@sema-agent/server 7.147.0 → 7.148.0

package/dist/boot/execution-env.js

@@ -1,11 +1,10 @@
 import { existsSync } from "node:fs";
 import { join } from "node:path";
-import { createHostLspManager } from "../host-lsp-manager.js";
+import { createLspManager } from "../host-lsp-manager.js";
 import { TaskEnvRegistry } from "../capabilities/sandbox-file-send.js";
 import { DEPLOYMENT_SHAPE_PREDICATES } from "../deployment-shape.js";
 import { SessionEnvironmentSelection } from "../capabilities/select-environment-tool.js";
 import { sandboxEnvNamesInForce } from "../config.js";
-import { createE2bLspManager } from "../lsp/e2b-manager.js";
 import { evictLspOnDestroy } from "../lsp-evict.js";
 import { PerTaskImageRegistry } from "../per-task-image.js";
 import { adbExecutionEnvFactory } from "../plugins/remote-env-adb.js";
@@ -17,10 +16,12 @@ import { boundedStoreCall, checkSandboxEgressPolicy, createSandboxPodApi, create
 import { podSpecPatchBrokerRefusal, SANDBOX_SECRET_SEAT_VERBS } from "../plugins/k8s-exec-protocol.js";
 import { createSandboxBrokerSeatOf, createSandboxGitPlaneSeat, sandboxGitPlanePremisesOf } from "../sandbox-git-plane.js";
 import { createSandboxPodReaper } from "../plugins/k8s-pod-reaper.js";
+import { createLocalDockerReaper } from "../plugins/local-docker-reaper.js";
 import { recordFailOpen } from "../observability/fail-open.js";
 import { createRunWorkspaceSnapshotSeat } from "../fleet/workspace-snapshot-residual.js";
 import { createSpaceCommitFence } from "../workspace-space-commit.js";
 import { localDockerExecutionEnvFactory } from "../plugins/remote-env-local-docker.js";
+import { createLocalDockerCapacity, localDockerWorkerLabelOf } from "../plugins/local-docker-capacity.js";
 import { sshExecutionEnvFactory } from "../plugins/remote-env-ssh.js";
 import { withRemoteScratchpad } from "../plugins/remote-scratchpad.js";
 import { FileSchedulerBackend, defaultSchedulerStorePath } from "../plugins/scheduler-support.js";
@@ -38,7 +39,7 @@ import { workspaceSnapshotTimeoutOf } from "../workspace-space.js";
 import { sayEgressPolicyReading } from "../sandbox-egress-policy.js";
 import { sandboxPathEnvSlots, withSandboxPathEnvSlot } from "./deferred-sandbox-path-env.js";
 import { createLaneHomeAbsenceReporter } from "../lane-home-probe.js";
-import { buildLaneHomeBootNote, buildLaneHomeClaim, capabilitiesFor, executionLaneOf, laneBindsReads, laneIsolated, laneSandboxReadFloorState } from "../execution-lane-caps.js";
+import { buildLaneHomeBootNote, buildLaneHomeClaim, capabilitiesFor, laneIsolated, laneSandboxReadFloorState } from "../execution-lane-caps.js";
 import { warnReadDenyFloorUnkept } from "./execution-lane.js";
 import { seatText } from "../trace/exit-seat.js";
 import { countSessionResidentBackground } from "../session-resident-background.js";
@@ -65,11 +66,13 @@ export function createSessionScopedRegistries(maxEntries = MAX_CWD_SESSIONS) {
     const perSessionShellEnv = new Map();
     const perSessionInheritEnv = new Map();
     const owners = new Map();
+    const occupants = new Map();
     const dropSession = (sid) => {
         perSessionCwd.delete(sid);
         perSessionShellEnv.delete(sid);
         perSessionInheritEnv.delete(sid);
         owners.delete(sid);
+        occupants.delete(sid);
     };
     const touch = (sid, owner) => {
         const next = owner === undefined ? (owners.has(sid) ? owners.get(sid) : null) : owner;
@@ -99,8 +102,14 @@ export function createSessionScopedRegistries(maxEntries = MAX_CWD_SESSIONS) {
             perSessionInheritEnv.set(sid, policy);
             touch(sid, undefined);
         },
-        fenceSessionOwner: (sid, owner) => {
-            if (owners.has(sid) && owners.get(sid) !== owner) {
+        fenceSessionOwner: (sid, owner, incarnation) => {
+            const ownerChanged = owners.has(sid) && owners.get(sid) !== owner;
+            const occupantChanged = incarnation !== undefined && occupants.has(sid) && occupants.get(sid) !== incarnation;
+            if (incarnation === undefined)
+                occupants.delete(sid);
+            else
+                occupants.set(sid, incarnation);
+            if (ownerChanged || occupantChanged) {
                 perSessionCwd.delete(sid);
                 perSessionShellEnv.delete(sid);
                 perSessionInheritEnv.delete(sid);
@@ -108,6 +117,12 @@ export function createSessionScopedRegistries(maxEntries = MAX_CWD_SESSIONS) {
             touch(sid, owner);
         },
         dropSession,
+        dropSessionOf: (sid, incarnation) => {
+            if (occupants.get(sid) !== incarnation)
+                return false;
+            dropSession(sid);
+            return true;
+        },
     };
 }
 export function ownsItsWorkspace(ctx) {
@@ -238,10 +253,14 @@ export function createExecutionEnv(ctx) {
     const { perSessionCwd, setSessionCwd } = sessionScoped;
     const { perSessionShellEnv, setSessionShellEnv } = sessionScoped;
     const { perSessionInheritEnv, setSessionInheritEnv } = sessionScoped;
+    const lspManager = createLspManager(config, (event, fields) => logger.info(event, fields));
+    if (lspManager)
+        logger.info("lsp_enabled", { provider: config.remoteExec.provider });
     let executionEnvFactory;
     let spaceReclaimer;
     let sandboxSecretSeatGate;
-    let sandboxPodReaper;
+    let sandboxReaper;
+    let sandboxCapacity;
     let sandboxGitPlane = createSandboxGitPlaneSeat((r) => sandboxGitPlanePremisesOf(config, r), {});
     let worktreeReap;
     const workspaceFillOf = taskAttachmentStore === undefined ? undefined : (fctx) => createWorkspaceFill({ store: taskAttachmentStore, sessionId: fctx.sessionId, seeds: ownsItsWorkspace(fctx), logger });
@@ -299,7 +318,7 @@ export function createExecutionEnv(ctx) {
         if (k8sCfg.cache !== undefined || k8sCfg.s3Snapshot !== undefined)
             spaceReclaimer = createSpaceReclaimer(k8sCfg);
         sandboxSecretSeatGate = () => ensureSandboxSecretSeat(k8sCfg, logger, undefined, () => readSandboxSecretSeat(k8sCfg, "env"));
-        sandboxPodReaper = createSandboxPodReaper({ api: createSandboxPodApi(k8sCfg), logger, metrics });
+        sandboxReaper = createSandboxPodReaper({ api: createSandboxPodApi(k8sCfg), logger, metrics });
         void checkSandboxEgressPolicy(k8sCfg)
             .then((gaps) => sayEgressPolicyReading(gaps, logger, k8sCfg.namespace))
             .catch((e) => logger.error("sandbox_egress_policy_check_crashed", { error: seatText("operator-log-text", e instanceof Error ? e.message : String(e)), effect: "the sandbox egress self-check did not complete this boot — the lane runs; the egress policy was not read" }));
@@ -347,6 +366,7 @@ export function createExecutionEnv(ctx) {
                 ? new FileSchedulerBackend({
                     storePath: schedulerStorePath,
                     log: logger,
+                    trust: { declaredOwnerUid: config.configLocalOwnerUid },
                     ...(config.schedulerSessionWakeup === false || config.schedulerSessionLifetime === false
                         ? {
                             caps: {
@@ -383,8 +403,11 @@ export function createExecutionEnv(ctx) {
         }
     }
     else if (config.remoteExec.provider === "local-docker") {
-        executionEnvFactory = localDockerExecutionEnvFactory({
+        const workerLabel = localDockerWorkerLabelOf(config.localDataRoot);
+        sandboxCapacity = config.remoteExec.capacity !== undefined ? createLocalDockerCapacity(config.remoteExec.capacity, { label: workerLabel, logger }) : undefined;
+        const localDockerFactory = localDockerExecutionEnvFactory({
             image: config.remoteExec.image,
+            workerLabel,
             ...(config.remoteExec.mountPath ? { mountPath: config.remoteExec.mountPath } : {}),
             ...homeDirSeat, ...homeAbsentNotice,
             ...(config.remoteExec.dockerPath ? { dockerPath: config.remoteExec.dockerPath } : {}),
@@ -398,8 +421,11 @@ export function createExecutionEnv(ctx) {
             ...(config.remoteExec.env ? { env: config.remoteExec.env } : {}),
             sandboxReadFloor: config.sandboxReadFloor,
             ...(workspaceFillOf !== undefined ? { workspaceFillOf } : {}),
+            ...(sandboxCapacity !== undefined ? { capacity: sandboxCapacity } : {}),
             logger,
         }, ctx.laneDeps?.localDocker);
+        executionEnvFactory = localDockerFactory;
+        sandboxReaper = createLocalDockerReaper({ port: localDockerFactory.reapPort, logger, metrics, ...(ctx.laneDeps?.localDockerReapNow !== undefined ? { now: ctx.laneDeps.localDockerReapNow } : {}) });
     }
     if (executionEnvFactory && DEPLOYMENT_SHAPE_PREDICATES.remoteScratchpad.holds(config)) {
         executionEnvFactory = withRemoteScratchpad(executionEnvFactory, logger);
@@ -476,28 +502,6 @@ export function createExecutionEnv(ctx) {
             logger.info("task_inherit_env_honored", { honored: taskInheritEnvRefusal(config) === undefined });
     }
     warnReadDenyFloorUnkept(config, logger);
-    const lspProvider = config.remoteExec.provider;
-    const lspLane = executionLaneOf(lspProvider);
-    const lspLaneBindsReads = lspLane !== undefined && laneBindsReads(lspLane);
-    if ((lspProvider === "e2b" || lspProvider === "k8s") && config.lspEnabled && !lspLaneBindsReads) {
-        logger.warn("lsp_not_mounted", {
-            provider: lspProvider,
-            reason: "LSP_ENABLED is set, but this lane's execution environment cannot bind a read to the file that was checked (openBound), so every language-server file sync would be refused; the LSP tool is not mounted on this lane in this version",
-        });
-    }
-    const lspManager = (lspProvider === "e2b" || lspProvider === "k8s") && config.lspEnabled && lspLaneBindsReads
-        ? createE2bLspManager({
-            log: (event, fields) => logger.info(event, fields),
-            scheme: lspProvider === "k8s" ? "ws" : "wss",
-            provider: lspProvider,
-            metrics,
-        })
-        :
-            lspProvider === "host" && config.lspHostEnabled && config.requirePrincipal !== true && lspLaneBindsReads
-                ? createHostLspManager(config, (event, fields) => logger.info(event, fields))
-                : undefined;
-    if (lspManager)
-        logger.info("lsp_enabled", { provider: lspProvider });
     const unreadableReported = new Set();
     let stallReapFailureReported = false;
     const stallMs = config.backgroundAgentStallMs;
@@ -533,8 +537,10 @@ export function createExecutionEnv(ctx) {
         perTaskImage, sessionEnvSelection, perSessionCwd, setSessionCwd, setSessionShellEnv, setSessionInheritEnv,
         fenceSessionOwner: sessionScoped.fenceSessionOwner,
         dropSessionScoped: sessionScoped.dropSession,
+        dropSessionScopedOf: sessionScoped.dropSessionOf,
         sessionResidentBackground,
-        executionEnvFactory, worktreeReap, sendUserFileTaskEnvs, lspManager, spaceReclaimer, sandboxSecretSeatGate, sandboxPodReaper, sandboxGitPlane,
+        executionEnvFactory, worktreeReap, sendUserFileTaskEnvs, lspManager, spaceReclaimer, sandboxSecretSeatGate, sandboxReaper, sandboxGitPlane,
+        sandboxCapacity,
     };
 }
 //# sourceMappingURL=execution-env.js.map

package/dist/boot/exit-boundary.d.ts

@@ -24,7 +24,7 @@
  * 不是退出边界)。
  */
 import { type TaskRegistry } from "@sema-agent/core";
-import type { Logger } from "../observability/logger.js";
+import { type Logger } from "../observability/logger.js";
 /**
  * 退出边界的硬收面**此刻**会收掉的后台 shell 行数(`background_bash` + `monitor`,在跑,整张进程级注册表,retain 行按
  * {@link PROCESS_EXIT_INCLUDES_RETAINED} 跳过)—— 「引擎现在退,会不会把一条在跑的后台 shell 一起收掉」这一问的**唯一**读法。
@@ -37,7 +37,7 @@ import type { Logger } from "../observability/logger.js";
  *
  * 读不出(core:某行 env 的 retain 声明读抛 ⇒ 计数抛)⇒ 按 **1** 计并经 `onUnreadable` 报出 —— 读不出 ⇒ 非空闲,与驻留项同一条律;
  * 本函数在租约拍(定时器回调)、`/health` 与交接口里被调,**不许抛**(定时器里一抛就是 uncaught,一台交接出去的引擎会因此崩掉并收掉它本该留着的 shell)——
- * 报口自己再抛(抛出物转不成文本之类)也一样:落 `console.error`(不回同一只报口),读数照返 1。
+ * 报口自己再抛(抛出物转不成文本之类)也一样:落日志出口接缝的文本出口 `writeLogText`(不回同一只报口),读数照返 1。
  * `registry` 只供测试换桩(只用到 `countRunningBackgroundShells`)。
  */
 export declare function countShellsExitWouldKill(opts: {

package/dist/boot/exit-boundary.js

@@ -1,5 +1,6 @@
 import { defaultTaskRegistry } from "@sema-agent/core";
 import { reportHardKillReceipts } from "../background-session-reap.js";
+import { writeLogText } from "../observability/logger.js";
 import { liveHostForegroundChildCount, reapHostForegroundChildren } from "../plugins/host-platform.js";
 import { liveEphemeralHostWorkspaceCount, reapEphemeralHostWorkspaces } from "../plugins/host-workspace-registry.js";
 import { seatText } from "../trace/exit-seat.js";
@@ -14,7 +15,7 @@ export function countShellsExitWouldKill(opts) {
             opts.onUnreadable(err);
         }
         catch (reportErr) {
-            console.error("engine_handover_shell_count_report_threw", reportErr);
+            writeLogText("stderr", "engine_handover_shell_count_report_threw", reportErr);
         }
         return 1;
     }
@@ -70,19 +71,19 @@ export function installProcessExitBoundary({ logger }) {
             reapOwnChildProcesses();
         }
         catch (err) {
-            console.error("shutdown_exit_boundary_child_reap_threw", err);
+            writeLogText("stderr", "shutdown_exit_boundary_child_reap_threw", err);
         }
         try {
             reapBackgroundHard();
         }
         catch (err) {
-            console.error("shutdown_exit_boundary_background_hard_kill_threw", err);
+            writeLogText("stderr", "shutdown_exit_boundary_background_hard_kill_threw", err);
         }
         try {
             reapOwnHostWorkspaces();
         }
         catch (err) {
-            console.error("shutdown_exit_boundary_workspace_reap_threw", err);
+            writeLogText("stderr", "shutdown_exit_boundary_workspace_reap_threw", err);
         }
         const left = { foregroundChildren: liveHostForegroundChildCount(), hostWorkspaces: liveEphemeralHostWorkspaceCount() };
         try {
@@ -91,7 +92,7 @@ export function installProcessExitBoundary({ logger }) {
                 logger.warn("shutdown_exit_boundary_incomplete", left);
         }
         catch (err) {
-            console.error("shutdown_exit_boundary_log_threw", err);
+            writeLogText("stderr", "shutdown_exit_boundary_log_threw", err);
         }
     };
     process.once("exit", onProcessExit);

package/dist/boot/fatal-exit.d.ts

@@ -18,12 +18,10 @@ export declare function buildFatalErrorText(err: unknown): string;
  * ── 修 ─────────────────────────────────────────────────────────────────────────────────────────
  * **同一只产物**再原样多行写一份到 stderr。刻意不做的三件:不铸第二份文案(两份措辞必然分叉)、不加
  * pretty 旋钮(一个只有出错时才走的出口不该有配置面)、JSON 行**照旧**(机读面零回退,scraper 不动)。
- * 两个面都在 stderr,次序=先机器行后人读段。**这个次序还承重**:`createLogger()` 的构造会装上 stdio 的
- * EPIPE 无害化监听(见 `observability/logger.ts` 那段注 —— 宿主把 stderr 接管道又先退时,下一次写会发一个
- * 异步 `'error'`,无监听即致命),所以那条裸 `process.stderr.write` **必须**排在它之后;同步抛由下面的
- * `try/finally` 兜住。
+ * 两个面都在 stderr,次序=先机器行后人读段;两个面都经日志出口接缝(`observability/logger.ts`:同一只秘密形筛、同一只
+ * 物理写,EPIPE 无害化监听由接缝在每次写之前装好),同步抛由下面的 `try/finally` 兜住。
  *
- * 全仓两个 fatal 出口(`main.ts` 的 `main().catch` 与 `run-local.ts` 的同名尾巴)都经这里 —— 后者此前
+ * 全仓三个 fatal 出口(`main.ts` 的 `main().catch`、起服前探针 `model-plane-probe.ts` 的同名尾巴与 `run-local.ts` 的那一只)都经这里 —— run-local 此前
  * 连形状律都没过(裸 `String(err)`),两处各写一遍正是「同类不同命」的土壤。
  */
 export declare function fatalExit(err: unknown): never;

package/dist/boot/fatal-exit.js

@@ -1,5 +1,5 @@
 import { redactSecrets } from "../trace/redact.js";
-import { createLogger } from "../observability/logger.js";
+import { createLogger, writeLogText } from "../observability/logger.js";
 export function buildFatalErrorText(err) {
     const code = err instanceof Error ? err.code : undefined;
     return redactSecrets(typeof code === "string" && err instanceof Error ? `${err.name} [${code}]: ${err.message}` : String(err));
@@ -8,7 +8,7 @@ export function fatalExit(err) {
     const text = buildFatalErrorText(err);
     try {
         createLogger().error("fatal", { err: text });
-        process.stderr.write(text + "\n");
+        writeLogText("stderr", text);
     }
     finally {
         process.exit(1);

package/dist/boot/leader.d.ts

@@ -81,5 +81,20 @@ export declare function leaderK8sMinioGap(leaderEnabled: boolean, leaderProvider
  * 而承担的方式是重复的真实推送。
  */
 export declare function assertLeaderDurableStore(leaderEnabled: boolean, hasLeaderRunStore: boolean): void;
+/**
+ * leader 的对象存储座(F2(a) 工厂模式的 diff-out:worker 自传补丁到 `<桶>/leader-diff/…`,leader 用同桶的 presigned GET 取回)。纯数据:三键齐(`MINIO_ENDPOINT` /
+ * `MINIO_ACCESS_KEY` / `MINIO_SECRET_KEY`)⇒ `{ s3 }`,否则 `{}`(静态兼容模式;k8s 车道要它)。
+ * 桶 = `MINIO_BUCKET`,缺席 = 工作区快照桶的**缺省名**(`WORKSPACE_SNAPSHOT_BUCKET_DEFAULT`,同一只常量)。两根旋钮各自独立:改了 `WORKSPACE_SNAPSHOT_BUCKET` 的部署,
+ * leader 的补丁仍落 `MINIO_BUCKET` 那一只 —— 要同桶就两根同设(目录两行写明)。
+ */
+export declare function buildLeaderObjectStore(env?: NodeJS.ProcessEnv): {
+    readonly s3?: {
+        endpoint: string;
+        bucket: string;
+        accessKey: string;
+        secretKey: string;
+        region?: string;
+    };
+};
 export declare function createLeaderFace(ctx: LeaderCtx): ReturnType<typeof createLeaderEndpoint> | undefined;
 //# sourceMappingURL=leader.d.ts.map

package/dist/boot/leader.js

@@ -1,8 +1,10 @@
 import { createLeaderEndpoint } from "../leader/endpoint.js";
-import { createLeaderRunVisibility } from "../http/owner-access.js";
-import { createLeaderRunner } from "../leader/wire.js";
-import { buildDeploymentPostureSeats } from "./runner-deps.js";
+import { seesRunAs } from "../http/owner-access.js";
+import { claimCallerOf } from "../security.js";
+import { createLeaderParkExpirer, createLeaderRunner } from "../leader/wire.js";
+import { buildDeploymentPostureSeats, buildHandsBand } from "./runner-deps.js";
 import { hasApprovalListIntent } from "../approval.js";
+import { WORKSPACE_SNAPSHOT_BUCKET_DEFAULT } from "../object-store-buckets.js";
 export function leaderK8sMinioGap(leaderEnabled, leaderProvider, hasS3) {
     if (!(leaderEnabled && leaderProvider === "k8s" && !hasS3))
         return null;
@@ -21,19 +23,17 @@ export function assertLeaderDurableStore(leaderEnabled, hasLeaderRunStore) {
         "without it a retry starts a SECOND real git push. Fix the database (or unset LEADER_ENABLED) and restart " +
         "(#193 车4 件2 capability gate; the DB_BACKEND literal check in config.ts is the intent half of the same rule)");
 }
+export function buildLeaderObjectStore(env = process.env) {
+    const endpoint = env.MINIO_ENDPOINT;
+    const accessKey = env.MINIO_ACCESS_KEY;
+    const secretKey = env.MINIO_SECRET_KEY;
+    if (!endpoint || !accessKey || !secretKey)
+        return {};
+    return { s3: { endpoint, bucket: env.MINIO_BUCKET ?? WORKSPACE_SNAPSHOT_BUCKET_DEFAULT, accessKey, secretKey, ...(env.MINIO_REGION ? { region: env.MINIO_REGION } : {}) } };
+}
 export function createLeaderFace(ctx) {
     const { config, logger, brain, pricing, executionEnvFactory, toolResultStore, sessionStore, checkpointStore, checkpointCtxSealing, governanceSeams } = ctx;
-    const leaderMinio = process.env.MINIO_ENDPOINT && process.env.MINIO_ACCESS_KEY && process.env.MINIO_SECRET_KEY
-        ? {
-            s3: {
-                endpoint: process.env.MINIO_ENDPOINT,
-                bucket: process.env.MINIO_BUCKET ?? "workspaces",
-                accessKey: process.env.MINIO_ACCESS_KEY,
-                secretKey: process.env.MINIO_SECRET_KEY,
-                ...(process.env.MINIO_REGION ? { region: process.env.MINIO_REGION } : {}),
-            },
-        }
-        : {};
+    const leaderMinio = buildLeaderObjectStore();
     const leaderProvider = config.remoteExec.provider;
     const leaderRunStore = ctx.backend?.leaderRun?.();
     assertLeaderDurableStore(config.leaderEnabled, leaderRunStore !== undefined);
@@ -60,6 +60,7 @@ export function createLeaderFace(ctx) {
             ...(ctx.promptSource ? { promptSource: ctx.promptSource } : {}),
             ...(ctx.onError ? { onError: ctx.onError } : {}),
             mods: ctx.deploymentMods,
+            hands: buildHandsBand(config, undefined),
             fanoutEnabled: config.leaderFanoutEnabled,
             ...(process.env.MODEL_ROUTER_ID ? { routerModel: process.env.MODEL_ROUTER_ID } : {}),
             ...(leaderProvider === "e2b" ? { e2bApiKey: config.remoteExec.apiKey } : {}),
@@ -87,7 +88,8 @@ export function createLeaderFace(ctx) {
             logger,
             requiredFields: ["objective", "durableRemote", "testCmd", "seedCmd", "baseSha"],
             ...(leaderRunStore ? { store: leaderRunStore } : {}),
-            ownerVisible: createLeaderRunVisibility(config),
+            ownerVisible: (subject, owner) => seesRunAs("run.leader", claimCallerOf(subject ?? undefined, config), owner ?? null),
+            ...(checkpointStore ? { expireWorkerParks: createLeaderParkExpirer(checkpointStore) } : {}),
         })
         : undefined;
     if (leaderEndpoint)

package/dist/boot/memory-consolidation.d.ts

@@ -55,6 +55,8 @@ export type ConsolidationSeatBilling = {
     readonly kind: "unresolvable";
     readonly fault: string;
 };
+/** 整理席解座的输入 = core 解析器的输入(凭据席除外 —— 由本函数按冻结的钥匙表铸)+ 部署的两张 per-model 钥匙表(与 `models` 同一代,同一刻读)。 */
+export type ConsolidationSeatDeps = Omit<MemoryConsolidationDriverDeps, "getApiKeyAndHeaders"> & Pick<ServiceConfig, "modelApiKeyEnv" | "modelApiKeys">;
 /** 座解析的产物:core 的 options 原样 + 给投影用的两位自证。 */
 export interface ConsolidationDriverSeat {
     /** `runMemoryConsolidationDriver` 第三参的**模型席那一半**,core 的 `resolveMemoryConsolidationDriver` 原样产出(写判官另由操作面的座给)。 */
@@ -81,7 +83,7 @@ export interface ConsolidationDriverSeat {
  * 体内的注 —— 那里才是它真正生效的地方,写在这里会随实现漂。
  * (探针只构造闭包、不发任何请求、无副作用。)
  */
-export declare function resolveConsolidationDriverSeat(deps: MemoryConsolidationDriverDeps): ConsolidationDriverSeat;
+export declare function resolveConsolidationDriverSeat(input: ConsolidationSeatDeps): ConsolidationDriverSeat;
 /**
  * [ref] 波 0([ref] §3)—— 整理驱动席的 **restart 读数**。过渡件:**波 1 转热后删**(那时每轮 run 起手
  * 现取当前代的席,不再有 boot 烤死的席,这只表也就没有要比的东西了)。
@@ -117,6 +119,8 @@ export interface ConsolidationSeatWatch {
 }
 /** 解席的输入面 = boot 期真席用的同三件(活引用:refresh 就地换代,`read()` 每次现取)。 */
 export type ConsolidationSeatPlane = Pick<MemoryConsolidationDriverDeps, "models" | "tiers" | "roles">;
+/** 重启读数的输入面 = 解席三件 + 座随之冻结的两张钥匙表(座位指纹带凭据身份)。 */
+export type ConsolidationSeatWeldPlane = ConsolidationSeatPlane & Pick<ServiceConfig, "modelApiKeyEnv" | "modelApiKeys">;
 /**
  * **每 scope 单飞**(codex 交叉复审 [high],验真后修)—— 同一 scope 上在飞的那一轮被后来者**并入**,
  * 而不是各起一轮。`create*`:返回带状态的活对象。
@@ -258,7 +262,7 @@ export declare function resolveConsolidationValve(input: {
 export declare function createConsolidationValveWatch(input: {
     driver: MemoryConsolidationDriverConfig;
     unwirable: Parameters<typeof resolveConsolidationValve>[0]["unwirable"];
-    plane: () => ConsolidationSeatPlane;
+    plane: () => ConsolidationSeatWeldPlane;
 }): ConsolidationSeatWatch | undefined;
 /**
  * 阀门的**装配点**(车PI 修复轮 ⑦(a)(e):boot 第 4 段调它,测试调同一只 —— 不在测试里手抄接线)。`create*`:产出带行为的 watch。
@@ -279,7 +283,7 @@ export declare function createConsolidationValve(input: ConsolidationValveInput
 };
 /** 阀门判决的两件输入(装配点与纯判共用一只形 —— 两个入口递的是同一组事实)。 */
 export interface ConsolidationValveInput {
-    readonly config: Pick<ServiceConfig, "memoryConsolidationDriver" | "memoryEngineBackend" | "memoryProvenance" | "compliancePosture" | "models" | "tiers" | "roles">;
+    readonly config: Pick<ServiceConfig, "memoryConsolidationDriver" | "memoryEngineBackend" | "memoryProvenance" | "compliancePosture" | "models" | "tiers" | "roles" | "modelApiKeyEnv" | "modelApiKeys">;
     /** 只读两件:在不在(记忆引擎接没接线)、整理状态随不随后端走(引擎的 `memoryGovernanceDurability` 答)。 */
     readonly memoryEngine: {
         readonly backend: MemoryBackend;
@@ -403,35 +407,37 @@ export declare function assertAutoConsolidationWirable(input: {
  * 「这条路径能不能写」在引擎里只有**一只**判官(合成写判官:技能拒行 / 收窄折叠 / 调用方与继承策略 / 人的持久规则车道 / 组织车道,一条走法一个优先序)。
  * 引擎的自动整理腿(有腿:名册上的 `Write` 脸、引擎盖的豁免根、人的持久规则读者)与本腿(运维手动阀门:没有腿)用的是**同一个构造器** ——
  * 同样的行给同样的答案,本仓不手搭第二只({@link createOperatorValveWriteJudge} 恰一处调用它,见 `test/memory-consolidation-write-judge.test.ts` ⑥)。
+ * 判官**按次铸**:每一次真跑(单飞里起跑的那一次,并入的等待者不另铸)现铸一只,所以人读的是发起这一轮的那位。
  *
- * ## 本仓供的两个部署事实(其余键一律缺席,缺席的语义见引擎:那一层不存在)
+ * ## 本仓供的部署事实(其余键一律缺席,缺席的语义见引擎:那一层不存在)
  *
  *  · `ruleStoreProvider` = 部署唯一的那只合成规则店(`RunnerDeps.permissionRuleStore` 的同一个变量,装配第 4 段铸一次)。规则店没装配 ⇒ 缺席 ⇒ 没有规则层。
+ *  · 人(`principal` / `localOwnerDeclared`)= **发起这一轮的调用方**:带主体 ⇒ 读那个主体的桶;不带主体 ⇒ 读本机属主的桶,当且仅当部署声明了它
+ *    (`localOwnerDeclared` = Runner 下发的 `localOwnerRules` 同一只判据 `localOwnerRulesDeclared` 的答案;多租形不声明 ⇒ 匿名地板,而多租形的阀门口本来就要主体)。
+ *    整理 run 按 scope 单飞、可续跑:并入正在跑的那一轮的调用方用起跑者的判官(它们拿到的是同一份收执);续跑一条 pending run 的那一次,发起者就是这一次的调用方。
  *  · `anchors.home` = `executionLaneHomeDir(config)` —— `~/` 行的基,与引擎执行环境的 `homeDir` 座、下单 422 门、规则基 `taskHome` 是**同一只函数**
  *    (车道没有自己的 home 时诚实缺席;缺席 ⇒ 引擎读到人持有的 `~/` 收紧行时无处锚定 = 按异议处置,拒闭)。**刻意不另调 `os.homedir()`**:
- *    那会在非 host 车道上造出第二个读法 —— 阀门答「可解析」而腿内答「读不出」。⚠️ 今天这一键在生产座上**空转**:阀门不带主体(下面的 `principal`),
- *    引擎读匿名地板、不读任何人的持久行,「`~/` 行无锚 ⇒ 拒闭」走不到;留着它是为了主体有了来源之后不必再回来改这里。
- *
- * ## 刻意缺席的键(披露,不是遗漏)—— 三层没喂,所以这条腿仍是**响亮的放行座**(P-DEBT,见 {@link createOperatorValveWriteJudge})
- *
- *  · `principal` / `localOwnerDeclared`(人的持久规则层):阀门是 operator 面的一次调用,本仓没有一个能回答「这个库属于谁」的来源 ——
- *    单用户 + file 后端(阀门结构上能起的唯一形,见 {@link assertConsolidationDriverWirable})里记忆是部署级全局层 / 任务根散列的项目层,principal 标签从不分盘,
- *    本仓也从不声明 `localOwnerRules`;整理 run 又是按 scope 单飞、可续跑的持久作业,「谁的规则」对并入 / 续跑的调用方没有定义。
- *  · `callerPolicy`(部署的调用方策略层):`APPROVAL_REQUIRE` / `APPROVAL_DENY` / `AUTONOMY` / 敏感路径守卫集是**每任务现合成**的(`deployment-governance.ts`,
- *    读热可改的活配置,「禁 memoize」),没有部署级单例;boot 期铸一份喂进来就是冻结一份会过期的策略(收紧不生效 = 静默放行)。喂它需要一份设计:取哪几层、
- *    活配置怎么读、审批席取什么形;其中敏感路径层还要引擎的豁免根(`RunnerDeps.memoryEngineDir` 盖在每个请求上),而宿主构造器的输入没有这一位 —— 要向 core 请托,
- *    不在本层造第二条豁免根的读法。
- *  · `anchors.root`:阀门按 scope 跑,手里没有项目根 —— 项目层 scope 键是任务根的单向散列(`project-identity.ts` 的 `repo:<sha256[:24]>`),反推不出根;
- *    全局层根本没有根。⇒ 人持有的相对 deny / ask 行无处锚定 = 异议,拒闭(引擎契约:判官不猜一行原本指向哪里)。
+ *    那会在非 host 车道上造出第二个读法 —— 阀门答「可解析」而腿内答「读不出」。
+ *
+ * ## 刻意缺席的键(披露,不是遗漏)—— 这两样没喂,所以这条腿仍记一笔债(P-DEBT,见 {@link createOperatorValveWriteJudge})
  *
- *  所以今天这条腿的放行范围与 7.128.x 相同(人的规则、部署的审批名单 / 敏感路径守卫都拦不住手动阀门这一轮折叠);变的只是「判官不再是代答」—— 往后每喂一层,
- *  只在本函数加键,钉 = `test/memory-consolidation-write-judge.test.ts` ⑦。
+ *  · `callerPolicy`(部署的调用方策略层):腿上它是任务的整条部署治理链(审批名单 + 敏感路径守卫与誊本门 + 命令策略,经 `createDeploymentGovernanceInputs` /
+ *    `createApprovalBaselinePolicy` / `applyRuntimeGovernance` 同一组构造口铸)。只喂其中一层(例如只喂审批名单)= 这条腿上半条治理链 —— 构造口的每个消费者都要挂
+ *    部署旋钮矩阵的一条腿、背齐全部旋钮(`test/operator-knob-client-posture-matrix.test.ts` 的消费腿对账),半条链背不齐。整条链喂进来又卡在敏感路径守卫:
+ *    腿上的守卫靠引擎盖在每个请求上的豁免根(`RunnerDeps.memoryEngineDir`)放过记忆库自己的写,宿主构造器的输入没有这一位 —— 不带豁免根喂进去会把库里的写当守卫目标拒掉
+ *    (与腿不同答);在本层另造一条豁免根的读法是第二个写者。⇒ 等引擎的宿主输入收这一位,再整条喂、挂矩阵腿。
+ *  · `anchors.root`:阀门按 scope 跑,手里没有项目根 —— 项目层 scope 键是任务根的单向散列(`project-identity.ts` 的 `repo:<sha256[:24]>`),反推不出根;
+ *    全局层根本没有根。⇒ 人持有的相对 deny / ask 行无处锚定 = 异议,拒闭(引擎契约:判官不猜一行原本指向哪里)。这一格没有来源,永久缺席。
  *
  * 自动整理腿不受影响:它走引擎腿自己的判官,人的持久规则与部署策略照判。
  */
 export declare function createOperatorValveJudgeInput(facts: {
     /** 部署唯一的合成规则店(装配第 4 段铸一次,`RunnerDeps.permissionRuleStore` 与本座读同一只)。缺席 = 规则店没装配。 */
     readonly ruleStoreProvider: PermissionRuleStoreProvider | undefined;
+    /** 部署是否声明本机属主的规则桶(`boot/runner-deps.ts` 的 `localOwnerRulesDeclared` —— Runner 下发 `localOwnerRules` 的同一只判据)。 */
+    readonly localOwnerDeclared: boolean;
+    /** 发起这一轮的调用方(阀门口的已验主体;不带主体 = `undefined`)。 */
+    readonly initiator: string | undefined;
     /** 只读 `executionLaneHomeDir` 读的两位(`ServiceConfig` 结构满足)。 */
     readonly config: LaneHomeDeployment;
 }): ConsolidationWriteJudgeInput;
@@ -439,10 +445,10 @@ export declare function createOperatorValveJudgeInput(facts: {
  * 运维阀门腿的写判官座:引擎的判官构造器喂 {@link createOperatorValveJudgeInput},**外加一个响亮的债计数**(P-DEBT)。
  *
  * 构造器只有引擎那一只,本函数不判任何东西:`judge(target)` 的答案原样返回。它只在每次被问时记一次
- * `server.memory-consolidation.operator-valve-layers-unfed`(计数 + 探针行 + 一次性告警)—— 因为人的规则层、部署策略层、项目根三样都没喂
- * ({@link createOperatorValveJudgeInput} 头注),放行的最坏后果没变:运维手动整理时,一条点名记忆库路径的人的持久规则或部署写策略拦不住这一轮折叠
- * (与 7.128.x 逐字同)。债在遥测里显形,而不是随着「判官已换成引擎的」这句话消失。自动整理腿不受影响,走引擎腿自己的判官。
- * 收口 = 三层各自有了来源(人:「读谁的桶」裁定;策略:设计 + 引擎的豁免根入参;根:无来源则永久缺席并改写本债)那一版,本 tag 删。
+ * `server.memory-consolidation.operator-valve-layers-unfed`(计数 + 探针行 + 一次性告警)—— 人已喂;没喂的是部署的调用方策略层
+ * (整条治理链等引擎的宿主输入收豁免根)与项目根(没有来源)({@link createOperatorValveJudgeInput} 头注)。放行的最坏后果:运维手动整理时,
+ * 部署的写策略(例如 `APPROVAL_DENY=Write`、点名记忆库路径的敏感路径守卫)拦不住这一轮折叠;人的 deny 行拦得住,人持有的相对行照旧拒闭。
+ * 自动整理腿不受影响,走引擎腿自己的判官。收口 = 引擎的宿主输入收豁免根、整条部署治理链喂上并挂矩阵腿那一版,本 tag 删(项目根改写成永久缺席的披露)。
  */
 export declare function createOperatorValveWriteJudge(facts: Parameters<typeof createOperatorValveJudgeInput>[0]): ConsolidationWriteJudge;
 /** 两个 admin 口消费的窄能力面(`ServiceDeps.memoryConsolidation` 的实参来源)。 */
@@ -454,8 +460,9 @@ export interface MemoryConsolidationFaces {
     /** 配置表的 scope(`MEMORY_CONSOLIDATION_SCOPES`)。恰好一条时是两个口的**唯一**缺省。 */
     readonly scopes: readonly string[];
     /** 跑(或**续跑**)一轮。core 的 run 行是持久的:同一 scope 上有 pending run 时本调用 CONTINUE 它
-     *  (同一 plan 缓存、同一 force requestId、零新 mint)—— 所以这一口对**重试安全**。 */
-    run(scope: string): Promise<ConsolidationRunReceipt>;
+     *  (同一 plan 缓存、同一 force requestId、零新 mint)—— 所以这一口对**重试安全**。
+     *  `initiator` = 发起这一次的调用方(已验主体;不带主体 = `undefined`):写判官按它读人的规则桶;并入正在跑的那一轮的调用方用起跑者的判官。 */
+    run(scope: string, initiator: string | undefined): Promise<ConsolidationRunReceipt>;
     /** 该 scope 最近一次 driver run 的账(`undefined` = 从没跑过 —— 诚实缺席,不编一个空壳)。core 7.63.0([ref])起经引擎的治理店座读、异步。 */
     lastRun(scope: string): Promise<ConsolidationDriverRunRow | undefined>;
 }
@@ -496,9 +503,10 @@ export declare function createMemoryConsolidationFaces(stores: MemoryScopeStores
     /** 停因自由文本的**运维日志**座(缺席 = 没人听,不影响任何行为)。载荷由 {@link buildStopDetailAudit}
      *  铸,调用点在单飞回调**之内** ⇒ 一轮真 run 一行,并入的等待者不各落一行。 */
     onStopDetail?: (audit: ReturnType<typeof buildStopDetailAudit>) => void;
-    /** core 7.50.0:整理跑的**写判官座**(必填 —— 缺席不是「没有规则」,core 也拒)。操作面不判任何东西,只把它原样递给驱动动词:
-     *  早问库目录一次、应用时问每个产物文件,答 `no_objection` 以外一律拒写。装配层给哪一只见 {@link createOperatorValveWriteJudge}。 */
-    writeJudge: ConsolidationWriteJudge;
+    /** core 7.50.0:整理跑的**写判官座**(必填 —— 缺席不是「没有规则」,core 也拒),按发起者铸:每一次真跑(单飞里起跑的那一次)调一次,
+     *  拿到的判官原样递给驱动动词 —— 早问库目录一次、应用时问每个产物文件,答 `no_objection` 以外一律拒写。操作面不判任何东西。
+     *  装配层给哪一只见 {@link createOperatorValveWriteJudge}。 */
+    writeJudgeFor: (initiator: string | undefined) => ConsolidationWriteJudge;
     /** 引擎通告的**运维行**座(与 Runner 的 `onNotice` 同一只转发器)。缺席 ⇒ 通告只在回执上。判官拒的两种时机都经它走一次:
      *  应用时拒 = 引擎在驱动里铸的 `memory.consolidation_incomplete`;早问拒 = 驱动抛出的拒绝经引擎导出的投递口(`deliverWriteRefusal`)转成的
      *  `memory.consolidation_refused`(本仓不读通告名、不自铸通告形)。 */

package/dist/boot/memory-consolidation.js

@@ -7,7 +7,11 @@ import { captureRecordStoreOf } from "../memory-operator-faces.js";
 import { memoryStoreForRequest } from "../memory-scope-stores.js";
 import { createConsolidationWriteJudge, deliverWriteRefusal, expandTiers, MemoryEngine, memoryGovernanceDurability, modelOriginOf, resolveComplianceDenies, resolveMemoryConsolidationDriver, runMemoryConsolidationDriver, } from "@sema-agent/core";
 import { seatText } from "../trace/exit-seat.js";
-export function resolveConsolidationDriverSeat(deps) {
+import { createKeyResolver, credentialIdentityFingerprint, credentialIdentityOf } from "../key-resolver.js";
+export function resolveConsolidationDriverSeat(input) {
+    const { modelApiKeyEnv, modelApiKeys, ...seatDeps } = input;
+    const frozenKeys = createKeyResolver({ ...modelApiKeyEnv }, process.env, { ...modelApiKeys });
+    const deps = { ...seatDeps, ...(frozenKeys !== undefined ? { getApiKeyAndHeaders: frozenKeys } : {}) };
     let options;
     try {
         options = resolveMemoryConsolidationDriver(deps);
@@ -57,7 +61,7 @@ function consolidationSeatFingerprint(plane) {
     if ("unresolvable" in seat)
         return seat;
     const { cost: _cost, ...route } = seat.entry;
-    return route;
+    return { ...route, credential: credentialIdentityFingerprint(credentialIdentityOf(plane, seat.entry.name)) };
 }
 function seatLabel(deps) {
     if (deps.memoryConsolidationDriver?.chat !== undefined)
@@ -195,7 +199,7 @@ export function createConsolidationValve(input) {
     if (valve.notice !== undefined)
         logger.warn(valve.notice.tag, { detail: valve.notice.detail });
     assertConsolidationDriverWirable({ ...wiring, enabled: valve.enabled });
-    const plane = () => ({ models: config.models, tiers: config.tiers, roles: config.roles });
+    const plane = () => ({ models: config.models, tiers: config.tiers, roles: config.roles, modelApiKeyEnv: config.modelApiKeyEnv, modelApiKeys: config.modelApiKeys });
     return { valve, watch: createConsolidationValveWatch({ driver: config.memoryConsolidationDriver, unwirable, plane }) };
 }
 export function judgeConsolidationValve(input) {
@@ -322,6 +326,8 @@ export function createOperatorValveJudgeInput(facts) {
     const home = executionLaneHomeDir(facts.config);
     return {
         ...(facts.ruleStoreProvider !== undefined ? { ruleStoreProvider: facts.ruleStoreProvider } : {}),
+        ...(facts.initiator !== undefined && facts.initiator !== "" ? { principal: facts.initiator } : {}),
+        ...(facts.localOwnerDeclared ? { localOwnerDeclared: true } : {}),
         anchors: home !== undefined ? { home } : {},
     };
 }
@@ -356,10 +362,10 @@ export function createMemoryConsolidationFaces(stores, input) {
         seat: input.seat.seat,
         model: input.seat.model,
         scopes: input.scopes,
-        run: (scope) => flight(scope, async () => {
+        run: (scope, initiator) => flight(scope, async () => {
             const receipt = await runMemoryConsolidationDriver(engineOf(scope), scope, {
                 ...input.seat.options,
-                writeJudge: input.writeJudge,
+                writeJudge: input.writeJudgeFor(initiator),
                 compliance: { ...(input.postureOf !== undefined ? { postureOf: input.postureOf } : {}), scopeContract: memoryScopeContractOf([scope]) },
                 ...(input.onNotice !== undefined ? { onNotice: input.onNotice } : {}),
             }).catch((err) => {

package/dist/boot/org-memory.js

@@ -28,7 +28,7 @@ export function createOrgMemoryAdmissionWiring(opts) {
     const directory = centerLeg !== undefined
         ? (() => {
             const directoryNow = createIdentityBins(centerLeg.credential, (credential) => createOrgMemoryDirectory({
-                fetchSection: (principal) => fetchPrincipalOrgMemory({ baseUrl: centerLeg.baseUrl, credential }, principal, fetch, centerLeg.worker),
+                fetchSection: (principal) => fetchPrincipalOrgMemory({ baseUrl: centerLeg.baseUrl, credential }, principal, undefined, centerLeg.worker),
                 grantTtlMs: config.memoryOrgGrantTtlMs,
                 unavailableBackoffMs: config.memoryOrgUnavailableBackoffMs,
                 logger,

package/dist/boot/parked-revive-gate.js

@@ -7,7 +7,7 @@ import { applyRuntimeGovernance } from "../runtime-governance.js";
 import { DeferredSandboxPathEnv, sandboxPathEnvSlots } from "./deferred-sandbox-path-env.js";
 import { DEPLOYMENT_SHAPE_PREDICATES } from "../deployment-shape.js";
 import { executionLaneHomeDir } from "../execution-lane-caps.js";
-import { createDeploymentListExemption } from "../approval.js";
+import { createSessionExemptionRead } from "../approval.js";
 import { seatText } from "../trace/exit-seat.js";
 function hostGateCwd(config, localRoot) {
     return join(config.localDataRoot ?? localRoot, "parked-revive-unrooted");
@@ -33,7 +33,7 @@ export function createParkedReviveInheritedGate(deps) {
         const baseline = createApprovalBaselinePolicy(config, {
             kind: "durable",
             question,
-            ...(approvalExemptionStore !== undefined && rootSessionId ? { exemption: createDeploymentListExemption(approvalExemptionStore, rootSessionId, logger, "parked_revive") } : {}),
+            ...(approvalExemptionStore !== undefined && rootSessionId ? { exemption: createSessionExemptionRead(approvalExemptionStore, rootSessionId, logger, "deployment_list", "parked_revive") } : {}),
         });
         const governed = applyRuntimeGovernance({ objective: "", toolPolicy: baseline }, createDeploymentGovernanceInputs(config, pathAdjudication));
         return {

package/dist/boot/reapers.d.ts

@@ -26,7 +26,7 @@ import type { ApprovalNonceStore, CheckpointStoreFull, CostQuotaStore, ImageBake
 import { type StoreSweep, type StoreSweepLeg } from "../plugins/store-sweep.js";
 import type { ToolApprovalCoordinator } from "../tool-approval.js";
 import type { ParkCommitWatch } from "../plugins/park-commit-watch.js";
-import { type SandboxPodReaper } from "../plugins/k8s-pod-reaper.js";
+import { type SandboxReaper } from "../plugins/sandbox-reaper.js";
 import { type AuditRotationPort } from "../approval-ask-retention.js";
 /** [ref] / [ref]§五(sema-comms `audits/failopen-governance-176.md` §7 "Z 类 1 条"):default consecutive-failure
  *  count before a reaper leg's swallowed error gets a `warn` line. The ~15 `.catch(() => undefined)` sites
@@ -122,8 +122,9 @@ export interface ReapersCtx {
     approvalAskAudit: AuditRotationPort | undefined;
     /** 晚绑(server 造出来才有)——见文件头「位置即契约」①。 */
     getRunDenySweep: () => ((now: number) => Promise<void>) | undefined;
-    /** k8s 车道的沙箱 Pod reaper(`plugins/k8s-pod-reaper.ts`;第 5 段与 run 工厂同一份 k8s 配置铸)。缺席 = 非 k8s 车道 ⇒ 本腿零调用。 */
-    sandboxPodReaper?: SandboxPodReaper;
+    /** 本车道的沙箱回收座(`plugins/sandbox-reaper.ts`;第 5 段与 run 工厂同一份车道配置铸):k8s 车道 = 沙箱 Pod reaper(`plugins/k8s-pod-reaper.ts`),local-docker 车道 = 无主容器 reaper
+     *  (`plugins/local-docker-reaper.ts`)。缺席 = 别的车道 ⇒ 本腿零调用。一次部署一条执行车道 ⇒ 一只座、一个节拍。 */
+    sandboxReaper?: SandboxReaper;
 }
 /** core 5.48 `reapDurableAgents` 的 `deps.sessions` 面(结构形,只列本仓要填的三格)。 */
 export interface ReapSessionsFacade {