@sema-agent/server 7.137.0 → 7.139.0

package/dist/config-invariants.d.ts

@@ -25,7 +25,7 @@
  * 依赖纪律:本文件是**叶**(只 type-import config-types + 值引 deployment-governance 的守卫集编译门),
  * 不引 config.ts,故 config.ts / runs.ts 都可以安全引它。
  */
-import type { ServiceConfigFlat } from "./config-types.js";
+import type { ConfigProviderWord, ServiceConfigFlat } from "./config-types.js";
 /**
  * 活体心跳周期(ms)——`runs.ts` 的 `HEARTBEAT_MS` 就是它(那边 re-export,单源在此)。
  *
@@ -34,9 +34,9 @@ import type { ServiceConfigFlat } from "./config-types.js";
  */
 export declare const LIVENESS_HEARTBEAT_MS = 30000;
 /** 闭集:新增一条不变量必须在这里加词(拼错 = 编译红,而不是运行期悄悄不判)。 */
-export type CrossInvariantId = "run-stale-heartbeat" | "bind-posture" | "bake-runner-credential" | "direct-door-anchors" | "operator-principals-required" | "operator-single-user" | "bake-operator-principals" | "sensitive-write-patterns" | "leader-host-lane" | "multi-tenant-shared-lane" | "leader-durable-store" | "device-durable-store" | "device-durable-approval" | "model-provider-word" | "gateway-url-userinfo" | "anthropic-credential-exclusive" | "model-route-endpoint" | "default-model-resolvable" | "refused-names-not-minted" | "require-execution-lane" | "center-one-identity" | "workflow-park-decision-domain";
+export type CrossInvariantId = "run-stale-heartbeat" | "bind-posture" | "bake-runner-credential" | "direct-door-anchors" | "operator-principals-required" | "operator-single-user" | "bake-operator-principals" | "sensitive-write-patterns" | "leader-host-lane" | "multi-tenant-shared-lane" | "leader-durable-store" | "device-durable-store" | "device-durable-approval" | "model-provider-word" | "gateway-url-userinfo" | "anthropic-credential-exclusive" | "model-route-endpoint" | "default-model-resolvable" | "refused-names-not-minted" | "require-execution-lane" | "center-one-identity" | "workflow-park-decision-domain" | "remote-config-provider-url" | "retention-lane-complete";
 /** 表读的键集(取自平铺配置型 ⇒ 键名/类型永不与真配置漂)。 */
-export type CrossInvariantView = Readonly<Pick<ServiceConfigFlat, "runStaleSec" | "authToken" | "authTokens" | "allowUnauthedWrites" | "imageBakes" | "directApprovalDoor" | "durableApproval" | "approvalHmacKeys" | "principalJwtPubkeys" | "principalJwtIss" | "principalJwtAud" | "requirePrincipal" | "operatorPrincipals" | "operatorSingleUser" | "sensitiveWritePatterns" | "leaderEnabled" | "selfOrchestrationEnabled" | "workflowRunStoreBackend" | "remoteExec" | "requireExecutionLane" | "dbBackend" | "tidb" | "pg" | "envModel" | "gatewayBaseUrl" | "gatewayFallbackUrls" | "anthropic" | "models" | "modelRefusals" | "tiers" | "authBridgeIssuer" | "webAdmin">>;
+export type CrossInvariantView = Readonly<Pick<ServiceConfigFlat, "runStaleSec" | "authToken" | "authTokens" | "allowUnauthedWrites" | "imageBakes" | "directApprovalDoor" | "durableApproval" | "approvalHmacKeys" | "principalJwtPubkeys" | "principalJwtIss" | "principalJwtAud" | "requirePrincipal" | "operatorPrincipals" | "operatorSingleUser" | "sensitiveWritePatterns" | "leaderEnabled" | "selfOrchestrationEnabled" | "workflowRunStoreBackend" | "remoteExec" | "requireExecutionLane" | "dbBackend" | "tidb" | "pg" | "envModel" | "gatewayBaseUrl" | "gatewayFallbackUrls" | "anthropic" | "models" | "modelRefusals" | "tiers" | "authBridgeIssuer" | "webAdmin" | "configProvider" | "retentionPolicy" | "retentionSweep">>;
 export interface CrossInvariantInput {
     /** 现役配置(boot 期 = 候选自身)。 */
     readonly live: CrossInvariantView;
@@ -107,6 +107,26 @@ export declare function workflowParkDecisionDomainRefusal(v: Pick<CrossInvariant
  * 标准部署形。没有 web 基址 ⇒ 无可互证,过。
  */
 export declare function centerIdentityRefusal(v: Pick<CrossInvariantView, "authBridgeIssuer" | "webAdmin">): string | undefined;
+/**
+ * `remote-config-provider-url` —— **配置源的词要么兑现、要么拒,从不被读成另一种源**。`CONFIG_PROVIDER=remote` 说的是「这台 worker 的配置来自中心」,
+ * 中心就是 `WEB_ADMIN_ENV.url` 那一只;没有它,这句话无处兑现 —— 不建配置源(服务端)或读本地 `config.d`(run-local)都是把它读成了另一种源,
+ * 多租部署的 entitlement / 模型目录 / 治理整份缺席而进程照起。判据与拒句的唯一属主;配置源判官(`config-provider.ts` 的 `configSourceKind`)
+ * 收到这一组合时抛的也是这一句(到得了那里 = 有人绕过了 `loadConfig`)。状态型:两只键都只来自 env、运行期无写点 ⇒ 热路径上恒与 boot 同答。
+ */
+export declare function remoteConfigProviderUrlRefusal(v: {
+    readonly configProvider?: ConfigProviderWord | undefined;
+    readonly webAdmin?: unknown;
+}): string | undefined;
+/**
+ * `retention-lane-complete` —— **被要的扫车道必须齐**。要车道的旋钮有两根:节律(`RETENTION_SWEEP_INTERVAL_SEC > 0`)与灰度档
+ * `RETENTION_MODE=enforce`(「按策略删」);齐 = 有视界(`RETENTION_MAX_AGE_DAYS`,算 cutoff)且节律 > 0(车道真在跑)。缺一 ⇒ 拒:
+ * enforce 而车道不跑 / 没有视界,运维以为在删而什么都没删(能力位 `retention` 只在车道齐时在场);节律在而没有视界,车道每拍枚举域、什么都算不出。
+ * 一条规则两种要法,拒句按要法说出路(enforce:补缺的键,或改回 audit-only —— 节律在而天数缺时连节律一起设 0;只给节律:补天数或节律设 0),
+ * 每条出路照做都落在本律之内(起得来)。audit-only 下「天数在、车道关」不在律内 ——
+ * 那只是一份声明,起服 warn `retention_policy_not_executed` 说出来(`boot/governance-seams.ts`)。车道的**接线**(执行器 / 方法 / 店声明)不是配置事实,
+ * 留在扫车道自持门(`boot/retention-lane.ts`)。状态型:三键都只来自 env、运行期无写点 ⇒ 热路径上恒与 boot 同答。
+ */
+export declare function retentionLaneRefusal(v: Pick<CrossInvariantView, "retentionPolicy" | "retentionSweep">): string | undefined;
 export declare const CONFIG_CROSS_INVARIANTS: readonly CrossInvariant[];
 /**
  * 按 id 取**一条**([ref]②:boot 面的单源化出口)。

package/dist/config-invariants.js

@@ -103,6 +103,34 @@ export function centerIdentityRefusal(v) {
         `the same web-admin: same host and port (http and https on one host count as one). Set ${WEB_ADMIN_ENV.webUrl} to that web-admin's console, set ` +
         `AUTH_BRIDGE_ISSUER to the web-admin's public origin, or unset ${WEB_ADMIN_ENV.webUrl}. Refusing to boot.`);
 }
+export function remoteConfigProviderUrlRefusal(v) {
+    return v.configProvider === "remote" && v.webAdmin === undefined
+        ? `CONFIG_PROVIDER=remote names the web-admin center as this worker's config source, but ${WEB_ADMIN_ENV.url} is not set — there is no center to pull ` +
+            "from, so this worker would run without the center's configuration (tenant entitlements, model catalog, governance) while it is declared centrally managed. " +
+            `Set ${WEB_ADMIN_ENV.url} to the center's base URL, or set CONFIG_PROVIDER=local to read the local config directory (unset CONFIG_PROVIDER for an env-only worker). ` +
+            "Refusing to boot."
+        : undefined;
+}
+export function retentionLaneRefusal(v) {
+    const { mode, intervalSec } = v.retentionSweep;
+    const cadence = intervalSec > 0;
+    const horizon = v.retentionPolicy !== undefined;
+    if ((mode !== "enforce" && !cadence) || (cadence && horizon))
+        return undefined;
+    const gaps = [
+        ...(horizon ? [] : ["RETENTION_MAX_AGE_DAYS is unset (no horizon to compute a cutoff from)"]),
+        ...(cadence ? [] : ["RETENTION_SWEEP_INTERVAL_SEC is unset or 0 (the sweep lane does not run)"]),
+    ].join(" and ");
+    if (mode === "enforce") {
+        const needs = [...(horizon ? [] : ["RETENTION_MAX_AGE_DAYS"]), ...(cadence ? [] : ["RETENTION_SWEEP_INTERVAL_SEC above 0"])].join(" and ");
+        const declareOnly = cadence && !horizon ? "set RETENTION_MODE=audit-only (or unset it) and RETENTION_SWEEP_INTERVAL_SEC=0" : "set RETENTION_MODE=audit-only (or unset it)";
+        return (`RETENTION_MODE=enforce declares that the retention sweep lane deletes data older than the policy horizon, but ${gaps} — nothing would be deleted ` +
+            `while the deployment declares that it deletes. Set ${needs} (the sweep lane runs on a SQL backend), or ${declareOnly} ` +
+            "if this deployment is not to delete. Refusing to boot.");
+    }
+    return (`RETENTION_SWEEP_INTERVAL_SEC=${intervalSec} arms the retention sweep lane, but ${gaps} — the lane would enumerate domains every tick and compute nothing. ` +
+        "Set RETENTION_MAX_AGE_DAYS, or set RETENTION_SWEEP_INTERVAL_SEC=0 to leave the lane off. Refusing to boot.");
+}
 export const CONFIG_CROSS_INVARIANTS = [
     {
         id: "run-stale-heartbeat",
@@ -297,6 +325,20 @@ export const CONFIG_CROSS_INVARIANTS = [
         bootAnchor: { file: "src/config.ts", marker: "CROSS-INVARIANT:center-one-identity" },
         check: ({ next }) => centerIdentityRefusal(next),
     },
+    {
+        id: "remote-config-provider-url",
+        keys: ["configProvider", "webAdmin"],
+        restartReason: "config-source",
+        bootAnchor: { file: "src/config.ts", marker: "CROSS-INVARIANT:remote-config-provider-url" },
+        check: ({ next }) => remoteConfigProviderUrlRefusal(next),
+    },
+    {
+        id: "retention-lane-complete",
+        keys: ["retentionPolicy", "retentionSweep"],
+        restartReason: "retention-lane",
+        bootAnchor: { file: "src/config.ts", marker: "CROSS-INVARIANT:retention-lane-complete" },
+        check: ({ next }) => retentionLaneRefusal(next),
+    },
 ];
 export function crossInvariant(id) {
     const inv = CONFIG_CROSS_INVARIANTS.find((i) => i.id === id);

package/dist/config-provider.d.ts

@@ -120,12 +120,12 @@ export interface ConfigProviderInput {
     };
     /** `CONFIG_PROVIDER` —— 闭集 `local` | `remote` | 缺席([ref]:词表属主 `CONFIG_PROVIDER_WORDS`,认不出的词在
      *  `loadConfig` 就拒启,本层**不可能**再收到第三个词 —— 修前那条「认不出 ⇒ 当 local + warn」的臂随之删除)。
-     *  `local` forces the local backend; `remote` selects the center (falls through to local if no URL). */
+     *  读法只有 {@link configSourceKind} 一只:`local` 建本地源;`remote` 建中心源(没有 `webAdmin` ⇒ 抛,起服本应已拒);缺席 ⇒ 有中心建中心源、没有 ⇒ 抛(纯 env 部署不建配置源)。 */
     provider?: ConfigProviderWord;
     /** 本地配置源的根(持有 `config.d/<domain>.json`;FileConfigStore 吃根、读 `<root>/config.d`)。🔴 [ref]:**必填**,
      *  值恒来自 {@link configLocalRoot}(入口算一次,工厂与执行车道合成步读同一个)—— 修前是可选、缺席回落
      *  `process.cwd()`,而工厂只在 `CONFIG_PROVIDER === "local"` 字面上递它 ⇒ 另一条走到 local 的路上配置源读 cwd、
-     *  合成步读 localRoot,两个根分家。一个远程源也收它:`remote` 而无中心 URL 的形照样落回 local。 */
+     *  合成步读 localRoot,两个根分家。远程源也收它(入参形一份),只有本地源读它。 */
     localDir: string;
     /** [ref]:本地配置源的属主声明(`CONFIG_LOCAL_OWNER_UID`,配置席 `configLocalOwnerUid`)—— 每拍读 `config.d` 之前的目录信任判官与起服那一次判同一个值。
      *  **必填**(值可以是 `undefined` = 没声明):两个生产构造点都必须递,漏递 = 起服判过、每拍却按「没声明」判 ⇒ 每一拍都拒(tsc 在这里挡)。 */
@@ -186,15 +186,11 @@ export declare class LocalConfigProvider implements ConfigProvider {
  */
 export declare function mapToServiceEffective(eff: AgentConfigEffective, version: number): EffectiveConfig;
 /**
- * Pick the backend off a CLOSED `provider` enum (`local` | `remote` | undefined): LOCAL when
- * `CONFIG_PROVIDER=local`, OR when no web-admin URL is configured (a lone box with config.d/ on disk
- * and no control plane). REMOTE otherwise (a configured center URL, the default fleet posture). A
- * `CONFIG_PROVIDER=remote` with no URL is a misconfiguration — we fall through to local rather than
- * constructing a remote provider with no endpoint (the caller would have skipped the remote pull entirely
- * under the old code path; local-with-empty-config.d degrades to env the same way). An UNRECOGNIZED value
- * never reaches this function: `loadConfig` refuses to boot on it ([ref]), so a fat-fingered knob can
- * neither source config from an unintended network endpoint nor be read as "local" here while the
- * execution-lane default reads it as "not local".
+ * 建判官 {@link configSourceKind} 答出来的那一种配置源:`local` ⇒ {@link LocalConfigProvider}(根 = 递进来的 `localDir`);`remote` ⇒
+ * {@link RemoteConfigProvider}(中心 = `webAdmin`)。判官答「无配置源」(没写词、没配中心 = 纯 env 部署)⇒ 抛:调用方只在判官答 local / remote 时建
+ * (服务端第 2 段先问判官;run-local 在入口只放过 `local` 的词)。没有第三种读法 —— 「remote 而没有中心 ⇒ 落回本地」那一臂已删(配置源的词要么兑现、要么拒;
+ * 起服在 `loadConfig` 的配置不变量段拒这一组合,到得了这里 = 绕过了 `loadConfig`,判官抛起服拒的同一句)。认不出的词同样到不了这里:
+ * `loadConfig` 拒启([ref]),入参型是闭集。
  */
 export declare function createConfigProvider(input: ConfigProviderInput): ConfigProvider;
 /**
@@ -209,21 +205,20 @@ export declare function createConfigProvider(input: ConfigProviderInput): Config
 export declare function configLocalRoot(config: {
     readonly configLocalDir?: string | undefined;
 }): string;
+/** 配置源的两种形态(纯 env 部署没有配置源 —— 判官答 `undefined`)。 */
+export type ConfigSourceKind = "local" | "remote";
 /**
- * {@link createConfigProvider} 会造出**哪一种**配置源 —— 判据的唯一属主(构造器与执行车道合成步读同一只:
- * local 形 `config.d/remote-exec.json` 的 file-wins 覆写只在配置源是 local 时生效,车PI 修复轮 ①)。
- * `local` 或没配中心 ⇒ local;其余 ⇒ remote。([ref] 起入参是闭集:「认不出的词 ⇒ local」那一臂随拒启删除。)
+ * 这台进程的配置源是**哪一种** —— 判据的唯一属主(一个问题一个读者):HTTP 服务第 2 段(目录信任 + 一次性迁移、执行车道合成步)、
+ * web-admin 工厂与 {@link createConfigProvider}(run-local 经它;run-local 在入口只放过 `local` 的词)都问这一只。规则一条 —— 配置源的词要么兑现、要么拒:
+ *  · `CONFIG_PROVIDER=local` ⇒ `local`(配没配中心都是;中心照样管 fleet 面);
+ *  · `CONFIG_PROVIDER=remote` ⇒ `remote`;没有中心 ⇒ **抛**起服拒的同一句(`remoteConfigProviderUrlRefusal`;`loadConfig` 的配置不变量段本应已拒,
+ *    到得了这里 = 绕过了它)—— 修前这一形在两只判官里各被读成一种别的源(服务端「无配置源」、构造器「local」),零句;
+ *  · 不写词 ⇒ 有中心 `remote`、没有 `undefined`(纯 env 部署,不建配置源)。
+ * 修前是两只判官(`configProviderKind` 答 local | remote、`serviceConfigSourceKind` 包一层答 local | remote | 无),对「不写词、没配中心」一只答 local、
+ * 一只答无;收成这一只,两名删除。
  */
-export declare function configProviderKind(input: {
-    readonly provider?: ConfigProviderWord | undefined;
-    readonly webAdmin?: unknown;
-}): "local" | "remote";
-/**
- * HTTP 服务这一侧的配置源:web-admin 工厂**建不建** provider(`CONFIG_PROVIDER=local` 或配了中心才建)、建出来是哪一种。
- * `undefined` = 纯 env 部署(没有配置源)。工厂与执行车道合成步读这同一只(车PI 修复轮 ①:合成步排在工厂之前)。
- */
-export declare function serviceConfigSourceKind(config: {
+export declare function configSourceKind(config: {
     readonly configProvider?: ConfigProviderWord | undefined;
     readonly webAdmin?: unknown;
-}): "local" | "remote" | undefined;
+}): ConfigSourceKind | undefined;
 //# sourceMappingURL=config-provider.d.ts.map

package/dist/config-provider.js

@@ -6,6 +6,7 @@ import { assertLocalConfigDirTrusted } from "./config-dir-trust.js";
 import { danglingRefs, emptyEffective, findSkillContent, promptArtifactFor, renderRefIssue, skillContentHash, } from "@sema-agent/settings-schema";
 import { redactSecrets } from "./trace/redact.js";
 import { fetchEffective as remoteFetchEffective, fetchSkillContent as remoteFetchSkillContent, skillToolListsOf, WebAdminHttpError, } from "./web-admin-client/facade.js";
+import { remoteConfigProviderUrlRefusal } from "./config-invariants.js";
 import { homedir } from "node:os";
 import { join } from "node:path";
 const OPERAND_FINGERPRINT_KEY = randomBytes(16);
@@ -205,6 +206,8 @@ export function mapToServiceEffective(eff, version) {
                     ...readMcpSourceLabel(s.name, s.source),
                     ...(s.toolFaces !== undefined ? { toolFaces: s.toolFaces } : {}),
                     ...(s.toolAxes !== undefined ? { toolAxes: s.toolAxes } : {}),
+                    ...(s.sessionMetaKey !== undefined ? { sessionMetaKey: s.sessionMetaKey } : {}),
+                    ...(s.startupTimeoutMs !== undefined ? { startupTimeoutMs: s.startupTimeoutMs } : {}),
                     ...(s.authForm !== undefined ? { authForm: s.authForm } : {}),
                     ...(s.entryKind !== undefined ? { entryKind: s.entryKind } : {}),
                 };
@@ -248,21 +251,33 @@ export function mapToServiceEffective(eff, version) {
     };
 }
 export function createConfigProvider(input) {
-    return configProviderKind(input) === "remote" && input.webAdmin !== undefined
-        ? new RemoteConfigProvider(input.webAdmin, {}, input.skillBodyCacheDir)
-        : new LocalConfigProvider(input.localDir, undefined, { declaredOwnerUid: input.localOwnerUid });
+    const kind = configSourceKind({ configProvider: input.provider, webAdmin: input.webAdmin });
+    if (kind === "local")
+        return new LocalConfigProvider(input.localDir, undefined, { declaredOwnerUid: input.localOwnerUid });
+    if (kind === "remote" && input.webAdmin !== undefined)
+        return new RemoteConfigProvider(input.webAdmin, {}, input.skillBodyCacheDir);
+    throw new Error(`createConfigProvider: no config source to build (CONFIG_PROVIDER is unset and no center is configured — an env-only deployment). ` +
+        `Build a provider only when configSourceKind answers "local" or "remote".`);
 }
 export function configLocalRoot(config) {
     return config.configLocalDir ?? process.env.AGENT_DATA_DIR ?? join(homedir(), ".ai-agent");
 }
-export function configProviderKind(input) {
-    if (input.provider === "local" || input.webAdmin === undefined)
-        return "local";
-    return "remote";
-}
-export function serviceConfigSourceKind(config) {
-    if (config.webAdmin === undefined && config.configProvider !== "local")
-        return undefined;
-    return configProviderKind({ provider: config.configProvider, webAdmin: config.webAdmin });
+export function configSourceKind(config) {
+    switch (config.configProvider) {
+        case "local":
+            return "local";
+        case "remote": {
+            const refusal = remoteConfigProviderUrlRefusal(config);
+            if (refusal !== undefined)
+                throw new Error(refusal);
+            return "remote";
+        }
+        case undefined:
+            return config.webAdmin !== undefined ? "remote" : undefined;
+        default: {
+            const unreachable = config.configProvider;
+            throw new Error(`configSourceKind: CONFIG_PROVIDER word outside the closed set: ${String(unreachable)}`);
+        }
+    }
 }
 //# sourceMappingURL=config-provider.js.map

package/dist/config-types.d.ts

@@ -23,6 +23,7 @@ import type { CustomPkgSource } from "./sandbox-pkg-source.js";
 import type { MemoryEngineBackend, StoreBackend as StoreBackendWord } from "@sema-agent/settings-schema/execution-lanes";
 import { DRAIN_GRACE_FLOOR_MS } from "@sema-agent/settings-schema/fleet";
 import type { AtMention } from "@sema-agent/settings-schema";
+import type { ModsDeclaration } from "./mods-declaration.js";
 /** [ref]:记忆向量面的 embedder 坐标(env `MEMORY_EMBEDDER_*` 解析结果;单一属主 = 本类型,
  *  `plugins/memory-embedder.ts` 的工厂直接消费它,不复制形状)。语义与三问见
  *  {@link ServiceConfigFlat.memoryEmbedder}。纯数据 —— 端点原文照存(拼 `/embeddings` 是 transport
@@ -130,7 +131,7 @@ export declare const DRAIN_SECOND_SIGNAL_MIN_GAP_DEFAULT_MS = 250;
  * 住在本叶(而不在 `fleet/drain-entry.ts`):`config.ts` 读它,而 drain-entry 值引 `plugins/store-contracts.ts`,config 不值引 plugins 层。
  */
 export declare function fleetScopeOf(raw: string | undefined): string;
-/** 中心基址三席(`SEMA_WEB_ADMIN_URL` / `SEMA_WEB_ADMIN_LIVE_URL` / `SEMA_WEB_ADMIN_WEB_URL`)与公告地址的形句 —— 判官 `web-admin-client/center-request.ts` `pathBaseUrlRefusal` 一只(形判 = settings-schema `httpUrlFlaws`),配置目录四行同读这一句。 */
+/** 中心基址三席(`SEMA_WEB_ADMIN_URL` / `SEMA_WEB_ADMIN_LIVE_URL` / `SEMA_WEB_ADMIN_WEB_URL`)与公告地址的形句 —— 判官 `web-admin-client/center-request.ts` `pathBaseUrlRefusal` 一只(形判 = settings-schema `pathBaseUrlFlaws`,14.7.0 起),配置目录四行同读这一句。 */
 export declare const CENTER_BASE_URL_RULE = "\u8BBE\u4E86\u5C31\u5FC5\u987B\u662F\u53EF\u89E3\u6790\u7684 http(s) URL,\u4E14\u4E0D\u5E26\u51ED\u636E / query / fragment(\u57FA\u5740\u540E\u9762\u8981\u62FC\u8DEF\u5F84);\u574F\u5F62\u62D2\u542F(\u6CA1\u63A5\u4E2D\u5FC3\u4E5F\u62D2),\u62D2\u53E5\u53EA\u70B9\u540D\u89C4\u5219,\u4E0D\u56DE\u663E scheme";
 /** 编排器片 2:`FLEET_LEASE_OUTAGE_MAX_MS` 的缺省(24 h)—— 中心 / 库故障、中心降级在今天都靠 LKG 无限期容忍,10 分钟级的窗会把它们变成数据面停服。 */
 export declare const FLEET_LEASE_OUTAGE_MAX_DEFAULT_MS = 86400000;
@@ -266,7 +267,7 @@ export interface MemoryConsolidationDriverConfig {
      *  ①恰好一条时 = 两个 admin 口省略 `scope` 的**唯一**缺省(两条及以上恒不猜——在两个库之间猜一个
      *  去花钱是本设计要消灭的形);②周期腿落地时的 scope 源(设计稿 D2)。
      *  🔴 **不是授权边界**:本仓今天没有任何授权源能对一个 operator 收窄 scope(理由与亲读依据逐字见
-     *  `src/memory-operator-faces.ts` 的 `erasureEnvelopeRefusal` 头注),在本层拿它当白名单就是**发明
+     *  `src/memory-operator-faces.ts` `MemoryComplianceFaces.erase` 的「授权座只有一只」段),在本层拿它当白名单就是**发明
      *  第二套授权语义**。显式传的 scope 照跑,表只管缺省。 */
     scopes: readonly string[];
     /**
@@ -297,7 +298,8 @@ export interface MemoryConsolidationDriverConfig {
      */
     autoRunOnRecommendation?: boolean;
 }
-/** A web-admin MCP server resolved to a core spec (env-NAME refs already → real values) plus the
+/** A web-admin MCP server resolved to a core spec (env-NAME refs already read and registered on the peer desk under the
+ *  roster lease: the spec carries the minted reference, never the values) plus the
  *  scenarios it applies to (empty = all). `resolveSpec` filters by scenario and passes `spec` to core. */
 export interface ScopedMcpServer {
     scenarios: string[];
@@ -312,7 +314,8 @@ export interface CenterMcp {
     servers: ScopedMcpServer[];
     reservedNames: readonly string[];
 }
-/** DESIGN-269 §2.1 —— an A2A PEER resolved to a core spec (header-NAME refs already → real values) plus
+/** DESIGN-269 §2.1 —— an A2A PEER resolved to a core spec (header-NAME refs already read and registered on the peer desk
+ *  under the roster lease: the spec carries the minted reference, never the values) plus
  *  the scenarios it applies to (empty = all). Exact sibling of {@link ScopedMcpServer}: `resolveSpec`
  *  filters by scenario (`a2aForScenario`) and passes `spec` to core as `TaskSpec.a2a`.
  *
@@ -510,8 +513,10 @@ export interface ServiceConfigFlat {
     gatewayFallbackUrls: string[];
     /** `GATEWAY_MAX_RETRIES` —— openai 兼容腿的**每次调用**重试上限。
      *
-     *  🔴 **缺席 = 不传给引擎**(不是"传个默认值"):此前这里是硬编码 `maxRetries: 2`,而显式传参**压过**
-     *  引擎默认 ⇒ core 抬默认对 server 部署一点效果都没有。缺席不传之后,引擎默认当家、core 抬默认自动继承。
+     *  🔴 **配置层缺席 = 本字段 `undefined`**(不是"传个默认值"):此前这里是硬编码 `maxRetries: 2`,而显式传参**压过**
+     *  引擎默认 ⇒ core 抬默认对 server 部署一点效果都没有。缺席之后由 `brain.ts` 按**外层拓扑**分两态(启动日志 `gatewayRetryCap` 回显):
+     *  外层有快切层(备用网关 / 断路器开关 / 反应式降级 —— 后者须配着 `MODEL_DEGRADE_TO`)⇒ 网关各路传 `FAST_FAIL_MAX_RETRIES`(2)并遮蔽引擎的 `SEMA_MAX_RETRIES`;
+     *  没有快切层 ⇒ 不传,引擎默认当家、core 抬默认自动继承。降级兜底腿不吃这条收窄(只吃显式值)。设了恒赢(原样传、同样遮蔽 `SEMA_MAX_RETRIES`)。
      *  (五报清查 R1① 的 server 半场,黑板 [ref]/[ref];anthropic 腿早有 `ANTHROPIC_MAX_RETRIES` 出口,
      *  这条只是把同样的出口补给限流 provider 真正走的那条腿。) */
     gatewayMaxRetries?: number;
@@ -931,7 +936,9 @@ export interface ServiceConfigFlat {
         token?: string;
         caCert?: string;
         insecureTls?: boolean;
-        namespace?: string;
+        /** `K8S_NAMESPACE` — the namespace the sandbox pods live in. REQUIRED, no default: the loader refuses to start when `REMOTE_EXEC=k8s` names the
+         *  lane without it, so this arm never carries an absent namespace and no consumer needs a fallback of its own. */
+        namespace: string;
         runtimeClass?: string;
         mountPath?: string;
         timeoutMs?: number;
@@ -1307,15 +1314,16 @@ export interface ServiceConfigFlat {
      *
      * 🔴 语义边界(成文,别当成"数据会被删"):core **只**拿它做启动期能力校验(锁着 + 店未声明
      * `retention:"managed"` ⇒ 拒启),引擎自己在任务路径上从不删数据;真执行(调度/重试/副本协调/审计)
-     * 是部署侧的活,本仓**尚未**建([ref] §5.2「server 半场四件皆新建」)。所以配了策略而没有任何
-     * managed 店时,启动会打一条 `retention_policy_not_executed` 的响亮 warn。
+     * 是部署侧的活 —— 扫车道(`retentionSweep`,`boot/retention-lane.ts`)。配了策略而扫车道关着(只可能在 `audit-only` 档:
+     * `enforce` 而车道不齐起服拒,配置不变量 `retention-lane-complete`)时,启动会打一条 `retention_policy_not_executed` 的响亮 warn。
      */
     retentionPolicy?: RetentionPolicy;
     /**
      * [ref] 车2 —— 托管留存 **sweep lane** 的两个旋钮(设计稿 `DESIGN-270-retention-lane.md` §3/§4)。
      * `retentionPolicy` 说的是「保留多久」(一句声明),本格说的是「谁在什么节律上按那句话删」。
      * **恒在场**(不是可选块):两根都有文档化的缺省,而缺省本身是一条要能被读出来的姿态 ——
-     * `{mode:"audit-only", intervalSec:0}` = 「lane 关着,真开起来也先只记账」。
+     * `{mode:"audit-only", intervalSec:0}` = 「lane 关着,真开起来也先只记账」。被要的车道必须齐(`intervalSec > 0` 或 `mode:"enforce"` ⇒
+     * 视界与 > 0 的节律都在,否则起服拒 —— 配置不变量 `retention-lane-complete`)。
      */
     retentionSweep: RetentionSweepConfig;
     /** Tool names that require operator approval before running (F4). Empty = no approval gate. */
@@ -2205,6 +2213,9 @@ export interface ServiceConfigFlat {
     defaultScenario: string;
     /** Directory of baked-in skill Markdown files, loaded once at startup. */
     skillsDir: string;
+    /** 运维声明的 mod 包(`MODS_ROOT` + `MODS_PACKAGES`;`loadConfig` 读一次,唯一读法 `mods-declaration.ts` 的 `parseModsDeclaration`)。两只起服入口的部署座装配
+     *  (`boot/deployment-mods.ts` 的 `assembleDeploymentMods`)都读这一份;没声明 = 没有 `packages` 这一席(`{}` / 单设根时 `{ root }`;部署座只有本仓自铸的注册)。起服装配一次,配置刷新不重载。 */
+    modsDeclaration: ModsDeclaration;
     /** Central web-admin (web-admin). When set, the service pulls the effective config
      *  on boot (and refreshes) and applies it OVER the env defaults — env is the fallback. Logical config
      *  only (model roster/roles/teams); secrets/gateways stay in this service's env.
@@ -2259,8 +2270,10 @@ export interface ServiceConfigFlat {
      *  传输上界)与 `CENTER_CREDENTIAL_RENEW_LEAD_MAX_MS`(访问令牌寿命之半)之间,坏值拒启(解析口 `parseCenterCredentialRenewLeadMs`)。
      *  裸行文件 / `SEMA_WEB_ADMIN_TOKEN` 值形不受它影响(不续签)。`CENTER_CREDENTIAL_RENEW_LEAD_MS`。 */
     centerCredentialRenewLeadMs: number;
-    /** Dual-mode config SOURCE (DUAL-MODE-DESIGN §4): "remote" (web-admin HTTP) | "local" (.env + config.d
+    /** Dual-mode config SOURCE (DUAL-MODE-DESIGN §4): "remote" (web-admin HTTP; needs SEMA_WEB_ADMIN_URL — remote without it
+     *  refuses to boot, cross-invariant `remote-config-provider-url`) | "local" (.env + config.d
      *  via @sema-agent/settings-schema FileConfigStore) | unset → remote if SEMA_WEB_ADMIN_URL is set, else pure-env.
+     *  One reader: `configSourceKind` (config-provider.ts).
      *  Env: CONFIG_PROVIDER —— [ref] 起闭集 {@link CONFIG_PROVIDER_WORDS}(认不出的词拒启;空串 = 未设)。
      *  The same resolver/EffectiveConfig either way (can't drift). */
     configProvider?: ConfigProviderWord;
@@ -2294,7 +2307,7 @@ export type ServiceLimitsHttpConfig = Pick<ServiceConfigFlat, "port" | "attachme
 /** 组:observability(可观测)。 */
 export type ServiceObservabilityConfig = Pick<ServiceConfigFlat, "metricsToken" | "traceToken" | "toolTrace" | "traceThinking" | "logLevel" | "otel">;
 /** 组:integrations(外部集成)。`mcpServers` / `a2aPeers` 由 web-admin 适配器填(无 env 腿),归本组。 */
-export type ServiceIntegrationsConfig = Pick<ServiceConfigFlat, "pluginsAllowHosts" | "mcpServers" | "a2aPeers" | "a2aServe" | "configBootFetchBudgetMs" | "gitApiBaseUrl" | "gitApiToken" | "gitApiKind" | "defaultScenario" | "skillsDir" | "centerCredentialRenewLeadMs" | "webAdmin" | "fleetLeaseFailClosed" | "fleetGeneration" | "fleetScope" | "fleetAdvertiseAddress" | "fleetLeaseOutageMaxMs" | "configProvider" | "configLocalDir" | "configLocalOwnerUid">;
+export type ServiceIntegrationsConfig = Pick<ServiceConfigFlat, "pluginsAllowHosts" | "mcpServers" | "a2aPeers" | "a2aServe" | "configBootFetchBudgetMs" | "gitApiBaseUrl" | "gitApiToken" | "gitApiKind" | "defaultScenario" | "skillsDir" | "modsDeclaration" | "centerCredentialRenewLeadMs" | "webAdmin" | "fleetLeaseFailClosed" | "fleetGeneration" | "fleetScope" | "fleetAdvertiseAddress" | "fleetLeaseOutageMaxMs" | "configProvider" | "configLocalDir" | "configLocalOwnerUid">;
 /** 九个组槽。每组恒在场(`loadConfig` / `attachConfigGroups` 装好才交出配置),故不可选——新代码写
  *  `config.modelPlane.model` 不需要 `?.`(可选组会把 `Model` 污染成 `Model | undefined`)。 */
 export interface ServiceConfigGroups {

package/dist/config.d.ts

@@ -1,4 +1,5 @@
 import { type Model, type PathRuleBases, type PermissionRule } from "@sema-agent/core";
+import { type ConfigProviderWord } from "./config-types.js";
 import { type CenterEndpoint } from "./web-admin-client/center-request.js";
 import { type Autonomy } from "./runtime-governance.js";
 import { type RunnerEnvNameAllowlistKnob, type ServerEnvNameAllowlistKnob } from "./env-name-allowlist-knobs.js";
@@ -106,6 +107,19 @@ export interface ConfigNotice {
     fields: Record<string, string>;
 }
 export declare function drainConfigNotices(): ConfigNotice[];
+/**
+ * [ref] —— `CONFIG_PROVIDER` 的**唯一**读点。闭集 {@link CONFIG_PROVIDER_WORDS};缺席 / 空串 ⇒ 未表态(`undefined`);
+ * 其余一律**拒启**,拒因句列合法词。逐字比较(不 trim、不折大小写)—— 与本仓其余闭集 env 同律([ref]:认不出的词
+ * 不许被悄悄猜成某一种意思)。
+ *
+ * 修前这根旋钮是开放词,而一个认不出的词在同一进程里被读成两种意思:配置源判官(`configProviderKind`)把它当 `local`
+ * (读 `config.d/`、执行车道合成步照读 `remote-exec.json`),这里的隐式 host 臂与车道落点披露却按字面 `=== "local"`
+ * 判它**不是** local;web-admin 工厂同样按字面只在 `"local"` 上递本地根,于是配置源的根落回 `process.cwd()`、
+ * 合成步读的是 `localRoot` —— 两个根分家。收成闭集 + 一个读点之后,这三处读的是同一个值。
+ * 调用方两处、读的是同一张闭集:`loadConfig` 开头一次;`run-local` 在 `loadConfig` 之前一次(本入口只装本地配置源,词是 `remote` 就在这里拒 ——
+ * 配没配中心地址都一样)。
+ */
+export declare function parseConfigProvider(): ConfigProviderWord | undefined;
 /** F10 (codex audit): drain + log BOTH pre-logger diagnostic collectors (S20 soft-knob warnings + [ref]④ boot
  *  notices) in one place. EVERY entrypoint that calls loadConfig() then builds a logger must call this right
  *  after (main.ts, run-local.ts) — a new entry that forgets it would silently drop operator-facing diagnostics
@@ -212,6 +226,25 @@ export declare function configKnobTable(): ConfigKnobRecord[];
 export declare const hostBackgroundShellEnabled: () => boolean;
 /** The `host` exec lane's spool-file stdio form; false ⇒ the pre-1.226 pipe fallback (read per exec). */
 export declare const hostExecSpoolEnabled: () => boolean;
+/** 名单在活配置里的落点(服务进程四只旋钮;bake-runner 那只在它自己的进程里,不在 `ServiceConfig`)。 */
+export type EnvNameAllowlistSeats = Pick<ServiceConfig, "lspEnvAllow" | "remoteExec">;
+/**
+ * 沙箱名单(表列 `channel: "sandbox-grant"` 的服务侧旋钮,表派生)此刻交出去的名 —— 起服行 `remote_exec_enabled.sandboxEnvKeys` 读它(`boot/execution-env.ts`,
+ * 排序后只出键名)。只有被选中车道的那一只有落点;e2b / k8s 报的是名单点到的键,不含 `SANDBOX_PKG_SOURCE` 推导出的包源变量(那一组是区域常量,装配点另并)。
+ */
+export declare function sandboxEnvNamesInForce(seats: EnvNameAllowlistSeats): readonly string[];
+/** 声明增长后重判的一处命中:哪只旋钮、它交出去的哪个名、判官的拒因({@link ownCredentialNameProblem} 那一句,只回显名)。 */
+export interface OwnCredentialInForce {
+    readonly knob: ServerEnvNameAllowlistKnob;
+    readonly name: string;
+    readonly problem: string;
+}
+/**
+ * 解析器头注 ② 那条不变量在**声明增长**那一刻的半边:对活配置里每只名单此刻交出去的名问**同一只**判官({@link ownCredentialNameProblem} → 引擎
+ * `inheritEnvPolicyProblem`,读引擎此刻的声明)。读活配置的落点,不重读 env(名单是起服输入;解析那一刻已判过形与当时的声明)。返回每一处命中,空 = 不相交。
+ * 调用点只有一处 = 声明增长的那一处(`apply-effective.ts` 的换代声明,真声明之后、席位换装之前)。
+ */
+export declare function ownCredentialHitsInForce(seats: EnvNameAllowlistSeats): OwnCredentialInForce[];
 /** 名单型 env 旋钮的**唯一**解析器(规则全文见上方 `ENV_NAME_ALLOWLIST_KNOBS` 头注)。`undefined` = 没配(未设 / 空串)。
  *  服务侧旋钮要交本进程的姿态(③);runner 旋钮没有姿态,签名上就不收 —— 读者与行形由叶表的类型一起定,传错是编译红。 */
 export declare function parseEnvNameAllowlist(knob: ServerEnvNameAllowlistKnob, singleUserTurnkey: boolean): readonly string[] | undefined;