@sema-agent/server 7.150.0 → 7.152.0

package/dist/leader/leader.js

@@ -2,8 +2,9 @@ import { fanOut } from "./fanout.js";
 import { redactErrorMessage, redactHead } from "../observability/run-terminal.js";
 import { pullDiff } from "./diffout.js";
 import { mergeBranches } from "./merge.js";
-import { Runner, runWithVerification, resumeWithVerification } from "@sema-agent/core";
+import { Runner, QUESTION_AWAITS_RESUME, runWithVerification, resumeWithVerification } from "@sema-agent/core";
 import { pausedCauseOf, outwardPlane } from "../terminal.js";
+import { seatText } from "../trace/exit-seat.js";
 import { voidVerifierPauseCard } from "../verifier-pause-card.js";
 import { entryPermissionMode } from "../runtime-governance.js";
 import { withUnattendedLeg } from "../unattended-permission-mode.js";
@@ -18,9 +19,68 @@ export async function autoResumeOnResource(initial, signal, resume, maxSlices =
     }
     return vr;
 }
-export function withLeaderLeg(spec, entry) {
-    const word = entryPermissionMode(spec.permissionMode, entry.permissionMode).effective;
-    return withUnattendedLeg(word === undefined ? spec : { ...spec, permissionMode: word });
+export const LEADER_APPROVAL_SCOPE = "_leader";
+export function leaderLegDurability(leg) {
+    switch (leg.continuation) {
+        case "in_run":
+            return { kind: "transient", why: "this leg is continued by the leader's own in-run repair round, which a separately resumed run cannot hand its result back to" };
+        case "replay":
+            switch (leg.resumeCtx) {
+                case "landed":
+                    return { kind: "durable", park: leg.park };
+                case "lost":
+                    return { kind: "transient", why: "the worker's resume context did not land in the checkpoint store, so a decided park could not rebuild this leg" };
+                case "unwritten":
+                    return { kind: "transient", why: "no park facility for this worker (no durable checkpoint store; on the static lane, no approval list in force either)" };
+                default: {
+                    const unhandled = leg;
+                    throw new Error(`leader leg resume context ${JSON.stringify(unhandled)} has no durability arm`);
+                }
+            }
+        default: {
+            const unhandled = leg;
+            throw new Error(`leader leg facts ${JSON.stringify(unhandled)} have no durability arm`);
+        }
+    }
+}
+export function staticLaneWorkerPark(park, approvalListInForce) {
+    return approvalListInForce ? park : undefined;
+}
+function legAuthSeat(spec, birth, executor) {
+    switch (executor.kind) {
+        case "fresh":
+            return birth.auth(spec.getApiKeyAndHeaders);
+        case "reuses":
+            return executor.worker.spec.getApiKeyAndHeaders;
+        default: {
+            const unhandled = executor;
+            throw new Error(`leader leg executor ${JSON.stringify(unhandled)} has no credential seat`);
+        }
+    }
+}
+function legApprovalSeat(durability, birth) {
+    switch (durability.kind) {
+        case "durable": {
+            const d = durability;
+            return {
+                toolPolicy: birth.baseline("durable"),
+                checkpointStore: d.park.checkpointStore,
+                durableApproval: { scope: LEADER_APPROVAL_SCOPE, ...(d.park.ttlMs ? { ttlMs: d.park.ttlMs } : {}) },
+                onQuestion: QUESTION_AWAITS_RESUME,
+            };
+        }
+        case "transient":
+            return { toolPolicy: birth.baseline("live") };
+        default: {
+            const unhandled = durability;
+            throw new Error(`leader leg durability ${JSON.stringify(unhandled)} has no approval seat`);
+        }
+    }
+}
+export function withLeaderLeg(spec, birth, leg) {
+    const governed = birth.govern({ ...spec, ...birth.identity, getApiKeyAndHeaders: legAuthSeat(spec, birth, leg.executor), ...legApprovalSeat(leg.durability, birth) }, leg.slotKey);
+    const word = entryPermissionMode(governed.permissionMode, birth.entry.permissionMode).effective;
+    return withUnattendedLeg(word === undefined ? governed : { ...governed, permissionMode: word });
 }
 export const LEADER_RUN_STOPPED = "leader run stopped at an abort checkpoint (cancel): no further work was started and nothing was pushed after the stop";
 export function stoppedResult(reports, route) {
@@ -230,7 +290,11 @@ export async function runLeaderTask(task, durableBaseSha, deps) {
                     }
                     deps.logger?.info?.("module_repair", { workerId: r.workerId, attempt: attempt + 1, reason: redactHead(verdict.reason ?? "", 500) });
                     try {
-                        const rr = await w.runner.runTaskStream(withLeaderLeg({ ...sub.spec, objective: deps.moduleGate.repairObjective(sub, safeVerdictReason), sessionId: `${w.sessionId}-r${attempt + 1}`, ...(signal ? { signal } : {}) }, deps.entry)).result();
+                        const rr = await w.runner.runTaskStream(withLeaderLeg({ ...sub.spec, objective: deps.moduleGate.repairObjective(sub, safeVerdictReason), sessionId: `${w.sessionId}-r${attempt + 1}`, ...(signal ? { signal } : {}) }, deps.birth, { slotKey: w.sessionId, durability: leaderLegDurability({ continuation: "in_run" }), executor: { kind: "reuses", worker: w } })).result();
+                        if (rr !== undefined && rr.terminal.kind !== "completed") {
+                            const plane = outwardPlane(rr.terminal);
+                            deps.logger?.warn?.("module_repair_incomplete", { workerId: r.workerId, attempt: attempt + 1, status: plane.status, ...(plane.errorMessage !== undefined ? { err: seatText("operator-log-error", plane.errorMessage) } : {}) });
+                        }
                         if (r.stats && rr?.stats)
                             r.stats = { ...r.stats, tokens: (r.stats.tokens ?? 0) + (rr.stats.tokens ?? 0), costMicroUsd: (r.stats.costMicroUsd ?? 0) + (rr.stats.costMicroUsd ?? 0) };
                     }

package/dist/leader/repair-wire.js

@@ -1,6 +1,6 @@
 import { runRepairLoop, delimitUntrusted, } from "@sema-agent/core";
 import { mkRepairOracle } from "./repair-oracle.js";
-import { withLeaderLeg } from "./leader.js";
+import { leaderLegDurability, withLeaderLeg } from "./leader.js";
 import { outwardPlane } from "../terminal.js";
 import { redactHead } from "../observability/run-terminal.js";
 function statusForTerminal(t) {
@@ -87,7 +87,7 @@ export function attachRepairLoopDeps(deps, resolve) {
     deps.repairLoop = {
         run: async (solo, sub) => {
             const cfg = await resolve(solo, sub);
-            const implSpec = withLeaderLeg({ ...sub.spec, sessionId: solo.sessionId, ...(deps.signal ? { signal: deps.signal } : {}) }, deps.entry);
+            const implSpec = withLeaderLeg({ ...sub.spec, sessionId: solo.sessionId, ...(deps.signal ? { signal: deps.signal } : {}) }, deps.birth, { slotKey: solo.sessionId, durability: leaderLegDurability({ continuation: "in_run" }), executor: { kind: "reuses", worker: solo } });
             return runRepairLoopForLeader(solo, implSpec, cfg);
         },
     };

package/dist/leader/run-entry.d.ts

@@ -16,7 +16,8 @@ import { type Autonomy } from "../runtime-governance.js";
 import type { LeaderRunEntry } from "./leader.js";
 /** 一条 leader run 的入口体:地板读一次、入口词经受理门同一只函数(地板缺席 ⇒ `{}`)。调用方读**活** config(热改只影响之后起的 run)。 */
 export declare function leaderRunEntry(autonomy: Autonomy | undefined): LeaderRunEntry;
-/** 拒句:原因(运维的 plan 地板 × 这条车道没有计划审阅通道)+ 两条出路(改走有计划审阅的 run 车道 / 运维换档)。不含任何配置值之外的回显。
+/** 拒句:原因(运维的 plan 地板 × 这条车道没有计划审阅通道)+ 两条出路(改走有计划审阅的 run 车道 / 运维换到 `ask` 档,代价写在句里)。`read-only` 不是出路:
+ *  部署治理折叠盖在 leader 每条腿的出生口上,`read-only` 下 worker 写不了。不含任何配置值之外的回显。
  *  受理口(HTTP 422 的 `error`)与 run 出生处(run 的 `error`)读的是这一份;字节由 `test/api-error-text-freeze.test.ts` 的常量锚格冻。 */
 export declare const LEADER_PLAN_ENTRY_REFUSAL: string;
 /**

package/dist/leader/run-entry.js

@@ -6,7 +6,7 @@ export function leaderRunEntry(autonomy) {
 export const LEADER_PLAN_ENTRY_REFUSAL = "this deployment runs with AUTONOMY=plan, which starts every task in plan mode and lets it out of plan mode only when a person approves its plan through plan review; " +
     "a leader task's workers have no plan review channel, so they could neither write nor hand their plan to anyone who can approve it. Nothing was started. " +
     "Submit the work as a run instead (POST /v1/runs, whose plan is reviewed through POST /v1/assistant/tasks/:id/plan_review), " +
-    "or ask the operator to set AUTONOMY=read-only or AUTONOMY=ask, under which leader tasks run.";
+    "or ask the operator to set AUTONOMY=ask, under which leader tasks run, though each shell command a worker runs then needs a person's approval.";
 export function leaderEntryRefusal(entry) {
     const mode = entry.permissionMode;
     if (mode === undefined)

package/dist/leader/wire.d.ts

@@ -1,15 +1,14 @@
-import { type Brain, type Model, type ModelRoles, type ModelPricing, type TaskSpec, type ExecutionEnvFactory, type RemoteExecutionEnv, type ToolResultStore, type SessionStore, type ExecutionEnv, type RunnerDeps, type CheckpointToken } from "@sema-agent/core";
+import { type TaskSpec, type ExecutionEnvFactory, type RemoteExecutionEnv, type ToolResultStore, type SessionStore, type ExecutionEnv, type CheckpointToken } from "@sema-agent/core";
 import type { Autonomy } from "../runtime-governance.js";
-import { type CheckpointCtxSealer } from "../http/checkpoint-ctx.js";
-import type { CheckpointStoreFull } from "../plugins/store-backend.js";
-import { type LeaderDeps, type LeaderResult } from "./leader.js";
-import { type DeploymentPostureSeats } from "../boot/runner-deps.js";
+import { type LeaderDiffStore } from "./diffup.js";
+import { type LeaderBirth, type LeaderDurableSeat, type LeaderDeps, type LeaderResult } from "./leader.js";
+import type { DeploymentPlaneDeps } from "../boot/runner-deps.js";
+import type { SandboxPathEnvSlots } from "../boot/deferred-sandbox-path-env.js";
 import type { LeaderRequestBody } from "./endpoint.js";
 /**
- * leader worker 停驻行的两只 scope —— **唯一属主**(审批停驻 / 资源分片停驻各一只;保留标识见 `principal-shape.ts` 的 `RESERVED_PRINCIPALS` /
- * `RESERVED_PRINCIPAL_PREFIXES`)。worker 的 durable spec 与取消时的残留过期({@link createLeaderParkExpirer})读这同一对。
+ * leader worker 资源分片停驻行的 scope —— **唯一属主**(保留前缀见 `principal-shape.ts` 的 `RESERVED_PRINCIPAL_PREFIXES`;审批停驻那一只
+ * `LEADER_APPROVAL_SCOPE` 的属主是出生口所在的 `leader.ts`)。worker 的资源分片 spec 与取消时的残留过期({@link createLeaderParkExpirer})读这同一对。
  */
-export declare const LEADER_APPROVAL_SCOPE = "_leader";
 export declare function leaderResourceScope(workerId: string): string;
 /** 过期残留停驻要的那两口(SQL 两方言与 local 店都有;结构型,单测用假件)。 */
 export interface LeaderParkStore {
@@ -30,18 +29,6 @@ export declare function createLeaderParkExpirer(store: LeaderParkStore): (worker
     readonly workerId: string;
     readonly sessionId: string;
 }>) => Promise<LeaderParkExpiry>;
-/** leader worker 的 durable 审批座(`LeaderWireConfig.durable` 函数席每次产出的一份)。 */
-export interface LeaderDurableSeat {
-    readonly checkpointStore: CheckpointStoreFull;
-    /** [ref]:写 worker 续跑上下文的封口(`ServiceDeps.checkpointCtxSealing` 同一只;规则属主 `http/checkpoint-ctx.ts` 末段「凭据位密封」)。
-     *  worker 的续跑体只有入口词 + 子任务 objective、不带凭据位 ⇒ 实际不封任何值,但写 ctx 的每一笔都经同一只封口(没有不封的第二种写法)。 */
-    readonly ctxSealer: CheckpointCtxSealer | undefined;
-    readonly requireApproval: string[];
-    readonly deny?: string[];
-    readonly ttlMs?: number;
-    readonly autoBudget?: number;
-    readonly neverAuto?: string[];
-}
 export interface LeaderWireConfig {
     /** Static-env compat mode (E2B only): the leader provisions/owns each env. Required when `envFactory` unset. */
     e2bApiKey?: string;
@@ -49,17 +36,17 @@ export interface LeaderWireConfig {
      *  REMOTE_EXEC (e2b or k8s/Kata) — workers and the integration sandbox run on envs from THIS factory.
      *  Requires `s3` (diff-out is the worker's self-upload; there is no leader-held env to pull from). */
     envFactory?: ExecutionEnvFactory;
-    /** Durable suspend/resume for SUB-WORKERS ([ref] C4): when the seat yields a value, that worker task carries
-     *  the durable question/ask policy + checkpoint store, so a gated ask/AskUserQuestion SUSPENDS the worker
-     *  (checkpoint + paused env) instead of failing — the trigger replan-lite C4 arbitrates on. Mirrors main.ts's
-     *  per-task durable wiring; ctx is seeded at provision so the surfaced token is resumable on the single-agent path.
-     *
-     *  🔴 **函数席,不是快照**([ref] 波 2 ①;先例 = 下方 `deploymentPosture` 的 [ref] 函数席):审批名单
-     *  (`governance.approvalRequire`)自本批起在进程内会被中心热换。boot 期取一次值会把这条腿钉在起服那一刻的名单上
-     *  —— 起服时名单为空 ⇒ 整块缺席、之后加进来的工具在 leader worker 上**永远**不被门住(fail-OPEN)。
-     *  `provisionWorker` 每只 worker 调一次(同一只 worker 的 toolPolicy / resource 停车 / ctx 保温读同一份);
-     *  返回 `undefined` = 这只 worker 不接 durable 审批(与修前「键缺席」同义)。 */
-    durable?: () => LeaderDurableSeat | undefined;
+    /** 部署的停驻设施([ref] C4):键在场 ⟺ 部署接了停驻店。worker 首跑的出生点按车道决定递不递给这条腿:工厂车道 = 递(worker 的环境由它自己的 Runner
+     *  经工厂铸,停驻续得上);静态车道 = `leader.ts` 的 `staticLaneWorkerPark`(上一发布版的条件:另要任一审批名单在场,见 {@link approvalListInForce})。
+     *  递了且续跑上下文真落了 ⇒ 这条腿**耐久**(唯一读者 `leader.ts` 的 `leaderLegDurability`):停驻设施进 spec、ctx 保温、开资源分片停驻。
+     *  函数席:`provisionWorker` 每只 worker 调一次,同一只 worker 的停驻设施 / ctx 保温 / 资源分片读同一份。 */
+    durable?: () => LeaderDurableSeat;
+    /** 这台部署此刻有没有任一审批名单在场(`APPROVAL_REQUIRE` / `APPROVAL_DENY` / `APPROVAL_NEVER_AUTO`,含中心热换的那一张;装配处闭包同一个活 config,与
+     *  {@link baseline} 同源)。**唯一读者** = 静态车道 worker 的停驻设施条件(`leader.ts` 的 `staticLaneWorkerPark`,上一发布版的条件);引擎提供
+     *  「宿主声明本腿审批停驻不可续」的声明位后,那条条件退役,本席随之删。函数席:每只 worker 现读一次。 */
+    approvalListInForce: () => boolean;
+    /** 审批基线的两臂(`LeaderBirth.baseline`;装配处闭包活 config,leader 不读 config)—— 每一条腿出生时经 {@link withLeaderLeg} 按它的耐久事实取一臂。 */
+    baseline: LeaderBirth["baseline"];
     /** Durable tool-result offload store (TiDB). REQUIRED for `durable` to actually suspend: core's suspend
      *  pre-commit refuses with the default InMemoryToolResultStore (offloaded results would deref to null after
      *  a cross-replica resume) and silently falls back to the synchronous onAsk gate — which the leader does not
@@ -70,109 +57,35 @@ export interface LeaderWireConfig {
      *  the resume dies with SessionError "Entry <leafId> not found" (found live: drill c3 deny path). */
     sessionStore?: SessionStore;
     /**
-     * [ref] 件B/C/D([ref],codex R2-F1)—— 部署治理三座席,**原样递给本车道的每一只 Runner**。
-     * 主车道的 `boot/governance-seams.ts` 是唯一属主(判据、拒启、解析全在那里),本字段只是把它的产物
-     * 搬过来:一个进程里「这台部署禁哪些能力、锁了哪些键」只能有一个答案。缺席 = 与接线前逐字相同。
+     * **部署平面层**(唯一铸点 `boot/runner-deps.ts` 的 `createDeploymentPlaneDeps`;起服第 6 段交出、`boot/leader.ts` 递进来)—— 本车道的每一只
+     * `new Runner` 头一项展开它,零逐席搬运:收紧面(治理三座 / 按主体准入 resolver / MCP 撤销台账 / 部署姿态座席族 / 豁免根)、计量面(tracer /
+     * 治理窗两键)、服务表(brain / 模型目录 / 定价 / 提示词目录)、部署座 / 手带、两条披露出口(通告 / 错误汇)。新的部署键进那一层即到达这里。
+     * 🔴 **函数席**([ref] 先例):姿态族与模型目录会被中心热换,本车道的 Runner 逐调用现构 ⇒ 每只构造时现铸一份,与主车道经 swap 门换代同代。
      */
-    governance?: Pick<RunnerDeps, "compliancePostureResolver" | "lockedConfig" | "retentionPolicy">;
-    /**
-     * [ref](黑板 [ref])—— **部署姿态座席族**(readFace 四席 `readFace`/`readDenyPatterns`/`readDenyBuiltinTiers`/
-     * `readDenyBuiltinExclude` + `memoryDelegationEvidence`/`memoryProvenance`/`memoryCapturePolicy`/
-     * `delegationEntryCaps`),**原样递给本车道的每一只 Runner**。唯一属主 = `boot/runner-deps.ts` 的
-     * `buildDeploymentPostureSeats(config)`(主 runner / subRunner / run-local 的共享基座展开的就是它),
-     * `boot/leader.ts` 把**同一函数、同一 config** 的产物搬过来:一个进程里「这台部署的 READ 面 / 记忆姿态 /
-     * 委派 caps」只能有一个答案。缺席 = 展开空对象 = 五处字面量键缺席(与接线前逐字相同)。
-     * 修前(≤7.53)这五只 Runner 一席都没有:运维写的 READ_DENY_PATTERNS / MEMORY_DELEGATION_EVIDENCE 等对
-     * leader 编排的 planner / worker / repair / conflict 四类任务**静默不生效**(core 内建 deny 表仍在)。
-     *
-     * 🔴 **是 provider 不是快照**([ref] 追加,codex 对抗复审 r1 [high] 验真后修):本车道的 Runner 是
-     * **逐调用现构**的,而 [ref] 起 `config.readFace` 在进程内**会变**(center 下发的 read face 转成了
-     * `Runner.swapDeps` 热换席)。boot 期取一次值再五处复用,等于让 leader 车道永远停在起服那一刻的 READ
-     * 姿态:读面(`/v1/capabilities`、`/v1/diagnostics/wiring`)报新档、`restart.reasons` 也不再要求重启,
-     * 而**新建的 leader Runner 仍在旧档上跑** —— 组织把 `open` 收紧成 `roots` 之后这条腿还在 open,方向是
-     * fail-OPEN。改成函数席之后每只 Runner 构造时现读,与主车道经 swap 门换代**同代**;已经准备好的腿
-     * 保留它准备时的那一份(core 的自然快照语义,两条腿同律)。 */
-    deploymentPosture?: () => DeploymentPostureSeats;
+    plane: () => DeploymentPlaneDeps;
     /**
-     * 运维 `AUTONOMY`(活 config 的那一位)—— 本车道每条 leader run **出生那一拍**读一次,经 `run-entry.ts` 的 `leaderRunEntry`(入口地板 + 受理门同一只入口函数 `entryPermissionMode`)
-     * 得出这条 run 的入口体(`LeaderDeps.entry`);本 run 铸的每一条 spec 与 worker 的续跑体都从它取词。入口词是 `plan` 的 run 进不了这条车道
-     * (`leaderEntryRefusal`:worker 会话没有计划审阅通道)⇒ 出生处即以拒句收场;HTTP 受理口用同一只判据先答 422。
-     *
-     * 🔴 **函数席**(与 `deploymentPosture` / `durable` 同一条先例):`config.autonomy` 被 web-admin 原地热改,boot 期取一次值会把这条腿钉在起服那一刻。
-     * **必填**:没有 AUTONOMY 的装配递 `() => undefined` —— 缺席不是「没有地板」的合法拼法(权限轴上不许静默放宽)。
-     */
-    autonomy: () => Autonomy | undefined;
-    /**
-     * [ref]([ref])—— **计费/遥测追踪席**,原样递给本车道的每一只 Runner。唯一属主 =
-     * `boot/budget-tracing.ts` 的 `createTracer(...)`(主 runner / subRunner / hook runner 经共享基座吃的
-     * 就是它),`boot/leader.ts` 搬的是**同一只**。
-     *
-     * 🔴 为什么这一席是承重的:`src/budget.ts` 的 `createTracer` 是 `brain.call` **唯一**的记账点 ——
-     * `costQuota.add` / `fleetUsage.record` / `fleetLease.recordSpend` / `model_cost_micro_usd_total` 四个写口
-     * 全在那里(`createBrain` 自己不记账)。而 `POST /v1/leader` 的准入处**读**的正是 costQuota / fleetLease
-     * 这两个桶。缺席 ⇒ 门查的桶与花钱的手不是同一只:`MAX_PRINCIPAL_COST_USD` 与 fleet 租约对这条腿结构性
-     * 失效,而一条 leader run 扇出 ≤6 个带手 worker + planner + repair/conflict 环,全是实钱。
-     * 归因的另一半在 `leader/endpoint.ts` 的 `drive()`(ALS `withSubject`)—— 记账臂按 `currentPerson()`
-     * 分租户,只补席不包裹 = 归因恒 undefined = 假绿。缺席 ⇒ 展开空对象(与接线前逐字相同)。
+     * 部署治理折叠(`LeaderBirth.govern`;装配处闭包活 config,leader 不读 config)—— 每一条腿出生时经 {@link withLeaderLeg} 调一次。
      */
-    tracer?: RunnerDeps["tracer"];
+    govern: LeaderBirth["govern"];
     /**
-     * **部署座**(`RunnerDeps.mods`),原样递给本车道的每一只 Runner。唯一铸点 = 起服第 5 段的装配口 `assembleDeploymentMods`(本服务自铸的注册在前、
-     * 运维声明的 mod 包在后、整列过引擎准入);主 / 无手 / hook 代理 / 子代经共享基座吃的就是它,`boot/leader.ts` 搬的是**同一份**。
-     * leader 不自铸、不自己装配(一个进程两份部署注册 = 主车道与 leader 车道各按一套扩展跑)。缺失时整个部署座在这条车道上缺席:运维声明的守卫包
-     * 管不到 leader 派出的腿,拒绝计量 / 工具追踪也漏这条腿。缺席 ⇒ 展开空对象。
+     * 每条腿的 per-model 凭据席(`LeaderBirth.auth`;装配处铸,与任务面同一只活引用)—— 本车道每一只 Runner 跑的 spec 都带它:五个出生点经 {@link withLeaderLeg},
+     * planner 路由在它的 Runner 构造那一拍取一只。**必填**:没有 per-model 钥匙的装配照样递(席对每只模型答「没有自己的钥」⇒ 网关钥,与不递逐字同)。
      */
-    mods?: RunnerDeps["mods"];
+    auth: LeaderBirth["auth"];
     /**
-     * **手带**(`RunnerDeps.hands`),原样递给本车道的每一只 Runner。唯一铸点 = `boot/runner-deps.ts` 的 `buildHandsBand`(共享基座调的同一只):
-     * 前台命令超时转后台读部署旋钮 `AUTO_BACKGROUND_ON_TIMEOUT`,本车道不署名。缺失时本车道的 Runner 没有手带(超时即杀、不署名)。缺席 ⇒ 展开空对象。
+     * 腿的路径裁决的槽表(进程内唯一那一只,`boot/deferred-sandbox-path-env.ts`)。本车道**手里握着 env** 的腿 —— 静态车道的 worker、集成修复腿 ——
+     * 的 env 不是部署工厂为那条腿铸的,工厂装饰器登记不到;每一次 run 由本车道按跑它的会话号登记、run 收场即注销(守卫在沙盒车道上按会话号取真身)。
      */
-    hands?: RunnerDeps["hands"];
+    legSlots: Pick<SandboxPathEnvSlots, "bind">;
     /**
-     * [ref]([ref],[ref]-T1)—— **部署级 token 治理窗**两键,**成对**递给本车道的每一只 Runner。
-     * 属主 = `config.usageWindows`(声明)+ `boot/stores.ts` 造的账本店(两者同真同假,与
-     * `boot/runner-deps.ts` 的共享基座同规);leader 不自己读 config。
-     *
-     * 成对的理由是 core 的消费形:`prepare-task.js` 的 `buildUsageGovernance(usageWindows, deps, …)` 要求
-     * 声明与 `deps.usageWindowStore` **同时**在场才铸 `usageGovernance`,缺一即 undefined(既不 check 也不
-     * commit)⇒ 半席只是死键。缺席 ⇒ 展开空对象。
-     * 提交面那一半(`POST /v1/leader` 的 `usageWindowDenied` 门)在 `src/http/routes/leader.ts`。
-     */
-    usageWindows?: RunnerDeps["usageWindows"];
-    usageWindowStore?: RunnerDeps["usageWindowStore"];
-    /**
-     * [ref]([ref])—— **center 发布的 prompt catalog** 席,原样递给本车道的每一只 Runner。唯一属主 =
-     * `boot/web-admin.ts` 的 `webAdmin.promptSource`(主 runner / subRunner 同一只;run-local 有自己
-     * 的等价腿)。缺席 ⇒ leader 的 planner/worker/repair/conflict 四类**顶层**任务跑引擎内置提示词,而同一
-     * 部署的 `/v1/tasks`、`/v1/runs` 跑运维发布的那一份 —— 且 core 顶层新任务走的是**静默**臂(pinned /
-     * parentCenterArtifactDigest 两支才 `prompt.snapshot_unavailable` fail-loud),运维面零信号。
-     * 缺席 ⇒ 展开空对象(与接线前逐字相同)。
-     */
-    promptSource?: RunnerDeps["promptSource"];
-    /**
-     * [ref] 的**披露半件**([ref],codex 对抗复审 r2-[high],亲读装树 core 后修)—— 部署级错误汇。
-     *
-     * 🔴 为什么它与治理窗席**同生共死**:core 对「治理窗最终扣账失败」的唯一出口就是这一席 ——
-     * `dist/core/runner/runtask.js` 收尾段 `catch (flushErr) { this.deps.onError?.(flushErr, { phase: "config", … }) }`
-     * (以及 10s 慢盘披露的同一只回调),抛错之后任务**按原结果收尾**。挂了窗席却不挂本席 = 一次窗账
-     * 永久丢失时这条腿上零日志零计数,后续提交继续读偏低的窗被放行 —— CLAUDE.md [ref]「治理/门轴禁静默
-     * fail-open」正是说这个。它顺带也把 leader 车道其余 phase(degraded / rewind / memory / mcp / a2a /
-     * prompt-cache …)的既有观测面补齐,与 `onNotice` 席当年([ref]②)同一个理由。
+     * 运维 `AUTONOMY`(活 config 的那一位)—— 本车道每条 leader run **出生那一拍**读一次,经 `run-entry.ts` 的 `leaderRunEntry`(入口地板 + 受理门同一只入口函数 `entryPermissionMode`)
+     * 得出这条 run 的入口体(`LeaderDeps.birth.entry`);本 run 铸的每一条 spec 与 worker 的续跑体都从它取词。入口词是 `plan` 的 run 进不了这条车道
+     * (`leaderEntryRefusal`:worker 会话没有计划审阅通道)⇒ 出生处即以拒句收场;HTTP 受理口用同一只判据先答 422。
      *
-     * 属主唯一 = `boot/runner-deps.ts` `createRunnerDeps` 铸的那一只;`boot/leader.ts` 直引
-     * `runnerDeps.onError`(**同一实例**,[ref]§三族A 的最强同源形,与 main.ts subRunner 的先例逐字同姿势),
-     * leader 绝不另写一份臂表(两份必漂)。缺席 ⇒ 展开空对象(与接线前逐字相同)。
+     * 🔴 **函数席**(与 `deploymentPosture` / `durable` 同一条先例):`config.autonomy` 被 web-admin 原地热改,boot 期取一次值会把这条腿钉在起服那一刻。
+     * **必填**:没有 AUTONOMY 的装配递 `() => undefined` —— 缺席不是「没有地板」的合法拼法(权限轴上不许静默放宽)。
      */
-    onError?: RunnerDeps["onError"];
-    /** Worker model brain + catalog (the same the service runs tasks on). */
-    brain: Brain;
-    models: Record<string, Model>;
-    roles: ModelRoles;
-    /** The active tier table of the served catalog (boot hands the same object as `config.tiers`, mutated in place on a hot apply).
-     *  Every leader Runner gets it with `models` / `roles` (one seat, `servedTableSeat`): a role resolves in the tier-expanded view,
-     *  exactly as the main runner resolves it — absent ⇒ no tiers (the env table has none). */
-    tiers?: NonNullable<RunnerDeps["tiers"]>;
-    pricing: Record<string, ModelPricing>;
+    autonomy: () => Autonomy | undefined;
     /** Workspace root inside each E2B VM. Default /home/user. */
     workspace?: string;
     /** Git identity for the Coordinator's local clone/commit. */
@@ -198,14 +111,7 @@ export interface LeaderWireConfig {
      *  complete path; a suspended worker's paused env is exempt from the leader reap by construction) and diff-out
      *  is the worker's mandatory self-upload to this MinIO/S3 store (presigned per worker; creds adapter-held).
      *  Unset = the original leader-owned static-env mode (pullDiff compat). */
-    s3?: {
-        endpoint: string;
-        bucket: string;
-        accessKey: string;
-        secretKey: string;
-        region?: string;
-        keyPrefix?: string;
-    };
+    s3?: LeaderDiffStore;
     logger?: {
         warn?: (m: string, x?: Record<string, unknown>) => void;
         info?: (m: string, x?: Record<string, unknown>) => void;
@@ -279,6 +185,10 @@ export declare function stageWorkerEnv(env: WireEnv, opts: {
  * (URL) silently killed long autonomous builds or expired the diff upload mid-run. core's turn cap is now a
  * high net (10000), so the leader gives each worker an explicit triple bound; a sub-task's own limits override.
  */
+/** The leader's diff-out URL lifetime (`presignTtlSec` = `LEADER_TIMEOUT_MS` / 1000 + 600: the URL outlives the worker) over the SigV4 ceiling ⇒ the
+ *  refusal sentence, naming the knob and its largest value; within it ⇒ `undefined`. The runner refuses to be built with a diff-out store on such a
+ *  configuration (boot), instead of signing URLs the store would refuse at the end of a worker's run. */
+export declare function leaderDiffUrlTtlRefusal(presignTtlSec: number): string | undefined;
 export declare function leaderResourceConfig(env?: NodeJS.ProcessEnv): {
     leaderTimeoutMs: number;
     workerMaxTurns: number;