@sema-agent/server 7.145.0 → 7.147.0

package/dist/config-catalog.js

@@ -8,13 +8,14 @@ import { SESSION_SNAPSHOT_BUCKET_DEFAULT, WORKSPACE_SNAPSHOT_BUCKET_DEFAULT } fr
 import { WORKSPACE_PERSIST_DEFAULT, WORKSPACE_PERSIST_WORDS, WORKSPACE_SNAPSHOT_KEEP_DEFAULT, WORKSPACE_SNAPSHOT_KEEP_RANGE, WORKSPACE_SNAPSHOT_PREFIX_DEFAULT, WORKSPACE_SNAPSHOT_TIMEOUT_MS_DEFAULT, WORKSPACE_SNAPSHOT_TIMEOUT_MS_RANGE } from "./workspace-space.js";
 import { APPROVAL_ASK_RETENTION_DEFAULT_MS, APPROVAL_ASK_RETENTION_FLOOR_MS } from "./approval-ask-retention.js";
 import { SANDBOX_SECRET_SEAT_VERBS } from "./plugins/k8s-exec-protocol.js";
+import { ADOPTION_IMPORT_MAX_SESSIONS_DEFAULT, ADOPTION_IMPORT_MAX_SESSIONS_FLOOR, ADOPTION_IMPORT_MAX_SESSION_BYTES_CEILING, ADOPTION_IMPORT_MAX_SESSION_BYTES_DEFAULT, ADOPTION_IMPORT_MAX_SESSION_BYTES_FLOOR } from "./adoption/import-limits.js";
 import { LIVENESS_MS_DEFAULT } from "./exec-bounds.js";
 import { THINKING_FORMATS } from "./model-compat.js";
 import { AUTO_MODE_CLASSIFIER_TIMEOUT_BOUNDS, CENTER_BASE_URL_RULE, CONFIG_PROVIDER_WORDS, DRAIN_SECOND_SIGNAL_MIN_GAP_BOUNDS, DRAIN_SECOND_SIGNAL_MIN_GAP_DEFAULT_MS, DEVICE_DELIVERY_TIMEOUT_BOUNDS, DEVICE_EXEC_TIMEOUT_BOUNDS, FIRST_BYTE_TIMEOUT_BOUNDS, FLEET_LEASE_OUTAGE_MAX_DEFAULT_MS, RESILIENCE_DEFAULTS, TASK_WRITE_FACE_ESCALATIONS } from "./config-types.js";
 import { DEVICE_HELLO_ACK_BOUNDS } from "./device-ws-protocol.js";
 import { webSearchProviderFromEnv, WEB_SEARCH_PROVIDERS } from "./plugins/web-search.js";
 import { AUTONOMY_MODES } from "./runtime-governance.js";
-import { REMOTE_EXEC_PROVIDER_WORDS, SANDBOX_READ_FLOOR_DEFAULT, SANDBOX_READ_FLOOR_WORDS } from "./execution-lane-caps.js";
+import { ALL_EXECUTION_LANES, SANDBOX_READ_FLOOR_DEFAULT, SANDBOX_READ_FLOOR_WORDS } from "./execution-lane-caps.js";
 import { MEMORY_ENGINE_BACKENDS, SESSION_BACKENDS, STORE_BACKENDS } from "@sema-agent/settings-schema/execution-lanes";
 import { MODEL_PROVIDER_WORDS } from "./model-provider.js";
 import { buildDisplaySafeUrlChecked } from "./trace/redact.js";
@@ -60,6 +61,8 @@ export const CONFIG_CATALOG = [
     r("ADB_MOUNT_PATH", "orchestration", "path", "adb 车道工作区挂载路径(缺省由 adapter 定)"),
     r("ADB_PATH", "orchestration", "path", "adb 二进制路径(缺省 PATH 上的 adb)"),
     r("ADB_SERIAL", "orchestration", "string", "adb 车道目标设备 serial(REMOTE_EXEC=adb 的必需件,缺 ⇒ 拒启)"),
+    r("ADOPTION_IMPORT_MAX_SESSIONS", "limitsHttp", "number", `收编批量导入 POST /v1/adoption/:id/sessions 每请求最多几个会话信封(超了整请求 400 request.field_invalid,句子点名本旋钮;地板 ${ADOPTION_IMPORT_MAX_SESSIONS_FLOOR},越界夹取 + 点名,小数拒启);当前值经能力位 adoptionImport.maxSessions 交给已收编的源主体`, { staticDefault: String(ADOPTION_IMPORT_MAX_SESSIONS_DEFAULT), configKey: "adoptionImportMaxSessions" }),
+    r("ADOPTION_IMPORT_MAX_SESSION_BYTES", "limitsHttp", "number", `收编批量导入每个会话信封最多多少字节(信封 JSON 的 UTF-8 字节;超了只拒那一个元素 rejected/too_large,带 count 与 cap;合法域 [${ADOPTION_IMPORT_MAX_SESSION_BYTES_FLOOR}, ${ADOPTION_IMPORT_MAX_SESSION_BYTES_CEILING}] —— 上帽 = JSON 体上限减空批包络,再大的值够不着,越界夹取 + 点名,小数拒启);当前值经能力位 adoptionImport.maxSessionBytes 交给已收编的源主体`, { staticDefault: String(ADOPTION_IMPORT_MAX_SESSION_BYTES_DEFAULT), configKey: "adoptionImportMaxSessionBytes" }),
     r("AGENT_DATA_DIR", "store", "path", "本机数据根回落链一环(LOCAL_DATA_ROOT → CONFIG_LOCAL_DIR → AGENT_DATA_DIR → ~/.ai-agent);记忆引擎缺省根同链", { danger: DATA, derivedDefaultNote: "缺席 ⇒ 链上下一环,最终 ~/.ai-agent" }),
     r("ALLOW_UNAUTHED_WRITES", "auth", "boolean", "无 service token 时仍接受任务提交(本地开发逃生口;缺省 fail-closed 拒提交)", { staticDefault: "false", danger: SEC, configKey: "allowUnauthedWrites" }),
     r("ANTHROPIC_API_KEY", "modelPlane", "secret", "Anthropic 协议路线的 x-api-key 凭据(只发 x-api-key 头;与 ANTHROPIC_AUTH_TOKEN 互斥 —— 同设拒启,机读码 `config.anthropic_credential_conflict`;与 BASE_URL 同在时可推断 provider)", { danger: [...SEC, ...BILL] }),
@@ -98,6 +101,7 @@ export const CONFIG_CATALOG = [
     r("BG_AGENT_PARK_CLAIM_STALE_MS", "orchestration", "number", "parked 后台 agent 的 stale-claim 清算窗(ms;claimer 崩死的行由此解卡)", { staticDefault: String(60 * 60_000), configKey: "backgroundAgentParkClaimStaleMs" }),
     r("BG_AGENT_RETENTION_MS", "orchestration", "number", "TERMINAL 后台 agent 行保留期(ms,reaper 按 scope 清)", { staticDefault: String(7 * 24 * 60 * 60 * 1000), danger: DATA, configKey: "backgroundAgentRetentionMs" }),
     r("BG_AGENT_STALE_RUNNING_MS", "orchestration", "number", "running 后台 agent 行写者心跳断更超此值翻 failed(ms;下限 10min 硬钳)", { staticDefault: String(15 * 60_000), configKey: "backgroundAgentStaleRunningMs" }),
+    r("BG_AGENT_STALL_MS", "orchestration", "number", "会话驻留后台子代理的停滞收割窗(ms;最后一次工具活动距今超此值 ⇒ 行收成 killed、归因 system、run 中止;缺省 = 下限,只许拉大,无关闭档)", { derivedDefaultNote: "缺席 ⇒ max(600000, max(STREAM_ASK_WINDOW_MS, UNREACHED_ASK_TTL_MS, QUESTION_TTL_MS, MCP_ELICITATION_TTL_MS) + 引擎单命令上限(缺省 600000));单用户 posture 下 86400000 + 600000", configKey: "backgroundAgentStallMs" }),
     r("BIND_HOST", "auth", "string", "监听绑址(显式值恒生效)", { danger: SEC, derivedDefaultNote: "缺席:无鉴权写面(allowUnauthedWrites ∧ 零凭证)自动收窄 127.0.0.1,其余全接口", resolve: (c) => c.bindHost ?? null }),
     r("CENTER_CREDENTIAL_RENEW_LEAD_MS", "integrations", "number", `center 凭证续签提前量(ms;${WEB_ADMIN_ENV.tokenFile} 指向人的登录会话信封时,访问令牌离到期 ≤ 本值即由引擎续签并原子改写同一文件;0 = 关续签只读信封;其余须为 [${CENTER_CREDENTIAL_RENEW_LEAD_MIN_MS}, ${CENTER_CREDENTIAL_RENEW_LEAD_MAX_MS}] 内整数,坏值拒启;裸行 / 值形凭证不续签)`, { staticDefault: String(CENTER_CREDENTIAL_RENEW_LEAD_DEFAULT_MS), danger: SEC, configKey: "centerCredentialRenewLeadMs" }),
     r("COMPLIANCE_ADDITIONAL_DENIES", "auth", "csv", "合规档位之上额外拒绝的能力名(只能收紧;词表=core 闭集,拼错拒启)", { danger: SEC }),
@@ -128,6 +132,7 @@ export const CONFIG_CATALOG = [
     r("DEVICE_RECONNECT_GRACE_MS", "orchestration", "number", `device 断连后在途不判丢的窗(ms;同 epoch 重连续接;原值进 helloAck.reconnectGraceMs;须为 [${DEVICE_HELLO_ACK_BOUNDS.reconnectGraceMs.min}, ${DEVICE_HELLO_ACK_BOUNDS.reconnectGraceMs.max}] 内规范十进制整数,其余拒启)`, { derivedDefaultNote: "缺席 ⇒ adapter 默认 120s" }),
     r("DEVICE_RELAY_URL", "orchestration", "url", "设备入口(REMOTE_EXEC=device 必填):设备连不到本引擎自己的地址(引擎在中继 / 网关之后)时拨的那一个 ws(s) URL,逐字上 /v1/capabilities 的 deviceExecutor.relayUrl;或字面 none = 没有中继,设备按引擎地址 + deviceExecutor.wsPath 拨号(能力面不带 relayUrl;有设备绑定时起服 warn 点名绑定数)。URL 须为无 userinfo / query / fragment、不带凭据形的 ws:// 或 wss:// 绝对地址,其余拒启。不从 FLEET_ADVERTISE_ADDRESS 派生(那是对中心公告的地址,受众不是设备)", { enumValues: [DEVICE_RELAY_NONE], derivedDefaultNote: "无缺省:device 车道的必需键 —— 缺席 / 空串 / 只含空白拒起(撤中继声明的回滚序 = 先恢复引擎自己的入口,再写 none)" }),
     r("DEVICE_SUPERSEDE", "orchestration", "enum", "同 deviceId 二连的顶替策略", { enumValues: ["stale_only", "deny"], staticDefault: "stale_only", danger: SEC }),
+    r("DEVICE_TRUSTED_PROXY_CIDRS", "orchestration", "csv", "设备 WS 未鉴权握手 per-remote 帽键的可信代理名单(逗号分隔,每项 = IP 地址或 CIDR,裸地址 = 单台;只放自己的反代):socket 对端落在名单内才读 X-Forwarded-For,取自右向左第一个不在名单内的地址作帽键;名单外的对端一律不采代理头;头行数到顶 / 头缺席 / 坏形 / 全在名单内 ⇒ 键退回 socket 对端 + warn。不是 IP 地址或 CIDR 的项 / zone id / 主机位非零 / 前缀 0 / 空项拒启", { danger: SEC, derivedDefaultNote: "缺席 ⇒ 空 = 不读任何代理头(帽键 = socket 对端)" }),
     r("DIRECT_APPROVAL_DOOR", "approval", "boolean", "直连 /decide 门(无 BFF 的桌面/CLI 客户端;开 ⇒ 要求签名 JWT+HMAC 信封,principal 头降级不可信)", { staticDefault: "false", danger: SEC, configKey: "directApprovalDoor" }),
     r("DOCKER_COMMAND_TIMEOUT_MS", "orchestration", "number", "local-docker 车道单命令超时(ms)"),
     r("DOCKER_CPUS", "orchestration", "number", "local-docker 容器 CPU 限额"),
@@ -140,7 +145,7 @@ export const CONFIG_CATALOG = [
     r("DOCKER_PATH", "orchestration", "path", "docker 二进制路径"),
     r("DOCKER_PIDS_LIMIT", "orchestration", "number", "local-docker fork-bomb 背栓(--pids-limit;非法值回 adapter 默认 512+warn)", { danger: SEC, derivedDefaultNote: "缺席 ⇒ adapter 默认 512" }),
     r("DOCKER_SANDBOX_ENV", "orchestration", "secret", "local-docker 车道每条 docker exec 以 -e 注入的本进程 env 点名表(NAME,NAME;点到的键从 worker env 原样取,值不进 spec/center/日志;与 LSP_ENV_ALLOW / E2B_SANDBOX_ENV 同一只解析器与「点名放行」谓词:形错 / 点名名单型旋钮 / 点名本服务自有凭据名(会把本服务的凭据装进模型读得到的沙箱;判官 = 引擎拒白名单的同一只)拒启且不回显值;本进程环境里没有的名按序号 warn、不转发;只在本车道被选中时求值;原文按凭据类对待:只回在场位、不进任何子进程)", { danger: SEC }),
-    r("DRAIN_GRACE_MS", "limitsHttp", "number", "SIGTERM 优雅排空窗(ms;期间新计费提交 503+Retry-After)。出厂默认是**服务器部署**的取值;壳自 spawn 的引擎会被壳注入更短的窗 ⇒ 排壳形关机预算时以本行的 effectiveValue(= 本进程实际生效值)为准,不照抄 staticDefault", { staticDefault: String(10 * 60 * 1000), configKey: "drainGraceMs", center: cLimits("drainGraceMs") }),
+    r("DRAIN_GRACE_MS", "limitsHttp", "number", "SIGTERM 优雅排空窗(ms;期间新计费提交 503+Retry-After)。出厂默认是**服务器部署**的取值;壳自 spawn 的引擎会被壳注入更短的窗 ⇒ 排壳形关机预算时按壳自己注入的值算(壳读不到本目录:它是 operator-only),排空开始后本次排空定死的到期点读 GET /health 的 engineSignal.draining.deadlineAt,从信号到进程退出的上界见 USAGE 的「停机上界(契约句)」;不照抄 staticDefault", { staticDefault: String(10 * 60 * 1000), configKey: "drainGraceMs", center: cLimits("drainGraceMs") }),
     r("DRAIN_SECOND_SIGNAL_MIN_GAP_MS", "limitsHttp", "number", `排空期「第二发信号 = 硬停」的最小间隔(ms;锚 = 本次排空的第一发停止信号 —— SIGTERM / SIGHUP 升级进的排空,入口那一发就是它;排空口 / 租约被拒 / 附着租约自退进的排空,到达的第一发被吸收、不缩短期限。SIGTERM / SIGINT 与锚相隔不足 ⇒ 同一拍的重复投递,一行 drain_duplicate_signal_ignored 后忽略、排空继续;0 = 关,恒按第二发硬停;须为 [${DRAIN_SECOND_SIGNAL_MIN_GAP_BOUNDS.minMs}, ${DRAIN_SECOND_SIGNAL_MIN_GAP_BOUNDS.maxMs}] 内十进制整数(上界 = DRAIN_GRACE_MS 地板),小数 / 负数 / 越界拒启)`, { staticDefault: String(DRAIN_SECOND_SIGNAL_MIN_GAP_DEFAULT_MS), configKey: "drainSecondSignalMinGapMs" }),
     r("DURABLE_APPROVAL", "approval", "boolean", "durable suspend/resume HITL(需 SQL 店;决定 checkpointStore 与 /v1/approvals 面的存在性)", { danger: SEC, derivedDefaultNote: "posture 三态(S-178):显式词恒赢,缺席 = 单用户(REQUIRE_PRINCIPAL≠true)且有耐久店 ⇒ on / 多租户或无耐久店 ⇒ off;生效来源见 GET /v1/diagnostics/wiring 的 serverGates.durableApproval.source", configKey: "durableApproval" }),
     r("E2B_ALLOW_NET", "orchestration", "boolean", "e2b 沙箱出网许可", { danger: SEC, derivedDefaultNote: "缺席 ⇒ 不铸键(adapter 默认允许)" }),
@@ -156,6 +161,8 @@ export const CONFIG_CATALOG = [
     r("E2B_TEMPLATE", "orchestration", "string", "e2b 模板名(缺省 adapter 基础模板)"),
     r("E2B_TIMEOUT_MS", "orchestration", "number", "e2b 单命令总超时(ms)"),
     r("ENGINE_AUTO_EXIT", "limitsHttp", "boolean", "引擎附着租约自退总开关(壳 spawn 形注 true;三合取持续 linger 窗才自退,走 SIGTERM 同一条 drain 腿)", { staticDefault: "false", configKey: "engineAutoExit" }),
+    r("ENGINE_FIRST_ATTACH_MS", "limitsHttp", "number", "首次附着前的宽限窗(ms):起服以来还没有过非探针请求时,自退的生效窗 = max(ENGINE_LINGER_MS, 本值);首个非探针请求后回到 ENGINE_LINGER_MS;父死后孤儿窗优先;0 = 不给额外宽限;其余 [1000,24h] 拒启带界", { staticDefault: "180000", configKey: "engineFirstAttachMs" }),
+    r("ENGINE_HANDOVER_LINGER_MS", "limitsHttp", "number", "交接车道的静默窗(ms):壳经 POST /v1/engine/handover 把引擎交给后台之后,无附着 ∧ 无在飞 ∧ 无运行中后台 shell ∧ 无 HTTP 触点要持续这么久才自退;下一只壳 POST /v1/engine/attach 即离开交接车道;[60000,24h] 外拒启带界(解析无条件)", { staticDefault: "1800000", configKey: "engineHandoverLingerMs" }),
     r("ENGINE_LINGER_MS", "limitsHttp", "number", "父还活着时自退前三合取须持续成立的静默窗(ms;[1000,24h] 拒启带界)", { staticDefault: "60000", configKey: "engineLingerMs" }),
     r("ENGINE_ORPHAN_LINGER_MS", "limitsHttp", "number", "父进程已不在(孤儿)时的静默窗(ms;[1000,24h] 拒启带界;SEMA_PARENT_PID 缺席则不生效)", { staticDefault: "2000", configKey: "engineOrphanLingerMs" }),
     r("EXPERIMENTAL_OBSERVER_AGENTS", "orchestration", "boolean", "observer 开闸线(实验面 ship-dark;多租户只认 center caps,env 被忽略)", { staticDefault: "false", configKey: "experimentalObserverAgents" }),
@@ -175,7 +182,7 @@ export const CONFIG_CATALOG = [
     r("GIT_API_BASEURL", "integrations", "url", "repo 工具的 Git host API base", { configKey: "gitApiBaseUrl" }),
     r("GIT_API_KIND", "integrations", "enum", "Git host API 方言", { enumValues: ["gitea", "github"], staticDefault: "gitea", configKey: "gitApiKind" }),
     r("GIT_API_TOKEN", "integrations", "secret", "repo 工具的 Git host 凭据", { danger: SEC }),
-    r("HOOKS_TIMEOUT_MS", "orchestration", "number", "请求 settings.hooks 注册每个 handler 的时间预算(ms;0=零预算是合法值)", { derivedDefaultNote: "缺席 ⇒ 不铸键,读法 settingsHooksBudgetMs 取 600000" }),
+    r("HOOKS_TIMEOUT_MS", "orchestration", "number", "请求 hooks 的每张车道注册(settings.hooks / settings.hooks.managed,各一份同值)每个 handler 的时间预算(ms;0=零预算是合法值)", { derivedDefaultNote: "缺席 ⇒ 不铸键,读法 settingsHooksBudgetMs 取 600000" }),
     r("HOST_BG_DEFAULT_TIMEOUT_SEC", "orchestration", "number", "host 后台 shell 缺省超时(秒)", { staticDefault: "300" }),
     r("HOST_BG_ENABLED", "orchestration", "boolean", "host 车道后台 shell 开关", { staticDefault: "true" }),
     r("HOST_BG_FILE_CAP", "orchestration", "number", "host 后台 shell 磁盘护栏(字节;失控输出被 reap)", { staticDefault: String(64 * 1024 * 1024) }),
@@ -233,7 +240,7 @@ export const CONFIG_CATALOG = [
     r("LEADER_WORKER_BUDGET_USD", "orchestration", "number", "leader 每 worker 花费帽(USD)", { staticDefault: "100", danger: BILL }),
     r("LEADER_WORKER_MAX_TURNS", "orchestration", "number", "leader 每 worker 轮数帽", { staticDefault: "10000", danger: BILL }),
     r("LEADER_WORKER_SLICE_BUDGET_USD", "orchestration", "number", "leader worker 单分片花费帽(USD)", { danger: BILL, derivedDefaultNote: "缺席 ⇒ max(1, workerBudgetUsd/4)" }),
-    r("LOCAL_DATA_ROOT", "store", "path", "file 店数据根的最高优先覆写(设了则与配置根分家,boot 出声)", { danger: DATA }),
+    r("LOCAL_DATA_ROOT", "store", "path", "file 店数据根的最高优先覆写(配置根不跟着走;`CONFIG_LOCAL_DIR` 没设而数据根 ≠ 推导出的配置根时,boot 出一行 `local_roots_split`;给了 `CONFIG_LOCAL_DIR` 即视作表过态,不出声)", { danger: DATA }),
     r("LOCKED_CONFIG_KEYS", "auth", "csv", "管理员锁定层声明(词表=core 闭集注册表,未知键拒启)", { danger: SEC, configKey: "lockedConfigKeys" }),
     r("LOG_LEVEL", "observability", "string", "日志档位", { staticDefault: "info", configKey: "logLevel" }),
     r("LSP_ENABLED", "orchestration", "boolean", "LSP 沙箱腿 opt-in —— 本版 e2b / k8s 执行环境不实现绑定读,开了也不挂(起服一行 lsp_not_mounted);host 腿另有 LSP_HOST_ENABLED", { staticDefault: "false", configKey: "lspEnabled" }),
@@ -250,7 +257,7 @@ export const CONFIG_CATALOG = [
     r("MCP_ELICITATION_TTL_MS", "approval", "number", "elicitation 无人应答释放窗(ms)", { derivedDefaultNote: "缺席 ⇒ 本服务出厂窗(DEFAULT_ELICITATION_THROTTLE)" }),
     r("MEMORY_AUTO_CONSOLIDATION", "memory", "enum", "记忆自动整理部署席(on=每个建议任务后整库整理跑,记忆内容自动外流到整理模型;off=显式关,胜过引擎缺省;未设=读引擎具名缺省)", { enumValues: ["on", "off"], derivedDefaultNote: "缺席 ⇒ 引擎具名缺省(**本版装的引擎是开**)——不配不等于关;前置=整理阀门开着(MEMORY_CONSOLIDATION_DRIVER=on,或未设而出厂缺省派生成开)", danger: SEC, resolve: (c) => c.memoryConsolidationDriver.autoRunOnRecommendation, booleanEnum: { true: "on", false: "off" } }),
     r("MEMORY_CAPTURE_POLICY", "memory", "enum", "记忆 capture 姿态(open=声明按面值;governed=按 per-principal verdict;capture-required=恒采)", { enumValues: ["open", "governed", "capture-required"], staticDefault: "open", danger: SEC, configKey: "memoryCapturePolicy" }),
-    r("MEMORY_CONSOLIDATION_DRIVER", "memory", "enum", "记忆折叠阀门(off=零装配零探针,两 admin 口 404 族;on=座解析 + 两 admin 口 + 引擎面整理两席)", { enumValues: ["on", "off"], derivedDefaultNote: "缺席 ⇒ 起服时派生:整理座不落主模型(MODEL_CHEAP_ID 在场且异于 MODEL_ID,或目录给 consolidate / summarize / flash 档位绑了别的模型)⇒ on;落主模型 ⇒ off + 起服 warn memory_consolidation_default_off_no_cheap_model;结构上跑不起来(无记忆引擎 / pg·mysql 记忆后端 / MEMORY_PROVENANCE=off)⇒ 恒 off 零提示。显式 on 而落主模型 ⇒ 照开 + warn memory_consolidation_on_main_model(按主模型计费)", danger: BILL, resolve: (_c, _env, boot) => (boot.memoryConsolidationValve === undefined ? undefined : boot.memoryConsolidationValve.enabled ? "on" : "off") }),
+    r("MEMORY_CONSOLIDATION_DRIVER", "memory", "enum", "记忆折叠阀门(off=零装配零探针,两 admin 口 404 族;on=座解析 + 两 admin 口 + 引擎面整理两席)", { enumValues: ["on", "off"], derivedDefaultNote: "缺席 ⇒ 起服时派生:整理座不落主模型(MODEL_CHEAP_ID 在场且异于 MODEL_ID,或目录给 consolidate / summarize / flash 档位绑了别的模型)⇒ on;落主模型 ⇒ off + 起服 warn memory_consolidation_default_off_no_cheap_model;结构上跑不起来(多租户 / MEMORY_ENGINE=off / pg·mysql 记忆后端 / MEMORY_PROVENANCE=off / 合规档否决整理)⇒ 恒 off 零提示。显式 on 而落主模型 ⇒ 照开 + warn memory_consolidation_on_main_model(按主模型计费)", danger: BILL, resolve: (_c, _env, boot) => (boot.memoryConsolidationValve === undefined ? undefined : boot.memoryConsolidationValve.enabled ? "on" : "off") }),
     r("MEMORY_CONSOLIDATION_INTERVAL_SEC", "memory", "number", "折叠周期腿节律(秒;本 build 任何正值拒启 —— 周期腿未落地,恒 0)", { staticDefault: "0" }),
     r("MEMORY_CONSOLIDATION_SCOPES", "memory", "csv", "折叠阀门 scope 表(恰一条时=admin 口缺省;不是授权边界)"),
     r("MEMORY_DELEGATION_EVIDENCE", "memory", "enum", "委派臂污染标记的证据标准", { enumValues: ["static-face", "attested-only"], staticDefault: "static-face", danger: SEC, configKey: "memoryDelegationEvidence" }),
@@ -258,6 +265,7 @@ export const CONFIG_CATALOG = [
     r("MEMORY_EMBEDDER_DIM", "memory", "number", "embeddings 维度声明"),
     r("MEMORY_EMBEDDER_ENDPOINT", "memory", "url", "OpenAI 兼容 /embeddings 端点(pg 记忆后端的向量面)"),
     r("MEMORY_EMBEDDER_MODEL", "memory", "string", "embeddings 模型名"),
+    r("MEMORY_EMBEDDER_REEMBED", "memory", "string", "清列重嵌的确认口令 `<model>/<dimensions>`:记下的 embedder 身份与配置对不上时,缺席 ⇒ 拒启、一行不清;在场且恰好点名配置的身份 ⇒ 清掉向量列按该身份重嵌一次(记下之后惰性);形不对或对不上 ⇒ 拒启", { danger: DATA }),
     r("MEMORY_EMBEDDER_TIMEOUT_MS", "memory", "number", "单次 embed 活性上限(ms)", { staticDefault: "30000" }),
     r("MEMORY_ENGINE", "memory", "enum", "记忆引擎总开关(注入式文件记忆面;双族词表,未知词拒启)", { enumValues: ["on", "off"], staticDefault: "on", configKey: "memoryEngineEnabled", booleanEnum: { true: "on", false: "off" } }),
     r("MEMORY_ENGINE_BACKEND", "memory", "enum", "记忆持久面方言(file=现状;pg/mysql=DB 真身,多租户点亮的唯一门;方言与 DB_BACKEND 同字)", { enumValues: MEMORY_ENGINE_BACKENDS, staticDefault: "file", danger: DATA, configKey: "memoryEngineBackend" }),
@@ -366,8 +374,8 @@ export const CONFIG_CATALOG = [
     r("MYSQL_PORT", "store", "number", "MySQL 协议端口", { staticDefault: "3306" }),
     r("MYSQL_USER", "store", "string", "MySQL 协议用户", { danger: DATA }),
     r("NO_PROXY", "limitsHttp", "csv", "不走代理的目标(小写 `no_proxy` 同认且优先);语法 = undici 的:逗号或空白分隔,`host` 精确且含其子域、`.host` / `*.host` 后缀、`host:port` 限端口、`*` 全直连;**回环 / 未指定地址目标无论写没写都直连**(本仓的无条件规则,不是 NO_PROXY 的一条);boot 冻结", { danger: SEC, derivedDefaultNote: "缺席 ⇒ 除回环外一律按 HTTP(S)_PROXY 走", resolve: (_c, env) => buildOutboundProxyPosture(env).noProxy }),
-    r("OPERATOR_PRINCIPALS", "auth", "csv", "operator 名单(全部运维面同一条读法:名单内的验过主体是运维;空名单 = 谁都不是;与 OPERATOR_SINGLE_USER 互斥)", { danger: SEC, configKey: "operatorPrincipals" }),
-    r("OPERATOR_SINGLE_USER", "auth", "boolean", "单用户形当自己运维的显式声明(true ⇒ 这台部署的每个调用方在全部运维面都是运维;只在 REQUIRE_PRINCIPAL 未开且 OPERATOR_PRINCIPALS 为空时成立,否则拒启;起服冻结)", { staticDefault: "false", danger: SEC, configKey: "operatorSingleUser" }),
+    r("OPERATOR_PRINCIPALS", "auth", "csv", "operator 名单(全部运维面同一条读法:名单内的验过主体是运维;空名单 = 谁都不是;与 OPERATOR_SINGLE_USER 互斥;单用户部署与 OPERATOR_SINGLE_USER 二者必写其一,都不写则拒启 —— 服务进程起服第 1 段即拒,直接调 `createHttpServer` 的嵌入方装配时拒)", { danger: SEC, configKey: "operatorPrincipals" }),
+    r("OPERATOR_SINGLE_USER", "auth", "boolean", "单用户形当自己运维的显式声明(true ⇒ 这台部署的每个调用方在全部运维面都是运维;只在 REQUIRE_PRINCIPAL 未开且 OPERATOR_PRINCIPALS 为空时成立,否则拒启;单用户部署与具名 OPERATOR_PRINCIPALS 二者必写其一 —— 都不写则拒启(服务进程起服第 1 段;嵌入方装配运维面时),false 与缺席同判;起服冻结)", { staticDefault: "false", danger: SEC, configKey: "operatorSingleUser" }),
     r("OTEL_EXPORTER_OTLP_ENDPOINT", "observability", "url", "OTLP 出口(设了=开 otel)"),
     r("OTEL_EXPORTER_OTLP_HEADERS", "observability", "secret", "OTLP 出口头(k=v CSV;常载鉴权头 ⇒ 按凭据处置)", { danger: SEC }),
     r("OTEL_EXPORT_INTERVAL_MS", "observability", "number", "OTLP 批报周期(ms)", { staticDefault: "15000" }),
@@ -401,9 +409,8 @@ export const CONFIG_CATALOG = [
     r("READ_FACE", "orchestration", "enum", "READ 容纳面档位(env 逐键恒赢 center —— 部署主权表达)", { enumValues: ["open", "roots"], danger: SEC, derivedDefaultNote: "缺席 ⇒ 按 posture 派生(S-167):单用户 turnkey(REQUIRE_PRINCIPAL 未设)铸 open;多租户不铸键、core 默认 roots。生效来源见 GET /v1/diagnostics/wiring 的 readFace.source 四词", configKey: "readFace" }),
     r("REAP_INTERVAL_SEC", "limitsHttp", "number", "reaper 周期(秒)", { staticDefault: "60", configKey: "reapIntervalSec" }),
     r("REAP_RUN_STALE_SEC", "limitsHttp", "number", "run 活性判陈旧阈(秒)", { staticDefault: "120", configKey: "runStaleSec", center: cLimits("runStaleSec") }),
-    r("REMOTE_EXEC", "orchestration", "enum", "执行车道选择(点名而配不齐/认不出 ⇒ 拒启,绝不静默降级到 host/stub)。形 = 部署声明的有序车道表(逗号分隔、首项缺省,契约 runtime.execution.lanes 的渲染形);本引擎每个进程只装一条车道 ⇒ 表里不止一条拒启,单词照旧", { enumValues: REMOTE_EXEC_PROVIDER_WORDS, danger: SEC, derivedDefaultNote: "缺席:CONFIG_PROVIDER=local ⇒ host;其余 ⇒ 进程内 stub(手带整族不挂;残余名册看活体 wiring_manifest 里 mountedBy=hands 的条目数,不按工具名点。想让这一形拒启见 REQUIRE_EXECUTION_LANE)", configKey: "remoteExec", resolve: (c) => c.remoteExec?.provider ?? null }),
+    r("REMOTE_EXEC", "orchestration", "enum", "执行车道选择(点名而配不齐/认不出 ⇒ 拒启,绝不静默降级到 host/stub)。形 = 部署声明的有序车道表(逗号分隔、首项缺省,契约 runtime.execution.lanes 的渲染形);本引擎每个进程只装一条车道 ⇒ 表里不止一条拒启,单词照旧", { enumValues: ALL_EXECUTION_LANES, danger: SEC, derivedDefaultNote: "无缺省:每个部署都声明执行车道 —— 未声明(且 CONFIG_PROVIDER=local 时 config.d/remote-exec.json 也没点名)/ 空串 ⇒ 拒启,拒句给一行修法(保持 7.146.0 及更早的行为:CONFIG_PROVIDER 非 local 写 none,local 写 host)。none = 声明「不给工具执行环境」:**零手带工具**(手带整族不挂;活体读数:mountedBy=hands 条目 10 → 0),名册里其余工具照常执行,任务仍回 status=completed:凡需要手的请求,与「模型不肯用工具」在用户面同形。判据 = 活体 wiring_manifest 里 mountedBy=hands 的条目数,不按工具名点;名册总条数随 core 版本走,不写死。曾经把「未设」改成拒启的 REQUIRE_EXECUTION_LANE 已退役(墓碑:设了即拒启,见 retired[])", configKey: "remoteExec", resolve: (c) => c.remoteExec.provider }),
     r("REMOTE_EXEC_HOME_DIR", "orchestration", "path", "执行环境的 home 目录(`~/` 形权限规则的基、引擎家锚拒读行的落点;core ExecutionEnv.homeDir 座)。声明与车道出厂答案(host ⇒ 本进程家目录,e2b ⇒ /home/user)都是主张:读得出家目录的车道(k8s / local-docker / ssh / adb / e2b / host)在每只执行环境开起来时拿环境里命令看到的 $HOME 证它(同一只判官、同一句拒),不一致或问不出 ⇒ 那只环境不开;不声明且车道没有出厂答案时,建环境那一拍实测 $HOME 填引擎手里的座(`~/` 形规则的下单门仍只认 boot 期答案);device 读不了 ⇒ 声明即座、起服 warn execution_lane_home_unmeasured 披露未实测", { danger: SEC, derivedDefaultNote: "缺席:host/in-process ⇒ os.homedir();e2b ⇒ /home/user(两者都在环境开起来时与 $HOME 对证);k8s/local-docker/ssh/adb ⇒ 建环境时实测 $HOME(实测缺席 ⇒ 那只环境的座缺席:泄内容的递归读全 shell 面真人问、只读面拒,并响 warn execution_lane_home_undeclared);device ⇒ 无(设备协议没有家目录读数:起服 warn execution_lane_home_undeclared);`~/` 形规则的下单门恒只认声明(无声明即 422 响亮拒)", configKey: "remoteExecHomeDir", resolve: (c) => c.remoteExecHomeDir ?? null }),
-    r("REQUIRE_EXECUTION_LANE", "orchestration", "boolean", "开了之后:REMOTE_EXEC 未点名 ∧ CONFIG_PROVIDER≠local ⇒ **拒启**并点名该设什么。默认关 = 照旧启动,但执行环境是进程内 stub、**零手带工具**(手带整族不挂;活体读数:mountedBy=hands 条目 10 → 0),名册里其余工具照常执行,任务仍回 status=completed —— 凡需要手的请求,与「模型不肯用工具」在用户面同形。判据 = 活体 wiring_manifest 里 mountedBy=hands 的条目数,不按工具名点;名册总条数随 core 版本走,不写死。托管/云部署推荐开(docs/DEPLOY-PREREQS.md)", { staticDefault: "false", danger: SEC, configKey: "requireExecutionLane" }),
     r("REQUIRE_PRINCIPAL", "auth", "boolean", "多租户开关(posture 判别位:true ⇒ CC 能力族默认收紧)", { staticDefault: "false", danger: SEC, configKey: "requirePrincipal" }),
     r("RESOURCE_SUSPEND", "approval", "boolean", "durable 路径 opt-in core resourceSuspend(预算/preempt ⇒ 可恢复挂起)", { staticDefault: "false", configKey: "resourceSuspend" }),
     r("RESOURCE_SUSPEND_MAX_SLICES", "approval", "number", "resume 链片数上限(0=不设;零进展循环兜底)", { staticDefault: "0", configKey: "resourceSuspendMaxSlices" }),
@@ -416,6 +423,8 @@ export const CONFIG_CATALOG = [
     r("REWIND_SNAPSHOT_MAX_MB", "store", "number", "已退役(S-15 整树快照纪元退役):设了只 boot warn 一次,零行为", { envTiming: "inert" }),
     r("ROSTER_RETENTION_MS", "orchestration", "number", "agent_roster 行 TTL(ms;SQL twins 扩展面)", { staticDefault: String(30 * 24 * 60 * 60 * 1000), danger: DATA, configKey: "rosterRetentionMs" }),
     r("ROUTER_ENABLED", "orchestration", "boolean", "A 价值路由(per-task 编排自动决策;ship-dark)", { staticDefault: "false", configKey: "routerEnabled" }),
+    r("RUN_MAX_CONCURRENT", "orchestration", "number", "本副本在飞 run 的全局并发帽(0 = 关;整数,坏值拒启):提交门(POST /v1/runs · A2A message/send · POST /v1/tasks · POST /v1/tasks/stream)在幂等重放之后判在飞数,已到帽 ⇒ 429 limit.rate_exceeded + reason run_concurrency_cap + Retry-After: 5;续跑 / 唤醒 / 审批作答不判", { staticDefault: "0", configKey: "runMaxConcurrent" }),
+    r("RUN_MAX_CONCURRENT_PER_PRINCIPAL", "orchestration", "number", "同一已验提交主体在本副本的在飞 run 并发帽(0 = 关;整数,坏值拒启;无主体请求不判这一帽,只受 RUN_MAX_CONCURRENT)", { staticDefault: "0", configKey: "runMaxConcurrentPerPrincipal" }),
     r("RUN_STORE_STRICT_HYDRATE", "store", "enum", "file run-store 列不出 runs/ 时拒启的 fail-closed 门(缺省带病起动+响亮披露)", { enumValues: ["on", "off"], staticDefault: "off", danger: DATA, configKey: "runStoreStrictHydrate", booleanEnum: { true: "on", false: "off" } }),
     r("S3_ENDPOINT", "store", "url", "外接 S3 兼容位(单独在场即开公链签发,兼作公网面)", { danger: DATA }),
     r("S3_PUBLIC_BUCKET", "store", "string", "SendUserFile 公链桶", { derivedDefaultNote: "缺席 ⇒ sema-public" }),
@@ -456,6 +465,7 @@ export const CONFIG_CATALOG = [
     r("SENSITIVE_WRITE_PATTERNS", "approval", "csv", "敏感路径写 deny 集(unset=core 推荐集;显式值整表替换;off/空=关 —— 真放松杆)。拒的是文件工具(Write / Edit / NotebookEdit,按路径);shell 命令写同一路径(重定向 / tee / cp …)不被这个集拒绝,走普通审批问", { danger: SEC, derivedDefaultNote: "缺席 ⇒ core RECOMMENDED_SENSITIVE_PATTERNS", configKey: "sensitiveWritePatterns" }),
     r("SERVICE_AUTH_TOKEN", "auth", "secret", "共享 service token(写面门;缺席且未开 ALLOW_UNAUTHED_WRITES ⇒ 拒提交)", { danger: SEC }),
     r("SERVICE_AUTH_TOKENS", "auth", "secret", "per-system 凭据表(tok=system CSV;source 从凭据派生,绝不自报)", { danger: SEC }),
+    r("SERVICE_TOKEN_ACTS_FOR_DEPLOYMENT", "auth", "boolean", "出示 service 凭据、不报主体的调用方代不代部署本人(true ⇒ 代:fleet 读面看全舰队、运维聚合口照放;false ⇒ 它是无身份调用方:fleet 读面 401、运维聚合口只认只读令牌、写档 401;带主体头的请求两形都是那位主体;GET /health 的 auth.serviceTokenActsForDeployment 自报;词表外拒启;起服冻结)", { staticDefault: "true", danger: SEC, configKey: "serviceTokenActsForDeployment" }),
     r("SESSION_AUTO_TITLE", "orchestration", "boolean", "首次提交自动铸 session 标题(一次 cheap 调用)", { staticDefault: "true", danger: BILL, configKey: "sessionAutoTitle" }),
     r("SESSION_BACKEND", "store", "enum", "session 店引擎(auto=配了该引擎的坐标就用那只库、没配就是内存;配了而此刻连不上 ⇒ 在 STORE_LOCK_WAIT_MS 窗内重试、到窗拒启,绝不落内存;回显=boot 解析后的真引擎)", { enumValues: SESSION_BACKENDS, danger: DATA, derivedDefaultNote: "缺席:显式 DB_BACKEND=mysql|pg ⇒ mysql,否则 memory", configKey: "sessionBackend", resolve: (c) => (c.sessionBackend === "tidb" ? "mysql" : c.sessionBackend) }),
     r("SESSION_CACHE_TTL_SEC", "store", "number", "session 读缓存 TTL(秒;0=关)", { staticDefault: "300", configKey: "sessionCacheTtlSec" }),

package/dist/config-invariants.d.ts

@@ -35,9 +35,9 @@ import { type EnvTableReplacementInput } from "./env-model-table-gate.js";
  */
 export declare const LIVENESS_HEARTBEAT_MS = 30000;
 /** 闭集:新增一条不变量必须在这里加词(拼错 = 编译红,而不是运行期悄悄不判)。 */
-export type CrossInvariantId = "run-stale-heartbeat" | "bind-posture" | "bake-runner-credential" | "direct-door-anchors" | "operator-principals-required" | "operator-single-user" | "bake-operator-principals" | "sensitive-write-patterns" | "leader-host-lane" | "multi-tenant-shared-lane" | "leader-durable-store" | "device-durable-store" | "device-durable-approval" | "model-provider-word" | "gateway-url-userinfo" | "anthropic-credential-exclusive" | "model-route-endpoint" | "default-model-resolvable" | "refused-names-not-minted" | "env-table-replacement-acknowledged" | "require-execution-lane" | "center-one-identity" | "workflow-park-decision-domain" | "remote-config-provider-url" | "retention-lane-complete";
+export type CrossInvariantId = "run-stale-heartbeat" | "bind-posture" | "bake-runner-credential" | "direct-door-anchors" | "operator-principals-required" | "operator-single-user" | "operator-declaration-required" | "bake-operator-principals" | "sensitive-write-patterns" | "leader-host-lane" | "multi-tenant-shared-lane" | "leader-durable-store" | "device-durable-store" | "device-durable-approval" | "model-provider-word" | "gateway-url-userinfo" | "anthropic-credential-exclusive" | "model-route-endpoint" | "default-model-resolvable" | "refused-names-not-minted" | "env-table-replacement-acknowledged" | "center-one-identity" | "workflow-park-decision-domain" | "remote-config-provider-url" | "retention-lane-complete";
 /** 表读的键集(取自平铺配置型 ⇒ 键名/类型永不与真配置漂)。 */
-export type CrossInvariantView = Readonly<Pick<ServiceConfigFlat, "runStaleSec" | "authToken" | "authTokens" | "allowUnauthedWrites" | "imageBakes" | "directApprovalDoor" | "durableApproval" | "approvalHmacKeys" | "principalJwtPubkeys" | "principalJwtIss" | "principalJwtAud" | "requirePrincipal" | "operatorPrincipals" | "operatorSingleUser" | "sensitiveWritePatterns" | "leaderEnabled" | "selfOrchestrationEnabled" | "workflowRunStoreBackend" | "remoteExec" | "requireExecutionLane" | "dbBackend" | "tidb" | "pg" | "envModel" | "gatewayBaseUrl" | "gatewayFallbackUrls" | "anthropic" | "models" | "modelRefusals" | "tiers" | "authBridgeIssuer" | "webAdmin" | "configProvider" | "retentionPolicy" | "retentionSweep">>;
+export type CrossInvariantView = Readonly<Pick<ServiceConfigFlat, "runStaleSec" | "authToken" | "authTokens" | "allowUnauthedWrites" | "imageBakes" | "directApprovalDoor" | "durableApproval" | "approvalHmacKeys" | "principalJwtPubkeys" | "principalJwtIss" | "principalJwtAud" | "requirePrincipal" | "operatorPrincipals" | "operatorSingleUser" | "sensitiveWritePatterns" | "leaderEnabled" | "selfOrchestrationEnabled" | "workflowRunStoreBackend" | "remoteExec" | "dbBackend" | "tidb" | "pg" | "envModel" | "gatewayBaseUrl" | "gatewayFallbackUrls" | "anthropic" | "models" | "modelRefusals" | "tiers" | "authBridgeIssuer" | "webAdmin" | "configProvider" | "retentionPolicy" | "retentionSweep">>;
 export interface CrossInvariantInput {
     /** 现役配置(boot 期 = 候选自身)。 */
     readonly live: CrossInvariantView;
@@ -65,7 +65,7 @@ export interface CrossInvariant {
 }
 /**
  * ── [ref] ① 推广(车 UZ 推广轮):**拒因句单铸点**是一类 —— 下面五只是 `config.ts` 区里五条跨域拒启的**判据 + 句子的唯一属主**
- * (`executionLaneRequiredRefusal` / `modelProviderRefusal` 同形):boot 的 throw(`config.ts`,锚在那儿)与注册表条目的 `check` **都调它**,
+ * (`modelProviderRefusal` 同形):boot 的 throw(`config.ts`,锚在那儿)与注册表条目的 `check` **都调它**,
  * 没有第二份文本可漂。修前这五条逐条两份不同的句子(boot 手写一份、表里另写一份),boot 那份是运维在 stderr 读到的(`config-validation.test.ts`
  * 钉着它的指纹),表那份只在热路径上被调 —— 而热键集带不上这些键 ⇒ 实际无读者。句子**取 boot 那份**(逐字不变);类钉 =
  * `test/config-hot/batch1-cross-invariants.test.ts` 的「类钉」一格(每条带 `bootAnchor` 的条目,boot 点不手写句子、且来自注册表本人或 check 同调的函数)。
@@ -84,6 +84,16 @@ export declare function operatorPrincipalsRequiredRefusal(v: Pick<CrossInvariant
  * 只在单用户形、名单为空时成立:多租形没有「单一用户」(声明会把每个租户都变成运维);名单非空时两个来源答同一个问题。两形都拒,句子点名两根旋钮与出路。
  */
 export declare function operatorSingleUserRefusal(v: Pick<CrossInvariantView, "operatorSingleUser" | "requirePrincipal" | "operatorPrincipals">): string | undefined;
+/**
+ * `operator-declaration-required`([ref])—— **单用户部署必须说出谁是运维**。单用户形(租户轴不成立,`DEPLOYMENT_SHAPE_PREDICATES.multiTenant`)上
+ * 「谁是运维」只有两种答法:`OPERATOR_SINGLE_USER=true`(每个调用方都是)或具名 `OPERATOR_PRINCIPALS`;两样都没有 = 没人能用这台部署的运维面
+ * (审批队列全量、诊断、outcomes、管理与记忆治理口),而升级前它是静默的 —— 本条把它变成起服拒,拒句一行给出两条出路。不加旋钮、不加宽限、不给缺省:
+ * 只有字面 `true` 是声明(`=false` 与缺席同判)。多租形不归本条:空名单 = 没人是运维是合法的多租姿态(durable 形另由 `operator-principals-required` 管)。
+ * 出路 A 只在单用户 ∧ 空名单时给出 —— 恰是 `operator-single-user` 放行的形;忘设 `REQUIRE_PRINCIPAL` 的团队机器不该照它把每个调用方变成运维,句子把它点出来。
+ * **两处调用、一只判据**:兜底座在装配运维面的地方(`createHttpServer`,装路由之前;所有装运维面者都过,嵌入方只过这一座,表条目的锚在这里);
+ * 服务入口另在起服第 1 段早拒(先于店连接与中心拉取)。不在 `loadConfig`:律管的是有运维面的进程,不装路由的 `run-local`(一次性 CLI,同读 `loadConfig`)不在射程。
+ */
+export declare function operatorDeclarationRefusal(v: Pick<CrossInvariantView, "requirePrincipal" | "operatorPrincipals" | "operatorSingleUser">): string | undefined;
 /** `bake-operator-principals`(IMAGE-API-DESIGN §P2.4a):bake 门是 build-host 无限制执行面,要**具名**运维 —— 空名单下要么没人用得了,要么(单用户声明)人人用得了。 */
 export declare function bakeOperatorPrincipalsRefusal(v: Pick<CrossInvariantView, "imageBakes" | "operatorPrincipals">): string | undefined;
 /**
@@ -133,6 +143,11 @@ export declare function remoteConfigProviderUrlRefusal(v: {
  * 留在扫车道自持门(`boot/retention-lane.ts`)。状态型:三键都只来自 env、运行期无写点 ⇒ 热路径上恒与 boot 同答。
  */
 export declare function retentionLaneRefusal(v: Pick<CrossInvariantView, "retentionPolicy" | "retentionSweep">): string | undefined;
+/**
+ * `run-stale-heartbeat` 的判据与拒因(唯一属主;[ref] ① 同形 —— 注册表条目的 `check` 与起服第 1 段的早拒都调它)。参数取窄 `Pick`:起服第 1 段手里是
+ * 合成之前的 raw 配置(执行车道还没定形),本条不读车道。
+ */
+export declare function runStaleHeartbeatRefusal(v: Pick<CrossInvariantView, "runStaleSec">): string | undefined;
 export declare const CONFIG_CROSS_INVARIANTS: readonly CrossInvariant[];
 /**
  * 按 id 取**一条**([ref]②:boot 面的单源化出口)。

package/dist/config-invariants.js

@@ -8,17 +8,17 @@ import { judgeEnvTableReplacement } from "./env-model-table-gate.js";
 import { WEB_ADMIN_ENV, httpUrlFlaws } from "@sema-agent/settings-schema";
 import { authBridgeIssuerOf } from "./auth-bridge.js";
 import { buildDisplaySafeUrl } from "./trace/redact.js";
-import { executionLaneCaps, executionLaneOf, executionLaneRequiredRefusal, REMOTE_EXEC_PROVIDER_WORDS } from "./execution-lane-caps.js";
+import { ALL_EXECUTION_LANES, executionLaneCaps } from "./execution-lane-caps.js";
 import { DEPLOYMENT_SHAPE_PREDICATES } from "./deployment-shape.js";
 export const LIVENESS_HEARTBEAT_MS = 30_000;
 const anyServiceAuth = (v) => Boolean(v.authToken) || Object.keys(v.authTokens ?? {}).length > 0;
 const mustNarrowBind = (v) => Boolean(v.allowUnauthedWrites) && !anyServiceAuth(v);
 const directDoorConjuncts = (v) => Boolean(v.directApprovalDoor) && Boolean(v.durableApproval) && v.approvalHmacKeys.length > 0 && v.principalJwtPubkeys.length > 0 && Boolean(v.principalJwtIss) && Boolean(v.principalJwtAud);
 function multiTenantSharedLaneRefusal(v) {
-    const lane = executionLaneOf(v.remoteExec?.provider);
+    const lane = v.remoteExec.provider;
     if (DEPLOYMENT_SHAPE_PREDICATES.laneSeparatesTenants.holds(v))
         return undefined;
-    const outlets = REMOTE_EXEC_PROVIDER_WORDS.filter((w) => executionLaneCaps(w).tenantSeparation === "supported");
+    const outlets = ALL_EXECUTION_LANES.filter((w) => executionLaneCaps(w).tenantSeparation === "supported");
     return (`REQUIRE_PRINCIPAL=true (multi-tenant posture) with the "${lane}" execution lane runs every tenant's Bash on one shared target — ` +
         `this lane does not separate tenants; set REMOTE_EXEC to ${outlets.join(" / ")}, or unset REQUIRE_PRINCIPAL for a single-user box`);
 }
@@ -56,6 +56,20 @@ export function operatorSingleUserRefusal(v) {
         return "OPERATOR_SINGLE_USER=true but OPERATOR_PRINCIPALS is also set — the two answer the same question (who is an operator) in two ways. Keep one: OPERATOR_SINGLE_USER=true (every caller of this single-user deployment) or OPERATOR_PRINCIPALS (only the named principals)";
     return undefined;
 }
+export function operatorDeclarationRefusal(v) {
+    if (DEPLOYMENT_SHAPE_PREDICATES.multiTenant.holds(v) || v.operatorPrincipals.length > 0 || v.operatorSingleUser === true)
+        return undefined;
+    return ("No operator is declared for this single-user deployment: REQUIRE_PRINCIPAL is off, OPERATOR_PRINCIPALS is empty and OPERATOR_SINGLE_USER is not true, " +
+        "so no caller could use its operator endpoints (the approval queues across owners, GET /v1/diagnostics/wiring, GET /v1/outcomes, the admin and memory-governance endpoints). " +
+        "Declare who operates it in one line: OPERATOR_SINGLE_USER=true (every caller of this single-user deployment is its operator) or OPERATOR_PRINCIPALS=<principal,...> (only the named principals); " +
+        "a worker called by more than one person is multi-tenant — set REQUIRE_PRINCIPAL=true instead (MIGRATION.md, invariant operator-declaration-required). Refusing to boot.");
+}
+function sameOperatorDeclaration(a, b) {
+    return (DEPLOYMENT_SHAPE_PREDICATES.multiTenant.holds(a) === DEPLOYMENT_SHAPE_PREDICATES.multiTenant.holds(b) &&
+        a.operatorSingleUser === b.operatorSingleUser &&
+        a.operatorPrincipals.length === b.operatorPrincipals.length &&
+        a.operatorPrincipals.every((p, k) => p === b.operatorPrincipals[k]));
+}
 export function bakeOperatorPrincipalsRefusal(v) {
     return v.imageBakes.enabled && v.operatorPrincipals.length === 0
         ? "IMAGE_BAKES_ENABLED=true but OPERATOR_PRINCIPALS is empty — the bake door runs build.sh on the privileged build host and needs named operators: with an empty list nobody can use it, and the single-user operator declaration would open it to every caller (world-writable RCE). Set OPERATOR_PRINCIPALS or disable bakes (IMAGE-API-DESIGN.md §P2.4a boot invariant)"
@@ -132,15 +146,18 @@ export function retentionLaneRefusal(v) {
     return (`RETENTION_SWEEP_INTERVAL_SEC=${intervalSec} arms the retention sweep lane, but ${gaps} — the lane would enumerate domains every tick and compute nothing. ` +
         "Set RETENTION_MAX_AGE_DAYS, or set RETENTION_SWEEP_INTERVAL_SEC=0 to leave the lane off. Refusing to boot.");
 }
+export function runStaleHeartbeatRefusal(v) {
+    return v.runStaleSec * 1000 <= LIVENESS_HEARTBEAT_MS
+        ? `runStaleSec (${v.runStaleSec}s) must exceed the ${LIVENESS_HEARTBEAT_MS / 1000}s liveness heartbeat — the reaper would race a run that is still heartbeating normally and reap live work`
+        : undefined;
+}
 export const CONFIG_CROSS_INVARIANTS = [
     {
         id: "run-stale-heartbeat",
         keys: ["runStaleSec"],
         restartReason: "run-stale-heartbeat",
         bootAnchor: { file: "src/boot/stage-01-config.ts", marker: "CROSS-INVARIANT:run-stale-heartbeat" },
-        check: ({ next }) => next.runStaleSec * 1000 <= LIVENESS_HEARTBEAT_MS
-            ? `runStaleSec (${next.runStaleSec}s) must exceed the ${LIVENESS_HEARTBEAT_MS / 1000}s liveness heartbeat — the reaper would race a run that is still heartbeating normally and reap live work`
-            : undefined,
+        check: ({ next }) => runStaleHeartbeatRefusal(next),
     },
     {
         id: "bind-posture",
@@ -181,6 +198,13 @@ export const CONFIG_CROSS_INVARIANTS = [
         bootAnchor: { file: "src/config.ts", marker: "CROSS-INVARIANT:operator-single-user" },
         check: ({ next }) => operatorSingleUserRefusal(next),
     },
+    {
+        id: "operator-declaration-required",
+        keys: ["requirePrincipal", "operatorPrincipals", "operatorSingleUser"],
+        restartReason: "operator-principals",
+        bootAnchor: { file: "src/http/server.ts", marker: "CROSS-INVARIANT:operator-declaration-required" },
+        check: ({ live, next }) => (sameOperatorDeclaration(live, next) ? undefined : operatorDeclarationRefusal(next)),
+    },
     {
         id: "bake-operator-principals",
         keys: ["imageBakes", "operatorPrincipals"],
@@ -203,20 +227,13 @@ export const CONFIG_CROSS_INVARIANTS = [
             }
         },
     },
-    {
-        id: "require-execution-lane",
-        keys: ["requireExecutionLane", "remoteExec"],
-        restartReason: "execution-lane",
-        bootAnchor: { file: "src/config.ts", marker: "CROSS-INVARIANT:require-execution-lane" },
-        check: ({ next }) => executionLaneRequiredRefusal(next),
-    },
     {
         id: "leader-host-lane",
         keys: ["leaderEnabled", "remoteExec"],
         restartReason: "leader-lane",
         bootAnchor: { file: "src/boot/execution-lane.ts", marker: "CROSS-INVARIANT:leader-host-lane" },
-        check: ({ next }) => next.leaderEnabled && next.remoteExec?.provider === "host"
-            ? "LEADER_ENABLED=true on the host execution lane (REMOTE_EXEC=host, CONFIG_PROVIDER=local with REMOTE_EXEC unset, or a " +
+        check: ({ next }) => next.leaderEnabled && next.remoteExec.provider === "host"
+            ? "LEADER_ENABLED=true on the host execution lane (REMOTE_EXEC=host, or a " +
                 "config.d/remote-exec.json host override) is refused: the leader wire pins ONE absolute workspace path " +
                 "(LEADER_WORKSPACE / the /home/user default) for every sub-worker, while the host adapter gives each env a " +
                 "DIFFERENT random directory — so N concurrent host workers would share one physical git worktree and " +
@@ -251,13 +268,13 @@ export const CONFIG_CROSS_INVARIANTS = [
         keys: ["remoteExec", "dbBackend", "tidb", "pg"],
         restartReason: "device-lane",
         bootAnchor: { file: "src/boot/execution-lane.ts", marker: "CROSS-INVARIANT:device-durable-store" },
-        check: ({ next }) => next.remoteExec?.provider === "device" && !((next.dbBackend === "mysql" && next.tidb !== undefined) || (next.dbBackend === "pg" && next.pg !== undefined))
+        check: ({ next }) => next.remoteExec.provider === "device" && !((next.dbBackend === "mysql" && next.tidb !== undefined) || (next.dbBackend === "pg" && next.pg !== undefined))
             ? `REMOTE_EXEC=device with DB_BACKEND=${next.dbBackend} and no SQL connection coordinates built is refused ` +
                 "[device-durable-store]: the device registry, the session↔device binding and the device audit trail are all " +
                 "SQL-backed — without a real SQL store the binding lives in this process only, so a restart forgets WHICH device " +
                 "a parked run must resume onto and a second replica cannot see it at all. Note DB_BACKEND alone is not enough: " +
                 "SESSION_BACKEND=memory (or auto with no MYSQL_HOST/PG_HOST) builds no coordinates at all. Configure a durable " +
-                "store (DB_BACKEND=mysql|pg + its *_HOST/*_USER/*_DATABASE), or unset REMOTE_EXEC " +
+                "store (DB_BACKEND=mysql|pg + its *_HOST/*_USER/*_DATABASE), or declare another lane (REMOTE_EXEC=none if the agent's tools need no execution environment) " +
                 "(device-executor-lane-v2 §4.7 boot invariant)"
             : undefined,
     },
@@ -266,11 +283,11 @@ export const CONFIG_CROSS_INVARIANTS = [
         keys: ["remoteExec", "durableApproval"],
         restartReason: "device-lane",
         bootAnchor: { file: "src/boot/execution-lane.ts", marker: "CROSS-INVARIANT:device-durable-approval" },
-        check: ({ next }) => next.remoteExec?.provider === "device" && !next.durableApproval
+        check: ({ next }) => next.remoteExec.provider === "device" && !next.durableApproval
             ? "REMOTE_EXEC=device without DURABLE_APPROVAL=true is refused [device-durable-approval]: a personal device goes " +
                 "offline (lid closed, network drop) at arbitrary points, so an in-flight approval that outlives the window MUST " +
                 "have a park exit — without the durable approval store there is none and the run is stuck with nowhere to persist. " +
-                "Set DURABLE_APPROVAL=true, or unset REMOTE_EXEC (device-executor-lane-v2 §4.7 boot invariant)"
+                "Set DURABLE_APPROVAL=true, or declare another lane (REMOTE_EXEC=none if the agent's tools need no execution environment) (device-executor-lane-v2 §4.7 boot invariant)"
             : undefined,
     },
     {

package/dist/config-lkg.d.ts

@@ -1,5 +1,5 @@
 import { type MigrationReceipt } from "@sema-agent/settings-schema/one-time-migrations";
-import type { PublishedPromptArtifact } from "@sema-agent/core";
+import { type PublishedPromptArtifact } from "@sema-agent/core";
 /** 落盘信封。`effective`/`etag` 逐字=当时的 fetchEffective 返回(JSON verbatim 面)。`formatVersion` 的语义见头注(5 = 载荷的 prompts 是中心层唯一的那种 wire 形)。 */
 export interface PersistedLkg {
     formatVersion: 5;

package/dist/config-lkg.js

@@ -2,10 +2,11 @@ import { promises as fs } from "node:fs";
 import { migrateEffectiveSnapshot } from "@sema-agent/settings-schema/one-time-migrations";
 import { formatConfigPath } from "@sema-agent/settings-schema";
 import { join, dirname, resolve } from "node:path";
-import { randomBytes } from "node:crypto";
+import { ensureDir } from "@sema-agent/core";
 import { judgeConfigCandidate } from "./web-admin-client/candidate-gate.js";
 import { centerStateBin } from "./center-credential.js";
 import { configRootOf } from "./sema-config-dir.js";
+import { atomicWriteFileAsync } from "./plugins/owner-only-file-mode.js";
 export function defaultSkillCacheDir(config) {
     return join(configRootOf(config), "skill-cache");
 }
@@ -28,10 +29,8 @@ export function lkgReadDenyRows(configLkgPath) {
 }
 export async function saveLkg(path, worker, identity, effective, etag) {
     const body = { formatVersion: 5, savedAt: new Date().toISOString(), worker: worker ?? "global", identity, ...(etag !== undefined ? { etag } : {}), effective };
-    const tmp = `${path}.${randomBytes(6).toString("hex")}.tmp`;
-    await fs.mkdir(dirname(path), { recursive: true });
-    await fs.writeFile(tmp, JSON.stringify(body), { mode: 0o600 });
-    await fs.rename(tmp, path);
+    ensureDir(dirname(path));
+    await atomicWriteFileAsync(path, JSON.stringify(body), { durability: "best-effort" });
 }
 export async function loadLkg(path, worker, identity) {
     let text;
@@ -153,7 +152,7 @@ function lkgPayloadShapeProblem(effective, etag) {
     const eff = effective;
     if (typeof eff.version !== "number")
         return "bad effective.version";
-    for (const [domain, arrayKey] of [["models", "models"], ["skills", "skills"], ["mcp", "servers"], ["scenarios", "scenarios"], ["limits", null]]) {
+    for (const [domain, arrayKey] of [["models", "models"], ["skills", "skills"], ["mcp", "servers"], ["a2a", "peers"], ["scenarios", "scenarios"], ["limits", null]]) {
         const v = eff[domain];
         if (v === undefined)
             continue;

package/dist/config-provider.d.ts

@@ -210,8 +210,8 @@ export declare function createConfigProvider(input: ConfigProviderInput): Config
  * (`composeExecutionLane` 的 `localRoot`)—— 修前两个入口各写一份这条链(run-local 还多一个与之等价的三元),工厂又在
  * 字面 `"local"` 之外回落 `process.cwd()`。
  *
- * ⚠️ 与**数据根**(`config.localDataRoot`,多一节 `LOCAL_DATA_ROOT`)不是同一条链:两根分家的那一形由第 1 段的
- * `local_roots_split` 告警说出来(`splitLocalRoots`),合一旋钮 = `CONFIG_LOCAL_DIR`。
+ * ⚠️ 与**数据根**(`config.localDataRoot`,多一节 `LOCAL_DATA_ROOT`)不是同一条链:两根一声不响分家的那一形(没给 `CONFIG_LOCAL_DIR`)由第 1 段的
+ * `local_roots_split` 告警说出来(`splitLocalRoots`),合一旋钮 = `CONFIG_LOCAL_DIR`(给出即是表态,等 = 合一,不等 = 有意分家,都不响)。
  */
 export declare function configLocalRoot(config: {
     readonly configLocalDir?: string | undefined;

package/dist/config-provider.js

@@ -169,6 +169,7 @@ export function mapToServiceEffective(eff, version) {
                 tier: m.tier,
                 ...(m.reasoning !== undefined ? { reasoning: m.reasoning } : {}),
                 ...(m.vision !== undefined ? { vision: m.vision } : {}),
+                ...(m.thinkingLevelMap !== undefined ? { thinkingLevelMap: m.thinkingLevelMap } : {}),
                 ...(m.contextWindow !== undefined ? { contextWindow: m.contextWindow } : {}),
                 ...(m.maxTokens !== undefined ? { maxTokens: m.maxTokens } : {}),
                 ...(typeof m.autoCompactTokens === "number" ? { autoCompactTokens: m.autoCompactTokens } : {}),
@@ -187,6 +188,7 @@ export function mapToServiceEffective(eff, version) {
         },
         ...(eff.collab?.templates?.length ? { collab: { templates: eff.collab.templates } } : {}),
         ...(eff.plugins?.plugins?.length ? { plugins: { plugins: eff.plugins.plugins } } : {}),
+        a2a: eff.a2a,
         skills: {
             skills: (eff.skills.skills ?? []).map((s) => ({
                 name: s.name,