@sema-agent/server 7.150.0 → 7.152.0

package/dist/config-lkg.js

@@ -1,6 +1,4 @@
 import { existsSync, promises as fs } from "node:fs";
-import { migrateEffectiveSnapshot } from "@sema-agent/settings-schema/one-time-migrations";
-import { formatConfigPath } from "@sema-agent/settings-schema";
 import { join, dirname, resolve } from "node:path";
 import { ensureDir } from "@sema-agent/core";
 import { judgeConfigCandidate } from "./web-admin-client/candidate-gate.js";
@@ -67,7 +65,7 @@ export async function loadLkg(path, worker, identity, trust) {
     const formatVersion = p.formatVersion;
     if (formatVersion === 1)
         return { reason: PRE_IDENTITY_LKG_REASON };
-    if (formatVersion !== 2 && formatVersion !== 3 && formatVersion !== 4 && formatVersion !== 5)
+    if (formatVersion !== 4 && formatVersion !== 5)
         return { reason: `unknown formatVersion ${String(formatVersion)}` };
     if (typeof p.worker !== "string" || p.worker !== (worker ?? "global"))
         return { reason: `worker mismatch (file=${String(p.worker)})` };
@@ -75,42 +73,19 @@ export async function loadLkg(path, worker, identity, trust) {
         return { reason: "credential identity mismatch (the LKG was fetched under another credential identity — not read back)" };
     if (p.effective === null || typeof p.effective !== "object" || Array.isArray(p.effective))
         return { reason: "bad effective" };
-    let envelope = p;
-    let note;
-    if (formatVersion === 2) {
-        const v2 = migrateV2Lkg(envelope);
-        if (v2.lkg === undefined)
-            return v2;
-        envelope = v2.lkg;
-        note = v2.migrated;
-    }
-    if (formatVersion !== 5) {
+    const envelope = p;
+    let migrated;
+    if (formatVersion === 4) {
         const v4 = migrateV4Lkg(envelope, formatVersion);
         if (v4.lkg === undefined)
             return v4;
-        note = note === undefined ? v4.migrated : `${note}; ${v4.migrated}`;
+        migrated = { fromFormat: formatVersion, note: v4.migrated };
     }
-    const payload = migrateLkgPayload(envelope.effective);
-    if ("refused" in payload)
-        return { reason: payload.refused };
-    const judged = lkgPayloadJudged(payload.effective, envelope.etag);
+    const judged = lkgPayloadJudged(envelope.effective, envelope.etag);
     if ("problem" in judged)
         return { reason: judged.problem };
-    const lkg = { ...envelope, formatVersion: 5, effective: payload.effective };
-    const migrated = formatVersion !== 5 || payload.receipts.length > 0;
-    return migrated ? { lkg, prompts: judged.prompts, migrated: { fromFormat: formatVersion, ...(note !== undefined ? { note } : {}), receipts: payload.receipts } } : { lkg, prompts: judged.prompts };
-}
-export function migrateLkgPayload(effective) {
-    const m = migrateEffectiveSnapshot(effective);
-    const refused = m.receipts.filter((r) => r.appliedAs === "refused");
-    if (refused.length > 0) {
-        return {
-            refused: "settings-schema one-time migration refused part of this LKG's payload (" +
-                refused.map((r) => `${r.migration} ${r.document}:${formatConfigPath(r.path)} — ${r.reason}`).join("; ") +
-                ") — not read back: the engine applies an LKG without the contract's reader, so a form the migration cannot rewrite would be silently skipped; the next clean candidate rewrites it",
-        };
-    }
-    return { effective: m.effective, receipts: m.receipts };
+    const lkg = { ...envelope, formatVersion: 5 };
+    return migrated === undefined ? { lkg, prompts: judged.prompts } : { lkg, prompts: judged.prompts, migrated };
 }
 function migrateV4Lkg(lkg, fromFormat) {
     if (Object.hasOwn(lkg.effective, "prompts")) {
@@ -122,35 +97,6 @@ function migrateV4Lkg(lkg, fromFormat) {
     }
     return { lkg, migrated: `formatVersion ${fromFormat} → 5 (one-time): the payload carries no prompts face, read back unchanged` };
 }
-const RETIRED_CATALOG_COORDINATE = /^models\.(0|[1-9][0-9]*)$/;
-function migrateDroppedIdentityRow(row) {
-    if (row === null || typeof row !== "object")
-        return row;
-    const r = row;
-    const at = typeof r.entry === "string" ? RETIRED_CATALOG_COORDINATE.exec(r.entry) : null;
-    const fields = r.fields;
-    if (at === null || typeof r.name !== "string" || (r.id !== undefined && typeof r.id !== "string") || !Array.isArray(fields) || !fields.every((f) => typeof f === "string") || typeof r.issues !== "string")
-        return row;
-    return { index: Number(at[1]), reasonCode: "entry-schema-invalid", identity: { name: r.name, ...(typeof r.id === "string" ? { id: r.id } : {}) }, fields: [...fields], issues: r.issues };
-}
-function migrateV2Lkg(lkg) {
-    const { etag: _incompleteCarrierValidator, ...envelope } = lkg;
-    const models = lkg.effective.models;
-    const hasRetired = models !== undefined && models !== null && typeof models === "object" && Object.hasOwn(models, "droppedIdentities");
-    let effective = lkg.effective;
-    if (hasRetired) {
-        const { droppedIdentities: retired, ...rest } = models;
-        if (Object.hasOwn(rest, "droppedCatalogEntries")) {
-            return { reason: "both the retired dropped-entry carrier (models.droppedIdentities) and its successor (models.droppedCatalogEntries) are present — no writer produces that shape; not read back" };
-        }
-        effective = { ...lkg.effective, models: { ...rest, droppedCatalogEntries: Array.isArray(retired) ? retired.map(migrateDroppedIdentityRow) : retired } };
-    }
-    return {
-        lkg: { ...envelope, effective },
-        migrated: "formatVersion 2 → 3 (one-time): this LKG was written before every dropped catalog entry was recorded, so its etag is not reused — the next pull re-reads the whole candidate and re-mints the full record" +
-            (hasRetired ? "; the retired carrier models.droppedIdentities was moved to models.droppedCatalogEntries" : ""),
-    };
-}
 function lkgPayloadJudged(effective, etag) {
     const problem = lkgPayloadShapeProblem(effective, etag);
     if (problem !== undefined)

package/dist/config-provider.d.ts

@@ -25,7 +25,7 @@ import type { ConfigProviderWord } from "./config-types.js";
  *  `effective.models.droppedCatalogEntries`(`GET /v1/models.droppedEntries` 的源,与 `models` 同世代)。 */
 /** `unreadFiles`:`config.d` 里读腿根本不读的文件(不是域 / 不是便携域)—— **不**进候选门(不是读的域判形失败),调用方一份一行
  *  `config_unread_file` 点名、其余照用;缺席 = 没有(本地读腿才会有)。 */
-/** `refusedDocuments`:被拒文档 —— 契约的类型 `ConfigDocumentRefusal`(`{ document, reason, error }`,墓碑另带 `migration`;`reason` 是契约闭集
+/** `refusedDocuments`:被拒文档 —— 契约的类型 `ConfigDocumentRefusal`(`{ document, reason, error }`,墓碑与文件层两臂同形;`reason` 是契约闭集
  *  `CONFIG_DOCUMENT_REFUSAL_REASONS`:`empty` / `invalid_json` / `not_object` / `io` / `too_deep` 文件层,`retired_domain` 墓碑)。读腿不抛,交成发现,候选判官以发现自带的词整拒这份候选
  *  (与域判形失败同一条回落链、同一行拒判);缺席 = 没有。远端腿:wire 上只有墓碑一种,那一键不进 effective、其余域照读、版本照读;本地腿:契约的单读口
  *  `FileConfigStore.read()` 交 `refused` ⇒ 被拒文档 = 那一读的拒单原样,什么域内容都没装配 —— 候选是空的 effective(被整拒,不会被应用),版本 = 那一读的契约版本(按文档内容寻址)。 */

package/dist/config-root-migration.d.ts

@@ -1,5 +1,5 @@
 import { type EnvModelsMigration } from "@sema-agent/settings-schema/node";
-import type { ConfigDirMigrationLog } from "./config-d-migration.js";
+import type { Logger } from "./observability/logger.js";
 /** 一次起服的输入:配置根、目标引擎的 env(契约只读两槽、只用来点名被顶替的 env 模型)、env 表是不是占位(严格名册布防 —— 与模型面闸同一只谓词)。 */
 export interface EnvModelsMigrationInput {
     readonly root: string;
@@ -9,5 +9,5 @@ export interface EnvModelsMigrationInput {
 /** 契约的迁移体调一次(本仓不改写它的判序,只调度)。 */
 export declare function runEnvModelsMigration(input: EnvModelsMigrationInput): Promise<EnvModelsMigration>;
 /** 结局的**唯一**说法(两个入口同调)。 */
-export declare function logEnvModelsMigration(log: ConfigDirMigrationLog, input: EnvModelsMigrationInput, m: EnvModelsMigration): void;
+export declare function logEnvModelsMigration(log: Pick<Logger, "info" | "warn">, input: EnvModelsMigrationInput, m: EnvModelsMigration): void;
 //# sourceMappingURL=config-root-migration.d.ts.map

package/dist/config-types.d.ts

@@ -19,7 +19,7 @@ import type { QuestionThrottle } from "./question.js";
 import type { UnattendedApprovalPolicy } from "./tool-approval.js";
 import type { InfraCostRates } from "./observability/cost-taxonomy.js";
 import type { Autonomy, CommandRule } from "./runtime-governance.js";
-import type { CenterCredentialSource } from "./center-credential.js";
+import type { CenterCredentialSource, DeclaredCredentialOrigin } from "./center-credential.js";
 import type { GitApiKind } from "./git-api-kind.js";
 import type { CustomPkgSource } from "./sandbox-pkg-source.js";
 import type { MemoryEngineBackend, StoreBackend as StoreBackendWord } from "@sema-agent/settings-schema/execution-lanes";
@@ -398,20 +398,16 @@ export interface A2aServeConfig {
  *  off (the control plane never mounts). The runner-facing facts (the runner principal, the build-host CACHE_BASE,
  *  the default base ref) live here so image-api injects only VETTED, server-fixed values into the build.sh argv —
  *  operator free-text never reaches the runner. */
-/** [ref] 车3([ref] 流内审批协议)的配置面。总开关默认 **true**(clay 裁 2026-08-08,[ref] 翻真验证后;
- *  树上已生效,发布线落在 7.4.0 之后的下一个发布);从属旋钮**除 `windowMs` 外**只在开关为真时生效
- *  ([ref]:`STREAM_ASK_WINDOW_MS` 是活卡窗长,与协议上不上场解耦 —— 逐条辖域见各字段域注)
+/** [ref] 车3([ref] 流内审批协议)的配置面。协议上不上场只由装配在场性定(审批席 ∧ store backend ∧ park 设施,
+ *  `resolveStreamApprovalGate`)—— 没有总开关:审批只有呈卡族一个帧族,开关的「关」(回退发旧族活卡)随旧族退役。
+ *  从属旋钮**除 `windowMs` 外**只在协议上场时生效([ref]:`STREAM_ASK_WINDOW_MS` 与协议上不上场解耦 —— 逐条辖域见各字段域注)
  *  (语义与「谁需要 / 谁被伤 / 什么补偿」三问见 `ServiceConfigFlat.streamApproval` 的注)。 */
 export interface StreamApprovalConfig {
-    /** 协议总开关。`STREAM_APPROVAL_ENABLED`,默认 **true**(clay 裁 2026-08-08,[ref] 翻真验证后;7.5.0 起)。显式 false ⇒ 全链逐字 7.3.0 前行为(唯一干净还原键)。
-     *  翻真要等回决端点(车4)与对账收敛器(车5)到位——在此之前是个不完整协议(有卡无正规回决口、
-     *  有 PARKING 无收敛器、跨副本回决无唤醒路径)。 */
-    enabled: boolean;
     /** `ToolApprovalCoordinator` 的 `ttlMs` —— **一只活卡等人多久**([ref] §3.3 的「配置窗默认」)。
      *  `STREAM_ASK_WINDOW_MS`,默认 **300000**(同裁与 sync 腿既有 5min 活卡窗对齐)。
      *
      *  🔴 **辖域([ref] 起):无条件** —— 本值在**每一条**呈活卡的腿上生效,与流内协议上不上场无关
-     *  (`DB_BACKEND=local` / 无 park 设施 / `STREAM_APPROVAL_ENABLED=false` 的部署同样按它计窗)。
+     *  (无 park 设施的部署上它管的是「没有卡、每只问当场交政策口」之前的那一格 —— 那里没有窗可计)。
      *  旧文「开关为假 ⇒ 本值不参与,窗保持既有 `DEFAULT_APPROVAL_TTL_MS`(5min)」是**已修的病**,不是
      *  设计:那让一根部署级旋钮的生效与否挂在装配在场性上,运维配了它、没有任何一行说它没生效
      *  (clay 令:部署级旋钮禁挂在场性派生腿)。缺省值与那个常量同为 300000 ⇒ **没配过这根 env 的部署
@@ -828,8 +824,9 @@ export interface ServiceConfigFlat {
      *  models/roles; mutateInPlace keeps the reference. */
     tiers: Record<string, string>;
     /** 项目登记簿(settings-schema `projects` 域):键 = projectId(小写规范 UUID),值 = settings-schema 的 `ProjectRegistration` **原样**
-     *  (本仓不持第二份项目型、不挑键 —— 形与判官只在 settings-schema)。读者:`GET /v1/projects` 读面(`http/routes/projects.ts`);
-     *  `defaultScopes` 作 `TaskSpec.memory.scopes` 的种子(v2 scope 键串,OPEN 值域 —— 本表只登记不解释)与 org 记忆准入的部署 scope 集。
+     *  (本仓不持第二份项目型、不挑键 —— 形与判官只在 settings-schema)。按调用方读(可见性判 + 按 id 取)只经 `project-registry.ts`:`GET /v1/projects` 读面
+     *  (`http/routes/projects.ts`)、项目上下文继承、`defaultScopes` 作 `TaskSpec.memory.scopes` 的种子(v2 scope 键串,OPEN 值域 —— 本表只登记不解释);
+     *  部署级聚合(org 记忆准入的部署 scope 集,`boot/org-memory.ts`)整表读。
      *  NO env source —— 只由 applyEffective 经 settings-schema 的视图面读函数判过后填(mutateInPlace,boot + refresh 整表替换);
      *  本地腿恒空(settings-schema 的本地读取集不收 `projects`)。 */
     projects: Record<string, ProjectRegistration>;
@@ -1237,14 +1234,9 @@ export interface ServiceConfigFlat {
     /** plugins 域 clone host 白名单(`PLUGINS_ALLOW_HOSTS`,缺省 github.com;契约 [ref]① 双保险面,
      *  消费在 capabilities/center-plugins.ts)。 */
     pluginsAllowHosts: string[];
-    /** 监听绑址([ref] cli 实锤:此前 `HOST` **零消费**、`listen(port)` 恒绑所有接口)。
-     *  `BIND_HOST`(兼容 `HOST`)。显式值恒生效;缺省见 {@link resolveBindHost}——**无鉴权写面
+    /** 监听绑址:唯一来源 = `BIND_HOST`(`HOST` 不读 —— zsh 恒设 HOST=机器名,读它等于被 shell 环境暗配 bind 面)。显式值恒生效;缺省见 {@link resolveBindHost}——**无鉴权写面
      *  (allowUnauthedWrites 且零凭证)自动收窄到 127.0.0.1**,其余维持全接口(既有部署零影响)。 */
     bindHost?: string;
-    /** [ref]③ `bindHost` 的取值来源(BIND_HOST 显式 / HOST 兼容名 / 未设)。`"HOST"` 时 main.ts 打一行
-     *  启动告警:zsh 常把 HOST 设成机器名,`{...process.env}` 起底的壳会静默继承给引擎——bind 面被 shell
-     *  环境暗配而部署者不知情(HOST=机器名解析到 LAN 口时=静默扩暴露面)。 */
-    bindHostSource?: "BIND_HOST" | "HOST";
     /** D-1 附件孤儿对象 GC 的 grace(毫秒;`ATTACHMENT_ORPHAN_GRACE_MS`,默认 1h,**0=关掉本腿**)。
      *  复审 F10:同 tick 邻居(workflowOrphanGraceMs/attachmentUnboundTtlMs/scratchpadSweepTtlMs)都有
      *  旋钮——存量对象巨大的部署要调慢/停掉,不该被迫取消 MinIO 配置(那会连带关掉整个附件面)。 */
@@ -1265,7 +1257,8 @@ export interface ServiceConfigFlat {
      *  the unguessable-key capability URLs be enumerated); the private presigned track shares
      *  SESSION_SNAPSHOT_BUCKET (default "session-snapshots") under a "sendfile/" prefix.
      *  SEND_USER_FILE_URL_TTL = default ttl seconds when the tool call omits one; 0 = permanent (the settled
-     *  default). Unset/non-integer/negative fail-SAFE to 0 — never NaN into a signature. */
+     *  default). Unset / empty ⇒ 0; anything but canonical decimal digits does not load (read as 0 it would turn a link meant to expire into a
+     *  permanent public one), nor does a value over the SigV4 ceiling (`config.ts` `sendUserFileUrlTtlKnob`). */
     sendUserFile?: {
         endpoint: string;
         publicEndpoint?: string;
@@ -1386,6 +1379,11 @@ export interface ServiceConfigFlat {
      *  "empty = everyone on the approval queue" reading is gone). A single-user deployment must answer "who operates it" — a named list here or {@link operatorSingleUser}; neither ⇒ refusal
      *  (`operator-declaration-required`: the server process refuses at boot stage 1, and `createHttpServer` refuses for every assembler, embedders included). */
     operatorPrincipals: string[];
+    /** `OPERATOR_DRAIN_PRINCIPALS` —— 名册的**排空档**(服务主体名单;档表 `src/operator-roster.ts` 的 `drain` 行):名单内的验过主体只持 `drain` 一只运维权力、不是人 ——
+     *  它的身份只在声明了 `drain` 权力的路由(`POST /v1/admin/drain`)上算数,其余每条路由整次请求 403 `auth.principal_confined`,`GET /health` 按没出示凭据分档。
+     *  缺席 ≡ 空 = 这一档没人(少给权力,fail-closed;`loadConfig` 恒写)。与 `OPERATOR_PRINCIPALS` 同一个名字 / 不是主体名的条目 / 不是名字列表 ⇒ 拒启(`operator-roster-well-formed`);与 `OPERATOR_SINGLE_USER=true` 同在 ⇒ 拒启
+     *  (`operator-single-user`)。env 独有(没有中心写位),起服冻结。不算运维声明:单用户形只写它 ⇒ 照旧 `operator-declaration-required` 拒。 */
+    operatorDrainPrincipals?: readonly string[];
     /** `OPERATOR_SINGLE_USER=true` —— 单用户形显式声明「这台部署的每个调用方都是运维」([ref],[ref] ① 裁 A)。缺席 = 不声明(没人是,除非在名单里)。
      *  只在单用户形(`REQUIRE_PRINCIPAL` 未开)且名单为空时成立 —— 否则拒启(`config-invariants.ts` 的 `operator-single-user`:一个事实一个来源)。
      *  单用户形上它与具名名单二者必有其一,都没有 ⇒ 拒启(服务进程起服第 1 段;嵌入方在 `createHttpServer`;`operator-declaration-required`,[ref];`false` 与缺席同判)。
@@ -2026,10 +2024,12 @@ export interface ServiceConfigFlat {
      *  {@link import("./question.js").DEFAULT_QUESTION_THROTTLE}(与本旋钮族默认逐字同值)。 */
     questionThrottle?: QuestionThrottle;
     /** [ref]/[ref]② live tool-approval HITL — mount the ToolApprovalCoordinator on `RunnerDeps.onAsk` + the
-     *  `POST /v1/tool-approvals/:id/respond` route so a policy `ask` (the fs-write gate, ask-lists, non-durable safety
+     *  ask decision door (`POST /v1/tasks/:taskId/asks/:askId/decision`) so a policy `ask` (the fs-write gate, ask-lists, non-durable safety
      *  asks) routes to the live human as the CC three-choice card on the run's stream (core 1.290 sync-ask leg). A CC
      *  cap → posture-gated like askQuestion (single-user turnkey → ON; multi-tenant opt-in);
-     *  `TOOL_APPROVAL_ENABLED=true/false` overrides. Absent ⇒ core's headless auto-deny stands ([ref]⑤ fail-closed). */
+     *  `TOOL_APPROVAL_ENABLED=true/false` overrides. Absent ⇒ core's headless auto-deny stands ([ref]⑤ fail-closed).
+     *  Necessary, not sufficient: the coordinator mounts only when this worker presents approval cards (this knob ∧ a store backend ∧ a park
+     *  facility — `resolveStreamApprovalGate`); on a worker without them the knob has nothing to mount and the headless auto-deny stands too. */
     toolApprovalEnabled: boolean;
     /**
      * [ref] 车二(core [ref] 持久化权限规则「不再询问」车道)**总开关**。`PERMISSION_RULES_ENABLED`,
@@ -2060,17 +2060,11 @@ export interface ServiceConfigFlat {
      *  旋钮本身缺省对现行为零影响(D1)。`STREAM_ASK_WINDOW_MARGIN_MS`,默认 10000(10s）。ttl 概念沿用既有
      *  `approvalTimeoutSec` 族,本旋钮不新增第二个 TTL 概念。 */
     streamAskWindowMarginMs: number;
-    /** [ref] 车3([ref] 流内审批协议)总开关 + 四个从属旋钮。
+    /** [ref] 车3([ref] 流内审批协议)的从属旋钮(没有总开关:协议上不上场只由装配在场性定,见 {@link StreamApprovalConfig} 顶注)。
      *
-     *  **现行默认(clay 裁 2026-08-08 走 (a),[ref] 翻真验证后)**:`STREAM_APPROVAL_ENABLED` 默认 **true**
-     *  = 协议整体默认 **ON**;`STREAM_ASK_WINDOW_MS` 默认 **300000**(5min,与 sync 腿既有活卡窗、与
-     *  `DEFAULT_APPROVAL_TTL_MS` 对齐——「开协议」不再顺带把窗砍短)。⚠️ 版本坐标:翻转**已在树上生效**,
-     *  发布线上落在 7.4.0 之后的下一个发布,所以一台自报 7.4.0 的**已发布** worker 仍是 OFF,别只按
-     *  `/health` 的版本号推默认。显式 `STREAM_APPROVAL_ENABLED=false` 是**唯一干净还原键** ⇒ 全链逐字回到
-     *  翻转前行为:不发 `approval_request` 帧、不落 `approval_ask` 行、不起收敛器腿、`askStore` 不注入
-     *  协调器。⚠️ **窗不在这份还原清单里了([ref])**:`STREAM_ASK_WINDOW_MS` 自此在关协议的部署上照样
-     *  生效(缺省 300000 == `DEFAULT_APPROVAL_TTL_MS` ⇒ 没配过它的部署仍然字节不变),理由见
-     *  `StreamApprovalConfig.windowMs` 的辖域段。
+     *  **总开关 `STREAM_APPROVAL_ENABLED` 已退役**:它的「关」= 回退发旧族活卡(`tool_approval`),旧族退役后没有可关的东西;
+     *  部署 env 里还留着这一键 ⇒ 起服拒(退役墓碑,不论值)。`STREAM_ASK_WINDOW_MS` 默认 **300000**(5min,与
+     *  `DEFAULT_APPROVAL_TTL_MS` 对齐),理由见 `StreamApprovalConfig.windowMs` 的辖域段。
      *
      *  **旋钮为什么存在(2026-08-08 翻转前的成文前提,已被上面的裁定取代,留作沿革)**:那一版默认 false +
      *  60s 窗,三问记的是那个世界——
@@ -2083,7 +2077,7 @@ export interface ServiceConfigFlat {
      *  ⇒ 翻真时「窗变短」这一项被从翻转里摘出(窗默认抬回 300000),被伤面①②因此消失;60s 只在运维显式设
      *  `STREAM_ASK_WINDOW_MS=60000` 时才回来。
      *
-     *  `STREAM_APPROVAL_ENABLED` / `STREAM_ASK_WINDOW_MS` / `STREAM_APPROVAL_REPLAY_MAX` /
+     *  键:`STREAM_ASK_WINDOW_MS` / `STREAM_APPROVAL_REPLAY_MAX` /
      *  `STREAM_APPROVAL_ADMIT_MAX_PER_TASK` / `STREAM_APPROVAL_ADMIT_MAX_PER_OWNER` /
      *  `STREAM_APPROVAL_RECONCILE_BATCH` / `STREAM_APPROVAL_PENDING_GRACE_MS` /
      *  `STREAM_APPROVAL_ADHOC_GRACE_MS` / `STREAM_APPROVAL_ORPHAN_TTL_MS`(后四键 = 车5 收敛器)。 */
@@ -2102,7 +2096,7 @@ export interface ServiceConfigFlat {
      *
      * 施加点 = `ToolApprovalCoordinator` 的构造参 `unattendedPolicy`,五条「无人可答」的臂读同一
      * 个值;对账收敛器的同名构造参([ref],`boot/reapers.ts` 恒传同一个部署值)只供它的孤儿段打同一只终态 claim ——
-     * 两处读同一个值,于是崩溃恢复与 live 腿同答(设计稿 §1 的表:(a) 有店窗到期赢 CAS /(b) 无店窗到期 /(c) 店报错 catch /(d) windowZero 与
+     * 两处读同一个值,于是崩溃恢复与 live 腿同答(设计稿 §1 的表:(a) 有店窗到期赢 CAS /(b) 无店窗到期(7.152.0 起随无账协调器退役)/(c) 店报错 catch /(d) windowZero 与
      * headless 腿 /(e) 断连强转 + emit 全灭 + 写侧准入超限 + **投递集合入口活性过滤清空**([ref] 归
      * 位:与「查无活流」同一件事实的两个时刻,详见 `askBroadcast` 的该臂注))。`"timeout"` 宿主自报只留在 (b)(c) ——
      * 结束等待的确实是本仓的窗;其余三臂结束等待的是容量/连接/装配,自报恒缺席。
@@ -2114,14 +2108,11 @@ export interface ServiceConfigFlat {
      * `"timeout"` 自报(`approval_window_expired`)。
      *
      * 🔴 **射程边界(成文,不是遗漏)**:
-     *  · 唯一让本旋钮**无处施加**的键是 `TOOL_APPROVAL_ENABLED=false`(协调器整体不构造,core 走它自己的
-     *    headless 姿态)。**不造推断腿**:旋钮只在协调器在场时有意义,这一句是成文而不是代码分支。
-     *  · ⚠️ **与 `STREAM_APPROVAL_ENABLED` 正交**(codex 交叉复审 R2-F2 验真后纠正 —— 本注上一版把两者
-     *    写成了一回事,是错的):协议开关关掉只是不注入 `askStore`/协议窗,协调器照常在场,于是 R-13 的
-     *    D1 窗到期臂**照样**走 park 路由。这不是漏网:设计稿 §2 明写 park 的承载是 **core checkpoint**
-     *    而不是 server 的 ask 行,「无 askStore 但有 durable 设施」正是 R-13 点名的**主受益部署**。
-     *    要回滚 R-13 的行为面,键是 `UNATTENDED_APPROVAL_POLICY=deny`,**不是**协议开关。
-     *    射程钉:`test/unattended-approval-policy.test.ts` 的 codex R2-F2 两格。
+     *  · 本旋钮只在审批协调器在场时有处施加;协调器只在呈卡协议上场时构造(`TOOL_APPROVAL_ENABLED` ∧ store backend ∧ park 设施,
+     *    `boot/coordinators.ts`)。不上场的三形各自的终局与本旋钮无关:开关关 ⇒ core 自己的姿态(有 durable 设施时照常 park);
+     *    开关开而无 store backend / 无 park 设施 ⇒ 没有审批席也没有停驻处,core 的无审批席臂当场拒。**不造推断腿**:这一句是成文而不是代码分支。
+     *  · 总开关 `STREAM_APPROVAL_ENABLED` 7.152.0 起退役;要回滚 R-13 的行为面,键是 `UNATTENDED_APPROVAL_POLICY=deny`。
+     *    射程钉:`test/unattended-approval-policy.test.ts` 的「呈卡协议不上场与本旋钮的关系」一组。
      *  · APPROVAL_REQUIRE 名单工具:**要不要 ask** 由 `createApprovalBaselinePolicy` 的 durable gate 类裁决,那一层
      *    结构上读不到本旋钮;但那只 ask 的**答法**在协调器在场时与治理 ask 同走流内臂、同政策(引擎先问活席
      *    `onAsk`,答 `"unavailable"` 才 park)⇒ `deny` 部署对名单工具同样当场拒。旧注「不经流内臂、不受本旋钮
@@ -2340,12 +2331,17 @@ export interface ServiceConfigFlat {
      *  `liveBaseUrl`(编排器片 2,env `SEMA_WEB_ADMIN_LIVE_URL`):fleet 活性组(心跳 / 注销、服务租约 —— settings-schema `FLEET_LIVE_PATHS`)的基址,
      *  给「管理面在就绪门后、活性面另走一条不看就绪的入口」的部署;缺席 ⇒ 活性组也打 `baseUrl`(这条缺省只在 `centerFetch` 读)。
      *  `webBaseUrl`(7.121.0,env `SEMA_WEB_ADMIN_WEB_URL`):这个中心的 **web 面固定基址**,运维声明、引擎原样转述到 `/health.center.webBaseUrl`
-     *  (壳按它拼会话深链;路径怎么拼归壳)。起服时判成「可拼路径的基址」:http(s)、不带凭据 / query / fragment,否则拒启;缺席即缺席,引擎不拼不猜。 */
+     *  (壳按它拼会话深链;路径怎么拼归壳)。起服时判成「可拼路径的基址」:http(s)、不带凭据 / query / fragment,否则拒启;缺席即缺席,引擎不拼不猜。
+     *  `assertionToken`([ref]):web-admin 断言令牌(`SEMA_WEB_ADMIN_ASSERTION_TOKEN` / `_FILE`,二选一,都设拒启)的**声明读数**,非秘密投影 ——
+     *  声明在 ⇒ 来源两形之一(`env` / `file` + 绝对路径);没声明 ⇒ 这一格缺席(`loadConfig` 只在声明在时写它;缺席只有一种读法 = 没声明)。
+     *  值不进配置:本版只读声明、不向中心出示;读者 = `/health.center.assertionToken` 与起服日志 `center_assertion_token`。读口与 `credential` 同一只
+     *  (`center-credential.ts` 的 `readWebAdminCredentialDeclaration`)。 */
     webAdmin?: {
         baseUrl: string;
         liveBaseUrl?: string;
         webBaseUrl?: string;
         credential: CenterCredentialSource;
+        assertionToken?: DeclaredCredentialOrigin;
         dryRun: boolean;
         worker?: string;
     };
@@ -2409,7 +2405,7 @@ export type ServiceMemoryConfig = Pick<ServiceConfigFlat, "memoryEngineEnabled"
  *  三者都是 operator 在配置面写下的**治理声明**(与 autonomy/commandPolicy 同族),不是存储旋钮
  *  ——`retentionPolicy` 尤其容易被误归 store 组:它的消费点是 core 的启动期能力校验与将来的调度面,
  *  config 这一层它只是一句声明。 */
-export type ServiceAuthConfig = Pick<ServiceConfigFlat, "authToken" | "authTokens" | "allowUnauthedWrites" | "corsOrigins" | "principalHeader" | "requirePrincipal" | "autonomy" | "commandPolicy" | "compliancePosture" | "lockedConfigKeys" | "configCatalogEnabled" | "retentionPolicy" | "retentionSweep" | "operatorPrincipals" | "operatorSingleUser" | "serviceTokenActsForDeployment" | "principalJwtPubkeys" | "principalJwtIss" | "principalJwtAud" | "authBridgeIssuer" | "principalJwtMaxTtlSec" | "bindHost" | "bindHostSource">;
+export type ServiceAuthConfig = Pick<ServiceConfigFlat, "authToken" | "authTokens" | "allowUnauthedWrites" | "corsOrigins" | "principalHeader" | "requirePrincipal" | "autonomy" | "commandPolicy" | "compliancePosture" | "lockedConfigKeys" | "configCatalogEnabled" | "retentionPolicy" | "retentionSweep" | "operatorPrincipals" | "operatorDrainPrincipals" | "operatorSingleUser" | "serviceTokenActsForDeployment" | "principalJwtPubkeys" | "principalJwtIss" | "principalJwtAud" | "authBridgeIssuer" | "principalJwtMaxTtlSec" | "bindHost">;
 /** 组:orchestration(编排 + 执行车道 + 沙箱面 + workflow/后台 agent 存留)。 */
 export type ServiceOrchestrationConfig = Pick<ServiceConfigFlat, "sandboxGit" | "remoteExec" | "remoteExecHomeDir" | "worktreeIsolation" | "leaderEnabled" | "leaderFanoutEnabled" | "routerEnabled" | "selfOrchestrationEnabled" | "selfOrchestrationModels" | "selfOrchestrationWorkerIsolation" | "forkEnabled" | "experimentalObserverAgents" | "schedulerEnabled" | "schedulerSessionWakeup" | "schedulerSessionLifetime" | "schedulerStorePath" | "planModeEnabled" | "hooksTimeoutMs" | "workflowRunStoreBackend" | "workflowOrphanGraceMs" | "workflowJournalRetentionMs" | "workflowRunRetentionMs" | "usageWindows" | "workflowAgentsReadOnly" | "workflowSizeGuideline" | "backgroundAgentRetentionMs" | "backgroundAgentStaleRunningMs" | "backgroundAgentStallMs" | "backgroundAgentParkClaimStaleMs" | "delegationEntryCaps" | "rosterRetentionMs" | "leaderRunStaleMs" | "scratchpadSweepTtlMs" | "sandboxPkgSource" | "sandboxPkgSourceCustom" | "sessionAutoTitle" | "sessionAutoTitleSource" | "selectEnvironmentTool" | "envFactsEnabled" | "toolDeferLongtail" | "lspHostEnabled" | "lspEnvAllow" | "hookEnvAllow" | "autoBackgroundOnTimeout" | "imageBakes" | "readFace" | "readFaceSource" | "taskWriteFaceEscalation" | "readDenyPatterns" | "readDenyBuiltinTiers" | "readDenyBuiltinExclude" | "readDenyFloorRequired" | "sandboxReadFloor" | "agentConfigDir" | "configLkgPath" | "configLkgEnabled">;
 /** 组:limitsHttp(HTTP 面 + 各类上限/配额/回收窗)。 */

package/dist/config.d.ts

@@ -3,6 +3,7 @@ import { type ConfigProviderWord } from "./config-types.js";
 import { type CenterEndpoint } from "./web-admin-client/center-request.js";
 import { type ExecutionLane } from "./execution-lane-caps.js";
 import { type Autonomy } from "./runtime-governance.js";
+import { type EntryProblemReason } from "./entry-problems.js";
 import { type RunnerEnvNameAllowlistKnob, type ServerEnvNameAllowlistKnob } from "./env-name-allowlist-knobs.js";
 import type { ServiceConfig, LoadedConfig, RemoteExecConfig, ServiceConfigFlat, ServiceConfigGroups } from "./config-types.js";
 /** [ref] A1: the config TYPE face lives in the leaf module config-types.ts; re-exported here so
@@ -61,9 +62,9 @@ export declare function parseNumOrFail(name: string, raw: string | undefined): n
  */
 export declare function parseNumOrFailNonNegative(name: string, raw: string | undefined): number;
 /** Optional FAIL-SAFE numeric env for an OPTIONAL feature knob: a non-numeric / non-positive value yields `undefined`
- *  (the caller falls back to its own default) rather than NaN OR a hard startup throw. Used for SESSION_SNAPSHOT_TTL_SEC
- *  (finding 20): a typo like "600s" must NOT sign every presigned URL with X-Amz-Expires=NaN (total snapshot outage),
- *  but ALSO must not crash boot of an unrelated subsystem — degrade to the MinioBlobBackend default. */
+ *  (the caller falls back to its own default) rather than NaN OR a hard startup throw. A presigned-URL lifetime is not such a
+ *  knob: its spelling is judged by `presignLifetimeSpelled` and a non-decimal one does not load (a typo there must neither sign
+ *  `X-Amz-Expires=NaN` nor a `Number()` reading of what the operator wrote). */
 /** S20 (SILENT-FALLBACK P1): soft-knob parse rejects, collected here because config parsing runs BEFORE the
  *  logger exists. main.ts drains this once after createLogger and warns per entry ("configured X=raw is
  *  invalid, using the default"). Module-level on purpose; drain clears it (repeat loadConfig in tests is fine). */
@@ -124,7 +125,10 @@ export declare function parseConfigProvider(): ConfigProviderWord | undefined;
 /** F10 (codex audit): drain + log BOTH pre-logger diagnostic collectors (S20 soft-knob warnings + [ref]④ boot
  *  notices) in one place. EVERY entrypoint that calls loadConfig() then builds a logger must call this right
  *  after (main.ts, run-local.ts) — a new entry that forgets it would silently drop operator-facing diagnostics
- *  (run-local historically did exactly that), so the drain lives beside the collectors, not in one entrypoint. */
+ *  (run-local historically did exactly that), so the drain lives beside the collectors, not in one entrypoint.
+ *  Draining is repeatable: a read made AFTER the boot drain (the execution-lane composition step reads the env of a lane the config file chose;
+ *  `boot/execution-lane.ts`) calls it again right after, so its soft-knob rejects and knob registrations reach the log instead of piling up
+ *  undrained — the polarity table (debug) is then printed again, now covering that read too. */
 export declare function logConfigDiagnostics(logger: {
     warn: (event: string, fields?: Record<string, unknown>) => void;
     info?: (event: string, fields?: Record<string, unknown>) => void;
@@ -192,10 +196,56 @@ export declare function buildUnpricedCeilingNotice(models: Record<string, Model>
 export type EntryDeclarableLane = Extract<ExecutionLane, "host" | "none">;
 /**
  * 这两条车道的配置形(唯一铸点):env 声明了它们时由 {@link loadConfig} 的车道链调,入口程序自身声明它们时由执行车道合成步调 —— 坐标 env 同一读法。
- * DUAL-MODE §5:`host` = 在这台机器上跑、无容器(坐标 `HOST_WORKSPACE_BASE` / `HOST_COMMAND_TIMEOUT_MS` 可选,无必需 env)。
+ * DUAL-MODE §5:`host` = 在这台机器上跑、无容器(坐标 `HOST_WORKSPACE_BASE` / `HOST_COMMAND_TIMEOUT_MS` 可选,无必需 env;读数见 {@link parseHostLaneEnv})。
  * 契约 18.0.0:`none` = 部署声明「智能体的工具没有执行环境」(零字段、无必需 env)。
  */
 export declare function entryDeclarableRemoteExec(lane: EntryDeclarableLane): RemoteExecConfig;
+/** `host` 车道的配置块(型从 {@link RemoteExecConfig} 判别联合取,不另写第二份字段表)。 */
+type HostRemoteExec = Extract<RemoteExecConfig, {
+    provider: "host";
+}>;
+/** `local-docker` 车道的配置块(同上)。 */
+type LocalDockerRemoteExec = Extract<RemoteExecConfig, {
+    provider: "local-docker";
+}>;
+/** env 一侧对 `host` 车道的读数(块去掉判别位)。 */
+export type HostEnvReading = Omit<HostRemoteExec, "provider">;
+/** env 一侧对 `local-docker` 车道的读数(块去掉判别位;`image` 改可选 —— `DOCKER_IMAGE` 是本车道的必需 env,读数本身不判必需,判官是车道必需 env 门)。 */
+export type LocalDockerEnvReading = Omit<LocalDockerRemoteExec, "provider" | "image"> & {
+    image?: string;
+};
+/**
+ * **`host` 车道的 env 读数**(唯一读者):`HOST_WORKSPACE_BASE` / `HOST_COMMAND_TIMEOUT_MS`。env 声明路径({@link entryDeclarableRemoteExec})、入口自身声明、
+ * 文件腿(`config.d/remote-exec.json` 选定 host 车道时,车道参数仍由 env 读)读的都是这一只。求值时点:`REMOTE_EXEC` 声明的车道在 `loadConfig` 里求值(早于文件);
+ * 文件选定而 env 没声明它 ⇒ 执行车道合成步现读;没被选中的车道不求值 —— 那里它们是无关配置。
+ */
+export declare function parseHostLaneEnv(): HostEnvReading;
+/**
+ * **`local-docker` 车道的 env 读数**(唯一读者):`DOCKER_*` 的全部坐标与车道参数(含容器帽、pids 限额、丢 capability、带外 env 名单)。env 声明路径
+ * ({@link loadConfig} 的车道链)与文件腿(`config.d/remote-exec.json` 选定 local-docker 车道时)读的是这一只:文件只定「哪条车道」,车道参数仍只有 env 一处可写,
+ * 文件里有同名格的那几格由文件胜(`FILE_LANE_CELL_ENV` 列的五格)。只在本车道被选中(env 声明,或文件选定)时求值 —— 其它车道上它们是无关配置。
+ * `singleUserTurnkey` = 本部署是不是单用户姿态(`REQUIRE_PRINCIPAL !== "true"`;名单型旋钮 `DOCKER_SANDBOX_ENV` 的姿态判)。
+ */
+export declare function parseLocalDockerLaneEnv(singleUserTurnkey: boolean): LocalDockerEnvReading;
+/**
+ * **文件格 ↔ env 键的对表**(`config.d/remote-exec.json` 与 env 对「同一件事」各有一个名字):文件选定车道后,块 = env 读数 ∪ 文件格,**同名格文件赢**;
+ * 两处在同一格上给了不同的值 ⇒ 文件赢并响亮点名那一格的 env 键(`remote_exec_file_overrides`,执行车道合成步)。表序 = 点名序。
+ * 格名取块的字段名(`satisfies` 钉住:块改名而表不跟 ⇒ 编译红);env 键须是车道表里这条车道的坐标键、且上面两只读者真的读它(`test/remote-exec-file-lane-env-params.test.ts` 钉)。
+ * 文件腿读不到 env 键字面 —— 键名只住在读者与这张表里。
+ */
+export declare const FILE_LANE_CELL_ENV: {
+    readonly host: {
+        readonly workspaceBase: "HOST_WORKSPACE_BASE";
+        readonly commandTimeoutMs: "HOST_COMMAND_TIMEOUT_MS";
+    };
+    readonly "local-docker": {
+        readonly image: "DOCKER_IMAGE";
+        readonly mountPath: "DOCKER_MOUNT_PATH";
+        readonly memory: "DOCKER_MEMORY";
+        readonly cpus: "DOCKER_CPUS";
+        readonly network: "DOCKER_NETWORK";
+    };
+};
 /** [ref] N8/N9 — the BOOLEAN member of this module's env-parser family (`env`/`env2`/`numEnv`/
  *  `numEnvBounded`/`optFinitePositiveEnv`/`enumEnv`/`headerNameEnv`). Until now booleans were the
  *  one type parsed by a hand-written literal comparison at every single site, and that is exactly why the same
@@ -338,9 +388,10 @@ export interface UnmatchableToolName {
     guidance: string;
     /**
      * 这一条为什么永远不生效 —— 机读位的 `reason`(`entry-problems.ts`):引擎名字判官的判词 `retired` / `unmintable_segment` / `unprefixed_namespace`、引擎规则文法的码原样(`invalid.*` /
-     * `unsupported.*`)、近似名 `near_miss`、名表消费者的 CC 规则形 `cc_rule_form`。句子里的 `guidance` 给人读,本字给机器读;两者在同一处同时铸。
+     * `unsupported.*`)、近似名 `near_miss`、名表消费者的 CC 规则形 `cc_rule_form`(本仓自铸,取闭集 `CC_RULE_FORM`)。句子里的 `guidance` 给人读,本字给机器读;两者在同一处同时铸。
+     * 型 = 条目问题 `reason` 的全部词表之并({@link EntryProblemReason}):这里写一个哪张表都没有的词 = tsc 红。
      */
-    reason: string;
+    reason: EntryProblemReason;
 }
 /**
  * [ref](core 7.9.0 [ref])—— **这条名单条目喂给谁**,决定「永不匹配」这句话怎么判。三个消费者形态: