@sema-agent/server 7.150.0 → 7.152.0

package/dist/boot/execution-env.js

@@ -12,7 +12,7 @@ import { deviceExecutionEnvFactory } from "../plugins/remote-env-device.js";
 import { e2bExecutionEnvFactory } from "../plugins/remote-env-e2b.js";
 import { createWorkspaceFill } from "../plugins/workspace-fill.js";
 import { hostExecutionEnvFactory, RemoteHostExecutionEnv } from "../plugins/remote-env-host.js";
-import { boundedStoreCall, checkSandboxEgressPolicy, createSandboxPodApi, createSpaceReclaimer, k8sExecutionEnvFactory, readSandboxSecretSeat, rpcTimeoutMsOf } from "../plugins/remote-env-k8s.js";
+import { boundedStoreCall, checkSandboxEgressPolicy, createSandboxPodApi, createSpaceReclaimer, k8sExecutionEnvFactory, readSandboxApiCredentials, readSandboxSecretSeat, rpcTimeoutMsOf, sandboxApiCredentialFact } from "../plugins/remote-env-k8s.js";
 import { podSpecPatchBrokerRefusal, SANDBOX_SECRET_SEAT_VERBS } from "../plugins/k8s-exec-protocol.js";
 import { createSandboxBrokerSeatOf, createSandboxGitPlaneSeat, sandboxGitPlanePremisesOf } from "../sandbox-git-plane.js";
 import { createSandboxPodReaper } from "../plugins/k8s-pod-reaper.js";
@@ -32,11 +32,14 @@ import { reapOrphanWorktrees, withWorktreeIsolation } from "../plugins/worktree-
 import { derivePkgSourceEnv } from "../sandbox-pkg-source.js";
 import { effectiveHostWorkspace } from "../task-cwd.js";
 import { taskInheritEnvRefusal } from "../hosted-posture.js";
+import { bindingsOf } from "../session-bindings.js";
 import { sessionFaceOfHead } from "../session-incarnation.js";
 import { isCodeToken } from "../terminal.js";
 import { createCacheMissMemory } from "../workspace-cache.js";
 import { workspaceSnapshotTimeoutOf } from "../workspace-space.js";
 import { sayEgressPolicyReading } from "../sandbox-egress-policy.js";
+import { K8sApiCredentialsMissingError, k8sCredentialsMissingBootSentence, k8sCredentialsMissingRunSentence, k8sCredentialsRejectedRunSentence } from "../k8s-api-credentials.js";
+import { executionEnvRefusalError } from "../execution-env-refusal.js";
 import { sandboxPathEnvSlots, withSandboxPathEnvSlot } from "./deferred-sandbox-path-env.js";
 import { createLaneHomeAbsenceReporter } from "../lane-home-probe.js";
 import { buildLaneHomeBootNote, buildLaneHomeClaim, capabilitiesFor, laneIsolated, laneSandboxReadFloorState } from "../execution-lane-caps.js";
@@ -61,16 +64,40 @@ function sandboxLaneEnvMerged(lane) {
     return Object.keys(merged).length > 0 ? merged : undefined;
 }
 const MAX_CWD_SESSIONS = 4096;
+function withWrites(cells, writes) {
+    return bindingsOf(writes.cwd ?? cells.cwd, writes.shellEnv !== undefined ? { ...writes.shellEnv } : cells.shellEnv, writes.inheritEnv);
+}
+function restoreCell(map, sid, value) {
+    if (value === undefined)
+        map.delete(sid);
+    else
+        map.set(sid, value);
+}
 export function createSessionScopedRegistries(maxEntries = MAX_CWD_SESSIONS) {
     const perSessionCwd = new Map();
     const perSessionShellEnv = new Map();
     const perSessionInheritEnv = new Map();
     const owners = new Map();
     const occupants = new Map();
+    const logs = new Map();
+    const cellsOf = (sid) => bindingsOf(perSessionCwd.get(sid), perSessionShellEnv.get(sid), perSessionInheritEnv.get(sid));
+    const materialize = (sid, log) => {
+        const cells = log.entries.reduce((acc, e) => withWrites(acc, e.writes), log.base);
+        restoreCell(perSessionCwd, sid, cells.cwd);
+        restoreCell(perSessionShellEnv, sid, cells.shellEnv);
+        restoreCell(perSessionInheritEnv, sid, cells.inheritEnv);
+    };
+    const compact = (sid, log) => {
+        while (log.entries[0]?.settled === true)
+            log.base = withWrites(log.base, log.entries.shift().writes);
+        if (log.entries.length === 0)
+            logs.delete(sid);
+    };
     const dropSession = (sid) => {
         perSessionCwd.delete(sid);
         perSessionShellEnv.delete(sid);
         perSessionInheritEnv.delete(sid);
+        logs.delete(sid);
         owners.delete(sid);
         occupants.delete(sid);
     };
@@ -85,22 +112,34 @@ export function createSessionScopedRegistries(maxEntries = MAX_CWD_SESSIONS) {
         perSessionCwd,
         perSessionShellEnv,
         sessionOwners: owners,
-        setSessionCwd: (sid, cwd) => {
-            perSessionCwd.set(sid, cwd);
+        perSessionInheritEnv,
+        commitSessionBindings: (sid, bindings) => {
+            const log = logs.get(sid) ?? { base: cellsOf(sid), entries: [] };
+            logs.set(sid, log);
+            const token = Symbol(sid);
+            log.entries.push({ token, writes: { ...bindings, ...(bindings.shellEnv !== undefined ? { shellEnv: { ...bindings.shellEnv } } : {}) }, settled: false });
+            materialize(sid, log);
             touch(sid, undefined);
+            return { sessionId: sid, token };
         },
-        setSessionShellEnv: (sid, env) => {
-            perSessionShellEnv.set(sid, env);
-            touch(sid, undefined);
+        withdrawSessionBindings: (receipt) => {
+            const log = logs.get(receipt.sessionId);
+            const at = log?.entries.findIndex((e) => e.token === receipt.token) ?? -1;
+            if (log === undefined || at < 0)
+                return false;
+            log.entries.splice(at, 1);
+            materialize(receipt.sessionId, log);
+            compact(receipt.sessionId, log);
+            return true;
         },
-        perSessionInheritEnv,
-        setSessionInheritEnv: (sid, policy) => {
-            if (policy === undefined) {
-                perSessionInheritEnv.delete(sid);
-                return;
-            }
-            perSessionInheritEnv.set(sid, policy);
-            touch(sid, undefined);
+        settleSessionBindings: (receipt) => {
+            const log = logs.get(receipt.sessionId);
+            const entry = log?.entries.find((e) => e.token === receipt.token);
+            if (log === undefined || entry === undefined)
+                return false;
+            entry.settled = true;
+            compact(receipt.sessionId, log);
+            return true;
         },
         fenceSessionOwner: (sid, owner, incarnation) => {
             const ownerChanged = owners.has(sid) && owners.get(sid) !== owner;
@@ -113,6 +152,7 @@ export function createSessionScopedRegistries(maxEntries = MAX_CWD_SESSIONS) {
                 perSessionCwd.delete(sid);
                 perSessionShellEnv.delete(sid);
                 perSessionInheritEnv.delete(sid);
+                logs.delete(sid);
             }
             touch(sid, owner);
         },
@@ -131,6 +171,22 @@ export function ownsItsWorkspace(ctx) {
 export function createK8sRunEnvFactory(k8sCfg, seats, deps) {
     const cacheMisses = createCacheMissMemory();
     return async (ctx) => {
+        const credentials = await readSandboxApiCredentials(k8sCfg, deps);
+        switch (credentials.state) {
+            case "missing":
+                throw executionEnvRefusalError("env.sandbox_refused", k8sCredentialsMissingRunSentence(credentials.fact));
+            case "rejected":
+                throw executionEnvRefusalError("env.sandbox_refused", k8sCredentialsRejectedRunSentence());
+            case "accepted":
+                break;
+            case "unproven":
+                recordFailOpen("server.sandbox-credentials.probe-unanswered", `namespace=${k8sCfg.namespace} ${credentials.detail}`);
+                break;
+            default: {
+                const unreachable = credentials;
+                throw new Error(`unhandled api credential reading: ${String(unreachable.state)}`);
+            }
+        }
         const onWorkspaceSnapshot = createRunWorkspaceSnapshotSeat(ctx.sessionId);
         const child = !ownsItsWorkspace(ctx);
         const s3Snapshot = child && k8sCfg.s3Snapshot !== undefined ? spaceOff(k8sCfg.s3Snapshot) : k8sCfg.s3Snapshot;
@@ -250,15 +306,14 @@ export function createExecutionEnv(ctx) {
     const perTaskImage = new PerTaskImageRegistry();
     const sessionEnvSelection = new SessionEnvironmentSelection();
     const sessionScoped = createSessionScopedRegistries();
-    const { perSessionCwd, setSessionCwd } = sessionScoped;
-    const { perSessionShellEnv, setSessionShellEnv } = sessionScoped;
-    const { perSessionInheritEnv, setSessionInheritEnv } = sessionScoped;
+    const { perSessionCwd, perSessionShellEnv, perSessionInheritEnv } = sessionScoped;
     const lspManager = createLspManager(config, (event, fields) => logger.info(event, fields));
     if (lspManager)
         logger.info("lsp_enabled", { provider: config.remoteExec.provider });
     let executionEnvFactory;
     let spaceReclaimer;
     let sandboxSecretSeatGate;
+    let sandboxApiCredentialsGate;
     let sandboxReaper;
     let sandboxCapacity;
     let sandboxGitPlane = createSandboxGitPlaneSeat((r) => sandboxGitPlanePremisesOf(config, r), {});
@@ -319,9 +374,16 @@ export function createExecutionEnv(ctx) {
             spaceReclaimer = createSpaceReclaimer(k8sCfg);
         sandboxSecretSeatGate = () => ensureSandboxSecretSeat(k8sCfg, logger, undefined, () => readSandboxSecretSeat(k8sCfg, "env"));
         sandboxReaper = createSandboxPodReaper({ api: createSandboxPodApi(k8sCfg), logger, metrics });
-        void checkSandboxEgressPolicy(k8sCfg)
-            .then((gaps) => sayEgressPolicyReading(gaps, logger, k8sCfg.namespace))
-            .catch((e) => logger.error("sandbox_egress_policy_check_crashed", { error: seatText("operator-log-text", e instanceof Error ? e.message : String(e)), effect: "the sandbox egress self-check did not complete this boot — the lane runs; the egress policy was not read" }));
+        const missingApiCredential = sandboxApiCredentialFact(k8sCfg, ctx.laneDeps?.k8s);
+        sandboxApiCredentialsGate = () => {
+            if (missingApiCredential !== undefined)
+                throw new K8sApiCredentialsMissingError(k8sCredentialsMissingBootSentence(missingApiCredential));
+        };
+        if (missingApiCredential === undefined) {
+            void checkSandboxEgressPolicy(k8sCfg, ctx.laneDeps?.k8s)
+                .then((gaps) => sayEgressPolicyReading(gaps, logger, k8sCfg.namespace))
+                .catch((e) => logger.error("sandbox_egress_policy_check_crashed", { error: seatText("operator-log-text", e instanceof Error ? e.message : String(e)), effect: "the sandbox egress self-check did not complete this boot — the lane runs; the egress policy was not read" }));
+        }
     }
     else if (config.remoteExec.provider === "ssh") {
         executionEnvFactory = sshExecutionEnvFactory({
@@ -533,12 +595,13 @@ export function createExecutionEnv(ctx) {
         },
     });
     return {
-        perTaskImage, sessionEnvSelection, perSessionCwd, setSessionCwd, setSessionShellEnv, setSessionInheritEnv,
+        perTaskImage, sessionEnvSelection, perSessionCwd,
+        sessionBindings: { commitSessionBindings: sessionScoped.commitSessionBindings, withdrawSessionBindings: sessionScoped.withdrawSessionBindings, settleSessionBindings: sessionScoped.settleSessionBindings },
         fenceSessionOwner: sessionScoped.fenceSessionOwner,
         dropSessionScoped: sessionScoped.dropSession,
         dropSessionScopedOf: sessionScoped.dropSessionOf,
         sessionResidentBackground,
-        executionEnvFactory, worktreeReap, sendUserFileTaskEnvs, lspManager, spaceReclaimer, sandboxSecretSeatGate, sandboxReaper, sandboxGitPlane,
+        executionEnvFactory, worktreeReap, sendUserFileTaskEnvs, lspManager, spaceReclaimer, sandboxApiCredentialsGate, sandboxSecretSeatGate, sandboxReaper, sandboxGitPlane,
         sandboxCapacity,
     };
 }

package/dist/boot/execution-lane.js

@@ -1,7 +1,7 @@
 import { loadRemoteExec } from "@sema-agent/settings-schema/node";
 import { assertLocalConfigDirTrusted } from "../config-dir-trust.js";
 import { crossInvariant } from "../config-invariants.js";
-import { entryDeclarableRemoteExec } from "../config.js";
+import { entryDeclarableRemoteExec, FILE_LANE_CELL_ENV, logConfigDiagnostics, parseHostLaneEnv, parseLocalDockerLaneEnv, } from "../config.js";
 import { ALL_EXECUTION_LANES, buildReadDenyFloorUnkeptNote, laneIsolated, laneWiresExecutionEnv } from "../execution-lane-caps.js";
 import { installReadDenyFloorDeployment } from "../read-deny-floor-notice.js";
 import { buildReadFacePostureNotice, settleDerivedReadFace } from "../read-face-posture.js";
@@ -27,6 +27,29 @@ function fileLaneUnresolvableRefusal(entry, lane, envReading, root) {
         `(file-source name→value resolution is not wired yet), and ${envReading}. The file's declaration ends the lane selection: no other declaration may stand in for it. ` +
         `Refusing before any task starts: set REMOTE_EXEC=${lane} with that lane's required env, or change the file to the lane you mean.`);
 }
+function envReadingOfFileLane(minted, read, logger) {
+    if (minted !== undefined)
+        return minted;
+    const reading = read();
+    logConfigDiagnostics(logger);
+    return reading;
+}
+function discloseFileCellOverrides(lane, envReading, fileCells, logger, root) {
+    const cellEnvKeys = FILE_LANE_CELL_ENV[lane];
+    const keys = Object.entries(cellEnvKeys)
+        .filter(([cell]) => envReading[cell] !== undefined && fileCells[cell] !== undefined && envReading[cell] !== fileCells[cell])
+        .map(([, envKey]) => envKey);
+    if (keys.length === 0)
+        return;
+    logger.warn("remote_exec_file_overrides", {
+        provider: lane,
+        root,
+        keys,
+        note: `config.d/remote-exec.json (CONFIG_PROVIDER=local, file-wins) gives a different value than env for ${keys.join(", ")} on the "${lane}" lane — the file's value is in effect and ` +
+            `the env value for ${keys.length === 1 ? "that key is" : "those keys are"} INERT. The lane's other env parameters are read as usual. ` +
+            `Make the two agree: unset the env key if the file's value is the intended one, or change the file's cell (an optional cell can be removed from the file; "image" is mandatory there).`,
+    });
+}
 export async function composeExecutionLane(loaded, ctx) {
     if (ctx.configSource === "local")
         await applyRemoteExecFile(loaded, ctx);
@@ -127,25 +150,29 @@ async function applyRemoteExecFile(config, ctx) {
     };
     const drives = (lane) => ctx.entry.runs.includes(lane);
     if (fileRx.provider === "host" && drives("host")) {
-        config.remoteExec = {
-            provider: "host",
+        const envReading = envReadingOfFileLane(config.remoteExec?.provider === "host" ? config.remoteExec : undefined, parseHostLaneEnv, logger);
+        const fileCells = {
             ...(fileRx.workdir ? { workspaceBase: fileRx.workdir } : {}),
             ...(fileRx.commandTimeoutMs != null ? { commandTimeoutMs: fileRx.commandTimeoutMs } : {}),
         };
+        config.remoteExec = { provider: "host", ...envReading, ...fileCells };
         disclosePreemption("host");
+        discloseFileCellOverrides("host", envReading, fileCells, logger, localRoot);
         logger.info("remote_exec_from_file", { provider: "host", root: localRoot });
         return;
     }
     if (fileRx.provider === "local-docker" && drives("local-docker")) {
-        config.remoteExec = {
-            provider: "local-docker",
+        const envReading = envReadingOfFileLane(config.remoteExec?.provider === "local-docker" ? config.remoteExec : undefined, () => parseLocalDockerLaneEnv(config.requirePrincipal !== true), logger);
+        const fileCells = {
             image: fileRx.image,
             ...(fileRx.mountPath ? { mountPath: fileRx.mountPath } : fileRx.workdir ? { mountPath: fileRx.workdir } : {}),
             ...(fileRx.memory ? { memory: fileRx.memory } : {}),
             ...(fileRx.cpus != null ? { cpus: fileRx.cpus } : {}),
             ...(fileRx.network ? { network: fileRx.network } : {}),
         };
+        config.remoteExec = { provider: "local-docker", ...envReading, ...fileCells };
         disclosePreemption("local-docker");
+        discloseFileCellOverrides("local-docker", envReading, fileCells, logger, localRoot);
         logger.info("remote_exec_from_file", { provider: "local-docker", root: localRoot, image: fileRx.image });
         return;
     }

package/dist/boot/late-binds.d.ts

@@ -1,5 +1,5 @@
 /**
- * 晚绑席([ref] 十段切分的**唯一**跨段可变面)—— 五只 cell,读点在前段、写点在后段。
+ * 晚绑席([ref] 十段切分的**唯一**跨段可变面)—— 六只 cell,读点在前段、写点在后段。
  *
  * 为什么是模块级 live binding 而不是 ctx 字段:读点的原文是**裸标识符**(`() => runStore`、
  * `() => parkedAskRedeem`),而 ctx 字段是**快照** —— 把读点改成 `ctx.runStore` 就是正文改写,
@@ -9,9 +9,10 @@
  *  · `parkedAskRedeem` / `runDenySweep` —— 它们的**声明行本身**就是 `let`(逐字搬进本文件,含缩进),
  *    赋值点(server 造出来之后那两处)也随之搬进 `bindServerLateSeats` —— 跨模块给 import 赋值是非法的,
  *    所以 cell 与它的写点必须同居一个模块;
- *  · `sessionNotifyDoor` —— 同上一形(server 的产物,写点在 `bindServerLateSeats`)。
+ *  · `sessionNotifyDoor` / `runEndedHandoff` —— 同上一形(server 的产物,写点在 `bindServerLateSeats`);
+ *  · `sessionAgeOut` —— 会话老化腿(`boot/session-age-out.ts`):读点在第 8 段的维护拍,它要的删除协调器在第 9 段铸 ⇒ 写点 `bindSessionAgeOut` 在第 9 段协调器之后。
  *
- * 时序与修前逐字相同:五只 cell 的读点全是 `() => x` 取值闭包(boot 期不求值,最早的求值发生在
+ * 时序与修前逐字相同:六只 cell 的读点全是 `() => x` 取值闭包(boot 期不求值,最早的求值发生在
  * listen 之后的请求/tick 上),写点仍在各自原来的那一拍。未绑窗内取值得到 `undefined` —— 这正是
  * 各消费座既有的 fail-closed 臂(device 限速座:`gate()` 取不到就抛,见 boot/device-lane.ts:68)。
  */
@@ -27,7 +28,10 @@ declare let rateLimiter: RateGate | undefined;
 declare let parkedAskRedeem: ParkedAskRedeem | undefined;
 declare let runDenySweep: ((now: number) => Promise<void>) | undefined;
 declare let sessionNotifyDoor: SessionNotifyDoor | undefined;
-export { runStore, rateLimiter, parkedAskRedeem, runDenySweep, sessionNotifyDoor };
+declare let runEndedHandoff: ((runId: string) => Promise<void>) | undefined;
+declare let sessionAgeOut: (() => Promise<unknown>) | undefined;
+export { runStore, rateLimiter, parkedAskRedeem, runDenySweep, sessionNotifyDoor, runEndedHandoff, sessionAgeOut };
+export declare function bindSessionAgeOut(v: (() => Promise<unknown>) | undefined): void;
 export declare function bindRunStore(v: ReturnType<StoreBackend["run"]> | undefined): void;
 export declare function bindRateLimiter(v: RateGate): void;
 export declare function bindServerLateSeats(ctx: {

package/dist/boot/late-binds.js

@@ -3,7 +3,12 @@ let rateLimiter;
 let parkedAskRedeem;
 let runDenySweep;
 let sessionNotifyDoor;
-export { runStore, rateLimiter, parkedAskRedeem, runDenySweep, sessionNotifyDoor };
+let runEndedHandoff;
+let sessionAgeOut;
+export { runStore, rateLimiter, parkedAskRedeem, runDenySweep, sessionNotifyDoor, runEndedHandoff, sessionAgeOut };
+export function bindSessionAgeOut(v) {
+    sessionAgeOut = v;
+}
 export function bindRunStore(v) {
     runStore = v;
 }
@@ -14,6 +19,7 @@ export function bindServerLateSeats(ctx) {
     const { config, logger, server } = ctx;
     runDenySweep = server.denyExpiredApprovals;
     sessionNotifyDoor = server.sessionNotifyDoor;
+    runEndedHandoff = server.handOverRunEndedDecisions;
     if (!config.directDoorActive)
         parkedAskRedeem = server.redeemParkedAsk;
     else

package/dist/boot/leader.d.ts

@@ -7,51 +7,35 @@
  * (工厂模式的 k8s/host 腿以 `executionEnvFactory` 在场为门;durable 子 worker 挂 `checkpointStore`)。
  */
 import type { ServiceConfig } from "../config.js";
-import type { createBrain } from "../brain.js";
-import type { buildPricing } from "../budget.js";
 import { createLeaderEndpoint } from "../leader/endpoint.js";
+import type { LeaderBirth } from "../leader/leader.js";
 import type { Logger } from "../observability/logger.js";
 import type { CheckpointStoreFull, StoreBackend, ToolResultStoreFull } from "../plugins/store-backend.js";
 import type { createSessionStore } from "../plugins/session-store.js";
-import type { RunnerDeps } from "@sema-agent/core";
+import { type RunnerDeps } from "@sema-agent/core";
+import type { DeploymentPlaneDeps, DeploymentPlaneLane } from "./runner-deps.js";
+import { type KeyResolver } from "./side-query-lane.js";
 export interface LeaderCtx {
     config: ServiceConfig;
     logger: Logger;
-    brain: ReturnType<typeof createBrain>;
-    pricing: ReturnType<typeof buildPricing>;
+    /** 本部署的本地店根(`config.localDataRoot` 缺席时的回落;host 车道上守卫裁决的哨兵目录挂在它下面,与 HTTP 腿同一处)。 */
+    localRoot: string;
     executionEnvFactory: RunnerDeps["executionEnvFactory"];
     toolResultStore: ToolResultStoreFull | undefined;
     sessionStore: ReturnType<typeof createSessionStore>;
     checkpointStore: CheckpointStoreFull | undefined;
     /** [ref]:停驻行凭据的封签器(与 HTTP 面 `ServiceDeps.checkpointCtxSealing` 同一只;起服第 6 段已对「店在、它不在」拒启)。必填键,值可为 undefined。 */
     checkpointCtxSealing: import("../http/checkpoint-ctx.js").CheckpointCtxSealing | undefined;
-    /** [ref] 件B/C/D([ref],codex R2-F1):部署治理三座席 —— leader 车道的每一只 Runner 都要带上它,
-     *  否则开了 leader 端点的部署就有一条在部署治理**之外**的执行面(合规否决/锁都够不着)。 */
-    governanceSeams: import("./governance-seams.js").GovernanceSeams;
     /**
-     * [ref]([ref])—— 主车道 `boot/budget-tracing.ts` 造的**同一只** tracer。leader 车道的每一只 Runner
-     * 都要带:tracer 是 `brain.call` 的唯一记账点(costQuota / fleetUsage / fleetLease / 花费计数四个写口),
-     * 而 `POST /v1/leader` 的准入处**读**的正是它填的那两个桶 —— 缺席 = 门查的桶与花钱的手不是同一只。
-     *
-     * 🔴 **必填键**(值可为 undefined):这三席都刻意写成非可选,让「main.ts 铸了却忘了递」变成**编译红**
-     * 而不是又一次静默漏配([ref]§三族A 病族的机器护栏)。
+     * **部署平面层**的铸口(起服第 6 段交出:与主 / 子 Runner 的平面层同一组输入 —— config / brain / 计量 / 治理座 / 按主体准入 resolver / 豁免根 /
+     * 错误汇 …)。leader 车道的每一只 Runner 展开它的产物,零逐席搬运;新的部署键进平面层即到达 leader。
      */
-    tracer: RunnerDeps["tracer"];
-    /** [ref]([ref],[ref]-T1)—— 治理窗**账本店**(与 `config.usageWindows` 声明成对;声明直接从
-     *  本 ctx 的 config 取,leader 不另读)。缺席 = 未配治理窗的部署。必填键,理由同 `tracer`。 */
-    usageWindowStore: RunnerDeps["usageWindowStore"];
-    /** [ref]([ref])—— center 发布的 prompt catalog(`webAdmin.promptSource`,与主 runner/subRunner
-     *  同一只)。缺席 ⇒ leader 的四类顶层任务跑引擎内置提示词,而同部署其余三条腿跑运维发布的那一份,
-     *  且 core 顶层新任务是**静默**落回(无 notice)。必填键,理由同 `tracer`。 */
-    promptSource: RunnerDeps["promptSource"];
-    /** [ref] 披露半件([ref],codex r2-[high])—— 主车道 `createRunnerDeps` 铸的**同一只**错误汇
-     *  (main.ts 直引 `runnerDeps.onError`,与 subRunner 的先例同姿势)。core 对治理窗**最终扣账失败**的
-     *  唯一出口就是它(`runtask.js` 的 `catch (flushErr) => deps.onError`),所以它与 `usageWindowStore`
-     *  席同生共死:挂窗不挂汇 = 治理轴上的静默失败面([ref])。必填键,理由同 `tracer`。 */
-    onError: RunnerDeps["onError"];
-    /** 部署座 —— 起服第 5 段装配口 `assembleDeploymentMods` 交回的**同一份**(主车道各 Runner 经共享基座吃的就是它)。leader 车道的每一只 Runner 都要带:
-     *  缺席 = 运维声明的 mod 包管不到 leader 派出的腿。必填键,理由同 `tracer`。 */
-    deploymentMods: NonNullable<RunnerDeps["mods"]>;
+    deploymentPlane: (lane: DeploymentPlaneLane) => DeploymentPlaneDeps;
+    /**
+     * per-model 凭据的**活引用**(`webAdmin.getKeyResolver`:中心每次 apply 整只重铸 resolver ⇒ 递取值口,不递当时的值;任务面 / side-query / WebFetch 摘要面同一只)。
+     * leader 车道每条腿的凭据席由它铸({@link createLeaderLegAuth})。必填:没有 web-admin 的装配递 `() => undefined`(每只模型落网关钥,与不配 per-model 钥匙同)。
+     */
+    getKeyResolver: () => KeyResolver;
     /** [ref] 车4 件1:durable store 后端(leader-run 登记表从这里取)。缺席 = 无 DB 的 env-only worker。 */
     backend?: StoreBackend | undefined;
 }
@@ -96,5 +80,22 @@ export declare function buildLeaderObjectStore(env?: NodeJS.ProcessEnv): {
         region?: string;
     };
 };
+/**
+ * leader 车道每条腿**出生时**的两只部署席({@link LeaderBirth} 的 `govern` / `baseline`)—— 装配处闭包活 config 的唯一铸点:起服 {@link createLeaderFace} 递进
+ * wire,部署治理矩阵(`test/operator-knob-client-posture-matrix.test.ts`)的 leader 腿经同一只函数装,矩阵测的就是起服装上的那一份。
+ *  · `govern` —— 部署治理折叠(R3):每条腿出生时调一次,读活 config(热改的 AUTONOMY / commandPolicy / 守卫集对之后出生的腿生效;续跑腿经 resolveSpec 同读)。
+ *    腿的路径裁决经唯一属主:沙盒车道按跑这条腿的会话号取真身;host 车道的 worker 落在工厂才铸的目录里、spec 期不可知 ⇒ 永不创建的哨兵目录
+ *    (与 HTTP 腿未登记工作目录的形同一处,相对目标解析不出真身 ⇒ 守卫的 fail-closed 臂)。
+ *  · `baseline` —— 审批基线的两臂(🔴 **函数席**,[ref] 波 2 ①:审批名单会被中心热换 ⇒ 每条腿出生时现调唯一属主 `createApprovalBaselinePolicy`,与 HTTP 腿 /
+ *    停驻赎回腿同一只构造):耐久腿取 durable 臂(问答门 + 三张名单),不耐久腿取 live 臂(三张名单,问由无人值守层服 —— 答不了即拒)。
+ */
+export declare function createLeaderLegGovernance(config: ServiceConfig, localRoot: string, logger: Logger): Pick<LeaderBirth, "govern" | "baseline">;
+/**
+ * leader 车道每条腿的 **per-model 凭据席**({@link LeaderBirth} 的 `auth`)—— 唯一铸点;席本身是 side-query / WebFetch 摘要面同一只工厂 `createPerModelAuthSeat`
+ * (spec 自带的席折成 `upstream`:先问它、它没意见才按模型解;不覆盖。声明了钥匙却拿不到 ⇒ 抛,与任务面同一只毒丸,绝不回落网关钥)。
+ * 律(与任务面 `resolveSpec` 同读法:spec 出生那一拍从活引用取值):resolver 在**腿出生那一拍**取一次 —— 那一拍与这条腿的 Runner 构造同一同步段,Runner 构造时把模型目录
+ * 收成私有副本,所以钥与目录同代;中心 apply 之后出生的腿取到新的那一只。不按调用现取:在飞腿的目录是上一代,现取会把新家的钥配上旧家的端点。
+ */
+export declare function createLeaderLegAuth(getKeyResolver: () => KeyResolver): LeaderBirth["auth"];
 export declare function createLeaderFace(ctx: LeaderCtx): ReturnType<typeof createLeaderEndpoint> | undefined;
 //# sourceMappingURL=leader.d.ts.map

package/dist/boot/leader.js

@@ -2,9 +2,15 @@ import { createLeaderEndpoint } from "../leader/endpoint.js";
 import { seesRunAs } from "../http/owner-access.js";
 import { claimCallerOf } from "../security.js";
 import { createLeaderParkExpirer, createLeaderRunner } from "../leader/wire.js";
-import { buildDeploymentPostureSeats, buildHandsBand } from "./runner-deps.js";
+import { join } from "node:path";
+import { NodeExecutionEnv } from "@sema-agent/core";
+import { applyRuntimeGovernance } from "../runtime-governance.js";
+import { createApprovalBaselinePolicy, createDeploymentGovernanceInputs } from "../deployment-governance.js";
 import { hasApprovalListIntent } from "../approval.js";
+import { createLegPathAdjudication } from "./leg-path-adjudication.js";
+import { sandboxPathEnvSlots } from "./deferred-sandbox-path-env.js";
 import { WORKSPACE_SNAPSHOT_BUCKET_DEFAULT } from "../object-store-buckets.js";
+import { createPerModelAuthSeat } from "./side-query-lane.js";
 export function leaderK8sMinioGap(leaderEnabled, leaderProvider, hasS3) {
     if (!(leaderEnabled && leaderProvider === "k8s" && !hasS3))
         return null;
@@ -31,8 +37,27 @@ export function buildLeaderObjectStore(env = process.env) {
         return {};
     return { s3: { endpoint, bucket: env.MINIO_BUCKET ?? WORKSPACE_SNAPSHOT_BUCKET_DEFAULT, accessKey, secretKey, ...(env.MINIO_REGION ? { region: env.MINIO_REGION } : {}) } };
 }
+export function createLeaderLegGovernance(config, localRoot, logger) {
+    return {
+        govern: (spec, legSessionId) => applyRuntimeGovernance(spec, createDeploymentGovernanceInputs(config, createLegPathAdjudication(config, {
+            sessionId: legSessionId,
+            leg: "leader",
+            hostArm: () => {
+                const gateCwd = join(config.localDataRoot ?? localRoot, "fs-write-gate-unrooted");
+                return { env: new NodeExecutionEnv({ cwd: gateCwd }), cwd: gateCwd };
+            },
+        }, { slots: sandboxPathEnvSlots, logger }))),
+        baseline: (kind) => createApprovalBaselinePolicy(config, { kind }),
+    };
+}
+export function createLeaderLegAuth(getKeyResolver) {
+    return (upstream) => {
+        const resolver = getKeyResolver();
+        return createPerModelAuthSeat(() => resolver, upstream !== undefined ? { upstream } : {});
+    };
+}
 export function createLeaderFace(ctx) {
-    const { config, logger, brain, pricing, executionEnvFactory, toolResultStore, sessionStore, checkpointStore, checkpointCtxSealing, governanceSeams } = ctx;
+    const { config, logger, executionEnvFactory, toolResultStore, sessionStore, checkpointStore, checkpointCtxSealing } = ctx;
     const leaderMinio = buildLeaderObjectStore();
     const leaderProvider = config.remoteExec.provider;
     const leaderRunStore = ctx.backend?.leaderRun?.();
@@ -45,22 +70,12 @@ export function createLeaderFace(ctx) {
             (leaderProvider === "k8s" && "s3" in leaderMinio && executionEnvFactory) ||
             (leaderProvider === "host" && executionEnvFactory))
         ? createLeaderEndpoint(createLeaderRunner({
-            brain, models: config.models, roles: config.roles, tiers: config.tiers, pricing, logger,
-            governance: {
-                compliancePostureResolver: governanceSeams.compliancePostureResolver,
-                lockedConfig: governanceSeams.lockedConfig,
-                retentionPolicy: governanceSeams.retentionPolicy,
-            },
-            deploymentPosture: () => buildDeploymentPostureSeats(config),
+            logger,
+            plane: () => ctx.deploymentPlane({ commitCoAuthor: undefined }),
+            ...createLeaderLegGovernance(config, ctx.localRoot, logger),
+            auth: createLeaderLegAuth(ctx.getKeyResolver),
+            legSlots: sandboxPathEnvSlots,
             autonomy: () => config.autonomy,
-            ...(ctx.tracer ? { tracer: ctx.tracer } : {}),
-            ...(config.usageWindows && ctx.usageWindowStore
-                ? { usageWindows: config.usageWindows, usageWindowStore: ctx.usageWindowStore }
-                : {}),
-            ...(ctx.promptSource ? { promptSource: ctx.promptSource } : {}),
-            ...(ctx.onError ? { onError: ctx.onError } : {}),
-            mods: ctx.deploymentMods,
-            hands: buildHandsBand(config, undefined),
             fanoutEnabled: config.leaderFanoutEnabled,
             ...(process.env.MODEL_ROUTER_ID ? { routerModel: process.env.MODEL_ROUTER_ID } : {}),
             ...(leaderProvider === "e2b" ? { e2bApiKey: config.remoteExec.apiKey } : {}),
@@ -69,19 +84,14 @@ export function createLeaderFace(ctx) {
             ...(toolResultStore ? { toolResultStore } : {}),
             ...(leaderProvider === "k8s" ? { workspace: "/workspace" } : {}),
             sessionStore,
+            approvalListInForce: () => hasApprovalListIntent(config),
             ...(checkpointStore
                 ? {
-                    durable: () => hasApprovalListIntent(config)
-                        ? {
-                            checkpointStore,
-                            ctxSealer: checkpointCtxSealing,
-                            requireApproval: config.approvalRequire,
-                            deny: config.approvalDeny,
-                            autoBudget: config.approvalAutoBudget,
-                            neverAuto: config.approvalNeverAuto,
-                            ...(config.approvalTimeoutSec > 0 ? { ttlMs: config.approvalTimeoutSec * 1000 } : {}),
-                        }
-                        : undefined,
+                    durable: () => ({
+                        checkpointStore,
+                        ctxSealer: checkpointCtxSealing,
+                        ...(config.approvalTimeoutSec > 0 ? { ttlMs: config.approvalTimeoutSec * 1000 } : {}),
+                    }),
                 }
                 : {}),
         }), {

package/dist/boot/leg-path-adjudication.d.ts

@@ -0,0 +1,40 @@
+/**
+ * **腿的路径裁决**(守卫集 / 写门裁决用的 env 与基准)—— 唯一属主。读者三处同调:HTTP 提交 / 续跑腿(`boot/resolve-spec.ts`)、停驻赎回腿
+ * (`boot/parked-revive-gate.ts`)、leader 车道的每一条腿(`boot/leader.ts` 交给出生口的治理折叠)。
+ *
+ * 律(一句):车道分形只问部署形表一行(`sandboxPathAdjudication`)—— 文件平面不在本进程盘上 ⇒ 代理({@link DeferredSandboxPathEnv})在裁决时刻按
+ * **这条腿的会话号**去槽表取那台真沙盒;在本进程盘上 ⇒ 腿自己给的 host 臂(真 fs;cwd / 真任务根是腿的知识,本口不猜)。两臂同带执行环境的 home
+ * (`~/` 形规则的基,唯一属主 `executionLaneHomeDir`)。
+ *
+ * 槽表的写者:部署工厂的装饰器(`withSandboxPathEnvSlot`,工厂铸的 env 按 `ctx.sessionId` 登记),以及**手里握着 env 的腿**自己登记 —— leader 的静态
+ * 车道 worker 与集成修复腿的 env 不是部署工厂为那条腿铸的,由 leader 按跑它的会话号登记进**同一只**槽表(`leader/wire.ts`)。没登记 ⇒ 代理取不到真身
+ * ⇒ 守卫 fail-closed(每一次结构化写被拒)—— 方向对,但那是把腿瘫痪,所以登记是承重的。
+ */
+import type { ServiceConfig } from "../config.js";
+import type { PathAdjudication } from "../deployment-governance.js";
+import { DEPLOYMENT_SHAPE_PREDICATES } from "../deployment-shape.js";
+import { executionLaneHomeDir } from "../execution-lane-caps.js";
+import { type SandboxPathEnvSlots } from "./deferred-sandbox-path-env.js";
+/** 本口读的部署切面:车道形(部署形表行的输入)+ 执行环境 home 的运维声明。 */
+export type LegPathAdjudicationConfigView = Parameters<typeof DEPLOYMENT_SHAPE_PREDICATES.sandboxPathAdjudication.holds>[0] & Parameters<typeof executionLaneHomeDir>[0] & {
+    readonly remoteExec: ServiceConfig["remoteExec"];
+};
+/** 一条腿在裁决面上的位置。 */
+export interface LegPathPlace {
+    /** 槽表的键 = 跑这条腿的会话号(沙盒车道上代理按它取真身)。缺席 ⇒ 代理恒 fail-closed。 */
+    readonly sessionId: string | undefined;
+    /** 槽取不到时那一行 warn 上的腿名(缺席 = 不写这个字段)。 */
+    readonly leg?: string;
+    /** host 语义车道上这条腿的真 fs 裁决(env + 相对基准 + 真任务根):每条腿各有自己的 cwd 知识,本口只在 host 车道调它。 */
+    readonly hostArm: () => Pick<PathAdjudication, "env" | "cwd" | "taskRoot">;
+}
+/** 代理的两件(进程内唯一的槽表 + 留痕面)。 */
+export interface LegPathSeat {
+    readonly slots: SandboxPathEnvSlots;
+    readonly logger: {
+        warn: (event: string, fields?: Record<string, unknown>) => void;
+    };
+}
+/** 活对象(代理 env)⇒ `create*`。每次调用现铸(读活 config;代理每实例留痕一次)。 */
+export declare function createLegPathAdjudication(config: LegPathAdjudicationConfigView, place: LegPathPlace, seat: LegPathSeat): PathAdjudication;
+//# sourceMappingURL=leg-path-adjudication.d.ts.map

package/dist/boot/leg-path-adjudication.js

@@ -0,0 +1,18 @@
+import { DEPLOYMENT_SHAPE_PREDICATES } from "../deployment-shape.js";
+import { executionLaneHomeDir } from "../execution-lane-caps.js";
+import { DeferredSandboxPathEnv } from "./deferred-sandbox-path-env.js";
+export function createLegPathAdjudication(config, place, seat) {
+    const home = executionLaneHomeDir(config);
+    const homeBase = home !== undefined ? { taskHome: home } : {};
+    if (!DEPLOYMENT_SHAPE_PREDICATES.sandboxPathAdjudication.holds(config))
+        return { ...place.hostArm(), ...homeBase };
+    return {
+        env: new DeferredSandboxPathEnv({
+            sessionId: place.sessionId,
+            slots: seat.slots,
+            logger: { warn: (event, fields) => seat.logger.warn(event, { ...(fields ?? {}), lane: config.remoteExec.provider, ...(place.leg !== undefined ? { leg: place.leg } : {}) }) },
+        }),
+        ...homeBase,
+    };
+}
+//# sourceMappingURL=leg-path-adjudication.js.map

package/dist/boot/memory-consolidation.d.ts

@@ -326,8 +326,9 @@ export declare function judgeConsolidationValve(input: ConsolidationValveInput):
 export declare function buildConsolidationValveAudit(input: {
     /** 阀门判决({@link resolveConsolidationValve} 的 `enabled` + `source`)。 */
     valve: Pick<ConsolidationValve, "enabled" | "source">;
-    /** 这台部署配了任何一把 service 凭证吗(`config.authToken` 或 `config.authTokens` 非空)。 */
-    hasServiceAuth: boolean;
+    /** 这台部署接没接任何一类过凭据门的来源(service 凭据 / 鉴权桥;部署形表行 `credentialGateSource`,写门律 5 在部署上的投影)。
+     *  没接 ⇒ 没有一次请求过得了写门(逃生口之外)。 */
+    credentialGateSource: boolean;
     /** 本地开发的显式逃生口(`ALLOW_UNAUTHED_WRITES=true`)。 */
     allowUnauthedWrites: boolean;
 }): {

package/dist/boot/memory-consolidation.js

@@ -282,17 +282,17 @@ export function buildConsolidationValveAudit(input) {
     if (!input.valve.enabled || input.valve.source !== "explicit")
         return { warnings: [] };
     const warnings = [];
-    if (!input.hasServiceAuth && !input.allowUnauthedWrites) {
+    if (!input.credentialGateSource && !input.allowUnauthedWrites) {
         warnings.push({
             tag: "memory_consolidation_run_credential_gated",
-            detail: "MEMORY_CONSOLIDATION_DRIVER=on armed the consolidation valve, but this worker has NO service credential " +
-                "(SERVICE_AUTH_TOKEN / per-system tokens are unset) and ALLOW_UNAUTHED_WRITES is not on. POST " +
+            detail: "MEMORY_CONSOLIDATION_DRIVER=on armed the consolidation valve, but this worker accepts NO credential on its write face " +
+                "(SERVICE_AUTH_TOKEN / per-system tokens are unset and no SSO bridge verifies registry sign-in tokens) and ALLOW_UNAUTHED_WRITES is not on. POST " +
                 "/v1/admin/memory/consolidation/run runs the model, so it rides the billable-submit gate and is refused " +
-                "with 503 auth.service_token_required BEFORE it reaches the route — while capabilities." +
+                "with 503 auth.service_token_required BEFORE it reaches the route for every caller — while capabilities." +
                 "memoryConsolidationDriver still reports true (a family-wide gap this worker shares with adoption / memory " +
                 "bundle / memory compliance; it is documented, not silently accepted). GET /v1/admin/memory/consolidation " +
-                "is unaffected (it runs no model). Set SERVICE_AUTH_TOKEN, or set ALLOW_UNAUTHED_WRITES=true for local " +
-                "development only.",
+                "is unaffected (it runs no model). Set SERVICE_AUTH_TOKEN (or configure the SSO bridge, AUTH_BRIDGE_ISSUER, so verified " +
+                "sign-in tokens pass), or set ALLOW_UNAUTHED_WRITES=true for local development only.",
         });
     }
     return { warnings };