@sema-agent/server 7.93.7 → 7.95.0

package/USAGE.md

@@ -747,6 +747,58 @@ READ_DENY_PATTERNS='[{"pattern":"**/secrets/**"},{"pattern":".ssh","caseSensitiv
   ⚠️ 本地 `config.d/` 车道今天**接不上**这一域(registry-core 的可移植域表里没有它),只有
   `CONFIG_PROVIDER=remote` 的部署走得通。
 
+**可选 — 任务层「掀开写围栏」的运维天花板(`TASK_WRITE_FACE_ESCALATION`,7.95.0 起 / S-591)**
+
+```bash
+TASK_WRITE_FACE_ESCALATION=allow     # 词表 allow|refuse;坏词启动期响亮拒;空串按未设
+                                     # 不设 = 本层不表态 ⇒ 按「托管形」posture 判(见下表)
+```
+
+- **它管什么**:`permissionMode:"bypassPermissions"` 派生 `TaskSpec.writeFace:"open"` ——
+  也就是说**一个调用方**可以掀掉写围栏(任务根之外也能写)。而引擎的解析序在普通部署上是
+  **任务席赢部署席**,引擎里唯一压得住它的两形(org 治理 / 只读 verifier 挂载)在本仓一个结构上不可达、
+  一个要靠 `AUTONOMY=read-only|plan`(那是**整条 run 禁写**,不是等比例旋钮)。⇒ 天花板由 **server 在
+  受理请求时**执行:不给的时候 **422 响亮拒**(`errorCode: request.host_posture_refused`),而**不是**
+  被静默钳回 roots(静默钳是本仓明令要修掉的失败形:调用方明说「别拦我」,却撞上一道它掀不掉
+  也看不见的墙)。
+- 🔴 **它只抬天花板,不是「部署席」**:它**不会**给一条没声明过的 run 开根外写面。
+  `RunnerDeps.writeFace`(部署**缺省**席)本版**仍然缺席** = 引擎默认 `roots`,那是另一件事、另一根
+  尚未铸出的旋钮(落点登记在 `src/boot/runner-deps.ts` 那一行上)。
+- **三态,与 `READ_FACE` 同律(显式 env 恒赢 > posture > 默认)**:
+
+  | `TASK_WRITE_FACE_ESCALATION` | 托管形? | `permissionMode:"bypassPermissions"` 的结局 |
+  |---|---|---|
+  | `allow` | 任意 | **放行**(部署允许任务层开写面) |
+  | `refuse` | 任意 | **422 拒**(运维显式表态**无条件**恒赢,不挂任何客户端派生腿) |
+  | 未设 | 否(单用户 turnkey) | **放行** —— 与 7.94 及以前逐字节相同 |
+  | 未设 | **是** | **422 拒**,拒因点名 `TASK_WRITE_FACE_ESCALATION=allow` 与判成托管的证据 |
+
+- 🔴 **`REMOTE_EXEC=device` 车道上本门不适用**(任何 `REQUIRE_PRINCIPAL` 值):那条车道的路径落在
+  **发起者自己的设备**上,归属由 `device_session` 绑定行 + 准入链的 owner 谓词验过 —— host 闸防的
+  跨租户宿主穿越在那儿**结构性不存在**(成文裁定,与 `settings.env` / `cwd` 两键在该车道上的既有臂同源),
+  也叠加「device 车道不额外加一道审批」这条既定纪律。⚠️ 运维的**显式** `refuse` 在 device 上照样恒赢(旋钮不挂车道派生腿)。
+- **「托管形」怎么判**(判据单点 `src/hosted-posture.ts`,两类三条证据,任一成立即托管):
+  ① `REQUIRE_PRINCIPAL=true`(定义式);② `PRINCIPAL_JWT_PUBKEYS` / `_ISS` / `_AUD` 任一在场;
+  ③ `AUTH_BRIDGE_ISSUER` **显式**在场。②③ 的共同标准是**运维点名了一个外部身份签发方** ——
+  一台机器一个可信主人的形不需要向任何人验签。
+  🔴 **「受控于控制面」不算证据**:`SEMA_REGISTRY_*`(含 worker 名)与 auth-bridge 那条
+  `?? configCenter.baseUrl` 回退**都不读** —— fleet 管理轴 ≠ 租户轴(一台 `sema run-local` 从组织下发面
+  取配置是正当用法)。其余被排除的候选(`OPERATOR_PRINCIPALS`、`SERVICE_AUTH_TOKENS` 条目数、
+  `DB_BACKEND`、`BIND_HOST`)逐条写在 `docs/DEPLOY-PREREQS.md`。
+- **同族的 `approverPosture` 是「忽略 + 留声」,不是拒**:提交体的 `approverPosture` 同样是一句宿主姿态
+  声明(引擎据此把 bypass 指令渲给模型 —— 那段文字指示模型改用 Bash 改文件而不是用文件工具),
+  托管形上它被**忽略**并留一条 `task_approver_posture_ignored`(与 `settings.hooks` / `cwd` /
+  `settings.env` 三条同姿势)。⚠️ 刻意**不拒**:它零授权,而续跑腿逐字重放盘上的体、调用方删不掉它 ⇒
+  拒会把一条 parked 任务永久砖死。
+- **续跑腿**:一条在托管形机器上带着 `bypassPermissions` 的 parked 任务,赎回时被同一道门挡住,
+  上层折成 `409 resume_blocked_by_policy`(`blockedBy: request.host_posture_refused`)。
+  运维的解法是 `TASK_WRITE_FACE_ESCALATION=allow`。
+- **能力面披露位**:`GET /v1/capabilities` 的 `taskWriteFaceOpen`(`false` ⇒ 发那个键会拿 422)——
+  壳不必靠踩一次 422 才学会。
+- **`AUTONOMY=read-only|plan` 一行未动**。⚠️ 两者叠加时**本门先说话**:托管形 + `AUTONOMY=read-only`
+  + `bypassPermissions` 的请求现在是 422,而 7.94 及以前它会跑起来(写被 autonomy 禁掉)。
+  要保留旧结局就 `TASK_WRITE_FACE_ESCALATION=allow`(写面仍被 autonomy 压回 roots)。
+
 - **MCP 撤销腿(7.39 起)**:MCP 服务器 mount 仍是 restart-to-apply(新增/改址要
   restart 才生效),但**从 enabled 集删除一个服务器即时生效**——refresh 拍收货后,被删服务器的
   MCP 调用当场按 coded 拒绝 `mcp.server_revoked` 结算(known-not-executed,引擎每次派发前探询

package/dist/boot/resolve-spec.js

@@ -13,6 +13,7 @@ import { assertGuardPatternsUsable, buildOnlySensitiveBaselineWarning, createApp
 import { acceptShellScratchpadDir, buildEnvFacts, egressForRemoteExec, ensureScratchpadDir, resumeFactsForLane, scratchpadCoveringTaskRoot } from "../env-facts.js";
 import { FleetEventBus } from "../fleet/fleet-bus.js";
 import { composeHooks, createTaskHooks } from "../hooks/hook-runner.js";
+import { HOST_POSTURE_REFUSED_CODE, taskApproverPostureHonored, taskWriteFaceRefusal } from "../hosted-posture.js";
 import { headerStr } from "../http/principal-gate.js";
 import { explicitOperatorOk } from "../http/server.js";
 import { isModelAllowlisted, matchCatalogModel, modelSupportsImages, resolveTaskModel, terminalCatalogName } from "../model-select.js";
@@ -68,6 +69,11 @@ export function createResolveSpec(ctx) {
         assertRequestA2aUnlocked(body.a2aPeers, lockedKeys);
         const gated = await gateScenarioAndAppend(body, auth, opts);
         const effMode = effectivePermissionMode(body, gated.parsedSettings.settings);
+        if (effMode !== undefined && writeFaceForMode(effMode) === "open") {
+            const why = taskWriteFaceRefusal(config);
+            if (why !== undefined)
+                throw new HttpError(422, why, { code: HOST_POSTURE_REFUSED_CODE });
+        }
         noteSessionShellGate?.(auth?.sessionId, effMode !== undefined && shellGateForMode(effMode) === "off");
         const lane = bindSettingsCwdEnvAndModel(body, auth, gated, effMode, opts);
         const anchors = await resolveHistoryAnchors(body, auth);
@@ -296,7 +302,14 @@ export function createResolveSpec(ctx) {
             ...(effMode ? { shellGate: shellGateForMode(effMode) } : {}),
             ...((f) => (f !== undefined ? { writeFace: f } : {}))(effMode !== undefined ? writeFaceForMode(effMode) : undefined),
             ...((f) => (f !== undefined ? { autoModeRequested: f } : {}))(effMode !== undefined ? autoModeRequestedForMode(effMode) : undefined),
-            ...(body.approverPosture !== undefined ? { approverPosture: body.approverPosture } : {}),
+            ...(() => {
+                if (body.approverPosture === undefined)
+                    return {};
+                if (taskApproverPostureHonored(config))
+                    return { approverPosture: body.approverPosture };
+                logger.warn("task_approver_posture_ignored", { honored: false, sessionId: auth?.sessionId ?? null });
+                return {};
+            })(),
             selfOrchestration: selfOrchestrationFromBody({ selfOrchestration: body.selfOrchestration === true || parsedSettings.settings?.ultracode === true }, config, Boolean(centerRuntimeCapsResolver)),
             forwardSubagentEvents: body.forwardSubagentEvents === true ? true : undefined,
             retainSubagentSessions: normalizeRetainSubagentSessions(body.retainSubagentSessions),

package/dist/boot/stage-09-leader.js

@@ -16,7 +16,7 @@ export function runStage09(ctx) {
     });
     const leaderEndpoint = createLeaderFace({ config, logger, brain, pricing, executionEnvFactory, toolResultStore, sessionStore, checkpointStore, governanceSeams, backend, tracer, usageWindowStore, promptSource: configCenter.promptSource, onError: runnerDeps.onError });
     const drainState = { draining: false };
-    const authBridgeIssuer = process.env.AUTH_BRIDGE_ISSUER || config.configCenter?.baseUrl;
+    const authBridgeIssuer = config.authBridgeIssuer ?? config.configCenter?.baseUrl;
     const registryJwtVerifier = authBridgeIssuer
         ? createRegistryJwtVerifier({
             issuer: authBridgeIssuer,

package/dist/boot/stores.js

@@ -1,5 +1,6 @@
 import { join } from "node:path";
 import { FileBackgroundAgentStore, FileMailboxStore, FileRosterStore, FileUsageWindowStore, InMemoryUsageWindowStore, mailboxCrossProcessMountVerdict } from "@sema-agent/core";
+import { createCorruptReadSeat } from "../observability/corrupt-read-seat.js";
 import { createMemorySyncRunner, createMemorySyncTransport } from "../memory-sync-client.js";
 import { memoryEmbedderFor } from "../plugins/memory-embedder.js";
 import { ensurePgMemoryEmbedderMetaSchema, reconcileEmbedderFingerprint } from "../plugins/memory-embedder-fingerprint.js";
@@ -231,7 +232,7 @@ export async function openStores(ctx) {
         }
         else if (backend?.kind === "local") {
             rosterStore = new FileRosterStore(join(config.localDataRoot ?? localRoot, "roster.json"), {
-                onCorruptRead: (info) => logger.warn("roster_corrupt_read", { path: info.path, reason: info.reason }),
+                onCorruptRead: createCorruptReadSeat(logger.warn.bind(logger), "roster_corrupt_read"),
             });
         }
         if (rosterStore)
@@ -251,7 +252,9 @@ export async function openStores(ctx) {
             backgroundAgentStore = new TiDBBackgroundAgentStore(mysqlPool);
         }
         else if (backend?.kind === "local") {
-            backgroundAgentStore = new FileBackgroundAgentStore(config.localDataRoot ?? localRoot);
+            backgroundAgentStore = new FileBackgroundAgentStore(config.localDataRoot ?? localRoot, {
+                onCorruptRead: createCorruptReadSeat(logger.warn.bind(logger), "background_agent_corrupt_read"),
+            });
         }
         if (backgroundAgentStore)
             logger.info("background_agent_store_enabled", { backend: pgPool ? "pg" : mysqlPool ? "tidb" : "file" });
@@ -305,7 +308,7 @@ export async function openStores(ctx) {
         }
         else if (backend?.kind === "local") {
             mailboxStore = new FileMailboxStore(config.localDataRoot ?? localRoot, {
-                onCorruptRead: (info) => logger.warn("mailbox_corrupt_read", { path: info.path, reason: info.reason }),
+                onCorruptRead: createCorruptReadSeat(logger.warn.bind(logger), "mailbox_corrupt_read"),
             });
             mailboxRecipientLifecycle = createDropOnlyRecipientLifecycle(mailboxStore);
         }

package/dist/boot/workflow-orchestration.js

@@ -2,6 +2,7 @@ import { FileWorkflowRunStore, InMemoryWorkflowRunStore } from "@sema-agent/core
 import { join } from "node:path";
 import { FleetEventBus } from "../fleet/fleet-bus.js";
 import { LocalWorkflowAgentSessionIndex } from "../orchestration/workflow-agent-session-index.js";
+import { createCorruptReadSeat } from "../observability/corrupt-read-seat.js";
 import { FileWorkflowCompletionInbox, InMemoryWorkflowCompletionInbox, resolveCompletionRoute } from "../orchestration/workflow-completion-inbox.js";
 import { FileWorkflowNotifyJournalStore, JournalingWorkflowRunStore, WorkflowNotifyGate } from "../orchestration/workflow-notify-journal.js";
 import { SubagentSteerRegistry } from "../orchestration/subagent-steer.js";
@@ -13,7 +14,10 @@ export function createWorkflowOrchestration(ctx) {
     const baseWorkflowRunStore = config.selfOrchestrationEnabled
         ? config.workflowRunStoreBackend === "memory"
             ? new InMemoryWorkflowRunStore()
-            : (sqlWorkflowRunStore ?? new FileWorkflowRunStore(join(config.localDataRoot ?? localRoot, "workflows")))
+            : (sqlWorkflowRunStore ??
+                new FileWorkflowRunStore(join(config.localDataRoot ?? localRoot, "workflows"), {
+                    onCorruptRead: createCorruptReadSeat(logger.warn.bind(logger), "workflow_run_corrupt_read"),
+                }))
         : undefined;
     const workflowNotifyJournal = config.selfOrchestrationEnabled && config.workflowRunStoreBackend !== "memory"
         ? (sqlWorkflowRunStore ? backend.notifyJournal() : new FileWorkflowNotifyJournalStore(join(config.localDataRoot ?? localRoot, "workflows")))

package/dist/config-catalog.js

@@ -1,6 +1,6 @@
 import { CROSS_SESSION_INBOUND_SETTINGS, CROSS_SESSION_DIALOG_EXPIRY_VALUES } from "@sema-agent/core";
 import { THINKING_FORMATS } from "./model-compat.js";
-import { RESILIENCE_DEFAULTS } from "./config-types.js";
+import { RESILIENCE_DEFAULTS, TASK_WRITE_FACE_ESCALATIONS } from "./config-types.js";
 import { webSearchConfigFromEnv, WEB_SEARCH_PROVIDERS } from "./plugins/web-search.js";
 import { AUTONOMY_MODES } from "./runtime-governance.js";
 import { REMOTE_EXEC_PROVIDER_WORDS } from "./execution-lane-caps.js";
@@ -74,7 +74,7 @@ export const CONFIG_CATALOG = [
     r("ATTACHMENT_ORPHAN_GRACE_MS", "limitsHttp", "number", "附件孤儿对象 GC 宽限(ms;0=关本腿,坏值回默认+warn)", { staticDefault: "3600000", danger: DATA, center: cLimits("attachmentOrphanGraceMs") }),
     r("ATTACHMENT_UNBOUND_TTL_MS", "limitsHttp", "number", "未绑定附件的 TTL(ms)", { staticDefault: String(24 * 3600 * 1000), danger: DATA, configKey: "attachmentUnboundTtlMs", center: cLimits("attachmentUnboundTtlMs") }),
     r("AUTH_BRIDGE_AUDIENCE", "auth", "string", "registry SSO-JWT 验签期望 aud", { danger: SEC }),
-    r("AUTH_BRIDGE_ISSUER", "auth", "url", "registry SSO-JWT issuer(auth bridge 的开关之一)", { danger: SEC, derivedDefaultNote: "缺席 ⇒ 用 configCenter.baseUrl(配了 center 即默认开桥)" }),
+    r("AUTH_BRIDGE_ISSUER", "auth", "url", "registry SSO-JWT issuer(auth bridge 的开关之一;S-591 起也是托管形判据的一条证据 —— 只认显式值,不认 center 回退)", { danger: SEC, derivedDefaultNote: "缺席 ⇒ 桥的装配处回退到 configCenter.baseUrl(配了 center 即默认开桥);但**托管判据不读那条回退**(fleet 管理轴 ≠ 租户轴)", configKey: "authBridgeIssuer" }),
     r("AUTH_BRIDGE_JWKS_URL", "auth", "url", "registry SSO-JWT 的 JWKS 地址(缺省从 issuer 派生)", { danger: SEC }),
     r("AUTONOMY", "auth", "enum", "运维 autonomy 模式,tighten-only 叠到每个 TaskSpec(read-only/plan ⇒ 只读手,ask ⇒ 恒 shellGate);center 腿热且 non-sticky", { danger: SEC, enumValues: AUTONOMY_MODES, configKey: "autonomy", center: cGov("autonomy") }),
     r("AUTO_MODE_CLASSIFIER_FALLBACK", "approval", "enum", "auto 分类器席答不出裁决时的梯子(main=主模型代判 / none=只留分类器那一级,整条拒)", { enumValues: ["main", "none"], danger: SEC, derivedDefaultNote: "未设/空串 ⇒ 不铸键,跟随引擎缺省 main(core 7.18.0 起;空串按未设,与其余词表旋钮同判);none = 7.77.0 及以前的行为逐字;词表外的值启动期拒启。权限轴放宽,升级须知见 DEPLOY-PREREQS", configKey: "autoModeClassifierFallback" }),
@@ -353,8 +353,9 @@ export const CONFIG_CATALOG = [
     r("READ_FACE", "orchestration", "enum", "READ 容纳面档位(env 逐键恒赢 center —— 部署主权表达)", { enumValues: ["open", "roots"], danger: SEC, derivedDefaultNote: "缺席 ⇒ 按 posture 派生(S-167):单用户 turnkey(REQUIRE_PRINCIPAL 未设)铸 open;多租户不铸键、core 默认 roots。生效来源见 GET /v1/diagnostics/wiring 的 readFace.source 四词", configKey: "readFace", center: cRead("face", "readFace") }),
     r("REAP_INTERVAL_SEC", "limitsHttp", "number", "reaper 周期(秒)", { staticDefault: "60", configKey: "reapIntervalSec" }),
     r("REAP_RUN_STALE_SEC", "limitsHttp", "number", "run 活性判陈旧阈(秒)", { staticDefault: "120", configKey: "runStaleSec", center: cLimits("runStaleSec") }),
-    r("REMOTE_EXEC", "orchestration", "enum", "执行车道选择(点名而配不齐/认不出 ⇒ 拒启,绝不静默降级到 host/stub)", { enumValues: REMOTE_EXEC_PROVIDER_WORDS, danger: SEC, derivedDefaultNote: "缺席:CONFIG_PROVIDER=local ⇒ host;其余 ⇒ 进程内 stub", configKey: "remoteExec", resolve: (c) => c.remoteExec?.provider ?? null }),
+    r("REMOTE_EXEC", "orchestration", "enum", "执行车道选择(点名而配不齐/认不出 ⇒ 拒启,绝不静默降级到 host/stub)", { enumValues: REMOTE_EXEC_PROVIDER_WORDS, danger: SEC, derivedDefaultNote: "缺席:CONFIG_PROVIDER=local ⇒ host;其余 ⇒ 进程内 stub(手带整族不挂;残余名册看活体 wiring_manifest 里 mountedBy=hands 的条目数,不按工具名点。想让这一形拒启见 REQUIRE_EXECUTION_LANE)", configKey: "remoteExec", resolve: (c) => c.remoteExec?.provider ?? null }),
     r("REMOTE_EXEC_HOME_DIR", "orchestration", "path", "执行环境的 home 目录(`~/` 形权限规则的基;core ExecutionEnv.homeDir 座)", { danger: SEC, derivedDefaultNote: "缺席:host/in-process ⇒ os.homedir();e2b ⇒ /home/user;k8s/local-docker/ssh/adb/device ⇒ 无(`~/` 规则 422 响亮拒)", configKey: "remoteExecHomeDir", resolve: (c) => c.remoteExecHomeDir ?? null }),
+    r("REQUIRE_EXECUTION_LANE", "orchestration", "boolean", "开了之后:REMOTE_EXEC 未点名 ∧ CONFIG_PROVIDER≠local ⇒ **拒启**并点名该设什么。默认关 = 照旧启动,但执行环境是进程内 stub、手带整族不挂,任务仍回 status=completed(活体读数:mountedBy=hands 条目 10 → 0,名册 38 → 19)—— 与「模型不肯用工具」在用户面同形。残余名册判据 = 活体 wiring_manifest 里 mountedBy=hands 的条目数,不按工具名点。托管/云部署推荐开(docs/DEPLOY-PREREQS.md)", { staticDefault: "false", danger: SEC, configKey: "requireExecutionLane" }),
     r("REQUIRE_PRINCIPAL", "auth", "boolean", "多租户开关(posture 判别位:true ⇒ CC 能力族默认收紧)", { staticDefault: "false", danger: SEC, configKey: "requirePrincipal" }),
     r("RESOURCE_SUSPEND", "approval", "boolean", "durable 路径 opt-in core resourceSuspend(预算/preempt ⇒ 可恢复挂起)", { staticDefault: "false", configKey: "resourceSuspend" }),
     r("RESOURCE_SUSPEND_MAX_SLICES", "approval", "number", "resume 链片数上限(0=不设;零进展循环兜底)", { staticDefault: "0", configKey: "resourceSuspendMaxSlices" }),
@@ -440,6 +441,7 @@ export const CONFIG_CATALOG = [
     r("TASK_MAX_TURNS_MAX", "limitsHttp", "number", "调用方自报 limits.maxTurns 的运营方封顶(同族三旋钮;只钳显式请求值,不是全队默认限额)", { danger: BILL, derivedDefaultNote: "缺席 ⇒ 不封顶" }),
     r("TASK_TIMEOUT_MAX_SEC", "limitsHttp", "number", "调用方自报 limits.timeoutSec 的运营方封顶(同族三旋钮)", { danger: BILL, derivedDefaultNote: "缺席 ⇒ 不封顶" }),
     r("TASK_TIMEOUT_SEC", "limitsHttp", "number", "任务墙钟超时(秒);0/缺席=按 tenancy(单用户无墙;多租户 2400s、大任务 3600s);正值**只抬不降**(Math.max 基值);负值拒启", { staticDefault: "0", derivedDefaultNote: "0/缺席 ⇒ 单用户无墙、多租户 2400/3600s;要低于基值的配速请用 body.limits.maxWalltimeMs" }),
+    r("TASK_WRITE_FACE_ESCALATION", "orchestration", "enum", "任务层「掀开写围栏」声明的运维天花板档位(S-591;只抬天花板,不是部署席)", { enumValues: [...TASK_WRITE_FACE_ESCALATIONS], danger: SEC, derivedDefaultNote: "三态:allow ⇒ 任务层 bypassPermissions 的开放写面成立;refuse ⇒ 无条件拒;**缺席 = 本层不表态** ⇒ 按托管 posture 判(托管拒 / 单用户 turnkey 放行)。判据单点 src/hosted-posture.ts;device 车道不适用(成文裁定:那条穿越结构性不存在)", configKey: "taskWriteFaceEscalation" }),
     r("TOOL_APPROVAL_ENABLED", "approval", "boolean", "活体工具审批 HITL(onAsk 装配;关 ⇒ core resolveAsk 走 headless 缺省)", { danger: SEC, derivedDefaultNote: "posture 三态:显式词恒赢,缺席 = 单用户(REQUIRE_PRINCIPAL≠true)⇒ on / 多租户 ⇒ off", configKey: "toolApprovalEnabled" }),
     r("TOOL_DEFER_LONGTAIL", "orchestration", "boolean", "长尾一方工具 defer 呈现(实验)", { staticDefault: "false", configKey: "toolDeferLongtail" }),
     r("TOOL_RESULT_TTL_SEC", "limitsHttp", "number", "工具结果店 TTL(秒)", { staticDefault: "86400", danger: DATA, configKey: "toolResultTtlSec", center: cLimits("toolResultTtlSec") }),

package/dist/config-center/types.d.ts

@@ -369,7 +369,7 @@ export interface EffectiveConfig {
  *  ruling riding the caps view. `required=false` / ruling absent = no enforcement (legacy). `allowedLanes` is
  *  an OPEN value domain (adding one is never BREAKING; consumers tolerate unknown names). Known lane names:
  *  `host`/`e2b`/`k8s`/`ssh`/`adb`/`local-docker`/`device` (the REMOTE_EXEC providers) **plus `in-process`**
- *  — the REMOTE_EXEC-unset fleet posture (OA/review-style workers; named distinctly from the explicit
+ *  — the REMOTE_EXEC-unset fleet posture (S-601: previously "OA/review-style workers", a scenario family retired in 5.0.0; named distinctly from the explicit
  *  `host` lane on purpose). ⚠️ Admins writing `required=true` policies must include `in-process` when such
  *  workers should stay admittable — center UI/doc 词表待补齐。
  *

package/dist/config-invariants.d.ts

@@ -28,9 +28,9 @@ import type { ServiceConfigFlat } from "./config-types.js";
  */
 export declare const LIVENESS_HEARTBEAT_MS = 30000;
 /** 闭集:新增一条不变量必须在这里加词(拼错 = 编译红,而不是运行期悄悄不判)。 */
-export type CrossInvariantId = "run-stale-heartbeat" | "bind-posture" | "bake-runner-credential" | "direct-door-anchors" | "operator-principals-required" | "bake-operator-principals" | "sensitive-write-patterns" | "leader-host-lane" | "leader-durable-store" | "device-durable-store" | "device-durable-approval" | "model-provider-word" | "gateway-url-userinfo";
+export type CrossInvariantId = "run-stale-heartbeat" | "bind-posture" | "bake-runner-credential" | "direct-door-anchors" | "operator-principals-required" | "bake-operator-principals" | "sensitive-write-patterns" | "leader-host-lane" | "leader-durable-store" | "device-durable-store" | "device-durable-approval" | "model-provider-word" | "gateway-url-userinfo" | "require-execution-lane" | "hosted-requires-principal";
 /** 表读的键集(取自平铺配置型 ⇒ 键名/类型永不与真配置漂)。 */
-export type CrossInvariantView = Readonly<Pick<ServiceConfigFlat, "runStaleSec" | "authToken" | "authTokens" | "allowUnauthedWrites" | "imageBakes" | "directApprovalDoor" | "durableApproval" | "approvalHmacKeys" | "principalJwtPubkeys" | "principalJwtIss" | "principalJwtAud" | "requirePrincipal" | "operatorPrincipals" | "sensitiveWritePatterns" | "leaderEnabled" | "remoteExec" | "dbBackend" | "tidb" | "pg" | "envModel" | "gatewayBaseUrl" | "gatewayFallbackUrls" | "anthropic">>;
+export type CrossInvariantView = Readonly<Pick<ServiceConfigFlat, "runStaleSec" | "authToken" | "authTokens" | "allowUnauthedWrites" | "imageBakes" | "directApprovalDoor" | "durableApproval" | "approvalHmacKeys" | "principalJwtPubkeys" | "principalJwtIss" | "principalJwtAud" | "requirePrincipal" | "operatorPrincipals" | "sensitiveWritePatterns" | "leaderEnabled" | "remoteExec" | "requireExecutionLane" | "dbBackend" | "tidb" | "pg" | "envModel" | "gatewayBaseUrl" | "gatewayFallbackUrls" | "anthropic" | "authBridgeIssuer">>;
 export interface CrossInvariantInput {
     /** 现役配置(boot 期 = 候选自身)。 */
     readonly live: CrossInvariantView;

package/dist/config-invariants.js

@@ -1,4 +1,5 @@
 import { assertGuardPatternsUsable } from "./deployment-governance.js";
+import { hostedPrincipalRefusal } from "./hosted-posture.js";
 import { modelProviderRefusal } from "./model-provider.js";
 import { modelRouteUrlRefusal } from "./model-route-url.js";
 export const LIVENESS_HEARTBEAT_MS = 30_000;
@@ -80,6 +81,13 @@ export const CONFIG_CROSS_INVARIANTS = [
             ? "IMAGE_BAKES_ENABLED with an EMPTY OPERATOR_PRINCIPALS is a world-writable bake door (the runner runs build.sh on the privileged build host)"
             : undefined,
     },
+    {
+        id: "hosted-requires-principal",
+        keys: ["requirePrincipal", "principalJwtPubkeys", "principalJwtIss", "principalJwtAud", "authBridgeIssuer"],
+        restartReason: "hosted-posture",
+        bootAnchor: { file: "src/config.ts", marker: "CROSS-INVARIANT:hosted-requires-principal" },
+        check: ({ next }) => hostedPrincipalRefusal(next),
+    },
     {
         id: "sensitive-write-patterns",
         keys: ["sensitiveWritePatterns"],
@@ -95,6 +103,15 @@ export const CONFIG_CROSS_INVARIANTS = [
             }
         },
     },
+    {
+        id: "require-execution-lane",
+        keys: ["requireExecutionLane", "remoteExec"],
+        restartReason: "execution-lane",
+        bootAnchor: { file: "src/config.ts", marker: "CROSS-INVARIANT:require-execution-lane" },
+        check: ({ next }) => next.requireExecutionLane && next.remoteExec === undefined
+            ? "REQUIRE_EXECUTION_LANE=true with no execution lane named (REMOTE_EXEC unset/empty and CONFIG_PROVIDER not \"local\") — the deployment asked to refuse this state"
+            : undefined,
+    },
     {
         id: "leader-host-lane",
         keys: ["leaderEnabled", "remoteExec"],

package/dist/config-types.d.ts

@@ -37,6 +37,11 @@ export interface MemoryEmbedderConfig {
  * 的 `mode` 列共读它);两词之外的值在启动期响亮拒 —— 一个拼错的档位静默落回 `audit-only` 会让运维
  * 以为在删、其实没删,而拼成别的方向就是反过来那件更坏的事。
  */
+/** S-591:任务层「掀开写围栏」的天花板档位闭集(**词表属主在此** —— config 型面与
+ *  `hosted-posture.ts` 的判据读同一份;抄第二份的那天两边会在加词时分家)。 */
+export declare const TASK_WRITE_FACE_ESCALATIONS: readonly ["allow", "refuse"];
+/** 天花板档位(闭集两词;缺席 = 本层不表态)。 */
+export type TaskWriteFaceEscalation = (typeof TASK_WRITE_FACE_ESCALATIONS)[number];
 export declare const RETENTION_MODES: readonly ["audit-only", "enforce"];
 export type RetentionMode = (typeof RETENTION_MODES)[number];
 /** [ref] §3/§4 —— sweep lane 的节律与灰度档(语义与三问见 {@link ServiceConfigFlat.retentionSweep})。 */
@@ -696,7 +701,9 @@ export interface ServiceConfigFlat {
      *  默认 10s。env `MEMORY_ORG_UNAVAILABLE_BACKOFF_MS`(numEnvBounded)。 */
     memoryOrgUnavailableBackoffMs: number;
     /** [ref] v1b + [ref]: opt-in remote execution backend (PEER adapters, chosen by REMOTE_EXEC). Unset
-     *  (OA/review deployments) → in-process stub env, zero behavior change. Secrets (apiKey/privateKey) ONLY from env.
+     *  → in-process stub env (S-601: this used to read "OA/review deployments", a scenario family retired wholesale
+     *  in 5.0.0 — see RETIRED_ENVS; the real discriminant is CONFIG_PROVIDER, and REQUIRE_EXECUTION_LANE turns this
+     *  arm into a boot refusal). Secrets (apiKey/privateKey) ONLY from env.
      *   - `e2b`  → per-task E2B Firecracker VM (isolated, suspendable). The default code-agent worker.
      *   - `k8s`  → per-task Kata pod on our k3s (isolated, NOT suspendable — no managed memory
      *              snapshot). Self-hosted sandbox lane; auth = explicit K8S_* env or in-cluster service account.
@@ -714,6 +721,25 @@ export interface ServiceConfigFlat {
      * 非绝对路径 ⇒ **拒启**([ref] A 档;core 侧同判为 `config.execution_env_home_dir_invalid`)。
      */
     remoteExecHomeDir?: string;
+    /**
+     * S-598 —— `REQUIRE_EXECUTION_LANE`:**「没点名车道」要不要拒启**。默认 **false**(缺省行为逐字不变)。
+     *
+     * `REMOTE_EXEC` 未设/空串 **∧** `CONFIG_PROVIDER ≠ local` ⇒ {@link remoteExec} 缺席 ⇒ `boot/execution-env.ts`
+     * 一条工厂臂都不走 ⇒ core 的 `handsEnabled` 为 false ⇒ **整条手带一件不挂**,而任务照跑、回执
+     * `status=completed`。[ref] 的 fail-closed 门只咬「点了名却配不齐/认不出」,**「根本没点名」是文档化的
+     * 部署姿态**,所以那道门放行。
+     *
+     * 本键把那条姿态交回给运维表态:`true` ⇒ 装配尾**拒启**并点名该设什么(`config.ts` 跨域不变量区)。
+     * 🔴 **为什么默认 off**:今天正在无手运行而自己不知道的部署(根 `docker-compose.yml` / review compose /
+     * `--sandbox=kata` 档 / web-admin 编排器起的 worker)会**升级即挂**,而其中一部分只跑只读/分析任务、
+     * 今天「能用」。缺省翻面留到下一个 major,翻之前生态有一版时间适配。托管清单推荐开
+     * (`docs/DEPLOY-PREREQS.md`)。
+     * 运维读面(2026-09-22 主会话验收订正:车原写「`GET /v1/diagnostics/wiring` 的 `executionLane.requireExecutionLane`」,
+     * 而该端点今天**没有** `executionLane` 段、`src/` 零投影 —— 一句没兑现的承诺,按 [ref] 不信 JSDoc 只信实现行的纪律改写):
+     * boot 期 `exec_lane_selected` 一行(`config.ts` 装配尾,带 `lane` / `source`)+ `GET /v1/config/catalog` 的目录行。
+     * 本键的**有效值今天没有运行期读面**;要出就随 S-602 的执行座三态在一处铸,不在这里单独长一位。
+     */
+    requireExecutionLane: boolean;
     remoteExec?: {
         provider: "e2b";
         apiKey: string;
@@ -1195,6 +1221,11 @@ export interface ServiceConfigFlat {
     /** Expected `iss` / `aud` of a direct client's principal JWT. `PRINCIPAL_JWT_ISS` / `PRINCIPAL_JWT_AUD`. */
     principalJwtIss?: string;
     principalJwtAud?: string;
+    /** S-591:registry SSO-JWT 的**显式** issuer(`AUTH_BRIDGE_ISSUER`)。
+     *  🔴 **只是显式 env,不含 boot 期那条 `?? configCenter.baseUrl` 回退**(回退仍在
+     *  `boot/stage-09-leader.ts` 的桥装配处)—— 本字段是「运维**点名了**一个外部签发方」这个事实的载体,
+     *  而那条回退的事实来源是「配了 center」= fleet 管理轴,不是租户轴(理由全文见 `hosted-posture.ts`)。 */
+    authBridgeIssuer?: string;
     /** Max accepted principal-JWT lifetime (exp − now), seconds — caps the replay window past the short-lived mandate.
      *  0 = no cap. `PRINCIPAL_JWT_MAX_TTL_SEC` (default 120). */
     principalJwtMaxTtlSec: number;
@@ -1736,6 +1767,16 @@ export interface ServiceConfigFlat {
      *  🔴 承重面**不是**装饰:`config-center/read-face.ts` 的「env 恒赢」逐键判据读的就是它(修前读的是
      *  「键在不在场」这个代理,posture 会铸键 ⇒ 代理当场失真,center 的 face 会被从没设过 env 的机器挡掉)。 */
     readFaceSource: ReadFaceSource;
+    /** S-591(7.95.0,车LT):任务层**掀开写围栏**这条声明的**运维天花板档位**(`TASK_WRITE_FACE_ESCALATION`)。
+     *  `"allow"` = 这台部署允许任务层把写容纳面开到任务根之外;`"refuse"` = 无条件拒;
+     *  **缺席 = 不表态** ⇒ 交给托管 posture 判(托管拒 / 单用户 turnkey 照旧放行)。判据单点在
+     *  `src/hosted-posture.ts` 的 `taskWriteFaceRefusal`。
+     *
+     *  🔴 **它只抬天花板,不是「部署席」**(clay 裁定② 2026-09-22):`RunnerDeps.writeFace` 那个**部署缺省席**
+     *  是另一件事 —— 把这根旋钮同时递过去,会让一条 `permissionMode:"default"` 的 run **也**拿到根外写面,
+     *  而它从没声明过(一根旋钮两个语义)。部署席保持**缺席**(= 引擎默认 `roots`),它的接线仍是登记在
+     *  `boot/runner-deps.ts` 那一行上的未闭环项。 */
+    taskWriteFaceEscalation?: TaskWriteFaceEscalation;
     /** [ref]:部署级 READ deny 追加表(additive-only,core 内建表永不可缩)。env=JSON 数组
      *  [{pattern, caseSensitive?}],boot 时用 core `compileReadDeny` 预验——坏形拒启。缺席=不铸。 */
     readDenyPatterns?: {
@@ -1878,9 +1919,9 @@ export type ServiceMemoryConfig = Pick<ServiceConfigFlat, "memoryEngineEnabled"
  *  三者都是 operator 在配置面写下的**治理声明**(与 autonomy/commandPolicy 同族),不是存储旋钮
  *  ——`retentionPolicy` 尤其容易被误归 store 组:它的消费点是 core 的启动期能力校验与将来的调度面,
  *  config 这一层它只是一句声明。 */
-export type ServiceAuthConfig = Pick<ServiceConfigFlat, "authToken" | "authTokens" | "allowUnauthedWrites" | "corsOrigins" | "principalHeader" | "requirePrincipal" | "autonomy" | "commandPolicy" | "compliancePosture" | "lockedConfigKeys" | "configCatalogEnabled" | "retentionPolicy" | "retentionSweep" | "operatorPrincipals" | "principalJwtPubkeys" | "principalJwtIss" | "principalJwtAud" | "principalJwtMaxTtlSec" | "bindHost" | "bindHostSource">;
+export type ServiceAuthConfig = Pick<ServiceConfigFlat, "authToken" | "authTokens" | "allowUnauthedWrites" | "corsOrigins" | "principalHeader" | "requirePrincipal" | "autonomy" | "commandPolicy" | "compliancePosture" | "lockedConfigKeys" | "configCatalogEnabled" | "retentionPolicy" | "retentionSweep" | "operatorPrincipals" | "principalJwtPubkeys" | "principalJwtIss" | "principalJwtAud" | "authBridgeIssuer" | "principalJwtMaxTtlSec" | "bindHost" | "bindHostSource">;
 /** 组:orchestration(编排 + 执行车道 + 沙箱面 + workflow/后台 agent 存留)。 */
-export type ServiceOrchestrationConfig = Pick<ServiceConfigFlat, "remoteExec" | "remoteExecHomeDir" | "worktreeIsolation" | "leaderEnabled" | "leaderFanoutEnabled" | "routerEnabled" | "selfOrchestrationEnabled" | "selfOrchestrationModels" | "selfOrchestrationWorkerIsolation" | "forkEnabled" | "experimentalObserverAgents" | "schedulerEnabled" | "schedulerSessionWakeup" | "schedulerSessionLifetime" | "schedulerStorePath" | "planModeEnabled" | "hooksTimeoutMs" | "workflowRunStoreBackend" | "workflowOrphanGraceMs" | "workflowJournalRetentionMs" | "workflowRunRetentionMs" | "usageWindows" | "workflowAgentsReadOnly" | "workflowSizeGuideline" | "backgroundAgentRetentionMs" | "backgroundAgentStaleRunningMs" | "backgroundAgentParkClaimStaleMs" | "delegationEntryCaps" | "rosterRetentionMs" | "leaderRunStaleMs" | "scratchpadSweepTtlMs" | "sandboxPkgSource" | "sessionAutoTitle" | "sessionAutoTitleSource" | "selectEnvironmentTool" | "envFactsEnabled" | "toolDeferLongtail" | "lspEnabled" | "lspHostEnabled" | "imageBakes" | "readFace" | "readFaceSource" | "readDenyPatterns" | "readDenyBuiltinTiers" | "readDenyBuiltinExclude">;
+export type ServiceOrchestrationConfig = Pick<ServiceConfigFlat, "remoteExec" | "remoteExecHomeDir" | "requireExecutionLane" | "worktreeIsolation" | "leaderEnabled" | "leaderFanoutEnabled" | "routerEnabled" | "selfOrchestrationEnabled" | "selfOrchestrationModels" | "selfOrchestrationWorkerIsolation" | "forkEnabled" | "experimentalObserverAgents" | "schedulerEnabled" | "schedulerSessionWakeup" | "schedulerSessionLifetime" | "schedulerStorePath" | "planModeEnabled" | "hooksTimeoutMs" | "workflowRunStoreBackend" | "workflowOrphanGraceMs" | "workflowJournalRetentionMs" | "workflowRunRetentionMs" | "usageWindows" | "workflowAgentsReadOnly" | "workflowSizeGuideline" | "backgroundAgentRetentionMs" | "backgroundAgentStaleRunningMs" | "backgroundAgentParkClaimStaleMs" | "delegationEntryCaps" | "rosterRetentionMs" | "leaderRunStaleMs" | "scratchpadSweepTtlMs" | "sandboxPkgSource" | "sessionAutoTitle" | "sessionAutoTitleSource" | "selectEnvironmentTool" | "envFactsEnabled" | "toolDeferLongtail" | "lspEnabled" | "lspHostEnabled" | "imageBakes" | "readFace" | "readFaceSource" | "taskWriteFaceEscalation" | "readDenyPatterns" | "readDenyBuiltinTiers" | "readDenyBuiltinExclude">;
 /** 组:limitsHttp(HTTP 面 + 各类上限/配额/回收窗)。 */
 export type ServiceLimitsHttpConfig = Pick<ServiceConfigFlat, "port" | "attachmentOrphanGraceMs" | "workspaceFileMaxBytes" | "attachmentMaxBytes" | "attachmentMimeAllowlist" | "attachmentUnboundTtlMs" | "infraCostRates" | "drainGraceMs" | "sighupIdleGraceMs" | "parentPid" | "engineAutoExit" | "engineLingerMs" | "engineOrphanLingerMs" | "rateLimitPerMin" | "maxTaskCostUsd" | "maxTaskTokens" | "maxPrincipalCostUsd" | "costQuotaWindowSec" | "reapIntervalSec" | "runStaleSec" | "toolResultTtlSec">;
 /** 组:observability(可观测)。 */

package/dist/config-types.js

@@ -1,3 +1,4 @@
+export const TASK_WRITE_FACE_ESCALATIONS = ["allow", "refuse"];
 export const RETENTION_MODES = ["audit-only", "enforce"];
 export const MEMORY_CONSOLIDATION_MIN_INTERVAL_SEC = 300;
 export const RESILIENCE_DEFAULTS = {

package/dist/config.js

@@ -10,13 +10,15 @@ import { DEFAULT_ELICITATION_THROTTLE } from "./elicitation.js";
 import { isV2ScopeKey } from "./memory-scope.js";
 import { DEFAULT_QUESTION_THROTTLE } from "./question.js";
 import { GIT_API_KINDS, isGitApiKind } from "./git-api-kind.js";
-import { RETENTION_MODES, MEMORY_CONSOLIDATION_MIN_INTERVAL_SEC, RESILIENCE_DEFAULTS } from "./config-types.js";
+import { RETENTION_MODES, MEMORY_CONSOLIDATION_MIN_INTERVAL_SEC, RESILIENCE_DEFAULTS, TASK_WRITE_FACE_ESCALATIONS } from "./config-types.js";
 import { buildWriteProtectionPosture } from "./write-protection.js";
 import { normalizeSshFingerprint } from "./ssh-host-key.js";
 import { readFaceForPosture } from "./read-face-posture.js";
 import { THINKING_LEVELS, THINKING_FORMATS, buildModelCompat, isThinkingFormat, isThinkingTier } from "./model-compat.js";
 import {} from "./posture-source.js";
+import { hostedPrincipalRefusal } from "./hosted-posture.js";
 import { CONTROL_AND_BIDI_STRIP_RE } from "./text-bidi.js";
+import { REMOTE_EXEC_PROVIDER_WORDS } from "./execution-lane-caps.js";
 import { AUTONOMY_MODES } from "./runtime-governance.js";
 import { modelProviderRefusal } from "./model-provider.js";
 import { modelRouteUrlRefusal } from "./model-route-url.js";
@@ -1590,6 +1592,7 @@ function parseAuthDomain(ctx) {
         principalJwtPubkeys,
         principalJwtIss,
         principalJwtAud,
+        authBridgeIssuer: process.env.AUTH_BRIDGE_ISSUER || undefined,
         principalJwtMaxTtlSec,
     };
 }
@@ -1637,9 +1640,11 @@ function parseOrchestrationDomain(ctx) {
         }
     }
     return {
+        requireExecutionLane: boolEnv("REQUIRE_EXECUTION_LANE", false),
         ...(process.env.READ_FACE !== undefined
             ? { readFace: enumEnv("READ_FACE", "roots", ["open", "roots"]), readFaceSource: "env" }
             : readFaceForPosture(singleUserTurnkey)),
+        ...optionalEnumKey("taskWriteFaceEscalation", "TASK_WRITE_FACE_ESCALATION", process.env.TASK_WRITE_FACE_ESCALATION, TASK_WRITE_FACE_ESCALATIONS),
         ...(process.env.READ_DENY_PATTERNS !== undefined ? { readDenyPatterns: parseReadDenyPatternsEnv(process.env.READ_DENY_PATTERNS) } : {}),
         ...(() => {
             const tiers = process.env.READ_DENY_BUILTIN_TIERS !== undefined ? parseNameListEnv("READ_DENY_BUILTIN_TIERS", process.env.READ_DENY_BUILTIN_TIERS, { emptySentinel: "none" }) : undefined;
@@ -2054,17 +2059,17 @@ const AUTH_GROUP_KEYS = [
     "authToken", "authTokens", "allowUnauthedWrites", "corsOrigins", "principalHeader", "requirePrincipal", "autonomy",
     "commandPolicy", "compliancePosture", "lockedConfigKeys", "retentionPolicy", "retentionSweep",
     "operatorPrincipals", "configCatalogEnabled", "principalJwtPubkeys", "principalJwtIss", "principalJwtAud",
-    "principalJwtMaxTtlSec", "bindHost", "bindHostSource",
+    "principalJwtMaxTtlSec", "authBridgeIssuer", "bindHost", "bindHostSource",
 ];
 const ORCHESTRATION_GROUP_KEYS = [
-    "remoteExec", "remoteExecHomeDir", "worktreeIsolation", "leaderEnabled", "leaderFanoutEnabled", "routerEnabled", "selfOrchestrationEnabled",
+    "remoteExec", "remoteExecHomeDir", "requireExecutionLane", "worktreeIsolation", "leaderEnabled", "leaderFanoutEnabled", "routerEnabled", "selfOrchestrationEnabled",
     "selfOrchestrationModels", "selfOrchestrationWorkerIsolation", "forkEnabled", "experimentalObserverAgents",
     "schedulerEnabled", "schedulerSessionWakeup", "schedulerSessionLifetime", "schedulerStorePath", "planModeEnabled", "hooksTimeoutMs", "workflowRunStoreBackend",
     "workflowOrphanGraceMs", "workflowJournalRetentionMs", "workflowRunRetentionMs", "usageWindows", "workflowAgentsReadOnly",
     "workflowSizeGuideline", "backgroundAgentRetentionMs", "backgroundAgentStaleRunningMs",
     "backgroundAgentParkClaimStaleMs", "delegationEntryCaps", "rosterRetentionMs", "leaderRunStaleMs", "scratchpadSweepTtlMs", "sandboxPkgSource",
     "sessionAutoTitle", "sessionAutoTitleSource", "selectEnvironmentTool", "envFactsEnabled", "toolDeferLongtail", "lspEnabled", "lspHostEnabled",
-    "imageBakes", "readFace", "readFaceSource", "readDenyPatterns", "readDenyBuiltinTiers", "readDenyBuiltinExclude",
+    "imageBakes", "readFace", "readFaceSource", "taskWriteFaceEscalation", "readDenyPatterns", "readDenyBuiltinTiers", "readDenyBuiltinExclude",
 ];
 const LIMITS_HTTP_GROUP_KEYS = [
     "port", "attachmentOrphanGraceMs", "workspaceFileMaxBytes", "attachmentMaxBytes", "attachmentMimeAllowlist",
@@ -2164,6 +2169,10 @@ export function loadConfig() {
     if (dgDurable && requirePrincipal && dgOperators.length === 0) {
         throw new Error("DURABLE_APPROVAL=true + REQUIRE_PRINCIPAL=true but OPERATOR_PRINCIPALS is empty — on a multi-tenant worker the empty operator set makes isOperator() true-for-all, so every authenticated tenant could read every other tenant's pending-approval queue (GET /v1/approvals & siblings). Set OPERATOR_PRINCIPALS, or unset REQUIRE_PRINCIPAL if this is a single-tenant deployment (#157-① boot invariant)");
     }
+    const hostedRefusal = hostedPrincipalRefusal({ requirePrincipal, principalJwtPubkeys, principalJwtIss, principalJwtAud, authBridgeIssuer: auth.authBridgeIssuer });
+    if (hostedRefusal !== undefined) {
+        throw new Error(hostedRefusal);
+    }
     if (imageBakesEnabled && dgOperators.length === 0) {
         throw new Error("IMAGE_BAKES_ENABLED=true but OPERATOR_PRINCIPALS is empty — the bake door runs build.sh on the privileged build host; an empty operator set makes isOperator() true-for-all (world-writable RCE). Set OPERATOR_PRINCIPALS or disable bakes (IMAGE-API-DESIGN.md §P2.4a boot invariant)");
     }
@@ -2204,6 +2213,17 @@ export function loadConfig() {
                 "Set DURABLE_APPROVAL=true, or unset REMOTE_EXEC (device-executor-lane-v2 §4.7 boot invariant)");
         }
     }
+    if (orchestration.requireExecutionLane && orchestration.remoteExec === undefined) {
+        throw new Error(`REQUIRE_EXECUTION_LANE=true but NO execution lane is named on this deployment — refusing to start. ` +
+            `With no lane the engine falls back to its in-process stub environment, where at least the Bash tool is ` +
+            `not mounted, yet every task still returns status=completed — indistinguishable from "the model chose ` +
+            `not to use its tools". (What the roster actually keeps is a per-run fact: read the wiring_manifest ` +
+            `event and count entries whose mountedBy is "hands".) ` +
+            `Cause: REMOTE_EXEC is unset/empty AND CONFIG_PROVIDER is not "local". ` +
+            `Fix: set REMOTE_EXEC to one of ${REMOTE_EXEC_PROVIDER_WORDS.join(" | ")} (and that lane's required env), ` +
+            `or set CONFIG_PROVIDER=local to take the single-machine \`host\` default, ` +
+            `or unset REQUIRE_EXECUTION_LANE to keep running without hands on purpose.`);
+    }
     EXEC_LANE_NOTICE = buildExecLaneNotice(orchestration.remoteExec);
     return attachConfigGroups({
         ...store,