@sema-agent/server 7.139.0 → 7.141.0

package/dist/config-provider.d.ts

@@ -1,19 +1,17 @@
-import { type DroppedConfigEntry, type RetiredDomainFinding, type UnreadConfigFile, type UnreadConfigKey } from "./web-admin-client/read-warnings.js";
+import { type DroppedConfigEntry, type UnreadConfigFile, type UnreadConfigKey } from "./web-admin-client/read-warnings.js";
 import { FileConfigStore } from "@sema-agent/settings-schema/node";
-import { type EffectiveConfig as AgentConfigEffective, type EffectiveReadWarning } from "@sema-agent/settings-schema";
+import { type ConfigDocumentRefusal, type EffectiveConfig as AgentConfigEffective, type EffectiveReadWarning } from "@sema-agent/settings-schema";
 import { fetchEffective as remoteFetchEffective, fetchSkillContent as remoteFetchSkillContent, type EffectiveConfig } from "./web-admin-client/facade.js";
 import type { CenterEndpoint } from "./web-admin-client/center-request.js";
 import type { ConfigProviderWord } from "./config-types.js";
 /** Result of a `fetchEffective` — EXACTLY the web-admin's return: the effective config + its etag, or
  *  `null` for "unchanged" (remote 304; local: the version matched the caller's prior etag).
- *  `domainErrors`([ref] registry-core 0.10.12 tolerant seam,local lane only):catalog 域坏文件不再
- *  连坐全包回落 env——坏域按该域 schema default 落+错误单列,好域照常生效;caller(main.ts)对每条打
- *  per-domain warn 点名坏域。gate 域(governance/rosters/…)坏文件 tolerant 仍 throw(READ 容错不放宽
- *  gate fail-loud,registry-core 半场精化)——那条路走既有的整包 catch。 */
+ *  `domainErrors`:某个**读得出**的域判形失败(schema 坏形 / 拼错键 / 悬空引用;那个域已按契约的域档位落缺省或被逐条判过)—— 候选判官以
+ *  `domain_invalid` 整拒;缺席 = 没有。读不出的**文档**不在这里(见 `refusedDocuments`)。 */
 /** 壳写在 `config.d/models.json` 条目上的装饰键(`sema*`)自 settings-schema 1.5.0 起是**声明过的扩展命名空间**
  *  (`EXTENSION_NAMESPACES`):schema 照旧 strip、但不再报「未知键」,所以本函数收到的每一个未知键都是拼错/越界 ⇒ 候选门错误。
  *  此前把这类键当「通知」放行的整套下游机制(域豁免/键路径闭集/满额特判/单独的通知面)已全部撤回——意图在声明处说,消费方不猜。 */
-/** `readWarnings`:契约 `onWarning` 流的**原值**(未折叠),两条读腿同键同义 —— 读者是一致性门的读腿适配器(它要逐条对契约语料的
+/** `readWarnings`:契约读侧告警流的**原值**(未折叠;远程腿 = `readEffectiveWire` 的告警回调,本地腿 = 单读口交成数据的 `warnings`),两条读腿同键同义 —— 读者是一致性门的读腿适配器(它要逐条对契约语料的
  *  告警多重集,折叠后的诊断面带不回 `kind` / 坐标段)。恒在场(空数组 = 这次读零告警),不用缺席表达「没有」
  *  ——缺席/空两形并存就是又一处二义。
  *  🔐 原流的 `error` 未经 {@link redactConfigError}(那道脱敏挂在真正进日志流的 `domainErrors` 产出边界上),
@@ -25,9 +23,10 @@ import type { ConfigProviderWord } from "./config-types.js";
  *  `effective.models.droppedCatalogEntries`(`GET /v1/models.droppedEntries` 的源,与 `models` 同世代)。 */
 /** `unreadFiles`:`config.d` 里读腿根本不读的文件(不是域 / 不是便携域)—— **不**进候选门(不是读的域判形失败),调用方一份一行
  *  `config_unread_file` 点名、其余照用;缺席 = 没有(本地读腿才会有)。 */
-/** `retiredDomains`([ref]):带事实的退役域文档(契约包的墓碑)—— 读腿不抛,交成发现,候选判官以成因 `retired_domain` 整拒这份候选(与域判形失败
- *  同一条回落链、同一行拒判);缺席 = 没有。远端腿:那一键不进 effective、其余域照读;本地腿:契约读腿在读便携域之前就拒,交出的候选只有版本
- *  (这棵树的内容版本,哈希含退役文件 ⇒ 改 / 删它版本即变),内容是空的 effective(被整拒,不会被应用)。 */
+/** `refusedDocuments`:被拒文档 —— 契约的类型 `ConfigDocumentRefusal`(`{ document, reason, error }`,墓碑另带 `migration`;`reason` 是契约闭集
+ *  `CONFIG_DOCUMENT_REFUSAL_REASONS`:`empty` / `invalid_json` / `not_object` / `io` / `too_deep` 文件层,`retired_domain` 墓碑)。读腿不抛,交成发现,候选判官以发现自带的词整拒这份候选
+ *  (与域判形失败同一条回落链、同一行拒判);缺席 = 没有。远端腿:wire 上只有墓碑一种,那一键不进 effective、其余域照读、版本照读;本地腿:契约的单读口
+ *  `FileConfigStore.read()` 交 `refused` ⇒ 被拒文档 = 那一读的拒单原样,什么域内容都没装配 —— 候选是空的 effective(被整拒,不会被应用),版本 = 那一读的契约版本(按文档内容寻址)。 */
 /** `unreadKeys`:本地读腿读了那份文件、却结构上不读其中一键(`prompts.json` 的 `workers`)—— 同 `unreadFiles`,不进候选门,调用方一键一行 `config_unread_key`。 */
 export type FetchEffectiveResult = {
     effective: EffectiveConfig;
@@ -39,7 +38,7 @@ export type FetchEffectiveResult = {
     droppedEntries?: DroppedConfigEntry[];
     unreadFiles?: UnreadConfigFile[];
     unreadKeys?: UnreadConfigKey[];
-    retiredDomains?: RetiredDomainFinding[];
+    refusedDocuments?: ConfigDocumentRefusal[];
     readWarnings: readonly EffectiveReadWarning[];
     credentialIdentity?: string;
 } | null;
@@ -154,21 +153,23 @@ export declare class RemoteConfigProvider implements ConfigProvider {
     fetchSkillContent(contentHash: string): Promise<string | undefined>;
 }
 /**
- * LocalConfigProvider — reads the SAME config contract from disk via `FileConfigStore`. `getEffective()`
- * returns the registry `EffectiveConfig` (all domains, defaults filled); `getVersion()` returns a
- * stable change-detector. We map that down to the service-local `EffectiveConfig` shape and surface the
- * version as the etag (so the caller's "skip re-apply if etag unchanged" works locally too).
+ * LocalConfigProvider — reads the SAME config contract from disk via `FileConfigStore`'s one read port `read()`:
+ * either the registry `EffectiveConfig` (all domains, defaults filled) with its content version, or the refusal
+ * list of the documents the file layer refused, with the version of that same read. We map the effective config down
+ * to the service-local `EffectiveConfig` shape and surface the version as the etag (so the caller's "skip re-apply
+ * if etag unchanged" works locally too).
  */
+/** 本地读腿对契约文件店只有一种读法 —— 单读口 `read()`(一次读整棵 `config.d`,交一个结局)。注入缝(测试)按这一形给;严读 / 容错档位不在这条腿的类型里。 */
+export type LocalConfigReader = Pick<FileConfigStore, "read">;
 export declare class LocalConfigProvider implements ConfigProvider {
     #private;
     readonly kind: "local";
     /** 本地配置源不留正文盘缓存:正文就内联在 config.d 里(同一块盘),缓存它是第二份真源。 */
     readonly skillBodyCacheDir: undefined;
-    private readonly store;
     /** [ref]b 可观测性:config_loaded 日志要能回答「到底读的哪个目录」——复验实录:只设 LOCAL_DATA_ROOT 时
      *  config.d 静默读不到且 0 模型无告警(CONFIG_LOCAL_DIR 才是本 lane 的选目录旋钮)。 */
     readonly root: string;
-    constructor(root: string, store?: FileConfigStore, trust?: {
+    constructor(root: string, store?: LocalConfigReader, trust?: {
         readonly declaredOwnerUid: number | undefined;
     });
     fetchEffective(etag: string | undefined): Promise<FetchEffectiveResult>;

package/dist/config-provider.js

@@ -1,6 +1,6 @@
 import { readMcpSourceLabel } from "./mcp-source-label.js";
 import { createHmac, randomBytes } from "node:crypto";
-import { retiredDomainFindingOf, splitFoldedReadWarnings, withDroppedCatalogEntries } from "./web-admin-client/read-warnings.js";
+import { splitFoldedReadWarnings, withDroppedCatalogEntries } from "./web-admin-client/read-warnings.js";
 import { FileConfigStore } from "@sema-agent/settings-schema/node";
 import { assertLocalConfigDirTrusted } from "./config-dir-trust.js";
 import { danglingRefs, emptyEffective, findSkillContent, promptArtifactFor, renderRefIssue, skillContentHash, } from "@sema-agent/settings-schema";
@@ -25,7 +25,9 @@ export function redactConfigError(text) {
 export function fingerprintConfigOperand(operand) {
     return `#${createHmac("sha256", OPERAND_FINGERPRINT_KEY).update(operand).digest("hex").slice(0, 8)}`;
 }
-const redactDroppedEntry = (d) => ({ ...d, error: redactSecrets(d.error) });
+const redactContractSentence = (text) => redactSecrets(text);
+const redactDroppedEntry = (d) => ({ ...d, error: redactContractSentence(d.error) });
+const redactRefusedDocument = (d) => ({ ...d, error: redactContractSentence(d.error) });
 export const BOOT_FETCH_DEFERRED = Symbol("boot-fetch-deferred");
 export function raceBootFetch(fetch, budgetMs) {
     if (budgetMs <= 0)
@@ -50,12 +52,13 @@ export class RemoteConfigProvider {
     async fetchEffective(etag) {
         const fn = this.deps.fetchEffective ?? remoteFetchEffective;
         const r = await fn(this.cc, etag, undefined, this.cc.worker);
-        if (r === null || (r.domainErrors === undefined && r.droppedEntries === undefined))
+        if (r === null || (r.domainErrors === undefined && r.droppedEntries === undefined && r.refusedDocuments === undefined))
             return r;
         return {
             ...r,
             ...(r.domainErrors !== undefined ? { domainErrors: r.domainErrors.map((de) => ({ domain: de.domain, error: redactConfigError(de.error) })) } : {}),
             ...(r.droppedEntries !== undefined ? { droppedEntries: r.droppedEntries.map(redactDroppedEntry) } : {}),
+            ...(r.refusedDocuments !== undefined ? { refusedDocuments: r.refusedDocuments.map(redactRefusedDocument) } : {}),
         };
     }
     async fetchSkillContent(contentHash) {
@@ -74,43 +77,31 @@ export class LocalConfigProvider {
     kind = "local";
     skillBodyCacheDir = undefined;
     #servedSkills = { skills: [] };
-    store;
     root;
-    #injectedStore;
+    #store;
     #declaredOwnerUid;
     constructor(root, store, trust = { declaredOwnerUid: undefined }) {
         this.root = root;
-        this.#injectedStore = store;
-        this.store = store ?? new FileConfigStore(root);
+        this.#store = store ?? new FileConfigStore(root);
         this.#declaredOwnerUid = trust.declaredOwnerUid;
     }
     async fetchEffective(etag) {
         await assertLocalConfigDirTrusted({ root: this.root, declaredOwnerUid: this.#declaredOwnerUid });
-        const readWarnings = [];
-        const store = this.#injectedStore ??
-            new FileConfigStore(this.root, {
-                onWarning: (w) => {
-                    readWarnings.push(w);
-                },
-            });
-        let read;
-        let retired;
-        try {
-            read = await store.getEffective({ tolerant: true });
-        }
-        catch (e) {
-            retired = retiredDomainFindingOf(e);
-            if (retired === undefined)
-                throw e;
-            const version = await store.getVersion().catch(() => {
-                throw e;
-            });
-            read = { effective: { ...emptyEffective(), version }, domainErrors: [] };
-        }
-        const { effective: eff, domainErrors } = read;
-        const tag = String(eff.version);
+        const read = await this.#store.read();
+        const tag = String(read.kind === "refused" ? read.version : read.effective.version);
         if (etag !== undefined && etag === tag)
             return null;
+        const readWarnings = [...read.warnings];
+        const folded = splitFoldedReadWarnings(readWarnings, "local");
+        const faces = read.kind === "refused" ? refusedFaces(read) : this.#effectiveFaces(read.effective, folded);
+        return {
+            ...faces,
+            etag: tag,
+            readWarnings,
+            ...(folded.unreadFiles.length > 0 ? { unreadFiles: folded.unreadFiles } : {}),
+        };
+    }
+    #effectiveFaces(eff, folded) {
         const refErrors = [];
         const byReferrer = new Map();
         for (const issue of danglingRefs(eff)) {
@@ -120,27 +111,28 @@ export class LocalConfigProvider {
         }
         for (const [domain, rows] of byReferrer)
             refErrors.push({ domain, error: rows.join("; ") });
-        const folded = splitFoldedReadWarnings(readWarnings, "local");
         const parseErrors = folded.domainErrors.map((w) => ({ domain: w.domain, error: redactConfigError(w.error) }));
         const droppedEntries = folded.droppedEntries.map(redactDroppedEntry);
-        const errors = [...domainErrors.map((de) => ({ domain: de.domain, error: redactConfigError(de.error) })), ...parseErrors, ...refErrors];
+        const errors = [...parseErrors, ...refErrors];
         this.#servedSkills = eff.skills;
         const unreadKeys = localUnreadPromptKeys(eff.prompts);
         return {
             effective: withDroppedCatalogEntries(mapToServiceEffective(eff, eff.version), folded.droppedCatalogEntries),
-            etag: tag,
-            readWarnings,
             ...(errors.length > 0 ? { domainErrors: errors } : {}),
             ...(droppedEntries.length > 0 ? { droppedEntries } : {}),
-            ...(folded.unreadFiles.length > 0 ? { unreadFiles: folded.unreadFiles } : {}),
             ...(unreadKeys.length > 0 ? { unreadKeys } : {}),
-            ...(retired !== undefined ? { retiredDomains: [retired] } : {}),
         };
     }
     async fetchSkillContent(contentHash) {
         return findSkillContent(this.#servedSkills, contentHash);
     }
 }
+function refusedFaces(read) {
+    return {
+        effective: mapToServiceEffective({ ...emptyEffective(), version: read.version }, read.version),
+        refusedDocuments: read.refusals.map(redactRefusedDocument),
+    };
+}
 function localUnreadPromptKeys(prompts) {
     const names = prompts?.workers === undefined ? [] : Object.keys(prompts.workers);
     return names.length === 0 ? [] : [{ file: "prompts.json", domain: "prompts", key: "workers", names }];

package/dist/config-types.d.ts

@@ -150,6 +150,17 @@ export declare const FIRST_BYTE_TIMEOUT_BOUNDS: {
     readonly minMs: 0;
     readonly maxMs: 2147483647;
 };
+/**
+ * device 车道的设备入口声明(`DEVICE_RELAY_URL` 的两种合法值;值文法与字面 `none` 归契约包 `deviceRelayFlaws` / `DEVICE_RELAY_NONE`;字段注见 `remoteExec` device 臂的 `relay`):
+ * 中继地址,或字面 `none` = 没有中继、设备拨本引擎自己的地址。「没写」不是第三种值 —— 车道表 device 行的必需键,缺席 / 空白在配置期就被车道必需 env 门拒
+ * (缺席曾被读成直拨,撤声明时把已绑设备困在一个拨不到的入口上)。
+ */
+export type DeviceRelayDeclaration = {
+    readonly kind: "url";
+    readonly url: string;
+} | {
+    readonly kind: "none";
+};
 /**
  * 整数合法域(闭区间)的**一种说法**:device 车道的数值旋钮(`DEVICE_RECONNECT_GRACE_MS` / `DEVICE_MAX_INFLIGHT_PER_DEVICE` /
  * `DEVICE_DELIVERY_TIMEOUT_MS` / `DEVICE_EXEC_TIMEOUT_MS`)、汇聚端创建时对 helloAck 六个数值位的校验、协议文档与配置目录的合法域句,
@@ -722,7 +733,7 @@ export interface ServiceConfigFlat {
      *  引擎却仍可能把别处落进记忆根的字节收进这次会话的账。
      *  ⚠️ **这一层的射程 = file 记忆引擎**(`MEMORY_ENGINE_BACKEND` 未设的默认单机形):受限视图是
      *  `FileMemoryEngineBackend.restrictedAdoptionView` 的实装,而 `engine.materialize` 取它走的是
-     *  `?? this.backend` 的**可选** seam。我方 pg/tidb 两只记忆后端没有实装、也不需要——它们的读侧走库,
+     *  `?? this.backend` 的**可选** seam。我方 pg/mysql 两只记忆后端没有实装、也不需要——它们的读侧走库,
      *  盘上目录只是每任务的投影工作区,没有「读磁盘即收编」这条通道。`false` 在 DB 后端上仍照常买到
      *  披露 / 写门 / 零收编 harvest 三件(引擎级,与后端无关)。
      *
@@ -741,7 +752,7 @@ export interface ServiceConfigFlat {
      *  undefined=纯本地现状零变化)/`MEMORY_SYNC_TOKEN`(Bearer)/`MEMORY_SYNC_SCOPE`(可选,缺省 =
      *  memoryScope 本身**仅当它已是 v2 typed key**;非 typed 键 ⇒ 拒启,[ref] —— 旧 formatUserScope 派生臂铸出的是本部署
      *  从不写的层,见 loadConfig)。半配置 fail-loud
-     *  (memoryEngineBackend 同款姿势);DB backend(pg/tidb)配了这些键=boot throw(中心侧自己就是
+     *  (memoryEngineBackend 同款姿势);DB backend(pg/mysql)配了这些键=boot throw(中心侧自己就是
      *  同步权威,不该再跑 client 腿)。 */
     memorySync?: {
         url: string;
@@ -766,7 +777,7 @@ export interface ServiceConfigFlat {
      *     不匹配的行只是悄悄退回词面档),只会让「向量面开着」这句话变成谎。所以坏 DIM(非正整数)在
      *     boot 期拒;运行期真维度不符(模型换了 / 端点指错)由 embedder 自己抛,绝不截断补零。
      *
-     *  ⚠️ 后端门:只有 `MEMORY_ENGINE_BACKEND=pg` 收这几键 —— tidb 记忆后端 v1 无向量档(传 embedder
+     *  ⚠️ 后端门:只有 `MEMORY_ENGINE_BACKEND=pg` 收这几键 —— mysql 记忆后端 v1 无向量档(传 embedder
      *  它自己就 fail-loud 拒),file 引擎压根没有 embedder 接缝。配错后端 = 拒启点名。 */
     memoryEmbedder?: MemoryEmbedderConfig;
     /** [ref] 件A(clay 三裁 [ref]):org 记忆准入模式。`enforce`(默认)=判决即结果;`audit`=判决
@@ -891,7 +902,9 @@ export interface ServiceConfigFlat {
      * 跑在哪个用户的 home 下」)。显式声明**恒赢**;缺席时只有 home 属于车道本身的那几条车道有答案
      * (host/in-process = `os.homedir()`、e2b = 平台固定用户),k8s/local-docker(镜像属性)、
      * ssh(目标机登录用户)、adb/device 一律缺席 ⇒ `~/` 规则在下单时被 422 响亮拒。
-     * 派生与逐车道理由的**单一属主** = `execution-lane-caps.ts` 的 `executionLaneHomeDir`。
+     * 声明与出厂答案都只是**主张**:读得出家目录的车道(device 之外的六条)在每只执行环境开起来时拿环境里命令看到的 `$HOME` 证它,
+     * 不一致 / 读不出 ⇒ 那只环境不开(拒句点名两值与改法);device 读不了 ⇒ 声明即座,起服披露「来自声明、未实测」。
+     * 派生与逐车道理由的**单一属主** = `execution-lane-caps.ts` 的 `executionLaneHomeDir` / `buildLaneHomeClaim`。
      * 非绝对路径 ⇒ **拒启**([ref] A 档;core 侧同判为 `config.execution_env_home_dir_invalid`)。
      */
     remoteExecHomeDir?: string;
@@ -1025,11 +1038,14 @@ export interface ServiceConfigFlat {
          *  域 = `[1, 86400]` 的十进制正整数,坏值**拒启**([ref] A 档;解析器 `parseDeviceEnrollTokenTtlEnv`)。
          *  缺席 ⇒ 签发点的属主默认 900(不在 config 层抄第二份默认,与本族其余旋钮同姿势)。 */
         enrollTokenTtlSec?: number;
-        /** `DEVICE_RELAY_URL` = 设备的**直达入口**:设备连不到本引擎自己的地址(引擎在中继 / 网关之后)时该拨的那一个 ws(s) URL,运维声明、**逐字**上能力面
-         *  `deviceExecutor.relayUrl`(唯一消费点 `http/routes/capabilities.ts`)。缺席 ⇒ 键缺席 = 设备按本引擎地址 + `deviceExecutor.wsPath` 拨号(既有形)。
+        /** `DEVICE_RELAY_URL` = 设备入口的运维声明,**必填**(缺席 / 空串 ⇒ 配置期拒起;解析器 `parseDeviceRelayUrlEnv`):
+         *  `{ kind: "url" }` = 设备连不到本引擎自己的地址(引擎在中继 / 网关之后)时该拨的那一个 ws(s) URL,**逐字**上能力面 `deviceExecutor.relayUrl`
+         *  (唯一消费点 `http/routes/capabilities.ts`);`{ kind: "none" }`(字面 `none`)= 没有中继,设备按本引擎地址 + `deviceExecutor.wsPath` 拨号,能力面不带 `relayUrl`。
+         *  必填的理由:「设备拨哪里」只有运维知道;缺席曾被读成「直拨」,于是撤掉中继声明而根会话行上还有设备绑定时,设备改拨引擎地址(入口已收窄则拨不到)、
+         *  绑定却留在格上 —— 缺席与「声明了直拨」是两件事,只有后者放行。`none` ∧ 有绑定 ⇒ 起服 warn 点名绑定数(`boot/device-lane.ts`)。
          *  **不派生**:`FLEET_ADVERTISE_ADDRESS` 是对中心公告的地址(内网 pod IP / 容器别名),受众不是用户机器上的设备;从它拼出来的入口对设备多半不可达。
-         *  形门 = ws / wss 绝对地址,无 userinfo / query / fragment、不带凭据形(值逐字上能力面),坏值**拒启**(解析器 `parseDeviceRelayUrlEnv`)。 */
-        relayUrl?: string;
+         *  URL 形门 = ws / wss 绝对地址,无 userinfo / query / fragment、不带凭据形(值逐字上能力面),坏值**拒启**。 */
+        relay: DeviceRelayDeclaration;
         /** `DEVICE_SUPERSEDE`(默认 `stale_only`)= 同 deviceId 二连的顶替策略(§5.2)。 */
         supersede?: "stale_only" | "deny";
     } | {
@@ -2118,6 +2134,17 @@ export interface ServiceConfigFlat {
      *  `READ_DENY_BUILTIN_EXCLUDE`=逗号分隔;不在表里的行名 / 空串**启动期响亮拒**。
      *  🔴 不变量(判据帖 G5b):删内建**绝不**削弱任务自己显式声明的 deny —— 那是另一层(additions)。 */
     readDenyBuiltinExclude?: readonly string[];
+    /** 部署**要不要求**读拒表的字节地板(`READ_DENY_FLOOR_REQUIRED`,布尔,缺省 false)—— 交引擎 `RunnerDeps.readDenyFloorRequired`
+     *  (部署姿态座席族的一席,唯一取值点 `buildDeploymentPostureSeats`)。判官是引擎:一个 run 的读拒表有行、而它的执行环境块
+     *  `keepsReadFloor` 不为真时 —— true ⇒ 准备期拒(`config.read_deny_floor_unkept`,一个命令都不起;同步腿 409);false ⇒ run 照跑,
+     *  每 run 一条 operator 通告同码(递归读照读表里的文件,通告不是保护)。出厂读拒档(credentials / agent-config)在岗时每条带手 run 的表都有行;
+     *  本仓七车道的块今天都不守地板 ⇒ 设 true 的部署上带手 run 一律拒起(起服 warn `read_deny_floor_required_unkept` 先说)。
+     *  **仅 deployment 席**:TaskSpec 上没有同名键,任务无法放宽自己的部署。 */
+    readDenyFloorRequired: boolean;
+    /** `SANDBOX_READ_FLOOR`(闭集 `keep | off`,缺省 `keep`;闭集 / 缺省 / 派生的属主 `execution-lane-caps.ts`):沙箱三车道(e2b / k8s / local-docker)守不守读拒表的
+     *  字节地板 = 沙箱读地板模块服务这条车道 ∧ 本键不是 `off`。车道块 `keepsReadFloor`(`capabilitiesFor`)与适配器手里的模块同读这一只判据;别的车道上本键无作用
+     *  (那些环境约束不了进程,恒不守)。部署级一键、不挂车道臂:`config.d/remote-exec.json` 换出的车道同样读它。 */
+    sandboxReadFloor: import("./execution-lane-caps.js").SandboxReadFloorKnob;
     /** core 7.46.0 [ref]:部署**声明**的配置根(`SEMA_CONFIG_DIR`,绝对路径;起服的供给动作建出目录,能不能用由引擎判)—— 交引擎 `RunnerDeps.agentConfigDir`
      *  与守卫集 `createSensitivePathPolicy` 的同名入参:内建读拒表里以 `.sema` 开头的行在这个根下同样拒,写进根下要问一次。缺席 = 没声明
      *  ⇒ 引擎读字面 `~/.sema`(与 LKG / skill 缓存 / scheduler 店的缺省落点同一处)。读法单一属主 `sema-config-dir.ts`。 */
@@ -2301,7 +2328,7 @@ export type ServiceMemoryConfig = Pick<ServiceConfigFlat, "memoryEngineEnabled"
  *  config 这一层它只是一句声明。 */
 export type ServiceAuthConfig = Pick<ServiceConfigFlat, "authToken" | "authTokens" | "allowUnauthedWrites" | "corsOrigins" | "principalHeader" | "requirePrincipal" | "autonomy" | "commandPolicy" | "compliancePosture" | "lockedConfigKeys" | "configCatalogEnabled" | "retentionPolicy" | "retentionSweep" | "operatorPrincipals" | "operatorSingleUser" | "principalJwtPubkeys" | "principalJwtIss" | "principalJwtAud" | "authBridgeIssuer" | "principalJwtMaxTtlSec" | "bindHost" | "bindHostSource">;
 /** 组:orchestration(编排 + 执行车道 + 沙箱面 + workflow/后台 agent 存留)。 */
-export type ServiceOrchestrationConfig = Pick<ServiceConfigFlat, "remoteExec" | "remoteExecHomeDir" | "requireExecutionLane" | "worktreeIsolation" | "leaderEnabled" | "leaderFanoutEnabled" | "routerEnabled" | "selfOrchestrationEnabled" | "selfOrchestrationModels" | "selfOrchestrationWorkerIsolation" | "forkEnabled" | "experimentalObserverAgents" | "schedulerEnabled" | "schedulerSessionWakeup" | "schedulerSessionLifetime" | "schedulerStorePath" | "planModeEnabled" | "hooksTimeoutMs" | "workflowRunStoreBackend" | "workflowOrphanGraceMs" | "workflowJournalRetentionMs" | "workflowRunRetentionMs" | "usageWindows" | "workflowAgentsReadOnly" | "workflowSizeGuideline" | "backgroundAgentRetentionMs" | "backgroundAgentStaleRunningMs" | "backgroundAgentParkClaimStaleMs" | "delegationEntryCaps" | "rosterRetentionMs" | "leaderRunStaleMs" | "scratchpadSweepTtlMs" | "sandboxPkgSource" | "sandboxPkgSourceCustom" | "sessionAutoTitle" | "sessionAutoTitleSource" | "selectEnvironmentTool" | "envFactsEnabled" | "toolDeferLongtail" | "lspEnabled" | "lspHostEnabled" | "lspEnvAllow" | "imageBakes" | "readFace" | "readFaceSource" | "taskWriteFaceEscalation" | "readDenyPatterns" | "readDenyBuiltinTiers" | "readDenyBuiltinExclude" | "agentConfigDir" | "configLkgPath" | "configLkgEnabled">;
+export type ServiceOrchestrationConfig = Pick<ServiceConfigFlat, "remoteExec" | "remoteExecHomeDir" | "requireExecutionLane" | "worktreeIsolation" | "leaderEnabled" | "leaderFanoutEnabled" | "routerEnabled" | "selfOrchestrationEnabled" | "selfOrchestrationModels" | "selfOrchestrationWorkerIsolation" | "forkEnabled" | "experimentalObserverAgents" | "schedulerEnabled" | "schedulerSessionWakeup" | "schedulerSessionLifetime" | "schedulerStorePath" | "planModeEnabled" | "hooksTimeoutMs" | "workflowRunStoreBackend" | "workflowOrphanGraceMs" | "workflowJournalRetentionMs" | "workflowRunRetentionMs" | "usageWindows" | "workflowAgentsReadOnly" | "workflowSizeGuideline" | "backgroundAgentRetentionMs" | "backgroundAgentStaleRunningMs" | "backgroundAgentParkClaimStaleMs" | "delegationEntryCaps" | "rosterRetentionMs" | "leaderRunStaleMs" | "scratchpadSweepTtlMs" | "sandboxPkgSource" | "sandboxPkgSourceCustom" | "sessionAutoTitle" | "sessionAutoTitleSource" | "selectEnvironmentTool" | "envFactsEnabled" | "toolDeferLongtail" | "lspEnabled" | "lspHostEnabled" | "lspEnvAllow" | "imageBakes" | "readFace" | "readFaceSource" | "taskWriteFaceEscalation" | "readDenyPatterns" | "readDenyBuiltinTiers" | "readDenyBuiltinExclude" | "readDenyFloorRequired" | "sandboxReadFloor" | "agentConfigDir" | "configLkgPath" | "configLkgEnabled">;
 /** 组:limitsHttp(HTTP 面 + 各类上限/配额/回收窗)。 */
 export type ServiceLimitsHttpConfig = Pick<ServiceConfigFlat, "port" | "attachmentOrphanGraceMs" | "workspaceFileMaxBytes" | "attachmentMaxBytes" | "attachmentMimeAllowlist" | "attachmentUnboundTtlMs" | "infraCostRates" | "drainGraceMs" | "drainSecondSignalMinGapMs" | "sighupIdleGraceMs" | "parentPid" | "engineAutoExit" | "engineLingerMs" | "engineOrphanLingerMs" | "rateLimitPerMin" | "maxTaskCostUsd" | "maxTaskTokens" | "maxPrincipalCostUsd" | "costQuotaWindowSec" | "reapIntervalSec" | "runStaleSec" | "toolResultTtlSec">;
 /** 组:observability(可观测)。 */

package/dist/config.js

@@ -36,7 +36,8 @@ import { laneLivenessOf } from "./exec-bounds.js";
 import { SANDBOX_IPV6_DEFAULT, SANDBOX_IPV6_WORDS } from "./sandbox-egress-policy.js";
 import { WORKSPACE_CACHE_DEFAULT, WORKSPACE_CACHE_MOUNT_DEFAULT, WORKSPACE_CACHE_MOUNT_RESERVED, WORKSPACE_CACHE_SIZE_DEFAULT, WORKSPACE_CACHE_WORDS, isK8sQuantity, mountsOverlap, reservedMountCollision } from "./workspace-cache.js";
 import { DEPLOYMENT_SHAPE_PREDICATES } from "./deployment-shape.js";
-import { REMOTE_EXEC_PROVIDER_WORDS, executionLaneOf, executionLaneRequiredRefusal, laneMissingEnv } from "./execution-lane-caps.js";
+import { sandboxForwardedEnvOf } from "./execution-config-root.js";
+import { SANDBOX_READ_FLOOR_DEFAULT, SANDBOX_READ_FLOOR_WORDS, executionLaneOf, executionLaneRequiredRefusal, laneMissingEnv, readDeclaredLaneTable } from "./execution-lane-caps.js";
 import { MEMORY_ENGINE_BACKENDS, SESSION_BACKENDS, STORE_BACKENDS } from "@sema-agent/settings-schema/execution-lanes";
 import { AUTONOMY_MODES } from "./runtime-governance.js";
 import { MAX_NAMED_INERT_ENTRIES, allowLayerEntryCountIssue, describeInertRuleEntries, inertRuleEntriesOf, inertRuleEntryGuidance, ruleEntryListShapeOk } from "./rule-entry-list.js";
@@ -45,7 +46,7 @@ import { createCenterCredentialSource, readCenterCredentialDeclaration } from ".
 import { parseCenterCredentialRenewLeadMs } from "./center-credential-renewer.js";
 import { modelProviderRefusal } from "./model-provider.js";
 import { modelRouteUrlRefusal } from "./model-route-url.js";
-import { httpUrlFlaws } from "@sema-agent/settings-schema";
+import { DEVICE_RELAY_NONE, DEVICE_RELAY_RULE, deviceRelayFlaws, httpUrlFlaws } from "@sema-agent/settings-schema";
 import { buildHttpUrlRefusal, buildRefusalShownUrl } from "./url-refusal.js";
 import { customPkgSourceFromEnv } from "./sandbox-pkg-source.js";
 import { anthropicCredentialRefusal, csvOf, declaredCredential, envLaneTable, mintedCheapId, readModelRouteEnv } from "./model-route-gap.js";
@@ -57,6 +58,7 @@ import { allowlistedEnv } from "./server-secret-env.js";
 import { ENV_NAME_ALLOWLIST_KNOBS, ENV_NAME_ALLOWLIST_KNOB_NAMES, describeAllowlistPostures } from "./env-name-allowlist-knobs.js";
 import { APPROVAL_ASK_RETENTION_DEFAULT_MS, APPROVAL_ASK_RETENTION_FLOOR_MS } from "./approval-ask-retention.js";
 import { parseModsDeclaration } from "./mods-declaration.js";
+import { buildDeclaredEngineWithoutCoordinatesRefusal, missingSqlCoordinateKeys } from "./sql-engine-coordinates.js";
 export { RETENTION_MODES, MEMORY_CONSOLIDATION_MIN_INTERVAL_SEC } from "./config-types.js";
 function csv(name) {
     return csvOf(process.env[name]);
@@ -378,17 +380,16 @@ function credentialLawRewriteOf(href) {
     const scanned = redactSecrets(href);
     return scanned === href ? undefined : scanned;
 }
-function parseDeviceRelayUrlEnv() {
-    const raw = process.env.DEVICE_RELAY_URL;
-    if (raw === undefined || raw === "")
-        return undefined;
-    const scheme = /^wss?:\/\//i.exec(raw)?.[0];
-    const asHttp = scheme === undefined ? undefined : `${scheme.length === "wss://".length ? "https" : "http"}://${raw.slice(scheme.length)}`;
-    const flaws = asHttp === undefined ? ["not-ws-url"] : httpUrlFlaws(asHttp, ["userinfo", "query", "fragment"]).map((f) => (f === "not-http-url" ? "not-ws-url" : f));
+function parseDeviceRelayUrlEnv(raw) {
+    if (raw === undefined) {
+        throw new Error("internal: the device lane was assembled without DEVICE_RELAY_URL — the lane's required-env gate must refuse this first (the settings-schema lane table lists DEVICE_RELAY_URL as required for device)");
+    }
+    if (raw === DEVICE_RELAY_NONE)
+        return { kind: "none" };
+    const flaws = deviceRelayFlaws(raw);
     if (flaws.length > 0) {
-        throw new Error(`env DEVICE_RELAY_URL must be an absolute ws:// or wss:// URL with no userinfo, query or fragment (ws(s)://host[:port][/path]) — found: ${flaws.join(", ")}; got ${JSON.stringify(buildRefusalShownUrl(raw))}. ` +
-            `It is published verbatim on GET /v1/capabilities (deviceExecutor.relayUrl) as the address devices dial, so it has no room for credentials (devices authenticate by signature). ` +
-            `Leave it unset when devices reach this engine at its own address — they then dial it at deviceExecutor.wsPath.`);
+        throw new Error(`env DEVICE_RELAY_URL ${DEVICE_RELAY_RULE} — found: ${flaws.join(", ")}; got ${JSON.stringify(buildRefusalShownUrl(raw))}. ` +
+            `A URL has no room for credentials (devices authenticate by signature). Set it to "${DEVICE_RELAY_NONE}" when devices reach this engine at its own address — they then dial it at deviceExecutor.wsPath.`);
     }
     const href = new URL(raw).href;
     const credentialScan = credentialLawRewriteOf(href);
@@ -396,7 +397,26 @@ function parseDeviceRelayUrlEnv() {
         throw new Error(`env DEVICE_RELAY_URL carries something the credential-redaction law recognizes (${credentialScan}) — it is published verbatim on GET /v1/capabilities (deviceExecutor.relayUrl), ` +
             `so it must not carry a token-shaped path segment; keep it to ws(s)://host[:port][/path] (devices authenticate by signature, not by the URL).`);
     }
-    return raw;
+    return { kind: "url", url: raw };
+}
+function declaredExecutionLane(raw) {
+    if (raw === undefined || raw === "")
+        return undefined;
+    const table = readDeclaredLaneTable(raw);
+    if ("refusal" in table)
+        throw new Error(table.refusal);
+    const [lane, ...rest] = table.lanes;
+    if (rest.length > 0) {
+        throw new Error(`REMOTE_EXEC="${raw}" declares ${table.lanes.length} execution lanes (${table.lanes.join(", ")}; the first is the default) — this engine wires exactly one execution lane per process, ` +
+            `so ${rest.join(", ")} would never run anything while the deployment declares ${rest.length === 1 ? "it" : "them"}. ` +
+            `Refusing to start rather than serving "${lane}" alone: declare one lane per engine (REMOTE_EXEC=${lane}) and run a separate engine for each further lane.`);
+    }
+    const missing = laneMissingEnv(lane, process.env);
+    if (missing.length > 0) {
+        throw new Error(`REMOTE_EXEC=${lane} but required env ${missing.join(", ")} ${missing.length === 1 ? "is" : "are"} unset, empty or whitespace-only — it counts as absent: ` +
+            `refusing to start rather than silently downgrading to the host/in-process lane (#157; set ${missing.length === 1 ? "it" : "them"}, or unset REMOTE_EXEC if you meant no sandbox lane).`);
+    }
+    return lane;
 }
 function parseDevicePreAuthPerRemoteEnv() {
     const raw = process.env.DEVICE_MAX_PREAUTH_PER_REMOTE;
@@ -515,17 +535,16 @@ const OWN_CREDENTIAL_HANDOFF = {
     "sandbox-grant": { where: "a sandbox list puts the named variable, as written, into a sandbox the model can read", whom: "the sandbox" },
 };
 function ownCredentialNameProblem(name, channel) {
-    const engine = inheritEnvPolicyProblem([name]);
-    if (engine === undefined)
+    if (inheritEnvPolicyProblem([name]) === undefined)
         return undefined;
     const { where, whom } = OWN_CREDENTIAL_HANDOFF[channel];
-    return `this deployment's own credential — ${where}; give ${whom} a credential of its own (another name and another value) and list that name instead (the engine refuses it on any allow list: ${engine})`;
+    return `this deployment's own credential — ${where}; give ${whom} a credential of its own (another name and another value) and list that name instead (the engine refuses it on any allow list)`;
 }
 const NAMES_IN_FORCE = {
     LSP_ENV_ALLOW: (c) => c.lspEnvAllow,
-    E2B_SANDBOX_ENV: (c) => (c.remoteExec?.provider === "e2b" ? Object.keys(c.remoteExec.sandboxEnv ?? {}) : []),
-    K8S_SANDBOX_ENV: (c) => (c.remoteExec?.provider === "k8s" ? Object.keys(c.remoteExec.sandboxEnv ?? {}) : []),
-    DOCKER_SANDBOX_ENV: (c) => (c.remoteExec?.provider === "local-docker" ? Object.keys(c.remoteExec.env ?? {}) : []),
+    E2B_SANDBOX_ENV: (c) => (c.remoteExec?.provider === "e2b" ? Object.keys(sandboxForwardedEnvOf(c)) : []),
+    K8S_SANDBOX_ENV: (c) => (c.remoteExec?.provider === "k8s" ? Object.keys(sandboxForwardedEnvOf(c)) : []),
+    DOCKER_SANDBOX_ENV: (c) => (c.remoteExec?.provider === "local-docker" ? Object.keys(sandboxForwardedEnvOf(c)) : []),
 };
 const SERVER_ENV_NAME_ALLOWLIST_KNOBS = Object.keys(NAMES_IN_FORCE);
 export function sandboxEnvNamesInForce(seats) {
@@ -889,11 +908,14 @@ function parseStoreDomain(ctx) {
             },
         });
     }
-    const sqlEngineExplicit = !!process.env.DB_BACKEND && dbBackend !== "local" && dbBackend !== "memory";
-    const sessionBackendRaw = enumEnv("SESSION_BACKEND", sqlEngineExplicit ? "mysql" : "memory", SESSION_BACKENDS);
+    const declaredSqlEngine = dbBackendSet && (dbBackend === "mysql" || dbBackend === "pg") ? dbBackend : undefined;
+    const sessionBackendRaw = enumEnv("SESSION_BACKEND", declaredSqlEngine !== undefined ? "mysql" : "memory", SESSION_BACKENDS);
     const sessionBackend = sessionBackendRaw === "mysql" ? "tidb" : sessionBackendRaw;
     const localDataRoot = resolveLocalDataRoot(process.env, homedir());
     const dbHostSet = dbBackend === "pg" ? !!process.env.PG_HOST : !!process.env.MYSQL_HOST;
+    if (declaredSqlEngine !== undefined && !dbHostSet) {
+        throw new Error(buildDeclaredEngineWithoutCoordinatesRefusal(declaredSqlEngine, missingSqlCoordinateKeys(declaredSqlEngine, process.env)));
+    }
     const needsTidb = sessionBackend === "tidb" || (sessionBackend === "auto" && dbHostSet);
     const needsDb = needsTidb;
     const sqlCoordinateKeys = [...(process.env.MYSQL_HOST ? ["MYSQL_HOST"] : []), ...(process.env.PG_HOST ? ["PG_HOST"] : [])];
@@ -1631,7 +1653,7 @@ function parseMemoryEmbedder(ctx) {
         throw new Error(`MEMORY_EMBEDDER_DIM="${dimRaw}" must be a positive integer (the embedding dimension, e.g. 1024). A wrong dimension writes wrong-length vectors into the memory embedding column, which neither the DB nor retrieval reports — the vector plane just silently degrades to the lexical floor (#228).`);
     }
     if (ctx.memoryEngineBackend !== "pg") {
-        throw new Error(`MEMORY_EMBEDDER_* is set but MEMORY_ENGINE_BACKEND=${ctx.memoryEngineBackend} — the vector plane exists only on the pg memory backend (the tidb backend is lexical-only in v1 and refuses an embedder; the file engine has no embedder seam). Set MEMORY_ENGINE_BACKEND=pg, or unset MEMORY_EMBEDDER_*.`);
+        throw new Error(`MEMORY_EMBEDDER_* is set but MEMORY_ENGINE_BACKEND=${ctx.memoryEngineBackend} — the vector plane exists only on the pg memory backend (the mysql backend is lexical-only in v1 and refuses an embedder; the file engine has no embedder seam). Set MEMORY_ENGINE_BACKEND=pg, or unset MEMORY_EMBEDDER_*.`);
     }
     if (!ctx.memoryEngineEnabled) {
         throw new Error("MEMORY_EMBEDDER_* is set but MEMORY_ENGINE=off — the memory engine is not wired at all, so the embedder would never be called; unset one of the two (#228)");
@@ -1915,21 +1937,7 @@ function parseOrchestrationDomain(ctx) {
         return boolEnv("LSP_HOST_ENABLED", true);
     })();
     const lspEnvAllow = parseEnvNameAllowlist("LSP_ENV_ALLOW", singleUserTurnkey) ?? [];
-    {
-        const lane = process.env.REMOTE_EXEC;
-        if (lane !== undefined && lane !== "") {
-            const word = REMOTE_EXEC_PROVIDER_WORDS.find((w) => w === lane);
-            if (word === undefined) {
-                throw new Error(`REMOTE_EXEC="${lane}" is not an execution lane — valid: ${REMOTE_EXEC_PROVIDER_WORDS.join(" | ")}. ` +
-                    `An unrecognized value used to fall through to the host/in-process lane silently; refusing to start instead (#157).`);
-            }
-            const missing = laneMissingEnv(word, process.env);
-            if (missing.length > 0) {
-                throw new Error(`REMOTE_EXEC=${lane} but required env ${missing.join(", ")} ${missing.length === 1 ? "is" : "are"} unset, empty or whitespace-only — it counts as absent: ` +
-                    `refusing to start rather than silently downgrading to the host/in-process lane (#157; set ${missing.length === 1 ? "it" : "them"}, or unset REMOTE_EXEC if you meant no sandbox lane).`);
-            }
-        }
-    }
+    const declaredLane = declaredExecutionLane(process.env.REMOTE_EXEC);
     const readFaceFacts = process.env.READ_FACE !== undefined
         ? { readFace: enumEnv("READ_FACE", "roots", ["open", "roots"]), readFaceSource: "env" }
         : { readFaceSource: "engine-default" };
@@ -1944,6 +1952,8 @@ function parseOrchestrationDomain(ctx) {
             assertReadDenyBuiltinsResolvable(tiers, exclude);
             return { ...(tiers !== undefined ? { readDenyBuiltinTiers: tiers } : {}), ...(exclude !== undefined ? { readDenyBuiltinExclude: exclude } : {}) };
         })(),
+        readDenyFloorRequired: boolEnv("READ_DENY_FLOOR_REQUIRED", false),
+        sandboxReadFloor: enumEnv("SANDBOX_READ_FLOOR", SANDBOX_READ_FLOOR_DEFAULT, SANDBOX_READ_FLOOR_WORDS),
         ...((dir) => (dir !== undefined ? { agentConfigDir: dir } : {}))(declaredSemaConfigDir()),
         ...((p) => (p !== undefined ? { configLkgPath: p } : {}))(lkgPathOverrideOf(process.env.CONFIG_LKG_PATH)),
         configLkgEnabled: boolEnv("CONFIG_LKG_ENABLED", true),
@@ -1959,7 +1969,7 @@ function parseOrchestrationDomain(ctx) {
             }
             return raw;
         })()),
-        remoteExec: process.env.REMOTE_EXEC === "e2b" && process.env.E2B_API_KEY
+        remoteExec: declaredLane === "e2b" && process.env.E2B_API_KEY
             ? {
                 provider: "e2b",
                 apiKey: process.env.E2B_API_KEY,
@@ -1972,7 +1982,7 @@ function parseOrchestrationDomain(ctx) {
                 orphanReclaim: boolEnv("E2B_ORPHAN_RECLAIM", true),
             }
             :
-                process.env.REMOTE_EXEC === "k8s" && process.env.K8S_SANDBOX_IMAGE && process.env.K8S_NAMESPACE
+                declaredLane === "k8s" && process.env.K8S_SANDBOX_IMAGE && process.env.K8S_NAMESPACE
                     ? {
                         provider: "k8s",
                         image: process.env.K8S_SANDBOX_IMAGE,
@@ -1994,7 +2004,7 @@ function parseOrchestrationDomain(ctx) {
                         ...((c) => (c !== undefined ? { workspaceCache: c } : {}))(k8sWorkspaceCache()),
                     }
                     :
-                        process.env.REMOTE_EXEC === "ssh" && process.env.SSH_HOST && process.env.SSH_USER && process.env.SSH_PRIVATE_KEY
+                        declaredLane === "ssh" && process.env.SSH_HOST && process.env.SSH_USER && process.env.SSH_PRIVATE_KEY
                             ? {
                                 provider: "ssh",
                                 host: process.env.SSH_HOST,
@@ -2005,7 +2015,7 @@ function parseOrchestrationDomain(ctx) {
                                 ...((hk) => (hk !== undefined ? { hostKey: hk } : {}))(parseSshHostKeyEnv()),
                             }
                             :
-                                process.env.REMOTE_EXEC === "adb" && process.env.ADB_SERIAL
+                                declaredLane === "adb" && process.env.ADB_SERIAL
                                     ? {
                                         provider: "adb",
                                         serial: process.env.ADB_SERIAL,
@@ -2013,14 +2023,14 @@ function parseOrchestrationDomain(ctx) {
                                         ...(process.env.ADB_MOUNT_PATH ? { mountPath: process.env.ADB_MOUNT_PATH } : {}),
                                     }
                                     :
-                                        process.env.REMOTE_EXEC === "host"
+                                        declaredLane === "host"
                                             ? {
                                                 provider: "host",
                                                 ...(process.env.HOST_WORKSPACE_BASE ? { workspaceBase: process.env.HOST_WORKSPACE_BASE } : {}),
                                                 ...((n) => (n !== undefined ? { commandTimeoutMs: n } : {}))(optNumEnvStrict("HOST_COMMAND_TIMEOUT_MS")),
                                             }
                                             :
-                                                process.env.REMOTE_EXEC === "local-docker" && process.env.DOCKER_IMAGE
+                                                declaredLane === "local-docker" && process.env.DOCKER_IMAGE
                                                     ? {
                                                         provider: "local-docker",
                                                         image: process.env.DOCKER_IMAGE,
@@ -2038,7 +2048,7 @@ function parseOrchestrationDomain(ctx) {
                                                         ...((names) => (names !== undefined ? { env: allowlistedEnv(names, process.env) } : {}))(parseEnvNameAllowlist("DOCKER_SANDBOX_ENV", singleUserTurnkey)),
                                                     }
                                                     :
-                                                        process.env.REMOTE_EXEC === "device"
+                                                        declaredLane === "device"
                                                             ? {
                                                                 provider: "device",
                                                                 ...((n) => (n !== undefined ? { deliveryTimeoutMs: n } : {}))(parseDeviceBoundedIntEnv("DEVICE_DELIVERY_TIMEOUT_MS", process.env.DEVICE_DELIVERY_TIMEOUT_MS, DEVICE_DELIVERY_TIMEOUT_BOUNDS)),
@@ -2047,7 +2057,7 @@ function parseOrchestrationDomain(ctx) {
                                                                 ...((n) => (n !== undefined ? { maxInflightPerDevice: n } : {}))(parseDeviceBoundedIntEnv("DEVICE_MAX_INFLIGHT_PER_DEVICE", process.env.DEVICE_MAX_INFLIGHT_PER_DEVICE, DEVICE_HELLO_ACK_BOUNDS.maxInflight)),
                                                                 ...((n) => (n !== undefined ? { maxPreAuthPerRemote: n } : {}))(parseDevicePreAuthPerRemoteEnv()),
                                                                 ...((n) => (n !== undefined ? { enrollTokenTtlSec: n } : {}))(parseDeviceEnrollTokenTtlEnv()),
-                                                                ...((n) => (n !== undefined ? { relayUrl: n } : {}))(parseDeviceRelayUrlEnv()),
+                                                                relay: parseDeviceRelayUrlEnv(process.env.DEVICE_RELAY_URL),
                                                                 ...(process.env.DEVICE_SUPERSEDE ? { supersede: enumEnv("DEVICE_SUPERSEDE", "stale_only", ["stale_only", "deny"]) } : {}),
                                                             }
                                                             :
@@ -2471,7 +2481,7 @@ const ORCHESTRATION_GROUP_KEYS = [
     "workflowSizeGuideline", "backgroundAgentRetentionMs", "backgroundAgentStaleRunningMs",
     "backgroundAgentParkClaimStaleMs", "delegationEntryCaps", "rosterRetentionMs", "leaderRunStaleMs", "scratchpadSweepTtlMs", "sandboxPkgSource", "sandboxPkgSourceCustom",
     "sessionAutoTitle", "sessionAutoTitleSource", "selectEnvironmentTool", "envFactsEnabled", "toolDeferLongtail", "lspEnabled", "lspHostEnabled", "lspEnvAllow",
-    "imageBakes", "readFace", "readFaceSource", "taskWriteFaceEscalation", "readDenyPatterns", "readDenyBuiltinTiers", "readDenyBuiltinExclude",
+    "imageBakes", "readFace", "readFaceSource", "taskWriteFaceEscalation", "readDenyPatterns", "readDenyBuiltinTiers", "readDenyBuiltinExclude", "readDenyFloorRequired", "sandboxReadFloor",
     "agentConfigDir", "configLkgPath", "configLkgEnabled",
 ];
 const LIMITS_HTTP_GROUP_KEYS = [