@sema-agent/server 7.97.0 → 7.99.0

package/dist/config.d.ts

@@ -243,6 +243,15 @@ export declare const REQUIRED_ENVS_BY_LANE: Record<RemoteExecProvider, readonly
  *  a loud CONFIG_NOTICES line ("removed-1m"); the center lane's roster culture is explicit declaration.
  *  Shared by the env lane (main + cheap models) and the center lane (sema-registry toModel). */
 export declare function applyAutoCompactWindow(m: Model, explicit?: number): "explicit" | "sonnet5" | "removed-1m" | "removed";
+/**
+ * **严格名册布防**的唯一判据(boot 就绪门 `boot/config-center.ts` 与 S-623 端点判据同调这一只)。
+ *
+ * 布防 = 远程 registry ∧ 非 dryRun ∧ `CONFIG_REQUIRE_ROSTER=true`(严格 `"true"`,直读 env、不进 ServiceConfig —— 纯
+ * boot 期姿势旋钮,原判据逐字搬来,零语义变化)。布防时运维声明 env MODEL_ID 是**占位**:名册落地前计费提交 503、
+ * `/health` ready:false,落地后整张模型表被中心目录换装。dryRun 是 compare-only(名册从不被应用),local / 纯 env
+ * 部署没有「中心」可等 ⇒ 都不布防。
+ */
+export declare function isRosterGateArmed(configCenter: ServiceConfig["configCenter"]): boolean;
 /**
  * 一条工具名**永不匹配任何现役工具**的三种拼法,及其修正指引。审批/权限名单是 server 侧 ToolPolicy 的
  * RAW 逐字比对(canonicalToolName 折叠面已随 core 5.0.0 [ref] 退役),所以写错的名字不会报错、只会静默

package/dist/config.js

@@ -7,7 +7,7 @@ import { BUILTIN_COMPLIANCE_DENIES, COMPLIANCE_CAPABILITIES, CROSS_SESSION_INBOU
 import { ROSTER_PRIMARY_ROLES, ROSTER_CHEAP_ROLES } from "@sema-agent/settings-schema";
 import { parseApprovalHmacKeys, parsePrincipalJwks } from "./auth-keys.js";
 import { DEFAULT_ELICITATION_THROTTLE } from "./elicitation.js";
-import { isV2ScopeKey } from "./memory-scope.js";
+import { isV2ScopeKey, memoryReplicationCoverage } from "./memory-scope.js";
 import { DEFAULT_QUESTION_THROTTLE } from "./question.js";
 import { GIT_API_KINDS, isGitApiKind } from "./git-api-kind.js";
 import { RETENTION_MODES, MEMORY_CONSOLIDATION_MIN_INTERVAL_SEC, RESILIENCE_DEFAULTS, TASK_WRITE_FACE_ESCALATIONS } from "./config-types.js";
@@ -16,12 +16,13 @@ import { normalizeSshFingerprint } from "./ssh-host-key.js";
 import { readFaceForPosture } from "./read-face-posture.js";
 import { THINKING_LEVELS, THINKING_FORMATS, buildModelCompat, isThinkingFormat, isThinkingTier } from "./model-compat.js";
 import {} from "./posture-source.js";
-import { hostedPrincipalRefusal } from "./hosted-posture.js";
 import { CONTROL_AND_BIDI_STRIP_RE } from "./text-bidi.js";
 import { REMOTE_EXEC_PROVIDER_WORDS, executionLaneOf } from "./execution-lane-caps.js";
 import { AUTONOMY_MODES } from "./runtime-governance.js";
+import { createCenterCredentialSource, readCenterCredentialDeclaration } from "./center-credential.js";
 import { modelProviderRefusal } from "./model-provider.js";
 import { modelRouteUrlRefusal } from "./model-route-url.js";
+import { modelRouteEndpointRefusal } from "./model-route-endpoint.js";
 import { buildDisplaySafeUrl, redactSecrets } from "./trace/redact.js";
 export { RETENTION_MODES, MEMORY_CONSOLIDATION_MIN_INTERVAL_SEC } from "./config-types.js";
 function csv(name) {
@@ -795,8 +796,11 @@ function parseStoreDomain(ctx) {
             : undefined,
     };
 }
+export function isRosterGateArmed(configCenter) {
+    return configCenter !== undefined && !configCenter.dryRun && process.env.CONFIG_REQUIRE_ROSTER === "true";
+}
 function parseModelDomain() {
-    const gatewayBaseUrl = env("MODEL_GATEWAY_BASEURL", "http://127.0.0.1:8000/v1");
+    const gatewayBaseUrl = firstSetEnv("MODEL_GATEWAY_BASEURL");
     const modelId = env("MODEL_ID", "");
     if (modelId === "") {
         throw new Error("MODEL_ID is required (no factory default since server 3.0.0) — set MODEL_ID=<model name your gateway serves>, " +
@@ -811,7 +815,7 @@ function parseModelDomain() {
         }
     }
     for (const [envKey, raw, knob] of [
-        ["MODEL_GATEWAY_BASEURL", gatewayBaseUrl, "MODEL_API_KEY"],
+        ["MODEL_GATEWAY_BASEURL", gatewayBaseUrl ?? "", "MODEL_API_KEY"],
         ...csv("MODEL_GATEWAY_FALLBACK_URLS").map((u, i) => [`MODEL_GATEWAY_FALLBACK_URLS[${i}]`, u, "MODEL_API_KEY"]),
         ["ANTHROPIC_BASE_URL", firstSetEnv("ANTHROPIC_BASE_URL") ?? "", "ANTHROPIC_API_KEY"],
     ]) {
@@ -918,6 +922,15 @@ function parseModelDomain() {
     const models = { default: model, [model.id]: model };
     if (cheapModel)
         models[cheapModel.id] = cheapModel;
+    const gatewayApiKey = process.env.MODEL_API_KEY;
+    if (gatewayBaseUrl === undefined && gatewayApiKey !== undefined && gatewayApiKey !== "") {
+        CONFIG_NOTICES.push({
+            event: "model_gateway_key_unpaired",
+            fields: {
+                hint: "MODEL_API_KEY is set but MODEL_GATEWAY_BASEURL is not — MODEL_API_KEY is the gateway's credential and pairs only with the gateway's own root, so with no gateway it is NOT loaded and is sent to no route (a model with its own baseUrl authenticates with its own per-model key). Set MODEL_GATEWAY_BASEURL to use it, or unset MODEL_API_KEY to silence this line.",
+            },
+        });
+    }
     const cheapRef = cheapModel ? cheapModel.id : DEFAULT_MODEL_REF;
     const verifierEnv = process.env.MODEL_VERIFIER;
     const verifierRef = verifierEnv && models[verifierEnv] ? verifierEnv : DEFAULT_MODEL_REF;
@@ -940,8 +953,7 @@ function parseModelDomain() {
     }
     const degradeOn = parseDegradeOn(csv("MODEL_DEGRADE_ON"));
     return {
-        gatewayBaseUrl,
-        gatewayApiKey: process.env.MODEL_API_KEY,
+        ...(gatewayBaseUrl !== undefined ? { gatewayBaseUrl, gatewayApiKey } : {}),
         gatewayFallbackUrls: csv("MODEL_GATEWAY_FALLBACK_URLS"),
         ...(process.env.GATEWAY_MAX_RETRIES ? { gatewayMaxRetries: numEnvBounded("GATEWAY_MAX_RETRIES", "2", 0, 20) } : {}),
         anthropic: firstSetEnv("ANTHROPIC_API_KEY", "ANTHROPIC_AUTH_TOKEN")
@@ -1469,6 +1481,19 @@ function parseMemoryDomain(ctx) {
             ...syncEntryCap("MEMORY_SYNC_MAX_PULL_ENTRIES", "maxPullEntries"),
         };
     }
+    const replication = memoryReplicationCoverage(memorySync !== undefined ? { memorySync } : {});
+    if (replication.kind === "scopes" && memoryEngineEnabled && !requirePrincipal && memoryScope !== undefined) {
+        CONFIG_NOTICES.push({
+            event: "memory_project_scope_yields_to_sync",
+            fields: {
+                replicatedScopes: replication.scopes.join(","),
+                writeScope: memoryScope,
+                hint: "memory sync (MEMORY_SYNC_*) replicates only the scope(s) listed — the per-project memory layer (S-512, repo:<key>) is not replicated, " +
+                    "so sessions do NOT write project-keyed memory here: new memory lands in the global layer (MEMORY_SCOPE), the same as 7.97.0, and every " +
+                    "project reads it. Project-layer replication is a separate change; unset MEMORY_SYNC_URL to get per-project memory without sync.",
+            },
+        });
+    }
     const projectMemoryEnabled = boolEnvWithLegacyNegated("PROJECT_MEMORY_ENABLED", "PROJECT_MEMORY_DISABLED", true);
     const memoryOrgAdmissionMode = enumEnv("MEMORY_ORG_ADMISSION_MODE", "enforce", ["audit", "enforce"]);
     const memoryOrgDirectoryJson = process.env.MEMORY_ORG_DIRECTORY_JSON || undefined;
@@ -1940,19 +1965,21 @@ function parseIntegrationsDomain() {
         gitApiKind: parseGitApiKind(process.env.GIT_API_KIND, process.env.GIT_API_BASEURL),
         defaultScenario: env("DEFAULT_SCENARIO", "code"),
         skillsDir: env("SKILLS_DIR", defaultSkillsDir()),
-        configCenter: process.env.SEMA_REGISTRY_URL
-            ? {
-                baseUrl: env("SEMA_REGISTRY_URL"),
-                token: process.env.SEMA_REGISTRY_TOKEN || "",
-                dryRun: boolEnv("SEMA_REGISTRY_DRY_RUN", false),
-                worker: process.env.SEMA_REGISTRY_WORKER || undefined,
-            }
-            : undefined,
+        configCenter: process.env.SEMA_REGISTRY_URL ? parseConfigCenter(env("SEMA_REGISTRY_URL")) : undefined,
         configProvider: process.env.CONFIG_PROVIDER || undefined,
         configLocalDir: process.env.CONFIG_LOCAL_DIR || undefined,
         a2aServe: parseA2aServe(),
     };
 }
+function parseConfigCenter(baseUrl) {
+    const worker = process.env.SEMA_REGISTRY_WORKER || undefined;
+    return {
+        baseUrl,
+        credential: createCenterCredentialSource(readCenterCredentialDeclaration(), worker),
+        dryRun: boolEnv("SEMA_REGISTRY_DRY_RUN", false),
+        worker,
+    };
+}
 const A2A_SERVE_MAX_SKILLS = 64;
 const A2A_SERVE_MAX_ID_CHARS = 128;
 const A2A_SERVE_MAX_TEXT_CHARS = 2048;
@@ -2170,10 +2197,6 @@ export function loadConfig() {
     if (dgDurable && requirePrincipal && dgOperators.length === 0) {
         throw new Error("DURABLE_APPROVAL=true + REQUIRE_PRINCIPAL=true but OPERATOR_PRINCIPALS is empty — on a multi-tenant worker the empty operator set makes isOperator() true-for-all, so every authenticated tenant could read every other tenant's pending-approval queue (GET /v1/approvals & siblings). Set OPERATOR_PRINCIPALS, or unset REQUIRE_PRINCIPAL if this is a single-tenant deployment (#157-① boot invariant)");
     }
-    const hostedRefusal = hostedPrincipalRefusal({ requirePrincipal, principalJwtPubkeys, principalJwtIss, principalJwtAud, authBridgeIssuer: auth.authBridgeIssuer });
-    if (hostedRefusal !== undefined) {
-        throw new Error(hostedRefusal);
-    }
     if (imageBakesEnabled && dgOperators.length === 0) {
         throw new Error("IMAGE_BAKES_ENABLED=true but OPERATOR_PRINCIPALS is empty — the bake door runs build.sh on the privileged build host; an empty operator set makes isOperator() true-for-all (world-writable RCE). Set OPERATOR_PRINCIPALS or disable bakes (IMAGE-API-DESIGN.md §P2.4a boot invariant)");
     }
@@ -2225,6 +2248,18 @@ export function loadConfig() {
             `or set CONFIG_PROVIDER=local to take the single-machine \`host\` default, ` +
             `or unset REQUIRE_EXECUTION_LANE to keep running without hands on purpose.`);
     }
+    {
+        const envLaneDispatchable = !isRosterGateArmed(integrations.configCenter);
+        const refusal = modelRouteEndpointRefusal({
+            gatewayBaseUrl: modelPlane.gatewayBaseUrl,
+            gatewayFallbackUrls: modelPlane.gatewayFallbackUrls,
+            anthropic: modelPlane.anthropic,
+            models: envLaneDispatchable ? modelPlane.models : {},
+        });
+        if (refusal !== undefined) {
+            throw new Error(refusal);
+        }
+    }
     EXEC_LANE_NOTICE = buildExecLaneNotice(orchestration.remoteExec);
     return attachConfigGroups({
         ...store,

package/dist/fleet-client.d.ts

@@ -13,6 +13,7 @@
  *  - 全部 fire-and-forget + swallow-guarded:fleet 面是运维旁路,绝不影响任务面;网络错误只 warn 一次/连败类。
  */
 import { UsageReport } from "@sema-agent/settings-schema/fleet";
+import { type CenterEndpoint } from "./config-center/center-request.js";
 /** Bound on distinct principal×model keys per window — a runaway/multi-tenant burst collapses into
  *  `__other__` instead of growing unbounded (same posture as budget.ts cardinalityGuard). */
 export declare const FLEET_USAGE_KEY_CAP = 1024;
@@ -55,9 +56,8 @@ export declare class FleetUsageAccumulator {
     get size(): number;
 }
 export interface FleetClientOpts {
-    center: {
-        baseUrl: string;
-        token: string;
+    /** S-651:凭证是**来源**(每条公告 / 用量 / 注销请求各取一次值),不是启动期烧进 header 的字符串。 */
+    center: CenterEndpoint & {
         worker: string;
     };
     instanceId: string;
@@ -88,16 +88,16 @@ export interface FleetClient {
  */
 export declare function startFleetClient(opts: FleetClientOpts): FleetClient;
 /**
- * Env/config gate (D3 可选分层): start ONLY when the sema-registry lane is configured (baseUrl+token+worker)
+ * Env/config gate (D3 可选分层): start ONLY when the sema-registry lane is configured (baseUrl + a DECLARED credential
+ * + worker — S-651: declared, not "currently readable": a token file that is unreadable right now still starts the
+ * client, every request re-reads it)
  * AND the operator explicitly declared this instance's reachable address. Anything missing → undefined (zero
  * behavior change for non-fleet deployments); worker missing is warned when the rest is present (half-configured).
  */
 export declare function startFleetClientFromEnv(cfg: {
-    configCenter?: {
-        baseUrl: string;
-        token: string;
+    configCenter?: (CenterEndpoint & {
         worker?: string;
-    };
+    }) | undefined;
 }, opts: Omit<FleetClientOpts, "center" | "advertiseAddress"> & {
     advertiseAddress?: string;
 }): FleetClient | undefined;

package/dist/fleet-client.js

@@ -1,5 +1,6 @@
 import { InstanceAnnouncement, UsageReport, DEFAULT_HEARTBEAT_MS } from "@sema-agent/settings-schema/fleet";
 import { buildDisplaySafeUrl } from "./trace/redact.js";
+import { centerFetch } from "./config-center/center-request.js";
 export const FLEET_USAGE_KEY_CAP = 1024;
 export const FLEET_CLIENT_FETCH_TIMEOUT_MS = 5000;
 export class FleetUsageAccumulator {
@@ -77,8 +78,7 @@ export function startFleetClient(opts) {
     const f = opts.fetchImpl ?? fetch;
     const heartbeatMs = opts.heartbeatMs ?? DEFAULT_HEARTBEAT_MS;
     const usageWindowMs = opts.usageWindowMs ?? 60_000;
-    const base = opts.center.baseUrl.replace(/\/+$/, "");
-    const headers = { authorization: `Bearer ${opts.center.token}`, "content-type": "application/json" };
+    const send = (route, method, json) => centerFetch(opts.center, { kind: route }, { method, json, timeoutMs: FLEET_CLIENT_FETCH_TIMEOUT_MS, fetchImpl: f });
     let stopped = false;
     let failStreak = 0;
     const announceNow = async () => {
@@ -92,7 +92,7 @@ export function startFleetClient(opts) {
             heartbeatMs,
         };
         try {
-            const res = await f(`${base}/api/fleet/instances`, { method: "POST", headers, body: JSON.stringify(body), signal: AbortSignal.timeout(FLEET_CLIENT_FETCH_TIMEOUT_MS) });
+            const { res } = await send("fleet-instances", "POST", body);
             if (!res.ok)
                 throw new Error(`announce ${res.status}${await rejectionSnippet(res)}`);
             if (failStreak > 0)
@@ -117,7 +117,7 @@ export function startFleetClient(opts) {
             return;
         const report = { worker: opts.center.worker, instanceId: opts.instanceId, windowStartMs: start, windowEndMs, entries };
         try {
-            const res = await f(`${base}/api/fleet/usage`, { method: "POST", headers, body: JSON.stringify({ reports: [report] }), signal: AbortSignal.timeout(FLEET_CLIENT_FETCH_TIMEOUT_MS) });
+            const { res } = await send("fleet-usage", "POST", { reports: [report] });
             if (!res.ok)
                 throw new Error(`usage ${res.status}${await rejectionSnippet(res)}`);
         }
@@ -140,7 +140,7 @@ export function startFleetClient(opts) {
             clearInterval(uw);
         await flushUsage();
         try {
-            await f(`${base}/api/fleet/instances`, { method: "DELETE", headers, body: JSON.stringify({ instanceId: opts.instanceId, worker: opts.center.worker }), signal: AbortSignal.timeout(FLEET_CLIENT_FETCH_TIMEOUT_MS) });
+            await send("fleet-instances", "DELETE", { instanceId: opts.instanceId, worker: opts.center.worker });
         }
         catch {
         }
@@ -150,7 +150,7 @@ export function startFleetClient(opts) {
 export function startFleetClientFromEnv(cfg, opts) {
     const cc = cfg.configCenter;
     const address = opts.advertiseAddress ?? process.env.FLEET_ADVERTISE_ADDRESS;
-    if (!cc?.baseUrl || !cc.token || !address)
+    if (!cc?.baseUrl || !cc.credential.declared || !address)
         return undefined;
     let parsed;
     try {
@@ -166,6 +166,6 @@ export function startFleetClientFromEnv(cfg, opts) {
         opts.logger?.warn("fleet_client_no_worker_scope", { note: "FLEET_ADVERTISE_ADDRESS set but SEMA_REGISTRY_WORKER missing — announce needs the worker (dispatch key); fleet client not started" });
         return undefined;
     }
-    return startFleetClient({ ...opts, center: { baseUrl: cc.baseUrl, token: cc.token, worker: cc.worker }, advertiseAddress: address });
+    return startFleetClient({ ...opts, center: { baseUrl: cc.baseUrl, credential: cc.credential, worker: cc.worker }, advertiseAddress: address });
 }
 //# sourceMappingURL=fleet-client.js.map

package/dist/fleet-lease.d.ts

@@ -24,6 +24,7 @@
  * - 全部 swallow-guarded:lease 面绝不 fault 任务提交路径。
  */
 import { QuotaLease } from "@sema-agent/settings-schema/fleet";
+import { type CenterEndpoint } from "./config-center/center-request.js";
 /** 负缓存 TTL:非 lease-enforced 的 principal 多久后再问一次 center(entitlement 升级为 lease 的收敛上界)。 */
 export declare const NOT_LEASE_TTL_MS: number;
 /** center 判 budget exhausted 后,多久内的重复提交直接拒绝而不再打 center(防 per-request 打爆)。 */
@@ -62,9 +63,8 @@ export type LeaseAdmission = {
     detail?: QuotaDenyDetail;
 };
 export interface FleetLeaseOpts {
-    center: {
-        baseUrl: string;
-        token: string;
+    /** S-651:凭证是**来源**(每次协商取一次值),不是构造期烧进 header 的字符串。 */
+    center: CenterEndpoint & {
         worker: string;
     };
     fetchImpl?: typeof fetch;
@@ -82,8 +82,6 @@ export declare class FleetLeaseManager {
     private readonly state;
     private readonly inflight;
     private readonly f;
-    private readonly base;
-    private readonly headers;
     private readonly now;
     private failStreak;
     constructor(opts: FleetLeaseOpts);
@@ -108,21 +106,23 @@ export declare class FleetLeaseManager {
     }): void;
     /** Test/observability hook: the current state kind for a principal (never exposes the token). */
     peek(principal: string): PrincipalState["kind"] | undefined;
+    /** 🔴 复审 O2(Opus)的鉴权失败臂,S-651 起两个入口共用(中心 401/403/400;凭证文件不可读):运维配置事故,
+     *  不是可用性事件。仍 fail-open(凭证抖一下不许把租户锁在门外),但**每次**都 warn + 专用计数,且**不缓存**。 */
+    private authFailOpen;
     private set;
     private issueOrRenew;
     private issueOrRenewInner;
 }
 /**
  * Env/config gate(与 startFleetClientFromEnv 同 D3 分层姿势,但 lease 不需要 FLEET_ADVERTISE_ADDRESS ——
- * 它是出站消费面,不是入站可达性声明):sema-registry lane 配齐(baseUrl+token+worker)即启;任一缺失 →
- * undefined,非 fleet 部署零行为变化。
+ * 它是出站消费面,不是入站可达性声明):sema-registry lane 配齐(baseUrl + **声明了**凭证 + worker)即启;任一缺失 →
+ * undefined,非 fleet 部署零行为变化。S-651:按**声明**装、不按内容装 —— `SEMA_REGISTRY_TOKEN_FILE` 在场而
+ * 文件此刻不可读,管理器照样装上(每次协商取值,失败走响亮的鉴权失败臂;文件恢复即恢复)。
  */
 export declare function createFleetLeaseFromEnv(cfg: {
-    configCenter?: {
-        baseUrl: string;
-        token: string;
+    configCenter?: (CenterEndpoint & {
         worker?: string;
-    };
+    }) | undefined;
 }, opts: Omit<FleetLeaseOpts, "center">): FleetLeaseManager | undefined;
 export {};
 //# sourceMappingURL=fleet-lease.d.ts.map

package/dist/fleet-lease.js

@@ -1,4 +1,6 @@
 import { QuotaLease, leaseExhausted, shouldRenewLease } from "@sema-agent/settings-schema/fleet";
+import { CenterCredentialUnavailableError } from "./center-credential.js";
+import { centerFetch } from "./config-center/center-request.js";
 export const NOT_LEASE_TTL_MS = 10 * 60 * 1000;
 export const EXHAUSTED_RETRY_MS = 30 * 1000;
 export const LEASE_PRINCIPAL_CAP = 4096;
@@ -8,15 +10,11 @@ export class FleetLeaseManager {
     state = new Map();
     inflight = new Map();
     f;
-    base;
-    headers;
     now;
     failStreak = 0;
     constructor(opts) {
         this.opts = opts;
         this.f = opts.fetchImpl ?? fetch;
-        this.base = opts.center.baseUrl.replace(/\/+$/, "");
-        this.headers = { authorization: `Bearer ${opts.center.token}`, "content-type": "application/json" };
         this.now = opts.now ?? Date.now;
     }
     async admit(principal) {
@@ -46,6 +44,11 @@ export class FleetLeaseManager {
     peek(principal) {
         return this.state.get(principal)?.kind;
     }
+    authFailOpen(principal, status, note) {
+        this.opts.logger?.warn?.("fleet_lease_auth_error_fail_open", { status, principal, note });
+        this.opts.metrics?.inc("fleet_lease_auth_error_total", { status: String(status) });
+        return { ok: true };
+    }
     set(principal, st) {
         if (!this.state.has(principal) && this.state.size >= LEASE_PRINCIPAL_CAP) {
             const oldest = this.state.keys().next().value;
@@ -64,11 +67,11 @@ export class FleetLeaseManager {
     }
     async issueOrRenewInner(principal) {
         try {
-            const res = await this.f(`${this.base}/api/fleet/leases`, {
+            const { res } = await centerFetch(this.opts.center, { kind: "fleet-leases" }, {
                 method: "POST",
-                headers: this.headers,
-                body: JSON.stringify({ principal, worker: this.opts.center.worker }),
-                signal: AbortSignal.timeout(LEASE_FETCH_TIMEOUT_MS),
+                json: { principal, worker: this.opts.center.worker },
+                timeoutMs: LEASE_FETCH_TIMEOUT_MS,
+                fetchImpl: this.f,
             });
             if (res.status === 200) {
                 const body = (await res.json());
@@ -100,13 +103,14 @@ export class FleetLeaseManager {
                 return { ok: true };
             }
             if (res.status === 401 || res.status === 403 || res.status === 400) {
-                this.opts.logger?.warn?.("fleet_lease_auth_error_fail_open", { status: res.status, principal, note: "center rejected the lease request — check the service token / worker id / center URL (budget NOT enforced until fixed)" });
-                this.opts.metrics?.inc("fleet_lease_auth_error_total", { status: String(res.status) });
-                return { ok: true };
+                return this.authFailOpen(principal, res.status, "center rejected the lease request — check the service token / worker id / center URL (budget NOT enforced until fixed)");
             }
             throw new Error(`lease ${res.status}`);
         }
         catch (err) {
+            if (err instanceof CenterCredentialUnavailableError) {
+                return this.authFailOpen(principal, "credential-unreadable", `${err.reason} — no lease request sent (budget NOT enforced until the credential is readable)`);
+            }
             this.failStreak += 1;
             if (this.failStreak === 1)
                 this.opts.logger?.warn?.("fleet_lease_unavailable_fail_open", { error: err instanceof Error ? err.message : String(err) });
@@ -117,8 +121,8 @@ export class FleetLeaseManager {
 }
 export function createFleetLeaseFromEnv(cfg, opts) {
     const cc = cfg.configCenter;
-    if (!cc?.baseUrl || !cc.token || !cc.worker)
+    if (!cc?.baseUrl || !cc.credential.declared || !cc.worker)
         return undefined;
-    return new FleetLeaseManager({ ...opts, center: { baseUrl: cc.baseUrl, token: cc.token, worker: cc.worker } });
+    return new FleetLeaseManager({ ...opts, center: { baseUrl: cc.baseUrl, credential: cc.credential, worker: cc.worker } });
 }
 //# sourceMappingURL=fleet-lease.js.map

package/dist/hooks/hook-llm.d.ts

@@ -9,7 +9,7 @@ import type { HookLlmCall } from "./hook-runner.js";
  *  - `openai-completions` ⇒ POST {base}/chat/completions(现状,字节不变);
  *  - `anthropic-messages` ⇒ POST {base}/v1/messages(x-api-key / Authorization: Bearer + anthropic-version
  *    头,messages 数组,回包取 content[].text)。此前 hookLlm 只会说 openai 形且缺省 baseUrl 恒落
- *    `config.gatewayBaseUrl`(缺省 http://127.0.0.1:8000/v1)——anthropic 单路由部署(主模型
+ *    `config.gatewayBaseUrl`(当年它有一个本机 8000 端口的出厂缺省,S-623 已删)——anthropic 单路由部署(主模型
  *    provider=anthropic 走 ANTHROPIC_BASE_URL,没配 MODEL_GATEWAY_BASEURL)下 titler 每会话打死
  *    localhost:8000 ⇒ `session_title_failed: TypeError: fetch failed`;即使端点活着,anthropic-messages
  *    模型也不能用 /chat/completions 形调。

package/dist/hooks/hook-llm.js

@@ -1,5 +1,6 @@
 import { adjudicateModelRoute, joinRequestUrl, resolveRouteCredential, routeKeyOf, routeRefusalText } from "@sema-agent/core";
 import { matchCatalogModel } from "../model-select.js";
+import { resolveOpenaiRouteEndpoint } from "../model-route-endpoint.js";
 import { buildDisplaySafeRefusal, redactSecrets } from "../trace/redact.js";
 export function buildHookFailureText(raw) {
     if (raw === "")
@@ -26,7 +27,8 @@ export function createHookLlm(deps) {
             }
             return { ok: true, catalogRef, providerModelId, baseUrl, api };
         }
-        return { ok: true, catalogRef, providerModelId, baseUrl: m?.baseUrl || config.gatewayBaseUrl, api };
+        const endpoint = resolveOpenaiRouteEndpoint(catalogRef, m?.baseUrl, config.gatewayBaseUrl);
+        return endpoint.ok ? { ok: true, catalogRef, providerModelId, baseUrl: endpoint.baseUrl, api } : { ok: false, error: endpoint.refusal };
     };
     const hookModelFor = (requested) => {
         const shape = (ref) => shapeFrom(ref, config.models[ref], config.models[ref]?.id ?? ref);

package/dist/hosted-posture.d.ts

@@ -1,5 +1,5 @@
 /**
- * S-591 / S-564(车LT,7.95.0)—— **「这台部署是不是托管 / 多租」的单一铸点**。
+ * S-591 / S-564(车LT,7.95.0)→ S-671 / B-10(车NB,7.99.0)—— **「这台部署是不是托管 / 多租」的单一铸点**。
  *
  * ## 为什么是一处
  *
@@ -21,60 +21,62 @@
  *       **`deviceCwdHonored` 这一臂里没有 `requirePrincipal` 项**(`task-cwd.ts`:device 车道上那条路径落在
  *       **发起者自己的设备**上,归属由 `device_session` 绑定行验过 ⇒ 跨租户面结构性不存在)。
  *
- * 两条判据的**交集之外**有一形谁都不管:**多用户部署但运维没开 `REQUIRE_PRINCIPAL`,也没有 org 治理**。
- * 那台机器上每一条赦免都成立(它自称单用户),而每一道天花板都不成立(它没有 org 分区)。
- * ⇒ 先把这个判定位铸成**一处**,再让两条腿都读它(clay 裁定③,2026-09-22):**不许各自加特判**——
+ * ⇒ 先把这个判定位铸成**一处**,再让各条腿都读它(clay 裁定③,2026-09-22):**不许各自加特判**——
  * 每加一条特判,「这台机器算不算托管」在本仓就多一个可以自己漂的答案。
  *
- * ## 判据的**唯一**标准:运维**显式点名了一个外部身份签发方**
- *
- * 🔴 判据里**必须**有不读 `requirePrincipal` 的臂,否则腿①(S-564)是同义反复
- * (「`REQUIRE_PRINCIPAL` 没设 ⇒ 要求设 `REQUIRE_PRINCIPAL`」永不触发)。所以词表分两类:
- *  · `require-principal` —— 运维**已经说了**这是多租户(定义式,零假阳);
- *  · 另外两条 —— 运维没说,但他**显式点了一个外部签发方的名字**。一台机器一个可信主人的形
- *    (CC 的信任模型)不需要向任何人验签:签发方存在 ⇒ 身份来自这台机器之外 ⇒ 有别人。
- *
- * ## 🔴 「受控于控制面」**不是**托管证据(主会话裁定⑥ 的二选一,本仓选这一侧)
- *
- * 初版收过第三条臂 `managed-worker`(`SEMA_REGISTRY_WORKER` 在场 = reconciler 管着这台 worker)。
- * **实测两个反例后撤回**:
- *  · `src/run-local.ts` 强设 `REQUIRE_PRINCIPAL=false` 之后才 `loadConfig()` —— 一个共享 `.env` 带着
- *    registry 键就让本机 CLI **拒启**,而拒因指的那根旋钮正是它自己会覆盖回去的(codex 对抗复审同批独立复现);
- *  · 本仓自己的 `test/config-coverage-blocks.test.ts` 两格(configCenter 块)就是「有 worker 名、没开
- *    `REQUIRE_PRINCIPAL`」——它们在初版上当场红。
- * ⇒ **fleet 管理轴 ≠ 租户轴**。同理 `AUTH_BRIDGE_ISSUER` 只收**显式 env**,**绝不**收 boot 期那条
- * `?? config.configCenter?.baseUrl` 的回退(`boot/stage-09-leader.ts`)—— 那条回退的事实来源同样是
- * 「配了 center」,收它等于把刚撤回的那条臂换个名字装回来,精度还更差。
- *
- * ## 精度优先于召回(逐条写下被排除的候选,不留「我没想到」的空白)
- *
- * 假阳 = 一台单用户 turnkey 被拒启 / 被收走一个它一直在用的能力。假阴 = 缺口照旧。
- * 两者都坏,但假阳会当场打到在跑的部署,所以词表只收**单用户形写不出来**的证据:
+ * ## 判据:托管 ⇔ 运维显式声明 `REQUIRE_PRINCIPAL=true`(clay 裁定 [ref] ①,2026-09-23)
+ *
+ * 只有一条定义式证据,零推断。7.95.0–7.98.x 还收过两条「运维点名了一个外部身份签发方」的推断臂
+ * (`PRINCIPAL_JWT_PUBKEYS/ISS/AUD` 任一在场;`AUTH_BRIDGE_ISSUER` 显式在场),[ref] ① 裁 (a) 撤回:
+ *  · **真假阳**:本机自起引擎、配了 principal-JWT / auth-bridge 签发方的单用户部署(web-admin 8090 真案)
+ *    在 7.98.0 被判托管而拒启,只能滚回 7.93.5;
+ *  · **与回退 issuer 不同判**:auth-bridge 的 `?? configCenter.baseUrl` 回退(`boot/stage-09-leader.ts`)
+ *    从来不算证据,而回退桥的引擎同样把单用户授予开给每一个验签通过的 registry JWT 调用者 —— 同一个
+ *    租户轴事实,「显式写了 issuer」与「从 center 推出 issuer」是同一形。裁定后两者同判。
+ * ⇒ 签发方配置是**身份验签轴**(谁的 JWT 算数),不是租户轴(这台机器有几个主人)。「受控于控制面」
+ * (`SEMA_REGISTRY_*`,含 worker 名)同理是 fleet 管理轴,本判据同样不读。
+ *
+ * 随两臂一起删掉的(按类删干净,规则集变小):S-564 腿①「托管 ∧ 未开 `REQUIRE_PRINCIPAL` ⇒ 拒启」
+ * (判据只剩读 `requirePrincipal` 的那一臂之后,那条合取恒假 ⇒ 结构上不可达)及其跨键不变量行;
+ * `run-local.ts` 为那两臂清 env 的清除口。
+ *
+ * ## 被排除的候选(逐条写下,不留「我没想到」的空白)
+ *
+ * 假阳 = 一台单用户部署被收走一个它一直在用的能力(7.98.0 时还会被拒启)。词表不收任何推断臂:
+ *  · ❌ `PRINCIPAL_JWT_*` / `AUTH_BRIDGE_ISSUER` 在场 —— 见上一段([ref] ① 撤回;加回来 = 翻案,要新裁定)。
+ *  · ❌ `configCenter`(含 `worker` 名)/ auth-bridge 的 center 回退 —— fleet 管理轴。初版(车LT)收过
+ *    `managed-worker` 臂,实测两个反例后撤回:`run-local.ts` 强设 `REQUIRE_PRINCIPAL=false` 的本机 CLI 在一个
+ *    带 registry 键的共享 `.env` 上拒启;本仓自己的 `test/config-coverage-blocks.test.ts` configCenter 两格当场红。
  *  · ❌ `operatorPrincipals` 非空 —— **真假阳**:`IMAGE_BAKES_ENABLED` 那条既有不变量
- *    (`config-invariants.ts` 的 `bake-operator-principals`)**强制**开烤门的部署把它填非空,
- *    于是一台开了烤门的单用户机器会被判成托管。
- *  · ❌ `configCenter`(含 `worker` 名)/ auth-bridge 的 center 回退 —— 见上一段,已实测撤回。
+ *    (`config-invariants.ts` 的 `bake-operator-principals`)**强制**开烤门的部署把它填非空。
  *  · ❌ `SERVICE_AUTH_TOKENS` 条目数 —— 一台机器上同时给 cli 与 web-admin 发一只令牌是单用户常态。
  *  · ❌ `DB_BACKEND=mysql|pg` —— 那是**耐久性**轴,不是租户轴(单用户要 durable run 也得开)。
  *  · ❌ `BIND_HOST` 非回环 —— 容器里 `0.0.0.0` 是单用户常态(compose/k8s 默认)。
- *  · ❌ `COMPLIANCE_PROFILE` / `RETENTION_MAX_AGE_DAYS` / `LOCKED_CONFIG_KEYS` —— 数据/治理轴;
- *    一个自己给自己上合规档的单用户部署不该因此被拒启。
- *
- * **已知召回缺口(显式登记,不用「应该很少」填空)**:一台既不验 principal-JWT、也没点 auth-bridge
- * 签发方的团队机器(例如只靠反代加一层 basic auth)本表**看不见**。它的运维面补偿是:
- * `REQUIRE_PRINCIPAL=true` 本身就是那台机器该设的键,而 `docs/DEPLOY-PREREQS.md` 的「托管形前置」段
- * 把判据写成了给人读的清单。
+ *  · ❌ `COMPLIANCE_PROFILE` / `RETENTION_MAX_AGE_DAYS` / `LOCKED_CONFIG_KEYS` —— 数据/治理轴。
+ *
+ * ## 🔴 召回缺口是**全量**的(显式登记,不用「应该很少」填空)
+ *
+ * 一台多用户 / 团队机器只要运维**忘设** `REQUIRE_PRINCIPAL`,本判据就**看不见**它 —— 无论它有没有
+ * 配签发方、受不受 reconciler 管。那台机器上:`principal` 缺席走单用户 `"default"` 赦免 ⇒ 全服无主会话
+ * 被列给每一个调用方;上面四条能力授予面(hooks / `settings.env` / `cwd` / `additionalDirectories`)对每个
+ * 调用方打开;写容纳面天花板与 `approverPosture` 留声两条腿(下文)也按单用户放行。
+ * `settings.env` 的射程要说准:适配器的 `env` 是**并**到 `process.env` 上的逐键覆盖(`plugins/remote-env-host.ts`
+ * 的 `mergeEnv`),而 `task-settings.ts` 的 `cleanEnvMap` 没有任何键名拒集 ⇒ `PATH` / `LD_PRELOAD` /
+ * `NODE_OPTIONS` 一视同仁。
+ * **补偿**:`REQUIRE_PRINCIPAL=true` 本来就是那台机器该设的键(运维自己的声明;server 不替他推断)——
+ * `docs/DEPLOY-PREREQS.md` 的「托管 / 多租部署」段把它写成部署前置,并列出忘设它的后果。
  */
 import { type ServiceConfigFlat } from "./config-types.js";
-/** 托管/多租的**证据词表**(闭集;加词 ⇒ {@link hostedEvidenceNote} 的穷举 switch 编译红)。 */
-export declare const HOSTED_EVIDENCE_WORDS: readonly ["require-principal", "principal-jwt", "auth-bridge-issuer"];
-/** 一条证据(闭集三词)。 */
+/** 托管/多租的**证据词表**(闭集;加词 ⇒ {@link hostedEvidenceNote} 的穷举 switch 编译红)。
+ *  🔴 恰一词是裁定([ref] ①),不是暂时的:加回一条推断臂 = 翻案,先要新裁定。 */
+export declare const HOSTED_EVIDENCE_WORDS: readonly ["require-principal"];
+/** 一条证据(闭集一词)。 */
 export type HostedEvidence = (typeof HOSTED_EVIDENCE_WORDS)[number];
 /**
- * 本判据读的配置键集 —— 取自平铺配置型(键名/类型永不与真配置漂)。
- * `ServiceConfig` 与 `CrossInvariantView` 都**结构上**满足本形,所以 boot 腿、热路径腿与请求腿读同一只函数。
+ * 本判据读的配置键集 —— 取自平铺配置型(键名/类型永不与真配置漂)。`ServiceConfig` **结构上**满足本形,
+ * 所以请求腿(阶段④)与能力面读同一只函数。
  */
-export type HostedPostureInput = Readonly<Pick<ServiceConfigFlat, "requirePrincipal" | "principalJwtPubkeys" | "principalJwtIss" | "principalJwtAud" | "authBridgeIssuer">>;
+export type HostedPostureInput = Readonly<Pick<ServiceConfigFlat, "requirePrincipal">>;
 /** 一台 worker 的托管姿态事实(值 + 证据)——纯数据。 */
 export interface HostedPostureFacts {
     /** 这台部署是不是托管 / 多租。 */
@@ -83,60 +85,14 @@ export interface HostedPostureFacts {
     readonly evidence: readonly HostedEvidence[];
 }
 /**
- * 判定位的**唯一**铸点(纯数据 ⇒ `build*`)。
+ * 判定位的**唯一**铸点(纯数据 ⇒ `build*`)。托管 ⇔ `requirePrincipal === true`([ref] ①)。
  *
- * 🔴 `evidence` 收**全部**命中而不是第一条:拒因要告诉运维「这台机器凭哪几件事被判成托管」,
- * 只报一条会让他改掉那一条之后再撞一次同样的拒(两次拒启之间他学不到全貌)。
+ * `evidence` 仍是数组(按词表顺序收**全部**命中):拒因逐字点它们,运维才知道改哪儿;词表是闭集,
+ * 形状不随词数变。
  */
 export declare function buildHostedPosture(c: HostedPostureInput): HostedPostureFacts;
-/**
- * 判据里**非定义式**那两条证据背后的 env 名 —— 即「运维显式点名了一个外部身份签发方」的全部拼法。
- *
- * 🔴 **单一属主**:`src/run-local.ts` 那条「强制单用户」的腿按本表清 env(W-新8)。它**结构上**兑现不了
- * 这些键(它把 `REQUIRE_PRINCIPAL` 焊死成 false ⇒ principal 门根本不上场),留着它们只会让判据看见一个
- * 假事实、然后拿一个**它自己会覆盖回去**的旋钮当拒因。名表抄第二份的那天,加一条证据 = run-local 静默漏清。
- * ⚠️ 表里**没有** `REQUIRE_PRINCIPAL`(那是定义式那一条,run-local 自己显式写值)也**没有**
- * `SEMA_REGISTRY_*`(fleet 管理轴,本判据根本不读 —— 本机 CLI 从组织下发面取配置是正当用法)。
- */
-export declare const HOSTED_EVIDENCE_ENV_KEYS: readonly ["PRINCIPAL_JWT_PUBKEYS", "PRINCIPAL_JWT_ISS", "PRINCIPAL_JWT_AUD", "AUTH_BRIDGE_ISSUER"];
-/**
- * 把上表那几根 env **清掉**(`run-local.ts` 的「强制单用户」腿调它)。
- *
- * 🔴 **为什么是四行字面 `delete` 而不是照表循环**:配置目录的 D1 对账门按文件数**动态 env 读点**并且是
- * **只降不升的棘轮** —— `process.env[k]` 那种计算属性读它一个都不放过(理由是动态读让「这个文件读了哪些
- * 键」变成机器看不见的事)。照表循环会给 `run-local.ts` 顶上第 3 处动态读、当场撞棘轮。⇒ 名字写成字面,
- * **但只写这一处**;上面那张表仍是**声明面**的属主,两者的一致性由
- * `test/hosted-posture.test.ts` 的行为格看着(逐个设上再调一次,断言全没了)——不是靠人眼比对。
- *
- * ⚠️ 表里**没有** `REQUIRE_PRINCIPAL`(定义式那条,调用方自己显式写值)也没有 `SEMA_REGISTRY_*`
- * (fleet 管理轴,本判据根本不读)。
- */
-export declare function clearHostedEvidenceEnv(): void;
 /** 一条证据的运维事实句 —— **穷举 switch,无缺省臂**(词表加员即编译红)。 */
 export declare function hostedEvidenceNote(e: HostedEvidence): string;
-/**
- * **腿①(S-564)** —— 托管形部署必须显式开 `REQUIRE_PRINCIPAL`。返回拒因;`undefined` = 通过。
- *
- * 判据与文案的**唯一属主**:boot 期的拒启 throw(`config.ts` 的跨域不变量区)与
- * `CONFIG_CROSS_INVARIANTS` 表(`config-invariants.ts`)**调同一只**,不各抄一份([ref] 的纪律 +
- * [ref]「禁手抄投影」)。
- *
- * 🔴 **表里那一行今天是「预置纵深」,不是在岗执法**(主会话裁定⑤,撤回初版那句「热路径同样在岗」):
- * `checkCrossInvariants` 的候选视图(`config-hot` 那条腿)今天只覆写 limits 那 14 员键,本判据读的
- * 5 个键**一个都不在里面** ⇒ 那一行在热路径上**永不返回拒因**。它先在场是纵深(哪天候选视图覆盖到
- * auth 域,它自己就活),不是现在有人在执法。**假覆盖比没覆盖更坏**(7.94.0 自己刚立的反面规矩)。
- *
- * 🔴 **为什么是拒启而不是 warn**:`principal` 缺席在本仓走 `"default"` 赦免 —— 一台没开这根旋钮的
- * 多用户机器会把**全服无主会话**列进 `ListAgents`,并且把 hooks / shellEnv / cwd / 根围栏拓宽四条
- * 能力授予面一并对每个调用方打开(四条面的谓词各不相同,逐条在模块头注 —— 别照「都一样」读)。
- * 安全轴上的 fail-open 不许有安静的兜底臂([ref])。
- *
- * 🔴 **`settings.env` 那一条的射程要说准**(亲读 `plugins/remote-env-host.ts` 的 `mergeEnv`):适配器的
- * `env` 是**并**到 `process.env` 上的逐键覆盖(不是替),而 `task-settings.ts` 的 `cleanEnvMap` 只判
- * 类型/键长/值长/条数、**没有任何键名拒集** ⇒ `PATH` / `LD_PRELOAD` / `NODE_OPTIONS` 一视同仁。
- * 那条面唯一的防线就是上面那道闸;闸一漂,面全开。
- */
-export declare function hostedPrincipalRefusal(c: HostedPostureInput): string | undefined;
 /** 腿② 读的键集 = 射程判据 + 天花板旋钮。
  *  🔴 档位的**词表属主在 `config-types.ts`**(`TASK_WRITE_FACE_ESCALATIONS`)—— 本模块刻意**不留第二份**:
  *  施工期真犯过一次(两处各写一份 `["allow","refuse"]`,加词的那天两边会分家),[ref] 第一排查点。 */