@sema-agent/server 7.43.0 → 7.44.0

package/dist/boot/runner-deps.js

@@ -1,14 +1,3 @@
-/**
- * design/158 A10:composition root 分段 —— `RunnerDeps` 装配(含 self-orchestration 成组段)。
- *
- * 纯搬运:两个字面量逐字来自 `main.ts`(原 1579-1881 行),缩进不变(顶层键仍在 4 空格,
- * `deps-literal-shape-gate` 的顶层条件展开门覆盖面不变);新增的只有 import 与包壳。
- *
- * ⚠️ **位置即契约**:必须晚于 stores/exec-env/coordinators/workflow 段(所有键都是它们的产物),
- * 且早于 `new Runner(runnerDeps)` —— Runner 构造会冻结 tier 展开后的私有目录副本
- * (`runnerTierFrozen` 判据就取自构造那一刻的 `config.tiers`)。
- * `getRunStore()` 是唯一的晚绑取值(runStore 在本段之后才构造),原文靠同作用域前向引用。
- */
 import { createFileWorkflowScriptStore } from "@sema-agent/core";
 import { join } from "node:path";
 import { listCollabWorkflows, resolveCollabWorkflow } from "../capabilities/collab-workflows.js";
@@ -17,7 +6,7 @@ import { createHardenedVmRunner } from "../orchestration/hardened-vm-runner.js";
 import { createWorkerHardenedVmRunner } from "../orchestration/hardened-vm-worker-runner.js";
 import { WorkflowAgentRegistry } from "../orchestration/workflow-agent-steer.js";
 import { resolveServedSession } from "../orchestration/workflow-completion-inbox.js";
-import { defaultEngineNoticeRouter } from "../trace/engine-notice-wire.js"; // #310:通告分流器的 wire 终点
+import { defaultEngineNoticeRouter } from "../trace/engine-notice-wire.js";
 import { WorkflowNotifyGate } from "../orchestration/workflow-notify-journal.js";
 import { makeLoadProjectMemory, makeProbeInstructionSources } from "../project-memory.js";
 import { workflowModelAllowlistFor } from "../task-workflow.js";
@@ -26,216 +15,68 @@ export function createRunnerDepsOnAsk(toolApproval) {
         return undefined;
     return (req, signal) => toolApproval.ask(req, signal);
 }
-/**
- * core `EngineNotice` → 结构化 `engine_notice` 行的**唯一**转发体(#240②)。
- *
- * 🔴 为什么是具名导出而不是就地闭包(合并码重扫):这一席此前只落在共享基座里,于是 leader 车道
- * (`src/leader/wire.ts` 自拼 deps 的五处 `new Runner({...})`)一处都没有 —— core 的契约是「接线 ⇒ 走
- * sink,缺席 ⇒ 逐字打 `console.warn`」,所以缺席不是静默而是**同一部署两条通告通道**:主车道进结构化
- * JSON 行,leader 车道落裸 stderr,按 code 采集(`tool_result.offload_put_failed` 等)的运维面漏掉后者。
- * 两处各写一份转发体必漂(键名/字段集),故收成一个函数;入参取**结构形** logger(leader 的 cfg 只带
- * 可选 `warn`/`info` 两格,不是全形 `Logger`)。
- *
- * 🔴 `warn` 是**必填**(codex 复审第一轮,验真后修):可选链 `logger.warn?.(…)` 形在「只装了 `info` 的
- * logger」上会把通告**吞掉** —— 比不接线还坏(不接线时 core 至少还打它自己的 `console.warn`)。所以
- * 「有没有 warn」这个判断留在**装配点**:没有就别铸这一席,让 core 的响亮权留在原处。
- *
- * ## #310:双终点分流器(设计稿 = 黑板 [4630])
- * 本体自 #310 起是**分流器**,两个终点:
- *  1. **日志(全族,逐字保留)** —— 上面那段契约一个字节不变:任何 code、detail 原样、缺 detail 不铸键。
- *     运维观察面零回退是本腿的硬前提(wire 半场是**增量**,不是搬家)。
- *  2. **wire(白名单 + sessionId 路由)** —— `router.route(notice)`:码在
- *     {@link import("../trace/engine-notice-wire.js").ENGINE_NOTICE_WIRE_CODES} 内**且** `detail.sessionId`
- *     在场时,投给那条会话的 run 腿(SSE + durable 账本);否则一帧不出。判据整条住在
- *     `src/trace/engine-notice-wire.ts`(白名单/归属/消毒/隔离四件同源),这里只负责**先日志后分流**的次序。
- *
- * 🔴 次序是承重的:日志在前 ⇒ 即便 wire 半场整条坏掉(路由抛、口抛),事实仍然完整落在运维面。
- * 反过来写就是「wire 故障吃掉运维日志」,那正是本仓 #157 纪律要根除的形。route 自身按 sink 隔离 +
- * F 类留痕(`server.engine-notice.wire-sink-threw`),不向 core 回抛。
- *
- * 🔴 `router` **有默认值**(进程单例)而不是必填:这一席有五个以上装配点(共享基座 / leader 车道四处 /
- * 未来任何新车道),必填会让"新车道忘了传 router"变成**静默半聋**(日志有、wire 无)——与本函数当初
- * 被抽成具名导出的理由逐字同一个。测试要隔离时显式传自己 new 的实例。
- */
 export function createEngineNoticeForwarder(logger, router = defaultEngineNoticeRouter) {
     return (notice) => {
         logger.warn("engine_notice", { code: notice.code, message: notice.message, ...(notice.detail !== undefined ? { detail: notice.detail } : {}) });
         router.route(notice);
     };
 }
-/**
- * `onNotice` **席**的装配判据本身 —— 「`warn` 真在场才铸席」这一条从此是**一个可直接调用的函数**,
- * 不是散在装配点、只能靠扫源码文本去猜的一行三元(codex 对抗复审 R1-[medium],验真后修)。
- *
- * 病(实测):把 leader 的门写成 `cfg.logger ? ((m, x) => cfg.logger?.warn?.(m, x)) : undefined` 时,
- * 「装配点切片里出现过 `warn` 这个词」这类**源码文本**判据一律照绿 —— 而只装了 `info` 的部署会拿到一个
- * truthy 闭包、照样铸席,通告随后被可选链**静默吞掉**,比不铸席更坏(不铸时 core 至少还打它自己的
- * `console.warn`,响亮权留在原处)。任何「在这段文本里找关键字」的门都挡不住这一族变异,因为病灶在
- * **值**(闭包 truthy)而不在字面。⇒ 把判据搬进函数,让它可以被**行为**测:info-only ⇒ 空席;带 warn ⇒
- * 具名转发体。
- *
- * 命名(CLAUDE.md 工厂律):返回的袋子里装的是**活闭包**(有行为)⇒ `create*`,不是 `build*`。
- * 返回**展开形**(`{}` 或 `{ onNotice }`)而不是 `onNotice: undefined`。理由是**键卫生**,不是 core 行为
- * (R3 复扫更正:core 5.28 的 `deliverEngineNotice` 只判 `typeof onNotice === "function"`,显式 `undefined`
- * 与键缺席在 core 那侧行为逐字相同、响亮权都留在 core——旧句「显式 undefined 也算 host 接管」与真码相反):
- * 展开形让 `new Runner({...seat})` 的键集只随真装配变化,EXPECTED_SHARED_KEYS 类的键集绊线才数得准。
- */
 export function createEngineNoticeSeat(logger, router = defaultEngineNoticeRouter) {
     const warn = logger?.warn?.bind(logger);
     return warn ? { onNotice: createEngineNoticeForwarder({ warn }, router) } : {};
 }
-// #289(core 5.43.0 #316 观测席,[4448] 表态② 的评估结论,如实登记):`onSecretEnvScrub` 席在 server
-// 侧**无真挂点**——host lane 的执行 env(真跑用户 Bash 的那只)由 core 引擎自建,server 构造的三只
-// NodeExecutionEnv(resolve-spec 裁决 env / parked-revive-gate 裁决 env / run-local 治理探测 env)都不
-// 执行用户 Bash,挂席=假遥测面。终态=core 的 once-per-process console 摘要腿(5.43 起自带,响亮权在
-// core);若未来 core 给 RunnerDeps 开执行 env 构造参透传席,再按表态制接(上游件,不在此仓旁路)。
 export function createSharedRunnerDeps(ctx) {
-    // 具名带类型的字面量(非裸 return)——deps-literal-shape-gate 的 POINTS 按 `const X: T = {` 咬装配
-    // 字面量,裸 return 形在它的覆盖外(复审 2026-07-30 F5):conditional-spread 病在这里就会失检。
     const shared = {
         brain: ctx.brain,
-        // core 5.28.0 EngineNotice 席(#240②,^5.28.0 floor 的编译锚之一):结构化运维通告——function 席
-        // **替换** console.warn 行(core 契约:host 接管即拥有响亮权,不双发),故必须真转发不吞。
-        // 🔴 转发体是**全族开放**的:按 `notice.code` 原样落 `logger.warn`,detail 逐字透传,不认词表、
-        // 不挑族 —— 族表的单一真源是 core 的 `EngineNotice.code` doc(`dist/core/types.d.ts` 的
-        // "Current families"),**不在本注里复述**。A-057.25:此处原写死「三族(config.env_timeout_discarded /
-        // config.materialize_env_discarded / tool_result.offload_put_failed)」,那是 5.28.0 当拍的快照,
-        // 5.29→5.45 六个提货代际零回填后已脱节 3/13(5.45.0 新增的三条 `memory.*` 就在漏的那半里)——
-        // 一张会漂的孪生词表比没有词表更坏:它会让下一个读它的人以为遥测面只需覆盖那三个码。
-        // 共享基座=两 Runner(main/sub)同源同席([1543] 纪律)。
         onNotice: createEngineNoticeForwarder(ctx.logger),
-        // core 1.265: the active tier table (tier words + CC aliases → catalog keys, expandTiers at Runner
-        // construction; empty = INERT by core contract). Same mutateInPlace reference applyEffective fills — a
-        // refresh-time tier change is restart-to-apply, same tier as models.
         tiers: ctx.config.tiers,
         models: ctx.config.models,
         roles: ctx.config.roles,
         pricing: ctx.pricing,
         tracer: ctx.tracer,
-        // e/b([985]):center catalog 轴的 core 消费面——candidate/pinned-digest 解析走这里(prepare-task
-        // dist:session_start 优先 candidate、resume 按 digest 解析、miss=fail-loud prompt_snapshot_unavailable)。
         promptSource: ctx.promptSource,
-        // #246(core 5.30.0):readFace/readDenyPatterns 部署座席——READ 容纳姿态是部署级承重面,主/子
-        // Runner 必须同源同席([1543] 纪律,与 onNotice 同理);缺席=undefined=core 引擎默认(roots+内建表)。
         readFace: ctx.config.readFace ? ctx.config.readFace : undefined,
         readDenyPatterns: ctx.config.readDenyPatterns ? ctx.config.readDenyPatterns : undefined,
-        // #253 件 G5(core 5.33.0 #245,clay 裁定件):**内建** deny 表的档位/删行两座席——与上面两键同席
-        // 同源(主/子 Runner 必须同姿态)。缺席=undefined=core 自默认档位(除 shell-history 外全开)。
-        // 🔴 `?? undefined` 而不是真值判:`readDenyBuiltinTiers: []` 是**显式的空姿态**(env 写 `none`),
-        // 真值判会把它折回「缺席=默认全开」——正好把运维显式关掉的档位偷偷开回去。
         readDenyBuiltinTiers: ctx.config.readDenyBuiltinTiers ?? undefined,
         readDenyBuiltinExclude: ctx.config.readDenyBuiltinExclude ?? undefined,
-        // #299(core 5.45.0 design/324 #324①):委派臂的证据标准 —— 与上面四席同族的**部署座席**,同样必须
-        // **主 runner / subRunner / run-local 三族**同源(本基座的射程,`run-local.test.ts` 的 SHARED_KEYS
-        // 编译期闭包 + `boot-runner-deps-shared-base.test.ts` 的键集绊线各钉一半)。core 明写「每个 run 读
-        // **准备它的那只 Runner** 的 deps」⇒ 漏挂 subRunner 不是「子代少个旋钮」,而是委派子代按**另一套**
-        // 证据标准判自己的污染臂(运维选的 attested-only 对它不生效),正是 [1543]§三族A 那个事故族的形。
-        // ⚠️ **leader lane 不在本基座射程**(如实登记,既有族级缺口非本席引入):`src/leader/wire.ts` 的
-        // Runner 是独立字面量,上面四席同样到不了那里;今日影响结构性为零(leader 不挂记忆后端,core 的
-        // 铸点要求污染面在场)。边界钉 = `test/memory-delegation-evidence-lane.test.ts` 的 ⑤ 组。
-        // 缺席=undefined=core 自缺省(`static-face`)。
         memoryDelegationEvidence: ctx.config.memoryDelegationEvidence ?? undefined,
-        // #307 件4(core 5.46.0 design/336 §13-3):provenance 总开关 —— 与上一席**同族同姿态**的部署座席。
-        // 同样必须三族(主 runner / subRunner / run-local)同源:core「每个 run 读准备它的那只 Runner 的
-        // deps」⇒ 漏挂 subRunner = 委派子代按另一套 provenance 写记忆(部署声称「暴露会话零收录」而子代
-        // 照收)。leader lane 的族级缺口同上一席,边界钉在 `memory-delegation-evidence-lane.test.ts` ⑤ 组
-        // 的 DEPLOYMENT_SEATS 名单里(本席已入册)。缺席=undefined=core 自缺省(`carry`)。
         memoryProvenance: ctx.config.memoryProvenance ?? undefined,
-        // debt #322-B(core 5.48 C18):委派入口 caps ——上两席同族的部署座席,三族(主/sub/run-local)
-        // 同源经本基座;缺席=undefined=core 自缺省(CC parity 20/200)。坏值双门:env 解析 numEnvBounded
-        // 启动期拒,pair 合法性(concurrent ≤ cumulative)core prepare `config.delegation_entry_caps` 拒。
         delegationEntryCaps: ctx.config.delegationEntryCaps ?? undefined,
         executionEnvFactory: ctx.executionEnvFactory ? ctx.executionEnvFactory : undefined,
         lspManager: ctx.lspManager ? ctx.lspManager : undefined,
-        // core 1.364 durable bg agents 读半场(写半场=scenarioDeps.backgroundAgentStore 同实例,组装区注释)。
         backgroundAgentStore: ctx.backgroundAgentStore ? ctx.backgroundAgentStore : undefined,
-        // S3c tier-3 懒复活(core 1.374):SendMessage 链内消费,与 backgroundAgentStore 同实例配套挂载。
         mailboxStore: ctx.mailboxStore ? ctx.mailboxStore : undefined,
-        // [1070]① agent-team S1:持久名册 seam(具名 spawn advisory 写入;SendMessage 活注册表 miss 后咨询)。
         rosterStore: ctx.rosterStore ? ctx.rosterStore : undefined,
         hooks: ctx.deploymentHooks,
-        // 交接件⑤:署名座进基座 ⇒ 主/sub 两只 Runner 自动同源(理由见 RunnerDepsCtx.hands 的注)。
         hands: ctx.hands,
         toolResultStore: ctx.toolResultStore,
-        // E6: operator-tightened session tool rules — core folds them into the ToolPolicy FIRST (subtract-only) for tasks
-        // carrying a sessionId (a delegated subagent has none → inherits no rules). Opt-in: undefined ⇒ no rules read.
         sessionPolicyStore: ctx.sessionPolicyStore ? ctx.sessionPolicyStore : undefined,
-        // design/170 件A:org 记忆准入两 seam(core 5.13.0)。共享基座=主/sub 同源(委托子代 prepare 的
-        // 委托冻结重判腿同样过目录);resolver 缺席=core 对 request-origin org 铸 admission_required
-        // fail-closed,deployment 自证集空=键缺席(诚实缺席>空数组——core 按 Set 语义消费,空集与缺席
-        // 同义,但缺席让 deps 字面量不携带死键)。
         memoryScopeAdmission: ctx.orgMemoryAdmission.memoryScopeAdmission ? ctx.orgMemoryAdmission.memoryScopeAdmission : undefined,
         deploymentMemoryScopes: ctx.orgMemoryAdmission.deploymentMemoryScopes && ctx.orgMemoryAdmission.deploymentMemoryScopes.length > 0 ? ctx.orgMemoryAdmission.deploymentMemoryScopes : undefined,
-        // design/166-T1:治理窗两键**成对**且进共享基座——主/sub/hook 三 runner 全覆盖(漏挂 subRunner=
-        // 子代用量不进窗,治理可被 subagent 刷穿;双记不存在:core stats.nested 是旁路侧栏不折入
-        // stats.tokens,governance.commit 是 per-任务 delta 制)。store 只在 config.usageWindows 配置时
-        // 构造(boot/stores.ts),两键同真同假。
         usageWindows: ctx.config.usageWindows ? ctx.config.usageWindows : undefined,
         usageWindowStore: ctx.usageWindowStore ? ctx.usageWindowStore : undefined,
-        // design/177 —— 必须进**共享基座**(codex 复审轮3 真缺口):它原先只挂在主 runnerDeps 上,于是
-        // 委托子代静默没有 memory_list/memory_read,而能力面与 HTTP 面照样宣布共享库可用 —— 正是 [1543]§三族A
-        // 「主 runner 挂了、subRunner 漏挂」那个病族。授权按 per-request principal 折叠(子代同宿主身份),
-        // 所以共享同一个 provider 实例既正确又是唯一能让两只 Runner 看到同一份库集合的做法。
         sharedMemoryStores: ctx.sharedMemoryStores ? ctx.sharedMemoryStores : undefined,
-        // design/170 件B/C/D(#252 件1)—— 三个部署治理座席,同样必须进**共享基座**:合规档位的判决沿委托
-        // 树继承(core 按 principal 冻结一次),而委托子代在本仓跑在**另一只 Runner** 上 —— 那只 Runner 不
-        // 挂 resolver 就等于子代平面没有档位;`lockedConfig` 同理(§4.2 明写「覆盖 resume / refresh / 子代
-        // 构造三条路径」)。三键的缺席形都是 undefined = core 契约的「无限制/无锁/无策略」,诚实缺席。
         compliancePostureResolver: ctx.governanceSeams.compliancePostureResolver,
         lockedConfig: ctx.governanceSeams.lockedConfig,
         retentionPolicy: ctx.governanceSeams.retentionPolicy,
-        // #324(core 5.50 design/338):撤销台账席进**共享基座** —— core 每次 MCP dispatch 前探
-        // isRevoked,委托子代跑在另一只 Runner 上,漏挂 subRunner = 子代平面绕过撤销([1543]§三族A 形,
-        // 且这条轴的绕过方向是 fail-OPEN:被中心撤掉的服务器在子代腿继续可调)。leader lane 零 MCP mount
-        // (`src/leader/wire.ts` 无 MCP 面)⇒ 席不达 leader 结构性零影响(memoryDelegationEvidence 同款登记)。
-        // 缺席=undefined=pre-338 语义(纯 env 部署,restart-signal 的删除向豁免也不生效——同一动作绑定)。
         mcpRevocations: ctx.mcpRevocations ? ctx.mcpRevocations : undefined,
     };
     return shared;
 }
 export function createRunnerDeps(ctx) {
     const { config, logger, metrics, localRoot, outcomeSink, elicitation, question, toolApproval, sessionStore, memoryEngine, memorySyncRunner, runtimeCapsResolver, fileSnapshotStore, permissionRuleStore, fleetBus, workflowRunStore, workflowJournalStore, workflowAgentRegistry, workflowNotifyGate, workflowCompletionInbox, deliverWorkflowCompletion, getRunStore, } = ctx;
-    // design/158 A10 留档发现②:共享基座——见 createSharedRunnerDeps 头注(main.ts 的第二处展开是
-    // 并行车道待办,未在本次改动内接线)。
     const sharedRunnerDeps = createSharedRunnerDeps(ctx);
-    // S8 (design/98) + SVC-1: mount core's `run_workflow` under the hardened-vm sandbox when
-    // enabled (default OFF → core fail-closed, tool not mounted, zero impact). The tool STARTS a workflow and
-    // returns its runId IMMEDIATELY (the background-run half — the caller never blocks); the workflow runs to
-    // terminal in the background and fires core's in-process completion notify. Workflow-spawned children inherit
-    // a CONSERVATIVE baseline (handsReadOnly — read-only by default; loosen deliberately); the script may pick
-    // ONLY allow-listed model names (empty ⇒ it cannot pick → the workflow's default role).
-    //
-    // design/158 S4:三处装配点里**唯一**一组多键条件段 —— 提成带类型标注的中间 const 再整体展开进
-    // runnerDeps。标注位 `Pick<RunnerDeps, …>` 本身触发 TS 多余属性检查(键名写错 / 键根本不属于
-    // RunnerDeps ⇒ 编译期红),所以这不是把旁路挪个地方;组内可选键一律写成显式
-    // `k: cond ? expr : undefined`,不再用 `...(cond ? { k } : {})`。
     const workflowModelAllowlist = workflowModelAllowlistFor(config);
     const selfOrchestrationDeps = config.selfOrchestrationEnabled
         ? {
-            // worker_thread isolation (heap cap + terminate) when opted in (multi-tenant DoS hardening), else
-            // the faster in-process runner. Both run the same conformance-validated + probe-hardened membrane.
             workflowScriptRunner: config.selfOrchestrationWorkerIsolation
                 ? createWorkerHardenedVmRunner()
                 : createHardenedVmRunner(),
             workflowRunStore: workflowRunStore ? workflowRunStore : undefined,
-            // SVC-2 (CORE-9 Part A): durable resume journal — core auto-wires it into the tool's startWorkflow, the
-            // `resumeFromRunId` tool input then replays the unchanged prefix (cross-replica when tidb/pg-backed). The
-            // store enforces scope in its WHERE (CORE-9 audit BLOCKER: a cross-tenant resumeFromRunId → empty → live).
             workflowJournalStore: workflowJournalStore ? workflowJournalStore : undefined,
-            // 切片 1.5 / design/140 §6: the named-workflow registry seam — a COMPOSITE store.
-            // persist/load = core's file store under `<localDataRoot>/workflow-scripts` (the CC scriptPath-iterate
-            // face: every invocation's script lands on disk, the model edits + re-invokes with {scriptPath};
-            // containment is the file store's contract). resolveName consults the collab projection FIRST (center
-            // collab templates as `{TEAM_DISCUSSION_SCRIPT, defaultArgs}` entries; a collab id equal to a built-in
-            // name SHADOWS it — §6 1c) and falls back to the file store's `<name>.js` face (an operator-saved
-            // script is a named workflow too). list() = collab entries only (the file store deliberately doesn't
-            // enumerate — its dir mixes per-run scripts with saved names, core contract note); sync, so the
-            // entries reach the statically-built Workflow tool card.
             workflowScriptStore: (() => {
                 const fileStore = createFileWorkflowScriptStore(join(config.localDataRoot ?? localRoot, "workflow-scripts"));
                 return {
-                    // core 1.366 (B-4) scope 分区一致性标:persist/load 直转 core file 实现(per-scope 子目录,
-                    // 真分区)——标是诚实声明;缺标=core 工具读侧拒/写侧跳(编译期必填字面量即为此设计)。
                     scopePartitioned: true,
                     persist: fileStore.persist.bind(fileStore),
                     load: fileStore.load.bind(fileStore),
@@ -243,66 +84,29 @@ export function createRunnerDeps(ctx) {
                     list: () => listCollabWorkflows(),
                 };
             })(),
-            // SVC-5 (CORE-9 Part B): the opt-in steer handle-sink. When set, the tool's `agent()` runs STEERABLE and
-            // emits the live handle HERE (never into the script/runner — the host-context membrane stays closed). We
-            // register it by runId+label so POST /v1/workflows/:id/agents/:label/steer can route a steer to it, and
-            // unregister when the agent settles (result() settles on stream completion; a stale handle would only
-            // 409 `steering.not_running` anyway — this just bounds the map). A steered agent is NOT journaled (CORE-9.1
-            // limitation: its resume re-runs live), which is correct + documented.
             onWorkflowAgentSpawn: workflowAgentRegistry
                 ? (handle) => {
                     const unregister = workflowAgentRegistry.register(handle);
                     void Promise.resolve(handle.result()).then(unregister, unregister);
                 }
                 : undefined,
-            // workflowSizeGuideline: advisory size guidance injected into the
-            // Workflow tool card (core Wvs, CC 206 verbatim). Absent/unrestricted = byte-compat card.
             workflowLimits: config.workflowSizeGuideline ? { sizeGuideline: config.workflowSizeGuideline } : undefined,
             workflowGovernanceBaseline: {
-                // [824]① clay 拍 A 案(workflow 权限全面 CC parity):默认基线撤 handsReadOnly 钳 —— 主 LLM 与
-                // 子 agent 同 root 同信任域,主 LLM 本就能写这棵树([816] ask 门照管),单独钳子 agent 的安全增益≈0
-                // (只防绕路不防直路的门不是边界);实测产品代价=[814]A 死锁(写型 workflow agent 永远只读)。并发
-                // 写互踩按 CC 同姿用建议解决(worktree 契约话术+design/111 advisory),不用强制钳。要保守的 TOB
-                // 部署自己开 WORKFLOW_AGENTS_READONLY=true(config.workflowAgentsReadOnly)加回旧钳。
                 base: config.workflowAgentsReadOnly ? { handsReadOnly: true } : {},
-                // [824]②/[826]-core 1.291 worktree seam(TOB 旋钮回归腿):旋钮开启时 worktreeBase 配成
-                // overlay 形状 —— core 对 `agent({isolation:"worktree"})` 做 base 浅合并(非整体替换,
-                // workflow-primitives effectiveBaseline:{...base,...worktreeBase}),{handsReadOnly:false} 语义=
-                // 「只放写,其余基线全保留」。效果:保守部署里非隔离子 agent 仍只读,进了自有 worktree 的
-                // agent 恢复可写([814]A 写型 workflow 在 TOB 形态下不死锁)。A 案默认(旋钮 off)不配 worktreeBase。
                 worktreeBase: config.workflowAgentsReadOnly ? { handsReadOnly: false } : undefined,
-                // Model allowlist for the script's `agent({model})` picks: explicit
-                // SELF_ORCHESTRATION_MODELS wins; single-user defaults to the deployment's own catalog; multi-tenant
-                // keeps core's fail-closed empty default. Decision + rationale in workflowModelAllowlistFor.
                 workflowModelAllowlist: workflowModelAllowlist ? workflowModelAllowlist : undefined,
             },
-            // SVC-1 at-least-once notify: route core's terminal notify THROUGH the gate (deliver-then-ack +
-            // journal dedup) instead of straight to log/meter, so a crash mid-delivery re-delivers on the next boot
-            // recovery sweep. When the gate is absent (memory backend / no journal) fall back to the bare
-            // log+meter delivery (at-most-once, the prior behavior — honest about the lost-on-crash window).
             workflowCompletionNotifier: {
-                // ⚠️ design/158 S4 有意保留的展开:两臂**都非空**(要么 gate 造的 notifier,要么裸 notify 兜底),
-                // 不是「条件键」形——它合并的是同一必填键 `notify` 的两个来源,两来源都有类型,不构成
-                // 多余属性检查旁路(缺 notify 反而当场编译红)。
                 ...(workflowNotifyGate
                     ? workflowNotifyGate.buildNotifier()
                     : { notify: (input) => deliverWorkflowCompletion(input) }),
-                // core 1.232 (the CORE half of the poll-then-also-notify dedup): pollWorkflow fires this
-                // ONCE when the ORIGINATING session polls the run to a real terminal (timeout/cross-session polls
-                // don't) — drop that (session, runId)'s pending inbox entry + arm the served fence, so the push
-                // that would duplicate what the model just read is dead even across a shell restart. Session
-                // attribution mirrors resolveCompletionRoute's session half (payload id, else the run row).
                 ackServed: async (input) => {
                     if (!workflowCompletionInbox)
                         return;
                     try {
-                        const sid = await resolveServedSession(input, getRunStore() ? (id) => getRunStore().getRun(id) : undefined); // A10 搬运改写:晚绑取值
+                        const sid = await resolveServedSession(input, getRunStore() ? (id) => getRunStore().getRun(id) : undefined);
                         if (sid) {
                             await workflowCompletionInbox.markTerminalServed(sid, input.runId);
-                            // The THIRD way an inbox entry disappears (besides the three stream-open drains
-                            // and the owner-mismatch drop) — the model itself polled the run to terminal, so the push is
-                            // suppressed. An "enqueue → ack within ms, but the shell showed nothing" report with THIS line
-                            // means the completion went to the MODEL in-process (core injected it), not onto any stream.
                             logger.info("workflow_complete_ack_served", { route: "poll-served", sessionId: sid, runId: input.runId });
                         }
                     }
@@ -314,44 +118,16 @@ export function createRunnerDeps(ctx) {
         }
         : {};
     const runnerDeps = {
-        // design/158 A10 留档发现②:brain/models/roles/tiers/pricing/tracer/promptSource/
-        // executionEnvFactory/lspManager/backgroundAgentStore/mailboxStore/rosterStore/hooks/
-        // toolResultStore/sessionPolicyStore —— 共享基座展开,见 createSharedRunnerDeps 头注
-        // (含每键各自的历史 rationale 注释,搬到了那个函数里,不在此重复)。
         ...sharedRunnerDeps,
-        // 交接件⑤:`hands` 已随共享基座展开(`...sharedRunnerDeps`)—— 这里**不再**手写同名键,
-        // 否则它会 override 展开、把 subRunner 重新甩开(本文件头注写死的那条:「不要再在任一调用点
-        // 手写同名键」)。判据([931]① branded 才署名)搬到了唯一的取值点 main.ts 的 `commitHands`。
-        // design/73 §1 (core 1.226 seam, clay 拍 2026-07-04 接): consume mechanical TaskOutcome facts into the
-        // outcome ledger — tidb/pg = SQL rows (coreOutcomeToLedgerRow mapping + verbatim `core_outcome` JSON so
-        // red-line ② oracleHadRedRun survives lossless), local = owner-only JSONL. Read-only v1: records facts,
-        // drives NO policy (§7.4 backtest gate stands). Fire-and-forget — a sink failure logs and never touches
-        // the run (core's emitTaskOutcome swallow-guards too). Emitters today: core runGoal terminal + any
-        // harness with a REAL mechanical oracle calling runner.emitTaskOutcome; plain runTask never auto-emits.
         onTaskOutcome: outcomeSink
             ? (o) => {
                 metrics.inc("task_outcomes_total", { status: o.status, green: String(o.oracle?.green ?? "unknown") });
                 void outcomeSink.recordCore(o).catch((err) => logger.warn("task_outcome_record_failed", { runId: o.runId, err: String(err) }));
             }
             : undefined,
-        // E23: the live-only inbound-elicitation seam. core invokes it only for servers that opted in via
-        // McpServerSpec.elicitation (default OFF) AND only when this is wired — both must hold (doubly fail-closed).
         onElicit: elicitation ? elicitation.elicit : undefined,
-        // §4④: the live AskUserQuestion seam. core mounts the tool when onQuestion is present + routes each ask here.
-        // #152([2703] 案二): with the coordinator wired the durable leg NO LONGER stamps spec.onQuestion
-        // (QUESTION_AWAITS_RESUME) — park-vs-live is decided per-leg by resolve-spec's live-aware question policy
-        // (live-stream leg → this coordinator; no-live-context leg → durable park). The sentinel is stamped only
-        // when the coordinator is absent (ASK_QUESTION_ENABLED off).
         onQuestion: question ? question.question : undefined,
-        // live tool-approval 接缝 —— 语义与历史全部搬进 `createRunnerDepsOnAsk` 的头注(#168 件4:同一份
-        // 说明只留一处,不在装配点复述)。
         onAsk: createRunnerDepsOnAsk(toolApproval),
-        // [822]② auto permission mode, deployment half: RunnerDeps.autoMode is the operator TRUST face of core's
-        // auto-mode classifier (1.276/1.277) — wiring it alone arms NOTHING (core requires the per-principal entitlement
-        // runtimeCaps.autoMode === true from center, fail-closed dark by default; see runtime-caps-resolver.ts). With
-        // both present, core screens every policy `ask` through the classifier (allow safe / deny hostile / leave the
-        // rest on the ask path → this bridge or durable park). Defaults-only config (core's rules/window); breaker-open
-        // is surfaced for observability.
         autoMode: {
             onBreakerOpen: (info) => {
                 metrics.inc("auto_mode_breaker_open_total");
@@ -359,24 +135,8 @@ export function createRunnerDeps(ctx) {
             },
         },
         sessionStore,
-        // design/138 S1: the memory-engine switch — when present (single-user + engine on), core replaces the
-        // legacy memory path WHOLESALE per task (materialize → session file ops → harvest; no remember/recall
-        // tools). `memoryEngineDir` = the resolved config root (core derives the B3 control plane beside the
-        // memory dir). Absent (multi-tenant / MEMORY_ENGINE=off) ⇒ no deps.memoryBackend ⇒ memory dark.
         memoryBackend: memoryEngine ? memoryEngine.backend : undefined,
         memoryEngineDir: memoryEngine ? memoryEngine.root : undefined,
-        // (sharedMemoryStores 由共享基座展开携带 —— 主/sub 两只 Runner 同源,见 createSharedRunnerDeps。
-        //  它与 `memoryBackend` **正交且完全不桥接**:那条是本地记忆链(注入索引 + 文件投影 + harvest,
-        //  有写路径),这条是纯文档只读面,共享内容永不进注入块/索引、永不落模型可写盘、永不被 harvest。)
-        // S3-TOB 复审 F-9(operator 可观测底座):harvest 报告 → metrics(拒收/incident/patch 计数从此可见;
-        // core swallow-guard 保证 throwing consumer 不伤边界)。
-        // #231(core 5.27.0 提货,codex 复审 [medium] 验真后修):**拒收码进遥测**。此前本站点只读
-        // `ok`/`incident`/`patches` 三件,而受限会话(`memoryPersistenceCapable:false`)对磁盘分歧的处置
-        // 走的是 `report.inboundFindings`(`ok` 仍是 true、`incident` 缺席)⇒ core 承诺的「响亮点名」在
-        // 我方这一侧**一条日志一个计数都没有**:运维看不到本机上有多少字节因为受限而没被收编。逐 code
-        // 计数(词表是 core 的 `HarvestRejectionCode` 闭集,基数天然有界)+ 一条 warn。
-        // ⚠️ **不打路径**:记忆根下的文件名是用户内容(core 已把逐条 reason 通告给模型那一侧),运维面
-        // 只需要「哪一类、多少条」。计数用 `??` 兜住旧引擎缺席的两个数组(additive 字段,不是 fail-open 分支)。
         onMemoryHarvestReport: memoryEngine
             ? (report, info) => {
                 metrics.inc("memory_harvest_total", { ok: String(report.ok), phase: info.phase, incident: report.incident?.kind ?? "none" });
@@ -392,102 +152,51 @@ export function createRunnerDeps(ctx) {
                 if (byCode.size > 0) {
                     logger.warn("memory_harvest_rejections", {
                         phase: info.phase,
-                        // 逐 code 计数(排序固定,便于日志 diff);内容/路径一律不进这条线。
                         codes: [...byCode].sort(([a], [b]) => (a < b ? -1 : 1)).map(([code, count]) => `${code}=${count}`).join(","),
                     });
                 }
-                // 142-S2.5-W1: 成功 harvest 真有 patch 落地 = 本地记忆变了 ⇒ fire-and-forget 一轮同步
-                // (trigger 自带 inflight 节流:上一轮在飞则跳过,漏掉的变更下一轮全量补上)。
                 if (memorySyncRunner && report.ok && (report.patches?.add ?? 0) + (report.patches?.update ?? 0) > 0)
                     memorySyncRunner.trigger("harvest");
             }
             : undefined,
-        // (toolResultStore/sessionPolicyStore already carried by the shared-base spread above.)
-        // design/99 §K: per-principal runtime entitlements (allowWorkflows / forceDurableGate) resolved from center.
-        // Opt-in: undefined ⇒ NO per-principal restriction (tighten-only; deployment default governs). See above.
         runtimeCapsResolver: runtimeCapsResolver ? runtimeCapsResolver : undefined,
-        // E19: working-tree snapshot/restore for rewind (+ the 2c artifact store). core snapshots each completed turn +
-        // restores on resumeAt when spec.rewindFiles is set, for ANY env when this store is wired (gate-split 1.134.0).
         fileSnapshotStore: fileSnapshotStore ? fileSnapshotStore : undefined,
-        // #154 车二(core 5.18.0 design/179):持久化权限规则店 —— 引擎据它铸 `AskRequest.ruleSuggestions`
-        // 并把 `permissionRules.storeWired` 报成真。缺席=诚实缺席(零候选、storeWired:false),绝不占位。
         permissionRuleStore: permissionRuleStore ? permissionRuleStore : undefined,
-        // (executionEnvFactory/lspManager already carried by the shared-base spread above.)
-        // design/129-B (core 1.240.0): the PROCESS-LEVEL background-child observer — spawn/tick/terminal
-        // for every bg delegation child, never dying with a leg. Feeds the fleet rows (launch 即有行, session-scoped
-        // children stay visible past the turn — the 缺口① fix) + the bg_notification frame on the
-        // always-open fleet stream (缺口②: idle completion delivery is immediate). Wired once per process.
         onBackgroundChildEvent: fleetBackgroundChildPublisher(fleetBus, (msg, fields) => logger.info(msg, fields)),
-        // design/113 C4: inject CLAUDE.md + git narrative so a chat opens project-aware (like CC). The helper reads cwd via
-        // local fs/execFile — only meaningful when cwd is LOCAL (host/file lane); it stats the dir and returns null on a
-        // remote-sandbox cwd, so this is safe to wire generally, but we gate it to single-user (cwdHonored posture — the
-        // same lane where reading the local project for the caller isn't a confused-deputy hole) + the opt-out kill-switch.
         loadProjectMemory: config.requirePrincipal !== true && config.projectMemoryEnabled ? makeLoadProjectMemory({ logger }) : undefined,
-        // core 1.302 instructions-change lane (板 [952]②): re-fingerprint the declared instruction file each turn so a
-        // mid-run edit surfaces as a tail attachment. STRICTLY host lane — on a remote-sandbox lane the instruction file
-        // lives in the container; a local re-read would fingerprint the wrong tree, so the probe is not wired there.
         probeInstructionSources: config.remoteExec?.provider === "host" && config.requirePrincipal !== true && config.projectMemoryEnabled
             ? makeProbeInstructionSources()
             : undefined,
-        // (hooks already carried by the shared-base spread above.)
-        ...selfOrchestrationDeps, // S8 self-orchestration 全家桶(成组条件段;类型标注在上方 const)
-        // F8: surface best-effort compaction failures + the 1.22 prompt-cache low-hit warning (an
-        // unstable/poisoned prefix tanking cost) instead of silently swallowing them.
+        ...selfOrchestrationDeps,
         onError: (err, ctx) => {
-            // "degraded" (1.40) is an operational event, NOT a failure — the task still completes (on a cheaper
-            // model). Log it as a warning so it doesn't pollute error rates/alerts. The degraded_total metric
-            // comes from the tracer's task.degraded event.
             if (ctx.phase === "degraded") {
                 logger.warn("task_degraded", { sessionId: ctx.sessionId, info: String(err) });
                 return;
             }
-            // "prompt-constitution" (core 1.243): a stableSystem provider returned an ALREADY-
-            // assembled prompt (constitution anchor found); core passed it through un-doubled. The task is safe
-            // (guard un-doubles), but the provider is pre-1.243-shaped and should be upgraded to return only the
-            // role base. Warn — paired with the tracer's prompt_constitution_total{mode="provider-assembled"}.
             if (ctx.phase === "prompt-constitution") {
                 logger.warn("prompt_provider_needs_upgrade", { sessionId: ctx.sessionId, info: String(err) });
                 return;
             }
-            // "rewind" (E19 per-turn file snapshot): best-effort — a failed snapshot only makes that one turn
-            // non-rewindable; the task itself is unaffected. `too_large` is the EXPECTED shape on a big working
-            // tree (TOC user opening a 20G folder: enumerate hits the 256MB bound EVERY turn → an error-level
-            // line per turn reads like the run is broken). Downgrade to warn + count by code so a real store
-            // fault (enumerate_failed on a readable tree, blob-write errors) still stands out in the metric.
             if (ctx.phase === "rewind") {
                 const code = /\((\w+)\)/.exec(String(err))?.[1] ?? "unknown";
                 logger.warn("rewind_snapshot_failed", { sessionId: ctx.sessionId, code, info: String(err) });
                 metrics.inc("rewind_snapshot_failed_total", { code });
                 return;
             }
-            // "memory" (1.62, design/41): a best-effort post-task consolidation pass failed. The task already
-            // completed and its notes are safely appended (just not reconciled this round) — warn, fail-open,
-            // don't pollute error rates. (Consolidation cost still lands in model_cost_micro_usd via the tracer.)
             if (ctx.phase === "memory") {
                 logger.warn("memory_consolidation_failed", { sessionId: ctx.sessionId, info: String(err) });
                 return;
             }
-            // "mcp" (1.68): a broken MCP server was SKIPPED (fail-open) — the task still ran without
-            // that server's tools. Surface it as a warning + metric so a misconfigured server is observable, not silent.
             if (ctx.phase === "mcp") {
                 logger.warn("mcp_server_unavailable", { sessionId: ctx.sessionId, info: String(err) });
                 metrics.inc("mcp_server_unavailable_total");
                 return;
             }
-            // "a2a" (DESIGN-269 车1 件4):an unreachable A2A peer was SKIPPED (core's materialize is fail-open per
-            // peer, `MaterializedA2a.warnings`) — the task still ran with the healthy peers' tools. Same posture as
-            // the MCP arm one line up, and for the same reason: a配置错/临时不可达的 peer 必须**可观测**,但它
-            // 不是任务失败,落 error 级会把它混进真故障的告警面。⚠️ 这不是「静默兜底」:fail-open 的裁决属 core
-            // (它已经决定跳过并把原因交出来),server 这一格只负责让它说出来 + 计数。
             if (ctx.phase === "a2a") {
                 logger.warn("a2a_peer_unavailable", { sessionId: ctx.sessionId, info: String(err) });
                 metrics.inc("a2a_peer_unavailable_total");
                 return;
             }
-            // "prompt-cache" (1.22 low-hit + design/31 break detector): since core 1.89 the detector passes its
-            // root cause as ctx.classification — "server-or-ttl" is usually benign in agentic tasks (slow tools ⇒
-            // 5min+ request gaps expire provider caches) → warn; the prefix-bug causes
-            // (model-switch/tool-schema/tool-set/system-prefix) stay errors that warrant attention.
             if (ctx.phase === "prompt-cache") {
                 metrics.inc("prompt_cache_low_hit_total");
                 const fields = { sessionId: ctx.sessionId, ...(ctx.classification ? { classification: ctx.classification } : {}), err: String(err) };
@@ -497,9 +206,6 @@ export function createRunnerDeps(ctx) {
                     logger.error("prompt_cache_break", fields);
                 return;
             }
-            // "config" (core 1.300 [931]②): assembly-time advisories — e.g. toolPolicy 名单池审计
-            // (config.toolpolicy.unmatched_names:名单里写了实挂宇宙不存在的工具名=typo 探测,enforcement
-            // 不变)。观测性提示,warn+metric,不进 error 告警面。
             if (ctx.phase === "config") {
                 logger.warn("runner_config_advisory", { sessionId: ctx.sessionId, info: String(err) });
                 metrics.inc("runner_config_advisory_total");

package/dist/boot/runtime-caps.js

@@ -1,46 +1,11 @@
 import { applyObserverEnvOptIn, centerEntitlementSourceWired, createPrincipalEntitlementsClient, scopedTokenNeedsWorker } from "../runtime-caps-resolver.js";
 export function createRuntimeCaps(ctx) {
     const { config, logger } = ctx;
-    // design/99 §K (core 1.157 `RunnerDeps.runtimeCapsResolver`) — the ENFORCE last-link of the
-    // three-stage workflows gate. core calls it once per task at prepare time with `spec.principal`; we resolve the
-    // per-principal entitlement from center's `GET /api/config/effective?principal=` (cached + fail-closed). Wired
-    // ONLY when a center is configured AND not in dry-run: in dry-run the service pulls+logs but does NOT APPLY
-    // center config, so it must NOT ENFORCE center's per-principal caps either (enforcing would deny workflows = a
-    // real behavior change, contradicting observe-only). Absent ⇒ core sees `undefined` ⇒ no per-principal
-    // restriction (the deployment-level capability + toolPolicy gates still govern).
-    //
-    // 🔐 TRUST DEPENDENCY: the gate keys off `spec.principal` (= resolveSpec's `auth.principal`). F-fix (2026-07-01,
-    // core-steered; contract-compliance per core 1.187's hardened `TaskSpec.principal` doc — it MUST be the
-    // cryptographically VERIFIED identity, never a spoofable header): `auth.principal` now comes from
-    // `verifiedPrincipal` (security.ts). On a GATED door that's `principalFrom` (the BFF already verified the header;
-    // `gatedPrincipal === principalFrom` there); on a DIRECT door (`directDoorActive`) it's the verified
-    // `x-approval-principal-token` JWT `sub`, NEVER the spoofable header. So `spec.principal` is ALWAYS the verified
-    // identity — governance (this gate), cost, and isolation key off it safely on BOTH postures. The same verified
-    // identity also fans out to the non-authorizer owner/cost sites that don't run createAuthorizer
-    // (runOwnerOk / quotaExceeded / leader / idemKey — they call `gatedPrincipal` directly). The invariant:
-    // spec.principal AND every principal-keyed security decision are VERIFIED. (Was a real direct-door spoof hole
-    // before this fix; latent until a multi-tenant direct door ships, but it is the only wall against it.)
-    // wpt_ scoped-token: RESOLVED (center ruling, sema-registry `aeb4979`). The earlier 1.14.0 guard
-    // (skip the resolver on a `wpt_` token, because center 403'd it for `?principal=`) is GONE — center now lets a
-    // worker-scoped `wpt_<self>` resolve its OWN worker's principal caps when we pass `?worker=<self>` (caps-only,
-    // never others' config). So we ALWAYS wire the resolver (configCenter + !dryRun) and pass `worker` =
-    // `SEMA_REGISTRY_WORKER` — it authorizes the wpt_ path and is harmless on a full token (caps are worker-
-    // independent). Per-principal workflow gating now truly works on the scoped-token topology (no more silent
-    // fleet-wide deny). (A wpt_ with no worker still 403s → fail-closed deny, the correct degrade.)
-    // MISCONFIG diagnostic (review MEDIUM): a wpt_<self> token with NO SEMA_REGISTRY_WORKER will 403 every caps
-    // fetch → fail-closed DENY ALL workflows (correct degrade, but otherwise only per-task warns). One-shot BOOT
-    // warning so it's diagnosable. (The orchestrator normally injects the worker alongside a wpt_ — hand-misconfig.)
     if (config.configCenter && !config.configCenter.dryRun && scopedTokenNeedsWorker(config.configCenter.token, config.configCenter.worker)) {
         logger.warn("runtime_caps_scoped_token_no_worker", {
             reason: "SEMA_REGISTRY_TOKEN is a worker-scoped wpt_ token but SEMA_REGISTRY_WORKER is unset → center 403s per-principal caps → ALL workflow self-orchestration will be fail-closed denied. Set SEMA_REGISTRY_WORKER (the orchestrator normally injects it) or use the full SERVICE_PULL_TOKEN.",
         });
     }
-    // ONE per-principal caps client serves two faces off the same fetch/cache — `resolveRuntimeCaps`
-    // (core's seam, fail-closed) and `scenarioRuling` (resolveSpec's scenario gate, fail-open; center attaches the
-    // resolved {scenario, allowlist} to the caps body, single semantic source in center resolve-scenario.ts).
-    // #A5([4147] 件2):判据搬进 `centerEntitlementSourceWired` —— **同一只**谓词也被 `/v1/capabilities` 的
-    // `permissionModeAuto.entitlementSource` 披露位消费,于是「装配点认为有 entitlement 源」与「能力面对外
-    // 声称有源」结构上不可能分家(两处各写一份条件正是本仓在册的「诊断说亮、位说暗」病族入口)。
     const principalCaps = centerEntitlementSourceWired(config) && config.configCenter
         ? createPrincipalEntitlementsClient({
             baseUrl: config.configCenter.baseUrl,
@@ -49,12 +14,7 @@ export function createRuntimeCaps(ctx) {
             onError: (err, principal) => logger.warn("runtime_caps_resolve_failed", { principal, err: String(err) }),
         })
         : undefined;
-    // 「entitlement resolver wired」语义源(enableForkFromBody / selfOrchestrationFromBody 的多租户 fail-close
-    // 判别):只有 center 背书的 caps client 算数 —— 下面的 env observer 基线不是 entitlement 源,不得改变它。
     const centerRuntimeCapsResolver = principalCaps?.resolveRuntimeCaps;
-    // observer 开闸线 env 半场:EXPERIMENTAL_OBSERVER_AGENTS=true → 单用户部署把
-    // allowObservers:true 作部署基线合成(center caps 带键则 center 赢);多租户不认 env(boot warn 一次,
-    // 行为零变)。center caps 的 allowObservers 键本身在 toCoreRuntimeCaps 宽读透传(缺键=core 默认 OFF)。
     const runtimeCapsResolver = applyObserverEnvOptIn(centerRuntimeCapsResolver, {
         experimentalObserverAgents: config.experimentalObserverAgents,
         requirePrincipal: config.requirePrincipal,