@sema-agent/server 7.146.0 → 7.147.0

package/dist/boot/execution-env.js

@@ -26,6 +26,7 @@ import { withRemoteScratchpad } from "../plugins/remote-scratchpad.js";
 import { FileSchedulerBackend, defaultSchedulerStorePath } from "../plugins/scheduler-support.js";
 import * as facts from "../capability-facts.js";
 import { materializeAttachmentsInto } from "../plugins/task-attachment-store.js";
+import { createAttachmentMaterializingFactory } from "../execution-env-purpose.js";
 import { reapOrphanWorktrees, withWorktreeIsolation } from "../plugins/worktree-isolation.js";
 import { derivePkgSourceEnv } from "../sandbox-pkg-source.js";
 import { effectiveHostWorkspace } from "../task-cwd.js";
@@ -37,7 +38,7 @@ import { workspaceSnapshotTimeoutOf } from "../workspace-space.js";
 import { sayEgressPolicyReading } from "../sandbox-egress-policy.js";
 import { sandboxPathEnvSlots, withSandboxPathEnvSlot } from "./deferred-sandbox-path-env.js";
 import { createLaneHomeAbsenceReporter } from "../lane-home-probe.js";
-import { REMOTE_EXEC_PROVIDER_WORDS, buildLaneHomeBootNote, buildLaneHomeClaim, capabilitiesFor, executionLaneOf, laneBindsReads, laneIsolated, laneSandboxReadFloorState } from "../execution-lane-caps.js";
+import { buildLaneHomeBootNote, buildLaneHomeClaim, capabilitiesFor, executionLaneOf, laneBindsReads, laneIsolated, laneSandboxReadFloorState } from "../execution-lane-caps.js";
 import { warnReadDenyFloorUnkept } from "./execution-lane.js";
 import { seatText } from "../trace/exit-seat.js";
 import { countSessionResidentBackground } from "../session-resident-background.js";
@@ -220,14 +221,7 @@ function persistNeedsOccupant(persist) {
             return false;
     }
 }
-function buildRealSystemNote(remoteExec) {
-    if (!DEPLOYMENT_SHAPE_PREDICATES.singleMachineDefaultLane.holds({ remoteExec }))
-        return "non-isolated target — actions are permanent; rely on the policy gate + HITL (design/61 §5)";
-    const sandboxLanes = REMOTE_EXEC_PROVIDER_WORDS.filter((lane) => laneIsolated(lane)).join("|");
-    return ("hands run on this machine with no OS sandbox (single-machine default: REMOTE_EXEC unset, CONFIG_PROVIDER=local) — actions are permanent, " +
-        "and the Bash read boundary is a text-level friction floor, not a safety boundary; the safety boundary is a sandbox lane: " +
-        `set REMOTE_EXEC=${sandboxLanes} (see docs/DEPLOY-PREREQS.md, section "S-281")`);
-}
+const REAL_SYSTEM_NOTE = "non-isolated target — actions are permanent; rely on the policy gate + HITL (design/61 §5)";
 function hostWorktreeUnwrappedRefusal() {
     return Object.assign(new Error('isolation "worktree" was requested but cannot be honored: this host lane has no worktree wrapper active ' +
         "(WORKTREE_ISOLATION_ENABLED=true together with WORKTREE_REPO_ROOT=<a git repository> turns it on; a repo root that does not exist or has no `.git` leaves it off — see the boot log), " +
@@ -251,7 +245,7 @@ export function createExecutionEnv(ctx) {
     let sandboxGitPlane = createSandboxGitPlaneSeat((r) => sandboxGitPlanePremisesOf(config, r), {});
     let worktreeReap;
     const workspaceFillOf = taskAttachmentStore === undefined ? undefined : (fctx) => createWorkspaceFill({ store: taskAttachmentStore, sessionId: fctx.sessionId, seeds: ownsItsWorkspace(fctx), logger });
-    if (config.remoteExec?.provider === "e2b") {
+    if (config.remoteExec.provider === "e2b") {
         executionEnvFactory = e2bExecutionEnvFactory({
             apiKey: config.remoteExec.apiKey,
             ...homeDirSeat, ...homeAbsentNotice,
@@ -267,7 +261,7 @@ export function createExecutionEnv(ctx) {
             metrics,
         }, ctx.laneDeps?.e2b);
     }
-    else if (config.remoteExec?.provider === "k8s") {
+    else if (config.remoteExec.provider === "k8s") {
         const k8sCfg = {
             image: config.remoteExec.image,
             ...homeDirSeat, ...homeAbsentNotice,
@@ -310,7 +304,7 @@ export function createExecutionEnv(ctx) {
             .then((gaps) => sayEgressPolicyReading(gaps, logger, k8sCfg.namespace))
             .catch((e) => logger.error("sandbox_egress_policy_check_crashed", { error: seatText("operator-log-text", e instanceof Error ? e.message : String(e)), effect: "the sandbox egress self-check did not complete this boot — the lane runs; the egress policy was not read" }));
     }
-    else if (config.remoteExec?.provider === "ssh") {
+    else if (config.remoteExec.provider === "ssh") {
         executionEnvFactory = sshExecutionEnvFactory({
             host: config.remoteExec.host,
             username: config.remoteExec.username,
@@ -319,9 +313,10 @@ export function createExecutionEnv(ctx) {
             ...(config.remoteExec.port != null ? { port: config.remoteExec.port } : {}),
             ...(config.remoteExec.mountPath ? { mountPath: config.remoteExec.mountPath } : {}),
             ...(config.remoteExec.hostKey !== undefined ? { hostKey: config.remoteExec.hostKey } : {}),
+            logger,
         });
     }
-    else if (config.remoteExec?.provider === "device") {
+    else if (config.remoteExec.provider === "device") {
         if (ctx.deviceLane) {
             executionEnvFactory = deviceExecutionEnvFactory({
                 hub: ctx.deviceLane.hub,
@@ -336,15 +331,16 @@ export function createExecutionEnv(ctx) {
             });
         }
     }
-    else if (config.remoteExec?.provider === "adb") {
+    else if (config.remoteExec.provider === "adb") {
         executionEnvFactory = adbExecutionEnvFactory({
             serial: config.remoteExec.serial,
             ...homeDirSeat, ...homeAbsentNotice,
             ...(config.remoteExec.adbPath ? { adbPath: config.remoteExec.adbPath } : {}),
             ...(config.remoteExec.mountPath ? { mountPath: config.remoteExec.mountPath } : {}),
+            logger,
         });
     }
-    else if (config.remoteExec?.provider === "host") {
+    else if (config.remoteExec.provider === "host") {
         {
             const schedulerStorePath = config.schedulerStorePath ?? defaultSchedulerStorePath(config);
             const hostScheduler = facts.hostScheduler(config).available
@@ -386,7 +382,7 @@ export function createExecutionEnv(ctx) {
             };
         }
     }
-    else if (config.remoteExec?.provider === "local-docker") {
+    else if (config.remoteExec.provider === "local-docker") {
         executionEnvFactory = localDockerExecutionEnvFactory({
             image: config.remoteExec.image,
             ...(config.remoteExec.mountPath ? { mountPath: config.remoteExec.mountPath } : {}),
@@ -402,6 +398,7 @@ export function createExecutionEnv(ctx) {
             ...(config.remoteExec.env ? { env: config.remoteExec.env } : {}),
             sandboxReadFloor: config.sandboxReadFloor,
             ...(workspaceFillOf !== undefined ? { workspaceFillOf } : {}),
+            logger,
         }, ctx.laneDeps?.localDocker);
     }
     if (executionEnvFactory && DEPLOYMENT_SHAPE_PREDICATES.remoteScratchpad.holds(config)) {
@@ -410,15 +407,15 @@ export function createExecutionEnv(ctx) {
     if (config.worktreeIsolation && executionEnvFactory) {
         const wtRoot = config.worktreeIsolation.repoRoot;
         const wtValid = existsSync(wtRoot) && existsSync(join(wtRoot, ".git"));
-        if (config.remoteExec?.provider === "host" && !wtValid) {
+        if (config.remoteExec.provider === "host" && !wtValid) {
             logger.error("worktree_isolation_disabled_bad_repo_root", {
                 repoRoot: wtRoot,
                 reason: existsSync(wtRoot) ? "not a git repository (no .git)" : "path does not exist",
                 note: "WORKTREE_ISOLATION_ENABLED is set but WORKTREE_REPO_ROOT is not a usable git repo — isolation left OFF; isolation:'worktree' workflow agents are refused (isolation.unavailable) until it is fixed. Fix the path or unset the flag.",
             });
         }
-        else if (config.remoteExec?.provider === "host") {
-            const gitBaseEnv = new RemoteHostExecutionEnv({ workspaceDir: config.worktreeIsolation.repoRoot, inheritEnv: "all", backgroundShell: config.requirePrincipal !== true });
+        else if (config.remoteExec.provider === "host") {
+            const gitBaseEnv = new RemoteHostExecutionEnv({ workspaceDir: config.worktreeIsolation.repoRoot, inheritEnv: "all", backgroundShell: config.requirePrincipal !== true, gitBase: true });
             executionEnvFactory = withWorktreeIsolation(executionEnvFactory, {
                 repoRoot: config.worktreeIsolation.repoRoot,
                 ...(config.worktreeIsolation.allowedRoots ? { allowedRoots: config.worktreeIsolation.allowedRoots } : {}),
@@ -444,7 +441,7 @@ export function createExecutionEnv(ctx) {
         }
         else {
             logger.warn("worktree_isolation_unsupported_lane", {
-                provider: config.remoteExec?.provider,
+                provider: config.remoteExec.provider,
                 note: "git-worktree isolation v1 covers only the 'host' lane — isolation:'worktree' is a no-op here (the base env is used). Worktree-rooted remote envs are a follow-on.",
             });
         }
@@ -456,37 +453,30 @@ export function createExecutionEnv(ctx) {
         executionEnvFactory = registry.wrapFactory(executionEnvFactory);
         return registry;
     })();
-    if (taskAttachmentStore && executionEnvFactory && !laneIsolated(executionLaneOf(config.remoteExec.provider))) {
-        const inner = executionEnvFactory;
+    if (taskAttachmentStore && executionEnvFactory && !laneIsolated(config.remoteExec.provider)) {
         const attStore = taskAttachmentStore;
-        executionEnvFactory = async (ctx) => {
-            const env = await inner(ctx);
-            const n = await materializeAttachmentsInto(env, attStore, ctx.sessionId);
-            if (n > 0)
-                logger.info("attachments_materialized", { sessionId: ctx.sessionId, count: n });
-            return env;
-        };
+        executionEnvFactory = createAttachmentMaterializingFactory(executionEnvFactory, (env, ctx) => materializeAttachmentsInto(env, attStore, ctx.sessionId), (sessionId, count) => logger.info("attachments_materialized", { sessionId, count }));
     }
     if (executionEnvFactory && DEPLOYMENT_SHAPE_PREDICATES.sandboxPathAdjudication.holds(config)) {
         executionEnvFactory = withSandboxPathEnvSlot(executionEnvFactory, sandboxPathEnvSlots, logger);
     }
     if (executionEnvFactory) {
-        const isolated = laneIsolated(executionLaneOf(config.remoteExec.provider));
+        const isolated = laneIsolated(config.remoteExec.provider);
         const suspendable = DEPLOYMENT_SHAPE_PREDICATES.suspendableHands.holds(config);
         const keepsReadFloor = capabilitiesFor(config).keepsReadFloor;
         const sandboxReadFloor = laneSandboxReadFloorState(config);
         const sandboxEnvKeys = [...sandboxEnvNamesInForce(config)].sort();
         logger.info("remote_exec_enabled", { provider: config.remoteExec.provider, isolated, suspendable, keepsReadFloor, ...(sandboxReadFloor !== undefined ? { sandboxReadFloor } : {}), ...(sandboxEnvKeys.length > 0 ? { sandboxEnvKeys } : {}) });
         if (!isolated)
-            logger.warn("remote_exec_real_system", { provider: config.remoteExec.provider, note: buildRealSystemNote(config.remoteExec) });
+            logger.warn("remote_exec_real_system", { provider: config.remoteExec.provider, note: REAL_SYSTEM_NOTE });
         const homeLine = buildLaneHomeBootNote(config);
         if (homeLine !== undefined)
             logger.warn(homeLine.event, { provider: config.remoteExec.provider, note: homeLine.note });
-        if (executionLaneOf(config.remoteExec.provider) === "host")
+        if (config.remoteExec.provider === "host")
             logger.info("task_inherit_env_honored", { honored: taskInheritEnvRefusal(config) === undefined });
     }
     warnReadDenyFloorUnkept(config, logger);
-    const lspProvider = config.remoteExec?.provider;
+    const lspProvider = config.remoteExec.provider;
     const lspLane = executionLaneOf(lspProvider);
     const lspLaneBindsReads = lspLane !== undefined && laneBindsReads(lspLane);
     if ((lspProvider === "e2b" || lspProvider === "k8s") && config.lspEnabled && !lspLaneBindsReads) {
@@ -509,6 +499,8 @@ export function createExecutionEnv(ctx) {
     if (lspManager)
         logger.info("lsp_enabled", { provider: lspProvider });
     const unreadableReported = new Set();
+    let stallReapFailureReported = false;
+    const stallMs = config.backgroundAgentStallMs;
     const sessionResidentBackground = () => countSessionResidentBackground(sessionScoped.sessionOwners, {
         onUnreadable: (sessionId, err) => {
             if (unreadableReported.has(sessionId))
@@ -516,6 +508,26 @@ export function createExecutionEnv(ctx) {
             unreadableReported.add(sessionId);
             logger.warn("session_resident_background_unreadable", { sessionId, counted: 1, err: seatText("operator-log-text", String(err)) });
         },
+        stall: {
+            stallMs,
+            report: (outcome) => {
+                switch (outcome.kind) {
+                    case "reaped":
+                        logger.warn("background_agent_stall_reaped", { reaped: outcome.count, stallMs });
+                        return;
+                    case "failed":
+                        if (stallReapFailureReported)
+                            return;
+                        stallReapFailureReported = true;
+                        logger.warn("background_agent_stall_reap_failed", { stallMs, err: seatText("operator-log-text", String(outcome.err)) });
+                        return;
+                    default: {
+                        const unhandled = outcome;
+                        throw new Error(`background agent stall reap: unknown outcome ${String(unhandled)}`);
+                    }
+                }
+            },
+        },
     });
     return {
         perTaskImage, sessionEnvSelection, perSessionCwd, setSessionCwd, setSessionShellEnv, setSessionInheritEnv,

package/dist/boot/execution-lane.d.ts

@@ -1,10 +1,31 @@
 import { type CrossInvariantView } from "../config-invariants.js";
-import type { ServiceConfig } from "../config-types.js";
-import { buildReadDenyFloorUnkeptNote } from "../execution-lane-caps.js";
+import type { LoadedConfig, ServiceConfig } from "../config-types.js";
+import { type EntryDeclarableLane } from "../config.js";
+import { buildReadDenyFloorUnkeptNote, type ExecutionLane } from "../execution-lane-caps.js";
 import type { Logger } from "../observability/logger.js";
-/** `config.d/remote-exec.json` 能写进来的车道(文件契约里不带密钥名、可 1:1 映射的两条;e2b/k8s/ssh/adb 要 NAME→值解析,尚未接线)。 */
-export declare const FILE_SOURCED_LANES: readonly ["host", "local-docker"];
+/** `config.d/remote-exec.json` 能写进来的车道(文件契约里不带密钥名、可 1:1 映射的三条 —— `none` 零字段;e2b/k8s/ssh/adb 要 NAME→值解析,尚未接线)。 */
+export declare const FILE_SOURCED_LANES: readonly ["host", "local-docker", "none"];
 export type FileSourcedLane = (typeof FILE_SOURCED_LANES)[number];
+/** 判点的拒句(一行;两条照旧行为的修法逐字在句中:7.146.0 非 local 未设 ⇒ `REMOTE_EXEC=none`,local 未设 ⇒ `REMOTE_EXEC=host`)。
+ *  车道词取自车道表(隔离与否读能力表的唯一布尔口 `laneIsolated`),不手抄清单。 */
+export declare const EXECUTION_LANE_UNDECLARED_REFUSAL: string;
+/**
+ * 一个**入口程序**(装配者)对车道说的两句话 —— 合成步对它们只有一条律:声明的先后 = 文件 > env > 入口自身,**在场的最高者终结选择**(文件在场 ⇒ 车道就是文件那一条,
+ * 解析不了即拒,不许 env / 入口顶上;文件缺席 ⇒ env;二者都缺席 ⇒ 入口自身);最终车道必须是入口跑得了的,否则拒(起任何任务之前)。
+ */
+export interface ExecutionLaneEntry {
+    /** 拒句点名的入口(`run-local` / `the HTTP service` …)。 */
+    readonly name: string;
+    /**
+     * 本入口跑得了的车道(闭集;HTTP 服务 = 全部八条,`run-local` = host 与 none —— 它没有容器 / 远程执行器,`none` 不要执行器)。
+     * 能从 `config.d/remote-exec.json` 取的 = 它 ∩ {@link FILE_SOURCED_LANES}(隔离车道 e2b / k8s / ssh / adb 要 NAME→值解析,文件腿尚未接线)。
+     */
+    readonly runs: readonly ExecutionLane[];
+    /** 入口自身的声明(入口 = 部署者,如 run-local ⇒ `host`):文件与 env 都没点名时才填,排在二者之后;缺席 = 本入口不替部署声明。不写进程 env。 */
+    readonly declares?: EntryDeclarableLane;
+}
+/** HTTP 服务这只入口:跑得了全部车道、不替部署声明(它的部署者是运维:声明只来自 env / 文件)。 */
+export declare const HTTP_SERVICE_LANE_ENTRY: ExecutionLaneEntry;
 export interface ExecutionLaneComposeCtx {
     /** 本入口的配置源形态(`configSourceKind` 的答案 —— 与它真建的 provider 同一只判据)。
      *  只有 `local` 才读文件;`undefined` = 纯 env 部署。 */
@@ -12,12 +33,19 @@ export interface ExecutionLaneComposeCtx {
     /** 配置根(与配置源同一个根,不分裂)。 */
     readonly localRoot: string;
     readonly logger: Logger;
-    /** 本入口**驱动得了**的文件车道。HTTP 服务两条都驱动;`run-local` 只驱动 host(它没有容器执行器)—— 文件写了本入口
-     *  驱动不了的车道 ⇒ 不写进 config,落「未接线」告警,env 腿的车道照旧(与 e2b/k8s/ssh/adb 的文件表态同一臂)。 */
-    readonly drivesFromFile: readonly FileSourcedLane[];
+    /** 装配这台部署的入口程序(跑得了哪些车道、自己声明哪一条)。 */
+    readonly entry: ExecutionLaneEntry;
 }
-/** 合成 + 判。覆写就地改写 `config.remoteExec`;坏文件 / 不变量不过 ⇒ 抛(拒启)。 */
-export declare function composeExecutionLane(config: ServiceConfig, ctx: ExecutionLaneComposeCtx): Promise<void>;
+/**
+ * 合成 + 判:raw 配置 → composed 配置(**同一个对象**就地覆写并收窄型,交回给装配链往下传)。没有声明 / 坏文件 / 不变量不过 ⇒ 抛(拒启)。
+ */
+export declare function composeExecutionLane(loaded: LoadedConfig, ctx: ExecutionLaneComposeCtx): Promise<ServiceConfig>;
+/**
+ * 合成步的**同步尾**(文件覆写之后的一切,恰此一份):入口声明补缺席位 → 入口跑不跑得了 → 判点 → 读面按最终车道派生 + 恰一行通告 → 车道交叉不变量 →
+ * `exec_lane_selected {lane}`。{@link composeExecutionLane} 在文件腿之后调它;没有文件腿的纯 env 形(`bench`、测试夹具)直接调它 —— 同一份合成,不是第二个判官。
+ * `entry` 缺席 = 这次装配没有入口程序替部署说话(嵌入方 / 脚本:车道只来自 env,跑得了的不设限)。
+ */
+export declare function composeDeclaredExecutionLane(loaded: LoadedConfig, logger: Pick<Logger, "info">, entry?: ExecutionLaneEntry): ServiceConfig;
 /**
  * **宿主车道的 shell 起服解析**(一次)—— 宿主车道(`provider === "host"`)的命令用本机 shell 起(win32 = Git Bash),起服时把它解析落定,
  * 找不到就在这里响亮地说一次(`warn host_shell_unavailable { err, remedy }`),而不是等第一个用户的第一条 Bash 撞上。

package/dist/boot/execution-lane.js

@@ -1,16 +1,62 @@
 import { loadRemoteExec } from "@sema-agent/settings-schema/node";
 import { assertLocalConfigDirTrusted } from "../config-dir-trust.js";
 import { crossInvariant } from "../config-invariants.js";
-import { buildReadDenyFloorUnkeptNote, executionLaneOf, laneIsolated } from "../execution-lane-caps.js";
+import { entryDeclarableRemoteExec } from "../config.js";
+import { ALL_EXECUTION_LANES, buildReadDenyFloorUnkeptNote, laneIsolated, laneWiresExecutionEnv } from "../execution-lane-caps.js";
 import { buildReadFacePostureNotice, settleDerivedReadFace } from "../read-face-posture.js";
 import { settleHostShellAtBoot } from "../plugins/host-platform.js";
 import { seatText } from "../trace/exit-seat.js";
-export const FILE_SOURCED_LANES = ["host", "local-docker"];
-export async function composeExecutionLane(config, ctx) {
+export const FILE_SOURCED_LANES = ["host", "local-docker", "none"];
+export const EXECUTION_LANE_UNDECLARED_REFUSAL = (() => {
+    const sandboxLanes = ALL_EXECUTION_LANES.filter((lane) => laneIsolated(lane));
+    const otherHandLanes = ALL_EXECUTION_LANES.filter((lane) => lane !== "host" && laneWiresExecutionEnv(lane) && !laneIsolated(lane));
+    return ("No execution lane is declared — every deployment names its execution lane: set REMOTE_EXEC (with CONFIG_PROVIDER=local, config.d/remote-exec.json also declares it). " +
+        "To keep what this deployment did before 7.147.0: REMOTE_EXEC=none when CONFIG_PROVIDER is not \"local\" (no execution environment — the agent's tool hands never mount), " +
+        "REMOTE_EXEC=host when CONFIG_PROVIDER=local (tools run directly on this machine with no OS sandbox). " +
+        `Or name a sandbox lane (${sandboxLanes.join(" | ")}) or ${otherHandLanes.join(" | ")} with that lane's required env. ` +
+        "CONFIG_PROVIDER only selects where configuration is read from; it does not select an execution lane.");
+})();
+export const HTTP_SERVICE_LANE_ENTRY = { name: "the HTTP service", runs: ALL_EXECUTION_LANES };
+function entryCannotRunLaneRefusal(entry, lane, source) {
+    return (`${source} declares the execution lane "${lane}", but ${entry.name} runs only ${entry.runs.join(" / ")} — it has no executor for "${lane}". ` +
+        `Refusing before any task starts rather than run on another lane: declare a lane ${entry.name} runs, or serve "${lane}" from an entry that runs it (the HTTP service runs every lane).`);
+}
+function fileLaneUnresolvableRefusal(entry, lane, envReading, root) {
+    return (`config.d/remote-exec.json under ${root} declares the execution lane "${lane}", but ${entry.name} reads "${lane}"'s coordinates only from REMOTE_EXEC env ` +
+        `(file-source name→value resolution is not wired yet), and ${envReading}. The file's declaration ends the lane selection: no other declaration may stand in for it. ` +
+        `Refusing before any task starts: set REMOTE_EXEC=${lane} with that lane's required env, or change the file to the lane you mean.`);
+}
+export async function composeExecutionLane(loaded, ctx) {
     if (ctx.configSource === "local")
-        await applyRemoteExecFile(config, ctx);
-    settleReadFaceForFinalLane(config, ctx.logger);
+        await applyRemoteExecFile(loaded, ctx);
+    return composeDeclaredExecutionLane(loaded, ctx.logger, ctx.entry);
+}
+export function composeDeclaredExecutionLane(loaded, logger, entry) {
+    if (entry !== undefined)
+        settleEntryLane(loaded, entry);
+    const config = requireDeclaredExecutionLane(loaded);
+    settleReadFaceForFinalLane(config, logger);
     assertExecutionLaneInvariants(config);
+    logger.info("exec_lane_selected", { lane: config.remoteExec.provider });
+    return config;
+}
+function requireDeclaredExecutionLane(loaded) {
+    if (!isComposed(loaded))
+        throw new Error(EXECUTION_LANE_UNDECLARED_REFUSAL);
+    return loaded;
+}
+function settleEntryLane(loaded, entry) {
+    const declaredByEntry = !isComposed(loaded) ? entry.declares : undefined;
+    if (declaredByEntry !== undefined)
+        loaded.remoteExec = entryDeclarableRemoteExec(declaredByEntry);
+    if (!isComposed(loaded))
+        return;
+    const lane = loaded.remoteExec.provider;
+    if (!entry.runs.includes(lane))
+        throw new Error(entryCannotRunLaneRefusal(entry, lane, declaredByEntry !== undefined ? `${entry.name} itself` : `REMOTE_EXEC=${lane}`));
+}
+function isComposed(config) {
+    return config.remoteExec !== undefined;
 }
 function settleReadFaceForFinalLane(config, logger) {
     if (!settleDerivedReadFace(config, config.requirePrincipal !== true))
@@ -20,14 +66,14 @@ function settleReadFaceForFinalLane(config, logger) {
         logger.info(notice.event, notice.fields);
 }
 export async function settleHostLaneShell(config, logger) {
-    if (config.remoteExec?.provider !== "host")
+    if (config.remoteExec.provider !== "host")
         return;
     await settleHostShellAtBoot(logger);
 }
 export function warnReadDenyFloorUnkept(config, logger) {
     const note = buildReadDenyFloorUnkeptNote(config);
     if (note !== undefined)
-        logger.warn("read_deny_floor_required_unkept", { provider: config.remoteExec?.provider, note });
+        logger.warn("read_deny_floor_required_unkept", { provider: config.remoteExec.provider, note });
 }
 export function assertExecutionLaneInvariants(config) {
     const judge = (id) => crossInvariant(id).check({ live: config, next: config });
@@ -61,11 +107,12 @@ async function applyRemoteExecFile(config, ctx) {
     }
     if (!fileRx)
         return;
-    const preemptedLane = executionLaneOf(config.remoteExec?.provider);
-    const disclosePreemption = (winner) => {
+    const envDeclared = config.remoteExec?.provider;
+    const disclosePreemption = envDeclared === undefined ? (_winner) => { } : (winner) => {
+        const preemptedLane = envDeclared;
         if (winner === preemptedLane)
             return;
-        const downgrade = laneIsolated(preemptedLane) && !laneIsolated(winner);
+        const downgrade = laneIsolated(preemptedLane) && laneWiresExecutionEnv(winner) && !laneIsolated(winner);
         logger.warn("remote_exec_lane_preempted_by_file", {
             preemptedLane,
             effectiveLane: winner,
@@ -76,7 +123,7 @@ async function applyRemoteExecFile(config, ctx) {
                 (downgrade ? `. This is an ISOLATION DOWNGRADE: tasks run on a non-isolated target. Delete/fix the file, or unset the lane env if the file is the intended source.` : `. Delete/fix the file, or unset the lane env if the file is the intended source.`),
         });
     };
-    const drives = (lane) => ctx.drivesFromFile.includes(lane);
+    const drives = (lane) => ctx.entry.runs.includes(lane);
     if (fileRx.provider === "host" && drives("host")) {
         config.remoteExec = {
             provider: "host",
@@ -100,18 +147,25 @@ async function applyRemoteExecFile(config, ctx) {
         logger.info("remote_exec_from_file", { provider: "local-docker", root: localRoot, image: fileRx.image });
         return;
     }
+    if (fileRx.provider === "none" && drives("none")) {
+        config.remoteExec = { provider: "none" };
+        disclosePreemption("none");
+        logger.info("remote_exec_from_file", { provider: "none", root: localRoot });
+        return;
+    }
     const fileLane = fileRx.provider;
-    const sourceable = FILE_SOURCED_LANES.some((lane) => lane === fileLane);
+    if (!ctx.entry.runs.includes(fileLane))
+        throw new Error(entryCannotRunLaneRefusal(ctx.entry, fileLane, `config.d/remote-exec.json under ${localRoot}`));
+    if (envDeclared !== fileLane) {
+        const envReading = envDeclared === undefined ? "REMOTE_EXEC is not set" : `REMOTE_EXEC declares "${envDeclared}"`;
+        throw new Error(fileLaneUnresolvableRefusal(ctx.entry, fileLane, envReading, localRoot));
+    }
     logger.warn("remote_exec_file_isolated_lane_unwired", {
         provider: fileLane,
-        effectiveLane: preemptedLane,
-        reason: sourceable ? "entry-has-no-executor" : "needs-name-resolution",
-        note: sourceable
-            ? `config.d/remote-exec.json names "${fileLane}", but this entry has no executor for it (it drives ${ctx.drivesFromFile.join(" / ")} ` +
-                `from the file; the HTTP service drives ${FILE_SOURCED_LANES.join(" / ")}) — the env-derived lane above stays in force`
-            : `this entry drives ${ctx.drivesFromFile.join(" / ")} from config.d/remote-exec.json; "${fileLane}" (like the other isolated lanes ` +
-                `e2b / k8s / ssh / adb) is sourced from REMOTE_EXEC env until file-source NAME→value resolution lands (center field map) — the ` +
-                `env-derived lane above stays in force`,
+        reason: "needs-name-resolution",
+        note: `config.d/remote-exec.json and REMOTE_EXEC both declare "${fileLane}": this entry takes ${FILE_SOURCED_LANES.filter((lane) => ctx.entry.runs.includes(lane)).join(" / ")} ` +
+            `from the file; "${fileLane}" (like the other isolated lanes e2b / k8s / ssh / adb) takes its coordinates from REMOTE_EXEC env until file-source NAME→value ` +
+            `resolution lands (center field map) — the coordinates written in the file for it are not read`,
     });
 }
 //# sourceMappingURL=execution-lane.js.map

package/dist/boot/exit-boundary.d.ts

@@ -31,7 +31,7 @@ import type { Logger } from "../observability/logger.js";
  *
  * 一问一源:数与收读同一只 `includeRetained` 常量,core 的 `countRunningBackgroundShells` 与 `killAllBackgroundShellsNow` 又按同一只访问函数选行
  * (core 注:the count and the walk cannot drift)⇒ 这只数就是硬收面会交出的 `killed` 收据数。
- * **不是** `/health.inflightBreakdown.sessionResident`(`session-resident-background.ts`):那一项回答「引擎托管着多少会话驻留的活」,是总数里的一个分项 ——
+ * **不是** `/health.inflightBreakdown.sessionResident`(`session-resident-background.ts`):那一项回答「引擎托管着多少会话驻留的 shell / monitor」,是总数里的一个分项 ——
  * 只数围栏表里会话的、会话驻留的行(挂在 run 腿上的行算在 http 项里,数它是第二次;围栏外的会话它看不见);本函数整表数、不分会话,
  * 腿上的行、围栏外会话的行都在内。两问的关系 = 读得出时本数 ≥ 驻留项(驻留项的每一行都是本数的一行)。
  *

package/dist/boot/exit-last.js

@@ -2,6 +2,7 @@ import { existsSync, readFileSync, unlinkSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { z } from "zod";
 import { ENGINE_LANES } from "./engine-lease.js";
+import { OWNER_ONLY_FILE_MODE } from "../plugins/owner-only-file-mode.js";
 export const EXIT_LAST_FORMAT = 3;
 const ExitLastSchema = z.object({
     format: z.literal(EXIT_LAST_FORMAT),
@@ -22,7 +23,7 @@ export function exitLastPath(dataRoot) {
 export function writeExitLast(dataRoot, info) {
     try {
         const body = { format: EXIT_LAST_FORMAT, at: new Date().toISOString(), pid: process.pid, ...info };
-        writeFileSync(exitLastPath(dataRoot), JSON.stringify(body) + "\n");
+        writeFileSync(exitLastPath(dataRoot), JSON.stringify(body) + "\n", { mode: OWNER_ONLY_FILE_MODE });
     }
     catch {
     }

package/dist/boot/governance-seams.d.ts

@@ -48,7 +48,7 @@
  *
  * ## 件D 的边界(成文,别读成「数据会被删」)
  *
- * 三只被托管的 SQL 店(session / checkpoint / tool-result)的 `retention` 声明读一个事实 —— 留存扫车道开不开(`plugins/retention-store-sql.ts` 的
+ * 三只被托管的 SQL 店(session / checkpoint / tool-result)的 `retention` 声明读一个事实 —— 留存扫车道开不开(`plugins/retention-declaration.ts` 的
  * `retentionSweepRuns`):开 ⇒ `managed`,关(缺省)⇒ `none`;local 形的店恒声明 `none`。删除的执行面是扫车道(`boot/retention-lane.ts`)与 SQL 店上的
  * 执行器,不在本装配点。所以本装配点对件D 只做两件事:①把策略与执行器递给 core 的启动期校验
  * (`assertRetentionCapability` —— 配对由引擎一个判官判:店声明 `managed` 而部署不跑执行器、执行器不是执行器,锁不锁都拒;锁着 + 店不能删 ⇒ 拒启,
@@ -83,7 +83,7 @@ export interface GovernanceSeamsCtx {
     /**
      * 交给引擎启动检查的留存执行器 —— 本部署跑扫车道 ⇒ 那只执行器(`backend.retention`),不跑 ⇒ `null`(必填:漏递即编译红,
      * 引擎对 `undefined` 也拒启)。「店说 managed」与「有执行器」的配对由引擎一个判官判(引擎 7.58.0:锁不锁都判);
-     * 店的词与这一格读同一个事实(`retention-store-sql.ts` 的 `retentionSweepRuns`),本仓不再另判一遍。
+     * 店的词与这一格读同一个事实(`retention-declaration.ts` 的 `retentionSweepRuns`),本仓不再另判一遍。
      */
     retentionExecutor: ManagedRetentionCapability | null;
 }

package/dist/boot/leader.js

@@ -34,7 +34,7 @@ export function createLeaderFace(ctx) {
             },
         }
         : {};
-    const leaderProvider = config.remoteExec?.provider;
+    const leaderProvider = config.remoteExec.provider;
     const leaderRunStore = ctx.backend?.leaderRun?.();
     assertLeaderDurableStore(config.leaderEnabled, leaderRunStore !== undefined);
     const minioGap = leaderK8sMinioGap(config.leaderEnabled, leaderProvider, "s3" in leaderMinio);

package/dist/boot/memory-boundary.d.ts

@@ -14,9 +14,9 @@
  * 这条链**结构上**走不通」——那句必须说出来。围栏根算不出来时**不说话**(判不了就闭嘴,别把猜测当告警)。
  *
  * 🔴 **已登记的判据限度(不在本批射程,别把它读成「判据已闭合」)**:② 号 warn 今天唯一算得出围栏根的
- * 腿是 `REMOTE_EXEC` 未设的 in-process 形(`boot/stores.ts` 的 `containmentRoots`),而**恰恰是这条腿
+ * 腿是无手的 `none` 形(`boot/stores.ts` 的 `containmentRoots`),而**恰恰是这条腿
  * 没有文件工具** —— 亲读装的这台 core:`prepare-execution-env.js` 的
- * `handsEnabled = ownedEnv !== undefined || deps.executionEnv !== undefined`,本仓不设 `REMOTE_EXEC` 时
+ * `handsEnabled = ownedEnv !== undefined || deps.executionEnv !== undefined`,`REMOTE_EXEC=none` 时
  * `executionEnvFactory` 恒 `undefined` ⇒ `handsEnabled=false` ⇒ `prepareHandsMount` 整个不跑。所以这条
  * warn 描述的失败形(「模型照提示词去 Write,拿回 `path_not_in_root`」)在该腿上并不成立:真相是**一只
  * 文件工具都没有**,而按它给的第一条恢复路径(把根挪进 workspace)会让 warn 闭嘴却仍然写不成。
@@ -54,7 +54,7 @@
  * `TaskSpec.memoryPersistenceCapable` 一条路进去(`boot/resolve-spec.ts` 直通),我方显式**不铸**受限会话、
  * 也**不投**这个读面(硬造一个消费点 = 造给自己看的 wire 键)。哪天真要在诊断面露它,先有消费方需求。
  */
-import { type ExecutionLane, type RemoteExecProvider } from "../execution-lane-caps.js";
+import { type ExecutionLane } from "../execution-lane-caps.js";
 import type { MemoryEngineBackend } from "@sema-agent/settings-schema/execution-lanes";
 /** boot 期可知的全部事实。每一位都必须由调用点从真配置/真装配结果取,禁在本模块内重算(重算=第二真源)。 */
 export interface MemoryWriteBoundaryFacts {
@@ -66,9 +66,9 @@ export interface MemoryWriteBoundaryFacts {
      *  core 7.16.0([ref])之后写家还要再深一层(`<平面>/<label>`),但 label 归引擎注册簿,boot 期说不出口;
      *  平面是**包含关系上等价**的那一只(家恒为平面的直接子目录),所以判据停在平面,不猜 label。 */
     memoryRoot: string | undefined;
-    /** 执行车道名,只进文案(归一读口 `executionLaneOf` 的答案;[ref] 起不在调用点手写 `?? "in-process"`)。 */
+    /** 执行车道名,只进文案(已合成配置上的车道词,直读)。 */
     lane: ExecutionLane;
-    /** 该车道的路径是不是本机的文件(执行环境块 `hostLocalPaths`:in-process 的桩块 / `REMOTE_EXEC=host` 为真)。false = 沙箱 / 远端 / 设备盘,
+    /** 该车道的路径是不是本机的文件(执行环境块 `hostLocalPaths`:`none` 的桩块 / `REMOTE_EXEC=host` 为真)。false = 沙箱 / 远端 / 设备盘,
      *  与记忆根分平面 —— 引擎在这一形上不教 `# Memory` 写指令(除非部署声明 `memoryPersistenceCapable: true`),判的是同一键。 */
     hostSemanticsLane: boolean;
     /** 部署声明 `MEMORY_PERSISTENCE_CAPABLE`(三态)。两极都让本模块闭嘴,但理由不同 —— 见各臂注释。 */
@@ -84,16 +84,16 @@ export interface MemoryWriteBoundaryFacts {
 }
 /**
  * 审计的**车道三位**由本函数派生(boot/stores.ts 的装配点只调它,不就地手写):
- *  · `lane` ⇐ 归一读口 `executionLaneOf`;
+ *  · `lane` ⇐ 已合成配置上的车道词;
  *  · `hostSemanticsLane` ⇐ 执行环境块 `hostLocalPaths`(唯一作者 `capabilitiesFor`;引擎撤不撤写指令读的是同一键);
- *  · `containmentRoots` ⇐ 只有 in-process 给得出(见下)。
+ *  · `containmentRoots` ⇐ 只有无手车道(`none`)给得出(见下)。
  * `processCwd` 由调用点传(stores 传 `process.cwd()`),本函数保持纯。
  */
 export declare function buildMemoryBoundaryLaneFacts(config: {
-    readonly remoteExec?: {
-        readonly provider: RemoteExecProvider;
+    readonly remoteExec: {
+        readonly provider: ExecutionLane;
         readonly s3Snapshot?: unknown;
-    } | undefined;
+    };
 }, processCwd: string): Pick<MemoryWriteBoundaryFacts, "lane" | "hostSemanticsLane" | "containmentRoots">;
 /** 一条启动告警:`tag` 进日志事件名(可被运维按名过滤/告警),`detail` 是给人读的整句(含恢复路径)。 */
 export interface MemoryWriteBoundaryWarning {
@@ -106,7 +106,7 @@ export interface MemoryWriteBoundaryWarning {
  * ① **路径不是本机的车道**(块 `hostLocalPaths` 为假:沙箱 / 远端 / 设备;记忆引擎在这里只可能因为 `MEMORY_ENGINE_REMOTE_LANE=allow`
  *    或 DB 记忆面才在):引擎不教 `# Memory` 写指令(手带够不着本机的记忆根),官方恢复路径是声明 `memoryPersistenceCapable: true`。
  *    未声明 ⇒ 点名 warn,把恢复旋钮写进句子里。
- * ② **路径是本机的车道**(in-process / host):记忆根不在任何一个已知围栏根内 ⇒ 模型被教着往一个 fs 工具够不到的路径写。
+ * ② **路径是本机的车道**(none / host):记忆根不在任何一个已知围栏根内 ⇒ 模型被教着往一个 fs 工具够不到的路径写。
  *
  * 两极声明都让本模块闭嘴,但理由不同,别合并:
  *  · `true` = operator 自证有推断看不见的持久通道(共享挂载 / 自定义 writer),我们的结构判断本就不该

package/dist/boot/memory-boundary.js

@@ -1,11 +1,11 @@
 import { resolve } from "node:path";
-import { capabilitiesFor, executionLaneOf } from "../execution-lane-caps.js";
+import { capabilitiesFor } from "../execution-lane-caps.js";
 export function buildMemoryBoundaryLaneFacts(config, processCwd) {
-    const lane = executionLaneOf(config.remoteExec?.provider);
+    const lane = config.remoteExec.provider;
     return {
         lane,
         hostSemanticsLane: capabilitiesFor(config).hostLocalPaths,
-        containmentRoots: lane === "in-process" ? [processCwd] : [],
+        containmentRoots: capabilitiesFor(config).io ? [] : [processCwd],
     };
 }
 function isInside(child, root) {

package/dist/boot/memory-consolidation.d.ts

@@ -13,7 +13,7 @@ type ConsolidationSeatOptions = ReturnType<typeof resolveMemoryConsolidationDriv
 /** D3 投影的座标签闭集。`role:<name>` 里的 name 只可能是 core 的 role 链两跳之一。 */
 export type ConsolidationSeatLabel = "explicit" | "role:consolidate" | "role:summarize";
 /** {@link buildConsolidationValveAudit} 的告警名闭集(事件名进日志 ⇒ 运维可按名过滤/告警)。 */
-export type ConsolidationValveWarningTag = "memory_consolidation_valve_unreachable" | "memory_consolidation_run_credential_gated";
+export type ConsolidationValveWarningTag = "memory_consolidation_run_credential_gated";
 /** {@link resolveConsolidationValve} 的起服提示名闭集([ref] / [ref];事件名进日志 ⇒ 运维可按名过滤/告警)。 */
 export type ConsolidationValveNoticeTag = "memory_consolidation_default_off_no_cheap_model" | "memory_consolidation_on_main_model";
 /**
@@ -301,38 +301,27 @@ export declare function judgeConsolidationValve(input: ConsolidationValveInput):
     unwirable: Parameters<typeof resolveConsolidationValve>[0]["unwirable"];
 };
 /**
- * 阀门上了场之后的**可达性**告警两条(自查 + codex 交叉复审;姿态=warn 不拒启)。
+ * 阀门上了场之后的**可达性**告警(自查 + codex 交叉复审;姿态=warn 不拒启)。
  *
- * ## 病(结构性,而且**只在**这条阀门够得着的那种部署上成立)
+ * ## 「没有运维」那一条为什么不在这里了
  *
- * consolidation 要后端自带引擎控制面归属 ⇒ 今天只有 file 记忆后端满足 ⇒ 本仓只在**单用户**形
- * (`REQUIRE_PRINCIPAL !== true`)上装配记忆引擎 —— 而那种部署的 `OPERATOR_PRINCIPALS` 通常是**空的**。
- * 没有运维名册(名单空且没有单用户声明 `OPERATOR_SINGLE_USER`)时 `explicitOperatorOk` 对任何身份恒假(「谁是 operator」的唯一读法:空名单绝不等于
- * 「人人都是 operator」),于是:阀门开着、启动成功、两口挂着、**每一次调用 501 `capability.operator_principals_required`**(运维面同一只拒发口;403 只留给名单非空而你不在名单上),
- * 能力位诚实地报 `false` —— 唯独运维不知道为什么,而他刚刚显式拧了一根写着 "on" 的旋钮。
- *
- * ## 为什么是 warn 而不是拒启(与 D1 的三条拒启臂**刻意不同档**)
- *
- * `OPERATOR_PRINCIPALS` 是**跨面共用**的部署级旋钮(adoption / retention-ops / memory-bundle /
- * memory-compliance / admin-drain 全在同一张名单上)。为一条阀门拒掉整台机器,比这条阀门本身的价值重;
- * 而那三条拒启臂拒的是「这台机器**结构上**跑不了这件事」(没有库 / 账会丢 / 折叠法铸不出标记),
- * 本条拒的是「配齐了但没人够得着」——后者是一次**配置遗漏**,补一行 env 即可,不该要一次重启失败来教。
- * 同族先例逐字:`permission_rules_lane_unavailable`(旋钮开着却上不了场 ⇒ 打一行,不拒启)。
- * 反过来说,**沉默**同样不行:那正是「设了但没生效」病族,而这一形连能力位都是诚实的假,唯一缺的
- * 就是一句把因果说清楚的话。
+ * 曾经还有一条「阀门够不着」告警(事件名已删,不再出现在日志里):阀门开着、两口挂着,而这台部署没有运维名册 ⇒ 两口对谁都 501。
+ * 它的在场条件今天在服务腿上不可达,前提链三环:① 显式开得起来的阀门要 file 记忆后端(SQL 两只孪生不发布控制面 ⇒ 第 4 段的
+ * {@link assertConsolidationDriverWirable} 拒启),而 file 记忆引擎只在单用户形上装配(`fileMemoryPlaneFor`);② 单用户形过了起服第 1 段就一定有运维
+ * (不变量 `operator-declaration-required`:`OPERATOR_SINGLE_USER=true` 或具名名单,都没有 ⇒ 第 1 段早拒;装运维面的兜底座 `createHttpServer` 同判);
+ * ③ 本函数的唯一调用点在服务腿第 6 段。读一个不可能状态的告警是死臂,随那条不变量一起退役(钉:`test/operator-declaration-required.test.ts` ⑥,
+ * 前提链每环一格,任何一环将来不成立 ⇒ 那一格红)。
  *
  * ## 只审**显式**开的阀门([ref] / [ref] 起)
  *
- * 两条告警的前提都是「运维**显式**拧了 on」(上面那句原话)——它们是一次**表态**够不着的诊断。出厂缺省**派生**开的
- * 那台(配了便宜模型的单用户部署)没有表态可审:引擎面的自动整理照跑(不走这两个口),手动口是一件它没要过的东西。
- * 照审的后果是每一台这样的部署升级后每次起服多两行 warn,点名一根它从没设过的 `MEMORY_CONSOLIDATION_DRIVER=on`,
- * 教它去配一个它不需要的操作面。判据读阀门判决的 `source`,不读表态原词(判决是阀门开关的唯一属主)。
+ * 告警的前提是「运维**显式**拧了 on」——它是一次**表态**够不着的诊断。出厂缺省**派生**开的那台(配了便宜模型的单用户部署)
+ * 没有表态可审:引擎面的自动整理照跑(不走手动口),手动口是一件它没要过的东西。照审的后果是每一台这样的部署升级后每次起服
+ * 多一行 warn,点名一根它从没设过的 `MEMORY_CONSOLIDATION_DRIVER=on`,教它去配一个它不需要的操作面。判据读阀门判决的 `source`,
+ * 不读表态原词(判决是阀门开关的唯一属主)。
  */
 export declare function buildConsolidationValveAudit(input: {
     /** 阀门判决({@link resolveConsolidationValve} 的 `enabled` + `source`)。 */
     valve: Pick<ConsolidationValve, "enabled" | "source">;
-    /** 这台部署有没有运维名册(`operatorRosterPresent`:名单非空 ∨ 单用户声明)—— 判据不在本函数里另写一份。 */
-    operatorRosterPresent: boolean;
     /** 这台部署配了任何一把 service 凭证吗(`config.authToken` 或 `config.authTokens` 非空)。 */
     hasServiceAuth: boolean;
     /** 本地开发的显式逃生口(`ALLOW_UNAUTHED_WRITES=true`)。 */