@sema-agent/server 7.151.0 → 7.152.0

package/dist/boot/device-lane.js

@@ -1,5 +1,6 @@
 import { createDeviceEnrollment, createFixedWindowRateLimiter } from "../device-enrollment.js";
 import { createDeviceWsHub } from "../device-ws-hub.js";
+import { deviceOwnerConfinedTier } from "../http/principal-gate.js";
 export const DEVICE_ENROLL_RATE_POLICY = { limit: 10, windowMs: 60_000 };
 export function createDeviceLane(ctx) {
     const { config, logger, metrics, backend, replicaId, seat } = ctx;
@@ -20,6 +21,7 @@ export function createDeviceLane(ctx) {
         store,
         enrollment,
         replicaId,
+        ownerConfinedTier: (owner) => deviceOwnerConfinedTier(owner, config),
         logger: {
             warn: (msg, fields) => logger.warn(msg, fields),
             error: (msg, fields) => logger.error(msg, fields),

package/dist/boot/execution-env.d.ts

@@ -184,6 +184,7 @@ export declare function createExecutionEnv(ctx: ExecutionEnvCtx): {
     sendUserFileTaskEnvs: TaskEnvRegistry | undefined;
     lspManager: import("@sema-agent/core").NodeLspManager | undefined;
     spaceReclaimer: SpaceReclaimer | undefined;
+    sandboxApiCredentialsGate: (() => void) | undefined;
     sandboxSecretSeatGate: (() => Promise<void>) | undefined;
     sandboxReaper: SandboxReaper | undefined;
     sandboxGitPlane: SandboxGitPlaneSeat;

package/dist/boot/execution-env.js

@@ -12,7 +12,7 @@ import { deviceExecutionEnvFactory } from "../plugins/remote-env-device.js";
 import { e2bExecutionEnvFactory } from "../plugins/remote-env-e2b.js";
 import { createWorkspaceFill } from "../plugins/workspace-fill.js";
 import { hostExecutionEnvFactory, RemoteHostExecutionEnv } from "../plugins/remote-env-host.js";
-import { boundedStoreCall, checkSandboxEgressPolicy, createSandboxPodApi, createSpaceReclaimer, k8sExecutionEnvFactory, readSandboxSecretSeat, rpcTimeoutMsOf } from "../plugins/remote-env-k8s.js";
+import { boundedStoreCall, checkSandboxEgressPolicy, createSandboxPodApi, createSpaceReclaimer, k8sExecutionEnvFactory, readSandboxApiCredentials, readSandboxSecretSeat, rpcTimeoutMsOf, sandboxApiCredentialFact } from "../plugins/remote-env-k8s.js";
 import { podSpecPatchBrokerRefusal, SANDBOX_SECRET_SEAT_VERBS } from "../plugins/k8s-exec-protocol.js";
 import { createSandboxBrokerSeatOf, createSandboxGitPlaneSeat, sandboxGitPlanePremisesOf } from "../sandbox-git-plane.js";
 import { createSandboxPodReaper } from "../plugins/k8s-pod-reaper.js";
@@ -38,6 +38,8 @@ import { isCodeToken } from "../terminal.js";
 import { createCacheMissMemory } from "../workspace-cache.js";
 import { workspaceSnapshotTimeoutOf } from "../workspace-space.js";
 import { sayEgressPolicyReading } from "../sandbox-egress-policy.js";
+import { K8sApiCredentialsMissingError, k8sCredentialsMissingBootSentence, k8sCredentialsMissingRunSentence, k8sCredentialsRejectedRunSentence } from "../k8s-api-credentials.js";
+import { executionEnvRefusalError } from "../execution-env-refusal.js";
 import { sandboxPathEnvSlots, withSandboxPathEnvSlot } from "./deferred-sandbox-path-env.js";
 import { createLaneHomeAbsenceReporter } from "../lane-home-probe.js";
 import { buildLaneHomeBootNote, buildLaneHomeClaim, capabilitiesFor, laneIsolated, laneSandboxReadFloorState } from "../execution-lane-caps.js";
@@ -169,6 +171,22 @@ export function ownsItsWorkspace(ctx) {
 export function createK8sRunEnvFactory(k8sCfg, seats, deps) {
     const cacheMisses = createCacheMissMemory();
     return async (ctx) => {
+        const credentials = await readSandboxApiCredentials(k8sCfg, deps);
+        switch (credentials.state) {
+            case "missing":
+                throw executionEnvRefusalError("env.sandbox_refused", k8sCredentialsMissingRunSentence(credentials.fact));
+            case "rejected":
+                throw executionEnvRefusalError("env.sandbox_refused", k8sCredentialsRejectedRunSentence());
+            case "accepted":
+                break;
+            case "unproven":
+                recordFailOpen("server.sandbox-credentials.probe-unanswered", `namespace=${k8sCfg.namespace} ${credentials.detail}`);
+                break;
+            default: {
+                const unreachable = credentials;
+                throw new Error(`unhandled api credential reading: ${String(unreachable.state)}`);
+            }
+        }
         const onWorkspaceSnapshot = createRunWorkspaceSnapshotSeat(ctx.sessionId);
         const child = !ownsItsWorkspace(ctx);
         const s3Snapshot = child && k8sCfg.s3Snapshot !== undefined ? spaceOff(k8sCfg.s3Snapshot) : k8sCfg.s3Snapshot;
@@ -295,6 +313,7 @@ export function createExecutionEnv(ctx) {
     let executionEnvFactory;
     let spaceReclaimer;
     let sandboxSecretSeatGate;
+    let sandboxApiCredentialsGate;
     let sandboxReaper;
     let sandboxCapacity;
     let sandboxGitPlane = createSandboxGitPlaneSeat((r) => sandboxGitPlanePremisesOf(config, r), {});
@@ -355,9 +374,16 @@ export function createExecutionEnv(ctx) {
             spaceReclaimer = createSpaceReclaimer(k8sCfg);
         sandboxSecretSeatGate = () => ensureSandboxSecretSeat(k8sCfg, logger, undefined, () => readSandboxSecretSeat(k8sCfg, "env"));
         sandboxReaper = createSandboxPodReaper({ api: createSandboxPodApi(k8sCfg), logger, metrics });
-        void checkSandboxEgressPolicy(k8sCfg)
-            .then((gaps) => sayEgressPolicyReading(gaps, logger, k8sCfg.namespace))
-            .catch((e) => logger.error("sandbox_egress_policy_check_crashed", { error: seatText("operator-log-text", e instanceof Error ? e.message : String(e)), effect: "the sandbox egress self-check did not complete this boot — the lane runs; the egress policy was not read" }));
+        const missingApiCredential = sandboxApiCredentialFact(k8sCfg, ctx.laneDeps?.k8s);
+        sandboxApiCredentialsGate = () => {
+            if (missingApiCredential !== undefined)
+                throw new K8sApiCredentialsMissingError(k8sCredentialsMissingBootSentence(missingApiCredential));
+        };
+        if (missingApiCredential === undefined) {
+            void checkSandboxEgressPolicy(k8sCfg, ctx.laneDeps?.k8s)
+                .then((gaps) => sayEgressPolicyReading(gaps, logger, k8sCfg.namespace))
+                .catch((e) => logger.error("sandbox_egress_policy_check_crashed", { error: seatText("operator-log-text", e instanceof Error ? e.message : String(e)), effect: "the sandbox egress self-check did not complete this boot — the lane runs; the egress policy was not read" }));
+        }
     }
     else if (config.remoteExec.provider === "ssh") {
         executionEnvFactory = sshExecutionEnvFactory({
@@ -575,7 +601,7 @@ export function createExecutionEnv(ctx) {
         dropSessionScoped: sessionScoped.dropSession,
         dropSessionScopedOf: sessionScoped.dropSessionOf,
         sessionResidentBackground,
-        executionEnvFactory, worktreeReap, sendUserFileTaskEnvs, lspManager, spaceReclaimer, sandboxSecretSeatGate, sandboxReaper, sandboxGitPlane,
+        executionEnvFactory, worktreeReap, sendUserFileTaskEnvs, lspManager, spaceReclaimer, sandboxApiCredentialsGate, sandboxSecretSeatGate, sandboxReaper, sandboxGitPlane,
         sandboxCapacity,
     };
 }

package/dist/boot/leader.d.ts

@@ -7,51 +7,35 @@
  * (工厂模式的 k8s/host 腿以 `executionEnvFactory` 在场为门;durable 子 worker 挂 `checkpointStore`)。
  */
 import type { ServiceConfig } from "../config.js";
-import type { createBrain } from "../brain.js";
-import type { buildPricing } from "../budget.js";
 import { createLeaderEndpoint } from "../leader/endpoint.js";
+import type { LeaderBirth } from "../leader/leader.js";
 import type { Logger } from "../observability/logger.js";
 import type { CheckpointStoreFull, StoreBackend, ToolResultStoreFull } from "../plugins/store-backend.js";
 import type { createSessionStore } from "../plugins/session-store.js";
-import type { RunnerDeps } from "@sema-agent/core";
+import { type RunnerDeps } from "@sema-agent/core";
+import type { DeploymentPlaneDeps, DeploymentPlaneLane } from "./runner-deps.js";
+import { type KeyResolver } from "./side-query-lane.js";
 export interface LeaderCtx {
     config: ServiceConfig;
     logger: Logger;
-    brain: ReturnType<typeof createBrain>;
-    pricing: ReturnType<typeof buildPricing>;
+    /** 本部署的本地店根(`config.localDataRoot` 缺席时的回落;host 车道上守卫裁决的哨兵目录挂在它下面,与 HTTP 腿同一处)。 */
+    localRoot: string;
     executionEnvFactory: RunnerDeps["executionEnvFactory"];
     toolResultStore: ToolResultStoreFull | undefined;
     sessionStore: ReturnType<typeof createSessionStore>;
     checkpointStore: CheckpointStoreFull | undefined;
     /** [ref]:停驻行凭据的封签器(与 HTTP 面 `ServiceDeps.checkpointCtxSealing` 同一只;起服第 6 段已对「店在、它不在」拒启)。必填键,值可为 undefined。 */
     checkpointCtxSealing: import("../http/checkpoint-ctx.js").CheckpointCtxSealing | undefined;
-    /** [ref] 件B/C/D([ref],codex R2-F1):部署治理三座席 —— leader 车道的每一只 Runner 都要带上它,
-     *  否则开了 leader 端点的部署就有一条在部署治理**之外**的执行面(合规否决/锁都够不着)。 */
-    governanceSeams: import("./governance-seams.js").GovernanceSeams;
     /**
-     * [ref]([ref])—— 主车道 `boot/budget-tracing.ts` 造的**同一只** tracer。leader 车道的每一只 Runner
-     * 都要带:tracer 是 `brain.call` 的唯一记账点(costQuota / fleetUsage / fleetLease / 花费计数四个写口),
-     * 而 `POST /v1/leader` 的准入处**读**的正是它填的那两个桶 —— 缺席 = 门查的桶与花钱的手不是同一只。
-     *
-     * 🔴 **必填键**(值可为 undefined):这三席都刻意写成非可选,让「main.ts 铸了却忘了递」变成**编译红**
-     * 而不是又一次静默漏配([ref]§三族A 病族的机器护栏)。
+     * **部署平面层**的铸口(起服第 6 段交出:与主 / 子 Runner 的平面层同一组输入 —— config / brain / 计量 / 治理座 / 按主体准入 resolver / 豁免根 /
+     * 错误汇 …)。leader 车道的每一只 Runner 展开它的产物,零逐席搬运;新的部署键进平面层即到达 leader。
      */
-    tracer: RunnerDeps["tracer"];
-    /** [ref]([ref],[ref]-T1)—— 治理窗**账本店**(与 `config.usageWindows` 声明成对;声明直接从
-     *  本 ctx 的 config 取,leader 不另读)。缺席 = 未配治理窗的部署。必填键,理由同 `tracer`。 */
-    usageWindowStore: RunnerDeps["usageWindowStore"];
-    /** [ref]([ref])—— center 发布的 prompt catalog(`webAdmin.promptSource`,与主 runner/subRunner
-     *  同一只)。缺席 ⇒ leader 的四类顶层任务跑引擎内置提示词,而同部署其余三条腿跑运维发布的那一份,
-     *  且 core 顶层新任务是**静默**落回(无 notice)。必填键,理由同 `tracer`。 */
-    promptSource: RunnerDeps["promptSource"];
-    /** [ref] 披露半件([ref],codex r2-[high])—— 主车道 `createRunnerDeps` 铸的**同一只**错误汇
-     *  (main.ts 直引 `runnerDeps.onError`,与 subRunner 的先例同姿势)。core 对治理窗**最终扣账失败**的
-     *  唯一出口就是它(`runtask.js` 的 `catch (flushErr) => deps.onError`),所以它与 `usageWindowStore`
-     *  席同生共死:挂窗不挂汇 = 治理轴上的静默失败面([ref])。必填键,理由同 `tracer`。 */
-    onError: RunnerDeps["onError"];
-    /** 部署座 —— 起服第 5 段装配口 `assembleDeploymentMods` 交回的**同一份**(主车道各 Runner 经共享基座吃的就是它)。leader 车道的每一只 Runner 都要带:
-     *  缺席 = 运维声明的 mod 包管不到 leader 派出的腿。必填键,理由同 `tracer`。 */
-    deploymentMods: NonNullable<RunnerDeps["mods"]>;
+    deploymentPlane: (lane: DeploymentPlaneLane) => DeploymentPlaneDeps;
+    /**
+     * per-model 凭据的**活引用**(`webAdmin.getKeyResolver`:中心每次 apply 整只重铸 resolver ⇒ 递取值口,不递当时的值;任务面 / side-query / WebFetch 摘要面同一只)。
+     * leader 车道每条腿的凭据席由它铸({@link createLeaderLegAuth})。必填:没有 web-admin 的装配递 `() => undefined`(每只模型落网关钥,与不配 per-model 钥匙同)。
+     */
+    getKeyResolver: () => KeyResolver;
     /** [ref] 车4 件1:durable store 后端(leader-run 登记表从这里取)。缺席 = 无 DB 的 env-only worker。 */
     backend?: StoreBackend | undefined;
 }
@@ -96,5 +80,22 @@ export declare function buildLeaderObjectStore(env?: NodeJS.ProcessEnv): {
         region?: string;
     };
 };
+/**
+ * leader 车道每条腿**出生时**的两只部署席({@link LeaderBirth} 的 `govern` / `baseline`)—— 装配处闭包活 config 的唯一铸点:起服 {@link createLeaderFace} 递进
+ * wire,部署治理矩阵(`test/operator-knob-client-posture-matrix.test.ts`)的 leader 腿经同一只函数装,矩阵测的就是起服装上的那一份。
+ *  · `govern` —— 部署治理折叠(R3):每条腿出生时调一次,读活 config(热改的 AUTONOMY / commandPolicy / 守卫集对之后出生的腿生效;续跑腿经 resolveSpec 同读)。
+ *    腿的路径裁决经唯一属主:沙盒车道按跑这条腿的会话号取真身;host 车道的 worker 落在工厂才铸的目录里、spec 期不可知 ⇒ 永不创建的哨兵目录
+ *    (与 HTTP 腿未登记工作目录的形同一处,相对目标解析不出真身 ⇒ 守卫的 fail-closed 臂)。
+ *  · `baseline` —— 审批基线的两臂(🔴 **函数席**,[ref] 波 2 ①:审批名单会被中心热换 ⇒ 每条腿出生时现调唯一属主 `createApprovalBaselinePolicy`,与 HTTP 腿 /
+ *    停驻赎回腿同一只构造):耐久腿取 durable 臂(问答门 + 三张名单),不耐久腿取 live 臂(三张名单,问由无人值守层服 —— 答不了即拒)。
+ */
+export declare function createLeaderLegGovernance(config: ServiceConfig, localRoot: string, logger: Logger): Pick<LeaderBirth, "govern" | "baseline">;
+/**
+ * leader 车道每条腿的 **per-model 凭据席**({@link LeaderBirth} 的 `auth`)—— 唯一铸点;席本身是 side-query / WebFetch 摘要面同一只工厂 `createPerModelAuthSeat`
+ * (spec 自带的席折成 `upstream`:先问它、它没意见才按模型解;不覆盖。声明了钥匙却拿不到 ⇒ 抛,与任务面同一只毒丸,绝不回落网关钥)。
+ * 律(与任务面 `resolveSpec` 同读法:spec 出生那一拍从活引用取值):resolver 在**腿出生那一拍**取一次 —— 那一拍与这条腿的 Runner 构造同一同步段,Runner 构造时把模型目录
+ * 收成私有副本,所以钥与目录同代;中心 apply 之后出生的腿取到新的那一只。不按调用现取:在飞腿的目录是上一代,现取会把新家的钥配上旧家的端点。
+ */
+export declare function createLeaderLegAuth(getKeyResolver: () => KeyResolver): LeaderBirth["auth"];
 export declare function createLeaderFace(ctx: LeaderCtx): ReturnType<typeof createLeaderEndpoint> | undefined;
 //# sourceMappingURL=leader.d.ts.map

package/dist/boot/leader.js

@@ -2,9 +2,15 @@ import { createLeaderEndpoint } from "../leader/endpoint.js";
 import { seesRunAs } from "../http/owner-access.js";
 import { claimCallerOf } from "../security.js";
 import { createLeaderParkExpirer, createLeaderRunner } from "../leader/wire.js";
-import { buildDeploymentPostureSeats, buildHandsBand } from "./runner-deps.js";
+import { join } from "node:path";
+import { NodeExecutionEnv } from "@sema-agent/core";
+import { applyRuntimeGovernance } from "../runtime-governance.js";
+import { createApprovalBaselinePolicy, createDeploymentGovernanceInputs } from "../deployment-governance.js";
 import { hasApprovalListIntent } from "../approval.js";
+import { createLegPathAdjudication } from "./leg-path-adjudication.js";
+import { sandboxPathEnvSlots } from "./deferred-sandbox-path-env.js";
 import { WORKSPACE_SNAPSHOT_BUCKET_DEFAULT } from "../object-store-buckets.js";
+import { createPerModelAuthSeat } from "./side-query-lane.js";
 export function leaderK8sMinioGap(leaderEnabled, leaderProvider, hasS3) {
     if (!(leaderEnabled && leaderProvider === "k8s" && !hasS3))
         return null;
@@ -31,8 +37,27 @@ export function buildLeaderObjectStore(env = process.env) {
         return {};
     return { s3: { endpoint, bucket: env.MINIO_BUCKET ?? WORKSPACE_SNAPSHOT_BUCKET_DEFAULT, accessKey, secretKey, ...(env.MINIO_REGION ? { region: env.MINIO_REGION } : {}) } };
 }
+export function createLeaderLegGovernance(config, localRoot, logger) {
+    return {
+        govern: (spec, legSessionId) => applyRuntimeGovernance(spec, createDeploymentGovernanceInputs(config, createLegPathAdjudication(config, {
+            sessionId: legSessionId,
+            leg: "leader",
+            hostArm: () => {
+                const gateCwd = join(config.localDataRoot ?? localRoot, "fs-write-gate-unrooted");
+                return { env: new NodeExecutionEnv({ cwd: gateCwd }), cwd: gateCwd };
+            },
+        }, { slots: sandboxPathEnvSlots, logger }))),
+        baseline: (kind) => createApprovalBaselinePolicy(config, { kind }),
+    };
+}
+export function createLeaderLegAuth(getKeyResolver) {
+    return (upstream) => {
+        const resolver = getKeyResolver();
+        return createPerModelAuthSeat(() => resolver, upstream !== undefined ? { upstream } : {});
+    };
+}
 export function createLeaderFace(ctx) {
-    const { config, logger, brain, pricing, executionEnvFactory, toolResultStore, sessionStore, checkpointStore, checkpointCtxSealing, governanceSeams } = ctx;
+    const { config, logger, executionEnvFactory, toolResultStore, sessionStore, checkpointStore, checkpointCtxSealing } = ctx;
     const leaderMinio = buildLeaderObjectStore();
     const leaderProvider = config.remoteExec.provider;
     const leaderRunStore = ctx.backend?.leaderRun?.();
@@ -45,22 +70,12 @@ export function createLeaderFace(ctx) {
             (leaderProvider === "k8s" && "s3" in leaderMinio && executionEnvFactory) ||
             (leaderProvider === "host" && executionEnvFactory))
         ? createLeaderEndpoint(createLeaderRunner({
-            brain, models: config.models, roles: config.roles, tiers: config.tiers, pricing, logger,
-            governance: {
-                compliancePostureResolver: governanceSeams.compliancePostureResolver,
-                lockedConfig: governanceSeams.lockedConfig,
-                retentionPolicy: governanceSeams.retentionPolicy,
-            },
-            deploymentPosture: () => buildDeploymentPostureSeats(config),
+            logger,
+            plane: () => ctx.deploymentPlane({ commitCoAuthor: undefined }),
+            ...createLeaderLegGovernance(config, ctx.localRoot, logger),
+            auth: createLeaderLegAuth(ctx.getKeyResolver),
+            legSlots: sandboxPathEnvSlots,
             autonomy: () => config.autonomy,
-            ...(ctx.tracer ? { tracer: ctx.tracer } : {}),
-            ...(config.usageWindows && ctx.usageWindowStore
-                ? { usageWindows: config.usageWindows, usageWindowStore: ctx.usageWindowStore }
-                : {}),
-            ...(ctx.promptSource ? { promptSource: ctx.promptSource } : {}),
-            ...(ctx.onError ? { onError: ctx.onError } : {}),
-            mods: ctx.deploymentMods,
-            hands: buildHandsBand(config, undefined),
             fanoutEnabled: config.leaderFanoutEnabled,
             ...(process.env.MODEL_ROUTER_ID ? { routerModel: process.env.MODEL_ROUTER_ID } : {}),
             ...(leaderProvider === "e2b" ? { e2bApiKey: config.remoteExec.apiKey } : {}),
@@ -69,19 +84,14 @@ export function createLeaderFace(ctx) {
             ...(toolResultStore ? { toolResultStore } : {}),
             ...(leaderProvider === "k8s" ? { workspace: "/workspace" } : {}),
             sessionStore,
+            approvalListInForce: () => hasApprovalListIntent(config),
             ...(checkpointStore
                 ? {
-                    durable: () => hasApprovalListIntent(config)
-                        ? {
-                            checkpointStore,
-                            ctxSealer: checkpointCtxSealing,
-                            requireApproval: config.approvalRequire,
-                            deny: config.approvalDeny,
-                            autoBudget: config.approvalAutoBudget,
-                            neverAuto: config.approvalNeverAuto,
-                            ...(config.approvalTimeoutSec > 0 ? { ttlMs: config.approvalTimeoutSec * 1000 } : {}),
-                        }
-                        : undefined,
+                    durable: () => ({
+                        checkpointStore,
+                        ctxSealer: checkpointCtxSealing,
+                        ...(config.approvalTimeoutSec > 0 ? { ttlMs: config.approvalTimeoutSec * 1000 } : {}),
+                    }),
                 }
                 : {}),
         }), {

package/dist/boot/leg-path-adjudication.d.ts

@@ -0,0 +1,40 @@
+/**
+ * **腿的路径裁决**(守卫集 / 写门裁决用的 env 与基准)—— 唯一属主。读者三处同调:HTTP 提交 / 续跑腿(`boot/resolve-spec.ts`)、停驻赎回腿
+ * (`boot/parked-revive-gate.ts`)、leader 车道的每一条腿(`boot/leader.ts` 交给出生口的治理折叠)。
+ *
+ * 律(一句):车道分形只问部署形表一行(`sandboxPathAdjudication`)—— 文件平面不在本进程盘上 ⇒ 代理({@link DeferredSandboxPathEnv})在裁决时刻按
+ * **这条腿的会话号**去槽表取那台真沙盒;在本进程盘上 ⇒ 腿自己给的 host 臂(真 fs;cwd / 真任务根是腿的知识,本口不猜)。两臂同带执行环境的 home
+ * (`~/` 形规则的基,唯一属主 `executionLaneHomeDir`)。
+ *
+ * 槽表的写者:部署工厂的装饰器(`withSandboxPathEnvSlot`,工厂铸的 env 按 `ctx.sessionId` 登记),以及**手里握着 env 的腿**自己登记 —— leader 的静态
+ * 车道 worker 与集成修复腿的 env 不是部署工厂为那条腿铸的,由 leader 按跑它的会话号登记进**同一只**槽表(`leader/wire.ts`)。没登记 ⇒ 代理取不到真身
+ * ⇒ 守卫 fail-closed(每一次结构化写被拒)—— 方向对,但那是把腿瘫痪,所以登记是承重的。
+ */
+import type { ServiceConfig } from "../config.js";
+import type { PathAdjudication } from "../deployment-governance.js";
+import { DEPLOYMENT_SHAPE_PREDICATES } from "../deployment-shape.js";
+import { executionLaneHomeDir } from "../execution-lane-caps.js";
+import { type SandboxPathEnvSlots } from "./deferred-sandbox-path-env.js";
+/** 本口读的部署切面:车道形(部署形表行的输入)+ 执行环境 home 的运维声明。 */
+export type LegPathAdjudicationConfigView = Parameters<typeof DEPLOYMENT_SHAPE_PREDICATES.sandboxPathAdjudication.holds>[0] & Parameters<typeof executionLaneHomeDir>[0] & {
+    readonly remoteExec: ServiceConfig["remoteExec"];
+};
+/** 一条腿在裁决面上的位置。 */
+export interface LegPathPlace {
+    /** 槽表的键 = 跑这条腿的会话号(沙盒车道上代理按它取真身)。缺席 ⇒ 代理恒 fail-closed。 */
+    readonly sessionId: string | undefined;
+    /** 槽取不到时那一行 warn 上的腿名(缺席 = 不写这个字段)。 */
+    readonly leg?: string;
+    /** host 语义车道上这条腿的真 fs 裁决(env + 相对基准 + 真任务根):每条腿各有自己的 cwd 知识,本口只在 host 车道调它。 */
+    readonly hostArm: () => Pick<PathAdjudication, "env" | "cwd" | "taskRoot">;
+}
+/** 代理的两件(进程内唯一的槽表 + 留痕面)。 */
+export interface LegPathSeat {
+    readonly slots: SandboxPathEnvSlots;
+    readonly logger: {
+        warn: (event: string, fields?: Record<string, unknown>) => void;
+    };
+}
+/** 活对象(代理 env)⇒ `create*`。每次调用现铸(读活 config;代理每实例留痕一次)。 */
+export declare function createLegPathAdjudication(config: LegPathAdjudicationConfigView, place: LegPathPlace, seat: LegPathSeat): PathAdjudication;
+//# sourceMappingURL=leg-path-adjudication.d.ts.map

package/dist/boot/leg-path-adjudication.js

@@ -0,0 +1,18 @@
+import { DEPLOYMENT_SHAPE_PREDICATES } from "../deployment-shape.js";
+import { executionLaneHomeDir } from "../execution-lane-caps.js";
+import { DeferredSandboxPathEnv } from "./deferred-sandbox-path-env.js";
+export function createLegPathAdjudication(config, place, seat) {
+    const home = executionLaneHomeDir(config);
+    const homeBase = home !== undefined ? { taskHome: home } : {};
+    if (!DEPLOYMENT_SHAPE_PREDICATES.sandboxPathAdjudication.holds(config))
+        return { ...place.hostArm(), ...homeBase };
+    return {
+        env: new DeferredSandboxPathEnv({
+            sessionId: place.sessionId,
+            slots: seat.slots,
+            logger: { warn: (event, fields) => seat.logger.warn(event, { ...(fields ?? {}), lane: config.remoteExec.provider, ...(place.leg !== undefined ? { leg: place.leg } : {}) }) },
+        }),
+        ...homeBase,
+    };
+}
+//# sourceMappingURL=leg-path-adjudication.js.map

package/dist/boot/parked-revive-gate.js

@@ -4,9 +4,8 @@ import { recordFailOpen } from "../observability/fail-open.js";
 import { decodeCheckpointScope } from "../security.js";
 import { createApprovalBaselinePolicy, createDeploymentGovernanceInputs, } from "../deployment-governance.js";
 import { applyRuntimeGovernance } from "../runtime-governance.js";
-import { DeferredSandboxPathEnv, sandboxPathEnvSlots } from "./deferred-sandbox-path-env.js";
-import { DEPLOYMENT_SHAPE_PREDICATES } from "../deployment-shape.js";
-import { executionLaneHomeDir } from "../execution-lane-caps.js";
+import { sandboxPathEnvSlots } from "./deferred-sandbox-path-env.js";
+import { createLegPathAdjudication } from "./leg-path-adjudication.js";
 import { createSessionExemptionRead } from "../approval.js";
 import { seatText } from "../trace/exit-seat.js";
 function hostGateCwd(config, localRoot) {
@@ -17,18 +16,7 @@ export function createParkedReviveInheritedGate(deps) {
     const slots = deps.slots ?? sandboxPathEnvSlots;
     return async (row, identity) => {
         const metadata = await chainMetadataOf(deps, row, identity);
-        const laneHome = executionLaneHomeDir(config);
-        const homeBase = laneHome !== undefined ? { taskHome: laneHome } : {};
-        const pathAdjudication = DEPLOYMENT_SHAPE_PREDICATES.sandboxPathAdjudication.holds(config)
-            ? {
-                env: new DeferredSandboxPathEnv({
-                    sessionId: row.sessionId,
-                    slots,
-                    logger: { warn: (event, fields) => logger.warn(event, { ...(fields ?? {}), lane: config.remoteExec.provider, leg: "parked_revive" }) },
-                }),
-                ...homeBase,
-            }
-            : { env: createHostAdjudicationEnv(config, localRoot), ...homeBase };
+        const pathAdjudication = createLegPathAdjudication(config, { sessionId: row.sessionId, leg: "parked_revive", hostArm: () => ({ env: createHostAdjudicationEnv(config, localRoot) }) }, { slots, logger });
         const rootSessionId = row.rootSessionId;
         const baseline = createApprovalBaselinePolicy(config, {
             kind: "durable",

package/dist/boot/reapers.d.ts

@@ -194,7 +194,7 @@ interface ReapSessionsInputs {
  *    抛的后果是安全的:core 两条臂的 release 都在 try 内、且计数在 release **之后**递增 ⇒ 抛 = 不计数
  *    + 下一 tick 重新枚举重试(失败经济学与 core 的成文一致:泄漏给下一轮,而不是谎报已清)。
  *
- * 抽成具名工厂而不是就地闭包的理由与 `createEngineNoticeSeat` 逐字同一条:判据在**值**上
+ * 抽成具名工厂而不是就地闭包的理由与当年 leader 通告席那只判据函数逐字同一条:判据在**值**上
  * (哪只店被调),源码文本门看不出对错,只有行为测得出来。
  */
 export declare function createPlacementAwareReapSessions(deps: ReapSessionsInputs): ReapSessionsFacade;

package/dist/boot/reapers.js

@@ -165,7 +165,7 @@ export function startReapers(ctx) {
     let permissionRuleReapInFlight = false;
     let approvalReconcileInFlight = false;
     const approvalReconciler = (() => {
-        if (!config.streamApproval.enabled || !backend)
+        if (!backend)
             return undefined;
         return createApprovalReconciler({
             askStore: backend.approvalAsk(),

package/dist/boot/resolve-spec.js

@@ -60,8 +60,9 @@ import { inertToolListEntryOf } from "../rule-entry-list.js";
 import { assertAttachmentIdsShape, assertImageProfileLane, assertInheritEnvServed, assertToolListsReadable, assertWriteFaceAdmitted, bodyImageProfileOf, scenarioRequestedBy } from "../request-form.js";
 import { TENANCY_WALL_CLOCK_BASE_SEC, enableForkFromBody, normalizeRetainSubagentSessions, selfOrchestrationFromBody } from "../task-workflow.js";
 import { redactSecrets } from "../trace/redact.js";
-import { DeferredSandboxPathEnv, sandboxPathEnvSlots } from "./deferred-sandbox-path-env.js";
-import { executionLaneHomeDir, executionLaneOf, laneIsolated, laneWiresExecutionEnv } from "../execution-lane-caps.js";
+import { sandboxPathEnvSlots } from "./deferred-sandbox-path-env.js";
+import { createLegPathAdjudication } from "./leg-path-adjudication.js";
+import { executionLaneOf, laneIsolated, laneWiresExecutionEnv } from "../execution-lane-caps.js";
 import { executionConfigRootOf } from "../execution-config-root.js";
 import { withUnattendedLeg } from "../unattended-permission-mode.js";
 import { bindingsOf } from "../session-bindings.js";
@@ -255,7 +256,7 @@ export function createResolveSpec(ctx) {
     const gateScenarioAndAppend = async (body, auth, root, opts, settingsEnv) => {
         const { parts: subjectParts, person } = identityAxesOf(auth);
         const requestedScenario = scenarioRequestedBy(subjectParts?.scenario, body.scenario);
-        const scenarioName = await scenarioGate(person, requestedScenario);
+        const { scenario: scenarioName } = await scenarioGate(person, requestedScenario);
         const rootFace = sessionHeadOf === undefined ? undefined : sessionFaceOfHead(root, await sessionHeadOf(root));
         const sessionWitness = { sessionId: root, owner: rootFace?.owner ?? null, incarnation: rootFace?.incarnation ?? null };
         const cap = selectScenario(scenarios, scenarioName)(body, person, { sessionId: sessionWitness.sessionId, delegationRoot: sessionWitness });
@@ -480,7 +481,7 @@ export function createResolveSpec(ctx) {
             ...(declaresInteractivePosture(body, req, opts) ? { interactionPosture: "interactive" } : {}),
             ...(body.approvalReach !== undefined ? { approvalReach: body.approvalReach } : {}),
             ...(typeof body.oneShot === "boolean" ? { oneShot: body.oneShot } : {}),
-            resilience: normalizeResilience(body.resilience, explicitOperatorOk(person, config)),
+            resilience: normalizeResilience(body.resilience, explicitOperatorOk(person, config, "operate")),
             finalVerification: cap.finalVerification === true || body.finalVerification === true ? true : undefined,
             attachments: normalizeAttachments(body.attachments),
             ...(taskHooks.length > 0 ? { mods: [...taskHooks] } : {}),
@@ -596,29 +597,14 @@ export function createResolveSpec(ctx) {
     const foldGovernanceAndSettings = async (body, auth, root, spec, gated, projectBrief, legSessionCwd) => {
         const { acceptedAppend, parsedSettings } = gated;
         const hostSemanticsLane = !DEPLOYMENT_SHAPE_PREDICATES.sandboxPathAdjudication.holds(config);
-        const laneHomeBase = () => {
-            const home = executionLaneHomeDir(config);
-            return home !== undefined ? { taskHome: home } : {};
-        };
-        const pathAdjudication = hostSemanticsLane
-            ? (() => {
+        const pathAdjudication = createLegPathAdjudication(config, {
+            sessionId: root,
+            hostArm: () => {
                 const realRoot = realTaskRootOf(legSessionCwd);
                 const gateCwd = realRoot ?? join(config.localDataRoot ?? localRoot, "fs-write-gate-unrooted");
-                return {
-                    env: new NodeExecutionEnv({ cwd: gateCwd }),
-                    cwd: gateCwd,
-                    ...(realRoot !== undefined ? { taskRoot: realRoot } : {}),
-                    ...laneHomeBase(),
-                };
-            })()
-            : {
-                env: new DeferredSandboxPathEnv({
-                    sessionId: root,
-                    slots: sandboxPathEnvSlots,
-                    logger: { warn: (event, fields) => logger.warn(event, { ...(fields ?? {}), lane: config.remoteExec.provider }) },
-                }),
-                ...laneHomeBase(),
-            };
+                return { env: new NodeExecutionEnv({ cwd: gateCwd }), cwd: gateCwd, ...(realRoot !== undefined ? { taskRoot: realRoot } : {}) };
+            },
+        }, { slots: sandboxPathEnvSlots, logger });
         const governedBase = applyRuntimeGovernance(spec, createDeploymentGovernanceInputs(config, pathAdjudication));
         let governed = governedBase;
         let effectiveSettings = parsedSettings.settings;
@@ -677,7 +663,7 @@ export function createResolveSpec(ctx) {
             const resolved = await resolveSandboxImageRef({
                 profile: taskImageProfile,
                 ...(capsNeeded && capsNeeded.length > 0 ? { capabilitiesNeeded: capsNeeded } : {}),
-                viewer: { operator: explicitOperatorOk(person, config), tenantId: person ?? null },
+                viewer: { operator: explicitOperatorOk(person, config, "operate"), tenantId: person ?? null },
                 index: imageIndex,
             });
             if (!resolved.ok)

package/dist/boot/runner-deps.d.ts

@@ -245,7 +245,7 @@ export interface RunnerDepsCtx {
     lspManager: RunnerDeps["lspManager"];
     fleetBus: FleetEventBus;
     /** 部署座的 mods 注册(起服第 5 段装配口 `assembleDeploymentMods` 铸:自铸 + 运维声明的包,起服自证过)—— 主 / handless / hookAgent / sub 经本共享基座、
-     *  leader 车道的路由 / worker / 修复腿经 `LeaderWireConfig.mods`(`boot/leader.ts` 递同一份),每一只 Runner 同一份。 */
+     *  leader 车道的路由 / worker / 修复腿经部署平面层(同一铸点),每一只 Runner 同一份。 */
     deploymentMods: NonNullable<RunnerDeps["mods"]>;
     workflowRunStore: WorkflowRunStore | undefined;
     workflowJournalStore: ServiceWorkflowJournalStore | undefined;
@@ -253,9 +253,22 @@ export interface RunnerDepsCtx {
     workflowNotifyGate: WorkflowNotifyGate | undefined;
     deliverWorkflowCompletion: (p: WorkflowCompletionPayload) => Promise<void>;
 }
-/** [ref] A10 留档发现②:main runner `RunnerDeps` 与 main.ts subRunner 字面量之间此前手工重复
- * 的 ~15 个键,类型标注见 {@link createSharedRunnerDeps} 头注。 */
-export type SharedRunnerDeps = Pick<RunnerDeps, "brain" | "readFace" | "readDenyPatterns" | "readDenyBuiltinTiers" | "readDenyBuiltinExclude" | "readDenyFloorRequired" | "memoryDelegationEvidence" | "memoryProvenance" | "memoryCapturePolicy" | "delegationEntryCaps" | "crossSessionInbound" | "crossSessionDialogExpiry" | "writeProtectedPaths" | "memoryEngineDir" | "allowedTools" | "crossBoundaryPosture" | "models" | "roles" | "tiers" | "pricing" | "tracer" | "promptSource" | "executionEnvFactory" | "lspManager" | "backgroundAgentStore" | "mailboxStore" | "rosterStore" | "mods" | "toolResultStore" | "checkpointStore" | "fileHistoryStore" | "fileHistoryCapture" | "hands" | "sessionPolicyStore" | "usageWindows" | "usageWindowStore" | "memoryScopeAdmission" | "deploymentMemoryScopes" | "sharedMemoryStores" | "compliancePostureResolver" | "lockedConfig" | "retentionPolicy" | "onNotice" | "mcpRevocations" | "peerSeat" | "runtimeCapsResolver">;
+/**
+ * **部署平面层**:一台部署对**每一条腿说同一句话**的键 —— 收紧面(治理三座 / 按主体准入 / MCP 撤销台账 / 部署姿态座席族 / 豁免根)+ 计量面
+ * (tracer / 治理窗两键)+ 服务表(brain / 模型目录 / 定价 / 提示词目录)+ 部署座 / 手带 + 两条披露出口(通告 / 错误)。
+ * 律:本进程每一只跑带主体 spec 的 Runner —— 主 / 无手 / hook 代理 / 子代 / run-local,**以及 leader 车道的每一只** —— 展开**同一层**
+ * ({@link createDeploymentPlaneDeps},唯一铸点);新的部署键进这一层即到达全部 Runner,没有哪条车道逐席搬运。
+ * 不在这一层的是**会话设施**({@link SessionFacilityDeps}):各车道按自己的生命周期自选(leader 的沙盒、停驻店与会话店归 leader)。
+ */
+export type DeploymentPlaneDeps = Pick<RunnerDeps, "brain" | "models" | "roles" | "tiers" | "pricing" | "tracer" | "promptSource" | keyof DeploymentPostureSeats | "mods" | "hands" | "usageWindows" | "usageWindowStore" | "compliancePostureResolver" | "lockedConfig" | "retentionPolicy" | "onNotice" | "onError" | "runtimeCapsResolver" | "mcpRevocations" | "memoryEngineDir">;
+/**
+ * **会话设施层**:停驻店、卸载店、后台子代店 / 信箱 / 名册、文件历史、会话规则、记忆三席、LSP、对端座、执行环境工厂 —— 按会话 / 车道的
+ * 生命周期选,不是部署对每条腿说的话。起服的主 / 子 Runner 与 run-local 经共享基座取全套;leader 车道不取(它的沙盒、停驻店、会话店按 worker
+ * 自己的生命周期给,`leader/wire.ts`)。
+ */
+export type SessionFacilityDeps = Pick<RunnerDeps, "executionEnvFactory" | "lspManager" | "backgroundAgentStore" | "mailboxStore" | "rosterStore" | "toolResultStore" | "checkpointStore" | "fileHistoryStore" | "fileHistoryCapture" | "sessionPolicyStore" | "memoryScopeAdmission" | "deploymentMemoryScopes" | "sharedMemoryStores" | "peerSeat">;
+/** 共享基座 = 部署平面层 + 会话设施层(起服主 / 子 Runner 与 run-local 的两只 Runner 展开它)。 */
+export type SharedRunnerDeps = DeploymentPlaneDeps & SessionFacilityDeps;
 /**
  * [ref] A10 留档发现②(review 2026-07-29,[ref]§三族A 同源修补的延续):main runner 的
  * `RunnerDeps` 字面量(下方 `createRunnerDeps`)与 `main.ts` 里 subRunner 的 `new Runner({...})`
@@ -281,8 +294,17 @@ export type SharedRunnerDeps = Pick<RunnerDeps, "brain" | "readFace" | "readDeny
  *    [ref]§三族A 已用「直引 `runnerDeps.X`」修过(main.ts 两处引用同一个 `runnerDeps` 实例的同一
  *    属性,比再抽一层共享基座更强的同源保证),不重复收纳进这里。
  */
-/** 基座真实消费的窄面(Pick)——subRunner 调用点(main.ts)只需凑这 13 个字段,不必造全量 ctx。 */
-export type SharedRunnerDepsCtx = Pick<RunnerDepsCtx, "config" | "brain" | "pricing" | "tracer" | "promptSource" | "executionEnvFactory" | "lspManager" | "backgroundAgentStore" | "mailboxStore" | "rosterStore" | "deploymentMods" | "toolResultStore" | "checkpointStore" | "fileHistoryStore" | "sessionPolicyStore" | "commitCoAuthor" | "usageWindowStore" | "orgMemoryAdmission" | "sharedMemoryStores" | "logger" | "governanceSeams" | "mcpRevocations" | "metrics" | "engineDataRoot" | "peerDesk" | "runtimeCapsResolver">;
+/** 部署平面层的输入(窄面)。`onError` = 本进程的错误汇(起服 = `createRunnerDeps` 铸的那一只,run-local = 它自己的那一只):必填键(值可缺席),
+ *  每个平面层调用点都得回答「这条腿的引擎错误交给谁」—— 它是按主体准入 resolver 抛 / 治理窗最终扣账失败的唯一出口,与 resolver、窗席同生共死。 */
+export type DeploymentPlaneCtx = Pick<RunnerDepsCtx, "config" | "brain" | "pricing" | "tracer" | "promptSource" | "deploymentMods" | "usageWindowStore" | "logger" | "governanceSeams" | "mcpRevocations" | "metrics" | "engineDataRoot" | "runtimeCapsResolver"> & {
+    readonly onError: RunnerDeps["onError"];
+};
+/** 平面层里**车道给**的一格:提交署名(`hands.commitCoAuthor`;起服 / run-local 各按品牌算一次,leader 车道不署名 ⇒ `undefined`)。 */
+export interface DeploymentPlaneLane {
+    readonly commitCoAuthor: RunnerDepsCtx["commitCoAuthor"];
+}
+/** 共享基座的输入 = 平面层的输入 + 会话设施的输入。 */
+export type SharedRunnerDepsCtx = DeploymentPlaneCtx & Pick<RunnerDepsCtx, "executionEnvFactory" | "lspManager" | "backgroundAgentStore" | "mailboxStore" | "rosterStore" | "toolResultStore" | "checkpointStore" | "fileHistoryStore" | "sessionPolicyStore" | "commitCoAuthor" | "orgMemoryAdmission" | "sharedMemoryStores" | "peerDesk">;
 /** 转发席只需要 `inc` —— 刻意窄到这一个动词,免得把整只 Metrics 拖进这条纯转发腿。 */
 export interface EngineNoticeMetricsSeat {
     inc: (name: string, labels?: Record<string, string>) => void;
@@ -299,39 +321,14 @@ export declare function createEngineNoticeForwarder(logger: {
 export declare function installDefaultEngineNoticeSeat(logger: {
     warn: (msg: string, fields?: Record<string, unknown>) => void;
 }, metrics?: EngineNoticeMetricsSeat): void;
-/**
- * `onNotice` **席**的装配判据本身 —— 「`warn` 真在场才铸席」这一条从此是**一个可直接调用的函数**,
- * 不是散在装配点、只能靠扫源码文本去猜的一行三元(codex 交叉复审 R1-[medium],验真后修)。
- *
- * 病(实测):把 leader 的门写成 `cfg.logger ? ((m, x) => cfg.logger?.warn?.(m, x)) : undefined` 时,
- * 「装配点切片里出现过 `warn` 这个词」这类**源码文本**判据一律照绿 —— 而只装了 `info` 的部署会拿到一个
- * truthy 闭包、照样铸席,通告随后被可选链**静默吞掉**,比不铸席更坏(不铸时 core 至少还打它自己的
- * `console.warn`,响亮权留在原处)。任何「在这段文本里找关键字」的门都挡不住这一族变异,因为病灶在
- * **值**(闭包 truthy)而不在字面。⇒ 把判据搬进函数,让它可以被**行为**测:info-only ⇒ 空席;带 warn ⇒
- * 具名转发体。
- *
- * 命名(CLAUDE.md 工厂律):返回的袋子里装的是**活闭包**(有行为)⇒ `create*`,不是 `build*`。
- * 返回**展开形**(`{}` 或 `{ onNotice }`)而不是 `onNotice: undefined`。理由是**键卫生**,不是 core 行为
- * (R3 复扫更正:core 5.28 的 `deliverEngineNotice` 只判 `typeof onNotice === "function"`,显式 `undefined`
- * 与键缺席在 core 那侧行为逐字相同、响亮权都留在 core——旧句「显式 undefined 也算 host 接管」与真码相反):
- * 展开形让 `new Runner({...seat})` 的键集只随真装配变化,EXPECTED_SHARED_KEYS 类的键集绊线才数得准。
- */
-export declare function createEngineNoticeSeat(logger: {
-    warn?: (msg: string, fields?: Record<string, unknown>) => void;
-} | undefined, router?: EngineNoticeRouter): {
-    onNotice?: NonNullable<RunnerDeps["onNotice"]>;
-};
 /**
  * [ref](黑板 [ref],[ref] 登记)—— **部署姿态座席族**:运维在配置面写下的姿态(READ 面四席 + 记忆三席 +
  * 委派入口 caps)。core 明写「每个 run 读**准备它的那只 Runner** 的 deps」⇒ 一台部署里跑任务的**每一只**
- * Runner 都必须带同一份:主 runner / subRunner / run-local(经 {@link createSharedRunnerDeps} 展开)+
- * **leader lane 五只**(`boot/leader.ts` → `LeaderWireConfig.deploymentPosture` → `src/leader/wire.ts`
- * 五处 `...deploymentPostureSeat`)。
+ * Runner 都必须带同一份:本进程每一只 Runner 经部署平面层({@link createDeploymentPlaneDeps})展开它 —— 主 runner / subRunner /
+ * run-local 经共享基座,leader 车道的四只经 `LeaderWireConfig.plane`。
  *
  * 🔴 本函数是这一族**唯一**的取值点。两处各读一遍 config 就是 [ref]§三族A「主挂了、副漏挂」的病族形——
- * [ref] 正是 leader 那条腿漏了**全族**(修前 wire.ts 五处一席都没有;边界曾靠
- * `test/memory-delegation-evidence-lane.test.ts` ⑤ 组的机器门如实登记,现已翻成正向门)。leader 不许自己
- * 再读 config 铸一份,只吃本函数经 cfg 递过去的产物(`test/leader-deployment-posture-seats.test.ts` ③ 钉)。
+ * [ref] 正是 leader 那条腿漏了**全族**。平面层每次铸都现调本函数(中心热换 READ 面之后新构造的 Runner 读新档,[ref])。
  *
  * 纯数据(键值全是 config 透传,无闭包)⇒ `build*`(CLAUDE.md 工厂律)。键**恒在场**、缺席 = `undefined`
  * ([ref] S4 house style;core 消费点全按 `!== undefined` / `??` 判 —— dist
@@ -359,7 +356,7 @@ export declare function crossBoundaryPostureOf(requirePrincipal: boolean): Cross
 /**
  * 手带(`RunnerDeps.hands`)的**唯一**铸点(纯数据 ⇒ `build*`)。两格两个来源:署名由腿给(两条腿判据不同,见 {@link RunnerDepsCtx.commitCoAuthor};
  * leader 车道今天不署名,显式交 `undefined`),前台命令超时转后台读部署旋钮 `AUTO_BACKGROUND_ON_TIMEOUT` —— 旋钮的读点只有这里。
- * 共享基座(主 / 无手 / hook 代理 / 子代,HTTP 与 run-local 两条腿)与 leader 车道(`boot/leader.ts` → `LeaderWireConfig.hands`)同调这一只:
+ * 部署平面层调这一只(署名一格由车道给,{@link DeploymentPlaneLane}):
  * 有手的每一只 Runner 都拿到它,`/health.autoBackgroundOnTimeout` 说「生效」时没有哪只 Runner 例外。
  */
 export declare function buildHandsBand(config: Pick<ServiceConfig, "autoBackgroundOnTimeout">, commitCoAuthor: RunnerDepsCtx["commitCoAuthor"]): NonNullable<RunnerDeps["hands"]>;
@@ -371,6 +368,13 @@ export declare function buildDeploymentPostureSeats(config: DeploymentPostureCon
  * 喂的是 `config.readDenyPatterns`(运维 ∪ 中心 read-face 的行),不是座席族并入 LKG 派生行之后的那一份 —— 派生行是根锚。绝不抛(纯诊断面)。
  */
 export declare function announceReadDenyRows(config: Pick<ServiceConfig, "readDenyPatterns">, logger: Pick<Logger, "warn">): void;
+/**
+ * **部署平面层的唯一铸点**({@link DeploymentPlaneDeps})。纯函数、无副作用(读拒行的进场告知留在共享基座 —— leader 每构造一只 Runner 调本函数一次,
+ * 告知不随它重复)。每次调用现读 `config`:部署姿态座席族与模型目录会被中心热换,逐调用现构的 Runner(leader 车道)读到的是构造那一刻的代,
+ * 与主车道经 swap 门换代同代([ref]);起服的主 / 子 Runner 各展开一次,同一份 ctx ⇒ 同值同引用。
+ * 署名一格车道给({@link DeploymentPlaneLane});其余每一格对每一条腿同一句话。
+ */
+export declare function createDeploymentPlaneDeps(ctx: DeploymentPlaneCtx, lane: DeploymentPlaneLane): DeploymentPlaneDeps;
 export declare function createSharedRunnerDeps(ctx: SharedRunnerDepsCtx): SharedRunnerDeps;
 /**
  * 这台部署**声明本机属主的规则桶**吗(core `RunnerDeps.localOwnerRules`:不带主体的 run 经规则店的 `forLocalOwner()` 读持久规则,而不是读零规则)。