@sema-agent/server 7.56.0 → 7.57.0

package/dist/boot/runtime-caps.js

@@ -1,24 +1,42 @@
-import { applyMemoryOptOutGrant, applyObserverEnvOptIn, centerEntitlementSourceWired, createPrincipalEntitlementsClient, scopedTokenNeedsWorker, } from "../runtime-caps-resolver.js";
+import { applyGovernedVerdictAbsenceWarning, applyLocalAutoModeDeny, applyMemoryOptOutGrant, applyObserverEnvOptIn, centerEntitlementSourceWired, createPrincipalEntitlementsClient, scopedTokenNeedsWorker, } from "../runtime-caps-resolver.js";
 export function assertMemoryCapturePolicyWirable(input) {
     if (input.policy !== "governed")
         return;
     if (input.grantSourceWired)
         return;
-    if (input.centerEntitlementPresent === true)
+    if (input.centerEntitlementSourceWired === true)
         return;
     throw new Error(`MEMORY_CAPTURE_POLICY=governed requires a per-principal memory opt-out verdict source, and this deployment wires NONE ` +
         `— under "governed" core REFUSES every session memory-capture opt-out whose verdict is absent (fail-closed, the posture's ` +
         `own contract), so a governed worker without a source would refuse every \`memory.capture:"off"\` declaration and the ` +
-        `refusal would read as an entitlement denial rather than the misconfiguration it is. The only verdict source in this ` +
-        `version is the \`memory_optout_grant\` table on a SQL store backend (DB_BACKEND=mysql|pg; the table is created by the ` +
-        `central ensureSchema and administered through /v1/admin/memory-optout). Wire a SQL backend, or set ` +
-        `MEMORY_CAPTURE_POLICY=open (opt-outs take effect; only an explicit per-principal false denies) or ` +
+        `refusal would read as an entitlement denial rather than the misconfiguration it is. This version has TWO verdict sources ` +
+        `— wire either one: (1) the \`memory_optout_grant\` table on a SQL store backend (DB_BACKEND=mysql|pg; the table is ` +
+        `created by the central ensureSchema and administered through /v1/admin/memory-optout), or (2) a config center that ` +
+        `EMITS \`allowMemoryOptOut\` in each principal's entitlement caps (SEMA_REGISTRY_URL + SEMA_REGISTRY_TOKEN, ` +
+        `SEMA_REGISTRY_DRY_RUN off — dry-run observes without applying, so it is not a source; and note the key is OPTIONAL in ` +
+        `the entitlement schema: a center that never emits it leaves every verdict absent, i.e. every opt-out still refused). ` +
+        `Or set MEMORY_CAPTURE_POLICY=open (opt-outs take effect; only an explicit per-principal false denies) or ` +
         `MEMORY_CAPTURE_POLICY=capture-required (every opt-out declaration refused, no source consulted).`);
 }
+function memoryVerdictAbsenceEffect(reason) {
+    switch (reason) {
+        case "anonymous_lane":
+            return 'an ANONYMOUS/system run (no principal) resolved no allowMemoryOptOut — the center entitlement source is per-principal and is never consulted without an identity, so on a center-only deployment the principal-less lane can NEVER obtain a verdict and core refuses every anonymous memory.capture:"off" (memory.capture_optout_denied). Only the local memory_optout_grant table answers for anonymous runs (its deployment-default row). One-shot per process.';
+        case "center_verdict_absent":
+            return 'governed posture, center-only verdict source, and this resolve produced NO allowMemoryOptOut for a NAMED principal (the center omitted the optional entitlement key, or the caps fetch degraded fail-closed) ⇒ core refuses that principal\'s memory.capture:"off" declarations (memory.capture_optout_denied). One-shot per process.';
+    }
+}
 export function createRuntimeCaps(ctx) {
     const { config, logger } = ctx;
-    assertMemoryCapturePolicyWirable({ policy: config.memoryCapturePolicy, grantSourceWired: ctx.memoryOptOutGrant !== undefined, centerEntitlementPresent: Boolean(config.configCenter && !config.configCenter.dryRun) });
-    if (config.configCenter && !config.configCenter.dryRun && scopedTokenNeedsWorker(config.configCenter.token, config.configCenter.worker)) {
+    const grantSourceWired = ctx.memoryOptOutGrant !== undefined;
+    assertMemoryCapturePolicyWirable({ policy: config.memoryCapturePolicy, grantSourceWired, centerEntitlementSourceWired: centerEntitlementSourceWired(config) });
+    const governedCenterOnlySource = config.memoryCapturePolicy === "governed" && !grantSourceWired && centerEntitlementSourceWired(config);
+    if (governedCenterOnlySource) {
+        logger.warn("memory_capture_governed_center_only_source", {
+            reason: "MEMORY_CAPTURE_POLICY=governed with NO local memory_optout_grant table: the only verdict source is the config center, and `allowMemoryOptOut` is an OPTIONAL entitlement key — for any principal whose caps omit it the verdict is ABSENT and core refuses that session's memory.capture:\"off\" (memory.capture_optout_denied, fail-closed). ANONYMOUS/system runs are worse off still: the center source is per-principal and is never consulted without an identity, so on this shape a principal-less run can never obtain a verdict at all. Verify the center emits allowMemoryOptOut for every principal, or wire a SQL backend (DB_BACKEND=mysql|pg) so the grant table answers (its deployment-default row also covers anonymous runs).",
+        });
+    }
+    if (centerEntitlementSourceWired(config) && config.configCenter && scopedTokenNeedsWorker(config.configCenter.token, config.configCenter.worker)) {
         logger.warn("runtime_caps_scoped_token_no_worker", {
             reason: "SEMA_REGISTRY_TOKEN is a worker-scoped wpt_ token but SEMA_REGISTRY_WORKER is unset → center 403s per-principal caps → ALL workflow self-orchestration will be fail-closed denied. Set SEMA_REGISTRY_WORKER (the orchestrator normally injects it) or use the full SERVICE_PULL_TOKEN.",
         });
@@ -32,18 +50,28 @@ export function createRuntimeCaps(ctx) {
         })
         : undefined;
     const centerRuntimeCapsResolver = principalCaps?.resolveRuntimeCaps;
-    const withObservers = applyObserverEnvOptIn(centerRuntimeCapsResolver, {
-        experimentalObserverAgents: config.experimentalObserverAgents,
-        requirePrincipal: config.requirePrincipal,
-        warn: (msg, fields) => logger.warn(msg, fields),
-    });
-    const runtimeCapsResolver = applyMemoryOptOutGrant(withObservers, ctx.memoryOptOutGrant, {
-        onFault: (err, principal) => logger.warn("memory_optout_grant_resolve_failed", {
-            principal,
-            err: String(err),
-            effect: "allowMemoryOptOut left ABSENT for this resolve (never coined as false): open posture ⇒ the opt-out takes effect; governed ⇒ core refuses the run (verdict absent)",
-        }),
-    });
-    return { principalCaps, centerRuntimeCapsResolver, runtimeCapsResolver };
+    const compose = (base, observability) => {
+        const withObservers = applyObserverEnvOptIn(base, {
+            experimentalObserverAgents: config.experimentalObserverAgents,
+            requirePrincipal: config.requirePrincipal,
+            ...(observability ? { warn: (msg, fields) => logger.warn(msg, fields) } : {}),
+        });
+        const withMemoryGrant = applyMemoryOptOutGrant(withObservers, ctx.memoryOptOutGrant, {
+            onFault: (err, principal) => logger.warn("memory_optout_grant_resolve_failed", {
+                principal,
+                err: String(err),
+                ...(observability ? {} : { face: "capabilities-read" }),
+                effect: "allowMemoryOptOut left ABSENT for this resolve (never coined as false): open posture ⇒ the opt-out takes effect; governed ⇒ core refuses the run (verdict absent)",
+            }),
+        });
+        const withLocalAutoModeDeny = applyLocalAutoModeDeny(withMemoryGrant, config.permissionsDisableAutoMode);
+        return applyGovernedVerdictAbsenceWarning(withLocalAutoModeDeny, {
+            enabled: observability && governedCenterOnlySource,
+            warn: (reason, principal) => logger.warn("memory_capture_governed_verdict_absent", { principal, reason, effect: memoryVerdictAbsenceEffect(reason) }),
+        });
+    };
+    const runtimeCapsResolver = compose(centerRuntimeCapsResolver, true);
+    const runtimeCapsPeekResolver = compose(principalCaps?.peekRuntimeCaps, false);
+    return { principalCaps, centerRuntimeCapsResolver, runtimeCapsResolver, runtimeCapsPeekResolver };
 }
 //# sourceMappingURL=runtime-caps.js.map

package/dist/boot/session-shell-gate-registry.d.ts

@@ -0,0 +1,39 @@
+/**
+ * [ref] 件⑤(core PM 三仓扫查 [ref] server 条 ③,并入 [ref])—— 「本 run 是否**显式**声明了 bypassPermissions」的
+ * per-session 登记簿,供 `boot/runner-deps.ts` 的 `onError(phase:"config")` 汇点给 core 的 `shell-gate-off`
+ * 忠告定级。
+ *
+ * ## 为什么需要它
+ * core 在「shell 门 doctrine=off ∧ 挂了真可写 Bash」时经 `onError(phase:"config", classification:"shell-gate-off")`
+ * 发一条忠告(`prepare-hands-readface.js`),但它分不清 off 是**调用方显式选的**(server 把 `permissionMode:
+ * "bypassPermissions"` 翻成 `shellGate:"off"`,[ref] 表)还是**没表态落到 core 默认**(无壳直连部署,真值得
+ * 一条 warn)。这正是真实用户提案里「bypass 下照打 shell gate doctrine is off 告警」的根:正常态被当异常打。
+ * 汇点只拿到 `ctx.sessionId`,而生效模式是 server 在 resolve-spec 阶段④ 单点算出的(`effectivePermissionMode`),
+ * 所以由 resolve-spec 在算出 effMode 的那一行登记、汇点按 sessionId 回查。
+ *
+ * ## 键
+ * `auth.sessionId`:authorizer 在服务路径上**恒**铸 session id(`security.ts` `uuidv7()`,core 的无 sessionId
+ * 分支在服务路径不可达),且 spec.sessionId = 同一值 ⇒ core 回调的 `ctx.sessionId` 与登记键同源。
+ * 缺 authorizer 的裸装配(测试桩)拿不到键 ⇒ 不登记 ⇒ 汇点按「未声明」处理 = 仍 warn(退化方向=多一条告警,
+ * 不是少一条)。
+ *
+ * ## 已知界(codex r2 [medium],登记不修:属主在 core 回调契约)
+ * 键是 session 而非**执行**:同 session 并发第二次提交在 resolveSpec 后才被 409 拒,其登记已覆盖前一次——若被拒的
+ * 那次是 bypass 而在跑的那次不是,且忠告恰在这一窗内发出,则一条本该 warn 的 `shell-gate-off` 被降成 info(仍整行
+ * 落日志、字段齐全,执法零变)。窗 = 在跑 run 的 resolveSpec 到其 prepare 期忠告之间(毫秒级,且要同 session 并发
+ * 提交 + 模式相反)。执行唯一的归因需要 core 回调 `ctx` 带 taskId / shellGate 出处(已作 core 侧诉求登记),
+ * 到货后本簿退役。
+ *
+ * ## 界
+ * 有界 Map(插入序淘汰,默认 10k 条,与 caps 缓存同量级):session id 是开集,长命 worker 不能无界累积。
+ * 淘汰掉的旧会话再来忠告时同样回落「未声明」⇒ warn(同一退化方向)。每次 resolve 覆写(同 session 后一轮改
+ * 模式时以最近一轮为准;续跑四条 rebuild 腿都经 resolveSpec ⇒ 同律登记)。
+ */
+export interface SessionShellGateRegistry {
+    /** resolve-spec 阶段④:登记本 session 这一轮是否显式声明 bypassPermissions(= server 翻成 shellGate:"off")。 */
+    note(sessionId: string | undefined, explicitOff: boolean): void;
+    /** runner-deps 汇点:本 session 最近一轮是否显式声明了 off。未登记/已淘汰 ⇒ false(退化=照 warn)。 */
+    explicitlyOff(sessionId: string): boolean;
+}
+export declare function createSessionShellGateRegistry(cap?: number): SessionShellGateRegistry;
+//# sourceMappingURL=session-shell-gate-registry.d.ts.map

package/dist/boot/session-shell-gate-registry.js

@@ -0,0 +1,21 @@
+export function createSessionShellGateRegistry(cap = 10_000) {
+    const off = new Map();
+    return {
+        note(sessionId, explicitOff) {
+            if (sessionId === undefined)
+                return;
+            if (off.has(sessionId))
+                off.delete(sessionId);
+            else if (off.size >= cap) {
+                const oldest = off.keys().next();
+                if (!oldest.done)
+                    off.delete(oldest.value);
+            }
+            off.set(sessionId, explicitOff);
+        },
+        explicitlyOff(sessionId) {
+            return off.get(sessionId) === true;
+        },
+    };
+}
+//# sourceMappingURL=session-shell-gate-registry.js.map

package/dist/config-catalog.js

@@ -254,7 +254,7 @@ export const CONFIG_CATALOG = [
     r("MODEL_COST_CACHE_WRITE", "modelPlane", "number", "主模型 cache-write 单价", { staticDefault: "0", danger: BILL, resolve: (c) => c.model.cost?.cacheWrite ?? null, center: cModels("models[].cost.cacheWrite") }),
     r("MODEL_COST_INPUT", "modelPlane", "number", "主模型 input 单价(NaN 会让成本天花板整条消失 ⇒ 坏值拒启)", { staticDefault: "0", danger: BILL, resolve: (c) => c.model.cost?.input ?? null, center: cModels("models[].cost.input") }),
     r("MODEL_COST_OUTPUT", "modelPlane", "number", "主模型 output 单价", { staticDefault: "0", danger: BILL, resolve: (c) => c.model.cost?.output ?? null, center: cModels("models[].cost.output") }),
-    r("MODEL_DEFAULT_THINKING", "modelPlane", "enum", "主模型默认思考档(llm-core ThinkingLevel,无 off)", { enumValues: ["minimal", "low", "medium", "high", "max"] }),
+    r("MODEL_DEFAULT_THINKING", "modelPlane", "enum", "主模型默认思考档(llm-core ThinkingLevel;off=不设模型级默认;未知词拒启)", { enumValues: ["minimal", "low", "medium", "high", "xhigh", "max", "off"], derivedDefaultNote: "缺席/off ⇒ 不铸 defaultThinking(逐任务档由 spec>role 决定)", resolve: (c) => c.model.defaultThinking ?? null }),
     r("MODEL_DEGRADE_AT_COST_FRACTION", "modelPlane", "number", "预算降级触发比(spent/budget;>1=实际别降级)", { staticDefault: "0.7", danger: BILL }),
     r("MODEL_DEGRADE_ON", "modelPlane", "csv", "反应式降级触发词表(core DegradeReason 全集;拼错拒启)", { center: { domain: "models", path: "degrade", centerKey: "models", precedence: "center-wins", timing: "restart", restartSlice: "degrade-route" } }),
     r("MODEL_DEGRADE_REACTIVE", "modelPlane", "boolean", "反应式降级开关(degrade-route 重启片只在它开时活)", { staticDefault: "false", center: { domain: "models", path: "degrade", centerKey: "models", precedence: "center-wins", timing: "restart", restartSlice: "degrade-route" } }),
@@ -271,7 +271,15 @@ export const CONFIG_CATALOG = [
     r("MODEL_PRESENCE_PENALTY", "modelPlane", "number", "presence_penalty 直通"),
     r("MODEL_PROVIDER", "modelPlane", "string", "主模型 provider(路由选 brain)", { derivedDefaultNote: "缺席:ANTHROPIC base+cred 同在 ⇒ anthropic,否则 gateway", resolve: (c) => c.model.provider, center: cModels("models[].provider") }),
     r("MODEL_REASONING", "modelPlane", "boolean", "主模型 reasoning 声明", { staticDefault: "true", resolve: (c) => c.model.reasoning ?? null, center: cModels("models[].reasoning") }),
-    r("MODEL_REASONING_EFFORT_LEVELS", "modelPlane", "csv", "openai 端点接受的思考档集(高档 clamp-down 不 422;anthropic 腿不需要)"),
+    r("MODEL_REASONING_EFFORT_LEVELS", "modelPlane", "csv", "openai 端点接受的思考档集(六档子集;高档 clamp-down 不 422;anthropic 腿不铸此键;未知词拒启)", {
+        derivedDefaultNote: "缺席 ⇒ 不铸 compat,core 走保守梯(minimal|low|medium|high),xhigh/max 被 clamp 下来",
+        resolve: (c) => {
+            const compat = c.model.compat;
+            if (compat === undefined || !("reasoningEffortLevels" in compat))
+                return null;
+            return compat.reasoningEffortLevels ?? null;
+        },
+    }),
     r("MODEL_ROUTER_ID", "modelPlane", "string", "leader 路由分类模型覆写", { derivedDefaultNote: "缺席 ⇒ MODEL_CHEAP_ID,再退 default", danger: BILL }),
     r("MODEL_VERIFIER", "modelPlane", "string", "verify 门的异构 verifier(须命中目录;typo 回 default 并 boot warn=自评自批)", { derivedDefaultNote: "缺席/不在目录 ⇒ default(=implementer,去相关性失效警告)" }),
     r("MODEL_VISION", "modelPlane", "boolean", "主模型 vision 声明(false 让 model_no_vision 预检真拦)", { staticDefault: "true", resolve: (c) => (Array.isArray(c.model.input) ? c.model.input.includes("image") : true), center: cModels("models[].vision") }),
@@ -286,6 +294,7 @@ export const CONFIG_CATALOG = [
     r("OTEL_EXPORTER_OTLP_HEADERS", "observability", "secret", "OTLP 出口头(k=v CSV;常载鉴权头 ⇒ 按凭据处置)", { danger: SEC }),
     r("OTEL_EXPORT_INTERVAL_MS", "observability", "number", "OTLP 批报周期(ms)", { staticDefault: "15000" }),
     r("OTEL_SERVICE_NAME", "observability", "string", "OTLP service.name", { staticDefault: "sema-server" }),
+    r("PERMISSIONS_DISABLE_AUTO_MODE", "approval", "boolean", "auto 模式本地 org deny(CC/center/settings 键名 permissions.disableAutoMode 的 env 腿;tighten-only:每 principal caps.autoMode 折 false,center 授予翻不回;未设=不动 caps;词表外拒启)", { staticDefault: "false", danger: SEC, configKey: "permissionsDisableAutoMode", center: { domain: "permissions", path: "disableAutoMode", centerKey: "permissions.disableAutoMode", precedence: "env-wins", timing: "inert" } }),
     r("PERMISSION_RULES_ENABLED", "approval", "boolean", "持久化权限规则车道总开关(撤销面已建 ⇒ 默认 ON)", { staticDefault: "true", danger: SEC, configKey: "permissionRulesEnabled" }),
     r("PG_DATABASE", "store", "string", "PostgreSQL 库名", { danger: DATA }),
     r("PG_HOST", "store", "string", "PostgreSQL 主机(在场即算 SQL 信号)", { danger: DATA }),
@@ -361,7 +370,7 @@ export const CONFIG_CATALOG = [
     r("SERVICE_AUTH_TOKEN", "auth", "secret", "共享 service token(写面门;缺席且未开 ALLOW_UNAUTHED_WRITES ⇒ 拒提交)", { danger: SEC }),
     r("SERVICE_AUTH_TOKENS", "auth", "secret", "per-system 凭据表(tok=system CSV;source 从凭据派生,绝不自报)", { danger: SEC }),
     r("SESSION_AUTO_TITLE", "orchestration", "boolean", "首次提交自动铸 session 标题(一次 cheap 调用)", { staticDefault: "true", danger: BILL, configKey: "sessionAutoTitle" }),
-    r("SESSION_BACKEND", "store", "enum", "session 店引擎(auto=探到 DB 用 DB,探不到回内存)", { enumValues: ["memory", "mysql", "auto"], danger: DATA, derivedDefaultNote: "缺席:显式 DB_BACKEND=mysql|pg ⇒ mysql,否则 memory", configKey: "sessionBackend", resolve: (c) => c.sessionBackend }),
+    r("SESSION_BACKEND", "store", "enum", "session 店引擎(auto=探到 DB 用 DB,探不到回内存;回显=boot 解析后的真引擎)", { enumValues: ["memory", "mysql", "auto"], danger: DATA, derivedDefaultNote: "缺席:显式 DB_BACKEND=mysql|pg ⇒ mysql,否则 memory", configKey: "sessionBackend", resolve: (c) => (c.sessionBackend === "tidb" ? "mysql" : c.sessionBackend) }),
     r("SESSION_CACHE_TTL_SEC", "store", "number", "session 读缓存 TTL(秒;0=关)", { staticDefault: "300", configKey: "sessionCacheTtlSec" }),
     r("SESSION_EVENTS_HOT_MS", "limitsHttp", "number", "session SSE 订阅热探针间隔(ms)", { derivedDefaultNote: "缺席 ⇒ 200" }),
     r("SESSION_EVENTS_MAX_CONNS", "limitsHttp", "number", "session SSE 并发连接帽", { derivedDefaultNote: "缺席 ⇒ 256" }),
@@ -391,12 +400,12 @@ export const CONFIG_CATALOG = [
     r("STREAM_APPROVAL_RECONCILE_BATCH", "approval", "number", "对账收敛器每 tick 每段行数帽(整数)", { staticDefault: "200" }),
     r("STREAM_APPROVAL_REPLAY_MAX", "approval", "number", "开流 preamble 重放帽", { staticDefault: "50" }),
     r("STREAM_ASK_WINDOW_MARGIN_MS", "approval", "number", "审批窗长三元安全余量(ms)", { staticDefault: "10000", configKey: "streamAskWindowMarginMs" }),
-    r("STREAM_ASK_WINDOW_MS", "approval", "number", "流内 ask 窗长(ms)", { staticDefault: "300000" }),
+    r("STREAM_ASK_WINDOW_MS", "approval", "number", "活卡审批窗长(ms;所有腿生效,与流内协议上不上场无关;0=关窗⇒不发卡恒走无人值守终局;负值与超 Node 定时器上界 2147483647 的值拒启)", { staticDefault: "300000" }),
     r("SYNC_IMPORT_LEASE_STALE_SEC", "memory", "number", "session-sync staged import 租约陈旧阈(秒)", { staticDefault: "600", configKey: "syncImportLeaseStaleSec" }),
     r("TASK_MAX_OUTPUT_TOKENS_MAX", "limitsHttp", "number", "调用方自报 limits.maxOutputTokens 的运营方封顶(Math.min 钳显式请求值;坏值=封顶不生效+响亮 warn)", { danger: BILL, derivedDefaultNote: "缺席 ⇒ 不封顶" }),
     r("TASK_MAX_TURNS_MAX", "limitsHttp", "number", "调用方自报 limits.maxTurns 的运营方封顶(同族三旋钮;只钳显式请求值,不是全队默认限额)", { danger: BILL, derivedDefaultNote: "缺席 ⇒ 不封顶" }),
     r("TASK_TIMEOUT_MAX_SEC", "limitsHttp", "number", "调用方自报 limits.timeoutSec 的运营方封顶(同族三旋钮)", { danger: BILL, derivedDefaultNote: "缺席 ⇒ 不封顶" }),
-    r("TASK_TIMEOUT_SEC", "limitsHttp", "number", "任务墙钟超时(秒;0=关)", { staticDefault: "0" }),
+    r("TASK_TIMEOUT_SEC", "limitsHttp", "number", "任务墙钟超时(秒);0/缺席=按 tenancy(单用户无墙;多租户 2400s、大任务 3600s);正值**只抬不降**(Math.max 基值);负值拒启", { staticDefault: "0", derivedDefaultNote: "0/缺席 ⇒ 单用户无墙、多租户 2400/3600s;要低于基值的配速请用 body.limits.maxWalltimeMs" }),
     r("TOOL_APPROVAL_ENABLED", "approval", "boolean", "活体工具审批 HITL(onAsk 装配;关 ⇒ core resolveAsk 走 headless 缺省)", { danger: SEC, derivedDefaultNote: "posture 三态:显式词恒赢,缺席 = 单用户(REQUIRE_PRINCIPAL≠true)⇒ on / 多租户 ⇒ off", configKey: "toolApprovalEnabled" }),
     r("TOOL_DEFER_LONGTAIL", "orchestration", "boolean", "长尾一方工具 defer 呈现(实验)", { staticDefault: "false", configKey: "toolDeferLongtail" }),
     r("TOOL_RESULT_TTL_SEC", "limitsHttp", "number", "工具结果店 TTL(秒)", { staticDefault: "86400", danger: DATA, configKey: "toolResultTtlSec", center: cLimits("toolResultTtlSec") }),

package/dist/config-types.d.ts

@@ -145,16 +145,36 @@ export interface A2aServeConfig {
  *  the default base ref) live here so image-api injects only VETTED, server-fixed values into the build.sh argv —
  *  operator free-text never reaches the runner. */
 /** [ref] 车3([ref] 流内审批协议)的配置面。总开关默认 **true**(clay 裁 2026-08-08,[ref] 翻真验证后;
- *  树上已生效,发布线落在 7.4.0 之后的下一个发布);四个从属旋钮只在开关为真时生效
+ *  树上已生效,发布线落在 7.4.0 之后的下一个发布);从属旋钮**除 `windowMs` 外**只在开关为真时生效
+ *  ([ref]:`STREAM_ASK_WINDOW_MS` 是活卡窗长,与协议上不上场解耦 —— 逐条辖域见各字段域注)
  *  (语义与「谁需要 / 谁被伤 / 什么补偿」三问见 `ServiceConfigFlat.streamApproval` 的注)。 */
 export interface StreamApprovalConfig {
     /** 协议总开关。`STREAM_APPROVAL_ENABLED`,默认 **true**(clay 裁 2026-08-08,[ref] 翻真验证后;7.5.0 起)。显式 false ⇒ 全链逐字 7.3.0 前行为(唯一干净还原键)。
      *  翻真要等回决端点(车4)与对账收敛器(车5)到位——在此之前是个不完整协议(有卡无正规回决口、
      *  有 PARKING 无收敛器、跨副本回决无唤醒路径)。 */
     enabled: boolean;
-    /** 开关为真时作为 `ToolApprovalCoordinator` 的 `ttlMs`([ref] §3.3 的「配置窗默认」)。
-     *  `STREAM_ASK_WINDOW_MS`,默认 **300000**(同裁与 sync 腿既有 5min 活卡窗对齐)。`0` = 运维显式关窗 ⇒ 恒 park(§3.3 窗=0 语义)。
-     *  开关为假 ⇒ 本值不参与,窗保持既有 `DEFAULT_APPROVAL_TTL_MS`(5min)。 */
+    /** `ToolApprovalCoordinator` 的 `ttlMs` —— **一只活卡等人多久**([ref] §3.3 的「配置窗默认」)。
+     *  `STREAM_ASK_WINDOW_MS`,默认 **300000**(同裁与 sync 腿既有 5min 活卡窗对齐)。
+     *
+     *  🔴 **辖域([ref] 起):无条件** —— 本值在**每一条**呈活卡的腿上生效,与流内协议上不上场无关
+     *  (`DB_BACKEND=local` / 无 park 设施 / `STREAM_APPROVAL_ENABLED=false` 的部署同样按它计窗)。
+     *  旧文「开关为假 ⇒ 本值不参与,窗保持既有 `DEFAULT_APPROVAL_TTL_MS`(5min)」是**已修的病**,不是
+     *  设计:那让一根部署级旋钮的生效与否挂在装配在场性上,运维配了它、没有任何一行说它没生效
+     *  (clay 令:部署级旋钮禁挂在场性派生腿)。缺省值与那个常量同为 300000 ⇒ **没配过这根 env 的部署
+     *  字节不变**;协议上不上场改变的是**持久层与协议帧**(ask 行 / 重放 / 迟到赎回),不是窗长。
+     *
+     *  `0` = 运维显式关窗 ⇒ **不发任何审批卡**,每只受门 ask 在铸造时刻直接走 `unattendedAskOutcome()`
+     *  (§3.3 窗=0 语义;[ref] 起两条车道同义 —— 此前 `0` 在协议不上场的腿上被静默读成「5min 活卡」)。
+     *  该形有 park 设施 ⇒ 全落 durable park(经 `POST /v1/approvals/:sessionId/decide` 兑现);无 park 设施
+     *  或 `UNATTENDED_APPROVAL_POLICY=deny` ⇒ core fail-closed 拒 = **受门工具全关**,故 boot 期有一行
+     *  `stream_ask_window_zero` 点名(`boot/coordinators.ts`)。
+     *  **坏值拒启两侧**([ref]):负值(`-1` 此前静默落成「立即到期」并白发一张没人赢得了的卡)与
+     *  **超过 Node 定时器上界 `2147483647`(2^31−1 ms ≈ 24.8 天)的值**(codex r1-[high]:`setTimeout` 把更大的
+     *  delay 静默折成 1ms ⇒ 想调长反而立即到期;跨旋钮门只管 `窗 + adhoc宽限 < orphanTtl`,而 orphanTtl 域上界
+     *  90 天,所以 30 天的窗此前合法通过)—— 两侧都点名拒启,不夹取。
+     *
+     *  窗到期的**去向**不由本键决定(`UNATTENDED_APPROVAL_POLICY` + park 设施在场性决定),本键只决定
+     *  「等多久」。悬挂 ask(零活流铸造,[ref] 案A)走的是 `unreachedTtlMs`,不是本键。 */
     windowMs: number;
     /** 开流重放(§5)每次最多投几张未决卡——**读面**的帽,超出只投最新的并记一次 warn,开流不失败。
      *  `STREAM_APPROVAL_REPLAY_MAX`,默认 **50**。 */
@@ -512,10 +532,12 @@ export interface ServiceConfigFlat {
      *  `open` 的故障极性**相反**,一个被静默折成缺省的拼写错误会让合规部署在故障窗里放行留存必需用户的 opt-out。
      *  core 侧 `prepareConfigDoors` 另有同判门(`config.memory_capture_policy`),两道同向不冲突。
      *
-     *  🔴 **`governed` 的半配置拒启**:该姿态要求本部署有 per-principal verdict 源。本批唯一源 = SQL 后端上的
-     *  `memory_optout_grant` 表(S-2;center 键 `EntitlementRuntimeCaps.allowMemoryOptOut` 是 settings-schema
-     *  的独立小件,到货前不算源)。governed 而无源 ⇒ 每个 opt-out 声明都被 core 拒且没人知道为什么 ⇒
+     *  🔴 **`governed` 的半配置拒启**:该姿态要求本部署有 per-principal verdict 源。源**两条**(析取,[ref] 起):
+     *  SQL 后端上的 `memory_optout_grant` 表(S-2),或非 dry-run 的 config center 发 `EntitlementRuntimeCaps.allowMemoryOptOut`
+     *  (settings-schema 1.4.0 到货)。两源皆无 ⇒ 每个 opt-out 声明都被 core 拒且没人知道为什么 ⇒
      *  `boot/runtime-caps.ts` 的 `assertMemoryCapturePolicyWirable` 在启动期拒启(与 consolidation 阀门 D1 同姿态)。
+     *  ⚠️ [ref]:center 那一臂只证「源在场」,不证 center 会**发**这个可选键 —— center-only 的部署起动后仍可能次次拒,
+     *  两处 warn 把它响亮化(`memory_capture_governed_center_only_source` / `memory_capture_governed_verdict_absent`)。
      *
      *  ⚠️ **部署席 ONLY**:TaskSpec 无同名键;不冻进 checkpoint(resume 腿跟当前部署配置走,core 成文)。
      *  运维读面 = `GET /v1/diagnostics/wiring` 的 `memoryPosture.capturePolicy`(`null`=本部署未设)。 */
@@ -1270,6 +1292,13 @@ export interface ServiceConfigFlat {
      *  other value (incl. `"off"`) is treated as unset — this knob has no "off" value to opt BACK OUT with once a
      *  session's baseline already tightened elsewhere (tightenTaskSpec would reject that as a loosen anyway). */
     manualModeShellGate?: "always" | "classify";
+    /** [ref] ③(黑板 [ref]/[ref],core [ref] 合修)—— CC `permissions.disableAutoMode` 的本地镜像
+     *  (`PERMISSIONS_DISABLE_AUTO_MODE`,布尔词表旋钮,opt-in 缺省 false):本部署对**每个** principal 把
+     *  `RuntimeCaps.autoMode` 折成 `false` = org deny 位(core [ref] 三态谓词 `runtimeCaps?.autoMode !== false`
+     *  的拒臂)。**tighten-only**:center 授予 `true` 翻不回;未设 = 不动 caps(无 center 的部署 caps 仍缺席 ⇒
+     *  「缺席=不阻」⇒ 壳发 `permissionMode:"auto"` 即武装)。词表外的值 boot 拒启(安全轴旋钮不许静默回默认)。
+     *  合成点 = `boot/runtime-caps.ts` 最外层(applyLocalAutoModeDeny);读面 = `/v1/capabilities.permissionModeAuto`。 */
+    permissionsDisableAutoMode: boolean;
     /** [ref]④ defer face (EXPERIMENTAL, default OFF): mark the default scenario's LONG-TAIL first-party tools
      *  (today = SelectEnvironment only) `defer:true` (core tool-disclosure: the model sees a placeholder until it
      *  ToolSearch-loads the schema). Assessment says the win is marginal for us (spec.tools total ≈4.2k tokens, of
@@ -1400,8 +1429,10 @@ export interface ServiceConfigFlat {
      *  `DEFAULT_APPROVAL_TTL_MS` 对齐——「开协议」不再顺带把窗砍短)。⚠️ 版本坐标:翻转**已在树上生效**,
      *  发布线上落在 7.4.0 之后的下一个发布,所以一台自报 7.4.0 的**已发布** worker 仍是 OFF,别只按
      *  `/health` 的版本号推默认。显式 `STREAM_APPROVAL_ENABLED=false` 是**唯一干净还原键** ⇒ 全链逐字回到
-     *  翻转前行为:不发 `approval_request` 帧、不落 `approval_ask` 行、不起收敛器腿、窗 = 既有
-     *  `DEFAULT_APPROVAL_TTL_MS`(5min)、`askStore` 不注入协调器。
+     *  翻转前行为:不发 `approval_request` 帧、不落 `approval_ask` 行、不起收敛器腿、`askStore` 不注入
+     *  协调器。⚠️ **窗不在这份还原清单里了([ref])**:`STREAM_ASK_WINDOW_MS` 自此在关协议的部署上照样
+     *  生效(缺省 300000 == `DEFAULT_APPROVAL_TTL_MS` ⇒ 没配过它的部署仍然字节不变),理由见
+     *  `StreamApprovalConfig.windowMs` 的辖域段。
      *
      *  **旋钮为什么存在(2026-08-08 翻转前的成文前提,已被上面的裁定取代,留作沿革)**:那一版默认 false +
      *  60s 窗,三问记的是那个世界——
@@ -1597,7 +1628,7 @@ export type ServiceStoreConfig = Pick<ServiceConfigFlat, "sessionBackend" | "ses
 export type ServiceModelPlaneConfig = Pick<ServiceConfigFlat, "gatewayBaseUrl" | "gatewayApiKey" | "gatewayFallbackUrls" | "gatewayMaxRetries" | "anthropic" | "resilience" | "model" | "models" | "modelApiKeyEnv" | "modelApiKeys" | "modelQuotaWeights" | "tiers" | "projects" | "roles" | "atModelAllowlist" | "cascadeLadder" | "degrade">;
 /** 组:approval(审批 / HITL 门)。`directDoorActive` 无 env 解析腿(装配层三域合取的产物),但语义上
  *  就是本组的门状态,故进组;`parseApprovalDomain` 的返回类型相应是 `Omit<…, "directDoorActive">`。 */
-export type ServiceApprovalConfig = Pick<ServiceConfigFlat, "approvalRequire" | "approvalDeny" | "approvalTimeoutSec" | "approvalAutoBudget" | "approvalNeverAuto" | "approvalHmacKeys" | "durableApproval" | "directApprovalDoor" | "directDoorActive" | "resourceSuspend" | "resourceSuspendTtlSec" | "resourceSuspendTotalTokens" | "resourceSuspendTotalBudgetUsd" | "resourceSuspendMaxSlices" | "askQuestionEnabled" | "questionThrottle" | "toolApprovalEnabled" | "permissionRulesEnabled" | "permissionRulesEnabledExplicit" | "streamAskWindowMarginMs" | "streamApproval" | "unattendedApprovalPolicy" | "mcpElicitation" | "sensitiveWritePatterns" | "manualModeShellGate">;
+export type ServiceApprovalConfig = Pick<ServiceConfigFlat, "approvalRequire" | "approvalDeny" | "approvalTimeoutSec" | "approvalAutoBudget" | "approvalNeverAuto" | "approvalHmacKeys" | "durableApproval" | "directApprovalDoor" | "directDoorActive" | "resourceSuspend" | "resourceSuspendTtlSec" | "resourceSuspendTotalTokens" | "resourceSuspendTotalBudgetUsd" | "resourceSuspendMaxSlices" | "askQuestionEnabled" | "questionThrottle" | "toolApprovalEnabled" | "permissionRulesEnabled" | "permissionRulesEnabledExplicit" | "streamAskWindowMarginMs" | "streamApproval" | "unattendedApprovalPolicy" | "mcpElicitation" | "sensitiveWritePatterns" | "manualModeShellGate" | "permissionsDisableAutoMode">;
 /** 组:memory(记忆面 + TOC 同步腿)。 */
 export type ServiceMemoryConfig = Pick<ServiceConfigFlat, "memoryEngineEnabled" | "memoryEngineDir" | "memoryEngineRemoteLaneAllowed" | "memoryEngineBackend" | "memoryScope" | "memoryPersistenceCapable" | "memorySync" | "memoryEmbedder" | "memoryOrgAdmissionMode" | "memoryDelegationEvidence" | "memoryProvenance" | "memoryCapturePolicy" | "memoryConsolidationDriver" | "memoryOrgDirectoryJson" | "memoryOrgGrantTtlMs" | "memoryOrgUnavailableBackoffMs" | "projectMemoryEnabled" | "syncImportLeaseStaleSec">;
 /** 组:auth(鉴权 / 身份 / 治理棒)。`commandPolicy` 只有 sema-registry 腿(无 env 标量形),故 env 解析

package/dist/config.d.ts

@@ -169,6 +169,27 @@ export declare const hostExecSpoolEnabled: () => boolean;
  *  a loud CONFIG_NOTICES line ("removed-1m"); the center lane's roster culture is explicit declaration.
  *  Shared by the env lane (main + cheap models) and the center lane (sema-registry toModel). */
 export declare function applyAutoCompactWindow(m: Model, explicit?: number): "explicit" | "sonnet5" | "removed-1m" | "removed";
+/**
+ * [ref] 件⑤ —— 思考档两键的**闭集词表**与拒启判据(`MODEL_DEFAULT_THINKING` / `MODEL_REASONING_EFFORT_LEVELS`)。
+ *
+ * 改前两键都走 `isThinkingLevel(...)` **过滤**:拼错的词被**静默丢掉**,而两根旋钮的失败方向恰好都是
+ * 「把运维的意图反向执行」——
+ *  · `MODEL_DEFAULT_THINKING=hight` ⇒ `defaultThinking` 不铸键 ⇒ 全部任务回落到「无模型级默认档」,
+ *    运维以为整台机器抬到了 high;
+ *  · `MODEL_REASONING_EFFORT_LEVELS=med,high` ⇒ 只剩 `["high"]`;写成 `med` 一个词则整键落空、
+ *    `compat` 不铸 ⇒ 回落 core 的保守梯(`minimal|low|medium|high`),`xhigh`/`max` 被 clamp 下来。
+ *    运维配这根旋钮的**全部用途**就是告诉引擎「本端点吃得下更高档」,静默落空 = 高档永远上不去。
+ * 两条都是 `MODEL_DEGRADE_ON` / `TASK_TIMEOUT_SEC` 那条族律的同形([ref] A 档:坏值拒启,不静默折默认),
+ * 所以改成 boot 响亮拒 —— 与 `MODEL_DEGRADE_ON` 的 `parseDegradeOn` 逐字同款(点名坏词 + 列合法词)。
+ *
+ * 词表用 `Record<ThinkingLevel, true>` 铸 = 与 llm-core 锁步:上游加一档而这里不补 ⇒ **编译红**
+ * (`MODEL_DEGRADE_ON` 的 `Set<DegradeReason>` 同款纪律);目录行的 `enumValues` 由本表派生,
+ * 「文档写五档、代码收六档」那种分叉在类型层就不可能发生。
+ */
+type ModelThinkingLevel = NonNullable<Model["defaultThinking"]>;
+/** 六档闭集(有序:低→高,取自上表的书写序),目录行 `enumValues` 与两条拒因文案的单一真源。
+ *  (`CATALOG_RESTART_SLICES = Object.keys(RESTART_SLICE_SET)` 同款派生式。) */
+export declare const THINKING_LEVELS: readonly ModelThinkingLevel[];
 /**
  * 一条工具名**永不匹配任何现役工具**的三种拼法,及其修正指引。审批/权限名单是 server 侧 ToolPolicy 的
  * RAW 逐字比对(canonicalToolName 折叠面已随 core 5.0.0 [ref] 退役),所以写错的名字不会报错、只会静默

package/dist/config.js

@@ -2,7 +2,7 @@ import { readFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
 import { fileURLToPath } from "node:url";
-import { BUILTIN_COMPLIANCE_DENIES, COMPLIANCE_CAPABILITIES, compileReadDeny, resolveReadDenyBuiltins, CODE_AGENT_PROMPT, formatUserScope, isThinkingLevel, PROTOCOL_TABLE, protocolOf, RECOMMENDED_SENSITIVE_PATTERNS, RETIRED_TOOL_NAMES, resolveFileHistoryRetention, resolveLockedKeys, validatePermissionRules } from "@sema-agent/core";
+import { BUILTIN_COMPLIANCE_DENIES, COMPLIANCE_CAPABILITIES, compileReadDeny, resolveReadDenyBuiltins, CODE_AGENT_PROMPT, formatUserScope, PROTOCOL_TABLE, protocolOf, RECOMMENDED_SENSITIVE_PATTERNS, RETIRED_TOOL_NAMES, resolveFileHistoryRetention, resolveLockedKeys, validatePermissionRules } from "@sema-agent/core";
 import { ROSTER_PRIMARY_ROLES, ROSTER_CHEAP_ROLES } from "@sema-agent/settings-schema";
 import { parseApprovalHmacKeys, parsePrincipalJwks } from "./auth-keys.js";
 import { DEFAULT_ELICITATION_THROTTLE } from "./elicitation.js";
@@ -521,7 +521,8 @@ function noticeAutoCompactAboveWindow(slot, envName, m) {
             model: m.id,
             value: String(act),
             contextWindow: String(window),
-            note: `${envName}=${act} is ABOVE the ${slot} model "${m.id}" physical context window (${window}) — core uses autoCompactTokens as the TRIGGER-side window, so a value above the physical window means autocompaction effectively never fires and the destructive context guard truncates history instead (the opposite of what this knob is for). The value is applied as configured (not clamped, not rejected); lower it below the window — CC's own shape is window-33000.`,
+            clampedTo: String(window),
+            note: `${envName}=${act} is ABOVE the ${slot} model "${m.id}" physical context window (${window}) — core uses autoCompactTokens as the TRIGGER-side window and CLAMPS it to the physical window (resolveTriggerWindow), so this knob is a NO-OP here: the trigger geometry falls back to ${window} and core mints one config.autocompact_window_clamped notice per prepare. server neither clamps nor rejects the value (clamping is core's, at the read site); lower it below the window to make the knob do something — CC's own shape is window-33000.`,
         },
     });
 }
@@ -637,8 +638,8 @@ function parseModelDomain() {
         return "gateway";
     })();
     const extraBody = buildExtraBody();
-    const thinkingDefault = (() => { const v = process.env.MODEL_DEFAULT_THINKING; return v && isThinkingLevel(v) && v !== "off" ? v : undefined; })();
-    const effortLevels = (process.env.MODEL_REASONING_EFFORT_LEVELS ?? "").split(",").map((s) => s.trim()).filter((s) => isThinkingLevel(s) && s !== "off");
+    const thinkingDefault = parseDefaultThinking(process.env.MODEL_DEFAULT_THINKING);
+    const effortLevels = parseReasoningEffortLevels(csv("MODEL_REASONING_EFFORT_LEVELS"));
     const model = {
         id: modelId,
         name: modelId,
@@ -777,6 +778,32 @@ function parseModelDomain() {
             : undefined,
     };
 }
+const THINKING_LEVEL_TABLE = { minimal: true, low: true, medium: true, high: true, xhigh: true, max: true };
+export const THINKING_LEVELS = Object.keys(THINKING_LEVEL_TABLE);
+const isThinkingTier = (w) => THINKING_LEVELS.includes(w);
+function parseDefaultThinking(raw) {
+    const v = raw?.trim();
+    if (v === undefined || v === "")
+        return undefined;
+    if (v === "off")
+        return undefined;
+    if (!isThinkingTier(v)) {
+        throw new Error(`env MODEL_DEFAULT_THINKING="${v}" is not a thinking tier — valid: ${THINKING_LEVELS.join(" | ")} | off ` +
+            `("off" = no model-level default). A typo used to be dropped SILENTLY, leaving the deployment on no default at all (#210 A 档).`);
+    }
+    return v;
+}
+function parseReasoningEffortLevels(words) {
+    if (words.length === 0)
+        return [];
+    const bad = words.filter((w) => !isThinkingTier(w));
+    if (bad.length > 0) {
+        throw new Error(`env MODEL_REASONING_EFFORT_LEVELS has unknown tier(s): ${bad.join(", ")} (valid: ${THINKING_LEVELS.join(" | ")})` +
+            `${bad.includes("off") ? ' — "off" belongs to MODEL_DEFAULT_THINKING (no model-level default), it is not an effort tier an endpoint can accept' : ""}. ` +
+            `Bad words used to be dropped SILENTLY, narrowing the declared ladder without a word (#210 A 档).`);
+    }
+    return words.filter(isThinkingTier);
+}
 const DEGRADE_ON_WORDS = new Set(["breaker_open", "rate_limit", "budget", "server_error", "last_resort"]);
 function parseDegradeOn(words) {
     if (words.length === 0)
@@ -853,6 +880,7 @@ export function formatUnmatchableToolNames(source, bad) {
     return (`${source} names tool(s) that can never match a live tool (these lists are RAW whole-name comparisons — core 5.0.0 RB-476 removed the alias/auto-prefix folds): ` +
         bad.map((b) => `${presentToolName(b.name)} → ${b.guidance}`).join("; ")).replace(CONTROL_AND_BIDI_STRIP_RE, "");
 }
+const MAX_TIMER_DELAY_MS = 2_147_483_647;
 function streamApprovalConfig(gates) {
     const cfg = {
         enabled: boolEnv("STREAM_APPROVAL_ENABLED", true),
@@ -866,6 +894,12 @@ function streamApprovalConfig(gates) {
         orphanTtlMs: numEnvBounded("STREAM_APPROVAL_ORPHAN_TTL_MS", String(7 * 24 * 60 * 60 * 1000), 60_000, 90 * 24 * 60 * 60 * 1000),
         unreachedTtlMs: numEnvBounded("UNREACHED_ASK_TTL_MS", String(60 * 60 * 1000), 60_000, 24 * 60 * 60 * 1000),
     };
+    if (cfg.windowMs < 0) {
+        throw new Error(`env STREAM_ASK_WINDOW_MS=${cfg.windowMs} must not be negative — 0 means "close the window" (every gated ask goes straight to the unattended outcome and NO approval card is emitted), any positive value is the live-card window in ms. A negative value used to emit a card nobody could ever win.`);
+    }
+    if (cfg.windowMs > MAX_TIMER_DELAY_MS) {
+        throw new Error(`env STREAM_ASK_WINDOW_MS=${cfg.windowMs} exceeds the Node timer ceiling ${MAX_TIMER_DELAY_MS} (2^31-1 ms ≈ 24.8 days) — setTimeout SILENTLY collapses a larger delay to 1ms, so the window you meant to lengthen would expire immediately and every gated ask would take the unattended route on the next tick. Pick a window at or below the ceiling (and remember STREAM_ASK_WINDOW_MS + STREAM_APPROVAL_ADHOC_GRACE_MS must stay strictly below STREAM_APPROVAL_ORPHAN_TTL_MS).`);
+    }
     if (cfg.windowMs + cfg.adhocGraceMs >= cfg.orphanTtlMs) {
         throw new Error(`env STREAM_ASK_WINDOW_MS=${cfg.windowMs} + STREAM_APPROVAL_ADHOC_GRACE_MS=${cfg.adhocGraceMs} must be STRICTLY LESS than STREAM_APPROVAL_ORPHAN_TTL_MS=${cfg.orphanTtlMs} — the adhoc arm fires at (createdAt + window + grace) while the orphan backstop fires at (createdAt + ttl); if the backstop wins, every adhoc-leg row is attributed "orphan_ttl_exceeded" instead of "adhoc_leg_no_durable_domain" (attribution honesty, design/172 §6.1)`);
     }
@@ -945,6 +979,7 @@ function parseApprovalDomain(ctx) {
                 `The words are matched EXACTLY (lowercase, surrounding whitespace trimmed): "OFF"/"Classify" land here too, deliberately — a closed word table with no case-folding is what keeps "it looked accepted" from meaning "it did nothing". ` +
                 `Refusing to boot rather than treating a misspelled value as "unset": that silently ran the deployment with NO shell gate while the operator believed one was configured`);
         })(process.env.MANUAL_MODE_SHELL_GATE),
+        permissionsDisableAutoMode: boolEnv("PERMISSIONS_DISABLE_AUTO_MODE", false),
         mcpElicitation: {
             enabled: boolEnv("MCP_ELICITATION_ENABLED", false),
             throttle: {
@@ -1757,7 +1792,7 @@ const APPROVAL_GROUP_KEYS = [
     "approvalRequire", "approvalDeny", "approvalTimeoutSec", "approvalAutoBudget", "approvalNeverAuto",
     "approvalHmacKeys", "durableApproval", "directApprovalDoor", "directDoorActive", "resourceSuspend",
     "resourceSuspendTtlSec", "resourceSuspendTotalTokens", "resourceSuspendTotalBudgetUsd", "resourceSuspendMaxSlices", "askQuestionEnabled", "questionThrottle", "toolApprovalEnabled", "permissionRulesEnabled", "permissionRulesEnabledExplicit", "streamAskWindowMarginMs", "streamApproval", "unattendedApprovalPolicy", "mcpElicitation",
-    "sensitiveWritePatterns", "manualModeShellGate",
+    "sensitiveWritePatterns", "manualModeShellGate", "permissionsDisableAutoMode",
 ];
 const MEMORY_GROUP_KEYS = [
     "memoryEngineEnabled", "memoryEngineDir", "memoryEngineRemoteLaneAllowed", "memoryEngineBackend", "memoryScope",

package/dist/http/route-ctx.d.ts

@@ -47,6 +47,24 @@ export interface RouteHelpers {
     rateLimited(req: IncomingMessage, res: ServerResponse): boolean;
     quotaExceeded(req: IncomingMessage, res: ServerResponse): boolean;
     leaseDenied(req: IncomingMessage, res: ServerResponse): Promise<boolean>;
+    /**
+     * 🔴 **[ref]:按**付费**方(不是请求方)判的成本配额准入 —— {@link quotaExceeded} 的孪生。**
+     *
+     * `quotaExceeded` 键在 `gatedPrincipal(req)` = 谁点的按钮;本门键在**这笔钱记谁的账**。两者在自助
+     * 场景恒相等,在「显式 operator 代别人动手」的场景不等 —— 那正是配额上限被绕过的那一支。
+     * 参数 `owner` 由调用点从**已属主校验过的那一行**取(run 行的 `owner` / checkpoint 的 scope),
+     * 本门不自己推身份(推得出来就说明调用点还有第二个身份源,那才是病)。
+     * `undefined`(匿名/开放行)⇒ 无付费方 ⇒ 不 gated,与 `quotaExceeded` 的成文语义同判。
+     * 拒 = 429 + `Retry-After`,码/文案/extras 与 `quotaExceeded` 逐字同一套。
+     * 位序纪律:**必须排在本路由的 owner 门之后**(反枚举 —— 否则 429 会变成「这行存在且它属主超顶了」
+     * 的谕示);且排在真正驱动模型之前。
+     */
+    ownerQuotaDenied(res: ServerResponse, owner: string | undefined): boolean;
+    /** 🔴 **[ref]:{@link ownerQuotaDenied} 的 lease 孪生 —— 按**付费**方判的 fleet-lease 准入。**
+     *  `leaseDenied` 键在请求方;本门键在付费方(`driveResumeLeg` 的 `fleetLease.admit(卡属主)` 早就是这个
+     *  语义,本位把它交给路由域)。两门在自助场景恒同答,在「operator 代别人动手」时不同 —— 那正是
+     *  「拿自己的额度去烧别人的账」的那一支。同样必须排在 owner 门之后、驱动之前。 */
+    ownerLeaseDenied(res: ServerResponse, owner: string | undefined): Promise<boolean>;
     /** [ref]-T1:治理窗 pre-admission(异步 202 车道的唯一 429 出路;key 公式与 core 单源)。 */
     usageWindowDenied(req: IncomingMessage, res: ServerResponse): Promise<boolean>;
     safeDecode(seg: string): string | null;
@@ -79,6 +97,17 @@ export interface RouteRequestState {
     streamDetached: boolean;
     /** 凭证派生的调用方系统身份(`source`)。handle() 的鉴权门是**唯一**赋值点,域模块只读。 */
     source: string | null;
+    /**
+     * [ref] 件2(cli [ref] sema-bug4 (c)):本请求驱动的那条 run 的**终局**(`completed` / `failed` /
+     * `suspended` / …)与结构化失败码。`handle()` 的 `request` 日志行读它 —— 让「端点 200 ≠ 模型成功」
+     * 这条歧义消失(取证:模型 connect timeout 的那一刻,日志里唯一的行是 `request status:200`)。
+     *
+     * 赋值点在 `routes/tasks.ts`(`/v1/tasks` 与 `/v1/tasks/stream` 两腿的终局到手处);拿不到 run 结果
+     * (受理即拒 / 幂等重放 / 非任务端点)⇒ **键缺席**,绝不写 null —— 缺席 = 「这条请求没驱动 run」,
+     * 与「run 结果不明」是两句话,而 `null` 会把两者压成一个形。
+     */
+    runStatus?: string;
+    runErrorCode?: string;
 }
 /** B4①(命名化):`prepareSpec` 的返回形(tasks.ts/runs.ts 两域共同消费的属性面)——原为 6 成员内联匿名对象。
  *  命名后好处不只是过 B4 门:两个消费域现在都能对同一个符号做 `import type` 标注,而不是各自重推断结构。 */
@@ -141,6 +170,52 @@ export interface DriveResumeArgs {
      *  **唯一不设此位的**是内部 D-D SLA deny-sweep:它没有在等响应的人,提前受理对它零收益,而且那条
      *  循环靠 `await` 串行给每 tick 的重活限流(见其调用处的登记注)。 */
     acceptEarly?: boolean;
+    /**
+     * 🔴 **[ref](codex 交叉复审 r2-[medium] 验真后修):这条腿是**调用方发起**的吗?**
+     *
+     * `true` = 有人在 HTTP 上点了按钮(resume / plan_review / wake / decide / 赎回席)⇒ 吃按**付费方**
+     * (卡属主)判的成本配额准入(`ownerCostQuotaDenied`)。缺席/`false` = **部署自己的结算腿**
+     * (内部 D-D SLA deny-sweep)⇒ **不吃**那道门。
+     *
+     * 为什么系统腿必须豁免(亲核后改的判据,首版曾一并拦下 sweep):sweep 的活是把过了 SLA 的卡**结算掉**
+     * (graceful deny → 行收敛 → 释放 `task_active` claim)。拦住它并不能省钱,只会让超顶租户的卡**挂着**
+     * —— 而挂多久的兜底**比首版注释里写的差得多**:`checkpoint-store-sql.ts` 的 `reapExpired` 在
+     * **deadline 分支**上逐字排除了 `APPROVAL_GATE_KINDS`(`gate_kind NOT IN (…) OR tool_name='AskUserQuestion'`),
+     * 所以一张过期的 human / irreversible_ask 卡根本不走那条腿;真正兜住它的只有绝对 backstop
+     * `terminal_at_ms`(`TERMINAL_BACKSTOP_MS` 默认 **30 天**)。于是「拦 sweep」= 把一个由
+     * `APPROVAL_TIMEOUT_SEC` 界定的 SLA 换成「等成本窗滚过(`COST_QUOTA_WINDOW_SEC` 默认 24h)、最坏等 30 天」,
+     * 并且整段时间攥着会话 claim。**方向也自洽**:deny 是**停下**这条 run 的动作,为了省钱而拒绝执行「停」
+     * 与 preempt 路由早就成文的那句同一条(「否则超顶租户连自己的花费都停不下来」)。
+     *
+     * 判别子取 `req` 的在场与否 —— 这在 `resumeCheckpoint` 里**已经是**「系统腿 vs 调用方腿」的既有判据
+     * (绑定强制、parked 分流两处都写着 `req !== undefined` 与「内部 D-D SLA deny-sweep(req 缺席)豁免」),
+     * 本位只是把同一条判据显式化成一个有名字的位,而不是让下游去猜。
+     * ⚠️ **射程覆盖两道门**:紧邻的 fleet-lease 准入(`ownerFleetLeaseDenied`)读**同一位** —— [ref] 件⑤②
+     * (codex r3-[high])把它一并改吃了 `callerInitiated`,理由与三问逐字同 cost 半场。
+     * 🔴 本句是 [ref] R4 改写的(2026-09-03,7.57.0 发车前合并重扫 wf_1abaaa9a):此处原文写着「紧邻的
+     * fleet-lease 准入**没有**这条豁免(对 sweep 一视同仁),本批不动它,分歧已登记为遗留」—— 那是**同一批
+     * 件⑤② 落地之前**的话,件⑤② 修好后这条 JSDoc 没跟着改,于是注释与代码正相反(亲读
+     * `server.ts` 的 `ownerFleetLeaseDenied` 消费点:两处都是 `args.callerInitiated === true` /
+     * `req !== undefined`)。两道门在这一位上**无分歧**,[ref] 上也没有这一项。
+     */
+    callerInitiated?: boolean;
+    /**
+     * 🔴 **[ref] codex 对抗复审 r1-F3 [medium](验真后修):本次请求的属主 lease 准入**已经做过了**。**
+     *
+     * `resumeCheckpoint` 在 parked 子代赎回分流**之前**先判一次属主 lease([ref] R3:那条腿提前 `return`,
+     * 结构上够不到 `driveResumeLeg` 的同一道门)。分流**未命中**时请求落回 legacy 腿,于是同一条请求、
+     * 同一个付费方会向 center 协商**两次**。cost 半场可以「过两次门」(本地同步、纯读);lease 半场**不行**:
+     * `FleetLeaseManager.admit` 的五条 fail-open 路径(center 不可达 / 5xx / 超时 / 401-403 / 畸形响应)
+     * 一律**不写缓存态**(亲读 `fleet-lease.ts` 的 `issueOrRenewInner`),而 single-flight 只合并**并发**调用 ——
+     * 两道门是串行的 ⇒ 半开 center 下一个请求连吃两次 `LEASE_FETCH_TIMEOUT_MS`,持续故障时整条 legacy
+     * resume 车道把控制面负载翻倍。
+     *
+     * 所以由上游把「已受理」这个事实传下来,`driveResumeLeg` 据此跳过重复协商。**安全性**:两处的键是
+     * **同一个表达式**(`decodeCheckpointScope(cp.scope)`,上游门与下游 `auth.principal` 同源),射程条件也
+     * 同一条(`req !== undefined` ⇔ `callerInitiated`)⇒ 跳过的是一次**逐字相同**的判定,不是一道门。
+     * 缺席/`false` ⇒ 照常自己判(其余三条驱动腿与 sweep 一字不变)。
+     */
+    ownerLeaseAdmitted?: boolean;
 }
 /** 提交/续跑「腿」= 跨域共享的**有状态**长流程(不像 {@link RouteHelpers} 那样只依赖 deps/config:它们要写
  *  run log、发 fleet 帧、走 markResuming CAS、驱动模型)。A9 上批的停点就在这里——tasks/runs 两域共用

package/dist/http/routes/a2a-serve.js

@@ -1,6 +1,7 @@
 import { createHash } from "node:crypto";
+import { memoRedactedRead, redactErrorMessage } from "../../observability/run-terminal-log.js";
 import { A2A_TASK_STATES } from "@sema-agent/core";
-import { isParkedRunStatus } from "../../plugins/store-contracts.js";
+import { isParkedRunStatus, isTerminalRunStatus } from "../../plugins/store-contracts.js";
 import { HttpError } from "../../security.js";
 import { scopedIdempotencyKey } from "../idempotency.js";
 import { sendJson, sendError } from "../send.js";
@@ -80,10 +81,11 @@ function statusTextForRun(run, state) {
         return "this task is suspended awaiting an approval decision on the serving deployment; it resumes once that decision is made";
     if (run.result?.result)
         return run.result.result;
+    const memo = (seat, raw) => (isTerminalRunStatus(run.status) ? memoRedactedRead(`a2a.${seat}`, raw, (v) => redactErrorMessage(v) ?? "") : (redactErrorMessage(raw) ?? ""));
     if (run.error)
-        return run.error;
+        return memo("error", run.error);
     if (run.result?.errorMessage)
-        return run.result.errorMessage;
+        return memo("errorMessage", run.result.errorMessage);
     return undefined;
 }
 function taskFromRun(run, stale) {