@sema-agent/server 7.43.0 → 7.44.0

package/dist/boot/execution-env.js

@@ -1,21 +1,3 @@
-/**
- * design/158 A10:composition root 分段 —— 执行环境装配(per-task 镜像 / cwd·shellEnv 注册表 /
- * 五条 remote-exec 腿的工厂 / 三层工厂装饰 / LSP 管理器)。
- *
- * 纯搬运:函数体逐字来自 `main.ts`(原 997-1302 行),缩进不变;新增的只有 import 与包壳。
- *
- * ⚠️ **位置即契约 —— 装饰顺序就是行为**:`executionEnvFactory` 由内向外被依次包装,
- * 次序逐字保留不可动:
- *    base(e2b|k8s|ssh|adb|host|local-docker)
- *      → `withRemoteScratchpad`(远程车道首 exec 才 mkdir)
- *      → `withWorktreeIsolation`(host 车道 per-agent worktree,定 cwd)
- *      → `TaskEnvRegistry.wrapFactory`(SendUserFile 直传登记 taskId→env)
- *      → 附件物化(内层先定 cwd,附件才落在最终 cwd —— 原文逐字注释即此)
- *      → `withSandboxPathEnvSlot`(#165,**最外层**:沙箱写门要裁决的是 core 最终拿到手的那个实例,
- *         而内层会换实例/改写方法,所以登记必须排在全部换手之后)。
- * 另:`lspManager` 声明在 host 工厂**之后**,host 工厂闭包对它是同作用域前向引用(闭包每任务才跑,
- * 那时已初始化)——本段整体搬运保住了这个前向引用,拆开两个模块就会破。
- */
 import { existsSync } from "node:fs";
 import { join } from "node:path";
 import { NodeLspManager } from "@sema-agent/core";
@@ -37,50 +19,24 @@ import { reapOrphanWorktrees, withWorktreeIsolation } from "../plugins/worktree-
 import { customPkgSourceFromEnv, derivePkgSourceEnv } from "../sandbox-pkg-source.js";
 import { effectiveHostWorkspace } from "../task-cwd.js";
 import { isSandboxPathAdjudicationLane, sandboxPathEnvSlots, withSandboxPathEnvSlot } from "./deferred-sandbox-path-env.js";
-/**
- * #97 R11: the perSessionCwd/perSessionShellEnv setters below share one idiom (delete-then-set so a
- * re-set moves the tail to MRU, then oldest-first eviction on overflow). Local to this file — NOT the
- * public {@link import("../bounded-session-map.js").BoundedSessionMap} seam, because both callers below
- * still hand out the raw `Map` (its declared type threads through `resolve-spec.ts` as `Map<string, V>`,
- * not a class instance) — this only DRYs the two identical closures, it changes no public shape.
- */
 function boundedSessionSetter(map, maxEntries) {
     return (sid, value) => {
-        map.delete(sid); // re-insert at the tail = most-recently-used
+        map.delete(sid);
         map.set(sid, value);
         if (map.size > maxEntries)
-            map.delete(map.keys().next().value); // evict oldest
+            map.delete(map.keys().next().value);
     };
 }
 export function createExecutionEnv(ctx) {
     const { config, logger, metrics, taskAttachmentStore } = ctx;
-    // design/48 v1b: deployment-level remote execution(部署级路由 + 懒汉连接). When
-    // REMOTE_EXEC=e2b, this deployment is a "code-agent worker" — each task's hand runs in a per-task E2B VM,
-    // provisioned lazily on first hand use (a plan-only task pays zero VM cost). Unset → in-process stub env.
-    // design/48 v1b + design/61: pick the remote-exec backend by provider (peer adapters). SSH/ADB target REAL
-    // systems (not isolated/suspendable) — the leader's autonomy + the design/37 gate + HITL run accordingly.
-    // §7 P0.5 per-task sandbox image: the trusted-control-plane bridge from resolveSpec (resolves the requested
-    // profile → digest with the caller's principal, fail-closed) to the k8s factory (applies it per-pod). See
-    // per-task-image.ts + resolveSpec below. Worker-global default image is the fallback when no profile is requested.
     const perTaskImage = new PerTaskImageRegistry();
-    // RFC A2: session-keyed environment selection (PROFILE intent, never a digest) written by the model-facing
-    // SelectEnvironment tool; resolveSpec re-resolves it FAIL-CLOSED per task (same re-admit as a body profile).
     const sessionEnvSelection = new SessionEnvironmentSelection();
-    // [#40 / TOC cwd seam] per-session launch dir → the host lane's agent workspace (resolveSpec registers it gated by
-    // cwdHonored; the host factory reads it by ctx.sessionId). Only ever written for the single-user host lane.
-    // BOUNDED (avoid unbounded growth over the persistent local engine's lifetime): an LRU cap; the shell
-    // re-sends cwd on every request, so evicting a stale session is harmless (it re-registers on next use).
     const MAX_CWD_SESSIONS = 4096;
     const perSessionCwd = new Map();
     const setSessionCwd = boundedSessionSetter(perSessionCwd, MAX_CWD_SESSIONS);
-    // [R-survey / TOC shellEnv seam, core PLAN批注] per-session `settings.env` → the host lane's agent shell env
-    // (resolveSpec registers it gated by cwdHonored — single-user host lane only; the host factory merges it by
-    // ctx.sessionId). design/107 "env = capability axis". Same LRU bound + re-send-on-every-request semantics as cwd.
     const perSessionShellEnv = new Map();
     const setSessionShellEnv = boundedSessionSetter(perSessionShellEnv, MAX_CWD_SESSIONS);
     let executionEnvFactory;
-    // SVC-3 worktree isolation: the reaper (defined far below) reuses ONE long-lived git base env + repoRoot to
-    // `git worktree prune` crash-orphaned worktrees. Holders are populated when the wrapper is wired (host lane).
     let worktreeReap;
     if (config.remoteExec?.provider === "e2b") {
         executionEnvFactory = e2bExecutionEnvFactory({
@@ -89,11 +45,7 @@ export function createExecutionEnv(ctx) {
             ...(config.remoteExec.timeoutMs != null ? { timeoutMs: config.remoteExec.timeoutMs } : {}),
             ...(config.remoteExec.livenessMs != null ? { livenessMs: config.remoteExec.livenessMs } : {}),
             ...(config.remoteExec.allowInternetAccess != null ? { allowInternetAccess: config.remoteExec.allowInternetAccess } : {}),
-            // [1452]/[1454] CWD-A: workspace 根透传(E2B_MOUNT_PATH)——缺省仍 /home/user(adapter 默认)。
             ...(config.remoteExec.mountPath ? { mountPath: config.remoteExec.mountPath } : {}),
-            // RFC B5: region package-source env set rides the operator-trusted sandboxEnv — ENV-FIRST, the derived
-            // ecosystem overrides (pip/uv/npm/go/rustup/flutter/…) beat the image's baked CN ENV on existing images,
-            // no rebake needed. Explicit E2B_SANDBOX_ENV keys win over derived on collision (deliberate override).
             ...(() => {
                 const merged = { ...derivePkgSourceEnv(config.sandboxPkgSource, customPkgSourceFromEnv()), ...(config.remoteExec.sandboxEnv ?? {}) };
                 return Object.keys(merged).length > 0 ? { sandboxEnv: merged } : {};
@@ -113,26 +65,14 @@ export function createExecutionEnv(ctx) {
             ...(config.remoteExec.runtimeClass != null ? { runtimeClass: config.remoteExec.runtimeClass } : {}),
             ...(config.remoteExec.mountPath ? { mountPath: config.remoteExec.mountPath } : {}),
             ...(config.remoteExec.timeoutMs != null ? { timeoutMs: config.remoteExec.timeoutMs } : {}),
-            // Resource-profile knobs. config.ts reads K8S_MEMORY/K8S_CPU; this passthrough was
-            // missing, so the adapter silently stayed on its 2Gi default (Kata VM = default_memory 2G + limit 2G = 4G
-            // MemTotal — task02b run9/10 integration gradle OOM'd there even after the env was set).
             ...(config.remoteExec.memory ? { memory: config.remoteExec.memory } : {}),
             ...(config.remoteExec.cpu ? { cpu: config.remoteExec.cpu } : {}),
             ...(config.remoteExec.s3Snapshot ? { s3Snapshot: config.remoteExec.s3Snapshot } : {}),
-            // RFC B5: region package-source env set → pod container env (operator-trusted, never task-controlled).
-            // ENV-FIRST: pod env beats image ENV and reaches every exec — the derived ecosystem overrides switch
-            // region on existing images; the SEMA_PKG_SOURCE marker drives the in-image hook (file-bound pieces).
             ...(() => {
                 const derived = derivePkgSourceEnv(config.sandboxPkgSource, customPkgSourceFromEnv());
                 return Object.keys(derived).length > 0 ? { podEnv: derived } : {};
             })(),
         };
-        // §7 P0.5: per-pod image override. resolveSpec resolved the requested profile→digest (with the caller's
-        // principal, fail-closed) and registered it by sessionId — the ONLY identifier stable across the factory ctx
-        // on every path (adversarial-review round-2: /v1/runs mints its own durable taskId that CLOBBERS spec.taskId,
-        // so taskId-keying misses on the primary path; sessionId survives). get() is non-removing (the factory may be
-        // invoked >once per logical task). Absent ⇒ the worker-global k8sCfg.image. Building the factory per task is a
-        // cheap closure alloc; the ref is immutable (repo@digest). podSpecPatch can NOT carry the image (hard invariant).
         executionEnvFactory = (ctx) => k8sExecutionEnvFactory({ ...k8sCfg, image: perTaskImage.get(ctx.sessionId) ?? k8sCfg.image })(ctx);
     }
     else if (config.remoteExec?.provider === "ssh") {
@@ -152,22 +92,10 @@ export function createExecutionEnv(ctx) {
         });
     }
     else if (config.remoteExec?.provider === "host") {
-        // DUAL-MODE §5: the TOC `host` lane — run on THIS machine, no container (isolation=none). Fan-out still
-        // works (bounded by one box). Secrets are env-NAMEs the host resolves from its own process.env.
         {
-            // R7 self-wake: inject the self-wake SchedulerCapability backend on the single-user TOC host lane
-            // (opt-in SCHEDULER_ENABLED). `hasScheduler(env)` then mounts CronCreate/CronDelete/CronList(旧名 CronCancel、Sleep 已 design/136 撤除——L8 注释订正,且挂载在 core prepare-task 非 createHandsToolkit); the TOC shell
-            // daemon reads the SAME ~/.sema/scheduled_tasks.json store (registry-core /node binding) and fires due intents.
-            // Multi-tenant (requirePrincipal) routes scheduling to center, NOT this host daemon → gate it off there. ONE
-            // backend instance at boot → every host task shares the same store file.
             const hostScheduler = config.schedulerEnabled && config.requirePrincipal !== true
                 ? new FileSchedulerBackend({
                     ...(config.schedulerStorePath ? { storePath: config.schedulerStorePath } : {}),
-                    // [1009]② host-signal: the spawning shell knows whether a resident daemon will honor session
-                    // wakeups — SCHEDULER_SESSION_WAKEUP=false flips the capability off at CONSTRUCTION (instance-
-                    // lifetime snapshot, core TOCTOU 契约) so core's ScheduleWakeup refuses up front.
-                    // [2436] session-lifetime 同族 host-signal(5.6.0):headless(无 daemon 收割)⇒
-                    // supportsSessionLifetime:false ⇒ CronCreate 前门拒收 + backend 第二道拒落盘,孤儿不产生。
                     ...(config.schedulerSessionWakeup === false || config.schedulerSessionLifetime === false
                         ? {
                             caps: {
@@ -184,37 +112,21 @@ export function createExecutionEnv(ctx) {
                 ...(config.remoteExec.workspaceBase ? { workspaceBase: config.remoteExec.workspaceBase } : {}),
                 ...(config.remoteExec.commandTimeoutMs != null ? { commandTimeoutMs: config.remoteExec.commandTimeoutMs } : {}),
                 ...(hostScheduler ? { scheduler: hostScheduler } : {}),
-                // design/103 background shell: single-user host lane only (parity with scheduler/cwd). Multi-tenant host
-                // lane (which shouldn't exist — host runs on the worker's own box) → INERT (run_in_background/etc. don't mount).
                 backgroundShell: config.requirePrincipal !== true,
             };
-            // [#40 / TOC cwd seam] per-request workspace: if resolveSpec registered a caller `cwd` for this session (gated by
-            // cwdHonored — single-user host lane only), run the agent VERBATIM in that dir (persistent, never deleted — the
-            // user's project). Else the boot-time host config (ephemeral random subdir). Mirrors the k8s perTaskImage wrap.
-            // core 1.219 `ctx.parentCwd` (dogfood finding: sub-agents landed in an EMPTY sandbox): a DELEGATED child
-            // (workflow ctx.agent / Task tool) now roots at its PARENT's working dir — CC parity — via core's TRUSTED
-            // RunInternals channel. Precedence in effectiveHostWorkspace: session cwd → parentCwd (unless the child asked
-            // for isolation:"worktree" — that wrapper wins below) → ephemeral. Container lanes never consult this.
             executionEnvFactory = (ctx) => {
                 const cwd = effectiveHostWorkspace(perSessionCwd.get(ctx.sessionId), ctx);
                 const shellEnv = perSessionShellEnv.get(ctx.sessionId);
                 const env = hostExecutionEnvFactory({
                     ...hostCfg,
                     ...(cwd ? { workspaceDir: cwd } : {}),
-                    ...(shellEnv ? { env: shellEnv } : {}), // R-survey: per-task shell env (merged UNDER per-command options.env by the host adapter)
+                    ...(shellEnv ? { env: shellEnv } : {}),
                 })(ctx);
-                // core 1.191: an EPHEMERAL host workspace (no honored `cwd` → a per-task `sema-host-<id>` dir destroy()
-                // rm's) evicts its LSP servers at task-end so a busy server doesn't accumulate one heavy language server per
-                // task. cwdHonored (persistent project) is NOT evicted — its stable root stays warm across turns (CC-parity);
-                // worktree/fan-out is bounded by maxSessions=16. Only wraps when a NodeLspManager is actually active.
                 return lspManager && !cwd ? evictLspOnDestroy(env, lspManager) : env;
             };
         }
     }
     else if (config.remoteExec?.provider === "local-docker") {
-        // DUAL-MODE §5: the TOC `local-docker` lane — a per-task container on THIS machine's docker daemon
-        // (isolation:true, suspendable:false). The base image comes ENTIRELY from config (no docker.io default —
-        // domestic-images iron rule). Secrets are resolved env-NAME→value here (config.ts already did the forward).
         executionEnvFactory = localDockerExecutionEnvFactory({
             image: config.remoteExec.image,
             ...(config.remoteExec.mountPath ? { mountPath: config.remoteExec.mountPath } : {}),
@@ -222,10 +134,6 @@ export function createExecutionEnv(ctx) {
             ...(config.remoteExec.dockerHost ? { dockerHost: config.remoteExec.dockerHost } : {}),
             ...(config.remoteExec.memory ? { memory: config.remoteExec.memory } : {}),
             ...(config.remoteExec.cpus != null ? { cpus: config.remoteExec.cpus } : {}),
-            // A-002.7: the two sandbox-hardening knobs were parsed by loadConfig and honored by the adapter, but this
-            // call site dropped them — so DOCKER_PIDS_LIMIT always resolved to the adapter's `?? 512` default and
-            // DOCKER_DROP_CAPS never emitted `--cap-drop ALL`. Absent stays absent (the adapter's defaults are the
-            // unconfigured shape); only a SET knob rides, same additive form as the siblings above.
             ...(config.remoteExec.pidsLimit != null ? { pidsLimit: config.remoteExec.pidsLimit } : {}),
             ...(config.remoteExec.dropAllCaps ? { dropAllCaps: true } : {}),
             ...(config.remoteExec.network ? { network: config.remoteExec.network } : {}),
@@ -233,24 +141,10 @@ export function createExecutionEnv(ctx) {
             ...(config.remoteExec.env ? { env: config.remoteExec.env } : {}),
         });
     }
-    // [848] remote scratchpad: decorate the REMOTE sandbox lanes (e2b/k8s/local-docker/ssh) so each env
-    // lazily `mkdir -p`s `/tmp/scratchpad/<sessionId>` on its FIRST exec — never at factory time (e2b is
-    // lazy-VM; a factory-time exec would force-boot the VM). adb is skipped (no standard /tmp on Android);
-    // host keeps its worker-local scratchpad (ensureScratchpadDir at the envFacts consumer). The envFacts
-    // advertisement below uses the SAME remoteScratchpadDirFor rule, so fact and mkdir can never disagree.
     if (executionEnvFactory && isRemoteScratchpadLane(config.remoteExec?.provider)) {
         executionEnvFactory = withRemoteScratchpad(executionEnvFactory, logger);
     }
-    // SVC-3 (design/97 CORE-6): wrap the factory with git-worktree isolation. When core marks an agent
-    // `isolation:"worktree"` (TRUSTED RunInternals — never a TaskSpec), the wrapper mints a per-agent detached
-    // worktree under the operator-trusted repoRoot; otherwise it passes the base env through untouched. v1
-    // covers the `host` lane (the TOC fan-out lane). Other lanes would need a worktree-ROOTED REMOTE env from
-    // `rootEnvAt` (a follow-on; a host/NodeExecutionEnv worktree is not durable-suspendable — see the plugin
-    // header) — they are left unwrapped here, isolation:"worktree" is then a no-op for them (the base env wins).
     if (config.worktreeIsolation && executionEnvFactory) {
-        // M4 (adversarial-review): a mis-wired WORKTREE_REPO_ROOT must fail LOUD at boot, not per-task at runtime. The
-        // root must exist AND be a git repo (`.git` dir or worktree-link file). On a bad root, log an error + LEAVE
-        // isolation OFF (the factory unwrapped) rather than wiring a factory that throws on every isolated agent.
         const wtRoot = config.worktreeIsolation.repoRoot;
         const wtValid = existsSync(wtRoot) && existsSync(join(wtRoot, ".git"));
         if (config.remoteExec?.provider === "host" && !wtValid) {
@@ -261,35 +155,18 @@ export function createExecutionEnv(ctx) {
             });
         }
         else if (config.remoteExec?.provider === "host") {
-            // The SHARED base env that runs `git worktree add/remove/prune` (cwd:repoRoot is passed explicitly by
-            // core on every git call, so this env's own root is irrelevant — it just needs `exec` + git on PATH).
-            // ONE long-lived env per deployment; the reaper reuses it. `inheritEnv:"all"` so the operator's git
-            // config/credentials are visible (this is the operator's own machine + own repo, the TOC posture).
-            // systematic-audit (gate-fail-direction): every worktree-lane RemoteHostExecutionEnv carries the SAME
-            // background-shell gate as the primary host factory (main.ts ~442) — not the env's `?? true` default. The
-            // git-base env is git-ops only (agents run on rootEnvAt below), but gating it keeps the policy uniform / future-proof.
             const gitBaseEnv = new RemoteHostExecutionEnv({ workspaceDir: config.worktreeIsolation.repoRoot, inheritEnv: "all", backgroundShell: config.requirePrincipal !== true });
             executionEnvFactory = withWorktreeIsolation(executionEnvFactory, {
                 repoRoot: config.worktreeIsolation.repoRoot,
                 ...(config.worktreeIsolation.allowedRoots ? { allowedRoots: config.worktreeIsolation.allowedRoots } : {}),
                 ...(config.worktreeIsolation.commit ? { commit: config.worktreeIsolation.commit } : {}),
                 baseEnvForGit: gitBaseEnv,
-                // Host-lane worktree-rooted env: a host adapter in PERSISTENT-DIR mode — its own destroy() does NOT
-                // rm the dir (so core's `git worktree remove` owns teardown), and it keeps the host adapter's secret
-                // scrub + timeout semantics (vs a bare NodeExecutionEnv). inheritEnv defaults to "scrub" (model-driven).
                 rootEnvAt: (dir) => {
                     const env = new RemoteHostExecutionEnv({ workspaceDir: dir, backgroundShell: config.requirePrincipal !== true });
-                    // A worktree root is per-agent + ephemeral (core's `git worktree remove` reclaims it at
-                    // task-end), so evict its LSP servers DETERMINISTICALLY too — not just via the maxSessions LRU backstop. The
-                    // worktree dir IS the LSP cache root (env.cwd), so evict(env.cwd) on destroy hits it. (`lspManager` is declared
-                    // below but this closure only runs per-task, well after it's initialized — same forward-ref as the host factory.)
                     return lspManager ? evictLspOnDestroy(env, lspManager) : env;
                 },
                 logger,
             });
-            // 复审 2026-07-30 F3:in-flight 单飞语义内建在铸造处——本函数有**两个**调用点(下方 boot recovery
-            // sweep 与 reapers.ts 的周期 tick),守卫只装 tick 侧会漏 boot 长跑(>REAP_INTERVAL_SEC 的
-            // `git worktree prune` 与首个 tick 叠跑,正是守卫要防的并发)。装在源头,调用点全免疫。
             {
                 let inFlight = false;
                 worktreeReap = () => {
@@ -300,28 +177,15 @@ export function createExecutionEnv(ctx) {
                 };
             }
             logger.info("worktree_isolation_enabled", { provider: "host", repoRoot: config.worktreeIsolation.repoRoot });
-            // BOOT recovery sweep: reap any worktrees orphaned by a crash BEFORE this process started (the periodic
-            // reaper would otherwise wait a full interval). Best-effort, fire-and-forget; never blocks boot.
             void worktreeReap().catch(() => undefined);
         }
         else {
-            // Not a no-op-silent: an operator who set WORKTREE_ISOLATION_ENABLED on a non-host lane should know it
-            // doesn't take effect yet (the worktree-rooted REMOTE env is a follow-on). Fail-loud-ish via a warning.
             logger.warn("worktree_isolation_unsupported_lane", {
                 provider: config.remoteExec?.provider,
                 note: "git-worktree isolation v1 covers only the 'host' lane — isolation:'worktree' is a no-op here (the base env is used). Worktree-rooted remote envs are a follow-on.",
             });
         }
     }
-    // SendUserFile v2(clay 拍 2026-07-14,Plan B 直传):沙箱 lane 的文件源需要「工具执行时拿到当前
-    // 任务的 env」——core 把 per-task env 关在 prepare-task 闭包里(ToolExecuteContext 无 env 面),但
-    // 工厂是我们装配的、工厂 ctx 自带 taskId,包一层登记 taskId→env(destroy 时注销)即可,零 core 改动
-    // (withWorktreeIsolation 同款包装先例)。lane 门+租户门=sandboxSendLaneEnabled(判定依据在其 doc):
-    // e2b/k8s=一任务一沙箱(沙箱文件系统=租户边界)任意租户可用;ssh(后补 2026-07-14)=同一 exec 契约
-    // (timeout 秒×1000/Result shape 同形)直传链零适配,但 peer=一台跨任务共享的常驻真实主机
-    // (sshExecutionEnvFactory 忽略 ctx、destroy=断连不删文件、isolation:false)→「沙箱 scoped 读=租户
-    // 隔离」不成立,与 host 同门单用户 only(requirePrincipal!==true 恒关多租户,不留口子)。
-    // 其余 lane 不包(零开销);签发面未配同样不包。
     const sendUserFileTaskEnvs = (() => {
         const provider = config.remoteExec?.provider;
         if (!config.sendUserFile || !executionEnvFactory || !sandboxSendLaneEnabled(provider, config.requirePrincipal))
@@ -330,11 +194,6 @@ export function createExecutionEnv(ctx) {
         executionEnvFactory = registry.wrapFactory(executionEnvFactory);
         return registry;
     })();
-    // D-1 附件物化包装(半场③):env 每次建立(fresh + resume/重建沙箱)都把该 session 绑定的附件写进
-    // 工作目录 `attachments/`。全 lane 统一(host/e2b/k8s/ssh/adb 都走 factory;ExecutionEnv.writeFile
-    // 双向通用);路径与 objective 告知共用 materializedRelPaths(确定性,两处不漂)。**fail-loud**:
-    // objective 已向模型宣告文件在场,静默缺文件=模型按幻影文件行动,比任务失败更糟 ⇒ 写失败即抛
-    // (env 建立失败,任务带明确错误)。链尾最外层:worktree 隔离等内层先定 cwd,附件落在最终 cwd。
     if (taskAttachmentStore && executionEnvFactory) {
         const inner = executionEnvFactory;
         const attStore = taskAttachmentStore;
@@ -346,54 +205,29 @@ export function createExecutionEnv(ctx) {
             return env;
         };
     }
-    // #165 沙箱写门的真 env slot(**最外层**,见文件头的装饰顺序):写门在 spec 期只能拿到一个代理,
-    // 裁决时刻由它去 slot 里取本 task 的真 env 转发 fs 读原语。所以登记的必须是 core 最终拿到手的那一个
-    // ——内层装饰器会换实例(worktree 的 rootEnvAt)或改写方法(scratchpad 的 exec/canonicalPath 前置)。
-    // 沙箱 lane 限定:host-semantics lane 的写门直接拿本机 NodeExecutionEnv,不经代理,包了也无人读。
     if (executionEnvFactory && isSandboxPathAdjudicationLane(config.remoteExec?.provider)) {
         executionEnvFactory = withSandboxPathEnvSlot(executionEnvFactory, sandboxPathEnvSlots, logger);
     }
     if (executionEnvFactory) {
-        // k8s (Kata) is isolated; it becomes WORKSPACE-suspendable when an S3 snapshot store is configured
-        // (tar→S3→fresh pod restore — files durable, in-VM memory not); e2b is fully suspendable.
         const isolated = config.remoteExec.provider === "e2b" ||
             config.remoteExec.provider === "k8s" ||
-            config.remoteExec.provider === "local-docker"; // a container is a real OS-level isolation boundary
+            config.remoteExec.provider === "local-docker";
         const suspendable = config.remoteExec.provider === "e2b" ||
             (config.remoteExec.provider === "k8s" && !!config.remoteExec.s3Snapshot);
-        // Out-of-band sandbox env (e2b): log the KEY NAMES only (never the secret values) so ops can confirm
-        // injection is active without leaking the credential.
         const sandboxEnvKeys = config.remoteExec.provider === "e2b" ? Object.keys(config.remoteExec.sandboxEnv ?? {}) : [];
         logger.info("remote_exec_enabled", { provider: config.remoteExec.provider, isolated, suspendable, ...(sandboxEnvKeys.length > 0 ? { sandboxEnvKeys } : {}) });
         if (!isolated)
             logger.warn("remote_exec_real_system", { provider: config.remoteExec.provider, note: "non-isolated target — actions are permanent; rely on the policy gate + HITL (design/61 §5)" });
     }
-    // LSP sidecar (design/64 §13.1, the 1.86.2 seam): ONE stateless manager on RunnerDeps — core passes each
-    // task's env into sessionFor at the tool mount point, so the manager reaches the SAME sandbox the agent edits
-    // (no sessionId registry / per-task construction). Opt-in (LSP_ENABLED — the SANDBOX lane's knob; the host lane
-    // below has its own, LSP_HOST_ENABLED, because its default is the opposite); with the baked `ai-agent-code-lsp`
-    // template the first call is fast, without it the language server installs on first use (slow once per sandbox).
-    // k8s lane (gate#2 alignment): same manager/bridge over the pod network — `ws://podIP:port` instead of E2B's
-    // public wss proxy, so it needs an IN-CLUSTER worker and a sandbox image with node + the language servers baked
-    // (no on-the-fly npm path on Kata; a miss degrades the lsp tool gracefully, same as E2B).
     const lspProvider = config.remoteExec?.provider;
     const lspManager = (lspProvider === "e2b" || lspProvider === "k8s") && config.lspEnabled
         ? createE2bLspManager({
             log: (event, fields) => logger.info(event, fields),
             scheme: lspProvider === "k8s" ? "ws" : "wss",
-            // §DESIGN-V2 F11: pass the lane explicitly — the bridge metrics' `provider` label names the
-            // DEPLOYMENT lane, not the WS scheme (the two happen to correlate today but are different axes).
             provider: lspProvider,
             metrics,
         })
-        : // TOC local LSP (core 1.190): the host lane runs on THIS machine, so core's `NodeLspManager` spawns the
-            // language server as a LOCAL child_process over stdio (CC `services/lsp` parity). Its default resolveRoot uses
-            // `env.cwd` — and core passes each task's executionEnv (the per-agent WORKTREE env, so the server roots in the
-            // worktree not the base repo) into sessionFor. host ONLY: ssh/adb target another host/device and local-docker a
-            // container, none of which a local child_process can reach (those keep the E2B-style bridge / stay degraded).
-            // 🔒 `requirePrincipal !== true` gate = uniform with the sibling host powers (scheduler/backgroundShell/
-            // loadProjectMemory): the host lane is single-user by design; a (discouraged) multi-tenant host fails SAFE to
-            // grep/read rather than fanning a per-tenant×language×root pool of heavy language servers (double-review B).
+        :
             lspProvider === "host" && config.lspHostEnabled && config.requirePrincipal !== true
                 ? new NodeLspManager({ log: (event, fields) => logger.info(event, fields) })
                 : undefined;

package/dist/boot/governance-seams.js

@@ -1,59 +1,4 @@
-/**
- * design/170 件B/C/D(#252 件1)—— 三个**部署治理座席**的装配点:把 core 5.13.0 起就存在、本仓一直
- * 零接线的三个 `RunnerDeps` seam 接上。
- *
- *  · 件B `compliancePostureResolver` —— per-principal 合规档位否决(闭集 profile × 闭集 capability;
- *    生效 deny 集 = `BUILTIN_COMPLIANCE_DENIES[profile] ∪ additionalDenies`,**供数只能收紧**)。
- *  · 件C `lockedConfig` —— 管理员锁定层的**声明**(闭集注册表;spec 占了锁着的字段 ⇒ core 整拒 prepare)。
- *  · 件D `retentionPolicy` —— 托管留存期。core **只**拿它做启动期能力校验,引擎在任务路径上从不删数据。
- *
- * ## 真源:为什么三件都只接 env
- *
- * design/170 §1 的三层分工表里,center 那一列对 B/C/D 写的都是「**新建**」——中心侧的档位真源 / 策略
- * 真源 / 保留期真源**至今不存在**。接一条 center 腿等于造一个恒缺席的假面(件A 的 org 目录能接 center,
- * 是因为那一面真被建出来了)。所以本装配点的供数只有部署配置面,并且这**恰好**是 design/170 §4.3 对
- * 「谁能解锁」的裁定:锁是**配置期物**,铸锁真源只有 center governance 域与部署 env,二者都是 operator
- * 控制的配置面,自带各自既有鉴权 —— 「谁能解锁」≡「谁能改部署配置」,不引入新鉴权面。
- *
- * ## 件B 的窄化:档位是**部署级**,不是 per-principal
- *
- * core 的座席签名按 principal 取值,本仓的 resolver 对每个 principal 返回同一份部署档位。这是诚实的窄
- * 实现:per-principal 档位需要 center 的下发面(§3.2 R5「与 caps 同一次 fetch」),那一面尚未建。
- * 座席在场即恒生效,不存在「某些 principal 悄悄没档位」的分岔。
- *
- * ## 件B 的**不采纳**:多租户缺解析器不拒启(显式定界)
- *
- * §3.4 建议「部署自称多租户却未配 B 的解析器 ⇒ 拒启动」。**本仓不采纳**,理由是三问里的第二问:
- * 谁被伤到 —— 今天每一个 `REQUIRE_PRINCIPAL=true` 的部署都没有这一格,采纳即是让它们**全部**在下一次
- * 升级时起不来,而它们并没有任何东西变得更不安全(B 缺席 = 无合规限制 = 与今天逐字相同的行为)。
- * 补偿是这条 env 旋钮本身:要档位的部署显式写下它。将来 center 真有了档位下发面,「多租户必须能解析出
- * 档位」才是一条有对象可指的判据,那时再立。
- *
- * ## 件C 的两条**装配相容性**判据(本仓特有,见 {@link assertLockAssemblable})
- *
- * core 的锁按「spec 是否占了这个字段」判,而本仓是**部署自己**在铸那两个 spec 字段:
- *  · `spec.toolPolicy` —— 治理拍(`applyRuntimeGovernance`)在**任何**客户端表态下都会铸出它(敏感路径
- *    守卫集默认非空);于是 `toolPolicy` 锁会让 core 的 preflight **整拒每一条腿**。
- *  · `spec.mcp` —— 部署自带的 MCP 基线(场景/center 下发)同样经 `spec.mcp` 进 core;部署配了 MCP 又锁
- *    `mcp`,同样是每条腿必拒。
- * 两者都在**启动期**拒(安全控件不得半开 §3.4 C 行),而不是让运维在每条任务腿上各撞一次
- * `config.locked_key` 去猜。
- *
- * ## 件D 的边界(成文,别读成「数据会被删」)
- *
- * 本仓**没有任何** store 声明 `retention:"managed"`(亲验:session/checkpoint/tool-result 三族 SQL 双生
- * 与 local 形都没有这一位),托管留存的执行面(调度/重试/副本协调/逐行审计)按 §5.2 是「server 半场四件
- * 皆新建」,不在本批。所以本装配点对件D 只做两件事:①把策略递给 core 的启动期校验
- * (`assertRetentionCapability` —— 锁着 + 店不能删 ⇒ 拒启,「策略锁着、数据永存」不许发生);②策略在场
- * 而没有任何 managed 店时打一条响亮 warn。**不**假装有执行面。
- */
 import { assertRetentionCapability, resolveComplianceDenies, resolveLockedKeys } from "@sema-agent/core";
-/**
- * 件C 的装配相容性判据(纯,可单测)——见文件头「两条判据」。
- *
- * 🔴 失败方向朝**拒启**:一把在本部署上必然把每条腿都拒掉的锁,不是「配得比较严」,是配错了;继续启动
- * 只会让服务对每一个请求说 `config.locked_key`,而运维手里没有任何线索指向那把锁。
- */
 export function assertLockAssemblable(input) {
     if (input.lockedKeys.has("toolPolicy")) {
         throw new Error('LOCKED_CONFIG_KEYS contains "toolPolicy", which this server cannot arm: it COMPOSES the effective tool policy itself on ' +
@@ -69,20 +14,6 @@ export function assertLockAssemblable(input) {
             "MCP servers — a locked deployment mounts no MCP at all.");
     }
 }
-/**
- * 治理面的**装配相容性**总判据(codex 对抗复审 R2-F2 起扩面)——锁与合规档位在这条轴上是同一件事:
- * 两者都可能把「本部署自己的装配」判成 core 门口的违规,而那不是「配得更严」,是**这台从此每条腿必失败**。
- *
- * 合规半场的判据来自亲核 core 的 prepare 门(`prepare-task` 的 compliance 段):被否决的能力若**已在
- * spec 上**,core 是**整拒 prepare**(`config.compliance_denied`),不是「不挂载」。于是:
- *  · `mcp_servers` 被禁 ∧ 部署自带 MCP 基线 ⇒ 每条腿的 `spec.mcp` 都在 ⇒ 必拒;
- *  · `web_fetch` 被禁 ∧ 花名册挂了 WebFetch ⇒ 必拒。⚠️ `hipaa` 的**内建 floor 就含 `web_fetch`**,而本仓
- *    的单用户花名册**恒挂** WebFetch(`capabilities/scenarios.ts` 的 roster 过滤只在多租户下摘它)——
- *    也就是说「单用户 + hipaa」在本仓是一个每条腿必失败的组合。这条判据的全部价值就在这儿:让它在
- *    启动期说出来,而不是让运维看着一台"启动成功、任务全失败"的 worker 猜。
- *  · `workflows` 被禁只在 `spec.selfOrchestration === true` 的腿上拒(per-task,不是部署恒真)⇒ 不在本
- *    判据内,由那条腿自己响亮拒;`org_memory_mount` 走件A 的准入面。**成文定界,不留白。**
- */
 export function assertGovernanceAssemblable(input) {
     assertLockAssemblable({ lockedKeys: input.lockedKeys, deploymentMcpConfigured: input.deploymentMcpConfigured });
     if (input.complianceDenies.has("mcp_servers") && input.deploymentMcpConfigured) {
@@ -97,25 +28,11 @@ export function assertGovernanceAssemblable(input) {
             "currently honor a web_fetch denial. Run the posture multi-tenant, or drop the profile/deny.");
     }
 }
-/**
- * 装配三座席。**拒启口即装配口**:相容性判据与 core 的留存能力校验都在这里跑,调用方不必记得再调一次
- * (件A 的 C12 探测同姿势)。
- */
 export function createGovernanceSeams(ctx) {
     const { config, logger, retentionStores } = ctx;
-    // 件C:锁集。config 层已用同一只 `resolveLockedKeys` 验过一遍;这里再验是因为 config 也可能由
-    // sema-registry 侧写入(env 不是唯一写点),而「安全控件不得半开」这条对每个写点都成立。
     const lockedKeys = resolveLockedKeys(config.lockedConfigKeys !== undefined ? { keys: config.lockedConfigKeys } : undefined);
-    // 件B:合规档位。`resolveComplianceDenies` 在装配期跑一次 —— 它是 core 的 fail-loud 解析口,同时给出
-    // 这台部署真正在禁哪些能力(启动行的内容 + 下面那道相容性判据的输入)。resolver 本身返回**冻结的部署
-    // 档位**,不做任何 per-call 工作。
     const posture = config.compliancePosture;
     const complianceDenies = posture !== undefined ? resolveComplianceDenies(posture) : new Set();
-    // `mcpServers` 读的是**已应用 center 配置之后**的值(本装配点排在 config-center 段之后)。中心侧后来
-    // 加了 MCP 服务器怎么办:那一族是 baked-at-boot 面,变更会翻 `restartRequired` 让编排器滚动重启 ——
-    // 重启就撞上这道门。所以这里不需要第二条热路径判据。
-    // `webFetchMounted` 的判据与花名册那处的过滤**同源**(`capabilities/scenarios.ts`:
-    // `.filter((t) => t.name !== "WebFetch" || deps.requirePrincipal !== true)`)—— 多租户摘、单用户挂。
     assertGovernanceAssemblable({
         lockedKeys,
         complianceDenies,
@@ -130,13 +47,10 @@ export function createGovernanceSeams(ctx) {
         logger.info("compliance_posture_enabled", { profile: posture.profile, denies: [...complianceDenies].sort() });
         compliancePostureResolver = () => posture;
     }
-    // 件D:留存期。先跑 core 的启动期校验(策略值本身 + 锁着时的店能力),再补一条本仓特有的诚实 warn。
     const retentionPolicy = config.retentionPolicy;
     const locked = lockedKeys.has("retentionPolicy");
     assertRetentionCapability({ policy: retentionPolicy, locked, stores: retentionStores });
     if (retentionPolicy !== undefined) {
-        // 声明位的读法与 core 的校验口**同一个结构型**(`RetentionDeclaring`)——不自造一个平行的形状,
-        // 否则「core 认为这店 managed / 我方认为不是」这种分歧会静默存在。
         const managed = retentionStores.filter((s) => s.store?.retention === "managed");
         const executorWired = ctx.retentionExecutorWired === true;
         if (managed.length === 0) {
@@ -148,12 +62,6 @@ export function createGovernanceSeams(ctx) {
             });
         }
         else if (!executorWired) {
-            // 🔴 #270 车1(codex R2-[critical] 验真后修):**店说 managed ≠ 有人在删**。
-            //  · locked ⇒ **拒启**:core 的门因为声明位而放行了,可这台机上没有执行器 —— 那正是它文案里
-            //    「policy locked, data immortal」的实况,只是伪装成了合规。拒启保住的是车1 之前的**同一个**
-            //    行为(那时店声明 none ⇒ core 直接拒),不是新增的严格。
-            //  · 未锁 ⇒ **响亮 warn**(不拒启):未锁的策略本就是一句声明,但它此前那条 warn 会被「有 managed
-            //    店在场」静音,于是最需要说话的那一刻反而没声音。
             const detail = `retention policy is configured (maxAgeDays=${retentionPolicy.maxAgeDays}) and ${managed.length} wired store(s) declare ` +
                 `retention:"managed", but THIS BUILD WIRES NO RETENTION EXECUTOR (the sweep lane) — nothing enumerates domains or calls ` +
                 `the destructive store methods, so no data is deleted on the policy's account. A "managed" declaration is a statement ` +

package/dist/boot/leader.js

@@ -1,15 +1,5 @@
 import { createLeaderEndpoint } from "../leader/endpoint.js";
 import { createLeaderRunner } from "../leader/wire.js";
-/**
- * 鲁棒性批5 A6(2026-08-05):k8s 腿要求 MinIO 三件套(ENDPOINT/ACCESS_KEY/SECRET_KEY)全在——半开(一件缺)
- * 就让 `leaderEndpoint` 的三元式落到 undefined,此前**零披露**:运维显式开了 LEADER_ENABLED +
- * REMOTE_EXEC=k8s,却在日志里既看不到 `leader_endpoint_enabled` 也看不到任何"为什么没启用"的信号——只能
- * 靠读源码才知道要去检查 MinIO 三件套。
- *
- * 纯谓词,抽出独立函数:只吃 leaderEnabled/leaderProvider/hasS3 三个原语 + 直接读 process.env 取缺失的
- * 具体变量名,不依赖完整 `LeaderCtx`(构造一整套 brain/pricing/sessionStore 只为测一个 warn 分支不值当)。
- * 返回 null = 不适用该警告(未开启/非 k8s 腿/三件套齐全);非 null = 该报警,携带具体缺的变量名列表。
- */
 export function leaderK8sMinioGap(leaderEnabled, leaderProvider, hasS3) {
     if (!(leaderEnabled && leaderProvider === "k8s" && !hasS3))
         return null;
@@ -19,19 +9,6 @@ export function leaderK8sMinioGap(leaderEnabled, leaderProvider, hasS3) {
         !process.env.MINIO_SECRET_KEY && "MINIO_SECRET_KEY",
     ].filter((v) => typeof v === "string");
 }
-/**
- * #193 车4 件2 的**能力面**门(codex 对抗复审 R1-high①,验真后修)。
- *
- * config 层的门②判的是 `DB_BACKEND` 的字面值 —— 那句话回答的是「运维要没要 durable」。它回答不了
- * 「这次启动**真的拿到**了 durable 吗」:`openStoreBackendWithFallback` 在 `SESSION_BACKEND=auto`
- * (默认)下,SQL 连不上 / 建表失败 ⇒ 返回 `backend=undefined` + 一条 warn 就继续启动。那次启动里
- * `leaderRun()` 缺席,leader 端点会静默落进单副本内存臂:多副本各自受理同一个 Idempotency-Key、
- * 跨副本 GET 404、重启失忆 —— 而这条腿的产物是**真 git push**。
- *
- * ⇒ 判据锚**真拿到了没有**。纯谓词、只吃两个原语(与 {@link leaderK8sMinioGap} 同姿势),便于单测。
- * 抛而不是 warn:这正是 #157「安全/执行车道禁静默 fail-open」说的那一类 —— 降级的代价由用户承担,
- * 而承担的方式是重复的真实推送。
- */
 export function assertLeaderDurableStore(leaderEnabled, hasLeaderRunStore) {
     if (!leaderEnabled || hasLeaderRunStore)
         return;
@@ -44,11 +21,6 @@ export function assertLeaderDurableStore(leaderEnabled, hasLeaderRunStore) {
 }
 export function createLeaderFace(ctx) {
     const { config, logger, brain, pricing, executionEnvFactory, toolResultStore, sessionStore, checkpointStore, governanceSeams } = ctx;
-    // v2 leader endpoint (design/50 + design/68): wire when LEADER_ENABLED + an isolated remote-exec backend
-    // (E2B or k8s/Kata — SSH/ADB are single-worker real-system backends, not fan-out targets). Default off →
-    // zero prod impact. 🔴 a real run also needs `git` on the host PATH + a durable remote with write creds.
-    // F2(a) factory mode (preferred) = the service's executionEnvFactory + MinIO self-upload diff-out; the k8s
-    // lane REQUIRES it (no static k8s mode). E2B without MinIO falls back to the static compat mode.
     const leaderMinio = process.env.MINIO_ENDPOINT && process.env.MINIO_ACCESS_KEY && process.env.MINIO_SECRET_KEY
         ? {
             s3: {
@@ -61,73 +33,38 @@ export function createLeaderFace(ctx) {
         }
         : {};
     const leaderProvider = config.remoteExec?.provider;
-    // #193 车4 件1:durable leader-run 登记表(SQL 后端专有;`backend` 本身可缺席=无 DB 的 env-only worker)。
-    // 件2 能力面门(codex R1-high①)紧随其后:开了 leader 却没真拿到店 ⇒ 拒启,绝不静默落内存臂。
     const leaderRunStore = ctx.backend?.leaderRun?.();
     assertLeaderDurableStore(config.leaderEnabled, leaderRunStore !== undefined);
     const minioGap = leaderK8sMinioGap(config.leaderEnabled, leaderProvider, "s3" in leaderMinio);
     if (minioGap)
         logger.warn("leader_k8s_minio_incomplete", { missing: minioGap });
-    // DUAL-MODE §5: orchestration is an ENGINE capability, not fleet-only — the TOC `host` lane runs leader fan-out
-    // bounded by ONE box (`remote-env-host.ts` declares `capabilities = { isolation:false, suspendable:false }`).
-    // e2b/k8s keep their isolated/suspendable posture.
-    //
-    // 🔴 #193 车4 件4(台账 P2-10)核实更正 —— 这里原先断言 host 腿「既不 durable 也没有快照,所以下面那个
-    // durable 子 worker 挂起块会被跳过」。**没有任何判别式这样做**:下面的 `durable` 块只 gate 在
-    // `checkpointStore && approvalRequire.length > 0` 上,与 provider 无关,host 腿照样拿到它。core 侧亲读
-    // (5.35.0)也不是「跳过」而是**park-only 降级**:一个 `suspendable:false` 的 remote env 仍然 durable
-    // suspend,被跳过的只有 `suspendVM` 那一步 —— 见 `@sema-agent/core` `dist/core/remote-env.d.ts` 的
-    // `WorkspaceHandle.restoreMode:"park_only"`(「non-suspendable env;workspace persists on the target,
-    // resume skips resumeVM」)与 `dist/core/types.d.ts` 的 `TaskResult.workspaceRestoreMode:"snapshot"|"park_only"`
-    // (「the env declared itself non-suspendable …, so NOTHING was paused: the machine keeps running (and keeps
-    // costing) … resume simply reconnects to the still-present workspace」)。
-    // 运维面的实义差别(也是原注为什么危险):park-only 的 host worker 在挂起期间**继续占着这台机器、继续
-    // 计费**,而 `suspendable:false` 同时**断言工作区在目标机上外部持久**(core 那条 LOAD-BEARING INVARIANT)
-    // —— 所以谁清理这台机器上的残留由部署方负责,不能指望「反正被跳过了」。
     const leaderEndpoint = config.leaderEnabled &&
         (leaderProvider === "e2b" ||
             (leaderProvider === "k8s" && "s3" in leaderMinio && executionEnvFactory) ||
             (leaderProvider === "host" && executionEnvFactory))
         ? createLeaderEndpoint(createLeaderRunner({
             brain, models: config.models, roles: config.roles, pricing, logger,
-            // design/170 件B/C/D:主车道装配出的**同一份**治理座席(单一属主,leader 不另判)。
             governance: {
                 compliancePostureResolver: governanceSeams.compliancePostureResolver,
                 lockedConfig: governanceSeams.lockedConfig,
                 retentionPolicy: governanceSeams.retentionPolicy,
             },
             fanoutEnabled: config.leaderFanoutEnabled,
-            // Route the single-vs-fanout classification on the cheap model (deepseek-v4-flash): the heavy
-            // reasoning worker model returns empty ~2/3 of the time on the route prompt → silent collapse to
-            // single (observed 2026-06-14). MODEL_ROUTER_ID overrides; else the cheap model; else default.
             ...((process.env.MODEL_ROUTER_ID || process.env.MODEL_CHEAP_ID)
                 ? { routerModel: (process.env.MODEL_ROUTER_ID || process.env.MODEL_CHEAP_ID) }
                 : {}),
             ...(leaderProvider === "e2b" ? { e2bApiKey: config.remoteExec.apiKey } : {}),
             ...(executionEnvFactory ? { envFactory: executionEnvFactory } : {}),
             ...leaderMinio,
-            // Durable offload store for sub-worker tool results — without it core REFUSES the durable
-            // suspend (InMemory offload would not survive a cross-replica resume) and the gated call is
-            // denied via the unwired onAsk fallback → the worker fails instead of suspending (drill c3).
             ...(toolResultStore ? { toolResultStore } : {}),
-            // k8s lane: align the wire's workspace with the adapter's durable-snapshot root (/workspace) —
-            // the E2B default (/home/user) is OUTSIDE the k8s suspend tar, so a suspended sub-worker's repo
-            // would silently vanish on resume (drill c3: 105-byte empty snapshots).
             ...(leaderProvider === "k8s" ? { workspace: "/workspace" } : {}),
-            // Same store as the main runner: a suspended sub-worker's session must be readable on /decide
-            // resume (sub-runner-local in-memory sessions die with "Entry <leafId> not found" on resume).
             sessionStore,
-            // design/68 C4: sub-workers can durably suspend when the service runs durable approvals.
             ...(checkpointStore && config.approvalRequire.length > 0
                 ? {
                     durable: {
                         checkpointStore,
                         requireApproval: config.approvalRequire,
                         deny: config.approvalDeny,
-                        // design/80: the leader's orchestrated sub-agents adopt the SAME supervisor loop as the
-                        // top-level agent — the D-E auto-budget (auto-approve NORMAL asks up to the budget, then
-                        // escalate) + the never-auto safety set. Without these a sub-agent's gated ask always
-                        // suspends-to-human, defeating the budget circuit-breaker for the supervised team.
                         autoBudget: config.approvalAutoBudget,
                         neverAuto: config.approvalNeverAuto,
                         ...(config.approvalTimeoutSec > 0 ? { ttlMs: config.approvalTimeoutSec * 1000 } : {}),
@@ -136,13 +73,7 @@ export function createLeaderFace(ctx) {
                 : {}),
         }), {
             logger,
-            // SDK 全量核查(2026-07-24,黑板 GD 组)撞获:wire.ts:368 的 runLeader 实际要求这五个字段全部
-            // 非空,此前同步门只查 objective,不完整请求会先拿到 202 再在后台必然失败——同步前移,让错误
-            // 尽早暴露而不是靠后续 GET 才发现。
             requiredFields: ["objective", "durableRemote", "testCmd", "seedCmd", "baseSha"],
-            // #193 车4 件1:durable 登记表(跨副本 GET + 提交幂等)。SQL 后端专有;缺席 ⇒ endpoint 落到
-            // 显式的单副本内存降级臂。生产上这条缺席路径够不着 —— config 层已把「LEADER_ENABLED=true 且
-            // 无外部 SQL 店」整个组合拒启(件2 门②),所以这里的可选链只服务单机试跑与测试装配。
             ...(leaderRunStore ? { store: leaderRunStore } : {}),
         })
         : undefined;

package/dist/boot/limit-sync.js

@@ -1,8 +1,6 @@
-/** USD/秒 → micro/ms 的**唯一**换算点(装配期构造与热同步共用;两处各算一次迟早会差一个 1e6)。 */
 export function buildQuotaBounds(config) {
     return { limitMicroUsd: Math.round(config.maxPrincipalCostUsd * 1e6), windowMs: config.costQuotaWindowSec * 1000 };
 }
-/** `create*`:返回带行为的活对象(闭包持座 + 上一代读数)。 */
 export function createLimitSync(ctx) {
     const { config, rateGate, quota, logger } = ctx;
     let lastRate;