@sema-agent/server 7.138.0 → 7.139.0

package/dist/boot/stage-06-runners.js

@@ -70,7 +70,6 @@ export async function runStage06(ctx) {
     const retentionLaneStore = backend?.retentionLane?.();
     assertRetentionLaneWirable({
         intervalSec: config.retentionSweep.intervalSec,
-        policy: config.retentionPolicy,
         executor: retentionExecutor,
         stores: [
             { name: "sessionStore", store: sessionStore },

package/dist/boot/stage-09-leader.js

@@ -6,9 +6,8 @@ import { createLeaderFace } from "./leader.js";
 import { assertStaticWiringConsistent } from "../http/routes/diagnostics.js";
 import { buildDisplaySafeUrl } from "../trace/redact.js";
 export function runStage09(ctx) {
-    const { approvalExemptionStore, backend, backgroundAgentStore, brain, checkpointStore, checkpointCtxSealing, config, webAdmin, deploymentMods, deviceLane, dropSessionScoped, durableEnabled, executionEnvFactory, fileHistoryErasure, governanceSeams, localRoot, logger, mailboxRecipientLifecycle, mailboxStore, metrics, pricing, resumeAnchorStore, runStore, runnerDeps, sessionPolicyStore, sessionStore, streamApprovalGate, taskAttachmentStore, spaceReclaimer, taskListLane, toolResultStore, tracer, usageWindowStore, userInputLedgerStore, workflowCompletionInbox } = ctx;
+    const { approvalExemptionStore, backend, backgroundAgentStore, brain, checkpointStore, checkpointCtxSealing, config, webAdmin, deploymentMods, dropSessionScoped, durableEnabled, executionEnvFactory, fileHistoryErasure, governanceSeams, localRoot, logger, mailboxRecipientLifecycle, mailboxStore, metrics, pricing, resumeAnchorStore, runStore, runnerDeps, sessionPolicyStore, sessionStore, streamApprovalGate, taskAttachmentStore, spaceReclaimer, taskListLane, toolResultStore, tracer, usageWindowStore, userInputLedgerStore, workflowCompletionInbox } = ctx;
     const { ownerAware, sessionAudit, sessionWatchRegistry, purgeSession, instrumentDegenerate, planCacheProbe } = createSessionFaces({
-        deviceStore: deviceLane?.store,
         dropSessionScoped,
         config, logger, metrics, localRoot, backend, sessionStore, runStore, checkpointStore, toolResultStore,
         resumeAnchorStore, approvalExemptionStore, sessionPolicyStore, taskAttachmentStore, fileHistoryErasure,

package/dist/boot/stage-10-http-server.js

@@ -105,6 +105,7 @@ export async function runStage10(ctx) {
         sessionMirrorRuling: principalCaps
             ? async (p) => (await principalCaps.executionRuling(p))?.sessionMirror
             : undefined,
+        executionRuling: principalCaps ? (p) => principalCaps.executionRuling(p) : undefined,
         instrumentDegenerate,
         sideQueryAccounting,
         parkedReviveSurface: parkedReviveSurface ? parkedReviveSurface : undefined,
@@ -118,7 +119,6 @@ export async function runStage10(ctx) {
         planCacheProbe,
     };
     const governance = {
-        authorize,
         webAdminJwtVerifier: webAdminJwtVerifier ? webAdminJwtVerifier : undefined,
         rateLimiter,
         costQuota,
@@ -214,7 +214,7 @@ export async function runStage10(ctx) {
     const runnerFor = createHandsRunnerSelector({ full: runner, handsless: handslessRunner });
     const sideQuery = createSideQueryLane({ brain, config, getKeyResolver: () => webAdmin.getKeyResolver() });
     const scenarioGate = createScenarioGate({ config, scenarios, principalCaps, logger }, "peek");
-    const server = createHttpServer({ runner, runnerFor, sideQuery, scenarioGate, peerDesk, config, resolveSpec, stores, coordinators, seams, observability, governance, deployment, knobs });
+    const server = createHttpServer({ runner, runnerFor, sideQuery, scenarioGate, peerDesk, config, authorize, resolveSpec, stores, coordinators, seams, observability, governance, deployment, knobs });
     bindServerLateSeats({ config, logger, server });
     const fleetReconcile = startFleetReconciler({
         bus: fleetBus,

package/dist/boot/stores.js

@@ -1,7 +1,7 @@
 import { join } from "node:path";
 import { FileBackgroundAgentStore, FileMailboxStore, FileRosterStore, InMemoryUsageWindowStore, mailboxCrossProcessMountVerdict } from "@sema-agent/core";
 import { createCorruptReadFailOpenSeat } from "../observability/corrupt-read-seat.js";
-import { createMemorySyncRunner, createMemorySyncTransport } from "../memory-sync-client.js";
+import { buildMemorySyncEnabledFields, createMemorySyncRunner, createMemorySyncTransport } from "../memory-sync-client.js";
 import { memoryEmbedderFor } from "../plugins/memory-embedder.js";
 import { ensurePgMemoryEmbedderMetaSchema, reconcileEmbedderFingerprint } from "../plugins/memory-embedder-fingerprint.js";
 import { PgMemoryEngineBackend, ensurePgMemoryEngineSchema } from "../plugins/memory-engine-pg.js";
@@ -39,7 +39,6 @@ import { buildMemoryPosture } from "../memory-posture.js";
 import { headReadOf } from "../session-incarnation.js";
 import { establishSqlEnginePosture, sqlPoolsOf } from "../sql-engine-posture.js";
 import { buildStorePosture } from "../store-posture.js";
-import { buildDisplaySafeUrl } from "../trace/redact.js";
 const DARK_REASON_PROSE = {
     engine_off: () => "MEMORY_ENGINE=off",
     multi_tenant_file_backend: () => "multi-tenant on the FILE backend (no tenant isolation; set MEMORY_ENGINE_BACKEND=pg|tidb to light up)",
@@ -364,16 +363,17 @@ export async function openStores(ctx) {
     let memorySyncRunner;
     if (config.memorySync) {
         if (memoryEngine) {
+            const transport = createMemorySyncTransport({ url: config.memorySync.url, token: config.memorySync.token });
             memorySyncRunner = createMemorySyncRunner({
                 backend: memoryEngine.backend,
                 scope: config.memorySync.scope,
                 memoryRoot: memoryEngine.root,
-                transport: createMemorySyncTransport({ url: config.memorySync.url, token: config.memorySync.token }),
+                transport,
                 log: logger,
                 ...(config.memorySync.maxPushEntries !== undefined ? { maxPushEntries: config.memorySync.maxPushEntries } : {}),
                 ...(config.memorySync.maxPullEntries !== undefined ? { maxPullEntries: config.memorySync.maxPullEntries } : {}),
             });
-            logger.info("memory_sync_enabled", { url: buildDisplaySafeUrl(config.memorySync.url), scope: config.memorySync.scope, cursorPath: memorySyncRunner.cursorPathFor(config.memorySync.scope) });
+            logger.info("memory_sync_enabled", buildMemorySyncEnabledFields(transport.peer, config.memorySync.scope, memorySyncRunner.cursorPathFor(config.memorySync.scope)));
             memorySyncRunner.trigger("boot");
         }
         else {

package/dist/boot/web-admin.js

@@ -17,7 +17,7 @@ import { answerStillCurrent, centerStateBin, credentialIdentityNow, judgeCenterC
 import { createCenterConfigTier } from "../center-config-tier.js";
 import { buildCenterCredentialHealthView, createCenterCredentialRenewer } from "../center-credential-renewer.js";
 import { centerManagedConfigKeys } from "../web-admin-client/apply-effective.js";
-import { createConfigProvider, raceBootFetch, serviceConfigSourceKind, BOOT_FETCH_DEFERRED } from "../config-provider.js";
+import { configSourceKind, createConfigProvider, raceBootFetch, BOOT_FETCH_DEFERRED } from "../config-provider.js";
 import { ConfigDirUntrustedError } from "../config-dir-trust.js";
 import { createKeyResolver } from "../key-resolver.js";
 import { buildSealedKeyPublicFace, ensureCheckpointCtxSealing, ensureSealedKeyStore, reportExecutionPublicKey } from "../sealed-key.js";
@@ -161,7 +161,7 @@ export async function createWebAdminRuntime(ctx) {
     catch (err) {
         logger.warn("checkpoint_ctx_sealing_unavailable", { err: err instanceof Error ? err.message : String(err), dir: join(sealedKeyDir, "checkpoint-ctx-keys"), note: "suspended tasks' request credentials cannot be sealed on this host; with durable approvals on the boot refuses — make that directory (under the sealed-key custody directory: SEALED_KEY_DIR, default <data root>/sealed-key) creatable and chmod-able by the service, or repair / remove a key file there whose public and private halves do not belong together" });
     }
-    const configProvider = serviceConfigSourceKind(config) !== undefined
+    const configProvider = configSourceKind(config) !== undefined
         ? createConfigProvider({
             ...(config.configProvider ? { provider: config.configProvider } : {}),
             ...(cc ? { webAdmin: { baseUrl: cc.baseUrl, credential: cc.credential, worker: cc.worker, dryRun: cc.dryRun } } : {}),

package/dist/capabilities/mcp-probe.js

@@ -178,7 +178,7 @@ export function createMcpProbeWalk(input, principal, desk, now = Date.now) {
         timeoutMs: MCP_PROBE_VERDICT_TIMEOUT_MS,
         concurrency: MCP_PROBE_CONCURRENCY,
         signal: controller.signal,
-        peerSeat: desk.seat.answer,
+        peerSeat: desk.seat,
     });
     if (lease !== undefined)
         void dials.then(() => lease.release(), () => lease.release());

package/dist/capabilities/scenarios.d.ts

@@ -85,7 +85,7 @@ export interface ScenarioContext {
     /**
      * [ref] / [ref]:**委派树根的见证**(停驻挂点的属主来源)—— 根会话 id + 调用方判断那一刻读到的根行住客(`delegated-session-owner.ts` 的 `DelegationRootWitness`)。
      * 由**每一个**接了停驻挂点的取用方显式交出(一条读法,没有回落):请求腿 = 本请求经鉴权解析的会话与受理时那一读(`boot/resolve-spec.ts`);`/decide` 赎回面 = 行上的
-     * `rootSessionId` 与赎回腿 claim 前后两读的那一位住客(`parked-revive-surface.ts`,交不交座都交)。它**只**喂停驻挂点,不挂任何会话级设施(那是 {@link sessionId} 的事,
+     * `rootSessionId` 与赎回腿写口放行的那一位住客(`parked-revive-surface.ts`,交不交座都交)。它**只**喂停驻挂点,不挂任何会话级设施(那是 {@link sessionId} 的事,
      * 判据是「这只 bundle 是不是在那只会话上取用的」,与属主来源是两个独立判据)。缺席 = 没有根可交(boot 期探针、run-local、行上没有根)⇒ 律给哨兵。
      * 挂点在停驻那一刻再读一次根行:住客不是见证的那一位(删了、同 id 被重新登记)⇒ 停驻否决 —— 不按新住客晋升或认领。
      */

package/dist/capability-facts.d.ts

@@ -33,12 +33,13 @@ export declare const CAPABILITY_FACT_WHY: {
     readonly subagent_output_face_absent: "the background sub-agent output face is not wired";
     readonly task_handle_faces_absent: "the background task-handle output/stop faces are not wired";
     readonly session_head_face_absent: "the session store has no by-id head read (sessionStorage.headOf — owner, occupant and leaf of a session row in one read)";
+    readonly execution_placement_seat_absent: "the session store has no execution placement seat (sessionStorage.executionPlacement — the occupant and the execution placement cell of a root session row in one read)";
     readonly checkpoint_store_absent: "no durable checkpoint store is wired (DURABLE_APPROVAL)";
     readonly session_audit_absent: "no session audit view is wired (needs a durable session store)";
     readonly session_watch_absent: "the session watch registry is not wired";
     readonly session_lister_absent: "no session enumerator is wired (session store or run store listSessions)";
     readonly session_fork_face_absent: "the session store has no fork face";
-    readonly session_row_faces_absent: "the session store has no session-row faces (headOf / sessionSummaryOf / patchSessionMeta)";
+    readonly session_row_faces_absent: "the session store has no session-row faces (headOf / sessionSummaryOf / writeSessionRowCells)";
     readonly session_purge_absent: "no session purge coordinator is wired";
     readonly session_policy_store_absent: "no session policy store is wired";
     readonly store_backend_absent: "no store backend is wired (DB_BACKEND=memory, multi-tenant bare boot, or half-configured SQL)";
@@ -128,6 +129,13 @@ type HeadReadingSessionStore = WithMethods<OwnerAwareSessionStore, "headOf">;
 export declare function sessionOwnership(d: Pick<Deps, "sessionStorage">): Fact<"session_head_face_absent", {
     sessionStorage: HeadReadingSessionStore;
 }>;
+/**
+ * 执行放置读面在场:会话店带执行席(`executionPlacement`:一次行读 = 住客 + 执行放置格;SQL 两孪生与 local 恒带,引擎缺省的内存会话店没有)。
+ * 见证 = 那只席 —— `GET /v1/sessions/:id/execution-placement` 读它,且只读它(属主门判这一读的住客)。
+ */
+export declare function executionPlacementRead(d: Pick<Deps, "sessionStorage">): Fact<"execution_placement_seat_absent", {
+    seat: NonNullable<OwnerAwareSessionStore["executionPlacement"]>;
+}>;
 export declare function mcpReconnect(d: Pick<Deps, "runStore" | "sessionStorage">): Fact<"run_store_absent" | "session_head_face_absent", {
     runStore: Store<"runStore">;
     sessionStorage: HeadReadingSessionStore;
@@ -148,11 +156,11 @@ export declare function sessionList(d: Pick<Deps, "sessionStorage" | "runStore">
 export declare function sessionFork(d: Pick<Deps, "sessionStorage">): Fact<"session_fork_face_absent" | "session_head_face_absent", {
     sessionStorage: WithMethods<OwnerAwareSessionStore, "headOf" | "fork">;
 }>;
-/** 会话行可写位(`PATCH /v1/sessions/:id`):会话店的头读(属主 + 化身一次读 —— 门判属主、写与读回按化身条件)∧ 行写口(写后按同一住客读回)。
+/** 会话行可写位(`PATCH /v1/sessions/:id`):会话店的头读(属主 + 化身一次读 —— 门判属主,那一读就是写原语的行期望)∧ 行格写原语(锁内判、提交后另读应答行)。
  *  三只 durable 店(SQL 双生 / local)都带;内存 dev 店没有行写口 ⇒ 501。
- *  本面**没有**独立能力位(契约附录 B.2c 登记):老 worker 对这一动词答 405,本事实为假的部署答 501。 */
+ *  本面**没有**独立能力位(契约附录 B.2c 登记):老 worker 对这一动词答 405,本事实为假的部署答 501;条件写也没有 —— 列表行上有 `rowTag` 即支持。 */
 export declare function sessionPatch(d: Pick<Deps, "sessionStorage">): Fact<"session_row_faces_absent", {
-    sessionStorage: WithMethods<OwnerAwareSessionStore, "headOf" | "patchSessionMeta">;
+    sessionStorage: WithMethods<OwnerAwareSessionStore, "headOf" | "writeSessionRowCells">;
 }>;
 export declare function sessionDelete(d: Pick<Deps, "purgeSession" | "sessionStorage">): Fact<"session_purge_absent" | "session_head_face_absent", {
     purge: Store<"purgeSession">;
@@ -162,11 +170,11 @@ export declare function sessionPolicy(d: Pick<Deps, "sessionPolicyStore" | "sess
     policyStore: Store<"sessionPolicyStore">;
     sessionStorage: HeadReadingSessionStore;
 }>;
-type SyncSessionStore = WithMethods<OwnerAwareSessionStore, "exportEntries" | "exportEntriesStream" | "beginImportStaging" | "headOf" | "sessionSummaryOf" | "patchSessionMeta">;
+type SyncSessionStore = WithMethods<OwnerAwareSessionStore, "exportEntries" | "exportEntriesStream" | "beginImportStaging" | "headOf" | "sessionSummaryOf" | "writeSessionRowCells">;
 type SessionSyncWhy = "store_backend_absent" | "file_history_store_absent" | "session_export_absent" | "session_import_staging_absent" | "session_row_faces_absent" | "policy_purge_absent";
 /** 会话对等同步的**对话半族**(manifest / entries / plan / import 两相):后端 ∧ 文件历史店 ∧ 导出两面 ∧ staged 导入面 ∧
- *  会话行三口(门读头 `headOf` —— 属主 + 化身一次读,属主判门、化身给 identical 短路腿;manifest 带 `title` / `pinned`;导入经唯一写口按导入落定的
- *  那一位住客重放它们)∧ policy 店能清(overwrite-dst 的 commit 要擦目的端旧 policy 行)。
+ *  会话行三口(门读头 `headOf` —— 属主 + 化身一次读,属主判门、化身给 identical 短路腿;manifest 带 `title` / `pinned`;导入经行格写原语以 `replay` 写者
+ *  按导入落定的那一位住客重放它们)∧ policy 店能清(overwrite-dst 的 commit 要擦目的端旧 policy 行)。
  *  文件历史的 blob 搬运是另一只事实。 */
 export declare function sessionSync(d: Pick<Deps, "backend" | "sessionStorage" | "fileHistoryStore" | "sessionPolicyStore">): Fact<SessionSyncWhy, {
     backend: Store<"backend">;

package/dist/capability-facts.js

@@ -13,12 +13,13 @@ export const CAPABILITY_FACT_WHY = {
     subagent_output_face_absent: "the background sub-agent output face is not wired",
     task_handle_faces_absent: "the background task-handle output/stop faces are not wired",
     session_head_face_absent: "the session store has no by-id head read (sessionStorage.headOf — owner, occupant and leaf of a session row in one read)",
+    execution_placement_seat_absent: "the session store has no execution placement seat (sessionStorage.executionPlacement — the occupant and the execution placement cell of a root session row in one read)",
     checkpoint_store_absent: "no durable checkpoint store is wired (DURABLE_APPROVAL)",
     session_audit_absent: "no session audit view is wired (needs a durable session store)",
     session_watch_absent: "the session watch registry is not wired",
     session_lister_absent: "no session enumerator is wired (session store or run store listSessions)",
     session_fork_face_absent: "the session store has no fork face",
-    session_row_faces_absent: "the session store has no session-row faces (headOf / sessionSummaryOf / patchSessionMeta)",
+    session_row_faces_absent: "the session store has no session-row faces (headOf / sessionSummaryOf / writeSessionRowCells)",
     session_purge_absent: "no session purge coordinator is wired",
     session_policy_store_absent: "no session policy store is wired",
     store_backend_absent: "no store backend is wired (DB_BACKEND=memory, multi-tenant bare boot, or half-configured SQL)",
@@ -99,6 +100,10 @@ export function sessionOwnership(d) {
     const s = d.sessionStorage;
     return headReadOf(s) !== undefined ? yes({ sessionStorage: s }) : no("session_head_face_absent");
 }
+export function executionPlacementRead(d) {
+    const seat = d.sessionStorage?.executionPlacement;
+    return seat !== undefined ? yes({ seat }) : no("execution_placement_seat_absent");
+}
 export function mcpReconnect(d) {
     const runs = durableRuns(d);
     if (!runs.available)
@@ -133,7 +138,7 @@ export function sessionFork(d) {
 }
 export function sessionPatch(d) {
     const s = d.sessionStorage;
-    if (headReadOf(s) === undefined || s?.patchSessionMeta === undefined)
+    if (headReadOf(s) === undefined || s?.writeSessionRowCells === undefined)
         return no("session_row_faces_absent");
     return yes({ sessionStorage: s });
 }
@@ -163,7 +168,7 @@ export function sessionSync(d) {
         return no("session_export_absent");
     if (s.beginImportStaging === undefined)
         return no("session_import_staging_absent");
-    if (headReadOf(s) === undefined || s.sessionSummaryOf === undefined || s.patchSessionMeta === undefined)
+    if (headReadOf(s) === undefined || s.sessionSummaryOf === undefined || s.writeSessionRowCells === undefined)
         return no("session_row_faces_absent");
     if (overwriteWipeIncapable(d.sessionPolicyStore))
         return no("policy_purge_absent");

package/dist/config-catalog.js

@@ -109,7 +109,7 @@ export const CONFIG_CATALOG = [
     r("CONFIG_LKG_PATH", "integrations", "path", "LKG 落盘路径(设了 ⇒ 派生一条读拒行 = 这条绝对路径:根锚定,只守这一个文件,经符号链接的目录时引擎沿链连目标一起守;大小写不敏感;用户仓里同尾的路径读得到;空串拒启)", { derivedDefaultNote: "缺席 ⇒ 配置根(SEMA_CONFIG_DIR,缺省 ~/.sema)下按 worker + 凭证身份分箱派生", configKey: "configLkgPath" }),
     r("CONFIG_LOCAL_DIR", "integrations", "path", "本地配置源根(config.d/<domain>.json);兼作数据根回落链一环", { configKey: "configLocalDir", danger: DATA }),
     r("CONFIG_LOCAL_OWNER_UID", "integrations", "number", "本地配置源读之前的目录信任判官多信的那一个属主 uid(本服务用户与 root 之外 —— userns-remap 的 bind-mount、运维用户持有的配置);只放宽属主判据,组 / 他人可写照拒;形错拒启", { configKey: "configLocalOwnerUid", danger: SEC, derivedDefaultNote: "缺席 = config.d 路径上的目录与文档只许属于本服务用户或 root" }),
-    r("CONFIG_PROVIDER", "integrations", "enum", "配置源双模选择(闭集,逐字比较;认不出的词 ⇒ 拒启,S-841)", { enumValues: CONFIG_PROVIDER_WORDS, derivedDefaultNote: `缺席:${WEB_ADMIN_ENV.url} 在场 ⇒ remote,否则纯 env(无管道)`, configKey: "configProvider" }),
+    r("CONFIG_PROVIDER", "integrations", "enum", `配置源双模选择(闭集,逐字比较;认不出的词 ⇒ 拒启;remote 而 ${WEB_ADMIN_ENV.url} 缺席 ⇒ 拒启 —— remote 的配置只来自那只中心)`, { enumValues: CONFIG_PROVIDER_WORDS, derivedDefaultNote: `缺席:${WEB_ADMIN_ENV.url} 在场 ⇒ remote,否则纯 env(无管道)`, configKey: "configProvider" }),
     r("CONFIG_REQUIRE_ROSTER", "integrations", "boolean", "远程 registry 非 dryRun 时布防 ready 门:roster 未落地 ⇒ 计费提交 503 + /health ready:false(严格 'true')", { staticDefault: "false" }),
     r("CORS_ORIGIN", "auth", "csv", "CORS 白名单(单值 v1 兼容回显;多值按请求 Origin 匹配 + Vary;未设=无 CORS 面)", { danger: SEC, configKey: "corsOrigins" }),
     r("COST_QUOTA_WINDOW_SEC", "limitsHttp", "number", "per-principal 成本配额窗长(秒);SQL 腿窗长进桶主键 ⇒ center 腿显式 deferred(重启生效)", { staticDefault: "86400", danger: BILL, configKey: "costQuotaWindowSec", center: cLimits("costQuotaWindowSec", { timing: "restart", restartReason: "cost-quota-window" }) }),
@@ -139,7 +139,7 @@ export const CONFIG_CATALOG = [
     r("DOCKER_NETWORK", "orchestration", "enum", "local-docker 容器网络模式", { enumValues: ["none", "bridge", "host"], staticDefault: "bridge", danger: SEC }),
     r("DOCKER_PATH", "orchestration", "path", "docker 二进制路径"),
     r("DOCKER_PIDS_LIMIT", "orchestration", "number", "local-docker fork-bomb 背栓(--pids-limit;非法值回 adapter 默认 512+warn)", { danger: SEC, derivedDefaultNote: "缺席 ⇒ adapter 默认 512" }),
-    r("DOCKER_SANDBOX_ENV", "orchestration", "secret", "local-docker 车道每条 docker exec 以 -e 注入的本进程 env 点名表(NAME,NAME;点到的键从 worker env 原样取,值不进 spec/center/日志;与 LSP_ENV_ALLOW / E2B_SANDBOX_ENV 同一只解析器与「点名放行」谓词:形错 / 点名名单型旋钮拒启且不回显值;本进程环境里没有的名按序号 warn、不转发;只在本车道被选中时求值;原文按凭据类对待:只回在场位、不进任何子进程)", { danger: SEC }),
+    r("DOCKER_SANDBOX_ENV", "orchestration", "secret", "local-docker 车道每条 docker exec 以 -e 注入的本进程 env 点名表(NAME,NAME;点到的键从 worker env 原样取,值不进 spec/center/日志;与 LSP_ENV_ALLOW / E2B_SANDBOX_ENV 同一只解析器与「点名放行」谓词:形错 / 点名名单型旋钮 / 点名本服务自有凭据名(会把本服务的凭据装进模型读得到的沙箱;判官 = 引擎拒白名单的同一只)拒启且不回显值;本进程环境里没有的名按序号 warn、不转发;只在本车道被选中时求值;原文按凭据类对待:只回在场位、不进任何子进程)", { danger: SEC }),
     r("DRAIN_GRACE_MS", "limitsHttp", "number", "SIGTERM 优雅排空窗(ms;期间新计费提交 503+Retry-After)。出厂默认是**服务器部署**的取值;壳自 spawn 的引擎会被壳注入更短的窗 ⇒ 排壳形关机预算时以本行的 effectiveValue(= 本进程实际生效值)为准,不照抄 staticDefault", { staticDefault: String(10 * 60 * 1000), configKey: "drainGraceMs", center: cLimits("drainGraceMs") }),
     r("DRAIN_SECOND_SIGNAL_MIN_GAP_MS", "limitsHttp", "number", `排空期「第二发信号 = 硬停」的最小间隔(ms;锚 = 本次排空的第一发停止信号 —— SIGTERM / SIGHUP 升级进的排空,入口那一发就是它;排空口 / 租约被拒 / 附着租约自退进的排空,到达的第一发被吸收、不缩短期限。SIGTERM / SIGINT 与锚相隔不足 ⇒ 同一拍的重复投递,一行 drain_duplicate_signal_ignored 后忽略、排空继续;0 = 关,恒按第二发硬停;须为 [${DRAIN_SECOND_SIGNAL_MIN_GAP_BOUNDS.minMs}, ${DRAIN_SECOND_SIGNAL_MIN_GAP_BOUNDS.maxMs}] 内十进制整数(上界 = DRAIN_GRACE_MS 地板),小数 / 负数 / 越界拒启)`, { staticDefault: String(DRAIN_SECOND_SIGNAL_MIN_GAP_DEFAULT_MS), configKey: "drainSecondSignalMinGapMs" }),
     r("DURABLE_APPROVAL", "approval", "boolean", "durable suspend/resume HITL(需 SQL 店;决定 checkpointStore 与 /v1/approvals 面的存在性)", { danger: SEC, derivedDefaultNote: "posture 三态(S-178):显式词恒赢,缺席 = 单用户(REQUIRE_PRINCIPAL≠true)且有耐久店 ⇒ on / 多租户或无耐久店 ⇒ off;生效来源见 GET /v1/diagnostics/wiring 的 serverGates.durableApproval.source", configKey: "durableApproval" }),
@@ -151,7 +151,7 @@ export const CONFIG_CATALOG = [
     r("E2B_LIVENESS_MS", "orchestration", "number", LIVENESS_KNOB_SEMANTICS("e2b"), { derivedDefaultNote: LIVENESS_KNOB_DEFAULT_NOTE }),
     r("E2B_MOUNT_PATH", "orchestration", "path", "e2b 工作区根(resume 用当前值,改前先 drain 挂起任务)"),
     r("E2B_ORPHAN_RECLAIM", "orchestration", "boolean", "崩溃遗留沙盒回收腿(boot 一次+周期;判据保守,拿不准恒不杀)", { staticDefault: "true", danger: BILL }),
-    r("E2B_SANDBOX_ENV", "orchestration", "secret", "转发进 e2b 沙箱的本进程 env 点名表(NAME,NAME;点到的键从 worker env 原样取,值不进 spec/center/事件日志;与 LSP_ENV_ALLOW / DOCKER_SANDBOX_ENV 同一只解析器与「点名放行」谓词:形错 / 点名名单型旋钮拒启且不回显值;本进程环境里没有的名按序号 warn、不转发;只在本车道被选中时求值;原文按凭据类对待:只回在场位、不进任何子进程)", { danger: SEC }),
+    r("E2B_SANDBOX_ENV", "orchestration", "secret", "转发进 e2b 沙箱的本进程 env 点名表(NAME,NAME;点到的键从 worker env 原样取,值不进 spec/center/事件日志;与 LSP_ENV_ALLOW / DOCKER_SANDBOX_ENV 同一只解析器与「点名放行」谓词:形错 / 点名名单型旋钮 / 点名本服务自有凭据名(会把本服务的凭据装进模型读得到的沙箱;判官 = 引擎拒白名单的同一只)拒启且不回显值;本进程环境里没有的名按序号 warn、不转发;只在本车道被选中时求值;原文按凭据类对待:只回在场位、不进任何子进程)", { danger: SEC }),
     r("E2B_SANDBOX_MAX_MS", "orchestration", "number", "e2b 沙箱最长存活(ms)", { staticDefault: "3600000", danger: BILL }),
     r("E2B_TEMPLATE", "orchestration", "string", "e2b 模板名(缺省 adapter 基础模板)"),
     r("E2B_TIMEOUT_MS", "orchestration", "number", "e2b 单命令总超时(ms)"),
@@ -208,10 +208,10 @@ export const CONFIG_CATALOG = [
     r("K8S_LIVENESS_MS", "orchestration", "number", LIVENESS_KNOB_SEMANTICS("k8s"), { derivedDefaultNote: LIVENESS_KNOB_DEFAULT_NOTE }),
     r("K8S_MEMORY", "orchestration", "string", "沙箱 pod 内存限额(2Gi 默认曾被真 OOM)"),
     r("K8S_MOUNT_PATH", "orchestration", "path", "k8s 工作区挂载路径"),
-    r("K8S_NAMESPACE", "orchestration", "string", "沙箱 pod namespace"),
+    r("K8S_NAMESPACE", "orchestration", "string", "沙箱 pod 所在的 namespace(REMOTE_EXEC=k8s 必需件,与 K8S_SANDBOX_IMAGE 同级:缺席、空串或只有空白 ⇒ 起服拒,拒句点名本旋钮;服务不带内置缺省 —— 部署的声明是唯一来源,随包 chart 已显式设为 sandbox.namespace;只在 REMOTE_EXEC=k8s 被选中时求值)"),
     r("K8S_RUNTIME_CLASS", "orchestration", "string", "沙箱 pod runtimeClass(Kata 等)"),
     r("K8S_SANDBOX_BROKER_IMAGE", "orchestration", "string", "成员 git 凭据代理容器的镜像(k8s 沙箱 pod 的 containers[1],只挂在成员 run 的 pod 上;建议填本引擎自身镜像 —— 代理是本包里固定路径的一只程序,命令固定);不设 ⇒ 成员 git 凭据平面关(GET /v1/capabilities 的 credentialPlane.sandboxGit = broker_image_unset),任何 pod 都不挂代理,pod 形逐字节同不设时;只在 REMOTE_EXEC=k8s 被选中时求值"),
-    r("K8S_SANDBOX_ENV", "orchestration", "secret", `转发进 k8s 沙箱 pod 容器 env 的本进程 env 点名表(NAME,NAME;点到的键从 worker env 原样取,值只进该 pod 自己的 Secret —— pod spec 的容器 env 只带 secretKeyRef 引用、不带值,Secret 随 pod 由集群回收;不进工作区 / 快照 / center / 事件日志;沙箱命名空间的 Role 要 secrets ${SANDBOX_SECRET_SEAT_VERBS.env.join(" / ")},起服问不许即拒启;与 LSP_ENV_ALLOW / E2B_SANDBOX_ENV / DOCKER_SANDBOX_ENV 同一只解析器与「点名放行」谓词:形错 / 点名名单型旋钮拒启且不回显值;本进程环境里没有的名按序号 warn、不转发;与包源派生 env 撞名时显式名单胜;只在本车道被选中时求值;原文按凭据类对待:只回在场位、不进任何子进程)`, { danger: SEC }),
+    r("K8S_SANDBOX_ENV", "orchestration", "secret", `转发进 k8s 沙箱 pod 容器 env 的本进程 env 点名表(NAME,NAME;点到的键从 worker env 原样取,值只进该 pod 自己的 Secret —— pod spec 的容器 env 只带 secretKeyRef 引用、不带值,Secret 随 pod 由集群回收;不进工作区 / 快照 / center / 事件日志;沙箱命名空间的 Role 要 secrets ${SANDBOX_SECRET_SEAT_VERBS.env.join(" / ")},起服问不许即拒启;与 LSP_ENV_ALLOW / E2B_SANDBOX_ENV / DOCKER_SANDBOX_ENV 同一只解析器与「点名放行」谓词:形错 / 点名名单型旋钮 / 点名本服务自有凭据名(会把本服务的凭据装进模型读得到的沙箱;判官 = 引擎拒白名单的同一只)拒启且不回显值;本进程环境里没有的名按序号 warn、不转发;与包源派生 env 撞名时显式名单胜;只在本车道被选中时求值;原文按凭据类对待:只回在场位、不进任何子进程)`, { danger: SEC }),
     r("K8S_SANDBOX_IMAGE", "orchestration", "string", "k8s 车道沙箱镜像(REMOTE_EXEC=k8s 必需件)"),
     r("K8S_SANDBOX_IPV6", "orchestration", "enum", "k8s 沙箱 pod 的 IPv6:disabled = pod 级 sysctl 关 IPv6(net.ipv6.conf.all / default.disable_ipv6=1;两只都不在 k8s 的 safe sysctl 表里 ⇒ 每个节点 kubelet 要 --allowed-unsafe-sysctls 点名,否则 pod 起不来;沙箱 ns 不能 enforce PodSecurity baseline / restricted);enabled = 不动 pod(pod 保留平台给的 IPv6,只执行 IPv4 的出网策略管不到它,起服自检每次一行 sandbox_egress_policy_gap{kind: ipv6_enabled});词表外拒启", { enumValues: SANDBOX_IPV6_WORDS, staticDefault: SANDBOX_IPV6_DEFAULT, danger: SEC }),
     r("K8S_TIMEOUT_MS", "orchestration", "number", "k8s 沙箱 pod 寿命(activeDeadlineSeconds,ms;整只 pod 的泄漏护栏,后台任务超时也被它钳;各条命令的超时见工具超时)"),
@@ -409,8 +409,8 @@ export const CONFIG_CATALOG = [
     r("RESOURCE_SUSPEND_TOTAL_TOKENS", "approval", "number", "跨片 token 总额(0=不设;与 MAX_TASK_TOKENS 的 per-slice 窗是两根轴)", { staticDefault: "0", danger: BILL, configKey: "resourceSuspendTotalTokens" }),
     r("RESOURCE_SUSPEND_TTL_SEC", "approval", "number", "resource/preempt checkpoint 的弃置 GC TTL(秒;0 ⇒ core 默认 30d)", { staticDefault: "0", danger: DATA, configKey: "resourceSuspendTtlSec" }),
     r("RETENTION_MAX_AGE_DAYS", "auth", "number", "托管留存期声明(core 启动期能力校验;真删除归 sweep lane)", { danger: DATA }),
-    r("RETENTION_MODE", "auth", "enum", "留存 sweep 灰度档(拼错拒启 —— audit-only 谎成 enforce 两个方向都致命)", { enumValues: ["audit-only", "enforce"], staticDefault: "audit-only", danger: DATA, resolve: (c) => c.retentionSweep.mode }),
-    r("RETENTION_SWEEP_INTERVAL_SEC", "auth", "number", "留存 sweep 节律(秒;0=lane 关)", { staticDefault: "0", danger: DATA }),
+    r("RETENTION_MODE", "auth", "enum", "留存 sweep 灰度档(拼错拒启 —— audit-only 谎成 enforce 两个方向都致命;enforce 而 RETENTION_MAX_AGE_DAYS 缺、或 RETENTION_SWEEP_INTERVAL_SEC 缺 / 为 0 ⇒ 拒启)", { enumValues: ["audit-only", "enforce"], staticDefault: "audit-only", danger: DATA, resolve: (c) => c.retentionSweep.mode }),
+    r("RETENTION_SWEEP_INTERVAL_SEC", "auth", "number", "留存 sweep 节律(秒;0=lane 关;> 0 而 RETENTION_MAX_AGE_DAYS 缺 ⇒ 拒启)", { staticDefault: "0", danger: DATA }),
     r("REWIND_SNAPSHOT_MAX_MB", "store", "number", "已退役(S-15 整树快照纪元退役):设了只 boot warn 一次,零行为", { envTiming: "inert" }),
     r("ROSTER_RETENTION_MS", "orchestration", "number", "agent_roster 行 TTL(ms;SQL twins 扩展面)", { staticDefault: String(30 * 24 * 60 * 60 * 1000), danger: DATA, configKey: "rosterRetentionMs" }),
     r("ROUTER_ENABLED", "orchestration", "boolean", "A 价值路由(per-task 编排自动决策;ship-dark)", { staticDefault: "false", configKey: "routerEnabled" }),

package/dist/config-invariants.d.ts

@@ -25,7 +25,7 @@
  * 依赖纪律:本文件是**叶**(只 type-import config-types + 值引 deployment-governance 的守卫集编译门),
  * 不引 config.ts,故 config.ts / runs.ts 都可以安全引它。
  */
-import type { ServiceConfigFlat } from "./config-types.js";
+import type { ConfigProviderWord, ServiceConfigFlat } from "./config-types.js";
 /**
  * 活体心跳周期(ms)——`runs.ts` 的 `HEARTBEAT_MS` 就是它(那边 re-export,单源在此)。
  *
@@ -34,9 +34,9 @@ import type { ServiceConfigFlat } from "./config-types.js";
  */
 export declare const LIVENESS_HEARTBEAT_MS = 30000;
 /** 闭集:新增一条不变量必须在这里加词(拼错 = 编译红,而不是运行期悄悄不判)。 */
-export type CrossInvariantId = "run-stale-heartbeat" | "bind-posture" | "bake-runner-credential" | "direct-door-anchors" | "operator-principals-required" | "operator-single-user" | "bake-operator-principals" | "sensitive-write-patterns" | "leader-host-lane" | "multi-tenant-shared-lane" | "leader-durable-store" | "device-durable-store" | "device-durable-approval" | "model-provider-word" | "gateway-url-userinfo" | "anthropic-credential-exclusive" | "model-route-endpoint" | "default-model-resolvable" | "refused-names-not-minted" | "require-execution-lane" | "center-one-identity" | "workflow-park-decision-domain";
+export type CrossInvariantId = "run-stale-heartbeat" | "bind-posture" | "bake-runner-credential" | "direct-door-anchors" | "operator-principals-required" | "operator-single-user" | "bake-operator-principals" | "sensitive-write-patterns" | "leader-host-lane" | "multi-tenant-shared-lane" | "leader-durable-store" | "device-durable-store" | "device-durable-approval" | "model-provider-word" | "gateway-url-userinfo" | "anthropic-credential-exclusive" | "model-route-endpoint" | "default-model-resolvable" | "refused-names-not-minted" | "require-execution-lane" | "center-one-identity" | "workflow-park-decision-domain" | "remote-config-provider-url" | "retention-lane-complete";
 /** 表读的键集(取自平铺配置型 ⇒ 键名/类型永不与真配置漂)。 */
-export type CrossInvariantView = Readonly<Pick<ServiceConfigFlat, "runStaleSec" | "authToken" | "authTokens" | "allowUnauthedWrites" | "imageBakes" | "directApprovalDoor" | "durableApproval" | "approvalHmacKeys" | "principalJwtPubkeys" | "principalJwtIss" | "principalJwtAud" | "requirePrincipal" | "operatorPrincipals" | "operatorSingleUser" | "sensitiveWritePatterns" | "leaderEnabled" | "selfOrchestrationEnabled" | "workflowRunStoreBackend" | "remoteExec" | "requireExecutionLane" | "dbBackend" | "tidb" | "pg" | "envModel" | "gatewayBaseUrl" | "gatewayFallbackUrls" | "anthropic" | "models" | "modelRefusals" | "tiers" | "authBridgeIssuer" | "webAdmin">>;
+export type CrossInvariantView = Readonly<Pick<ServiceConfigFlat, "runStaleSec" | "authToken" | "authTokens" | "allowUnauthedWrites" | "imageBakes" | "directApprovalDoor" | "durableApproval" | "approvalHmacKeys" | "principalJwtPubkeys" | "principalJwtIss" | "principalJwtAud" | "requirePrincipal" | "operatorPrincipals" | "operatorSingleUser" | "sensitiveWritePatterns" | "leaderEnabled" | "selfOrchestrationEnabled" | "workflowRunStoreBackend" | "remoteExec" | "requireExecutionLane" | "dbBackend" | "tidb" | "pg" | "envModel" | "gatewayBaseUrl" | "gatewayFallbackUrls" | "anthropic" | "models" | "modelRefusals" | "tiers" | "authBridgeIssuer" | "webAdmin" | "configProvider" | "retentionPolicy" | "retentionSweep">>;
 export interface CrossInvariantInput {
     /** 现役配置(boot 期 = 候选自身)。 */
     readonly live: CrossInvariantView;
@@ -107,6 +107,26 @@ export declare function workflowParkDecisionDomainRefusal(v: Pick<CrossInvariant
  * 标准部署形。没有 web 基址 ⇒ 无可互证,过。
  */
 export declare function centerIdentityRefusal(v: Pick<CrossInvariantView, "authBridgeIssuer" | "webAdmin">): string | undefined;
+/**
+ * `remote-config-provider-url` —— **配置源的词要么兑现、要么拒,从不被读成另一种源**。`CONFIG_PROVIDER=remote` 说的是「这台 worker 的配置来自中心」,
+ * 中心就是 `WEB_ADMIN_ENV.url` 那一只;没有它,这句话无处兑现 —— 不建配置源(服务端)或读本地 `config.d`(run-local)都是把它读成了另一种源,
+ * 多租部署的 entitlement / 模型目录 / 治理整份缺席而进程照起。判据与拒句的唯一属主;配置源判官(`config-provider.ts` 的 `configSourceKind`)
+ * 收到这一组合时抛的也是这一句(到得了那里 = 有人绕过了 `loadConfig`)。状态型:两只键都只来自 env、运行期无写点 ⇒ 热路径上恒与 boot 同答。
+ */
+export declare function remoteConfigProviderUrlRefusal(v: {
+    readonly configProvider?: ConfigProviderWord | undefined;
+    readonly webAdmin?: unknown;
+}): string | undefined;
+/**
+ * `retention-lane-complete` —— **被要的扫车道必须齐**。要车道的旋钮有两根:节律(`RETENTION_SWEEP_INTERVAL_SEC > 0`)与灰度档
+ * `RETENTION_MODE=enforce`(「按策略删」);齐 = 有视界(`RETENTION_MAX_AGE_DAYS`,算 cutoff)且节律 > 0(车道真在跑)。缺一 ⇒ 拒:
+ * enforce 而车道不跑 / 没有视界,运维以为在删而什么都没删(能力位 `retention` 只在车道齐时在场);节律在而没有视界,车道每拍枚举域、什么都算不出。
+ * 一条规则两种要法,拒句按要法说出路(enforce:补缺的键,或改回 audit-only —— 节律在而天数缺时连节律一起设 0;只给节律:补天数或节律设 0),
+ * 每条出路照做都落在本律之内(起得来)。audit-only 下「天数在、车道关」不在律内 ——
+ * 那只是一份声明,起服 warn `retention_policy_not_executed` 说出来(`boot/governance-seams.ts`)。车道的**接线**(执行器 / 方法 / 店声明)不是配置事实,
+ * 留在扫车道自持门(`boot/retention-lane.ts`)。状态型:三键都只来自 env、运行期无写点 ⇒ 热路径上恒与 boot 同答。
+ */
+export declare function retentionLaneRefusal(v: Pick<CrossInvariantView, "retentionPolicy" | "retentionSweep">): string | undefined;
 export declare const CONFIG_CROSS_INVARIANTS: readonly CrossInvariant[];
 /**
  * 按 id 取**一条**([ref]②:boot 面的单源化出口)。

package/dist/config-invariants.js

@@ -103,6 +103,34 @@ export function centerIdentityRefusal(v) {
         `the same web-admin: same host and port (http and https on one host count as one). Set ${WEB_ADMIN_ENV.webUrl} to that web-admin's console, set ` +
         `AUTH_BRIDGE_ISSUER to the web-admin's public origin, or unset ${WEB_ADMIN_ENV.webUrl}. Refusing to boot.`);
 }
+export function remoteConfigProviderUrlRefusal(v) {
+    return v.configProvider === "remote" && v.webAdmin === undefined
+        ? `CONFIG_PROVIDER=remote names the web-admin center as this worker's config source, but ${WEB_ADMIN_ENV.url} is not set — there is no center to pull ` +
+            "from, so this worker would run without the center's configuration (tenant entitlements, model catalog, governance) while it is declared centrally managed. " +
+            `Set ${WEB_ADMIN_ENV.url} to the center's base URL, or set CONFIG_PROVIDER=local to read the local config directory (unset CONFIG_PROVIDER for an env-only worker). ` +
+            "Refusing to boot."
+        : undefined;
+}
+export function retentionLaneRefusal(v) {
+    const { mode, intervalSec } = v.retentionSweep;
+    const cadence = intervalSec > 0;
+    const horizon = v.retentionPolicy !== undefined;
+    if ((mode !== "enforce" && !cadence) || (cadence && horizon))
+        return undefined;
+    const gaps = [
+        ...(horizon ? [] : ["RETENTION_MAX_AGE_DAYS is unset (no horizon to compute a cutoff from)"]),
+        ...(cadence ? [] : ["RETENTION_SWEEP_INTERVAL_SEC is unset or 0 (the sweep lane does not run)"]),
+    ].join(" and ");
+    if (mode === "enforce") {
+        const needs = [...(horizon ? [] : ["RETENTION_MAX_AGE_DAYS"]), ...(cadence ? [] : ["RETENTION_SWEEP_INTERVAL_SEC above 0"])].join(" and ");
+        const declareOnly = cadence && !horizon ? "set RETENTION_MODE=audit-only (or unset it) and RETENTION_SWEEP_INTERVAL_SEC=0" : "set RETENTION_MODE=audit-only (or unset it)";
+        return (`RETENTION_MODE=enforce declares that the retention sweep lane deletes data older than the policy horizon, but ${gaps} — nothing would be deleted ` +
+            `while the deployment declares that it deletes. Set ${needs} (the sweep lane runs on a SQL backend), or ${declareOnly} ` +
+            "if this deployment is not to delete. Refusing to boot.");
+    }
+    return (`RETENTION_SWEEP_INTERVAL_SEC=${intervalSec} arms the retention sweep lane, but ${gaps} — the lane would enumerate domains every tick and compute nothing. ` +
+        "Set RETENTION_MAX_AGE_DAYS, or set RETENTION_SWEEP_INTERVAL_SEC=0 to leave the lane off. Refusing to boot.");
+}
 export const CONFIG_CROSS_INVARIANTS = [
     {
         id: "run-stale-heartbeat",
@@ -297,6 +325,20 @@ export const CONFIG_CROSS_INVARIANTS = [
         bootAnchor: { file: "src/config.ts", marker: "CROSS-INVARIANT:center-one-identity" },
         check: ({ next }) => centerIdentityRefusal(next),
     },
+    {
+        id: "remote-config-provider-url",
+        keys: ["configProvider", "webAdmin"],
+        restartReason: "config-source",
+        bootAnchor: { file: "src/config.ts", marker: "CROSS-INVARIANT:remote-config-provider-url" },
+        check: ({ next }) => remoteConfigProviderUrlRefusal(next),
+    },
+    {
+        id: "retention-lane-complete",
+        keys: ["retentionPolicy", "retentionSweep"],
+        restartReason: "retention-lane",
+        bootAnchor: { file: "src/config.ts", marker: "CROSS-INVARIANT:retention-lane-complete" },
+        check: ({ next }) => retentionLaneRefusal(next),
+    },
 ];
 export function crossInvariant(id) {
     const inv = CONFIG_CROSS_INVARIANTS.find((i) => i.id === id);

package/dist/config-provider.d.ts

@@ -120,12 +120,12 @@ export interface ConfigProviderInput {
     };
     /** `CONFIG_PROVIDER` —— 闭集 `local` | `remote` | 缺席([ref]:词表属主 `CONFIG_PROVIDER_WORDS`,认不出的词在
      *  `loadConfig` 就拒启,本层**不可能**再收到第三个词 —— 修前那条「认不出 ⇒ 当 local + warn」的臂随之删除)。
-     *  `local` forces the local backend; `remote` selects the center (falls through to local if no URL). */
+     *  读法只有 {@link configSourceKind} 一只:`local` 建本地源;`remote` 建中心源(没有 `webAdmin` ⇒ 抛,起服本应已拒);缺席 ⇒ 有中心建中心源、没有 ⇒ 抛(纯 env 部署不建配置源)。 */
     provider?: ConfigProviderWord;
     /** 本地配置源的根(持有 `config.d/<domain>.json`;FileConfigStore 吃根、读 `<root>/config.d`)。🔴 [ref]:**必填**,
      *  值恒来自 {@link configLocalRoot}(入口算一次,工厂与执行车道合成步读同一个)—— 修前是可选、缺席回落
      *  `process.cwd()`,而工厂只在 `CONFIG_PROVIDER === "local"` 字面上递它 ⇒ 另一条走到 local 的路上配置源读 cwd、
-     *  合成步读 localRoot,两个根分家。一个远程源也收它:`remote` 而无中心 URL 的形照样落回 local。 */
+     *  合成步读 localRoot,两个根分家。远程源也收它(入参形一份),只有本地源读它。 */
     localDir: string;
     /** [ref]:本地配置源的属主声明(`CONFIG_LOCAL_OWNER_UID`,配置席 `configLocalOwnerUid`)—— 每拍读 `config.d` 之前的目录信任判官与起服那一次判同一个值。
      *  **必填**(值可以是 `undefined` = 没声明):两个生产构造点都必须递,漏递 = 起服判过、每拍却按「没声明」判 ⇒ 每一拍都拒(tsc 在这里挡)。 */
@@ -186,15 +186,11 @@ export declare class LocalConfigProvider implements ConfigProvider {
  */
 export declare function mapToServiceEffective(eff: AgentConfigEffective, version: number): EffectiveConfig;
 /**
- * Pick the backend off a CLOSED `provider` enum (`local` | `remote` | undefined): LOCAL when
- * `CONFIG_PROVIDER=local`, OR when no web-admin URL is configured (a lone box with config.d/ on disk
- * and no control plane). REMOTE otherwise (a configured center URL, the default fleet posture). A
- * `CONFIG_PROVIDER=remote` with no URL is a misconfiguration — we fall through to local rather than
- * constructing a remote provider with no endpoint (the caller would have skipped the remote pull entirely
- * under the old code path; local-with-empty-config.d degrades to env the same way). An UNRECOGNIZED value
- * never reaches this function: `loadConfig` refuses to boot on it ([ref]), so a fat-fingered knob can
- * neither source config from an unintended network endpoint nor be read as "local" here while the
- * execution-lane default reads it as "not local".
+ * 建判官 {@link configSourceKind} 答出来的那一种配置源:`local` ⇒ {@link LocalConfigProvider}(根 = 递进来的 `localDir`);`remote` ⇒
+ * {@link RemoteConfigProvider}(中心 = `webAdmin`)。判官答「无配置源」(没写词、没配中心 = 纯 env 部署)⇒ 抛:调用方只在判官答 local / remote 时建
+ * (服务端第 2 段先问判官;run-local 在入口只放过 `local` 的词)。没有第三种读法 —— 「remote 而没有中心 ⇒ 落回本地」那一臂已删(配置源的词要么兑现、要么拒;
+ * 起服在 `loadConfig` 的配置不变量段拒这一组合,到得了这里 = 绕过了 `loadConfig`,判官抛起服拒的同一句)。认不出的词同样到不了这里:
+ * `loadConfig` 拒启([ref]),入参型是闭集。
  */
 export declare function createConfigProvider(input: ConfigProviderInput): ConfigProvider;
 /**
@@ -209,21 +205,20 @@ export declare function createConfigProvider(input: ConfigProviderInput): Config
 export declare function configLocalRoot(config: {
     readonly configLocalDir?: string | undefined;
 }): string;
+/** 配置源的两种形态(纯 env 部署没有配置源 —— 判官答 `undefined`)。 */
+export type ConfigSourceKind = "local" | "remote";
 /**
- * {@link createConfigProvider} 会造出**哪一种**配置源 —— 判据的唯一属主(构造器与执行车道合成步读同一只:
- * local 形 `config.d/remote-exec.json` 的 file-wins 覆写只在配置源是 local 时生效,车PI 修复轮 ①)。
- * `local` 或没配中心 ⇒ local;其余 ⇒ remote。([ref] 起入参是闭集:「认不出的词 ⇒ local」那一臂随拒启删除。)
+ * 这台进程的配置源是**哪一种** —— 判据的唯一属主(一个问题一个读者):HTTP 服务第 2 段(目录信任 + 一次性迁移、执行车道合成步)、
+ * web-admin 工厂与 {@link createConfigProvider}(run-local 经它;run-local 在入口只放过 `local` 的词)都问这一只。规则一条 —— 配置源的词要么兑现、要么拒:
+ *  · `CONFIG_PROVIDER=local` ⇒ `local`(配没配中心都是;中心照样管 fleet 面);
+ *  · `CONFIG_PROVIDER=remote` ⇒ `remote`;没有中心 ⇒ **抛**起服拒的同一句(`remoteConfigProviderUrlRefusal`;`loadConfig` 的配置不变量段本应已拒,
+ *    到得了这里 = 绕过了它)—— 修前这一形在两只判官里各被读成一种别的源(服务端「无配置源」、构造器「local」),零句;
+ *  · 不写词 ⇒ 有中心 `remote`、没有 `undefined`(纯 env 部署,不建配置源)。
+ * 修前是两只判官(`configProviderKind` 答 local | remote、`serviceConfigSourceKind` 包一层答 local | remote | 无),对「不写词、没配中心」一只答 local、
+ * 一只答无;收成这一只,两名删除。
  */
-export declare function configProviderKind(input: {
-    readonly provider?: ConfigProviderWord | undefined;
-    readonly webAdmin?: unknown;
-}): "local" | "remote";
-/**
- * HTTP 服务这一侧的配置源:web-admin 工厂**建不建** provider(`CONFIG_PROVIDER=local` 或配了中心才建)、建出来是哪一种。
- * `undefined` = 纯 env 部署(没有配置源)。工厂与执行车道合成步读这同一只(车PI 修复轮 ①:合成步排在工厂之前)。
- */
-export declare function serviceConfigSourceKind(config: {
+export declare function configSourceKind(config: {
     readonly configProvider?: ConfigProviderWord | undefined;
     readonly webAdmin?: unknown;
-}): "local" | "remote" | undefined;
+}): ConfigSourceKind | undefined;
 //# sourceMappingURL=config-provider.d.ts.map

package/dist/config-provider.js

@@ -6,6 +6,7 @@ import { assertLocalConfigDirTrusted } from "./config-dir-trust.js";
 import { danglingRefs, emptyEffective, findSkillContent, promptArtifactFor, renderRefIssue, skillContentHash, } from "@sema-agent/settings-schema";
 import { redactSecrets } from "./trace/redact.js";
 import { fetchEffective as remoteFetchEffective, fetchSkillContent as remoteFetchSkillContent, skillToolListsOf, WebAdminHttpError, } from "./web-admin-client/facade.js";
+import { remoteConfigProviderUrlRefusal } from "./config-invariants.js";
 import { homedir } from "node:os";
 import { join } from "node:path";
 const OPERAND_FINGERPRINT_KEY = randomBytes(16);
@@ -205,6 +206,8 @@ export function mapToServiceEffective(eff, version) {
                     ...readMcpSourceLabel(s.name, s.source),
                     ...(s.toolFaces !== undefined ? { toolFaces: s.toolFaces } : {}),
                     ...(s.toolAxes !== undefined ? { toolAxes: s.toolAxes } : {}),
+                    ...(s.sessionMetaKey !== undefined ? { sessionMetaKey: s.sessionMetaKey } : {}),
+                    ...(s.startupTimeoutMs !== undefined ? { startupTimeoutMs: s.startupTimeoutMs } : {}),
                     ...(s.authForm !== undefined ? { authForm: s.authForm } : {}),
                     ...(s.entryKind !== undefined ? { entryKind: s.entryKind } : {}),
                 };
@@ -248,21 +251,33 @@ export function mapToServiceEffective(eff, version) {
     };
 }
 export function createConfigProvider(input) {
-    return configProviderKind(input) === "remote" && input.webAdmin !== undefined
-        ? new RemoteConfigProvider(input.webAdmin, {}, input.skillBodyCacheDir)
-        : new LocalConfigProvider(input.localDir, undefined, { declaredOwnerUid: input.localOwnerUid });
+    const kind = configSourceKind({ configProvider: input.provider, webAdmin: input.webAdmin });
+    if (kind === "local")
+        return new LocalConfigProvider(input.localDir, undefined, { declaredOwnerUid: input.localOwnerUid });
+    if (kind === "remote" && input.webAdmin !== undefined)
+        return new RemoteConfigProvider(input.webAdmin, {}, input.skillBodyCacheDir);
+    throw new Error(`createConfigProvider: no config source to build (CONFIG_PROVIDER is unset and no center is configured — an env-only deployment). ` +
+        `Build a provider only when configSourceKind answers "local" or "remote".`);
 }
 export function configLocalRoot(config) {
     return config.configLocalDir ?? process.env.AGENT_DATA_DIR ?? join(homedir(), ".ai-agent");
 }
-export function configProviderKind(input) {
-    if (input.provider === "local" || input.webAdmin === undefined)
-        return "local";
-    return "remote";
-}
-export function serviceConfigSourceKind(config) {
-    if (config.webAdmin === undefined && config.configProvider !== "local")
-        return undefined;
-    return configProviderKind({ provider: config.configProvider, webAdmin: config.webAdmin });
+export function configSourceKind(config) {
+    switch (config.configProvider) {
+        case "local":
+            return "local";
+        case "remote": {
+            const refusal = remoteConfigProviderUrlRefusal(config);
+            if (refusal !== undefined)
+                throw new Error(refusal);
+            return "remote";
+        }
+        case undefined:
+            return config.webAdmin !== undefined ? "remote" : undefined;
+        default: {
+            const unreachable = config.configProvider;
+            throw new Error(`configSourceKind: CONFIG_PROVIDER word outside the closed set: ${String(unreachable)}`);
+        }
+    }
 }
 //# sourceMappingURL=config-provider.js.map

package/dist/config-types.d.ts

@@ -936,7 +936,9 @@ export interface ServiceConfigFlat {
         token?: string;
         caCert?: string;
         insecureTls?: boolean;
-        namespace?: string;
+        /** `K8S_NAMESPACE` — the namespace the sandbox pods live in. REQUIRED, no default: the loader refuses to start when `REMOTE_EXEC=k8s` names the
+         *  lane without it, so this arm never carries an absent namespace and no consumer needs a fallback of its own. */
+        namespace: string;
         runtimeClass?: string;
         mountPath?: string;
         timeoutMs?: number;
@@ -1312,15 +1314,16 @@ export interface ServiceConfigFlat {
      *
      * 🔴 语义边界(成文,别当成"数据会被删"):core **只**拿它做启动期能力校验(锁着 + 店未声明
      * `retention:"managed"` ⇒ 拒启),引擎自己在任务路径上从不删数据;真执行(调度/重试/副本协调/审计)
-     * 是部署侧的活,本仓**尚未**建([ref] §5.2「server 半场四件皆新建」)。所以配了策略而没有任何
-     * managed 店时,启动会打一条 `retention_policy_not_executed` 的响亮 warn。
+     * 是部署侧的活 —— 扫车道(`retentionSweep`,`boot/retention-lane.ts`)。配了策略而扫车道关着(只可能在 `audit-only` 档:
+     * `enforce` 而车道不齐起服拒,配置不变量 `retention-lane-complete`)时,启动会打一条 `retention_policy_not_executed` 的响亮 warn。
      */
     retentionPolicy?: RetentionPolicy;
     /**
      * [ref] 车2 —— 托管留存 **sweep lane** 的两个旋钮(设计稿 `DESIGN-270-retention-lane.md` §3/§4)。
      * `retentionPolicy` 说的是「保留多久」(一句声明),本格说的是「谁在什么节律上按那句话删」。
      * **恒在场**(不是可选块):两根都有文档化的缺省,而缺省本身是一条要能被读出来的姿态 ——
-     * `{mode:"audit-only", intervalSec:0}` = 「lane 关着,真开起来也先只记账」。
+     * `{mode:"audit-only", intervalSec:0}` = 「lane 关着,真开起来也先只记账」。被要的车道必须齐(`intervalSec > 0` 或 `mode:"enforce"` ⇒
+     * 视界与 > 0 的节律都在,否则起服拒 —— 配置不变量 `retention-lane-complete`)。
      */
     retentionSweep: RetentionSweepConfig;
     /** Tool names that require operator approval before running (F4). Empty = no approval gate. */
@@ -2267,8 +2270,10 @@ export interface ServiceConfigFlat {
      *  传输上界)与 `CENTER_CREDENTIAL_RENEW_LEAD_MAX_MS`(访问令牌寿命之半)之间,坏值拒启(解析口 `parseCenterCredentialRenewLeadMs`)。
      *  裸行文件 / `SEMA_WEB_ADMIN_TOKEN` 值形不受它影响(不续签)。`CENTER_CREDENTIAL_RENEW_LEAD_MS`。 */
     centerCredentialRenewLeadMs: number;
-    /** Dual-mode config SOURCE (DUAL-MODE-DESIGN §4): "remote" (web-admin HTTP) | "local" (.env + config.d
+    /** Dual-mode config SOURCE (DUAL-MODE-DESIGN §4): "remote" (web-admin HTTP; needs SEMA_WEB_ADMIN_URL — remote without it
+     *  refuses to boot, cross-invariant `remote-config-provider-url`) | "local" (.env + config.d
      *  via @sema-agent/settings-schema FileConfigStore) | unset → remote if SEMA_WEB_ADMIN_URL is set, else pure-env.
+     *  One reader: `configSourceKind` (config-provider.ts).
      *  Env: CONFIG_PROVIDER —— [ref] 起闭集 {@link CONFIG_PROVIDER_WORDS}(认不出的词拒启;空串 = 未设)。
      *  The same resolver/EffectiveConfig either way (can't drift). */
     configProvider?: ConfigProviderWord;