@sema-agent/server 7.147.0 → 7.148.0

package/dist/config-dir-trust.d.ts

@@ -1,3 +1,4 @@
+import { ConfigCandidateRefusedError } from "./config-pull-failure.js";
 /** 拒的机器码:起服拒启的 fatal 标题(`[config.dir_untrusted]`)与每拍那一行的句首同用。 */
 export declare const CONFIG_DIR_UNTRUSTED_CODE = "config.dir_untrusted";
 /** 属主声明的 env 名(登记 `config-catalog.ts`)。 */
@@ -95,14 +96,46 @@ export declare function kubeletVolumeIn(mountinfo: string, dir: string): Kubelet
 export declare function localConfigDirOf(root: string): string;
 /** 判一次。`undefined` = 读者可以读(或没有可读的);否则那一条发现。 */
 export declare function judgeLocalConfigDir(input: ConfigDirTrustInput): Promise<ConfigDirUntrustedFinding | undefined>;
-/** 一条发现的句子(纯字符串 ⇒ `build*`)。头半句说为什么要判、谁可以改;后半句点名路径、实测值与改法。 */
+/**
+ * 🔴 同一只判官的**另两只读者**:配置根之外、同属「盘上字节决定起什么」的两个文件(闭集;加一只读者 = 加一个词,拒句随词走,编译期穷举):
+ *  · `lkg` —— 中心配置的盘上 LKG 读回(`config-lkg.ts` `loadLkg`):中心慢或断时它就是本服务的配置(起哪些 MCP 命令、把凭据送给哪只模型端点);
+ *  · `scheduler-store` —— 调度共享店(`plugins/scheduler-support.ts` `FileSchedulerBackend`):常驻调度方按其中记录点名的主体起任务。
+ * 律与本地配置根逐字同一条(从 `/` 起逐级判到这一个文件,链接照跟;属主 ∈ 同一可信集;非链接组件不得组 / 他人可写,同两个例外;常规文件 ≤ 上界;
+ * 缺席且所在目录关着 = 读者也读不到,不是发现)。不是第二份判:走的是同一只 {@link reach}、同一张可信属主集、同一只句子。
+ */
+export type TrustedFileReader = "lkg" | "scheduler-store";
+/** 拒句头半句的三格 + `creatable` 的出路(按读者;本地配置源那一份见 {@link judgeLocalConfigDir} 的句子)。 */
+export interface TrustSubject {
+    readonly what: string;
+    readonly decides: string;
+    readonly pronoun: "it" | "them";
+    readonly relocate: string;
+}
+/** 本地配置源(`config.d` 与配置根上的根级文档)那一份(`configDir` = {@link localConfigDirOf} 的值)。 */
+export declare function localConfigSubject(configDir: string): TrustSubject;
+/** 判一个文件(读者 `reader` 要打开的那一个)。`undefined` = 可以读(或它不在、谁也建不出来);否则那一条发现。相对路径按进程 cwd 解(与读者打开时同一个解法,见 {@link readerPathOf})。 */
+export declare function judgeTrustedFile(input: {
+    readonly reader: TrustedFileReader;
+    readonly file: string;
+    readonly declaredOwnerUid: number | undefined;
+    readonly host?: ConfigDirTrustHost;
+}): Promise<ConfigDirUntrustedFinding | undefined>;
+/** 两只读者的口:判,有发现就交回那一句(与本地配置根的拒句同族:同一个码、同一组发现句);可读 ⇒ `undefined`。读者各按自己的纪律处置(不读回 / 拒这一次读写)。 */
+export declare function trustedFileRefusal(input: {
+    readonly reader: TrustedFileReader;
+    readonly file: string;
+    readonly declaredOwnerUid: number | undefined;
+    readonly host?: ConfigDirTrustHost;
+}): Promise<string | undefined>;
+/** 一条发现的句子(纯字符串 ⇒ `build*`)。头半句说读的是什么、为什么要判、谁可以改;后半句点名路径、实测值与改法。`subject` = 本地配置源({@link localConfigSubject})或另两只读者之一。 */
 export declare function buildConfigDirUntrustedSentence(f: ConfigDirUntrustedFinding, ctx: {
-    readonly configDir: string;
+    readonly subject: TrustSubject;
     readonly euid: number | undefined;
     readonly declaredOwnerUid: number | undefined;
 }): string;
-/** 判出一条发现时抛的错:`code` = {@link CONFIG_DIR_UNTRUSTED_CODE},`message` = 那一句,`finding` = 结构。 */
-export declare class ConfigDirUntrustedError extends Error {
+/** 判出一条发现时抛的错:`code` = {@link CONFIG_DIR_UNTRUSTED_CODE},`message` = 那一句,`finding` = 结构。
+ *  是 `ConfigCandidateRefusedError` 的子类 —— 每拍那一拉里抛出时,失败行的成因是 `rejected`(本引擎拒收这份本地候选;`config-pull-failure.ts`)。 */
+export declare class ConfigDirUntrustedError extends ConfigCandidateRefusedError {
     readonly code = "config.dir_untrusted";
     readonly finding: ConfigDirUntrustedFinding;
     constructor(sentence: string, finding: ConfigDirUntrustedFinding);

package/dist/config-dir-trust.js

@@ -1,9 +1,11 @@
-import { lstat, readFile, readdir, readlink, realpath, stat } from "node:fs/promises";
+import { lstat, readdir, readlink, realpath, stat } from "node:fs/promises";
 import path from "node:path";
 import { CONFIG_ROOT_DOCUMENTS } from "@sema-agent/settings-schema";
 import { LOCAL_READER_DOCUMENTS } from "./config-d-migration.js";
 import { recordFailOpen } from "./observability/fail-open.js";
 import { HOST_PLATFORM } from "./plugins/host-platform.js";
+import { coversPath, parseMountinfo, readProcessMountinfo, visibleMountOf } from "./mountinfo.js";
+import { ConfigCandidateRefusedError } from "./config-pull-failure.js";
 export const CONFIG_DIR_UNTRUSTED_CODE = "config.dir_untrusted";
 export const CONFIG_LOCAL_OWNER_UID_ENV = "CONFIG_LOCAL_OWNER_UID";
 export const CONFIG_DOCUMENT_MAX_BYTES = 16 * 1024 * 1024;
@@ -12,35 +14,8 @@ const UID_MAX = 4294967294;
 const WIN32_UNVERIFIED_TAG = "server.config-dir-trust.win32-owner-mode-unverifiable";
 const errnoOf = (e) => (e instanceof Error && "code" in e && typeof e.code === "string" ? e.code : undefined);
 const KUBELET_VOLUME_ROOT = /\/pods\/[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\/volumes\/kubernetes\.io~configmap\/[^/]+$/;
-const coversPath = (ancestor, p) => ancestor === p || ancestor === "/" || p.startsWith(`${ancestor}/`);
-const unescapeMountinfoPath = (field) => field.replace(/\\([0-7]{3})/g, (_m, oct) => String.fromCharCode(Number.parseInt(oct, 8)));
-function visibleMountOf(rows, dir) {
-    const ids = new Set(rows.map((r) => r.id));
-    let level = rows.filter((r) => !ids.has(r.parent) || r.parent === r.id);
-    let visible;
-    for (let depth = 0; depth <= rows.length; depth++) {
-        const covering = level.filter((r) => coversPath(r.mountPoint, dir));
-        if (covering.length === 0)
-            break;
-        const shortest = Math.min(...covering.map((r) => r.mountPoint.length));
-        const first = covering.filter((r) => r.mountPoint.length === shortest);
-        if (first.length !== 1)
-            return "ambiguous";
-        const next = first[0];
-        visible = next;
-        level = rows.filter((r) => r.parent === next.id && r.id !== next.id);
-    }
-    return visible;
-}
 export function kubeletVolumeIn(mountinfo, dir) {
-    const rows = [];
-    for (const line of mountinfo.split("\n")) {
-        const f = line.split(" ");
-        const [id, parent, dev, root, mountPoint, options] = f;
-        if (f.indexOf("-", 6) === -1 || id === undefined || parent === undefined || dev === undefined || root === undefined || mountPoint === undefined || options === undefined)
-            continue;
-        rows.push({ id, parent, dev, root: unescapeMountinfoPath(root), mountPoint: unescapeMountinfoPath(mountPoint), options: options.split(",") });
-    }
+    const { rows } = parseMountinfo(mountinfo);
     const visible = visibleMountOf(rows, dir);
     if (typeof visible !== "object" || visible.mountPoint !== dir || !visible.options.includes("ro") || !KUBELET_VOLUME_ROOT.test(visible.root))
         return undefined;
@@ -59,7 +34,7 @@ export function kubeletVolumeIn(mountinfo, dir) {
     return { source, writableExposures };
 }
 async function processMountinfo() {
-    return HOST_PLATFORM === "linux" ? readFile("/proc/self/mountinfo", "utf8") : "";
+    return (await readProcessMountinfo()) ?? "";
 }
 const processHost = () => ({ platform: HOST_PLATFORM, euid: process.geteuid?.(), mountinfo: processMountinfo });
 const UNREACHABLE = new Set(["ENOENT", "ENOTDIR"]);
@@ -339,25 +314,95 @@ async function judgeWin32(root, configDir) {
 export function localConfigDirOf(root) {
     return path.join(path.resolve(root), "config.d");
 }
+function judgeCtxOf(host, declaredOwnerUid) {
+    const owners = new Set([0]);
+    if (host.euid !== undefined)
+        owners.add(host.euid);
+    if (declaredOwnerUid !== undefined)
+        owners.add(declaredOwnerUid);
+    return { owners, mountinfo: host.mountinfo ?? processMountinfo };
+}
 export async function judgeLocalConfigDir(input) {
     const host = input.host ?? processHost();
     const configDir = localConfigDirOf(input.root);
     const root = path.dirname(configDir);
     if (host.platform === "win32")
         return judgeWin32(root, configDir);
-    const owners = new Set([0]);
-    if (host.euid !== undefined)
-        owners.add(host.euid);
-    if (input.declaredOwnerUid !== undefined)
-        owners.add(input.declaredOwnerUid);
-    return judgePosix(root, configDir, { owners, mountinfo: host.mountinfo ?? processMountinfo });
+    return judgePosix(root, configDir, judgeCtxOf(host, input.declaredOwnerUid));
+}
+export function localConfigSubject(configDir) {
+    return {
+        what: `the local config source ${configDir}`,
+        decides: "its documents decide which commands this server starts (mcp.json) and where it sends credentials (models.json)",
+        pronoun: "them",
+        relocate: "move the config root (CONFIG_LOCAL_DIR) under a directory only this server's user or root can write",
+    };
+}
+function trustedFileSubject(reader, file) {
+    switch (reader) {
+        case "lkg":
+            return {
+                what: `the last-known-good config ${file}`,
+                decides: "it is applied as this server's configuration whenever the center is slow or unreachable (the MCP commands this server starts, the model endpoints it sends credentials to)",
+                pronoun: "it",
+                relocate: "move it (SEMA_CONFIG_DIR, or CONFIG_LKG_PATH for this file alone) under a directory only this server's user or root can write",
+            };
+        case "scheduler-store":
+            return {
+                what: `the scheduled-task store ${file}`,
+                decides: "the resident scheduler starts its records as tasks under the principal each record names",
+                pronoun: "it",
+                relocate: "move it (SEMA_CONFIG_DIR, or SCHEDULER_STORE_PATH for this file alone) under a directory only this server's user or root can write",
+            };
+        default: {
+            const unknownReader = reader;
+            throw new Error(`config-dir-trust: unknown trusted-file reader ${String(unknownReader)}`);
+        }
+    }
+}
+async function judgeWin32File(reader, file) {
+    let at;
+    try {
+        at = await realpath(file);
+    }
+    catch (e) {
+        const code = errnoOf(e);
+        if (code !== undefined && UNREACHABLE.has(code))
+            return undefined;
+        if (code === "ELOOP")
+            return { kind: "link-loop", path: file };
+        return { kind: "unreadable", path: file, errno: code ?? String(e) };
+    }
+    const st = await stat(at);
+    if (!st.isFile())
+        return { kind: "not-regular", path: at, type: typeOf(st) };
+    if (st.size > CONFIG_DOCUMENT_MAX_BYTES)
+        return { kind: "too-large", path: at, bytes: st.size };
+    recordFailOpen(WIN32_UNVERIFIED_TAG, `${reader}=${at}`);
+    return undefined;
+}
+const readerPathOf = (file) => (path.isAbsolute(file) ? file : `${process.cwd()}/${file}`);
+export async function judgeTrustedFile(input) {
+    const host = input.host ?? processHost();
+    const file = readerPathOf(input.file);
+    if (host.platform === "win32")
+        return judgeWin32File(input.reader, file);
+    const reached = await reach(file, "file", judgeCtxOf(host, input.declaredOwnerUid));
+    return reached !== undefined && "kind" in reached ? reached : undefined;
+}
+export async function trustedFileRefusal(input) {
+    const host = input.host ?? processHost();
+    const finding = await judgeTrustedFile({ ...input, host });
+    if (finding === undefined)
+        return undefined;
+    return buildConfigDirUntrustedSentence(finding, { subject: trustedFileSubject(input.reader, readerPathOf(input.file)), euid: host.euid, declaredOwnerUid: input.declaredOwnerUid });
 }
 const octal = (mode) => `0${(mode & 0o7777).toString(8).padStart(3, "0")}`;
 export function buildConfigDirUntrustedSentence(f, ctx) {
     const self = ctx.euid === undefined ? "this server's user" : `this server's user (uid ${ctx.euid})`;
     const declared = ctx.declaredOwnerUid === undefined ? "" : ` or the declared owner ${CONFIG_LOCAL_OWNER_UID_ENV}=${ctx.declaredOwnerUid}`;
-    const head = `${CONFIG_DIR_UNTRUSTED_CODE}: refusing to read the local config source ${ctx.configDir} — its documents decide which commands this server starts (mcp.json) ` +
-        `and where it sends credentials (models.json), so only ${self}, root${declared} may be able to change them, but`;
+    const s = ctx.subject;
+    const head = `${CONFIG_DIR_UNTRUSTED_CODE}: refusing to read ${s.what} — ${s.decides}, so only ${self}, root${declared} may be able to change ${s.pronoun}, but`;
     switch (f.kind) {
         case "owner":
             return (`${head} ${f.path} is owned by uid ${f.uid}${ctx.declaredOwnerUid === undefined ? ` (${CONFIG_LOCAL_OWNER_UID_ENV} is not set)` : ""}. ` +
@@ -376,7 +421,7 @@ export function buildConfigDirUntrustedSentence(f, ctx) {
             return `${head} ${f.path} cannot be inspected (${f.errno}), so its owner and mode cannot be checked. Fix: give this server's user search access to every directory on the path.`;
         case "creatable":
             return (`${head} ${f.path} does not exist and ${f.parent} (mode ${octal(f.mode)}) lets other users create it between this check and the read. ` +
-                `Fix: create ${f.path} as this server's user, or move the config root (CONFIG_LOCAL_DIR) under a directory only this server's user or root can write.`);
+                `Fix: create ${f.path} as this server's user, or ${s.relocate}.`);
         case "unresolvable":
             return `${head} ${f.path} is a symbolic link that does not resolve to a path (it points at a kernel object such as a /proc descriptor), so its owner and mode cannot be checked. Fix: point it at a regular file.`;
         case "exposed":
@@ -389,12 +434,11 @@ export function buildConfigDirUntrustedSentence(f, ctx) {
         }
     }
 }
-export class ConfigDirUntrustedError extends Error {
+export class ConfigDirUntrustedError extends ConfigCandidateRefusedError {
     code = CONFIG_DIR_UNTRUSTED_CODE;
     finding;
     constructor(sentence, finding) {
-        super(sentence);
-        this.name = "ConfigDirUntrustedError";
+        super(sentence, "ConfigDirUntrustedError");
         this.finding = finding;
     }
 }
@@ -403,7 +447,7 @@ export async function assertLocalConfigDirTrusted(input) {
     const finding = await judgeLocalConfigDir({ ...input, host });
     if (finding === undefined)
         return;
-    throw new ConfigDirUntrustedError(buildConfigDirUntrustedSentence(finding, { configDir: localConfigDirOf(input.root), euid: host.euid, declaredOwnerUid: input.declaredOwnerUid }), finding);
+    throw new ConfigDirUntrustedError(buildConfigDirUntrustedSentence(finding, { subject: localConfigSubject(localConfigDirOf(input.root)), euid: host.euid, declaredOwnerUid: input.declaredOwnerUid }), finding);
 }
 export function parseConfigLocalOwnerUid(raw) {
     if (raw === undefined)
@@ -412,6 +456,6 @@ export function parseConfigLocalOwnerUid(raw) {
     if (Number.isInteger(n) && n <= UID_MAX)
         return n;
     throw new Error(`env ${CONFIG_LOCAL_OWNER_UID_ENV}=${JSON.stringify(raw)} must be a uid — a decimal integer in [0, ${UID_MAX}]: the one extra owner (besides this server's user and root) ` +
-        `the local config source's directories and documents may have (a userns-remapped bind mount, an operator-owned config). Unset it to trust only this server's user and root.`);
+        `the local config source's directories and documents, the last-known-good config and the scheduled-task store may have (a userns-remapped bind mount, an operator-owned config). Unset it to trust only this server's user and root.`);
 }
 //# sourceMappingURL=config-dir-trust.js.map

package/dist/config-invariants.d.ts

@@ -25,7 +25,7 @@
  * 依赖纪律:本文件是**叶**(只 type-import config-types + 值引 deployment-governance 的守卫集编译门),
  * 不引 config.ts,故 config.ts / runs.ts 都可以安全引它。
  */
-import type { ConfigProviderWord, ServiceConfigFlat } from "./config-types.js";
+import type { A2aServeConfig, ConfigProviderWord, ServiceConfigFlat } from "./config-types.js";
 import { type EnvTableReplacementInput } from "./env-model-table-gate.js";
 /**
  * 活体心跳周期(ms)——`runs.ts` 的 `HEARTBEAT_MS` 就是它(那边 re-export,单源在此)。
@@ -35,9 +35,9 @@ import { type EnvTableReplacementInput } from "./env-model-table-gate.js";
  */
 export declare const LIVENESS_HEARTBEAT_MS = 30000;
 /** 闭集:新增一条不变量必须在这里加词(拼错 = 编译红,而不是运行期悄悄不判)。 */
-export type CrossInvariantId = "run-stale-heartbeat" | "bind-posture" | "bake-runner-credential" | "direct-door-anchors" | "operator-principals-required" | "operator-single-user" | "operator-declaration-required" | "bake-operator-principals" | "sensitive-write-patterns" | "leader-host-lane" | "multi-tenant-shared-lane" | "leader-durable-store" | "device-durable-store" | "device-durable-approval" | "model-provider-word" | "gateway-url-userinfo" | "anthropic-credential-exclusive" | "model-route-endpoint" | "default-model-resolvable" | "refused-names-not-minted" | "env-table-replacement-acknowledged" | "center-one-identity" | "workflow-park-decision-domain" | "remote-config-provider-url" | "retention-lane-complete";
+export type CrossInvariantId = "run-stale-heartbeat" | "bind-posture" | "bake-runner-credential" | "direct-door-anchors" | "operator-principals-required" | "operator-single-user" | "operator-declaration-required" | "operator-single-user-boundary" | "single-user-anonymous-boundary" | "bake-operator-principals" | "sensitive-write-patterns" | "leader-host-lane" | "multi-tenant-shared-lane" | "leader-durable-store" | "device-durable-store" | "device-durable-approval" | "model-provider-word" | "gateway-url-userinfo" | "anthropic-credential-exclusive" | "model-route-endpoint" | "default-model-resolvable" | "refused-names-not-minted" | "env-table-replacement-acknowledged" | "center-one-identity" | "workflow-park-decision-domain" | "remote-config-provider-url" | "retention-lane-complete";
 /** 表读的键集(取自平铺配置型 ⇒ 键名/类型永不与真配置漂)。 */
-export type CrossInvariantView = Readonly<Pick<ServiceConfigFlat, "runStaleSec" | "authToken" | "authTokens" | "allowUnauthedWrites" | "imageBakes" | "directApprovalDoor" | "durableApproval" | "approvalHmacKeys" | "principalJwtPubkeys" | "principalJwtIss" | "principalJwtAud" | "requirePrincipal" | "operatorPrincipals" | "operatorSingleUser" | "sensitiveWritePatterns" | "leaderEnabled" | "selfOrchestrationEnabled" | "workflowRunStoreBackend" | "remoteExec" | "dbBackend" | "tidb" | "pg" | "envModel" | "gatewayBaseUrl" | "gatewayFallbackUrls" | "anthropic" | "models" | "modelRefusals" | "tiers" | "authBridgeIssuer" | "webAdmin" | "configProvider" | "retentionPolicy" | "retentionSweep">>;
+export type CrossInvariantView = Readonly<Pick<ServiceConfigFlat, "runStaleSec" | "authToken" | "authTokens" | "allowUnauthedWrites" | "imageBakes" | "directApprovalDoor" | "durableApproval" | "approvalHmacKeys" | "principalJwtPubkeys" | "principalJwtIss" | "principalJwtAud" | "requirePrincipal" | "operatorPrincipals" | "operatorSingleUser" | "bindHost" | "bindHostSource" | "sensitiveWritePatterns" | "leaderEnabled" | "selfOrchestrationEnabled" | "workflowRunStoreBackend" | "remoteExec" | "dbBackend" | "tidb" | "pg" | "envModel" | "gatewayBaseUrl" | "gatewayFallbackUrls" | "anthropic" | "models" | "modelRefusals" | "tiers" | "authBridgeIssuer" | "webAdmin" | "configProvider" | "retentionPolicy" | "retentionSweep">>;
 export interface CrossInvariantInput {
     /** 现役配置(boot 期 = 候选自身)。 */
     readonly live: CrossInvariantView;
@@ -94,6 +94,44 @@ export declare function operatorSingleUserRefusal(v: Pick<CrossInvariantView, "o
  * 服务入口另在起服第 1 段早拒(先于店连接与中心拉取)。不在 `loadConfig`:律管的是有运维面的进程,不装路由的 `run-local`(一次性 CLI,同读 `loadConfig`)不在射程。
  */
 export declare function operatorDeclarationRefusal(v: Pick<CrossInvariantView, "requirePrincipal" | "operatorPrincipals" | "operatorSingleUser">): string | undefined;
+/** {@link operatorSingleUserBoundaryRefusal} 读的键(条目的 `keys` 与「判正在改的那份」比较同读这一张)。 */
+declare const SINGLE_USER_BOUNDARY_KEYS: readonly ["operatorSingleUser", "authToken", "authTokens", "allowUnauthedWrites", "bindHost", "bindHostSource"];
+type SingleUserBoundaryView = Pick<CrossInvariantView, (typeof SINGLE_USER_BOUNDARY_KEYS)[number]>;
+/**
+ * `operator-single-user-boundary` —— **单用户声明要有一道身份边界**。`OPERATOR_SINGLE_USER=true` 让这台部署的每个调用方都是运维(`explicitOperatorOk`),
+ * 而「调用方」由部署自己的凭据门划定:没配 service 凭据(`SERVICE_AUTH_TOKEN` / `SERVICE_AUTH_TOKENS`)的部署上,能连上这个口的都是调用方。
+ * 监听地址只在本机回环上({@link listensLoopbackOnly} 读 {@link resolveBindHost} —— 起服 listen 读的同一只)⇒ 能连上的只有本机,声明的意思成立;
+ * 否则(缺省全接口 / `0.0.0.0` / 局域网地址 / 主机名)⇒ 网络上任何人都是运维(审批队列全量与决断、诊断、管理与记忆治理口)⇒ 起服拒,拒句一行给三条出路:
+ * 配凭据 / 只听本机回环 / 撤声明换具名名单。不加旋钮(三条出路都是既有键)。
+ * 「谁受伤」= 本地单机 dev 监听全接口、没配凭据、写了声明的部署;补偿 = 三条出路之一。
+ * **只在服务入口判**(起服第 1 段,`operator-declaration-required` 之后 —— 没声明先报没声明):律管的是开监听口的进程;`run-local` 不监听、同读 `loadConfig`,不在射程,
+ * 所以不在 loadConfig。嵌入方自己 listen,装配座(`createHttpServer`)看不见它绑在哪,不在那里判。
+ */
+export declare function operatorSingleUserBoundaryRefusal(v: SingleUserBoundaryView): string | undefined;
+/** {@link singleUserAnonymousBoundaryRefusal} 读的键(条目的 `keys` 与「判正在改的那份」比较同读这一张)。 */
+declare const ANONYMOUS_BOUNDARY_KEYS: readonly ["requirePrincipal", "authToken", "authTokens", "allowUnauthedWrites", "bindHost", "bindHostSource"];
+type AnonymousBoundaryView = Pick<CrossInvariantView, (typeof ANONYMOUS_BOUNDARY_KEYS)[number]>;
+/**
+ * `single-user-anonymous-boundary` —— **单用户部署上不带主体的 run 要有一道身份边界**。单用户形(部署形表 `multiTenant` 不成立)上,不带主体的 run 就是这台部署的那一个人:
+ * 部署声明本机属主的规则桶(`boot/runner-deps.ts` 的 `localOwnerRulesDeclared`),这类 run 读那只桶里的持久规则 —— 包括那个人存下的 allow 行。
+ * 写面无鉴权(`ALLOW_UNAUTHED_WRITES` ∧ 没配 service 凭据 = {@link bindMustNarrow})时,能连上这个口的都能不带主体提交 run;监听地址只在本机回环 ⇒ 能连上的只有本机,成立;
+ * 否则 ⇒ 网络上任何人都按那个人的规则跑 ⇒ 起服拒,拒句一行给两条出路:配凭据 / 只听本机回环。不加旋钮(两条出路都是既有键)。
+ * 写面无鉴权且零凭据时,监听地址缺省就收窄到 127.0.0.1(继承的 `HOST` 也压不过)⇒ 本条只在运维显式 `BIND_HOST` 把它暴露出去时成立。
+ * 写面要凭据而没配凭据的部署没有人能提交 run,不归本条;配了凭据的部署,调用方 = 凭据持有者(与 `operator-single-user-boundary` 同一道边界)。
+ * 「谁受伤」= 单用户 ∧ 写面无鉴权 ∧ 显式非回环 `BIND_HOST` 的部署(含容器里 `BIND_HOST=0.0.0.0`、宿主只发布到回环的那一形 —— 进程看不见宿主怎么发布端口);补偿 = 两条出路之一。
+ * **只在服务入口判**(起服第 1 段,紧跟 `operator-single-user-boundary`):律管开监听口的进程;`run-local` 不监听、同读 `loadConfig`,不在射程。
+ */
+export declare function singleUserAnonymousBoundaryRefusal(v: AnonymousBoundaryView): string | undefined;
+/**
+ * `a2a-audience-identity-boundary` —— **受限技能只在有身份边界的部署上成立**。`A2A_SERVE_SKILLS` 的条目写了 `audience`(只发布给点名的调用方),而这台部署
+ * 没有身份边界 = 配置**没接任何已验身份来源**(`identity-source.ts` 的 `configuredIdentitySources` 为空 —— 「这台部署接了哪几个身份来源」的唯一读法:
+ * 没配服务凭据、没配鉴权桥 issuer(含中心回退)、没开直连门)。卡谓词只读**验过的**来源(`a2a-serve.ts` 的 `cardReaderOf` 先问 `verifiedIdentitySource`,匿名自报的主体头读成匿名),
+ * 所以这一形上**没有任何调用方能被名单点中** —— 照装就是一份静默失效的名单。只设 trace 凭据(只读凭据,不是身份来源)或只开 `REQUIRE_PRINCIPAL`(要求主体在场,
+ * 不验它)都不接来源,同判。起服拒,拒句一行给两条出路(接一个已验身份来源 / 删掉 `audience`),与 `operatorDeclarationRefusal` 同形。不回显名单里的名字。
+ * 座在装配路由的地方(`createHttpServer`,装路由之前;与 `operator-declaration-required` 的兜底座相邻,服务入口与嵌入方都过这一座)。
+ * 判据收座上对 `configuredIdentitySources(config)` 的读数,本函数不另写一份「有没有凭据」。热路径不必判:`A2A_SERVE_SKILLS` 与身份键都只来自 env、起服冻结。
+ */
+export declare function a2aAudienceIdentityBoundaryRefusal(a2aServe: A2aServeConfig | undefined, noVerifiedSource: boolean): string | undefined;
 /** `bake-operator-principals`(IMAGE-API-DESIGN §P2.4a):bake 门是 build-host 无限制执行面,要**具名**运维 —— 空名单下要么没人用得了,要么(单用户声明)人人用得了。 */
 export declare function bakeOperatorPrincipalsRefusal(v: Pick<CrossInvariantView, "imageBakes" | "operatorPrincipals">): string | undefined;
 /**
@@ -168,4 +206,5 @@ export type CrossInvariantVerdict = {
 };
 /** 全表校验(**第一条不过即拒**:候选是整批的,报第一个成因足够行动,继续跑其余条目只会淹掉它)。 */
 export declare function checkCrossInvariants(input: CrossInvariantInput): CrossInvariantVerdict;
+export {};
 //# sourceMappingURL=config-invariants.d.ts.map

package/dist/config-invariants.js

@@ -6,13 +6,12 @@ import { modelRouteEndpointRefusal } from "./model-route-endpoint.js";
 import { defaultModelRefusal, refusedNameMintedRefusal } from "./model-entry-refusal.js";
 import { judgeEnvTableReplacement } from "./env-model-table-gate.js";
 import { WEB_ADMIN_ENV, httpUrlFlaws } from "@sema-agent/settings-schema";
-import { authBridgeIssuerOf } from "./auth-bridge.js";
+import { authBridgeIssuerOf } from "./identity-source.js";
 import { buildDisplaySafeUrl } from "./trace/redact.js";
 import { ALL_EXECUTION_LANES, executionLaneCaps } from "./execution-lane-caps.js";
 import { DEPLOYMENT_SHAPE_PREDICATES } from "./deployment-shape.js";
+import { anyServiceCredential, bindMustNarrow, listensLoopbackOnly, resolveBindHost } from "./bind-host.js";
 export const LIVENESS_HEARTBEAT_MS = 30_000;
-const anyServiceAuth = (v) => Boolean(v.authToken) || Object.keys(v.authTokens ?? {}).length > 0;
-const mustNarrowBind = (v) => Boolean(v.allowUnauthedWrites) && !anyServiceAuth(v);
 const directDoorConjuncts = (v) => Boolean(v.directApprovalDoor) && Boolean(v.durableApproval) && v.approvalHmacKeys.length > 0 && v.principalJwtPubkeys.length > 0 && Boolean(v.principalJwtIss) && Boolean(v.principalJwtAud);
 function multiTenantSharedLaneRefusal(v) {
     const lane = v.remoteExec.provider;
@@ -61,9 +60,60 @@ export function operatorDeclarationRefusal(v) {
         return undefined;
     return ("No operator is declared for this single-user deployment: REQUIRE_PRINCIPAL is off, OPERATOR_PRINCIPALS is empty and OPERATOR_SINGLE_USER is not true, " +
         "so no caller could use its operator endpoints (the approval queues across owners, GET /v1/diagnostics/wiring, GET /v1/outcomes, the admin and memory-governance endpoints). " +
-        "Declare who operates it in one line: OPERATOR_SINGLE_USER=true (every caller of this single-user deployment is its operator) or OPERATOR_PRINCIPALS=<principal,...> (only the named principals); " +
+        "Declare who operates it in one line: OPERATOR_SINGLE_USER=true (every caller of this single-user deployment is its operator — with a service credential or a loopback-only listener, or anyone who can reach the port is) or OPERATOR_PRINCIPALS=<principal,...> (only the named principals); " +
         "a worker called by more than one person is multi-tenant — set REQUIRE_PRINCIPAL=true instead (MIGRATION.md, invariant operator-declaration-required). Refusing to boot.");
 }
+const SINGLE_USER_BOUNDARY_KEYS = ["operatorSingleUser", "authToken", "authTokens", "allowUnauthedWrites", "bindHost", "bindHostSource"];
+function sameSingleUserBoundary(a, b) {
+    return a.operatorSingleUser === b.operatorSingleUser && anyServiceCredential(a) === anyServiceCredential(b) && resolveBindHost(a) === resolveBindHost(b);
+}
+export function operatorSingleUserBoundaryRefusal(v) {
+    if (v.operatorSingleUser !== true || anyServiceCredential(v))
+        return undefined;
+    const where = offHostListener(v);
+    if (where === undefined)
+        return undefined;
+    return (`OPERATOR_SINGLE_USER=true with no service credential, listening on ${where} — the declaration makes every caller an operator, and without a credential every caller ` +
+        "is anyone who can reach this port (the approval queues across owners and their decisions, GET /v1/diagnostics/wiring, the admin and memory-governance endpoints). " +
+        "Pick one: set SERVICE_AUTH_TOKEN (or SERVICE_AUTH_TOKENS) so only credential holders reach this deployment; or listen on loopback only (BIND_HOST=127.0.0.1 — " +
+        "a container whose port is published to other hosts needs a credential instead); or unset OPERATOR_SINGLE_USER and name the operators in OPERATOR_PRINCIPALS " +
+        "(MIGRATION.md, invariant operator-single-user-boundary). Refusing to boot.");
+}
+function offHostListener(v) {
+    const bound = resolveBindHost(v);
+    if (listensLoopbackOnly(bound))
+        return undefined;
+    return bound === undefined ? "every network interface (BIND_HOST is not set)" : `${bound}${v.bindHostSource === "HOST" ? " (from the HOST env var)" : ""}`;
+}
+const ANONYMOUS_BOUNDARY_KEYS = ["requirePrincipal", "authToken", "authTokens", "allowUnauthedWrites", "bindHost", "bindHostSource"];
+function sameAnonymousBoundary(a, b) {
+    return DEPLOYMENT_SHAPE_PREDICATES.multiTenant.holds(a) === DEPLOYMENT_SHAPE_PREDICATES.multiTenant.holds(b) && bindMustNarrow(a) === bindMustNarrow(b) && resolveBindHost(a) === resolveBindHost(b);
+}
+export function singleUserAnonymousBoundaryRefusal(v) {
+    if (DEPLOYMENT_SHAPE_PREDICATES.multiTenant.holds(v) || !bindMustNarrow(v))
+        return undefined;
+    const where = offHostListener(v);
+    if (where === undefined)
+        return undefined;
+    return (`ALLOW_UNAUTHED_WRITES=true with no service credential on a single-user deployment (REQUIRE_PRINCIPAL is off), listening on ${where} — anyone who can reach this port ` +
+        "submits runs without a principal, and on a single-user deployment such a run is this deployment's one user: it runs under the local-owner permission-rule bucket, " +
+        "so the standing rules that user saved — allow rules included — apply to every caller. " +
+        "Pick one: set SERVICE_AUTH_TOKEN (or SERVICE_AUTH_TOKENS) so only credential holders submit runs; or listen on loopback only (BIND_HOST=127.0.0.1, or leave BIND_HOST unset — " +
+        "an unauthenticated write face then listens on 127.0.0.1 by itself; a container whose port is published to other hosts needs a credential instead) " +
+        "(MIGRATION.md, invariant single-user-anonymous-boundary). Refusing to boot.");
+}
+export function a2aAudienceIdentityBoundaryRefusal(a2aServe, noVerifiedSource) {
+    if (!noVerifiedSource || a2aServe === undefined)
+        return undefined;
+    const restricted = a2aServe.skills.filter((s) => s.audience !== undefined).length;
+    if (restricted === 0)
+        return undefined;
+    return (`A2A_SERVE_SKILLS declares ${restricted} skill${restricted === 1 ? "" : "s"} with an "audience", but this deployment has no identity boundary: ` +
+        `it wires no verified identity source (no service credential, no SSO bridge, no direct-door principal JWT; a trace token or REQUIRE_PRINCIPAL alone verifies nobody), ` +
+        `so a caller's principal header is only a self-asserted label and no caller could ever be matched against an audience. ` +
+        `Wire one verified identity source (SERVICE_AUTH_TOKEN / SERVICE_AUTH_TOKENS, the SSO bridge, or the direct door) or remove the "audience" entries from A2A_SERVE_SKILLS ` +
+        `(MIGRATION.md, invariant a2a-audience-identity-boundary). Refusing to boot.`);
+}
 function sameOperatorDeclaration(a, b) {
     return (DEPLOYMENT_SHAPE_PREDICATES.multiTenant.holds(a) === DEPLOYMENT_SHAPE_PREDICATES.multiTenant.holds(b) &&
         a.operatorSingleUser === b.operatorSingleUser &&
@@ -163,7 +213,7 @@ export const CONFIG_CROSS_INVARIANTS = [
         id: "bind-posture",
         keys: ["authToken", "authTokens", "allowUnauthedWrites"],
         restartReason: "bind-posture",
-        check: ({ live, next }) => !mustNarrowBind(live) && mustNarrowBind(next)
+        check: ({ live, next }) => !bindMustNarrow(live) && bindMustNarrow(next)
             ? "this candidate would make the unauthenticated-write posture require narrowing the listener to 127.0.0.1, but the listen address is bound once at boot — refusing to hot-apply (restart to re-bind)"
             : undefined,
     },
@@ -205,6 +255,20 @@ export const CONFIG_CROSS_INVARIANTS = [
         bootAnchor: { file: "src/http/server.ts", marker: "CROSS-INVARIANT:operator-declaration-required" },
         check: ({ live, next }) => (sameOperatorDeclaration(live, next) ? undefined : operatorDeclarationRefusal(next)),
     },
+    {
+        id: "single-user-anonymous-boundary",
+        keys: [...ANONYMOUS_BOUNDARY_KEYS],
+        restartReason: "bind-posture",
+        bootAnchor: { file: "src/boot/stage-01-config.ts", marker: "CROSS-INVARIANT:single-user-anonymous-boundary" },
+        check: ({ live, next }) => (sameAnonymousBoundary(live, next) ? undefined : singleUserAnonymousBoundaryRefusal(next)),
+    },
+    {
+        id: "operator-single-user-boundary",
+        keys: [...SINGLE_USER_BOUNDARY_KEYS],
+        restartReason: "operator-principals",
+        bootAnchor: { file: "src/boot/stage-01-config.ts", marker: "CROSS-INVARIANT:operator-single-user-boundary" },
+        check: ({ live, next }) => (sameSingleUserBoundary(live, next) ? undefined : operatorSingleUserBoundaryRefusal(next)),
+    },
     {
         id: "bake-operator-principals",
         keys: ["imageBakes", "operatorPrincipals"],

package/dist/config-lkg.d.ts

@@ -1,5 +1,6 @@
 import { type MigrationReceipt } from "@sema-agent/settings-schema/one-time-migrations";
 import { type PublishedPromptArtifact } from "@sema-agent/core";
+import { type ConfigDirTrustHost } from "./config-dir-trust.js";
 /** 落盘信封。`effective`/`etag` 逐字=当时的 fetchEffective 返回(JSON verbatim 面)。`formatVersion` 的语义见头注(5 = 载荷的 prompts 是中心层唯一的那种 wire 形)。 */
 export interface PersistedLkg {
     formatVersion: 5;
@@ -22,6 +23,21 @@ export declare function defaultSkillCacheDir(config: {
 export declare function defaultLkgPath(config: {
     readonly agentConfigDir?: string;
 }, worker: string | undefined, identity: string): string;
+/**
+ * formatVersion 1(7.98.0 及以前,信封不带凭证身份)的 LKG 不读回时的**拒因** —— 一个事实一句话:`loadLkg` 的 1 臂(`CONFIG_LKG_PATH` 指到旧文件)与
+ * 起服读腿点名默认路径旧文件名那一臂({@link preIdentityLkgPath})说同一句,运维按同一个 `reason` 认。
+ */
+export declare const PRE_IDENTITY_LKG_REASON = "pre-identity LKG (formatVersion 1) \u2014 not read back: it cannot prove whose credential fetched it (S-651); the next clean candidate rewrites it";
+/**
+ * 默认路径上 7.98.0 及以前的旧 LKG 还在吗 —— 在 ⇒ 交回它的路径,起服读腿据此打一行 `config_lkg_unusable`(拒因 {@link PRE_IDENTITY_LKG_REASON} + 出路「删掉」);
+ * 不在 ⇒ `undefined`。只看名字上有没有东西(`existsSync`),**不读内容**、不迁、不改名:那个名字只有身份箱之前的版本写过,一次性迁移窗已关。
+ * 配置根本身进不去时答「不在」—— 与 {@link loadLkg} 读箱同一个读法(那一形箱也读不到,箱缺席已是这次起服的结局)。
+ * 调用方只在读箱答「缺席」、且没有 `CONFIG_LKG_PATH` 覆写时问(覆写的那一条路径由 `loadLkg` 自己判);`loadLkg` 把读不了的箱也答成缺席,所以这里先看
+ * 箱名字上有没有东西 —— 有 ⇒ 箱在,旧文件与这次起服无关。
+ */
+export declare function preIdentityLkgLeftover(config: {
+    readonly agentConfigDir?: string;
+}, worker: string | undefined, binPath: string): string | undefined;
 /**
  * `CONFIG_LKG_PATH`(LKG 落盘路径覆写)的**唯一读法**:没设 ⇒ `undefined`(LKG 落在配置根下按箱派生,{@link defaultLkgPath});设了 ⇒ 绝对路径
  * (相对值按进程 cwd 解,与文件被打开时同一个解法);空串 ⇒ 拒(起服拒):空串解出来是进程工作目录本身 —— 一条落盘路径不该是一个目录,
@@ -55,14 +71,20 @@ export interface LkgReadMigration {
     readonly note?: string;
     readonly receipts: readonly MigrationReceipt[];
 }
+/** {@link loadLkg} 读之前判官要的两件:声明的属主(`CONFIG_LOCAL_OWNER_UID`,配置席 `configLocalOwnerUid`;与本地配置根同一张可信集)+ 宿主事实(测试注入;缺席 = 本进程)。 */
+export interface LkgReadTrust {
+    readonly declaredOwnerUid: number | undefined;
+    readonly host?: ConfigDirTrustHost;
+}
 /**
  * 读盘上 LKG。返回 undefined 的所有情形都「安静地回 env 兜底」(调用方 warn 点名 reason):
+ * 别人改得动这份文件(目录信任判官的发现)/
  * 文件缺席/JSON 坏/信封形不对/worker 或凭证身份不匹配(防同名文件跨 worker / 跨账号串包;`CONFIG_LKG_PATH`
  * 单一路径时这是唯一的一道)/载荷有迁不动的旧形({@link migrateLkgPayload})/prompts 面复判失败。
  * `migrated`:读回时做过一次性迁移(信封 2 → 3 / 4 → 5 或载荷的 settings-schema 迁移)—— 调用方响亮打一行,并把交回的 5 写回原位。
  * `prompts`:候选判官对这份载荷 prompts 面交出的中心层(引擎 verify 过的发布形 artifact;`undefined` = 载荷不带 prompts 键)—— 调用方采纳直接用它。
  */
-export declare function loadLkg(path: string, worker: string | undefined, identity: string): Promise<{
+export declare function loadLkg(path: string, worker: string | undefined, identity: string, trust: LkgReadTrust): Promise<{
     lkg: PersistedLkg;
     prompts: PublishedPromptArtifact | undefined;
     migrated?: LkgReadMigration;

package/dist/config-lkg.js

@@ -1,4 +1,4 @@
-import { promises as fs } from "node:fs";
+import { existsSync, promises as fs } from "node:fs";
 import { migrateEffectiveSnapshot } from "@sema-agent/settings-schema/one-time-migrations";
 import { formatConfigPath } from "@sema-agent/settings-schema";
 import { join, dirname, resolve } from "node:path";
@@ -7,12 +7,23 @@ import { judgeConfigCandidate } from "./web-admin-client/candidate-gate.js";
 import { centerStateBin } from "./center-credential.js";
 import { configRootOf } from "./sema-config-dir.js";
 import { atomicWriteFileAsync } from "./plugins/owner-only-file-mode.js";
+import { trustedFileRefusal } from "./config-dir-trust.js";
 export function defaultSkillCacheDir(config) {
     return join(configRootOf(config), "skill-cache");
 }
 export function defaultLkgPath(config, worker, identity) {
     return join(configRootOf(config), `config-lkg-${centerStateBin(worker, identity)}.json`);
 }
+export const PRE_IDENTITY_LKG_REASON = "pre-identity LKG (formatVersion 1) — not read back: it cannot prove whose credential fetched it (S-651); the next clean candidate rewrites it";
+function preIdentityLkgPath(config, worker) {
+    return join(configRootOf(config), `config-lkg-${(worker ?? "global").replace(/[^a-zA-Z0-9._-]/g, "_").slice(0, 64)}.json`);
+}
+export function preIdentityLkgLeftover(config, worker, binPath) {
+    if (existsSync(binPath))
+        return undefined;
+    const path = preIdentityLkgPath(config, worker);
+    return existsSync(path) ? path : undefined;
+}
 export function lkgPathOverrideOf(raw) {
     if (raw === undefined)
         return undefined;
@@ -32,7 +43,10 @@ export async function saveLkg(path, worker, identity, effective, etag) {
     ensureDir(dirname(path));
     await atomicWriteFileAsync(path, JSON.stringify(body), { durability: "best-effort" });
 }
-export async function loadLkg(path, worker, identity) {
+export async function loadLkg(path, worker, identity, trust) {
+    const untrusted = await trustedFileRefusal({ reader: "lkg", file: path, declaredOwnerUid: trust.declaredOwnerUid, ...(trust.host !== undefined ? { host: trust.host } : {}) });
+    if (untrusted !== undefined)
+        return { reason: untrusted };
     let text;
     try {
         text = await fs.readFile(path, "utf8");
@@ -52,7 +66,7 @@ export async function loadLkg(path, worker, identity) {
     const p = parsed;
     const formatVersion = p.formatVersion;
     if (formatVersion === 1)
-        return { reason: "pre-identity LKG (formatVersion 1) — not read back: it cannot prove whose credential fetched it (S-651); the next clean candidate rewrites it" };
+        return { reason: PRE_IDENTITY_LKG_REASON };
     if (formatVersion !== 2 && formatVersion !== 3 && formatVersion !== 4 && formatVersion !== 5)
         return { reason: `unknown formatVersion ${String(formatVersion)}` };
     if (typeof p.worker !== "string" || p.worker !== (worker ?? "global"))

package/dist/config-provider.d.ts

@@ -80,7 +80,7 @@ export declare const BOOT_FETCH_DEFERRED: unique symbol;
  * background continuation that triggers a refresh tick when it finally settles. The timer is unref'd
  * (never holds the loop) and cleared as soon as the fetch wins.
  */
-export declare function raceBootFetch<T>(fetch: Promise<T>, budgetMs: number): Promise<T | typeof BOOT_FETCH_DEFERRED>;
+export declare function raceBootFetch<T>(pull: Promise<T>, budgetMs: number): Promise<T | typeof BOOT_FETCH_DEFERRED>;
 /**
  * The two transport calls the service makes to obtain config, behind a backend-selectable seam. Both
  * signatures and return shapes match `facade.fetchEffective` / `facade.fetchSkillContent`
@@ -186,16 +186,16 @@ export declare class LocalConfigProvider implements ConfigProvider {
     fetchSkillContent(contentHash: string): Promise<string | undefined>;
 }
 /**
- * Map the registry `EffectiveConfig` (superset, all domains) → the service-local `EffectiveConfig`
- * the consumers (`applyEffective`, `resolveMcpServers`, …) expect. The two are structurally compatible
- * for every field the consumers read; this projection makes that explicit (and drops control-plane-only
- * domains the service never consumes: rosters, systems, workers, hosts, integrations, access).
+ * 本地腿交出的有效视图 —— **与中心 `/effective` 同一形**(两条腿只交一种形:契约的线上视图;远端腿交中心铸的那一份,`http-client.ts`)。
  *
- * Skills are mapped to the MANIFEST shape (name/description/scenarios/contentHash/enabled) — the same
- * shape RemoteConfigProvider's `/effective` ships — so the lazy `fetchSkillContent`-by-hash path is
- * identical in both modes. The local content hash is the `contentHash` the store already computed.
+ * 铸法只有契约里那一只:`resolveEffectiveForWorker(eff, null)` —— 中心把存储形铸成 `/effective` 用的同一个函数(本地腿没有 worker 身份 ⇒ 全局拉取:
+ * 目录不按名册收窄、`rosters` 域清空、`entitlement` 清空、技能换成 manifest〔`content` → `contentHash`,正文经 {@link LocalConfigProvider.fetchSkillContent}
+ * 按哈希从同一次读取的存储形里找〕、其余域原样)。本地腿唯一自己的一步是**发布**:存储形的 `prompts` 换成发布形(`localPromptsWire`,契约包的唯一选择读法;
+ * 中心那一步是它的发布闸)。
+ *
+ * 不在这里挑键:每个消费方读自己要的字段(远端腿上它们读的一直是整份线上视图),所以契约给条目加一个键,两条腿同时带上 —— 不存在「本地腿静默丢键」那一类补丁。
  */
-export declare function mapToServiceEffective(eff: AgentConfigEffective, version: number): EffectiveConfig;
+export declare function publishLocalEffective(eff: AgentConfigEffective): EffectiveConfig;
 /**
  * 建判官 {@link configSourceKind} 答出来的那一种配置源:`local` ⇒ {@link LocalConfigProvider}(根 = 递进来的 `localDir`);`remote` ⇒
  * {@link RemoteConfigProvider}(中心 = `webAdmin`)。判官答「无配置源」(没写词、没配中心 = 纯 env 部署)⇒ 抛:调用方只在判官答 local / remote 时建