@sema-agent/server 7.43.0 → 7.44.0

package/dist/runtime-caps-resolver.js

@@ -2,19 +2,7 @@ import { fetchPrincipalCaps } from "./config-center/facade.js";
 import { HttpError } from "./security.js";
 import { createLogger } from "./observability/logger.js";
 const defaultLogger = createLogger();
-/** #157 / [2762]§五(sema-comms `audits/failopen-governance-176.md` §7 "已知在办 1 条"):module-scope,
- *  once-per-process record of which {@link gateExecutionLane} fail-open DEFAULT form has already been traced.
- *  Two forms are counted SEPARATELY (both currently resolve to the same "pass" default, but they are different
- *  facts about the world — a caller must be able to tell "we never got a ruling for this principal" apart from
- *  "center ruled, and explicitly said not-required"):
- *   - `"no_ruling"` — `ruling === undefined` (no principal / center absent-or-blip / older center missing the key).
- *   - `"required_false"` — a ruling WAS resolved and it explicitly says `required: false`.
- *  Each form logs ONCE per process at first hit (a debug line — this is an expected, non-alarming default, not a
- *  warning); every subsequent hit of the SAME form only increments the counter (no repeat log line — this is a
- *  per-task gate, so without the throttle a busy deployment would log once per task forever). Pure record-keeping:
- *  never changes {@link gateExecutionLane}'s pass/deny outcome. */
 const executionLaneDefaultTrace = new Map();
-/** test-only: reset the once-per-process trace so each test observes a fresh "first hit". */
 export function resetExecutionLaneDefaultTraceForTest() {
     executionLaneDefaultTrace.clear();
 }
@@ -22,14 +10,8 @@ function traceExecutionLaneDefault(form, ownLane, logger) {
     const hitCount = (executionLaneDefaultTrace.get(form) ?? 0) + 1;
     executionLaneDefaultTrace.set(form, hitCount);
     if (hitCount > 1)
-        return; // subsequent hits: silently counted only (see map above), no repeat log line
+        return;
     try {
-        // codex 交叉复审第二轮真发现(2026-08-05):a throwing `logger.debug` must NEVER turn this pure
-        // observability step into gateExecutionLane itself throwing — that would silently convert a fail-open
-        // PASS into an uncaught exception, the exact inversion this module's whole design fights elsewhere
-        // (see the FAIL-CLOSED/FAIL-OPEN posture doc above). The hit-count above already advanced, so a retry
-        // of the SAME form stays silent rather than storming — the trade-off is "lose one trace line", not
-        // "lose one task admission".
         logger.debug("execution_lane_default_applied", {
             dimension: "execution_lane",
             form,
@@ -41,34 +23,12 @@ function traceExecutionLaneDefault(form, ownLane, logger) {
         });
     }
     catch {
-        // tracing must never affect the fail-open admission outcome — see comment above.
     }
 }
-/** Map center's `EntitlementRuntimeCaps` → the subset core's engine enforces. `allowUltracode` (shell/UX) is
- *  dropped on purpose (not a core primitive); `allowWorkflows` / `forceDurableGate` / `allowFork` are the three the
- *  engine enforces. Returns undefined when no enforceable cap is set (= no restriction). FAIL-CLOSED defense-in-depth:
- *  do NOT trust the wire to be boolean. center serializes these as zod-validated booleans, but a schema drift / proxy
- *  mangling that sent a TRUTHY non-boolean (e.g. the STRING "false") would slip past core's strict `=== false` deny
- *  check and silently GRANT. So a cap that is PRESENT but not a real boolean is a contract breach → THROW (the
- *  resolver's catch then fail-closes to deny). `allowFork` (registry-core 0.1.47): the per-principal Fork
- *  ceiling — core mounts Fork only when `runtimeCaps.allowFork !== false` (prepare-task), tighten-only like allowWorkflows.
- *
- *  `allowObservers`(observer 开闸线,core 1.270.0/1.273.0):**极性与 allow* 相反** —
- *  core 是 `=== true` 显式 opt-in(默认 OFF,undefined ships dark)。registry-core 0.10.3 起该键已收编进
- *  `EntitlementRuntimeCaps` 类型(此前 0.10.2 走 unknown 宽读透传,现为类型直读,行为零变)。
- *  **缺键=不写键**(绝不把缺键补成显式 false —— core 是唯一默认源,补 false 语义上等价但会伪造「center
- *  说过话」的显式判决,污染 env-baseline 合成序,见 applyObserverEnvOptIn)。非 boolean 虽然骗不过 core
- *  的 `=== true`(不会误 GRANT),但 PRESENT-非-boolean 与 allow* 同属同一 body 的契约破损信号 → 同款 THROW。
- *
- *  `autoMode`(core 1.276.0 `RuntimeCaps.autoMode`):auto-mode 分类器 per-principal
- *  开闸线,极性同 allowObservers(`=== true` 显式 opt-in,默认 OFF;真执行还要 deployment 装配
- *  `RunnerDeps.autoMode` 分类器面=信任门,center 键只是 entitlement 半场)。[2373]B-6a:registry-core
- *  0.13.0 已把 autoMode 收进 EntitlementRuntimeCaps(types.d.ts:1786)——宽读逃逸期结束,现为类型直读
- *  (allowObservers 同款收编先例)。 */
 export function toCoreRuntimeCaps(ent) {
     if (!ent)
         return undefined;
-    const autoMode = ent.autoMode; // [2373]B-6a:0.13.0 类型直读(宽读逃逸已收编)
+    const autoMode = ent.autoMode;
     const badCap = (v) => v !== undefined && typeof v !== "boolean";
     if (badCap(ent.allowWorkflows) || badCap(ent.forceDurableGate) || badCap(ent.allowFork) || badCap(ent.allowObservers) || badCap(autoMode)) {
         throw new Error("runtimeCaps from center carries a non-boolean cap (contract breach — fail closed)");
@@ -86,43 +46,12 @@ export function toCoreRuntimeCaps(ent) {
         caps.autoMode = autoMode;
     return Object.keys(caps).length ? caps : undefined;
 }
-/**
- * #A5([4147] 件2)—— 「这台 worker 上**存在** per-principal entitlement 源吗」的**单一谓词**。
- *
- * 判据逐字 = `boot/runtime-caps.ts` 建 caps 客户端的那一条(**配了 center ∧ 非 dry-run**):dry-run 的部署
- * 拉取并记录 center 配置但**不应用、不执法**(observe-only),所以它解不出任何 per-principal caps —— 把它
- * 算成源会让能力面对着一台永不武装的机器说「有源」。
- *
- * 为什么要抽成函数:这条判据现在有**两个**读者 —— boot 的装配点,与 `/v1/capabilities` 的
- * `permissionModeAuto.entitlementSource` 披露位。两处各写一份条件,就是本仓在册的
- * 「诊断页说亮、能力位说暗」病族的入口(装配与披露对同一件事各算各的)。
- *
- * ⚠️ **辖域**:说的是「源在不在」,不是「某个 principal 被授权了」。授权是 per-principal 的
- * (`RuntimeCaps.autoMode === true` 逐 principal 解),任何部署级布尔都对它说不了话。
- */
 export function centerEntitlementSourceWired(config) {
     return config.configCenter !== undefined && !config.configCenter.dryRun;
 }
-/** A MISCONFIG diagnostic (review MEDIUM): a worker-scoped `wpt_<self>` pull token REQUIRES `?worker=<self>` to
- *  resolve per-principal caps — so a `wpt_` token with NO `SEMA_REGISTRY_WORKER` set will 403
- *  on every caps fetch → fail-closed DENY ALL workflows for ALL principals (correct degrade, but otherwise silent
- *  bar per-task warns). True ⇒ the caller should log a one-shot BOOT warning so the misconfig is diagnosable.
- *  (The orchestrator normally injects SEMA_REGISTRY_WORKER alongside a wpt_ token, so this is a hand-misconfig.) */
 export function scopedTokenNeedsWorker(token, worker) {
     return token.startsWith("wpt_") && !worker;
 }
-/**
- * Task-admission enforcement of the per-principal execution policy(stage7 P5 的「真强制」
- * service 半场——壳侧锁定是易用性强制可绕,这里是引擎闸)。The lane is a WORKER-PROCESS identity
- * (REMOTE_EXEC is boot wiring; there is no per-task lane switch), so the gate is "this worker's lane is not
- * permitted for this principal ⇒ reject the task": typed 403 `execution_lane_not_allowed` carrying the
- * allowlist + this worker's lane (machine code on the wire, prose stays with the shell/web).
- * No ruling / required=false / caps blip ⇒ pass (fail-open + audit). `allowedLanes` is an
- * OPEN domain — unknown names simply never match this worker's lane.
- *
- * `logger` (optional, defaults to this module's `defaultLogger`) is an injection seam purely for the
- * once-per-process default trace below (test observability) — it does not change enforcement.
- */
 export function gateExecutionLane(ruling, ownLane, logger = defaultLogger) {
     if (!ruling) {
         traceExecutionLaneDefault("no_ruling", ownLane, logger);
@@ -139,13 +68,6 @@ export function gateExecutionLane(ruling, ownLane, logger = defaultLogger) {
         });
     }
 }
-/**
- * Build the per-principal caps client: `resolveRuntimeCaps` matches core's seam signature
- * `(principal) => Promise<RuntimeCaps | undefined>`; `scenarioRuling` rides the SAME fetch/cache/in-flight
- * (zero extra center RTT — center attaches the ruling to the caps body). Wire ONLY when a center is
- * configured (and not in dry-run) — absent ⇒ core sees `undefined` ⇒ NO per-principal restriction, and the
- * scenario gate sees `undefined` ⇒ legacy body-or-default chain.
- */
 export function createPrincipalEntitlementsClient(opts) {
     const ttlMs = opts.ttlMs ?? 60_000;
     const denyTtlMs = opts.denyTtlMs ?? Math.min(ttlMs, 10_000);
@@ -155,9 +77,6 @@ export function createPrincipalEntitlementsClient(opts) {
     const onError = opts.onError ?? ((err, principal) => defaultLogger.warn("runtime_caps_resolve_failed", { principal, err: String(err) }));
     const cache = new Map();
     const inflight = new Map();
-    // Bound cache growth (review L1-1): `principal` is a per-user identity, so a long-lived worker — or a direct-door
-    // caller spoofing many principals — would accumulate one entry forever. On write, when the map crosses a soft cap,
-    // sweep logically-expired entries (TTL is a freshness gate, not eviction). Caps retention to ~the active set.
     const MAX_CACHE = 10_000;
     const putCache = (key, entry) => {
         if (cache.size >= MAX_CACHE) {
@@ -168,25 +87,17 @@ export function createPrincipalEntitlementsClient(opts) {
         }
         cache.set(key, entry);
     };
-    // ONE loader behind both faces: fresh-cached entry → as-is; else fetch (in-flight-deduped) → cache → entry.
     async function load(principal) {
         const cached = cache.get(principal);
         if (cached && cached.expiresAt > now())
             return cached;
-        // Collapse concurrent prepare-time lookups for the SAME principal onto one in-flight fetch.
         const dup = inflight.get(principal);
         if (dup)
             return dup;
         const p = (async () => {
             try {
-                // `cached?.etag` is set only on a real prior entry (an error entry clears it) → an `if-none-match` here can
-                // only 304-confirm a REAL value, never resurrect a stale deny. Pass `opts.worker` as `?worker=<self>` so a
-                // worker-scoped `wpt_<self>` token can resolve its OWN worker's principal caps; harmless
-                // on a full token (caps are worker-independent — the worker only scopes the config view we ignore).
                 const r = await fetchCaps(opts.baseUrl, opts.token, principal, cached?.etag, fetchImpl, opts.worker);
                 if (r === null) {
-                    // 304 — unchanged. We only sent if-none-match because `cached` was a real entry → reuse caps AND the
-                    // rulings (same body, same generation), refresh TTL.
                     const entry = {
                         caps: cached?.caps,
                         ...(cached?.scenario ? { scenario: cached.scenario } : {}),
@@ -197,14 +108,11 @@ export function createPrincipalEntitlementsClient(opts) {
                     putCache(principal, entry);
                     return entry;
                 }
-                // execution ruling shape drift = ruling dropped (fail-open) + THIS audit
-                // line — the "fail-open + audit" posture now covers the wire-drift direction too (previously a
-                // drifted allowedLanes coerced to [] = silent fleet-wide deny-all). Routed through onError (never throws).
                 if (r.executionDrift) {
                     try {
                         onError(new Error(`execution ruling wire drift: ${r.executionDrift}`), principal);
                     }
-                    catch { /* observability never breaks the resolver */ }
+                    catch { }
                 }
                 const entry = {
                     caps: toCoreRuntimeCaps(r.runtimeCaps),
@@ -217,11 +125,6 @@ export function createPrincipalEntitlementsClient(opts) {
                 return entry;
             }
             catch (err) {
-                // codex 交叉复审第三轮真发现(2026-08-05):a poison rejection reason (throwing `Symbol.toPrimitive`/
-                // `toString`) must not make THIS normalization line itself throw — this catch block exists to
-                // GUARANTEE the documented FAIL-CLOSED degrade below runs; if normalizing `err` throws, that
-                // guarantee is exactly what breaks (resolveRuntimeCaps/scenarioRuling/executionRuling would reject
-                // instead of resolving to their fail-closed/fail-open defaults on a degraded center response).
                 let e;
                 try {
                     e = err instanceof Error ? err : new Error(String(err));
@@ -229,18 +132,12 @@ export function createPrincipalEntitlementsClient(opts) {
                 catch {
                     e = new Error("center fetch failed with an unstringifiable rejection reason");
                 }
-                // Caps face FAIL CLOSED: deny the OPTIONAL amplification caps (workflows + fork); never force the durable
-                // gate on error. Scenario face FAIL OPEN: `scenario` stays undefined (no governance — never pin users to
-                // the default scenario on a center blip; deliberate posture split, see PrincipalEntitlementsClient). Cache the
-                // deny for a SHORT window (bound center hammering on a sustained outage) WITHOUT an etag — so the next
-                // fetch is a full 200 pull that re-reads the real caps the moment center recovers (a 304 can't resurrect
-                // this deny). Write the deny BEFORE onError so a throwing observability hook can't escape before recording.
                 const entry = { caps: { allowWorkflows: false, allowFork: false }, expiresAt: now() + denyTtlMs };
                 putCache(principal, entry);
                 try {
                     onError(e, principal);
                 }
-                catch { /* an observability hook must never break the resolver */ }
+                catch { }
                 return entry;
             }
             finally {
@@ -251,48 +148,25 @@ export function createPrincipalEntitlementsClient(opts) {
         return p;
     }
     return {
-        // No principal = an anonymous/system run with no per-principal identity → no per-principal restriction
-        // (tighten-only: absence falls back to the deployment-level default; core treats undefined as "no caps").
         resolveRuntimeCaps: async (principal) => (principal ? (await load(principal)).caps : undefined),
         scenarioRuling: async (principal) => (principal ? (await load(principal)).scenario : undefined),
         executionRuling: async (principal) => (principal ? (await load(principal)).execution : undefined),
     };
 }
-/** Back-compat face for core's seam-only consumers: the caps half of {@link createPrincipalEntitlementsClient}. */
 export function createEntitlementsResolver(opts) {
     return createPrincipalEntitlementsClient(opts).resolveRuntimeCaps;
 }
-/**
- * observer 开闸线的 env 半场:`EXPERIMENTAL_OBSERVER_AGENTS=true` 时把
- * `RuntimeCaps.allowObservers: true` 作为**部署基线**合成进 caps resolver(core 1.270.0/1.273.0 的
- * observer 面是 `=== true` 显式 opt-in、默认 OFF —— 命名先例=CC 的 `CLAUDE_CODE_EXPERIMENTAL_OBSERVER_AGENTS`
- * env 对儿)。租户姿势(与 FORK_ENABLED/SELF_ORCHESTRATION 同款判别):
- *  - **单用户部署**(`requirePrincipal !== true`,operator 即用户):env=true 直开 —— 无 center 时静态
- *    `{allowObservers:true}`;有 center 时作 BASELINE,**center caps 带键则 center 赢**(含显式 false;
- *    缺键=center 没说话 → env 基线生效。这依赖 toCoreRuntimeCaps 缺键不补 false 的纪律 —— core 是唯一
- *    默认源,center 只有真说了话才覆盖)。fail-closed 错误 entry(deny)不带 allowObservers 键 → 单用户
- *    env 基线在 center blip 期间维持(operator 在自己盒子上显式 opt-in 过;observers 非 workflows/fork
- *    级的放大面,且 deny entry 的两把闸不受影响)。
- *  - **多租户**(`requirePrincipal === true`):env **不认**,只认 center caps(半配置 fail-loud:置了
- *    env 却多租户 → 一次 boot warn,行为零变——与 MEMORY_ENGINE_BACKEND 半配置同款姿势)。
- * 返回合成后的 resolver;两边都无源(无 center、env 无效)⇒ undefined(RunnerDeps 不接线,零行为差)。
- * ⚠️ 调用方注意:`Boolean(centerResolver)` 才是「entitlement resolver wired」语义(enableForkFromBody /
- * selfOrchestrationFromBody 的多租户 fail-close 判别),不要改用本函数的返回值判 —— env-only lane 不是
- * center 背书的 entitlement 源。
- */
 export function applyObserverEnvOptIn(centerResolver, opts) {
     if (!opts.experimentalObserverAgents)
-        return centerResolver; // env 未置 = 纯透传(多数部署路径,零成本)
+        return centerResolver;
     if (opts.requirePrincipal) {
-        // 多租户不认 env(observer 是 per-principal 治理面,只认 center caps)——半配置 fail-loud 一次。
         opts.warn?.("observer_env_opt_in_ignored", {
             reason: "EXPERIMENTAL_OBSERVER_AGENTS=true is single-user only; a multi-tenant deployment (REQUIRE_PRINCIPAL=true) honors ONLY center caps allowObservers — env ignored, behavior unchanged",
         });
         return centerResolver;
     }
     if (!centerResolver)
-        return () => ({ allowObservers: true }); // 单用户无 center:env 即静态开闸
-    // 单用户 + center:env 作 baseline,center 带键(true/false 皆)覆盖;缺键 → baseline 生效。
+        return () => ({ allowObservers: true });
     return async (principal) => ({ allowObservers: true, ...(await centerResolver(principal)) });
 }
 //# sourceMappingURL=runtime-caps-resolver.js.map

package/dist/runtime-governance.js

@@ -1,117 +1,34 @@
-/**
- * Runtime governance compiler — the "second baton" (center §10, core 1.114.0): turn the
- * operator's declarative `runtime.autonomy` + `runtime.commandPolicy` (`@sema-agent/registry-core`,
- * carried to the service via sema-registry `EffectiveConfig.runtime`) into TIGHTEN-ONLY overrides on the
- * per-task `TaskSpec`. Pure so it is unit-testable in isolation (the spec is otherwise assembled inside
- * main.ts's `resolveSpec`).
- *
- * 🪤 TWO TRAPS this module exists to NOT fall into (see core
- * `tool-policy.ts` / `tighten-task-spec.ts` JSDoc):
- *
- *   TRAP #1 — `TaskSpec.toolPolicy` OVERRIDES (not merges) `RunnerDeps.toolPolicy` (the runner does
- *   `spec.toolPolicy ?? deps.toolPolicy`). A bare `spec.toolPolicy = createCoarseCommandNamePolicy(…)` would
- *   SILENTLY DISCARD the deployment's approval/durable baseline. We compose via {@link tightenTaskSpec}, whose
- *   toolPolicy rule is `combinePolicies(base, override)` (deny-wins) — the command gate can only ADD denies/asks
- *   on top of the baseline, never clear it.
- *
- *   TRAP #2 — `autonomy` must EXPAND INTO the three core primitives (`handsReadOnly` / `shellGate` / a
- *   `toolPolicy`), NOT become a parallel enum on the spec (design-research §10: a parallel `autonomy` field +
- *   `handsReadOnly:true` would conflict). The expansion is tighten-only and routed through `tightenTaskSpec`, so
- *   `auto` (the loosest mode) can never LOOSEN a stricter base — `tightenTaskSpec` THROWS instead.
- *
- * ⚠️ `commandPolicy` is a COARSE name-level filter, NOT a sandbox. `sh -c …` / `$(…)` / pipes / `env X=…` /
- * path-prefixed commands all bypass the argv[0] match (they route to `ask`, fail-closed, but are not blocked by
- * name). Real isolation is the `executionEnv` sandbox. Same caveat core documents on `createCoarseCommandNamePolicy`.
- */
 import { combinePolicies, COARSE_SHELL_TOOLS as CORE_COARSE_SHELL_TOOLS, createCoarseCommandNamePolicy, DEFAULT_SUBAGENT_TOOL_NAME, parseLeadingCommandName, tightenTaskSpec, } from "@sema-agent/core";
 import { currentGovernanceAskMarks } from "./governance-ask-marks.js";
-/** True when `name` names a DELEGATION tool — the subagent tool(CC-187 canonical `"Agent"`,core
- *  `DEFAULT_SUBAGENT_TOOL_NAME`)。5.0.0 RB-476:折叠面退役,RAW 比对 core 单源常量——旧名("Task")
- *  在 core roster 层响亮 miss,不再需要归一;单源常量本身就防了当年 1.202 改名时裸字符串失配的
- *  fail-open(那个教训的解=引用常量,不是折叠)。 */
 export function isDelegationToolName(name) {
     return name === DEFAULT_SUBAGENT_TOOL_NAME;
 }
-/** The hands-read-only DELEGATION STRIP (the main.ts governed-spec site, extracted here so the actual filter —
- *  not just the name predicate — is pinned by tests): a read-only (plan-mode) run does not mount a delegation
- *  tool at all.
- *
- *  🔴 原始理由已被上游收编(2026-08-05 亲验安装包 core 5.13.x):子任务 spec 现在**继承** `handsReadOnly`
- *  (`dist/agents/subagent.js:1501` 的 `...(ctx.handsReadOnly === true ? { handsReadOnly: true } : {})`,resume
- *  腿 `:405` 同款)与 `shellGate`(`dist/core/runner/prepare-task.js` 的 `inheritedGateForChildren`),所以
- *  「子任务会拿到可写的手」这个当年的缺口在 core 侧已经补上。本 strip 因此是**同向的第二层**(更严,不更松):
- *  它保证 read-only 一档下连委派工具面都不铸,与继承是否存在无关。拆掉它是一次行为变更(read-only 任务将
- *  重新能委派),需要单独决定——不要因为「上游修好了」就顺手删。
- *
- *  Identity (the same array) when nothing matches, so the caller's spec-object churn stays minimal. */
 export function stripDelegationTools(tools) {
     const kept = tools.filter((t) => !isDelegationToolName(t.name));
     return kept.length === tools.length ? tools : kept;
 }
-/** The shell tool names a command-name gate parses — **core 的 {@link COARSE_SHELL_TOOLS} 本尊**,不再是镜像。
- *  本仓的 ask-list 策略因此恒门住与 `createCoarseCommandNamePolicy` **同一批**工具。
- *  Q6 (core 1.161): tool names align to CC — `bash`→`Bash`; the old `bash_readonly` MERGED into `Bash` (read-only is
- *  now a toolEffect, not a separate tool).
- *
- *  🔴 A-033.1(#256)换装记:本常量此前是**手抄镜像** `["Bash","Monitor"] as const`,注释自称「core 未导出」。
- *  那句话在 core RB-153(server [1708] 请托)之后就过期了 —— core 现在**公开导出**这份名单(index.d.ts:134),
- *  它自己的原话是「The list itself is the fact; publishing it removes the guess」。镜像的真实代价有前科:
- *  core 1.414 把默认从 `["Bash"]` 扩到 `["Bash","Monitor"]`(Monitor 走同一条执行 seam),镜像漏跟一轮 ⇒
- *  **blocklist 模式下本仓的 ask-list 不覆盖 Monitor 而 core 的 deny 覆盖**(core 端到端实证:同一条
- *  `rm -rf $(cat targets)`,Bash 被拒、Monitor 零门执行)。换真 import 之后这一整类漏跟在结构上消失。
- *  `test/coarse-shell-tools-mirror.test.ts` 的钉相应从「行为反推 + 值比对」改成**同源断言**(见那里顶注)。 */
 const COARSE_SHELL_TOOLS = CORE_COARSE_SHELL_TOOLS;
-/** 导出给 `test/coarse-shell-tools-mirror.test.ts` 的同源钉用(见那里的顶注)。 */
 export const COARSE_SHELL_TOOLS_MIRROR = COARSE_SHELL_TOOLS;
-/**
- * A per-command ask-list ToolPolicy: a parsed shell command whose `argv[0]` is in `askCommands` tightens to
- * `ask`; everything else passes (`allow`). core's `createCoarseCommandNamePolicy` has NO per-command ask list
- * (only `allow[]` / `deny[]` / `defaultAction`), so blocklist-mode "ask before THIS command, pass the rest"
- * cannot be expressed by it — this thin policy carries the `ask` decisions. It reuses core's
- * `parseLeadingCommandName` (the SINGLE source-of-truth simple-command parser used by the `Bash` tool and
- * `createCoarseCommandNamePolicy`), so the argv[0]-bypass surface (operators / pipes / `env=` / path-prefix)
- * routes to `ask` (fail toward the gate), never silent-allow.
- */
 function createCommandAskListPolicy(askCommands, tools = COARSE_SHELL_TOOLS) {
     const askSet = new Set(askCommands);
     const shellTools = new Set(tools);
     const ask = (message) => ({ action: "ask", message, decisionReason: "rule" });
     return {
         check(req) {
-            // Out of scope for non-shell tools: this gate only speaks about shell command names. RAW(5.0.0):
-            // live 名恒 canonical,pre-rename 重放由 core 响亮拒——折叠臂退役。
             if (!shellTools.has(req.toolName))
                 return { action: "allow" };
             const command = req.args?.command;
             if (typeof command !== "string")
                 return ask(`tool "${req.toolName}" call has no parseable command string`);
             const parsed = parseLeadingCommandName(command);
-            // Un-parseable (operators / path-prefix / env-assignment) = exactly the argv[0]-bypass surface → gate it.
             if ("reject" in parsed)
                 return ask(`command is not a single simple command (${parsed.reject})`);
             return askSet.has(parsed.name) ? ask(`command "${parsed.name}" requires approval by policy`) : { action: "allow" };
         },
     };
 }
-/** A valid `commandPolicy` rule targets a bare argv[0] command NAME. core's `createCoarseCommandNamePolicy` does
- *  EXACT `Set` matching (NOT glob, NOT last-match-wins — the §10 verdict deliberately downgraded the original
- *  `createCommandGlobPolicy` idea), so a glob like `git*` or a path `/usr/bin/rm` or `npm i`
- *  would SILENTLY never match a parsed argv[0] → the command would slip the gate. We accept only bare-name tokens
- *  (letters/digits and `. _ - +`, covering `python3.11`/`docker-compose`/`g++`) and reject the rest FAIL-LOUD at
- *  config-apply. 🔴 Kept ALIGNED with the `@sema-agent/registry-core` contract-layer regex (center fixed the
- *  glob→exact contract bug in 0.1.26 + publish-validates with this SAME pattern) so the contract gate and this
- *  defense-in-depth gate agree. [2373]B-11:旧注靠「dep=^0.1.26 additive 窗」论证对齐,地板抬到 ^0.13.0 后
- *  该论证失效——现由机器钉逐字节对表(test/runtime-governance.test.ts 读安装包正则比对),lockstep 不再
- *  是注释请求。2026-08-02 亲核 0.13.0 dist/types.js:703:两正则逐字节相同。 */
 const VALID_COMMAND_NAME = /^[A-Za-z0-9._+-]+$/;
-/** The three legal per-command decisions (mirrors the registry `runtime.commandPolicy[].decision` enum). */
 const VALID_DECISIONS = new Set(["allow", "ask", "deny"]);
-/** Validate `commandPolicy` rules — the shape (array of {command, decision}), the `command` (a bare argv[0] name,
- *  see {@link VALID_COMMAND_NAME}), AND the `decision` enum. Returns the list of human-readable errors (empty =
- *  OK). Called at config-apply (config-center/facade.ts `applyRuntimeHot`) so a malformed rule that BYPASSED the
- *  registry schema (a hand-edited config.d / a non-conformant publish) is rejected LOUDLY rather than
- *  silently mis-compiling — review MEDIUM: an out-of-enum `decision` (e.g. "DENY") would otherwise fall through
- *  {@link compileCommandPolicy}'s `decision==="deny"?…:"ask"` to ASK, silently WEAKENING an intended deny. */
 export function validateCommandRules(rules) {
     const errors = [];
     if (!Array.isArray(rules))
@@ -132,31 +49,9 @@ export function validateCommandRules(rules) {
     }
     return errors;
 }
-/**
- * Compile `runtime.commandPolicy` (per-command 3-way rules) into a single ToolPolicy, or `undefined` when there
- * is nothing to govern. The registry model (per-command `allow`/`ask`/`deny`) and core's helper model
- * (`allow[]` + `deny[]` + `defaultAction`) don't map 1:1, so the compilation picks a mode by the rules present:
- *
- *  - **Allowlist mode** — triggered when ANY rule resolves to `allow`. Only `allow` commands pass; `deny` wins;
- *    EVERY other command — `ask`-decision AND unlisted — falls to `defaultAction:"ask"`.
- *    🔴 OPERATOR FOOTGUN (documented contract): adding even one `allow` rule flips the whole policy to a strict
- *    allowlist — previously-passing unlisted commands now ASK.
- *  - **Blocklist mode** — no `allow` rules. Only `deny` commands are blocked; the rest pass THROUGH to the
- *    deployment baseline. Per-command `ask` is carried by {@link createCommandAskListPolicy} (the coarse helper
- *    can't express it). Un-parseable bypass commands fail toward `ask` in both the deny gate and the ask-list.
- *
- * Duplicate rules for the SAME command collapse to the STRICTEST decision (`deny > ask > allow`) BEFORE the mode
- * split, so e.g. a command listed both `allow` and `ask` resolves to `ask` — honoring `combinePolicies`'
- * strictest-wins (without this, the `allow` rule would shadow the `ask` for that command in allowlist mode).
- *
- * Either way the result only ever ADDS asks/denies — composed onto the baseline via `combinePolicies`
- * (deny-wins) by {@link applyRuntimeGovernance}, so it is tighten-only. (Assumes commands are pre-validated by
- * {@link validateCommandRules}; an un-matchable command here is simply inert, never a parse error.)
- */
 export function compileCommandPolicy(rules) {
     if (!rules || rules.length === 0)
         return undefined;
-    // Collapse per command to the strictest decision (deny > ask > allow) so a duplicate can't shadow a stricter one.
     const RANK = { deny: 3, ask: 2, allow: 1 };
     const strictest = new Map();
     for (const r of rules) {
@@ -172,20 +67,9 @@ export function compileCommandPolicy(rules) {
     }
     const policies = [];
     if (allow.length > 0) {
-        // Allowlist mode: `allow` passes, `deny` wins, `ask`-decision + unlisted fall to defaultAction "ask".
         policies.push(createCoarseCommandNamePolicy({ allow, deny, defaultAction: "ask" }));
     }
     else {
-        // Blocklist mode: only `deny` blocks; per-command `ask` via the ask-list; an unlisted **simple** command
-        // passes through.
-        // ⚠️ #184([3038]/[3047] 双探针实证):「unlisted pass through」只对**单纯命令**成立。带 shell 运算符的
-        // 复合命令(`a && b`、管道、`;`)`parseLeadingCommandName` 判 reject,而 `createCoarseCommandNamePolicy`
-        // 的 `defaultAction` **缺省就是 `"ask"`**(core tool-policy.js:`opts.defaultAction ?? "ask"`)—— 于是它们
-        // 在 deny 门上折 **ask**,不是放行(无 command 串的调用同理)。这与 allowlist 模式那句「fall to
-        // defaultAction」是同一个兜底,只是这里没显式传参所以容易读漏。上方 docblock 的「Un-parseable bypass
-        // commands fail toward `ask` in both the deny gate and the ask-list」说的就是这一条。零行为码改动。
-        // (NOTE: never pass `allow: []` to the coarse helper — an empty array is truthy there and would turn it
-        //  into an allowlist that asks on EVERYTHING. Omit allow entirely instead.)
         if (deny.length > 0)
             policies.push(createCoarseCommandNamePolicy({ deny }));
         if (ask.length > 0)
@@ -195,15 +79,6 @@ export function compileCommandPolicy(rules) {
         return undefined;
     return policies.length === 1 ? policies[0] : combinePolicies(...policies);
 }
-/**
- * Expand an autonomy mode into TIGHTEN-ONLY `TaskSpec` safety overrides (the three primitives — TRAP #2):
- *  - `read-only` / `plan` → `handsReadOnly: true` (read + propose, never mutate; the §6 verifier read-only
- *    boundary). `plan` shares the SAME safety boundary as `read-only`; the "present a plan for approval" intent
- *    is higher up (UX), not a distinct TaskSpec safety field, so both map to read-only hands.
- *  - `ask` → `shellGate: "always"` (every `Bash` command tightens to an `irreversible_ask` durable suspend —
- *    the fail-closed default for an unattended deployment with no parsed classifier).
- *  - `auto` / `undefined` → `{}` (no extra tightening; still subject to the deployment baseline + commandPolicy).
- */
 export function autonomyOverrides(autonomy) {
     switch (autonomy) {
         case "read-only":
@@ -216,53 +91,11 @@ export function autonomyOverrides(autonomy) {
             return {};
     }
 }
-/**
- * #220:**部署级**判据 —— 本部署的治理层自己是否把 shellGate 抬到 `"always"`。
- *
- * 用途 = 持久门(park 行)的出身归因。活卡腿判「这只 ask 是治理层产的」靠 ALS 标记表(见本文件
- * `createGovernanceAskMarkingPolicy` / `createGovernanceShellGateMarkPolicy`),而 park 腿天然跨副本、
- * 跨重启,进程内的表在那里结构上够不着;行上唯一的取证格是 core 写的
- * `gate.riskDescriptor.shellGateDoctrine`。
- *
- * 🔴 **为什么单看行上那一格不够**:有效档 `"always"` **不止治理层一个产地** —— `resolve-spec` 的 SUP 路由
- * 姿态(`supPostureOverrides`)在 governance **之后**叠,同样产 `"always"`(本文件 `manualModeShellGate`
- * 合成段的注释里已如实记着这条时序)。只看行 ⇒ 一条 SUP 路由出来的门会被谎报成「运维治理层强制」,
- * 而那恰是这个信号要回答的那个问题。所以归因取**合取**:行上是 `always` **∧** 本部署的治理层本来就
- * 要求 `always`(后者成立时,治理层就是一个真成因,SUP 是否也抬过不改变这句话的真假)。
- *
- * 判据逐字对着两个产地(与 `applyRuntimeGovernance` 里 `overrides.shellGate` 的取值同源):
- * `autonomyOverrides(autonomy).shellGate`(`AUTONOMY=ask`)与 `MANUAL_MODE_SHELL_GATE` 旋钮,取「有一个
- * 是 always」。`commandPolicy` 不入判据:它产的是 `toolPolicy` 的 ask,不抬 shellGate 档,与本格无关。
- *
- * ⚠️ **已知残留(codex 对抗复审 2026-08-11 逮到,如实登记而不是掩盖)**:本判据读的是**当下**的
- * config,而 `config.autonomy` 是**热改**的(`config-center/apply-effective.ts` 就地写 `config.autonomy`)。
- * 于是失真是**双向**的,不是我原先写的「只往缺席方向」:
- *  · 缺席向(常见):mint 之后运维把 `AUTONOMY=ask` 撤了 ⇒ 老 park 行归不出治理出身,少标一个;
- *  · **在场向**(窄):一条**纯 SUP 路由**产的门(`ROUTER_ENABLED` 开 ∧ 路由判 supervisor ∧ 当时治理层
- *    并不要求 always),之后运维把 autonomy 热改成 `ask`,那条老行会被标成治理出身 —— 五个前提要**同时**
- *    成立,且该行仍未决。
- * 根治要**在 mint 那一刻把出身写进行里**(core 的 `CheckpointGate` 属主面,不是本仓能单方面做的);
- * 在那之前这一位的定位是**分诊提示**,不是裁决输入 —— 它不参与任何门/CAS/resume 判定,消费端也只拿它
- * 渲染徽标。登记在此,不加特征化测试(把已知残留钉成契约是另一种病)。
- */
 export function governanceMandatesShellGateAlways(governance) {
     return autonomyOverrides(governance.autonomy).shellGate === "always" || governance.manualModeShellGate === "always";
 }
-/**
- * [2942]/[2943] `governanceForced` 的**写侧** —— 把内层策略(治理层自己合成的那些)产的 `ask` 记进标记表。
- *
- * 决议本身**逐字透传**:本包装器只观察,不改 action / message / updatedInput / decisionReason,也不吞异常
- * (内层抛就照抛,fail-closed 的属主仍是内层)。同步内层保持同步返回(不无谓地把一条同步策略异步化)。
- *
- * 为什么标在这一层而不是让 `decisionReason` 上 wire:core 的 ask 铸造点不透传 `PermissionResult`
- * (侦察结论逐字见 `governance-ask-marks.ts` 顶注),这条缝在当前 core 上根本不存在。
- */
 function createGovernanceAskMarkingPolicy(inner, marksOf) {
-    // 🔴 codex 交叉复审 round2 [medium](验真):**如实覆写**,不是只加不减 —— core 的
-    // `recheckApprovedEdit` 拿同一个 `toolCallId` 重跑策略链(人编辑 args 之后),「原始 args 治理层要问 /
-    // 编辑后治理层放行、由别的策略提第二问」会让第二张卡挂陈旧治理标。理由全文见 GovernanceAskMarks.setMarked。
     const note = (d, req) => {
-        // 表在**裁决那一刻**解析(不是构造时):策略闭包铸于 resolveSpec,真正的作用域要到 run 腿跑起来才在。
         marksOf()?.setMarked(req.toolCallId, d.action === "ask");
         return d;
     };
@@ -273,72 +106,22 @@ function createGovernanceAskMarkingPolicy(inner, marksOf) {
         },
     };
 }
-/**
- * [2942]/[2943] shellGate 腿的写侧 —— **纯观察器**(恒 `allow` = `combinePolicies` 折叠里的弃权,见
- * `applyRuntimeGovernance` 顶注对 sensitivePathPolicy 那段 allow 语义的同款说明)。
- *
- * 只在治理层把 shellGate 抬到 **`"always"`** 时装:该档下 core 对**每一次** shell 调用都要人批
- * (`prepare-task.js` 把 Bash/Monitor 的 irreversibility tier 置 `"always"`),所以「这是一次 shell 调用」
- * 与「这只 ask 是治理层门出来的」等价——推断是紧的,零错标。
- *
- * 🔴 `"classify"` 档**故意不装**:那一档由 core 的分类器逐调用裁决,一次 shell ask 可能来自分类器
- * (治理),也可能来自 `APPROVAL_REQUIRE` 这类别的门(非治理),在 `AskRequest` 上无从分辨。按本信号
- * 「只做正向断言」的语义,分不清就**让键缺席**,不去猜(`governance-ask-marks.ts` 语义 1)。
- */
 function createGovernanceShellGateMarkPolicy(marksOf, tools = COARSE_SHELL_TOOLS) {
     const shellTools = new Set(tools);
     return {
         check(req) {
-            // 只对 shell 工具**置位**,非 shell 一格不碰(那格的属主是上面的 ask 观察器)。本策略在合成里
-            // 恒排在 ask 观察器**之后**(见 applyRuntimeGovernance 的 combinePolicies 顺序):`always` 档下
-            // 每一次 shell 调用都被治理层门住,所以它对 shell 那一格的裁定压过「治理策略这次没产 ask」。
             if (shellTools.has(req.toolName))
                 marksOf()?.setMarked(req.toolCallId, true);
             return { action: "allow" };
         },
     };
 }
-/** core `tighten-task-spec` 的 SHELL_GATE_RANK 镜像(单一属主:#153 搬家后本文件是 server 侧唯一副本;
- *  task-settings 的旧副本随 settings 折叠臂一并拆除)。tightenTaskSpec 的契约是「override 自身必须收紧」
- *  而非「取两者较严」——低于 base 的 override 直接 throw,所以施加前要按 rank 只升不降。 */
 const SHELL_GATE_RANK = { off: 0, classify: 1, always: 2 };
-/**
- * Apply the operator's runtime governance (autonomy + commandPolicy + manualModeShellGate) onto a base
- * `TaskSpec`, TIGHTEN-ONLY, in a SINGLE {@link tightenTaskSpec} call: commandPolicy compiles to a `toolPolicy`
- * override (combined onto the baseline by `tightenTaskSpec` — TRAP #1), and autonomy expands to
- * `handsReadOnly` / `shellGate` overrides (TRAP #2). `tightenTaskSpec` THROWS `TaskSpecTightenError` if any
- * override would LOOSEN a stricter base safety field — surfacing a misconfiguration loudly instead of silently
- * weakening the gate. Returns `base` untouched when there is nothing to apply.
- *
- * #153([2713] server 分单②):`MANUAL_MODE_SHELL_GATE` 从 settings 折叠搬到这里**无条件施加**。旧家
- * (task-settings deriveSettingsPolicy 的 default/auto/acceptEdits 三臂)让一个**部署级 tighten-only 旋钮
- * 的生死由客户端表态在场性决定**:body 无 settings/permissionMode(cli print/headless 腿按设计不 stamp)
- * ⇒ 旋钮静默失效(clay 实机 Monitor 案「门根本没铸」);bypassPermissions 一句话掀掉部署闸;非 host lane
- * fsWriteGate wiring 不建 ⇒ 沙箱 lane 全失效。governance 层与 autonomy 同拍施加后三者全闭。rank 合成:
- * autonomy 派生值与旋钮取大(ask→"always" 压过 "classify"),再对 base 只升不降(防 tightenTaskSpec throw)。
- *
- * #177([2951] issue #29,**邻仓 test AI 的 46 格真机矩阵**实证——不是本仓的钉,别到本仓文件里数 46;
- * 本仓的类级门是 test/operator-knob-client-posture-matrix.test.ts 的 旋钮×表态×lane 矩阵):
- * `SENSITIVE_WRITE_PATTERNS` 是 #153 那次搬家漏下的兄弟旋钮——同一个病灶原样复发在 sensitive-path
- * DENY 腿上(唯一合成点在 deriveSettingsPolicy 的 fsWriteGate 闭包,bypassPermissions/键缺席/settings
- * 整缺席三形整条腿不建)。同方修:调用方(resolve-spec)把 operator 守卫集预铸成 `sensitivePathPolicy`
- * 从这里**无条件施加**——它只在守卫段上产 deny(core 语义 deny/"safety"),对其余目标返回的是
- * `action:"allow"`(**不是**「无意见」这种第三态:core 的 ToolPolicy 没有弃权值。它在
- * `combinePolicies` 的 deny/ask 优先折叠里不构成一票,所以在**折叠语境**下等价于弃权;若日后有人把
- * 这条策略单独当成唯一 policy 用,那个 allow 就是真放行——别照抄这句话去别的语境)。于是对 bypass
- * 只挡守卫段、不给普通目标加 ask 门([820] 表第四行「bypass=不加门非开门」保持逐字)。策略在这里
- * 只组合不构造:裁决 env 的 lane 分形(host 真 fs / 沙箱 deferred 代理)是 resolve-spec 的属主知识,
- * governance 层不重复它。
- */
 export function applyRuntimeGovernance(base, governance) {
-    // 显式注入(测试/将来的多实例形)优先;否则**每次裁决时**取当前 run 腿的 ALS 表(顶注「作用域」段)。
     const marksOf = () => governance.askMarks ?? currentGovernanceAskMarks();
     const overrides = { ...autonomyOverrides(governance.autonomy) };
     const coarse = compileCommandPolicy(governance.commandPolicy);
     const governancePolicies = [coarse, governance.sensitivePathPolicy].filter((p) => p !== undefined);
-    // [2942]/[2943]:治理层自己产的 `ask` 打标 —— 包在**合成之后**,于是 commandPolicy 的两模式
-    // (allowlist 的 defaultAction:"ask" / blocklist 的 ask-list)与 sensitivePathPolicy 走同一个铸点,
-    // 不会漏掉将来加进这个数组的第四条腿。
     const governancePolicy = governancePolicies.length > 0
         ? createGovernanceAskMarkingPolicy(governancePolicies.length === 1 ? governancePolicies[0] : combinePolicies(...governancePolicies), marksOf)
         : undefined;
@@ -348,31 +131,17 @@ export function applyRuntimeGovernance(base, governance) {
         const candidate = overrides.shellGate !== undefined && SHELL_GATE_RANK[overrides.shellGate] >= SHELL_GATE_RANK[governance.manualModeShellGate]
             ? overrides.shellGate
             : governance.manualModeShellGate;
-        // base 已更严 ⇒ 省略,让 base 原样保留(省略=行为等价,不 throw)。**仍然装配上不可达、纯防御**
-        // ——但论证已随 design/201 换了一条:
-        //  · 前提(改):resolveSpec 的 spec 字面量**现在会写 shellGate** —— 显式 permissionMode 的翻译档
-        //    (`shellGateForMode`,阶段④,governance 之前),所以 base.shellGate 不再恒缺席。
-        //  · 结论(不变):这一支照旧不可达。翻译表的**上限是 classify**(rank 1),而能走到这里的 candidate
-        //    下限也是 classify(旋钮词表只有 classify/always,且 candidate 已取过与 autonomy 派生值的较大者)
-        //    ⇒ candidate ≥ base 恒成立。SUP 路由姿态(resolve-spec 的 supPostureOverrides)是 governance 之
-        //    **后**才叠的,够不到这里的 base。
-        // 若将来有人给 base 种上更严的值(例:翻译表新增一个 ⇒ always 的模式词),这里省略而不是让
-        // tightenTaskSpec 因「override 更松」throw——candidate 已是 autonomy 派生值与旋钮的较大者,省略它不会
-        // 丢掉 autonomy 那一半(autonomy 只产 "always",即最高 rank,永远不会落进这一支)。
         if (SHELL_GATE_RANK[candidate] >= SHELL_GATE_RANK[base.shellGate ?? "off"])
             overrides.shellGate = candidate;
         else
             delete overrides.shellGate;
     }
-    // [2942]/[2943] shellGate 腿:治理层**自己**把门抬到 `"always"` 时,挂上纯观察器给 shell 调用打标
-    // (理由与 `"classify"` 为何不装,见 createGovernanceShellGateMarkPolicy 顶注)。判据取
-    // `overrides.shellGate` 而不是有效档 —— base 已经更严时上面那支会 `delete`,那时门不是治理层给的。
     if (overrides.shellGate === "always") {
         const shellObserver = createGovernanceShellGateMarkPolicy(marksOf);
         overrides.toolPolicy = governancePolicy === undefined ? shellObserver : combinePolicies(governancePolicy, shellObserver);
     }
     if (overrides.toolPolicy === undefined && overrides.handsReadOnly === undefined && overrides.shellGate === undefined) {
-        return base; // nothing to govern → avoid a needless tightenTaskSpec pass
+        return base;
     }
     return tightenTaskSpec(base, overrides);
 }