@sema-agent/server 7.43.0 → 7.44.0

package/dist/boot/resolve-spec.js

@@ -1,22 +1,3 @@
-/**
- * design/158 A10:composition root 分段 —— `resolveSpec`(部署方拥有的 body→TaskSpec 映射)。
- *
- * 纯搬运:函数体逐字来自 `main.ts`(原 3347-4313 行),缩进不变;新增的只有本文件的 import 与
- * 下面这层 `createResolveSpec(ctx)` 包壳(捕获原先靠闭包拿到的 boot 局部量)。
- *
- * ⚠️ **位置即契约**:本函数在 boot 次序里**必须晚于** scenarios 装配(`scenarios` 已含 center overlay)
- * 且早于 `createHttpServer`;它读的两个量是 boot 后仍会变的活引用,故经函数取值而非值捕获:
- *  - `getKeyResolver()` —— registry 热应用会整个换 `keyResolver` 引用(createHookLlm 同款姿势);
- *  - `getCenterPrompts()` —— `adoptCenterPrompts` 每次采用都换 `centerPrompts` 引用。
- * 这两处是本次搬运里**仅有的**两行改写(值 → 取值调用),其余逐字。
- *
- * design/158 A10 留档件#2(阶段化):原先 967 行的匿名 `resolveSpec` 体按其**真实六阶段**提为具名阶段函数
- * (①场景/append 门 → ②settings·cwd·env → ③anchors → ④spec 字面量 → ⑤governance 折叠 → ⑥image·envFacts·router)。
- * 这是可读性刀不是行为刀:各阶段体**逐字搬运**(判别顺序/短路语义/传参不变),原先靠闭包拿的 boot 局部量仍由
- * 同一层闭包捕获(完全同一批),仅把**请求级**量(body/auth/opts + 前序阶段产出)改成显式形参、在阶段头解构。
- * 唯一的非搬运改动:一段游离注释(`[#40 / TOC cwd seam]`,原文夹在附件块之上却描述其**下面**的 cwd 门)随它
- * 描述的代码下移进阶段②。
- */
 import { realpathSync } from "node:fs";
 import { join } from "node:path";
 import { NodeExecutionEnv, QUESTION_AWAITS_RESUME, expandTiers, tightenTaskSpec } from "@sema-agent/core";
@@ -55,47 +36,14 @@ import { DeferredSandboxPathEnv, isSandboxPathAdjudicationLane, sandboxPathEnvSl
 import { effectiveMemoryPersistenceCapable } from "./memory-boundary.js";
 export function createResolveSpec(ctx) {
     const { config, logger, metrics, localRoot, scenarios, principalCaps, centerRuntimeCapsResolver, handsLanes, getCenterPrompts, getKeyResolver, taskAttachmentStore, perSessionCwd, setSessionCwd, setSessionShellEnv, hookLlm, hookAgent, fleetBus, hookWakeBus, resumeAnchorStore, ownerAware, taskLimitCaps, taskTimeoutSec, selectEnvTool, sendUserFileToolSpec, memoryEngine, durableEnabled, approvalExemptionStore, singleUserAutoAcceptBaseline, checkpointStore, deploymentHooks, imageIndex, perTaskImage, sessionEnvSelection, liveQuestionFace, lockedKeys, } = ctx;
-    // ── #177 的两件 boot 期收口(把守卫集搬到 governance 拍之后才成立的两条)────────────────────────
-    //
-    // ① 守卫集的**编译**从此每个请求都发生(旧家只在 default/auto/acceptEdits 三个模式臂里发生)。
-    //    非法旋钮值必须当场炸在启动上而不是每任务一条 500 —— 判据与文案随 design/181 件一搬进构造口
-    //    (`assertGuardPatternsUsable`),赎回腿/run-local 装配时调同一只,三腿同得。
-    // CROSS-INVARIANT:sensitive-write-patterns —— 同一条判据的热路径半场在 config-invariants.ts 的表里
-    // (#322:stage 期用同一只编译门判候选,禁手抄第二份判据)。
     assertGuardPatternsUsable(config);
-    // ② governance 拍的 DENY 基线让 `spec.toolPolicy` 在**任何**客户端表态下都在场,于是 core 的
-    //    「write-capable hand tools are present but UNGATED」那条 onError 不再触发(core 判据是
-    //    `policyLayers.length > 0`,prepare-task dist 亲读)。它此前是「部署一个门都没接」这个 misconfig
-    //    的唯一信号,而守卫集只挡那二十来个路径段、其余写目标照旧无裁决 —— 信号不能因为本件静默消失。
-    //    条件 = 两条产 toolPolicy 的腿都不在场(durable 门关 ∧ 单用户 auto-accept 基线不适用),即修前
-    //    `spec.toolPolicy` 恒缺席的那一形;三个量都是 boot 常量,所以这里说一次而不是每任务说一次。
-    //    判据与文案随 design/181 件三搬进构造口(`buildOnlySensitiveBaselineWarning`),run-local 腿调同
-    //    一只 —— 本处零行为变化(条件与字段逐字同前)。
     const onlySensitiveBaseline = buildOnlySensitiveBaselineWarning(config, { durableEnabled, singleUserAutoAcceptBaseline });
     if (onlySensitiveBaseline)
         logger.warn(onlySensitiveBaseline.event, onlySensitiveBaseline.fields);
-    // Deployment-owned mapping. Tools/prompt/skills come from the selected scenario (assembled once,
-    // bound per request); identity/session/policy stay server-side. Never taken from the request body.
-    // design/158 A8:从 createHttpServer 实参里提出来(原地占该字面量 1,093 行中的 967 行)——
-    // 类型标注 `ServiceDeps["resolveSpec"]` 顶替了原来的上下文推导,签名不变。
     const resolveSpec = async (body, _req, auth, opts) => {
-        // design/170 件C §4.3 —— **锁的拒排在最前**(codex 对抗复审 F3,验真后采纳)。
-        // 判据不是「在哪一阶段读到这个字段」而是「在**任何副作用**之前」:①阶段最先跑的
-        // `gateScenarioAndAppend` 会把上传的附件行**持久绑定**到 session,②阶段会写 per-session 的 cwd/env 表
-        // —— 一个最终 400 的请求若已经改掉了这两样,它就改变了**后续被接受的**任务会物化什么、在哪里执行。
-        // core 对同一把锁的裁定原话是「Runs BEFORE any side effect of task preparation」,server 侧同姿势。
         assertRequestMcpUnlocked(body.mcpServers, lockedKeys);
-        // DESIGN-269 车1 件3:A2A 的同一条判据、同一个位置(同一批副作用要防)。锁键 `a2a` 在 core 5.36 的
-        // `LockedKey` 里尚不存在(分单件 C-1),所以这道门今天恒不触发 —— 它先在场是纵深:词表到货那一拍
-        // 它自己就活,而不是等着谁记起来补(见 task-a2a.ts 模块头的成文理由)。
         assertRequestA2aUnlocked(body.a2aPeers, lockedKeys);
-        // A10 留档件#2:六阶段流水线。顺序=原文顺序(每一阶段的体逐字搬运),阶段之间只传显式产出;
-        // 六个阶段函数定义在本 `return` 之后(自上而下先读骨架、再读各阶段)。
         const gated = await gateScenarioAndAppend(body, auth, opts);
-        // design/201 §6-1:本请求的**生效** permission mode —— 一次算,三处消费(hooks 载荷的
-        // `permission_mode`、阶段④的 shellGate 翻译写点、阶段⑤的 settings 折叠)。此前前两者各算一次,
-        // 翻译表要是再开第三个算点,「顶层键 vs bundle defaultMode 谁赢」这条优先序就有三份可以各自漂移的
-        // 副本,而漂移在这条轴上的形态是「壳发的 bundle bypass 在这一面生效、在那一面没生效」——三审同点。
         const effMode = effectivePermissionMode(body, gated.parsedSettings.settings);
         const lane = bindSettingsCwdEnvAndModel(body, auth, gated, effMode, opts);
         const anchors = await resolveHistoryAnchors(body, auth);
@@ -106,78 +54,21 @@ export function createResolveSpec(ctx) {
             scratchpadDir: folded.scratchpadDir,
             hostSemanticsLane: folded.hostSemanticsLane,
         });
-        // #196:登记本请求的 hands lane。**必须是最终对象**(阶段⑤/⑥ 会换新对象 —— 登记中间态 = 执行点
-        // 查不到、静默落回 full)。resume 腿也走同一条 resolveSpec,故续跑与首跑选同一只 Runner。
         handsLanes.stamp(final, gated.hands);
         return final;
     };
-    /** 阶段①(场景/append 门):吃 请求体 + auth + `opts.leg`,吐 本请求的场景绑定(scenarioName/cap)、center-pack
-     *  的**单次**快照与 append 门结论(centerDecls/appendLessPack/acceptedAppend)、objective、解析后的 settings 戳,
-     *  以及 D-1 附件绑定产出的 attachmentNotice;沿途的准入拒绝(scenario 400 / lane 403 / append 400 / 附件 4xx·501)
-     *  与 warn 原样在此发生。 */
     const gateScenarioAndAppend = async (body, auth, opts) => {
-        // per-principal scenario governance (assignment-as-default; an explicit
-        // body.scenario is bounded to the allowlist — outside ⇒ typed 400 `scenario_not_allowed`). The ruling
-        // {scenario, allowlist} is center-RESOLVED and rides the caps view (TTL-cached, same fetch as runtimeCaps);
-        // no center / dry-run / anonymous / older center / caps blip ⇒ undefined ⇒ legacy body-or-default chain.
-        // #273 alias:`gateScenarioRequest` 是 HTTP lane 的唯一归一点(旧名 team → discuss,响亮 warn);
-        // 此后 `scenarioName` 只可能是现役主名,下游判据点一律按主名写(禁双名判)。
         const requested = gateScenarioRequest(await principalCaps?.scenarioRuling(auth?.principal), body.scenario, config.defaultScenario, Object.keys(scenarios), logger);
-        // per-principal execution-lane policy — this worker's lane is a
-        // PROCESS identity (REMOTE_EXEC boot wiring, no per-task switch), so admission is the gate: lane ∉
-        // allowedLanes ⇒ typed 403 `execution_lane_not_allowed`. Same caps car as the scenario ruling (zero extra
-        // RTT); fail-open + audit on blip. "in-process" = fleet's REMOTE_EXEC-unset core stub lane
-        // (named distinctly from the explicit `host` lane — same machine, different posture).
-        // #157 补痕交叉复审真发现(codex,2026-08-05):第三参不传就落 runtime-caps-resolver.ts 自己的私有
-        // `defaultLogger`(createLogger() 默认 minLevel="info")——与本部署真正按 config.logLevel 建的 `logger`
-        // 是两个独立实例,即便运维把 LOG_LEVEL 调到 debug 也打不到这条新增的一次性默认落痕行(补痕功能形同虚设)。
-        // 显式传本装配的真 logger,让该痕迹真的受部署日志级别管辖。
         gateExecutionLane(await principalCaps?.executionRuling(auth?.principal), config.remoteExec?.provider ?? "in-process", logger);
-        // Resolve an unknown name to "default" so the WHOLE bundle stays coherent — tools/prompt AND
-        // skills/mcp fall back together. (selectScenario already falls back for tools/prompt; without
-        // resolving here, skills/mcp would still be filtered by the raw unknown name → any skill/MCP tagged
-        // ["default"] silently drops. council finding.)
         const scenarioName = scenarios[requested] ? requested : "default";
-        // [891]→[2400]:"autonomous" alias 已退役(clay 裁不留过渡)——body 显式传它走 scenario_unknown 400。
-        // 定死 finalVerification:true 保存量行为)。warn 不 400——TB harness/存量部署平滑迁移。
-        // #318 第三参 = {@link ScenarioContext}(服务端事实,与不可信的 `body` 分开的通道)。`sessionId`
-        // 只能来自 `auth`(authorizer 解析 + 归属校验过的那一只)—— 与下游 assembleSpecLiteral 里
-        // 「sessionId comes from `auth`, NEVER the body」逐字同纪律:body.sessionId 是调用方自报串,
-        // 拿它当会话级设施(任务清单)的分区键就是让一个租户读另一个租户的清单。缺席(无 authorizer
-        // 的裸部署)⇒ 整键省略 ⇒ 场景侧退回 per-call 私店,不发明假 session。
         const cap = selectScenario(scenarios, scenarioName)(body, auth?.principal, auth?.sessionId !== undefined ? { sessionId: auth.sessionId } : {});
-        // codex R3/R4 (appendSystemPrompt 案): ONE center-pack snapshot per request — the append-less gate below
-        // AND the provider pick (promptProvider field) both read THIS capture, never the mutable centerPrompts ref
-        // again (R4 TOCTOU: a refresh between the two reads could make the final provider assembled while the gate
-        // judged safe, restoring the in-core silent drop).
-        const centerDecls = getCenterPrompts()?.declarations; // A10 搬运改写①:活引用取值(原 `centerPrompts?.declarations`)
-        // TRUE when the EFFECTIVE assembly for this request takes core's pass-through arm (no core/role.append
-        // section ⇒ any append rider/outputStyle silently discarded in core). codex R9: PROVIDER-AWARE — mirrors
-        // core's actual triggers (stableBlocks identity decls / stableSystem OUTPUT carrying the anchors), because
-        // a raw body.systemPrompt anchor heuristic false-positives on default-provider scenarios (unbranded
-        // default / scan: no provider ⇒ core defaultPromptProvider retains role.append and the rider mounts even
-        // with an anchored systemPrompt). center-wins mirrors the provider pick below (same snapshot, same
-        // scenario derivation — principal ruling + defaultScenario already folded into scenarioName above).
+        const centerDecls = getCenterPrompts()?.declarations;
         const appendLessPack = centerDecls
             ? centerIdentityAssembled(centerDecls, scenarioName, hasConstitutionAnchors)
             : providerDropsAppend(cap.promptProvider, typeof body.systemPrompt === "string" ? body.systemPrompt : undefined);
-        // Accepted rider (defensive resume mirror inside; fresh malformed/over-cap shapes already 400'd in
-        // prepareSpec). Hoisted to a const so the R14 combined-cap check below can see the accepted length.
         const acceptedAppend = acceptAppendSystemPrompt(body.appendSystemPrompt, (detail) => logger.warn("append_system_prompt_dropped", { detail, sessionId: auth?.sessionId ?? null }), appendLessPack);
-        // @-model (1.24) + explicit picker: an end user may pick a CONFIGURED model via the CLI
-        // `/model` picker / `run --model` flag (body.model) OR an inline `@name` in the objective. resolveTaskModel
-        // gates BOTH against the catalog allow-list (config.models keys) — pick WHICH model, never inject one — with
-        // body.model winning over @mention winning over `default`. Returns the objective with the @mention stripped.
         const objective = typeof body.objective === "string" ? body.objective : "";
-        // TaskRequest.settings (client per-request SemaSettings stamp). Parsed DEFENSIVELY off the untrusted body
-        // (every field shape-checked; `bypassPermissions`/unknown modes dropped). `env`/`hooks` are recorded as
-        // received-but-deferred (never silent-dropped). Folded into the spec TIGHTEN-ONLY after applyRuntimeGovernance.
         const parsedSettings = parseTaskSettings(body.settings);
-        // codex R4 (appendSystemPrompt 案) fresh-leg fail-loud: a NEW submit whose append payload (top-level rider
-        // or settings.outputStyle) meets an append-less pack 400s HERE — inside resolveSpec, where the effective
-        // scenario (principal ruling + defaultScenario) and the center-pack snapshot are the SAME ones the provider
-        // pick uses (an HTTP-side gate could disagree with the actual assembly). Resume legs (opts.leg absent)
-        // keep the drop+warn mirror below — a 4xx would brick a pre-1.243 stored task.
         if (opts?.leg === "fresh" && appendLessPack) {
             const riderPresent = typeof body.appendSystemPrompt === "string" && body.appendSystemPrompt.length > 0;
             if (riderPresent || parsedSettings.settings?.outputStyle) {
@@ -185,15 +76,8 @@ export function createResolveSpec(ctx) {
             }
         }
         if (parsedSettings.deferred.length > 0) {
-            // No-silent-drop: a caller SENT env/hooks but this version does not wire them on remote (need a core seam /
-            // a remote hook-runner — see task-settings.ts + capabilities). Log so the gap is visible, never silent.
             logger.warn("task_settings_deferred", { fields: parsedSettings.deferred, sessionId: auth?.sessionId ?? null });
         }
-        // ── D-1 附件绑定半场(②):TaskRequest.attachments = 上传句柄数组 ──
-        // fresh 腿硬验证(未知/他人 id → 400 typed;超数 → 400)——「引用了不存在的附件」必须在提交时
-        // 拒,不能等 env 建立时才炸。resume 腿降级(acceptedAppend 同姿):缺行 warn+跳过,余下照常
-        // (4xx 会砖存量 task;记录不可变 ⇒ 在场行的 notice 字节恒稳)。绑定=把行钉到 auth.sessionId
-        // (authorizer 恒解析出一个;绑定幂等,重复提交/resume 重绑同值)。
         let attachmentNotice;
         {
             const reqAtt = body.attachmentIds;
@@ -228,22 +112,8 @@ export function createResolveSpec(ctx) {
         }
         return { scenarioName, cap, hands: cap.hands, centerDecls, appendLessPack, acceptedAppend, objective, parsedSettings, attachmentNotice };
     };
-    /** 阶段②(settings·cwd·env):吃 请求体 + auth + 阶段①的 objective/parsedSettings,吐 taskHooks、
-     *  additionalDirectories、档位展开后的 wireCatalog 与选中的 picked;副作用=per-session cwd/shellEnv 注册与
-     *  honored/ignored 日志、未知模型回落与无视觉模型降级的计数/告警。 */
     const bindSettingsCwdEnvAndModel = (body, auth, gated, effMode, opts) => {
         const { objective, parsedSettings } = gated;
-        // [#40 / TOC cwd seam] register the caller's launch dir so the HOST factory runs the agent there (read by
-        // ctx.sessionId). 🔒 GATED: only the single-user host lane (cwdHonored) honors it; on any other lane / multi-tenant
-        // a sent cwd is IGNORED (logged once, never silently — the shell learns via capabilities.projectContext). isValidCwd
-        // re-checked here too (RESUME re-runs resolveSpec WITHOUT the prepareSpec 400 validation). Re-applies on resume.
-        // [851]P3a 信号真实化:cwdHonored 只认显式 REMOTE_EXEC=host;provider 未设的 in-process 单用户 lane 没有
-        // shell hands(core prepare-task:无 factory/executionEnv ⇒ StubExecutionEnv,亲读 dist 坐实),但进程级
-        // 消费者(hooks 命令、C4 projectContext 本地读取)仍看引擎自身的 cwd/env——壳把引擎 spawn 在用户目录/用户
-        // 环境时,请求的 override 往往「已被进程状态满足」,此前每任务打 "ignored" warn 与实际状态矛盾(飞轮双平台
-        // 观测)。改法:已满足 ⇒ debug;真失配 ⇒ 保留 warn 且带 lane 字段(值与 run_local_start exec 口径一致:
-        // provider ?? "in-process")。真 per-session honor 之路仍是 REMOTE_EXEC=host(host factory 消费
-        // perSessionCwd/perSessionShellEnv)。
         const execLane = config.remoteExec?.provider ?? "in-process";
         if (typeof body.cwd === "string" && body.cwd.length > 0 && auth?.sessionId) {
             if (cwdHonored(config) && isValidCwd(body.cwd))
@@ -253,14 +123,10 @@ export function createResolveSpec(ctx) {
             else
                 logger.warn("task_cwd_ignored", { honored: cwdHonored(config), lane: execLane, sessionId: auth.sessionId });
         }
-        // [R-survey / TOC shellEnv seam] register the caller's `settings.env` so the HOST factory injects it into the
-        // agent's shell env. 🔒 GATED identically to cwd (single-user host lane only — design/107 env=capability axis);
-        // on any cloud/multi-tenant lane a sent env is IGNORED (logged once, never silent). Re-applies on resume.
         if (parsedSettings.settings?.shellEnv && auth?.sessionId) {
             if (cwdHonored(config))
                 setSessionShellEnv(auth.sessionId, parsedSettings.settings.shellEnv);
             else if (inProcessSingleUserLane(config)) {
-                // 只记失配键「数量」,绝不记键值(秘密类)与键名(名字本身可带敏感语义)——shellEnvMismatchCount 文档同款红线。
                 const requested = parsedSettings.settings.shellEnv;
                 const mismatched = shellEnvMismatchCount(requested, process.env);
                 if (mismatched === 0)
@@ -271,11 +137,6 @@ export function createResolveSpec(ctx) {
             else
                 logger.warn("task_shell_env_ignored", { honored: false, lane: execLane, sessionId: auth.sessionId });
         }
-        // hooks hook-runner(阶段一):settings.hooks(契约校验过)→ core TaskSpec.hooks 进程内回调。
-        // 🔒 hook 命令跑在 WORKER HOST(CC 语义:hooks 跑在引擎所在机,哪怕工具在远端沙箱)= design/107 class ②
-        // 能力授予 → 单用户闸 `requirePrincipal !== true`,与 scheduler/backgroundShell/lspHost/MCP 注入同一姿势;
-        // 多租户 lane 收到只警告忽略(`task_hooks_ignored`,capabilities.taskSettings.hooks 同步 advertise),绝不执行。
-        // Re-applies on resume(从 stored body 重解析,幂等)。
         const taskHooks = (() => {
             const hc = parsedSettings.settings?.hooks;
             if (!hc)
@@ -284,86 +145,41 @@ export function createResolveSpec(ctx) {
                 logger.warn("task_hooks_ignored", { honored: false, sessionId: auth?.sessionId ?? null });
                 return undefined;
             }
-            // payload 的 permission_mode 用【生效】模式——body.permissionMode(显式请求)优先于
-            // settings.permissions.defaultMode(与 spec 的 withPermissionMode 同一优先序),否则钩子读到的模式与
-            // 实际裁决模式不一致(如 body=plan 时钩子仍看到 default)。design/201 起该优先序由
-            // `effectivePermissionMode` 单点裁定,本处只消费(形参 `effMode`),不再自算一份。
             return createTaskHooks(hc, {
                 logger,
                 sessionId: auth?.sessionId ?? "",
                 cwd: (auth?.sessionId ? perSessionCwd.get(auth.sessionId) : undefined) ?? process.cwd(),
                 ...(effMode ? { permissionMode: effMode } : {}),
-                // 用户变量通道(hook 进程 env + http $NAME 插值源):同请求的 settings.env——hookEnv 绝不读
-                // 裸 process.env 的非 allowlist 键(服务密钥不可被 allowedEnvVars 点名)。
                 ...(parsedSettings.settings?.shellEnv ? { shellEnv: parsedSettings.settings.shellEnv } : {}),
-                // 阶段三b:prompt/agent 条目的模型载体(boot 组装,见 hookLlm/hookAgent 定义处的影响范围说明)。
                 hookLlm,
                 hookAgent,
-                // cli [1786] 点名的观测位:一次 hook 判定**未能完成**时,往常开的 fleet 流推一帧。
-                // ⚠️ **纯 observe**(不拦、不续跑、不注入)——`additionalContext` 那条通道会让这一轮不结束,
-                //    所以不能拿它当"提示一下"用(见 hook-runner 折叠处旁注)。
-                // ⚠️ 带 ownerScope/ownerSessionId 供流侧做 **fail-CLOSED** 过滤(与 bg_notification 同一姿势):
-                //    一条关于别人会话的通知落到这个壳上,会让用户以为是自己这轮出了问题。
                 onHookNotice: (n) => fleetBus.publishHookNotice({
                     ...n,
                     ...(auth?.principal ? { ownerScope: auth.principal } : {}),
                     ...(auth?.sessionId ? { ownerSessionId: auth.sessionId } : {}),
                 }),
-                // asyncRewake wake 管道(契约:exit 2 唤醒模型):session→本副本活流 steer(hookWakeBus,server
-                // 启动装 deliver)。stderr 过 redactSecrets 再注入(hook 进程可能回显 env 密钥;与 trace 出口同纪律)。
-                // 无 session(匿名一次性任务)不给 wake——没有可稳定寻址的流。
                 ...(auth?.sessionId
                     ? {
                         wake: async (text) => hookWakeBus.deliver
-                            ? // provenance 围栏:注入内容标明来源=asyncRewake hook 的运行时输出,
-                                // 模型按 hook 反馈对待而非操作者指令(trusted:false 在 server 侧同批落定)。
+                            ?
                                 hookWakeBus.deliver(auth.sessionId, `[hook asyncRewake] ${redactSecrets(text)}`)
                             : false,
                     }
                     : {}),
             });
         })();
-        // design/119 (CC --add-dir parity, core 1.215 `TaskSpec.additionalDirectories`): extra host dirs the FILE tools
-        // may access beyond the containment root. 🔒 GATED identically to cwd/shellEnv (single-user host lane only —
-        // these are the caller's own-machine paths; a cloud/multi-tenant lane must not let a caller widen the file-tool
-        // containment onto operator/other-tenant host paths). Unlike cwd/shellEnv (registered per-session for the host
-        // FACTORY to read at env construction), additionalDirectories is a plain TaskSpec field core reads directly, so
-        // it rides onto the spec below. Ignored (logged, never silent) off the host lane. Re-applies on resume (from body).
-        // 键在 `TaskRequestBody` 上显式声明(#205 件1)⇒ 直读,不再裸铸([2704] 边界必 schema)。
-        // 运行期校验保留:resume 腿重放的是**持久化 body**,不过 HTTP 400 门,类型说得再准也管不住盘上的字节。
         const rawAddDirs = body.additionalDirectories;
         const additionalDirectories = cwdHonored(config) ? parseAdditionalDirectories(rawAddDirs) : undefined;
         if (rawAddDirs !== undefined && !cwdHonored(config)) {
             logger.warn("task_additional_directories_ignored", { honored: false, sessionId: auth?.sessionId ?? null });
         }
-        // core 5.11.0([2625] Added①,[2597] P0 案三决③A):`additionalReadDirectories` —— 只读围栏拓宽。
-        // 与 additionalDirectories 同门(host 单用户车道)、同形校验(parseAdditionalDirectories:绝对路径
-        // 数组 fail-loud)、同「忽略必留声」纪律;差异只在语义:只进 READ 面(classify 读边界 auto-allow +
-        // read_file/grep 等 containment),写面照旧拒——读授权永不静默变写授权(core 侧保证,我们只透传)。
-        const rawAddReadDirs = body.additionalReadDirectories; // 同上:直读(#205 件1)
+        const rawAddReadDirs = body.additionalReadDirectories;
         const additionalReadDirectories = cwdHonored(config) ? parseAdditionalDirectories(rawAddReadDirs) : undefined;
         if (rawAddReadDirs !== undefined && !cwdHonored(config)) {
             logger.warn("task_additional_read_directories_ignored", { honored: false, sessionId: auth?.sessionId ?? null });
         }
-        // body.model (explicit /model picker or run --model) WINS over settings.model (the config default); both gate
-        // against the catalog allow-list via resolveTaskModel (a settings.model not in the catalog is ignored, never injected).
-        // 🔴 TOB 档位联跑曾 FAIL(坐标级):the gate must see the TIER-EXPANDED catalog — expandTiers
-        // runs inside core's Runner on a PRIVATE deps copy (runtask.ts), so gating on bare config.models silently
-        // degraded every tier word (pro/flash/@mention/CC alias) to default BEFORE the Runner could resolve it.
-        // Expand per request (cheap: empty tiers returns the same reference; non-empty = one small spread) so the
-        // gate's key set is exactly what a freshly-constructed Runner resolves — tier words, degrade chains, CC
-        // aliases, catalog-SHADOW all from core's ONE implementation. Window note: tiers are restart-to-apply at
-        // the Runner; a refresh-time tier change makes this gate briefly AHEAD of the old Runner snapshot (a new
-        // tier word then fails loud in core instead of silently degrading — honest during the restart window).
         const wireCatalog = expandTiers(config.models, config.tiers) ?? config.models;
-        // #233 / A-002.8:`atModelAllowlist` 与门目录同源(增广视图)——名单按 catalog name 写,而用户可以
-        // 用档位词/别名/id 指同一只模型,归一在 isModelAllowlisted 里做(model-select.ts 顶注)。
         const picked = resolveTaskModel(body.model ?? parsedSettings.settings?.model, objective, wireCatalog, config.atModelAllowlist);
-        // #233 拒形分流(clay 终裁 (a)):**fresh 提交** 400 `request.model_not_allowed`(治理拒——模型在目录
-        // 里但名单未含,与"目录里没有"是两回事,故与 request.unknown_reference 分码);**resume 续跑照旧**
-        // ——名单管"用户可点什么",resume 不是一次新选择;而本文件的 appendSystemPrompt 与 compactionModel
-        // 两处 fresh-vs-resume 分流注、加 model-select.ts 的 [865]② 头注,三处都已成文"砖死 resume 比降级
-        // 糟"。留声(warn+计数)让治理面看得见还有多少存量会话跑在名单外。
         if (picked.notAllowed !== undefined) {
             const { requested, resolved, source } = picked.notAllowed;
             if (opts?.leg === "fresh") {
@@ -372,65 +188,27 @@ export function createResolveSpec(ctx) {
             metrics.inc("task_model_not_allowlisted_resume_total");
             logger.warn("task_model_not_allowlisted_resume", { requested: requested.slice(0, 120), resolved, source, sessionId: auth?.sessionId ?? null, note: "resumed leg keeps running the model it was started on — the allowlist gates fresh picks only" });
         }
-        // [865]② 降级永远可见:fresh submit 的未知 body.model 已在 HTTP 门 400(不会到这);走到这的未知 ref
-        // 只剩 RESUME 重放(模型事后被移出目录)与 settings.model(lenient 文档面)——落 default 可跑,但必须
-        // 有声(session 中途换模型是最恶性的上下文污染路径,静默=病灶本体)。
         if (picked.unknownExplicit !== undefined) {
             metrics.inc("task_model_unknown_fallback_total");
             logger.warn("task_model_unknown_fallback", { requested: picked.unknownExplicit.slice(0, 120), fallback: picked.model, sessionId: auth?.sessionId ?? null });
         }
-        // no-vision images = PLACEHOLDER, not 422(会话可继续的 CC 心智). The old
-        // fail-loud 422 here BLOCKED core's own degradation: since core 1.233.1 a serving model whose `input`
-        // has no "image" gets image parts degraded to a bounded text placeholder ("[image omitted: …]"), per
-        // CURRENT model (degrade chains stay correct) and re-applied on every history replay — so a previously
-        // poisoned session self-heals. We pin ≥1.240.1, so pass the images through and let core do exactly that.
-        // The GET /v1/models vision flag stays advertised (the shell's composer-warning half). A model
-        // that never declared `input` keeps sending images verbatim (deliberate default — never wrongly strip
-        // for a vision-capable deployment that skipped the metadata; same posture).
-        // S6 (SILENT-FALLBACK P0-c): images headed for an EXPLICITLY text-only model — core (>=1.233.1) degrades
-        // them to bounded text placeholders per current model (the pass-through posture above). That modality drop
-        // was invisible fleet-side; count + warn at submit. modelSupportsImages is false-safe (undeclared input →
-        // true → no signal), matching core's "never wrongly strip" posture — no false positives for verbatim
-        // pass-through models. ⚠️ config-center lane caveat (review LOW-2): the roster maps `vision?: boolean` to
-        // an EXPLICIT input list (config-center/facade.ts) — a vision-capable roster model that FORGOT the flag becomes
-        // declared text-only, so this signal fires AND core really does degrade its images (signal matches
-        // behavior; the fix for that footgun is the roster entry, not this counter). The per-run durable event rides core's vision.placeholder trace kind once we
-        // consume >=1.245 (the authoritative replacement-time signal), not this submit-time predictor.
         if (Array.isArray(body.images) && body.images.length > 0 && !modelSupportsImages(wireCatalog[picked.model])) {
             metrics.inc("images_omitted_total", { model: picked.model });
             logger.warn("images_omitted_no_vision_model", { model: picked.model, count: body.images.length });
         }
         return { taskHooks, additionalDirectories, additionalReadDirectories, wireCatalog, picked };
     };
-    /** 阶段③(anchors):吃 请求体 + auth,吐 两个历史锚解析后的 entryId(resumeAt / rewindFilesTo —— eventId→entryId
-     *  过 anchor store,未知锚在此 4xx 而不是交给 core)与 142-S4 项目登记簿种子 s4DefaultScopes。 */
     const resolveHistoryAnchors = async (body, auth) => {
-        // E18 resume-at: the shell sends body.resumeAt as the E2 message eventId; core's TaskSpec.resumeAt takes the
-        // PERSISTED SessionTreeEntry.id, NOT the eventId ("a deployment that holds eventIds owns the eventId→entryId
-        // map" — core never persists eventIds). Resolve eventId→entryId via the anchor store HERE, 4xx-ing BEFORE the
-        // run on an UNKNOWN anchor (never hand core an unresolvable id). A KNOWN anchor whose entry was later compacted
-        // away surfaces as a failed run RESULT (resume_at.not_found) — 4xx on the sync path, the run result on async (the
-        // async contract is poll-the-result). RESUME re-runs resolveSpec from the stored body — the resume paths strip
-        // resumeAt before re-resolving (else core would reject resumeAt + a durable resume), so this branch only fires on
-        // a fresh submit. NEVER silent-drop (mirrors the body.model silent-drop bug class).
         let resumeAtEntryId;
         if (typeof body.resumeAt === "string" && body.resumeAt.length > 0) {
             if (!auth?.sessionId)
                 throw new HttpError(422, "resumeAt requires a session to branch (resume_at.no_session)");
-            // 501 gated on the SAME pair the `resumeAt` capability advertises (anchor store AND getLeafId) — capture is a
-            // no-op without getLeafId, so a getLeafId-less backend has a permanently-empty map; report "not available"
-            // (honest 501) rather than a misleading 404. Keeps "capability says yes ⟺ the route resolves" by construction.
             if (!resumeAnchorStore || !ownerAware.getLeafId)
                 throw new HttpError(501, "resume-at is not available on this worker (no session-store backend for the anchor map)");
             resumeAtEntryId = await resumeAnchorStore.resolve(auth.sessionId, body.resumeAt, auth.principal ?? null);
             if (resumeAtEntryId === undefined)
                 throw new HttpError(404, "resumeAt: no such message in this session (resume_at.unknown_event)");
         }
-        // R8 code-only rewind (CC "Restore code" mode, core 1.166 `rewindFilesTo`): restore the working tree to a prior
-        // USER message's snapshot WITHOUT forking the conversation. Resolve the SAME handle (the prompt's taskId) → entryId
-        // via the SAME anchor store. Honored ONLY when resumeAt is ABSENT (core's contract: the two are mutually exclusive —
-        // with resumeAt set, that branch's own rewindFiles governs); so we only resolve it on the code-only path. Same
-        // fail-loud discipline as resumeAt (501 no-store / 404 unknown anchor — never silent-drop).
         let rewindFilesToEntryId;
         if (resumeAtEntryId === undefined && typeof body.rewindFilesTo === "string" && body.rewindFilesTo.length > 0) {
             if (!auth?.sessionId)
@@ -441,241 +219,59 @@ export function createResolveSpec(ctx) {
             if (rewindFilesToEntryId === undefined)
                 throw new HttpError(404, "rewindFilesTo: no such message in this session (rewind_files_to.unknown_event)");
         }
-        // 142-S4 defaultScopes 种子:projectId → center 项目登记簿(config.projects,registry 喂)→ 该项目
-        // 声明的默认记忆 scope 词表(memory.scopes 额外 READ 层;写路由仍钉在派生 scope — memorySpecForRequest)。
-        // projectId 优先取 auth.resolvedProjectId(authorizer 的 PROJECT_ID_REGEX 422 门通过后回传);RESUME 腿
-        // 的 auth 从 checkpoint 重建、无此字段 → 回落持久化 body.projectId(原始提交已过形状门,与 memoryWrite
-        // 的 rides-the-persisted-body 姿势一致),让种子在 resume 腿等价重放。查表 miss(未登记/已下架)= 无种子,
-        // 不 fail(登记簿是加性配置面,不是准入门)。
-        // A-033.1(#256):回落腿同样折小写 —— authorizer 那一格自 core 的 `/i` 词法起收下大写形并归一,
-        // 若这条回落腿原样传,同一个 projectId 在首提交与 resume 两腿会查两个不同的 `config.projects` 键。
         const s4ProjectId = auth?.resolvedProjectId ?? (typeof body.projectId === "string" && body.projectId ? body.projectId.toLowerCase() : undefined);
         const s4DefaultScopes = s4ProjectId ? config.projects[s4ProjectId]?.defaultScopes : undefined;
         return { resumeAtEntryId, rewindFilesToEntryId, s4DefaultScopes };
     };
-    /** 阶段④(spec 字面量):吃 请求体 + auth + `opts.leg` + 前三阶段的全部产出,吐**尚未过治理层**的 TaskSpec
-     *  字面量 —— 部署方拥有的 body→TaskSpec 映射本体(compactionModel 的 fresh 腿 400 也在这一段)。 */
     const assembleSpecLiteral = (body, auth, opts, parts, effMode) => {
         const { scenarioName, cap, hands, centerDecls, acceptedAppend, parsedSettings, attachmentNotice, taskHooks, additionalDirectories, additionalReadDirectories, wireCatalog, picked, resumeAtEntryId, rewindFilesToEntryId, s4DefaultScopes, } = parts;
         const spec = {
-            // D-1:附件告知随 objective 进 durable 流(只有名字/mime/尺寸——**内容永不进流**,这正是
-            // 「拼进 objective 是伪方案」的账要划清的线;文件名已消毒为安全字符集,无注入面)。
             objective: attachmentNotice ? `${picked.cleanedObjective}\n\n${attachmentNotice}` : picked.cleanedObjective,
-            // Decoupling seam: a trusted client (token-holder) injects its OWN business/UX system prompt
-            // (persona, UI markers like ::ISSUE_FORM::, workflow rules). The service stays business-agnostic
-            // — integrators evolve their UX here, not by changing scenario prompts in this repo. core's
-            // stableSystem appends it after the scenario base, before <user_memory>.
             systemPrompt: typeof body.systemPrompt === "string" ? body.systemPrompt : undefined,
-            // [1476] R1 / [1478] R2: top-level append rider → core TaskSpec.appendSystemPrompt (stable block after the
-            // scenario base + systemPrompt, before the volatile tail). settings.outputStyle composes AFTER this via
-            // applyTaskSettings (`append\n\nstyle`) — byte-stable order: knowledge block always first, style always
-            // second (pinned by test; order flapping would shred the prefix cache). Resume re-enters here off the
-            // persisted body, so the rider re-applies on resumed legs like systemPrompt does — DEFENSIVELY (codex F2):
-            // the resume families skip prepareSpec's 400 gate and a pre-1.243 store kept unknown keys verbatim, so an
-            // over-cap legacy value is dropped+warned here instead of becoming active prompt content.
             appendSystemPrompt: acceptedAppend,
-            // sessionId comes from `auth` (ownership-checked / principal-derived), NEVER the body — the
-            // authorizer always resolves one. (No `?? body.sessionId` fallback: that would re-open the
-            // body-as-capability hole S6 closed if a deployment ran without an authorizer.)
             sessionId: auth?.sessionId,
-            // The authenticated end-user principal (design/62, core 1.78). Read-only on the TaskSpec — core injects
-            // it into a consumer MCP's `principalHeader` per-task so the MCP can enforce per-user RBAC (oa-mcp). It
-            // comes from the auth channel (never the body/model), so the model can't substitute another identity.
             principal: auth?.principal,
             images: body.images,
-            // design/112 C1: pass the client/gateway-supplied user context through to core (localizes the env block's date
-            // to the user's zone + surfaces who the agent acts for). HTTP-validated + capped at submit (prepareSpec); on a
-            // resume the body was already validated at its original submit. core re-validates timeZone (invalid → UTC) and
-            // SANITIZES userEmail (inlineUntrusted: folds newlines, neutralizes <system-reminder>, caps 160cp — no injection;
-            // double-review-confirmed). PICK only the two fields core reads — don't passthrough stray keys (a caller could
-            // otherwise bloat the persisted run body with an uncapped junk field; core ignores them but the body stays tight).
             ...(body.clientContext ? { clientContext: { timeZone: body.clientContext.timeZone, userEmail: body.clientContext.userEmail } } : {}),
-            // Structured output (CC --json-schema): a JSON Schema constraining the model's FINAL
-            // answer. core injects a built-in `submit_output` tool from it + surfaces the validated object as
-            // TaskResult.structuredOutput. HTTP layer shape+size-validated it (prepareSpec); core does deep validation.
-            // RESUME re-runs resolveSpec ⇒ the structured-output constraint re-applies on resumed legs too.
-            // 历史复审轴B #5(1.254):compactionModel 已接([1479]①)而 design/145 配套旋钮 clampTolerance
-            // 够不着=不对称。窄收单键(0..1 数值;其余 compaction 键仍是操作方轴,有意不开)。
             ...(() => {
-                // 键已在 `TaskRequestBody` 上声明为 `{ clampTolerance?: number }`(#205 件1)⇒ 直读;
-                // 下面的 typeof/区间校验照旧(resume 重放持久化 body 不过 HTTP 门)。
                 const ct = body.compaction?.clampTolerance;
                 return typeof ct === "number" && Number.isFinite(ct) && ct >= 0 && ct <= 1 ? { compaction: { clampTolerance: ct } } : {};
             })(),
             outputSchema: body.outputSchema,
-            // 历史复审轴A #2(1.254):outputRetries 与 outputSchema 是成对的 caller 面旋钮(retry-on-invalid
-            // 轮数),此前只接了 schema 半边。窄校验:1..10 整数,schema 在场才有意义(core 无 schema 时忽略)。
             ...(typeof body.outputRetries === "number" && Number.isFinite(body.outputRetries) && body.outputRetries >= 1
                 ? { outputRetries: Math.min(10, Math.floor(body.outputRetries)) }
                 : {}),
-            // E18 resume-at: the resolved persistent SessionTreeEntry.id (from the eventId the shell sent). core branches
-            // the session at this prior entry before running the new objective ("rewind to this message, ask differently").
             resumeAt: resumeAtEntryId,
-            // [833] rewind exclusive mode (core 1.292): "before" branches at the target's PARENT (excludes the target —
-            // "remove this prompt and everything after it"); absent/"at" = core default, zero regression. Defensive
-            // normalize (RESUME re-enters resolveSpec without the HTTP 400 gate): only the two enum values ride, and only
-            // WITH a resolved resumeAt (core ignores the field otherwise; keep the persisted spec tight). core's "before"
-            // edge rejections (resume_at.before_target_not_user / resume_at.before_root_unsupported /
-            // rewind_snapshot.unresolvable) surface as failed-result errorCodes mapped to 4xx by resumeAtHttpStatus,
-            // errorCode passed through UNCHANGED for the shell to render.
             resumeAtMode: normalizeResumeAtMode(body.resumeAtMode, resumeAtEntryId !== undefined),
-            // design/114 Phase3 (reuse-path warm-resume): require the session to already exist — core's acquire fails loud
-            // (`resume.session_not_found`) on a genuinely-missing/purged session instead of silently starting a fresh one.
-            // The service authorizer ALSO stops pre-registering a missing id under this flag (security.ts), so the store's
-            // fail-loud actually fires (else the authorizer's claim-create would materialize the session first). Rides onto
-            // resume legs (resolveSpec re-runs); a resumed session exists, so it's satisfied there.
             requireExistingSession: body.requireExistingSession === true ? true : undefined,
-            // §4 (Fork): CC `/fork` — core 1.257 (design/136 BREAKING) retired the standalone Fork tool; a fork is now
-            // Agent(subagent_type:"fork") gated by `enableFork`. 🔴 core FLIPPED enableFork to opt-OUT (undefined = available),
-            // so enableForkFromBody now returns an EXPLICIT boolean (never undefined) — false where the service denies, else
-            // fail-OPEN. DEFAULT ON single-user turnkey (clay 2026-07-01); per-task opt-OUT via body.enableFork:false;
-            // multi-tenant honored ONLY with a per-principal entitlement resolver wired (core enforces `allowFork`), else
-            // explicit false (fail-closed). core still requires a fork-capable store (`hasSessionFork`; TOC file backend
-            // satisfies it via LocalSessionStore.fork), else inert.
-            // NB: `centerRuntimeCapsResolver`(非合成后的 runtimeCapsResolver)—— env observer 基线不是
-            // center 背书的 entitlement 源,多租户 fail-close 判别只认 center caps client。
             enableFork: enableForkFromBody(body, config, Boolean(centerRuntimeCapsResolver)),
-            // E12 (shell-host contract): opt-in post-completion prompt suggestions. core runs ONE extra fire-and-forget LLM pass
-            // after the task completes; the service surfaces the strings (redacted, UNTRUSTED UI-only) as a `suggestions`
-            // event. Defensive normalize (RESUME re-runs resolveSpec without the HTTP 400 validation). OFF ⇒ zero extra LLM.
             suggestNextPrompts: normalizeSuggestNextPrompts(body.suggestNextPrompts),
-            // E19 (shell-host contract): opt-in working-tree rewind. core snapshots each completed turn + restores the files on a
-            // resumeAt branch, for any env when fileSnapshotStore is wired (gate-split 1.134.0). OFF ⇒ no snapshot.
             rewindFiles: body.rewindFiles === true ? true : undefined,
-            // R8 code-only (core 1.166): the resolved target entry id for "Restore code" — core restores the working tree to
-            // its snapshot WITHOUT branching the session. Mutually exclusive with resumeAt (only set on the code-only path).
             rewindFilesTo: rewindFilesToEntryId,
-            // design/119 (CC --add-dir): extra host dirs the FILE tools may access (core canonicalizes each into the
-            // containment allowlist + lists them in the `# Environment` block). Single-user host lane only (gated above).
             additionalDirectories,
-            // core 5.11.0:只读围栏(见上方 parse 段注)。缺席=字节等价([2625] 自查③)。
             additionalReadDirectories,
-            // EnterPlanMode (core 1.167): MODEL-DRIVEN plan — `enablePlanMode:true` alone (writable
-            // start, NO handsReadOnly) auto-mounts `enter_plan_mode`/`present_plan` so the model can self-enter read-only
-            // plan AT ANY TIME it judges a task needs planning. 🆕 DEFAULT ON (clay: resident; PLAN_MODE_ENABLED=false opts
-            // out). USER-driven plan (permissionMode=plan) ADDS handsReadOnly on top via applyTaskSettings (which also sets
-            // enablePlanMode, idempotent). Additive — widens nothing; the model self-selects when to use it.
             enablePlanMode: config.planModeEnabled ? true : undefined,
-            // design/201 §2:**显式** permission mode → shell 门档位的翻译(bypassPermissions ⇒ "off",
-            // auto/default/acceptEdits/plan ⇒ "classify";表逐字在 `shellGateForMode`)。这一档是 governance 的
-            // **base** —— 部署旋钮 `MANUAL_MODE_SHELL_GATE` 与 `AUTONOMY=ask` 在其后的 governance 拍只升不降地
-            // 覆盖它(#153 那条无条件施加的腿一行未动),所以客户端表态**减不掉**任何 operator 面的收紧。
-            //
-            // 🔴 **表态缺席 ⇒ 不写这个键**(不是写 "off",也不是写 "classify"):
-            //  · 写 "classify" 会让今天 env 真缺席的**无壳直连**部署(多租户云 / OA / scan 车道 / SDK 直连)
-            //    在一个 minor 版本里静默收紧,而它们多半没有审批面 ⇒ 失败形是 headless auto-deny;
-            //  · 写 "off" 与不写在 core 的**默认**上等价,但在本进程里不等价 —— 写下去它就成了 governance 的
-            //    base,把 runtime-governance 那条「base 更严则省略」的防御臂喂上一个人造输入。
-            // 缺席不写 = 今日行为逐字节不变,车道缺省由壳恒 stamp mode 保证(设计 §3 前提③)。
             ...(effMode ? { shellGate: shellGateForMode(effMode) } : {}),
-            // Workflow super-set unlock (same shape as the rank-1 roster gap): per-task activation of the
-            // LLM-authored workflow engine (core `run_workflow` + the workflow.ts agent/parallel/pipeline orchestration).
-            // The engine is BUILT but the HTTP API never mapped a body field to `spec.selfOrchestration`, so run_workflow
-            // was per-task unreachable (capabilities advertised `workflows:true` but the LLM could never call it). Gated on
-            // the DEPLOYMENT enabling it (`selfOrchestrationEnabled` → workflowScriptRunner/stores wired; else a set flag is
-            // a harmless no-op core fail-closes). 🔒 Multi-tenant entitlement is NOT blanket-closed here (unlike mcp, which
-            // has no engine entitlement) — core's `runtimeCapsResolver` enforces `allowWorkflows` (the third-stage
-            // per-principal cap) ON THE ENGINE, so a multi-tenant principal WITHOUT the entitlement gets run_workflow
-            // fail-closed by core (no resolver ⇒ fail-closed). Single-user honors directly. Three-gate: engine-can ∧
-            // center-may(allowWorkflows) ∧ shell-show. (Logic + gates documented in `selfOrchestrationFromBody`.) 🔒 The
-            // multi-tenant floor: pass whether an entitlement RESOLVER is wired — core's allowWorkflows is TIGHTEN-ONLY
-            // (no resolver ⇒ fail-OPEN per-principal), so the helper fail-closes multi-tenant when none is present.
-            // L2 ultracode (design/111): OR the preset's selfOrchestration:true into the body intent, passed THROUGH the
-            // existing gate — it grants nothing a raw body.selfOrchestration:true couldn't (multi-tenant still fail-closes
-            // without an entitlement resolver). The preset never bypasses the闸.
             selfOrchestration: selfOrchestrationFromBody({ selfOrchestration: body.selfOrchestration === true || parsedSettings.settings?.ultracode === true }, config, Boolean(centerRuntimeCapsResolver)),
-            // C1 (core 1.219, subagent viewing pane): opt-in widening of the forward sink from
-            // task_progress-only to a delegated child's live CONTENT events (text_delta/reasoning_delta/tool_start/
-            // tool_end, each carrying `parentToolCallId` attribution). Purely a RENDER channel — core never merges the
-            // child stream into the parent's model context. The service's forward-sink consumers redact per §E1 (shared
-            // builders); default OFF = prior progress-only behavior. Strict `=== true` (never a truthy coercion).
             forwardSubagentEvents: body.forwardSubagentEvents === true ? true : undefined,
-            // design/122 (core 1.225): opt-in retention of SETTLED sub-agent sessions so the operator/
-            // shell can REVIVE them (POST /v1/runs/:id/subagents/:target/resume). Defensive normalize + clamp
-            // (RESUME re-runs resolveSpec without HTTP validation): boolean passes; an object's ttlMs/max are clamped
-            // to sane ceilings (retention pins live sessions in memory — a caller must not turn the knob into a
-            // resource hold; core's own defaults are 30min/16, the run-scoped ledger releases everything at parent
-            // end either way). Malformed values fall to undefined = OFF (core default), never a throw.
             retainSubagentSessions: normalizeRetainSubagentSessions(body.retainSubagentSessions),
-            // [876] per-task custom subagents (core 1.295 TaskSpec.agents — CC `.claude/agents/` parity): the shell's
-            // resolved AgentDefinition[] rides the spec verbatim (model already a real name/Model object — no alias
-            // translation here). 🔒 TOB tenant gate + defensive per-item normalize live in taskAgentsFromBody
-            // (spec-fields.ts): multi-tenant is fail-closed (warn task_agents_ignored — no per-tenant caps face yet,
-            // capabilities.taskAgents advertises false); RESUME replays skip the HTTP whitelist 400 → illegal items
-            // DROP+warn per entry (task_agent_dropped), never a bricked resume. Absent/empty ⇒ no key (byte-compat).
-            // [1.211 codex L] 内联闭包换 spec-fields 真出口(taskAgentsSpecFragment)——测试直接 import 调真
-            // fold,SOURCE PIN 收敛为「resolveSpec 内恰一次调用点」单锚(文本重写同构表达式的假绿面就此关)。
             ...taskAgentsSpecFragment(body.agents, config.requirePrincipal, (event, fields) => logger.warn(event, { ...fields, sessionId: auth?.sessionId ?? null })),
-            // [854]② (core 1.295): opt-out of task-end session-background reaping ("keep my dev server running").
-            // Resource-residency grant on the host lane → single-user gate like backgroundShell/hooks (multi-tenant
-            // warns task_retain_bg_ignored + ignores; capability advertises false). Only literal `true` rides (false =
-            // core default, key omitted); non-boolean is 400 at submit, defensively dropped on a resume replay.
             ...(retainBackgroundProcessesFromBody(body.retainBackgroundProcesses, config.requirePrincipal, (event, fields) => logger.warn(event, { ...fields, sessionId: auth?.sessionId ?? null })) === true
                 ? { retainBackgroundProcesses: true }
                 : {}),
-            // [1052]② (core 1.314): per-run 工具面收窄两位——excludeTools=roster 真卸载,deferTools=延迟披露
-            // (cli「Workflow 默认开不暴露」承载位)。tighten-only(core 继承 union 不变量),无租户门;defensive
-            // normalize(resume 重放),提交面 400 在 HTTP 门。
             ...(() => { const v = toolNameListFromBody(body.excludeTools); return v ? { excludeTools: v } : {}; })(),
             ...(() => { const v = toolNameListFromBody(body.deferTools); return v ? { deferTools: v } : {}; })(),
-            // [1144]/[1146] (core 1.328 R2): promptProfile 双形轴直通——纯呈现轴无租户门(deferTools 姿势);
-            // 缺省不挂键(引擎缺省 simple);非法值由 HTTP 门 400,resume 重放 defensive DROP。
             ...(() => { const v = promptProfileFromBody(body.promptProfile); return v ? { promptProfile: v } : {}; })(),
-            // [2856]②(core 5.14.0 引入;5.15.0 BREAKING 末项默认翻 swap):deferred 工具激活后的 schema 供给
-            // 策略,per-task 位。core 侧读法是 `spec.toolMaterializeStrategy ?? env ?? "swap"`(5.16.0 dist
-            // prepare-task 亲读)⇒ **缺省不挂键**才能让进程级 env 继续说话;
-            // 挂一个「缺省值」上去会把 env 车道悄悄夺权。非法值由 HTTP 门 400,resume 重放 defensive DROP。
             ...(() => { const v = toolMaterializeStrategyFromBody(body.toolMaterializeStrategy); return v ? { toolMaterializeStrategy: v } : {}; })(),
-            // [922]①/[915]② (core 1.296): interactiveTools 三态旋钮直通——boolean 上 spec(壳 -p 恒 stamp false=
-            // A3 类「headless 提问 park」根治腿;plan 显式 true 恒赢),undefined=core 自动判据(送达面探测)。
-            // per-run 工具面选择无跨租户面 ⇒ 无租户门;非 boolean 由 HTTP 门 400,resume 重放 typeof 检查天然 DROP。
             ...(typeof body.interactiveTools === "boolean"
                 ? { interactiveTools: body.interactiveTools }
                 : {}),
-            // [1909]⑧(core 5.23.0 `TaskSpec.oneShot`):这次**提交**是不是一次性的 —— 没有后续回合能接住异步
-            // 后台通知(headless `sema -p` 的进程随本回合退出)。core 只拿它改 run_workflow / 委派回执的**指引
-            // 文本**(告诉模型主动 block-wait,而不是「结束回合等通知」——后者在一次性进程里必丢结果),不授予
-            // 任何能力 ⇒ 无租户门,与 interactiveTools 同姿势直通。
-            // 🔴 **表态在场才写、缺席不写键**(与 shellGate 同形):不写 = core 默认(交互态)逐字节不变;写一个
-            // 「默认值」上去等于替没表态的调用方做了表态。非 boolean(resume 重放持久化 body / 提交面已 400)
-            // 同样不写键。四条 rebuild 腿读的是同一份持久化 body ⇒ 首跑与续跑天然同值。
             ...(typeof body.oneShot === "boolean" ? { oneShot: body.oneShot } : {}),
-            // design/131 (core 1.246): per-task resilience INTENT flags. allowDegrade/allowFailover are
-            // caller-facing (a bench/eval run wants true failure shapes); bypassBreaker is operator-only (normalizer
-            // drops it for non-operators — it punches through a SHARED breaker). All-absent = byte-compat.
             resilience: normalizeResilience(body.resilience, explicitOperatorOk(auth?.principal, config.operatorPrincipals)),
-            // design/132 (core 1.249): one-shot end-game verification nudge ("re-run the final artifact through
-            // its real entrypoint before finishing"). OPT-IN by core's own judgment (default ON lost the evidence case:
-            // +1 turn on every interactive write task) — the AUTONOMY caller declares it (harness/scheduler lanes).
-            // [849]→[2400] scenario-declared leg 已无生产者(autonomous 退役后无场景定死终验);保留 OR 折入形防回归 —— (cap.finalVerification —
-            // picking that scenario IS the autonomy declaration, so this is not "inferring from scenario"); OR-folded
-            // with the caller's explicit flag — a scenario can only ADD the closing verification turn, never strip a
-            // caller's request. Children do not inherit (core semantics).
             finalVerification: cap.finalVerification === true || body.finalVerification === true ? true : undefined,
-            // design/133 (core 1.251): turn-boundary attachment reminders (todo/changed-files/plan-mode),
-            // literal-true unions — the normalizer drops `false`/garbage keys instead of forwarding them (core contract:
-            // "off = delete the key, never send false"). Resume-safe by construction: the persisted body is full JSON
-            // and this is the single translation point, so this line IS the whitelist inclusion.
             attachments: normalizeAttachments(body.attachments),
-            // hooks(阶段一,gate 见上面 taskHooks 装配):core 是整槽覆盖(`spec.hooks ?? deps.hooks`,
-            // runtask gateBaseline 注释点名),task hooks 一挂会 shadow deps.hooks 上的 TOOL_TRACE 观测 → composeHooks
-            // 把部署基线折进来(部署槽先跑=观测看到真实执行)。无 task hooks 时不挂字段,deps 路径原样。
             ...(taskHooks ? { hooks: composeHooks(deploymentHooks, taskHooks) } : {}),
             model: picked.model,
-            // [1479]① compactionModel (design/145 cheap compaction gear): catalog-gated to the SAME expanded view as
-            // body.model (canonical name form). resolveSpec is the AUTHORITY (codex R5 — the prepareSpec 400 is only
-            // a fast-fail UX layer; the catalog hot-refreshes in place, so a ref valid at the HTTP gate can be gone
-            // after the authorize/resolve awaits): unknown on a FRESH leg → 400 fail-loud (the documented guarantee —
-            // never a silent price change); unknown on a RESUME replay → drop + warn (core's resolveModel THROWS on
-            // an unknown compactionModel, which would brick the resume; the fallback is the summarize role / main
-            // model, the pre-field behavior).
-            // Window note (codex R6, requalified): the resolveSpec→Runner handoff shares spec.model's DOCUMENTED
-            // restart-window class ([865] / the wireCatalog note above) — the Runner resolves the canonical string
-            // against ITS OWN constructor-time expanded snapshot, so a hot refresh between here and prepare can
-            // desync the two views. Inside that window the failure mode is core's resolveModel TYPED THROW
-            // ("Unknown model ref", roles.js dist-read) = a fail-loud task error, never a silent price change —
-            // the same honest posture the sibling field ships with. Binding a Model OBJECT here instead would
-            // diverge from spec.model's string-intent contract and freeze catalog bytes into the persisted body.
             ...((() => {
                 if (typeof body.compactionModel !== "string" || body.compactionModel.length === 0)
                     return {};
@@ -688,10 +284,6 @@ export function createResolveSpec(ctx) {
                     logger.warn("compaction_model_unknown_fallback", { requested: body.compactionModel.slice(0, 120), sessionId: auth?.sessionId ?? null });
                     return {};
                 }
-                // #233 / A-002.8 第二执法点:`compactionModel` 也是用户逐 turn 选择通道(一次显式的省钱换挡),
-                // 与 body.model 同门同拒形。归一同源(isModelAllowlisted 收增广目录 + 名单)。resume 照旧续跑
-                // (终裁 (a)):这条腿上"照旧"= 保留该 compactionModel,只留声——把它丢回 summarize 角色是
-                // **静默换价**,正是本字段当初为之存在的病灶。
                 if (!isModelAllowlisted(cm, wireCatalog, config.atModelAllowlist)) {
                     const terminal = terminalCatalogName(cm, wireCatalog) ?? cm;
                     if (opts?.leg === "fresh") {
@@ -702,31 +294,10 @@ export function createResolveSpec(ctx) {
                 }
                 return { compactionModel: cm };
             })()),
-            // E7 (shell-host contract): reasoning-effort selection threaded to core's ThinkingLevel. Defensive
-            // isThinkingLevel guard — RESUME re-runs resolveSpec WITHOUT the HTTP-layer 400 validation, so an invalid/
-            // absent value falls through to the resolved role's default thinking (core's RoleSpec.thinking), never throws.
-            // L2 ultracode (design/111): the preset FLOORS thinking at the ultra tier (= max, via core resolveReasoningProfile);
-            // awareness rides for free (core composes it from thinking∈{xhigh,max}). Else the explicit reasoningEffort.
             thinking: effectiveThinking(body.reasoningEffort, parsedSettings.settings?.ultracode === true),
-            // Per-model auth (config-center apiKeyEnv): core calls this per brain call / cascade rung so each
-            // model uses its own upstream key; a model without one falls back to the gateway key. undefined
-            // when no per-model keys are configured → unchanged single-key behavior.
-            getApiKeyAndHeaders: getKeyResolver(), // A10 搬运改写②:活引用取值(原 `keyResolver`)
-            // [854]④ per-request 配速:body.limits.{maxWalltimeMs,maxOutputTokens,maxTurns} 现在被收下(核对上游
-            // TB2.0 实测诉求;旧姿势「body limits 一律忽略」作废)。合成规则在 resolveTaskLimits(spec-fields.ts):
-            //  - body.maxWalltimeMs 给了就用 body(caller 显式配速,可低于内建墙;已被可选 TASK_TIMEOUT_MAX_SEC
-            //    封顶——env 保秒义,对毫秒键封顶时 ×1000);
-            //  - body 缺席保持既有姿势 = tenancy 墙钟(单用户 turnkey 无墙 / 多租 2400s、大任务 3600s,
-            //    clay 2026-07-04 make-real 教训①)+ env TASK_TIMEOUT_SEC 只抬不降(taskWallClockSec 内 Math.max);
-            //  - maxOutputTokens/maxTurns 直透传(可选 TASK_MAX_OUTPUT_TOKENS_MAX / TASK_MAX_TURNS_MAX 同款封顶)。
-            // resume 重放持久化 body 不过 HTTP 400 门 → normalizeLimits defensive(0/负/垃圾按键 DROP,不 throw);
-            // 退役键(timeoutSec/deadline 族)DROP 必须留痕:task_limits_legacy_key_dropped 带被丢键与最终生效墙钟
-            // (null=整任务无墙——单用户 turnkey 无 env 墙时的真后果;多租=被延到租户墙)。
+            getApiKeyAndHeaders: getKeyResolver(),
             ...(() => {
                 const limits = resolveTaskLimits(body.limits, taskLimitCaps, taskTimeoutSec, config.requirePrincipal, body.council === true || body.debate === true || scenarioName === "discuss", (event, fields) => logger.warn(event, { ...fields, sessionId: auth?.sessionId ?? null }));
-                // [1301]③ config catalog server 半场:env 封顶不再是「五层五值互不知情」的暗手——每个真在场
-                // 的运营方旋钮以 configOverrides 声明进 spec(advisory,core 折进 config.assembled 的
-                // overrideReasons;「谁设的顶」变成读帧不考古)。只声明 SET 了的键(缺省不设=不污染帧)。
                 const declarations = [];
                 if (taskLimitCaps.timeoutSec !== undefined)
                     declarations.push({ key: "server.limits.timeoutSecCap", value: String(taskLimitCaps.timeoutSec), reason: "env TASK_TIMEOUT_MAX_SEC (seconds; operator ceiling applied to caller limits.maxWalltimeMs as cap×1000)" });
@@ -734,33 +305,18 @@ export function createResolveSpec(ctx) {
                     declarations.push({ key: "server.limits.maxOutputTokensCap", value: String(taskLimitCaps.maxOutputTokens), reason: "env TASK_MAX_OUTPUT_TOKENS_MAX (operator ceiling)" });
                 if (taskLimitCaps.maxTurns !== undefined)
                     declarations.push({ key: "server.limits.maxTurnsCap", value: String(taskLimitCaps.maxTurns), reason: "env TASK_MAX_TURNS_MAX (operator ceiling)" });
-                // PAIR-REVIEW F-4:budget 族与墙钟基值的声明补齐——[1301]③ 首批只做了 limits 三键,而
-                // MAX_TASK_COST_USD/MAX_TASK_TOKENS 在 caller 缺席时**直接成为** spec 值(cappedCeiling),core
-                // 便记 provenance:"spec"=归因谎报(「谁设的 5 刀」重回考古)。同姿势:只声明 SET 了的键,
-                // server 命名空间,绝不重复 core 目录键。
                 if (config.maxTaskCostUsd > 0)
                     declarations.push({ key: "server.budget.maxCostUsdCap", value: String(config.maxTaskCostUsd), reason: "env MAX_TASK_COST_USD (operator ceiling; becomes the effective value when the caller sends none)" });
                 if (config.maxTaskTokens > 0)
                     declarations.push({ key: "server.budget.maxTokensCap", value: String(config.maxTaskTokens), reason: "env MAX_TASK_TOKENS_MAX (operator ceiling; becomes the effective value when the caller sends none)" });
-                // F-4 附:tenancy 墙钟基值(taskWallClockSec 在 multi-tenant 时注入 2400/3600 基值——同为
-                // 「server 设的顶」,声明其来源;single-user 无墙=不声明)。
                 if (config.requirePrincipal === true)
                     declarations.push({ key: "server.limits.wallClockBaseSec", value: "2400/3600", reason: "tenancy wall-clock base (multi-tenant; big tasks 3600) — TASK_TIMEOUT_SEC raises, never shrinks" });
-                // codex F1:core 目录自有键(limits.maxWalltimeMs 等)**绝不重复声明**——core 已按真 provenance 发
-                // 该字段,叠一条 host-declared 字符串值=同键双条矛盾帧(by-key 投影抹掉权威来源)。server 只
-                // 声明自己命名空间的键;来源语义(caller vs 墙钟)由 maxWalltimeMs 的 spec provenance + 上面的
-                // Cap 声明组合可读。
-                // core 5.8.0:预算族(maxCostUsd/maxTokens/degrade)从 TaskSpec 顶层迁入 limits——顶层键已删,
-                // 继续写顶层=经宽类型静默死键(E-HIGH-1 病族)。wire 面不变:body 顶层 maxCostUsd/maxTokens 照收
-                //(SDK 在发),装配目标改到 limits。budgetStreamCancel 语义照 core 默认(maxCostUsd 在场即 true)。
                 const maxCostUsd = cappedCeiling(body.maxCostUsd, config.maxTaskCostUsd);
                 const maxTokens = cappedCeiling(body.maxTokens, config.maxTaskTokens);
                 const degrade = (() => {
                     if (!config.degrade || maxCostUsd === undefined)
                         return undefined;
                     if (Array.isArray(body.images) && body.images.length > 0 && !config.degrade.toSupportsImages) {
-                        // S14 (SILENT-FALLBACK P0-f): this drop was undetectable — the task keeps its vision-capable main
-                        // model and near-budget it hard-fails on cost instead of degrading. Surface it.
                         metrics.inc("degrade_dropped_total", { reason: "vision_target" });
                         logger.warn("degrade_dropped", { reason: "vision_target", model: picked.model, images: body.images.length });
                         return undefined;
@@ -775,96 +331,21 @@ export function createResolveSpec(ctx) {
                 };
                 return { ...(Object.keys(merged).length > 0 ? { limits: merged } : {}), ...(declarations.length > 0 ? { configOverrides: declarations } : {}) };
             })(),
-            // design/129: the TOC/interactive posture (single-user turnkey — the shell's
-            // session lane) defaults background children to SESSION scope = CC Backgrounded semantics (a bg Agent/
-            // Fork outlives the turn; completion arrives via the durable-inbox push). Multi-tenant / CI / workflow
-            // deployments keep core's "task" default (no orphans burning tokens). Caller-trusted spec field
-            // (systemPrompt tier), NEVER read from the request body. Same tenancy predicate as the wall clock above.
             ...(config.requirePrincipal !== true ? { backgroundScope: "session" } : {}),
-            // ⑤ Per-task budget gate + 1.40 near-budget degrade:core 5.8.0 起全部在 limits(上方 IIFE 合成),
-            // 顶层键已随 core 类型删除。
-            // Long-term memory (design/138 S1): enabled when the memory ENGINE is wired AND a scope was derived
-            // (single-user only — multi-tenant derives none, memory dark). MF-30 PAUSE (option B, per-request —
-            // clay 2026-06-27 confirmed with core): `body.memoryWrite:false` makes THIS run read-only over memory
-            // (`writeScope:null` — the engine materializes/reads but harvest commits nothing). Per-request (not a
-            // stored flag) → no new per-session state; the shell carries the toggle. RESUME re-runs resolveSpec
-            // from the persisted body, so a paused run stays paused across resume legs.
-            // 件A origin 盖章(#148 件3④):部署形态维随 requirePrincipal——多租户下登记簿种子(projectId
-            // 选定)按 request 盖章走 core 准入门,单用户一律 deployment(v4 §1 N2;零 org 键=整键缺席零迁移)。
             memory: memoryEngine ? memorySpecForRequest(auth?.memoryScope, body.memoryWrite, s4DefaultScopes, { multiTenant: config.requirePrincipal === true }) : undefined,
-            // #217(core 5.26.0 提货):部署对「本机能不能把用户的『记住 X』落到持久处」的自我声明,env
-            // `MEMORY_PERSISTENCE_CAPABLE` 三态直通。**部署面旋钮,不开请求键**——恢复 remote lane 的
-            // `# Memory` 写指令是「这条执行车道与记忆根共享挂载」这个部署事实,归 operator 不归调用方表态
-            // (operator-knob 律:部署级旋钮禁挂客户端表态派生腿)。与请求键 `memoryWrite` 两轴正交:后者是
-            // per-run 收紧(writeScope:null),前者是部署声明;任一取否方向即只读方向,客户端永远撑不开
-            // 部署声明的 `false`(core 自己也把 declared false 当 FLOOR:委派转发 tighten-only)。
-            // 三态的 absent 腿 = **整键缺席**(core:「absent = 各自推断」),所以走条件展开而不是赋 undefined。
-            // 🔴 core 5.27.0([3612] F2)起,`false` 还让这次会话成为**受限会话**:按已提交账供给,磁盘上
-            // 无事务背书的分歧不收编不供给(留盘 + `restricted_divergence` 点名)。**受限是会话级的这一个键**,
-            // 与上面 `memoryWrite:false` 铸出的 `writeScope:null` **只读平面**不是一回事 —— 那条平面照旧
-            // adopt-on-read(暂停的只是 harvest)。两轴各自的完整口径见 `config-types.ts` 的字段注。
-            // 🔴 #266 A3 源头修([4082],A-044):有效值经 effectiveMemoryPersistenceCapable 单源——env 显式恒赢;
-            // env 缺席且 `REMOTE_EXEC=host` ⇒ 自动 true(host 腿文件平面=本机,capable 断言的车道级事实由构造
-            // 成立;core 按 remote 面 withhold 对这条腿是误伤,裸装默认形的记忆写指令曾因此静默消失)。
-            // 沙箱腿/in-process 逐位不变。理由全文与「为什么不是围栏合取」见该函数头注。
             ...((v) => (v !== undefined ? { memoryPersistenceCapable: v } : {}))(effectiveMemoryPersistenceCapable(config)),
-            // Scenario-provided capabilities (e.g. code-review = repo tools + reviewer subagents + prompt).
-            // RFC A2: the SelectEnvironment tool rides after the scenario's tools (spec.tools is ADDITIVE to core's
-            // built-in roster — prepare-task mounts first-party tools separately). Only when the image chain is live.
             tools: ((base) => {
                 const extra = [...(selectEnvTool ? [selectEnvTool] : []), ...(sendUserFileToolSpec ? [sendUserFileToolSpec] : [])];
                 const merged = extra.length > 0 ? [...(base ?? []), ...extra] : base;
-                // [803]④ defer face (EXPERIMENTAL, default OFF): long-tail first-party tools get per-tool defer:true
-                // (assessment + why NOT deferMode:"auto"/SendUserFile: src/capabilities/tool-defer.ts header).
                 return merged && config.toolDeferLongtail ? applyLongtailDefer(merged, true) : merged;
             })(cap.tools),
-            // Personalization: the caller's own skills ride after the scenario's; scenario
-            // wins on a name clash (mergeUserSkills — the security baseline can't be shadowed). HTTP layer
-            // already validated shape + caps (validateUserSkills).
             skills: mergeUserSkills(cap.skills, body.skills, logger),
-            // Sema-registry MCP servers (B1) filtered to this scenario (env-NAME refs already resolved at startup),
-            // PLUS the caller's gated per-request MCP (R3 — TOC local `.mcp.json`). resolveRequestMcp honors body.mcpServers
-            // on any SINGLE-USER deployment (`requirePrincipal!==true` — the requester is the super-admin of their own
-            // worker; the stdio MCP runs on the worker, not the exec env, so the lane is irrelevant → seamless TOC↔cloud);
-            // a multi-tenant deployment returns the baseline unchanged (gate closed → ignored, advertised via
-            // capabilities.mcpInjection). Baseline wins on a name clash (a caller can ADD a server, never SHADOW a configured one).
-            // design/170 件C:锁形下本行不可达 —— `resolveSpec` 腿首已整拒(见那里的 F3 注)。`resolveRequestMcp`
-            // 收下的 config 带着 `lockedConfigKeys`,所以即使将来有人绕开腿首那道门,honored 谓词也会翻假。
             mcp: resolveRequestMcp(mcpForScenario(config.mcpServers, scenarioName), body.mcpServers, config, logger),
-            // DESIGN-269 车1 件3 —— A2A peers,与上一行逐点同构:center 基线按场景过滤 + 调用方自带的 peer
-            // (单用户闸 ∧ 未锁 ∧ 合规未禁,`resolveRequestA2a` 里那只三票谓词是唯一属主),同名 baseline 赢。
-            // 🔴 与 MCP 的语义差:一个 peer 是**远端 agent**,core 给它的每条 skill 挂 `egress:true`+
-            // `effect:"write"`(2026-08-03 裁定)—— 所以这一行接出去的是对外写通道,不是数据源。两侧都缺席时
-            // 键整个不写(`a2aForScenario` 与 `resolveRequestA2a` 都恒返回 undefined 而非 []):缺席 = 本部署
-            // 没有这条腿,空表 = 「声明了一个空的 peer 集合」,对 core 与对读面都是两回事。
             a2a: resolveRequestA2a(a2aForScenario(config.a2aPeers, scenarioName), body.a2aPeers, config, logger),
-            // center prompts 投影([1057]①f):center 下发的场景终形(overrides[s] ?? 基线)赢过内置 provider
-            // (center-wins,scenario overlay 同先例);无 pack/该场景空声明 ⇒ 内置照旧。声明数组逐字喂 typed
-            // 钩子(contentHash 透传,core 1.315 校验入 manifest);packId 归因在采用日志(center_prompts_adopted)。
-            // codex R4:读请求级快照 centerDecls(与 append-less 门同一份),不再回读活 ref——刷新竞态下门与
-            // provider 才不会各看一版(TOCTOU:门判安全、pick 到已组装包=core 侧静默丢 rider 复活)。
             promptProvider: centerDecls ? centerPromptProvider(centerDecls, scenarioName) : cap.promptProvider,
-            // F4: high-risk write approval gate. DURABLE (design/45, opt-in): the gated `ask` SUSPENDS the task
-            // (durable checkpoint, resumable on any replica). [2354]/[2356] A-5(5.0.0): the legacy POLL gate
-            // (createOaApprovalPolicy over ApprovalStore pending rows) is retired — durable is the ONLY gate; an
-            // operator with approval intent but no checkpointStore falls to `undefined` (core's UNGATED warning).
-            // Durable ask (TC-5.4, core 1.95): in durable mode an AskUserQuestion call suspends like an F4 gate —
-            // the question policy adjudicates it `ask`, the operator answers out-of-band, and the resume carries
-            // the QuestionAnswer (server.ts `body.answer` → onQuestion closure). #152([2703] 案二): the question
-            // policy is LIVE-AWARE when the QuestionCoordinator is wired — a live-stream leg adjudicates `allow`
-            // (the live human answers over the stream) instead of unconditionally parking; see durableQuestionPolicy.
-            // design/181 件一:基线的**构造**归 `createApprovalBaselinePolicy`(三腿单一属主);本处只做部署形
-            // 判断——哪一形该有 durable 轴、哪一形铺 allow-all、哪一形留 `undefined`(见下两条注)。
-            // #196 纵深(设计小票 §2b):hands=none 的场景在 spec 上叠一份 band 名单 deny —— **不是**主保证
-            // (主保证=这类任务跑在不挂 executionEnvFactory 的 Runner 上,band 根本不 mount),而是「将来
-            // 有人把它误接回有手 Runner」时的第二层。合成走 tighten-only 的 combinePolicies(TRAP #1:
-            // 直接赋值会静默丢掉下方那条 durable 审批基线 / auto-accept 座),见 capabilities/hands-lane.ts。
             toolPolicy: toolPolicyForHands(hands, durableEnabled
                 ? createApprovalBaselinePolicy(config, {
                     question: liveQuestionFace,
-                    // The probe key is the CONTINUED session (auth.sessionId — the same id that keys the
-                    // durable checkpoint /decide route). A fresh session (no body.sessionId) has no exemptions by
-                    // construction; fail-closed inside the policy on a store error.
                     ...(approvalExemptionStore && auth?.sessionId
                         ? {
                             exempt: (toolName) => approvalExemptionStore.has(auth.sessionId, toolName),
@@ -873,22 +354,8 @@ export function createResolveSpec(ctx) {
                         : {}),
                 })
                 : singleUserAutoAcceptBaseline
-                    // 🔴 (live finding: single-user host-lane Bash ran UNGATED, no adjudication): a
-                    // single-user turnkey worker with NO expressed gate intent previously left `toolPolicy` UNDEFINED →
-                    // core's write-capable hand tools mount UNADJUDICATED (core error-logs it every task; host lane has NO
-                    // sandbox to fall back on). CC's trust model is auto-accept, but the GATE MECHANISM must be PRESENT
-                    // (core 原则: "机制留、默认可更宽 auto-accept"). So wire an adjudicated auto-accept BASELINE
-                    // (the durable-less arm of `createApprovalBaselinePolicy` = a present, effect-aware policy that allows
-                    // all): satisfies core's `hasEffectAwareGate`, restores observability + a hook/tighten point, and the
-                    // operator STILL tightens irreversible ops via `AUTONOMY` / `commandPolicy` (layered TIGHTEN-ONLY by
-                    // applyRuntimeGovernance).
-                    // Interactive approval routed to the shell HITL = follow-on. 🔴 `singleUserAutoAcceptBaseline` requires
-                    // ZERO gate intent — a single-user op who SET approval flags but wired no store falls to `undefined`
-                    // (core warns = real misconfig, not masked); multi-tenant likewise stays `undefined` (approval required).
                     ? createApprovalBaselinePolicy(config)
                     : undefined),
-            // Durable suspend needs both the store (here, per-task) and the opt-in scope key (multi-tenant =
-            // principal; "_" when auth is off). core suspends on a policy `ask` only when these are present.
             ...(durableEnabled
                 ? {
                     checkpointStore,
@@ -896,11 +363,6 @@ export function createResolveSpec(ctx) {
                         scope: encodeCheckpointScope(auth?.principal),
                         ...(config.approvalTimeoutSec > 0 ? { ttlMs: config.approvalTimeoutSec * 1000 } : {}),
                     },
-                    // design/80 seam #2: opt this task into resource/preempt durable-suspend (design/74 third state)
-                    // when RESOURCE_SUSPEND=true — a budget/turns/walltime limit OR a scheduler preempt durably SUSPENDS
-                    // (resumable) instead of failing. SAME scope key as durableApproval (the principal). The decision
-                    // (incl. the 🔴 verify/cascade EXCLUSION that keeps eligibility aligned with the preemptSignal wiring,
-                    // so an inner suspend can't orphan a VM+checkpoint) lives in the pure, unit-tested `resourceSuspendOptIn`.
                     ...((rs) => (rs ? { resourceSuspend: rs } : {}))(resourceSuspendOptIn({
                         enabled: config.resourceSuspend,
                         ttlSec: config.resourceSuspendTtlSec,
@@ -908,43 +370,14 @@ export function createResolveSpec(ctx) {
                         isCascade: body.cascade === true,
                         scope: encodeCheckpointScope(auth?.principal),
                     })),
-                    // #152([2703] 案二):sentinel 只在活体面缺席时 stamp。core 取 `spec.onQuestion ?? deps.onQuestion`
-                    // (spec 位恒赢),无条件 stamp 会把 ASK_QUESTION_ENABLED 部署的活人腿永久遮蔽成 durable park。
-                    // 活体面在场 ⇒ 键缺席,RunnerDeps.onQuestion 的 coordinator 生效;park 与否由上面的判决门分腿。
-                    // (suspend 侧的「未答 approve」拒绝不靠 sentinel:server.ts decide 路由 pre-CAS 400 守着。)
                     ...(liveQuestionFace === undefined ? { onQuestion: QUESTION_AWAITS_RESUME } : {}),
                 }
                 : {}),
         };
         return spec;
     };
-    /** 阶段⑤(governance 折叠):吃 阶段④的 spec + 请求体 + auth + 阶段①的 append/settings 三量,吐 折完运营方
-     *  governance 与客户端 settings(tighten-only)后的 governed,外加两个下游还要用的量:本请求的 scratchpadDir
-     *  与 hostSemanticsLane 判别。 */
     const foldGovernanceAndSettings = async (body, auth, spec, gated, effMode) => {
         const { appendLessPack, acceptedAppend, parsedSettings } = gated;
-        // Runtime governance "second baton" (center §10): compile the operator's autonomy + commandPolicy onto the
-        // spec TIGHTEN-ONLY. commandPolicy layers via combinePolicies onto the approval/durable baseline above (NOT a
-        // bare overwrite — TRAP #1), autonomy expands to handsReadOnly/shellGate (TRAP #2). Applied here so it also
-        // re-applies identically on the resume paths (which rebuild via resolveSpec) — core requires shellGate/
-        // toolPolicy be re-supplied on resume (omitting shellGate would leave a resumed run's bash UNGATED).
-        // tightenTaskSpec THROWS on a loosening misconfig (fail-loud).
-        //
-        // 🔴 RESUME uses LIVE config (not a per-task frozen snapshot), IDENTICAL to how the approval baseline above
-        // reads live `config.approvalRequire`. So if an operator LOOSENS the fleet governance while a task is
-        // suspended, the resumed task picks up the looser policy (governance stays per-call tighten-only, so a
-        // mid-suspend TIGHTENING is honored; a loosening is an explicit operator action). Freezing deployment policy
-        // per-task across suspend is a larger, separate decision that must cover the approval baseline too — tracked
-        // for center (adversarial-review HIGH-1), deliberately NOT a governance-only partial freeze here (that would
-        // be an inconsistent false-safety: approval would still be live).
-        // #153([2713] 分单②):MANUAL_MODE_SHELL_GATE 在此无条件施加(与 autonomy 同拍)——部署旋钮不再
-        // 依赖客户端 settings 在场性/模式臂/host lane(三重条件曾让 print/headless 腿与沙箱 lane 全静默失效)。
-        //
-        // #177([2951] issue #29):SENSITIVE_WRITE_PATTERNS 是 #153 漏下的兄弟旋钮,同病同修——operator
-        // 守卫集预铸成纯 DENY policy 在 governance 拍无条件施加(bypassPermissions/键缺席/settings 整缺席
-        // 都掀不掉;deny-wins 折叠,普通目标弃权 ⇒ 不给 bypass 加 ask 门,[820] 表第四行逐字保持)。
-        // 裁决 env/cwd 在此**单点**铸,settings 折叠的 fsWriteGate wiring 复用同一份(两处各铸一份正是
-        // 漂移的成因)。lane 分形与 cwd 三形/哨兵的完整理由成文在下方 settings 块(修5/W4/#165),此处不复述。
         const hostSemanticsLane = !isSandboxPathAdjudicationLane(config.remoteExec?.provider);
         const pathAdjudication = hostSemanticsLane
             ? (() => {
@@ -952,7 +385,7 @@ export function createResolveSpec(ctx) {
                 const gateCwd = sessionCwd ??
                     (config.remoteExec === undefined
                         ? process.cwd()
-                        : join(config.localDataRoot ?? localRoot, "fs-write-gate-unrooted")); // never created — see the settings block
+                        : join(config.localDataRoot ?? localRoot, "fs-write-gate-unrooted"));
                 return { env: new NodeExecutionEnv({ cwd: gateCwd }), cwd: gateCwd };
             })()
             : {
@@ -962,49 +395,19 @@ export function createResolveSpec(ctx) {
                     logger: { warn: (event, fields) => logger.warn(event, { ...(fields ?? {}), lane: config.remoteExec?.provider }) },
                 }),
             };
-        // design/181 件一:governance 实参(含守卫集预铸)归 `createDeploymentGovernanceInputs`(三腿单一
-        // 属主),**折叠属主不变**——仍是这一句 `applyRuntimeGovernance` → core `tightenTaskSpec`。每请求现调,
-        // 读的是活 config(autonomy/commandPolicy 热改;resume 腿按当前值重折,与上方审批基线同姿势)。
         const governedBase = applyRuntimeGovernance(spec, createDeploymentGovernanceInputs(config, pathAdjudication));
-        // Fold the client's per-request settings stamp onto the governed spec, TIGHTEN-ONLY (deny-wins) — AFTER
-        // the approval baseline + operator governance, so the order is deployment ⊇ operator ⊇ client (each can only
-        // narrow). tightenTaskSpec THROWS if the client settings would LOOSEN a stricter baseline → a 422 client error
-        // (a settings stamp is tighten-only by contract; never a silent weakening). Re-applies idempotently on resume.
         let governed = governedBase;
-        // R4: fold a LIGHT top-level `body.permissionMode` onto the parsed settings (the explicit
-        // per-turn intent WINS over a bundle `defaultMode`) → the SAME tighten-only governance path. Post-[816] all
-        // five CC modes are honored as gate-SHAPE choices (see coercePermissionMode/deriveSettingsPolicy): `plan` ⇒
-        // read-only hands + present_plan; `default`/`auto` ⇒ the fs-write ask gate; `acceptEdits` ⇒ the cwd-domain
-        // variant; `bypassPermissions` ⇒ no mode gate (the deployment baseline is composed above and untouchable).
-        // design/201 §6-1:折叠也读**同一只** effMode(顶层键赢过 bundle defaultMode 的裁定在
-        // `effectivePermissionMode` 里说一次)。effMode 来自 bundle 时这里把同值原样写回,是恒等折叠;
-        // 缺席时整条 settings 原样透传(无表态请求的 pre-[816] 行为不变)。
         let effectiveSettings = effMode ? withPermissionMode(parsedSettings.settings, effMode) : parsedSettings.settings;
-        // codex R3 second bypass: settings.outputStyle ALSO lands in spec.appendSystemPrompt (applyTaskSettings
-        // fold) — on an append-less pack core would discard it silently, exactly like the top-level rider. Same
-        // disposition: fresh submits 400 at the HTTP gate; here (the resume mirror + any leg the gate didn't see)
-        // strip + warn. Spread-copy, never mutate parsedSettings (it may be consulted elsewhere).
         if (appendLessPack && effectiveSettings?.outputStyle) {
             logger.warn("output_style_dropped", { detail: "the effective prompt pack cannot mount the append slot (already-assembled systemPrompt or center assembled-identity declaration)", sessionId: auth?.sessionId ?? null });
             const { outputStyle: _dropped, ...rest } = effectiveSettings;
             effectiveSettings = Object.keys(rest).length > 0 ? rest : undefined;
         }
-        // codex R14 resume mirror of the aggregate cap: both carriers fold into ONE spec field — a pre-cap stored
-        // body can be individually valid but combined over the bound (fresh submits 400'd this in prepareSpec).
-        // Drop the STYLE (it composes second; the knowledge rider keeps priority) + warn, never silently oversize.
         if (effectiveSettings?.outputStyle && acceptedAppend && acceptedAppend.length + 2 + effectiveSettings.outputStyle.length > MAX_SETTINGS_OUTPUT_STYLE_CHARS) {
             logger.warn("output_style_dropped", { detail: `combined append carriers exceed the ${MAX_SETTINGS_OUTPUT_STYLE_CHARS} cap (rider ${acceptedAppend.length} + style ${effectiveSettings.outputStyle.length}) — style dropped (pre-cap stored body on a resume leg?)`, sessionId: auth?.sessionId ?? null });
             const { outputStyle: _dropped2, ...rest2 } = effectiveSettings;
             effectiveSettings = Object.keys(rest2).length > 0 ? rest2 : undefined;
         }
-        // [820]③ scratchpadDir, hoisted from the envFacts block below so the SAME per-session dir feeds BOTH the
-        // `# Environment` fact and the fs-write gate's exemptDirs (single-source path via scratchpadDirFor inside
-        // ensureScratchpadDir). HOST-semantics lanes only + session required — rationale at the envFacts consumer.
-        // (hostSemanticsLane 判别式已随 #177 上移到 governance 拍前——单一真源不变,只是搬了家。)
-        // G3([816]③/[820]③,[1840]§四):壳供 body.scratchpadDir 优先——壳(CC 形)有自己的 per-session
-        // scratchpad 约定路径,接受后事实/豁免/根围栏三处同源指向壳的目录(壳侧提示词与 server 写门不再
-        // 两个 scratchpad)。验收门 fail-closed(多租户/远程 lane/浅路径全拒收,warn 后回落自算)——
-        // 规则与理由集中在 acceptShellScratchpadDir。
         const shellScratchpad = await acceptShellScratchpadDir(body.scratchpadDir, {
             requirePrincipal: config.requirePrincipal,
             hostSemanticsLane,
@@ -1013,44 +416,7 @@ export function createResolveSpec(ctx) {
         const scratchpadDir = shellScratchpad ??
             (hostSemanticsLane && auth?.sessionId ? await ensureScratchpadDir(config.localDataRoot ?? localRoot, auth.sessionId) : undefined);
         if (effectiveSettings) {
-            // [816]/[820]① fs-write gate wiring —— 两形,按 lane 分:
-            //
-            // ① HOST-semantics lane(REMOTE_EXEC 未设或 "host"):core 的 createFsWriteGatePolicy 把每一个
-            //    target/dir 交给给定 env 的**真实 fs**(exists/canonicalPath/readLink,dist 亲读),所以 env 必须
-            //    就是 hand 工具真正写的那块盘 —— 这里给 worker 本机的 NodeExecutionEnv(构造是纯字段赋值,不 spawn)。
-            //
-            // ② 沙箱 lane(e2b/k8s/ssh/adb/local-docker,#165):沙箱 env 由 core 在 spec **之后**才铸
-            //    (executionEnvFactory),spec 期把 worker 本机 env 递进去会拿**别人机器上的 fs 事实**裁决
-            //    (symlink/exists 全答错),而错误的 allow 比没有门更糟。解法是把「取 env」推迟到裁决时刻:
-            //    `DeferredSandboxPathEnv` 是个代理,per-session slot 由工厂装饰器在铸 env 时填(boot/execution-env.ts
-            //    链尾),写门每次 canonicalize 都转发那台**真沙箱**的 exists/canonicalPath/fileInfo/readLink。
-            //    唯一不转发的是 `absolutePath`(相对路径基准之争,理由在下面那条臂与代理模块的文件头)。
-            //    cwd 仍不铸 ⇒ 无 acceptDirs、相对路径恒 ask;scratchpad 豁免按 host 同形补回(真 canonicalize
-            //    在场,软链逃逸形会落回真身裁决)。sensitivePatterns 的 deny 腿与 isExempt 会话豁免探针照常施加。
-            //
-            // 修5(三路复审 W4,cwd 基准漂移):gate 的 cwd 基准=与 hands 真跑处同源,分三形:
-            //  · session 注册过 cwd(cwdHonored 已在注册处把关)⇒ 用它——与 host factory 的 effectiveHostWorkspace
-            //    第一优先级同源(顶层 HTTP 任务无 parentCwd,resolver 即 session cwd)。
-            //  · `host` factory lane 且未注册 ⇒ hands 落在 factory 才铸的 EPHEMERAL per-task 目录(spec 期不可知)。
-            //    此前回退 process.cwd()(服务自身启动目录)——acceptEdits 会把服务目录当 auto-allow 域、多任务共享
-            //    进程时判定漂移(W4)。改为 fail-safe 哨兵:一个从不创建的目录 ⇒ acceptDirs/相对路径 canonicalize
-            //    失败即 ask(fs-write-gate-policy dist 亲读:dir.ok=false 跳过、target 解析失败=ask);绝对路径裁决
-            //    (hand 工具的书面契约形)与 scratchpad exempt 均不受影响。
-            //  · provider 未设(in-process host / run-local)⇒ hands 就在本进程 cwd 跑(无 factory),process.cwd()
-            //    正是真工作目录,保留。
-            // 两形**共有**的一件(与 env/cwd 无关,故不随 lane 分叉——单一属主,两臂各抄一份正是漂移的成因):
             const gateCommon = {
-                // ③ 的 sensitive-path DENY 腿已随 #177([2951] issue #29)搬到 governance 拍(见上方
-                // sensitivePathPolicy)——wiring 不再承运守卫集,FsWriteGateWiring.sensitivePatterns 字段一并拆除
-                // (#153 shellGate 同形搬家:部署级旋钮不得挂在客户端表态派生腿上)。
-                // [1557]§四 的 shellGate 旧家已随 #153 搬到 applyRuntimeGovernance(governance 层无条件施加,
-                // 见上方 governedBase)——wiring 不再承运该旋钮,FsWriteGateWiring.shellGate 字段一并拆除。
-                // [841]① / core 1.294 exemption seam:gate 产 ask 前查同一只 approval_exemption 店(与 decide
-                // remember="session" 的授予、ask 政策层探针同店同 canonical toolName 键空间)——「本会话不再询问」
-                // 对 fs-write 门同 turn 即时生效(父+继承子任务,ask 路径不再重入)。has() reject ⇒ core 按
-                // 未豁免处理(fail-closed 照 ask),与店契约的调用方纪律一致;命中打 info 审计(对齐
-                // approval_exempted 的短路留痕,不记路径,路径留在 core 的 allow message 里)。探针是 name-keyed
-                // 的(不做任何 fs 裁决),所以沙箱 lane 照接不误。
                 ...(approvalExemptionStore && auth?.sessionId
                     ? {
                         isExempt: async (toolName) => {
@@ -1064,42 +430,18 @@ export function createResolveSpec(ctx) {
             };
             const fsWriteGate = hostSemanticsLane
                 ? {
-                    // env/cwd 构造已随 #177 上移(governance 拍前的 pathAdjudication 单点),此处复用同一份——
-                    // 守卫集 DENY 腿与写门 ask 腿在同一 env/同一 cwd 基准上裁决,两腿不可能分家漂移。
                     env: pathAdjudication.env,
                     ...(pathAdjudication.cwd !== undefined ? { cwd: pathAdjudication.cwd } : {}),
                     ...(scratchpadDir ? { scratchpadDir } : {}),
                     ...gateCommon,
                 }
-                : // 沙箱 lane(#165):裁决 env = `DeferredSandboxPathEnv` 代理 —— 裁决时刻(必在 prepare 之后)
-                    // 去 per-session slot 里取本 task 的**真沙箱 env**,转发 exists/canonicalPath/fileInfo/readLink。
-                    // 于是绝对路径的 symlink 真身、存在性都是真沙箱 fs 的事实,域内软链指向守卫段照样 deny;
-                    // slot 空/歧义 ⇒ 转发面报错 ⇒ core 判 `unresolvedSymlink` ⇒ 写门 ask + sensitive deny(fail-closed)。
-                    //
-                    // **`cwd` 仍不给**(显式裁定,非过渡欠款):`cwd` 同时是 core 的 `rootPath`(相对路径基准)与
-                    // acceptEdits 的 accept 域。沙箱里那个基准是 engine 跟踪的 cwd,不是 env 自己的 cwd,server 侧要
-                    // 铸它得先建一个 per-task 跟踪面——那是独立一件(与 host 臂哨兵同族的漂移风险)。后果:相对路径
-                    // 恒 ask,acceptEdits 在沙箱 lane 与 default 同形(全 ask),fail-safe 方向。
-                    //
-                    // **scratchpad 豁免按 host 同形补回**:`/tmp/scratchpad/<sessionId>`(remote-scratchpad.ts 单一
-                    // 真源,e2b/k8s/local-docker/ssh 四 lane;adb 无此约定故无豁免)。#156 当年不豁免是因为词法版
-                    // 看不见软链——域内一个指向域外的软链会被判成域内;现在 exemptDirs 与写目标两侧都过真
-                    // canonicalize,逃逸形会解出域外真身而落回真身裁决,host lane 的同一保证在这里成立了。
-                    // 注:远程 lane 的**根围栏**admit 走的是 core 对 `spec.envFacts.scratchpadDir` 的自建根(prepare 期
-                    // canonicalize/实体化),而那条事实在 `SANDBOX_ENV_FACTS=false` 下不发——那种配置里根围栏先拒,
-                    // 本豁免够不着(方向更严,不是放行面);host 臂的 additionalDirectories 折叠不受影响。
+                :
                     (() => {
                         const sandboxScratchpadDir = isRemoteScratchpadLane(config.remoteExec?.provider) ? remoteScratchpadDirFor(auth?.sessionId) : undefined;
                         return {
-                            env: pathAdjudication.env, // #177 单点构造(DeferredSandboxPathEnv 代理),与守卫集 DENY 腿同一份
+                            env: pathAdjudication.env,
                             ...gateCommon,
                             ...(sandboxScratchpadDir ? { scratchpadDir: sandboxScratchpadDir } : {}),
-                            // codex 复审 B(2026-08-05,dist 亲读+实测):core 的 canonicalizeTarget 把反斜杠 UNC 形在**入口**
-                            // 短路成 ok:true/key=原样——不经本 env,canon 便「成功」,gate 随后就咨询豁免探针;name-keyed
-                            // 命中即 allow,「非 POSIX 绝对形一律 ask」就被豁免会话越过(相对形/盘符形没这个洞:它们的
-                            // canon 失败先于豁免咨询)。沙箱臂因此给探针加 canonical-key 守门:只有 `/` 开头(=真经过本
-                            // 代理的路径面)的 key 才享豁免,其余落回 defaultWrite 的 ask。host 臂不加
-                            // (真 fs canonicalize 的 key 可信,[841]① 原契约不动)。
                             ...(gateCommon.isExempt
                                 ? {
                                     isExempt: (toolName, canonicalPath) => canonicalPath.startsWith("/") ? gateCommon.isExempt(toolName) : false,
@@ -1107,11 +449,6 @@ export function createResolveSpec(ctx) {
                                 : {}),
                         };
                     })();
-            // [1248]②/codex F2 — the workflow ask leg's session-exemption probe. Name-keyed and never fs-adjudicated,
-            // so it was on EVERY lane from day one (the fs gate has been too since #156, by a different route: a
-            // lane-specific adjudication env rather than no gate). Same store + canonical toolName key space as the
-            // fs-gate probe — one remember="session" grant serves both; without it the durable lane re-parks every
-            // later run_workflow call after an operator already granted "don't ask again this session".
             const workflowGate = approvalExemptionStore && auth?.sessionId
                 ? {
                     isExempt: async (toolName) => {
@@ -1129,61 +466,26 @@ export function createResolveSpec(ctx) {
                 throw new HttpError(422, `settings are tighten-only and cannot loosen the deployment policy: ${e.message}`);
             }
         }
-        // subagent-hands follow-on (adversarial-review finding): a read-only (permissionMode=plan) parent that mounts
-        // the delegation tool used to let the CHILD get WRITABLE hands — reachable once subRunner grew an
-        // executionEnvFactory — which defeats plan mode's read-only contract. So a hands-read-only run mounts no
-        // delegation tool at all.
-        // 🔴 复审 2026-08-05 亲验安装包(core 5.13.x)后修口:当年那句「core 不把 handsReadOnly/shellGate 传给
-        // 子任务」**已过期** —— 子 spec 现在两者都继承(subagent.js / prepare-task.js 的 inheritedGateForChildren,
-        // 引文在 stripDelegationTools 的注释里)。本行因此是同向第二层(更严不更松),不是唯一防线;要拆得单独决定。
-        // `stripDelegationTools`(runtime-governance.ts,过滤器本体在那里被测钉住)按 core 单源常量
-        // `DEFAULT_SUBAGENT_TOOL_NAME`(="Agent")RAW 比对——5.0.0 RB-476 退役了折叠面,旧名 "Task"/"Fork" 在
-        // roster 层就 miss、不再需要归一(常量引用本身即防当年 1.202 改名时裸字符串失配的那类 fail-open)。
         if (governed.handsReadOnly === true && Array.isArray(governed.tools)) {
             governed = { ...governed, tools: stripDelegationTools(governed.tools) };
         }
-        // #217(core 5.26.0 提货,板 [3499]②/[3521]④ 两次点名的 server 接线半场):零记忆面部署形把 core 的
-        // `NO_PERSISTENT_MEMORY_NOTICE` 组进 system prompt(core 导出但**不注入** —— 「组装归宿主」,同
-        // MEMORY_SAFETY 姿势)。判别式与 provider 分腿装配的全部理由在 capabilities/memory-notice.ts。
-        // 🔴 位置即契约:必须在 governance+settings 折完之后 —— `handsReadOnly` 是判别式的一位输入,而它可能
-        // 由 autonomy(governance 拍)或 permissionMode:plan(settings 拍)才被点亮;在阶段④判会漏掉这两条腿。
         if (shouldDiscloseNoPersistentMemory({
             memory: governed.memory,
-            declaredCapable: effectiveMemoryPersistenceCapable(config), // #266:同一有效值(host 腿自动 true 后披露判别式同视角)
+            declaredCapable: effectiveMemoryPersistenceCapable(config),
             hands: gated.hands,
             handsReadOnly: governed.handsReadOnly === true,
             excludeTools: governed.excludeTools,
-            // core 的 `isRemoteExecutionEnv` 是鸭子类型判别,我方**所有** `REMOTE_EXEC` 车道(含 `host` ——
-            // remote-env-host.ts 实现了 suspendVM/workspaceHandle/execStream,亲验)都满足它。判别位因此是
-            // 「provider 有没有设」;未设 = in-process(core 拿 StubExecutionEnv,非 remote)。
             remoteExecutionEnv: config.remoteExec !== undefined,
         })) {
             governed = { ...governed, promptProvider: withNoPersistentMemoryNotice(governed.promptProvider) };
         }
         return { governed, scratchpadDir, hostSemanticsLane };
     };
-    /** 阶段⑥(image·envFacts·router):吃 阶段⑤的 governed + scratchpadDir/hostSemanticsLane + 场景名,吐**最终**
-     *  TaskSpec —— per-task 镜像 fail-closed 解析并按 session 登记、envFacts 组装、scratchpad 根围栏折叠,以及 A
-     *  价值路由(命中 supervisor 时以 supPostureOverrides 收紧后返回)。 */
     const applyImageFactsAndRouting = async (body, auth, governed, folded) => {
         const { scenarioName, scratchpadDir, hostSemanticsLane } = folded;
-        // §7 P0.5 per-task sandbox image(用户按需选像): the caller sends a PROFILE
-        // (intent) — NEVER a digest (a sha256 is enumerable + caller-unbound → trusting a caller digest is fail-OPEN;
-        // a user could pass another tenant's digest). The TRUSTED control plane resolves profile→digest with the
-        // caller's principal, FAIL-CLOSED (same visibility the /v1/images/select admission uses), and registers it by
-        // sessionId for the k8s factory to apply per-pod. RESUME re-runs resolveSpec ⇒ re-resolves LIVE (no stale
-        // frozen digest), consistent with the governance live-config discipline above.
-        // RFC A2: a session-level SelectEnvironment binding (PROFILE intent, tool-written) is the fallback when the
-        // request body carries no explicit profile. Body wins (an explicit caller choice for THIS task); either way
-        // the profile is re-resolved FAIL-CLOSED right here — a session binding never skips re-admission, and the
-        // F3 boundary contract holds structurally (binding is only read at task boundaries, children inherit
-        // the registered ref at spawn).
         const bodyProfile = typeof body.sandboxImageProfile === "string" && body.sandboxImageProfile.length > 0 ? body.sandboxImageProfile : undefined;
-        // cascade/verify mirror the HTTP-layer v1 reject (server.ts): those flows strip/replace the session, so a
-        // session-level binding would not reach the rungs/verifier sub-run — silently mixed environments. A body
-        // profile on cascade/verify is already 400-rejected up front; the session fallback simply does not apply.
         const taskImageProfile = bodyProfile ?? (body.cascade === true || body.verify === true ? undefined : sessionEnvSelection.get(auth?.sessionId));
-        let resolvedImageCaps; // RFC A1: rides into envFacts
+        let resolvedImageCaps;
         if (taskImageProfile !== undefined) {
             if (config.remoteExec?.provider !== "k8s") {
                 throw new HttpError(400, "sandboxImageProfile is only supported on the k8s sandbox backend");
@@ -1200,54 +502,16 @@ export function createResolveSpec(ctx) {
             const resolved = await resolveSandboxImageRef({
                 profile: taskImageProfile,
                 ...(capsNeeded && capsNeeded.length > 0 ? { capabilitiesNeeded: capsNeeded } : {}),
-                // principal comes from the auth channel (trusted header / verified JWT), NEVER the body — so a caller
-                // cannot widen its own visibility. explicitOperatorOk (NOT isOperator): an empty OPERATOR_PRINCIPALS must
-                // yield operator=false here — isOperator([],p)=true-for-all would let any caller resolve tenant-scoped
-                // images on an operator-less deployment (adversarial-review HIGH-1; the bake/direct-door boot guards do
-                // NOT cover per-task image selection).
                 viewer: { operator: explicitOperatorOk(auth.principal, config.operatorPrincipals), tenantId: auth.principal ?? null },
                 index: imageIndex,
             });
             if (!resolved.ok)
                 throw new HttpError(resolved.status, resolved.message);
-            // Register by sessionId — the factory reads it by ctx.sessionId (stable on every path; see the factory
-            // wrapper). RESUME re-runs resolveSpec ⇒ re-resolves LIVE + re-registers (no stale frozen digest).
-            // ⚠️ KNOWN narrow edge (NOT a security breach): two CONCURRENT requests for the SAME session (same owner —
-            // session ownership is enforced) race this set(); a request the run-claim later rejects (409) can leave its
-            // image bound for the active run. Both images are the SAME principal's own admitted images, so the worst
-            // case is the user's run using the user's other selected image (a correctness glitch, not cross-tenant).
-            // Hardening (register-after-claim, keyed by the durable run id) needs the registry threaded into the server
-            // claim path — tracked as a follow-up; cascade/verify are rejected with a profile (see prepareSpec) because
-            // they strip/replace the session and would silently fall back to the default image.
             perTaskImage.set(auth.sessionId, resolved.ref);
             resolvedImageCaps = resolved.capabilities;
         }
-        // RFC A1 (core 1.240.0 `TaskSpec.envFacts`): compose the deployment-trusted sandbox facts
-        // (profile/capabilities from the fail-closed resolution above, region pkgSource, exec-lane egress posture)
-        // and ride them on the spec — core renders the `# Environment` block (sanitized+bounded, egress=none gets
-        // the "downloads will fail" caveat). Facts only ride when known; nothing known ⇒ no field ⇒ block unchanged.
         if (config.envFactsEnabled) {
-            // pkgSource is a FACT only where the derivePkgSourceEnv injection actually lands (the e2b/k8s sandbox
-            // lanes — main.ts wiring above). host/ssh/adb/run-local get NO injection, so with the global default
-            // (1.180.0) an unconditional read would tell the model "official sources" about an environment we never
-            // touched (workflow audit 2026-07-13: honest-facts posture, same as egress's "don't declare what you
-            // don't know").
             const pkgSourceLane = config.remoteExec?.provider === "e2b" || config.remoteExec?.provider === "k8s";
-            // [820]③ scratchpadDir (core field + prompt chain in since 1.257.3; this fill was the missing half).
-            // HOST-semantics lanes only (provider unset = in-process host, or explicit "host"): the advertised path
-            // must be REAL to the executing hands — on e2b/k8s/ssh/adb/local-docker the tools run off this box, so a
-            // worker-local path would be a lie (same honest-facts axis as pkgSource above; the remote lanes get their
-            // IN-SANDBOX path via the [848] branch below instead). Session-scoped dir under
-            // localDataRoot, mkdir'd at the HOISTED compute above the settings fold (fail → fact omitted) — the SAME
-            // dir now feeds createFsWriteGatePolicy's exemptDirs ([820]① landed at core 1.290, wired in the
-            // applyTaskSettings gate above). No sessionId (adhoc no-session task) ⇒ no per-session home ⇒ fact
-            // omitted. Lifecycle/reaping: see ensureScratchpadDir docs (deferred).
-            // [848] remote lanes' counterpart: on e2b/k8s/local-docker/ssh the withRemoteScratchpad-decorated
-            // factory `mkdir -p`s exactly this path on the env's first exec, so advertising it is honest — with
-            // the one best-effort caveat (a failed mkdir leaves the advertised path absent; see the decorator
-            // header). Mutually exclusive with the host-lane fact above by construction (hostSemanticsLane owns
-            // scratchpadDir; this branch is remote lanes only), and it applies the decorator's OWN validity rule
-            // (remoteScratchpadDirFor: absent/unsafe sessionId ⇒ no decoration ⇒ no fact). adb stays factless.
             const remoteScratchpadDir = !hostSemanticsLane && isRemoteScratchpadLane(config.remoteExec?.provider)
                 ? remoteScratchpadDirFor(auth?.sessionId)
                 : undefined;
@@ -1258,36 +522,17 @@ export function createResolveSpec(ctx) {
                 ...(pkgSourceLane ? { pkgSource: config.sandboxPkgSource } : {}),
                 egress: egressForRemoteExec(config.remoteExec),
                 ...(factScratchpadDir ? { scratchpadDir: factScratchpadDir } : {}),
-                // [1467]②(core 1.360)durable resume 铸句真值:按车道能力面,单真源 resumeFactsForLane
-                // (e2b=双 preserved/k8s=按 s3Snapshot 有效能力分叉/ssh·adb·host=scratch preserved/
-                // local-docker=不声明)。
                 resumeFacts: resumeFactsForLane(config.remoteExec?.provider, config.remoteExec?.provider === "k8s" ? { k8sSnapshot: Boolean(config.remoteExec.s3Snapshot) } : undefined),
             });
             if (facts)
                 governed = { ...governed, envFacts: facts };
         }
-        // [1339] scratchpad 写门失效真因:提示词(envFacts.scratchpadDir)和 policy 层豁免(exemptDirs)都
-        // 接了,但 core fs 工具的**根围栏**(resolveKey:taskRootPath+additionalDirectories)在 policy 之前
-        // 短路——Write/Edit 到 scratchpad 直接 path_not_in_root,exemptDirs 根本没被问到(Bash 无根围栏,
-        // 反而能写=口径矛盾还教模型绕门)。修:host 车道把同一 scratchpadDir 折进 spec.additionalDirectories
-        // (server 自算的 per-session 路径,非租户输入,不走 cwdHonored 门限;compute 时已 mkdir,core 的
-        // canonicalPath 必过)。remote 车道暂不折:in-sandbox 路径由 [848] 装饰器首 exec 才 mkdir,prepare 期
-        // canonicalize 会失败被 core 静默跳过——那半场随 core 排序案另行。
-        // codex R3(M2):**独立于 envFactsEnabled 门**——SANDBOX_ENV_FACTS=false 只关事实展示,写门围栏
-        // 豁免是行为契约,关展示不得顺带关围栏(否则该配置下 [1339] 原病复发)。
         if (scratchpadDir !== undefined) {
             const dirs = governed.additionalDirectories ?? [];
             if (!dirs.includes(scratchpadDir))
                 governed = { ...governed, additionalDirectories: [...dirs, scratchpadDir] };
         }
-        // A value router (S1 verdict §6.3 cash-out, src/router/route-orchestration.ts): auto-decide this task's
-        // orchestration. CONSERVATIVE + DETERMINISTIC — default single; escalate to the SUP prevention posture only
-        // on a capability-danger signal (write/exec on a NON-isolated env — an isolated sandbox CONTAINS the harm,
-        // so isolated tasks stay single, matching the verdict's default). caller-explicit team (council/debate/team)
-        // is honored, never auto-produced. Flag-gated (ROUTER_ENABLED) — ships dark, enable after live validation.
         if (config.routerEnabled) {
-            // Resolve isolation from provider AND runtimeClass — a k8s worker on plain runc is NOT VM-isolated
-            // (review HIGH); fail-closed for runc/empty/unknown.
             const isolatedExecEnv = isIsolatedExecEnv(config.remoteExec?.provider, config.remoteExec?.provider === "k8s" ? config.remoteExec.runtimeClass : undefined);
             const decision = routeServiceTask({
                 isolatedExecEnv,
@@ -1297,10 +542,6 @@ export function createResolveSpec(ctx) {
             });
             logger.info("orchestration_routed", { mode: decision.mode, reason: decision.reason, sessionId: auth?.sessionId ?? null });
             if (decision.mode === "supervisor") {
-                // SUP prevention posture: gate every bash (shellGate:"always") AND the direct write hand tools
-                // (edit_file/write_file via toolPolicy) — the verdict's gate-deny on capability-danger. tighten-only
-                // (composes with the governance/approval baseline; never loosens). The worker's existing approval
-                // machinery (durable/poll) enforces the suspend — same precondition as autonomy "ask".
                 return tightenTaskSpec(governed, supPostureOverrides());
             }
         }