@sema-agent/server 7.142.0 → 7.143.0

package/dist/config-dir-trust.js

@@ -1,5 +1,6 @@
 import { lstat, readFile, readdir, readlink, realpath, stat } from "node:fs/promises";
 import path from "node:path";
+import { CONFIG_ROOT_DOCUMENTS } from "@sema-agent/settings-schema";
 import { LOCAL_READER_DOCUMENTS } from "./config-d-migration.js";
 import { recordFailOpen } from "./observability/fail-open.js";
 import { HOST_PLATFORM } from "./plugins/host-platform.js";
@@ -244,35 +245,44 @@ async function confirmUnreached(lexical) {
     return { kind: "unresolvable", path: lexical };
 }
 const documentFiles = () => LOCAL_READER_DOCUMENTS.map((d) => `${d}.json`);
-async function reachDir(lexical, ctx) {
+const rootDocumentFiles = () => CONFIG_ROOT_DOCUMENTS.map((d) => `${d}.json`);
+async function reach(lexical, want, ctx) {
     const top = await lstatStep("/");
     if (!isStats(top))
         return "finding" in top ? top.finding : undefined;
     const rootVerdict = await judgeComponent("/", top, ctx);
     if (typeof rootVerdict !== "string")
         return rootVerdict;
-    const step = await walk({ start: "/", stats: top, open: rootVerdict === "open", hops: 0 }, lexical.split("/"), "dir", ctx);
+    const step = await walk({ start: "/", stats: top, open: rootVerdict === "open", hops: 0 }, lexical.split("/"), want, ctx);
     if ("finding" in step)
         return step.finding;
     return step.reached ? step : confirmUnreached(lexical);
 }
-async function judgePosix(configDir, ctx) {
-    const dir = await reachDir(configDir, ctx);
-    if (dir === undefined || "kind" in dir)
-        return dir;
-    for (const file of documentFiles()) {
-        const doc = await walk({ start: dir.physical, stats: dir.stats, open: dir.open, hops: dir.hops }, [file], "file", ctx);
+async function judgeDocumentsIn(at, lexical, files, ctx) {
+    for (const file of files) {
+        const doc = await walk({ start: at.physical, stats: at.stats, open: at.open, hops: at.hops }, [file], "file", ctx);
         if ("finding" in doc)
             return doc.finding;
         if (!doc.reached) {
-            const unseen = await confirmUnreached(path.join(configDir, file));
+            const unseen = await confirmUnreached(path.join(lexical, file));
             if (unseen !== undefined)
                 return unseen;
         }
     }
     return undefined;
 }
-async function judgeWin32(configDir) {
+async function judgePosix(root, configDir, ctx) {
+    for (const file of rootDocumentFiles()) {
+        const doc = await reach(path.join(root, file), "file", ctx);
+        if (doc !== undefined && "kind" in doc)
+            return doc;
+    }
+    const dir = await reach(configDir, "dir", ctx);
+    if (dir === undefined || "kind" in dir)
+        return dir;
+    return judgeDocumentsIn(dir, configDir, documentFiles(), ctx);
+}
+async function judgeWin32(root, configDir) {
     const resolveStep = async (p) => {
         try {
             return await realpath(p);
@@ -286,26 +296,44 @@ async function judgeWin32(configDir) {
             return { kind: "unreadable", path: p, errno: code ?? String(e) };
         }
     };
-    const dir = await resolveStep(configDir);
-    if (dir === undefined)
+    const judgeDocs = async (dir, files) => {
+        let present = 0;
+        for (const file of files) {
+            const doc = await resolveStep(path.join(dir, file));
+            if (doc === undefined)
+                continue;
+            if (typeof doc !== "string")
+                return doc;
+            const st = await stat(doc);
+            if (!st.isFile())
+                return { kind: "not-regular", path: doc, type: typeOf(st) };
+            if (st.size > CONFIG_DOCUMENT_MAX_BYTES)
+                return { kind: "too-large", path: doc, bytes: st.size };
+            present += 1;
+        }
+        return present;
+    };
+    const rootAt = await resolveStep(root);
+    if (rootAt === undefined)
         return undefined;
-    if (typeof dir !== "string")
-        return dir;
-    if (!(await stat(dir)).isDirectory())
+    if (typeof rootAt !== "string")
+        return rootAt;
+    if (!(await stat(rootAt)).isDirectory())
         return undefined;
-    for (const file of documentFiles()) {
-        const doc = await resolveStep(path.join(dir, file));
-        if (doc === undefined)
-            continue;
-        if (typeof doc !== "string")
-            return doc;
-        const st = await stat(doc);
-        if (!st.isFile())
-            return { kind: "not-regular", path: doc, type: typeOf(st) };
-        if (st.size > CONFIG_DOCUMENT_MAX_BYTES)
-            return { kind: "too-large", path: doc, bytes: st.size };
+    const rootDocs = await judgeDocs(rootAt, rootDocumentFiles());
+    if (typeof rootDocs !== "number")
+        return rootDocs;
+    const dir = await resolveStep(path.join(rootAt, path.basename(configDir)));
+    if (dir !== undefined && typeof dir !== "string")
+        return dir;
+    const dirIsDir = dir !== undefined && (await stat(dir)).isDirectory();
+    if (dirIsDir) {
+        const docs = await judgeDocs(dir, documentFiles());
+        if (typeof docs !== "number")
+            return docs;
     }
-    recordFailOpen(WIN32_UNVERIFIED_TAG, `config.d=${dir}`);
+    if (dirIsDir || rootDocs > 0)
+        recordFailOpen(WIN32_UNVERIFIED_TAG, dirIsDir ? `config.d=${dir}` : `config root=${rootAt}`);
     return undefined;
 }
 export function localConfigDirOf(root) {
@@ -314,14 +342,15 @@ export function localConfigDirOf(root) {
 export async function judgeLocalConfigDir(input) {
     const host = input.host ?? processHost();
     const configDir = localConfigDirOf(input.root);
+    const root = path.dirname(configDir);
     if (host.platform === "win32")
-        return judgeWin32(configDir);
+        return judgeWin32(root, configDir);
     const owners = new Set([0]);
     if (host.euid !== undefined)
         owners.add(host.euid);
     if (input.declaredOwnerUid !== undefined)
         owners.add(input.declaredOwnerUid);
-    return judgePosix(configDir, { owners, mountinfo: host.mountinfo ?? processMountinfo });
+    return judgePosix(root, configDir, { owners, mountinfo: host.mountinfo ?? processMountinfo });
 }
 const octal = (mode) => `0${(mode & 0o7777).toString(8).padStart(3, "0")}`;
 export function buildConfigDirUntrustedSentence(f, ctx) {

package/dist/config-invariants.d.ts

@@ -26,6 +26,7 @@
  * 不引 config.ts,故 config.ts / runs.ts 都可以安全引它。
  */
 import type { ConfigProviderWord, ServiceConfigFlat } from "./config-types.js";
+import { type EnvTableReplacementInput } from "./env-model-table-gate.js";
 /**
  * 活体心跳周期(ms)——`runs.ts` 的 `HEARTBEAT_MS` 就是它(那边 re-export,单源在此)。
  *
@@ -34,7 +35,7 @@ import type { ConfigProviderWord, ServiceConfigFlat } from "./config-types.js";
  */
 export declare const LIVENESS_HEARTBEAT_MS = 30000;
 /** 闭集:新增一条不变量必须在这里加词(拼错 = 编译红,而不是运行期悄悄不判)。 */
-export type CrossInvariantId = "run-stale-heartbeat" | "bind-posture" | "bake-runner-credential" | "direct-door-anchors" | "operator-principals-required" | "operator-single-user" | "bake-operator-principals" | "sensitive-write-patterns" | "leader-host-lane" | "multi-tenant-shared-lane" | "leader-durable-store" | "device-durable-store" | "device-durable-approval" | "model-provider-word" | "gateway-url-userinfo" | "anthropic-credential-exclusive" | "model-route-endpoint" | "default-model-resolvable" | "refused-names-not-minted" | "require-execution-lane" | "center-one-identity" | "workflow-park-decision-domain" | "remote-config-provider-url" | "retention-lane-complete";
+export type CrossInvariantId = "run-stale-heartbeat" | "bind-posture" | "bake-runner-credential" | "direct-door-anchors" | "operator-principals-required" | "operator-single-user" | "bake-operator-principals" | "sensitive-write-patterns" | "leader-host-lane" | "multi-tenant-shared-lane" | "leader-durable-store" | "device-durable-store" | "device-durable-approval" | "model-provider-word" | "gateway-url-userinfo" | "anthropic-credential-exclusive" | "model-route-endpoint" | "default-model-resolvable" | "refused-names-not-minted" | "env-table-replacement-acknowledged" | "require-execution-lane" | "center-one-identity" | "workflow-park-decision-domain" | "remote-config-provider-url" | "retention-lane-complete";
 /** 表读的键集(取自平铺配置型 ⇒ 键名/类型永不与真配置漂)。 */
 export type CrossInvariantView = Readonly<Pick<ServiceConfigFlat, "runStaleSec" | "authToken" | "authTokens" | "allowUnauthedWrites" | "imageBakes" | "directApprovalDoor" | "durableApproval" | "approvalHmacKeys" | "principalJwtPubkeys" | "principalJwtIss" | "principalJwtAud" | "requirePrincipal" | "operatorPrincipals" | "operatorSingleUser" | "sensitiveWritePatterns" | "leaderEnabled" | "selfOrchestrationEnabled" | "workflowRunStoreBackend" | "remoteExec" | "requireExecutionLane" | "dbBackend" | "tidb" | "pg" | "envModel" | "gatewayBaseUrl" | "gatewayFallbackUrls" | "anthropic" | "models" | "modelRefusals" | "tiers" | "authBridgeIssuer" | "webAdmin" | "configProvider" | "retentionPolicy" | "retentionSweep">>;
 export interface CrossInvariantInput {
@@ -42,6 +43,11 @@ export interface CrossInvariantInput {
     readonly live: CrossInvariantView;
     /** 候选(stage 期 = 现役 + 本批 staged 赋值)。 */
     readonly next: CrossInvariantView;
+    /**
+     * 一份**模型面候选**随身带的、不在配置键里的事实(它从哪条配置腿来、本地腿上配置根的 env 模型表决定在同一拍读作什么、引擎铸的 env 表)——
+     * 只有模型面 stage 带(它是装模型表的唯一写口);全表扫描(限额批的候选视图)不装模型表、不带。读它的不变量:`env-table-replacement-acknowledged`。
+     */
+    readonly candidate?: EnvTableReplacementInput;
 }
 export interface CrossInvariant {
     readonly id: CrossInvariantId;

package/dist/config-invariants.js

@@ -4,6 +4,7 @@ import { modelRouteUrlRefusal } from "./model-route-url.js";
 import { anthropicCredentialRefusal } from "./model-route-gap.js";
 import { modelRouteEndpointRefusal } from "./model-route-endpoint.js";
 import { defaultModelRefusal, refusedNameMintedRefusal } from "./model-entry-refusal.js";
+import { judgeEnvTableReplacement } from "./env-model-table-gate.js";
 import { WEB_ADMIN_ENV, httpUrlFlaws } from "@sema-agent/settings-schema";
 import { authBridgeIssuerOf } from "./auth-bridge.js";
 import { buildDisplaySafeUrl } from "./trace/redact.js";
@@ -318,6 +319,12 @@ export const CONFIG_CROSS_INVARIANTS = [
         bootAnchor: { file: "src/boot/stage-02-web-admin-pull.ts", marker: "CROSS-INVARIANT:refused-names-not-minted" },
         check: ({ live, next }) => (next.models === live.models ? undefined : refusedNameMintedRefusal(next)),
     },
+    {
+        id: "env-table-replacement-acknowledged",
+        keys: ["models"],
+        restartReason: "env-model-table",
+        check: ({ candidate }) => (candidate === undefined ? undefined : judgeEnvTableReplacement(candidate)?.reason),
+    },
     {
         id: "center-one-identity",
         keys: ["authBridgeIssuer", "webAdmin"],

package/dist/config-provider.d.ts

@@ -1,5 +1,7 @@
 import { type DroppedConfigEntry, type UnreadConfigFile, type UnreadConfigKey } from "./web-admin-client/read-warnings.js";
 import { FileConfigStore } from "@sema-agent/settings-schema/node";
+import { type EnvModelsDecision } from "@sema-agent/settings-schema";
+import { type CatalogSource } from "./env-model-table-gate.js";
 import { type ConfigDocumentRefusal, type EffectiveConfig as AgentConfigEffective, type EffectiveReadWarning } from "@sema-agent/settings-schema";
 import { fetchEffective as remoteFetchEffective, fetchSkillContent as remoteFetchSkillContent, type EffectiveConfig } from "./web-admin-client/facade.js";
 import type { CenterEndpoint } from "./web-admin-client/center-request.js";
@@ -28,6 +30,8 @@ import type { ConfigProviderWord } from "./config-types.js";
  *  (与域判形失败同一条回落链、同一行拒判);缺席 = 没有。远端腿:wire 上只有墓碑一种,那一键不进 effective、其余域照读、版本照读;本地腿:契约的单读口
  *  `FileConfigStore.read()` 交 `refused` ⇒ 被拒文档 = 那一读的拒单原样,什么域内容都没装配 —— 候选是空的 effective(被整拒,不会被应用),版本 = 那一读的契约版本(按文档内容寻址)。 */
 /** `unreadKeys`:本地读腿读了那份文件、却结构上不读其中一键(`prompts.json` 的 `workers`)—— 同 `unreadFiles`,不进候选门,调用方一键一行 `config_unread_key`。 */
+/** `catalogSource`:这份候选**从哪条配置腿来**(必填;`env-model-table-gate.ts`)—— 本地腿另带配置根上 env 模型表决定在**同一拍**的读数(契约的唯一读者
+ *  `readEnvModelsDecision`;本地 etag 并入同一份读数的身份)。调用方原样交给 `applyEffective` / `logEffectiveDiff`,模型面 stage 的本地腿确认闸只读它。 */
 export type FetchEffectiveResult = {
     effective: EffectiveConfig;
     etag?: string;
@@ -41,6 +45,7 @@ export type FetchEffectiveResult = {
     refusedDocuments?: ConfigDocumentRefusal[];
     readWarnings: readonly EffectiveReadWarning[];
     credentialIdentity?: string;
+    catalogSource: CatalogSource;
 } | null;
 /**
  * 引号段 = **一条规则**:先过 `redactSecrets`;文本里没有引号字符(`"` / `'`)⇒ 原样返回;有 ⇒ 从**第一个**引号到**最后一个**引号(含两端,
@@ -161,6 +166,11 @@ export declare class RemoteConfigProvider implements ConfigProvider {
  */
 /** 本地读腿对契约文件店只有一种读法 —— 单读口 `read()`(一次读整棵 `config.d`,交一个结局)。注入缝(测试)按这一形给;严读 / 容错档位不在这条腿的类型里。 */
 export type LocalConfigReader = Pick<FileConfigStore, "read">;
+/**
+ * 本地配置源的 etag(纯字符串,唯一拼法):契约文件店的内容版本 ⊕ 配置根上决定读数的身份(`envModelsDecisionTag`:`absent` / `d:<digest>` / `io:<errno>`)。
+ * 只改决定、不改目录 ⇒ etag 也变(下一拍重判);运行记录不进 etag(只在起服读)。
+ */
+export declare function buildLocalConfigEtag(version: number, envModels: EnvModelsDecision): string;
 export declare class LocalConfigProvider implements ConfigProvider {
     #private;
     readonly kind: "local";

package/dist/config-provider.js

@@ -1,7 +1,9 @@
 import { readMcpSourceLabel } from "./mcp-source-label.js";
 import { createHmac, randomBytes } from "node:crypto";
 import { splitFoldedReadWarnings, withDroppedCatalogEntries } from "./web-admin-client/read-warnings.js";
-import { FileConfigStore } from "@sema-agent/settings-schema/node";
+import { FileConfigStore, readEnvModelsDecision } from "@sema-agent/settings-schema/node";
+import { envModelsDecisionTag } from "@sema-agent/settings-schema";
+import { REMOTE_CATALOG_SOURCE } from "./env-model-table-gate.js";
 import { assertLocalConfigDirTrusted } from "./config-dir-trust.js";
 import { danglingRefs, emptyEffective, findSkillContent, promptArtifactFor, renderRefIssue, skillContentHash, } from "@sema-agent/settings-schema";
 import { redactSecrets } from "./trace/redact.js";
@@ -52,10 +54,13 @@ export class RemoteConfigProvider {
     async fetchEffective(etag) {
         const fn = this.deps.fetchEffective ?? remoteFetchEffective;
         const r = await fn(this.cc, etag, undefined, this.cc.worker);
-        if (r === null || (r.domainErrors === undefined && r.droppedEntries === undefined && r.refusedDocuments === undefined))
-            return r;
+        if (r === null)
+            return null;
+        if (r.domainErrors === undefined && r.droppedEntries === undefined && r.refusedDocuments === undefined)
+            return { ...r, catalogSource: REMOTE_CATALOG_SOURCE };
         return {
             ...r,
+            catalogSource: REMOTE_CATALOG_SOURCE,
             ...(r.domainErrors !== undefined ? { domainErrors: r.domainErrors.map((de) => ({ domain: de.domain, error: redactConfigError(de.error) })) } : {}),
             ...(r.droppedEntries !== undefined ? { droppedEntries: r.droppedEntries.map(redactDroppedEntry) } : {}),
             ...(r.refusedDocuments !== undefined ? { refusedDocuments: r.refusedDocuments.map(redactRefusedDocument) } : {}),
@@ -73,6 +78,9 @@ export class RemoteConfigProvider {
         }
     }
 }
+export function buildLocalConfigEtag(version, envModels) {
+    return `${String(version)}+${envModelsDecisionTag(envModels)}`;
+}
 export class LocalConfigProvider {
     kind = "local";
     skillBodyCacheDir = undefined;
@@ -88,7 +96,9 @@ export class LocalConfigProvider {
     async fetchEffective(etag) {
         await assertLocalConfigDirTrusted({ root: this.root, declaredOwnerUid: this.#declaredOwnerUid });
         const read = await this.#store.read();
-        const tag = String(read.kind === "refused" ? read.version : read.effective.version);
+        const envModels = await readEnvModelsDecision(this.root);
+        const catalogSource = { kind: "local", root: this.root, envModels };
+        const tag = buildLocalConfigEtag(read.kind === "refused" ? read.version : read.effective.version, envModels);
         if (etag !== undefined && etag === tag)
             return null;
         const readWarnings = [...read.warnings];
@@ -98,6 +108,7 @@ export class LocalConfigProvider {
             ...faces,
             etag: tag,
             readWarnings,
+            catalogSource,
             ...(folded.unreadFiles.length > 0 ? { unreadFiles: folded.unreadFiles } : {}),
         };
     }

package/dist/config-root-migration.d.ts

@@ -0,0 +1,13 @@
+import { type EnvModelsMigration } from "@sema-agent/settings-schema/node";
+import type { ConfigDirMigrationLog } from "./config-d-migration.js";
+/** 一次起服的输入:配置根、目标引擎的 env(契约只读两槽、只用来点名被顶替的 env 模型)、env 表是不是占位(严格名册布防 —— 与模型面闸同一只谓词)。 */
+export interface EnvModelsMigrationInput {
+    readonly root: string;
+    readonly env: Readonly<Record<string, string | undefined>>;
+    readonly envTableIsPlaceholder: boolean;
+}
+/** 契约的迁移体调一次(本仓不改写它的判序,只调度)。 */
+export declare function runEnvModelsMigration(input: EnvModelsMigrationInput): Promise<EnvModelsMigration>;
+/** 结局的**唯一**说法(两个入口同调)。 */
+export declare function logEnvModelsMigration(log: ConfigDirMigrationLog, input: EnvModelsMigrationInput, m: EnvModelsMigration): void;
+//# sourceMappingURL=config-root-migration.d.ts.map

package/dist/config-root-migration.js

@@ -0,0 +1,99 @@
+import { formatConfigPath } from "@sema-agent/settings-schema";
+import { migrateEnvModelsDecision } from "@sema-agent/settings-schema/node";
+import { envModelsDocumentPath } from "./env-model-table-gate.js";
+const markerWriteFailureAnnounced = new Set();
+export function runEnvModelsMigration(input) {
+    return migrateEnvModelsDecision({ root: input.root, env: input.env });
+}
+export function logEnvModelsMigration(log, input, m) {
+    const dir = input.root;
+    switch (m.kind) {
+        case "already_ran":
+        case "not_minter":
+            return;
+        case "marker_unreadable":
+            log.warn("config_env_models_marker_unreadable", {
+                dir,
+                reason: m.reason,
+                note: "the SS-M11 run marker on this config root does not read — it counts as run, so no decision is minted for anyone; an absent decision reads as kept",
+            });
+            return;
+        case "marker_write_failed":
+            if (markerWriteFailureAnnounced.has(dir))
+                return;
+            markerWriteFailureAnnounced.add(dir);
+            log.warn("config_dir_migration_failed", {
+                dir,
+                migration: "SS-M11",
+                reason: m.error,
+                ...(m.errno !== undefined ? { errno: m.errno } : {}),
+                wayOut: m.wayOut,
+                note: "the SS-M11 run marker could not be created, so no decision was minted — an absent decision reads as kept (a decision written by hand still applies); said once per process",
+            });
+            return;
+        case "recorded":
+            logMint(log, input, m.mint, m.createdRoot, m.decision.kind);
+            return;
+        default: {
+            const unhandled = m;
+            throw new Error(`SS-M11 migration: unknown result ${JSON.stringify(unhandled)}`);
+        }
+    }
+}
+function logMint(log, input, mint, createdRoot, decisionBefore) {
+    const dir = input.root;
+    const decisionFile = envModelsDocumentPath(dir);
+    switch (mint.kind) {
+        case "minted":
+            log.info("config_dir_migrated", {
+                dir,
+                receipts: [{ migration: mint.receipt.migration, document: mint.receipt.document, path: formatConfigPath(mint.receipt.path), appliedAs: mint.receipt.appliedAs }],
+                written: [decisionFile],
+                removed: [],
+                createdRoot,
+                migration: "SS-M11",
+                minted: true,
+                note: "settings-schema one-time migration SS-M11 recorded that a catalog managing the model plane replaces the env model table on this config root (the reading before the decision existed); it runs once per config root",
+            });
+            if (mint.replacedEnvModels.length > 0 && !input.envTableIsPlaceholder) {
+                log.warn("config_env_models_replaced_by_migration", {
+                    dir,
+                    envModels: mint.replacedEnvModels.map((e) => ({ id: e.id, env: e.env })),
+                    decisionFile,
+                    note: `the local catalog keeps replacing these env models (as before this version). To serve the env models instead, delete ${decisionFile} or write it as {"envModels":"kept"}; a running process keeps the catalog it serves until the next start`,
+                });
+            }
+            return;
+        case "exists":
+        case "skipped":
+            log.info("config_dir_migrated", {
+                dir,
+                receipts: [],
+                written: [],
+                removed: [],
+                createdRoot,
+                migration: "SS-M11",
+                minted: false,
+                why: mint.kind === "exists" ? "decision_written_meanwhile" : mint.why,
+                decisionBefore,
+                note: "settings-schema one-time migration SS-M11 ran on this config root and minted nothing; an absent decision reads as kept from now on",
+            });
+            return;
+        case "failed":
+        case "models_unreadable":
+            log.warn("config_env_models_mint_failed", {
+                dir,
+                cause: mint.kind === "failed" ? "decision_write_failed" : "models_unreadable",
+                reason: mint.error,
+                ...(mint.errno !== undefined ? { errno: mint.errno } : {}),
+                wayOut: mint.wayOut,
+                note: "SS-M11 did not mint the decision and will not try again on this config root (its run marker is in place) — an absent decision reads as kept, so a local catalog that manages the model plane is refused while env models are declared",
+            });
+            return;
+        default: {
+            const unhandled = mint;
+            throw new Error(`SS-M11 migration: unknown mint outcome ${JSON.stringify(unhandled)}`);
+        }
+    }
+}
+//# sourceMappingURL=config-root-migration.js.map

package/dist/config-types.d.ts

@@ -748,7 +748,7 @@ export interface ServiceConfigFlat {
      *  git pull 落下的文件都还认),它只是不 harvest;而 declared-false 的部署连收编都不做。 */
     memoryPersistenceCapable?: boolean;
     /** 142-S2.5-W1: TOC 同步 client 腿 —— file memory 形态把本地记忆盘与中心(DB 权威,
-     *  POST /v1/memory/sync/:scope)做一轮一 RTT 双向同步。env 三键:`MEMORY_SYNC_URL`(设了=开;缺省
+     *  POST /v2/memory/sync/:scope)做一轮一 RTT 双向同步。env 三键:`MEMORY_SYNC_URL`(设了=开;缺省
      *  undefined=纯本地现状零变化)/`MEMORY_SYNC_TOKEN`(Bearer)/`MEMORY_SYNC_SCOPE`(可选,缺省 =
      *  memoryScope 本身**仅当它已是 v2 typed key**;非 typed 键 ⇒ 拒启,[ref] —— 旧 formatUserScope 派生臂铸出的是本部署
      *  从不写的层,见 loadConfig)。半配置 fail-loud
@@ -762,7 +762,7 @@ export interface ServiceConfigFlat {
         maxPullEntries?: number;
     };
     /** [ref] R2:中心(DB 记忆平面)声明的**同步身份** —— 客户端用来到达本中心同步口的基址(env `MEMORY_SYNC_SERVE_IDENTITY`)。
-     *  一处声明、三个读者:能力面 `memorySyncServe.identity` 逐字公开;中心入站 `POST /v1/memory/sync/:scope` 的 `peer` 按串与它比(不等 ⇒ 409,零写);
+     *  一处声明、三个读者:能力面 `memorySyncServe.identity` 逐字公开;中心入站 `POST /v2/memory/sync/:scope` 的 `peer` 按串与它比(不等 ⇒ 409,零写);
      *  缺席 ⇒ 本中心不服务同步(501 `feature.memory_sync_serve_disabled`)。必须已是规范形(铸点 `memory-sync-identity.ts`),否则拒启 —— 无条件解析。 */
     memorySyncServeIdentity?: string;
     /** [ref](黑板 [ref]/[ref] 两裁):记忆检索的**向量面**接线 —— OpenAI 兼容 `/embeddings` 端点。
@@ -1330,9 +1330,9 @@ export interface ServiceConfigFlat {
      * env `LOCKED_CONFIG_KEYS`(csv;词表 = core 的 `LOCKED_KEY_REGISTRY` 闭集,未知键 boot 拒 =
      * `config.locked_registry`「不解析的安全控件不得半开」)。
      *
-     * ⚠️ 本仓的两条**装配相容性**判据在 boot/governance-seams.ts(`assertLockAssemblable`):
-     * `toolPolicy` 锁与本仓「每条腿自铸 spec.toolPolicy」的装配形结构性冲突,`mcp` 锁与「部署自带 MCP
-     * 基线」冲突 —— 两者都在启动期拒,而不是让每条任务腿在 prepare 期各撞一次 `config.locked_key`。
+     * ⚠️ 本仓的**装配相容性**判据在 boot/governance-seams.ts(`assertGovernanceAssemblable`,部署 MCP / A2A 基线物化之后判一次):
+     * `toolPolicy` 锁与本仓「每条腿自铸 spec.toolPolicy」的装配形结构性冲突,`mcp` / `a2a` 锁与「部署自带 MCP 服务器 /
+     * A2A 对端」冲突 —— 都在启动期拒,而不是让每条任务腿在 prepare 期各撞一次 `config.locked_key`。
      */
     lockedConfigKeys?: readonly LockedKey[];
     /**

package/dist/config.d.ts

@@ -264,10 +264,11 @@ export declare function applyAutoCompactWindow(m: Model, explicit?: number): "ex
 /**
  * **严格名册布防**的唯一判据(boot 就绪门 `boot/web-admin.ts` 与装配第 2 段的路由端点判官同调这一只)。
  *
- * 布防 = 远程 registry ∧ 非 dryRun ∧ `CONFIG_REQUIRE_ROSTER=true`(严格 `"true"`,直读 env、不进 ServiceConfig —— 纯
+ * 布防 = 声明了中心(`webAdmin` 在场)∧ 非 dryRun ∧ `CONFIG_REQUIRE_ROSTER=true`(严格 `"true"`,直读 env、不进 ServiceConfig —— 纯
  * boot 期姿势旋钮,原判据逐字搬来,零语义变化)。布防时运维声明 env MODEL_ID 是**占位**:名册落地前计费提交 503、
- * `/health` ready:false,落地后整张模型表被中心目录换装。dryRun 是 compare-only(名册从不被应用),local / 纯 env
- * 部署没有「中心」可等 ⇒ 都不布防。
+ * `/health` ready:false,落地后整张模型表被中心目录换装。判据**不看配置源形态**:`CONFIG_PROVIDER=local` 而同时声明了中心与
+ * `CONFIG_REQUIRE_ROSTER=true` 的部署同样布防,env 表同样按占位读(路由判官、本地腿的 env 模型表闸都不判它)。没有声明中心的
+ * local / 纯 env 部署没有「中心」可等 ⇒ 不布防;dryRun 是 compare-only(名册从不被应用)⇒ 不布防。
  */
 export declare function isRosterGateArmed(webAdmin: ServiceConfig["webAdmin"]): boolean;
 /**

package/dist/config.js

@@ -1742,7 +1742,7 @@ function parseMemoryDomain(ctx) {
     }
     else {
         if (memoryEngineBackend !== "file") {
-            throw new Error(`MEMORY_SYNC_URL is a FILE-memory (TOC client) knob, but MEMORY_ENGINE_BACKEND=${memoryEngineBackend} — the DB memory plane IS the central sync authority (it serves POST /v1/memory/sync/:scope) and must not also run the client leg; unset MEMORY_SYNC_* here`);
+            throw new Error(`MEMORY_SYNC_URL is a FILE-memory (TOC client) knob, but MEMORY_ENGINE_BACKEND=${memoryEngineBackend} — the DB memory plane IS the central sync authority (it serves POST /v2/memory/sync/:scope) and must not also run the client leg; unset MEMORY_SYNC_* here`);
         }
         if (memorySyncToken === undefined) {
             throw new Error("MEMORY_SYNC_URL is set but MEMORY_SYNC_TOKEN is not — refusing to start half-configured (the central sync face requires a bearer token)");

package/dist/delegated-session-owner.d.ts

@@ -136,18 +136,20 @@ export interface PlacedRowWriter {
  */
 export declare function createPlacedSessionRow(sessionId: string, placement: PlacementSources, io: PlacedRowWriter, log: OrphanOwnerLog): Promise<void>;
 /**
- * 停驻挂点的**见证**:调用方交出的委派树根 + 调用方判断那一刻读到的根行住客(化身;`null` = 那一读里根行不在)。请求腿 = 鉴权解析的会话与受理时那一读;
- * 赎回腿 = 行上的根与写口放行的那一位住客(认领之前解析器那一读)。
+ * 停驻挂点的**见证**:调用方交出的委派树根 + 调用方判断那一刻读到的根行住客(属主与化身,同一读;化身 `null` = 那一读里根行不在,此时属主恒 `null`)。
+ * 请求腿 = 鉴权解析的会话与受理时那一读;赎回腿 = 行上的根与写口放行的那一位住客(认领之前解析器那一读)。
+ * 读者:停驻挂点({@link assertRootStillWitnessed},只比化身)、会话行记录座(化身)、后台子代完成 relay(属主与化身,会话通知门的目标住客)。
  */
 export interface DelegationRootWitness {
     readonly sessionId: string;
+    readonly owner: string | null;
     readonly incarnation: string | null;
 }
 /**
  * 「根行的化身已换 ⇒ 拒」在停驻挂点的那一道(挂点的见证是更早的一读,不是这一读):此刻根行在、而住客不是见证的那一位(见证那一读里不在,或是另一位)⇒ 抛。
  * 根行此刻不在 ⇒ 不抛(根真没了 ⇒ 律给哨兵,不是「换了住客」)。这是**判断**的一部分;判断之后、写之前根的变化不改变写进去的值(律:属主 = 判断时见证到的)。
  */
-export declare function assertRootStillWitnessed(sessionId: string, witness: DelegationRootWitness | undefined, judged: JudgedOwner): void;
+export declare function assertRootStillWitnessed(sessionId: string, witness: Pick<DelegationRootWitness, "incarnation"> | undefined, judged: JudgedOwner): void;
 /** 记录委派树的宿主店多交的两只口(三只持久会话店与缓存包装层;无 repo 的内存店两只都没有 ⇒ 没有可按的树 ⇒ 不认领)。 */
 export interface DelegationTreeStore {
     /** 本行落库的 placement 元组(`undefined` = 本行不是 placed 行 ⇒ 不记委派树)。 */

package/dist/delegated-session-owner.js

@@ -92,7 +92,7 @@ export async function settleDelegatedOwner(host, sessionId, owner, tree) {
             throw refuse();
         judged = await readDelegatedOwner(sessionId, recorded, sourceFacesVia(host.headOf));
         if (tree.root !== null)
-            assertRootStillWitnessed(sessionId, { sessionId: tree.root, incarnation: tree.rootIncarnation }, judged);
+            assertRootStillWitnessed(sessionId, { incarnation: tree.rootIncarnation }, judged);
         expected = judged.inherited.owner;
         if (face.owner === null && expected !== null) {
             claimed = await trees.claimOwnerless(sessionId, face.incarnation, expected);

package/dist/device-ws-protocol.d.ts

@@ -75,6 +75,7 @@ export declare const DEVICE_OUTCOME_ERROR_CODES_BY_REVISION: {
     readonly 1: readonly ["aborted", "already_exists", "auth_failed", "callback_error", "invalid", "is_directory", "not_directory", "not_found", "not_supported", "outcome_unknown", "permission_denied", "precondition_failed", "shell_unavailable", "spawn_error", "suspended", "target_unavailable", "timeout", "transport_lost", "unknown"];
     readonly 2: readonly ["liveness_no_output"];
     readonly 3: readonly ["name_too_long"];
+    readonly 4: readonly ["symlink_loop"];
 };
 /** 本包认得的协议修订号(= 增量表的行键)。 */
 export type DeviceProtocolRevision = keyof typeof DEVICE_OUTCOME_ERROR_CODES_BY_REVISION;

package/dist/device-ws-protocol.js

@@ -1,7 +1,7 @@
 import { createPublicKey, randomBytes, randomInt, verify as edVerify } from "node:crypto";
 import { MAX_TIMER_DELAY_MS, inWholeNumberBounds, wholeNumberBoundsRule } from "./config-types.js";
 export const DEVICE_WS_PATH = "/v1/device/ws";
-export const DEVICE_PROTOCOL_VERSION = 3;
+export const DEVICE_PROTOCOL_VERSION = 4;
 export const DEVICE_MIN_PROTOCOL_VERSION = 1;
 export const DEVICE_HELLO_DOMAIN_TAG = "sema.device.hello.v1";
 export const DEVICE_WS_LIMITS = {
@@ -67,6 +67,7 @@ export const DEVICE_OUTCOME_ERROR_CODES_BY_REVISION = {
     ],
     2: ["liveness_no_output"],
     3: ["name_too_long"],
+    4: ["symlink_loop"],
 };
 export function deviceOutcomeErrorCodesAt(revision) {
     if (!Number.isInteger(revision) || revision < 1 || revision > DEVICE_PROTOCOL_VERSION) {

package/dist/env-model-table-gate.d.ts

@@ -0,0 +1,53 @@
+/**
+ * 本地配置腿上「一份管模型面的目录能不能顶替已声明的 env 模型表」—— **唯一判官**与它的拒句;以及候选随身带的那一份事实 {@link CatalogSource}。
+ *
+ * ## 律(一条)
+ * 一份候选的模型面被组拒 `config.catalog_replaces_env_models`,当且仅当四件同时成立:
+ *  ① 候选来自**本地配置腿**({@link CatalogSource} 的 `local` 臂;中心腿不守卫 —— 中心发布的目录照旧整表顶替 env 表);
+ *  ② 候选**管**模型面(模型面 stage 已走过「一条启用条目也没有 ⇒ 不管」那条捷径 —— 本判官只在它之后被问);
+ *  ③ env 模型表**已声明**且不是占位(`MODEL_ID` 铸出了条目;严格名册布防时 env 表是占位、不算);
+ *  ④ 配置根上的决定读数**不是** `replaced`(缺席 / `kept` / 读不懂 —— 运行记录在场之后缺席 ≡ `kept`,读不懂的不许读成确认)。
+ * 拒 ⇒ 模型面这一组停在上一代(起服:env 表;刷新拍:在服的那一代),其余组照落;拒句点名被顶替的 env 模型、决定文件的路径与两条出路。
+ *
+ * 执法点:模型面 stage 经登记条 `config-invariants.ts` 的 `env-table-replacement-acknowledged` 调本判官(候选的事实随 `CrossInvariantInput.candidate` 交来)。
+ *
+ * ## 一个读者
+ * 决定文件的字节只有契约的 `readEnvModelsDecision` 打开:`LocalConfigProvider.fetchEffective` 在读候选的**同一拍**调它,读数随候选交出
+ * (`FetchEffectiveResult.catalogSource`;本地 etag 由同一份读数的身份 `envModelsDecisionTag` 并入)。本模块与模型面 stage 只读这份读数,不开文件。
+ * 「env 表已声明」读的是引擎**自己铸的那张** env 表(模型面 stage 的 env 快照),不再读一遍 env。
+ */
+import { CATALOG_REPLACES_ENV_MODELS_CODE, type EnvModelTableEntry, type EnvModelsDecision } from "@sema-agent/settings-schema";
+/**
+ * 一份目录候选**从哪条配置腿来**(以及本地腿上,配置根的 env 模型表决定在**同一拍**读作什么)。必填、没有缺省腿:安全轴上「忘了说是哪条腿」
+ * 不许静默落成某一种语义(与 `ApplyLeg` 同一条纪律)。铸点:`LocalConfigProvider.fetchEffective`(`local` 臂,带 `root` 与那一读的决定)、
+ * `RemoteConfigProvider.fetchEffective` 与盘上 LKG 读回(`remote` 臂 —— LKG 只在中心腿启用)。
+ */
+export type CatalogSource = {
+    readonly kind: "local";
+    readonly root: string;
+    readonly envModels: EnvModelsDecision;
+} | {
+    readonly kind: "remote";
+};
+/** 中心腿的那一份(冻结;中心腿不守卫,没有可带的事实)。 */
+export declare const REMOTE_CATALOG_SOURCE: CatalogSource;
+/** 判官的拒决(码与句出自同一次判决)。 */
+export interface EnvTableReplacementRefusal {
+    readonly code: typeof CATALOG_REPLACES_ENV_MODELS_CODE;
+    readonly reason: string;
+}
+/** 判官的输入(纯数据)。 */
+export interface EnvTableReplacementInput {
+    /** 引擎自己铸的那张 env 表的条目(槽序;空 = env 表没声明)。 */
+    readonly envTable: readonly EnvModelTableEntry[];
+    /** 严格名册布防(`isRosterGateArmed`):env 表是占位、从不被派发 ⇒ 对本闸等于没声明。 */
+    readonly envTableIsPlaceholder: boolean;
+    readonly source: CatalogSource;
+}
+/**
+ * **唯一判官**(见文件头的律;② 由调用方的位置保证)。通过 ⇒ `undefined`。两只闭集都穷举:腿加一臂 / 决定加一词不补 ⇒ 编译红。
+ */
+export declare function judgeEnvTableReplacement(input: EnvTableReplacementInput): EnvTableReplacementRefusal | undefined;
+/** 配置根上决定文件的路径(文件名取契约的文档名,不手抄)。 */
+export declare function envModelsDocumentPath(root: string): string;
+//# sourceMappingURL=env-model-table-gate.d.ts.map

package/dist/env-model-table-gate.js

@@ -0,0 +1,53 @@
+import { CATALOG_REPLACES_ENV_MODELS_CODE, ENV_MODELS_DOCUMENT } from "@sema-agent/settings-schema";
+import path from "node:path";
+export const REMOTE_CATALOG_SOURCE = Object.freeze({ kind: "remote" });
+export function judgeEnvTableReplacement(input) {
+    const { source } = input;
+    switch (source.kind) {
+        case "remote":
+            return undefined;
+        case "local":
+            break;
+        default: {
+            const unhandled = source;
+            throw new Error(`judgeEnvTableReplacement: unknown catalog source ${JSON.stringify(unhandled)}`);
+        }
+    }
+    if (input.envTable.length === 0 || input.envTableIsPlaceholder)
+        return undefined;
+    const decision = source.envModels;
+    switch (decision.kind) {
+        case "replaced":
+            return undefined;
+        case "absent":
+        case "kept":
+        case "unreadable":
+            return { code: CATALOG_REPLACES_ENV_MODELS_CODE, reason: envTableReplacementSentence(input.envTable, decision, envModelsDocumentPath(source.root)) };
+        default: {
+            const unhandled = decision;
+            throw new Error(`judgeEnvTableReplacement: unknown decision ${JSON.stringify(unhandled)}`);
+        }
+    }
+}
+export function envModelsDocumentPath(root) {
+    return path.join(root, `${ENV_MODELS_DOCUMENT}.json`);
+}
+function decisionPhrase(decision) {
+    switch (decision.kind) {
+        case "absent":
+            return "is absent (an absent decision reads as kept)";
+        case "kept":
+            return 'says "kept"';
+        case "unreadable":
+            return decision.reason === "io" ? `cannot be read (${decision.errno}) — an unreadable decision is never read as a confirmation` : `does not read (${decision.reason}) — an unreadable decision is never read as a confirmation`;
+    }
+}
+function envTableReplacementSentence(envTable, decision, documentPath) {
+    const named = envTable.map((e) => `${e.env} "${e.id}"`).join(", ");
+    const keys = envTable.map((e) => e.env).join(" / ");
+    return (`[${CATALOG_REPLACES_ENV_MODELS_CODE}] config.d/models.json manages the model plane, which would replace the env model table (${named}); ` +
+        `the config root's decision ${documentPath} ${decisionPhrase(decision)}, so this catalog's model plane is not adopted and the model plane in force keeps serving ` +
+        `(the env models, unless an earlier catalog generation was adopted). To let local catalogs replace the env models on this config root, write ${documentPath} as {"envModels":"replaced"} ` +
+        `(a supported writer does this after showing what is replaced), or unset ${keys}.`);
+}
+//# sourceMappingURL=env-model-table-gate.js.map