@sema-agent/server 7.146.0 → 7.148.0

package/dist/config-dir-trust.d.ts

@@ -1,3 +1,4 @@
+import { ConfigCandidateRefusedError } from "./config-pull-failure.js";
 /** 拒的机器码:起服拒启的 fatal 标题(`[config.dir_untrusted]`)与每拍那一行的句首同用。 */
 export declare const CONFIG_DIR_UNTRUSTED_CODE = "config.dir_untrusted";
 /** 属主声明的 env 名(登记 `config-catalog.ts`)。 */
@@ -95,14 +96,46 @@ export declare function kubeletVolumeIn(mountinfo: string, dir: string): Kubelet
 export declare function localConfigDirOf(root: string): string;
 /** 判一次。`undefined` = 读者可以读(或没有可读的);否则那一条发现。 */
 export declare function judgeLocalConfigDir(input: ConfigDirTrustInput): Promise<ConfigDirUntrustedFinding | undefined>;
-/** 一条发现的句子(纯字符串 ⇒ `build*`)。头半句说为什么要判、谁可以改;后半句点名路径、实测值与改法。 */
+/**
+ * 🔴 同一只判官的**另两只读者**:配置根之外、同属「盘上字节决定起什么」的两个文件(闭集;加一只读者 = 加一个词,拒句随词走,编译期穷举):
+ *  · `lkg` —— 中心配置的盘上 LKG 读回(`config-lkg.ts` `loadLkg`):中心慢或断时它就是本服务的配置(起哪些 MCP 命令、把凭据送给哪只模型端点);
+ *  · `scheduler-store` —— 调度共享店(`plugins/scheduler-support.ts` `FileSchedulerBackend`):常驻调度方按其中记录点名的主体起任务。
+ * 律与本地配置根逐字同一条(从 `/` 起逐级判到这一个文件,链接照跟;属主 ∈ 同一可信集;非链接组件不得组 / 他人可写,同两个例外;常规文件 ≤ 上界;
+ * 缺席且所在目录关着 = 读者也读不到,不是发现)。不是第二份判:走的是同一只 {@link reach}、同一张可信属主集、同一只句子。
+ */
+export type TrustedFileReader = "lkg" | "scheduler-store";
+/** 拒句头半句的三格 + `creatable` 的出路(按读者;本地配置源那一份见 {@link judgeLocalConfigDir} 的句子)。 */
+export interface TrustSubject {
+    readonly what: string;
+    readonly decides: string;
+    readonly pronoun: "it" | "them";
+    readonly relocate: string;
+}
+/** 本地配置源(`config.d` 与配置根上的根级文档)那一份(`configDir` = {@link localConfigDirOf} 的值)。 */
+export declare function localConfigSubject(configDir: string): TrustSubject;
+/** 判一个文件(读者 `reader` 要打开的那一个)。`undefined` = 可以读(或它不在、谁也建不出来);否则那一条发现。相对路径按进程 cwd 解(与读者打开时同一个解法,见 {@link readerPathOf})。 */
+export declare function judgeTrustedFile(input: {
+    readonly reader: TrustedFileReader;
+    readonly file: string;
+    readonly declaredOwnerUid: number | undefined;
+    readonly host?: ConfigDirTrustHost;
+}): Promise<ConfigDirUntrustedFinding | undefined>;
+/** 两只读者的口:判,有发现就交回那一句(与本地配置根的拒句同族:同一个码、同一组发现句);可读 ⇒ `undefined`。读者各按自己的纪律处置(不读回 / 拒这一次读写)。 */
+export declare function trustedFileRefusal(input: {
+    readonly reader: TrustedFileReader;
+    readonly file: string;
+    readonly declaredOwnerUid: number | undefined;
+    readonly host?: ConfigDirTrustHost;
+}): Promise<string | undefined>;
+/** 一条发现的句子(纯字符串 ⇒ `build*`)。头半句说读的是什么、为什么要判、谁可以改;后半句点名路径、实测值与改法。`subject` = 本地配置源({@link localConfigSubject})或另两只读者之一。 */
 export declare function buildConfigDirUntrustedSentence(f: ConfigDirUntrustedFinding, ctx: {
-    readonly configDir: string;
+    readonly subject: TrustSubject;
     readonly euid: number | undefined;
     readonly declaredOwnerUid: number | undefined;
 }): string;
-/** 判出一条发现时抛的错:`code` = {@link CONFIG_DIR_UNTRUSTED_CODE},`message` = 那一句,`finding` = 结构。 */
-export declare class ConfigDirUntrustedError extends Error {
+/** 判出一条发现时抛的错:`code` = {@link CONFIG_DIR_UNTRUSTED_CODE},`message` = 那一句,`finding` = 结构。
+ *  是 `ConfigCandidateRefusedError` 的子类 —— 每拍那一拉里抛出时,失败行的成因是 `rejected`(本引擎拒收这份本地候选;`config-pull-failure.ts`)。 */
+export declare class ConfigDirUntrustedError extends ConfigCandidateRefusedError {
     readonly code = "config.dir_untrusted";
     readonly finding: ConfigDirUntrustedFinding;
     constructor(sentence: string, finding: ConfigDirUntrustedFinding);

package/dist/config-dir-trust.js

@@ -1,9 +1,11 @@
-import { lstat, readFile, readdir, readlink, realpath, stat } from "node:fs/promises";
+import { lstat, readdir, readlink, realpath, stat } from "node:fs/promises";
 import path from "node:path";
 import { CONFIG_ROOT_DOCUMENTS } from "@sema-agent/settings-schema";
 import { LOCAL_READER_DOCUMENTS } from "./config-d-migration.js";
 import { recordFailOpen } from "./observability/fail-open.js";
 import { HOST_PLATFORM } from "./plugins/host-platform.js";
+import { coversPath, parseMountinfo, readProcessMountinfo, visibleMountOf } from "./mountinfo.js";
+import { ConfigCandidateRefusedError } from "./config-pull-failure.js";
 export const CONFIG_DIR_UNTRUSTED_CODE = "config.dir_untrusted";
 export const CONFIG_LOCAL_OWNER_UID_ENV = "CONFIG_LOCAL_OWNER_UID";
 export const CONFIG_DOCUMENT_MAX_BYTES = 16 * 1024 * 1024;
@@ -12,35 +14,8 @@ const UID_MAX = 4294967294;
 const WIN32_UNVERIFIED_TAG = "server.config-dir-trust.win32-owner-mode-unverifiable";
 const errnoOf = (e) => (e instanceof Error && "code" in e && typeof e.code === "string" ? e.code : undefined);
 const KUBELET_VOLUME_ROOT = /\/pods\/[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\/volumes\/kubernetes\.io~configmap\/[^/]+$/;
-const coversPath = (ancestor, p) => ancestor === p || ancestor === "/" || p.startsWith(`${ancestor}/`);
-const unescapeMountinfoPath = (field) => field.replace(/\\([0-7]{3})/g, (_m, oct) => String.fromCharCode(Number.parseInt(oct, 8)));
-function visibleMountOf(rows, dir) {
-    const ids = new Set(rows.map((r) => r.id));
-    let level = rows.filter((r) => !ids.has(r.parent) || r.parent === r.id);
-    let visible;
-    for (let depth = 0; depth <= rows.length; depth++) {
-        const covering = level.filter((r) => coversPath(r.mountPoint, dir));
-        if (covering.length === 0)
-            break;
-        const shortest = Math.min(...covering.map((r) => r.mountPoint.length));
-        const first = covering.filter((r) => r.mountPoint.length === shortest);
-        if (first.length !== 1)
-            return "ambiguous";
-        const next = first[0];
-        visible = next;
-        level = rows.filter((r) => r.parent === next.id && r.id !== next.id);
-    }
-    return visible;
-}
 export function kubeletVolumeIn(mountinfo, dir) {
-    const rows = [];
-    for (const line of mountinfo.split("\n")) {
-        const f = line.split(" ");
-        const [id, parent, dev, root, mountPoint, options] = f;
-        if (f.indexOf("-", 6) === -1 || id === undefined || parent === undefined || dev === undefined || root === undefined || mountPoint === undefined || options === undefined)
-            continue;
-        rows.push({ id, parent, dev, root: unescapeMountinfoPath(root), mountPoint: unescapeMountinfoPath(mountPoint), options: options.split(",") });
-    }
+    const { rows } = parseMountinfo(mountinfo);
     const visible = visibleMountOf(rows, dir);
     if (typeof visible !== "object" || visible.mountPoint !== dir || !visible.options.includes("ro") || !KUBELET_VOLUME_ROOT.test(visible.root))
         return undefined;
@@ -59,7 +34,7 @@ export function kubeletVolumeIn(mountinfo, dir) {
     return { source, writableExposures };
 }
 async function processMountinfo() {
-    return HOST_PLATFORM === "linux" ? readFile("/proc/self/mountinfo", "utf8") : "";
+    return (await readProcessMountinfo()) ?? "";
 }
 const processHost = () => ({ platform: HOST_PLATFORM, euid: process.geteuid?.(), mountinfo: processMountinfo });
 const UNREACHABLE = new Set(["ENOENT", "ENOTDIR"]);
@@ -339,25 +314,95 @@ async function judgeWin32(root, configDir) {
 export function localConfigDirOf(root) {
     return path.join(path.resolve(root), "config.d");
 }
+function judgeCtxOf(host, declaredOwnerUid) {
+    const owners = new Set([0]);
+    if (host.euid !== undefined)
+        owners.add(host.euid);
+    if (declaredOwnerUid !== undefined)
+        owners.add(declaredOwnerUid);
+    return { owners, mountinfo: host.mountinfo ?? processMountinfo };
+}
 export async function judgeLocalConfigDir(input) {
     const host = input.host ?? processHost();
     const configDir = localConfigDirOf(input.root);
     const root = path.dirname(configDir);
     if (host.platform === "win32")
         return judgeWin32(root, configDir);
-    const owners = new Set([0]);
-    if (host.euid !== undefined)
-        owners.add(host.euid);
-    if (input.declaredOwnerUid !== undefined)
-        owners.add(input.declaredOwnerUid);
-    return judgePosix(root, configDir, { owners, mountinfo: host.mountinfo ?? processMountinfo });
+    return judgePosix(root, configDir, judgeCtxOf(host, input.declaredOwnerUid));
+}
+export function localConfigSubject(configDir) {
+    return {
+        what: `the local config source ${configDir}`,
+        decides: "its documents decide which commands this server starts (mcp.json) and where it sends credentials (models.json)",
+        pronoun: "them",
+        relocate: "move the config root (CONFIG_LOCAL_DIR) under a directory only this server's user or root can write",
+    };
+}
+function trustedFileSubject(reader, file) {
+    switch (reader) {
+        case "lkg":
+            return {
+                what: `the last-known-good config ${file}`,
+                decides: "it is applied as this server's configuration whenever the center is slow or unreachable (the MCP commands this server starts, the model endpoints it sends credentials to)",
+                pronoun: "it",
+                relocate: "move it (SEMA_CONFIG_DIR, or CONFIG_LKG_PATH for this file alone) under a directory only this server's user or root can write",
+            };
+        case "scheduler-store":
+            return {
+                what: `the scheduled-task store ${file}`,
+                decides: "the resident scheduler starts its records as tasks under the principal each record names",
+                pronoun: "it",
+                relocate: "move it (SEMA_CONFIG_DIR, or SCHEDULER_STORE_PATH for this file alone) under a directory only this server's user or root can write",
+            };
+        default: {
+            const unknownReader = reader;
+            throw new Error(`config-dir-trust: unknown trusted-file reader ${String(unknownReader)}`);
+        }
+    }
+}
+async function judgeWin32File(reader, file) {
+    let at;
+    try {
+        at = await realpath(file);
+    }
+    catch (e) {
+        const code = errnoOf(e);
+        if (code !== undefined && UNREACHABLE.has(code))
+            return undefined;
+        if (code === "ELOOP")
+            return { kind: "link-loop", path: file };
+        return { kind: "unreadable", path: file, errno: code ?? String(e) };
+    }
+    const st = await stat(at);
+    if (!st.isFile())
+        return { kind: "not-regular", path: at, type: typeOf(st) };
+    if (st.size > CONFIG_DOCUMENT_MAX_BYTES)
+        return { kind: "too-large", path: at, bytes: st.size };
+    recordFailOpen(WIN32_UNVERIFIED_TAG, `${reader}=${at}`);
+    return undefined;
+}
+const readerPathOf = (file) => (path.isAbsolute(file) ? file : `${process.cwd()}/${file}`);
+export async function judgeTrustedFile(input) {
+    const host = input.host ?? processHost();
+    const file = readerPathOf(input.file);
+    if (host.platform === "win32")
+        return judgeWin32File(input.reader, file);
+    const reached = await reach(file, "file", judgeCtxOf(host, input.declaredOwnerUid));
+    return reached !== undefined && "kind" in reached ? reached : undefined;
+}
+export async function trustedFileRefusal(input) {
+    const host = input.host ?? processHost();
+    const finding = await judgeTrustedFile({ ...input, host });
+    if (finding === undefined)
+        return undefined;
+    return buildConfigDirUntrustedSentence(finding, { subject: trustedFileSubject(input.reader, readerPathOf(input.file)), euid: host.euid, declaredOwnerUid: input.declaredOwnerUid });
 }
 const octal = (mode) => `0${(mode & 0o7777).toString(8).padStart(3, "0")}`;
 export function buildConfigDirUntrustedSentence(f, ctx) {
     const self = ctx.euid === undefined ? "this server's user" : `this server's user (uid ${ctx.euid})`;
     const declared = ctx.declaredOwnerUid === undefined ? "" : ` or the declared owner ${CONFIG_LOCAL_OWNER_UID_ENV}=${ctx.declaredOwnerUid}`;
-    const head = `${CONFIG_DIR_UNTRUSTED_CODE}: refusing to read the local config source ${ctx.configDir} — its documents decide which commands this server starts (mcp.json) ` +
-        `and where it sends credentials (models.json), so only ${self}, root${declared} may be able to change them, but`;
+    const s = ctx.subject;
+    const head = `${CONFIG_DIR_UNTRUSTED_CODE}: refusing to read ${s.what} — ${s.decides}, so only ${self}, root${declared} may be able to change ${s.pronoun}, but`;
     switch (f.kind) {
         case "owner":
             return (`${head} ${f.path} is owned by uid ${f.uid}${ctx.declaredOwnerUid === undefined ? ` (${CONFIG_LOCAL_OWNER_UID_ENV} is not set)` : ""}. ` +
@@ -376,7 +421,7 @@ export function buildConfigDirUntrustedSentence(f, ctx) {
             return `${head} ${f.path} cannot be inspected (${f.errno}), so its owner and mode cannot be checked. Fix: give this server's user search access to every directory on the path.`;
         case "creatable":
             return (`${head} ${f.path} does not exist and ${f.parent} (mode ${octal(f.mode)}) lets other users create it between this check and the read. ` +
-                `Fix: create ${f.path} as this server's user, or move the config root (CONFIG_LOCAL_DIR) under a directory only this server's user or root can write.`);
+                `Fix: create ${f.path} as this server's user, or ${s.relocate}.`);
         case "unresolvable":
             return `${head} ${f.path} is a symbolic link that does not resolve to a path (it points at a kernel object such as a /proc descriptor), so its owner and mode cannot be checked. Fix: point it at a regular file.`;
         case "exposed":
@@ -389,12 +434,11 @@ export function buildConfigDirUntrustedSentence(f, ctx) {
         }
     }
 }
-export class ConfigDirUntrustedError extends Error {
+export class ConfigDirUntrustedError extends ConfigCandidateRefusedError {
     code = CONFIG_DIR_UNTRUSTED_CODE;
     finding;
     constructor(sentence, finding) {
-        super(sentence);
-        this.name = "ConfigDirUntrustedError";
+        super(sentence, "ConfigDirUntrustedError");
         this.finding = finding;
     }
 }
@@ -403,7 +447,7 @@ export async function assertLocalConfigDirTrusted(input) {
     const finding = await judgeLocalConfigDir({ ...input, host });
     if (finding === undefined)
         return;
-    throw new ConfigDirUntrustedError(buildConfigDirUntrustedSentence(finding, { configDir: localConfigDirOf(input.root), euid: host.euid, declaredOwnerUid: input.declaredOwnerUid }), finding);
+    throw new ConfigDirUntrustedError(buildConfigDirUntrustedSentence(finding, { subject: localConfigSubject(localConfigDirOf(input.root)), euid: host.euid, declaredOwnerUid: input.declaredOwnerUid }), finding);
 }
 export function parseConfigLocalOwnerUid(raw) {
     if (raw === undefined)
@@ -412,6 +456,6 @@ export function parseConfigLocalOwnerUid(raw) {
     if (Number.isInteger(n) && n <= UID_MAX)
         return n;
     throw new Error(`env ${CONFIG_LOCAL_OWNER_UID_ENV}=${JSON.stringify(raw)} must be a uid — a decimal integer in [0, ${UID_MAX}]: the one extra owner (besides this server's user and root) ` +
-        `the local config source's directories and documents may have (a userns-remapped bind mount, an operator-owned config). Unset it to trust only this server's user and root.`);
+        `the local config source's directories and documents, the last-known-good config and the scheduled-task store may have (a userns-remapped bind mount, an operator-owned config). Unset it to trust only this server's user and root.`);
 }
 //# sourceMappingURL=config-dir-trust.js.map

package/dist/config-invariants.d.ts

@@ -25,7 +25,7 @@
  * 依赖纪律:本文件是**叶**(只 type-import config-types + 值引 deployment-governance 的守卫集编译门),
  * 不引 config.ts,故 config.ts / runs.ts 都可以安全引它。
  */
-import type { ConfigProviderWord, ServiceConfigFlat } from "./config-types.js";
+import type { A2aServeConfig, ConfigProviderWord, ServiceConfigFlat } from "./config-types.js";
 import { type EnvTableReplacementInput } from "./env-model-table-gate.js";
 /**
  * 活体心跳周期(ms)——`runs.ts` 的 `HEARTBEAT_MS` 就是它(那边 re-export,单源在此)。
@@ -35,9 +35,9 @@ import { type EnvTableReplacementInput } from "./env-model-table-gate.js";
  */
 export declare const LIVENESS_HEARTBEAT_MS = 30000;
 /** 闭集:新增一条不变量必须在这里加词(拼错 = 编译红,而不是运行期悄悄不判)。 */
-export type CrossInvariantId = "run-stale-heartbeat" | "bind-posture" | "bake-runner-credential" | "direct-door-anchors" | "operator-principals-required" | "operator-single-user" | "bake-operator-principals" | "sensitive-write-patterns" | "leader-host-lane" | "multi-tenant-shared-lane" | "leader-durable-store" | "device-durable-store" | "device-durable-approval" | "model-provider-word" | "gateway-url-userinfo" | "anthropic-credential-exclusive" | "model-route-endpoint" | "default-model-resolvable" | "refused-names-not-minted" | "env-table-replacement-acknowledged" | "require-execution-lane" | "center-one-identity" | "workflow-park-decision-domain" | "remote-config-provider-url" | "retention-lane-complete";
+export type CrossInvariantId = "run-stale-heartbeat" | "bind-posture" | "bake-runner-credential" | "direct-door-anchors" | "operator-principals-required" | "operator-single-user" | "operator-declaration-required" | "operator-single-user-boundary" | "single-user-anonymous-boundary" | "bake-operator-principals" | "sensitive-write-patterns" | "leader-host-lane" | "multi-tenant-shared-lane" | "leader-durable-store" | "device-durable-store" | "device-durable-approval" | "model-provider-word" | "gateway-url-userinfo" | "anthropic-credential-exclusive" | "model-route-endpoint" | "default-model-resolvable" | "refused-names-not-minted" | "env-table-replacement-acknowledged" | "center-one-identity" | "workflow-park-decision-domain" | "remote-config-provider-url" | "retention-lane-complete";
 /** 表读的键集(取自平铺配置型 ⇒ 键名/类型永不与真配置漂)。 */
-export type CrossInvariantView = Readonly<Pick<ServiceConfigFlat, "runStaleSec" | "authToken" | "authTokens" | "allowUnauthedWrites" | "imageBakes" | "directApprovalDoor" | "durableApproval" | "approvalHmacKeys" | "principalJwtPubkeys" | "principalJwtIss" | "principalJwtAud" | "requirePrincipal" | "operatorPrincipals" | "operatorSingleUser" | "sensitiveWritePatterns" | "leaderEnabled" | "selfOrchestrationEnabled" | "workflowRunStoreBackend" | "remoteExec" | "requireExecutionLane" | "dbBackend" | "tidb" | "pg" | "envModel" | "gatewayBaseUrl" | "gatewayFallbackUrls" | "anthropic" | "models" | "modelRefusals" | "tiers" | "authBridgeIssuer" | "webAdmin" | "configProvider" | "retentionPolicy" | "retentionSweep">>;
+export type CrossInvariantView = Readonly<Pick<ServiceConfigFlat, "runStaleSec" | "authToken" | "authTokens" | "allowUnauthedWrites" | "imageBakes" | "directApprovalDoor" | "durableApproval" | "approvalHmacKeys" | "principalJwtPubkeys" | "principalJwtIss" | "principalJwtAud" | "requirePrincipal" | "operatorPrincipals" | "operatorSingleUser" | "bindHost" | "bindHostSource" | "sensitiveWritePatterns" | "leaderEnabled" | "selfOrchestrationEnabled" | "workflowRunStoreBackend" | "remoteExec" | "dbBackend" | "tidb" | "pg" | "envModel" | "gatewayBaseUrl" | "gatewayFallbackUrls" | "anthropic" | "models" | "modelRefusals" | "tiers" | "authBridgeIssuer" | "webAdmin" | "configProvider" | "retentionPolicy" | "retentionSweep">>;
 export interface CrossInvariantInput {
     /** 现役配置(boot 期 = 候选自身)。 */
     readonly live: CrossInvariantView;
@@ -65,7 +65,7 @@ export interface CrossInvariant {
 }
 /**
  * ── [ref] ① 推广(车 UZ 推广轮):**拒因句单铸点**是一类 —— 下面五只是 `config.ts` 区里五条跨域拒启的**判据 + 句子的唯一属主**
- * (`executionLaneRequiredRefusal` / `modelProviderRefusal` 同形):boot 的 throw(`config.ts`,锚在那儿)与注册表条目的 `check` **都调它**,
+ * (`modelProviderRefusal` 同形):boot 的 throw(`config.ts`,锚在那儿)与注册表条目的 `check` **都调它**,
  * 没有第二份文本可漂。修前这五条逐条两份不同的句子(boot 手写一份、表里另写一份),boot 那份是运维在 stderr 读到的(`config-validation.test.ts`
  * 钉着它的指纹),表那份只在热路径上被调 —— 而热键集带不上这些键 ⇒ 实际无读者。句子**取 boot 那份**(逐字不变);类钉 =
  * `test/config-hot/batch1-cross-invariants.test.ts` 的「类钉」一格(每条带 `bootAnchor` 的条目,boot 点不手写句子、且来自注册表本人或 check 同调的函数)。
@@ -84,6 +84,54 @@ export declare function operatorPrincipalsRequiredRefusal(v: Pick<CrossInvariant
  * 只在单用户形、名单为空时成立:多租形没有「单一用户」(声明会把每个租户都变成运维);名单非空时两个来源答同一个问题。两形都拒,句子点名两根旋钮与出路。
  */
 export declare function operatorSingleUserRefusal(v: Pick<CrossInvariantView, "operatorSingleUser" | "requirePrincipal" | "operatorPrincipals">): string | undefined;
+/**
+ * `operator-declaration-required`([ref])—— **单用户部署必须说出谁是运维**。单用户形(租户轴不成立,`DEPLOYMENT_SHAPE_PREDICATES.multiTenant`)上
+ * 「谁是运维」只有两种答法:`OPERATOR_SINGLE_USER=true`(每个调用方都是)或具名 `OPERATOR_PRINCIPALS`;两样都没有 = 没人能用这台部署的运维面
+ * (审批队列全量、诊断、outcomes、管理与记忆治理口),而升级前它是静默的 —— 本条把它变成起服拒,拒句一行给出两条出路。不加旋钮、不加宽限、不给缺省:
+ * 只有字面 `true` 是声明(`=false` 与缺席同判)。多租形不归本条:空名单 = 没人是运维是合法的多租姿态(durable 形另由 `operator-principals-required` 管)。
+ * 出路 A 只在单用户 ∧ 空名单时给出 —— 恰是 `operator-single-user` 放行的形;忘设 `REQUIRE_PRINCIPAL` 的团队机器不该照它把每个调用方变成运维,句子把它点出来。
+ * **两处调用、一只判据**:兜底座在装配运维面的地方(`createHttpServer`,装路由之前;所有装运维面者都过,嵌入方只过这一座,表条目的锚在这里);
+ * 服务入口另在起服第 1 段早拒(先于店连接与中心拉取)。不在 `loadConfig`:律管的是有运维面的进程,不装路由的 `run-local`(一次性 CLI,同读 `loadConfig`)不在射程。
+ */
+export declare function operatorDeclarationRefusal(v: Pick<CrossInvariantView, "requirePrincipal" | "operatorPrincipals" | "operatorSingleUser">): string | undefined;
+/** {@link operatorSingleUserBoundaryRefusal} 读的键(条目的 `keys` 与「判正在改的那份」比较同读这一张)。 */
+declare const SINGLE_USER_BOUNDARY_KEYS: readonly ["operatorSingleUser", "authToken", "authTokens", "allowUnauthedWrites", "bindHost", "bindHostSource"];
+type SingleUserBoundaryView = Pick<CrossInvariantView, (typeof SINGLE_USER_BOUNDARY_KEYS)[number]>;
+/**
+ * `operator-single-user-boundary` —— **单用户声明要有一道身份边界**。`OPERATOR_SINGLE_USER=true` 让这台部署的每个调用方都是运维(`explicitOperatorOk`),
+ * 而「调用方」由部署自己的凭据门划定:没配 service 凭据(`SERVICE_AUTH_TOKEN` / `SERVICE_AUTH_TOKENS`)的部署上,能连上这个口的都是调用方。
+ * 监听地址只在本机回环上({@link listensLoopbackOnly} 读 {@link resolveBindHost} —— 起服 listen 读的同一只)⇒ 能连上的只有本机,声明的意思成立;
+ * 否则(缺省全接口 / `0.0.0.0` / 局域网地址 / 主机名)⇒ 网络上任何人都是运维(审批队列全量与决断、诊断、管理与记忆治理口)⇒ 起服拒,拒句一行给三条出路:
+ * 配凭据 / 只听本机回环 / 撤声明换具名名单。不加旋钮(三条出路都是既有键)。
+ * 「谁受伤」= 本地单机 dev 监听全接口、没配凭据、写了声明的部署;补偿 = 三条出路之一。
+ * **只在服务入口判**(起服第 1 段,`operator-declaration-required` 之后 —— 没声明先报没声明):律管的是开监听口的进程;`run-local` 不监听、同读 `loadConfig`,不在射程,
+ * 所以不在 loadConfig。嵌入方自己 listen,装配座(`createHttpServer`)看不见它绑在哪,不在那里判。
+ */
+export declare function operatorSingleUserBoundaryRefusal(v: SingleUserBoundaryView): string | undefined;
+/** {@link singleUserAnonymousBoundaryRefusal} 读的键(条目的 `keys` 与「判正在改的那份」比较同读这一张)。 */
+declare const ANONYMOUS_BOUNDARY_KEYS: readonly ["requirePrincipal", "authToken", "authTokens", "allowUnauthedWrites", "bindHost", "bindHostSource"];
+type AnonymousBoundaryView = Pick<CrossInvariantView, (typeof ANONYMOUS_BOUNDARY_KEYS)[number]>;
+/**
+ * `single-user-anonymous-boundary` —— **单用户部署上不带主体的 run 要有一道身份边界**。单用户形(部署形表 `multiTenant` 不成立)上,不带主体的 run 就是这台部署的那一个人:
+ * 部署声明本机属主的规则桶(`boot/runner-deps.ts` 的 `localOwnerRulesDeclared`),这类 run 读那只桶里的持久规则 —— 包括那个人存下的 allow 行。
+ * 写面无鉴权(`ALLOW_UNAUTHED_WRITES` ∧ 没配 service 凭据 = {@link bindMustNarrow})时,能连上这个口的都能不带主体提交 run;监听地址只在本机回环 ⇒ 能连上的只有本机,成立;
+ * 否则 ⇒ 网络上任何人都按那个人的规则跑 ⇒ 起服拒,拒句一行给两条出路:配凭据 / 只听本机回环。不加旋钮(两条出路都是既有键)。
+ * 写面无鉴权且零凭据时,监听地址缺省就收窄到 127.0.0.1(继承的 `HOST` 也压不过)⇒ 本条只在运维显式 `BIND_HOST` 把它暴露出去时成立。
+ * 写面要凭据而没配凭据的部署没有人能提交 run,不归本条;配了凭据的部署,调用方 = 凭据持有者(与 `operator-single-user-boundary` 同一道边界)。
+ * 「谁受伤」= 单用户 ∧ 写面无鉴权 ∧ 显式非回环 `BIND_HOST` 的部署(含容器里 `BIND_HOST=0.0.0.0`、宿主只发布到回环的那一形 —— 进程看不见宿主怎么发布端口);补偿 = 两条出路之一。
+ * **只在服务入口判**(起服第 1 段,紧跟 `operator-single-user-boundary`):律管开监听口的进程;`run-local` 不监听、同读 `loadConfig`,不在射程。
+ */
+export declare function singleUserAnonymousBoundaryRefusal(v: AnonymousBoundaryView): string | undefined;
+/**
+ * `a2a-audience-identity-boundary` —— **受限技能只在有身份边界的部署上成立**。`A2A_SERVE_SKILLS` 的条目写了 `audience`(只发布给点名的调用方),而这台部署
+ * 没有身份边界 = 配置**没接任何已验身份来源**(`identity-source.ts` 的 `configuredIdentitySources` 为空 —— 「这台部署接了哪几个身份来源」的唯一读法:
+ * 没配服务凭据、没配鉴权桥 issuer(含中心回退)、没开直连门)。卡谓词只读**验过的**来源(`a2a-serve.ts` 的 `cardReaderOf` 先问 `verifiedIdentitySource`,匿名自报的主体头读成匿名),
+ * 所以这一形上**没有任何调用方能被名单点中** —— 照装就是一份静默失效的名单。只设 trace 凭据(只读凭据,不是身份来源)或只开 `REQUIRE_PRINCIPAL`(要求主体在场,
+ * 不验它)都不接来源,同判。起服拒,拒句一行给两条出路(接一个已验身份来源 / 删掉 `audience`),与 `operatorDeclarationRefusal` 同形。不回显名单里的名字。
+ * 座在装配路由的地方(`createHttpServer`,装路由之前;与 `operator-declaration-required` 的兜底座相邻,服务入口与嵌入方都过这一座)。
+ * 判据收座上对 `configuredIdentitySources(config)` 的读数,本函数不另写一份「有没有凭据」。热路径不必判:`A2A_SERVE_SKILLS` 与身份键都只来自 env、起服冻结。
+ */
+export declare function a2aAudienceIdentityBoundaryRefusal(a2aServe: A2aServeConfig | undefined, noVerifiedSource: boolean): string | undefined;
 /** `bake-operator-principals`(IMAGE-API-DESIGN §P2.4a):bake 门是 build-host 无限制执行面,要**具名**运维 —— 空名单下要么没人用得了,要么(单用户声明)人人用得了。 */
 export declare function bakeOperatorPrincipalsRefusal(v: Pick<CrossInvariantView, "imageBakes" | "operatorPrincipals">): string | undefined;
 /**
@@ -133,6 +181,11 @@ export declare function remoteConfigProviderUrlRefusal(v: {
  * 留在扫车道自持门(`boot/retention-lane.ts`)。状态型:三键都只来自 env、运行期无写点 ⇒ 热路径上恒与 boot 同答。
  */
 export declare function retentionLaneRefusal(v: Pick<CrossInvariantView, "retentionPolicy" | "retentionSweep">): string | undefined;
+/**
+ * `run-stale-heartbeat` 的判据与拒因(唯一属主;[ref] ① 同形 —— 注册表条目的 `check` 与起服第 1 段的早拒都调它)。参数取窄 `Pick`:起服第 1 段手里是
+ * 合成之前的 raw 配置(执行车道还没定形),本条不读车道。
+ */
+export declare function runStaleHeartbeatRefusal(v: Pick<CrossInvariantView, "runStaleSec">): string | undefined;
 export declare const CONFIG_CROSS_INVARIANTS: readonly CrossInvariant[];
 /**
  * 按 id 取**一条**([ref]②:boot 面的单源化出口)。
@@ -153,4 +206,5 @@ export type CrossInvariantVerdict = {
 };
 /** 全表校验(**第一条不过即拒**:候选是整批的,报第一个成因足够行动,继续跑其余条目只会淹掉它)。 */
 export declare function checkCrossInvariants(input: CrossInvariantInput): CrossInvariantVerdict;
+export {};
 //# sourceMappingURL=config-invariants.d.ts.map

package/dist/config-invariants.js

@@ -6,19 +6,18 @@ import { modelRouteEndpointRefusal } from "./model-route-endpoint.js";
 import { defaultModelRefusal, refusedNameMintedRefusal } from "./model-entry-refusal.js";
 import { judgeEnvTableReplacement } from "./env-model-table-gate.js";
 import { WEB_ADMIN_ENV, httpUrlFlaws } from "@sema-agent/settings-schema";
-import { authBridgeIssuerOf } from "./auth-bridge.js";
+import { authBridgeIssuerOf } from "./identity-source.js";
 import { buildDisplaySafeUrl } from "./trace/redact.js";
-import { executionLaneCaps, executionLaneOf, executionLaneRequiredRefusal, REMOTE_EXEC_PROVIDER_WORDS } from "./execution-lane-caps.js";
+import { ALL_EXECUTION_LANES, executionLaneCaps } from "./execution-lane-caps.js";
 import { DEPLOYMENT_SHAPE_PREDICATES } from "./deployment-shape.js";
+import { anyServiceCredential, bindMustNarrow, listensLoopbackOnly, resolveBindHost } from "./bind-host.js";
 export const LIVENESS_HEARTBEAT_MS = 30_000;
-const anyServiceAuth = (v) => Boolean(v.authToken) || Object.keys(v.authTokens ?? {}).length > 0;
-const mustNarrowBind = (v) => Boolean(v.allowUnauthedWrites) && !anyServiceAuth(v);
 const directDoorConjuncts = (v) => Boolean(v.directApprovalDoor) && Boolean(v.durableApproval) && v.approvalHmacKeys.length > 0 && v.principalJwtPubkeys.length > 0 && Boolean(v.principalJwtIss) && Boolean(v.principalJwtAud);
 function multiTenantSharedLaneRefusal(v) {
-    const lane = executionLaneOf(v.remoteExec?.provider);
+    const lane = v.remoteExec.provider;
     if (DEPLOYMENT_SHAPE_PREDICATES.laneSeparatesTenants.holds(v))
         return undefined;
-    const outlets = REMOTE_EXEC_PROVIDER_WORDS.filter((w) => executionLaneCaps(w).tenantSeparation === "supported");
+    const outlets = ALL_EXECUTION_LANES.filter((w) => executionLaneCaps(w).tenantSeparation === "supported");
     return (`REQUIRE_PRINCIPAL=true (multi-tenant posture) with the "${lane}" execution lane runs every tenant's Bash on one shared target — ` +
         `this lane does not separate tenants; set REMOTE_EXEC to ${outlets.join(" / ")}, or unset REQUIRE_PRINCIPAL for a single-user box`);
 }
@@ -56,6 +55,71 @@ export function operatorSingleUserRefusal(v) {
         return "OPERATOR_SINGLE_USER=true but OPERATOR_PRINCIPALS is also set — the two answer the same question (who is an operator) in two ways. Keep one: OPERATOR_SINGLE_USER=true (every caller of this single-user deployment) or OPERATOR_PRINCIPALS (only the named principals)";
     return undefined;
 }
+export function operatorDeclarationRefusal(v) {
+    if (DEPLOYMENT_SHAPE_PREDICATES.multiTenant.holds(v) || v.operatorPrincipals.length > 0 || v.operatorSingleUser === true)
+        return undefined;
+    return ("No operator is declared for this single-user deployment: REQUIRE_PRINCIPAL is off, OPERATOR_PRINCIPALS is empty and OPERATOR_SINGLE_USER is not true, " +
+        "so no caller could use its operator endpoints (the approval queues across owners, GET /v1/diagnostics/wiring, GET /v1/outcomes, the admin and memory-governance endpoints). " +
+        "Declare who operates it in one line: OPERATOR_SINGLE_USER=true (every caller of this single-user deployment is its operator — with a service credential or a loopback-only listener, or anyone who can reach the port is) or OPERATOR_PRINCIPALS=<principal,...> (only the named principals); " +
+        "a worker called by more than one person is multi-tenant — set REQUIRE_PRINCIPAL=true instead (MIGRATION.md, invariant operator-declaration-required). Refusing to boot.");
+}
+const SINGLE_USER_BOUNDARY_KEYS = ["operatorSingleUser", "authToken", "authTokens", "allowUnauthedWrites", "bindHost", "bindHostSource"];
+function sameSingleUserBoundary(a, b) {
+    return a.operatorSingleUser === b.operatorSingleUser && anyServiceCredential(a) === anyServiceCredential(b) && resolveBindHost(a) === resolveBindHost(b);
+}
+export function operatorSingleUserBoundaryRefusal(v) {
+    if (v.operatorSingleUser !== true || anyServiceCredential(v))
+        return undefined;
+    const where = offHostListener(v);
+    if (where === undefined)
+        return undefined;
+    return (`OPERATOR_SINGLE_USER=true with no service credential, listening on ${where} — the declaration makes every caller an operator, and without a credential every caller ` +
+        "is anyone who can reach this port (the approval queues across owners and their decisions, GET /v1/diagnostics/wiring, the admin and memory-governance endpoints). " +
+        "Pick one: set SERVICE_AUTH_TOKEN (or SERVICE_AUTH_TOKENS) so only credential holders reach this deployment; or listen on loopback only (BIND_HOST=127.0.0.1 — " +
+        "a container whose port is published to other hosts needs a credential instead); or unset OPERATOR_SINGLE_USER and name the operators in OPERATOR_PRINCIPALS " +
+        "(MIGRATION.md, invariant operator-single-user-boundary). Refusing to boot.");
+}
+function offHostListener(v) {
+    const bound = resolveBindHost(v);
+    if (listensLoopbackOnly(bound))
+        return undefined;
+    return bound === undefined ? "every network interface (BIND_HOST is not set)" : `${bound}${v.bindHostSource === "HOST" ? " (from the HOST env var)" : ""}`;
+}
+const ANONYMOUS_BOUNDARY_KEYS = ["requirePrincipal", "authToken", "authTokens", "allowUnauthedWrites", "bindHost", "bindHostSource"];
+function sameAnonymousBoundary(a, b) {
+    return DEPLOYMENT_SHAPE_PREDICATES.multiTenant.holds(a) === DEPLOYMENT_SHAPE_PREDICATES.multiTenant.holds(b) && bindMustNarrow(a) === bindMustNarrow(b) && resolveBindHost(a) === resolveBindHost(b);
+}
+export function singleUserAnonymousBoundaryRefusal(v) {
+    if (DEPLOYMENT_SHAPE_PREDICATES.multiTenant.holds(v) || !bindMustNarrow(v))
+        return undefined;
+    const where = offHostListener(v);
+    if (where === undefined)
+        return undefined;
+    return (`ALLOW_UNAUTHED_WRITES=true with no service credential on a single-user deployment (REQUIRE_PRINCIPAL is off), listening on ${where} — anyone who can reach this port ` +
+        "submits runs without a principal, and on a single-user deployment such a run is this deployment's one user: it runs under the local-owner permission-rule bucket, " +
+        "so the standing rules that user saved — allow rules included — apply to every caller. " +
+        "Pick one: set SERVICE_AUTH_TOKEN (or SERVICE_AUTH_TOKENS) so only credential holders submit runs; or listen on loopback only (BIND_HOST=127.0.0.1, or leave BIND_HOST unset — " +
+        "an unauthenticated write face then listens on 127.0.0.1 by itself; a container whose port is published to other hosts needs a credential instead) " +
+        "(MIGRATION.md, invariant single-user-anonymous-boundary). Refusing to boot.");
+}
+export function a2aAudienceIdentityBoundaryRefusal(a2aServe, noVerifiedSource) {
+    if (!noVerifiedSource || a2aServe === undefined)
+        return undefined;
+    const restricted = a2aServe.skills.filter((s) => s.audience !== undefined).length;
+    if (restricted === 0)
+        return undefined;
+    return (`A2A_SERVE_SKILLS declares ${restricted} skill${restricted === 1 ? "" : "s"} with an "audience", but this deployment has no identity boundary: ` +
+        `it wires no verified identity source (no service credential, no SSO bridge, no direct-door principal JWT; a trace token or REQUIRE_PRINCIPAL alone verifies nobody), ` +
+        `so a caller's principal header is only a self-asserted label and no caller could ever be matched against an audience. ` +
+        `Wire one verified identity source (SERVICE_AUTH_TOKEN / SERVICE_AUTH_TOKENS, the SSO bridge, or the direct door) or remove the "audience" entries from A2A_SERVE_SKILLS ` +
+        `(MIGRATION.md, invariant a2a-audience-identity-boundary). Refusing to boot.`);
+}
+function sameOperatorDeclaration(a, b) {
+    return (DEPLOYMENT_SHAPE_PREDICATES.multiTenant.holds(a) === DEPLOYMENT_SHAPE_PREDICATES.multiTenant.holds(b) &&
+        a.operatorSingleUser === b.operatorSingleUser &&
+        a.operatorPrincipals.length === b.operatorPrincipals.length &&
+        a.operatorPrincipals.every((p, k) => p === b.operatorPrincipals[k]));
+}
 export function bakeOperatorPrincipalsRefusal(v) {
     return v.imageBakes.enabled && v.operatorPrincipals.length === 0
         ? "IMAGE_BAKES_ENABLED=true but OPERATOR_PRINCIPALS is empty — the bake door runs build.sh on the privileged build host and needs named operators: with an empty list nobody can use it, and the single-user operator declaration would open it to every caller (world-writable RCE). Set OPERATOR_PRINCIPALS or disable bakes (IMAGE-API-DESIGN.md §P2.4a boot invariant)"
@@ -132,21 +196,24 @@ export function retentionLaneRefusal(v) {
     return (`RETENTION_SWEEP_INTERVAL_SEC=${intervalSec} arms the retention sweep lane, but ${gaps} — the lane would enumerate domains every tick and compute nothing. ` +
         "Set RETENTION_MAX_AGE_DAYS, or set RETENTION_SWEEP_INTERVAL_SEC=0 to leave the lane off. Refusing to boot.");
 }
+export function runStaleHeartbeatRefusal(v) {
+    return v.runStaleSec * 1000 <= LIVENESS_HEARTBEAT_MS
+        ? `runStaleSec (${v.runStaleSec}s) must exceed the ${LIVENESS_HEARTBEAT_MS / 1000}s liveness heartbeat — the reaper would race a run that is still heartbeating normally and reap live work`
+        : undefined;
+}
 export const CONFIG_CROSS_INVARIANTS = [
     {
         id: "run-stale-heartbeat",
         keys: ["runStaleSec"],
         restartReason: "run-stale-heartbeat",
         bootAnchor: { file: "src/boot/stage-01-config.ts", marker: "CROSS-INVARIANT:run-stale-heartbeat" },
-        check: ({ next }) => next.runStaleSec * 1000 <= LIVENESS_HEARTBEAT_MS
-            ? `runStaleSec (${next.runStaleSec}s) must exceed the ${LIVENESS_HEARTBEAT_MS / 1000}s liveness heartbeat — the reaper would race a run that is still heartbeating normally and reap live work`
-            : undefined,
+        check: ({ next }) => runStaleHeartbeatRefusal(next),
     },
     {
         id: "bind-posture",
         keys: ["authToken", "authTokens", "allowUnauthedWrites"],
         restartReason: "bind-posture",
-        check: ({ live, next }) => !mustNarrowBind(live) && mustNarrowBind(next)
+        check: ({ live, next }) => !bindMustNarrow(live) && bindMustNarrow(next)
             ? "this candidate would make the unauthenticated-write posture require narrowing the listener to 127.0.0.1, but the listen address is bound once at boot — refusing to hot-apply (restart to re-bind)"
             : undefined,
     },
@@ -181,6 +248,27 @@ export const CONFIG_CROSS_INVARIANTS = [
         bootAnchor: { file: "src/config.ts", marker: "CROSS-INVARIANT:operator-single-user" },
         check: ({ next }) => operatorSingleUserRefusal(next),
     },
+    {
+        id: "operator-declaration-required",
+        keys: ["requirePrincipal", "operatorPrincipals", "operatorSingleUser"],
+        restartReason: "operator-principals",
+        bootAnchor: { file: "src/http/server.ts", marker: "CROSS-INVARIANT:operator-declaration-required" },
+        check: ({ live, next }) => (sameOperatorDeclaration(live, next) ? undefined : operatorDeclarationRefusal(next)),
+    },
+    {
+        id: "single-user-anonymous-boundary",
+        keys: [...ANONYMOUS_BOUNDARY_KEYS],
+        restartReason: "bind-posture",
+        bootAnchor: { file: "src/boot/stage-01-config.ts", marker: "CROSS-INVARIANT:single-user-anonymous-boundary" },
+        check: ({ live, next }) => (sameAnonymousBoundary(live, next) ? undefined : singleUserAnonymousBoundaryRefusal(next)),
+    },
+    {
+        id: "operator-single-user-boundary",
+        keys: [...SINGLE_USER_BOUNDARY_KEYS],
+        restartReason: "operator-principals",
+        bootAnchor: { file: "src/boot/stage-01-config.ts", marker: "CROSS-INVARIANT:operator-single-user-boundary" },
+        check: ({ live, next }) => (sameSingleUserBoundary(live, next) ? undefined : operatorSingleUserBoundaryRefusal(next)),
+    },
     {
         id: "bake-operator-principals",
         keys: ["imageBakes", "operatorPrincipals"],
@@ -203,20 +291,13 @@ export const CONFIG_CROSS_INVARIANTS = [
             }
         },
     },
-    {
-        id: "require-execution-lane",
-        keys: ["requireExecutionLane", "remoteExec"],
-        restartReason: "execution-lane",
-        bootAnchor: { file: "src/config.ts", marker: "CROSS-INVARIANT:require-execution-lane" },
-        check: ({ next }) => executionLaneRequiredRefusal(next),
-    },
     {
         id: "leader-host-lane",
         keys: ["leaderEnabled", "remoteExec"],
         restartReason: "leader-lane",
         bootAnchor: { file: "src/boot/execution-lane.ts", marker: "CROSS-INVARIANT:leader-host-lane" },
-        check: ({ next }) => next.leaderEnabled && next.remoteExec?.provider === "host"
-            ? "LEADER_ENABLED=true on the host execution lane (REMOTE_EXEC=host, CONFIG_PROVIDER=local with REMOTE_EXEC unset, or a " +
+        check: ({ next }) => next.leaderEnabled && next.remoteExec.provider === "host"
+            ? "LEADER_ENABLED=true on the host execution lane (REMOTE_EXEC=host, or a " +
                 "config.d/remote-exec.json host override) is refused: the leader wire pins ONE absolute workspace path " +
                 "(LEADER_WORKSPACE / the /home/user default) for every sub-worker, while the host adapter gives each env a " +
                 "DIFFERENT random directory — so N concurrent host workers would share one physical git worktree and " +
@@ -251,13 +332,13 @@ export const CONFIG_CROSS_INVARIANTS = [
         keys: ["remoteExec", "dbBackend", "tidb", "pg"],
         restartReason: "device-lane",
         bootAnchor: { file: "src/boot/execution-lane.ts", marker: "CROSS-INVARIANT:device-durable-store" },
-        check: ({ next }) => next.remoteExec?.provider === "device" && !((next.dbBackend === "mysql" && next.tidb !== undefined) || (next.dbBackend === "pg" && next.pg !== undefined))
+        check: ({ next }) => next.remoteExec.provider === "device" && !((next.dbBackend === "mysql" && next.tidb !== undefined) || (next.dbBackend === "pg" && next.pg !== undefined))
             ? `REMOTE_EXEC=device with DB_BACKEND=${next.dbBackend} and no SQL connection coordinates built is refused ` +
                 "[device-durable-store]: the device registry, the session↔device binding and the device audit trail are all " +
                 "SQL-backed — without a real SQL store the binding lives in this process only, so a restart forgets WHICH device " +
                 "a parked run must resume onto and a second replica cannot see it at all. Note DB_BACKEND alone is not enough: " +
                 "SESSION_BACKEND=memory (or auto with no MYSQL_HOST/PG_HOST) builds no coordinates at all. Configure a durable " +
-                "store (DB_BACKEND=mysql|pg + its *_HOST/*_USER/*_DATABASE), or unset REMOTE_EXEC " +
+                "store (DB_BACKEND=mysql|pg + its *_HOST/*_USER/*_DATABASE), or declare another lane (REMOTE_EXEC=none if the agent's tools need no execution environment) " +
                 "(device-executor-lane-v2 §4.7 boot invariant)"
             : undefined,
     },
@@ -266,11 +347,11 @@ export const CONFIG_CROSS_INVARIANTS = [
         keys: ["remoteExec", "durableApproval"],
         restartReason: "device-lane",
         bootAnchor: { file: "src/boot/execution-lane.ts", marker: "CROSS-INVARIANT:device-durable-approval" },
-        check: ({ next }) => next.remoteExec?.provider === "device" && !next.durableApproval
+        check: ({ next }) => next.remoteExec.provider === "device" && !next.durableApproval
             ? "REMOTE_EXEC=device without DURABLE_APPROVAL=true is refused [device-durable-approval]: a personal device goes " +
                 "offline (lid closed, network drop) at arbitrary points, so an in-flight approval that outlives the window MUST " +
                 "have a park exit — without the durable approval store there is none and the run is stuck with nowhere to persist. " +
-                "Set DURABLE_APPROVAL=true, or unset REMOTE_EXEC (device-executor-lane-v2 §4.7 boot invariant)"
+                "Set DURABLE_APPROVAL=true, or declare another lane (REMOTE_EXEC=none if the agent's tools need no execution environment) (device-executor-lane-v2 §4.7 boot invariant)"
             : undefined,
     },
     {