@sema-agent/server 7.149.0 → 7.151.0

package/dist/config-types.d.ts

@@ -19,7 +19,7 @@ import type { QuestionThrottle } from "./question.js";
 import type { UnattendedApprovalPolicy } from "./tool-approval.js";
 import type { InfraCostRates } from "./observability/cost-taxonomy.js";
 import type { Autonomy, CommandRule } from "./runtime-governance.js";
-import type { CenterCredentialSource } from "./center-credential.js";
+import type { CenterCredentialSource, DeclaredCredentialOrigin } from "./center-credential.js";
 import type { GitApiKind } from "./git-api-kind.js";
 import type { CustomPkgSource } from "./sandbox-pkg-source.js";
 import type { MemoryEngineBackend, StoreBackend as StoreBackendWord } from "@sema-agent/settings-schema/execution-lanes";
@@ -331,7 +331,7 @@ export interface CenterMcp {
     servers: ScopedMcpServer[];
     reservedNames: readonly string[];
 }
-/** DESIGN-269 §2.1 —— an A2A PEER resolved to a core spec (header-NAME refs already read and registered on the peer desk
+/** [ref] §2.1 —— an A2A PEER resolved to a core spec (header-NAME refs already read and registered on the peer desk
  *  under the roster lease: the spec carries the minted reference, never the values) plus
  *  the scenarios it applies to (empty = all). Exact sibling of {@link ScopedMcpServer}: `resolveSpec`
  *  filters by scenario (`a2aForScenario`) and passes `spec` to core as `TaskSpec.a2a`.
@@ -344,7 +344,7 @@ export interface ScopedA2aPeer {
     spec: A2aServerSpec;
 }
 /**
- * DESIGN-269 §3.1 车2 —— ONE declared skill on the agent card this deployment publishes when it acts as
+ * [ref] §3.1 车2 —— ONE declared skill on the agent card this deployment publishes when it acts as
  * an A2A **peer** (server-as-peer half). v1 is a **static declaration**: the operator writes the list,
  * the server never enumerates its own scenarios into it.
  *
@@ -369,7 +369,7 @@ export interface A2aServeSkill {
     audience?: readonly string[];
 }
 /**
- * DESIGN-269 §3.3 车2 —— the server-as-peer block. **Absence IS the OFF state** (`A2A_SERVE_ENABLED`
+ * [ref] §3.3 车2 —— the server-as-peer block. **Absence IS the OFF state** (`A2A_SERVE_ENABLED`
  * default OFF): with this field undefined both `/.well-known/agent-card.json` and `POST /v1/a2a` 404,
  * i.e. "卡都不发=对外不存在" — not "publish a card but refuse the calls". Modelling OFF as absence
  * (rather than an `enabled:false` member) makes the half-state structurally unrepresentable.
@@ -828,8 +828,9 @@ export interface ServiceConfigFlat {
      *  models/roles; mutateInPlace keeps the reference. */
     tiers: Record<string, string>;
     /** 项目登记簿(settings-schema `projects` 域):键 = projectId(小写规范 UUID),值 = settings-schema 的 `ProjectRegistration` **原样**
-     *  (本仓不持第二份项目型、不挑键 —— 形与判官只在 settings-schema)。读者:`GET /v1/projects` 读面(`http/routes/projects.ts`);
-     *  `defaultScopes` 作 `TaskSpec.memory.scopes` 的种子(v2 scope 键串,OPEN 值域 —— 本表只登记不解释)与 org 记忆准入的部署 scope 集。
+     *  (本仓不持第二份项目型、不挑键 —— 形与判官只在 settings-schema)。按调用方读(可见性判 + 按 id 取)只经 `project-registry.ts`:`GET /v1/projects` 读面
+     *  (`http/routes/projects.ts`)、项目上下文继承、`defaultScopes` 作 `TaskSpec.memory.scopes` 的种子(v2 scope 键串,OPEN 值域 —— 本表只登记不解释);
+     *  部署级聚合(org 记忆准入的部署 scope 集,`boot/org-memory.ts`)整表读。
      *  NO env source —— 只由 applyEffective 经 settings-schema 的视图面读函数判过后填(mutateInPlace,boot + refresh 整表替换);
      *  本地腿恒空(settings-schema 的本地读取集不收 `projects`)。 */
     projects: Record<string, ProjectRegistration>;
@@ -1108,14 +1109,14 @@ export interface ServiceConfigFlat {
      *  present (restart-to-apply, like models/roles); undefined = no center MCP (scenarios use no MCP).
      *  Carries both the mounted list and the full declared-name set — see {@link CenterMcp}. */
     mcpServers?: CenterMcp;
-    /** DESIGN-269 §2.1 —— A2A peers from the web-admin (`/effective.a2a`), resolved at startup
+    /** [ref] §2.1 —— A2A peers from the web-admin (`/effective.a2a`), resolved at startup
      *  (header-NAME refs → values) and filtered per scenario in `resolveSpec` (`a2aForScenario`). Same
      *  posture as {@link mcpServers}: not env-derived (no A2A_* env leg — a peer is a structured record,
      *  not a scalar), populated by the web-admin adapter when present, restart-to-apply.
      *  undefined = no center peers ⇒ **the whole leg does not exist** for a task (`TaskSpec.a2a` stays
      *  absent unless a single-user caller injects `body.a2aPeers`). */
     a2aPeers?: ScopedA2aPeer[];
-    /** DESIGN-269 §3.3 车2 —— server-as-peer. **undefined = OFF** (the default), and OFF means both the
+    /** [ref] §3.3 车2 —— server-as-peer. **undefined = OFF** (the default), and OFF means both the
      *  card and the JSON-RPC endpoint 404. See {@link A2aServeConfig}. Env-derived (`A2A_SERVE_*`), unlike
      *  {@link a2aPeers}: the serve block is a handful of scalars an operator sets on the worker, not a
      *  center-distributed record. */
@@ -1371,7 +1372,7 @@ export interface ServiceConfigFlat {
      */
     retentionPolicy?: RetentionPolicy;
     /**
-     * [ref] 车2 —— 托管留存 **sweep lane** 的两个旋钮(设计稿 `DESIGN-270-retention-lane.md` §3/§4)。
+     * [ref] 车2 —— 托管留存 **sweep lane** 的两个旋钮(设计稿 `[ref]-retention-lane.md` §3/§4)。
      * `retentionPolicy` 说的是「保留多久」(一句声明),本格说的是「谁在什么节律上按那句话删」。
      * **恒在场**(不是可选块):两根都有文档化的缺省,而缺省本身是一条要能被读出来的姿态 ——
      * `{mode:"audit-only", intervalSec:0}` = 「lane 关着,真开起来也先只记账」。被要的车道必须齐(`intervalSec > 0` 或 `mode:"enforce"` ⇒
@@ -1401,7 +1402,7 @@ export interface ServiceConfigFlat {
      */
     serviceTokenActsForDeployment: boolean;
     /**
-     * DESIGN-278 §5 S2([ref])—— `GET /v1/config/catalog`(配置目录自描述端点)的显式旋钮。
+     * [ref] §5 S2([ref])—— `GET /v1/config/catalog`(配置目录自描述端点)的显式旋钮。
      * 默认 **ON**(设计稿 §0.5:合规部署可关)。端点本身已是 operator-only(`explicitOperatorOk`,
      * 空名单=谁都不是),本键给的是「即便 operator 也不许从 wire 读部署事实」的合规姿态:关 ⇒ 路径
      * 不存在(404 族,与 memory-consolidation 阀门同判:旋钮没开 ≠ 能力缺失)、能力位 `configCatalog`
@@ -2019,7 +2020,8 @@ export interface ServiceConfigFlat {
      *  ON; multi-tenant opt-in); `ASK_QUESTION_ENABLED=true/false` overrides. */
     askQuestionEnabled: boolean;
     /** [ref] 裁2:AskUserQuestion 的**裁量窗**——每 run 腿的并发帽 / 总量帽 / 无人应答的释放窗。窗用尽或到期
-     *  不是拒绝、也不是替人作答:协调器报 `unavailable`,落点(durable park / 非 durable 合成续跑)归 core。
+     *  不是拒绝、也不是替人作答:协调器报 `unavailable`,落点(durable park / 非 durable 合成续跑)归 core;卡由活面呈出而窗到期 ⇒
+     *  协调器抛(core 的投递失败臂,不改道)。
      *  `QUESTION_MAX_CONCURRENT_PER_RUN`(默认 2)/ `QUESTION_MAX_TOTAL_PER_RUN`(20)/ `QUESTION_TTL_MS`
      *  (300000),越界值启动期响亮拒(照 `MCP_ELICITATION_*` 同门,不静默夹取)。缺席 ⇒ 协调器出厂窗
      *  {@link import("./question.js").DEFAULT_QUESTION_THROTTLE}(与本旋钮族默认逐字同值)。 */
@@ -2339,12 +2341,17 @@ export interface ServiceConfigFlat {
      *  `liveBaseUrl`(编排器片 2,env `SEMA_WEB_ADMIN_LIVE_URL`):fleet 活性组(心跳 / 注销、服务租约 —— settings-schema `FLEET_LIVE_PATHS`)的基址,
      *  给「管理面在就绪门后、活性面另走一条不看就绪的入口」的部署;缺席 ⇒ 活性组也打 `baseUrl`(这条缺省只在 `centerFetch` 读)。
      *  `webBaseUrl`(7.121.0,env `SEMA_WEB_ADMIN_WEB_URL`):这个中心的 **web 面固定基址**,运维声明、引擎原样转述到 `/health.center.webBaseUrl`
-     *  (壳按它拼会话深链;路径怎么拼归壳)。起服时判成「可拼路径的基址」:http(s)、不带凭据 / query / fragment,否则拒启;缺席即缺席,引擎不拼不猜。 */
+     *  (壳按它拼会话深链;路径怎么拼归壳)。起服时判成「可拼路径的基址」:http(s)、不带凭据 / query / fragment,否则拒启;缺席即缺席,引擎不拼不猜。
+     *  `assertionToken`([ref]):web-admin 断言令牌(`SEMA_WEB_ADMIN_ASSERTION_TOKEN` / `_FILE`,二选一,都设拒启)的**声明读数**,非秘密投影 ——
+     *  声明在 ⇒ 来源两形之一(`env` / `file` + 绝对路径);没声明 ⇒ 这一格缺席(`loadConfig` 只在声明在时写它;缺席只有一种读法 = 没声明)。
+     *  值不进配置:本版只读声明、不向中心出示;读者 = `/health.center.assertionToken` 与起服日志 `center_assertion_token`。读口与 `credential` 同一只
+     *  (`center-credential.ts` 的 `readWebAdminCredentialDeclaration`)。 */
     webAdmin?: {
         baseUrl: string;
         liveBaseUrl?: string;
         webBaseUrl?: string;
         credential: CenterCredentialSource;
+        assertionToken?: DeclaredCredentialOrigin;
         dryRun: boolean;
         worker?: string;
     };
@@ -2368,9 +2375,9 @@ export interface ServiceConfigFlat {
     fleetAdvertiseAddress?: string;
     /** 编排器片 2:一台实例「活着而不服务」的最长时长 `T_max`(ms;env `FLEET_LEASE_OUTAGE_MAX_MS`)。缺省 86 400 000(24 h);地板 = 服务租约
      *  TTL 地板(settings-schema `SERVING_LEASE_TTL_FLOOR_MS`,60 s);不许 0 / 无穷,坏值拒启。`loadConfig` 无条件解析(成员与非成员同读)。两个读者:
-     *  ① 服务租约**中心不可达的容忍上限**(`fleet/serving-lease.ts`;只在 fleet 成员 ∧ 中心宣告了 `servingLease` 能力位时生效):租约过期(中心
-     *  不可达 / 答 unknown)之后照常服务,直到过期满这么久 ⇒ 新计费提交 503 `state.lease_expired`(取消 / HITL 应答 / 续跑 / 读面照放行),在飞不动、
-     *  不自停;中心恢复授予即恢复。② 排空口 `POST /v1/admin/drain` 的**期限准入上界**(`fleet/drain-entry.ts` 规则 2):`deadlineAt` 离此刻超过它 ⇒
+     *  ① 服务租约**中心不可达的容忍上限**(`fleet/serving-lease.ts`;只在 fleet 成员 ∧ 中心没有声明不执行租约时生效 —— 没听到中心的成员也算,
+     *  起步即推定在围栏内):租约过期(中心不可达 / 答 unknown;从没被授予过的,从围栏生效那一刻 —— 一直没听到中心的成员从本进程起点)之后照常服务,
+     *  直到满这么久 ⇒ 新计费提交 503 `state.lease_expired`(取消 / HITL 应答 / 续跑 / 读面照放行),在飞不动、不自停;中心恢复授予即恢复。② 排空口 `POST /v1/admin/drain` 的**期限准入上界**(`fleet/drain-entry.ts` 规则 2):`deadlineAt` 离此刻超过它 ⇒
      *  400 `request.field_invalid`。 */
     fleetLeaseOutageMaxMs: number;
     /** [ref](design-325 §2):中心凭证**续签提前量**(ms)—— `SEMA_WEB_ADMIN_TOKEN_FILE` 指向人的登录会话信封

package/dist/config.d.ts

@@ -124,7 +124,10 @@ export declare function parseConfigProvider(): ConfigProviderWord | undefined;
 /** F10 (codex audit): drain + log BOTH pre-logger diagnostic collectors (S20 soft-knob warnings + [ref]④ boot
  *  notices) in one place. EVERY entrypoint that calls loadConfig() then builds a logger must call this right
  *  after (main.ts, run-local.ts) — a new entry that forgets it would silently drop operator-facing diagnostics
- *  (run-local historically did exactly that), so the drain lives beside the collectors, not in one entrypoint. */
+ *  (run-local historically did exactly that), so the drain lives beside the collectors, not in one entrypoint.
+ *  Draining is repeatable: a read made AFTER the boot drain (the execution-lane composition step reads the env of a lane the config file chose;
+ *  `boot/execution-lane.ts`) calls it again right after, so its soft-knob rejects and knob registrations reach the log instead of piling up
+ *  undrained — the polarity table (debug) is then printed again, now covering that read too. */
 export declare function logConfigDiagnostics(logger: {
     warn: (event: string, fields?: Record<string, unknown>) => void;
     info?: (event: string, fields?: Record<string, unknown>) => void;
@@ -192,10 +195,56 @@ export declare function buildUnpricedCeilingNotice(models: Record<string, Model>
 export type EntryDeclarableLane = Extract<ExecutionLane, "host" | "none">;
 /**
  * 这两条车道的配置形(唯一铸点):env 声明了它们时由 {@link loadConfig} 的车道链调,入口程序自身声明它们时由执行车道合成步调 —— 坐标 env 同一读法。
- * DUAL-MODE §5:`host` = 在这台机器上跑、无容器(坐标 `HOST_WORKSPACE_BASE` / `HOST_COMMAND_TIMEOUT_MS` 可选,无必需 env)。
+ * DUAL-MODE §5:`host` = 在这台机器上跑、无容器(坐标 `HOST_WORKSPACE_BASE` / `HOST_COMMAND_TIMEOUT_MS` 可选,无必需 env;读数见 {@link parseHostLaneEnv})。
  * 契约 18.0.0:`none` = 部署声明「智能体的工具没有执行环境」(零字段、无必需 env)。
  */
 export declare function entryDeclarableRemoteExec(lane: EntryDeclarableLane): RemoteExecConfig;
+/** `host` 车道的配置块(型从 {@link RemoteExecConfig} 判别联合取,不另写第二份字段表)。 */
+type HostRemoteExec = Extract<RemoteExecConfig, {
+    provider: "host";
+}>;
+/** `local-docker` 车道的配置块(同上)。 */
+type LocalDockerRemoteExec = Extract<RemoteExecConfig, {
+    provider: "local-docker";
+}>;
+/** env 一侧对 `host` 车道的读数(块去掉判别位)。 */
+export type HostEnvReading = Omit<HostRemoteExec, "provider">;
+/** env 一侧对 `local-docker` 车道的读数(块去掉判别位;`image` 改可选 —— `DOCKER_IMAGE` 是本车道的必需 env,读数本身不判必需,判官是车道必需 env 门)。 */
+export type LocalDockerEnvReading = Omit<LocalDockerRemoteExec, "provider" | "image"> & {
+    image?: string;
+};
+/**
+ * **`host` 车道的 env 读数**(唯一读者):`HOST_WORKSPACE_BASE` / `HOST_COMMAND_TIMEOUT_MS`。env 声明路径({@link entryDeclarableRemoteExec})、入口自身声明、
+ * 文件腿(`config.d/remote-exec.json` 选定 host 车道时,车道参数仍由 env 读)读的都是这一只。求值时点:`REMOTE_EXEC` 声明的车道在 `loadConfig` 里求值(早于文件);
+ * 文件选定而 env 没声明它 ⇒ 执行车道合成步现读;没被选中的车道不求值 —— 那里它们是无关配置。
+ */
+export declare function parseHostLaneEnv(): HostEnvReading;
+/**
+ * **`local-docker` 车道的 env 读数**(唯一读者):`DOCKER_*` 的全部坐标与车道参数(含容器帽、pids 限额、丢 capability、带外 env 名单)。env 声明路径
+ * ({@link loadConfig} 的车道链)与文件腿(`config.d/remote-exec.json` 选定 local-docker 车道时)读的是这一只:文件只定「哪条车道」,车道参数仍只有 env 一处可写,
+ * 文件里有同名格的那几格由文件胜(`FILE_LANE_CELL_ENV` 列的五格)。只在本车道被选中(env 声明,或文件选定)时求值 —— 其它车道上它们是无关配置。
+ * `singleUserTurnkey` = 本部署是不是单用户姿态(`REQUIRE_PRINCIPAL !== "true"`;名单型旋钮 `DOCKER_SANDBOX_ENV` 的姿态判)。
+ */
+export declare function parseLocalDockerLaneEnv(singleUserTurnkey: boolean): LocalDockerEnvReading;
+/**
+ * **文件格 ↔ env 键的对表**(`config.d/remote-exec.json` 与 env 对「同一件事」各有一个名字):文件选定车道后,块 = env 读数 ∪ 文件格,**同名格文件赢**;
+ * 两处在同一格上给了不同的值 ⇒ 文件赢并响亮点名那一格的 env 键(`remote_exec_file_overrides`,执行车道合成步)。表序 = 点名序。
+ * 格名取块的字段名(`satisfies` 钉住:块改名而表不跟 ⇒ 编译红);env 键须是车道表里这条车道的坐标键、且上面两只读者真的读它(`test/remote-exec-file-lane-env-params.test.ts` 钉)。
+ * 文件腿读不到 env 键字面 —— 键名只住在读者与这张表里。
+ */
+export declare const FILE_LANE_CELL_ENV: {
+    readonly host: {
+        readonly workspaceBase: "HOST_WORKSPACE_BASE";
+        readonly commandTimeoutMs: "HOST_COMMAND_TIMEOUT_MS";
+    };
+    readonly "local-docker": {
+        readonly image: "DOCKER_IMAGE";
+        readonly mountPath: "DOCKER_MOUNT_PATH";
+        readonly memory: "DOCKER_MEMORY";
+        readonly cpus: "DOCKER_CPUS";
+        readonly network: "DOCKER_NETWORK";
+    };
+};
 /** [ref] N8/N9 — the BOOLEAN member of this module's env-parser family (`env`/`env2`/`numEnv`/
  *  `numEnvBounded`/`optFinitePositiveEnv`/`enumEnv`/`headerNameEnv`). Until now booleans were the
  *  one type parsed by a hand-written literal comparison at every single site, and that is exactly why the same

package/dist/config.js

@@ -49,7 +49,7 @@ import { AUTONOMY_MODES } from "./runtime-governance.js";
 import { deploymentRuleRefusal } from "./rule-issue-reading.js";
 import { MAX_NAMED_INERT_ENTRIES, allowLayerEntryCountIssue, describeInertRuleEntries, inertRuleEntriesOf, inertRuleEntryGuidance, ruleEntryListShapeOk } from "./rule-entry-list.js";
 import { readReadDenyEntry } from "./read-deny-entry.js";
-import { createCenterCredentialSource, readCenterCredentialDeclaration } from "./center-credential.js";
+import { createCenterCredentialSource, credentialOriginOf, readWebAdminCredentialDeclaration } from "./center-credential.js";
 import { parseCenterCredentialRenewLeadMs } from "./center-credential-renewer.js";
 import { catalogBrainLane, modelProviderRefusal } from "./model-provider.js";
 import { modelRouteUrlRefusal } from "./model-route-url.js";
@@ -408,15 +408,39 @@ function parseDeviceRelayUrlEnv(raw) {
 export function entryDeclarableRemoteExec(lane) {
     switch (lane) {
         case "host":
-            return {
-                provider: "host",
-                ...(process.env.HOST_WORKSPACE_BASE ? { workspaceBase: process.env.HOST_WORKSPACE_BASE } : {}),
-                ...((n) => (n !== undefined ? { commandTimeoutMs: n } : {}))(optNumEnvStrict("HOST_COMMAND_TIMEOUT_MS")),
-            };
+            return { provider: "host", ...parseHostLaneEnv() };
         case "none":
             return { provider: "none" };
     }
 }
+export function parseHostLaneEnv() {
+    return {
+        ...(process.env.HOST_WORKSPACE_BASE ? { workspaceBase: process.env.HOST_WORKSPACE_BASE } : {}),
+        ...((n) => (n !== undefined ? { commandTimeoutMs: n } : {}))(optNumEnvStrict("HOST_COMMAND_TIMEOUT_MS")),
+    };
+}
+export function parseLocalDockerLaneEnv(singleUserTurnkey) {
+    return {
+        ...(process.env.DOCKER_IMAGE ? { image: process.env.DOCKER_IMAGE } : {}),
+        ...(process.env.DOCKER_MOUNT_PATH ? { mountPath: process.env.DOCKER_MOUNT_PATH } : {}),
+        ...(process.env.DOCKER_PATH ? { dockerPath: process.env.DOCKER_PATH } : {}),
+        ...(process.env.DOCKER_HOST ? { dockerHost: process.env.DOCKER_HOST } : {}),
+        ...(process.env.DOCKER_MEMORY ? { memory: process.env.DOCKER_MEMORY } : {}),
+        ...((n) => (n !== undefined ? { cpus: n } : {}))(optNumEnvStrict("DOCKER_CPUS")),
+        ...((n) => (n !== undefined ? { pidsLimit: n } : {}))(optFinitePositiveEnv("DOCKER_PIDS_LIMIT")),
+        ...(boolEnv("DOCKER_DROP_CAPS", false) ? { dropAllCaps: true } : {}),
+        ...(process.env.DOCKER_NETWORK
+            ? { network: enumEnv("DOCKER_NETWORK", "bridge", ["none", "bridge", "host"]) }
+            : {}),
+        ...((n) => (n !== undefined ? { commandTimeoutMs: n } : {}))(optNumEnvStrict("DOCKER_COMMAND_TIMEOUT_MS")),
+        ...((names) => (names !== undefined ? { env: allowlistedEnv(names, process.env) } : {}))(parseEnvNameAllowlist("DOCKER_SANDBOX_ENV", singleUserTurnkey)),
+        ...((capacity) => (capacity !== undefined ? { capacity } : {}))(parseLocalDockerCapacityEnv()),
+    };
+}
+export const FILE_LANE_CELL_ENV = {
+    host: { workspaceBase: "HOST_WORKSPACE_BASE", commandTimeoutMs: "HOST_COMMAND_TIMEOUT_MS" },
+    "local-docker": { image: "DOCKER_IMAGE", mountPath: "DOCKER_MOUNT_PATH", memory: "DOCKER_MEMORY", cpus: "DOCKER_CPUS", network: "DOCKER_NETWORK" },
+};
 const envNamesNoLane = (raw) => raw === undefined || raw === "";
 function declaredExecutionLane(raw) {
     if (envNamesNoLane(raw))
@@ -2127,23 +2151,8 @@ function parseOrchestrationDomain(ctx) {
                                             ? entryDeclarableRemoteExec(declaredLane)
                                             :
                                                 declaredLane === "local-docker" && process.env.DOCKER_IMAGE
-                                                    ? {
-                                                        provider: "local-docker",
-                                                        image: process.env.DOCKER_IMAGE,
-                                                        ...(process.env.DOCKER_MOUNT_PATH ? { mountPath: process.env.DOCKER_MOUNT_PATH } : {}),
-                                                        ...(process.env.DOCKER_PATH ? { dockerPath: process.env.DOCKER_PATH } : {}),
-                                                        ...(process.env.DOCKER_HOST ? { dockerHost: process.env.DOCKER_HOST } : {}),
-                                                        ...(process.env.DOCKER_MEMORY ? { memory: process.env.DOCKER_MEMORY } : {}),
-                                                        ...((n) => (n !== undefined ? { cpus: n } : {}))(optNumEnvStrict("DOCKER_CPUS")),
-                                                        ...((n) => (n !== undefined ? { pidsLimit: n } : {}))(optFinitePositiveEnv("DOCKER_PIDS_LIMIT")),
-                                                        ...(boolEnv("DOCKER_DROP_CAPS", false) ? { dropAllCaps: true } : {}),
-                                                        ...(process.env.DOCKER_NETWORK
-                                                            ? { network: enumEnv("DOCKER_NETWORK", "bridge", ["none", "bridge", "host"]) }
-                                                            : {}),
-                                                        ...((n) => (n !== undefined ? { commandTimeoutMs: n } : {}))(optNumEnvStrict("DOCKER_COMMAND_TIMEOUT_MS")),
-                                                        ...((names) => (names !== undefined ? { env: allowlistedEnv(names, process.env) } : {}))(parseEnvNameAllowlist("DOCKER_SANDBOX_ENV", singleUserTurnkey)),
-                                                        ...((capacity) => (capacity !== undefined ? { capacity } : {}))(parseLocalDockerCapacityEnv()),
-                                                    }
+                                                    ?
+                                                        { provider: "local-docker", ...parseLocalDockerLaneEnv(singleUserTurnkey), image: process.env.DOCKER_IMAGE }
                                                     :
                                                         declaredLane === "device"
                                                             ? {
@@ -2488,12 +2497,14 @@ function parseCenterBaseUrl(name, raw, role) {
 }
 function parseWebAdmin(baseUrl, requirePrincipal, liveBaseUrl, webBaseUrl) {
     const worker = process.env[WEB_ADMIN_ENV.worker] || undefined;
-    const declared = readCenterCredentialDeclaration();
+    const declared = readWebAdminCredentialDeclaration("access");
+    const assertion = credentialOriginOf(readWebAdminCredentialDeclaration("assertion"));
     return {
         baseUrl,
         ...(liveBaseUrl !== undefined ? { liveBaseUrl } : {}),
         ...(webBaseUrl !== undefined ? { webBaseUrl } : {}),
         credential: createCenterCredentialSource(declared.from === "file" ? { ...declared, multiTenant: requirePrincipal } : declared, worker),
+        ...(assertion.from !== "absent" ? { assertionToken: assertion } : {}),
         dryRun: boolEnv(WEB_ADMIN_ENV.dryRun, false),
         worker,
     };

package/dist/deployment-governance.d.ts

@@ -58,15 +58,12 @@ export interface PathAdjudication {
      *  `task-settings.ts` 的 `FsWriteGateWiring.taskHome`。 */
     readonly taskHome?: string;
 }
-/** [ref]([ref] 案二):durable 部署上的 AskUserQuestion 门的活体面探针(QuestionCoordinator 的切面)。 */
-export interface LiveQuestionFace {
-    hasLiveContext(): boolean;
-}
 /**
  * [ref] —— 审批基线的**席**:这条腿上「一个名单产的 `ask` 由谁来服」。闭集三形,每条腿**显式**说出自己那一形
  * ({@link createApprovalBaselinePolicy} 的席参数必填、按 `kind` 穷举 —— 闭集 +1 = 编译红):
- *  · `durable` —— checkpoint suspend/resume 服 ask(HTTP 腿 durable 开、park 赎回腿)。AskUserQuestion 的问答门
- *    **只**叠在这一形上(它的 `ask` 语义就是 durable park)。
+ *  · `durable` —— checkpoint suspend/resume 服 ask(HTTP 腿 durable 开、park 赎回腿)。core 的问答策略
+ *    (`createDurableQuestionPolicy()`,原形逐字)**只**叠在这一形上:它对引擎的问题工具答 `ask`,落点归 core 的同步优先
+ *    (有问题席 ⇒ 先投卡、席在窗内拿到答即交答;没拿到 ⇒ 停驻 —— 卡由活面呈出而窗走完的那一问除外:席抛,引擎的投递失败臂不停驻)。
  *  · `live`    —— Runner 的活 onAsk 席当场服 ask(run-local 的 `createLocalApprover`:TTY 问 y/N / 无 TTY 当场拒;
  *    core `isLiveApproverSeat(onAsk)` 为真时 `suspendAsk` 早退,ask 落回调)。三张名单与 durable 席**同一只**策略。
  *  · `absent`  —— 没有谁服 ask ⇒ adjudicated allow-all;**只**服务零名单(HTTP 腿「durable 关 ∧ 单用户零意图」)。
@@ -79,11 +76,9 @@ export interface LiveQuestionFace {
 export type ApprovalSeat = DurableApprovalSeat | LiveApprovalSeat | AbsentApprovalSeat;
 /** 席的形名(补偿 warn 等只需要「哪一形」的读者读它,不必铸整只席)。 */
 export type ApprovalSeatKind = ApprovalSeat["kind"];
-/** durable 席:checkpoint suspend/resume 服 ask,问答门叠在名单策略上。 */
+/** durable 席:checkpoint suspend/resume 服 ask,core 的问答策略叠在名单策略上。 */
 export interface DurableApprovalSeat {
     readonly kind: "durable";
-    /** 活体问答面;`undefined` ⇒ 恒 durable park 的原形门。 */
-    readonly question: LiveQuestionFace | undefined;
     /** 本会话的「本会话放行」读面(部署名单那一问的站着的答案;铸点 `approval.ts` 的 `createSessionExemptionRead`)。缺席 = 这条腿没有会话 / 没有豁免店 ⇒ 名单照问。 */
     readonly exemption?: SessionExemptionRead;
 }
@@ -95,23 +90,6 @@ export interface LiveApprovalSeat {
 export interface AbsentApprovalSeat {
     readonly kind: "absent";
 }
-/**
- * [ref]([ref] 案二):durable 部署上的 AskUserQuestion 门。活体面(QuestionCoordinator)缺席 ⇒ 原形
- * `createDurableQuestionPolicy()`(恒 ask ⇒ 恒 durable park)。在场 ⇒ **判决时**按活流上下文分腿:
- * 活流腿(bg/SSE,coordinator.runWithContext 包裹且投递面此刻可达,ALS 判)allow——工具执行落到
- * RunnerDeps.onQuestion 的 coordinator,问正在 tail 流的活人;无活流腿(sync /v1/tasks、verify/cascade、
- * durable resume 驱动、断连后的 detach 腿)ask——durable park 原语义逐字保留([ref] 后无活流腿放行执行
- * 也不会产出空答:coordinator 无 ALS ctx ⇒ 冻结 `{kind:"unavailable"}`(src/question.ts),永不悬挂;
- * park 仍是把问题送到人面前的唯一那条腿,正当性不变、只是反事实前提换了)。
- * 「是不是引擎的问题工具」不在本层判:core 7.56.0 [ref] 起本门**组合** core 原形的答(它读调用的脸 —— 引擎挂载点 + 目录契约 id,不读名字;
- * 它答 `ask` ⇒ 是;本层只在那之上按活流分腿)。决断口的 pre-CAS 守卫(「批准问答必须带答」)仍按保留名读(core 同版「Not changed here」那一条)。
- * ⚠️ **单一属主**(复审 A2):AskUserQuestion 的 durable 判决只有这一处。任何需要「同参重建」这条判决的
- * 地方(main.ts 的 parkedReviveInheritedGate 父约束链)必须调本工厂,不得自折 core 原形——两份拷贝里
- * 只改一份正是本条 finding 的成因。**登记豁免一处**:leader worker 腿(src/leader/wire.ts provisionWorker)
- * 自折 core 原形——该腿无活体问答面可装且 leader 不 import boot 层(分层),core 原形+sentinel 即其完整
- * 语义;豁免注在彼处互指,接活体面之日必须并回本工厂。
- */
-export declare function createDurableQuestionGate(live: LiveQuestionFace | undefined): ToolPolicy;
 /**
  * 沙箱 lane 上**相对形**写目标的守卫补层用 env(codex 交叉复审 round1 finding 1,红先复现)。
  *
@@ -266,8 +244,9 @@ export declare function buildApprovalGrantNotice(config: {
  * `undefined`**:治理层是 tighten-only 的叠加层,没有基线可叠时它自己也产不出「门在场」这件事。
  *
  * 三形,按席穷举([ref],席的定义见 {@link ApprovalSeat}):
- *  · `durable` ⇒ AskUserQuestion 判决门 + 三张名单的审批门(deny/neverAuto/预算/本会话的豁免行全在
- *    `createDurableAskPolicy` 里)。gated `ask` 由 core 变成 durable checkpoint suspend。
+ *  · `durable` ⇒ core 的问答策略(原形逐字,不包)+ 三张名单的审批门(deny/neverAuto/预算/本会话的豁免行全在
+ *    `createDurableAskPolicy` 里)。gated `ask` 由 core 变成 durable checkpoint suspend;问题族的 `ask` 先过 core 的同步优先
+ *    (问题席在窗内拿到答 ⇒ 交答;没拿到 ⇒ 停驻;活面呈出而窗走完 ⇒ 投递失败臂)—— 「有没有人」本口不预判,唯一判官是那一次投递的结局。
  *  · `live`    ⇒ **同一只**三张名单审批门,不叠问答门。gated `ask` 由 core 交给 Runner 的活 onAsk 席
  *    (本口**不**做 ask→deny 映射:无人可问时的拒由那只席说,判据与文案都归它)。
  *  · `absent`  ⇒ **adjudicated allow-all**(`createAllowDenyPolicy({})`):一条**在场的**、

package/dist/deployment-governance.js

@@ -1,19 +1,6 @@
 import { join, posix } from "node:path";
 import { FileError, StubExecutionEnv, combinePolicies, createAllowDenyPolicy, createDurableQuestionPolicy, createSensitivePathPolicy, createTranscriptIntegrityPolicy, err, isAbsoluteForFamily, isProtectedWrite, ok, pathTargetValue, protectivePathTargetOf, } from "@sema-agent/core";
 import { createDurableAskPolicy, hasApprovalListIntent } from "./approval.js";
-export function createDurableQuestionGate(live) {
-    const durable = createDurableQuestionPolicy();
-    if (live === undefined)
-        return durable;
-    return {
-        async check(req) {
-            const answer = await durable.check(req);
-            if (answer.action !== "ask")
-                return answer;
-            return live.hasLiveContext() ? { action: "allow" } : answer;
-        },
-    };
-}
 export const SANDBOX_TREE_FAMILY = "posix";
 function writeTargetFormOf(req) {
     if (!isProtectedWrite(req))
@@ -125,7 +112,7 @@ export function buildApprovalGrantNotice(config) {
 export function createApprovalBaselinePolicy(config, seat) {
     switch (seat.kind) {
         case "durable":
-            return combinePolicies(createDurableQuestionGate(seat.question), createApprovalListPolicy(config, seat.exemption));
+            return combinePolicies(createDurableQuestionPolicy(), createApprovalListPolicy(config, seat.exemption));
         case "live":
             return createApprovalListPolicy(config, undefined);
         case "absent":

package/dist/deployment-shape.d.ts

@@ -17,7 +17,7 @@
  * `holds` 的入参型 = 所声明轴读入形的交叉({@link DeploymentShapeInput}),所以调用方递完整 `ServiceConfig` 或只递那几键的窄形都行。
  *
  * ## 什么进表、什么不进
- * 进表的是**形规则**:只由部署形事实决定的布尔(去重后 15 行;同一条规则的多个消费者读同一行,不各成一行)。
+ * 进表的是**形规则**:只由部署形事实决定的布尔(去重后 16 行;同一条规则的多个消费者读同一行,不各成一行)。
  * 把一行与**非形事实**(锁键、合规档位、审批意图、请求身份、请求体)合取的能力判据是**消费者**,住在它自己的模块
  * (`mcpInjectionHonored` = 锁 ∧ 合规 ∧ `!multiTenant`;`taskHooksHonored`;身份门 …),读行、不读原始键。
  * 车道表(`execution-lane-caps.ts`)按车道词键控的布尔列(`laneIsolated` 等)是车道轴自己的事实表,不是「部署」的谓词;行读它们。
@@ -111,6 +111,14 @@ export declare const DEPLOYMENT_SHAPE_PREDICATES: Readonly<{
      * 一次性迁移 M48 的输入(`plugins/store-backend.ts`:有边界 ⇒ 不改写哨兵属主)。
      */
     identityBoundary: DeploymentShapePredicate<"principal" | "identity">;
+    /**
+     * 「这台部署接没接**过凭据门**的来源」的问法 —— 身份来源律 5(`identity-source.ts` 头注)在部署上的投影:配置接了的来源里有凭据门认的那一类
+     * (service 凭据,或鉴权桥 issuer —— 含中心回退;`passesCredentialGate` 那一列)。**不是** {@link DEPLOYMENT_SHAPE_PREDICATES.identityBoundary}:
+     * 那一行把 `REQUIRE_PRINCIPAL` / 只读 trace 凭据 / 直连门也算作边界(它们让主体头不再是 dev-open 的自报),本行只问「有没有一类凭据过得了门」——
+     * 三样都不过,所以只配其中之一的部署两行答案相反,这是两问,不是一问两答。没接 ⇒ 写门(问请求)对每一次请求都拒(`ALLOW_UNAUTHED_WRITES` 之外)。
+     * 读者:记忆整理阀门的启动期告警(`boot/stage-06-runners.ts`;「这台部署上 run 口对谁都开不了」)。请求面不读本行:写门问的是请求。
+     */
+    credentialGateSource: DeploymentShapePredicate<"identity">;
     /**
      * 租户轴的问法。今天与 {@link DEPLOYMENT_SHAPE_PREDICATES.principalRequired} 读**同一个声明**([ref] ①:托管 / 多租 ⇔ `REQUIRE_PRINCIPAL=true`,
      * 签发方配置是身份验签轴、不算租户证据)—— 两个问题、一根轴、一个读口;「鉴权必需」与「多租形」拆成两个声明时只改这一行的判官。

package/dist/deployment-shape.js

@@ -1,5 +1,5 @@
 import { capabilitiesFor, executionLaneCaps, executionLaneOf, handsOnWorkerFilePlane, laneWiresExecutionEnv } from "./execution-lane-caps.js";
-import { configuredIdentitySources } from "./identity-source.js";
+import { configuredIdentitySources, passesCredentialGate } from "./identity-source.js";
 function readPrincipalAxis(deployment) {
     return { declared: deployment.requirePrincipal === true };
 }
@@ -54,6 +54,7 @@ const VM_ISOLATION_RUNTIME_CLASSES = new Set(["kata", "kata-qemu", "kata-clh", "
 export const DEPLOYMENT_SHAPE_PREDICATES = Object.freeze({
     principalRequired: createPredicate(["principal"], "身份轴:运维声明了 REQUIRE_PRINCIPAL=true —— 每个调用方都必须带一个验过的主体。", ({ principal }) => principal.declared),
     identityBoundary: createPredicate(["principal", "identity"], "身份轴:这台部署有身份边界 —— 声明了 REQUIRE_PRINCIPAL,或配置接了任一已验身份来源(service 凭据 / 鉴权桥 / 直连门),或声明了只读 trace 凭据。", ({ principal, identity }) => principal.declared || identity.sources.length > 0 || identity.traceTokenDeclared),
+    credentialGateSource: createPredicate(["identity"], "身份轴:这台部署接了一类过凭据门的来源 —— service 凭据,或鉴权桥(登录令牌);只开 REQUIRE_PRINCIPAL / 只配 trace 凭据 / 只开直连门都不算。", ({ identity }) => identity.sources.some(passesCredentialGate)),
     multiTenant: createPredicate(["principal"], "租户轴:这台部署服务不止一个主人(托管 / 多租;C-R100 ① 由 REQUIRE_PRINCIPAL=true 声明)。", ({ principal }) => principal.declared),
     callerCwd: createPredicate(["lane", "principal"], "车道 × 租户 / 设备归属:调用方送来的 cwd(与 settings.env)被尊重 —— host 车道且单主,或 device 车道。", ({ lane, principal }) => lane.caps !== undefined && capabilityHolds(lane.caps.callerCwd, principal)),
     callerOwnsWorkerDisk: createPredicate(["lane", "principal"], "车道 × 租户:手就在本 worker 的盘上且部署只有一个主人 —— 这块盘上的路径就是调用方自己的。", ({ lane, principal }) => lane.lane !== undefined && handsOnWorkerFilePlane(lane.lane) && !principal.declared),

package/dist/device-protocol.d.ts

@@ -7,11 +7,12 @@
  *
  * 为什么是精选而不是把 `device-ws-protocol.ts` 整只暴露:那个模块里还有**服务端**自己的半场(帧解析与准入、
  * 验签、各种铸 id)。把它们变成公开面,等于替实现细节背上 semver。这里只再导出 executor **会用到**的:
- * 闭集常量、两向帧型、构造握手签名字节所需的两只纯函数,以及两份「随协议修订号走」的事实:结局码按修订号分行的增量表
- * (`DEVICE_OUTCOME_ERROR_CODES_BY_REVISION` + 取集函数 `deviceOutcomeErrorCodesAt`:executor 按自己声明的修订号裁剪会发的词)与
+ * 闭集常量、两向帧型、构造握手签名字节所需的两只纯函数,以及三份「随协议修订号走」的事实:结局码按修订号分行的增量表
+ * (`DEVICE_OUTCOME_ERROR_CODES_BY_REVISION` + 取集函数 `deviceOutcomeErrorCodesAt`:executor 按自己声明的修订号裁剪会发的词)、指令 kind 按修订号分行的增量表
+ * (`DEVICE_INSTRUCTION_KINDS_BY_REVISION` + 取集函数 `deviceInstructionKindsAt`:executor 按自己声明的修订号裁剪 `hello.supports` —— 高于它的 kind 声明了也不会下发)与
  * helloAck 数值位的界表(`DEVICE_HELLO_ACK_BOUNDS` + 判据 `deviceHelloAckNumberFlaw`:executor 读到越界值 ⇒ 协议违例)。要加名字 = 改这只文件 + 同批改
  * `test/device-protocol-subpath.test.ts` 的闭集(新增公开面必须是一次有意的动作)。
  */
-export { DEVICE_WS_PATH, DEVICE_PROTOCOL_VERSION, DEVICE_MIN_PROTOCOL_VERSION, DEVICE_HELLO_DOMAIN_TAG, DEVICE_WS_LIMITS, DEVICE_FRAME_TYPES, DEVICE_SERVER_FRAME_TYPES, DEVICE_HELLO_REJECT_CODES, DEVICE_BYE_REASONS, DEVICE_GOODBYE_REASONS, DEVICE_CHUNK_KINDS, DEVICE_CANCEL_STATES, DEVICE_INSTRUCTION_KINDS, DEVICE_OUTCOME_ERROR_CODES, DEVICE_OUTCOME_ERROR_CODES_BY_REVISION, DEVICE_HELLO_ACK_BOUNDS, buildHelloSignaturePayload, decodeUlid16, deviceOutcomeErrorCodesAt, deviceHelloAckNumberFlaw, } from "./device-ws-protocol.js";
-export type { DeviceFrameType, DeviceServerFrameType, DeviceHelloRejectCode, DeviceByeReason, DeviceGoodbyeReason, DeviceChunkKind, DeviceCancelState, DeviceInstructionKind, DeviceOutcomeErrorCode, DeviceProtocolRevision, DeviceHelloAckNumericField, WireFileInfo, WireWriteExpectation, DeviceInstructionOutcome, DeviceInstructionArgsByKind, DeviceChallengeFrame, DeviceHelloAckFrame, DeviceHelloRejectFrame, DeviceInstructionFrame, DevicePayloadFrame, DeviceServerFrame, DeviceHelloFrame, DeviceFrame, DeviceResultFrame, DeviceChunkFrame, DeviceGoodbyeFrame, DeviceHeartbeatFrame, } from "./device-ws-protocol.js";
+export { DEVICE_WS_PATH, DEVICE_PROTOCOL_VERSION, DEVICE_MIN_PROTOCOL_VERSION, DEVICE_HELLO_DOMAIN_TAG, DEVICE_WS_LIMITS, DEVICE_FRAME_TYPES, DEVICE_SERVER_FRAME_TYPES, DEVICE_HELLO_REJECT_CODES, DEVICE_BYE_REASONS, DEVICE_GOODBYE_REASONS, DEVICE_CHUNK_KINDS, DEVICE_CANCEL_STATES, DEVICE_INSTRUCTION_KINDS, DEVICE_INSTRUCTION_KINDS_BY_REVISION, DEVICE_BOUND_READ_OPS, DEVICE_OUTCOME_ERROR_CODES, DEVICE_OUTCOME_ERROR_CODES_BY_REVISION, DEVICE_HELLO_ACK_BOUNDS, buildHelloSignaturePayload, decodeUlid16, deviceOutcomeErrorCodesAt, deviceInstructionKindsAt, deviceHelloAckNumberFlaw, } from "./device-ws-protocol.js";
+export type { DeviceFrameType, DeviceServerFrameType, DeviceHelloRejectCode, DeviceByeReason, DeviceGoodbyeReason, DeviceChunkKind, DeviceCancelState, DeviceInstructionKind, DeviceBoundReadOp, DeviceOutcomeErrorCode, DeviceProtocolRevision, DeviceHelloAckNumericField, WireFileInfo, WireWriteExpectation, DeviceInstructionOutcome, DeviceInstructionArgsByKind, DeviceChallengeFrame, DeviceHelloAckFrame, DeviceHelloRejectFrame, DeviceInstructionFrame, DevicePayloadFrame, DeviceServerFrame, DeviceHelloFrame, DeviceFrame, DeviceResultFrame, DeviceChunkFrame, DeviceGoodbyeFrame, DeviceHeartbeatFrame, } from "./device-ws-protocol.js";
 //# sourceMappingURL=device-protocol.d.ts.map

package/dist/device-protocol.js

@@ -1,2 +1,2 @@
-export { DEVICE_WS_PATH, DEVICE_PROTOCOL_VERSION, DEVICE_MIN_PROTOCOL_VERSION, DEVICE_HELLO_DOMAIN_TAG, DEVICE_WS_LIMITS, DEVICE_FRAME_TYPES, DEVICE_SERVER_FRAME_TYPES, DEVICE_HELLO_REJECT_CODES, DEVICE_BYE_REASONS, DEVICE_GOODBYE_REASONS, DEVICE_CHUNK_KINDS, DEVICE_CANCEL_STATES, DEVICE_INSTRUCTION_KINDS, DEVICE_OUTCOME_ERROR_CODES, DEVICE_OUTCOME_ERROR_CODES_BY_REVISION, DEVICE_HELLO_ACK_BOUNDS, buildHelloSignaturePayload, decodeUlid16, deviceOutcomeErrorCodesAt, deviceHelloAckNumberFlaw, } from "./device-ws-protocol.js";
+export { DEVICE_WS_PATH, DEVICE_PROTOCOL_VERSION, DEVICE_MIN_PROTOCOL_VERSION, DEVICE_HELLO_DOMAIN_TAG, DEVICE_WS_LIMITS, DEVICE_FRAME_TYPES, DEVICE_SERVER_FRAME_TYPES, DEVICE_HELLO_REJECT_CODES, DEVICE_BYE_REASONS, DEVICE_GOODBYE_REASONS, DEVICE_CHUNK_KINDS, DEVICE_CANCEL_STATES, DEVICE_INSTRUCTION_KINDS, DEVICE_INSTRUCTION_KINDS_BY_REVISION, DEVICE_BOUND_READ_OPS, DEVICE_OUTCOME_ERROR_CODES, DEVICE_OUTCOME_ERROR_CODES_BY_REVISION, DEVICE_HELLO_ACK_BOUNDS, buildHelloSignaturePayload, decodeUlid16, deviceOutcomeErrorCodesAt, deviceInstructionKindsAt, deviceHelloAckNumberFlaw, } from "./device-ws-protocol.js";
 //# sourceMappingURL=device-protocol.js.map

package/dist/device-ws-hub.d.ts

@@ -209,6 +209,7 @@ export interface DeviceWsHub {
     declaredSupports(deviceId: string): ReadonlySet<DeviceInstructionKind> | undefined;
     close(): Promise<void>;
 }
+export declare const DEVICE_MAX_PAYLOAD_PART_BYTES: number;
 /** per-remote 帽键的来源(闭集;指标 `device_preauth_key_total{source}` 与 cap-hit 行 `keySource` 同一张表)。 */
 export declare const DEVICE_PREAUTH_KEY_SOURCES: readonly ["socket", "xff", "fallback"];
 export type DevicePreAuthKeySource = (typeof DEVICE_PREAUTH_KEY_SOURCES)[number];