@sema-agent/server 7.150.0 → 7.152.0

package/dist/boot/parked-revive-gate.js

@@ -4,9 +4,8 @@ import { recordFailOpen } from "../observability/fail-open.js";
 import { decodeCheckpointScope } from "../security.js";
 import { createApprovalBaselinePolicy, createDeploymentGovernanceInputs, } from "../deployment-governance.js";
 import { applyRuntimeGovernance } from "../runtime-governance.js";
-import { DeferredSandboxPathEnv, sandboxPathEnvSlots } from "./deferred-sandbox-path-env.js";
-import { DEPLOYMENT_SHAPE_PREDICATES } from "../deployment-shape.js";
-import { executionLaneHomeDir } from "../execution-lane-caps.js";
+import { sandboxPathEnvSlots } from "./deferred-sandbox-path-env.js";
+import { createLegPathAdjudication } from "./leg-path-adjudication.js";
 import { createSessionExemptionRead } from "../approval.js";
 import { seatText } from "../trace/exit-seat.js";
 function hostGateCwd(config, localRoot) {
@@ -17,18 +16,7 @@ export function createParkedReviveInheritedGate(deps) {
     const slots = deps.slots ?? sandboxPathEnvSlots;
     return async (row, identity) => {
         const metadata = await chainMetadataOf(deps, row, identity);
-        const laneHome = executionLaneHomeDir(config);
-        const homeBase = laneHome !== undefined ? { taskHome: laneHome } : {};
-        const pathAdjudication = DEPLOYMENT_SHAPE_PREDICATES.sandboxPathAdjudication.holds(config)
-            ? {
-                env: new DeferredSandboxPathEnv({
-                    sessionId: row.sessionId,
-                    slots,
-                    logger: { warn: (event, fields) => logger.warn(event, { ...(fields ?? {}), lane: config.remoteExec.provider, leg: "parked_revive" }) },
-                }),
-                ...homeBase,
-            }
-            : { env: createHostAdjudicationEnv(config, localRoot), ...homeBase };
+        const pathAdjudication = createLegPathAdjudication(config, { sessionId: row.sessionId, leg: "parked_revive", hostArm: () => ({ env: createHostAdjudicationEnv(config, localRoot) }) }, { slots, logger });
         const rootSessionId = row.rootSessionId;
         const baseline = createApprovalBaselinePolicy(config, {
             kind: "durable",

package/dist/boot/reapers.d.ts

@@ -28,6 +28,7 @@ import type { ToolApprovalCoordinator } from "../tool-approval.js";
 import type { ParkCommitWatch } from "../plugins/park-commit-watch.js";
 import { type SandboxReaper } from "../plugins/sandbox-reaper.js";
 import { type AuditRotationPort } from "../approval-ask-retention.js";
+import type { HolderPullTally } from "../orchestration/workflow-park-holder.js";
 /** [ref] / [ref]§五(sema-comms `audits/failopen-governance-176.md` §7 "Z 类 1 条"):default consecutive-failure
  *  count before a reaper leg's swallowed error gets a `warn` line. The ~15 `.catch(() => undefined)` sites
  *  below are correct in DIRECTION (a hiccuping periodic sweep must never crash the whole tick loop — one bad
@@ -103,6 +104,8 @@ export interface ReapersCtx {
      *  `TOOL_APPROVAL_ENABLED=false` 的部署恒 undefined ⇒ 收敛器照常收敛,只是不发通知帧(壳侧靠
      *  重连 preamble 对账,见 approval-card.ts 的 `ApprovalRevokeFrame` 顶注)。 */
     toolApproval: ToolApprovalCoordinator | undefined;
+    /** workflow 停驻卡持有进程的拉取腿(`orchestration/workflow-park-holder.ts`;第 8 段按决定店 / 执行器视图在场装配)。缺席 = 没有 workflow 停驻车道 ⇒ 本腿零调用。 */
+    workflowParkHolderPull?: () => Promise<HolderPullTally>;
     /** [ref]:规则店的**保留期口**。`PERMISSION_RULES_ENABLED=false` 或后端没实装 ⇒ undefined
      *  ⇒ 本腿根本不注册(零扫描),与它的同族旋钮腿同姿势。
      *
@@ -122,6 +125,8 @@ export interface ReapersCtx {
     approvalAskAudit: AuditRotationPort | undefined;
     /** 晚绑(server 造出来才有)——见文件头「位置即契约」①。 */
     getRunDenySweep: () => ((now: number) => Promise<void>) | undefined;
+    /** 会话老化腿(晚绑:它要的删除协调器在第 9 段铸,`late-binds.ts` 的 `sessionAgeOut`)。缺席 = 这台部署记不了会话种类 / 还没绑 ⇒ 本腿零调用。 */
+    getSessionAgeOut?: () => (() => Promise<unknown>) | undefined;
     /** 本车道的沙箱回收座(`plugins/sandbox-reaper.ts`;第 5 段与 run 工厂同一份车道配置铸):k8s 车道 = 沙箱 Pod reaper(`plugins/k8s-pod-reaper.ts`),local-docker 车道 = 无主容器 reaper
      *  (`plugins/local-docker-reaper.ts`)。缺席 = 别的车道 ⇒ 本腿零调用。一次部署一条执行车道 ⇒ 一只座、一个节拍。 */
     sandboxReaper?: SandboxReaper;
@@ -189,7 +194,7 @@ interface ReapSessionsInputs {
  *    抛的后果是安全的:core 两条臂的 release 都在 try 内、且计数在 release **之后**递增 ⇒ 抛 = 不计数
  *    + 下一 tick 重新枚举重试(失败经济学与 core 的成文一致:泄漏给下一轮,而不是谎报已清)。
  *
- * 抽成具名工厂而不是就地闭包的理由与 `createEngineNoticeSeat` 逐字同一条:判据在**值**上
+ * 抽成具名工厂而不是就地闭包的理由与当年 leader 通告席那只判据函数逐字同一条:判据在**值**上
  * (哪只店被调),源码文本门看不出对错,只有行为测得出来。
  */
 export declare function createPlacementAwareReapSessions(deps: ReapSessionsInputs): ReapSessionsFacade;

package/dist/boot/reapers.js

@@ -86,7 +86,7 @@ export function createPlacementAwareReapSessions(deps) {
     };
 }
 export function startReapers(ctx) {
-    const { config, logger, metrics, localRoot, backend, subRunner, runStore, checkpointStore, parkCommits, rateLimiter, costQuota, storeSweep, fileHistoryErasure, taskAttachmentStore, imageBakes, worktreeReap, workflowNotifyGate, workflowRecoverOpts, sqlWorkflowRunStore, workflowNotifyJournal, backgroundAgentStore, mailboxStore, toolApproval, permissionRuleStores, approvalNonceStore, getRunDenySweep, userInputLedger, approvalAskAudit, sandboxReaper, } = ctx;
+    const { config, logger, metrics, localRoot, backend, subRunner, runStore, checkpointStore, parkCommits, rateLimiter, costQuota, storeSweep, fileHistoryErasure, taskAttachmentStore, imageBakes, worktreeReap, workflowNotifyGate, workflowRecoverOpts, sqlWorkflowRunStore, workflowNotifyJournal, backgroundAgentStore, mailboxStore, toolApproval, permissionRuleStores, approvalNonceStore, getRunDenySweep, getSessionAgeOut, userInputLedger, approvalAskAudit, sandboxReaper, workflowParkHolderPull, } = ctx;
     const leg = (p) => {
         if (p !== undefined)
             trackMaintenanceLeg(p);
@@ -119,6 +119,7 @@ export function startReapers(ctx) {
     const approvalNonceReapExpiredGuard = createThrottledReaperCatch("approval_nonce_reap_expired", logger);
     const runsFailSuspendedExpiredCheckpointGuard = createThrottledReaperCatch("runs_fail_suspended_expired_checkpoint", logger);
     const runDenySweepGuard = createThrottledReaperCatch("run_deny_sweep", logger);
+    const sessionAgeOutGuard = createThrottledReaperCatch("session_age_out", logger);
     const runsReapSuspendedGuard = createThrottledReaperCatch("runs_reap_suspended", logger);
     const checkpointReapCtxGuard = createThrottledReaperCatch("checkpoint_reap_ctx", logger);
     const storeSweepGuards = {
@@ -158,11 +159,13 @@ export function startReapers(ctx) {
     const approvalReconcileGuard = createThrottledReaperCatch("approval_reconcile", logger);
     const approvalSuspendedPollGuard = createThrottledReaperCatch("approval_suspended_poll", logger);
     let approvalSuspendedPollInFlight = false;
+    const workflowParkHolderPullGuard = createThrottledReaperCatch("workflow_park_holder_pull", logger);
+    let workflowParkHolderPullInFlight = false;
     const permissionRuleReapGuard = createThrottledReaperCatch("permission_rule_reap_expired", logger);
     let permissionRuleReapInFlight = false;
     let approvalReconcileInFlight = false;
     const approvalReconciler = (() => {
-        if (!config.streamApproval.enabled || !backend)
+        if (!backend)
             return undefined;
         return createApprovalReconciler({
             askStore: backend.approvalAsk(),
@@ -265,6 +268,8 @@ export function startReapers(ctx) {
             leg(getRunDenySweep()?.(Date.now())
                 .then(() => runDenySweepGuard.onSuccess(), runDenySweepGuard.onError));
         }
+        leg(getSessionAgeOut?.()?.()
+            .then(() => sessionAgeOutGuard.onSuccess(), sessionAgeOutGuard.onError));
         leg(approvalNonceStore
             ?.reapExpired()
             .then(reapCount("approval_nonces_reaped_total", {}))
@@ -360,6 +365,12 @@ export function startReapers(ctx) {
                 .then(() => approvalSuspendedPollGuard.onSuccess(), approvalSuspendedPollGuard.onError)
                 .finally(() => (approvalSuspendedPollInFlight = false)));
         }
+        if (workflowParkHolderPull && !workflowParkHolderPullInFlight) {
+            workflowParkHolderPullInFlight = true;
+            leg(workflowParkHolderPull()
+                .then(() => workflowParkHolderPullGuard.onSuccess(), workflowParkHolderPullGuard.onError)
+                .finally(() => (workflowParkHolderPullInFlight = false)));
+        }
         if (!permissionRuleReapInFlight) {
             permissionRuleReapInFlight = true;
             leg(permissionRuleStores

package/dist/boot/resolve-spec.d.ts

@@ -33,9 +33,9 @@ export interface ResolveSpecCtx {
     /** 活引用(registry 热应用换引用)—— 见文件头「位置即契约」。 */
     getKeyResolver: () => ReturnType<typeof createKeyResolver>;
     taskAttachmentStore: TaskAttachmentStore | undefined;
-    perSessionCwd: Map<string, string>;
-    setSessionCwd: (sid: string, cwd: string) => void;
-    setSessionShellEnv: (sid: string, env: Record<string, string>) => void;
+    /** 会话登记簿的工作目录那一格(**只读**:这条腿没带工作目录时它是会话上已登记的那一枚)。会话绑定(cwd / shellEnv / inheritEnv)本装配器只判、只算
+     *  (`LegFacts.sessionBindings`),写在路由层 run 认领之后的唯一提交点(`session-bindings.ts` 的 `commitLegBindings`)—— 律见那只文件头注。 */
+    perSessionCwd: ReadonlyMap<string, string>;
     /** 两张 per-session 登记簿的**租户围栏**(codex R1-F1):每次提交对拍本会话的主人,换主即清。
      *  论证(为什么 device lane 把这条从「不需要」变成「必需」)逐字见 `createSessionScopedRegistries` 头注。 */
     fenceSessionOwner: (sid: string, owner: string | null, incarnation?: string) => void;

package/dist/boot/resolve-spec.js

@@ -18,6 +18,7 @@ import { headerStr } from "../http/principal-gate.js";
 import { routeListFilter } from "../http/owner-access.js";
 import { projectRegistry } from "../capability-facts.js";
 import { projectContextOf } from "../project-context.js";
+import { memorySeedOf, memorySeedScopesOf } from "../project-registry.js";
 import { explicitOperatorOk } from "../http/server.js";
 import { isAtMentionable, matchCatalogModel, pickUserModel, refusedCatalogEntry, terminalCatalogName } from "../model-select.js";
 import { echoModelRef, modelNotAllowedMessage, modelUnavailableMessage, refusedNameLogField } from "../model-entry-refusal.js";
@@ -59,10 +60,12 @@ import { inertToolListEntryOf } from "../rule-entry-list.js";
 import { assertAttachmentIdsShape, assertImageProfileLane, assertInheritEnvServed, assertToolListsReadable, assertWriteFaceAdmitted, bodyImageProfileOf, scenarioRequestedBy } from "../request-form.js";
 import { TENANCY_WALL_CLOCK_BASE_SEC, enableForkFromBody, normalizeRetainSubagentSessions, selfOrchestrationFromBody } from "../task-workflow.js";
 import { redactSecrets } from "../trace/redact.js";
-import { DeferredSandboxPathEnv, sandboxPathEnvSlots } from "./deferred-sandbox-path-env.js";
-import { executionLaneHomeDir, executionLaneOf, laneIsolated, laneWiresExecutionEnv } from "../execution-lane-caps.js";
+import { sandboxPathEnvSlots } from "./deferred-sandbox-path-env.js";
+import { createLegPathAdjudication } from "./leg-path-adjudication.js";
+import { executionLaneOf, laneIsolated, laneWiresExecutionEnv } from "../execution-lane-caps.js";
 import { executionConfigRootOf } from "../execution-config-root.js";
 import { withUnattendedLeg } from "../unattended-permission-mode.js";
+import { bindingsOf } from "../session-bindings.js";
 import { fieldConflictFacts } from "../field-conflict.js";
 function identityAxesOf(auth) {
     const subject = auth?.subject === undefined ? undefined : recoveredSubject(auth.subject);
@@ -74,7 +77,7 @@ function unrooted(spec) {
     return resolved;
 }
 export function createResolveSpec(ctx) {
-    const { config, logger, metrics, localRoot, scenarios, principalCaps, centerRuntimeCapsResolver, getKeyResolver, taskAttachmentStore, perSessionCwd, setSessionCwd, setSessionShellEnv, fenceSessionOwner, hookLlm, hookAgent, belowTaskChainPatterns, fleetBus, hookWakeBus, historyAnchors, ownerAware, taskLimitCaps, taskTimeoutSec, selectEnvTool, sendUserFileToolSpec, memoryEngine, memorySyncRunner, durableEnabled, approvalExemptionStore, checkpointStore, imageIndex, perTaskImage, sessionEnvSelection, questionSeat, approverSeat, lockedKeys, loadedSkills, peerDesk, } = ctx;
+    const { config, logger, metrics, localRoot, scenarios, principalCaps, centerRuntimeCapsResolver, getKeyResolver, taskAttachmentStore, perSessionCwd, fenceSessionOwner, hookLlm, hookAgent, belowTaskChainPatterns, fleetBus, hookWakeBus, historyAnchors, ownerAware, taskLimitCaps, taskTimeoutSec, selectEnvTool, sendUserFileToolSpec, memoryEngine, memorySyncRunner, durableEnabled, approvalExemptionStore, checkpointStore, imageIndex, perTaskImage, sessionEnvSelection, questionSeat, approverSeat, lockedKeys, loadedSkills, peerDesk, } = ctx;
     const deploymentSkillSources = new Map(loadedSkills.map((k) => [k.spec.name, k.source]));
     const scenarioGate = createScenarioGate({ config, scenarios, principalCaps, logger }, "enforce");
     const sessionHeadOf = headReadOf(ownerAware);
@@ -85,10 +88,10 @@ export function createResolveSpec(ctx) {
         approvalSeat: durableEnabled ? "durable" : "absent",
         singleUserAutoAcceptBaseline: singleUserAutoAcceptBaselineApplies(config),
     });
-    const realTaskRootOf = (root) => {
+    const realTaskRootOf = (legSessionCwd) => {
         if (DEPLOYMENT_SHAPE_PREDICATES.sandboxPathAdjudication.holds(config))
             return undefined;
-        const sessionCwd = effectiveHostWorkspace(perSessionCwd.get(root), {});
+        const sessionCwd = effectiveHostWorkspace(legSessionCwd, {});
         return sessionCwd ?? (laneWiresExecutionEnv(config.remoteExec.provider) ? undefined : process.cwd());
     };
     const memoryProjectLayers = createMemoryProjectLayers({ stores: memoryEngine, syncRunner: memorySyncRunner, log: logger });
@@ -114,13 +117,18 @@ export function createResolveSpec(ctx) {
             assertRequestMcpEntries(body.mcpServers);
         const submittedProjectId = auth?.resolvedProjectId ?? (typeof body.projectId === "string" && body.projectId ? body.projectId.toLowerCase() : undefined);
         const legProjectId = await legProjectIdOf(submittedProjectId, sessionWorkspace, root);
+        const registryFact = projectRegistry({ config });
+        const registry = registryFact.available ? registryFact.registry : undefined;
+        const projectViewer = opts?.leg === "fresh" && req !== undefined ? routeListFilter(req, { config }, "project-get") : undefined;
+        const memorySeed = opts?.leg === "fresh" ? memorySeedOf(registry, submittedProjectId, projectViewer) : opts?.memorySeed;
+        if (opts?.leg !== "fresh" && memorySeed === undefined && submittedProjectId !== undefined)
+            logger.warn("resume_memory_seed_unjudged", { sessionId: root, projectId: submittedProjectId, note: "this continuation's stored rebuild input carries no memory-seed judgment (it was parked before this server version judged one), so the project registry's default read layers are not applied to it; submit the work again as a new task to have them" });
         let projectContext;
         if (opts?.leg === "fresh") {
-            const registry = projectRegistry({ config });
             const decision = projectContextOf({
                 projectId: legProjectId,
-                registry: registry.available ? registry.registry : undefined,
-                viewer: req === undefined ? undefined : routeListFilter(req, { config }, "project-get"),
+                registry,
+                viewer: projectViewer,
                 pathsHonored: DEPLOYMENT_SHAPE_PREDICATES.callerOwnsWorkerDisk.holds(config),
                 requestCwd: typeof body.cwd === "string" && body.cwd.length > 0,
                 projectMemoryOff: body.projectMemory === "disabled",
@@ -229,12 +237,12 @@ export function createResolveSpec(ctx) {
         const gated = await gateScenarioAndAppend(body, auth, root, opts, settingsEnv);
         const effMode = effectivePermissionMode(body, gated.parsedSettings.settings);
         assertWriteFaceAdmitted(effMode, config);
-        const lane = bindSettingsCwdEnvAndModel(body, auth, root, gated, opts, legCwd);
-        const anchors = await resolveHistoryAnchors(body, req, auth, root, submittedProjectId, legProjectId);
-        const projectKey = memoryEngine ? await memoryProjectLayers.prepare(config, auth?.memoryScope, realTaskRootOf(root)) : undefined;
+        const lane = judgeSettingsCwdEnvAndModel(body, auth, root, gated, opts, legCwd);
+        const anchors = await resolveHistoryAnchors(body, req, auth, root, memorySeedScopesOf(registry, memorySeed), legProjectId);
+        const projectKey = memoryEngine ? await memoryProjectLayers.prepare(config, auth?.memoryScope, realTaskRootOf(lane.sessionCwd)) : undefined;
         const runSkills = buildRunSkills({ scenario: gated.cap.skills, request: body.skills, disable: body.disableSkills === true, deploymentSources: deploymentSkillSources }, logger);
         const spec = assembleSpecLiteral(body, auth, root, req, opts, { ...gated, ...lane, ...anchors, projectKey, a2aPeers, storedToolAxes, runSkills, projectBrief: projectContext?.brief }, effMode);
-        const folded = await foldGovernanceAndSettings(body, auth, root, spec, gated, projectContext?.brief);
+        const folded = await foldGovernanceAndSettings(body, auth, root, spec, gated, projectContext?.brief, lane.sessionCwd);
         const retiredNotice = opts.onNotice !== undefined ? buildNeverAutoRetiredNotice(gated.parsedSettings.settings?.tightenOnly?.neverAuto, root) : undefined;
         if (retiredNotice !== undefined)
             opts.onNotice?.(retiredNotice);
@@ -243,13 +251,12 @@ export function createResolveSpec(ctx) {
             scratchpadDir: folded.scratchpadDir,
             hostSemanticsLane: folded.hostSemanticsLane,
         });
-        const registeredCwd = perSessionCwd.get(root);
-        return { spec: final, facts: { hands: gated.hands, skills: runSkills.roster, sessionWitness: gated.sessionWitness, ...(registeredCwd !== undefined ? { registeredCwd } : {}), ...(projectContext !== undefined ? { projectContext } : {}) } };
+        return { spec: final, facts: { hands: gated.hands, skills: runSkills.roster, sessionWitness: gated.sessionWitness, sessionBindings: lane.sessionBindings, ...(projectContext !== undefined ? { projectContext } : {}), ...(memorySeed !== undefined ? { memorySeed } : {}) } };
     };
     const gateScenarioAndAppend = async (body, auth, root, opts, settingsEnv) => {
         const { parts: subjectParts, person } = identityAxesOf(auth);
         const requestedScenario = scenarioRequestedBy(subjectParts?.scenario, body.scenario);
-        const scenarioName = await scenarioGate(person, requestedScenario);
+        const { scenario: scenarioName } = await scenarioGate(person, requestedScenario);
         const rootFace = sessionHeadOf === undefined ? undefined : sessionFaceOfHead(root, await sessionHeadOf(root));
         const sessionWitness = { sessionId: root, owner: rootFace?.owner ?? null, incarnation: rootFace?.incarnation ?? null };
         const cap = selectScenario(scenarios, scenarioName)(body, person, { sessionId: sessionWitness.sessionId, delegationRoot: sessionWitness });
@@ -302,22 +309,24 @@ export function createResolveSpec(ctx) {
         }
         return { scenarioName, cap, hands: cap.hands, acceptedAppend, objective, parsedSettings, attachmentNotice, sessionWitness };
     };
-    const bindSettingsCwdEnvAndModel = (body, auth, root, gated, opts, cwd) => {
+    const judgeSettingsCwdEnvAndModel = (body, auth, root, gated, opts, cwd) => {
         const { objective, parsedSettings } = gated;
         const cwdWriteGate = DEPLOYMENT_SHAPE_PREDICATES.callerCwd.holds(config);
         const execLane = config.remoteExec.provider;
         fenceSessionOwner(root, auth?.subject ?? null, opts.execution.occupant?.incarnation);
+        let boundCwd;
         if (typeof cwd === "string" && cwd.length > 0) {
             if (cwdWriteGate && isAbsoluteHostPath(cwd))
-                setSessionCwd(root, cwd);
+                boundCwd = cwd;
             else if (DEPLOYMENT_SHAPE_PREDICATES.noHandsSingleUser.holds(config) && isAbsoluteHostPath(cwd) && satisfiedByProcessCwd(cwd, realpathSync))
                 logger.debug("task_cwd_inherited", { lane: execLane, sessionId: root });
             else
                 logger.warn("task_cwd_ignored", { honored: cwdWriteGate, lane: execLane, sessionId: root });
         }
+        let boundShellEnv;
         if (parsedSettings.settings?.shellEnv) {
             if (cwdWriteGate)
-                setSessionShellEnv(root, parsedSettings.settings.shellEnv);
+                boundShellEnv = parsedSettings.settings.shellEnv;
             else if (DEPLOYMENT_SHAPE_PREDICATES.noHandsSingleUser.holds(config)) {
                 const requested = parsedSettings.settings.shellEnv;
                 const mismatched = shellEnvMismatchCount(requested, process.env);
@@ -329,6 +338,8 @@ export function createResolveSpec(ctx) {
             else
                 logger.warn("task_shell_env_ignored", { honored: false, lane: execLane, sessionId: root });
         }
+        const sessionCwd = boundCwd ?? perSessionCwd.get(root);
+        const sessionBindings = bindingsOf(sessionCwd, boundShellEnv, body.inheritEnv);
         const taskHooks = (() => {
             const hc = parsedSettings.settings?.hooks;
             if (!hc)
@@ -340,7 +351,7 @@ export function createResolveSpec(ctx) {
             return createSettingsHooksRegistrations(hc, {
                 logger,
                 sessionId: root,
-                cwd: perSessionCwd.get(root) ?? process.cwd(),
+                cwd: sessionCwd ?? process.cwd(),
                 hookEnvAllow: config.hookEnvAllow,
                 ...(parsedSettings.settings?.shellEnv ? { shellEnv: parsedSettings.settings.shellEnv } : {}),
                 httpHookAllowlistLayers: parsedSettings.settings?.httpHookAllowlist !== undefined ? [parsedSettings.settings.httpHookAllowlist] : [],
@@ -390,9 +401,9 @@ export function createResolveSpec(ctx) {
             metrics.inc("task_model_unknown_fallback_total");
             logger.warn("task_model_unknown_fallback", { requested: echoModelRef(picked.unknownExplicit), fallback: picked.model, sessionId: root });
         }
-        return { taskHooks, additionalDirectories, additionalReadDirectories, wireCatalog, picked };
+        return { taskHooks, additionalDirectories, additionalReadDirectories, wireCatalog, picked, sessionBindings, sessionCwd };
     };
-    const resolveHistoryAnchors = async (body, req, auth, root, submittedProjectId, legProjectId) => {
+    const resolveHistoryAnchors = async (body, req, auth, root, s4DefaultScopes, legProjectId) => {
         const anchorReader = req === undefined ? undefined : anchorReaderOf(req, { config, logger }, claimCallerOf(identityAxesOf(auth).subject, config));
         let resumeAtEntryId;
         if (typeof body.resumeAt === "string" && body.resumeAt.length > 0) {
@@ -406,7 +417,6 @@ export function createResolveSpec(ctx) {
                 throw new HttpError(501, "rewind-files-to is not available on this worker (no session-store backend for the anchor map)");
             rewindFilesToEntryId = await resolveHistoryAnchor("rewindFilesTo", anchorsResolvable, anchorReader, root, body.rewindFilesTo, auth?.subject ?? null, "rewindFilesTo");
         }
-        const s4DefaultScopes = submittedProjectId ? config.projects[submittedProjectId]?.defaultScopes : undefined;
         return { resumeAtEntryId, rewindFilesToEntryId, s4DefaultScopes, legProjectId };
     };
     const declaresInteractivePosture = (body, req, opts) => {
@@ -433,7 +443,7 @@ export function createResolveSpec(ctx) {
             ...(body.outputStyle !== undefined ? { outputStyle: body.outputStyle } : {}),
             ...(body.projectMemory !== undefined ? { projectMemory: body.projectMemory } : {}),
             ...(legProjectId !== undefined ? { projectId: legProjectId } : {}),
-            principal: taskSpecIdentityOf(subjectParts).principal,
+            ...taskSpecIdentityOf(subjectParts),
             images: body.images,
             ...(body.userAttachments !== undefined ? { userAttachments: body.userAttachments } : {}),
             ...(body.clientContext ? { clientContext: { timeZone: body.clientContext.timeZone, userEmail: body.clientContext.userEmail } } : {}),
@@ -471,7 +481,7 @@ export function createResolveSpec(ctx) {
             ...(declaresInteractivePosture(body, req, opts) ? { interactionPosture: "interactive" } : {}),
             ...(body.approvalReach !== undefined ? { approvalReach: body.approvalReach } : {}),
             ...(typeof body.oneShot === "boolean" ? { oneShot: body.oneShot } : {}),
-            resilience: normalizeResilience(body.resilience, explicitOperatorOk(person, config)),
+            resilience: normalizeResilience(body.resilience, explicitOperatorOk(person, config, "operate")),
             finalVerification: cap.finalVerification === true || body.finalVerification === true ? true : undefined,
             attachments: normalizeAttachments(body.attachments),
             ...(taskHooks.length > 0 ? { mods: [...taskHooks] } : {}),
@@ -584,32 +594,17 @@ export function createResolveSpec(ctx) {
         };
         return spec;
     };
-    const foldGovernanceAndSettings = async (body, auth, root, spec, gated, projectBrief) => {
+    const foldGovernanceAndSettings = async (body, auth, root, spec, gated, projectBrief, legSessionCwd) => {
         const { acceptedAppend, parsedSettings } = gated;
         const hostSemanticsLane = !DEPLOYMENT_SHAPE_PREDICATES.sandboxPathAdjudication.holds(config);
-        const laneHomeBase = () => {
-            const home = executionLaneHomeDir(config);
-            return home !== undefined ? { taskHome: home } : {};
-        };
-        const pathAdjudication = hostSemanticsLane
-            ? (() => {
-                const realRoot = realTaskRootOf(root);
+        const pathAdjudication = createLegPathAdjudication(config, {
+            sessionId: root,
+            hostArm: () => {
+                const realRoot = realTaskRootOf(legSessionCwd);
                 const gateCwd = realRoot ?? join(config.localDataRoot ?? localRoot, "fs-write-gate-unrooted");
-                return {
-                    env: new NodeExecutionEnv({ cwd: gateCwd }),
-                    cwd: gateCwd,
-                    ...(realRoot !== undefined ? { taskRoot: realRoot } : {}),
-                    ...laneHomeBase(),
-                };
-            })()
-            : {
-                env: new DeferredSandboxPathEnv({
-                    sessionId: root,
-                    slots: sandboxPathEnvSlots,
-                    logger: { warn: (event, fields) => logger.warn(event, { ...(fields ?? {}), lane: config.remoteExec.provider }) },
-                }),
-                ...laneHomeBase(),
-            };
+                return { env: new NodeExecutionEnv({ cwd: gateCwd }), cwd: gateCwd, ...(realRoot !== undefined ? { taskRoot: realRoot } : {}) };
+            },
+        }, { slots: sandboxPathEnvSlots, logger });
         const governedBase = applyRuntimeGovernance(spec, createDeploymentGovernanceInputs(config, pathAdjudication));
         let governed = governedBase;
         let effectiveSettings = parsedSettings.settings;
@@ -668,7 +663,7 @@ export function createResolveSpec(ctx) {
             const resolved = await resolveSandboxImageRef({
                 profile: taskImageProfile,
                 ...(capsNeeded && capsNeeded.length > 0 ? { capabilitiesNeeded: capsNeeded } : {}),
-                viewer: { operator: explicitOperatorOk(person, config), tenantId: person ?? null },
+                viewer: { operator: explicitOperatorOk(person, config, "operate"), tenantId: person ?? null },
                 index: imageIndex,
             });
             if (!resolved.ok)

package/dist/boot/runner-deps.d.ts

@@ -206,6 +206,13 @@ export interface RunnerDepsCtx {
     sharedMemoryStores: RunnerDeps["sharedMemoryStores"];
     toolResultStore: ToolResultStoreFull | undefined;
     sessionPolicyStore: ReturnType<StoreBackend["sessionPolicy"]> | undefined;
+    /**
+     * [ref] §K —— per-principal 运行期准入的**收紧面**(`boot/runtime-caps.ts` 一处合成;缺席 = 这条部署腿没有 per-principal 收紧,
+     * 部署级缺省照管)。进{@link createSharedRunnerDeps 共享基座}:引擎按腿以 `spec.principal` 解它(每条腿各解一次),委派子代的主体由引擎的
+     * 父 spec 座继承 —— 子腿是同一个主体,跑它的那只 Runner 不挂 = 中心对这个主体的拒位(bypass / fork / 自编排 / auto / 强制门 / 观察者 /
+     * 记忆 opt-out)与中心硬故障时的 fail-closed 降级项一位都到不了子腿(安全轴 fail-open)。它不是会话设施(不同于 selfOrchestration /
+     * scheduler / memory 那几席),所以没有「子腿刻意不给」的理由。
+     */
     runtimeCapsResolver: RunnerDeps["runtimeCapsResolver"];
     /** [ref] per-edited-file rewind history (core `RunnerDeps.fileHistoryStore`; replaces the retired E19
      *  whole-tree snapshot seat — core 94632197 renamed the seat, not a coexistence). WIRING IS THE OPT-IN.
@@ -238,7 +245,7 @@ export interface RunnerDepsCtx {
     lspManager: RunnerDeps["lspManager"];
     fleetBus: FleetEventBus;
     /** 部署座的 mods 注册(起服第 5 段装配口 `assembleDeploymentMods` 铸:自铸 + 运维声明的包,起服自证过)—— 主 / handless / hookAgent / sub 经本共享基座、
-     *  leader 车道的路由 / worker / 修复腿经 `LeaderWireConfig.mods`(`boot/leader.ts` 递同一份),每一只 Runner 同一份。 */
+     *  leader 车道的路由 / worker / 修复腿经部署平面层(同一铸点),每一只 Runner 同一份。 */
     deploymentMods: NonNullable<RunnerDeps["mods"]>;
     workflowRunStore: WorkflowRunStore | undefined;
     workflowJournalStore: ServiceWorkflowJournalStore | undefined;
@@ -246,9 +253,22 @@ export interface RunnerDepsCtx {
     workflowNotifyGate: WorkflowNotifyGate | undefined;
     deliverWorkflowCompletion: (p: WorkflowCompletionPayload) => Promise<void>;
 }
-/** [ref] A10 留档发现②:main runner `RunnerDeps` 与 main.ts subRunner 字面量之间此前手工重复
- * 的 ~15 个键,类型标注见 {@link createSharedRunnerDeps} 头注。 */
-export type SharedRunnerDeps = Pick<RunnerDeps, "brain" | "readFace" | "readDenyPatterns" | "readDenyBuiltinTiers" | "readDenyBuiltinExclude" | "readDenyFloorRequired" | "memoryDelegationEvidence" | "memoryProvenance" | "memoryCapturePolicy" | "delegationEntryCaps" | "crossSessionInbound" | "crossSessionDialogExpiry" | "writeProtectedPaths" | "memoryEngineDir" | "allowedTools" | "crossBoundaryPosture" | "models" | "roles" | "tiers" | "pricing" | "tracer" | "promptSource" | "executionEnvFactory" | "lspManager" | "backgroundAgentStore" | "mailboxStore" | "rosterStore" | "mods" | "toolResultStore" | "checkpointStore" | "fileHistoryStore" | "fileHistoryCapture" | "hands" | "sessionPolicyStore" | "usageWindows" | "usageWindowStore" | "memoryScopeAdmission" | "deploymentMemoryScopes" | "sharedMemoryStores" | "compliancePostureResolver" | "lockedConfig" | "retentionPolicy" | "onNotice" | "mcpRevocations" | "peerSeat">;
+/**
+ * **部署平面层**:一台部署对**每一条腿说同一句话**的键 —— 收紧面(治理三座 / 按主体准入 / MCP 撤销台账 / 部署姿态座席族 / 豁免根)+ 计量面
+ * (tracer / 治理窗两键)+ 服务表(brain / 模型目录 / 定价 / 提示词目录)+ 部署座 / 手带 + 两条披露出口(通告 / 错误)。
+ * 律:本进程每一只跑带主体 spec 的 Runner —— 主 / 无手 / hook 代理 / 子代 / run-local,**以及 leader 车道的每一只** —— 展开**同一层**
+ * ({@link createDeploymentPlaneDeps},唯一铸点);新的部署键进这一层即到达全部 Runner,没有哪条车道逐席搬运。
+ * 不在这一层的是**会话设施**({@link SessionFacilityDeps}):各车道按自己的生命周期自选(leader 的沙盒、停驻店与会话店归 leader)。
+ */
+export type DeploymentPlaneDeps = Pick<RunnerDeps, "brain" | "models" | "roles" | "tiers" | "pricing" | "tracer" | "promptSource" | keyof DeploymentPostureSeats | "mods" | "hands" | "usageWindows" | "usageWindowStore" | "compliancePostureResolver" | "lockedConfig" | "retentionPolicy" | "onNotice" | "onError" | "runtimeCapsResolver" | "mcpRevocations" | "memoryEngineDir">;
+/**
+ * **会话设施层**:停驻店、卸载店、后台子代店 / 信箱 / 名册、文件历史、会话规则、记忆三席、LSP、对端座、执行环境工厂 —— 按会话 / 车道的
+ * 生命周期选,不是部署对每条腿说的话。起服的主 / 子 Runner 与 run-local 经共享基座取全套;leader 车道不取(它的沙盒、停驻店、会话店按 worker
+ * 自己的生命周期给,`leader/wire.ts`)。
+ */
+export type SessionFacilityDeps = Pick<RunnerDeps, "executionEnvFactory" | "lspManager" | "backgroundAgentStore" | "mailboxStore" | "rosterStore" | "toolResultStore" | "checkpointStore" | "fileHistoryStore" | "fileHistoryCapture" | "sessionPolicyStore" | "memoryScopeAdmission" | "deploymentMemoryScopes" | "sharedMemoryStores" | "peerSeat">;
+/** 共享基座 = 部署平面层 + 会话设施层(起服主 / 子 Runner 与 run-local 的两只 Runner 展开它)。 */
+export type SharedRunnerDeps = DeploymentPlaneDeps & SessionFacilityDeps;
 /**
  * [ref] A10 留档发现②(review 2026-07-29,[ref]§三族A 同源修补的延续):main runner 的
  * `RunnerDeps` 字面量(下方 `createRunnerDeps`)与 `main.ts` 里 subRunner 的 `new Runner({...})`
@@ -274,8 +294,17 @@ export type SharedRunnerDeps = Pick<RunnerDeps, "brain" | "readFace" | "readDeny
  *    [ref]§三族A 已用「直引 `runnerDeps.X`」修过(main.ts 两处引用同一个 `runnerDeps` 实例的同一
  *    属性,比再抽一层共享基座更强的同源保证),不重复收纳进这里。
  */
-/** 基座真实消费的窄面(Pick)——subRunner 调用点(main.ts)只需凑这 13 个字段,不必造全量 ctx。 */
-export type SharedRunnerDepsCtx = Pick<RunnerDepsCtx, "config" | "brain" | "pricing" | "tracer" | "promptSource" | "executionEnvFactory" | "lspManager" | "backgroundAgentStore" | "mailboxStore" | "rosterStore" | "deploymentMods" | "toolResultStore" | "checkpointStore" | "fileHistoryStore" | "sessionPolicyStore" | "commitCoAuthor" | "usageWindowStore" | "orgMemoryAdmission" | "sharedMemoryStores" | "logger" | "governanceSeams" | "mcpRevocations" | "metrics" | "engineDataRoot" | "peerDesk">;
+/** 部署平面层的输入(窄面)。`onError` = 本进程的错误汇(起服 = `createRunnerDeps` 铸的那一只,run-local = 它自己的那一只):必填键(值可缺席),
+ *  每个平面层调用点都得回答「这条腿的引擎错误交给谁」—— 它是按主体准入 resolver 抛 / 治理窗最终扣账失败的唯一出口,与 resolver、窗席同生共死。 */
+export type DeploymentPlaneCtx = Pick<RunnerDepsCtx, "config" | "brain" | "pricing" | "tracer" | "promptSource" | "deploymentMods" | "usageWindowStore" | "logger" | "governanceSeams" | "mcpRevocations" | "metrics" | "engineDataRoot" | "runtimeCapsResolver"> & {
+    readonly onError: RunnerDeps["onError"];
+};
+/** 平面层里**车道给**的一格:提交署名(`hands.commitCoAuthor`;起服 / run-local 各按品牌算一次,leader 车道不署名 ⇒ `undefined`)。 */
+export interface DeploymentPlaneLane {
+    readonly commitCoAuthor: RunnerDepsCtx["commitCoAuthor"];
+}
+/** 共享基座的输入 = 平面层的输入 + 会话设施的输入。 */
+export type SharedRunnerDepsCtx = DeploymentPlaneCtx & Pick<RunnerDepsCtx, "executionEnvFactory" | "lspManager" | "backgroundAgentStore" | "mailboxStore" | "rosterStore" | "toolResultStore" | "checkpointStore" | "fileHistoryStore" | "sessionPolicyStore" | "commitCoAuthor" | "orgMemoryAdmission" | "sharedMemoryStores" | "peerDesk">;
 /** 转发席只需要 `inc` —— 刻意窄到这一个动词,免得把整只 Metrics 拖进这条纯转发腿。 */
 export interface EngineNoticeMetricsSeat {
     inc: (name: string, labels?: Record<string, string>) => void;
@@ -292,39 +321,14 @@ export declare function createEngineNoticeForwarder(logger: {
 export declare function installDefaultEngineNoticeSeat(logger: {
     warn: (msg: string, fields?: Record<string, unknown>) => void;
 }, metrics?: EngineNoticeMetricsSeat): void;
-/**
- * `onNotice` **席**的装配判据本身 —— 「`warn` 真在场才铸席」这一条从此是**一个可直接调用的函数**,
- * 不是散在装配点、只能靠扫源码文本去猜的一行三元(codex 交叉复审 R1-[medium],验真后修)。
- *
- * 病(实测):把 leader 的门写成 `cfg.logger ? ((m, x) => cfg.logger?.warn?.(m, x)) : undefined` 时,
- * 「装配点切片里出现过 `warn` 这个词」这类**源码文本**判据一律照绿 —— 而只装了 `info` 的部署会拿到一个
- * truthy 闭包、照样铸席,通告随后被可选链**静默吞掉**,比不铸席更坏(不铸时 core 至少还打它自己的
- * `console.warn`,响亮权留在原处)。任何「在这段文本里找关键字」的门都挡不住这一族变异,因为病灶在
- * **值**(闭包 truthy)而不在字面。⇒ 把判据搬进函数,让它可以被**行为**测:info-only ⇒ 空席;带 warn ⇒
- * 具名转发体。
- *
- * 命名(CLAUDE.md 工厂律):返回的袋子里装的是**活闭包**(有行为)⇒ `create*`,不是 `build*`。
- * 返回**展开形**(`{}` 或 `{ onNotice }`)而不是 `onNotice: undefined`。理由是**键卫生**,不是 core 行为
- * (R3 复扫更正:core 5.28 的 `deliverEngineNotice` 只判 `typeof onNotice === "function"`,显式 `undefined`
- * 与键缺席在 core 那侧行为逐字相同、响亮权都留在 core——旧句「显式 undefined 也算 host 接管」与真码相反):
- * 展开形让 `new Runner({...seat})` 的键集只随真装配变化,EXPECTED_SHARED_KEYS 类的键集绊线才数得准。
- */
-export declare function createEngineNoticeSeat(logger: {
-    warn?: (msg: string, fields?: Record<string, unknown>) => void;
-} | undefined, router?: EngineNoticeRouter): {
-    onNotice?: NonNullable<RunnerDeps["onNotice"]>;
-};
 /**
  * [ref](黑板 [ref],[ref] 登记)—— **部署姿态座席族**:运维在配置面写下的姿态(READ 面四席 + 记忆三席 +
  * 委派入口 caps)。core 明写「每个 run 读**准备它的那只 Runner** 的 deps」⇒ 一台部署里跑任务的**每一只**
- * Runner 都必须带同一份:主 runner / subRunner / run-local(经 {@link createSharedRunnerDeps} 展开)+
- * **leader lane 五只**(`boot/leader.ts` → `LeaderWireConfig.deploymentPosture` → `src/leader/wire.ts`
- * 五处 `...deploymentPostureSeat`)。
+ * Runner 都必须带同一份:本进程每一只 Runner 经部署平面层({@link createDeploymentPlaneDeps})展开它 —— 主 runner / subRunner /
+ * run-local 经共享基座,leader 车道的四只经 `LeaderWireConfig.plane`。
  *
  * 🔴 本函数是这一族**唯一**的取值点。两处各读一遍 config 就是 [ref]§三族A「主挂了、副漏挂」的病族形——
- * [ref] 正是 leader 那条腿漏了**全族**(修前 wire.ts 五处一席都没有;边界曾靠
- * `test/memory-delegation-evidence-lane.test.ts` ⑤ 组的机器门如实登记,现已翻成正向门)。leader 不许自己
- * 再读 config 铸一份,只吃本函数经 cfg 递过去的产物(`test/leader-deployment-posture-seats.test.ts` ③ 钉)。
+ * [ref] 正是 leader 那条腿漏了**全族**。平面层每次铸都现调本函数(中心热换 READ 面之后新构造的 Runner 读新档,[ref])。
  *
  * 纯数据(键值全是 config 透传,无闭包)⇒ `build*`(CLAUDE.md 工厂律)。键**恒在场**、缺席 = `undefined`
  * ([ref] S4 house style;core 消费点全按 `!== undefined` / `??` 判 —— dist
@@ -352,7 +356,7 @@ export declare function crossBoundaryPostureOf(requirePrincipal: boolean): Cross
 /**
  * 手带(`RunnerDeps.hands`)的**唯一**铸点(纯数据 ⇒ `build*`)。两格两个来源:署名由腿给(两条腿判据不同,见 {@link RunnerDepsCtx.commitCoAuthor};
  * leader 车道今天不署名,显式交 `undefined`),前台命令超时转后台读部署旋钮 `AUTO_BACKGROUND_ON_TIMEOUT` —— 旋钮的读点只有这里。
- * 共享基座(主 / 无手 / hook 代理 / 子代,HTTP 与 run-local 两条腿)与 leader 车道(`boot/leader.ts` → `LeaderWireConfig.hands`)同调这一只:
+ * 部署平面层调这一只(署名一格由车道给,{@link DeploymentPlaneLane}):
  * 有手的每一只 Runner 都拿到它,`/health.autoBackgroundOnTimeout` 说「生效」时没有哪只 Runner 例外。
  */
 export declare function buildHandsBand(config: Pick<ServiceConfig, "autoBackgroundOnTimeout">, commitCoAuthor: RunnerDepsCtx["commitCoAuthor"]): NonNullable<RunnerDeps["hands"]>;
@@ -364,6 +368,13 @@ export declare function buildDeploymentPostureSeats(config: DeploymentPostureCon
  * 喂的是 `config.readDenyPatterns`(运维 ∪ 中心 read-face 的行),不是座席族并入 LKG 派生行之后的那一份 —— 派生行是根锚。绝不抛(纯诊断面)。
  */
 export declare function announceReadDenyRows(config: Pick<ServiceConfig, "readDenyPatterns">, logger: Pick<Logger, "warn">): void;
+/**
+ * **部署平面层的唯一铸点**({@link DeploymentPlaneDeps})。纯函数、无副作用(读拒行的进场告知留在共享基座 —— leader 每构造一只 Runner 调本函数一次,
+ * 告知不随它重复)。每次调用现读 `config`:部署姿态座席族与模型目录会被中心热换,逐调用现构的 Runner(leader 车道)读到的是构造那一刻的代,
+ * 与主车道经 swap 门换代同代([ref]);起服的主 / 子 Runner 各展开一次,同一份 ctx ⇒ 同值同引用。
+ * 署名一格车道给({@link DeploymentPlaneLane});其余每一格对每一条腿同一句话。
+ */
+export declare function createDeploymentPlaneDeps(ctx: DeploymentPlaneCtx, lane: DeploymentPlaneLane): DeploymentPlaneDeps;
 export declare function createSharedRunnerDeps(ctx: SharedRunnerDepsCtx): SharedRunnerDeps;
 /**
  * 这台部署**声明本机属主的规则桶**吗(core `RunnerDeps.localOwnerRules`:不带主体的 run 经规则店的 `forLocalOwner()` 读持久规则,而不是读零规则)。