@sema-agent/server 7.146.0 → 7.147.0

package/dist/config-types.d.ts

@@ -22,7 +22,7 @@ import type { GitApiKind } from "./git-api-kind.js";
 import type { CustomPkgSource } from "./sandbox-pkg-source.js";
 import type { MemoryEngineBackend, StoreBackend as StoreBackendWord } from "@sema-agent/settings-schema/execution-lanes";
 import { DRAIN_GRACE_FLOOR_MS } from "@sema-agent/settings-schema/fleet";
-import type { AtMention, SandboxGitConfig } from "@sema-agent/settings-schema";
+import type { AtMention, ProjectRegistration, SandboxGitConfig } from "@sema-agent/settings-schema";
 import type { ModsDeclaration } from "./mods-declaration.js";
 /** [ref]:记忆向量面的 embedder 坐标(env `MEMORY_EMBEDDER_*` 解析结果;单一属主 = 本类型,
  *  `plugins/memory-embedder.ts` 的工厂直接消费它,不复制形状)。语义与三问见
@@ -39,6 +39,9 @@ export interface MemoryEmbedderConfig {
     timeoutMs: number;
     /** 可选 Bearer(自托管 TEI/vllm/ollama 通常不需要;公有云端点需要)。 */
     apiKey?: string;
+    /** 运维已确认「记下的身份与本身份对不上时,清掉向量列、按本身份重嵌」(env `MEMORY_EMBEDDER_REEMBED=<model>/<dimensions>`,
+     *  config 层已判过它恰好点名本身份)。缺席 = 未确认 ⇒ 指纹门对不上就拒启、一行不清。只交给指纹门,不是 transport 参数。 */
+    reembedConfirmed?: true;
 }
 /**
  * [ref] §4 —— 托管留存的**灰度档**闭集。`as const` 数组是词表的唯一真源(config 解析、能力位、审计行
@@ -503,6 +506,159 @@ export interface ImageBakeConfig {
 /** Service configuration, read from environment — the **平铺面**(the ONE storage location for every
  *  field). `ServiceConfig` (bottom of this file) = this flat face **plus** nine read-only group views;
  *  fixtures that CONSTRUCT a config literal build this type and hand it to `attachConfigGroups`. */
+/**
+ * The deployment's execution lane, as COMPOSED ([ref] v1b + [ref]; PEER adapters). Every deployment names it: the env
+ * `REMOTE_EXEC` (one lane word), or — with `CONFIG_PROVIDER=local` — `config.d/remote-exec.json`; the execution-lane composition step
+ * (`boot/execution-lane.ts`) refuses to start when neither declares one. `ServiceConfig.remoteExec` is therefore always present; only the raw
+ * shape `loadConfig()` returns ({@link LoadedConfig}) may lack it. `none` = the agent's tools get no execution environment (no factory,
+ * no `executionEnv`). Secrets (apiKey/privateKey) ONLY from env.
+ *   - `e2b`  → per-task E2B Firecracker VM (isolated, suspendable). The default code-agent worker.
+ *   - `k8s`  → per-task Kata pod on our k3s (isolated, NOT suspendable — no managed memory
+ *              snapshot). Self-hosted sandbox lane; auth = explicit K8S_* env or in-cluster service account.
+ *   - `ssh`  → a real host over SSH (NOT isolated/suspendable; [ref] §5). AI-orchestrated batch deploy.
+ *   - `adb`  → a real device over ADB (NOT isolated/suspendable). On-device APP testing.
+ */
+export type RemoteExecConfig = {
+    provider: "e2b";
+    apiKey: string;
+    template?: string;
+    timeoutMs?: number;
+    livenessMs?: number;
+    allowInternetAccess?: boolean;
+    /** [ref] —— `E2B_SANDBOX_ENV=NAME,NAME` 点到、且本进程环境里真有的键 ⇒ 原值(经唯一的「点名放行」谓词 `allowlistedEnv`,
+     *  空串值照带)。键缺席 = 旋钮未设 / 空串;名单形错(空段 / 非变量名形 / 点名名单型旋钮)拒启,源里没有的名按序号 warn。 */
+    sandboxEnv?: Record<string, string>;
+    mountPath?: string;
+    /** [ref]:崩溃遗留沙盒回收腿(E2B_ORPHAN_RECLAIM,默认 true;判据与 v1 边界见
+     *  plugins/e2b-orphan-reclaim.ts 头注)。 */
+    orphanReclaim?: boolean;
+} | {
+    provider: "k8s";
+    image: string;
+    apiUrl?: string;
+    token?: string;
+    caCert?: string;
+    insecureTls?: boolean;
+    /** `K8S_NAMESPACE` — the namespace the sandbox pods live in. REQUIRED, no default: the loader refuses to start when `REMOTE_EXEC=k8s` names the
+     *  lane without it, so this arm never carries an absent namespace and no consumer needs a fallback of its own. */
+    namespace: string;
+    runtimeClass?: string;
+    mountPath?: string;
+    timeoutMs?: number;
+    /** `K8S_LIVENESS_MS` — the lane's liveness bound (ms; the `E2B_LIVENESS_MS` twin, same parser; absent ⇒ the adapter's
+     *  default 120 s): cuts a command silent for this long ONLY when its caller stated no timeout (`exec-bounds.ts`). */
+    livenessMs?: number;
+    /** Resource-profile knobs: sandbox pod limits (adapter defaults: 2Gi / 1 cpu). */
+    memory?: string;
+    cpu?: string;
+    /** `K8S_SANDBOX_IPV6`(闭集与缺省的属主 `sandbox-egress-policy.ts`):`disabled` ⇒ 沙箱 pod 级 sysctl 关 IPv6;`enabled` ⇒ pod spec 不带 sysctl。
+     *  loader 恒铸;可选只为手搓配置。 */
+    sandboxIpv6?: import("./sandbox-egress-policy.js").SandboxIpv6;
+    /** `K8S_SANDBOX_BROKER_IMAGE` — the member git-credential broker container's image (`containers[1]` of a member's sandbox pod; this
+     *  engine's own image is the recommended value — the broker is a program of this package at a fixed path, `broker/constants.ts`). Absent /
+     *  empty ⇒ the plane is off (`credentialPlane.sandboxGit` = `broker_image_unset`) and no pod carries a broker. */
+    brokerImage?: string;
+    /** `K8S_SANDBOX_ENV=NAME,NAME` 点到、且本进程环境里真有的键 ⇒ 原值(与 e2b 的 `sandboxEnv` 同名同形、同一只解析器、同一只谓词 `allowlistedEnv`,
+     *  空串值照带)。只进 pod 容器 env;装配点与包源派生 env 合并一处,显式名单胜。键缺席 = 旋钮未设 / 空串(零转发)。 */
+    sandboxEnv?: Record<string, string>;
+    s3Snapshot?: {
+        endpoint: string;
+        bucket: string;
+        accessKey: string;
+        secretKey: string;
+        region?: string;
+        keyPrefix?: string;
+        presignTtlSec?: number;
+    };
+    /** Workspace persistence by space key (`WORKSPACE_PERSIST`) and snapshots kept per space key (`WORKSPACE_SNAPSHOT_KEEP`).
+     *  The loader always mints both on this arm; optional only so hand-built configs may omit them. Effective policy =
+     *  the capability fact `workspaceSpace` (`capability-facts.ts`, the one reading: defaults applied there, absent store ⇒
+     *  unavailable). */
+    workspacePersist?: import("./workspace-space.js").WorkspacePersist;
+    workspaceSnapshotKeep?: number;
+    /** `WORKSPACE_SNAPSHOT_TIMEOUT_MS` — the lane's one data bound (`workspace-space.ts`); the loader always mints it, the boot
+     *  assembly hands it to the adapter as `dataTimeoutMs`, the capability fact reports it (`workspaceSync.timeoutMs`). */
+    workspaceSnapshotTimeoutMs?: number;
+    /** The build-cache volume per workspace space (`WORKSPACE_CACHE=volume`, `_SIZE`, `_MOUNT`; `workspace-cache.ts`); present iff
+     *  `volume`. Effective policy = the capability fact `workspaceCache`. */
+    workspaceCache?: import("./workspace-cache.js").WorkspaceCacheCapability;
+    /** `WORKSPACE_SNAPSHOT_EXCLUDE` — the snapshot's tar exclusion table (closed item form, `workspace-space.ts`); present iff
+     *  non-empty. Handed to the adapter's one tar upload (both snapshot lanes); never on the wire. */
+    workspaceSnapshotExclude?: readonly string[];
+} | {
+    provider: "ssh";
+    host: string;
+    port?: number;
+    username: string;
+    privateKey: string;
+    mountPath?: string;
+    hostKey?: {
+        fingerprintSha256?: string;
+        knownHostsPath?: string;
+    };
+} | {
+    provider: "adb";
+    serial: string;
+    adbPath?: string;
+    mountPath?: string;
+} | {
+    provider: "host";
+    workspaceBase?: string;
+    commandTimeoutMs?: number;
+} | {
+    provider: "none";
+} | {
+    provider: "device";
+    /** `DEVICE_DELIVERY_TIMEOUT_MS`(默认 10s)= 等在途槽的上限;到期 = `device.busy`(§5.5)。 */
+    deliveryTimeoutMs?: number;
+    /** `DEVICE_RECONNECT_GRACE_MS`(默认 120s)= 断连后在途不判丢的窗(§5.4 同 epoch 重连)。 */
+    reconnectGraceMs?: number;
+    /** `DEVICE_EXEC_TIMEOUT_MS`(默认 1800s)= 指令级默认超时;core 的 per-command `timeout` 可收紧。 */
+    execTimeoutMs?: number;
+    /** `DEVICE_MAX_INFLIGHT_PER_DEVICE`(§11-O3 clay 已裁 = 4)。 */
+    maxInflightPerDevice?: number;
+    /** `DEVICE_MAX_PREAUTH_PER_REMOTE`(默认 8;字面 `off` = 显式停用 per-remote 层)= 未鉴权
+     *  握手的 per-remote 并发帽([ref]/[ref]:帽键是裸 remoteAddress——XFF 反代 / 公司 NAT 部署
+     *  形会把全员折叠成单键,per-remote 层退化成共享预算而非公平层,`off` + 全局帽 64 是诚实形)。
+     *  坏值拒启([ref] A 档),词表与拒因见 config.ts `parseDevicePreAuthPerRemoteEnv`。 */
+    maxPreAuthPerRemote?: number | "off";
+    /** `DEVICE_TRUSTED_PROXY_CIDRS`([ref];缺席 = 名单空 = 不读任何代理头,帽键 = socket 对端)= per-remote 帽键的可信代理
+     *  名单(规范 CIDR 文本)。socket 对端落在名单内,汇聚端才读 `X-Forwarded-For`、取自右向左第一个名单外地址作帽键。
+     *  坏项拒启([ref] A 档),拒因见 config.ts `parseDeviceTrustedProxyCidrsEnv`;唯一消费点 = `boot/device-lane.ts` 透传汇聚端。 */
+    trustedProxyCidrs?: readonly string[];
+    /** `DEVICE_ENROLL_TOKEN_TTL_SEC`(§4.7 第五个旋钮;默认 900 = §7-T5 ① 的 15min)= enrollment
+     *  token 的有效期**时长**(整秒,自 **DB now** 起算 —— 时间权威是库,不是副本墙钟)。唯一消费点 =
+     *  签发动词 `POST /v1/devices/enroll-tokens`(`http/routes/devices.ts`);[ref] 之前它刻意未铸
+     *  (端点不存在 ⇒ 铸了就是一个「配了不生效」的死键,[ref] 病族),随该端点同批铸 + 接线。
+     *  域 = `[1, 86400]` 的十进制正整数,坏值**拒启**([ref] A 档;解析器 `parseDeviceEnrollTokenTtlEnv`)。
+     *  缺席 ⇒ 签发点的属主默认 900(不在 config 层抄第二份默认,与本族其余旋钮同姿势)。 */
+    enrollTokenTtlSec?: number;
+    /** `DEVICE_RELAY_URL` = 设备入口的运维声明,**必填**(缺席 / 空串 / 只含空白 ⇒ 配置期拒起:契约包车道表 device 行的必需键,同所有车道的必需键判官 `laneMissingEnv`;值的文法与凭据形由解析器 `parseDeviceRelayUrlEnv` 拒):
+     *  `{ kind: "url" }` = 设备连不到本引擎自己的地址(引擎在中继 / 网关之后)时该拨的那一个 ws(s) URL,**逐字**上能力面 `deviceExecutor.relayUrl`
+     *  (唯一消费点 `http/routes/capabilities.ts`);`{ kind: "none" }`(字面 `none`)= 没有中继,设备按本引擎地址 + `deviceExecutor.wsPath` 拨号,能力面不带 `relayUrl`。
+     *  必填的理由:「设备拨哪里」只有运维知道;缺席曾被读成「直拨」,于是撤掉中继声明而根会话行上还有设备绑定时,设备改拨引擎地址(入口已收窄则拨不到)、
+     *  绑定却留在格上 —— 缺席与「声明了直拨」是两件事,只有后者放行。`none` ∧ 有绑定 ⇒ 起服 warn 点名绑定数(`boot/device-lane.ts`)。
+     *  **不派生**:`FLEET_ADVERTISE_ADDRESS` 是对中心公告的地址(内网 pod IP / 容器别名),受众不是用户机器上的设备;从它拼出来的入口对设备多半不可达。
+     *  URL 形门 = ws / wss 绝对地址,无 userinfo / query / fragment、不带凭据形(值逐字上能力面),坏值**拒启**。 */
+    relay: DeviceRelayDeclaration;
+    /** `DEVICE_SUPERSEDE`(默认 `stale_only`)= 同 deviceId 二连的顶替策略(§5.2)。 */
+    supersede?: "stale_only" | "deny";
+} | {
+    provider: "local-docker";
+    image: string;
+    mountPath?: string;
+    dockerPath?: string;
+    dockerHost?: string;
+    memory?: string;
+    cpus?: number;
+    pidsLimit?: number;
+    dropAllCaps?: boolean;
+    network?: "none" | "bridge" | "host";
+    commandTimeoutMs?: number;
+    /** [ref] —— `DOCKER_SANDBOX_ENV=NAME,NAME` 点到、且本进程环境里真有的键 ⇒ 原值(与 e2b 的 `sandboxEnv` 同一只解析器、
+     *  同一只谓词;每条 `docker exec` 以 `-e K=V` 注入)。键缺席 = 旋钮未设 / 空串。 */
+    env?: Record<string, string>;
+};
 export interface ServiceConfigFlat {
     port: number;
     /** OpenAI-compatible model gateway base URL (without /chat/completions) — `MODEL_GATEWAY_BASEURL`.
@@ -646,17 +802,12 @@ export interface ServiceConfigFlat {
      *  Runner construction and re-expanded on every refresh-time plane swap (`Runner.swapDeps`) — HOT, same as
      *  models/roles; mutateInPlace keeps the reference. */
     tiers: Record<string, string>;
-    /** 142-S4(registry-core 0.10.0 projects 域):center 项目登记簿的 service 消费面 —
-     *  键=projectId(PROJECT_ID_REGEX,generic lowercase UUID)。消费点:①`memoryScopeFor` 第三参数
-     *  (projectId 在场 ⇒ 项目盘 v2 键 `proj:<tenant>/<projectId>`);②`defaultScopes` 作
-     *  `TaskSpec.memory.scopes` 的种子(v2 scope 键串,OPEN 值域——本表只登记不解释)。NO env source —
-     *  populated ONLY by applyEffective(mutateInPlace,boot+refresh 整表替换);env lane 恒空(INERT)。
-     *  ProjectRegistration 的审计字段(registeredBy/registeredAt/notes)不进 ServiceConfig(runtime 不消费)。 */
-    projects: Record<string, {
-        displayName?: string;
-        gitRemotes?: string[];
-        defaultScopes?: string[];
-    }>;
+    /** 项目登记簿(settings-schema `projects` 域):键 = projectId(小写规范 UUID),值 = settings-schema 的 `ProjectRegistration` **原样**
+     *  (本仓不持第二份项目型、不挑键 —— 形与判官只在 settings-schema)。读者:`GET /v1/projects` 读面(`http/routes/projects.ts`);
+     *  `defaultScopes` 作 `TaskSpec.memory.scopes` 的种子(v2 scope 键串,OPEN 值域 —— 本表只登记不解释)与 org 记忆准入的部署 scope 集。
+     *  NO env source —— 只由 applyEffective 经 settings-schema 的视图面读函数判过后填(mutateInPlace,boot + refresh 整表替换);
+     *  本地腿恒空(settings-schema 的本地读取集不收 `projects`)。 */
+    projects: Record<string, ProjectRegistration>;
     /** Role → model map (1.24): `subagent`/`summarize` → the cheap model when `MODEL_CHEAP_ID` is set
      *  (delegated children + compaction get cheap), `default` stays on the main model. Keys are the engine's role
      *  words (core `MODEL_ROLES`, six since 7.49.0). */
@@ -889,22 +1040,13 @@ export interface ServiceConfigFlat {
     /** 件A 目录 unavailable 退避窗(ms)——取数失败的退避语义(bound center hammering),不是策略负结果。
      *  默认 10s。env `MEMORY_ORG_UNAVAILABLE_BACKOFF_MS`(numEnvBounded)。 */
     memoryOrgUnavailableBackoffMs: number;
-    /** [ref] v1b + [ref]: opt-in remote execution backend (PEER adapters, chosen by REMOTE_EXEC). Unset
-     *  → in-process stub env ([ref]: this used to read "OA/review deployments", a scenario family retired wholesale
-     *  in 5.0.0 — see RETIRED_ENVS; the real discriminant is CONFIG_PROVIDER, and REQUIRE_EXECUTION_LANE turns this
-     *  arm into a boot refusal). Secrets (apiKey/privateKey) ONLY from env.
-     *   - `e2b`  → per-task E2B Firecracker VM (isolated, suspendable). The default code-agent worker.
-     *   - `k8s`  → per-task Kata pod on our k3s (isolated, NOT suspendable — no managed memory
-     *              snapshot). Self-hosted sandbox lane; auth = explicit K8S_* env or in-cluster service account.
-     *   - `ssh`  → a real host over SSH (NOT isolated/suspendable; [ref] §5). AI-orchestrated batch deploy.
-     *   - `adb`  → a real device over ADB (NOT isolated/suspendable). On-device APP testing. */
     /**
      * [ref]④ —— `REMOTE_EXEC_HOME_DIR`:**执行环境的 home 目录**(core `ExecutionEnv.homeDir`),
      * `~/…` 形权限规则(`Edit(~/.ssh/**)`)唯一的基,绝对路径。
      *
      * 部署级旋钮,**跨车道同一根**(不按 provider 分七根 —— 它回答的是同一个问题:「这条部署的手,
      * 跑在哪个用户的 home 下」)。显式声明**恒赢**;缺席时只有 home 属于车道本身的那几条车道有答案
-     * (host/in-process = `os.homedir()`、e2b = 平台固定用户),k8s/local-docker(镜像属性)、
+     * (host/none = `os.homedir()`、e2b = 平台固定用户),k8s/local-docker(镜像属性)、
      * ssh(目标机登录用户)、adb/device 一律缺席 ⇒ `~/` 规则在下单时被 422 响亮拒。
      * 声明与出厂答案都只是**主张**:读得出家目录的车道(device 之外的六条)在每只执行环境开起来时拿环境里命令看到的 `$HOME` 证它,
      * 不一致 / 读不出 ⇒ 那只环境不开(拒句点名两值与改法);device 读不了 ⇒ 声明即座,起服披露「来自声明、未实测」。
@@ -912,26 +1054,6 @@ export interface ServiceConfigFlat {
      * 非绝对路径 ⇒ **拒启**([ref] A 档;core 侧同判为 `config.execution_env_home_dir_invalid`)。
      */
     remoteExecHomeDir?: string;
-    /**
-     * [ref] —— `REQUIRE_EXECUTION_LANE`:**「没点名车道」要不要拒启**。默认 **false**(缺省行为逐字不变)。
-     *
-     * `REMOTE_EXEC` 未设/空串 **∧** `CONFIG_PROVIDER ≠ local` ⇒ {@link remoteExec} 缺席 ⇒ `boot/execution-env.ts`
-     * 一条工厂臂都不走 ⇒ core 的 `handsEnabled` 为 false ⇒ **整条手带一件不挂**,而任务照跑、回执
-     * `status=completed`。[ref] 的 fail-closed 门只咬「点了名却配不齐/认不出」,**「根本没点名」是文档化的
-     * 部署姿态**,所以那道门放行。
-     *
-     * 本键把那条姿态交回给运维表态:`true` ⇒ 装配尾**拒启**并点名该设什么(`config.ts` 跨域不变量区)。
-     * 🔴 **为什么默认 off**:今天正在无手运行而自己不知道的部署(根 `docker-compose.yml` / review compose /
-     * `--sandbox=kata` 档 / web-admin 编排器起的 worker)会**升级即挂**,而其中一部分只跑只读/分析任务、
-     * 今天「能用」。缺省翻面留到下一个 major,翻之前生态有一版时间适配。托管清单推荐开
-     * (`docs/DEPLOY-PREREQS.md`)。
-     * 运维读面(2026-09-22 主会话验收订正:车原写「`GET /v1/diagnostics/wiring` 的 `executionLane.requireExecutionLane`」,
-     * 而该端点当时**没有** `executionLane` 段、`src/` 零投影 —— 一句没兑现的承诺,按 [ref] 不信 JSDoc 只信实现行的纪律改写):
-     * boot 期 `exec_lane_selected` 一行(`config.ts` 装配尾,带 `lane` / `source`)+ `GET /v1/config/catalog` 的目录行。
-     * 本键的**有效值今天没有运行期读面**;要出就随 [ref] 的执行座三态在一处铸,不在这里单独长一位。
-     * ([ref] 起诊断面**有了** `executionLane` 段,但它就是能力面那一只投影 `{provider, toolsOnThisHost, isolated?}`,**不带**本键。)
-     */
-    requireExecutionLane: boolean;
     /**
      * 沙箱 git 平面的有效配置块(本部署经凭据代理路由哪些 git origin;契约 `SandboxGitConfig`:规范形 origin ≤ 16、两两不同、`connectUrl` 必 https、空表合法)。
      * **唯一来源 = 中心有效配置**(`/effective` 的 `sandboxGit`,web-admin 按部署登记册投影;无 env 旋钮,本地配置源没有这一块);唯一判官 = `stageEffective`
@@ -939,146 +1061,7 @@ export interface ServiceConfigFlat {
      * 热:读者(平面座 `sandbox-git-plane.ts` 的每一次读)逐次现读这一键,不捕获对象本身。缺席 = 没有这一块(与契约「可选、无默认」同一种缺席读法,不另设 null)。
      */
     sandboxGit?: SandboxGitConfig;
-    remoteExec?: {
-        provider: "e2b";
-        apiKey: string;
-        template?: string;
-        timeoutMs?: number;
-        livenessMs?: number;
-        allowInternetAccess?: boolean;
-        /** [ref] —— `E2B_SANDBOX_ENV=NAME,NAME` 点到、且本进程环境里真有的键 ⇒ 原值(经唯一的「点名放行」谓词 `allowlistedEnv`,
-         *  空串值照带)。键缺席 = 旋钮未设 / 空串;名单形错(空段 / 非变量名形 / 点名名单型旋钮)拒启,源里没有的名按序号 warn。 */
-        sandboxEnv?: Record<string, string>;
-        mountPath?: string;
-        /** [ref]:崩溃遗留沙盒回收腿(E2B_ORPHAN_RECLAIM,默认 true;判据与 v1 边界见
-         *  plugins/e2b-orphan-reclaim.ts 头注)。 */
-        orphanReclaim?: boolean;
-    } | {
-        provider: "k8s";
-        image: string;
-        apiUrl?: string;
-        token?: string;
-        caCert?: string;
-        insecureTls?: boolean;
-        /** `K8S_NAMESPACE` — the namespace the sandbox pods live in. REQUIRED, no default: the loader refuses to start when `REMOTE_EXEC=k8s` names the
-         *  lane without it, so this arm never carries an absent namespace and no consumer needs a fallback of its own. */
-        namespace: string;
-        runtimeClass?: string;
-        mountPath?: string;
-        timeoutMs?: number;
-        /** `K8S_LIVENESS_MS` — the lane's liveness bound (ms; the `E2B_LIVENESS_MS` twin, same parser; absent ⇒ the adapter's
-         *  default 120 s): cuts a command silent for this long ONLY when its caller stated no timeout (`exec-bounds.ts`). */
-        livenessMs?: number;
-        /** Resource-profile knobs: sandbox pod limits (adapter defaults: 2Gi / 1 cpu). */
-        memory?: string;
-        cpu?: string;
-        /** `K8S_SANDBOX_IPV6`(闭集与缺省的属主 `sandbox-egress-policy.ts`):`disabled` ⇒ 沙箱 pod 级 sysctl 关 IPv6;`enabled` ⇒ pod spec 不带 sysctl。
-         *  loader 恒铸;可选只为手搓配置。 */
-        sandboxIpv6?: import("./sandbox-egress-policy.js").SandboxIpv6;
-        /** `K8S_SANDBOX_BROKER_IMAGE` — the member git-credential broker container's image (`containers[1]` of a member's sandbox pod; this
-         *  engine's own image is the recommended value — the broker is a program of this package at a fixed path, `broker/constants.ts`). Absent /
-         *  empty ⇒ the plane is off (`credentialPlane.sandboxGit` = `broker_image_unset`) and no pod carries a broker. */
-        brokerImage?: string;
-        /** `K8S_SANDBOX_ENV=NAME,NAME` 点到、且本进程环境里真有的键 ⇒ 原值(与 e2b 的 `sandboxEnv` 同名同形、同一只解析器、同一只谓词 `allowlistedEnv`,
-         *  空串值照带)。只进 pod 容器 env;装配点与包源派生 env 合并一处,显式名单胜。键缺席 = 旋钮未设 / 空串(零转发)。 */
-        sandboxEnv?: Record<string, string>;
-        s3Snapshot?: {
-            endpoint: string;
-            bucket: string;
-            accessKey: string;
-            secretKey: string;
-            region?: string;
-            keyPrefix?: string;
-            presignTtlSec?: number;
-        };
-        /** Workspace persistence by space key (`WORKSPACE_PERSIST`) and snapshots kept per space key (`WORKSPACE_SNAPSHOT_KEEP`).
-         *  The loader always mints both on this arm; optional only so hand-built configs may omit them. Effective policy =
-         *  the capability fact `workspaceSpace` (`capability-facts.ts`, the one reading: defaults applied there, absent store ⇒
-         *  unavailable). */
-        workspacePersist?: import("./workspace-space.js").WorkspacePersist;
-        workspaceSnapshotKeep?: number;
-        /** `WORKSPACE_SNAPSHOT_TIMEOUT_MS` — the lane's one data bound (`workspace-space.ts`); the loader always mints it, the boot
-         *  assembly hands it to the adapter as `dataTimeoutMs`, the capability fact reports it (`workspaceSync.timeoutMs`). */
-        workspaceSnapshotTimeoutMs?: number;
-        /** The build-cache volume per workspace space (`WORKSPACE_CACHE=volume`, `_SIZE`, `_MOUNT`; `workspace-cache.ts`); present iff
-         *  `volume`. Effective policy = the capability fact `workspaceCache`. */
-        workspaceCache?: import("./workspace-cache.js").WorkspaceCacheCapability;
-        /** `WORKSPACE_SNAPSHOT_EXCLUDE` — the snapshot's tar exclusion table (closed item form, `workspace-space.ts`); present iff
-         *  non-empty. Handed to the adapter's one tar upload (both snapshot lanes); never on the wire. */
-        workspaceSnapshotExclude?: readonly string[];
-    } | {
-        provider: "ssh";
-        host: string;
-        port?: number;
-        username: string;
-        privateKey: string;
-        mountPath?: string;
-        hostKey?: {
-            fingerprintSha256?: string;
-            knownHostsPath?: string;
-        };
-    } | {
-        provider: "adb";
-        serial: string;
-        adbPath?: string;
-        mountPath?: string;
-    } | {
-        provider: "host";
-        workspaceBase?: string;
-        commandTimeoutMs?: number;
-        singleMachineDefault?: true;
-    } | {
-        provider: "device";
-        /** `DEVICE_DELIVERY_TIMEOUT_MS`(默认 10s)= 等在途槽的上限;到期 = `device.busy`(§5.5)。 */
-        deliveryTimeoutMs?: number;
-        /** `DEVICE_RECONNECT_GRACE_MS`(默认 120s)= 断连后在途不判丢的窗(§5.4 同 epoch 重连)。 */
-        reconnectGraceMs?: number;
-        /** `DEVICE_EXEC_TIMEOUT_MS`(默认 1800s)= 指令级默认超时;core 的 per-command `timeout` 可收紧。 */
-        execTimeoutMs?: number;
-        /** `DEVICE_MAX_INFLIGHT_PER_DEVICE`(§11-O3 clay 已裁 = 4)。 */
-        maxInflightPerDevice?: number;
-        /** `DEVICE_MAX_PREAUTH_PER_REMOTE`(默认 8;字面 `off` = 显式停用 per-remote 层)= 未鉴权
-         *  握手的 per-remote 并发帽([ref]/[ref]:帽键是裸 remoteAddress——XFF 反代 / 公司 NAT 部署
-         *  形会把全员折叠成单键,per-remote 层退化成共享预算而非公平层,`off` + 全局帽 64 是诚实形)。
-         *  坏值拒启([ref] A 档),词表与拒因见 config.ts `parseDevicePreAuthPerRemoteEnv`。 */
-        maxPreAuthPerRemote?: number | "off";
-        /** `DEVICE_TRUSTED_PROXY_CIDRS`([ref];缺席 = 名单空 = 不读任何代理头,帽键 = socket 对端)= per-remote 帽键的可信代理
-         *  名单(规范 CIDR 文本)。socket 对端落在名单内,汇聚端才读 `X-Forwarded-For`、取自右向左第一个名单外地址作帽键。
-         *  坏项拒启([ref] A 档),拒因见 config.ts `parseDeviceTrustedProxyCidrsEnv`;唯一消费点 = `boot/device-lane.ts` 透传汇聚端。 */
-        trustedProxyCidrs?: readonly string[];
-        /** `DEVICE_ENROLL_TOKEN_TTL_SEC`(§4.7 第五个旋钮;默认 900 = §7-T5 ① 的 15min)= enrollment
-         *  token 的有效期**时长**(整秒,自 **DB now** 起算 —— 时间权威是库,不是副本墙钟)。唯一消费点 =
-         *  签发动词 `POST /v1/devices/enroll-tokens`(`http/routes/devices.ts`);[ref] 之前它刻意未铸
-         *  (端点不存在 ⇒ 铸了就是一个「配了不生效」的死键,[ref] 病族),随该端点同批铸 + 接线。
-         *  域 = `[1, 86400]` 的十进制正整数,坏值**拒启**([ref] A 档;解析器 `parseDeviceEnrollTokenTtlEnv`)。
-         *  缺席 ⇒ 签发点的属主默认 900(不在 config 层抄第二份默认,与本族其余旋钮同姿势)。 */
-        enrollTokenTtlSec?: number;
-        /** `DEVICE_RELAY_URL` = 设备入口的运维声明,**必填**(缺席 / 空串 / 只含空白 ⇒ 配置期拒起:契约包车道表 device 行的必需键,同所有车道的必需键判官 `laneMissingEnv`;值的文法与凭据形由解析器 `parseDeviceRelayUrlEnv` 拒):
-         *  `{ kind: "url" }` = 设备连不到本引擎自己的地址(引擎在中继 / 网关之后)时该拨的那一个 ws(s) URL,**逐字**上能力面 `deviceExecutor.relayUrl`
-         *  (唯一消费点 `http/routes/capabilities.ts`);`{ kind: "none" }`(字面 `none`)= 没有中继,设备按本引擎地址 + `deviceExecutor.wsPath` 拨号,能力面不带 `relayUrl`。
-         *  必填的理由:「设备拨哪里」只有运维知道;缺席曾被读成「直拨」,于是撤掉中继声明而根会话行上还有设备绑定时,设备改拨引擎地址(入口已收窄则拨不到)、
-         *  绑定却留在格上 —— 缺席与「声明了直拨」是两件事,只有后者放行。`none` ∧ 有绑定 ⇒ 起服 warn 点名绑定数(`boot/device-lane.ts`)。
-         *  **不派生**:`FLEET_ADVERTISE_ADDRESS` 是对中心公告的地址(内网 pod IP / 容器别名),受众不是用户机器上的设备;从它拼出来的入口对设备多半不可达。
-         *  URL 形门 = ws / wss 绝对地址,无 userinfo / query / fragment、不带凭据形(值逐字上能力面),坏值**拒启**。 */
-        relay: DeviceRelayDeclaration;
-        /** `DEVICE_SUPERSEDE`(默认 `stale_only`)= 同 deviceId 二连的顶替策略(§5.2)。 */
-        supersede?: "stale_only" | "deny";
-    } | {
-        provider: "local-docker";
-        image: string;
-        mountPath?: string;
-        dockerPath?: string;
-        dockerHost?: string;
-        memory?: string;
-        cpus?: number;
-        pidsLimit?: number;
-        dropAllCaps?: boolean;
-        network?: "none" | "bridge" | "host";
-        commandTimeoutMs?: number;
-        /** [ref] —— `DOCKER_SANDBOX_ENV=NAME,NAME` 点到、且本进程环境里真有的键 ⇒ 原值(与 e2b 的 `sandboxEnv` 同一只解析器、
-         *  同一只谓词;每条 `docker exec` 以 `-e K=V` 注入)。键缺席 = 旋钮未设 / 空串。 */
-        env?: Record<string, string>;
-    };
+    remoteExec: RemoteExecConfig;
     /**
      * SVC-3 git-WORKTREE ISOLATION ([ref] CORE-6). Opt-in (WORKTREE_ISOLATION_ENABLED + WORKTREE_REPO_ROOT).
      * When set, the deployment's `executionEnvFactory` is wrapped so an agent core marks `isolation:"worktree"`
@@ -1366,11 +1349,12 @@ export interface ServiceConfigFlat {
     /** Principals allowed to act as OPERATORS (`OPERATOR_PRINCIPALS`): every operator face reads it through the one reading
      *  `explicitOperatorOk` (`http/principal-gate.ts`) — e.g. the F4 approval queue (`/v1/approvals`): list ANY owner's pending +
      *  decide. A non-operator principal may only LIST ITS OWN pending. **Empty = no one is an operator** ([ref]: the old
-     *  "empty = everyone on the approval queue" reading is gone); a single-user deployment that wants to be its own operator
-     *  declares {@link operatorSingleUser}. */
+     *  "empty = everyone on the approval queue" reading is gone). A single-user deployment must answer "who operates it" — a named list here or {@link operatorSingleUser}; neither ⇒ refusal
+     *  (`operator-declaration-required`: the server process refuses at boot stage 1, and `createHttpServer` refuses for every assembler, embedders included). */
     operatorPrincipals: string[];
     /** `OPERATOR_SINGLE_USER=true` —— 单用户形显式声明「这台部署的每个调用方都是运维」([ref],[ref] ① 裁 A)。缺席 = 不声明(没人是,除非在名单里)。
      *  只在单用户形(`REQUIRE_PRINCIPAL` 未开)且名单为空时成立 —— 否则拒启(`config-invariants.ts` 的 `operator-single-user`:一个事实一个来源)。
+     *  单用户形上它与具名名单二者必有其一,都没有 ⇒ 拒启(服务进程起服第 1 段;嵌入方在 `createHttpServer`;`operator-declaration-required`,[ref];`false` 与缺席同判)。
      *  env 独有(没有中心写位),起服冻结。读法只有 `explicitOperatorOk` / `operatorRosterPresent` 两只。 */
     operatorSingleUser?: boolean;
     /**
@@ -1680,6 +1664,13 @@ export interface ServiceConfigFlat {
      *  failed/stoppedBy=system(诚实终态,跨实例读面永不虚构存活)。core 契约要求 ≥10min(60s 心跳的
      *  安全裕度),**下限 10min 硬钳**。Default 15min。`BG_AGENT_STALE_RUNNING_MS`。 */
     backgroundAgentStaleRunningMs: number;
+    /** 会话驻留后台子代理的**停滞收割窗**(ms):一行 `running` 的会话驻留后台子代理最后一次工具活动距今超过它 ⇒ 引擎把行收成 `killed`(归因 `system`)、
+     *  run 中止(引擎的 `TaskRegistry.reapStaleSessionBackgroundAgents`;按静默判,不按年龄)。收割在 `/health.inflight` 计法表的读口上、数活之前做
+     *  (`session-resident-background.ts`)—— 判停四处与 `/health` 读同一只读口,于是阻断集里的后台子代理一项有了上界。
+     *  与 `backgroundAgentStaleRunningMs` 不是同一个窗:那只量**写者进程**的 60 s 心跳(进程死没死),这只量**子代**的工具活动(子代卡没卡),
+     *  一条 30 min 的工具调用就是 30 min 静默。缺省 = 下限 = `backgroundAgentStallFloorMs(…)` 的派生值(等人的四个窗取大 + 引擎单命令上限,
+     *  单用户 posture 下 ≈ 24 h 10 min),只许拉大,没有「关」。`BG_AGENT_STALL_MS`。 */
+    backgroundAgentStallMs: number;
     /** core 1.382([ref],[ref] 提货单④)`TaskRegistry.reconcileParkedAgents` 的 stale-claim 清算窗
      *  ——core 该整块逻辑被 `opts.staleClaimMaxAgeMs !== undefined` 门住,缺席 = **整块清算永不运行**
      *  (claim 后 claimer 进程崩死的行永久卡在"已 claim 不可再 claim"态,只能等 checkpoint TTL 自然过期;
@@ -1908,7 +1899,7 @@ export interface ServiceConfigFlat {
      *  under the shared-engine shape (several shell sessions on one config, engine rides the FIRST shell's process
      *  group per the T11 anti-orphan call) other live sessions may still be using this engine, so an unconditional
      *  drain kills a peer mid-turn (499) and 503s new submits. Instead SIGHUP arms an idle watch: shut down only
-     *  after `inflight()` (bg/resume legs + live streams — the blocking set `http + leader`; session-resident background shells/monitors are in the `/health.inflight` total but do not block) has been 0 for this long, WITHOUT flipping `draining`
+     *  after `inflight()` (bg/resume legs + live streams + background sub-agents that outlived their leg — the blocking set `http + leader + backgroundAgents`; session-resident background shells/monitors are in the `/health.inflight` total but do not block) has been 0 for this long, WITHOUT flipping `draining`
      *  (peers stay fully served). A true orphan (last window closed) self-terminates when the window expires —
      *  T11 stands, just bounded instead of immediate. A SECOND SIGHUP (or SIGTERM) escalates to the normal drain
      *  path. Default 120s, floor 5s. Env: SIGHUP_IDLE_GRACE_MS. */
@@ -2378,7 +2369,7 @@ export type ServiceMemoryConfig = Pick<ServiceConfigFlat, "memoryEngineEnabled"
  *  config 这一层它只是一句声明。 */
 export type ServiceAuthConfig = Pick<ServiceConfigFlat, "authToken" | "authTokens" | "allowUnauthedWrites" | "corsOrigins" | "principalHeader" | "requirePrincipal" | "autonomy" | "commandPolicy" | "compliancePosture" | "lockedConfigKeys" | "configCatalogEnabled" | "retentionPolicy" | "retentionSweep" | "operatorPrincipals" | "operatorSingleUser" | "serviceTokenActsForDeployment" | "principalJwtPubkeys" | "principalJwtIss" | "principalJwtAud" | "authBridgeIssuer" | "principalJwtMaxTtlSec" | "bindHost" | "bindHostSource">;
 /** 组:orchestration(编排 + 执行车道 + 沙箱面 + workflow/后台 agent 存留)。 */
-export type ServiceOrchestrationConfig = Pick<ServiceConfigFlat, "sandboxGit" | "remoteExec" | "remoteExecHomeDir" | "requireExecutionLane" | "worktreeIsolation" | "leaderEnabled" | "leaderFanoutEnabled" | "routerEnabled" | "selfOrchestrationEnabled" | "selfOrchestrationModels" | "selfOrchestrationWorkerIsolation" | "forkEnabled" | "experimentalObserverAgents" | "schedulerEnabled" | "schedulerSessionWakeup" | "schedulerSessionLifetime" | "schedulerStorePath" | "planModeEnabled" | "hooksTimeoutMs" | "workflowRunStoreBackend" | "workflowOrphanGraceMs" | "workflowJournalRetentionMs" | "workflowRunRetentionMs" | "usageWindows" | "workflowAgentsReadOnly" | "workflowSizeGuideline" | "backgroundAgentRetentionMs" | "backgroundAgentStaleRunningMs" | "backgroundAgentParkClaimStaleMs" | "delegationEntryCaps" | "rosterRetentionMs" | "leaderRunStaleMs" | "scratchpadSweepTtlMs" | "sandboxPkgSource" | "sandboxPkgSourceCustom" | "sessionAutoTitle" | "sessionAutoTitleSource" | "selectEnvironmentTool" | "envFactsEnabled" | "toolDeferLongtail" | "lspEnabled" | "lspHostEnabled" | "lspEnvAllow" | "imageBakes" | "readFace" | "readFaceSource" | "taskWriteFaceEscalation" | "readDenyPatterns" | "readDenyBuiltinTiers" | "readDenyBuiltinExclude" | "readDenyFloorRequired" | "sandboxReadFloor" | "agentConfigDir" | "configLkgPath" | "configLkgEnabled">;
+export type ServiceOrchestrationConfig = Pick<ServiceConfigFlat, "sandboxGit" | "remoteExec" | "remoteExecHomeDir" | "worktreeIsolation" | "leaderEnabled" | "leaderFanoutEnabled" | "routerEnabled" | "selfOrchestrationEnabled" | "selfOrchestrationModels" | "selfOrchestrationWorkerIsolation" | "forkEnabled" | "experimentalObserverAgents" | "schedulerEnabled" | "schedulerSessionWakeup" | "schedulerSessionLifetime" | "schedulerStorePath" | "planModeEnabled" | "hooksTimeoutMs" | "workflowRunStoreBackend" | "workflowOrphanGraceMs" | "workflowJournalRetentionMs" | "workflowRunRetentionMs" | "usageWindows" | "workflowAgentsReadOnly" | "workflowSizeGuideline" | "backgroundAgentRetentionMs" | "backgroundAgentStaleRunningMs" | "backgroundAgentStallMs" | "backgroundAgentParkClaimStaleMs" | "delegationEntryCaps" | "rosterRetentionMs" | "leaderRunStaleMs" | "scratchpadSweepTtlMs" | "sandboxPkgSource" | "sandboxPkgSourceCustom" | "sessionAutoTitle" | "sessionAutoTitleSource" | "selectEnvironmentTool" | "envFactsEnabled" | "toolDeferLongtail" | "lspEnabled" | "lspHostEnabled" | "lspEnvAllow" | "imageBakes" | "readFace" | "readFaceSource" | "taskWriteFaceEscalation" | "readDenyPatterns" | "readDenyBuiltinTiers" | "readDenyBuiltinExclude" | "readDenyFloorRequired" | "sandboxReadFloor" | "agentConfigDir" | "configLkgPath" | "configLkgEnabled">;
 /** 组:limitsHttp(HTTP 面 + 各类上限/配额/回收窗)。 */
 export type ServiceLimitsHttpConfig = Pick<ServiceConfigFlat, "port" | "attachmentOrphanGraceMs" | "workspaceFileMaxBytes" | "attachmentMaxBytes" | "attachmentMimeAllowlist" | "attachmentUnboundTtlMs" | "adoptionImportMaxSessions" | "adoptionImportMaxSessionBytes" | "infraCostRates" | "drainGraceMs" | "drainSecondSignalMinGapMs" | "sighupIdleGraceMs" | "parentPid" | "engineAutoExit" | "engineLingerMs" | "engineOrphanLingerMs" | "engineFirstAttachMs" | "engineHandoverLingerMs" | "rateLimitPerMin" | "runMaxConcurrent" | "runMaxConcurrentPerPrincipal" | "maxTaskCostUsd" | "maxTaskTokens" | "maxPrincipalCostUsd" | "costQuotaWindowSec" | "reapIntervalSec" | "runStaleSec" | "toolResultTtlSec">;
 /** 组:observability(可观测)。 */
@@ -2401,4 +2392,17 @@ export interface ServiceConfigGroups {
 /** Service configuration = 平铺面(唯一存储处,消费点原样) ∩ 九个组视图(additive,不可枚举)。 */
 export interface ServiceConfig extends ServiceConfigFlat, ServiceConfigGroups {
 }
+/**
+ * `loadConfig()` 的产物 —— **raw** 形(合成之前):执行车道可以缺席(env `REMOTE_EXEC` 未设;`CONFIG_PROVIDER=local` 下车道也可以由
+ * `config.d/remote-exec.json` 声明,读它是合成步的事)。缺席不是任何车道:读者不得把它折成某条车道。只有执行车道合成步
+ * (`boot/execution-lane.ts` 的 `composeExecutionLane`)把它收成 {@link ServiceConfig}(composed:`remoteExec` 必在)—— 没有显式声明 ⇒ 拒启。
+ * 装配链上合成之后的每一段、`createHttpServer`、run-local 只收 composed 形 ⇒ 漏调合成步的嵌入方 tsc 红(这就是通知)。
+ * 组视图 `orchestration` 与平铺面是同一个对象的两个取景器,所以车道位在两处一起放宽。
+ */
+export type LoadedConfig = Omit<ServiceConfig, "remoteExec" | "orchestration"> & {
+    remoteExec?: RemoteExecConfig;
+    orchestration: Omit<ServiceOrchestrationConfig, "remoteExec"> & {
+        remoteExec?: RemoteExecConfig;
+    };
+};
 //# sourceMappingURL=config-types.d.ts.map

package/dist/config.d.ts

@@ -1,13 +1,14 @@
 import { type Model, type PathRuleBases, type PermissionRule } from "@sema-agent/core";
 import { type ConfigProviderWord } from "./config-types.js";
 import { type CenterEndpoint } from "./web-admin-client/center-request.js";
+import { type ExecutionLane } from "./execution-lane-caps.js";
 import { type Autonomy } from "./runtime-governance.js";
 import { type RunnerEnvNameAllowlistKnob, type ServerEnvNameAllowlistKnob } from "./env-name-allowlist-knobs.js";
-import type { ServiceConfig, ServiceConfigFlat, ServiceConfigGroups } from "./config-types.js";
+import type { ServiceConfig, LoadedConfig, RemoteExecConfig, ServiceConfigFlat, ServiceConfigGroups } from "./config-types.js";
 /** [ref] A1: the config TYPE face lives in the leaf module config-types.ts; re-exported here so
  *  every existing `from "./config.js"` importer compiles unchanged (pure-type consumers should prefer
  *  importing config-types.js directly — a type-only leaf, no loader baggage). */
-export type { ServiceConfig, ScopedMcpServer, ImageBakeConfig, ServiceConfigFlat, ServiceConfigGroups, ServiceStoreConfig, ServiceModelPlaneConfig, ServiceApprovalConfig, ServiceMemoryConfig, ServiceAuthConfig, ServiceOrchestrationConfig, ServiceLimitsHttpConfig, ServiceObservabilityConfig, ServiceIntegrationsConfig, MemoryEmbedderConfig, // [ref]:embedder 坐标(plugins/memory-embedder.ts 消费同一属主类型)
+export type { ServiceConfig, LoadedConfig, RemoteExecConfig, ScopedMcpServer, ImageBakeConfig, ServiceConfigFlat, ServiceConfigGroups, ServiceStoreConfig, ServiceModelPlaneConfig, ServiceApprovalConfig, ServiceMemoryConfig, ServiceAuthConfig, ServiceOrchestrationConfig, ServiceLimitsHttpConfig, ServiceObservabilityConfig, ServiceIntegrationsConfig, MemoryEmbedderConfig, // [ref]:embedder 坐标(plugins/memory-embedder.ts 消费同一属主类型)
 A2aServeConfig, A2aServeSkill, RetentionMode, RetentionSweepConfig, MemoryConsolidationDriverConfig, } from "./config-types.js";
 export { RETENTION_MODES, MEMORY_CONSOLIDATION_MIN_INTERVAL_SEC } from "./config-types.js";
 /** Parse the AUTONOMY env into a validated autonomy mode. Unset/empty → undefined (unmanaged → no extra
@@ -113,7 +114,7 @@ export declare function drainConfigNotices(): ConfigNotice[];
  * 不许被悄悄猜成某一种意思)。
  *
  * 修前这根旋钮是开放词,而一个认不出的词在同一进程里被读成两种意思:配置源判官(`configProviderKind`)把它当 `local`
- * (读 `config.d/`、执行车道合成步照读 `remote-exec.json`),这里的隐式 host 臂与车道落点披露却按字面 `=== "local"`
+ * (读 `config.d/`、执行车道合成步照读 `remote-exec.json`),当时的隐式 host 臂与车道落点披露(7.147.0 随「车道恒具名」退役)却按字面 `=== "local"`
  * 判它**不是** local;web-admin 工厂同样按字面只在 `"local"` 上递本地根,于是配置源的根落回 `process.cwd()`、
  * 合成步读的是 `localRoot` —— 两个根分家。收成闭集 + 一个读点之后,这三处读的是同一个值。
  * 调用方两处、读的是同一张闭集:`loadConfig` 开头一次;`run-local` 在 `loadConfig` 之前一次(本入口只装本地配置源,词是 `remote` 就在这里拒 ——
@@ -187,6 +188,14 @@ export declare function buildUnpricedCeilingNotice(models: Record<string, Model>
     event: string;
     fields: Record<string, string>;
 } | undefined;
+/** 入口程序可以替部署声明的车道:不要坐标 env 之外的任何必需件的那两条(`host` 的坐标可选、`none` 零字段)。 */
+export type EntryDeclarableLane = Extract<ExecutionLane, "host" | "none">;
+/**
+ * 这两条车道的配置形(唯一铸点):env 声明了它们时由 {@link loadConfig} 的车道链调,入口程序自身声明它们时由执行车道合成步调 —— 坐标 env 同一读法。
+ * DUAL-MODE §5:`host` = 在这台机器上跑、无容器(坐标 `HOST_WORKSPACE_BASE` / `HOST_COMMAND_TIMEOUT_MS` 可选,无必需 env)。
+ * 契约 18.0.0:`none` = 部署声明「智能体的工具没有执行环境」(零字段、无必需 env)。
+ */
+export declare function entryDeclarableRemoteExec(lane: EntryDeclarableLane): RemoteExecConfig;
 /** [ref] N8/N9 — the BOOLEAN member of this module's env-parser family (`env`/`env2`/`numEnv`/
  *  `numEnvBounded`/`optFinitePositiveEnv`/`enumEnv`/`headerNameEnv`). Until now booleans were the
  *  one type parsed by a hand-written literal comparison at every single site, and that is exactly why the same
@@ -291,7 +300,9 @@ export declare function isRosterGateArmed(webAdmin: ServiceConfig["webAdmin"]):
  *     {@link findCcRuleFormNames}(它同时是 `allow` 腿的**唯一**判据,见下方例外说明)。
  *   - 退役名(`bash`/`Task`/`KillShell`…)与 pre-prefix 短名(`figma__x`):[ref](core 7.41.0 [ref])起判据是 core 导出的
  *     **那一只** `judgeRuleToolName`(准备阶段、两只会话规则店、本仓会话规则写口同调),本函数零手写臂;指引 = core 表给的现役指引 /
- *     补全协议前缀。
+ *     补全协议前缀。退役名里**没有后继**的那一种(判词 `retired` 不带 `currentName`:`TeamCreate` / `TaskOutput` / `MultiEdit`)不在拒面 ——
+ *     `namespaced-rule-name.ts` 的 `isRetiredWithoutSuccessor` 是唯一读法:**有通告席的表**({@link UnmatchableToolNameJudgment} 的 `noticeSeat`)上这一行不拒、原样留着,
+ *     读这张表的一方说一句(引擎读的请求规则桶由引擎通告;只有本服务读的运维 / 中心名单由装配处日志点名);没有通告席的表(请求体 `neverAuto`)照拒。
  *   - 够不着挂载工具的协议名:**对端段铸不出**(`mcp__github.com`、`mcp__github.com__*`、对端段里的部分通配 `mcp__git*`、超长 / 归一后带连串下划线的服务器段、对端段为空的
  *     `mcp__` / `mcp____x`)—— 前缀对,但引擎铸注册名时归一对端段,而规则对对端段逐字比,永不匹配。判官是引擎的 `judgeRuleToolName`(core 7.43.0 [ref] (b)
  *     的判词 `unmintable_segment`,句子带它的 guidance 与 1:1 现名);本仓 7.116.0–7.117.x 那只自比 `mintNamespacePrefix` 的对照随之退役。
@@ -353,6 +364,13 @@ export type UnmatchableToolNameJudgment = {
     readonly consumer: RuleEntryConsumer;
     readonly behavior: PermissionRule["behavior"];
     readonly pathBases?: PathRuleBases;
+    /**
+     * 这张表上退役且**无后继**的名字({@link isRetiredWithoutSuccessor})由谁说那一句:`engine` = 引擎准备期名字审计铸 `config.legacy_tool_name`
+     * (表经带名单投影的策略到达引擎:请求体 `settings.permissions.deny` / `ask`);`server` = 本服务读这张表的那一处落一行日志(运维 `APPROVAL_REQUIRE` /
+     * `DENY` / `NEVER_AUTO` 起服、中心 `governance.approvalRequire` 落配)。**在场才不拒**:不拒必须配恰一句话;缺席 = 这张表没有通告席(请求体
+     * `settings.permissions.neverAuto`:引擎不读这张表,它编成的策略不带名单投影)⇒ 照拒;放行那一天由本服务铸通告(引擎导出「条目 + 句」源之后),那时加第三个席位词。
+     */
+    readonly noticeSeat?: "engine" | "server";
 };
 /**
  * 「这张表里有永远不会生效的条目」的**判据与拒因句,同一只函数**(返回 `undefined` = 通过;拒 ⇒ 句子 + 被点名的条目)。
@@ -401,6 +419,47 @@ export declare function approvalGrantRefusal(names: unknown): string | undefined
 /** [ref] 车2 —— sweep 节律的上界(秒)。`setInterval` 的 delay 是 32 位有符号毫秒(2^31-1);越界会被
  *  Node **重置成 1ms**,理由与拒启判据见调用点。导出供判据与文档单点引用。 */
 export declare const RETENTION_SWEEP_INTERVAL_MAX_SEC: number;
+/** 域:orchestration(编排 + 执行车道)—— remoteExec 五车道/worktree 隔离、leader/router/scheduler/fork、
+ *  workflow 与后台 agent 的存留旋钮、沙箱面(pkg 源/env facts/LSP)、烤镜像门。 */
+/**
+ * 「按静默判死」的地板 = 引擎写者心跳(60 s)的十倍 —— 引擎给两只按静默收割的同一句参考:耐久行的 stale-running 翻转窗(`BG_AGENT_STALE_RUNNING_MS` 的硬钳)
+ * 与会话驻留后台子代理的停滞收割窗(`BG_AGENT_STALL_MS` 派生值的地板)。一句参考一个数。
+ */
+export declare const BG_AGENT_SILENCE_FLOOR_MS: number;
+/**
+ * `BG_AGENT_STALL_MS`(会话驻留后台子代理的停滞收割窗)的**缺省,同时是下限** —— 唯一计算处(装配读它当缺省与钳位,目录行的派生说明写它的公式,钉断言它)。
+ *
+ * 引擎按**工具活动**判静默(子代一次工具开始 / 结束算一拍),两拍之间可以合法地静默多久 = 一步:一轮模型输出,接一次工具调用(先在门上等人,再执行)。
+ * 本部署说得出上限的两段:
+ *  · 等人:四个等人窗取大 —— 活审批卡窗(`STREAM_ASK_WINDOW_MS`,单用户 posture 缺省 24 h)、没人在场时铸的审批卡窗(`UNREACHED_ASK_TTL_MS`)、
+ *    `AskUserQuestion` 窗(`QUESTION_TTL_MS`)、MCP elicitation 窗(`MCP_ELICITATION_TTL_MS`)。子代在这些窗里等人时行是 `running`(只有窗满之后的
+ *    耐久停驻才转 `parked`),窗不取大就会把一只等你回来批的子代当僵尸收掉。四个窗不按「这一门开没开」挑 —— 「开没开」的判在各门自己的装配点,
+ *    这里再判一次就是第二个读者;没开的门的窗只会让下限偏大(方向 = 多等),要收紧就调小那个窗(门没开时它本来就不起作用)。
+ *  · 执行:引擎给单条命令的上限(`resolveBashTimeoutCaps().maxMs`,引擎读法的唯一出口,缺省 600 s)。
+ * 不进派生的三类(这只窗的误杀面,补偿是把旋钮拉大):
+ *  · MCP 调用:引擎的时限缺省 1e8 ms(约 27.8 h,引擎刻意取大、交给任务级预算管;进程 env `MCP_TOOL_TIMEOUT` / `MCP_TOOL_TIMEOUT_TOTAL`),
+ *    读法不在引擎包根导出 —— 本服务另读那两个 env、另抄那个常数就是第二个读者;调用中的进度通知也不给本行打拍;
+ *  · 前台嵌套委派:子委派里的工具活动与等人都不给本行打拍(引擎只认带本行派生调用号的工具开始 / 结束),整段委派对本行是一次静默;
+ *  · 一轮模型输出的总时长(流式文本不打拍)。
+ * 另:引擎按墙钟(`Date.now()`)记最后一拍、也按墙钟量静默 —— 墙钟前跳或整机睡眠超过窗,醒来的第一读就会收掉睡前那一拍之后再没打拍的行。
+ * 地板 {@link BG_AGENT_SILENCE_FLOOR_MS}:两段都被调到很小时窗也不低于引擎的参考值。
+ */
+export declare function backgroundAgentStallFloorMs(f: {
+    readonly streamApproval: {
+        readonly windowMs: number;
+        readonly unreachedTtlMs: number;
+    };
+    /** 缺席 = 问答协调器的出厂窗(与协调器构造时的回落同一个常量)。 */
+    readonly questionThrottle?: {
+        readonly ttlMs: number;
+    } | undefined;
+    readonly mcpElicitation: {
+        readonly throttle: {
+            readonly ttlMs: number;
+        };
+    };
+    readonly commandCeilingMs: number;
+}): number;
 /** 域:limits+http(限额与 HTTP 面)—— 端口、附件/工作区体积与 TTL、成本与速率天花板、排空窗、回收周期。 */
 /**
  * [ref]:limitsHttp 组里**有下限**的三个数值旋钮的下限值 —— env 腿(夹取+点名)与 center 热腿(整批拒)
@@ -461,7 +520,11 @@ export declare const CONFIG_GROUP_KEYS: {
  *
  *  `loadConfig` 是主调用点;测试夹具(test/helpers/make-config.ts)构造 `ServiceConfigFlat` 后同样过它。 */
 export declare function attachConfigGroups(flat: ServiceConfigFlat): ServiceConfig;
-export declare function loadConfig(): ServiceConfig;
+/**
+ * env → **raw** 配置({@link LoadedConfig}):执行车道可以缺席(env 没有点名)。只有执行车道合成步(`composeExecutionLane`)把它收成
+ * {@link ServiceConfig} —— 车道必须来自显式声明(文件 / env / 入口程序自身),否则拒启;合成之前没有读者读车道。
+ */
+export declare function loadConfig(): LoadedConfig;
 /** 有效监听绑址([ref])。**显式 `BIND_HOST`/`HOST` 恒生效**(operator 保留在任何形下明示暴露的
  *  权利);未显式时:**无鉴权写面 ⇒ 127.0.0.1**,其余 ⇒ undefined(Node 默认全接口,既有部署零影响)。
  *