@sema-agent/server 7.55.0 → 7.57.0

package/dist/boot/config-center.js

@@ -14,6 +14,7 @@ import { configLkgEnabled } from "../config.js";
 import { defaultLkgPath, defaultSkillCacheDir, saveLkg, loadLkg } from "../config-lkg.js";
 import { centerManagedConfigKeys } from "../config-center/apply-effective.js";
 import { createConfigProvider, raceBootFetch, BOOT_FETCH_DEFERRED } from "../config-provider.js";
+import { executionLaneCaps, executionLaneOf } from "../execution-lane-caps.js";
 import { createKeyResolver } from "../key-resolver.js";
 import { ensureSealedKeyStore, reportExecutionPublicKey } from "../sealed-key.js";
 import { applyEffective, applyCenterReadFace, mutateInPlace, logEffectiveDiff, applyCenterSkills, resolveMcpServers, resolveA2aPeers, restartReasons, modelPlaneChanged, planeHasActiveTiers, fetchPromptArtifact } from "../config-center/facade.js";
@@ -366,12 +367,32 @@ export async function createConfigCenterRuntime(ctx) {
                 try {
                     const fileRx = await loadRemoteExec(localRoot);
                     if (fileRx) {
+                        const preemptedLane = config.remoteExec?.provider ?? "in-process";
+                        const isolatedLane = (lane) => {
+                            const word = executionLaneOf(lane === "in-process" ? undefined : lane);
+                            return word !== undefined && executionLaneCaps(word).isolation === "supported";
+                        };
+                        const disclosePreemption = (winner) => {
+                            if (winner === preemptedLane)
+                                return;
+                            const downgrade = isolatedLane(preemptedLane) && !isolatedLane(winner);
+                            logger.warn("remote_exec_lane_preempted_by_file", {
+                                preemptedLane,
+                                effectiveLane: winner,
+                                root: localRoot,
+                                isolationDowngrade: downgrade,
+                                note: `config.d/remote-exec.json (CONFIG_PROVIDER=local, file-wins) replaced the env-derived execution lane ` +
+                                    `"${preemptedLane}" with "${winner}" — any REMOTE_EXEC/lane coordinate env for "${preemptedLane}" is now INERT` +
+                                    (downgrade ? `. This is an ISOLATION DOWNGRADE: tasks run on a non-isolated target. Delete/fix the file, or unset the lane env if the file is the intended source.` : `. Delete/fix the file, or unset the lane env if the file is the intended source.`),
+                            });
+                        };
                         if (fileRx.provider === "host") {
                             config.remoteExec = {
                                 provider: "host",
                                 ...(fileRx.workdir ? { workspaceBase: fileRx.workdir } : {}),
                                 ...(fileRx.commandTimeoutMs != null ? { commandTimeoutMs: fileRx.commandTimeoutMs } : {}),
                             };
+                            disclosePreemption("host");
                             logger.info("remote_exec_from_file", { provider: "host", root: localRoot });
                         }
                         else if (fileRx.provider === "local-docker") {
@@ -383,10 +404,11 @@ export async function createConfigCenterRuntime(ctx) {
                                 ...(fileRx.cpus != null ? { cpus: fileRx.cpus } : {}),
                                 ...(fileRx.network ? { network: fileRx.network } : {}),
                             };
+                            disclosePreemption("local-docker");
                             logger.info("remote_exec_from_file", { provider: "local-docker", root: localRoot, image: fileRx.image });
                         }
                         else {
-                            logger.warn("remote_exec_file_isolated_lane_unwired", { provider: fileRx.provider, note: "e2b/k8s/ssh/adb are sourced from REMOTE_EXEC env until file-source NAME→value resolution lands (center field map)" });
+                            logger.warn("remote_exec_file_isolated_lane_unwired", { provider: fileRx.provider, effectiveLane: preemptedLane, note: "e2b/k8s/ssh/adb are sourced from REMOTE_EXEC env until file-source NAME→value resolution lands (center field map) — the env-derived lane above stays in force" });
                         }
                     }
                 }

package/dist/boot/coordinators.js

@@ -26,6 +26,17 @@ export function createLiveCoordinators(ctx) {
             checkpointStore: backend?.checkpoint !== undefined,
             durableApproval: config.durableApproval === true,
             toolApproval: config.toolApprovalEnabled === true,
+            askWindowMs: config.streamApproval.windowMs,
+        });
+    }
+    if (config.toolApprovalEnabled === true && config.streamApproval.windowMs === 0) {
+        logger.warn("stream_ask_window_zero", {
+            unattendedPolicy: config.unattendedApprovalPolicy,
+            parkFacility: durableEnabled,
+            streamApproval: streamApprovalGate.active ? "active" : streamApprovalGate.reason,
+            note: durableEnabled && config.unattendedApprovalPolicy === "park"
+                ? "STREAM_ASK_WINDOW_MS=0 — no approval card is emitted on ANY leg; every gated ask parks immediately (answer it via POST /v1/approvals/:sessionId/decide). Set a positive window (ms) to get live cards back."
+                : "STREAM_ASK_WINDOW_MS=0 — no approval card is emitted on ANY leg, and this deployment has no park destination (UNATTENDED_APPROVAL_POLICY=deny and/or no checkpoint store), so every gated tool call is refused fail-closed. Set a positive window (ms), or wire DURABLE_APPROVAL + a checkpoint store.",
         });
     }
     const approvalAskAudit = config.toolApprovalEnabled && backend?.kind === "local" && config.localDataRoot !== undefined
@@ -45,8 +56,9 @@ export function createLiveCoordinators(ctx) {
     }
     const toolApproval = config.toolApprovalEnabled
         ? new ToolApprovalCoordinator({
+            ttlMs: config.streamApproval.windowMs,
             ...(streamApprovalGate.active
-                ? { askStore: streamApprovalGate.askStore, ttlMs: config.streamApproval.windowMs, unreachedTtlMs: config.streamApproval.unreachedTtlMs }
+                ? { askStore: streamApprovalGate.askStore, unreachedTtlMs: config.streamApproval.unreachedTtlMs }
                 : {}),
             windowMarginMs: config.streamAskWindowMarginMs,
             admitMaxPerTask: config.streamApproval.admitMaxPerTask,

package/dist/boot/leader.d.ts

@@ -25,6 +25,27 @@ export interface LeaderCtx {
     /** [ref] 件B/C/D([ref],codex R2-F1):部署治理三座席 —— leader 车道的每一只 Runner 都要带上它,
      *  否则开了 leader 端点的部署就有一条在部署治理**之外**的执行面(合规否决/锁都够不着)。 */
     governanceSeams: import("./governance-seams.js").GovernanceSeams;
+    /**
+     * [ref]([ref])—— 主车道 `boot/budget-tracing.ts` 造的**同一只** tracer。leader 车道的每一只 Runner
+     * 都要带:tracer 是 `brain.call` 的唯一记账点(costQuota / fleetUsage / fleetLease / 花费计数四个写口),
+     * 而 `POST /v1/leader` 的准入处**读**的正是它填的那两个桶 —— 缺席 = 门查的桶与花钱的手不是同一只。
+     *
+     * 🔴 **必填键**(值可为 undefined):这三席都刻意写成非可选,让「main.ts 铸了却忘了递」变成**编译红**
+     * 而不是又一次静默漏配([ref]§三族A 病族的机器护栏)。
+     */
+    tracer: RunnerDeps["tracer"];
+    /** [ref]([ref],[ref]-T1)—— 治理窗**账本店**(与 `config.usageWindows` 声明成对;声明直接从
+     *  本 ctx 的 config 取,leader 不另读)。缺席 = 未配治理窗的部署。必填键,理由同 `tracer`。 */
+    usageWindowStore: RunnerDeps["usageWindowStore"];
+    /** [ref]([ref])—— center 发布的 prompt catalog(`configCenter.promptSource`,与主 runner/subRunner
+     *  同一只)。缺席 ⇒ leader 的四类顶层任务跑引擎内置提示词,而同部署其余三条腿跑运维发布的那一份,
+     *  且 core 顶层新任务是**静默**落回(无 notice)。必填键,理由同 `tracer`。 */
+    promptSource: RunnerDeps["promptSource"];
+    /** [ref] 披露半件([ref],codex r2-[high])—— 主车道 `createRunnerDeps` 铸的**同一只**错误汇
+     *  (main.ts 直引 `runnerDeps.onError`,与 subRunner 的先例同姿势)。core 对治理窗**最终扣账失败**的
+     *  唯一出口就是它(`runtask.js` 的 `catch (flushErr) => deps.onError`),所以它与 `usageWindowStore`
+     *  席同生共死:挂窗不挂汇 = 治理轴上的静默失败面([ref])。必填键,理由同 `tracer`。 */
+    onError: RunnerDeps["onError"];
     /** [ref] 车4 件1:durable store 后端(leader-run 登记表从这里取)。缺席 = 无 DB 的 env-only worker。 */
     backend?: StoreBackend | undefined;
 }

package/dist/boot/leader.js

@@ -51,6 +51,12 @@ export function createLeaderFace(ctx) {
                 retentionPolicy: governanceSeams.retentionPolicy,
             },
             deploymentPosture: buildDeploymentPostureSeats(config),
+            ...(ctx.tracer ? { tracer: ctx.tracer } : {}),
+            ...(config.usageWindows && ctx.usageWindowStore
+                ? { usageWindows: config.usageWindows, usageWindowStore: ctx.usageWindowStore }
+                : {}),
+            ...(ctx.promptSource ? { promptSource: ctx.promptSource } : {}),
+            ...(ctx.onError ? { onError: ctx.onError } : {}),
             fanoutEnabled: config.leaderFanoutEnabled,
             ...((process.env.MODEL_ROUTER_ID || process.env.MODEL_CHEAP_ID)
                 ? { routerModel: (process.env.MODEL_ROUTER_ID || process.env.MODEL_CHEAP_ID) }

package/dist/boot/parked-revive-gate.d.ts

@@ -57,9 +57,14 @@ export interface ParkedReviveGateDeps {
      * 手抄一个等价签名会让 core 改这条 seam 的那天变成静默漂移而不是编译期事件)。
      */
     readonly resolveRuntimeCaps?: RunnerDeps["runtimeCapsResolver"];
-    /** `RunnerDeps.autoMode` 分类器面(信任门半场)在不在场 —— core 的武装条件是
-     *  `runtimeCaps.autoMode === true` **∧** 这一面在场,两个半场缺一不武装(prepare-task 原式)。 */
+    /** `RunnerDeps.autoMode` 分类器面(信任门半场)在不在场 —— core 7.2.0 的武装条件是
+     *  `runtimeCaps.autoMode === true` **∧** 这一面在场(prepare-task 原式)。⚠️ [ref] / core [ref] 起武装式换成
+     *  `spec.autoModeRequested === true ∧ 席位 ∧ runtimeCaps?.autoMode !== false`——本文件的镜像
+     *  {@link autoModePostureOf} **未随改**(赎回行无父 run 的 auto 意图可读),见该函数头注的未闭环登记。 */
     readonly autoModeSeatMounted?: boolean;
+    /** [ref]:父 run 的 auto 意图(`TaskSpec.autoModeRequested` / 链位)——意图武装式下重建 decider 的第三项。⚠️ 今日
+     *  **无持久源**(core [ref] 链位 live-only;RunRecord 无 body),生产装配不递 ⇒ 恒缺席;座留给 core 持久化到货。 */
+    readonly parentAutoModeIntent?: ((row: BackgroundAgentRecord) => boolean) | undefined;
     readonly logger: {
         info(event: string, fields?: Record<string, unknown>): void;
         warn(event: string, fields?: Record<string, unknown>): void;

package/dist/boot/parked-revive-gate.js

@@ -1,3 +1,4 @@
+import { coreArmsAutoOnIntent } from "../auto-mode-face.js";
 import { join } from "node:path";
 import { createAutoModeDecider, NodeExecutionEnv } from "@sema-agent/core";
 import { recordFailOpen } from "../observability/fail-open.js";
@@ -66,8 +67,18 @@ async function resolveCapsFor(deps, identity) {
     }
 }
 function autoModePostureOf(deps, row, caps) {
-    if (deps.autoModeSeatMounted !== true || caps?.autoMode !== true)
+    if (deps.autoModeSeatMounted !== true)
         return {};
+    if (!coreArmsAutoOnIntent()) {
+        if (caps?.autoMode !== true)
+            return {};
+    }
+    else {
+        if (caps?.autoMode === false)
+            return {};
+        if (deps.parentAutoModeIntent?.(row) !== true)
+            return {};
+    }
     return { autoMode: { decider: createUnreachableAncestorClassifier(deps, row) } };
 }
 function createUnreachableAncestorClassifier(deps, row) {

package/dist/boot/resolve-spec.d.ts

@@ -50,6 +50,9 @@ export interface ResolveSpecCtx {
     hookWakeBus: {
         deliver?: (sessionId: string, text: string) => Promise<boolean>;
     };
+    /** [ref] 件⑤:per-session「显式 bypassPermissions」登记簿的写腿(`boot/session-shell-gate-registry.ts`);
+     *  阶段④ 算出 effMode 的那一行登记,runner-deps 的 config 忠告汇点按 sessionId 回查定级。缺席(桩)= 不登记。 */
+    noteSessionShellGate?: ((sessionId: string | undefined, explicitOff: boolean) => void) | undefined;
     resumeAnchorStore: ReturnType<StoreBackend["resumeAnchor"]> | undefined;
     ownerAware: OwnerAwareSessionStore;
     taskLimitCaps: {

package/dist/boot/resolve-spec.js

@@ -36,7 +36,7 @@ import { redactSecrets } from "../trace/redact.js";
 import { DeferredSandboxPathEnv, isSandboxPathAdjudicationLane, sandboxPathEnvSlots } from "./deferred-sandbox-path-env.js";
 import { effectiveMemoryPersistenceCapable } from "./memory-boundary.js";
 export function createResolveSpec(ctx) {
-    const { config, logger, metrics, localRoot, scenarios, principalCaps, centerRuntimeCapsResolver, handsLanes, getCenterPrompts, getKeyResolver, taskAttachmentStore, perSessionCwd, setSessionCwd, setSessionShellEnv, fenceSessionOwner, hookLlm, hookAgent, fleetBus, hookWakeBus, resumeAnchorStore, ownerAware, taskLimitCaps, taskTimeoutSec, selectEnvTool, sendUserFileToolSpec, memoryEngine, durableEnabled, approvalExemptionStore, singleUserAutoAcceptBaseline, checkpointStore, deploymentHooks, imageIndex, perTaskImage, sessionEnvSelection, liveQuestionFace, approverSeat, lockedKeys, } = ctx;
+    const { config, logger, metrics, localRoot, scenarios, principalCaps, centerRuntimeCapsResolver, handsLanes, getCenterPrompts, getKeyResolver, taskAttachmentStore, perSessionCwd, setSessionCwd, setSessionShellEnv, fenceSessionOwner, hookLlm, hookAgent, fleetBus, hookWakeBus, noteSessionShellGate, resumeAnchorStore, ownerAware, taskLimitCaps, taskTimeoutSec, selectEnvTool, sendUserFileToolSpec, memoryEngine, durableEnabled, approvalExemptionStore, singleUserAutoAcceptBaseline, checkpointStore, deploymentHooks, imageIndex, perTaskImage, sessionEnvSelection, liveQuestionFace, approverSeat, lockedKeys, } = ctx;
     assertGuardPatternsUsable(config);
     const onlySensitiveBaseline = buildOnlySensitiveBaselineWarning(config, { durableEnabled, singleUserAutoAcceptBaseline });
     if (onlySensitiveBaseline)
@@ -52,6 +52,7 @@ export function createResolveSpec(ctx) {
         assertRequestA2aUnlocked(body.a2aPeers, lockedKeys);
         const gated = await gateScenarioAndAppend(body, auth, opts);
         const effMode = effectivePermissionMode(body, gated.parsedSettings.settings);
+        noteSessionShellGate?.(auth?.sessionId, effMode === "bypassPermissions");
         const lane = bindSettingsCwdEnvAndModel(body, auth, gated, effMode, opts);
         const anchors = await resolveHistoryAnchors(body, auth);
         const spec = assembleSpecLiteral(body, auth, req, opts, { ...gated, ...lane, ...anchors }, effMode);
@@ -278,6 +279,7 @@ export function createResolveSpec(ctx) {
             additionalReadDirectories,
             enablePlanMode: config.planModeEnabled ? true : undefined,
             ...(effMode ? { shellGate: shellGateForMode(effMode) } : {}),
+            ...(effMode === "auto" ? { autoModeRequested: true } : {}),
             selfOrchestration: selfOrchestrationFromBody({ selfOrchestration: body.selfOrchestration === true || parsedSettings.settings?.ultracode === true }, config, Boolean(centerRuntimeCapsResolver)),
             forwardSubagentEvents: body.forwardSubagentEvents === true ? true : undefined,
             retainSubagentSessions: normalizeRetainSubagentSessions(body.retainSubagentSessions),

package/dist/boot/runner-deps.d.ts

@@ -52,6 +52,14 @@ import type { MemorySyncRunner } from "../memory-sync-client.js";
  */
 export type RunnerDepsOnAsk = (req: Parameters<ToolApprovalCoordinator["ask"]>[0], signal?: AbortSignal) => Promise<AskOutcome>;
 export declare function createRunnerDepsOnAsk(toolApproval: ToolApprovalCoordinator | undefined): RunnerDepsOnAsk | undefined;
+/** [ref] 件⑤:core `onError(phase:"config")` 的 `classification` 已知词表。⚠️ core d.ts(`RunnerDeps.onError` 注)只登记了
+ *  prompt-cache 相的五词,config 相的词**只在 dist js 出现**(7.2.0 亲扫 dist 下全部 js 的 `phase: "config"` 发射点:五词——
+ *  `interaction-posture-refused`(prepare-config-doors)/ `memory-tools-not-mounted` / `sandbox-admission-unavailable` /
+ *  `shared-memory-not-mounted` / `shell-gate-off`(prepare-hands-readface));[ref] 去幻觉轮真抓:首版只写了 shell-gate-off
+ *  一词,其余四词会被误标 unknown。所以这是「按实现亲读」的开集快照,不是 core 类型闭集——词表外的值原样进日志并标
+ *  `classificationKnown:false`(指标标签折 `unknown`),不吞不编;与安装包的锁步由 test/boot-runner-deps-shared-base.test.ts
+ *  的 dist 扫描格钉住(core 加词/收进 d.ts 那天先红)。 */
+export declare const CONFIG_ADVISORY_CLASSIFICATIONS: ReadonlySet<string>;
 export interface RunnerDepsCtx {
     config: ServiceConfig;
     logger: Logger;
@@ -113,6 +121,10 @@ export interface RunnerDepsCtx {
      *  来源=configCenter.takeMcpRevocations()(取走即声明接线,restart 豁免与承接绑同一动作)。
      *  缺席=undefined=pre-338 语义(纯 env 部署无中心撤销面)。 */
     mcpRevocations: RunnerDeps["mcpRevocations"];
+    /** [ref] 件⑤([ref] server ③):per-session「显式 bypassPermissions」登记簿的读腿 —— `onError(phase:"config",
+     *  classification:"shell-gate-off")` 在本 session 显式声明 bypass 时降级 info(正常态不打 warn)。缺席(桩 /
+     *  run-local)= 照 warn(退化方向=多一条告警)。 */
+    sessionShellGateExplicitlyOff?: ((sessionId: string) => boolean) | undefined;
     /**
      * 交接件⑤ —— commit 尾注的署名座(`RunnerDeps.hands.commitCoAuthor`)。
      *

package/dist/boot/runner-deps.js

@@ -15,6 +15,13 @@ export function createRunnerDepsOnAsk(toolApproval) {
         return undefined;
     return (req, signal) => toolApproval.ask(req, signal);
 }
+export const CONFIG_ADVISORY_CLASSIFICATIONS = new Set([
+    "interaction-posture-refused",
+    "memory-tools-not-mounted",
+    "sandbox-admission-unavailable",
+    "shared-memory-not-mounted",
+    "shell-gate-off",
+]);
 export function createEngineNoticeForwarder(logger, router = defaultEngineNoticeRouter) {
     return (notice) => {
         logger.warn("engine_notice", { code: notice.code, message: notice.message, ...(notice.detail !== undefined ? { detail: notice.detail } : {}) });
@@ -71,7 +78,7 @@ export function createSharedRunnerDeps(ctx) {
     return shared;
 }
 export function createRunnerDeps(ctx) {
-    const { config, logger, metrics, localRoot, outcomeSink, elicitation, question, toolApproval, sessionStore, memoryEngine, sessionCaptureRecordStore, memorySyncRunner, runtimeCapsResolver, fileHistoryStore, legacyRewindBoundaryProbe, permissionRuleStore, fleetBus, workflowRunStore, workflowJournalStore, workflowAgentRegistry, workflowNotifyGate, workflowCompletionInbox, deliverWorkflowCompletion, getRunStore, } = ctx;
+    const { config, logger, metrics, localRoot, outcomeSink, elicitation, question, toolApproval, sessionStore, memoryEngine, sessionCaptureRecordStore, memorySyncRunner, runtimeCapsResolver, fileHistoryStore, legacyRewindBoundaryProbe, permissionRuleStore, fleetBus, workflowRunStore, workflowJournalStore, workflowAgentRegistry, workflowNotifyGate, workflowCompletionInbox, deliverWorkflowCompletion, getRunStore, sessionShellGateExplicitlyOff, } = ctx;
     const sharedRunnerDeps = createSharedRunnerDeps(ctx);
     const workflowModelAllowlist = workflowModelAllowlistFor(config);
     const selfOrchestrationDeps = config.selfOrchestrationEnabled
@@ -216,8 +223,26 @@ export function createRunnerDeps(ctx) {
                 return;
             }
             if (ctx.phase === "config") {
-                logger.warn("runner_config_advisory", { sessionId: ctx.sessionId, info: String(err) });
-                metrics.inc("runner_config_advisory_total");
+                const code = typeof err?.code === "string" ? err.code : undefined;
+                const classification = ctx.classification;
+                const classificationKnown = classification === undefined ? undefined : CONFIG_ADVISORY_CLASSIFICATIONS.has(classification);
+                const expectedShellGateOff = classification === "shell-gate-off" && sessionShellGateExplicitlyOff?.(ctx.sessionId) === true;
+                const fields = {
+                    sessionId: ctx.sessionId,
+                    ...(code !== undefined ? { code } : {}),
+                    ...(classification !== undefined ? { classification, classificationKnown } : {}),
+                    ...(expectedShellGateOff ? { expected: "bypassPermissions declared by the caller for this session — shell gate off is the requested posture, not a misconfiguration" } : {}),
+                    info: String(err),
+                };
+                if (expectedShellGateOff)
+                    logger.info("runner_config_advisory", fields);
+                else
+                    logger.warn("runner_config_advisory", fields);
+                metrics.inc("runner_config_advisory_total", {
+                    ...(code !== undefined ? { code } : {}),
+                    ...(classification !== undefined ? { classification: classificationKnown ? classification : "unknown" } : {}),
+                    level: expectedShellGateOff ? "info" : "warn",
+                });
                 return;
             }
             logger.error("runner_error", { phase: ctx.phase, sessionId: ctx.sessionId, err: String(err) });

package/dist/boot/runtime-caps.d.ts

@@ -9,7 +9,7 @@
  */
 import type { ServiceConfig } from "../config.js";
 import type { Logger } from "../observability/logger.js";
-import { type MemoryOptOutVerdictSource } from "../runtime-caps-resolver.js";
+import { type EntitlementsResolverFn, type MemoryOptOutVerdictSource } from "../runtime-caps-resolver.js";
 export interface RuntimeCapsCtx {
     config: ServiceConfig;
     logger: Logger;
@@ -22,23 +22,34 @@ export interface RuntimeCapsCtx {
  * D1 / `boot/retention-lane.ts` 同姿态:安全/合规控件不得半开)。
  *
  * governed 的语义是「per-principal verdict **必答**」:core 对 verdict 缺席一律**拒跑**(fail-closed,部署显式
- * 选的方向)。而 verdict 只能来自一个源 —— 本批唯一源 = SQL 后端上的 `memory_optout_grant` 表(三层折叠后
- * 恒答显式 boolean)。governed 而无源 ⇒ 每一个 `capture:"off"` 声明都被 core 以
+ * 选的方向)。verdict 源**两条**(析取,[ref] 起):①SQL 后端上的 `memory_optout_grant` 表(三层折叠后
+ * 恒答显式 boolean),②非 dry-run 的 config center 发 `EntitlementRuntimeCaps.allowMemoryOptOut`。
+ * governed 而两源皆无 ⇒ 每一个 `capture:"off"` 声明都被 core 以
  * `memory.capture_optout_denied` 拒掉,而运维看到的只是一台「启动成功、opt-out 全拒」的机器 —— 正是
- * 「阀门开着而配不出来 ⇒ 悄悄读成别的」那一形。所以在**启动期**点名:要么接 SQL 后端(表随中央
- * ensureSchema 建),要么改姿态。`open`/`capture-required`/缺席 不依赖源(前者故障放行、后者全拒,
- * 都不问 verdict)。
+ * 「阀门开着而配不出来 ⇒ 悄悄读成别的」那一形。所以在**启动期**点名:接 SQL 后端(表随中央
+ * ensureSchema 建)、接非 dry-run center,或改姿态。`open`/`capture-required`/缺席 不依赖源(前者故障放行、
+ * 后者全拒,都不问 verdict)。
  *
  * ⚠️ center 键 `EntitlementRuntimeCaps.allowMemoryOptOut` 是 settings-schema 的独立小件([ref] §四 开放问题①),
- * 到货前**不算源**;到货后本断言加一条「center 在场」析取臂即可,判据不变。
+ * 已到货(1.4.0,[ref])——析取臂已加,dry-run 不算源(不 APPLY 即不 ENFORCE 同律)。
+ *
+ * 🔴 **[ref] —— 第三臂的辖域**:它证的是「center 这个**源**在场」,**不是**「center 会为每个 principal
+ * **发** `allowMemoryOptOut`」。该键在 settings-schema 里是**可选**的(`z.ZodOptional<z.ZodBoolean>`),
+ * `toCoreRuntimeCaps` 对缺席不铸键 ⇒ 一台 center 从不发该键的 governed worker 照样起动、然后每一个
+ * `memory.capture:"off"` 恒拒(core: verdict absent)。这条**不能**在启动期证死(部署级布尔对 per-principal
+ * 的授权说不了话,且 boot 期去问 center 会把拒启挂在一次网络上),所以取「拒启臂放行 + 两处响亮」:
+ * 启动期一行 `memory_capture_governed_center_only_source`(这一形有风险)+ 运行期首次真缺席一行
+ * (见 `applyGovernedVerdictAbsenceWarning`,一次性、不改判)。
  */
 export declare function assertMemoryCapturePolicyWirable(input: {
     policy: ServiceConfig["memoryCapturePolicy"];
     grantSourceWired: boolean;
+    centerEntitlementSourceWired?: boolean;
 }): void;
 export declare function createRuntimeCaps(ctx: RuntimeCapsCtx): {
     principalCaps: import("../runtime-caps-resolver.js").PrincipalEntitlementsClient | undefined;
     centerRuntimeCapsResolver: ((principal: string | undefined) => Promise<import("@sema-agent/core").RuntimeCaps | undefined>) | undefined;
-    runtimeCapsResolver: import("../runtime-caps-resolver.js").EntitlementsResolverFn | undefined;
+    runtimeCapsResolver: EntitlementsResolverFn | undefined;
+    runtimeCapsPeekResolver: EntitlementsResolverFn | undefined;
 };
 //# sourceMappingURL=runtime-caps.d.ts.map

package/dist/boot/runtime-caps.js

@@ -1,22 +1,42 @@
-import { applyMemoryOptOutGrant, applyObserverEnvOptIn, centerEntitlementSourceWired, createPrincipalEntitlementsClient, scopedTokenNeedsWorker, } from "../runtime-caps-resolver.js";
+import { applyGovernedVerdictAbsenceWarning, applyLocalAutoModeDeny, applyMemoryOptOutGrant, applyObserverEnvOptIn, centerEntitlementSourceWired, createPrincipalEntitlementsClient, scopedTokenNeedsWorker, } from "../runtime-caps-resolver.js";
 export function assertMemoryCapturePolicyWirable(input) {
     if (input.policy !== "governed")
         return;
     if (input.grantSourceWired)
         return;
+    if (input.centerEntitlementSourceWired === true)
+        return;
     throw new Error(`MEMORY_CAPTURE_POLICY=governed requires a per-principal memory opt-out verdict source, and this deployment wires NONE ` +
         `— under "governed" core REFUSES every session memory-capture opt-out whose verdict is absent (fail-closed, the posture's ` +
         `own contract), so a governed worker without a source would refuse every \`memory.capture:"off"\` declaration and the ` +
-        `refusal would read as an entitlement denial rather than the misconfiguration it is. The only verdict source in this ` +
-        `version is the \`memory_optout_grant\` table on a SQL store backend (DB_BACKEND=mysql|pg; the table is created by the ` +
-        `central ensureSchema and administered through /v1/admin/memory-optout). Wire a SQL backend, or set ` +
-        `MEMORY_CAPTURE_POLICY=open (opt-outs take effect; only an explicit per-principal false denies) or ` +
+        `refusal would read as an entitlement denial rather than the misconfiguration it is. This version has TWO verdict sources ` +
+        `— wire either one: (1) the \`memory_optout_grant\` table on a SQL store backend (DB_BACKEND=mysql|pg; the table is ` +
+        `created by the central ensureSchema and administered through /v1/admin/memory-optout), or (2) a config center that ` +
+        `EMITS \`allowMemoryOptOut\` in each principal's entitlement caps (SEMA_REGISTRY_URL + SEMA_REGISTRY_TOKEN, ` +
+        `SEMA_REGISTRY_DRY_RUN off — dry-run observes without applying, so it is not a source; and note the key is OPTIONAL in ` +
+        `the entitlement schema: a center that never emits it leaves every verdict absent, i.e. every opt-out still refused). ` +
+        `Or set MEMORY_CAPTURE_POLICY=open (opt-outs take effect; only an explicit per-principal false denies) or ` +
         `MEMORY_CAPTURE_POLICY=capture-required (every opt-out declaration refused, no source consulted).`);
 }
+function memoryVerdictAbsenceEffect(reason) {
+    switch (reason) {
+        case "anonymous_lane":
+            return 'an ANONYMOUS/system run (no principal) resolved no allowMemoryOptOut — the center entitlement source is per-principal and is never consulted without an identity, so on a center-only deployment the principal-less lane can NEVER obtain a verdict and core refuses every anonymous memory.capture:"off" (memory.capture_optout_denied). Only the local memory_optout_grant table answers for anonymous runs (its deployment-default row). One-shot per process.';
+        case "center_verdict_absent":
+            return 'governed posture, center-only verdict source, and this resolve produced NO allowMemoryOptOut for a NAMED principal (the center omitted the optional entitlement key, or the caps fetch degraded fail-closed) ⇒ core refuses that principal\'s memory.capture:"off" declarations (memory.capture_optout_denied). One-shot per process.';
+    }
+}
 export function createRuntimeCaps(ctx) {
     const { config, logger } = ctx;
-    assertMemoryCapturePolicyWirable({ policy: config.memoryCapturePolicy, grantSourceWired: ctx.memoryOptOutGrant !== undefined });
-    if (config.configCenter && !config.configCenter.dryRun && scopedTokenNeedsWorker(config.configCenter.token, config.configCenter.worker)) {
+    const grantSourceWired = ctx.memoryOptOutGrant !== undefined;
+    assertMemoryCapturePolicyWirable({ policy: config.memoryCapturePolicy, grantSourceWired, centerEntitlementSourceWired: centerEntitlementSourceWired(config) });
+    const governedCenterOnlySource = config.memoryCapturePolicy === "governed" && !grantSourceWired && centerEntitlementSourceWired(config);
+    if (governedCenterOnlySource) {
+        logger.warn("memory_capture_governed_center_only_source", {
+            reason: "MEMORY_CAPTURE_POLICY=governed with NO local memory_optout_grant table: the only verdict source is the config center, and `allowMemoryOptOut` is an OPTIONAL entitlement key — for any principal whose caps omit it the verdict is ABSENT and core refuses that session's memory.capture:\"off\" (memory.capture_optout_denied, fail-closed). ANONYMOUS/system runs are worse off still: the center source is per-principal and is never consulted without an identity, so on this shape a principal-less run can never obtain a verdict at all. Verify the center emits allowMemoryOptOut for every principal, or wire a SQL backend (DB_BACKEND=mysql|pg) so the grant table answers (its deployment-default row also covers anonymous runs).",
+        });
+    }
+    if (centerEntitlementSourceWired(config) && config.configCenter && scopedTokenNeedsWorker(config.configCenter.token, config.configCenter.worker)) {
         logger.warn("runtime_caps_scoped_token_no_worker", {
             reason: "SEMA_REGISTRY_TOKEN is a worker-scoped wpt_ token but SEMA_REGISTRY_WORKER is unset → center 403s per-principal caps → ALL workflow self-orchestration will be fail-closed denied. Set SEMA_REGISTRY_WORKER (the orchestrator normally injects it) or use the full SERVICE_PULL_TOKEN.",
         });
@@ -30,18 +50,28 @@ export function createRuntimeCaps(ctx) {
         })
         : undefined;
     const centerRuntimeCapsResolver = principalCaps?.resolveRuntimeCaps;
-    const withObservers = applyObserverEnvOptIn(centerRuntimeCapsResolver, {
-        experimentalObserverAgents: config.experimentalObserverAgents,
-        requirePrincipal: config.requirePrincipal,
-        warn: (msg, fields) => logger.warn(msg, fields),
-    });
-    const runtimeCapsResolver = applyMemoryOptOutGrant(withObservers, ctx.memoryOptOutGrant, {
-        onFault: (err, principal) => logger.warn("memory_optout_grant_resolve_failed", {
-            principal,
-            err: String(err),
-            effect: "allowMemoryOptOut left ABSENT for this resolve (never coined as false): open posture ⇒ the opt-out takes effect; governed ⇒ core refuses the run (verdict absent)",
-        }),
-    });
-    return { principalCaps, centerRuntimeCapsResolver, runtimeCapsResolver };
+    const compose = (base, observability) => {
+        const withObservers = applyObserverEnvOptIn(base, {
+            experimentalObserverAgents: config.experimentalObserverAgents,
+            requirePrincipal: config.requirePrincipal,
+            ...(observability ? { warn: (msg, fields) => logger.warn(msg, fields) } : {}),
+        });
+        const withMemoryGrant = applyMemoryOptOutGrant(withObservers, ctx.memoryOptOutGrant, {
+            onFault: (err, principal) => logger.warn("memory_optout_grant_resolve_failed", {
+                principal,
+                err: String(err),
+                ...(observability ? {} : { face: "capabilities-read" }),
+                effect: "allowMemoryOptOut left ABSENT for this resolve (never coined as false): open posture ⇒ the opt-out takes effect; governed ⇒ core refuses the run (verdict absent)",
+            }),
+        });
+        const withLocalAutoModeDeny = applyLocalAutoModeDeny(withMemoryGrant, config.permissionsDisableAutoMode);
+        return applyGovernedVerdictAbsenceWarning(withLocalAutoModeDeny, {
+            enabled: observability && governedCenterOnlySource,
+            warn: (reason, principal) => logger.warn("memory_capture_governed_verdict_absent", { principal, reason, effect: memoryVerdictAbsenceEffect(reason) }),
+        });
+    };
+    const runtimeCapsResolver = compose(centerRuntimeCapsResolver, true);
+    const runtimeCapsPeekResolver = compose(principalCaps?.peekRuntimeCaps, false);
+    return { principalCaps, centerRuntimeCapsResolver, runtimeCapsResolver, runtimeCapsPeekResolver };
 }
 //# sourceMappingURL=runtime-caps.js.map

package/dist/boot/session-shell-gate-registry.d.ts

@@ -0,0 +1,39 @@
+/**
+ * [ref] 件⑤(core PM 三仓扫查 [ref] server 条 ③,并入 [ref])—— 「本 run 是否**显式**声明了 bypassPermissions」的
+ * per-session 登记簿,供 `boot/runner-deps.ts` 的 `onError(phase:"config")` 汇点给 core 的 `shell-gate-off`
+ * 忠告定级。
+ *
+ * ## 为什么需要它
+ * core 在「shell 门 doctrine=off ∧ 挂了真可写 Bash」时经 `onError(phase:"config", classification:"shell-gate-off")`
+ * 发一条忠告(`prepare-hands-readface.js`),但它分不清 off 是**调用方显式选的**(server 把 `permissionMode:
+ * "bypassPermissions"` 翻成 `shellGate:"off"`,[ref] 表)还是**没表态落到 core 默认**(无壳直连部署,真值得
+ * 一条 warn)。这正是真实用户提案里「bypass 下照打 shell gate doctrine is off 告警」的根:正常态被当异常打。
+ * 汇点只拿到 `ctx.sessionId`,而生效模式是 server 在 resolve-spec 阶段④ 单点算出的(`effectivePermissionMode`),
+ * 所以由 resolve-spec 在算出 effMode 的那一行登记、汇点按 sessionId 回查。
+ *
+ * ## 键
+ * `auth.sessionId`:authorizer 在服务路径上**恒**铸 session id(`security.ts` `uuidv7()`,core 的无 sessionId
+ * 分支在服务路径不可达),且 spec.sessionId = 同一值 ⇒ core 回调的 `ctx.sessionId` 与登记键同源。
+ * 缺 authorizer 的裸装配(测试桩)拿不到键 ⇒ 不登记 ⇒ 汇点按「未声明」处理 = 仍 warn(退化方向=多一条告警,
+ * 不是少一条)。
+ *
+ * ## 已知界(codex r2 [medium],登记不修:属主在 core 回调契约)
+ * 键是 session 而非**执行**:同 session 并发第二次提交在 resolveSpec 后才被 409 拒,其登记已覆盖前一次——若被拒的
+ * 那次是 bypass 而在跑的那次不是,且忠告恰在这一窗内发出,则一条本该 warn 的 `shell-gate-off` 被降成 info(仍整行
+ * 落日志、字段齐全,执法零变)。窗 = 在跑 run 的 resolveSpec 到其 prepare 期忠告之间(毫秒级,且要同 session 并发
+ * 提交 + 模式相反)。执行唯一的归因需要 core 回调 `ctx` 带 taskId / shellGate 出处(已作 core 侧诉求登记),
+ * 到货后本簿退役。
+ *
+ * ## 界
+ * 有界 Map(插入序淘汰,默认 10k 条,与 caps 缓存同量级):session id 是开集,长命 worker 不能无界累积。
+ * 淘汰掉的旧会话再来忠告时同样回落「未声明」⇒ warn(同一退化方向)。每次 resolve 覆写(同 session 后一轮改
+ * 模式时以最近一轮为准;续跑四条 rebuild 腿都经 resolveSpec ⇒ 同律登记)。
+ */
+export interface SessionShellGateRegistry {
+    /** resolve-spec 阶段④:登记本 session 这一轮是否显式声明 bypassPermissions(= server 翻成 shellGate:"off")。 */
+    note(sessionId: string | undefined, explicitOff: boolean): void;
+    /** runner-deps 汇点:本 session 最近一轮是否显式声明了 off。未登记/已淘汰 ⇒ false(退化=照 warn)。 */
+    explicitlyOff(sessionId: string): boolean;
+}
+export declare function createSessionShellGateRegistry(cap?: number): SessionShellGateRegistry;
+//# sourceMappingURL=session-shell-gate-registry.d.ts.map

package/dist/boot/session-shell-gate-registry.js

@@ -0,0 +1,21 @@
+export function createSessionShellGateRegistry(cap = 10_000) {
+    const off = new Map();
+    return {
+        note(sessionId, explicitOff) {
+            if (sessionId === undefined)
+                return;
+            if (off.has(sessionId))
+                off.delete(sessionId);
+            else if (off.size >= cap) {
+                const oldest = off.keys().next();
+                if (!oldest.done)
+                    off.delete(oldest.value);
+            }
+            off.set(sessionId, explicitOff);
+        },
+        explicitlyOff(sessionId) {
+            return off.get(sessionId) === true;
+        },
+    };
+}
+//# sourceMappingURL=session-shell-gate-registry.js.map

package/dist/config-catalog.js

@@ -254,7 +254,7 @@ export const CONFIG_CATALOG = [
     r("MODEL_COST_CACHE_WRITE", "modelPlane", "number", "主模型 cache-write 单价", { staticDefault: "0", danger: BILL, resolve: (c) => c.model.cost?.cacheWrite ?? null, center: cModels("models[].cost.cacheWrite") }),
     r("MODEL_COST_INPUT", "modelPlane", "number", "主模型 input 单价(NaN 会让成本天花板整条消失 ⇒ 坏值拒启)", { staticDefault: "0", danger: BILL, resolve: (c) => c.model.cost?.input ?? null, center: cModels("models[].cost.input") }),
     r("MODEL_COST_OUTPUT", "modelPlane", "number", "主模型 output 单价", { staticDefault: "0", danger: BILL, resolve: (c) => c.model.cost?.output ?? null, center: cModels("models[].cost.output") }),
-    r("MODEL_DEFAULT_THINKING", "modelPlane", "enum", "主模型默认思考档(llm-core ThinkingLevel,无 off)", { enumValues: ["minimal", "low", "medium", "high", "max"] }),
+    r("MODEL_DEFAULT_THINKING", "modelPlane", "enum", "主模型默认思考档(llm-core ThinkingLevel;off=不设模型级默认;未知词拒启)", { enumValues: ["minimal", "low", "medium", "high", "xhigh", "max", "off"], derivedDefaultNote: "缺席/off ⇒ 不铸 defaultThinking(逐任务档由 spec>role 决定)", resolve: (c) => c.model.defaultThinking ?? null }),
     r("MODEL_DEGRADE_AT_COST_FRACTION", "modelPlane", "number", "预算降级触发比(spent/budget;>1=实际别降级)", { staticDefault: "0.7", danger: BILL }),
     r("MODEL_DEGRADE_ON", "modelPlane", "csv", "反应式降级触发词表(core DegradeReason 全集;拼错拒启)", { center: { domain: "models", path: "degrade", centerKey: "models", precedence: "center-wins", timing: "restart", restartSlice: "degrade-route" } }),
     r("MODEL_DEGRADE_REACTIVE", "modelPlane", "boolean", "反应式降级开关(degrade-route 重启片只在它开时活)", { staticDefault: "false", center: { domain: "models", path: "degrade", centerKey: "models", precedence: "center-wins", timing: "restart", restartSlice: "degrade-route" } }),
@@ -271,7 +271,15 @@ export const CONFIG_CATALOG = [
     r("MODEL_PRESENCE_PENALTY", "modelPlane", "number", "presence_penalty 直通"),
     r("MODEL_PROVIDER", "modelPlane", "string", "主模型 provider(路由选 brain)", { derivedDefaultNote: "缺席:ANTHROPIC base+cred 同在 ⇒ anthropic,否则 gateway", resolve: (c) => c.model.provider, center: cModels("models[].provider") }),
     r("MODEL_REASONING", "modelPlane", "boolean", "主模型 reasoning 声明", { staticDefault: "true", resolve: (c) => c.model.reasoning ?? null, center: cModels("models[].reasoning") }),
-    r("MODEL_REASONING_EFFORT_LEVELS", "modelPlane", "csv", "openai 端点接受的思考档集(高档 clamp-down 不 422;anthropic 腿不需要)"),
+    r("MODEL_REASONING_EFFORT_LEVELS", "modelPlane", "csv", "openai 端点接受的思考档集(六档子集;高档 clamp-down 不 422;anthropic 腿不铸此键;未知词拒启)", {
+        derivedDefaultNote: "缺席 ⇒ 不铸 compat,core 走保守梯(minimal|low|medium|high),xhigh/max 被 clamp 下来",
+        resolve: (c) => {
+            const compat = c.model.compat;
+            if (compat === undefined || !("reasoningEffortLevels" in compat))
+                return null;
+            return compat.reasoningEffortLevels ?? null;
+        },
+    }),
     r("MODEL_ROUTER_ID", "modelPlane", "string", "leader 路由分类模型覆写", { derivedDefaultNote: "缺席 ⇒ MODEL_CHEAP_ID,再退 default", danger: BILL }),
     r("MODEL_VERIFIER", "modelPlane", "string", "verify 门的异构 verifier(须命中目录;typo 回 default 并 boot warn=自评自批)", { derivedDefaultNote: "缺席/不在目录 ⇒ default(=implementer,去相关性失效警告)" }),
     r("MODEL_VISION", "modelPlane", "boolean", "主模型 vision 声明(false 让 model_no_vision 预检真拦)", { staticDefault: "true", resolve: (c) => (Array.isArray(c.model.input) ? c.model.input.includes("image") : true), center: cModels("models[].vision") }),
@@ -286,6 +294,7 @@ export const CONFIG_CATALOG = [
     r("OTEL_EXPORTER_OTLP_HEADERS", "observability", "secret", "OTLP 出口头(k=v CSV;常载鉴权头 ⇒ 按凭据处置)", { danger: SEC }),
     r("OTEL_EXPORT_INTERVAL_MS", "observability", "number", "OTLP 批报周期(ms)", { staticDefault: "15000" }),
     r("OTEL_SERVICE_NAME", "observability", "string", "OTLP service.name", { staticDefault: "sema-server" }),
+    r("PERMISSIONS_DISABLE_AUTO_MODE", "approval", "boolean", "auto 模式本地 org deny(CC/center/settings 键名 permissions.disableAutoMode 的 env 腿;tighten-only:每 principal caps.autoMode 折 false,center 授予翻不回;未设=不动 caps;词表外拒启)", { staticDefault: "false", danger: SEC, configKey: "permissionsDisableAutoMode", center: { domain: "permissions", path: "disableAutoMode", centerKey: "permissions.disableAutoMode", precedence: "env-wins", timing: "inert" } }),
     r("PERMISSION_RULES_ENABLED", "approval", "boolean", "持久化权限规则车道总开关(撤销面已建 ⇒ 默认 ON)", { staticDefault: "true", danger: SEC, configKey: "permissionRulesEnabled" }),
     r("PG_DATABASE", "store", "string", "PostgreSQL 库名", { danger: DATA }),
     r("PG_HOST", "store", "string", "PostgreSQL 主机(在场即算 SQL 信号)", { danger: DATA }),
@@ -361,7 +370,7 @@ export const CONFIG_CATALOG = [
     r("SERVICE_AUTH_TOKEN", "auth", "secret", "共享 service token(写面门;缺席且未开 ALLOW_UNAUTHED_WRITES ⇒ 拒提交)", { danger: SEC }),
     r("SERVICE_AUTH_TOKENS", "auth", "secret", "per-system 凭据表(tok=system CSV;source 从凭据派生,绝不自报)", { danger: SEC }),
     r("SESSION_AUTO_TITLE", "orchestration", "boolean", "首次提交自动铸 session 标题(一次 cheap 调用)", { staticDefault: "true", danger: BILL, configKey: "sessionAutoTitle" }),
-    r("SESSION_BACKEND", "store", "enum", "session 店引擎(auto=探到 DB 用 DB,探不到回内存)", { enumValues: ["memory", "mysql", "auto"], danger: DATA, derivedDefaultNote: "缺席:显式 DB_BACKEND=mysql|pg ⇒ mysql,否则 memory", configKey: "sessionBackend", resolve: (c) => c.sessionBackend }),
+    r("SESSION_BACKEND", "store", "enum", "session 店引擎(auto=探到 DB 用 DB,探不到回内存;回显=boot 解析后的真引擎)", { enumValues: ["memory", "mysql", "auto"], danger: DATA, derivedDefaultNote: "缺席:显式 DB_BACKEND=mysql|pg ⇒ mysql,否则 memory", configKey: "sessionBackend", resolve: (c) => (c.sessionBackend === "tidb" ? "mysql" : c.sessionBackend) }),
     r("SESSION_CACHE_TTL_SEC", "store", "number", "session 读缓存 TTL(秒;0=关)", { staticDefault: "300", configKey: "sessionCacheTtlSec" }),
     r("SESSION_EVENTS_HOT_MS", "limitsHttp", "number", "session SSE 订阅热探针间隔(ms)", { derivedDefaultNote: "缺席 ⇒ 200" }),
     r("SESSION_EVENTS_MAX_CONNS", "limitsHttp", "number", "session SSE 并发连接帽", { derivedDefaultNote: "缺席 ⇒ 256" }),
@@ -391,12 +400,12 @@ export const CONFIG_CATALOG = [
     r("STREAM_APPROVAL_RECONCILE_BATCH", "approval", "number", "对账收敛器每 tick 每段行数帽(整数)", { staticDefault: "200" }),
     r("STREAM_APPROVAL_REPLAY_MAX", "approval", "number", "开流 preamble 重放帽", { staticDefault: "50" }),
     r("STREAM_ASK_WINDOW_MARGIN_MS", "approval", "number", "审批窗长三元安全余量(ms)", { staticDefault: "10000", configKey: "streamAskWindowMarginMs" }),
-    r("STREAM_ASK_WINDOW_MS", "approval", "number", "流内 ask 窗长(ms)", { staticDefault: "300000" }),
+    r("STREAM_ASK_WINDOW_MS", "approval", "number", "活卡审批窗长(ms;所有腿生效,与流内协议上不上场无关;0=关窗⇒不发卡恒走无人值守终局;负值与超 Node 定时器上界 2147483647 的值拒启)", { staticDefault: "300000" }),
     r("SYNC_IMPORT_LEASE_STALE_SEC", "memory", "number", "session-sync staged import 租约陈旧阈(秒)", { staticDefault: "600", configKey: "syncImportLeaseStaleSec" }),
     r("TASK_MAX_OUTPUT_TOKENS_MAX", "limitsHttp", "number", "调用方自报 limits.maxOutputTokens 的运营方封顶(Math.min 钳显式请求值;坏值=封顶不生效+响亮 warn)", { danger: BILL, derivedDefaultNote: "缺席 ⇒ 不封顶" }),
     r("TASK_MAX_TURNS_MAX", "limitsHttp", "number", "调用方自报 limits.maxTurns 的运营方封顶(同族三旋钮;只钳显式请求值,不是全队默认限额)", { danger: BILL, derivedDefaultNote: "缺席 ⇒ 不封顶" }),
     r("TASK_TIMEOUT_MAX_SEC", "limitsHttp", "number", "调用方自报 limits.timeoutSec 的运营方封顶(同族三旋钮)", { danger: BILL, derivedDefaultNote: "缺席 ⇒ 不封顶" }),
-    r("TASK_TIMEOUT_SEC", "limitsHttp", "number", "任务墙钟超时(秒;0=关)", { staticDefault: "0" }),
+    r("TASK_TIMEOUT_SEC", "limitsHttp", "number", "任务墙钟超时(秒);0/缺席=按 tenancy(单用户无墙;多租户 2400s、大任务 3600s);正值**只抬不降**(Math.max 基值);负值拒启", { staticDefault: "0", derivedDefaultNote: "0/缺席 ⇒ 单用户无墙、多租户 2400/3600s;要低于基值的配速请用 body.limits.maxWalltimeMs" }),
     r("TOOL_APPROVAL_ENABLED", "approval", "boolean", "活体工具审批 HITL(onAsk 装配;关 ⇒ core resolveAsk 走 headless 缺省)", { danger: SEC, derivedDefaultNote: "posture 三态:显式词恒赢,缺席 = 单用户(REQUIRE_PRINCIPAL≠true)⇒ on / 多租户 ⇒ off", configKey: "toolApprovalEnabled" }),
     r("TOOL_DEFER_LONGTAIL", "orchestration", "boolean", "长尾一方工具 defer 呈现(实验)", { staticDefault: "false", configKey: "toolDeferLongtail" }),
     r("TOOL_RESULT_TTL_SEC", "limitsHttp", "number", "工具结果店 TTL(秒)", { staticDefault: "86400", danger: DATA, configKey: "toolResultTtlSec", center: cLimits("toolResultTtlSec") }),

package/dist/config-center/types.d.ts

@@ -103,7 +103,8 @@ export interface CenterMcpServer {
      * 所以它的家在 center 下发这条腿;请求腿那半场的门与结构性兑现见 `task-mcp.ts`
      * 的 `assertRequestMcpContentOrigin` 顶注。
      *
-     * ⚠️ **两条腿今天都到不了这里**([ref]③ / [ref]③ / [ref],2026-08-31 双绊线实测更正 —— 本注旧版那句
+     * ✅ **两条腿已通**([ref],settings-schema 1.4.0 补键 + config-provider 映射行,2026-09-02;双绊线翻正销账)。
+     * 病史([ref]③ / [ref]③ / [ref],2026-08-31 双绊线实测更正 —— 本注更旧版那句
      * 「远端 /effective.mcp 腿是直读 JSON,今天就通」**不成立**,doc-rot):settings-schema(原 registry-core)
      * 的 `McpServerSpec` 是默认 strip 的 zod object 且没有 `contentOrigin` 可选键,本地腿在 FileConfigStore 的
      * `parseDomainLoud(DOMAIN_SCHEMAS.mcp)`、远端腿在消费端边界 `readEffectiveWire`([ref] 裁B)**各被剥一次**。

package/dist/config-provider.js

@@ -145,6 +145,7 @@ export function mapToServiceEffective(eff, version) {
                     enabled: s.enabled,
                     ...(s.allowTools !== undefined ? { allowTools: s.allowTools } : {}),
                     ...(s.elicitation !== undefined ? { elicitation: s.elicitation } : {}),
+                    ...(s.contentOrigin !== undefined ? { contentOrigin: s.contentOrigin } : {}),
                 };
                 if (s.transport.kind === "stdio") {
                     return {