | "operator-principals-required" | "operator-single-user" | "bake-operator-principals" | "sensitive-write-patterns" | "leader-host-lane" | "multi-tenant-shared-lane" | "leader-durable-store" | "device-durable-store" | "device-durable-approval" | "model-provider-word" | "gateway-url-userinfo" | "anthropic-credential-exclusive" | "model-route-endpoint" | "default-model-resolvable" | "refused-names-not-minted" | "require-execution-lane" | "center-one-identity" | "workflow-park-decision-domain";
 /** 表读的键集(取自平铺配置型 ⇒ 键名/类型永不与真配置漂)。 */
 export type CrossInvariantView = Readonly<Pick<ServiceConfigFlat, "runStaleSec" | "authToken" | "authTokens" | "allowUnauthedWrites" | "imageBakes" | "directApprovalDoor" | "durableApproval" | "approvalHmacKeys" | "principalJwtPubkeys" | "principalJwtIss" | "principalJwtAud" | "requirePrincipal" | "operatorPrincipals" | "operatorSingleUser" | "sensitiveWritePatterns" | "leaderEnabled" | "selfOrchestrationEnabled" | "workflowRunStoreBackend" | "remoteExec" | "requireExecutionLane" | "dbBackend" | "tidb" | "pg" | "envModel" | "gatewayBaseUrl" | "gatewayFallbackUrls" | "anthropic" | "models" | "modelRefusals" | "tiers" | "authBridgeIssuer" | "webAdmin">>;
 export interface CrossInvariantInput {

package/dist/config-invariants.js

@@ -1,6 +1,7 @@
 import { assertGuardPatternsUsable } from "./deployment-governance.js";
 import { modelProviderRefusal } from "./model-provider.js";
 import { modelRouteUrlRefusal } from "./model-route-url.js";
+import { anthropicCredentialRefusal } from "./model-route-gap.js";
 import { modelRouteEndpointRefusal } from "./model-route-endpoint.js";
 import { defaultModelRefusal, refusedNameMintedRefusal } from "./model-entry-refusal.js";
 import { WEB_ADMIN_ENV, httpUrlFlaws } from "@sema-agent/settings-schema";
@@ -261,6 +262,13 @@ export const CONFIG_CROSS_INVARIANTS = [
                 .find((r) => r !== undefined) ??
             modelRouteUrlRefusal("ANTHROPIC_BASE_URL", next.anthropic?.baseUrl ?? "", "ANTHROPIC_API_KEY"),
     },
+    {
+        id: "anthropic-credential-exclusive",
+        keys: ["anthropic"],
+        restartReason: "anthropic-credential",
+        bootAnchor: { file: "src/config.ts", marker: "CROSS-INVARIANT:anthropic-credential-exclusive" },
+        check: ({ next }) => (next.anthropic === undefined ? undefined : anthropicCredentialRefusal(next.anthropic)),
+    },
     {
         id: "model-route-endpoint",
         keys: ["gatewayBaseUrl", "gatewayFallbackUrls", "anthropic", "models"],

package/dist/config-lkg.d.ts

@@ -82,42 +82,4 @@ export declare function migrateLkgPayload(effective: Record<string, unknown>): {
 } | {
     refused: string;
 };
-/** 7.98.0 及以前的默认 LKG 路径(按当时的写法逐字保留 —— 这是盘上已有文件的名字,不是现行分箱规则)。 */
-export declare function legacyV1LkgPath(config: {
-    readonly agentConfigDir?: string;
-}, worker: string | undefined): string;
-export type LegacyLkgMigration = {
-    readonly outcome: "none";
-}
-/** `retireError`:新箱已写好,只是旧文件没退役成(改名 / 留副本失败)—— 只响一行,不影响已写好的箱。 */
- | {
-    readonly outcome: "migrated";
-    readonly from: string;
-    readonly retiredTo: string;
-    readonly retireError?: string;
-} | {
-    readonly outcome: "not-migrated";
-    readonly path: string;
-    readonly reason: string;
-};
-/**
- * formatVersion 1 LKG 的一次性迁移(规则一句:**身份推得出来才迁,推不出来就响亮拒**)。判序:
- *  1. `legacyPath` ≠ `binPath` 时**先看本身份的箱**:箱里已有文件 ⇒ `none`(箱自己说话,旧文件是好是坏都不再相关,
- *     不许一个坏旧文件把有效的箱挡成 env 兜底 —— 7.99.0 修复验证 N4)。箱查不了(非 ENOENT)⇒ 响亮拒。
- *  2. 旧文件没有(ENOENT / ENOTDIR)或不是 formatVersion 1 信封 ⇒ `none`。旧默认路径上却读不了 / 不是 JSON ⇒
- *     `not-migrated`(响亮,不当它不存在);`CONFIG_LKG_PATH` 同路径时这两形由 loadLkg 自己报(不重复打一行)。
- *  3. v1 信封只记 worker:唯一推得出身份的形是拉取令牌(身份 = worker,`pullTokenIdentity`)。此刻身份正是它、worker
- *     对得上、载荷过 {@link migrateLkgPayload}(迁成 11 的形;迁不动 ⇒ 响亮拒、不写箱)与 {@link lkgPayloadJudged} ⇒ **先写后退役**(修复验证 N9):先按新格式把它写进 `binPath`(原子写,
- *     0600),写成了才把旧文件改名 `<legacyPath>.migrated-v1`。写失败 ⇒ `not-migrated`,旧文件原样留在原位,下一次
- *     照常可迁;写成之后改名失败 ⇒ 仍是 `migrated`(`retireError` 响一行),箱已在 ⇒ 下一次按判序 1 不再看旧文件。
- *     同路径(`CONFIG_LKG_PATH`)时新箱的写入会原子替换旧文件本身,所以旧字节在写之前留一份 `.migrated-v1` 副本
- *     (副本失败同样只进 `retireError`:载荷正要写进新箱,不是丢数据)。
- *  4. 其余一律 `not-migrated`:拒因点名旧文件路径与出路(删掉它;中心下一份干净候选会写本身份自己的 LKG),不改名、不读回。
- */
-export declare function migrateV1Lkg(o: {
-    legacyPath: string;
-    binPath: string;
-    worker: string | undefined;
-    identity: string;
-}): Promise<LegacyLkgMigration>;
 //# sourceMappingURL=config-lkg.d.ts.map

package/dist/config-lkg.js

@@ -4,7 +4,7 @@ import { formatConfigPath } from "@sema-agent/settings-schema";
 import { join, dirname, resolve } from "node:path";
 import { randomBytes } from "node:crypto";
 import { judgeConfigCandidate } from "./web-admin-client/candidate-gate.js";
-import { centerStateBin, pullTokenIdentity } from "./center-credential.js";
+import { centerStateBin } from "./center-credential.js";
 import { configRootOf } from "./sema-config-dir.js";
 export function defaultSkillCacheDir(config) {
     return join(configRootOf(config), "skill-cache");
@@ -167,86 +167,4 @@ function lkgPayloadShapeProblem(effective, etag) {
     }
     return undefined;
 }
-export function legacyV1LkgPath(config, worker) {
-    const key = (worker ?? "global").replace(/[^a-zA-Z0-9._-]/g, "_").slice(0, 64);
-    return join(configRootOf(config), `config-lkg-${key}.json`);
-}
-export async function migrateV1Lkg(o) {
-    const refuse = (why) => ({
-        outcome: "not-migrated",
-        path: o.legacyPath,
-        reason: `pre-identity LKG (formatVersion 1) at ${o.legacyPath} not migrated: ${why}. Way out: delete that file — the next clean candidate from the center writes this credential identity's own LKG (${o.binPath})`,
-    });
-    const sameFile = o.legacyPath === o.binPath;
-    if (!sameFile) {
-        try {
-            await fs.access(o.binPath);
-            return { outcome: "none" };
-        }
-        catch (err) {
-            const code = errnoOf(err);
-            if (code !== "ENOENT")
-                return refuse(`this credential identity's bin ${o.binPath} could not be checked (${code})`);
-        }
-    }
-    let text;
-    try {
-        text = await fs.readFile(o.legacyPath, "utf8");
-    }
-    catch (err) {
-        const code = errnoOf(err);
-        return code === "ENOENT" || code === "ENOTDIR" || sameFile ? { outcome: "none" } : refuse(`it could not be read (${code})`);
-    }
-    let parsed;
-    try {
-        parsed = JSON.parse(text);
-    }
-    catch (err) {
-        return sameFile ? { outcome: "none" } : refuse(`it is not valid JSON (${err instanceof Error ? err.name : "parse error"})`);
-    }
-    if (parsed === null || typeof parsed !== "object" || !("formatVersion" in parsed) || parsed.formatVersion !== 1)
-        return { outcome: "none" };
-    const v1 = parsed;
-    if (v1.worker !== (o.worker ?? "global"))
-        return refuse(`it belongs to worker ${JSON.stringify(v1.worker)}`);
-    if (o.identity !== pullTokenIdentity(o.worker)) {
-        return refuse("its envelope records only the worker, and only a pull-token credential's identity (= the worker) can be derived from that — the current credential is not this worker's pull token, so the file cannot prove whose credential fetched it");
-    }
-    if (v1.effective === null || typeof v1.effective !== "object" || Array.isArray(v1.effective))
-        return refuse("its payload is unusable (bad effective)");
-    const payload = migrateLkgPayload(v1.effective);
-    if ("refused" in payload)
-        return refuse(`its payload cannot be migrated to the current settings form (${payload.refused})`);
-    const judged = lkgPayloadJudged(payload.effective, v1.etag);
-    if ("problem" in judged)
-        return refuse(`its payload is unusable (${judged.problem})`);
-    const retiredTo = `${o.legacyPath}.migrated-v1`;
-    let retireError;
-    if (sameFile) {
-        try {
-            await fs.copyFile(o.legacyPath, retiredTo);
-        }
-        catch (err) {
-            retireError = `the formatVersion 1 bytes could not be kept as ${retiredTo} (${errnoOf(err)})`;
-        }
-    }
-    try {
-        await saveLkg(o.binPath, o.worker, o.identity, payload.effective, undefined);
-    }
-    catch (err) {
-        return refuse(`writing it into this credential identity's bin failed (${String(err)}) — the old file is left in place and the migration retries on the next LKG read`);
-    }
-    if (!sameFile) {
-        try {
-            await fs.rename(o.legacyPath, retiredTo);
-        }
-        catch (err) {
-            retireError = `the old file could not be renamed to ${retiredTo} (${errnoOf(err)}) — harmless: the bin now exists, so the old file is never read again`;
-        }
-    }
-    return { outcome: "migrated", from: o.legacyPath, retiredTo, ...(retireError !== undefined ? { retireError } : {}) };
-}
-function errnoOf(err) {
-    return err instanceof Error && "code" in err && typeof err.code === "string" ? err.code : "unknown";
-}
 //# sourceMappingURL=config-lkg.js.map

package/dist/config-types.d.ts

@@ -518,11 +518,12 @@ export interface ServiceConfigFlat {
     /** Optional Anthropic Messages API ROUTE (cloud). Selected for models whose `provider` is
      *  "anthropic" (routing is by model.provider); the local gateway serves every other provider. */
     anthropic?: {
-        /** `x-api-key` auth. OPTIONAL since the Anthropic-compatible Bearer path: a Bearer-only
-         *  provider may auth by `authToken` alone. When BOTH are set, authToken wins. */
+        /** `ANTHROPIC_API_KEY` —— sent as the `x-api-key` header ONLY. One name, one header ([ref]): mutually exclusive with
+         *  `authToken` — both set refuses boot (`loadConfig`, invariant `anthropic-credential-exclusive`) and refuses brain construction
+         *  for an embedder-built config. Which header rides is `judgeAnthropicCredential`'s answer (`model-route-gap.ts`). */
         apiKey?: string;
         /** Anthropic-compatible-ecosystem `ANTHROPIC_AUTH_TOKEN` (many such providers use Bearer, not x-api-key):
-         *  sent as `Authorization: Bearer <token>`; when set, `apiKey` is NOT sent (二选一, AUTH_TOKEN priority). */
+         *  sent as `Authorization: Bearer <token>` ONLY. Mutually exclusive with `apiKey` (see there) — no precedence arm. */
         authToken?: string;
         /** Default https://api.anthropic.com (overridden by model.baseUrl). */
         baseUrl?: string;
@@ -1091,6 +1092,13 @@ export interface ServiceConfigFlat {
      *  service and a run-local on the same box agree on one data dir (boot-locked single-instance). Only the
      *  `local` backend reads it. */
     localDataRoot?: string;
+    /**
+     * `SEALED_KEY_DIR` —— 模型钥匙保管目录(sealed 形的 X25519 钥匙对 `<publicKeyId>.json`,连同停驻行封签那一域的子目录 `checkpoint-ctx-keys/`)。
+     * **缺席不铸键** ⇒ 保管目录 = `<localDataRoot>/sealed-key`(今天的行为;建不了只是一行 warn,sealed 模型逐个 `no_key_store`)。
+     * 给了 ⇒ 绝对路径(相对路径 loadConfig 拒启),该目录是**唯一**保管目录;起服在它上面建不了保管店 ⇒ 拒启(fail-closed:运维点名了目录)。
+     * 谁需要:读同一份 `config.d` 而数据根不同的多台引擎(终端 × 桌面端默认形)—— sealed 条目绑定的是钥匙身份(`publicKeyId` → 钥匙对),指到同一目录 ⇒ 同一把钥。
+     */
+    sealedKeyDir?: string;
     /**
      * [ref] 件B(`RUN_STORE_STRICT_HYDRATE`,普查表第 29 行的**终局格**)—— file 后端的**可选** fail-closed
      * 启动门。`true` ⇒ `FileRunStore.hydrate()` 列不出 `runs/` 时**拒启**(error 级遗言带绝对路径 + 异常
@@ -2255,7 +2263,7 @@ export interface ServiceConfigFlat {
     configLocalOwnerUid?: number;
 }
 /** 组:store(持久化)—— DB 引擎三态、session 后端、SQL coords、快照 BLOB / SendUserFile 对象存储。 */
-export type ServiceStoreConfig = Pick<ServiceConfigFlat, "sessionBackend" | "sessionCacheTtlSec" | "storeProbeIntervalMs" | "storeLockWaitMs" | "dbBackend" | "dbBackendExplicit" | "localDataRoot" | "runStoreStrictHydrate" | "tidb" | "pg" | "dbQueryTimeoutMs" | "snapshotBlobStore" | "snapshotBlobSqlMaxBytes" | "snapshotBlobAllowSql" | "fileHistory" | "fileHistoryCapture" | "sendUserFile">;
+export type ServiceStoreConfig = Pick<ServiceConfigFlat, "sessionBackend" | "sessionCacheTtlSec" | "storeProbeIntervalMs" | "storeLockWaitMs" | "dbBackend" | "dbBackendExplicit" | "localDataRoot" | "sealedKeyDir" | "runStoreStrictHydrate" | "tidb" | "pg" | "dbQueryTimeoutMs" | "snapshotBlobStore" | "snapshotBlobSqlMaxBytes" | "snapshotBlobAllowSql" | "fileHistory" | "fileHistoryCapture" | "sendUserFile">;
 /** 组:modelPlane(模型面)—— 网关坐标、Anthropic 路线、韧性旋钮、主/廉价 model entry、role 表、降级梯。 */
 export type ServiceModelPlaneConfig = Pick<ServiceConfigFlat, "gatewayBaseUrl" | "gatewayApiKey" | "gatewayFallbackUrls" | "gatewayMaxRetries" | "anthropic" | "resilience" | "model" | "envModel" | "models" | "modelApiKeyEnv" | "modelApiKeys" | "modelRefusals" | "droppedCatalogEntries" | "modelQuotaWeights" | "tiers" | "projects" | "roles" | "atMention" | "cascadeLadder" | "degrade">;
 /** 组:approval(审批 / HITL 门)。`directDoorActive` 无 env 解析腿(装配层三域合取的产物),但语义上