@sema-agent/server 7.150.0 → 7.152.0

package/dist/config-catalog.js

@@ -5,8 +5,8 @@ import { DEVICE_RELAY_NONE, WEB_ADMIN_ENV, DOMAIN_SCHEMAS, buildRetiredEnvWire }
 import { CENTER_CREDENTIAL_RENEW_LEAD_DEFAULT_MS, CENTER_CREDENTIAL_RENEW_LEAD_MAX_MS, CENTER_CREDENTIAL_RENEW_LEAD_MIN_MS } from "./center-credential-renewer.js";
 import { SANDBOX_IPV6_DEFAULT, SANDBOX_IPV6_WORDS } from "./sandbox-egress-policy.js";
 import { WORKSPACE_CACHE_DEFAULT, WORKSPACE_CACHE_MOUNT_DEFAULT, WORKSPACE_CACHE_SIZE_DEFAULT, WORKSPACE_CACHE_WORDS } from "./workspace-cache.js";
-import { SESSION_SNAPSHOT_BUCKET_DEFAULT, WORKSPACE_SNAPSHOT_BUCKET_DEFAULT } from "./object-store-buckets.js";
-import { WORKSPACE_PERSIST_DEFAULT, WORKSPACE_PERSIST_WORDS, WORKSPACE_SNAPSHOT_KEEP_DEFAULT, WORKSPACE_SNAPSHOT_KEEP_RANGE, WORKSPACE_SNAPSHOT_PREFIX_DEFAULT, WORKSPACE_SNAPSHOT_TIMEOUT_MS_DEFAULT, WORKSPACE_SNAPSHOT_TIMEOUT_MS_RANGE } from "./workspace-space.js";
+import { LEGACY_BLOB_ROOT_DEFAULT, S3_PUBLIC_BUCKET_DEFAULT, SESSION_SNAPSHOT_BUCKET_DEFAULT, SIGV4_PRESIGN_MAX_SEC, WORKSPACE_SNAPSHOT_BUCKET_DEFAULT, WORKSPACE_SNAPSHOT_PREFIX_DEFAULT, objectStoreActionOf } from "./object-store-buckets.js";
+import { WORKSPACE_PERSIST_DEFAULT, WORKSPACE_PERSIST_WORDS, WORKSPACE_SNAPSHOT_KEEP_DEFAULT, WORKSPACE_SNAPSHOT_KEEP_RANGE, WORKSPACE_SNAPSHOT_TIMEOUT_MS_DEFAULT, WORKSPACE_SNAPSHOT_TIMEOUT_MS_RANGE } from "./workspace-space.js";
 import { APPROVAL_ASK_RETENTION_DEFAULT_MS, APPROVAL_ASK_RETENTION_FLOOR_MS } from "./approval-ask-retention.js";
 import { SANDBOX_SECRET_SEAT_VERBS } from "./plugins/k8s-exec-protocol.js";
 import { ADOPTION_IMPORT_MAX_SESSIONS_DEFAULT, ADOPTION_IMPORT_MAX_SESSIONS_FLOOR, ADOPTION_IMPORT_MAX_SESSION_BYTES_CEILING, ADOPTION_IMPORT_MAX_SESSION_BYTES_DEFAULT, ADOPTION_IMPORT_MAX_SESSION_BYTES_FLOOR } from "./adoption/import-limits.js";
@@ -24,11 +24,13 @@ import { buildDisplaySafeUrlChecked } from "./trace/redact.js";
 import { describeAllowlistPostures } from "./env-name-allowlist-knobs.js";
 import { buildOutboundProxyPosture } from "./outbound-dispatcher.js";
 import { modelImageInput, modelReasoningDecl } from "./model-select.js";
+const BLOB_TTL_DEFAULT_SEC = ((ttl) => (ttl === "unsigned" ? undefined : ttl.defaultSec))(objectStoreActionOf("file-history/blob:GET").ttl);
 export const CATALOG_VALUE_TYPES = ["boolean", "number", "string", "enum", "csv", "json", "path", "url", "secret", "opaque"];
 export const CATALOG_TIMINGS = ["hot", "restart", "deploy", "inert"];
 export const CATALOG_DANGER_AXES = ["security", "billing", "data"];
 export const URL_CREDENTIAL_POLICIES = ["refuse", "mask"];
-export const SECRET_CREDENTIAL_FORMS = ["whole", "token-table", "key-set"];
+export const SECRET_CREDENTIAL_FORMS = ["whole", "token-table", "key-set", "name-list"];
+export const BAKE_RUNNER_CREDENTIAL_ENV = { BAKE_RUNNER_TOKEN: "whole" };
 const RESTART_SLICE_SET = {
     skills: true,
     mcp: true,
@@ -70,7 +72,7 @@ export const CONFIG_CATALOG = [
     r("ADOPTION_IMPORT_MAX_SESSIONS", "limitsHttp", "number", `收编批量导入 POST /v1/adoption/:id/sessions 每请求最多几个会话信封(超了整请求 400 request.field_invalid,句子点名本旋钮;地板 ${ADOPTION_IMPORT_MAX_SESSIONS_FLOOR},越界夹取 + 点名,小数拒启);当前值经能力位 adoptionImport.maxSessions 交给已收编的源主体`, { staticDefault: String(ADOPTION_IMPORT_MAX_SESSIONS_DEFAULT), configKey: "adoptionImportMaxSessions" }),
     r("ADOPTION_IMPORT_MAX_SESSION_BYTES", "limitsHttp", "number", `收编批量导入每个会话信封最多多少字节(信封 JSON 的 UTF-8 字节;超了只拒那一个元素 rejected/too_large,带 count 与 cap;合法域 [${ADOPTION_IMPORT_MAX_SESSION_BYTES_FLOOR}, ${ADOPTION_IMPORT_MAX_SESSION_BYTES_CEILING}] —— 上帽 = JSON 体上限减空批包络,再大的值够不着,越界夹取 + 点名,小数拒启);当前值经能力位 adoptionImport.maxSessionBytes 交给已收编的源主体`, { staticDefault: String(ADOPTION_IMPORT_MAX_SESSION_BYTES_DEFAULT), configKey: "adoptionImportMaxSessionBytes" }),
     r("AGENT_DATA_DIR", "store", "path", "本机数据根回落链一环(LOCAL_DATA_ROOT → CONFIG_LOCAL_DIR → AGENT_DATA_DIR → ~/.ai-agent);记忆引擎缺省根同链", { danger: DATA, derivedDefaultNote: "缺席 ⇒ 链上下一环,最终 ~/.ai-agent" }),
-    r("ALLOW_UNAUTHED_WRITES", "auth", "boolean", "无 service token 时仍接受任务提交(本地开发逃生口;缺省 fail-closed 拒提交)", { staticDefault: "false", danger: SEC, configKey: "allowUnauthedWrites" }),
+    r("ALLOW_UNAUTHED_WRITES", "auth", "boolean", "写门对没带过门凭据(service token / 鉴权桥验过的登录令牌)的请求也放行:任务提交、改写门与破坏性会话写都照收(本地开发逃生口;缺省 fail-closed 拒)", { staticDefault: "false", danger: SEC, configKey: "allowUnauthedWrites" }),
     r("ANTHROPIC_API_KEY", "modelPlane", "secret", "Anthropic 协议路线的 x-api-key 凭据(只发 x-api-key 头;与 ANTHROPIC_AUTH_TOKEN 互斥 —— 同设拒启,机读码 `config.anthropic_credential_conflict`;与 BASE_URL 同在时可推断 provider)", { credentialForm: "whole", danger: [...SEC, ...BILL] }),
     r("ANTHROPIC_AUTH_TOKEN", "modelPlane", "secret", "Anthropic 兼容生态的 Bearer 凭据(只发 Authorization: Bearer 头;与 ANTHROPIC_API_KEY 互斥 —— 同设拒启,机读码 `config.anthropic_credential_conflict`)", { credentialForm: "whole", danger: [...SEC, ...BILL] }),
     r("ANTHROPIC_BASE_URL", "modelPlane", "url", "Anthropic 协议路线 base URL(与凭据同在且 MODEL_PROVIDER 未设 ⇒ 推断 provider=anthropic 并 boot notice;带 userinfo 拒启,机读码 `config.gateway_url_userinfo`;解析不动/不透明形拒启,机读码 `config.model_route_url_invalid`;带 `#fragment` 拒启,机读码 `config.model_route_url_fragment` —— fragment 从不上线,后缀会落进被丢弃的那一半)", { credentialPolicy: "refuse" }),
@@ -94,7 +96,7 @@ export const CONFIG_CATALOG = [
     r("AUTH_BRIDGE_AUDIENCE", "auth", "string", "registry SSO-JWT 验签期望 aud", { danger: SEC }),
     r("AUTH_BRIDGE_ISSUER", "auth", "url", "registry SSO-JWT issuer(auth bridge 的开关之一;**不是**托管证据 —— 多租户只认 REQUIRE_PRINCIPAL=true)", { credentialPolicy: "mask", danger: SEC, derivedDefaultNote: "缺席 ⇒ 桥的装配处回退到 webAdmin.baseUrl(配了 center 即默认开桥);显式值与回退值在托管判定上同判(都不算)", configKey: "authBridgeIssuer" }),
     r("AUTH_BRIDGE_JWKS_URL", "auth", "url", "registry SSO-JWT 的 JWKS 地址(缺省从 issuer 派生)", { credentialPolicy: "mask", danger: SEC }),
-    r("AUTONOMY", "auth", "enum", "运维 autonomy 模式(read-only ⇒ 只读手 + 写面 roots,每段续跑重折,子代同受、委派照挂;ask ⇒ 恒 shellGate,每段重折;plan ⇒ 提交入口的模式词地板:新提交的任务以 permissionMode:plan 起步,请求词钳到它之下,写与非只读调用在调用时问 / 拒,批准计划之后整条 run 按批准的档跑完);center 腿热且 non-sticky(plan 地板只作用于之后提交的任务)", { danger: SEC, enumValues: AUTONOMY_MODES, configKey: "autonomy", center: cGov("autonomy") }),
+    r("AUTONOMY", "auth", "enum", "运维 autonomy 模式(read-only ⇒ 只读手 + 写面 roots,每段续跑重折,子代同受、委派照挂;ask ⇒ 恒 shellGate,每段重折;plan ⇒ 提交入口的模式词地板:新提交的任务以 permissionMode:plan 起步,请求词钳到它之下,写与非只读调用在调用时问 / 拒,批准计划之后整条 run 按批准的档跑完);center 腿热且 non-sticky(plan 地板作用于之后的提交,也作用于停驻 run 的下一次续跑:续跑之前体上的词过此刻的地板,批准计划写下的档原样)", { danger: SEC, enumValues: AUTONOMY_MODES, configKey: "autonomy", center: cGov("autonomy") }),
     r("AUTO_BACKGROUND_ON_TIMEOUT", "orchestration", "boolean", "前台 Bash 命令撞上它自己的超时时:开 ⇒ 合格的命令(资格由引擎判)转成后台任务继续跑(后台进程上限与后台超时硬上限照常管它);同一个开关也让引擎在有人的输入排队等着而合格命令还在跑时把它转后台、好让输入送达;关 ⇒ 两件都不做,超时即杀。只在能把运行中的命令领养成后台的车道上生效,其余车道照起、旋钮不生效 —— 本车道上生不生效看 GET /health 的 autoBackgroundOnTimeout(armed / off / unsupported)", { staticDefault: "true", configKey: "autoBackgroundOnTimeout" }),
     r("AUTO_MODE_CLASSIFIER_FALLBACK", "approval", "enum", "auto 分类器席答不出裁决时的梯子(main=主模型代判 / none=只留分类器那一级,整条拒)", { enumValues: ["main", "none"], danger: SEC, derivedDefaultNote: "未设/空串 ⇒ 不铸键,跟随引擎缺省 main(core 7.18.0 起;空串按未设,与其余词表旋钮同判);none = 7.77.0 及以前的行为逐字;词表外的值启动期拒启。权限轴放宽,升级须知见 DEPLOY-PREREQS", configKey: "autoModeClassifierFallback" }),
     r("AUTO_MODE_CLASSIFIER_TIMEOUT_MS", "approval", "number", `auto 分类器单级判决上限(ms;缺席 = core 缺省;自托管慢网关按排队 + prefill 留足;一级到点没裁 ⇒ 走下一级,走完仍没裁 ⇒ 这次门控调用整条拒;须为 [${AUTO_MODE_CLASSIFIER_TIMEOUT_BOUNDS.minMs}, ${AUTO_MODE_CLASSIFIER_TIMEOUT_BOUNDS.maxMs}] 内十进制整数,0 / 小数 / 越界拒启)`, { derivedDefaultNote: "未设/空串 ⇒ 不铸键,跟随 core 缺省(本仓不复制上游数字;core 改缺省本旋钮照映不改)", configKey: "autoModeClassifierTimeoutMs" }),
@@ -106,7 +108,7 @@ export const CONFIG_CATALOG = [
     r("BAKE_SUBMIT_RATE_MAX", "orchestration", "number", "per-principal bake 提交限流窗内最大次数(0=关)", { staticDefault: "10" }),
     r("BAKE_SUBMIT_RATE_WINDOW_SEC", "orchestration", "number", "per-principal bake 提交限流窗长(秒)", { staticDefault: "60" }),
     r("BG_AGENT_PARK_CLAIM_STALE_MS", "orchestration", "number", "parked 后台 agent 的 stale-claim 清算窗(ms;claimer 崩死的行由此解卡)", { staticDefault: String(60 * 60_000), configKey: "backgroundAgentParkClaimStaleMs" }),
-    r("BG_AGENT_RETENTION_MS", "orchestration", "number", "TERMINAL 后台 agent 行保留期(ms,reaper 按 scope 清)", { staticDefault: String(7 * 24 * 60 * 60 * 1000), danger: DATA, configKey: "backgroundAgentRetentionMs" }),
+    r("BG_AGENT_RETENTION_MS", "orchestration", "number", "保留期(ms)的两个读者:TERMINAL 后台 agent 行(终局起,reaper 按 scope 清)与 sidechain 会话(最后活动起,维护拍的会话老化腿删)", { staticDefault: String(7 * 24 * 60 * 60 * 1000), danger: DATA, configKey: "backgroundAgentRetentionMs" }),
     r("BG_AGENT_STALE_RUNNING_MS", "orchestration", "number", "running 后台 agent 行写者心跳断更超此值翻 failed(ms;下限 10min 硬钳)", { staticDefault: String(15 * 60_000), configKey: "backgroundAgentStaleRunningMs" }),
     r("BG_AGENT_STALL_MS", "orchestration", "number", "会话驻留后台子代理的停滞收割窗(ms;最后一次工具活动距今超此值 ⇒ 行收成 killed、归因 system、run 中止;缺省 = 下限,只许拉大,无关闭档)", { derivedDefaultNote: "缺席 ⇒ max(600000, max(STREAM_ASK_WINDOW_MS, UNREACHED_ASK_TTL_MS, QUESTION_TTL_MS, MCP_ELICITATION_TTL_MS) + 引擎单命令上限(缺省 600000));单用户 posture 下 86400000 + 600000", configKey: "backgroundAgentStallMs" }),
     r("BIND_HOST", "auth", "string", "监听绑址(显式值恒生效)", { danger: SEC, derivedDefaultNote: "缺席:无鉴权写面(allowUnauthedWrites ∧ 零凭证)自动收窄 127.0.0.1,其余全接口", resolve: (c) => c.bindHost ?? null }),
@@ -152,7 +154,7 @@ export const CONFIG_CATALOG = [
     r("DOCKER_NETWORK", "orchestration", "enum", "local-docker 容器网络模式", { enumValues: ["none", "bridge", "host"], staticDefault: "bridge", danger: SEC }),
     r("DOCKER_PATH", "orchestration", "path", "docker 二进制路径"),
     r("DOCKER_PIDS_LIMIT", "orchestration", "number", "local-docker fork-bomb 背栓(--pids-limit;非法值回 adapter 默认 512+warn)", { danger: SEC, derivedDefaultNote: "缺席 ⇒ adapter 默认 512" }),
-    r("DOCKER_SANDBOX_ENV", "orchestration", "secret", "local-docker 车道每条 docker exec 以 -e 注入的本进程 env 点名表(NAME,NAME;点到的键从 worker env 原样取,值不进 spec/center/日志;与 LSP_ENV_ALLOW / E2B_SANDBOX_ENV 同一只解析器与「点名放行」谓词:形错 / 点名名单型旋钮 / 点名本服务自有凭据 —— 名是,或值是本服务的某一枚凭据(另一个名下的副本)—— (会把本服务的凭据装进模型读得到的沙箱;判官 = 引擎此刻的自有凭据声明)拒启且不回显值;本进程环境里没有的名按序号 warn、不转发;只在本车道被选中时求值;原文按凭据类对待:只回在场位、不进任何子进程)", { credentialForm: "whole", danger: SEC }),
+    r("DOCKER_SANDBOX_ENV", "orchestration", "secret", "local-docker 车道每条 docker exec 以 -e 注入的本进程 env 点名表(NAME,NAME;点到的键从 worker env 原样取,值不进 spec/center/日志;与 LSP_ENV_ALLOW / E2B_SANDBOX_ENV 同一只解析器与「点名放行」谓词:形错 / 点名名单型旋钮 / 点名本服务自有凭据 —— 名是,或值是本服务的某一枚凭据(另一个名下的副本)—— (会把本服务的凭据装进模型读得到的沙箱;判官 = 引擎此刻的自有凭据声明)拒启且不回显值;本进程环境里没有的名按序号 warn、不转发;只在本车道被选中时求值;原文按凭据类对待:只回在场位、不进任何子进程)", { credentialForm: "name-list", danger: SEC }),
     r("DRAIN_GRACE_MS", "limitsHttp", "number", "SIGTERM 优雅排空窗(ms;期间新计费提交 503+Retry-After)。出厂默认是**服务器部署**的取值;壳自 spawn 的引擎会被壳注入更短的窗 ⇒ 排壳形关机预算时按壳自己注入的值算(壳读不到本目录:它是 operator-only),排空开始后本次排空定死的到期点读 GET /health 的 engineSignal.draining.deadlineAt,从信号到进程退出的上界见 USAGE 的「停机上界(契约句)」;不照抄 staticDefault", { staticDefault: String(10 * 60 * 1000), configKey: "drainGraceMs", center: cLimits("drainGraceMs") }),
     r("DRAIN_SECOND_SIGNAL_MIN_GAP_MS", "limitsHttp", "number", `排空期「第二发信号 = 硬停」的最小间隔(ms;锚 = 本次排空的第一发停止信号 —— SIGTERM / SIGHUP 升级进的排空,入口那一发就是它;排空口 / 租约被拒 / 附着租约自退进的排空,到达的第一发被吸收、不缩短期限。SIGTERM / SIGINT 与锚相隔不足 ⇒ 同一拍的重复投递,一行 drain_duplicate_signal_ignored 后忽略、排空继续;0 = 关,恒按第二发硬停;须为 [${DRAIN_SECOND_SIGNAL_MIN_GAP_BOUNDS.minMs}, ${DRAIN_SECOND_SIGNAL_MIN_GAP_BOUNDS.maxMs}] 内十进制整数(上界 = DRAIN_GRACE_MS 地板),小数 / 负数 / 越界拒启)`, { staticDefault: String(DRAIN_SECOND_SIGNAL_MIN_GAP_DEFAULT_MS), configKey: "drainSecondSignalMinGapMs" }),
     r("DURABLE_APPROVAL", "approval", "boolean", "durable suspend/resume HITL(需 SQL 店;决定 checkpointStore 与 /v1/approvals 面的存在性)", { danger: SEC, derivedDefaultNote: "posture 三态:显式词恒赢,缺席 = 单用户(REQUIRE_PRINCIPAL≠true)且有耐久店 ⇒ on / 多租户或无耐久店 ⇒ off;生效来源见 GET /v1/diagnostics/wiring 的 serverGates.durableApproval.source", configKey: "durableApproval" }),
@@ -164,7 +166,7 @@ export const CONFIG_CATALOG = [
     r("E2B_LIVENESS_MS", "orchestration", "number", LIVENESS_KNOB_SEMANTICS("e2b"), { derivedDefaultNote: LIVENESS_KNOB_DEFAULT_NOTE }),
     r("E2B_MOUNT_PATH", "orchestration", "path", "e2b 工作区根(resume 用当前值,改前先 drain 挂起任务)"),
     r("E2B_ORPHAN_RECLAIM", "orchestration", "boolean", "崩溃遗留沙盒回收腿(boot 一次+周期;判据保守,拿不准恒不杀)", { staticDefault: "true", danger: BILL }),
-    r("E2B_SANDBOX_ENV", "orchestration", "secret", "转发进 e2b 沙箱的本进程 env 点名表(NAME,NAME;点到的键从 worker env 原样取,值不进 spec/center/事件日志;与 LSP_ENV_ALLOW / DOCKER_SANDBOX_ENV 同一只解析器与「点名放行」谓词:形错 / 点名名单型旋钮 / 点名本服务自有凭据 —— 名是,或值是本服务的某一枚凭据(另一个名下的副本)—— (会把本服务的凭据装进模型读得到的沙箱;判官 = 引擎此刻的自有凭据声明)拒启且不回显值;本进程环境里没有的名按序号 warn、不转发;只在本车道被选中时求值;原文按凭据类对待:只回在场位、不进任何子进程)", { credentialForm: "whole", danger: SEC }),
+    r("E2B_SANDBOX_ENV", "orchestration", "secret", "转发进 e2b 沙箱的本进程 env 点名表(NAME,NAME;点到的键从 worker env 原样取,值不进 spec/center/事件日志;与 LSP_ENV_ALLOW / DOCKER_SANDBOX_ENV 同一只解析器与「点名放行」谓词:形错 / 点名名单型旋钮 / 点名本服务自有凭据 —— 名是,或值是本服务的某一枚凭据(另一个名下的副本)—— (会把本服务的凭据装进模型读得到的沙箱;判官 = 引擎此刻的自有凭据声明)拒启且不回显值;本进程环境里没有的名按序号 warn、不转发;只在本车道被选中时求值;原文按凭据类对待:只回在场位、不进任何子进程)", { credentialForm: "name-list", danger: SEC }),
     r("E2B_SANDBOX_MAX_MS", "orchestration", "number", "e2b 沙箱最长存活(ms)", { staticDefault: "3600000", danger: BILL }),
     r("E2B_TEMPLATE", "orchestration", "string", "e2b 模板名(缺省 adapter 基础模板)"),
     r("E2B_TIMEOUT_MS", "orchestration", "number", "e2b 单命令总超时(ms)"),
@@ -177,10 +179,10 @@ export const CONFIG_CATALOG = [
     r("FILE_HISTORY_CAPTURE", "store", "boolean", "文件历史**捕获**总开关(三条车道同义)。关 = 不再捕获任何改动文件的首次快照(落 core 的部署捕获位 `RunnerDeps.fileHistoryCapture: \"off\"`,能力词 `fileHistoryCapture` 翻 off);7.104.0 起**只关捕获**:历史店照接,已存历史照常 restoreFiles / rewindFilesTo / 2c session-sync。关掉 ≠ 删掉:已捕获的历史不被批量删除,仍按会话删除与留存规则清理 —— 要清存量走 DELETE 会话或留存旋钮;没有「整库历史不可用」的旋钮", { staticDefault: "true", danger: DATA, configKey: "fileHistoryCapture" }),
     r("FILE_HISTORY_RETENTION_KEEP", "store", "number", "per-file rewind 历史的保留上限(与 core FileStorageBackend 同域键形,三条车道一套语义)", { danger: DATA, derivedDefaultNote: "缺席 ⇒ core 缺省 100" }),
     r("FLEET_ADVERTISE_ADDRESS", "integrations", "url", `fleet 面向 center 公告的本 worker 可达地址(中心车道配齐 + 本键 ⇒ 公告环;空串 = 未设;用量环不看本键)。中心往它后面拼路径,与中心基址三席同一条判据:${CENTER_BASE_URL_RULE}`, { credentialPolicy: "refuse", configKey: "fleetAdvertiseAddress" }),
-    r("FLEET_GENERATION", "integrations", "string", "fleet 成员的代际(配置渲染器写;引擎回声到心跳与 /health 的 generation)。缺席 ⇔ 非 fleet 成员(不续服务租约、不受围栏);在场必须是规范十进制串(\"0\" / \"7\";空串、前导零、符号、空白拒启)", { danger: SEC, configKey: "fleetGeneration" }),
+    r("FLEET_GENERATION", "integrations", "string", "fleet 成员的代际(配置渲染器写;引擎回声到心跳与 /health 的 generation)。缺席 ⇔ 非 fleet 成员(不续服务租约、不受围栏、sso 准入不比对令牌 scope;成员上令牌 scope 必须等于 FLEET_SCOPE);在场必须是规范十进制串(\"0\" / \"7\";空串、前导零、符号、空白拒启)", { danger: SEC, configKey: "fleetGeneration" }),
     r("FLEET_LEASE_FAIL_CLOSED", "integrations", "boolean", "租约连接级失败(中心鉴权拒 / 凭证不可读 / 不可达 / 5xx / 超时 / 坏体)时计费入口拒 503 fleet.lease_unavailable(true)还是放行(false);409 not-lease 与耗尽 429 不受它管;词表外拒启", { danger: SEC, derivedDefaultNote: "缺席 ⇒ 按部署姿态派生:REQUIRE_PRINCIPAL=true ⇒ true(多租:额度是安全轴);单用户 ⇒ false(AP 姿态)。显式值压过派生。生效值见 caps centerWiring.failMode", configKey: "fleetLeaseFailClosed" }),
     r("FLEET_LEASE_OUTAGE_MAX_MS", "integrations", "number", "一台实例「活着而不服务」的最长时长 T_max(ms),两处读它:① 服务租约中心不可达的容忍上限 —— 租约过期(从没被授予过的:从围栏生效那一刻;一直没听到中心的成员从本进程起点)满这么久 ⇒ 新计费提交 503 state.lease_expired(取消 / HITL 应答 / 续跑 / 读面照放行,在飞不动,/readyz 不翻),只在 fleet 成员 ∧ 中心没有声明不执行租约(心跳答复的 capabilities 声明不带 servingLease)时生效;② 排空口 POST /v1/admin/drain 的期限上界 —— deadlineAt 离此刻超过它 ⇒ 400 request.field_invalid,成员与非成员同读;< 60000(租约 TTL 地板)或非整数拒启", { danger: SEC, staticDefault: String(FLEET_LEASE_OUTAGE_MAX_DEFAULT_MS), configKey: "fleetLeaseOutageMaxMs" }),
-    r("FLEET_SCOPE", "integrations", "string", "本引擎所在的租户 scope(配置渲染器对每台受管引擎写,缺省 scope 也写;手接的引擎缺席 = 缺省 scope;唯一读者 = 排空口 POST /v1/admin/drain 的身份比对,请求不带 scope 也读成缺省 scope)。在场必须是 scope id 形(小写字母 / 数字 / 内部连字符,1–64;空串拒启);与 FLEET_GENERATION 不联动(成员缺席 ⇒ 缺省 scope)。续租体与心跳不带它(scope 由中心凭证绑定)", { danger: SEC, staticDefault: GLOBAL_SCOPE, configKey: "fleetScope" }),
+    r("FLEET_SCOPE", "integrations", "string", "本引擎所在的租户 scope(配置渲染器对每台受管引擎写,缺省 scope 也写;手接的引擎缺席 = 缺省 scope;两个读者读同一个值:排空口 POST /v1/admin/drain 的身份比对(请求不带 scope 也读成缺省 scope)与 fleet 成员(FLEET_GENERATION 在场)上的 sso 准入 —— 登记中心登录令牌的 scope ≠ 本值 ⇒ 整次请求 403 auth.scope_mismatch;非成员不比对)。在场必须是 scope id 形(小写字母 / 数字 / 内部连字符,1–64;空串拒启);与 FLEET_GENERATION 不联动(成员缺席 ⇒ 缺省 scope)。续租体与心跳不带它(scope 由中心凭证绑定)", { danger: SEC, staticDefault: GLOBAL_SCOPE, configKey: "fleetScope" }),
     r("FORK_ENABLED", "orchestration", "boolean", "CC /fork(core Fork 工具)装配开关", { derivedDefaultNote: "posture 三态:缺席 = 单用户 ⇒ on / 多租户 ⇒ off(per-principal entitlement 另判)", configKey: "forkEnabled" }),
     r("GATEWAY_MAX_RETRIES", "modelPlane", "number", "openai 兼容腿每次调用重试上限", {
         derivedDefaultNote: "缺席 ⇒ 按外层拓扑分两态(启动日志 `brain` 字段的 `gatewayRetryCap` 回显哪一态):配了备用网关(`MODEL_GATEWAY_FALLBACK_URLS`)/ 开了断路器开关(`MODEL_CIRCUIT_BREAKER`,单路网关上也算)/ 开了反应式降级(配着 `MODEL_DEGRADE_TO` 且 `MODEL_DEGRADE_REACTIVE` 开)" +
@@ -191,7 +193,7 @@ export const CONFIG_CATALOG = [
     r("GIT_API_KIND", "integrations", "enum", "Git host API 方言", { enumValues: ["gitea", "github"], staticDefault: "gitea", configKey: "gitApiKind" }),
     r("GIT_API_TOKEN", "integrations", "secret", "repo 工具的 Git host 凭据", { credentialForm: "whole", danger: SEC }),
     r("HOOKS_TIMEOUT_MS", "orchestration", "number", "请求 hooks 的每张车道注册(settings.hooks / settings.hooks.managed,各一份同值)每个 handler 的时间预算(ms;0=零预算是合法值)", { derivedDefaultNote: "缺席 ⇒ 不铸键,读法 settingsHooksBudgetMs 取 600000" }),
-    r("HOOK_ENV_ALLOW", "orchestration", "secret", `settings hook 环境的点名放回名单(点到的键从服务进程环境原样放回 hook 环境、部署方显式承担:命令 hook 的子进程 env 与 http hook 头的 $NAME 插值读同一份;服务进程变量进 hook 环境只有这一个来源,请求的 allowedEnvVars / settings.httpHookAllowedEnvVars 只收窄、不授予;形错 / 点名任一只名单型旋钮(含自己)/ 点名本服务自有凭据 —— 名是,或值是本服务的某一枚凭据(另一个名下的副本;列表形凭据逐枚比)—— (判官 = 引擎此刻的自有凭据声明)拒启且不回显值;本进程环境里没有的名按序号 warn、不放回、不回显;多租户姿态(忽略时起服 warn 一次):${describeAllowlistPostures()};原文按凭据类对待:只回在场位、不进任何子进程)`, { credentialForm: "whole", danger: SEC, derivedDefaultNote: "缺席 / 空串 ⇒ 空名单 = 不放回(hook 环境 = 十二名基础名单 + 请求 settings.env)" }),
+    r("HOOK_ENV_ALLOW", "orchestration", "secret", `settings hook 环境的点名放回名单(点到的键从服务进程环境原样放回 hook 环境、部署方显式承担:命令 hook 的子进程 env 与 http hook 头的 $NAME 插值读同一份;服务进程变量进 hook 环境只有这一个来源,请求的 allowedEnvVars / settings.httpHookAllowedEnvVars 只收窄、不授予;形错 / 点名任一只名单型旋钮(含自己)/ 点名本服务自有凭据 —— 名是,或值是本服务的某一枚凭据(另一个名下的副本;列表形凭据逐枚比)—— (判官 = 引擎此刻的自有凭据声明)拒启且不回显值;本进程环境里没有的名按序号 warn、不放回、不回显;多租户姿态(忽略时起服 warn 一次):${describeAllowlistPostures()};原文按凭据类对待:只回在场位、不进任何子进程)`, { credentialForm: "name-list", danger: SEC, derivedDefaultNote: "缺席 / 空串 ⇒ 空名单 = 不放回(hook 环境 = 十二名基础名单 + 请求 settings.env)" }),
     r("HOST_BG_DEFAULT_TIMEOUT_SEC", "orchestration", "number", "host 后台 shell 缺省超时(秒)", { staticDefault: "300" }),
     r("HOST_BG_ENABLED", "orchestration", "boolean", "host 车道后台 shell 开关", { staticDefault: "true" }),
     r("HOST_BG_FILE_CAP", "orchestration", "number", "host 后台 shell 磁盘护栏(字节;失控输出被 reap)", { staticDefault: String(64 * 1024 * 1024) }),
@@ -227,7 +229,7 @@ export const CONFIG_CATALOG = [
     r("K8S_NAMESPACE", "orchestration", "string", "沙箱 pod 所在的 namespace(REMOTE_EXEC=k8s 必需件,与 K8S_SANDBOX_IMAGE 同级:缺席、空串或只有空白 ⇒ 起服拒,拒句点名本旋钮;服务不带内置缺省 —— 部署的声明是唯一来源,随包 chart 已显式设为 sandbox.namespace;只在 REMOTE_EXEC=k8s 被选中时求值)"),
     r("K8S_RUNTIME_CLASS", "orchestration", "string", "沙箱 pod runtimeClass(Kata 等)"),
     r("K8S_SANDBOX_BROKER_IMAGE", "orchestration", "string", "成员 git 凭据代理容器的镜像(k8s 沙箱 pod 的 containers[1],只挂在成员 run 的 pod 上;建议填本引擎自身镜像 —— 代理是本包里固定路径的一只程序,命令固定);不设 ⇒ 成员 git 凭据平面关(GET /v1/capabilities 的 credentialPlane.sandboxGit = broker_image_unset),任何 pod 都不挂代理,pod 形逐字节同不设时;只在 REMOTE_EXEC=k8s 被选中时求值"),
-    r("K8S_SANDBOX_ENV", "orchestration", "secret", `转发进 k8s 沙箱 pod 容器 env 的本进程 env 点名表(NAME,NAME;点到的键从 worker env 原样取,值只进该 pod 自己的 Secret —— pod spec 的容器 env 只带 secretKeyRef 引用、不带值,Secret 随 pod 由集群回收;不进工作区 / 快照 / center / 事件日志;沙箱命名空间的 Role 要 secrets ${SANDBOX_SECRET_SEAT_VERBS.env.join(" / ")},起服问不许即拒启;与 LSP_ENV_ALLOW / E2B_SANDBOX_ENV / DOCKER_SANDBOX_ENV 同一只解析器与「点名放行」谓词:形错 / 点名名单型旋钮 / 点名本服务自有凭据 —— 名是,或值是本服务的某一枚凭据(另一个名下的副本)—— (会把本服务的凭据装进模型读得到的沙箱;判官 = 引擎此刻的自有凭据声明)拒启且不回显值;本进程环境里没有的名按序号 warn、不转发;与包源派生 env 撞名时显式名单胜;只在本车道被选中时求值;原文按凭据类对待:只回在场位、不进任何子进程)`, { credentialForm: "whole", danger: SEC }),
+    r("K8S_SANDBOX_ENV", "orchestration", "secret", `转发进 k8s 沙箱 pod 容器 env 的本进程 env 点名表(NAME,NAME;点到的键从 worker env 原样取,值只进该 pod 自己的 Secret —— pod spec 的容器 env 只带 secretKeyRef 引用、不带值,Secret 随 pod 由集群回收;不进工作区 / 快照 / center / 事件日志;沙箱命名空间的 Role 要 secrets ${SANDBOX_SECRET_SEAT_VERBS.env.join(" / ")},起服问不许即拒启;与 LSP_ENV_ALLOW / E2B_SANDBOX_ENV / DOCKER_SANDBOX_ENV 同一只解析器与「点名放行」谓词:形错 / 点名名单型旋钮 / 点名本服务自有凭据 —— 名是,或值是本服务的某一枚凭据(另一个名下的副本)—— (会把本服务的凭据装进模型读得到的沙箱;判官 = 引擎此刻的自有凭据声明)拒启且不回显值;本进程环境里没有的名按序号 warn、不转发;与包源派生 env 撞名时显式名单胜;只在本车道被选中时求值;原文按凭据类对待:只回在场位、不进任何子进程)`, { credentialForm: "name-list", danger: SEC }),
     r("K8S_SANDBOX_IMAGE", "orchestration", "string", "k8s 车道沙箱镜像(REMOTE_EXEC=k8s 必需件)"),
     r("K8S_SANDBOX_IPV6", "orchestration", "enum", "k8s 沙箱 pod 的 IPv6:disabled = pod 级 sysctl 关 IPv6(net.ipv6.conf.all / default.disable_ipv6=1;两只都不在 k8s 的 safe sysctl 表里 ⇒ 每个节点 kubelet 要 --allowed-unsafe-sysctls 点名,否则 pod 起不来;沙箱 ns 不能 enforce PodSecurity baseline / restricted);enabled = 不动 pod(pod 保留平台给的 IPv6,只执行 IPv4 的出网策略管不到它,起服自检每次一行 sandbox_egress_policy_gap{kind: ipv6_enabled});词表外拒启", { enumValues: SANDBOX_IPV6_WORDS, staticDefault: SANDBOX_IPV6_DEFAULT, danger: SEC }),
     r("K8S_TIMEOUT_MS", "orchestration", "number", "k8s 沙箱 pod 寿命(activeDeadlineSeconds,ms;整只 pod 的泄漏护栏,后台任务超时也被它钳;各条命令的超时见工具超时)"),
@@ -253,7 +255,7 @@ export const CONFIG_CATALOG = [
     r("LOCAL_STORE_DURABILITY", "store", "enum", "运维声明 local 店易失(词闭集只有 ephemeral):local 后端交给会话店与检查点店两半的引擎声明都降为 process-local(委派分区不降:后台子代照旧能停驻) ⇒ 数据根落在易失介质(容器可写层 / tmpfs / emptyDir)上不再拒启 config.store_not_durable,起服 warn 一行;后果 = 店里的会话、停驻审批与记忆不随容器 / Pod 替换保留(进程重启照旧活过)。读面 store.durability 照旧按介质如实报。SQL / memory 后端不读。部署者自己设,壳 / 编排器不代写", { enumValues: LOCAL_STORE_DECLARATION_WORDS, danger: DATA, derivedDefaultNote: "缺席 ⇒ 店型的设计声明(活过进程重启);店落在调用方自己的盘上(host 车道单主)且数据根介质易失时,同样降为 process-local", configKey: "localStoreDurability" }),
     r("LOCKED_CONFIG_KEYS", "auth", "csv", "管理员锁定层声明(词表=core 闭集注册表,未知键拒启)", { danger: SEC, configKey: "lockedConfigKeys" }),
     r("LOG_LEVEL", "observability", "string", "日志档位", { staticDefault: "info", configKey: "logLevel" }),
-    r("LSP_ENV_ALLOW", "orchestration", "secret", `host 腿语言服务器子进程 env 的点名放行名单(点到的键从服务 env 原样放回、部署方显式承担;没点到的照剥;与 host shell inheritEnv:[names] 同一只谓词;形错 / 点名任一只名单型旋钮(含自己)/ 点名本服务自有凭据 —— 名是,或值是本服务的某一枚凭据(另一个名下的副本)—— (剥后放回会把引擎刚扣下的凭据交回去;判官 = 引擎此刻的自有凭据声明)拒启且不回显值;本进程环境里没有的名按序号 warn、不放行、不回显;多租户姿态(忽略时起服 warn 一次):${describeAllowlistPostures()};原文按凭据类对待:只回在场位、不进任何子进程,生效名单见起服披露行 allowed)`, { credentialForm: "whole", danger: SEC, derivedDefaultNote: "缺席 / 空串 ⇒ 空名单 = 全剥(7.100.0 行为)" }),
+    r("LSP_ENV_ALLOW", "orchestration", "secret", `host 腿语言服务器子进程 env 的点名放行名单(点到的键从服务 env 原样放回、部署方显式承担;没点到的照剥;与 host shell inheritEnv:[names] 同一只谓词;形错 / 点名任一只名单型旋钮(含自己)/ 点名本服务自有凭据 —— 名是,或值是本服务的某一枚凭据(另一个名下的副本)—— (剥后放回会把引擎刚扣下的凭据交回去;判官 = 引擎此刻的自有凭据声明)拒启且不回显值;本进程环境里没有的名按序号 warn、不放行、不回显;多租户姿态(忽略时起服 warn 一次):${describeAllowlistPostures()};原文按凭据类对待:只回在场位、不进任何子进程,生效名单见起服披露行 allowed)`, { credentialForm: "name-list", danger: SEC, derivedDefaultNote: "缺席 / 空串 ⇒ 空名单 = 全剥(7.100.0 行为)" }),
     r("LSP_HOST_ENABLED", "orchestration", "boolean", "本机语言服务器开关(只在 host 车道且单主时挂;本机 language server,优雅降级)", { staticDefault: "true", configKey: "lspHostEnabled" }),
     r("MANUAL_MODE_SHELL_GATE", "approval", "enum", "手动模式 shell 门收紧腿(off=no-op 非放松 —— 本键只有收紧半场;拼错拒启;classify 档已退役 = 拒启指路)", { danger: SEC, enumValues: ["always", "off"], echoWords: ["always"], resolve: (c) => c.manualModeShellGate ?? null, derivedDefaultNote: "off/未设 ⇒ 本键不贡献任何东西(归一成键缺席)⇒ 回显 null;真姿态只有 always 一个(core 7.34.0 起形状档在每一种模式下都装,classify 不再是运维选的档)" }),
     r("MAX_PRINCIPAL_COST_USD", "limitsHttp", "number", "per-principal 窗内成本天花板(0=关)", { staticDefault: "0", danger: BILL, configKey: "maxPrincipalCostUsd", center: cLimits("maxPrincipalCostUsd") }),
@@ -383,8 +385,9 @@ export const CONFIG_CATALOG = [
     r("MYSQL_PORT", "store", "number", "MySQL 协议端口", { staticDefault: "3306" }),
     r("MYSQL_USER", "store", "string", "MySQL 协议用户", { danger: DATA }),
     r("NO_PROXY", "limitsHttp", "csv", "不走代理的目标(小写 `no_proxy` 同认且优先);语法 = undici 的:逗号或空白分隔,`host` 精确且含其子域、`.host` / `*.host` 后缀、`host:port` 限端口、`*` 全直连;**回环 / 未指定地址目标无论写没写都直连**(本仓的无条件规则,不是 NO_PROXY 的一条);boot 冻结", { danger: SEC, derivedDefaultNote: "缺席 ⇒ 除回环外一律按 HTTP(S)_PROXY 走", resolve: (_c, env) => buildOutboundProxyPosture(env).noProxy }),
-    r("OPERATOR_PRINCIPALS", "auth", "csv", "operator 名单(全部运维面同一条读法:名单内的验过主体是运维;空名单 = 谁都不是;与 OPERATOR_SINGLE_USER 互斥;单用户部署与 OPERATOR_SINGLE_USER 二者必写其一,都不写则拒启 —— 服务进程起服第 1 段即拒,直接调 `createHttpServer` 的嵌入方装配时拒)", { danger: SEC, configKey: "operatorPrincipals" }),
-    r("OPERATOR_SINGLE_USER", "auth", "boolean", "单用户形当自己运维的显式声明(true ⇒ 这台部署的每个调用方在全部运维面都是运维;只在 REQUIRE_PRINCIPAL 未开且 OPERATOR_PRINCIPALS 为空时成立,否则拒启;单用户部署与具名 OPERATOR_PRINCIPALS 二者必写其一 —— 都不写则拒启(服务进程起服第 1 段;嵌入方装配运维面时),false 与缺席同判;起服冻结)", { staticDefault: "false", danger: SEC, configKey: "operatorSingleUser" }),
+    r("OPERATOR_DRAIN_PRINCIPALS", "auth", "csv", "名册的排空档 —— 只持排空一权的服务主体名单(名单内的验过主体可调 POST /v1/admin/drain,不是人:它的身份在其余每条路由上整次请求 403 auth.principal_confined,GET /health 按没出示凭据分档,它名下登记过的设备在 GET /v1/device/ws 的 hello 被拒 auth_failed;空 / 缺席 = 这一档没人;与 OPERATOR_PRINCIPALS 同一个名字 ⇒ 拒启;与 OPERATOR_SINGLE_USER 互斥;不算运维声明;起服冻结)", { danger: SEC, configKey: "operatorDrainPrincipals" }),
+    r("OPERATOR_PRINCIPALS", "auth", "csv", "operator 名单 —— 名册的全运维档(全部运维面同一条读法:名单内的验过主体是运维,持每一只运维权力,排空在内;空名单 = 谁都不是;与 OPERATOR_DRAIN_PRINCIPALS 不相交;与 OPERATOR_SINGLE_USER 互斥;单用户部署与 OPERATOR_SINGLE_USER 二者必写其一,都不写则拒启 —— 服务进程起服第 1 段即拒,直接调 `createHttpServer` 的嵌入方装配时拒)", { danger: SEC, configKey: "operatorPrincipals" }),
+    r("OPERATOR_SINGLE_USER", "auth", "boolean", "单用户形当自己运维的显式声明(true ⇒ 这台部署的每个调用方在全部运维面都是运维;只在 REQUIRE_PRINCIPAL 未开且 OPERATOR_PRINCIPALS 与 OPERATOR_DRAIN_PRINCIPALS 都为空时成立,否则拒启;单用户部署与具名 OPERATOR_PRINCIPALS 二者必写其一 —— 都不写则拒启(服务进程起服第 1 段;嵌入方装配运维面时),false 与缺席同判;起服冻结)", { staticDefault: "false", danger: SEC, configKey: "operatorSingleUser" }),
     r("OTEL_EXPORTER_OTLP_ENDPOINT", "observability", "url", "OTLP 出口(设了=开 otel)", { credentialPolicy: "mask" }),
     r("OTEL_EXPORTER_OTLP_HEADERS", "observability", "secret", "OTLP 出口头(k=v CSV;常载鉴权头 ⇒ 按凭据处置)", { credentialForm: "whole", danger: SEC }),
     r("OTEL_EXPORT_INTERVAL_MS", "observability", "number", "OTLP 批报周期(ms)", { staticDefault: "15000" }),
@@ -435,8 +438,8 @@ export const CONFIG_CATALOG = [
     r("RUN_MAX_CONCURRENT", "orchestration", "number", "本副本在飞 run 的全局并发帽(0 = 关;整数,坏值拒启):提交门(POST /v1/runs · A2A message/send · POST /v1/tasks · POST /v1/tasks/stream)在幂等重放之后判在飞数,已到帽 ⇒ 429 limit.rate_exceeded + reason run_concurrency_cap + Retry-After: 5;续跑 / 唤醒 / 审批作答不判", { staticDefault: "0", configKey: "runMaxConcurrent" }),
     r("RUN_MAX_CONCURRENT_PER_PRINCIPAL", "orchestration", "number", "同一已验提交主体在本副本的在飞 run 并发帽(0 = 关;整数,坏值拒启;无主体请求不判这一帽,只受 RUN_MAX_CONCURRENT)", { staticDefault: "0", configKey: "runMaxConcurrentPerPrincipal" }),
     r("RUN_STORE_STRICT_HYDRATE", "store", "enum", "file run-store 列不出 runs/ 时拒启的 fail-closed 门(缺省带病起动+响亮披露)", { enumValues: ["on", "off"], staticDefault: "off", danger: DATA, configKey: "runStoreStrictHydrate", booleanEnum: { true: "on", false: "off" } }),
-    r("S3_ENDPOINT", "store", "url", "外接 S3 兼容位(单独在场即开公链签发,兼作公网面)", { credentialPolicy: "mask", danger: DATA }),
-    r("S3_PUBLIC_BUCKET", "store", "string", "SendUserFile 公链桶", { derivedDefaultNote: "缺席 ⇒ sema-public" }),
+    r("S3_ENDPOINT", "store", "url", "外接 S3 兼容位(MINIO_ENDPOINT 缺席时作 SendUserFile 的对象存储端点,与 MINIO_ACCESS_KEY / MINIO_SECRET_KEY 同在才开签发;S3_PUBLIC_ENDPOINT 缺席时兼作公网面)", { credentialPolicy: "mask", danger: DATA }),
+    r("S3_PUBLIC_BUCKET", "store", "string", "SendUserFile 公链桶", { derivedDefaultNote: `缺席 ⇒ ${S3_PUBLIC_BUCKET_DEFAULT}` }),
     r("S3_PUBLIC_ENDPOINT", "store", "url", "SendUserFile 公网面 endpoint(跨仓契约名,禁改)", { credentialPolicy: "mask" }),
     r("SANDBOX_BASE_REF", "orchestration", "string", "bake 缺省 base ref(缺席回落 index 最新 sandbox-base)"),
     r("SANDBOX_ENV_FACTS", "orchestration", "boolean", "沙箱事实注入(# Environment 块的 profile/capabilities/pkgSource/egress/resume 事实);会话 scratchpad 的宣告不归本键管(它是写面的宣告,关事实不关 scratchpad)", { staticDefault: "true", configKey: "envFactsEnabled" }),
@@ -462,6 +465,8 @@ export const CONFIG_CATALOG = [
     r("SEMA_UV_INDEX", "orchestration", "url", "SANDBOX_PKG_SOURCE=custom 的显式 uv index 地址", { credentialPolicy: "refuse" }),
     r("SEMA_UV_PY_MIRROR", "orchestration", "url", "SANDBOX_PKG_SOURCE=custom 的显式 uv python 分发镜像地址", { credentialPolicy: "refuse" }),
     r(WEB_ADMIN_ENV.adminToken, "integrations", "secret", "写 web-admin 的管理凭证(仅 boot 上报执行公钥用;刻意不入 ServiceConfig —— 不进 configHash/日志面)", { credentialForm: "whole", danger: SEC, scope: "bootstrap-only" }),
+    r(WEB_ADMIN_ENV.assertionToken, "integrations", "secret", `web-admin 断言令牌(值形;编排器注入;与 ${WEB_ADMIN_ENV.assertionTokenFile} 二选一,都设=拒启)。唯一读者 = 中心凭证的声明读口(与 ${WEB_ADMIN_ENV.token} 同一只判官;只在接了中心 ${WEB_ADMIN_ENV.url} 时读):本版只报声明在 / 不在(/health center.assertionToken、起服日志 center_assertion_token),值不进配置、不向中心出示;它是本服务自有凭据,宿主子进程环境里扣掉`, { credentialForm: "whole", danger: SEC }),
+    r(WEB_ADMIN_ENV.assertionTokenFile, "integrations", "path", `web-admin 断言令牌文件(给不经编排器的手接引擎;与 ${WEB_ADMIN_ENV.assertionToken} 二选一,都设=拒启)。唯一读者同 ${WEB_ADMIN_ENV.assertionToken}:本版只报声明在 / 不在,不读文件内容`, { danger: SEC }),
     r(WEB_ADMIN_ENV.dryRun, "integrations", "boolean", "web-admin 腿 dry-run(拉而不应用)", { staticDefault: "false", danger: SEC }),
     r(WEB_ADMIN_ENV.liveUrl, "integrations", "url", `fleet 活性组(心跳 / 注销、服务租约 = settings-schema FLEET_LIVE_PATHS)的 web-admin 基址:给管理面在就绪门后、活性面另走一条不看就绪的入口的部署。缺席 = ${WEB_ADMIN_ENV.url}。传输地址,不参与中心身份互证。${CENTER_BASE_URL_RULE}`, { credentialPolicy: "refuse", danger: SEC }),
     r(WEB_ADMIN_ENV.token, "integrations", "secret", `center 拉取凭据(值形;与 ${WEB_ADMIN_ENV.tokenFile} 二选一,都设=拒启)`, { credentialForm: "whole", danger: SEC }),
@@ -470,7 +475,7 @@ export const CONFIG_CATALOG = [
     r(WEB_ADMIN_ENV.webUrl, "integrations", "url", `web-admin 人用界面的固定基址:引擎原样转述到 /health 的 center.webBaseUrl,壳按它拼会话深链(路径归壳)。缺席即缺席(引擎不拼不猜);只在接了中心(${WEB_ADMIN_ENV.url})时挂;必须与中心身份(AUTH_BRIDGE_ISSUER,缺席 = ${WEB_ADMIN_ENV.url})同主机同端口(http ↔ https 同族),否则拒启。${CENTER_BASE_URL_RULE}`, { credentialPolicy: "refuse" }),
     r(WEB_ADMIN_ENV.worker, "integrations", "string", "本 worker 在 web-admin 上的名字(per-worker effective)"),
     r("SEND_USER_FILE_SANDBOX_PUT_ENDPOINT", "store", "url", "沙箱侧 presigned PUT Host 绑定 endpoint(in-cluster 可用内网面)", { credentialPolicy: "mask", derivedDefaultNote: "缺席 ⇒ publicEndpoint" }),
-    r("SEND_USER_FILE_URL_TTL", "store", "number", "公链 TTL(秒;非法值回 0=永久轨,绝不 NaN 进签名)", { staticDefault: "0" }),
+    r("SEND_USER_FILE_URL_TTL", "store", "number", `SendUserFile 链接有效期(秒;不设 / 0 = 永久公链轨,正整数 = 私有预签名链接,至多 ${SIGV4_PRESIGN_MAX_SEC}(SigV4 的 7 天);超过上限或不是十进制整数(如 \`1h\` / \`-5\` / \`3600.5\` / \`1e3\`)起服拒)`, { staticDefault: "0" }),
     r("SENSITIVE_WRITE_PATTERNS", "approval", "csv", "敏感路径写 deny 集(unset=core 推荐集;显式值整表替换;off/空=关 —— 真放松杆)。拒的是文件工具(Write / Edit / NotebookEdit,按路径);shell 命令写同一路径(重定向 / tee / cp …)不被这个集拒绝,走普通审批问", { danger: SEC, derivedDefaultNote: "缺席 ⇒ core RECOMMENDED_SENSITIVE_PATTERNS", configKey: "sensitiveWritePatterns" }),
     r("SERVICE_AUTH_TOKEN", "auth", "secret", "共享 service token(写面门;缺席且未开 ALLOW_UNAUTHED_WRITES ⇒ 拒提交)", { credentialForm: "whole", danger: SEC }),
     r("SERVICE_AUTH_TOKENS", "auth", "secret", "per-system 凭据表(tok=system CSV;source 从凭据派生,绝不自报)", { credentialForm: "token-table", danger: SEC }),
@@ -483,8 +488,8 @@ export const CONFIG_CATALOG = [
     r("SESSION_EVENTS_MAX_PROBES", "limitsHttp", "number", "session SSE 共享探针数帽", { derivedDefaultNote: "缺席 ⇒ 512" }),
     r("SESSION_EVENTS_WARM_MS", "limitsHttp", "number", "session SSE 温探针间隔(ms)", { derivedDefaultNote: "缺席 ⇒ 2000" }),
     r("SESSION_SNAPSHOT_BUCKET", "store", "string", "快照 blob 桶(兼 SendUserFile 私桶)", { derivedDefaultNote: `缺席 ⇒ ${SESSION_SNAPSHOT_BUCKET_DEFAULT}` }),
-    r("SESSION_SNAPSHOT_PREFIX", "store", "string", "快照 blob key 前缀", { derivedDefaultNote: "缺席 ⇒ blobs/(MinioBlobBackend 默认)" }),
-    r("SESSION_SNAPSHOT_TTL_SEC", "store", "number", "快照 presign TTL(秒;坏值省略走默认,绝不 NaN 签名)", { derivedDefaultNote: "缺席 ⇒ 3600(MinioBlobBackend 默认)" }),
+    r("SESSION_SNAPSHOT_PREFIX", "store", "string", "会话 blob 命名空间的 key 前缀(文件历史 / 附件 / 认领物件;共用一只会话快照桶的引擎各设各的,同桶同前缀的第二只库起服拒;以 attachments/ 或 file-history/ 结尾的值起服拒)", { derivedDefaultNote: `缺席 ⇒ 文件历史、附件与认领物件在桶根,退役快照纪元读 ${LEGACY_BLOB_ROOT_DEFAULT}` }),
+    r("SESSION_SNAPSHOT_TTL_SEC", "store", "number", `会话 blob 请求的 presign TTL(秒;十进制整数,0 告警后走缺省;超过 ${SIGV4_PRESIGN_MAX_SEC}(SigV4 的 7 天)或不是十进制整数(如 \`1h\` / \`-5\` / \`3600.5\` / \`1e3\` / \`0x10\`)起服拒)`, { derivedDefaultNote: `缺席 ⇒ ${BLOB_TTL_DEFAULT_SEC}(对象存储动作表 blob 行的缺省)` }),
     r("SIGHUP_IDLE_GRACE_MS", "limitsHttp", "number", "SIGHUP 空闲关停窗(ms;共享引擎形防误杀)", { staticDefault: "120000", configKey: "sighupIdleGraceMs" }),
     r("SKILLS_DIR", "integrations", "path", "出厂 skill 目录(设了就整个替换包内 skills/,不叠加;配置源的技能再按名盖上)", { derivedDefaultNote: "缺席 ⇒ 包内 skills/(相对模块解析,不是 cwd)", configKey: "skillsDir" }),
     r("SNAPSHOT_BLOB_ALLOW_SQL_BYTES", "store", "boolean", "云形缺 MinIO 时显式接受 SQL 店放快照字节(严格 'true';安全姿势开关不收宽松真值)", { staticDefault: "false", danger: DATA, configKey: "snapshotBlobAllowSql" }),
@@ -501,7 +506,6 @@ export const CONFIG_CATALOG = [
     r("STREAM_APPROVAL_ADHOC_GRACE_MS", "approval", "number", "流内审批 adhoc 腿窗后宽限(ms;须 window+grace < orphanTtl,破坏形拒启)", { staticDefault: "60000" }),
     r("STREAM_APPROVAL_ADMIT_MAX_PER_OWNER", "approval", "number", "流内审批 per-owner 未决帽", { staticDefault: "256" }),
     r("STREAM_APPROVAL_ADMIT_MAX_PER_TASK", "approval", "number", "流内审批 per-task 未决帽(超限 unavailable ⇒ park 路由)", { staticDefault: "32" }),
-    r("STREAM_APPROVAL_ENABLED", "approval", "boolean", "流内审批协议总开关(false=整链回 7.3.0 前行为的唯一干净还原键)", { staticDefault: "true", danger: SEC, configKey: "streamApproval" }),
     r("STREAM_APPROVAL_ORPHAN_TTL_MS", "approval", "number", "遗孤 ask 最终可判上界(ms,量 createdAt)", { staticDefault: String(7 * 24 * 60 * 60 * 1000) }),
     r("STREAM_APPROVAL_PENDING_GRACE_MS", "approval", "number", "崩溃恢复扫描宽限(ms;活属主常态必胜,reaper 只兜纯崩溃)", { staticDefault: "30000" }),
     r("STREAM_APPROVAL_RECONCILE_BATCH", "approval", "number", "对账收敛器每 tick 每段行数帽(整数)", { staticDefault: "200" }),
@@ -547,7 +551,7 @@ export const CONFIG_CATALOG = [
     r("WORKSPACE_SNAPSHOT_KEEP", "orchestration", "number", `k8s 工作区每个空间(会话住客)保留的快照份数(整数 [${WORKSPACE_SNAPSHOT_KEEP_RANGE.min}, ${WORKSPACE_SNAPSHOT_KEEP_RANGE.max}];写新快照后删最老的;域外拒启)`, { staticDefault: String(WORKSPACE_SNAPSHOT_KEEP_DEFAULT), danger: DATA }),
     r("WORKSPACE_SNAPSHOT_PREFIX", "orchestration", "string", "k8s 工作区快照 key 前缀:`/` 分隔的一段或多段普通 key 段(kata、libA/ws;每段以字母或数字开头,其后字母数字 . _ -);空段 / . / .. / 前导或尾随 / / 其它字符 ⇒ 拒启并点名第几段(config.workspace_snapshot_prefix_invalid)", { derivedDefaultNote: `缺席 ⇒ ${WORKSPACE_SNAPSHOT_PREFIX_DEFAULT}` }),
     r("WORKSPACE_SNAPSHOT_TIMEOUT_MS", "orchestration", "number", `k8s 工作区快照的时限(毫秒,整数 [${WORKSPACE_SNAPSHOT_TIMEOUT_MS_RANGE.min}, ${WORKSPACE_SNAPSHOT_TIMEOUT_MS_RANGE.max}];域外拒启):一个数管四处 —— run 末上传与连沙箱时恢复的墙钟上界、空间结束时回收座一次调用的绝对截止(卷与对象都在内)、下一条 run 等上一条存完的最长等待(提交围栏的存活上界);大文件读写的墙钟也是它。大工作区(构建目录 GB 级)撞上界 ⇒ 调大它或配 WORKSPACE_SNAPSHOT_EXCLUDE`, { staticDefault: String(WORKSPACE_SNAPSHOT_TIMEOUT_MS_DEFAULT) }),
-    r("WORKSPACE_SNAPSHOT_TTL_SEC", "orchestration", "number", "k8s 工作区快照 presign TTL(秒)"),
+    r("WORKSPACE_SNAPSHOT_TTL_SEC", "orchestration", "number", `k8s 工作区快照 presign TTL(秒;十进制整数,0 = 缺省;按行的策略帽截到 3600;超过 ${SIGV4_PRESIGN_MAX_SEC}(SigV4 的 7 天)或不是十进制整数(如 \`1h\` / \`-5\` / \`3600.5\` / \`1e3\` / \`0x10\`)起服拒)`),
     r("WORKTREE_ALLOWED_ROOTS", "orchestration", "csv", "worktree 隔离纵深白名单(缺省 = [repoRoot])", { danger: SEC }),
     r("WORKTREE_BASE_COMMIT", "orchestration", "string", "worktree 基准 ref(缺省 core HEAD)"),
     r("WORKTREE_ISOLATION_ENABLED", "orchestration", "boolean", "git-worktree 隔离(与 REPO_ROOT 同在才开,半配保持 OFF)", { staticDefault: "false", danger: SEC }),

package/dist/config-dir-trust.js

@@ -1,7 +1,8 @@
 import { lstat, readdir, readlink, realpath, stat } from "node:fs/promises";
 import path from "node:path";
-import { CONFIG_ROOT_DOCUMENTS } from "@sema-agent/settings-schema";
-import { LOCAL_READER_DOCUMENTS } from "./config-d-migration.js";
+import { CONFIG_ROOT_DOCUMENTS, RETIRED_DOMAINS, isRetiredDomainName } from "@sema-agent/settings-schema";
+import { PORTABLE_DOMAINS } from "@sema-agent/settings-schema/node";
+import { REMOTE_EXEC_DOCUMENT } from "@sema-agent/settings-schema/remote-exec";
 import { recordFailOpen } from "./observability/fail-open.js";
 import { HOST_PLATFORM } from "./plugins/host-platform.js";
 import { coversPath, parseMountinfo, readProcessMountinfo, visibleMountOf } from "./mountinfo.js";
@@ -219,6 +220,7 @@ async function confirmUnreached(lexical) {
     }
     return { kind: "unresolvable", path: lexical };
 }
+const LOCAL_READER_DOCUMENTS = [...PORTABLE_DOMAINS, ...Object.keys(RETIRED_DOMAINS).filter(isRetiredDomainName), REMOTE_EXEC_DOCUMENT];
 const documentFiles = () => LOCAL_READER_DOCUMENTS.map((d) => `${d}.json`);
 const rootDocumentFiles = () => CONFIG_ROOT_DOCUMENTS.map((d) => `${d}.json`);
 async function reach(lexical, want, ctx) {

package/dist/config-invariants.d.ts

@@ -35,9 +35,9 @@ import { type EnvTableReplacementInput } from "./env-model-table-gate.js";
  */
 export declare const LIVENESS_HEARTBEAT_MS = 30000;
 /** 闭集:新增一条不变量必须在这里加词(拼错 = 编译红,而不是运行期悄悄不判)。 */
-export type CrossInvariantId = "run-stale-heartbeat" | "bind-posture" | "bake-runner-credential" | "direct-door-anchors" | "operator-principals-required" | "operator-single-user" | "operator-declaration-required" | "operator-single-user-boundary" | "single-user-anonymous-boundary" | "bake-operator-principals" | "sensitive-write-patterns" | "leader-host-lane" | "multi-tenant-shared-lane" | "leader-durable-store" | "device-durable-store" | "device-durable-approval" | "model-provider-word" | "gateway-url-userinfo" | "anthropic-credential-exclusive" | "model-route-endpoint" | "default-model-resolvable" | "refused-names-not-minted" | "env-table-replacement-acknowledged" | "center-one-identity" | "workflow-park-decision-domain" | "remote-config-provider-url" | "retention-lane-complete";
+export type CrossInvariantId = "run-stale-heartbeat" | "bind-posture" | "bake-runner-credential" | "direct-door-anchors" | "operator-principals-required" | "operator-single-user" | "operator-roster-well-formed" | "operator-declaration-required" | "operator-single-user-boundary" | "single-user-anonymous-boundary" | "bake-operator-principals" | "sensitive-write-patterns" | "leader-host-lane" | "multi-tenant-shared-lane" | "leader-durable-store" | "device-durable-store" | "device-durable-approval" | "model-provider-word" | "gateway-url-userinfo" | "anthropic-credential-exclusive" | "model-route-endpoint" | "default-model-resolvable" | "refused-names-not-minted" | "env-table-replacement-acknowledged" | "center-one-identity" | "workflow-park-decision-domain" | "remote-config-provider-url" | "retention-lane-complete";
 /** 表读的键集(取自平铺配置型 ⇒ 键名/类型永不与真配置漂)。 */
-export type CrossInvariantView = Readonly<Pick<ServiceConfigFlat, "runStaleSec" | "authToken" | "authTokens" | "allowUnauthedWrites" | "imageBakes" | "directApprovalDoor" | "durableApproval" | "approvalHmacKeys" | "principalJwtPubkeys" | "principalJwtIss" | "principalJwtAud" | "requirePrincipal" | "operatorPrincipals" | "operatorSingleUser" | "bindHost" | "bindHostSource" | "sensitiveWritePatterns" | "leaderEnabled" | "selfOrchestrationEnabled" | "workflowRunStoreBackend" | "remoteExec" | "dbBackend" | "tidb" | "pg" | "envModel" | "gatewayBaseUrl" | "gatewayFallbackUrls" | "anthropic" | "models" | "modelRefusals" | "tiers" | "authBridgeIssuer" | "webAdmin" | "configProvider" | "retentionPolicy" | "retentionSweep">>;
+export type CrossInvariantView = Readonly<Pick<ServiceConfigFlat, "runStaleSec" | "authToken" | "authTokens" | "allowUnauthedWrites" | "imageBakes" | "directApprovalDoor" | "durableApproval" | "approvalHmacKeys" | "principalJwtPubkeys" | "principalJwtIss" | "principalJwtAud" | "requirePrincipal" | "operatorPrincipals" | "operatorDrainPrincipals" | "operatorSingleUser" | "bindHost" | "sensitiveWritePatterns" | "leaderEnabled" | "selfOrchestrationEnabled" | "workflowRunStoreBackend" | "remoteExec" | "dbBackend" | "tidb" | "pg" | "envModel" | "gatewayBaseUrl" | "gatewayFallbackUrls" | "anthropic" | "models" | "modelRefusals" | "tiers" | "authBridgeIssuer" | "webAdmin" | "configProvider" | "retentionPolicy" | "retentionSweep">>;
 export interface CrossInvariantInput {
     /** 现役配置(boot 期 = 候选自身)。 */
     readonly live: CrossInvariantView;
@@ -80,10 +80,21 @@ export declare function halfOpenDirectDoorRefusal(v: Pick<CrossInvariantView, "d
  */
 export declare function operatorPrincipalsRequiredRefusal(v: Pick<CrossInvariantView, "durableApproval" | "requirePrincipal" | "operatorPrincipals">): string | undefined;
 /**
- * `operator-single-user`([ref],[ref] ① 裁 A):「谁是 operator」一个事实一个来源。`OPERATOR_SINGLE_USER=true`(单用户形的每个调用方都是运维)
- * 只在单用户形、名单为空时成立:多租形没有「单一用户」(声明会把每个租户都变成运维);名单非空时两个来源答同一个问题。两形都拒,句子点名两根旋钮与出路。
+ * `operator-single-user`([ref],[ref] ① 裁 A):「谁是 operator」一个事实一个来源。`OPERATOR_SINGLE_USER=true`(单用户形的每个调用方都落全运维档)
+ * 只在单用户形、名册各档名单都空时成立:多租形没有「单一用户」(声明会把每个租户都变成运维);任一档名单非空时两个来源答同一个问题(档表 `operator-roster.ts` 逐档读)。
+ * 两形都拒,句子点名两根旋钮与出路(一档一句,穷举 switch:加一档不接句子 = 编译红)。
  */
-export declare function operatorSingleUserRefusal(v: Pick<CrossInvariantView, "operatorSingleUser" | "requirePrincipal" | "operatorPrincipals">): string | undefined;
+export declare function operatorSingleUserRefusal(v: Pick<CrossInvariantView, "operatorSingleUser" | "requirePrincipal" | "operatorPrincipals" | "operatorDrainPrincipals">): string | undefined;
+/**
+ * `operator-roster-well-formed` —— **名册良构**(档表 `operator-roster.ts` 逐档读;三臂,按序答第一条):
+ *  ① 每一档的名单是名字的列表(绕过类型手搓的配置放一串字符串 ⇒ `includes` 读成子串匹配 = 放宽);
+ *  ② **非人档**的每个名字都是一位主体的名字(与身份边界同一只名形判官 `principalShapeProblem`:空 / 不可见字符 / 保留标识 / 超长)—— 坏形的名字永远读不成一位验过的人,
+ *     也就永远圈禁不到(圈禁判在读人抛名形错时不判,这一臂让「不判」结构上无害);人档的坏形名字只是永远对不上任何人,不拒(没写新键的部署零差);
+ *  ③ 各档名单不相交 —— 一个名字的运维权力只在一档里答(与 `operator-single-user` 同理:两个来源答同一个问题 ⇒ 拒)。
+ * 拒句点名 env 与条数,不回显名字(名单是部署的身份配置,拒句进 stderr 与起服日志)。**两处调用、一只判据**:`loadConfig`(服务入口起服即拒)与装配路由的
+ * `createHttpServer`(嵌入方只过这一座)。env 独有、起服冻结 —— 热路径上同判(条目在下)。
+ */
+export declare function operatorRosterWellFormedRefusal(v: Pick<CrossInvariantView, "operatorPrincipals" | "operatorDrainPrincipals">): string | undefined;
 /**
  * `operator-declaration-required`([ref])—— **单用户部署必须说出谁是运维**。单用户形(租户轴不成立,`DEPLOYMENT_SHAPE_PREDICATES.multiTenant`)上
  * 「谁是运维」只有两种答法:`OPERATOR_SINGLE_USER=true`(每个调用方都是)或具名 `OPERATOR_PRINCIPALS`;两样都没有 = 没人能用这台部署的运维面
@@ -95,7 +106,7 @@ export declare function operatorSingleUserRefusal(v: Pick<CrossInvariantView, "o
  */
 export declare function operatorDeclarationRefusal(v: Pick<CrossInvariantView, "requirePrincipal" | "operatorPrincipals" | "operatorSingleUser">): string | undefined;
 /** {@link operatorSingleUserBoundaryRefusal} 读的键(条目的 `keys` 与「判正在改的那份」比较同读这一张)。 */
-declare const SINGLE_USER_BOUNDARY_KEYS: readonly ["operatorSingleUser", "authToken", "authTokens", "allowUnauthedWrites", "bindHost", "bindHostSource"];
+declare const SINGLE_USER_BOUNDARY_KEYS: readonly ["operatorSingleUser", "authToken", "authTokens", "allowUnauthedWrites", "bindHost"];
 type SingleUserBoundaryView = Pick<CrossInvariantView, (typeof SINGLE_USER_BOUNDARY_KEYS)[number]>;
 /**
  * `operator-single-user-boundary` —— **单用户声明要有一道身份边界**。`OPERATOR_SINGLE_USER=true` 让这台部署的每个调用方都是运维(`explicitOperatorOk`),
@@ -109,7 +120,7 @@ type SingleUserBoundaryView = Pick<CrossInvariantView, (typeof SINGLE_USER_BOUND
  */
 export declare function operatorSingleUserBoundaryRefusal(v: SingleUserBoundaryView): string | undefined;
 /** {@link singleUserAnonymousBoundaryRefusal} 读的键(条目的 `keys` 与「判正在改的那份」比较同读这一张)。 */
-declare const ANONYMOUS_BOUNDARY_KEYS: readonly ["requirePrincipal", "authToken", "authTokens", "allowUnauthedWrites", "bindHost", "bindHostSource"];
+declare const ANONYMOUS_BOUNDARY_KEYS: readonly ["requirePrincipal", "authToken", "authTokens", "allowUnauthedWrites", "bindHost"];
 type AnonymousBoundaryView = Pick<CrossInvariantView, (typeof ANONYMOUS_BOUNDARY_KEYS)[number]>;
 /**
  * `single-user-anonymous-boundary` —— **单用户部署上不带主体的 run 要有一道身份边界**。单用户形(部署形表 `multiTenant` 不成立)上,不带主体的 run 就是这台部署的那一个人:
@@ -117,7 +128,8 @@ type AnonymousBoundaryView = Pick<CrossInvariantView, (typeof ANONYMOUS_BOUNDARY
  * 写面无鉴权(`ALLOW_UNAUTHED_WRITES` ∧ 没配 service 凭据 = {@link bindMustNarrow})时,能连上这个口的都能不带主体提交 run;监听地址只在本机回环 ⇒ 能连上的只有本机,成立;
  * 否则 ⇒ 网络上任何人都按那个人的规则跑 ⇒ 起服拒,拒句一行给两条出路:配凭据 / 只听本机回环。不加旋钮(两条出路都是既有键)。
  * 写面无鉴权且零凭据时,监听地址缺省就收窄到 127.0.0.1(继承的 `HOST` 也压不过)⇒ 本条只在运维显式 `BIND_HOST` 把它暴露出去时成立。
- * 写面要凭据而没配凭据的部署没有人能提交 run,不归本条;配了凭据的部署,调用方 = 凭据持有者(与 `operator-single-user-boundary` 同一道边界)。
+ * 写面要凭据的部署(没开逃生口)上能提交 run 的只有带着凭据门认的凭据的调用方(service 凭据持有者 / 鉴权桥验过的登录令牌 —— 后者恒带主体),不归本条;
+ * 配了 service 凭据的部署,调用方 = 凭据持有者(与 `operator-single-user-boundary` 同一道边界)。
  * 「谁受伤」= 单用户 ∧ 写面无鉴权 ∧ 显式非回环 `BIND_HOST` 的部署(含容器里 `BIND_HOST=0.0.0.0`、宿主只发布到回环的那一形 —— 进程看不见宿主怎么发布端口);补偿 = 两条出路之一。
  * **只在服务入口判**(起服第 1 段,紧跟 `operator-single-user-boundary`):律管开监听口的进程;`run-local` 不监听、同读 `loadConfig`,不在射程。
  */

package/dist/config-invariants.js

@@ -2,15 +2,18 @@ import { assertGuardPatternsUsable } from "./deployment-governance.js";
 import { modelProviderRefusal } from "./model-provider.js";
 import { modelRouteUrlRefusal } from "./model-route-url.js";
 import { anthropicCredentialRefusal } from "./model-route-gap.js";
+import { CATALOG_REFUSAL_LEG } from "./model-select.js";
 import { modelRouteEndpointRefusal } from "./model-route-endpoint.js";
 import { defaultModelRefusal, refusedNameMintedRefusal } from "./model-entry-refusal.js";
 import { judgeEnvTableReplacement } from "./env-model-table-gate.js";
 import { WEB_ADMIN_ENV, httpUrlFlaws } from "@sema-agent/settings-schema";
-import { authBridgeIssuerOf } from "./identity-source.js";
+import { authBridgeIssuerOf, hasServiceAuth } from "./identity-source.js";
 import { buildDisplaySafeUrl } from "./trace/redact.js";
 import { ALL_EXECUTION_LANES, executionLaneCaps } from "./execution-lane-caps.js";
 import { DEPLOYMENT_SHAPE_PREDICATES } from "./deployment-shape.js";
-import { anyServiceCredential, bindMustNarrow, listensLoopbackOnly, resolveBindHost } from "./bind-host.js";
+import { bindMustNarrow, listensLoopbackOnly, resolveBindHost } from "./bind-host.js";
+import { ROSTER_TIERS, ROSTER_TIER_ORDER, rosterNamesOf } from "./operator-roster.js";
+import { principalShapeProblem } from "./principal-shape.js";
 export const LIVENESS_HEARTBEAT_MS = 30_000;
 const directDoorConjuncts = (v) => Boolean(v.directApprovalDoor) && Boolean(v.durableApproval) && v.approvalHmacKeys.length > 0 && v.principalJwtPubkeys.length > 0 && Boolean(v.principalJwtIss) && Boolean(v.principalJwtAud);
 function multiTenantSharedLaneRefusal(v) {
@@ -51,8 +54,41 @@ export function operatorSingleUserRefusal(v) {
         return undefined;
     if (v.requirePrincipal)
         return "OPERATOR_SINGLE_USER=true but REQUIRE_PRINCIPAL=true — the declaration makes every caller an operator, which only fits a single-user deployment; a multi-tenant worker names its operators in OPERATOR_PRINCIPALS. Unset OPERATOR_SINGLE_USER, or unset REQUIRE_PRINCIPAL if this is a single-user deployment";
-    if (v.operatorPrincipals.length > 0)
-        return "OPERATOR_SINGLE_USER=true but OPERATOR_PRINCIPALS is also set — the two answer the same question (who is an operator) in two ways. Keep one: OPERATOR_SINGLE_USER=true (every caller of this single-user deployment) or OPERATOR_PRINCIPALS (only the named principals)";
+    const named = ROSTER_TIER_ORDER.find((tier) => rosterNamesOf(tier, v).length > 0);
+    if (named === undefined)
+        return undefined;
+    switch (named) {
+        case "operator":
+            return "OPERATOR_SINGLE_USER=true but OPERATOR_PRINCIPALS is also set — the two answer the same question (who is an operator) in two ways. Keep one: OPERATOR_SINGLE_USER=true (every caller of this single-user deployment) or OPERATOR_PRINCIPALS (only the named principals)";
+        case "drain":
+            return "OPERATOR_SINGLE_USER=true but OPERATOR_DRAIN_PRINCIPALS is also set — the declaration already makes every caller an operator who may drain, so a drain-only roster answers the same question (who may drain) a second way. Keep one: OPERATOR_SINGLE_USER=true (every caller of this single-user deployment) or OPERATOR_DRAIN_PRINCIPALS (only the named drain-only service principals, with the operators named in OPERATOR_PRINCIPALS)";
+        default: {
+            const unknownTier = named;
+            throw new Error(`operatorSingleUserRefusal: unknown roster tier ${String(unknownTier)}`);
+        }
+    }
+}
+export function operatorRosterWellFormedRefusal(v) {
+    for (const tier of ROSTER_TIER_ORDER) {
+        const names = v[ROSTER_TIERS[tier].field];
+        if (names !== undefined && (!Array.isArray(names) || names.some((n) => typeof n !== "string")))
+            return `${ROSTER_TIERS[tier].env} must be a list of principal names, and the assembled configuration carries something else in that cell — an embedder passes an array of names (loadConfig always does) (invariant operator-roster-well-formed). Refusing to boot.`;
+    }
+    for (const tier of ROSTER_TIER_ORDER) {
+        if (ROSTER_TIERS[tier].person)
+            continue;
+        const malformed = rosterNamesOf(tier, v).filter((n) => principalShapeProblem(n) !== undefined).length;
+        if (malformed > 0)
+            return `${ROSTER_TIERS[tier].env} lists ${malformed} entr${malformed === 1 ? "y that is" : "ies that are"} not a principal name (empty, invisible or control characters, a reserved identifier, or over the principal length budget) — no verified caller can carry such a name, so it could never be confined. Remove those entries (MIGRATION.md, invariant operator-roster-well-formed). Refusing to boot.`;
+    }
+    for (const [i, a] of ROSTER_TIER_ORDER.entries()) {
+        const names = new Set(rosterNamesOf(a, v));
+        for (const b of ROSTER_TIER_ORDER.slice(i + 1)) {
+            const shared = rosterNamesOf(b, v).filter((n) => names.has(n)).length;
+            if (shared > 0)
+                return `${ROSTER_TIERS[a].env} and ${ROSTER_TIERS[b].env} name the same principal (${shared} name${shared === 1 ? "" : "s"} in both lists) — a principal's operator powers must be answered by one roster tier only. Remove each such name from one of the two lists (MIGRATION.md, invariant operator-roster-well-formed). Refusing to boot.`;
+        }
+    }
     return undefined;
 }
 export function operatorDeclarationRefusal(v) {
@@ -63,12 +99,12 @@ export function operatorDeclarationRefusal(v) {
         "Declare who operates it in one line: OPERATOR_SINGLE_USER=true (every caller of this single-user deployment is its operator — with a service credential or a loopback-only listener, or anyone who can reach the port is) or OPERATOR_PRINCIPALS=<principal,...> (only the named principals); " +
         "a worker called by more than one person is multi-tenant — set REQUIRE_PRINCIPAL=true instead (MIGRATION.md, invariant operator-declaration-required). Refusing to boot.");
 }
-const SINGLE_USER_BOUNDARY_KEYS = ["operatorSingleUser", "authToken", "authTokens", "allowUnauthedWrites", "bindHost", "bindHostSource"];
+const SINGLE_USER_BOUNDARY_KEYS = ["operatorSingleUser", "authToken", "authTokens", "allowUnauthedWrites", "bindHost"];
 function sameSingleUserBoundary(a, b) {
-    return a.operatorSingleUser === b.operatorSingleUser && anyServiceCredential(a) === anyServiceCredential(b) && resolveBindHost(a) === resolveBindHost(b);
+    return a.operatorSingleUser === b.operatorSingleUser && hasServiceAuth(a) === hasServiceAuth(b) && resolveBindHost(a) === resolveBindHost(b);
 }
 export function operatorSingleUserBoundaryRefusal(v) {
-    if (v.operatorSingleUser !== true || anyServiceCredential(v))
+    if (v.operatorSingleUser !== true || hasServiceAuth(v))
         return undefined;
     const where = offHostListener(v);
     if (where === undefined)
@@ -83,9 +119,9 @@ function offHostListener(v) {
     const bound = resolveBindHost(v);
     if (listensLoopbackOnly(bound))
         return undefined;
-    return bound === undefined ? "every network interface (BIND_HOST is not set)" : `${bound}${v.bindHostSource === "HOST" ? " (from the HOST env var)" : ""}`;
+    return bound === undefined ? "every network interface (BIND_HOST is not set)" : bound;
 }
-const ANONYMOUS_BOUNDARY_KEYS = ["requirePrincipal", "authToken", "authTokens", "allowUnauthedWrites", "bindHost", "bindHostSource"];
+const ANONYMOUS_BOUNDARY_KEYS = ["requirePrincipal", "authToken", "authTokens", "allowUnauthedWrites", "bindHost"];
 function sameAnonymousBoundary(a, b) {
     return DEPLOYMENT_SHAPE_PREDICATES.multiTenant.holds(a) === DEPLOYMENT_SHAPE_PREDICATES.multiTenant.holds(b) && bindMustNarrow(a) === bindMustNarrow(b) && resolveBindHost(a) === resolveBindHost(b);
 }
@@ -243,11 +279,18 @@ export const CONFIG_CROSS_INVARIANTS = [
     },
     {
         id: "operator-single-user",
-        keys: ["operatorSingleUser", "requirePrincipal", "operatorPrincipals"],
+        keys: ["operatorSingleUser", "requirePrincipal", "operatorPrincipals", "operatorDrainPrincipals"],
         restartReason: "operator-principals",
         bootAnchor: { file: "src/config.ts", marker: "CROSS-INVARIANT:operator-single-user" },
         check: ({ next }) => operatorSingleUserRefusal(next),
     },
+    {
+        id: "operator-roster-well-formed",
+        keys: ["operatorPrincipals", "operatorDrainPrincipals"],
+        restartReason: "operator-principals",
+        bootAnchor: { file: "src/config.ts", marker: "CROSS-INVARIANT:operator-roster-well-formed" },
+        check: ({ next }) => operatorRosterWellFormedRefusal(next),
+    },
     {
         id: "operator-declaration-required",
         keys: ["requirePrincipal", "operatorPrincipals", "operatorSingleUser"],
@@ -384,14 +427,14 @@ export const CONFIG_CROSS_INVARIANTS = [
         keys: ["gatewayBaseUrl", "gatewayFallbackUrls", "anthropic", "models"],
         restartReason: "model-route-endpoint",
         bootAnchor: { file: "src/boot/stage-02-web-admin-pull.ts", marker: "CROSS-INVARIANT:model-route-endpoint" },
-        check: ({ live, next }) => (next.models === live.models ? undefined : modelRouteEndpointRefusal(next, "catalog")),
+        check: ({ live, next }) => (next.models === live.models ? undefined : modelRouteEndpointRefusal(next, CATALOG_REFUSAL_LEG)),
     },
     {
         id: "default-model-resolvable",
         keys: ["models", "modelRefusals"],
         restartReason: "default-model",
         bootAnchor: { file: "src/boot/stage-02-web-admin-pull.ts", marker: "CROSS-INVARIANT:default-model-resolvable" },
-        check: ({ live, next }) => (next.models === live.models ? undefined : defaultModelRefusal(next, "catalog")),
+        check: ({ live, next }) => (next.models === live.models ? undefined : defaultModelRefusal(next, CATALOG_REFUSAL_LEG)),
     },
     {
         id: "refused-names-not-minted",

package/dist/config-lkg.d.ts

@@ -1,4 +1,3 @@
-import { type MigrationReceipt } from "@sema-agent/settings-schema/one-time-migrations";
 import { type PublishedPromptArtifact } from "@sema-agent/core";
 import { type ConfigDirTrustHost } from "./config-dir-trust.js";
 /** 落盘信封。`effective`/`etag` 逐字=当时的 fetchEffective 返回(JSON verbatim 面)。`formatVersion` 的语义见头注(5 = 载荷的 prompts 是中心层唯一的那种 wire 形)。 */
@@ -65,11 +64,10 @@ export declare function lkgReadDenyRows(configLkgPath: string | undefined): {
  *  影响在飞的应用链——LKG 缓存丢失的代价只是下次冷启动回到 env 兜底。 */
 export declare function saveLkg(path: string, worker: string | undefined, identity: string, effective: Record<string, unknown>, etag: string | undefined): Promise<void>;
 /** 一次读回做过的一次性迁移(调用方响亮打一行 `config_lkg_migrated`,并按 5 写回原位):`fromFormat` = 盘上的版本号;`note` = 信封层的说明
- *  (2 → 3 那一步 {@link migrateV2Lkg} / 4 → 5 那一步 {@link migrateV4Lkg});`receipts` = 载荷层 settings-schema 迁移的收据(只点名坐标与处置,不带值)。 */
+ *  (4 → 5 那一步 {@link migrateV4Lkg})。 */
 export interface LkgReadMigration {
-    readonly fromFormat: 2 | 3 | 4 | 5;
-    readonly note?: string;
-    readonly receipts: readonly MigrationReceipt[];
+    readonly fromFormat: 4;
+    readonly note: string;
 }
 /** {@link loadLkg} 读之前判官要的两件:声明的属主(`CONFIG_LOCAL_OWNER_UID`,配置席 `configLocalOwnerUid`;与本地配置根同一张可信集)+ 宿主事实(测试注入;缺席 = 本进程)。 */
 export interface LkgReadTrust {
@@ -80,8 +78,8 @@ export interface LkgReadTrust {
  * 读盘上 LKG。返回 undefined 的所有情形都「安静地回 env 兜底」(调用方 warn 点名 reason):
  * 别人改得动这份文件(目录信任判官的发现)/
  * 文件缺席/JSON 坏/信封形不对/worker 或凭证身份不匹配(防同名文件跨 worker / 跨账号串包;`CONFIG_LKG_PATH`
- * 单一路径时这是唯一的一道)/载荷有迁不动的旧形({@link migrateLkgPayload})/prompts 面复判失败。
- * `migrated`:读回时做过一次性迁移(信封 2 → 3 / 4 → 5 或载荷的 settings-schema 迁移)—— 调用方响亮打一行,并把交回的 5 写回原位。
+ * 单一路径时这是唯一的一道)/载荷带着 4 之前的旧形(3 及更早 ⇒ 版本拒)/prompts 面复判失败。
+ * `migrated`:读回时做过一次性迁移(信封 4 → 5)—— 调用方响亮打一行,并把交回的 5 写回原位。
  * `prompts`:候选判官对这份载荷 prompts 面交出的中心层(引擎 verify 过的发布形 artifact;`undefined` = 载荷不带 prompts 键)—— 调用方采纳直接用它。
  */
 export declare function loadLkg(path: string, worker: string | undefined, identity: string, trust: LkgReadTrust): Promise<{
@@ -92,16 +90,4 @@ export declare function loadLkg(path: string, worker: string | undefined, identi
     lkg?: undefined;
     reason: string;
 }>;
-/**
- * LKG 载荷(一份冻结的 effective)→ settings-schema 11 的形:调契约的 `migrateEffectiveSnapshot`(本仓不写任何一条改写规则;只认形、幂等,
- * `version` / `updatedAt` 与其余信封键原样)。有收据 `refused`(迁不动 —— 例:同一份文档里 `atModelAllowlist` 与 `atMention` 并存、
- * `runtime` 文档读不进)⇒ 交回拒因(**点名迁移 id 与契约的拒句**,不带值),调用方不读回这份 LKG:本仓应用 LKG 不经契约读腿,迁不动的旧形
- * 留在载荷里就会被下游当作缺席静默略过(例:`atModelAllowlist` 不再有读者 = 限制被静默放宽)。
- */
-export declare function migrateLkgPayload(effective: Record<string, unknown>): {
-    effective: Record<string, unknown>;
-    receipts: readonly MigrationReceipt[];
-} | {
-    refused: string;
-};
 //# sourceMappingURL=config-lkg.d.ts.map