@sema-agent/server 7.94.0 → 7.95.0

package/USAGE.md

@@ -747,6 +747,58 @@ READ_DENY_PATTERNS='[{"pattern":"**/secrets/**"},{"pattern":".ssh","caseSensitiv
   ⚠️ 本地 `config.d/` 车道今天**接不上**这一域(registry-core 的可移植域表里没有它),只有
   `CONFIG_PROVIDER=remote` 的部署走得通。
 
+**可选 — 任务层「掀开写围栏」的运维天花板(`TASK_WRITE_FACE_ESCALATION`,7.95.0 起 / S-591)**
+
+```bash
+TASK_WRITE_FACE_ESCALATION=allow     # 词表 allow|refuse;坏词启动期响亮拒;空串按未设
+                                     # 不设 = 本层不表态 ⇒ 按「托管形」posture 判(见下表)
+```
+
+- **它管什么**:`permissionMode:"bypassPermissions"` 派生 `TaskSpec.writeFace:"open"` ——
+  也就是说**一个调用方**可以掀掉写围栏(任务根之外也能写)。而引擎的解析序在普通部署上是
+  **任务席赢部署席**,引擎里唯一压得住它的两形(org 治理 / 只读 verifier 挂载)在本仓一个结构上不可达、
+  一个要靠 `AUTONOMY=read-only|plan`(那是**整条 run 禁写**,不是等比例旋钮)。⇒ 天花板由 **server 在
+  受理请求时**执行:不给的时候 **422 响亮拒**(`errorCode: request.host_posture_refused`),而**不是**
+  被静默钳回 roots(静默钳是本仓明令要修掉的失败形:调用方明说「别拦我」,却撞上一道它掀不掉
+  也看不见的墙)。
+- 🔴 **它只抬天花板,不是「部署席」**:它**不会**给一条没声明过的 run 开根外写面。
+  `RunnerDeps.writeFace`(部署**缺省**席)本版**仍然缺席** = 引擎默认 `roots`,那是另一件事、另一根
+  尚未铸出的旋钮(落点登记在 `src/boot/runner-deps.ts` 那一行上)。
+- **三态,与 `READ_FACE` 同律(显式 env 恒赢 > posture > 默认)**:
+
+  | `TASK_WRITE_FACE_ESCALATION` | 托管形? | `permissionMode:"bypassPermissions"` 的结局 |
+  |---|---|---|
+  | `allow` | 任意 | **放行**(部署允许任务层开写面) |
+  | `refuse` | 任意 | **422 拒**(运维显式表态**无条件**恒赢,不挂任何客户端派生腿) |
+  | 未设 | 否(单用户 turnkey) | **放行** —— 与 7.94 及以前逐字节相同 |
+  | 未设 | **是** | **422 拒**,拒因点名 `TASK_WRITE_FACE_ESCALATION=allow` 与判成托管的证据 |
+
+- 🔴 **`REMOTE_EXEC=device` 车道上本门不适用**(任何 `REQUIRE_PRINCIPAL` 值):那条车道的路径落在
+  **发起者自己的设备**上,归属由 `device_session` 绑定行 + 准入链的 owner 谓词验过 —— host 闸防的
+  跨租户宿主穿越在那儿**结构性不存在**(成文裁定,与 `settings.env` / `cwd` 两键在该车道上的既有臂同源),
+  也叠加「device 车道不额外加一道审批」这条既定纪律。⚠️ 运维的**显式** `refuse` 在 device 上照样恒赢(旋钮不挂车道派生腿)。
+- **「托管形」怎么判**(判据单点 `src/hosted-posture.ts`,两类三条证据,任一成立即托管):
+  ① `REQUIRE_PRINCIPAL=true`(定义式);② `PRINCIPAL_JWT_PUBKEYS` / `_ISS` / `_AUD` 任一在场;
+  ③ `AUTH_BRIDGE_ISSUER` **显式**在场。②③ 的共同标准是**运维点名了一个外部身份签发方** ——
+  一台机器一个可信主人的形不需要向任何人验签。
+  🔴 **「受控于控制面」不算证据**:`SEMA_REGISTRY_*`(含 worker 名)与 auth-bridge 那条
+  `?? configCenter.baseUrl` 回退**都不读** —— fleet 管理轴 ≠ 租户轴(一台 `sema run-local` 从组织下发面
+  取配置是正当用法)。其余被排除的候选(`OPERATOR_PRINCIPALS`、`SERVICE_AUTH_TOKENS` 条目数、
+  `DB_BACKEND`、`BIND_HOST`)逐条写在 `docs/DEPLOY-PREREQS.md`。
+- **同族的 `approverPosture` 是「忽略 + 留声」,不是拒**:提交体的 `approverPosture` 同样是一句宿主姿态
+  声明(引擎据此把 bypass 指令渲给模型 —— 那段文字指示模型改用 Bash 改文件而不是用文件工具),
+  托管形上它被**忽略**并留一条 `task_approver_posture_ignored`(与 `settings.hooks` / `cwd` /
+  `settings.env` 三条同姿势)。⚠️ 刻意**不拒**:它零授权,而续跑腿逐字重放盘上的体、调用方删不掉它 ⇒
+  拒会把一条 parked 任务永久砖死。
+- **续跑腿**:一条在托管形机器上带着 `bypassPermissions` 的 parked 任务,赎回时被同一道门挡住,
+  上层折成 `409 resume_blocked_by_policy`(`blockedBy: request.host_posture_refused`)。
+  运维的解法是 `TASK_WRITE_FACE_ESCALATION=allow`。
+- **能力面披露位**:`GET /v1/capabilities` 的 `taskWriteFaceOpen`(`false` ⇒ 发那个键会拿 422)——
+  壳不必靠踩一次 422 才学会。
+- **`AUTONOMY=read-only|plan` 一行未动**。⚠️ 两者叠加时**本门先说话**:托管形 + `AUTONOMY=read-only`
+  + `bypassPermissions` 的请求现在是 422,而 7.94 及以前它会跑起来(写被 autonomy 禁掉)。
+  要保留旧结局就 `TASK_WRITE_FACE_ESCALATION=allow`(写面仍被 autonomy 压回 roots)。
+
 - **MCP 撤销腿(7.39 起)**:MCP 服务器 mount 仍是 restart-to-apply(新增/改址要
   restart 才生效),但**从 enabled 集删除一个服务器即时生效**——refresh 拍收货后,被删服务器的
   MCP 调用当场按 coded 拒绝 `mcp.server_revoked` 结算(known-not-executed,引擎每次派发前探询

package/dist/boot/resolve-spec.js

@@ -13,6 +13,7 @@ import { assertGuardPatternsUsable, buildOnlySensitiveBaselineWarning, createApp
 import { acceptShellScratchpadDir, buildEnvFacts, egressForRemoteExec, ensureScratchpadDir, resumeFactsForLane, scratchpadCoveringTaskRoot } from "../env-facts.js";
 import { FleetEventBus } from "../fleet/fleet-bus.js";
 import { composeHooks, createTaskHooks } from "../hooks/hook-runner.js";
+import { HOST_POSTURE_REFUSED_CODE, taskApproverPostureHonored, taskWriteFaceRefusal } from "../hosted-posture.js";
 import { headerStr } from "../http/principal-gate.js";
 import { explicitOperatorOk } from "../http/server.js";
 import { isModelAllowlisted, matchCatalogModel, modelSupportsImages, resolveTaskModel, terminalCatalogName } from "../model-select.js";
@@ -68,6 +69,11 @@ export function createResolveSpec(ctx) {
         assertRequestA2aUnlocked(body.a2aPeers, lockedKeys);
         const gated = await gateScenarioAndAppend(body, auth, opts);
         const effMode = effectivePermissionMode(body, gated.parsedSettings.settings);
+        if (effMode !== undefined && writeFaceForMode(effMode) === "open") {
+            const why = taskWriteFaceRefusal(config);
+            if (why !== undefined)
+                throw new HttpError(422, why, { code: HOST_POSTURE_REFUSED_CODE });
+        }
         noteSessionShellGate?.(auth?.sessionId, effMode !== undefined && shellGateForMode(effMode) === "off");
         const lane = bindSettingsCwdEnvAndModel(body, auth, gated, effMode, opts);
         const anchors = await resolveHistoryAnchors(body, auth);
@@ -296,7 +302,14 @@ export function createResolveSpec(ctx) {
             ...(effMode ? { shellGate: shellGateForMode(effMode) } : {}),
             ...((f) => (f !== undefined ? { writeFace: f } : {}))(effMode !== undefined ? writeFaceForMode(effMode) : undefined),
             ...((f) => (f !== undefined ? { autoModeRequested: f } : {}))(effMode !== undefined ? autoModeRequestedForMode(effMode) : undefined),
-            ...(body.approverPosture !== undefined ? { approverPosture: body.approverPosture } : {}),
+            ...(() => {
+                if (body.approverPosture === undefined)
+                    return {};
+                if (taskApproverPostureHonored(config))
+                    return { approverPosture: body.approverPosture };
+                logger.warn("task_approver_posture_ignored", { honored: false, sessionId: auth?.sessionId ?? null });
+                return {};
+            })(),
             selfOrchestration: selfOrchestrationFromBody({ selfOrchestration: body.selfOrchestration === true || parsedSettings.settings?.ultracode === true }, config, Boolean(centerRuntimeCapsResolver)),
             forwardSubagentEvents: body.forwardSubagentEvents === true ? true : undefined,
             retainSubagentSessions: normalizeRetainSubagentSessions(body.retainSubagentSessions),

package/dist/boot/stage-09-leader.js

@@ -16,7 +16,7 @@ export function runStage09(ctx) {
     });
     const leaderEndpoint = createLeaderFace({ config, logger, brain, pricing, executionEnvFactory, toolResultStore, sessionStore, checkpointStore, governanceSeams, backend, tracer, usageWindowStore, promptSource: configCenter.promptSource, onError: runnerDeps.onError });
     const drainState = { draining: false };
-    const authBridgeIssuer = process.env.AUTH_BRIDGE_ISSUER || config.configCenter?.baseUrl;
+    const authBridgeIssuer = config.authBridgeIssuer ?? config.configCenter?.baseUrl;
     const registryJwtVerifier = authBridgeIssuer
         ? createRegistryJwtVerifier({
             issuer: authBridgeIssuer,

package/dist/config-catalog.js

@@ -1,6 +1,6 @@
 import { CROSS_SESSION_INBOUND_SETTINGS, CROSS_SESSION_DIALOG_EXPIRY_VALUES } from "@sema-agent/core";
 import { THINKING_FORMATS } from "./model-compat.js";
-import { RESILIENCE_DEFAULTS } from "./config-types.js";
+import { RESILIENCE_DEFAULTS, TASK_WRITE_FACE_ESCALATIONS } from "./config-types.js";
 import { webSearchConfigFromEnv, WEB_SEARCH_PROVIDERS } from "./plugins/web-search.js";
 import { AUTONOMY_MODES } from "./runtime-governance.js";
 import { REMOTE_EXEC_PROVIDER_WORDS } from "./execution-lane-caps.js";
@@ -74,7 +74,7 @@ export const CONFIG_CATALOG = [
     r("ATTACHMENT_ORPHAN_GRACE_MS", "limitsHttp", "number", "附件孤儿对象 GC 宽限(ms;0=关本腿,坏值回默认+warn)", { staticDefault: "3600000", danger: DATA, center: cLimits("attachmentOrphanGraceMs") }),
     r("ATTACHMENT_UNBOUND_TTL_MS", "limitsHttp", "number", "未绑定附件的 TTL(ms)", { staticDefault: String(24 * 3600 * 1000), danger: DATA, configKey: "attachmentUnboundTtlMs", center: cLimits("attachmentUnboundTtlMs") }),
     r("AUTH_BRIDGE_AUDIENCE", "auth", "string", "registry SSO-JWT 验签期望 aud", { danger: SEC }),
-    r("AUTH_BRIDGE_ISSUER", "auth", "url", "registry SSO-JWT issuer(auth bridge 的开关之一)", { danger: SEC, derivedDefaultNote: "缺席 ⇒ 用 configCenter.baseUrl(配了 center 即默认开桥)" }),
+    r("AUTH_BRIDGE_ISSUER", "auth", "url", "registry SSO-JWT issuer(auth bridge 的开关之一;S-591 起也是托管形判据的一条证据 —— 只认显式值,不认 center 回退)", { danger: SEC, derivedDefaultNote: "缺席 ⇒ 桥的装配处回退到 configCenter.baseUrl(配了 center 即默认开桥);但**托管判据不读那条回退**(fleet 管理轴 ≠ 租户轴)", configKey: "authBridgeIssuer" }),
     r("AUTH_BRIDGE_JWKS_URL", "auth", "url", "registry SSO-JWT 的 JWKS 地址(缺省从 issuer 派生)", { danger: SEC }),
     r("AUTONOMY", "auth", "enum", "运维 autonomy 模式,tighten-only 叠到每个 TaskSpec(read-only/plan ⇒ 只读手,ask ⇒ 恒 shellGate);center 腿热且 non-sticky", { danger: SEC, enumValues: AUTONOMY_MODES, configKey: "autonomy", center: cGov("autonomy") }),
     r("AUTO_MODE_CLASSIFIER_FALLBACK", "approval", "enum", "auto 分类器席答不出裁决时的梯子(main=主模型代判 / none=只留分类器那一级,整条拒)", { enumValues: ["main", "none"], danger: SEC, derivedDefaultNote: "未设/空串 ⇒ 不铸键,跟随引擎缺省 main(core 7.18.0 起;空串按未设,与其余词表旋钮同判);none = 7.77.0 及以前的行为逐字;词表外的值启动期拒启。权限轴放宽,升级须知见 DEPLOY-PREREQS", configKey: "autoModeClassifierFallback" }),
@@ -353,8 +353,9 @@ export const CONFIG_CATALOG = [
     r("READ_FACE", "orchestration", "enum", "READ 容纳面档位(env 逐键恒赢 center —— 部署主权表达)", { enumValues: ["open", "roots"], danger: SEC, derivedDefaultNote: "缺席 ⇒ 按 posture 派生(S-167):单用户 turnkey(REQUIRE_PRINCIPAL 未设)铸 open;多租户不铸键、core 默认 roots。生效来源见 GET /v1/diagnostics/wiring 的 readFace.source 四词", configKey: "readFace", center: cRead("face", "readFace") }),
     r("REAP_INTERVAL_SEC", "limitsHttp", "number", "reaper 周期(秒)", { staticDefault: "60", configKey: "reapIntervalSec" }),
     r("REAP_RUN_STALE_SEC", "limitsHttp", "number", "run 活性判陈旧阈(秒)", { staticDefault: "120", configKey: "runStaleSec", center: cLimits("runStaleSec") }),
-    r("REMOTE_EXEC", "orchestration", "enum", "执行车道选择(点名而配不齐/认不出 ⇒ 拒启,绝不静默降级到 host/stub)", { enumValues: REMOTE_EXEC_PROVIDER_WORDS, danger: SEC, derivedDefaultNote: "缺席:CONFIG_PROVIDER=local ⇒ host;其余 ⇒ 进程内 stub", configKey: "remoteExec", resolve: (c) => c.remoteExec?.provider ?? null }),
+    r("REMOTE_EXEC", "orchestration", "enum", "执行车道选择(点名而配不齐/认不出 ⇒ 拒启,绝不静默降级到 host/stub)", { enumValues: REMOTE_EXEC_PROVIDER_WORDS, danger: SEC, derivedDefaultNote: "缺席:CONFIG_PROVIDER=local ⇒ host;其余 ⇒ 进程内 stub(手带整族不挂;残余名册看活体 wiring_manifest 里 mountedBy=hands 的条目数,不按工具名点。想让这一形拒启见 REQUIRE_EXECUTION_LANE)", configKey: "remoteExec", resolve: (c) => c.remoteExec?.provider ?? null }),
     r("REMOTE_EXEC_HOME_DIR", "orchestration", "path", "执行环境的 home 目录(`~/` 形权限规则的基;core ExecutionEnv.homeDir 座)", { danger: SEC, derivedDefaultNote: "缺席:host/in-process ⇒ os.homedir();e2b ⇒ /home/user;k8s/local-docker/ssh/adb/device ⇒ 无(`~/` 规则 422 响亮拒)", configKey: "remoteExecHomeDir", resolve: (c) => c.remoteExecHomeDir ?? null }),
+    r("REQUIRE_EXECUTION_LANE", "orchestration", "boolean", "开了之后:REMOTE_EXEC 未点名 ∧ CONFIG_PROVIDER≠local ⇒ **拒启**并点名该设什么。默认关 = 照旧启动,但执行环境是进程内 stub、手带整族不挂,任务仍回 status=completed(活体读数:mountedBy=hands 条目 10 → 0,名册 38 → 19)—— 与「模型不肯用工具」在用户面同形。残余名册判据 = 活体 wiring_manifest 里 mountedBy=hands 的条目数,不按工具名点。托管/云部署推荐开(docs/DEPLOY-PREREQS.md)", { staticDefault: "false", danger: SEC, configKey: "requireExecutionLane" }),
     r("REQUIRE_PRINCIPAL", "auth", "boolean", "多租户开关(posture 判别位:true ⇒ CC 能力族默认收紧)", { staticDefault: "false", danger: SEC, configKey: "requirePrincipal" }),
     r("RESOURCE_SUSPEND", "approval", "boolean", "durable 路径 opt-in core resourceSuspend(预算/preempt ⇒ 可恢复挂起)", { staticDefault: "false", configKey: "resourceSuspend" }),
     r("RESOURCE_SUSPEND_MAX_SLICES", "approval", "number", "resume 链片数上限(0=不设;零进展循环兜底)", { staticDefault: "0", configKey: "resourceSuspendMaxSlices" }),
@@ -440,6 +441,7 @@ export const CONFIG_CATALOG = [
     r("TASK_MAX_TURNS_MAX", "limitsHttp", "number", "调用方自报 limits.maxTurns 的运营方封顶(同族三旋钮;只钳显式请求值,不是全队默认限额)", { danger: BILL, derivedDefaultNote: "缺席 ⇒ 不封顶" }),
     r("TASK_TIMEOUT_MAX_SEC", "limitsHttp", "number", "调用方自报 limits.timeoutSec 的运营方封顶(同族三旋钮)", { danger: BILL, derivedDefaultNote: "缺席 ⇒ 不封顶" }),
     r("TASK_TIMEOUT_SEC", "limitsHttp", "number", "任务墙钟超时(秒);0/缺席=按 tenancy(单用户无墙;多租户 2400s、大任务 3600s);正值**只抬不降**(Math.max 基值);负值拒启", { staticDefault: "0", derivedDefaultNote: "0/缺席 ⇒ 单用户无墙、多租户 2400/3600s;要低于基值的配速请用 body.limits.maxWalltimeMs" }),
+    r("TASK_WRITE_FACE_ESCALATION", "orchestration", "enum", "任务层「掀开写围栏」声明的运维天花板档位(S-591;只抬天花板,不是部署席)", { enumValues: [...TASK_WRITE_FACE_ESCALATIONS], danger: SEC, derivedDefaultNote: "三态:allow ⇒ 任务层 bypassPermissions 的开放写面成立;refuse ⇒ 无条件拒;**缺席 = 本层不表态** ⇒ 按托管 posture 判(托管拒 / 单用户 turnkey 放行)。判据单点 src/hosted-posture.ts;device 车道不适用(成文裁定:那条穿越结构性不存在)", configKey: "taskWriteFaceEscalation" }),
     r("TOOL_APPROVAL_ENABLED", "approval", "boolean", "活体工具审批 HITL(onAsk 装配;关 ⇒ core resolveAsk 走 headless 缺省)", { danger: SEC, derivedDefaultNote: "posture 三态:显式词恒赢,缺席 = 单用户(REQUIRE_PRINCIPAL≠true)⇒ on / 多租户 ⇒ off", configKey: "toolApprovalEnabled" }),
     r("TOOL_DEFER_LONGTAIL", "orchestration", "boolean", "长尾一方工具 defer 呈现(实验)", { staticDefault: "false", configKey: "toolDeferLongtail" }),
     r("TOOL_RESULT_TTL_SEC", "limitsHttp", "number", "工具结果店 TTL(秒)", { staticDefault: "86400", danger: DATA, configKey: "toolResultTtlSec", center: cLimits("toolResultTtlSec") }),

package/dist/config-center/types.d.ts

@@ -369,7 +369,7 @@ export interface EffectiveConfig {
  *  ruling riding the caps view. `required=false` / ruling absent = no enforcement (legacy). `allowedLanes` is
  *  an OPEN value domain (adding one is never BREAKING; consumers tolerate unknown names). Known lane names:
  *  `host`/`e2b`/`k8s`/`ssh`/`adb`/`local-docker`/`device` (the REMOTE_EXEC providers) **plus `in-process`**
- *  — the REMOTE_EXEC-unset fleet posture (OA/review-style workers; named distinctly from the explicit
+ *  — the REMOTE_EXEC-unset fleet posture (S-601: previously "OA/review-style workers", a scenario family retired in 5.0.0; named distinctly from the explicit
  *  `host` lane on purpose). ⚠️ Admins writing `required=true` policies must include `in-process` when such
  *  workers should stay admittable — center UI/doc 词表待补齐。
  *

package/dist/config-invariants.d.ts

@@ -28,9 +28,9 @@ import type { ServiceConfigFlat } from "./config-types.js";
  */
 export declare const LIVENESS_HEARTBEAT_MS = 30000;
 /** 闭集:新增一条不变量必须在这里加词(拼错 = 编译红,而不是运行期悄悄不判)。 */
-export type CrossInvariantId = "run-stale-heartbeat" | "bind-posture" | "bake-runner-credential" | "direct-door-anchors" | "operator-principals-required" | "bake-operator-principals" | "sensitive-write-patterns" | "leader-host-lane" | "leader-durable-store" | "device-durable-store" | "device-durable-approval" | "model-provider-word" | "gateway-url-userinfo";
+export type CrossInvariantId = "run-stale-heartbeat" | "bind-posture" | "bake-runner-credential" | "direct-door-anchors" | "operator-principals-required" | "bake-operator-principals" | "sensitive-write-patterns" | "leader-host-lane" | "leader-durable-store" | "device-durable-store" | "device-durable-approval" | "model-provider-word" | "gateway-url-userinfo" | "require-execution-lane" | "hosted-requires-principal";
 /** 表读的键集(取自平铺配置型 ⇒ 键名/类型永不与真配置漂)。 */
-export type CrossInvariantView = Readonly<Pick<ServiceConfigFlat, "runStaleSec" | "authToken" | "authTokens" | "allowUnauthedWrites" | "imageBakes" | "directApprovalDoor" | "durableApproval" | "approvalHmacKeys" | "principalJwtPubkeys" | "principalJwtIss" | "principalJwtAud" | "requirePrincipal" | "operatorPrincipals" | "sensitiveWritePatterns" | "leaderEnabled" | "remoteExec" | "dbBackend" | "tidb" | "pg" | "envModel" | "gatewayBaseUrl" | "gatewayFallbackUrls" | "anthropic">>;
+export type CrossInvariantView = Readonly<Pick<ServiceConfigFlat, "runStaleSec" | "authToken" | "authTokens" | "allowUnauthedWrites" | "imageBakes" | "directApprovalDoor" | "durableApproval" | "approvalHmacKeys" | "principalJwtPubkeys" | "principalJwtIss" | "principalJwtAud" | "requirePrincipal" | "operatorPrincipals" | "sensitiveWritePatterns" | "leaderEnabled" | "remoteExec" | "requireExecutionLane" | "dbBackend" | "tidb" | "pg" | "envModel" | "gatewayBaseUrl" | "gatewayFallbackUrls" | "anthropic" | "authBridgeIssuer">>;
 export interface CrossInvariantInput {
     /** 现役配置(boot 期 = 候选自身)。 */
     readonly live: CrossInvariantView;

package/dist/config-invariants.js

@@ -1,4 +1,5 @@
 import { assertGuardPatternsUsable } from "./deployment-governance.js";
+import { hostedPrincipalRefusal } from "./hosted-posture.js";
 import { modelProviderRefusal } from "./model-provider.js";
 import { modelRouteUrlRefusal } from "./model-route-url.js";
 export const LIVENESS_HEARTBEAT_MS = 30_000;
@@ -80,6 +81,13 @@ export const CONFIG_CROSS_INVARIANTS = [
             ? "IMAGE_BAKES_ENABLED with an EMPTY OPERATOR_PRINCIPALS is a world-writable bake door (the runner runs build.sh on the privileged build host)"
             : undefined,
     },
+    {
+        id: "hosted-requires-principal",
+        keys: ["requirePrincipal", "principalJwtPubkeys", "principalJwtIss", "principalJwtAud", "authBridgeIssuer"],
+        restartReason: "hosted-posture",
+        bootAnchor: { file: "src/config.ts", marker: "CROSS-INVARIANT:hosted-requires-principal" },
+        check: ({ next }) => hostedPrincipalRefusal(next),
+    },
     {
         id: "sensitive-write-patterns",
         keys: ["sensitiveWritePatterns"],
@@ -95,6 +103,15 @@ export const CONFIG_CROSS_INVARIANTS = [
             }
         },
     },
+    {
+        id: "require-execution-lane",
+        keys: ["requireExecutionLane", "remoteExec"],
+        restartReason: "execution-lane",
+        bootAnchor: { file: "src/config.ts", marker: "CROSS-INVARIANT:require-execution-lane" },
+        check: ({ next }) => next.requireExecutionLane && next.remoteExec === undefined
+            ? "REQUIRE_EXECUTION_LANE=true with no execution lane named (REMOTE_EXEC unset/empty and CONFIG_PROVIDER not \"local\") — the deployment asked to refuse this state"
+            : undefined,
+    },
     {
         id: "leader-host-lane",
         keys: ["leaderEnabled", "remoteExec"],

package/dist/config-types.d.ts

@@ -37,6 +37,11 @@ export interface MemoryEmbedderConfig {
  * 的 `mode` 列共读它);两词之外的值在启动期响亮拒 —— 一个拼错的档位静默落回 `audit-only` 会让运维
  * 以为在删、其实没删,而拼成别的方向就是反过来那件更坏的事。
  */
+/** S-591:任务层「掀开写围栏」的天花板档位闭集(**词表属主在此** —— config 型面与
+ *  `hosted-posture.ts` 的判据读同一份;抄第二份的那天两边会在加词时分家)。 */
+export declare const TASK_WRITE_FACE_ESCALATIONS: readonly ["allow", "refuse"];
+/** 天花板档位(闭集两词;缺席 = 本层不表态)。 */
+export type TaskWriteFaceEscalation = (typeof TASK_WRITE_FACE_ESCALATIONS)[number];
 export declare const RETENTION_MODES: readonly ["audit-only", "enforce"];
 export type RetentionMode = (typeof RETENTION_MODES)[number];
 /** [ref] §3/§4 —— sweep lane 的节律与灰度档(语义与三问见 {@link ServiceConfigFlat.retentionSweep})。 */
@@ -696,7 +701,9 @@ export interface ServiceConfigFlat {
      *  默认 10s。env `MEMORY_ORG_UNAVAILABLE_BACKOFF_MS`(numEnvBounded)。 */
     memoryOrgUnavailableBackoffMs: number;
     /** [ref] v1b + [ref]: opt-in remote execution backend (PEER adapters, chosen by REMOTE_EXEC). Unset
-     *  (OA/review deployments) → in-process stub env, zero behavior change. Secrets (apiKey/privateKey) ONLY from env.
+     *  → in-process stub env (S-601: this used to read "OA/review deployments", a scenario family retired wholesale
+     *  in 5.0.0 — see RETIRED_ENVS; the real discriminant is CONFIG_PROVIDER, and REQUIRE_EXECUTION_LANE turns this
+     *  arm into a boot refusal). Secrets (apiKey/privateKey) ONLY from env.
      *   - `e2b`  → per-task E2B Firecracker VM (isolated, suspendable). The default code-agent worker.
      *   - `k8s`  → per-task Kata pod on our k3s (isolated, NOT suspendable — no managed memory
      *              snapshot). Self-hosted sandbox lane; auth = explicit K8S_* env or in-cluster service account.
@@ -714,6 +721,25 @@ export interface ServiceConfigFlat {
      * 非绝对路径 ⇒ **拒启**([ref] A 档;core 侧同判为 `config.execution_env_home_dir_invalid`)。
      */
     remoteExecHomeDir?: string;
+    /**
+     * S-598 —— `REQUIRE_EXECUTION_LANE`:**「没点名车道」要不要拒启**。默认 **false**(缺省行为逐字不变)。
+     *
+     * `REMOTE_EXEC` 未设/空串 **∧** `CONFIG_PROVIDER ≠ local` ⇒ {@link remoteExec} 缺席 ⇒ `boot/execution-env.ts`
+     * 一条工厂臂都不走 ⇒ core 的 `handsEnabled` 为 false ⇒ **整条手带一件不挂**,而任务照跑、回执
+     * `status=completed`。[ref] 的 fail-closed 门只咬「点了名却配不齐/认不出」,**「根本没点名」是文档化的
+     * 部署姿态**,所以那道门放行。
+     *
+     * 本键把那条姿态交回给运维表态:`true` ⇒ 装配尾**拒启**并点名该设什么(`config.ts` 跨域不变量区)。
+     * 🔴 **为什么默认 off**:今天正在无手运行而自己不知道的部署(根 `docker-compose.yml` / review compose /
+     * `--sandbox=kata` 档 / web-admin 编排器起的 worker)会**升级即挂**,而其中一部分只跑只读/分析任务、
+     * 今天「能用」。缺省翻面留到下一个 major,翻之前生态有一版时间适配。托管清单推荐开
+     * (`docs/DEPLOY-PREREQS.md`)。
+     * 运维读面(2026-09-22 主会话验收订正:车原写「`GET /v1/diagnostics/wiring` 的 `executionLane.requireExecutionLane`」,
+     * 而该端点今天**没有** `executionLane` 段、`src/` 零投影 —— 一句没兑现的承诺,按 [ref] 不信 JSDoc 只信实现行的纪律改写):
+     * boot 期 `exec_lane_selected` 一行(`config.ts` 装配尾,带 `lane` / `source`)+ `GET /v1/config/catalog` 的目录行。
+     * 本键的**有效值今天没有运行期读面**;要出就随 S-602 的执行座三态在一处铸,不在这里单独长一位。
+     */
+    requireExecutionLane: boolean;
     remoteExec?: {
         provider: "e2b";
         apiKey: string;
@@ -1195,6 +1221,11 @@ export interface ServiceConfigFlat {
     /** Expected `iss` / `aud` of a direct client's principal JWT. `PRINCIPAL_JWT_ISS` / `PRINCIPAL_JWT_AUD`. */
     principalJwtIss?: string;
     principalJwtAud?: string;
+    /** S-591:registry SSO-JWT 的**显式** issuer(`AUTH_BRIDGE_ISSUER`)。
+     *  🔴 **只是显式 env,不含 boot 期那条 `?? configCenter.baseUrl` 回退**(回退仍在
+     *  `boot/stage-09-leader.ts` 的桥装配处)—— 本字段是「运维**点名了**一个外部签发方」这个事实的载体,
+     *  而那条回退的事实来源是「配了 center」= fleet 管理轴,不是租户轴(理由全文见 `hosted-posture.ts`)。 */
+    authBridgeIssuer?: string;
     /** Max accepted principal-JWT lifetime (exp − now), seconds — caps the replay window past the short-lived mandate.
      *  0 = no cap. `PRINCIPAL_JWT_MAX_TTL_SEC` (default 120). */
     principalJwtMaxTtlSec: number;
@@ -1736,6 +1767,16 @@ export interface ServiceConfigFlat {
      *  🔴 承重面**不是**装饰:`config-center/read-face.ts` 的「env 恒赢」逐键判据读的就是它(修前读的是
      *  「键在不在场」这个代理,posture 会铸键 ⇒ 代理当场失真,center 的 face 会被从没设过 env 的机器挡掉)。 */
     readFaceSource: ReadFaceSource;
+    /** S-591(7.95.0,车LT):任务层**掀开写围栏**这条声明的**运维天花板档位**(`TASK_WRITE_FACE_ESCALATION`)。
+     *  `"allow"` = 这台部署允许任务层把写容纳面开到任务根之外;`"refuse"` = 无条件拒;
+     *  **缺席 = 不表态** ⇒ 交给托管 posture 判(托管拒 / 单用户 turnkey 照旧放行)。判据单点在
+     *  `src/hosted-posture.ts` 的 `taskWriteFaceRefusal`。
+     *
+     *  🔴 **它只抬天花板,不是「部署席」**(clay 裁定② 2026-09-22):`RunnerDeps.writeFace` 那个**部署缺省席**
+     *  是另一件事 —— 把这根旋钮同时递过去,会让一条 `permissionMode:"default"` 的 run **也**拿到根外写面,
+     *  而它从没声明过(一根旋钮两个语义)。部署席保持**缺席**(= 引擎默认 `roots`),它的接线仍是登记在
+     *  `boot/runner-deps.ts` 那一行上的未闭环项。 */
+    taskWriteFaceEscalation?: TaskWriteFaceEscalation;
     /** [ref]:部署级 READ deny 追加表(additive-only,core 内建表永不可缩)。env=JSON 数组
      *  [{pattern, caseSensitive?}],boot 时用 core `compileReadDeny` 预验——坏形拒启。缺席=不铸。 */
     readDenyPatterns?: {
@@ -1878,9 +1919,9 @@ export type ServiceMemoryConfig = Pick<ServiceConfigFlat, "memoryEngineEnabled"
  *  三者都是 operator 在配置面写下的**治理声明**(与 autonomy/commandPolicy 同族),不是存储旋钮
  *  ——`retentionPolicy` 尤其容易被误归 store 组:它的消费点是 core 的启动期能力校验与将来的调度面,
  *  config 这一层它只是一句声明。 */
-export type ServiceAuthConfig = Pick<ServiceConfigFlat, "authToken" | "authTokens" | "allowUnauthedWrites" | "corsOrigins" | "principalHeader" | "requirePrincipal" | "autonomy" | "commandPolicy" | "compliancePosture" | "lockedConfigKeys" | "configCatalogEnabled" | "retentionPolicy" | "retentionSweep" | "operatorPrincipals" | "principalJwtPubkeys" | "principalJwtIss" | "principalJwtAud" | "principalJwtMaxTtlSec" | "bindHost" | "bindHostSource">;
+export type ServiceAuthConfig = Pick<ServiceConfigFlat, "authToken" | "authTokens" | "allowUnauthedWrites" | "corsOrigins" | "principalHeader" | "requirePrincipal" | "autonomy" | "commandPolicy" | "compliancePosture" | "lockedConfigKeys" | "configCatalogEnabled" | "retentionPolicy" | "retentionSweep" | "operatorPrincipals" | "principalJwtPubkeys" | "principalJwtIss" | "principalJwtAud" | "authBridgeIssuer" | "principalJwtMaxTtlSec" | "bindHost" | "bindHostSource">;
 /** 组:orchestration(编排 + 执行车道 + 沙箱面 + workflow/后台 agent 存留)。 */
-export type ServiceOrchestrationConfig = Pick<ServiceConfigFlat, "remoteExec" | "remoteExecHomeDir" | "worktreeIsolation" | "leaderEnabled" | "leaderFanoutEnabled" | "routerEnabled" | "selfOrchestrationEnabled" | "selfOrchestrationModels" | "selfOrchestrationWorkerIsolation" | "forkEnabled" | "experimentalObserverAgents" | "schedulerEnabled" | "schedulerSessionWakeup" | "schedulerSessionLifetime" | "schedulerStorePath" | "planModeEnabled" | "hooksTimeoutMs" | "workflowRunStoreBackend" | "workflowOrphanGraceMs" | "workflowJournalRetentionMs" | "workflowRunRetentionMs" | "usageWindows" | "workflowAgentsReadOnly" | "workflowSizeGuideline" | "backgroundAgentRetentionMs" | "backgroundAgentStaleRunningMs" | "backgroundAgentParkClaimStaleMs" | "delegationEntryCaps" | "rosterRetentionMs" | "leaderRunStaleMs" | "scratchpadSweepTtlMs" | "sandboxPkgSource" | "sessionAutoTitle" | "sessionAutoTitleSource" | "selectEnvironmentTool" | "envFactsEnabled" | "toolDeferLongtail" | "lspEnabled" | "lspHostEnabled" | "imageBakes" | "readFace" | "readFaceSource" | "readDenyPatterns" | "readDenyBuiltinTiers" | "readDenyBuiltinExclude">;
+export type ServiceOrchestrationConfig = Pick<ServiceConfigFlat, "remoteExec" | "remoteExecHomeDir" | "requireExecutionLane" | "worktreeIsolation" | "leaderEnabled" | "leaderFanoutEnabled" | "routerEnabled" | "selfOrchestrationEnabled" | "selfOrchestrationModels" | "selfOrchestrationWorkerIsolation" | "forkEnabled" | "experimentalObserverAgents" | "schedulerEnabled" | "schedulerSessionWakeup" | "schedulerSessionLifetime" | "schedulerStorePath" | "planModeEnabled" | "hooksTimeoutMs" | "workflowRunStoreBackend" | "workflowOrphanGraceMs" | "workflowJournalRetentionMs" | "workflowRunRetentionMs" | "usageWindows" | "workflowAgentsReadOnly" | "workflowSizeGuideline" | "backgroundAgentRetentionMs" | "backgroundAgentStaleRunningMs" | "backgroundAgentParkClaimStaleMs" | "delegationEntryCaps" | "rosterRetentionMs" | "leaderRunStaleMs" | "scratchpadSweepTtlMs" | "sandboxPkgSource" | "sessionAutoTitle" | "sessionAutoTitleSource" | "selectEnvironmentTool" | "envFactsEnabled" | "toolDeferLongtail" | "lspEnabled" | "lspHostEnabled" | "imageBakes" | "readFace" | "readFaceSource" | "taskWriteFaceEscalation" | "readDenyPatterns" | "readDenyBuiltinTiers" | "readDenyBuiltinExclude">;
 /** 组:limitsHttp(HTTP 面 + 各类上限/配额/回收窗)。 */
 export type ServiceLimitsHttpConfig = Pick<ServiceConfigFlat, "port" | "attachmentOrphanGraceMs" | "workspaceFileMaxBytes" | "attachmentMaxBytes" | "attachmentMimeAllowlist" | "attachmentUnboundTtlMs" | "infraCostRates" | "drainGraceMs" | "sighupIdleGraceMs" | "parentPid" | "engineAutoExit" | "engineLingerMs" | "engineOrphanLingerMs" | "rateLimitPerMin" | "maxTaskCostUsd" | "maxTaskTokens" | "maxPrincipalCostUsd" | "costQuotaWindowSec" | "reapIntervalSec" | "runStaleSec" | "toolResultTtlSec">;
 /** 组:observability(可观测)。 */

package/dist/config-types.js

@@ -1,3 +1,4 @@
+export const TASK_WRITE_FACE_ESCALATIONS = ["allow", "refuse"];
 export const RETENTION_MODES = ["audit-only", "enforce"];
 export const MEMORY_CONSOLIDATION_MIN_INTERVAL_SEC = 300;
 export const RESILIENCE_DEFAULTS = {

package/dist/config.js

@@ -10,13 +10,15 @@ import { DEFAULT_ELICITATION_THROTTLE } from "./elicitation.js";
 import { isV2ScopeKey } from "./memory-scope.js";
 import { DEFAULT_QUESTION_THROTTLE } from "./question.js";
 import { GIT_API_KINDS, isGitApiKind } from "./git-api-kind.js";
-import { RETENTION_MODES, MEMORY_CONSOLIDATION_MIN_INTERVAL_SEC, RESILIENCE_DEFAULTS } from "./config-types.js";
+import { RETENTION_MODES, MEMORY_CONSOLIDATION_MIN_INTERVAL_SEC, RESILIENCE_DEFAULTS, TASK_WRITE_FACE_ESCALATIONS } from "./config-types.js";
 import { buildWriteProtectionPosture } from "./write-protection.js";
 import { normalizeSshFingerprint } from "./ssh-host-key.js";
 import { readFaceForPosture } from "./read-face-posture.js";
 import { THINKING_LEVELS, THINKING_FORMATS, buildModelCompat, isThinkingFormat, isThinkingTier } from "./model-compat.js";
 import {} from "./posture-source.js";
+import { hostedPrincipalRefusal } from "./hosted-posture.js";
 import { CONTROL_AND_BIDI_STRIP_RE } from "./text-bidi.js";
+import { REMOTE_EXEC_PROVIDER_WORDS } from "./execution-lane-caps.js";
 import { AUTONOMY_MODES } from "./runtime-governance.js";
 import { modelProviderRefusal } from "./model-provider.js";
 import { modelRouteUrlRefusal } from "./model-route-url.js";
@@ -1590,6 +1592,7 @@ function parseAuthDomain(ctx) {
         principalJwtPubkeys,
         principalJwtIss,
         principalJwtAud,
+        authBridgeIssuer: process.env.AUTH_BRIDGE_ISSUER || undefined,
         principalJwtMaxTtlSec,
     };
 }
@@ -1637,9 +1640,11 @@ function parseOrchestrationDomain(ctx) {
         }
     }
     return {
+        requireExecutionLane: boolEnv("REQUIRE_EXECUTION_LANE", false),
         ...(process.env.READ_FACE !== undefined
             ? { readFace: enumEnv("READ_FACE", "roots", ["open", "roots"]), readFaceSource: "env" }
             : readFaceForPosture(singleUserTurnkey)),
+        ...optionalEnumKey("taskWriteFaceEscalation", "TASK_WRITE_FACE_ESCALATION", process.env.TASK_WRITE_FACE_ESCALATION, TASK_WRITE_FACE_ESCALATIONS),
         ...(process.env.READ_DENY_PATTERNS !== undefined ? { readDenyPatterns: parseReadDenyPatternsEnv(process.env.READ_DENY_PATTERNS) } : {}),
         ...(() => {
             const tiers = process.env.READ_DENY_BUILTIN_TIERS !== undefined ? parseNameListEnv("READ_DENY_BUILTIN_TIERS", process.env.READ_DENY_BUILTIN_TIERS, { emptySentinel: "none" }) : undefined;
@@ -2054,17 +2059,17 @@ const AUTH_GROUP_KEYS = [
     "authToken", "authTokens", "allowUnauthedWrites", "corsOrigins", "principalHeader", "requirePrincipal", "autonomy",
     "commandPolicy", "compliancePosture", "lockedConfigKeys", "retentionPolicy", "retentionSweep",
     "operatorPrincipals", "configCatalogEnabled", "principalJwtPubkeys", "principalJwtIss", "principalJwtAud",
-    "principalJwtMaxTtlSec", "bindHost", "bindHostSource",
+    "principalJwtMaxTtlSec", "authBridgeIssuer", "bindHost", "bindHostSource",
 ];
 const ORCHESTRATION_GROUP_KEYS = [
-    "remoteExec", "remoteExecHomeDir", "worktreeIsolation", "leaderEnabled", "leaderFanoutEnabled", "routerEnabled", "selfOrchestrationEnabled",
+    "remoteExec", "remoteExecHomeDir", "requireExecutionLane", "worktreeIsolation", "leaderEnabled", "leaderFanoutEnabled", "routerEnabled", "selfOrchestrationEnabled",
     "selfOrchestrationModels", "selfOrchestrationWorkerIsolation", "forkEnabled", "experimentalObserverAgents",
     "schedulerEnabled", "schedulerSessionWakeup", "schedulerSessionLifetime", "schedulerStorePath", "planModeEnabled", "hooksTimeoutMs", "workflowRunStoreBackend",
     "workflowOrphanGraceMs", "workflowJournalRetentionMs", "workflowRunRetentionMs", "usageWindows", "workflowAgentsReadOnly",
     "workflowSizeGuideline", "backgroundAgentRetentionMs", "backgroundAgentStaleRunningMs",
     "backgroundAgentParkClaimStaleMs", "delegationEntryCaps", "rosterRetentionMs", "leaderRunStaleMs", "scratchpadSweepTtlMs", "sandboxPkgSource",
     "sessionAutoTitle", "sessionAutoTitleSource", "selectEnvironmentTool", "envFactsEnabled", "toolDeferLongtail", "lspEnabled", "lspHostEnabled",
-    "imageBakes", "readFace", "readFaceSource", "readDenyPatterns", "readDenyBuiltinTiers", "readDenyBuiltinExclude",
+    "imageBakes", "readFace", "readFaceSource", "taskWriteFaceEscalation", "readDenyPatterns", "readDenyBuiltinTiers", "readDenyBuiltinExclude",
 ];
 const LIMITS_HTTP_GROUP_KEYS = [
     "port", "attachmentOrphanGraceMs", "workspaceFileMaxBytes", "attachmentMaxBytes", "attachmentMimeAllowlist",
@@ -2164,6 +2169,10 @@ export function loadConfig() {
     if (dgDurable && requirePrincipal && dgOperators.length === 0) {
         throw new Error("DURABLE_APPROVAL=true + REQUIRE_PRINCIPAL=true but OPERATOR_PRINCIPALS is empty — on a multi-tenant worker the empty operator set makes isOperator() true-for-all, so every authenticated tenant could read every other tenant's pending-approval queue (GET /v1/approvals & siblings). Set OPERATOR_PRINCIPALS, or unset REQUIRE_PRINCIPAL if this is a single-tenant deployment (#157-① boot invariant)");
     }
+    const hostedRefusal = hostedPrincipalRefusal({ requirePrincipal, principalJwtPubkeys, principalJwtIss, principalJwtAud, authBridgeIssuer: auth.authBridgeIssuer });
+    if (hostedRefusal !== undefined) {
+        throw new Error(hostedRefusal);
+    }
     if (imageBakesEnabled && dgOperators.length === 0) {
         throw new Error("IMAGE_BAKES_ENABLED=true but OPERATOR_PRINCIPALS is empty — the bake door runs build.sh on the privileged build host; an empty operator set makes isOperator() true-for-all (world-writable RCE). Set OPERATOR_PRINCIPALS or disable bakes (IMAGE-API-DESIGN.md §P2.4a boot invariant)");
     }
@@ -2204,6 +2213,17 @@ export function loadConfig() {
                 "Set DURABLE_APPROVAL=true, or unset REMOTE_EXEC (device-executor-lane-v2 §4.7 boot invariant)");
         }
     }
+    if (orchestration.requireExecutionLane && orchestration.remoteExec === undefined) {
+        throw new Error(`REQUIRE_EXECUTION_LANE=true but NO execution lane is named on this deployment — refusing to start. ` +
+            `With no lane the engine falls back to its in-process stub environment, where at least the Bash tool is ` +
+            `not mounted, yet every task still returns status=completed — indistinguishable from "the model chose ` +
+            `not to use its tools". (What the roster actually keeps is a per-run fact: read the wiring_manifest ` +
+            `event and count entries whose mountedBy is "hands".) ` +
+            `Cause: REMOTE_EXEC is unset/empty AND CONFIG_PROVIDER is not "local". ` +
+            `Fix: set REMOTE_EXEC to one of ${REMOTE_EXEC_PROVIDER_WORDS.join(" | ")} (and that lane's required env), ` +
+            `or set CONFIG_PROVIDER=local to take the single-machine \`host\` default, ` +
+            `or unset REQUIRE_EXECUTION_LANE to keep running without hands on purpose.`);
+    }
     EXEC_LANE_NOTICE = buildExecLaneNotice(orchestration.remoteExec);
     return attachConfigGroups({
         ...store,

package/dist/hosted-posture.d.ts

@@ -0,0 +1,176 @@
+/**
+ * S-591 / S-564(车LT,7.95.0)—— **「这台部署是不是托管 / 多租」的单一铸点**。
+ *
+ * ## 为什么是一处
+ *
+ * 本仓此前有两条腿各自回答这同一个问题,而且**答得不一样**:
+ *  · 写容纳面的天花板挂在 **core 的 `orgGoverned`** 上(core `prepareHandsReadFace` 读
+ *    `deps.permissionRuleStore?.partitions.org === true`)—— 而本仓从不给那只 provider 传 `org` 分区
+ *    (`boot/stage-04-stores.ts` 的 `createPermissionRuleStoreProvider({ durable })` 只递 durable),
+ *    core 的 provider 按「传了没有」冻出 `partitions` ⇒ 本仓 `org` 恒 `false` ⇒ 那条天花板**结构上不可达**。
+ *    ⚠️ 这句话此前在本仓被抄成「`boot/resolve-spec.ts` 阶段④ 的 `partitions` 字面量」——`src/` 里**没有**
+ *    那个字面量(全仓 `partitions` 的 src 命中全是注释;尺子:同目录 `config` 3721 命中)。手抄的**坐标**
+ *    比手抄的值更难发现烂掉,[ref] 的第一排查点就是它;
+ *  · 能力授予面的赦免挂在 **`requirePrincipal !== true`** 上 —— 但**三条面各有各的谓词,不是一只**
+ *    (异源复核实测,别照「它们都一样」写):
+ *     · `settings.hooks` —— `boot/resolve-spec.ts` 的 hooks 臂,判据**只有** `config.requirePrincipal === true`
+ *       ⇒ 忽略(**不看车道**,任何 `REMOTE_EXEC` 都一样);
+ *     · `additionalDirectories` / `additionalReadDirectories` —— **只有** `cwdHonored`
+ *       (= `provider === "host" ∧ requirePrincipal !== true`);
+ *     · `settings.env` / `cwd` —— `cwdHonored ‖ deviceCwdHonored`,而
+ *       **`deviceCwdHonored` 这一臂里没有 `requirePrincipal` 项**(`task-cwd.ts`:device 车道上那条路径落在
+ *       **发起者自己的设备**上,归属由 `device_session` 绑定行验过 ⇒ 跨租户面结构性不存在)。
+ *
+ * 两条判据的**交集之外**有一形谁都不管:**多用户部署但运维没开 `REQUIRE_PRINCIPAL`,也没有 org 治理**。
+ * 那台机器上每一条赦免都成立(它自称单用户),而每一道天花板都不成立(它没有 org 分区)。
+ * ⇒ 先把这个判定位铸成**一处**,再让两条腿都读它(clay 裁定③,2026-09-22):**不许各自加特判**——
+ * 每加一条特判,「这台机器算不算托管」在本仓就多一个可以自己漂的答案。
+ *
+ * ## 判据的**唯一**标准:运维**显式点名了一个外部身份签发方**
+ *
+ * 🔴 判据里**必须**有不读 `requirePrincipal` 的臂,否则腿①(S-564)是同义反复
+ * (「`REQUIRE_PRINCIPAL` 没设 ⇒ 要求设 `REQUIRE_PRINCIPAL`」永不触发)。所以词表分两类:
+ *  · `require-principal` —— 运维**已经说了**这是多租户(定义式,零假阳);
+ *  · 另外两条 —— 运维没说,但他**显式点了一个外部签发方的名字**。一台机器一个可信主人的形
+ *    (CC 的信任模型)不需要向任何人验签:签发方存在 ⇒ 身份来自这台机器之外 ⇒ 有别人。
+ *
+ * ## 🔴 「受控于控制面」**不是**托管证据(主会话裁定⑥ 的二选一,本仓选这一侧)
+ *
+ * 初版收过第三条臂 `managed-worker`(`SEMA_REGISTRY_WORKER` 在场 = reconciler 管着这台 worker)。
+ * **实测两个反例后撤回**:
+ *  · `src/run-local.ts` 强设 `REQUIRE_PRINCIPAL=false` 之后才 `loadConfig()` —— 一个共享 `.env` 带着
+ *    registry 键就让本机 CLI **拒启**,而拒因指的那根旋钮正是它自己会覆盖回去的(codex 对抗复审同批独立复现);
+ *  · 本仓自己的 `test/config-coverage-blocks.test.ts` 两格(configCenter 块)就是「有 worker 名、没开
+ *    `REQUIRE_PRINCIPAL`」——它们在初版上当场红。
+ * ⇒ **fleet 管理轴 ≠ 租户轴**。同理 `AUTH_BRIDGE_ISSUER` 只收**显式 env**,**绝不**收 boot 期那条
+ * `?? config.configCenter?.baseUrl` 的回退(`boot/stage-09-leader.ts`)—— 那条回退的事实来源同样是
+ * 「配了 center」,收它等于把刚撤回的那条臂换个名字装回来,精度还更差。
+ *
+ * ## 精度优先于召回(逐条写下被排除的候选,不留「我没想到」的空白)
+ *
+ * 假阳 = 一台单用户 turnkey 被拒启 / 被收走一个它一直在用的能力。假阴 = 缺口照旧。
+ * 两者都坏,但假阳会当场打到在跑的部署,所以词表只收**单用户形写不出来**的证据:
+ *  · ❌ `operatorPrincipals` 非空 —— **真假阳**:`IMAGE_BAKES_ENABLED` 那条既有不变量
+ *    (`config-invariants.ts` 的 `bake-operator-principals`)**强制**开烤门的部署把它填非空,
+ *    于是一台开了烤门的单用户机器会被判成托管。
+ *  · ❌ `configCenter`(含 `worker` 名)/ auth-bridge 的 center 回退 —— 见上一段,已实测撤回。
+ *  · ❌ `SERVICE_AUTH_TOKENS` 条目数 —— 一台机器上同时给 cli 与 web-admin 发一只令牌是单用户常态。
+ *  · ❌ `DB_BACKEND=mysql|pg` —— 那是**耐久性**轴,不是租户轴(单用户要 durable run 也得开)。
+ *  · ❌ `BIND_HOST` 非回环 —— 容器里 `0.0.0.0` 是单用户常态(compose/k8s 默认)。
+ *  · ❌ `COMPLIANCE_PROFILE` / `RETENTION_MAX_AGE_DAYS` / `LOCKED_CONFIG_KEYS` —— 数据/治理轴;
+ *    一个自己给自己上合规档的单用户部署不该因此被拒启。
+ *
+ * **已知召回缺口(显式登记,不用「应该很少」填空)**:一台既不验 principal-JWT、也没点 auth-bridge
+ * 签发方的团队机器(例如只靠反代加一层 basic auth)本表**看不见**。它的运维面补偿是:
+ * `REQUIRE_PRINCIPAL=true` 本身就是那台机器该设的键,而 `docs/DEPLOY-PREREQS.md` 的「托管形前置」段
+ * 把判据写成了给人读的清单。
+ */
+import { type ServiceConfigFlat } from "./config-types.js";
+/** 托管/多租的**证据词表**(闭集;加词 ⇒ {@link hostedEvidenceNote} 的穷举 switch 编译红)。 */
+export declare const HOSTED_EVIDENCE_WORDS: readonly ["require-principal", "principal-jwt", "auth-bridge-issuer"];
+/** 一条证据(闭集三词)。 */
+export type HostedEvidence = (typeof HOSTED_EVIDENCE_WORDS)[number];
+/**
+ * 本判据读的配置键集 —— 取自平铺配置型(键名/类型永不与真配置漂)。
+ * `ServiceConfig` 与 `CrossInvariantView` 都**结构上**满足本形,所以 boot 腿、热路径腿与请求腿读同一只函数。
+ */
+export type HostedPostureInput = Readonly<Pick<ServiceConfigFlat, "requirePrincipal" | "principalJwtPubkeys" | "principalJwtIss" | "principalJwtAud" | "authBridgeIssuer">>;
+/** 一台 worker 的托管姿态事实(值 + 证据)——纯数据。 */
+export interface HostedPostureFacts {
+    /** 这台部署是不是托管 / 多租。 */
+    readonly hosted: boolean;
+    /** 判成托管的**全部**证据(按词表顺序;`hosted:false` ⇒ 空数组)。拒因逐字点它们,运维才知道改哪儿。 */
+    readonly evidence: readonly HostedEvidence[];
+}
+/**
+ * 判定位的**唯一**铸点(纯数据 ⇒ `build*`)。
+ *
+ * 🔴 `evidence` 收**全部**命中而不是第一条:拒因要告诉运维「这台机器凭哪几件事被判成托管」,
+ * 只报一条会让他改掉那一条之后再撞一次同样的拒(两次拒启之间他学不到全貌)。
+ */
+export declare function buildHostedPosture(c: HostedPostureInput): HostedPostureFacts;
+/**
+ * 判据里**非定义式**那两条证据背后的 env 名 —— 即「运维显式点名了一个外部身份签发方」的全部拼法。
+ *
+ * 🔴 **单一属主**:`src/run-local.ts` 那条「强制单用户」的腿按本表清 env(W-新8)。它**结构上**兑现不了
+ * 这些键(它把 `REQUIRE_PRINCIPAL` 焊死成 false ⇒ principal 门根本不上场),留着它们只会让判据看见一个
+ * 假事实、然后拿一个**它自己会覆盖回去**的旋钮当拒因。名表抄第二份的那天,加一条证据 = run-local 静默漏清。
+ * ⚠️ 表里**没有** `REQUIRE_PRINCIPAL`(那是定义式那一条,run-local 自己显式写值)也**没有**
+ * `SEMA_REGISTRY_*`(fleet 管理轴,本判据根本不读 —— 本机 CLI 从组织下发面取配置是正当用法)。
+ */
+export declare const HOSTED_EVIDENCE_ENV_KEYS: readonly ["PRINCIPAL_JWT_PUBKEYS", "PRINCIPAL_JWT_ISS", "PRINCIPAL_JWT_AUD", "AUTH_BRIDGE_ISSUER"];
+/**
+ * 把上表那几根 env **清掉**(`run-local.ts` 的「强制单用户」腿调它)。
+ *
+ * 🔴 **为什么是四行字面 `delete` 而不是照表循环**:配置目录的 D1 对账门按文件数**动态 env 读点**并且是
+ * **只降不升的棘轮** —— `process.env[k]` 那种计算属性读它一个都不放过(理由是动态读让「这个文件读了哪些
+ * 键」变成机器看不见的事)。照表循环会给 `run-local.ts` 顶上第 3 处动态读、当场撞棘轮。⇒ 名字写成字面,
+ * **但只写这一处**;上面那张表仍是**声明面**的属主,两者的一致性由
+ * `test/hosted-posture.test.ts` 的行为格看着(逐个设上再调一次,断言全没了)——不是靠人眼比对。
+ *
+ * ⚠️ 表里**没有** `REQUIRE_PRINCIPAL`(定义式那条,调用方自己显式写值)也没有 `SEMA_REGISTRY_*`
+ * (fleet 管理轴,本判据根本不读)。
+ */
+export declare function clearHostedEvidenceEnv(): void;
+/** 一条证据的运维事实句 —— **穷举 switch,无缺省臂**(词表加员即编译红)。 */
+export declare function hostedEvidenceNote(e: HostedEvidence): string;
+/**
+ * **腿①(S-564)** —— 托管形部署必须显式开 `REQUIRE_PRINCIPAL`。返回拒因;`undefined` = 通过。
+ *
+ * 判据与文案的**唯一属主**:boot 期的拒启 throw(`config.ts` 的跨域不变量区)与
+ * `CONFIG_CROSS_INVARIANTS` 表(`config-invariants.ts`)**调同一只**,不各抄一份([ref] 的纪律 +
+ * [ref]「禁手抄投影」)。
+ *
+ * 🔴 **表里那一行今天是「预置纵深」,不是在岗执法**(主会话裁定⑤,撤回初版那句「热路径同样在岗」):
+ * `checkCrossInvariants` 的候选视图(`config-hot` 那条腿)今天只覆写 limits 那 14 员键,本判据读的
+ * 5 个键**一个都不在里面** ⇒ 那一行在热路径上**永不返回拒因**。它先在场是纵深(哪天候选视图覆盖到
+ * auth 域,它自己就活),不是现在有人在执法。**假覆盖比没覆盖更坏**(7.94.0 自己刚立的反面规矩)。
+ *
+ * 🔴 **为什么是拒启而不是 warn**:`principal` 缺席在本仓走 `"default"` 赦免 —— 一台没开这根旋钮的
+ * 多用户机器会把**全服无主会话**列进 `ListAgents`,并且把 hooks / shellEnv / cwd / 根围栏拓宽四条
+ * 能力授予面一并对每个调用方打开(四条面的谓词各不相同,逐条在模块头注 —— 别照「都一样」读)。
+ * 安全轴上的 fail-open 不许有安静的兜底臂([ref])。
+ *
+ * 🔴 **`settings.env` 那一条的射程要说准**(亲读 `plugins/remote-env-host.ts` 的 `mergeEnv`):适配器的
+ * `env` 是**并**到 `process.env` 上的逐键覆盖(不是替),而 `task-settings.ts` 的 `cleanEnvMap` 只判
+ * 类型/键长/值长/条数、**没有任何键名拒集** ⇒ `PATH` / `LD_PRELOAD` / `NODE_OPTIONS` 一视同仁。
+ * 那条面唯一的防线就是上面那道闸;闸一漂,面全开。
+ */
+export declare function hostedPrincipalRefusal(c: HostedPostureInput): string | undefined;
+/** 腿② 读的键集 = 射程判据 + 天花板旋钮。
+ *  🔴 档位的**词表属主在 `config-types.ts`**(`TASK_WRITE_FACE_ESCALATIONS`)—— 本模块刻意**不留第二份**:
+ *  施工期真犯过一次(两处各写一份 `["allow","refuse"]`,加词的那天两边会分家),[ref] 第一排查点。 */
+export type TaskWriteFaceInput = TaskHostPostureScope & Readonly<Pick<ServiceConfigFlat, "taskWriteFaceEscalation">>;
+/** 任务层宿主姿态声明被拒时的 wire 子码(附录 A 的 `request.` 族)。 */
+export declare const HOST_POSTURE_REFUSED_CODE = "request.host_posture_refused";
+/** 射程判据读的键集(托管证据 + 车道)。 */
+export type TaskHostPostureScope = HostedPostureInput & Readonly<Pick<ServiceConfigFlat, "remoteExec">>;
+/**
+ * **腿③(clay 裁定① 2026-09-22)** —— `approverPosture` 在这台部署上兑现吗?`false` ⇒ 调用点
+ * **忽略 + 留声**(与 `task_hooks_ignored` / `task_cwd_ignored` / `task_shell_env_ignored` 同姿势)。
+ *
+ * 🔴 **为什么这一条不拒**(初版给了 422,当批撤回):这个键**零授权** —— 引擎只把它渲给模型,没有任何
+ * 裁决腿读它(`http/wire-types.ts` 的字段注逐字,来源是 core 的 `ApproverPosture` 头注)。而续跑腿
+ * **逐字重放盘上的体**,调用方**删不掉**它 ⇒ 一条 park 会被永久砖死;`resumePlanReview` 上更贵:
+ * nonce 先烧、拒在其后才抛,运维重签再撞同一个拒 = 无限循环。本仓对这一类的成文结论逐字是
+ * 「**砖死 resume 比降级糟**」(`boot/resolve-spec.ts` 顶部那段列了三处先例)。
+ * ⇒ 把本批最硬的处置给族里**危害最小**的成员,方向是错的。
+ *
+ * ⚠️ 它**不是**没有危害:引擎据此把 bypass 指令渲给模型,而那段文字指示模型**改用 Bash 改文件**
+ * 而不是用文件工具 ⇒ 写动作从**文件带**(core 写门 / `sensitiveWritePatterns` / `writeProtectedPaths`)
+ * 挪到**shell 带**(`shellGate`)。所以它要被**忽略**,而不是原样过境;留声让运维看得见。
+ */
+export declare function taskApproverPostureHonored(c: TaskHostPostureScope): boolean;
+/**
+ * **腿②** —— 这条请求要掀开写围栏,这台部署给不给?返回拒因;`undefined` = 放行。
+ *
+ * 🔴 **响亮拒而不是静默钳**:一个明确要求「别拦我」的调用方撞上一道它掀不掉、也看不见的墙,
+ * 正是 [ref] 裁定要修掉的那个失败形。core 在同一条律上的姿势也是抛,不是钳;而本仓这一侧**不能**改用
+ * governance 的 `overrides.writeFace="roots"` 去压——实测 core 的 `tightenTaskSpec` 在
+ * base `open` × override `roots` 上**静默**取 `roots`(该函数零回调形参 ⇒ 没有留痕通道)。
+ *
+ * 🔴 **射程(含 device 车道那条对位臂)在共用谓词 {@link hostPostureDeclarationsHonored} 上** ——
+ * 两条腿同射程、不同处置,射程只有一处答案。
+ */
+export declare function taskWriteFaceRefusal(c: TaskWriteFaceInput): string | undefined;
+//# sourceMappingURL=hosted-posture.d.ts.map

package/dist/hosted-posture.js

@@ -0,0 +1,76 @@
+import { TASK_WRITE_FACE_ESCALATIONS } from "./config-types.js";
+import { deviceCwdHonored } from "./task-cwd.js";
+export const HOSTED_EVIDENCE_WORDS = ["require-principal", "principal-jwt", "auth-bridge-issuer"];
+export function buildHostedPosture(c) {
+    const evidence = [];
+    if (c.requirePrincipal === true)
+        evidence.push("require-principal");
+    if (c.principalJwtPubkeys.length > 0 || c.principalJwtIss !== undefined || c.principalJwtAud !== undefined)
+        evidence.push("principal-jwt");
+    if (c.authBridgeIssuer !== undefined)
+        evidence.push("auth-bridge-issuer");
+    return { hosted: evidence.length > 0, evidence };
+}
+export const HOSTED_EVIDENCE_ENV_KEYS = ["PRINCIPAL_JWT_PUBKEYS", "PRINCIPAL_JWT_ISS", "PRINCIPAL_JWT_AUD", "AUTH_BRIDGE_ISSUER"];
+export function clearHostedEvidenceEnv() {
+    delete process.env.PRINCIPAL_JWT_PUBKEYS;
+    delete process.env.PRINCIPAL_JWT_ISS;
+    delete process.env.PRINCIPAL_JWT_AUD;
+    delete process.env.AUTH_BRIDGE_ISSUER;
+}
+export function hostedEvidenceNote(e) {
+    switch (e) {
+        case "require-principal":
+            return "REQUIRE_PRINCIPAL=true (this deployment declares itself multi-tenant)";
+        case "principal-jwt":
+            return "PRINCIPAL_JWT_PUBKEYS/ISS/AUD is configured (principal identities are verified against an external issuer — a single-user turnkey box has no issuer)";
+        case "auth-bridge-issuer":
+            return "AUTH_BRIDGE_ISSUER is set explicitly (a second external SSO-JWT issuer; the registry-URL fallback is deliberately NOT read here — that fact is fleet management, not tenancy)";
+    }
+}
+function hostedBecause(facts) {
+    return facts.evidence.map(hostedEvidenceNote).join("; ");
+}
+export function hostedPrincipalRefusal(c) {
+    const facts = buildHostedPosture(c);
+    if (!facts.hosted || c.requirePrincipal === true)
+        return undefined;
+    return (`this deployment looks HOSTED/multi-tenant (${hostedBecause(facts)}) but REQUIRE_PRINCIPAL is not set — ` +
+        `an absent principal takes the single-user "default" amnesty, which would list every ownerless session to every caller ` +
+        `and open the single-user capability grants (settings.hooks / settings.env / cwd / additionalDirectories) to all of them. ` +
+        `Set REQUIRE_PRINCIPAL=true (and OPERATOR_PRINCIPALS for the operator-only routes), or remove the hosted-deployment configuration if this really is a single-user box.`);
+}
+export const HOST_POSTURE_REFUSED_CODE = "request.host_posture_refused";
+function hostPostureDeclarationsHonored(c) {
+    if (deviceCwdHonored(c))
+        return true;
+    return !buildHostedPosture(c).hosted;
+}
+export function taskApproverPostureHonored(c) {
+    return hostPostureDeclarationsHonored(c);
+}
+export function taskWriteFaceRefusal(c) {
+    switch (c.taskWriteFaceEscalation) {
+        case "allow":
+            return undefined;
+        case "refuse":
+            return (`permissionMode:"bypassPermissions" opens the WRITE containment face (TaskSpec.writeFace:"open") — the run could write outside the task root. ` +
+                `Refused because this deployment pins TASK_WRITE_FACE_ESCALATION=refuse (the operator's own declaration — it wins over any request, unconditionally). ` +
+                `Omit permissionMode:"bypassPermissions", or ask the operator for TASK_WRITE_FACE_ESCALATION=allow.`);
+        case undefined:
+            break;
+        default: {
+            const unhandled = c.taskWriteFaceEscalation;
+            return (`permissionMode:"bypassPermissions" opens the WRITE containment face (TaskSpec.writeFace:"open") — the run could write outside the task root. ` +
+                `Refused because this deployment carries an UNRECOGNISED TASK_WRITE_FACE_ESCALATION word (${String(unhandled)}) — a knob this build cannot interpret is never read as permission. ` +
+                `Set TASK_WRITE_FACE_ESCALATION to one of ${TASK_WRITE_FACE_ESCALATIONS.join(" | ")}, or unset it to let the deployment posture decide.`);
+        }
+    }
+    if (hostPostureDeclarationsHonored(c))
+        return undefined;
+    const facts = buildHostedPosture(c);
+    return (`permissionMode:"bypassPermissions" opens the WRITE containment face (TaskSpec.writeFace:"open") — the run could write outside the task root. ` +
+        `Refused because this deployment is HOSTED/multi-tenant (${hostedBecause(facts)}), so the task layer may only TIGHTEN the write face, never open it. ` +
+        `Set TASK_WRITE_FACE_ESCALATION=allow if the DEPLOYMENT permits the task layer to open it, or omit permissionMode:"bypassPermissions".`);
+}
+//# sourceMappingURL=hosted-posture.js.map

package/dist/http/resume-legs.js

@@ -286,20 +286,10 @@ export function createResumeLegs(ctx) {
         if (!ctx)
             return { status: 409, body: { error: "resume context missing — cannot rebuild task config", errorCode: "conflict.resume_context_unavailable" } };
         const auth = { sessionId: cp.sessionId, principal: decodeCheckpointScope(cp.scope), memoryScope: ctx.memoryScope };
-        let spec;
-        let engineNotices = [];
-        try {
-            ({ spec, engineNotices } = await resolveResumeSpec(ctx.body, req, auth));
-        }
-        catch (e) {
-            if (e instanceof HttpError) {
-                return {
-                    status: 409,
-                    body: { error: `resume blocked by an admission policy change: ${e.message}`, errorCode: "resume_blocked_by_policy", ...(e.code ? { blockedBy: e.code } : {}), ...(e.extra ?? {}) },
-                };
-            }
-            throw e;
-        }
+        const resolved = await resolveResumeSpecOrBlocked(ctx.body, req, auth);
+        if (!resolved.ok)
+            return resolved.answer;
+        const { spec, engineNotices } = resolved;
         const pendingTool = cp.pendingAction.toolName;
         if (decision === "approve" && pendingTool === ASK_USER_QUESTION_TOOL_NAME && !answer) {
             return { status: 400, body: { error: "pending action is AskUserQuestion — approve must carry body.answer ({ answers: [{ header, selected: string[], note? }] })", errorCode: "request.field_conflict" } };
@@ -333,6 +323,24 @@ export function createResumeLegs(ctx) {
         const spec = await deps.resolveSpec({ ...body, ...ONE_SHOT_HISTORY_STRIP }, req, auth, { leg: "resume", onNotice: (n) => engineNotices.push(n) });
         return { spec, engineNotices };
     };
+    const resolveResumeSpecOrBlocked = async (body, req, auth) => {
+        try {
+            const { spec, engineNotices } = await resolveResumeSpec(body, req, auth);
+            return { ok: true, spec, engineNotices };
+        }
+        catch (e) {
+            if (e instanceof HttpError) {
+                return {
+                    ok: false,
+                    answer: {
+                        status: 409,
+                        body: { error: `resume blocked by an admission policy change: ${e.message}`, errorCode: "resume_blocked_by_policy", ...(e.code ? { blockedBy: e.code } : {}), ...(e.extra ?? {}) },
+                    },
+                };
+            }
+            throw e;
+        }
+    };
     async function driveResumeIntoRunLog(args) {
         if (args.acceptEarly !== true)
             return await driveResumeLeg(args);
@@ -1041,7 +1049,10 @@ export function createResumeLegs(ctx) {
             return { status: 409, body: { error: "resume context missing — cannot rebuild task config", errorCode: "conflict.resume_context_unavailable" } };
         const ctx = ctxRead.ctx;
         const auth = { sessionId: cp.sessionId, principal: decodeCheckpointScope(cp.scope), memoryScope: ctx.memoryScope };
-        const { spec, engineNotices } = await resolveResumeSpec(ctx.body, req, auth);
+        const resolved = await resolveResumeSpecOrBlocked(ctx.body, req, auth);
+        if (!resolved.ok)
+            return resolved.answer;
+        const { spec, engineNotices } = resolved;
         const { objective: resumeObjective, sessionId: _sessionId, ...taskConfig } = spec;
         const verifyRounds = verifyRoundsFromBody(ctx.body);
         return driveResumeIntoRunLog({ runner: runnerFor(spec), token, sessionId: cp.sessionId, principal: auth.principal, fleetScope: resumeFleetScope(req, auth), taskConfig, resumeObjective, outcome: { gate: "resource_limit", decision: "continue" }, verifyRounds, resumeCtx: { sessionId, ctx }, ...(engineNotices.length > 0 ? { engineNotices } : {}), ...(acceptEarly === true ? { acceptEarly: true } : {}), ...(req !== undefined ? { callerInitiated: true } : {}) });
@@ -1070,17 +1081,10 @@ export function createResumeLegs(ctx) {
         if (windowDenial)
             return { status: windowDenial.status, body: windowDenial.body };
         const auth = { sessionId, principal, memoryScope: ctx.memoryScope };
-        let spec;
-        let engineNotices = [];
-        try {
-            ({ spec, engineNotices } = await resolveResumeSpec(ctx.body, req, auth));
-        }
-        catch (e) {
-            if (e instanceof HttpError) {
-                return { status: 409, body: { error: `resume blocked by an admission policy change: ${e.message}`, errorCode: "resume_blocked_by_policy", ...(e.code ? { blockedBy: e.code } : {}), ...(e.extra ?? {}) } };
-            }
-            throw e;
-        }
+        const resolved = await resolveResumeSpecOrBlocked(ctx.body, req, auth);
+        if (!resolved.ok)
+            return resolved.answer;
+        const { spec, engineNotices } = resolved;
         const hostSpec = { ...spec, objective, sessionId };
         const out = await mintAndDriveDurableRun(routeCtxBase, deps.runStore, {
             prepared: { spec: hostSpec, runner: runnerFor(hostSpec), auth, body: ctx.body, ...(engineNotices.length > 0 ? { engineNotices } : {}) },
@@ -1151,7 +1155,10 @@ export function createResumeLegs(ctx) {
             return { status: 409, body: { error: "resume context missing — cannot rebuild task config", errorCode: "conflict.resume_context_unavailable" } };
         const ctx = ctxRead.ctx;
         const auth = { sessionId: cp.sessionId, principal: decodeCheckpointScope(cp.scope), memoryScope: ctx.memoryScope };
-        const { spec, engineNotices } = await resolveResumeSpec(ctx.body, req, auth);
+        const resolved = await resolveResumeSpecOrBlocked(ctx.body, req, auth);
+        if (!resolved.ok)
+            return resolved.answer;
+        const { spec, engineNotices } = resolved;
         const { objective: resumeObjective, sessionId: _sessionId, ...taskConfig } = spec;
         return driveResumeIntoRunLog({
             runner: runnerFor(spec),
@@ -1242,7 +1249,10 @@ export function createResumeLegs(ctx) {
         }
         const approvedMode = decision === "approve" && effMode === "plan" ? (permissionModeAfter ?? "default") : undefined;
         const resumeBody = approvedMode === undefined ? ctx.body : { ...ctx.body, permissionMode: approvedMode };
-        const { spec, engineNotices } = await resolveResumeSpec(resumeBody, req, auth);
+        const resolved = await resolveResumeSpecOrBlocked(resumeBody, req, auth);
+        if (!resolved.ok)
+            return resolved.answer;
+        const { spec, engineNotices } = resolved;
         const { objective: resumeObjective, sessionId: _sessionId, ...taskConfig } = spec;
         const verifyRounds = verifyRoundsFromBody(ctx.body);
         const outcome = {

package/dist/http/routes/capabilities.js

@@ -3,6 +3,7 @@ import { isModelAllowlisted } from "../../model-select.js";
 import { resolveModelApiKey } from "../../key-resolver.js";
 import { isSealedKeyPoison } from "../../sealed-key.js";
 import { cwdHonored, deviceCwdHonored } from "../../task-cwd.js";
+import { taskApproverPostureHonored, taskWriteFaceRefusal } from "../../hosted-posture.js";
 import { DEVICE_PROTOCOL_VERSION, DEVICE_WS_PATH } from "../../device-ws-protocol.js";
 import { a2aInjectionHonored } from "../../task-a2a.js";
 import { mcpInjectionHonored } from "../../task-mcp.js";
@@ -135,6 +136,8 @@ export async function handleCapabilities(req, res, match, ctx) {
                 interactiveTools: true,
                 projectContext: cwdHonored(deps.config),
                 callerCwd: cwdHonored(deps.config) || deviceCwdHonored(deps.config),
+                taskWriteFaceOpen: taskWriteFaceRefusal(deps.config) === undefined,
+                taskApproverPosture: taskApproverPostureHonored(deps.config),
                 executionLane: projectExecutionLaneCapability(deps.config),
                 mcpInjection: mcpInjectionHonored(deps.config),
                 a2a: true,

package/dist/http/wire-types.d.ts

@@ -326,10 +326,19 @@ export interface TaskRequestBody {
      * (且只能收紧、deny-wins),前者只说「谁来答卡」。两者在语义上同族,声明它而不开 `bypassPermissions`
      * 只是对模型说了一句与实际不符的话 —— 见契约文档那一段的「谁受伤」。
      *
-     * 🔴 **本仓零判据、原样过境**(`boot/resolve-spec.ts` 写点):词的拒绝逻辑属引擎
-     * (`refuseInvalidApproverPosture` 响亮拒一个不认识的词),server **不加第二道门** —— 在下游再判一次就是
-     * 同一语义面的第二个判官(源头修复纪律 [ref]),而且本仓抄一份词表的那天 core 加第二个词就会被静默 400 掉。
-     * 型也从 core 的 `ApproverPosture` 派生(不抄字面联合)。
+     * 🔴 **值域上本仓零判据**(`boot/resolve-spec.ts` 写点):词的拒绝逻辑属引擎
+     * (`refuseInvalidApproverPosture` 响亮拒一个不认识的词),server **不抄词表、不加第二道值域门** ——
+     * 在下游再判一次就是同一语义面的第二个判官(源头修复纪律 [ref]),而且本仓抄一份词表的那天 core 加
+     * 第二个词就会被静默 400 掉。型也从 core 的 `ApproverPosture` 派生(不抄字面联合)。
+     *
+     * 🔴 **但「原样过境」自 7.95.0(S-591 腿③)起不再成立 —— 它有一道**准入**闸**:本键是一句**宿主姿态
+     * 声明**(「这个 run 的审批卡由宿主自己自动答」),而在**托管 / 多租**部署上提交方**不是**宿主。
+     * 所以托管形上它被**忽略 + 留声**(`task_approver_posture_ignored`,`honored:false`),与同族的
+     * `settings.hooks` / `cwd` / `settings.env` 三条逐字同姿势;单用户 turnkey 与 device 车道照旧过境
+     * (射程判据单点 = `src/hosted-posture.ts` 的 `taskApproverPostureHonored`)。
+     * ⚠️ **刻意不是 400/422**:本键零授权,而续跑腿逐字重放盘上的体、调用方删不掉它 ⇒ 拒会把一条 parked
+     * 任务永久砖死(clay 裁定① 2026-09-22;本仓成文结论「砖死 resume 比降级糟」)。
+     * ⇒ 这一条与「值域零判据」**不矛盾**:值域仍归引擎,本仓判的是**这台部署认不认这句声明**。
      */
     approverPosture?: ApproverPosture;
     /** MF-30 memory PAUSE (shell-host contract, option B per-request — clay 2026-06-27): `false` makes THIS run

package/dist/run-local.js

@@ -18,6 +18,7 @@ import { taskWallClockSec } from "./task-workflow.js";
 import { applyCatalogToSource } from "./capabilities/center-prompts.js";
 import { validatePromptsDomain, CORE_ENGINE_VERSION } from "./prompts-domain-validate.js";
 import { buildUnpricedCeilingNotice, loadConfig, logConfigDiagnostics, parseNumOrFailNonNegative } from "./config.js";
+import { clearHostedEvidenceEnv } from "./hosted-posture.js";
 import { buildStoreOpenRefusalTail } from "./plugins/store-open-refusal.js";
 import { acquireLocalBackendWithWait } from "./plugins/store-lock-wait.js";
 import { createConfigProvider } from "./config-provider.js";
@@ -176,6 +177,7 @@ export async function runLocal(argv, deps = {}) {
         process.env.CONFIG_PROVIDER = "local";
     process.env.SESSION_BACKEND = "memory";
     process.env.REQUIRE_PRINCIPAL = "false";
+    clearHostedEvidenceEnv();
     const root = args.root ?? process.env.CONFIG_LOCAL_DIR ?? process.env.AGENT_DATA_DIR ?? join(homedir(), ".ai-agent");
     if (args.root)
         process.env.CONFIG_LOCAL_DIR = args.root;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/server",
-  "version": "7.94.0",
+  "version": "7.95.0",
   "description": "Sema Server — the server/API implementation layer for Sema, wiring core, registry, model providers, and cloud agent execution. Built on @sema-agent/core.",
   "type": "module",
   "license": "BUSL-1.1",