@sema-agent/server 7.138.0 → 7.140.0

package/dist/approval-card.d.ts

@@ -83,10 +83,10 @@ export declare const RuleOfferSchema: z.ZodUnion<readonly [z.ZodObject<{
     kind: z.ZodLiteral<"single">;
     rule: z.ZodString;
     match: z.ZodEnum<{
-        name: "name";
-        tool: "tool";
         host: "host";
+        name: "name";
         path: "path";
+        tool: "tool";
         exact: "exact";
         pattern: "pattern";
         prefix: "prefix";
@@ -102,10 +102,10 @@ export declare const RuleOfferSchema: z.ZodUnion<readonly [z.ZodObject<{
         kind: z.ZodLiteral<"command">;
         rule: z.ZodString;
         match: z.ZodEnum<{
-            name: "name";
-            tool: "tool";
             host: "host";
+            name: "name";
             path: "path";
+            tool: "tool";
             exact: "exact";
             pattern: "pattern";
             prefix: "prefix";
@@ -554,21 +554,21 @@ export declare const ApprovalCardSchema: z.ZodObject<{
     rememberRefused: z.ZodOptional<z.ZodLiteral<true>>;
     approvalCard: z.ZodOptional<z.ZodEnum<{
         question: "question";
-        skill: "skill";
         plan: "plan";
-        shell: "shell";
+        skill: "skill";
         workflow: "workflow";
-        fetch: "fetch";
-        "file-write": "file-write";
         "file-edit": "file-edit";
+        "file-write": "file-write";
         "notebook-edit": "notebook-edit";
+        shell: "shell";
+        fetch: "fetch";
         generic: "generic";
     }>>;
     inputHasBidi: z.ZodOptional<z.ZodLiteral<true>>;
     allowRuleShadowed: z.ZodOptional<z.ZodArray<z.ZodObject<{
         member: z.ZodEnum<{
-            skill: "skill";
             hook: "hook";
+            skill: "skill";
             deployment: "deployment";
             request: "request";
             persisted: "persisted";
@@ -580,10 +580,10 @@ export declare const ApprovalCardSchema: z.ZodObject<{
         kind: z.ZodLiteral<"single">;
         rule: z.ZodString;
         match: z.ZodEnum<{
-            name: "name";
-            tool: "tool";
             host: "host";
+            name: "name";
             path: "path";
+            tool: "tool";
             exact: "exact";
             pattern: "pattern";
             prefix: "prefix";
@@ -599,10 +599,10 @@ export declare const ApprovalCardSchema: z.ZodObject<{
             kind: z.ZodLiteral<"command">;
             rule: z.ZodString;
             match: z.ZodEnum<{
-                name: "name";
-                tool: "tool";
                 host: "host";
+                name: "name";
                 path: "path";
+                tool: "tool";
                 exact: "exact";
                 pattern: "pattern";
                 prefix: "prefix";
@@ -669,8 +669,8 @@ export declare const ApprovalCardSchema: z.ZodObject<{
         }, z.core.$strict>>>;
         personalRuleDotsAbsent: z.ZodOptional<z.ZodCustom<AskEvidenceAbsence, AskEvidenceAbsence>>;
     }, z.core.$strict>>;
-    askClass: z.ZodOptional<z.ZodCustom<"probe" | "mode" | "hook" | "org_rule" | "write_protection" | "target_unresolved" | "content_question" | "ask_rule" | "denial_limit_fallback" | "ancestor" | "dangerous_delete" | "unverifiable_delete" | "unverifiable_shell_text" | "transcript_write" | "rule_unreadable" | "classifier_no_ruling" | "requires_user_interaction" | "cross_boundary" | "operator_forced" | "shell_floor" | "write_protection_on_disk" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "unstated" | "ordinary", "probe" | "mode" | "hook" | "org_rule" | "write_protection" | "target_unresolved" | "content_question" | "ask_rule" | "denial_limit_fallback" | "ancestor" | "dangerous_delete" | "unverifiable_delete" | "unverifiable_shell_text" | "transcript_write" | "rule_unreadable" | "classifier_no_ruling" | "requires_user_interaction" | "cross_boundary" | "operator_forced" | "shell_floor" | "write_protection_on_disk" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "unstated" | "ordinary">>;
-    classes: z.ZodOptional<z.ZodArray<z.ZodCustom<"probe" | "mode" | "hook" | "org_rule" | "write_protection" | "target_unresolved" | "content_question" | "ask_rule" | "denial_limit_fallback" | "ancestor" | "dangerous_delete" | "unverifiable_delete" | "unverifiable_shell_text" | "transcript_write" | "rule_unreadable" | "classifier_no_ruling" | "requires_user_interaction" | "cross_boundary" | "operator_forced" | "shell_floor" | "write_protection_on_disk" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "unstated" | "ordinary", "probe" | "mode" | "hook" | "org_rule" | "write_protection" | "target_unresolved" | "content_question" | "ask_rule" | "denial_limit_fallback" | "ancestor" | "dangerous_delete" | "unverifiable_delete" | "unverifiable_shell_text" | "transcript_write" | "rule_unreadable" | "classifier_no_ruling" | "requires_user_interaction" | "cross_boundary" | "operator_forced" | "shell_floor" | "write_protection_on_disk" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "unstated" | "ordinary">>>;
+    askClass: z.ZodOptional<z.ZodCustom<"mode" | "hook" | "org_rule" | "write_protection" | "target_unresolved" | "content_question" | "ask_rule" | "denial_limit_fallback" | "ancestor" | "dangerous_delete" | "unverifiable_delete" | "unverifiable_shell_text" | "transcript_write" | "rule_unreadable" | "classifier_no_ruling" | "requires_user_interaction" | "cross_boundary" | "operator_forced" | "shell_floor" | "probe" | "write_protection_on_disk" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "unstated" | "ordinary", "mode" | "hook" | "org_rule" | "write_protection" | "target_unresolved" | "content_question" | "ask_rule" | "denial_limit_fallback" | "ancestor" | "dangerous_delete" | "unverifiable_delete" | "unverifiable_shell_text" | "transcript_write" | "rule_unreadable" | "classifier_no_ruling" | "requires_user_interaction" | "cross_boundary" | "operator_forced" | "shell_floor" | "probe" | "write_protection_on_disk" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "unstated" | "ordinary">>;
+    classes: z.ZodOptional<z.ZodArray<z.ZodCustom<"mode" | "hook" | "org_rule" | "write_protection" | "target_unresolved" | "content_question" | "ask_rule" | "denial_limit_fallback" | "ancestor" | "dangerous_delete" | "unverifiable_delete" | "unverifiable_shell_text" | "transcript_write" | "rule_unreadable" | "classifier_no_ruling" | "requires_user_interaction" | "cross_boundary" | "operator_forced" | "shell_floor" | "probe" | "write_protection_on_disk" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "unstated" | "ordinary", "mode" | "hook" | "org_rule" | "write_protection" | "target_unresolved" | "content_question" | "ask_rule" | "denial_limit_fallback" | "ancestor" | "dangerous_delete" | "unverifiable_delete" | "unverifiable_shell_text" | "transcript_write" | "rule_unreadable" | "classifier_no_ruling" | "requires_user_interaction" | "cross_boundary" | "operator_forced" | "shell_floor" | "probe" | "write_protection_on_disk" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "unstated" | "ordinary">>>;
     fromSubagent: z.ZodOptional<z.ZodLiteral<true>>;
     sourceTaskId: z.ZodOptional<z.ZodString>;
     sourceAgentName: z.ZodOptional<z.ZodString>;
@@ -708,21 +708,21 @@ export declare const ApprovalCardEnvelopeSchema: z.ZodObject<{
         rememberRefused: z.ZodOptional<z.ZodLiteral<true>>;
         approvalCard: z.ZodOptional<z.ZodEnum<{
             question: "question";
-            skill: "skill";
             plan: "plan";
-            shell: "shell";
+            skill: "skill";
             workflow: "workflow";
-            fetch: "fetch";
-            "file-write": "file-write";
             "file-edit": "file-edit";
+            "file-write": "file-write";
             "notebook-edit": "notebook-edit";
+            shell: "shell";
+            fetch: "fetch";
             generic: "generic";
         }>>;
         inputHasBidi: z.ZodOptional<z.ZodLiteral<true>>;
         allowRuleShadowed: z.ZodOptional<z.ZodArray<z.ZodObject<{
             member: z.ZodEnum<{
-                skill: "skill";
                 hook: "hook";
+                skill: "skill";
                 deployment: "deployment";
                 request: "request";
                 persisted: "persisted";
@@ -734,10 +734,10 @@ export declare const ApprovalCardEnvelopeSchema: z.ZodObject<{
             kind: z.ZodLiteral<"single">;
             rule: z.ZodString;
             match: z.ZodEnum<{
-                name: "name";
-                tool: "tool";
                 host: "host";
+                name: "name";
                 path: "path";
+                tool: "tool";
                 exact: "exact";
                 pattern: "pattern";
                 prefix: "prefix";
@@ -753,10 +753,10 @@ export declare const ApprovalCardEnvelopeSchema: z.ZodObject<{
                 kind: z.ZodLiteral<"command">;
                 rule: z.ZodString;
                 match: z.ZodEnum<{
-                    name: "name";
-                    tool: "tool";
                     host: "host";
+                    name: "name";
                     path: "path";
+                    tool: "tool";
                     exact: "exact";
                     pattern: "pattern";
                     prefix: "prefix";
@@ -823,8 +823,8 @@ export declare const ApprovalCardEnvelopeSchema: z.ZodObject<{
             }, z.core.$strict>>>;
             personalRuleDotsAbsent: z.ZodOptional<z.ZodCustom<AskEvidenceAbsence, AskEvidenceAbsence>>;
         }, z.core.$strict>>;
-        askClass: z.ZodOptional<z.ZodCustom<"probe" | "mode" | "hook" | "org_rule" | "write_protection" | "target_unresolved" | "content_question" | "ask_rule" | "denial_limit_fallback" | "ancestor" | "dangerous_delete" | "unverifiable_delete" | "unverifiable_shell_text" | "transcript_write" | "rule_unreadable" | "classifier_no_ruling" | "requires_user_interaction" | "cross_boundary" | "operator_forced" | "shell_floor" | "write_protection_on_disk" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "unstated" | "ordinary", "probe" | "mode" | "hook" | "org_rule" | "write_protection" | "target_unresolved" | "content_question" | "ask_rule" | "denial_limit_fallback" | "ancestor" | "dangerous_delete" | "unverifiable_delete" | "unverifiable_shell_text" | "transcript_write" | "rule_unreadable" | "classifier_no_ruling" | "requires_user_interaction" | "cross_boundary" | "operator_forced" | "shell_floor" | "write_protection_on_disk" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "unstated" | "ordinary">>;
-        classes: z.ZodOptional<z.ZodArray<z.ZodCustom<"probe" | "mode" | "hook" | "org_rule" | "write_protection" | "target_unresolved" | "content_question" | "ask_rule" | "denial_limit_fallback" | "ancestor" | "dangerous_delete" | "unverifiable_delete" | "unverifiable_shell_text" | "transcript_write" | "rule_unreadable" | "classifier_no_ruling" | "requires_user_interaction" | "cross_boundary" | "operator_forced" | "shell_floor" | "write_protection_on_disk" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "unstated" | "ordinary", "probe" | "mode" | "hook" | "org_rule" | "write_protection" | "target_unresolved" | "content_question" | "ask_rule" | "denial_limit_fallback" | "ancestor" | "dangerous_delete" | "unverifiable_delete" | "unverifiable_shell_text" | "transcript_write" | "rule_unreadable" | "classifier_no_ruling" | "requires_user_interaction" | "cross_boundary" | "operator_forced" | "shell_floor" | "write_protection_on_disk" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "unstated" | "ordinary">>>;
+        askClass: z.ZodOptional<z.ZodCustom<"mode" | "hook" | "org_rule" | "write_protection" | "target_unresolved" | "content_question" | "ask_rule" | "denial_limit_fallback" | "ancestor" | "dangerous_delete" | "unverifiable_delete" | "unverifiable_shell_text" | "transcript_write" | "rule_unreadable" | "classifier_no_ruling" | "requires_user_interaction" | "cross_boundary" | "operator_forced" | "shell_floor" | "probe" | "write_protection_on_disk" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "unstated" | "ordinary", "mode" | "hook" | "org_rule" | "write_protection" | "target_unresolved" | "content_question" | "ask_rule" | "denial_limit_fallback" | "ancestor" | "dangerous_delete" | "unverifiable_delete" | "unverifiable_shell_text" | "transcript_write" | "rule_unreadable" | "classifier_no_ruling" | "requires_user_interaction" | "cross_boundary" | "operator_forced" | "shell_floor" | "probe" | "write_protection_on_disk" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "unstated" | "ordinary">>;
+        classes: z.ZodOptional<z.ZodArray<z.ZodCustom<"mode" | "hook" | "org_rule" | "write_protection" | "target_unresolved" | "content_question" | "ask_rule" | "denial_limit_fallback" | "ancestor" | "dangerous_delete" | "unverifiable_delete" | "unverifiable_shell_text" | "transcript_write" | "rule_unreadable" | "classifier_no_ruling" | "requires_user_interaction" | "cross_boundary" | "operator_forced" | "shell_floor" | "probe" | "write_protection_on_disk" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "unstated" | "ordinary", "mode" | "hook" | "org_rule" | "write_protection" | "target_unresolved" | "content_question" | "ask_rule" | "denial_limit_fallback" | "ancestor" | "dangerous_delete" | "unverifiable_delete" | "unverifiable_shell_text" | "transcript_write" | "rule_unreadable" | "classifier_no_ruling" | "requires_user_interaction" | "cross_boundary" | "operator_forced" | "shell_floor" | "probe" | "write_protection_on_disk" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "unstated" | "ordinary">>>;
         fromSubagent: z.ZodOptional<z.ZodLiteral<true>>;
         sourceTaskId: z.ZodOptional<z.ZodString>;
         sourceAgentName: z.ZodOptional<z.ZodString>;

package/dist/bench/s1/arms.d.ts

@@ -95,7 +95,7 @@ export declare function bindingFromCheckpoint(cp: Checkpoint | null): {
     boundInputHash: string;
 } | undefined;
 /** The non-optional C1 finance taxonomy the harness always emits (core's `CoreStatsSubset.costBreakdown` is
- *  OPTIONAL for back-compat, but the producer ALWAYS fills all four lines — this is that concrete shape). */
+ *  OPTIONAL for back-compat, but the producer ALWAYS fills its three required lines — this is that concrete shape). */
 type CostBreakdown = NonNullable<CoreStatsSubset["costBreakdown"]>;
 /** The s1.v1 `stats` the producer emits — a `CoreStatsSubset` with `costBreakdown` + `humanReview` ALWAYS present
  *  (core types them optional; the harness never omits them, so it works with concrete, non-undefined locals). */

package/dist/bench/s1/arms.js

@@ -24,7 +24,7 @@ export function bindingFromCheckpoint(cp) {
 }
 const ORACLE_UNDELIVERED = { delivered: false, hiddenTestsGreen: false, buildPassed: false, invariantsOk: false };
 function emptyCostBreakdown() {
-    return { llmRootMicroUsd: 0, nestedSubagentMicroUsd: 0, memoryConsolidationMicroUsd: 0, compactionMicroUsd: 0 };
+    return { llmRootMicroUsd: 0, nestedSubagentMicroUsd: 0, compactionMicroUsd: 0 };
 }
 export function classifyRunStatus(input) {
     if (input.status === "failed")
@@ -40,7 +40,6 @@ export function captureStats(stats) {
         costBreakdown: {
             llmRootMicroUsd: bd.llmRootMicroUsd,
             nestedSubagentMicroUsd: bd.nestedSubagentMicroUsd,
-            memoryConsolidationMicroUsd: bd.memoryConsolidationMicroUsd,
             compactionMicroUsd: bd.compactionMicroUsd,
         },
         humanReview: { count: hr.count, totalWaitMs: hr.totalWaitMs, gates: hr.gates },
@@ -55,7 +54,6 @@ export async function driveSupSuspendResume(initial, deps, implSpec, trap, advan
             return;
         c1Acc.llmRootMicroUsd += b.llmRootMicroUsd;
         c1Acc.nestedSubagentMicroUsd += b.nestedSubagentMicroUsd;
-        c1Acc.memoryConsolidationMicroUsd += b.memoryConsolidationMicroUsd;
         c1Acc.compactionMicroUsd += b.compactionMicroUsd;
     };
     let exitedViaBreak = false;

package/dist/bench/s1/live-deps.js

@@ -6,7 +6,7 @@ import { withUnattendedLeg } from "../../unattended-permission-mode.js";
 import { createBrain } from "../../brain.js";
 import { buildPricing } from "../../budget.js";
 import { RemoteContainerExecutionEnv } from "../../plugins/remote-env-e2b.js";
-import { E2B_SANDBOX_HOME } from "../../execution-lane-caps.js";
+import { buildLaneHomeClaim } from "../../execution-lane-caps.js";
 import { createDurableAskPolicy } from "../../approval.js";
 import { runOracle as runStandaloneOracle } from "./oracle.js";
 import { makeRepairOracle } from "./repair-oracle-adapter.js";
@@ -68,9 +68,10 @@ const sh = (env) => async (cmd) => {
     return { code: r.value.exitCode, out: (r.value.stdout + r.value.stderr).trim() };
 };
 async function provisionSandbox(rt, role, cellId) {
+    const homeSeat = rt.e2bTemplate ? {} : buildLaneHomeClaim({ remoteExec: { provider: "e2b" } });
     const env = new RemoteContainerExecutionEnv({
         apiKey: rt.e2bApiKey,
-        homeDir: E2B_SANDBOX_HOME,
+        ...homeSeat,
         ...(rt.e2bTemplate ? { template: rt.e2bTemplate } : {}),
         timeoutMs: rt.sandboxTimeoutMs ?? 600_000,
         metadata: { s1Cell: cellId, s1Role: role },

package/dist/bench/s1/row.d.ts

@@ -34,8 +34,11 @@ export type { RunRecord, OracleVerdicts, DeliveryDecision, CoreStatsSubset, Inte
 /** The schema version stamped into every row — the field-contract handshake with core's metric tool. */
 export declare const S1_SCHEMA_VERSION: "s1.v1";
 export type S1SchemaVersion = typeof S1_SCHEMA_VERSION;
-/** The INSTALLED core version, read from node_modules at load(SPEC §0 provenance-honesty——接入审计 L16:
- *  硬钉 "1.111.0" 在 core 升到 1.258.x 后让 harness 每行 meta.coreVersion 输出错误溯源;动态读=永不再漂)。 */
+/** The INSTALLED core version (SPEC §0 provenance-honesty — a hard-pinned "1.111.0" once drifted past a core upgrade and stamped every row's
+ *  `meta.coreVersion` with the wrong provenance). Read from core's own root export `CONTRACT_KIT_ENGINE_VERSION` — the engine's
+ *  `package.json` version, resolved by the engine itself ("unknown" only under a bundler that severed the module from its package root) —
+ *  not by walking the installed package's directory from here (the dependency-direction gate, `test/dependency-direction-gate.test.ts` R2,
+ *  bans reading core's install tree by file-system path). */
 export declare const S1_CORE_VERSION: string;
 /** The arm tag as emitted on the wire (lowercase — the s1.v1 contract value; the internal `Arm` is uppercase). The
  *  harness emits a SUBSET of core's `RunRecord["arm"]` (which also carries "sup-vf", an S1b ablation S1 does not run). */

package/dist/bench/s1/row.js

@@ -1,27 +1,7 @@
 import { buildReport, trulyCorrect, } from "@sema-agent/core/bench";
-import { createRequire } from "node:module";
-import { readFileSync, existsSync } from "node:fs";
-import { dirname, join } from "node:path";
+import { CONTRACT_KIT_ENGINE_VERSION } from "@sema-agent/core";
 export const S1_SCHEMA_VERSION = "s1.v1";
-export const S1_CORE_VERSION = (() => {
-    try {
-        const require = createRequire(import.meta.url);
-        let dir = dirname(require.resolve("@sema-agent/core"));
-        for (let i = 0; i < 6; i++) {
-            const pj = join(dir, "package.json");
-            if (existsSync(pj)) {
-                const parsed = JSON.parse(readFileSync(pj, "utf8"));
-                if (parsed.name === "@sema-agent/core" && parsed.version)
-                    return parsed.version;
-            }
-            dir = dirname(dir);
-        }
-        return "unknown";
-    }
-    catch {
-        return "unknown";
-    }
-})();
+export const S1_CORE_VERSION = CONTRACT_KIT_ENGINE_VERSION;
 export function armTag(arm) {
     switch (arm) {
         case "SOLO":

package/dist/bench/s1/run-firm.js

@@ -109,7 +109,7 @@ function infraFailedRow(cell, ctx) {
         oracle: { delivered: false, hiddenTestsGreen: false, buildPassed: false, invariantsOk: false },
         delivery: { withheld: false },
         stats: {
-            costBreakdown: { llmRootMicroUsd: 0, nestedSubagentMicroUsd: 0, memoryConsolidationMicroUsd: 0, compactionMicroUsd: 0 },
+            costBreakdown: { llmRootMicroUsd: 0, nestedSubagentMicroUsd: 0, compactionMicroUsd: 0 },
             humanReview: { count: 0, totalWaitMs: 0, gates: [] },
         },
         wallTimeSec: 0,
@@ -221,7 +221,7 @@ export function positiveIntArg(raw, def, flag) {
 function dryRunMockFactory() {
     return (trap, seed) => {
         const stats = {
-            costBreakdown: { llmRootMicroUsd: 50_000, nestedSubagentMicroUsd: 0, memoryConsolidationMicroUsd: 0, compactionMicroUsd: 0 },
+            costBreakdown: { llmRootMicroUsd: 50_000, nestedSubagentMicroUsd: 0, compactionMicroUsd: 0 },
             humanReview: { count: 0, totalWaitMs: 0, gates: [] },
         };
         const green = trap.id !== "C2-honest-bound";

package/dist/boot/adoption.js

@@ -5,7 +5,7 @@ export async function runAdoptionBootScan(ctx) {
         return { scanned: 0, resumed: [], stalled: [], rejected: [], failed: [] };
     const runner = createAdoptionRunner({
         store,
-        dialect: ctx.backend?.kind === "pg" ? "pg" : "tidb",
+        dialect: ctx.backend?.kind === "pg" ? "pg" : "mysql",
         now: ctx.now ?? Date.now,
         logger: ctx.logger,
     });

package/dist/boot/device-lane.d.ts

@@ -1,7 +1,7 @@
 /**
  * [ref] A10 分段 —— **device lane 的装配件**(device-executor-lane-v2 §4.6/§4.7/§5,车A-4)。
  *
- * 一处建齐三件活对象:**店**(四表双库的 `DeviceStore`)→ **准入链**(`DeviceEnrollment`,含跨副本
+ * 一处建齐三件活对象:**店**(三表双库的 `DeviceStore`;绑定写在根会话行的执行格上)→ **准入链**(`DeviceEnrollment`,读会话店的执行席,含跨副本
  * 限速座)→ **WS 汇聚端**(`DeviceWsHub`)。三件的依赖是单向的(hub 吃 store+enrollment),所以它们
  * 必须在同一处按序建 —— 拆到三处装配点会让「hub 拿到的是不是同一只店」变成一个要读三个文件才答得出
  * 的问题(而答错的后果是 presence 与租约各写各的)。
@@ -15,6 +15,7 @@
  */
 import { type DeviceEnrollment } from "../device-enrollment.js";
 import type { DeviceStore } from "../device-store.js";
+import type { ExecutionPlacementSeat } from "../execution-placement.js";
 import { type DeviceWsHub } from "../device-ws-hub.js";
 import type { ServiceConfig } from "../config.js";
 import type { Logger } from "../observability/logger.js";
@@ -25,6 +26,8 @@ export interface DeviceLaneCtx {
     logger: Logger;
     metrics: Metrics;
     backend: StoreBackend | undefined;
+    /** 会话店的执行席(`sessionStore.executionPlacement`):根会话 ↔ 设备绑定的唯一载体与唯一读。device 车道只在 SQL 后端 ⇒ 席恒在;缺 = 装配缝 ⇒ 本函数响亮抛。 */
+    seat: ExecutionPlacementSeat | undefined;
     /** 本副本 id(写进连接租约行 —— §4.6 的跨副本排障面)。 */
     replicaId: string;
 }
@@ -32,6 +35,8 @@ export interface DeviceLane {
     store: DeviceStore;
     enrollment: DeviceEnrollment;
     hub: DeviceWsHub;
+    /** 会话店的执行席(准入链、工厂、换绑门读的同一只)。 */
+    seat: ExecutionPlacementSeat;
 }
 /**
  * 注册口(`POST /v1/devices/enroll`,pre-auth)的限速策略 —— **本车道自己的地板,不挂任何运维旋钮**。
@@ -49,7 +54,7 @@ export declare const DEVICE_ENROLL_RATE_POLICY: {
     readonly windowMs: 60000;
 };
 /**
- * 建齐 device lane 的三件。返回 `undefined` = **建不起来**(没有 SQL 后端 ⇒ 没有四表店)。
+ * 建齐 device lane 的三件。返回 `undefined` = **建不起来**(没有 SQL 后端 ⇒ 没有设备店)。
  *
  * 只在调用方判定本部署是 device 车道时调用;非 device 车道调用它是纯浪费(会白建一只 WS server)。
  */
@@ -61,7 +66,7 @@ export declare function createDeviceLane(ctx: DeviceLaneCtx): DeviceLane | undef
  * config 层的门①判的是「运维配没配 SQL 坐标」——那句话回答的是**意图**。它回答不了「这次启动**真的
  * 拿到**了店吗」:`openStoreBackendWithFallback` 曾在 `SESSION_BACKEND=auto` 下,SQL 连不上 /
  * 建表失败 ⇒ `backend=undefined` + 一条 warn 就继续启动(那条降级臂已退役:配了 DSN 的库窗内重试、到窗拒启,见 `plugins/store-open-wait.ts`;
- * 仍走得到本门的形:`DB_BACKEND=mysql|pg` 声明了 SQL 而 `SESSION_BACKEND=memory`,刻意不持久 ⇒ 不开店)。那次启动里 device lane 的四表整个不在,
+ * 仍走得到本门的形:`DB_BACKEND=mysql|pg` 声明了 SQL 而 `SESSION_BACKEND=memory`,刻意不持久 ⇒ 不开店)。那次启动里 device lane 的表整个不在,
  * 而 `boot/execution-env.ts` 的第七臂拿不到三件 ⇒ `executionEnvFactory` 落 `undefined` ⇒ core 拿
  * `StubExecutionEnv`:**一台自称在员工设备上执行的 worker 实际在自己进程里跑,而且回执同形**。
  * 那正是 [ref]「执行车道禁静默降级」点名的样板病,也正是 A-1 那条临时门当初要拦的东西 —— 换执法点,

package/dist/boot/device-lane.js

@@ -2,13 +2,18 @@ import { createDeviceEnrollment, createFixedWindowRateLimiter } from "../device-
 import { createDeviceWsHub } from "../device-ws-hub.js";
 export const DEVICE_ENROLL_RATE_POLICY = { limit: 10, windowMs: 60_000 };
 export function createDeviceLane(ctx) {
-    const { config, logger, metrics, backend, replicaId } = ctx;
+    const { config, logger, metrics, backend, replicaId, seat } = ctx;
     const store = backend?.device?.();
     if (!store)
         return undefined;
+    if (seat === undefined) {
+        throw new Error("device lane: the device store is wired but the session store carries no execution placement seat — the session↔device binding lives on the " +
+            "root session row and is read only through that seat; refusing to start a device lane that could neither bind nor read a binding (assembly bug)");
+    }
     const knobs = config.remoteExec?.provider === "device" ? config.remoteExec : undefined;
     const enrollment = createDeviceEnrollment({
         store,
+        seat,
         rateLimiter: createFixedWindowRateLimiter(DEVICE_ENROLL_RATE_POLICY),
     });
     const hub = createDeviceWsHub({
@@ -33,7 +38,7 @@ export function createDeviceLane(ctx) {
         maxPreAuthPerRemote: knobs?.maxPreAuthPerRemote ?? 8,
         enrollRateLimit: `${DEVICE_ENROLL_RATE_POLICY.limit}/${DEVICE_ENROLL_RATE_POLICY.windowMs / 1000}s per caller identity (per replica; independent of RATE_LIMIT_RPM)`,
     });
-    return { store, enrollment, hub };
+    return { store, enrollment, hub, seat };
 }
 export function assertDeviceLaneWired(isDeviceLane, lane, hasFactory) {
     if (!isDeviceLane)

package/dist/boot/execution-env.d.ts

@@ -1,11 +1,12 @@
 import { TaskEnvRegistry } from "../capabilities/sandbox-file-send.js";
 import { SessionEnvironmentSelection } from "../capabilities/select-environment-tool.js";
-import type { ServiceConfig } from "../config.js";
+import { type ServiceConfig } from "../config.js";
 import type { Logger } from "../observability/logger.js";
 import type { Metrics } from "../observability/metrics.js";
 import { PerTaskImageRegistry } from "../per-task-image.js";
 import type { DeviceEnrollment } from "../device-enrollment.js";
 import type { DeviceStore } from "../device-store.js";
+import type { ExecutionPlacementSeat } from "../execution-placement.js";
 import type { DeviceWsHub } from "../device-ws-hub.js";
 import { k8sExecutionEnvFactory, type K8sEnvConfig, type K8sEnvDeps, type SandboxSecretSeat } from "../plugins/remote-env-k8s.js";
 import { type SandboxGitPlane, type SandboxGitRunRows } from "../sandbox-git-plane.js";
@@ -117,11 +118,12 @@ export declare function assertWorkspaceSpaceReadable(space: ReturnType<typeof fa
     readonly headOf: HeadRead | undefined;
     readonly spaceCommits: (() => SpaceCommitRows | undefined) | undefined;
 }, cache: ReturnType<typeof facts.workspaceCache>, sessionStoreLabel: string): void;
-/** device lane 的三件活对象(店 / 汇聚端 / 准入链)。缺席 = 本部署没有 device 车道。 */
+/** device lane 的活对象(店 / 汇聚端 / 准入链 + 会话店的执行席 —— 绑定的唯一载体与唯一读,工厂与准入链读同一只)。缺席 = 本部署没有 device 车道。 */
 export interface DeviceLaneWiring {
     store: DeviceStore;
     hub: DeviceWsHub;
     enrollment: DeviceEnrollment;
+    seat: ExecutionPlacementSeat;
 }
 export interface ExecutionEnvCtx {
     config: ServiceConfig;

package/dist/boot/execution-env.js

@@ -4,6 +4,7 @@ import { createHostLspManager } from "../host-lsp-manager.js";
 import { TaskEnvRegistry } from "../capabilities/sandbox-file-send.js";
 import { DEPLOYMENT_SHAPE_PREDICATES } from "../deployment-shape.js";
 import { SessionEnvironmentSelection } from "../capabilities/select-environment-tool.js";
+import { sandboxEnvNamesInForce } from "../config.js";
 import { createE2bLspManager } from "../lsp/e2b-manager.js";
 import { evictLspOnDestroy } from "../lsp-evict.js";
 import { PerTaskImageRegistry } from "../per-task-image.js";
@@ -11,7 +12,7 @@ import { adbExecutionEnvFactory } from "../plugins/remote-env-adb.js";
 import { deviceExecutionEnvFactory } from "../plugins/remote-env-device.js";
 import { e2bExecutionEnvFactory } from "../plugins/remote-env-e2b.js";
 import { hostExecutionEnvFactory, RemoteHostExecutionEnv } from "../plugins/remote-env-host.js";
-import { boundedStoreCall, checkSandboxEgressPolicy, createSandboxPodApi, createSpaceReclaimer, K8S_SANDBOX_NAMESPACE_DEFAULT, k8sExecutionEnvFactory, readSandboxSecretSeat, rpcTimeoutMsOf } from "../plugins/remote-env-k8s.js";
+import { boundedStoreCall, checkSandboxEgressPolicy, createSandboxPodApi, createSpaceReclaimer, k8sExecutionEnvFactory, readSandboxSecretSeat, rpcTimeoutMsOf } from "../plugins/remote-env-k8s.js";
 import { podSpecPatchBrokerRefusal, SANDBOX_SECRET_SEAT_VERBS } from "../plugins/k8s-exec-protocol.js";
 import { judgeSandboxGitPlane, runIdentitySourceOf, sandboxBrokerSeatOf, sandboxGitPlaneAsksSecretSeat, sandboxGitPlanePremisesOf } from "../sandbox-git-plane.js";
 import { createSandboxPodReaper } from "../plugins/k8s-pod-reaper.js";
@@ -33,8 +34,9 @@ import { createCacheMissMemory } from "../workspace-cache.js";
 import { workspaceSnapshotTimeoutOf } from "../workspace-space.js";
 import { sayEgressPolicyReading } from "../sandbox-egress-policy.js";
 import { sandboxPathEnvSlots, withSandboxPathEnvSlot } from "./deferred-sandbox-path-env.js";
-import { LANE_HOME_UNDECLARED_EVENT, createLaneHomeAbsenceReporter } from "../lane-home-probe.js";
-import { REMOTE_EXEC_PROVIDER_WORDS, buildUndeclaredHomeNote, executionLaneHomeDir, executionLaneOf, laneBindsReads, laneIsolated } from "../execution-lane-caps.js";
+import { createLaneHomeAbsenceReporter } from "../lane-home-probe.js";
+import { REMOTE_EXEC_PROVIDER_WORDS, buildLaneHomeBootNote, buildLaneHomeClaim, capabilitiesFor, executionLaneOf, laneBindsReads, laneIsolated } from "../execution-lane-caps.js";
+import { warnReadDenyFloorUnkept } from "./execution-lane.js";
 function boundedSessionSetter(map, maxEntries) {
     return (sid, value) => {
         map.delete(sid);
@@ -43,24 +45,6 @@ function boundedSessionSetter(map, maxEntries) {
             map.delete(map.keys().next().value);
     };
 }
-function forwardedSandboxEnvKeys(remoteExec) {
-    switch (remoteExec.provider) {
-        case "e2b":
-        case "k8s":
-            return Object.keys(remoteExec.sandboxEnv ?? {}).sort();
-        case "local-docker":
-            return Object.keys(remoteExec.env ?? {}).sort();
-        case "ssh":
-        case "adb":
-        case "host":
-        case "device":
-            return [];
-        default: {
-            const unreachable = remoteExec;
-            throw new Error(`unhandled remote-exec provider: ${String(unreachable.provider)}`);
-        }
-    }
-}
 function buildSandboxLaneEnv(config, explicit) {
     const secretEnv = { ...(explicit ?? {}) };
     const env = Object.fromEntries(Object.entries(derivePkgSourceEnv(config.sandboxPkgSource, config.sandboxPkgSourceCustom)).filter(([name]) => !Object.hasOwn(secretEnv, name)));
@@ -173,7 +157,7 @@ export async function ensureSandboxSecretSeat(k8sCfg, logger, deps, read = () =>
     const names = Object.keys(k8sCfg.podSecretEnv ?? {});
     if (names.length === 0)
         return;
-    const namespace = k8sCfg.namespace ?? K8S_SANDBOX_NAMESPACE_DEFAULT;
+    const namespace = k8sCfg.namespace;
     const seat = await read();
     switch (seat.state) {
         case "granted":
@@ -235,10 +219,15 @@ function buildRealSystemNote(remoteExec) {
         "and the Bash read boundary is a text-level friction floor, not a safety boundary; the safety boundary is a sandbox lane: " +
         `set REMOTE_EXEC=${sandboxLanes} (see docs/DEPLOY-PREREQS.md, section "S-281")`);
 }
+function hostWorktreeUnwrappedRefusal() {
+    return Object.assign(new Error('isolation "worktree" was requested but cannot be honored: this host lane has no worktree wrapper active ' +
+        "(WORKTREE_ISOLATION_ENABLED=true together with WORKTREE_REPO_ROOT=<a git repository> turns it on; a repo root that does not exist or has no `.git` leaves it off — see the boot log), " +
+        "and the base host environment would place the sub-agent in an empty temporary directory instead of an isolated checkout. " +
+        "The sub-agent was not started (fail-closed — no silent fallback to the shared working tree)."), { code: "isolation.unavailable" });
+}
 export function createExecutionEnv(ctx) {
     const { config, logger, metrics, taskAttachmentStore } = ctx;
-    const laneHomeDir = executionLaneHomeDir(config);
-    const homeDirSeat = laneHomeDir !== undefined ? { homeDir: laneHomeDir } : {};
+    const homeDirSeat = buildLaneHomeClaim(config);
     const homeAbsentNotice = { onHomeAbsent: createLaneHomeAbsenceReporter((event, fields) => logger.warn(event, fields)) };
     const perTaskImage = new PerTaskImageRegistry();
     const sessionEnvSelection = new SessionEnvironmentSelection();
@@ -256,7 +245,7 @@ export function createExecutionEnv(ctx) {
     if (config.remoteExec?.provider === "e2b") {
         executionEnvFactory = e2bExecutionEnvFactory({
             apiKey: config.remoteExec.apiKey,
-            ...homeDirSeat,
+            ...homeDirSeat, ...homeAbsentNotice,
             ...(config.remoteExec.template ? { template: config.remoteExec.template } : {}),
             ...(config.remoteExec.timeoutMs != null ? { timeoutMs: config.remoteExec.timeoutMs } : {}),
             ...(config.remoteExec.livenessMs != null ? { livenessMs: config.remoteExec.livenessMs } : {}),
@@ -275,7 +264,7 @@ export function createExecutionEnv(ctx) {
             ...(config.remoteExec.token ? { token: config.remoteExec.token } : {}),
             ...(config.remoteExec.caCert ? { caCert: config.remoteExec.caCert } : {}),
             ...(config.remoteExec.insecureTls ? { insecureTls: true } : {}),
-            ...(config.remoteExec.namespace ? { namespace: config.remoteExec.namespace } : {}),
+            namespace: config.remoteExec.namespace,
             ...(config.remoteExec.runtimeClass != null ? { runtimeClass: config.remoteExec.runtimeClass } : {}),
             ...(config.remoteExec.mountPath ? { mountPath: config.remoteExec.mountPath } : {}),
             ...(config.remoteExec.timeoutMs != null ? { timeoutMs: config.remoteExec.timeoutMs } : {}),
@@ -312,7 +301,7 @@ export function createExecutionEnv(ctx) {
         };
         sandboxPodReaper = createSandboxPodReaper({ api: createSandboxPodApi(k8sCfg), logger, metrics });
         void checkSandboxEgressPolicy(k8sCfg)
-            .then((gaps) => sayEgressPolicyReading(gaps, logger, k8sCfg.namespace ?? K8S_SANDBOX_NAMESPACE_DEFAULT))
+            .then((gaps) => sayEgressPolicyReading(gaps, logger, k8sCfg.namespace))
             .catch((e) => logger.error("sandbox_egress_policy_check_crashed", { error: e instanceof Error ? e.message : String(e), effect: "the sandbox egress self-check did not complete this boot — the lane runs; the egress policy was not read" }));
     }
     else if (config.remoteExec?.provider === "ssh") {
@@ -332,6 +321,7 @@ export function createExecutionEnv(ctx) {
                 hub: ctx.deviceLane.hub,
                 store: ctx.deviceLane.store,
                 enrollment: ctx.deviceLane.enrollment,
+                seat: ctx.deviceLane.seat,
                 ...homeDirSeat,
                 ...(config.remoteExec.execTimeoutMs != null ? { execTimeoutMs: config.remoteExec.execTimeoutMs } : {}),
                 perSessionCwd,
@@ -368,13 +358,15 @@ export function createExecutionEnv(ctx) {
             if (hostScheduler)
                 logger.info(`R7: self-wake scheduler enabled (host lane), store=${schedulerStorePath}`);
             const hostCfg = {
-                ...homeDirSeat,
+                ...homeDirSeat, ...homeAbsentNotice,
                 ...(config.remoteExec.workspaceBase ? { workspaceBase: config.remoteExec.workspaceBase } : {}),
                 ...(config.remoteExec.commandTimeoutMs != null ? { commandTimeoutMs: config.remoteExec.commandTimeoutMs } : {}),
                 ...(hostScheduler ? { scheduler: hostScheduler } : {}),
                 backgroundShell: config.requirePrincipal !== true,
             };
             executionEnvFactory = (ctx) => {
+                if (ctx.isolation === "worktree")
+                    throw hostWorktreeUnwrappedRefusal();
                 const cwd = effectiveHostWorkspace(perSessionCwd.get(ctx.sessionId), ctx);
                 const shellEnv = perSessionShellEnv.get(ctx.sessionId);
                 const inheritEnv = perSessionInheritEnv.get(ctx.sessionId);
@@ -414,7 +406,7 @@ export function createExecutionEnv(ctx) {
             logger.error("worktree_isolation_disabled_bad_repo_root", {
                 repoRoot: wtRoot,
                 reason: existsSync(wtRoot) ? "not a git repository (no .git)" : "path does not exist",
-                note: "WORKTREE_ISOLATION_ENABLED is set but WORKTREE_REPO_ROOT is not a usable git repo — isolation left OFF; isolation:'worktree' agents run on the shared base env. Fix the path or unset the flag.",
+                note: "WORKTREE_ISOLATION_ENABLED is set but WORKTREE_REPO_ROOT is not a usable git repo — isolation left OFF; isolation:'worktree' workflow agents are refused (isolation.unavailable) until it is fixed. Fix the path or unset the flag.",
             });
         }
         else if (config.remoteExec?.provider === "host") {
@@ -473,16 +465,18 @@ export function createExecutionEnv(ctx) {
     if (executionEnvFactory) {
         const isolated = laneIsolated(executionLaneOf(config.remoteExec.provider));
         const suspendable = DEPLOYMENT_SHAPE_PREDICATES.suspendableHands.holds(config);
-        const sandboxEnvKeys = forwardedSandboxEnvKeys(config.remoteExec);
-        logger.info("remote_exec_enabled", { provider: config.remoteExec.provider, isolated, suspendable, ...(sandboxEnvKeys.length > 0 ? { sandboxEnvKeys } : {}) });
+        const keepsReadFloor = capabilitiesFor(config).keepsReadFloor;
+        const sandboxEnvKeys = [...sandboxEnvNamesInForce(config)].sort();
+        logger.info("remote_exec_enabled", { provider: config.remoteExec.provider, isolated, suspendable, keepsReadFloor, ...(sandboxEnvKeys.length > 0 ? { sandboxEnvKeys } : {}) });
         if (!isolated)
             logger.warn("remote_exec_real_system", { provider: config.remoteExec.provider, note: buildRealSystemNote(config.remoteExec) });
-        const homeNote = buildUndeclaredHomeNote(config);
-        if (homeNote !== undefined)
-            logger.warn(LANE_HOME_UNDECLARED_EVENT, { provider: config.remoteExec.provider, note: homeNote });
+        const homeLine = buildLaneHomeBootNote(config);
+        if (homeLine !== undefined)
+            logger.warn(homeLine.event, { provider: config.remoteExec.provider, note: homeLine.note });
         if (executionLaneOf(config.remoteExec.provider) === "host")
             logger.info("task_inherit_env_honored", { honored: taskInheritEnvRefusal(config) === undefined });
     }
+    warnReadDenyFloorUnkept(config, logger);
     const lspProvider = config.remoteExec?.provider;
     const lspLane = executionLaneOf(lspProvider);
     const lspLaneBindsReads = lspLane !== undefined && laneBindsReads(lspLane);

package/dist/boot/execution-lane.d.ts

@@ -1,11 +1,12 @@
 import { type CrossInvariantView } from "../config-invariants.js";
 import type { ServiceConfig } from "../config-types.js";
+import { buildReadDenyFloorUnkeptNote } from "../execution-lane-caps.js";
 import type { Logger } from "../observability/logger.js";
 /** `config.d/remote-exec.json` 能写进来的车道(文件契约里不带密钥名、可 1:1 映射的两条;e2b/k8s/ssh/adb 要 NAME→值解析,尚未接线)。 */
 export declare const FILE_SOURCED_LANES: readonly ["host", "local-docker"];
 export type FileSourcedLane = (typeof FILE_SOURCED_LANES)[number];
 export interface ExecutionLaneComposeCtx {
-    /** 本入口的配置源形态(`configProviderKind` / `serviceConfigSourceKind` 的答案 —— 与它真建的 provider 同一只判据)。
+    /** 本入口的配置源形态(`configSourceKind` 的答案 —— 与它真建的 provider 同一只判据)。
      *  只有 `local` 才读文件;`undefined` = 纯 env 部署。 */
     readonly configSource: "local" | "remote" | undefined;
     /** 配置根(与配置源同一个根,不分裂)。 */
@@ -28,6 +29,13 @@ export declare function composeExecutionLane(config: ServiceConfig, ctx: Executi
  * 非宿主车道零动作 —— 不解析、不装观察者。
  */
 export declare function settleHostLaneShell(config: Pick<ServiceConfig, "remoteExec">, logger: Pick<Logger, "info" | "warn">): Promise<void>;
+/**
+ * **读地板的起服一行**:部署要求读拒表的字节地板(`READ_DENY_FLOOR_REQUIRED=true`)而最终车道的执行环境块不守 ⇒ 每条读拒表有行的 run 都在准备期拒 ——
+ * 起服先说清后果与出路(`warn read_deny_floor_required_unkept { provider, note }`;判据与句子的唯一属主 `buildReadDenyFloorUnkeptNote`)。
+ * 两个入口调同一只(与 {@link settleHostLaneShell} 同形):HTTP 服务在执行环境装配里(`boot/execution-env.ts`,有没有执行环境工厂都调),`run-local` 在宿主车道定下之后 ——
+ * 旋钮两个入口都递给引擎(`RunnerDeps.readDenyFloorRequired`),所以两个入口都要先说。不要求 / 车道守地板 ⇒ 零动作。
+ */
+export declare function warnReadDenyFloorUnkept(config: Parameters<typeof buildReadDenyFloorUnkeptNote>[0], logger: Pick<Logger, "warn">): void;
 /**
  * 车道合成之后的跨域不变量 —— 表(`config-invariants.ts`)里读 `remoteExec.provider` 的那几条,boot 期 `live === next`。
  * 同步、纯判据:只读 config,不碰文件(测试可以对 `loadConfig()` 的产物直接调它)。

package/dist/boot/execution-lane.js

@@ -1,7 +1,7 @@
 import { loadRemoteExec } from "@sema-agent/settings-schema/node";
 import { assertLocalConfigDirTrusted } from "../config-dir-trust.js";
 import { crossInvariant } from "../config-invariants.js";
-import { executionLaneOf, laneIsolated } from "../execution-lane-caps.js";
+import { buildReadDenyFloorUnkeptNote, executionLaneOf, laneIsolated } from "../execution-lane-caps.js";
 import { buildReadFacePostureNotice, settleDerivedReadFace } from "../read-face-posture.js";
 import { settleHostShellAtBoot } from "../plugins/host-platform.js";
 export const FILE_SOURCED_LANES = ["host", "local-docker"];
@@ -23,6 +23,11 @@ export async function settleHostLaneShell(config, logger) {
         return;
     await settleHostShellAtBoot(logger);
 }
+export function warnReadDenyFloorUnkept(config, logger) {
+    const note = buildReadDenyFloorUnkeptNote(config);
+    if (note !== undefined)
+        logger.warn("read_deny_floor_required_unkept", { provider: config.remoteExec?.provider, note });
+}
 export function assertExecutionLaneInvariants(config) {
     const judge = (id) => crossInvariant(id).check({ live: config, next: config });
     const leader = judge("leader-host-lane");