@sema-agent/server 7.150.0 → 7.152.0

package/dist/http/submit-ctx.d.ts

@@ -40,7 +40,7 @@ export declare function persistSubmitCtx(store: SubmitCtxStore, deps: {
  * 提交腿写续跑输入的入口(三个调用点同调这一只):体与标记按受理座提交时交出的那一份定(见文件头「体里的目标按哪一份写」),只写这一笔。
  * 写不进的处置与答复 = {@link persistSubmitCtx}(本函数只定体、不另判)。
  */
-export declare function persistSubmissionCtx(store: SubmitCtxStore, deps: Parameters<typeof persistSubmitCtx>[1], claim: Parameters<typeof persistSubmitCtx>[2], prepared: Pick<PreparedTaskSubmission, "body" | "auth" | "verify" | "acceptance" | "bodyFromScreenedCtx"> & Partial<Pick<PreparedTaskSubmission, "legFacts">> & {
+export declare function persistSubmissionCtx(store: SubmitCtxStore, deps: Parameters<typeof persistSubmitCtx>[1], claim: Parameters<typeof persistSubmitCtx>[2], prepared: Pick<PreparedTaskSubmission, "body" | "auth" | "verify" | "acceptance" | "bodyFromScreenedCtx" | "bodyPermissionModeWrite"> & Partial<Pick<PreparedTaskSubmission, "legFacts">> & {
     readonly spec: Pick<PreparedTaskSubmission["spec"], "sessionId" | "model">;
 }): Promise<SubmitCtxRefusal | typeof SUBMIT_CTX_CLAIM_LOST | undefined>;
 //# sourceMappingURL=submit-ctx.d.ts.map

package/dist/http/submit-ctx.js

@@ -7,6 +7,7 @@ import { limitFactsUnmeasured } from "../limit-refusal.js";
 import { serviceVersion } from "../service-version.js";
 import { recordFailOpen } from "../observability/fail-open.js";
 import { DEFAULT_MODEL_REF } from "../model-select.js";
+import { submissionPermissionModeWrite } from "../permission-mode-admission.js";
 const WITHHELD_OBJECTIVE = "";
 export function objectiveWithheldIn(ctx) {
     return ctx.promptScreened === true;
@@ -29,11 +30,11 @@ function unsealableRefusal(e) {
 function rowTooLargeRefusal(tooLarge) {
     switch (tooLarge.wall) {
         case "row":
-            return { status: 413, body: refusalBody({ errorCode: "request.payload_too_large", message: `the database refused to store this task: it is larger than the database keeps in one row (${tooLarge.dbMessage}) — nothing was run; shrink the inline images / userAttachments, or ask the operator to raise the database's single-row limit (TiDB performance.txn-entry-size-limit)`, facts: limitFactsUnmeasured("body", "bytes") }) };
+            return { status: 413, body: refusalBody({ errorCode: "request.payload_too_large", message: `the database refused to store this task: it is larger than the database keeps in one row — nothing was run; shrink the inline images / userAttachments, or ask the operator to raise the database's single-row limit (TiDB performance.txn-entry-size-limit)`, facts: limitFactsUnmeasured("body", "bytes") }) };
         case "statement":
-            return { status: 413, body: refusalBody({ errorCode: "request.payload_too_large", message: `the database refused to store this task: it is larger than the database accepts in one statement (${tooLarge.dbMessage}) — nothing was run; shrink the inline images / userAttachments, or ask the operator to raise the database's max_allowed_packet`, facts: limitFactsUnmeasured("body", "bytes") }) };
+            return { status: 413, body: refusalBody({ errorCode: "request.payload_too_large", message: `the database refused to store this task: it is larger than the database accepts in one statement — nothing was run; shrink the inline images / userAttachments, or ask the operator to raise the database's max_allowed_packet`, facts: limitFactsUnmeasured("body", "bytes") }) };
         case "value":
-            return { status: 413, body: refusalBody({ errorCode: "request.payload_too_large", message: `the database refused to store this task: it is larger than PostgreSQL holds in one value (${tooLarge.dbMessage}) — nothing was run; shrink the inline images / userAttachments`, facts: limitFactsUnmeasured("body", "bytes") }) };
+            return { status: 413, body: refusalBody({ errorCode: "request.payload_too_large", message: `the database refused to store this task: it is larger than PostgreSQL holds in one value — nothing was run; shrink the inline images / userAttachments`, facts: limitFactsUnmeasured("body", "bytes") }) };
         default: {
             const unhandled = tooLarge.wall;
             throw new Error(`row-too-large refusal without an HTTP answer: ${String(unhandled)}`);
@@ -62,7 +63,7 @@ export async function persistSubmitCtx(store, deps, claim, sessionId, fields) {
         }
         if (tooLarge === undefined)
             throw err;
-        deps.logger?.warn("submit_ctx_row_too_large", { sessionId, taskId: claim?.taskId, wall: tooLarge.wall, db: tooLarge.dbMessage });
+        deps.logger?.warn("submit_ctx_row_too_large", { sessionId, taskId: claim?.taskId, wall: tooLarge.wall });
         return rowTooLargeRefusal(tooLarge);
     }
     return landed === "claim_released" ? SUBMIT_CTX_CLAIM_LOST : undefined;
@@ -77,7 +78,9 @@ export async function persistSubmissionCtx(store, deps, claim, prepared) {
         memoryScope: prepared.auth?.memoryScope,
         ...(screened || prepared.bodyFromScreenedCtx === true ? { promptScreened: true } : {}),
         ...(prepared.legFacts?.projectContext !== undefined ? { projectContext: prepared.legFacts.projectContext } : {}),
+        ...(prepared.legFacts?.memorySeed !== undefined ? { memorySeed: prepared.legFacts.memorySeed } : {}),
         writerVersion: serviceVersion(),
+        permissionModeWrite: prepared.bodyPermissionModeWrite !== undefined ? prepared.bodyPermissionModeWrite.stored : submissionPermissionModeWrite(prepared.body),
     });
 }
 //# sourceMappingURL=submit-ctx.js.map

package/dist/http/wire-types.d.ts

@@ -41,6 +41,14 @@ export interface TaskRequestAttachments {
 export interface TaskRequestBody {
     objective: string;
     sessionId?: string;
+    /**
+     * 这一次提交建的会话是哪一**种**(闭集一词 `"sidechain"` = 客户端放置的子代对话;缺席 = 顶层对话;律在 `session-kind.ts`)。
+     * 只在**建这只会话的那一笔**写下(不带 `sessionId` / 带一只还不存在的 id),此后终身不改:带键提交到一只既有的会话 ⇒ 种类相等照常、不等 409
+     * `conflict.session_kind_mismatch`(会话一字节不变,体上机读位 `sessionKind` = 行上的词,顶层行缺席);不带键 = 不声明(续轮不必重发)。
+     * 词表外 ⇒ 400 `request.field_invalid`;部署记不了种类(能力位 `sessionKinds` 为空)⇒ 400 `request.precondition_unmet`,都在任何写之前。
+     * 续跑腿不读不判(键随存体留着)。
+     */
+    sessionKind?: "sidechain";
     /** Which deployment SCENARIO assembles this task's tools/prompt/skills (the keys of the worker's scenario
      *  table — e.g. "default"/"code"/"code-review"/"scan"/"cowork"). An INTENT bounded by the deployment's own table AND,
      *  on a governed worker, by the principal's center-resolved allowlist: an unknown name is a typed 400
@@ -240,7 +248,9 @@ export interface TaskRequestBody {
      *  (unknown ⇒ 404 `rewind_files_to.unknown_event`). Honored ONLY when `resumeAt` is ABSENT (the two modes are mutually
      *  exclusive). Requires the anchor map + a FileHistoryStore + the session store's head read (capability
      *  `rewindFilesTo`). Its out-of-run twin — no run, no model call — is `POST /v1/sessions/:id/rewind-files` with the same
-     *  handle in `to` (capability `sessionRewindFiles`). */
+     *  handle in `to` (capability `sessionRewindFiles`). Not accepted together with `cascade: true` — the ladder's rungs
+     *  run on sessions the engine mints, so there is no history of this session to restore from ⇒ 400 `request.field_conflict`
+     *  (`reason: "cascade_verify"`, `fields: ["rewindFilesTo", "cascade"]`) at admission, before any side effect. */
     rewindFilesTo?: string;
     /** [ref](core 7.31.0 [ref] `TaskSpec.fileHistory`)—— 请求级的**文件历史关断词**,唯一词 `"disabled"`(core 的拼法,
      *  与 `checkpointStore` 同;没有 `"enabled"` —— 缺席就是「部署说了算」的唯一形,声明只能单向收紧)。`"disabled"` ⇒
@@ -449,9 +459,9 @@ export interface TaskRequestBody {
      *  authorizer(core `PROJECT_ID_REGEX`,不合形状=422 typed `invalid_project_id`)。**大小写不敏感收、
      *  归一小写用**([ref]/[ref]:词法与 core 的格式单源对齐,带 /i;收下后折小写再派生 scope/查表 ——
      *  同一个 id 的两种大小写写法落同一只记忆盘)。多租户 DB 记忆面下它把派生
-     *  scope 从 user 盘切到项目盘(`proj:<tenant>/<projectId>`)并以 config.projects[projectId].defaultScopes
-     *  作 memory.scopes 种子;单用户部署忽略派生(memoryScopeFor 不变),仅 defaultScopes 种子生效。
-     *  Rides the persisted body onto resume legs(与 memoryWrite 同姿势)。
+     *  scope 从 user 盘切到项目盘(`proj:<tenant>/<projectId>`);它对提交者**可见**时(`project-registry.ts`,与 `GET /v1/projects/:id` 同一只判)
+     *  那只登记的 defaultScopes 作 memory.scopes 种子(看不见 / 未登记 ⇒ 无种子,同答);单用户部署忽略派生(memoryScopeFor 不变),仅种子生效。
+     *  Rides the persisted body onto resume legs(与 memoryWrite 同姿势)—— 种子不随体:续跑腿只认提交腿冻结的种子(`CheckpointCtx.memorySeed`,以冻结的观者重判)。
      *  7.150.0 起它(或会话行上声明过的项目)也选这条 run **继承的项目上下文**(`project-context.ts`;能力位 `projectInheritance`):登记对提交者可见且带内容证明 ⇒
      *  项目简报进系统提示追加折叠的中段、射程内第一条 folder 填缺席的 `cwd`;判一次、随 run 冻结。项目继承来的成员参与的拒,`fields` 以本键为坐标。 */
     projectId?: string;

package/dist/human-facing-args.d.ts

@@ -0,0 +1,33 @@
+/**
+ * 给人看的调用入参 —— **唯一一份读法**。三处读者同调这一只函数:活卡的 `args`(`tool-approval.ts` 的卡帧 / `card_json` / 续跑拒体的 `acceptableForm`)、
+ * 停驻行的 `input`(`plugins/checkpoint-store-face.ts` 的 `boundedToolInput`:两孪生都在读时从停驻快照的待决动作投影,不存第二份)、问帧的 `questions`(`question.ts`)。
+ *
+ * 律(一条):**脱敏 → 序列化 → 按 UTF-8 字节量 → 对一个常量判;卡的种类决定超了怎样。**
+ *  · 入参**就是**人要决的东西(问:题干与选项;计划:要批的计划正文)⇒ 整份给出、从不折叠。折掉它,人能做的只剩拒答 —— 那就不该把 run 停在他面前;
+ *    同一份字节(模型原调用的那一份)本就随 `tool_start.args` 不封顶地进了同一条流与账本,在这里封顶挡不住它,只制造「活面不给看、停驻行给折叠」两种盲。
+ *  · 其余动作卡 ⇒ 超常量即折叠(活卡 `argsOmitted`、停驻行 `{ truncated: true, bytes }`):盲批的安全答是「不」,动作卡的保留部分在兄弟格上
+ *    (卡的 `message`、停驻行的 `riskDescriptor.summary` / `touchedPaths`),帽买到的是队列列举 / 流 upsert / `card_json` 少一份大拷贝。
+ *  · 无卡(引擎没铸卡词:更早的停驻行 / 非审批门;集外词在读点已读作无卡)⇒ 按动作折(有界是 fail-safe 方向)。
+ * 序列化不出(BigInt / 抛错的 `toJSON`;环在脱敏遍历里已被断开成 `[circular]`)⇒ 折叠、`bytes: null` —— 没有可给的整份,问 / 计划卡同此。
+ *
+ * 卡是哪一张只有引擎铸的 `approvalCard` 一个事实源(`approval-content-kind.ts` 的律:不从工具名回推):活卡读 `AskRequest.approvalCard`,停驻行读门上那一格
+ * (SQL 孪生 = `approval_card` / `gate_kind` 两列,LOCAL 孪生 = 门本身,同一只 `parkedApprovalCard`);调用方读定后交进来,本模块不读卡。
+ * 如实:这是一只函数、三处调用、同一判定,不是「一次判定先于所有落点」—— 各面在自己的时刻对自己手里的那份入参判,同一份入参在各面答同一个结局。
+ */
+import type { ToolApprovalCard } from "@sema-agent/core";
+/**
+ * 动作卡入参给人看的上限:脱敏后 JSON 的 **UTF-8 字节数**。取值:本版之前停驻行的帽是 8192 个 UTF-16 单元,一个单元至多 3 个 UTF-8 字节(`\uXXXX` 转义 6 单元 6 字节)
+ * ⇒ 那一帽下整份的入参最坏 24576 字节 < 本值 —— 停驻行、活卡、问三面相对上一版零收窄。
+ */
+export declare const HUMAN_FACING_ARGS_BYTES = 32768;
+/** 一份入参给人看的结局:整份(脱敏后的值)或折叠(`bytes` = 脱敏后 JSON 的 UTF-8 字节数;序列化不出 ⇒ `null`)。纯数据。 */
+export type HumanFacingArgs = {
+    readonly kind: "whole";
+    readonly value: unknown;
+} | {
+    readonly kind: "omitted";
+    readonly bytes: number | null;
+};
+/** 见模块头注的律。`card` = 调用方读定的卡(无卡 ⇒ `undefined`)。 */
+export declare function humanFacingArgs(args: unknown, card: ToolApprovalCard | undefined): HumanFacingArgs;
+//# sourceMappingURL=human-facing-args.d.ts.map

package/dist/human-facing-args.js

@@ -0,0 +1,33 @@
+import { redactDeep } from "./trace/redact.js";
+export const HUMAN_FACING_ARGS_BYTES = 32768;
+const ARGS_ARE_THE_DECISION = {
+    question: true,
+    plan: true,
+    "file-edit": false,
+    "file-write": false,
+    "notebook-edit": false,
+    shell: false,
+    fetch: false,
+    skill: false,
+    workflow: false,
+    generic: false,
+    "computer-access": false,
+    "computer-control": false,
+};
+export function humanFacingArgs(args, card) {
+    const redacted = redactDeep(args);
+    let text;
+    try {
+        text = JSON.stringify(redacted);
+    }
+    catch {
+        return { kind: "omitted", bytes: null };
+    }
+    if (text === undefined)
+        return { kind: "omitted", bytes: null };
+    if (card !== undefined && ARGS_ARE_THE_DECISION[card])
+        return { kind: "whole", value: redacted };
+    const bytes = Buffer.byteLength(text, "utf8");
+    return bytes > HUMAN_FACING_ARGS_BYTES ? { kind: "omitted", bytes } : { kind: "whole", value: redacted };
+}
+//# sourceMappingURL=human-facing-args.js.map

package/dist/identity-source.d.ts

@@ -2,7 +2,7 @@
  * **身份来源闭集 + run 行身份元组** —— 叶子模块(零依赖):凭据门(`http/principal-gate.ts`)、run 店契约(`plugins/store-contracts.ts`)、
  * 三只 run 店与 leader run 店(`plugins/leader-run-store-sql.ts`)、中央建表语句(`plugins/tidb-pool.ts` / `plugins/pg-pool.ts`)与 `/health` 自报位读同一份。
  *
- * ## 律(三句;全仓只在这里写一次)
+ * ## 律(五条;全仓只在这里写一次)
  * 1. **一张表、一个次序**:{@link IDENTITY_SOURCES} 的序 = 凭据门的判定次序(`verifiedIdentitySource` 答表里第一个验得过的词)= `/health.auth.kinds` 的出现序。
  *    出示了部署的 service 凭据就是 `service_token` —— 哪怕同一枚 Bearer 也被鉴权桥验成登录令牌、哪怕运维给这枚凭据起的系统名叫 `sso`;
  *    验不过 service 凭据而鉴权桥挂了身份 ⇒ `sso`;都没有而直连门 principal 令牌验过 ⇒ `direct_door_jwt`。
@@ -15,6 +15,10 @@
  * 4. **令牌声明装不进它的列就不记**(不截断:截断 = 两个不同的值折成一个):`sso` 臂从验过的令牌铸元组时,某一格装不进它的列宽({@link RUN_IDENTITY_CLAIM_COLUMNS})
  *    ⇒ 那一格「未记录」—— 可空的格(化身号)记 `null`;必填的格(scope)装不下就铸不出合形元组 ⇒ 无元组。两格结果不同来自元组的型,不是两条规则:
  *    同一只判({@link runIdentityClaimOverflow})、同一行告警 `run_identity_claim_unrecorded { claim, chars, max }`(凭据门的铸点发;只名与长度,不带值)。
+ * 5. **凭据门认哪几类来源,一列答**({@link passesCredentialGate}):service 凭据与鉴权桥验过的登录令牌过门,直连门 principal 令牌不过(它只证审批决定者是谁)。
+ *    两道门读这同一列、各问各的事:全局凭据门(401)只在部署配了 service 凭据时武装({@link hasServiceAuth});fail-closed 写门(503:计费提交 / bake / 改写门 /
+ *    破坏性会话写 / 停驻赎回开新腿)恒武装,问的是**这次请求**带没带过门的凭据,`ALLOW_UNAUTHED_WRITES` 是它唯一的逃生口 —— 写门不读任何部署级布尔:
+ *    部署接没接过门的来源,落在「这次请求验不验得出」里(没接 ⇒ 没有一次请求验得出 ⇒ 照拒)。
  *
  * 化身号 `principalInc`:令牌 `sub_inc` 声明原样(契约包 `VerifiedIdentity.principalInc`)。来源链只有一条 —— 验证器读出 → 注入边界再判形(`auth-bridge.ts` 的
  * `admitBridgeIdentity`)→ 入口预认证挂 request-local(`security.ts` 的 `setSsoPrincipalInc`)→ 凭据门 `admitRunIdentity` 的 `sso` 臂铸进元组(律 4)→ 建行原样写入。
@@ -46,9 +50,22 @@ export declare function authBridgeIssuerOf(config: Pick<IdentitySourceConfig, "a
     readonly issuer: string;
     readonly source: "explicit" | "fallback";
 } | undefined;
-/** 「这台部署配了任何一把 service 凭证吗」—— fail-closed 写门族的真值源,也是身份来源 `service_token` 接没接线的那一句。**单一属主**:全局凭据门(`http/dispatch.ts`)、
- *  停驻行的赎回席(`http/approval-sweeps.ts`)、记忆整理阀门的启动期告警(`boot/stage-06-runners.ts`)、以及 {@link configuredIdentitySources} 读同一句(手抄迟早只改一处,而这条判据决定的是「无凭证部署上写口开不开」)。 */
+/**
+ * 「这台部署配了任何一把 service 凭证吗」—— 身份来源 `service_token` 接没接线的那一句,也是**全局凭据门的武装谓词**(配了 ⇒ 门后各口不带过门凭据就 401;
+ * 没配 ⇒ 门不武装,写门照样只认过门的凭据,见文件头律 5)。**单一属主**(手抄迟早只改一处):全局凭据门的武装(`http/dispatch.ts`)、门前读路谓词与 `/health` 读者档
+ * (同文件 `readCredentialOk` / `healthReaderOf`,问的都是「门武装没有」)、监听收窄与两条单用户边界不变量(`bind-host.ts` 的 `bindMustNarrow`,`config-invariants.ts`)、
+ * 多租无 fleet 凭据的启动期告警(`boot/stage-07-capability-layer.ts`)、以及 {@link configuredIdentitySources} 读同一句。**不是**写门的判据(写门问请求,律 5)。
+ */
 export declare function hasServiceAuth(config: Pick<IdentitySourceConfig, "authToken" | "authTokens">): boolean;
+/** 凭据门认的那几类来源(律 5;{@link passesCredentialGate} 收窄到它)。 */
+export type CredentialGateSource = Extract<IdentitySource, "service_token" | "sso">;
+/**
+ * 🔴 **律 5 的那一列:这一类来源过不过凭据门**(缺席 = 这次请求没有验过的来源 ⇒ 不过)。service 凭据是部署发的凭据;鉴权桥验过的登录令牌由本部署信任的签发方签、
+ * 主体就是令牌里的那一位(主体头盖不过它);直连门 principal 令牌只证审批决定者是谁,从来不替代凭据。穷举:加一个来源不接这里 ⇒ 编译红。
+ * 读者:全局凭据门的 401 与 fail-closed 写门的 503(`http/dispatch.ts`,读同一次 `verifiedIdentitySource` 的答案)、停驻赎回席(`http/approval-sweeps.ts`)、
+ * 以及它在部署上的投影 —— 部署形表行 `credentialGateSource`(`deployment-shape.ts`;请求面不读那一行,写门问的是请求)。
+ */
+export declare function passesCredentialGate(kind: IdentitySource | undefined): kind is CredentialGateSource;
 /**
  * 🔴 **「这台部署能回哪几个身份来源」的唯一读法**({@link IDENTITY_SOURCES} 里配置接了线的那几个词,序同表)。读者:部署形表的 `identity` 轴
  * (`deployment-shape.ts`,「有没有身份边界」那一行由它答)、`/health.auth`(自报位,`http/health-self-report.ts`)、server-as-peer 受众门(`http/server.ts`)。

package/dist/identity-source.js

@@ -23,6 +23,20 @@ function identitySourceConfigured(kind, config) {
         }
     }
 }
+export function passesCredentialGate(kind) {
+    switch (kind) {
+        case "service_token":
+        case "sso":
+            return true;
+        case "direct_door_jwt":
+        case undefined:
+            return false;
+        default: {
+            const unknownKind = kind;
+            throw new Error(`identity sources: unknown identity source ${String(unknownKind)}`);
+        }
+    }
+}
 export function configuredIdentitySources(config) {
     return IDENTITY_SOURCES.filter((k) => identitySourceConfigured(k, config));
 }

package/dist/index.d.ts

@@ -20,7 +20,7 @@ export { RateLimiter, type RateDecision } from "./observability/rate-limit.js";
 export { GiteaClient, GitHubClient, createRepoClient, GIT_API_KINDS, isGitApiKind, repoToolsFor, parseRepo, type GitApiKind, type RepoCoords, type RepoReadClient } from "./capabilities/repo-tools.js";
 export { nowTool } from "./capabilities/builtin-tools.js";
 export { loadSkills, skillsForScenario, type LoadedSkill } from "./capabilities/skills.js";
-export { buildScenarios, selectScenario, createScenarioGate, type Scenario, type ScenarioBundle, type ScenarioContext, type ScenarioDeps, type ScenarioGate, type ScenarioGateLeg, type ScenarioGateSources, type ScenarioRequest, } from "./capabilities/scenarios.js";
+export { buildScenarios, selectScenario, createScenarioGate, type Scenario, type ScenarioBundle, type ScenarioChoice, type ScenarioContext, type ScenarioDeps, type ScenarioGate, type ScenarioGateLeg, type ScenarioGateSources, type ScenarioRequest, type ScenarioSource, } from "./capabilities/scenarios.js";
 export { createTaskListLane, taskListKeyFor, MAX_TASK_LIST_SESSIONS, type TaskListLane, type TaskListLaneBackend, type TaskListLaneOpts } from "./boot/task-list-lane.js";
 export { ensureTiDBTaskListSchema, ensurePgTaskListSchema } from "./plugins/task-list-store-sql.js";
 export { createAuthorizer, principalFrom, HttpError, type AuthContext, type OwnerAwareSessionStore, } from "./security.js";
@@ -41,5 +41,9 @@ export { judgeServedModelRoute, type ServedModelRouteView, type ServedModelRoute
 export type { UserInputLedgerStore, UserInputAcceptance, NewUserInputAcceptance, OpenScanCursor, OpenScanPage, SettleHow, WriterGoneEvidence } from "./user-input-ledger.js";
 export type { OrgDeliveryQuotaStore, OrgDeliveryQuotaPolicy, OrgDeliveryQuotaVerdict } from "./plugins/org-delivery-quota-store.js";
 export type { ServerOrgDeliveryGate, ServerOrgDeliveryOutcome } from "./org-delivery-gate.js";
+export type { LandedAttendantSeat, LandedAnchor, FileHistoryReplayResult, FileHistoryReplayFailure } from "./plugins/landed-attendants.js";
+export type { LandedOutcome } from "./session-row.js";
+export type { SessionFace } from "./session-incarnation.js";
+export type { BlobGetter } from "./session-sync.js";
 export { APPROVAL_GATE_KINDS, type ApprovalGateKind } from "./approval-content-kind.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/k8s-api-credentials.d.ts

@@ -0,0 +1,29 @@
+/**
+ * k8s 车道的**集群 API 凭据**:缺什么、怎么说、说给谁(纯叶:零值依赖,零 IO)。
+ *
+ * ## 法
+ * 车道声明了(`REMOTE_EXEC=k8s`)而控制面凭据没有 ⇒ 车道上每一条命令都起不来(`shell_unavailable`),而 run 照常 `completed` —— 这是**起服前就知道**的事,
+ * 不许走到 run 才说(同一件事实一个出口)。判「凭据在不在」只有一只判官(`plugins/remote-env-k8s.ts` 的 `resolveK8sApiAccess`:显式配置 ∨ in-cluster 服务账号,
+ * 适配器每次请求前读的 `creds()` 与下面三处说法读同一只),它答三个事实之一({@link K8sApiCredentialFact});本模块只管每个事实的**一句话**与三处说法:
+ *  · 起服拒({@link k8sCredentialsMissingBootSentence} + {@link K8sApiCredentialsMissingError},机器码 `config.k8s_api_credentials_missing`):凭据缺 ⇒ 不起;
+ *  · 运行期拒({@link k8sCredentialsMissingRunSentence} / {@link k8sCredentialsRejectedRunSentence}):起服之后凭据缺(服务账号文件没了)或被集群 401 拒 ⇒
+ *    每条 run 的环境铸造前拒,码 `env.sandbox_refused`(`execution-env-refusal.ts`)。
+ * 两条出路只写一次({@link EXITS}),三句共用:给凭据,或改车道。
+ */
+/** 判官的三个事实:缺集群 API 地址 / 缺 API 令牌 / 缺 CA(且没声明实验室 TLS)。 */
+export type K8sApiCredentialFact = "api_url" | "token" | "ca";
+/** 一个缺失事实的一句话。 */
+export declare function describeMissingK8sCredential(fact: K8sApiCredentialFact): string;
+/** 起服拒的拒句:点名「REMOTE_EXEC=k8s 需要集群 API 凭据」、缺的那一件、后果与两条出路。 */
+export declare function k8sCredentialsMissingBootSentence(fact: K8sApiCredentialFact): string;
+/** 运行期拒(凭据在起服之后读不到):句里不再说「拒启」,说这条 run 被拒。 */
+export declare function k8sCredentialsMissingRunSentence(fact: K8sApiCredentialFact): string;
+/** 运行期拒(集群 API 以 401 拒了车道的凭据)。 */
+export declare function k8sCredentialsRejectedRunSentence(): string;
+/** 起服拒的机器码(`boot/fatal-exit.ts` 把带码异常写成 `<名> [<码>]: …` 标题;`config.*` 族与 `config.store_not_durable` 同形)。 */
+export declare const K8S_API_CREDENTIALS_MISSING_CODE = "config.k8s_api_credentials_missing";
+/** 起服因 k8s 车道声明而集群 API 凭据缺而拒启时的抛出物。 */
+export declare class K8sApiCredentialsMissingError extends Error {
+    readonly code = "config.k8s_api_credentials_missing";
+}
+//# sourceMappingURL=k8s-api-credentials.d.ts.map

package/dist/k8s-api-credentials.js

@@ -0,0 +1,25 @@
+const MISSING_WHAT = {
+    api_url: "no cluster API address is set (K8S_API_URL) and the process is not running in a cluster (no KUBERNETES_SERVICE_HOST)",
+    token: "no API token is set (K8S_TOKEN) and the mounted service-account token cannot be read",
+    ca: "no CA certificate is set (K8S_CA_CERT_B64) and the mounted service-account CA cannot be read, and K8S_INSECURE_TLS is not true",
+};
+export function describeMissingK8sCredential(fact) {
+    return MISSING_WHAT[fact];
+}
+const EXITS = "Either give the server the cluster API credentials (K8S_API_URL + K8S_TOKEN, plus K8S_CA_CERT_B64 or K8S_INSECURE_TLS=true for a lab; or run the server in a pod that mounts a service account) " +
+    "or declare an execution lane that needs no cluster (REMOTE_EXEC=none, or another lane).";
+export function k8sCredentialsMissingBootSentence(fact) {
+    return (`REMOTE_EXEC=k8s needs cluster API credentials, but ${MISSING_WHAT[fact]} — refusing to start rather than serving a lane on which every sandbox command ` +
+        `fails (shell_unavailable) while every run still finishes as completed. ${EXITS}`);
+}
+export function k8sCredentialsMissingRunSentence(fact) {
+    return `this run is refused: the k8s execution lane needs cluster API credentials, but ${MISSING_WHAT[fact]}. ${EXITS}`;
+}
+export function k8sCredentialsRejectedRunSentence() {
+    return `this run is refused: the cluster API rejected the k8s lane's credentials (HTTP 401) — a revoked or expired token, or an API address of another cluster. ${EXITS}`;
+}
+export const K8S_API_CREDENTIALS_MISSING_CODE = "config.k8s_api_credentials_missing";
+export class K8sApiCredentialsMissingError extends Error {
+    code = K8S_API_CREDENTIALS_MISSING_CODE;
+}
+//# sourceMappingURL=k8s-api-credentials.js.map

package/dist/lane-home-probe.d.ts

@@ -23,6 +23,7 @@
  * 读不了家目录的车道(device:设备协议没有读数)不持座 —— 声明就是座,起服披露「来自声明、未实测」(`execution-lane-caps.ts` `buildLaneHomeBootNote`)。
  * 规则基与 422 门在下单那一刻就要家目录,而那一刻执行环境还没开 —— 它们只读主张(`executionLaneHomeDir`);环境开起来时主张被证,证不了的环境不开。
  */
+import { type ExecutionEnvRefusalCode } from "./execution-env-refusal.js";
 /** 探针答案的行首标记:登录脚本 / profile 往 stdout 打的横幅不会被读成家目录 —— 只认带这个标记的那一行(恰一条,见 `markedHome`)。 */
 export declare const LANE_HOME_PROBE_MARKER = "sema-lane-home=";
 /**
@@ -72,14 +73,9 @@ export type LanePathFlavor = "posix" | "win32";
  */
 export declare function judgeLaneHome(lane: string, claim: LaneHomeClaim, probe: LaneHomeProbe, paths?: LanePathFlavor): LaneHomeVerdict;
 /**
- * 本仓自铸的**执行环境拒码**闭集(`env.*` 族;今天一员)—— 一只执行环境在交给引擎之前就被拒时,工厂抛出的错带的 `code`。引擎在准备期原样再抛、不建环境,
- * run 的 `failed` 终局原样承运码与句;同步提交腿按零工作拒落档(`runs.ts` 的 `EXECUTION_ENV_REFUSAL_HTTP_STATUS`,按本闭集键控:加一员而档没跟 ⇒ tsc 红)。
- *  · `env.home_unconfirmed` —— 家目录主张证不了({@link judgeLaneHome} 的三形拒句:读不出 / 不是绝对路径 / 与实测不一致)。三形一个码:出路都在部署
- *    (声明、环境里的 `HOME`,或会话 `settings.env` 里的 `HOME`),消费端不按形分岔;是哪一形、怎么改,句子里说。
+ * 家目录拒的带码错误:句 = 判官的拒句原文,码 = `env.home_unconfirmed`(本仓 `env.*` 族的一员,闭集属主 `execution-env-refusal.ts`)。读数在铸环境时就到手的车道(host)
+ * 构造时抛它,工厂原样抛出;读数要环境起来才有的车道在建连时以同一码答(建连座的拒因表 `home_unconfirmed`)。
  */
-export declare const EXECUTION_ENV_REFUSAL_CODES: readonly ["env.home_unconfirmed"];
-export type ExecutionEnvRefusalCode = (typeof EXECUTION_ENV_REFUSAL_CODES)[number];
-/** 家目录拒的带码错误:句 = 判官的拒句原文,码 = `env.home_unconfirmed`。读数在铸环境时就到手的车道(host)构造时抛它,工厂原样抛出。 */
 export declare function laneHomeRefusal(verdict: NonNullable<LaneHomeVerdict>): Error & {
     readonly code: Extract<ExecutionEnvRefusalCode, "env.home_unconfirmed">;
 };

package/dist/lane-home-probe.js

@@ -1,3 +1,4 @@
+import { executionEnvRefusalError } from "./execution-env-refusal.js";
 export const LANE_HOME_PROBE_MARKER = "sema-lane-home=";
 export const LANE_HOME_PROBE_COMMAND = `printf '\\n${LANE_HOME_PROBE_MARKER}%s\\n' "$HOME"`;
 const SHOWN_MAX = 256;
@@ -61,9 +62,8 @@ export function judgeLaneHome(lane, claim, probe, paths = "posix") {
         answered: true,
     };
 }
-export const EXECUTION_ENV_REFUSAL_CODES = ["env.home_unconfirmed"];
 export function laneHomeRefusal(verdict) {
-    return Object.assign(new Error(verdict.refusal), { code: "env.home_unconfirmed" });
+    return executionEnvRefusalError("env.home_unconfirmed", verdict.refusal);
 }
 export const LANE_HOME_UNDECLARED_EVENT = "execution_lane_home_undeclared";
 const HOME_ABSENT_COST = "the engine cannot place its home-anchored read-deny rows, so every contents-disclosing recursive read (grep -r, rg, git grep, tar c, …) asks a person on the full shell — " +

package/dist/leader/diffup.d.ts

@@ -15,6 +15,25 @@
  * pullDiff stays as the compat path for static (leader-owned) envs — M2 降兼容.
  */
 import { type PullDiffResult } from "./diffout.js";
+/** The leader's diff-out store (`MINIO_BUCKET` + the shared `MINIO_*` endpoint and key; `boot/leader.ts` `buildLeaderObjectStore`). */
+export interface LeaderDiffStore {
+    endpoint: string;
+    bucket: string;
+    accessKey: string;
+    secretKey: string;
+    region?: string;
+}
+/**
+ * One worker's diff-out object and its two URLs — the ONE place the key is spelled (`leader-diff/<run>/<workerId>.patch`; one object per worker per
+ * leader run, a repair re-run overwrites): the PUT the worker env's upload script sends (`leader-diff/patch:PUT`, the sandbox) and the GET the
+ * leader fetches it with on the control plane (`leader-diff/patch:GET`, the server). `workerId` is validateSubtasks-clean (`[A-Za-z0-9._-]+`) ⇒
+ * safe as a key segment (the presigner backstop-rejects traversal anyway). `ttlSec` = the worker's deadline plus slack (`leaderResourceConfig`).
+ */
+export declare function buildLeaderDiffUrls(s3: LeaderDiffStore, workerId: string, ttlSec: number): {
+    readonly key: string;
+    readonly putUrl: string;
+    readonly getUrl: string;
+};
 /** The staged upload script. `repoDir`/`workDir` are deployment config; `baseSha` is interpolated into a
  *  shell line, so it is re-validated HERE (fail-closed) — callers should already have applied diffout's
  *  safeRev rules, but this function is the last line before the shell. The patch is written OUTSIDE the repo

package/dist/leader/diffup.js

@@ -1,6 +1,13 @@
 import { safeRev, DEFAULT_MAX_DIFF_BYTES } from "./diffout.js";
 import { OBJECT_STORE_IO_TIMEOUT_MS } from "../plugins/blob-backend.js";
 import { createEgressFetch } from "../egress-redirect.js";
+import { presignS3Url } from "../plugins/s3-presign.js";
+import { LEADER_DIFF_PREFIX } from "../object-store-buckets.js";
+export function buildLeaderDiffUrls(s3, workerId, ttlSec) {
+    const key = `${LEADER_DIFF_PREFIX}/${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 8)}/${workerId}.patch`;
+    const base = { endpoint: s3.endpoint, bucket: s3.bucket, accessKey: s3.accessKey, secretKey: s3.secretKey, ...(s3.region ? { region: s3.region } : {}), key, expiresSec: ttlSec };
+    return { key, putUrl: presignS3Url({ ...base, op: "leader-diff/patch:PUT", method: "PUT" }), getUrl: presignS3Url({ ...base, op: "leader-diff/patch:GET", method: "GET" }) };
+}
 export function buildUploadScript(p) {
     if (!safeRev(p.baseSha))
         throw new Error(`buildUploadScript: unsafe baseSha ${JSON.stringify(p.baseSha)}`);

package/dist/leader/leader.d.ts

@@ -15,8 +15,10 @@
 import { type RunnerLike, type WorkerReport } from "./fanout.js";
 import { type ExecStreamLike } from "./diffout.js";
 import { type MergeDeps, type MergeResult } from "./merge.js";
-import { type PermissionMode, type TaskSpec, type VerifyConfig, type CheckpointToken, type TerminalCause, type ToolSpec, type RepairTerminal, type OracleTier, type RepairResult } from "@sema-agent/core";
+import { type PermissionMode, type ToolPolicy, type TaskSpec, type VerifyConfig, type CheckpointToken, type TerminalCause, type ToolSpec, type RepairTerminal, type OracleTier, type RepairResult } from "@sema-agent/core";
 import { type UnattendedLegSpec } from "../unattended-permission-mode.js";
+import type { CheckpointStoreFull } from "../plugins/store-backend.js";
+import type { CheckpointCtxSealer } from "../http/checkpoint-ctx.js";
 /** [ref] Slice 6: drive a worker's resource-suspend auto-resume to a terminal (or bound) state. Exported
  *  for unit tests. Loops `resume(token, slice)` WHILE the result's terminal cause is a park on a
  *  `resource_limit` gate. Exits on: a terminal cause that is not a park, a park on any OTHER gate
@@ -70,19 +72,122 @@ export interface ProvisionedWorker {
  * (`runtime-governance.ts` `entryPermissionMode`)得出的入口词(`run-entry.ts` `leaderRunEntry`);地板缺席 ⇒ `{}`。leader 请求不带调用方的模式词,所以入口词就是地板本身(与 run-local 同)。
  * 本 run 铸的每一条 spec 经 {@link withLeaderLeg} 从这一份取词;worker 的续跑体由它展开(`{ ...entry, objective }`)⇒ 首跑、续跑、修复腿同一个词。
  * 入口词是 `plan` 的 run 进不了这条车道(`run-entry.ts` `leaderEntryRefusal`:worker 会话没有计划审阅通道)—— 受理口与出生处同判,到不了 worker。
- * 热改 `AUTONOMY` 只影响之后起的 leader run:在飞的 run 保持它出生时盖下的这一份。
+ * 热改 `AUTONOMY` 只影响之后起的 leader run:在飞的 run(含它后来 provision 的 worker,与经 HTTP 续跑腿赎回的停驻 worker —— 续跑口对带无人值守标的行照写下的体重放,
+ * `http/resume-legs.ts` `replayCtxOf`)保持它出生时盖下的这一份。
  */
 export interface LeaderRunEntry {
     readonly permissionMode?: PermissionMode;
 }
 /**
- * leader 车道铸 spec 的**唯一**合并口:spec 的词钳在入口体的词之下(`runtime-governance.ts` `entryPermissionMode(spec 的词, 入口词)` —— 与受理门同一只函数;
- * 写进 spec 的值就是它的 `effective`),再交给无人值守腿的合并口(`withUnattendedLeg` 的 `default` 钳在那个词之下)。入口体无词 ⇒ spec 原物交给
- * `withUnattendedLeg`,与不经本口逐字同。本车道的 spec 今天自己不带模式词(子任务体只有 objective,其余并进的键是预算 / 审批 / 身份)⇒ 入口词在场时写下的就是它;
- * 将来带了词,比入口词松的折回入口词、比它紧的留着 —— 与一条提交体过受理门同一个答案,不另写「写」的规则。五个出生点(worker 首跑的工厂 / 静态两条车道、
- * 集成修复、模块门修复、单代理修复环)都调它、不直调 `withUnattendedLeg`(`test/leader-entry-floor.test.ts` 按语法树数调用点):「这条腿的词从哪来」只有入口体一个答案。
+ * 一条 leader run 的**出生上下文**:run 出生那一拍定下、本 run 铸的每一条腿都从它取 —— 入口体({@link LeaderRunEntry})、提交者的身份格
+ * (`engine-identity.ts` `taskSpecIdentityOf` 的产物,出生时读一次 ALS)、部署治理折叠(装配处闭包活 config 交进来,leader 自己不读 config)。
  */
-export declare function withLeaderLeg<S extends Partial<TaskSpec>>(spec: S, entry: LeaderRunEntry): S & UnattendedLegSpec;
+export interface LeaderBirth {
+    readonly entry: LeaderRunEntry;
+    /** 提交者的身份格(匿名 ⇒ `{}`:键缺席,与提交腿同一读法)。中心按主体的收紧位、治理窗的锅都按它解。 */
+    readonly identity: {
+        readonly principal?: string;
+    };
+    /**
+     * 部署治理折叠(`runtime-governance.ts` `applyRuntimeGovernance`,与 `resolveSpec` / 停驻赎回腿同一属主):运维 `AUTONOMY` / `commandPolicy` /
+     * `MANUAL_MODE_SHELL_GATE` / 守卫集 tighten-only 盖到 spec 上。`legSessionId` = 这条腿的**槽键**(沙盒车道上守卫按它在槽表里取那台真沙盒):
+     * 跑在 worker 执行器上的腿(首跑、模块门修复、单代理修复环)= worker 自己的会话号;集成修复腿 = 它那一轮的会话号(`leader/wire.ts` 按同一个键登记)。
+     */
+    readonly govern: (spec: TaskSpec, legSessionId: string) => TaskSpec;
+    /**
+     * 审批基线(`deployment-governance.ts` `createApprovalBaselinePolicy` 的两臂,装配处闭包活 config —— 名单热换对之后出生的腿生效)。出生口按这条腿的
+     * {@link LeaderLegDurability} 取一臂:耐久腿 `durable`(问答门 + 三张名单,问由停驻服);不耐久腿 `live`(三张名单,问由这条腿的活席服 —— 即无人值守层:
+     * 答得了的按类答,答不了的交回引擎的缺席路,这条腿没有停驻设施 ⇒ 拒)。
+     */
+    readonly baseline: (seat: "durable" | "live") => ToolPolicy;
+    /**
+     * 这条腿的 per-model 凭据席(`TaskSpec.getApiKeyAndHeaders`)—— 装配处铸(`boot/leader.ts` 的 `createLeaderLegAuth`:与任务面同一只活引用、与 side-query /
+     * WebFetch 摘要面同一只席工厂);leader 自己不碰钥链。**每只执行器出生时调一次**(出生口 {@link withLeaderLeg} 对执行器与腿同拍出生的腿调;planner 路由在它的
+     * Runner 构造那一拍调):解钥的那一代在这一拍定下,与这只执行器构造时收下的模型目录同代(目录与钥匙表由中心成对换代 ⇒ 在飞的腿不会把新家的钥发到它目录里的旧家)。
+     * 跑在已出生执行器上的腿不再调它,沿用那只执行器的席({@link LeaderLegExecutor})。
+     * `upstream` = spec 自带的席:每次调用先问它,它没意见才按模型解(不覆盖)。声明了钥匙却拿不到 ⇒ 席抛(与任务面同一只毒丸),那次调用整体失败,绝不回落网关钥。
+     */
+    readonly auth: (upstream: TaskSpec["getApiKeyAndHeaders"]) => NonNullable<TaskSpec["getApiKeyAndHeaders"]>;
+}
+/**
+ * leader worker 审批停驻行的 scope(唯一属主;保留标识见 `principal-shape.ts` 的 `RESERVED_PRINCIPALS`)。出生口给耐久腿的 `durableApproval` 与
+ * 取消时的残留过期(`wire.ts` `createLeaderParkExpirer`)读这同一只。
+ */
+export declare const LEADER_APPROVAL_SCOPE = "_leader";
+/** 部署的停驻设施(`LeaderWireConfig.durable` 函数席每次产出的一份;键在场 ⟺ 部署接了停驻店)。 */
+export interface LeaderDurableSeat {
+    readonly checkpointStore: CheckpointStoreFull;
+    /** [ref]:写 worker 续跑上下文的封口(`ServiceDeps.checkpointCtxSealing` 同一只;规则属主 `http/checkpoint-ctx.ts` 末段「凭据位密封」)。
+     *  worker 的续跑体只有入口词 + 子任务 objective、不带凭据位 ⇒ 实际不封任何值,但写 ctx 的每一笔都经同一只封口(没有不封的第二种写法)。 */
+    readonly ctxSealer: CheckpointCtxSealer | undefined;
+    readonly ttlMs?: number;
+}
+/**
+ * 出生点陈述的这条腿的事实 ——「停驻决完之后,谁接着做这条腿的工作」:
+ *  · `replay` —— worker 首跑:留续跑体,决完之后由一条单独的续跑 run(HTTP 续跑腿,照写下的体重放)接着做。`resumeCtx` = 续跑上下文那一笔的结局:
+ *    `landed` = 写进了出生点递给这条腿的停驻店(`park`);`lost` = 写了、店抛了;`unwritten` = 出生点没递停驻设施 ⇒ 不写。递不递由出生点按车道定:
+ *    工厂车道 = 部署接了停驻店即递(环境由 worker 自己的 Runner 经工厂铸,停驻时引擎把可恢复的环境句柄写进检查点,续跑腿经部署工厂按句柄接回同一工作区);
+ *    静态车道 = {@link staticLaneWorkerPark}(上一发布版的条件,不按本律)。
+ *  · `in_run` —— 这条腿的续接是本 run 内存里的那一轮(集成修复、模块门修复、单代理修复环):一条单独续跑的 run 交不回去。
+ */
+export type LeaderLegFacts = {
+    readonly continuation: "replay";
+    readonly resumeCtx: "landed";
+    readonly park: LeaderDurableSeat;
+} | {
+    readonly continuation: "replay";
+    readonly resumeCtx: "lost" | "unwritten";
+} | {
+    readonly continuation: "in_run";
+};
+/** 一条腿的耐久事实({@link leaderLegDurability} 的产物)。`transient.why` 是给运维的那一句(资源分片停驻不生效的告警原因读它)。 */
+export type LeaderLegDurability = {
+    readonly kind: "durable";
+    readonly park: LeaderDurableSeat;
+} | {
+    readonly kind: "transient";
+    readonly why: string;
+};
+/**
+ * **一条 leader 腿的耐久事实 —— 唯一读者**。耐久 ⇔ 这条腿由单独的续跑 run 接续 ∧ 它的续跑上下文真落进了出生点递给它的停驻店(没落 ⇒ 停出来的卡
+ * 决的时候重建不了这条腿 ⇒ 不耐久)。四个调用点:worker 首跑(工厂 / 静态两条车道共一次)、集成修复、模块门修复、单代理修复环;出生口({@link withLeaderLeg})
+ * 按它盖审批基线与停驻设施,worker 首跑按它保温续跑上下文、开资源分片停驻。主车道没有握在手里的环境(它的每一只环境都由工厂铸,环境能不能停驻由引擎读),
+ * 所以「递不递停驻设施」这一问只在本车道有。
+ */
+export declare function leaderLegDurability(leg: LeaderLegFacts): LeaderLegDurability;
+/**
+ * 静态车道 worker 递不递停驻设施 —— **上一发布版的条件原样**:部署接了停驻店 ∧ 任一审批名单在场(每只 worker 现读)。只此一处,worker 首跑的出生点调它一次。
+ * 不按 {@link leaderLegDurability} 的律(工厂车道「店在即递」)判:这条车道上两种停驻的续接路不同 —— 资源分片停驻由 leader 在进程内同一只执行器上续(续得上);
+ * 审批停驻的赎回走 HTTP 续跑腿、经部署工厂另铸执行环境(worker 的沙盒握在 leader 手里,检查点里没有它的句柄 ⇒ 续不上)。引擎今天只有「给不给停驻店」一个开关,
+ * 两种停驻拆不开:照「店在即递」会比上一版多出几种部署形停出决完落新执行环境的卡,照「续不上就不递」又关掉上一版就工作的资源分片停驻 ⇒ 沿用上一版的条件。
+ * 已知缺陷(上一版同形,随包文书同句披露):名单在 × 店在时审批问停驻,决完的续跑落在新执行环境上。引擎提供「宿主声明本腿审批停驻不可续」的声明位后,
+ * 本条件退役、静态车道并回本读者的律(店在即递 + 声明审批停驻不可续:资源分片照停,审批问不走停驻)。
+ */
+export declare function staticLaneWorkerPark(park: LeaderDurableSeat | undefined, approvalListInForce: boolean): LeaderDurableSeat | undefined;
+/**
+ * 这条腿跑在哪只执行器上 —— **凭据代随执行器**:执行器构造时把模型目录收成私有副本,这条腿的钥取同一代(否则中心换代之后,新一代的钥会配上旧一代目录里的端点)。
+ *  · `fresh` —— 执行器与这条腿同拍出生(worker 首跑的工厂 / 静态两条车道、集成修复):出生口此刻从出生上下文取一只席({@link LeaderBirth.auth},折 spec 自带的那一只);
+ *  · `reuses` —— 腿跑在一只已经出生的 worker 执行器上(模块门修复、单代理修复环):沿用那只 worker 首跑 spec 上的席(它经出生口 `fresh` 出生,已折过子任务自带的席),不再取一代。
+ */
+export type LeaderLegExecutor = {
+    readonly kind: "fresh";
+} | {
+    readonly kind: "reuses";
+    readonly worker: Pick<ProvisionedWorker, "spec">;
+};
+/** 出生口收的这条腿:槽键(见 {@link LeaderBirth.govern})+ 耐久事实(见 {@link leaderLegDurability})+ 执行器(凭据代,见 {@link LeaderLegExecutor})。 */
+export interface LeaderLeg {
+    readonly slotKey: string;
+    readonly durability: LeaderLegDurability;
+    readonly executor: LeaderLegExecutor;
+}
+/**
+ * leader 车道铸 spec 的**唯一**出生口。顺序即语义:身份格 + 凭据席(随执行器的那一代,{@link LeaderLegExecutor})+ 审批基线与停驻设施(按这条腿的耐久事实)→ 部署治理折叠(同属主,tighten-only 叠在基线上)→
+ * 入口词(spec 的词钳在入口体的词之下,`runtime-governance.ts` `entryPermissionMode` —— 与受理门同一只函数)→ 无人值守腿(`withUnattendedLeg` 头注要求它在
+ * 治理折叠**之后**)。首跑、修复腿与停驻后的续跑腿(续跑腿经 `resolveSpec` 折同一只治理)因此同一读法。五个出生点(worker 首跑的工厂 / 静态两条车道、
+ * 集成修复、模块门修复、单代理修复环)都调它、不直调 `withUnattendedLeg`、不各自盖身份或基线(`test/leader-entry-floor.test.ts` 按语法树数调用点)。
+ */
+export declare function withLeaderLeg(spec: TaskSpec, birth: LeaderBirth, leg: LeaderLeg): TaskSpec & UnattendedLegSpec;
 export interface LeaderDeps {
     /**
      * 本 run 的中止信号(取消口 / 陈旧裁决;HTTP 驱动腿恒给,`endpoint.ts` 的 `drive`)。与 core `TaskSpec.signal` 同一约定:缺席 = 不可外部取消(单测 / bench 形)。
@@ -90,9 +195,9 @@ export interface LeaderDeps {
      * 不再起任何新的计费工作;在跑的腿经 spec 的同一根信号中止(fan-out 共享信号 / 修复腿 / 单代理修复环);合并在 push 咽喉前再核一次(`merge.ts`)。
      */
     signal?: AbortSignal;
-    /** 本 run 的入口体({@link LeaderRunEntry}:运维地板在 run 出生时盖一次)。必填:没有地板的装配写 `{}` —— 缺席不是「没有地板」的合法拼法。
-     *  模块门修复与单代理修复环这两个出生点从这里取词(经 {@link withLeaderLeg})。 */
-    entry: LeaderRunEntry;
+    /** 本 run 的出生上下文({@link LeaderBirth}:入口体 + 身份格 + 治理折叠,run 出生时定一次)。必填:没有地板的装配写 `entry: {}` —— 缺席不是「没有地板」的合法拼法。
+     *  模块门修复与单代理修复环这两个出生点从这里出生(经 {@link withLeaderLeg})。 */
+    birth: LeaderBirth;
     /** Plan a task into N disjoint-file sub-tasks (MVP: simple/hand-authored; adaptive replan = scale). */
     plan: (task: string) => Promise<SubtaskSpec[]>;
     /** Provision a leader-owned worker (its env seeded with base at `branch` + an env-bound runner). */