@sema-agent/server 7.140.0 → 7.142.0

package/dist/config-catalog.js

@@ -1,6 +1,6 @@
 import { CROSS_SESSION_INBOUND_SETTINGS, CROSS_SESSION_DIALOG_EXPIRY_VALUES } from "@sema-agent/core";
 import { GLOBAL_SCOPE } from "@sema-agent/settings-schema/api/scopes";
-import { WEB_ADMIN_ENV, DOMAIN_SCHEMAS, buildRetiredEnvWire } from "@sema-agent/settings-schema";
+import { DEVICE_RELAY_NONE, WEB_ADMIN_ENV, DOMAIN_SCHEMAS, buildRetiredEnvWire } from "@sema-agent/settings-schema";
 import { CENTER_CREDENTIAL_RENEW_LEAD_DEFAULT_MS, CENTER_CREDENTIAL_RENEW_LEAD_MAX_MS, CENTER_CREDENTIAL_RENEW_LEAD_MIN_MS } from "./center-credential-renewer.js";
 import { SANDBOX_IPV6_DEFAULT, SANDBOX_IPV6_WORDS } from "./sandbox-egress-policy.js";
 import { WORKSPACE_CACHE_DEFAULT, WORKSPACE_CACHE_MOUNT_DEFAULT, WORKSPACE_CACHE_SIZE_DEFAULT, WORKSPACE_CACHE_WORDS } from "./workspace-cache.js";
@@ -14,7 +14,7 @@ import { AUTO_MODE_CLASSIFIER_TIMEOUT_BOUNDS, CENTER_BASE_URL_RULE, CONFIG_PROVI
 import { DEVICE_HELLO_ACK_BOUNDS } from "./device-ws-protocol.js";
 import { webSearchProviderFromEnv, WEB_SEARCH_PROVIDERS } from "./plugins/web-search.js";
 import { AUTONOMY_MODES } from "./runtime-governance.js";
-import { REMOTE_EXEC_PROVIDER_WORDS } from "./execution-lane-caps.js";
+import { REMOTE_EXEC_PROVIDER_WORDS, SANDBOX_READ_FLOOR_DEFAULT, SANDBOX_READ_FLOOR_WORDS } from "./execution-lane-caps.js";
 import { MEMORY_ENGINE_BACKENDS, SESSION_BACKENDS, STORE_BACKENDS } from "@sema-agent/settings-schema/execution-lanes";
 import { MODEL_PROVIDER_WORDS } from "./model-provider.js";
 import { buildDisplaySafeUrlChecked } from "./trace/redact.js";
@@ -126,7 +126,7 @@ export const CONFIG_CATALOG = [
     r("DEVICE_MAX_INFLIGHT_PER_DEVICE", "orchestration", "number", `per-device 在途上限(超额云侧排队;原值进 helloAck.maxInflight;须为 ≥ ${DEVICE_HELLO_ACK_BOUNDS.maxInflight.min} 的规范十进制整数,其余拒启 —— 0 会让每次派发都 device.busy)`, { derivedDefaultNote: "缺席 ⇒ 4(§11-O3 裁定值)" }),
     r("DEVICE_MAX_PREAUTH_PER_REMOTE", "orchestration", "number", "未鉴权握手的 per-remote 并发帽(正整数或字面 off;XFF/NAT 形用 off+全局帽)", { danger: SEC, derivedDefaultNote: "缺席 ⇒ 8" }),
     r("DEVICE_RECONNECT_GRACE_MS", "orchestration", "number", `device 断连后在途不判丢的窗(ms;同 epoch 重连续接;原值进 helloAck.reconnectGraceMs;须为 [${DEVICE_HELLO_ACK_BOUNDS.reconnectGraceMs.min}, ${DEVICE_HELLO_ACK_BOUNDS.reconnectGraceMs.max}] 内规范十进制整数,其余拒启)`, { derivedDefaultNote: "缺席 ⇒ adapter 默认 120s" }),
-    r("DEVICE_RELAY_URL", "orchestration", "url", "设备直达入口:设备连不到本引擎自己的地址(引擎在中继 / 网关之后)时拨的那一个 ws(s) URL,逐字上 /v1/capabilities 的 deviceExecutor.relayUrl;须为无 userinfo / query / fragment、不带凭据形的 ws:// 或 wss:// 绝对地址,其余拒启。不从 FLEET_ADVERTISE_ADDRESS 派生(那是对中心公告的地址,受众不是设备)", { derivedDefaultNote: "缺席 ⇒ 能力面不带 relayUrl,设备按引擎地址 + deviceExecutor.wsPath 拨号" }),
+    r("DEVICE_RELAY_URL", "orchestration", "url", "设备入口(REMOTE_EXEC=device 必填):设备连不到本引擎自己的地址(引擎在中继 / 网关之后)时拨的那一个 ws(s) URL,逐字上 /v1/capabilities 的 deviceExecutor.relayUrl;或字面 none = 没有中继,设备按引擎地址 + deviceExecutor.wsPath 拨号(能力面不带 relayUrl;有设备绑定时起服 warn 点名绑定数)。URL 须为无 userinfo / query / fragment、不带凭据形的 ws:// 或 wss:// 绝对地址,其余拒启。不从 FLEET_ADVERTISE_ADDRESS 派生(那是对中心公告的地址,受众不是设备)", { enumValues: [DEVICE_RELAY_NONE], derivedDefaultNote: "无缺省:device 车道的必需键 —— 缺席 / 空串 / 只含空白拒起(撤中继声明的回滚序 = 先恢复引擎自己的入口,再写 none)" }),
     r("DEVICE_SUPERSEDE", "orchestration", "enum", "同 deviceId 二连的顶替策略", { enumValues: ["stale_only", "deny"], staticDefault: "stale_only", danger: SEC }),
     r("DIRECT_APPROVAL_DOOR", "approval", "boolean", "直连 /decide 门(无 BFF 的桌面/CLI 客户端;开 ⇒ 要求签名 JWT+HMAC 信封,principal 头降级不可信)", { staticDefault: "false", danger: SEC, configKey: "directApprovalDoor" }),
     r("DOCKER_COMMAND_TIMEOUT_MS", "orchestration", "number", "local-docker 车道单命令超时(ms)"),
@@ -250,7 +250,7 @@ export const CONFIG_CATALOG = [
     r("MCP_ELICITATION_TTL_MS", "approval", "number", "elicitation 无人应答释放窗(ms)", { derivedDefaultNote: "缺席 ⇒ 本服务出厂窗(DEFAULT_ELICITATION_THROTTLE)" }),
     r("MEMORY_AUTO_CONSOLIDATION", "memory", "enum", "记忆自动整理部署席(on=每个建议任务后整库整理跑,记忆内容自动外流到整理模型;off=显式关,胜过引擎缺省;未设=读引擎具名缺省)", { enumValues: ["on", "off"], derivedDefaultNote: "缺席 ⇒ 引擎具名缺省(**本版装的引擎是开**)——不配不等于关;前置=整理阀门开着(MEMORY_CONSOLIDATION_DRIVER=on,或未设而出厂缺省派生成开)", danger: SEC, resolve: (c) => c.memoryConsolidationDriver.autoRunOnRecommendation, booleanEnum: { true: "on", false: "off" } }),
     r("MEMORY_CAPTURE_POLICY", "memory", "enum", "记忆 capture 姿态(open=声明按面值;governed=按 per-principal verdict;capture-required=恒采)", { enumValues: ["open", "governed", "capture-required"], staticDefault: "open", danger: SEC, configKey: "memoryCapturePolicy" }),
-    r("MEMORY_CONSOLIDATION_DRIVER", "memory", "enum", "记忆折叠阀门(off=零装配零探针,两 admin 口 404 族;on=座解析 + 两 admin 口 + 引擎面整理两席)", { enumValues: ["on", "off"], derivedDefaultNote: "缺席 ⇒ 起服时派生:整理座不落主模型(MODEL_CHEAP_ID 在场且异于 MODEL_ID,或目录给 consolidate / summarize / flash 档位绑了别的模型)⇒ on;落主模型 ⇒ off + 起服 warn memory_consolidation_default_off_no_cheap_model;结构上跑不起来(无记忆引擎 / pg·tidb 记忆后端 / MEMORY_PROVENANCE=off)⇒ 恒 off 零提示。显式 on 而落主模型 ⇒ 照开 + warn memory_consolidation_on_main_model(按主模型计费)", danger: BILL, resolve: (_c, _env, boot) => (boot.memoryConsolidationValve === undefined ? undefined : boot.memoryConsolidationValve.enabled ? "on" : "off") }),
+    r("MEMORY_CONSOLIDATION_DRIVER", "memory", "enum", "记忆折叠阀门(off=零装配零探针,两 admin 口 404 族;on=座解析 + 两 admin 口 + 引擎面整理两席)", { enumValues: ["on", "off"], derivedDefaultNote: "缺席 ⇒ 起服时派生:整理座不落主模型(MODEL_CHEAP_ID 在场且异于 MODEL_ID,或目录给 consolidate / summarize / flash 档位绑了别的模型)⇒ on;落主模型 ⇒ off + 起服 warn memory_consolidation_default_off_no_cheap_model;结构上跑不起来(无记忆引擎 / pg·mysql 记忆后端 / MEMORY_PROVENANCE=off)⇒ 恒 off 零提示。显式 on 而落主模型 ⇒ 照开 + warn memory_consolidation_on_main_model(按主模型计费)", danger: BILL, resolve: (_c, _env, boot) => (boot.memoryConsolidationValve === undefined ? undefined : boot.memoryConsolidationValve.enabled ? "on" : "off") }),
     r("MEMORY_CONSOLIDATION_INTERVAL_SEC", "memory", "number", "折叠周期腿节律(秒;本 build 任何正值拒启 —— 周期腿未落地,恒 0)", { staticDefault: "0" }),
     r("MEMORY_CONSOLIDATION_SCOPES", "memory", "csv", "折叠阀门 scope 表(恰一条时=admin 口缺省;不是授权边界)"),
     r("MEMORY_DELEGATION_EVIDENCE", "memory", "enum", "委派臂污染标记的证据标准", { enumValues: ["static-face", "attested-only"], staticDefault: "static-face", danger: SEC, configKey: "memoryDelegationEvidence" }),
@@ -260,7 +260,7 @@ export const CONFIG_CATALOG = [
     r("MEMORY_EMBEDDER_MODEL", "memory", "string", "embeddings 模型名"),
     r("MEMORY_EMBEDDER_TIMEOUT_MS", "memory", "number", "单次 embed 活性上限(ms)", { staticDefault: "30000" }),
     r("MEMORY_ENGINE", "memory", "enum", "记忆引擎总开关(注入式文件记忆面;双族词表,未知词拒启)", { enumValues: ["on", "off"], staticDefault: "on", configKey: "memoryEngineEnabled", booleanEnum: { true: "on", false: "off" } }),
-    r("MEMORY_ENGINE_BACKEND", "memory", "enum", "记忆持久面方言(file=现状;pg/tidb=DB 真身,多租户点亮的唯一门)", { enumValues: MEMORY_ENGINE_BACKENDS, staticDefault: "file", danger: DATA, configKey: "memoryEngineBackend" }),
+    r("MEMORY_ENGINE_BACKEND", "memory", "enum", "记忆持久面方言(file=现状;pg/mysql=DB 真身,多租户点亮的唯一门;方言与 DB_BACKEND 同字)", { enumValues: MEMORY_ENGINE_BACKENDS, staticDefault: "file", danger: DATA, configKey: "memoryEngineBackend" }),
     r("MEMORY_ENGINE_DIR", "memory", "path", "记忆引擎根覆写", { derivedDefaultNote: "缺席 ⇒ core 默认链(AGENT_DATA_DIR → ~/.ai-agent)", configKey: "memoryEngineDir" }),
     r("MEMORY_ENGINE_REMOTE_LANE", "memory", "enum", "远端执行车道上放行 file 记忆引擎的 plane-split 覆写", { enumValues: ["allow"] }),
     r("MEMORY_ORG_ADMISSION_MODE", "memory", "enum", "org 记忆准入模式(audit=判决照算纯观察)", { enumValues: ["audit", "enforce"], staticDefault: "enforce", danger: SEC, configKey: "memoryOrgAdmissionMode" }),
@@ -273,6 +273,7 @@ export const CONFIG_CATALOG = [
     r("MEMORY_SYNC_MAX_PULL_ENTRIES", "memory", "number", "TOC 同步单轮 pull 条数帽(设了必须 ≥1 整数)", { derivedDefaultNote: "缺席 ⇒ 键缺席,core 默认" }),
     r("MEMORY_SYNC_MAX_PUSH_ENTRIES", "memory", "number", "TOC 同步单轮 push 条数帽(设了必须 ≥1 整数)", { derivedDefaultNote: "缺席 ⇒ 键缺席,core 默认" }),
     r("MEMORY_SYNC_SCOPE", "memory", "string", "TOC 同步 scope 覆写(本服务铸的项目键族 `userrepo:` / `repo:` 拒启:项目层由同步腿按属主自己选)", { derivedDefaultNote: "缺席 ⇒ = MEMORY_SCOPE,仅当它已是 typed 键;非 typed 键拒启(S-964)" }),
+    r("MEMORY_SYNC_SERVE_IDENTITY", "memory", "url", "记忆同步中心(DB 记忆平面)声明的同步身份 = 客户端用来到达本中心同步口的基址;必须已是规范形(小写协议与主机、无缺省端口、无尾斜杠、无查询串 / 片段 / 凭据),否则拒启并给出规范形;能力位 `memorySyncServe.identity` 逐字公开,入站 `peer` 按串与它比", { derivedDefaultNote: "缺席 ⇒ 本中心不服务同步(501 feature.memory_sync_serve_disabled)", configKey: "memorySyncServeIdentity" }),
     r("MEMORY_SYNC_TOKEN", "memory", "secret", "TOC 同步中心面的 Bearer(URL 设了它必须在,半配拒启)", { danger: SEC }),
     r("MEMORY_SYNC_URL", "memory", "url", "TOC 同步中心地址(设了=开;file 记忆形专用,DB 后端配了拒启;同步覆盖同步层与同属主的项目层 `userrepo:<属主>/…` ⇒ 同步层与 MEMORY_SCOPE 同属主时单用户任务照常按项目键控并随同步推拉;不同属主 ⇒ 写家落全局层,启动通知 `memory_project_scope_yields_to_sync`)"),
     r("METRICS_TOKEN", "observability", "secret", "/metrics 只读令牌", { danger: SEC }),
@@ -395,12 +396,12 @@ export const CONFIG_CATALOG = [
     r("RATE_LIMIT_RPM", "limitsHttp", "number", "计费提交每分钟限流(0=关)", { staticDefault: "0", danger: BILL, configKey: "rateLimitPerMin", center: cLimits("rateLimitPerMin") }),
     r("READ_DENY_BUILTIN_EXCLUDE", "orchestration", "csv", "按行名删内建 deny 条目(档位之后生效;绝不削任务显式 deny)", { danger: SEC, configKey: "readDenyBuiltinExclude" }),
     r("READ_DENY_BUILTIN_TIERS", "orchestration", "csv", "内建 deny 表档位选择(闭集五档 credentials/shell-history/browser/wallet/agent-config;none=显式空姿态)", { danger: SEC, derivedDefaultNote: "缺席 ⇒ 出厂两档在岗 **credentials,agent-config**(core 7.34.0 R-2 起;7.22.0–7.33.x 曾为 OFF)。要全关显式写 none;要全五档显式写 credentials,shell-history,browser,wallet,agent-config;空值拒启(手滑与显式意图不许同形)", configKey: "readDenyBuiltinTiers" }),
-    r("READ_DENY_FLOOR_REQUIRED", "orchestration", "boolean", "要求读拒表的字节地板:true ⇒ 读拒表有行而执行环境不守地板(起服行 remote_exec_enabled.keepsReadFloor=false;此时另有起服 warn read_deny_floor_required_unkept)的 run 在准备期拒(config.read_deny_floor_unkept,一个命令都不起;同步提交 409)。出厂读拒档在岗 ⇒ 这类车道上带手的 run 一律拒起", { staticDefault: "false", danger: SEC, derivedDefaultNote: "缺席 ⇒ 不要求:run 照跑,每 run 一条 operator 通告 config.read_deny_floor_unkept(engine_notice 日志;递归读照读表里的文件,通告不是保护)", configKey: "readDenyFloorRequired" }),
+    r("READ_DENY_FLOOR_REQUIRED", "orchestration", "boolean", "要求读拒表的字节地板:true ⇒ 读拒表有行而执行环境不守地板(起服行 remote_exec_enabled.keepsReadFloor=false;此时另有起服 warn read_deny_floor_required_unkept)的 run 在准备期拒(config.read_deny_floor_unkept,一个命令都不起;同步提交 409)。出厂读拒档在岗 ⇒ 不守地板的车道(主机 / ssh / adb / device,以及读地板模块尚未服务或 SANDBOX_READ_FLOOR=off 的沙箱车道)上带手的 run 一律拒起", { staticDefault: "false", danger: SEC, derivedDefaultNote: "缺席 ⇒ 不要求:run 照跑,每 run 一条 operator 通告 config.read_deny_floor_unkept(engine_notice 日志;递归读照读表里的文件,通告不是保护)", configKey: "readDenyFloorRequired" }),
     r("READ_DENY_PATTERNS", "orchestration", "csv", "READ 面额外 deny pattern 表", { danger: SEC, configKey: "readDenyPatterns" }),
     r("READ_FACE", "orchestration", "enum", "READ 容纳面档位(env 逐键恒赢 center —— 部署主权表达)", { enumValues: ["open", "roots"], danger: SEC, derivedDefaultNote: "缺席 ⇒ 按 posture 派生(S-167):单用户 turnkey(REQUIRE_PRINCIPAL 未设)铸 open;多租户不铸键、core 默认 roots。生效来源见 GET /v1/diagnostics/wiring 的 readFace.source 四词", configKey: "readFace" }),
     r("REAP_INTERVAL_SEC", "limitsHttp", "number", "reaper 周期(秒)", { staticDefault: "60", configKey: "reapIntervalSec" }),
     r("REAP_RUN_STALE_SEC", "limitsHttp", "number", "run 活性判陈旧阈(秒)", { staticDefault: "120", configKey: "runStaleSec", center: cLimits("runStaleSec") }),
-    r("REMOTE_EXEC", "orchestration", "enum", "执行车道选择(点名而配不齐/认不出 ⇒ 拒启,绝不静默降级到 host/stub)", { enumValues: REMOTE_EXEC_PROVIDER_WORDS, danger: SEC, derivedDefaultNote: "缺席:CONFIG_PROVIDER=local ⇒ host;其余 ⇒ 进程内 stub(手带整族不挂;残余名册看活体 wiring_manifest 里 mountedBy=hands 的条目数,不按工具名点。想让这一形拒启见 REQUIRE_EXECUTION_LANE)", configKey: "remoteExec", resolve: (c) => c.remoteExec?.provider ?? null }),
+    r("REMOTE_EXEC", "orchestration", "enum", "执行车道选择(点名而配不齐/认不出 ⇒ 拒启,绝不静默降级到 host/stub)。形 = 部署声明的有序车道表(逗号分隔、首项缺省,契约 runtime.execution.lanes 的渲染形);本引擎每个进程只装一条车道 ⇒ 表里不止一条拒启,单词照旧", { enumValues: REMOTE_EXEC_PROVIDER_WORDS, danger: SEC, derivedDefaultNote: "缺席:CONFIG_PROVIDER=local ⇒ host;其余 ⇒ 进程内 stub(手带整族不挂;残余名册看活体 wiring_manifest 里 mountedBy=hands 的条目数,不按工具名点。想让这一形拒启见 REQUIRE_EXECUTION_LANE)", configKey: "remoteExec", resolve: (c) => c.remoteExec?.provider ?? null }),
     r("REMOTE_EXEC_HOME_DIR", "orchestration", "path", "执行环境的 home 目录(`~/` 形权限规则的基、引擎家锚拒读行的落点;core ExecutionEnv.homeDir 座)。声明与车道出厂答案(host ⇒ 本进程家目录,e2b ⇒ /home/user)都是主张:读得出家目录的车道(k8s / local-docker / ssh / adb / e2b / host)在每只执行环境开起来时拿环境里命令看到的 $HOME 证它(同一只判官、同一句拒),不一致或问不出 ⇒ 那只环境不开;不声明且车道没有出厂答案时,建环境那一拍实测 $HOME 填引擎手里的座(`~/` 形规则的下单门仍只认 boot 期答案);device 读不了 ⇒ 声明即座、起服 warn execution_lane_home_unmeasured 披露未实测", { danger: SEC, derivedDefaultNote: "缺席:host/in-process ⇒ os.homedir();e2b ⇒ /home/user(两者都在环境开起来时与 $HOME 对证);k8s/local-docker/ssh/adb ⇒ 建环境时实测 $HOME(实测缺席 ⇒ 那只环境的座缺席:泄内容的递归读全 shell 面真人问、只读面拒,并响 warn execution_lane_home_undeclared);device ⇒ 无(设备协议没有家目录读数:起服 warn execution_lane_home_undeclared);`~/` 形规则的下单门恒只认声明(无声明即 422 响亮拒)", configKey: "remoteExecHomeDir", resolve: (c) => c.remoteExecHomeDir ?? null }),
     r("REQUIRE_EXECUTION_LANE", "orchestration", "boolean", "开了之后:REMOTE_EXEC 未点名 ∧ CONFIG_PROVIDER≠local ⇒ **拒启**并点名该设什么。默认关 = 照旧启动,但执行环境是进程内 stub、**零手带工具**(手带整族不挂;活体读数:mountedBy=hands 条目 10 → 0),名册里其余工具照常执行,任务仍回 status=completed —— 凡需要手的请求,与「模型不肯用工具」在用户面同形。判据 = 活体 wiring_manifest 里 mountedBy=hands 的条目数,不按工具名点;名册总条数随 core 版本走,不写死。托管/云部署推荐开(docs/DEPLOY-PREREQS.md)", { staticDefault: "false", danger: SEC, configKey: "requireExecutionLane" }),
     r("REQUIRE_PRINCIPAL", "auth", "boolean", "多租户开关(posture 判别位:true ⇒ CC 能力族默认收紧)", { staticDefault: "false", danger: SEC, configKey: "requirePrincipal" }),
@@ -422,6 +423,7 @@ export const CONFIG_CATALOG = [
     r("SANDBOX_BASE_REF", "orchestration", "string", "bake 缺省 base ref(缺席回落 index 最新 sandbox-base)"),
     r("SANDBOX_ENV_FACTS", "orchestration", "boolean", "沙箱事实注入(# Environment 块的 profile/capabilities/pkgSource/egress/resume 事实);会话 scratchpad 的宣告不归本键管(S-842:它是写面的宣告,关事实不关 scratchpad)", { staticDefault: "true", configKey: "envFactsEnabled" }),
     r("SANDBOX_PKG_SOURCE", "orchestration", "enum", "沙箱包源选择(cn/global/custom;none=完全不注入)", { enumValues: ["global", "cn", "custom", "none"], staticDefault: "global" }),
+    r("SANDBOX_READ_FLOOR", "orchestration", "enum", "沙箱三车道(e2b / k8s / local-docker)的读拒表字节地板:keep = 沙箱读地板模块服务该车道时守地板(命令跑的每个程序都打不开读拒表判拒的路径,做不到就拒起该命令:spawn_error 首句点名原因词);off = 不守(车道块 keepsReadFloor=false,起动与没有模块时逐字同)。起服行 remote_exec_enabled.sandboxReadFloor 报生效状态(kept / off / unserved);别的车道上无作用;词表外 / 空串拒启", { enumValues: SANDBOX_READ_FLOOR_WORDS, staticDefault: SANDBOX_READ_FLOOR_DEFAULT, danger: SEC, derivedDefaultNote: "缺席 ⇒ keep;本版模块尚未服务任何沙箱车道(状态 unserved),三条沙箱车道照旧不守地板", configKey: "sandboxReadFloor" }),
     r("SCHEDULER_ENABLED", "orchestration", "boolean", "自唤醒 scheduler(host 车道单用户形)", { derivedDefaultNote: "posture 三态:缺席 = 单用户 ⇒ on / 多租户 ⇒ off(调度归 center)", configKey: "schedulerEnabled" }),
     r("SCHEDULER_SESSION_LIFETIME", "orchestration", "boolean", "session-lifetime 记录 host-signal(headless 壳注 false ⇒ CronCreate 前门拒)", { staticDefault: "true", configKey: "schedulerSessionLifetime" }),
     r("SCHEDULER_SESSION_WAKEUP", "orchestration", "boolean", "session 唤醒 host-signal(无常驻 daemon 的壳注 false)", { staticDefault: "true", configKey: "schedulerSessionWakeup" }),
@@ -451,7 +453,7 @@ export const CONFIG_CATALOG = [
     r(WEB_ADMIN_ENV.worker, "integrations", "string", "本 worker 在 web-admin 上的名字(per-worker effective)"),
     r("SEND_USER_FILE_SANDBOX_PUT_ENDPOINT", "store", "url", "沙箱侧 presigned PUT Host 绑定 endpoint(in-cluster 可用内网面)", { derivedDefaultNote: "缺席 ⇒ publicEndpoint" }),
     r("SEND_USER_FILE_URL_TTL", "store", "number", "公链 TTL(秒;非法值回 0=永久轨,绝不 NaN 进签名)", { staticDefault: "0" }),
-    r("SENSITIVE_WRITE_PATTERNS", "approval", "csv", "敏感路径写 deny 集(unset=core 推荐集;显式值整表替换;off/空=关 —— 真放松杆)", { danger: SEC, derivedDefaultNote: "缺席 ⇒ core RECOMMENDED_SENSITIVE_PATTERNS", configKey: "sensitiveWritePatterns" }),
+    r("SENSITIVE_WRITE_PATTERNS", "approval", "csv", "敏感路径写 deny 集(unset=core 推荐集;显式值整表替换;off/空=关 —— 真放松杆)。拒的是文件工具(Write / Edit / NotebookEdit,按路径);shell 命令写同一路径(重定向 / tee / cp …)不被这个集拒绝,走普通审批问", { danger: SEC, derivedDefaultNote: "缺席 ⇒ core RECOMMENDED_SENSITIVE_PATTERNS", configKey: "sensitiveWritePatterns" }),
     r("SERVICE_AUTH_TOKEN", "auth", "secret", "共享 service token(写面门;缺席且未开 ALLOW_UNAUTHED_WRITES ⇒ 拒提交)", { danger: SEC }),
     r("SERVICE_AUTH_TOKENS", "auth", "secret", "per-system 凭据表(tok=system CSV;source 从凭据派生,绝不自报)", { danger: SEC }),
     r("SESSION_AUTO_TITLE", "orchestration", "boolean", "首次提交自动铸 session 标题(一次 cheap 调用)", { staticDefault: "true", danger: BILL, configKey: "sessionAutoTitle" }),
@@ -642,6 +644,8 @@ function sanitizeValue(spec, v) {
     const type = spec.type;
     if (type === "url") {
         if (typeof v === "string") {
+            if (spec.enumValues?.includes(v) === true)
+                return { value: v };
             if (v.includes(","))
                 return displayUrlItems(v.split(",").map((s) => s.trim()), true);
             const shown = buildDisplaySafeUrlChecked(v);

package/dist/config-provider.d.ts

@@ -1,4 +1,5 @@
 import { type DroppedConfigEntry, type UnreadConfigFile, type UnreadConfigKey } from "./web-admin-client/read-warnings.js";
+import { FileConfigStore } from "@sema-agent/settings-schema/node";
 import { type ConfigDocumentRefusal, type EffectiveConfig as AgentConfigEffective, type EffectiveReadWarning } from "@sema-agent/settings-schema";
 import { fetchEffective as remoteFetchEffective, fetchSkillContent as remoteFetchSkillContent, type EffectiveConfig } from "./web-admin-client/facade.js";
 import type { CenterEndpoint } from "./web-admin-client/center-request.js";
@@ -10,7 +11,7 @@ import type { ConfigProviderWord } from "./config-types.js";
 /** 壳写在 `config.d/models.json` 条目上的装饰键(`sema*`)自 settings-schema 1.5.0 起是**声明过的扩展命名空间**
  *  (`EXTENSION_NAMESPACES`):schema 照旧 strip、但不再报「未知键」,所以本函数收到的每一个未知键都是拼错/越界 ⇒ 候选门错误。
  *  此前把这类键当「通知」放行的整套下游机制(域豁免/键路径闭集/满额特判/单独的通知面)已全部撤回——意图在声明处说,消费方不猜。 */
-/** `readWarnings`:契约 `onWarning` 流的**原值**(未折叠),两条读腿同键同义 —— 读者是一致性门的读腿适配器(它要逐条对契约语料的
+/** `readWarnings`:契约读侧告警流的**原值**(未折叠;远程腿 = `readEffectiveWire` 的告警回调,本地腿 = 单读口交成数据的 `warnings`),两条读腿同键同义 —— 读者是一致性门的读腿适配器(它要逐条对契约语料的
  *  告警多重集,折叠后的诊断面带不回 `kind` / 坐标段)。恒在场(空数组 = 这次读零告警),不用缺席表达「没有」
  *  ——缺席/空两形并存就是又一处二义。
  *  🔐 原流的 `error` 未经 {@link redactConfigError}(那道脱敏挂在真正进日志流的 `domainErrors` 产出边界上),
@@ -23,9 +24,9 @@ import type { ConfigProviderWord } from "./config-types.js";
 /** `unreadFiles`:`config.d` 里读腿根本不读的文件(不是域 / 不是便携域)—— **不**进候选门(不是读的域判形失败),调用方一份一行
  *  `config_unread_file` 点名、其余照用;缺席 = 没有(本地读腿才会有)。 */
 /** `refusedDocuments`:被拒文档 —— 契约的类型 `ConfigDocumentRefusal`(`{ document, reason, error }`,墓碑另带 `migration`;`reason` 是契约闭集
- *  `CONFIG_DOCUMENT_REFUSAL_REASONS`:`empty` / `invalid_json` / `not_object` / `io` 文件层,`retired_domain` 墓碑)。读腿不抛,交成发现,候选判官以发现自带的词整拒这份候选
- *  (与域判形失败同一条回落链、同一行拒判);缺席 = 没有。远端腿:wire 上只有墓碑一种,那一键不进 effective、其余域照读、版本照读;本地腿:契约的严读拒了这棵树 ⇒
- *  被拒文档 = 契约整目录拒单 `inspectBundle` 的原样,什么内容都没读到 —— 候选是空的 effective(被整拒,不会被应用),版本 = 拒单那一读的契约版本(按文档内容寻址)。 */
+ *  `CONFIG_DOCUMENT_REFUSAL_REASONS`:`empty` / `invalid_json` / `not_object` / `io` / `too_deep` 文件层,`retired_domain` 墓碑)。读腿不抛,交成发现,候选判官以发现自带的词整拒这份候选
+ *  (与域判形失败同一条回落链、同一行拒判);缺席 = 没有。远端腿:wire 上只有墓碑一种,那一键不进 effective、其余域照读、版本照读;本地腿:契约的单读口
+ *  `FileConfigStore.read()` 交 `refused` ⇒ 被拒文档 = 那一读的拒单原样,什么域内容都没装配 —— 候选是空的 effective(被整拒,不会被应用),版本 = 那一读的契约版本(按文档内容寻址)。 */
 /** `unreadKeys`:本地读腿读了那份文件、却结构上不读其中一键(`prompts.json` 的 `workers`)—— 同 `unreadFiles`,不进候选门,调用方一键一行 `config_unread_key`。 */
 export type FetchEffectiveResult = {
     effective: EffectiveConfig;
@@ -152,15 +153,14 @@ export declare class RemoteConfigProvider implements ConfigProvider {
     fetchSkillContent(contentHash: string): Promise<string | undefined>;
 }
 /**
- * LocalConfigProvider — reads the SAME config contract from disk via `FileConfigStore`. `getEffective()`
- * returns the registry `EffectiveConfig` (all domains, defaults filled); `getVersion()` returns a
- * stable change-detector. We map that down to the service-local `EffectiveConfig` shape and surface the
- * version as the etag (so the caller's "skip re-apply if etag unchanged" works locally too).
+ * LocalConfigProvider — reads the SAME config contract from disk via `FileConfigStore`'s one read port `read()`:
+ * either the registry `EffectiveConfig` (all domains, defaults filled) with its content version, or the refusal
+ * list of the documents the file layer refused, with the version of that same read. We map the effective config down
+ * to the service-local `EffectiveConfig` shape and surface the version as the etag (so the caller's "skip re-apply
+ * if etag unchanged" works locally too).
  */
-/** 本地读腿对契约文件店只有一种读法 —— 严读 `getEffective()`。注入缝(测试)按这一形给;容错档位不在这条腿的类型里。 */
-export interface StrictConfigStore {
-    getEffective(): Promise<AgentConfigEffective>;
-}
+/** 本地读腿对契约文件店只有一种读法 —— 单读口 `read()`(一次读整棵 `config.d`,交一个结局)。注入缝(测试)按这一形给;严读 / 容错档位不在这条腿的类型里。 */
+export type LocalConfigReader = Pick<FileConfigStore, "read">;
 export declare class LocalConfigProvider implements ConfigProvider {
     #private;
     readonly kind: "local";
@@ -169,7 +169,7 @@ export declare class LocalConfigProvider implements ConfigProvider {
     /** [ref]b 可观测性:config_loaded 日志要能回答「到底读的哪个目录」——复验实录:只设 LOCAL_DATA_ROOT 时
      *  config.d 静默读不到且 0 模型无告警(CONFIG_LOCAL_DIR 才是本 lane 的选目录旋钮)。 */
     readonly root: string;
-    constructor(root: string, store?: StrictConfigStore, trust?: {
+    constructor(root: string, store?: LocalConfigReader, trust?: {
         readonly declaredOwnerUid: number | undefined;
     });
     fetchEffective(etag: string | undefined): Promise<FetchEffectiveResult>;

package/dist/config-provider.js

@@ -1,7 +1,7 @@
 import { readMcpSourceLabel } from "./mcp-source-label.js";
 import { createHmac, randomBytes } from "node:crypto";
 import { splitFoldedReadWarnings, withDroppedCatalogEntries } from "./web-admin-client/read-warnings.js";
-import { FileConfigStore, inspectBundle } from "@sema-agent/settings-schema/node";
+import { FileConfigStore } from "@sema-agent/settings-schema/node";
 import { assertLocalConfigDirTrusted } from "./config-dir-trust.js";
 import { danglingRefs, emptyEffective, findSkillContent, promptArtifactFor, renderRefIssue, skillContentHash, } from "@sema-agent/settings-schema";
 import { redactSecrets } from "./trace/redact.js";
@@ -78,35 +78,30 @@ export class LocalConfigProvider {
     skillBodyCacheDir = undefined;
     #servedSkills = { skills: [] };
     root;
-    #injectedStore;
+    #store;
     #declaredOwnerUid;
     constructor(root, store, trust = { declaredOwnerUid: undefined }) {
         this.root = root;
-        this.#injectedStore = store;
+        this.#store = store ?? new FileConfigStore(root);
         this.#declaredOwnerUid = trust.declaredOwnerUid;
     }
     async fetchEffective(etag) {
         await assertLocalConfigDirTrusted({ root: this.root, declaredOwnerUid: this.#declaredOwnerUid });
-        const readWarnings = [];
-        const store = this.#injectedStore ??
-            new FileConfigStore(this.root, {
-                onWarning: (w) => {
-                    readWarnings.push(w);
-                },
-            });
-        let eff;
-        try {
-            eff = await store.getEffective();
-        }
-        catch (e) {
-            const inspection = await inspectBundle(this.root);
-            if (inspection.refusals.length === 0)
-                throw e;
-            return refusedRead(inspection.refusals.map(redactRefusedDocument), inspection.version, etag);
-        }
-        const tag = String(eff.version);
+        const read = await this.#store.read();
+        const tag = String(read.kind === "refused" ? read.version : read.effective.version);
         if (etag !== undefined && etag === tag)
             return null;
+        const readWarnings = [...read.warnings];
+        const folded = splitFoldedReadWarnings(readWarnings, "local");
+        const faces = read.kind === "refused" ? refusedFaces(read) : this.#effectiveFaces(read.effective, folded);
+        return {
+            ...faces,
+            etag: tag,
+            readWarnings,
+            ...(folded.unreadFiles.length > 0 ? { unreadFiles: folded.unreadFiles } : {}),
+        };
+    }
+    #effectiveFaces(eff, folded) {
         const refErrors = [];
         const byReferrer = new Map();
         for (const issue of danglingRefs(eff)) {
@@ -116,7 +111,6 @@ export class LocalConfigProvider {
         }
         for (const [domain, rows] of byReferrer)
             refErrors.push({ domain, error: rows.join("; ") });
-        const folded = splitFoldedReadWarnings(readWarnings, "local");
         const parseErrors = folded.domainErrors.map((w) => ({ domain: w.domain, error: redactConfigError(w.error) }));
         const droppedEntries = folded.droppedEntries.map(redactDroppedEntry);
         const errors = [...parseErrors, ...refErrors];
@@ -124,11 +118,8 @@ export class LocalConfigProvider {
         const unreadKeys = localUnreadPromptKeys(eff.prompts);
         return {
             effective: withDroppedCatalogEntries(mapToServiceEffective(eff, eff.version), folded.droppedCatalogEntries),
-            etag: tag,
-            readWarnings,
             ...(errors.length > 0 ? { domainErrors: errors } : {}),
             ...(droppedEntries.length > 0 ? { droppedEntries } : {}),
-            ...(folded.unreadFiles.length > 0 ? { unreadFiles: folded.unreadFiles } : {}),
             ...(unreadKeys.length > 0 ? { unreadKeys } : {}),
         };
     }
@@ -136,15 +127,10 @@ export class LocalConfigProvider {
         return findSkillContent(this.#servedSkills, contentHash);
     }
 }
-function refusedRead(refused, version, etag) {
-    const tag = String(version);
-    if (etag !== undefined && etag === tag)
-        return null;
+function refusedFaces(read) {
     return {
-        effective: mapToServiceEffective({ ...emptyEffective(), version }, version),
-        etag: tag,
-        readWarnings: [],
-        refusedDocuments: refused,
+        effective: mapToServiceEffective({ ...emptyEffective(), version: read.version }, read.version),
+        refusedDocuments: read.refusals.map(redactRefusedDocument),
     };
 }
 function localUnreadPromptKeys(prompts) {

package/dist/config-types.d.ts

@@ -22,7 +22,7 @@ import type { GitApiKind } from "./git-api-kind.js";
 import type { CustomPkgSource } from "./sandbox-pkg-source.js";
 import type { MemoryEngineBackend, StoreBackend as StoreBackendWord } from "@sema-agent/settings-schema/execution-lanes";
 import { DRAIN_GRACE_FLOOR_MS } from "@sema-agent/settings-schema/fleet";
-import type { AtMention } from "@sema-agent/settings-schema";
+import type { AtMention, SandboxGitConfig } from "@sema-agent/settings-schema";
 import type { ModsDeclaration } from "./mods-declaration.js";
 /** [ref]:记忆向量面的 embedder 坐标(env `MEMORY_EMBEDDER_*` 解析结果;单一属主 = 本类型,
  *  `plugins/memory-embedder.ts` 的工厂直接消费它,不复制形状)。语义与三问见
@@ -150,6 +150,17 @@ export declare const FIRST_BYTE_TIMEOUT_BOUNDS: {
     readonly minMs: 0;
     readonly maxMs: 2147483647;
 };
+/**
+ * device 车道的设备入口声明(`DEVICE_RELAY_URL` 的两种合法值;值文法与字面 `none` 归契约包 `deviceRelayFlaws` / `DEVICE_RELAY_NONE`;字段注见 `remoteExec` device 臂的 `relay`):
+ * 中继地址,或字面 `none` = 没有中继、设备拨本引擎自己的地址。「没写」不是第三种值 —— 车道表 device 行的必需键,缺席 / 空白在配置期就被车道必需 env 门拒
+ * (缺席曾被读成直拨,撤声明时把已绑设备困在一个拨不到的入口上)。
+ */
+export type DeviceRelayDeclaration = {
+    readonly kind: "url";
+    readonly url: string;
+} | {
+    readonly kind: "none";
+};
 /**
  * 整数合法域(闭区间)的**一种说法**:device 车道的数值旋钮(`DEVICE_RECONNECT_GRACE_MS` / `DEVICE_MAX_INFLIGHT_PER_DEVICE` /
  * `DEVICE_DELIVERY_TIMEOUT_MS` / `DEVICE_EXEC_TIMEOUT_MS`)、汇聚端创建时对 helloAck 六个数值位的校验、协议文档与配置目录的合法域句,
@@ -722,7 +733,7 @@ export interface ServiceConfigFlat {
      *  引擎却仍可能把别处落进记忆根的字节收进这次会话的账。
      *  ⚠️ **这一层的射程 = file 记忆引擎**(`MEMORY_ENGINE_BACKEND` 未设的默认单机形):受限视图是
      *  `FileMemoryEngineBackend.restrictedAdoptionView` 的实装,而 `engine.materialize` 取它走的是
-     *  `?? this.backend` 的**可选** seam。我方 pg/tidb 两只记忆后端没有实装、也不需要——它们的读侧走库,
+     *  `?? this.backend` 的**可选** seam。我方 pg/mysql 两只记忆后端没有实装、也不需要——它们的读侧走库,
      *  盘上目录只是每任务的投影工作区,没有「读磁盘即收编」这条通道。`false` 在 DB 后端上仍照常买到
      *  披露 / 写门 / 零收编 harvest 三件(引擎级,与后端无关)。
      *
@@ -741,7 +752,7 @@ export interface ServiceConfigFlat {
      *  undefined=纯本地现状零变化)/`MEMORY_SYNC_TOKEN`(Bearer)/`MEMORY_SYNC_SCOPE`(可选,缺省 =
      *  memoryScope 本身**仅当它已是 v2 typed key**;非 typed 键 ⇒ 拒启,[ref] —— 旧 formatUserScope 派生臂铸出的是本部署
      *  从不写的层,见 loadConfig)。半配置 fail-loud
-     *  (memoryEngineBackend 同款姿势);DB backend(pg/tidb)配了这些键=boot throw(中心侧自己就是
+     *  (memoryEngineBackend 同款姿势);DB backend(pg/mysql)配了这些键=boot throw(中心侧自己就是
      *  同步权威,不该再跑 client 腿)。 */
     memorySync?: {
         url: string;
@@ -750,6 +761,10 @@ export interface ServiceConfigFlat {
         maxPushEntries?: number;
         maxPullEntries?: number;
     };
+    /** [ref] R2:中心(DB 记忆平面)声明的**同步身份** —— 客户端用来到达本中心同步口的基址(env `MEMORY_SYNC_SERVE_IDENTITY`)。
+     *  一处声明、三个读者:能力面 `memorySyncServe.identity` 逐字公开;中心入站 `POST /v1/memory/sync/:scope` 的 `peer` 按串与它比(不等 ⇒ 409,零写);
+     *  缺席 ⇒ 本中心不服务同步(501 `feature.memory_sync_serve_disabled`)。必须已是规范形(铸点 `memory-sync-identity.ts`),否则拒启 —— 无条件解析。 */
+    memorySyncServeIdentity?: string;
     /** [ref](黑板 [ref]/[ref] 两裁):记忆检索的**向量面**接线 —— OpenAI 兼容 `/embeddings` 端点。
      *  env 四键(+ 可选 key):`MEMORY_EMBEDDER_ENDPOINT` / `MEMORY_EMBEDDER_MODEL` / `MEMORY_EMBEDDER_DIM`
      *  (+ `MEMORY_EMBEDDER_TIMEOUT_MS` / `MEMORY_EMBEDDER_API_KEY`)。三问:
@@ -766,7 +781,7 @@ export interface ServiceConfigFlat {
      *     不匹配的行只是悄悄退回词面档),只会让「向量面开着」这句话变成谎。所以坏 DIM(非正整数)在
      *     boot 期拒;运行期真维度不符(模型换了 / 端点指错)由 embedder 自己抛,绝不截断补零。
      *
-     *  ⚠️ 后端门:只有 `MEMORY_ENGINE_BACKEND=pg` 收这几键 —— tidb 记忆后端 v1 无向量档(传 embedder
+     *  ⚠️ 后端门:只有 `MEMORY_ENGINE_BACKEND=pg` 收这几键 —— mysql 记忆后端 v1 无向量档(传 embedder
      *  它自己就 fail-loud 拒),file 引擎压根没有 embedder 接缝。配错后端 = 拒启点名。 */
     memoryEmbedder?: MemoryEmbedderConfig;
     /** [ref] 件A(clay 三裁 [ref]):org 记忆准入模式。`enforce`(默认)=判决即结果;`audit`=判决
@@ -917,6 +932,13 @@ export interface ServiceConfigFlat {
      * ([ref] 起诊断面**有了** `executionLane` 段,但它就是能力面那一只投影 `{provider, toolsOnThisHost, isolated?}`,**不带**本键。)
      */
     requireExecutionLane: boolean;
+    /**
+     * 沙箱 git 平面的有效配置块(本部署经凭据代理路由哪些 git origin;契约 `SandboxGitConfig`:规范形 origin ≤ 16、两两不同、`connectUrl` 必 https、空表合法)。
+     * **唯一来源 = 中心有效配置**(`/effective` 的 `sandboxGit`,web-admin 按部署登记册投影;无 env 旋钮,本地配置源没有这一块);唯一判官 = `stageEffective`
+     * 的那一次 `SandboxGitConfig.safeParse`,`commitStaged` 整只重赋值 —— 缺席或判不过 ⇒ 键**删**(不写 undefined;判不过 = 当作没有任何 origin,契约 §12.8)。
+     * 热:读者(平面座 `sandbox-git-plane.ts` 的每一次读)逐次现读这一键,不捕获对象本身。缺席 = 没有这一块(与契约「可选、无默认」同一种缺席读法,不另设 null)。
+     */
+    sandboxGit?: SandboxGitConfig;
     remoteExec?: {
         provider: "e2b";
         apiKey: string;
@@ -1027,11 +1049,14 @@ export interface ServiceConfigFlat {
          *  域 = `[1, 86400]` 的十进制正整数,坏值**拒启**([ref] A 档;解析器 `parseDeviceEnrollTokenTtlEnv`)。
          *  缺席 ⇒ 签发点的属主默认 900(不在 config 层抄第二份默认,与本族其余旋钮同姿势)。 */
         enrollTokenTtlSec?: number;
-        /** `DEVICE_RELAY_URL` = 设备的**直达入口**:设备连不到本引擎自己的地址(引擎在中继 / 网关之后)时该拨的那一个 ws(s) URL,运维声明、**逐字**上能力面
-         *  `deviceExecutor.relayUrl`(唯一消费点 `http/routes/capabilities.ts`)。缺席 ⇒ 键缺席 = 设备按本引擎地址 + `deviceExecutor.wsPath` 拨号(既有形)。
+        /** `DEVICE_RELAY_URL` = 设备入口的运维声明,**必填**(缺席 / 空串 / 只含空白 ⇒ 配置期拒起:契约包车道表 device 行的必需键,同所有车道的必需键判官 `laneMissingEnv`;值的文法与凭据形由解析器 `parseDeviceRelayUrlEnv` 拒):
+         *  `{ kind: "url" }` = 设备连不到本引擎自己的地址(引擎在中继 / 网关之后)时该拨的那一个 ws(s) URL,**逐字**上能力面 `deviceExecutor.relayUrl`
+         *  (唯一消费点 `http/routes/capabilities.ts`);`{ kind: "none" }`(字面 `none`)= 没有中继,设备按本引擎地址 + `deviceExecutor.wsPath` 拨号,能力面不带 `relayUrl`。
+         *  必填的理由:「设备拨哪里」只有运维知道;缺席曾被读成「直拨」,于是撤掉中继声明而根会话行上还有设备绑定时,设备改拨引擎地址(入口已收窄则拨不到)、
+         *  绑定却留在格上 —— 缺席与「声明了直拨」是两件事,只有后者放行。`none` ∧ 有绑定 ⇒ 起服 warn 点名绑定数(`boot/device-lane.ts`)。
          *  **不派生**:`FLEET_ADVERTISE_ADDRESS` 是对中心公告的地址(内网 pod IP / 容器别名),受众不是用户机器上的设备;从它拼出来的入口对设备多半不可达。
-         *  形门 = ws / wss 绝对地址,无 userinfo / query / fragment、不带凭据形(值逐字上能力面),坏值**拒启**(解析器 `parseDeviceRelayUrlEnv`)。 */
-        relayUrl?: string;
+         *  URL 形门 = ws / wss 绝对地址,无 userinfo / query / fragment、不带凭据形(值逐字上能力面),坏值**拒启**。 */
+        relay: DeviceRelayDeclaration;
         /** `DEVICE_SUPERSEDE`(默认 `stale_only`)= 同 deviceId 二连的顶替策略(§5.2)。 */
         supersede?: "stale_only" | "deny";
     } | {
@@ -2127,6 +2152,10 @@ export interface ServiceConfigFlat {
      *  本仓七车道的块今天都不守地板 ⇒ 设 true 的部署上带手 run 一律拒起(起服 warn `read_deny_floor_required_unkept` 先说)。
      *  **仅 deployment 席**:TaskSpec 上没有同名键,任务无法放宽自己的部署。 */
     readDenyFloorRequired: boolean;
+    /** `SANDBOX_READ_FLOOR`(闭集 `keep | off`,缺省 `keep`;闭集 / 缺省 / 派生的属主 `execution-lane-caps.ts`):沙箱三车道(e2b / k8s / local-docker)守不守读拒表的
+     *  字节地板 = 沙箱读地板模块服务这条车道 ∧ 本键不是 `off`。车道块 `keepsReadFloor`(`capabilitiesFor`)与适配器手里的模块同读这一只判据;别的车道上本键无作用
+     *  (那些环境约束不了进程,恒不守)。部署级一键、不挂车道臂:`config.d/remote-exec.json` 换出的车道同样读它。 */
+    sandboxReadFloor: import("./execution-lane-caps.js").SandboxReadFloorKnob;
     /** core 7.46.0 [ref]:部署**声明**的配置根(`SEMA_CONFIG_DIR`,绝对路径;起服的供给动作建出目录,能不能用由引擎判)—— 交引擎 `RunnerDeps.agentConfigDir`
      *  与守卫集 `createSensitivePathPolicy` 的同名入参:内建读拒表里以 `.sema` 开头的行在这个根下同样拒,写进根下要问一次。缺席 = 没声明
      *  ⇒ 引擎读字面 `~/.sema`(与 LKG / skill 缓存 / scheduler 店的缺省落点同一处)。读法单一属主 `sema-config-dir.ts`。 */
@@ -2301,7 +2330,7 @@ export type ServiceModelPlaneConfig = Pick<ServiceConfigFlat, "gatewayBaseUrl" |
  *  就是本组的门状态,故进组;`parseApprovalDomain` 的返回类型相应是 `Omit<…, "directDoorActive">`。 */
 export type ServiceApprovalConfig = Pick<ServiceConfigFlat, "approvalRequire" | "approvalDeny" | "approvalTimeoutSec" | "approvalAskRetentionMs" | "approvalAutoBudget" | "approvalNeverAuto" | "approvalGrant" | "approvalHmacKeys" | "durableApproval" | "durableApprovalSource" | "streamAskWindowMsSource" | "directApprovalDoor" | "directDoorActive" | "resourceSuspend" | "resourceSuspendTtlSec" | "resourceSuspendTotalTokens" | "resourceSuspendTotalBudgetUsd" | "resourceSuspendMaxSlices" | "askQuestionEnabled" | "questionThrottle" | "toolApprovalEnabled" | "permissionRulesEnabled" | "permissionRulesEnabledExplicit" | "streamAskWindowMarginMs" | "streamApproval" | "unattendedApprovalPolicy" | "mcpElicitation" | "sensitiveWritePatterns" | "writeProtectedPaths" | "manualModeShellGate" | "permissionsDisableAutoMode" | "autoModeClassifierFallback" | "autoModeClassifierTimeoutMs" | "crossSessionInbound" | "crossSessionDialogExpiry" | "principalInboxAssistant">;
 /** 组:memory(记忆面 + TOC 同步腿)。 */
-export type ServiceMemoryConfig = Pick<ServiceConfigFlat, "memoryEngineEnabled" | "memoryEngineDir" | "memoryEngineRemoteLaneAllowed" | "memoryEngineBackend" | "memoryScope" | "memoryPersistenceCapable" | "memorySync" | "memoryEmbedder" | "memoryOrgAdmissionMode" | "memoryDelegationEvidence" | "memoryProvenance" | "memoryCapturePolicy" | "memoryConsolidationDriver" | "memoryOrgDirectoryJson" | "memoryOrgGrantTtlMs" | "memoryOrgUnavailableBackoffMs" | "projectMemoryEnabled" | "syncImportLeaseStaleSec">;
+export type ServiceMemoryConfig = Pick<ServiceConfigFlat, "memoryEngineEnabled" | "memoryEngineDir" | "memoryEngineRemoteLaneAllowed" | "memoryEngineBackend" | "memoryScope" | "memoryPersistenceCapable" | "memorySync" | "memorySyncServeIdentity" | "memoryEmbedder" | "memoryOrgAdmissionMode" | "memoryDelegationEvidence" | "memoryProvenance" | "memoryCapturePolicy" | "memoryConsolidationDriver" | "memoryOrgDirectoryJson" | "memoryOrgGrantTtlMs" | "memoryOrgUnavailableBackoffMs" | "projectMemoryEnabled" | "syncImportLeaseStaleSec">;
 /** 组:auth(鉴权 / 身份 / 治理棒)。`commandPolicy` 只有 web-admin 腿(无 env 标量形),故 env 解析
  *  函数不产出它,但它与 `autonomy` 是同一根治理棒的两半,归本组。
  *  [ref] 的三件部署治理声明(`compliancePosture`/`lockedConfigKeys`/`retentionPolicy`)同归本组:
@@ -2310,7 +2339,7 @@ export type ServiceMemoryConfig = Pick<ServiceConfigFlat, "memoryEngineEnabled"
  *  config 这一层它只是一句声明。 */
 export type ServiceAuthConfig = Pick<ServiceConfigFlat, "authToken" | "authTokens" | "allowUnauthedWrites" | "corsOrigins" | "principalHeader" | "requirePrincipal" | "autonomy" | "commandPolicy" | "compliancePosture" | "lockedConfigKeys" | "configCatalogEnabled" | "retentionPolicy" | "retentionSweep" | "operatorPrincipals" | "operatorSingleUser" | "principalJwtPubkeys" | "principalJwtIss" | "principalJwtAud" | "authBridgeIssuer" | "principalJwtMaxTtlSec" | "bindHost" | "bindHostSource">;
 /** 组:orchestration(编排 + 执行车道 + 沙箱面 + workflow/后台 agent 存留)。 */
-export type ServiceOrchestrationConfig = Pick<ServiceConfigFlat, "remoteExec" | "remoteExecHomeDir" | "requireExecutionLane" | "worktreeIsolation" | "leaderEnabled" | "leaderFanoutEnabled" | "routerEnabled" | "selfOrchestrationEnabled" | "selfOrchestrationModels" | "selfOrchestrationWorkerIsolation" | "forkEnabled" | "experimentalObserverAgents" | "schedulerEnabled" | "schedulerSessionWakeup" | "schedulerSessionLifetime" | "schedulerStorePath" | "planModeEnabled" | "hooksTimeoutMs" | "workflowRunStoreBackend" | "workflowOrphanGraceMs" | "workflowJournalRetentionMs" | "workflowRunRetentionMs" | "usageWindows" | "workflowAgentsReadOnly" | "workflowSizeGuideline" | "backgroundAgentRetentionMs" | "backgroundAgentStaleRunningMs" | "backgroundAgentParkClaimStaleMs" | "delegationEntryCaps" | "rosterRetentionMs" | "leaderRunStaleMs" | "scratchpadSweepTtlMs" | "sandboxPkgSource" | "sandboxPkgSourceCustom" | "sessionAutoTitle" | "sessionAutoTitleSource" | "selectEnvironmentTool" | "envFactsEnabled" | "toolDeferLongtail" | "lspEnabled" | "lspHostEnabled" | "lspEnvAllow" | "imageBakes" | "readFace" | "readFaceSource" | "taskWriteFaceEscalation" | "readDenyPatterns" | "readDenyBuiltinTiers" | "readDenyBuiltinExclude" | "readDenyFloorRequired" | "agentConfigDir" | "configLkgPath" | "configLkgEnabled">;
+export type ServiceOrchestrationConfig = Pick<ServiceConfigFlat, "sandboxGit" | "remoteExec" | "remoteExecHomeDir" | "requireExecutionLane" | "worktreeIsolation" | "leaderEnabled" | "leaderFanoutEnabled" | "routerEnabled" | "selfOrchestrationEnabled" | "selfOrchestrationModels" | "selfOrchestrationWorkerIsolation" | "forkEnabled" | "experimentalObserverAgents" | "schedulerEnabled" | "schedulerSessionWakeup" | "schedulerSessionLifetime" | "schedulerStorePath" | "planModeEnabled" | "hooksTimeoutMs" | "workflowRunStoreBackend" | "workflowOrphanGraceMs" | "workflowJournalRetentionMs" | "workflowRunRetentionMs" | "usageWindows" | "workflowAgentsReadOnly" | "workflowSizeGuideline" | "backgroundAgentRetentionMs" | "backgroundAgentStaleRunningMs" | "backgroundAgentParkClaimStaleMs" | "delegationEntryCaps" | "rosterRetentionMs" | "leaderRunStaleMs" | "scratchpadSweepTtlMs" | "sandboxPkgSource" | "sandboxPkgSourceCustom" | "sessionAutoTitle" | "sessionAutoTitleSource" | "selectEnvironmentTool" | "envFactsEnabled" | "toolDeferLongtail" | "lspEnabled" | "lspHostEnabled" | "lspEnvAllow" | "imageBakes" | "readFace" | "readFaceSource" | "taskWriteFaceEscalation" | "readDenyPatterns" | "readDenyBuiltinTiers" | "readDenyBuiltinExclude" | "readDenyFloorRequired" | "sandboxReadFloor" | "agentConfigDir" | "configLkgPath" | "configLkgEnabled">;
 /** 组:limitsHttp(HTTP 面 + 各类上限/配额/回收窗)。 */
 export type ServiceLimitsHttpConfig = Pick<ServiceConfigFlat, "port" | "attachmentOrphanGraceMs" | "workspaceFileMaxBytes" | "attachmentMaxBytes" | "attachmentMimeAllowlist" | "attachmentUnboundTtlMs" | "infraCostRates" | "drainGraceMs" | "drainSecondSignalMinGapMs" | "sighupIdleGraceMs" | "parentPid" | "engineAutoExit" | "engineLingerMs" | "engineOrphanLingerMs" | "rateLimitPerMin" | "maxTaskCostUsd" | "maxTaskTokens" | "maxPrincipalCostUsd" | "costQuotaWindowSec" | "reapIntervalSec" | "runStaleSec" | "toolResultTtlSec">;
 /** 组:observability(可观测)。 */

package/dist/config.d.ts

@@ -422,6 +422,12 @@ export declare const FLEET_ENV_REFUSAL_CODES: {
     readonly member_unfenced: "config.fleet_member_unfenced";
 };
 export type FleetEnvRefusalCode = (typeof FLEET_ENV_REFUSAL_CODES)[keyof typeof FLEET_ENV_REFUSAL_CODES];
+/**
+ * `MEMORY_SYNC_SERVE_IDENTITY`(中心声明的同步身份)的**唯一**解析口。**无条件解析**(运维旋钮律,同 `FLEET_ADVERTISE_ADDRESS`):未设 / 空串 ⇒ 缺席;
+ * 设了就必须**已是**同步身份的规范形(铸点 `memory-sync-identity.ts` 的「声明的身份」座位)—— 运维写下的就是能力面公开的、中心入站按串比的那一串,
+ * 没有第二种拼法 ⇒ 不是规范形就拒启并给出规范形(不静默规范化);带凭据 / 查询 / 片段 / 非 http(s) / 超宽同样拒启,拒句不引路径与凭据。
+ */
+export declare function parseMemorySyncServeIdentity(raw: string | undefined): string | undefined;
 /** 一只 fleet 成员的围栏车道:续租打的中心端点(车道对象原样,含活性基址)+ 代际。 */
 export interface FleetFenceLane {
     readonly center: CenterEndpoint & {