@sema-agent/server 7.98.0 → 7.99.0

package/dist/hosted-posture.d.ts

@@ -1,5 +1,5 @@
 /**
- * S-591 / S-564(车LT,7.95.0)—— **「这台部署是不是托管 / 多租」的单一铸点**。
+ * S-591 / S-564(车LT,7.95.0)→ S-671 / B-10(车NB,7.99.0)—— **「这台部署是不是托管 / 多租」的单一铸点**。
  *
  * ## 为什么是一处
  *
@@ -21,60 +21,62 @@
  *       **`deviceCwdHonored` 这一臂里没有 `requirePrincipal` 项**(`task-cwd.ts`:device 车道上那条路径落在
  *       **发起者自己的设备**上,归属由 `device_session` 绑定行验过 ⇒ 跨租户面结构性不存在)。
  *
- * 两条判据的**交集之外**有一形谁都不管:**多用户部署但运维没开 `REQUIRE_PRINCIPAL`,也没有 org 治理**。
- * 那台机器上每一条赦免都成立(它自称单用户),而每一道天花板都不成立(它没有 org 分区)。
- * ⇒ 先把这个判定位铸成**一处**,再让两条腿都读它(clay 裁定③,2026-09-22):**不许各自加特判**——
+ * ⇒ 先把这个判定位铸成**一处**,再让各条腿都读它(clay 裁定③,2026-09-22):**不许各自加特判**——
  * 每加一条特判,「这台机器算不算托管」在本仓就多一个可以自己漂的答案。
  *
- * ## 判据的**唯一**标准:运维**显式点名了一个外部身份签发方**
- *
- * 🔴 判据里**必须**有不读 `requirePrincipal` 的臂,否则腿①(S-564)是同义反复
- * (「`REQUIRE_PRINCIPAL` 没设 ⇒ 要求设 `REQUIRE_PRINCIPAL`」永不触发)。所以词表分两类:
- *  · `require-principal` —— 运维**已经说了**这是多租户(定义式,零假阳);
- *  · 另外两条 —— 运维没说,但他**显式点了一个外部签发方的名字**。一台机器一个可信主人的形
- *    (CC 的信任模型)不需要向任何人验签:签发方存在 ⇒ 身份来自这台机器之外 ⇒ 有别人。
- *
- * ## 🔴 「受控于控制面」**不是**托管证据(主会话裁定⑥ 的二选一,本仓选这一侧)
- *
- * 初版收过第三条臂 `managed-worker`(`SEMA_REGISTRY_WORKER` 在场 = reconciler 管着这台 worker)。
- * **实测两个反例后撤回**:
- *  · `src/run-local.ts` 强设 `REQUIRE_PRINCIPAL=false` 之后才 `loadConfig()` —— 一个共享 `.env` 带着
- *    registry 键就让本机 CLI **拒启**,而拒因指的那根旋钮正是它自己会覆盖回去的(codex 对抗复审同批独立复现);
- *  · 本仓自己的 `test/config-coverage-blocks.test.ts` 两格(configCenter 块)就是「有 worker 名、没开
- *    `REQUIRE_PRINCIPAL`」——它们在初版上当场红。
- * ⇒ **fleet 管理轴 ≠ 租户轴**。同理 `AUTH_BRIDGE_ISSUER` 只收**显式 env**,**绝不**收 boot 期那条
- * `?? config.configCenter?.baseUrl` 的回退(`boot/stage-09-leader.ts`)—— 那条回退的事实来源同样是
- * 「配了 center」,收它等于把刚撤回的那条臂换个名字装回来,精度还更差。
- *
- * ## 精度优先于召回(逐条写下被排除的候选,不留「我没想到」的空白)
- *
- * 假阳 = 一台单用户 turnkey 被拒启 / 被收走一个它一直在用的能力。假阴 = 缺口照旧。
- * 两者都坏,但假阳会当场打到在跑的部署,所以词表只收**单用户形写不出来**的证据:
+ * ## 判据:托管 ⇔ 运维显式声明 `REQUIRE_PRINCIPAL=true`(clay 裁定 [ref] ①,2026-09-23)
+ *
+ * 只有一条定义式证据,零推断。7.95.0–7.98.x 还收过两条「运维点名了一个外部身份签发方」的推断臂
+ * (`PRINCIPAL_JWT_PUBKEYS/ISS/AUD` 任一在场;`AUTH_BRIDGE_ISSUER` 显式在场),[ref] ① 裁 (a) 撤回:
+ *  · **真假阳**:本机自起引擎、配了 principal-JWT / auth-bridge 签发方的单用户部署(web-admin 8090 真案)
+ *    在 7.98.0 被判托管而拒启,只能滚回 7.93.5;
+ *  · **与回退 issuer 不同判**:auth-bridge 的 `?? configCenter.baseUrl` 回退(`boot/stage-09-leader.ts`)
+ *    从来不算证据,而回退桥的引擎同样把单用户授予开给每一个验签通过的 registry JWT 调用者 —— 同一个
+ *    租户轴事实,「显式写了 issuer」与「从 center 推出 issuer」是同一形。裁定后两者同判。
+ * ⇒ 签发方配置是**身份验签轴**(谁的 JWT 算数),不是租户轴(这台机器有几个主人)。「受控于控制面」
+ * (`SEMA_REGISTRY_*`,含 worker 名)同理是 fleet 管理轴,本判据同样不读。
+ *
+ * 随两臂一起删掉的(按类删干净,规则集变小):S-564 腿①「托管 ∧ 未开 `REQUIRE_PRINCIPAL` ⇒ 拒启」
+ * (判据只剩读 `requirePrincipal` 的那一臂之后,那条合取恒假 ⇒ 结构上不可达)及其跨键不变量行;
+ * `run-local.ts` 为那两臂清 env 的清除口。
+ *
+ * ## 被排除的候选(逐条写下,不留「我没想到」的空白)
+ *
+ * 假阳 = 一台单用户部署被收走一个它一直在用的能力(7.98.0 时还会被拒启)。词表不收任何推断臂:
+ *  · ❌ `PRINCIPAL_JWT_*` / `AUTH_BRIDGE_ISSUER` 在场 —— 见上一段([ref] ① 撤回;加回来 = 翻案,要新裁定)。
+ *  · ❌ `configCenter`(含 `worker` 名)/ auth-bridge 的 center 回退 —— fleet 管理轴。初版(车LT)收过
+ *    `managed-worker` 臂,实测两个反例后撤回:`run-local.ts` 强设 `REQUIRE_PRINCIPAL=false` 的本机 CLI 在一个
+ *    带 registry 键的共享 `.env` 上拒启;本仓自己的 `test/config-coverage-blocks.test.ts` configCenter 两格当场红。
  *  · ❌ `operatorPrincipals` 非空 —— **真假阳**:`IMAGE_BAKES_ENABLED` 那条既有不变量
- *    (`config-invariants.ts` 的 `bake-operator-principals`)**强制**开烤门的部署把它填非空,
- *    于是一台开了烤门的单用户机器会被判成托管。
- *  · ❌ `configCenter`(含 `worker` 名)/ auth-bridge 的 center 回退 —— 见上一段,已实测撤回。
+ *    (`config-invariants.ts` 的 `bake-operator-principals`)**强制**开烤门的部署把它填非空。
  *  · ❌ `SERVICE_AUTH_TOKENS` 条目数 —— 一台机器上同时给 cli 与 web-admin 发一只令牌是单用户常态。
  *  · ❌ `DB_BACKEND=mysql|pg` —— 那是**耐久性**轴,不是租户轴(单用户要 durable run 也得开)。
  *  · ❌ `BIND_HOST` 非回环 —— 容器里 `0.0.0.0` 是单用户常态(compose/k8s 默认)。
- *  · ❌ `COMPLIANCE_PROFILE` / `RETENTION_MAX_AGE_DAYS` / `LOCKED_CONFIG_KEYS` —— 数据/治理轴;
- *    一个自己给自己上合规档的单用户部署不该因此被拒启。
- *
- * **已知召回缺口(显式登记,不用「应该很少」填空)**:一台既不验 principal-JWT、也没点 auth-bridge
- * 签发方的团队机器(例如只靠反代加一层 basic auth)本表**看不见**。它的运维面补偿是:
- * `REQUIRE_PRINCIPAL=true` 本身就是那台机器该设的键,而 `docs/DEPLOY-PREREQS.md` 的「托管形前置」段
- * 把判据写成了给人读的清单。
+ *  · ❌ `COMPLIANCE_PROFILE` / `RETENTION_MAX_AGE_DAYS` / `LOCKED_CONFIG_KEYS` —— 数据/治理轴。
+ *
+ * ## 🔴 召回缺口是**全量**的(显式登记,不用「应该很少」填空)
+ *
+ * 一台多用户 / 团队机器只要运维**忘设** `REQUIRE_PRINCIPAL`,本判据就**看不见**它 —— 无论它有没有
+ * 配签发方、受不受 reconciler 管。那台机器上:`principal` 缺席走单用户 `"default"` 赦免 ⇒ 全服无主会话
+ * 被列给每一个调用方;上面四条能力授予面(hooks / `settings.env` / `cwd` / `additionalDirectories`)对每个
+ * 调用方打开;写容纳面天花板与 `approverPosture` 留声两条腿(下文)也按单用户放行。
+ * `settings.env` 的射程要说准:适配器的 `env` 是**并**到 `process.env` 上的逐键覆盖(`plugins/remote-env-host.ts`
+ * 的 `mergeEnv`),而 `task-settings.ts` 的 `cleanEnvMap` 没有任何键名拒集 ⇒ `PATH` / `LD_PRELOAD` /
+ * `NODE_OPTIONS` 一视同仁。
+ * **补偿**:`REQUIRE_PRINCIPAL=true` 本来就是那台机器该设的键(运维自己的声明;server 不替他推断)——
+ * `docs/DEPLOY-PREREQS.md` 的「托管 / 多租部署」段把它写成部署前置,并列出忘设它的后果。
  */
 import { type ServiceConfigFlat } from "./config-types.js";
-/** 托管/多租的**证据词表**(闭集;加词 ⇒ {@link hostedEvidenceNote} 的穷举 switch 编译红)。 */
-export declare const HOSTED_EVIDENCE_WORDS: readonly ["require-principal", "principal-jwt", "auth-bridge-issuer"];
-/** 一条证据(闭集三词)。 */
+/** 托管/多租的**证据词表**(闭集;加词 ⇒ {@link hostedEvidenceNote} 的穷举 switch 编译红)。
+ *  🔴 恰一词是裁定([ref] ①),不是暂时的:加回一条推断臂 = 翻案,先要新裁定。 */
+export declare const HOSTED_EVIDENCE_WORDS: readonly ["require-principal"];
+/** 一条证据(闭集一词)。 */
 export type HostedEvidence = (typeof HOSTED_EVIDENCE_WORDS)[number];
 /**
- * 本判据读的配置键集 —— 取自平铺配置型(键名/类型永不与真配置漂)。
- * `ServiceConfig` 与 `CrossInvariantView` 都**结构上**满足本形,所以 boot 腿、热路径腿与请求腿读同一只函数。
+ * 本判据读的配置键集 —— 取自平铺配置型(键名/类型永不与真配置漂)。`ServiceConfig` **结构上**满足本形,
+ * 所以请求腿(阶段④)与能力面读同一只函数。
  */
-export type HostedPostureInput = Readonly<Pick<ServiceConfigFlat, "requirePrincipal" | "principalJwtPubkeys" | "principalJwtIss" | "principalJwtAud" | "authBridgeIssuer">>;
+export type HostedPostureInput = Readonly<Pick<ServiceConfigFlat, "requirePrincipal">>;
 /** 一台 worker 的托管姿态事实(值 + 证据)——纯数据。 */
 export interface HostedPostureFacts {
     /** 这台部署是不是托管 / 多租。 */
@@ -83,60 +85,14 @@ export interface HostedPostureFacts {
     readonly evidence: readonly HostedEvidence[];
 }
 /**
- * 判定位的**唯一**铸点(纯数据 ⇒ `build*`)。
+ * 判定位的**唯一**铸点(纯数据 ⇒ `build*`)。托管 ⇔ `requirePrincipal === true`([ref] ①)。
  *
- * 🔴 `evidence` 收**全部**命中而不是第一条:拒因要告诉运维「这台机器凭哪几件事被判成托管」,
- * 只报一条会让他改掉那一条之后再撞一次同样的拒(两次拒启之间他学不到全貌)。
+ * `evidence` 仍是数组(按词表顺序收**全部**命中):拒因逐字点它们,运维才知道改哪儿;词表是闭集,
+ * 形状不随词数变。
  */
 export declare function buildHostedPosture(c: HostedPostureInput): HostedPostureFacts;
-/**
- * 判据里**非定义式**那两条证据背后的 env 名 —— 即「运维显式点名了一个外部身份签发方」的全部拼法。
- *
- * 🔴 **单一属主**:`src/run-local.ts` 那条「强制单用户」的腿按本表清 env(W-新8)。它**结构上**兑现不了
- * 这些键(它把 `REQUIRE_PRINCIPAL` 焊死成 false ⇒ principal 门根本不上场),留着它们只会让判据看见一个
- * 假事实、然后拿一个**它自己会覆盖回去**的旋钮当拒因。名表抄第二份的那天,加一条证据 = run-local 静默漏清。
- * ⚠️ 表里**没有** `REQUIRE_PRINCIPAL`(那是定义式那一条,run-local 自己显式写值)也**没有**
- * `SEMA_REGISTRY_*`(fleet 管理轴,本判据根本不读 —— 本机 CLI 从组织下发面取配置是正当用法)。
- */
-export declare const HOSTED_EVIDENCE_ENV_KEYS: readonly ["PRINCIPAL_JWT_PUBKEYS", "PRINCIPAL_JWT_ISS", "PRINCIPAL_JWT_AUD", "AUTH_BRIDGE_ISSUER"];
-/**
- * 把上表那几根 env **清掉**(`run-local.ts` 的「强制单用户」腿调它)。
- *
- * 🔴 **为什么是四行字面 `delete` 而不是照表循环**:配置目录的 D1 对账门按文件数**动态 env 读点**并且是
- * **只降不升的棘轮** —— `process.env[k]` 那种计算属性读它一个都不放过(理由是动态读让「这个文件读了哪些
- * 键」变成机器看不见的事)。照表循环会给 `run-local.ts` 顶上第 3 处动态读、当场撞棘轮。⇒ 名字写成字面,
- * **但只写这一处**;上面那张表仍是**声明面**的属主,两者的一致性由
- * `test/hosted-posture.test.ts` 的行为格看着(逐个设上再调一次,断言全没了)——不是靠人眼比对。
- *
- * ⚠️ 表里**没有** `REQUIRE_PRINCIPAL`(定义式那条,调用方自己显式写值)也没有 `SEMA_REGISTRY_*`
- * (fleet 管理轴,本判据根本不读)。
- */
-export declare function clearHostedEvidenceEnv(): void;
 /** 一条证据的运维事实句 —— **穷举 switch,无缺省臂**(词表加员即编译红)。 */
 export declare function hostedEvidenceNote(e: HostedEvidence): string;
-/**
- * **腿①(S-564)** —— 托管形部署必须显式开 `REQUIRE_PRINCIPAL`。返回拒因;`undefined` = 通过。
- *
- * 判据与文案的**唯一属主**:boot 期的拒启 throw(`config.ts` 的跨域不变量区)与
- * `CONFIG_CROSS_INVARIANTS` 表(`config-invariants.ts`)**调同一只**,不各抄一份([ref] 的纪律 +
- * [ref]「禁手抄投影」)。
- *
- * 🔴 **表里那一行今天是「预置纵深」,不是在岗执法**(主会话裁定⑤,撤回初版那句「热路径同样在岗」):
- * `checkCrossInvariants` 的候选视图(`config-hot` 那条腿)今天只覆写 limits 那 14 员键,本判据读的
- * 5 个键**一个都不在里面** ⇒ 那一行在热路径上**永不返回拒因**。它先在场是纵深(哪天候选视图覆盖到
- * auth 域,它自己就活),不是现在有人在执法。**假覆盖比没覆盖更坏**(7.94.0 自己刚立的反面规矩)。
- *
- * 🔴 **为什么是拒启而不是 warn**:`principal` 缺席在本仓走 `"default"` 赦免 —— 一台没开这根旋钮的
- * 多用户机器会把**全服无主会话**列进 `ListAgents`,并且把 hooks / shellEnv / cwd / 根围栏拓宽四条
- * 能力授予面一并对每个调用方打开(四条面的谓词各不相同,逐条在模块头注 —— 别照「都一样」读)。
- * 安全轴上的 fail-open 不许有安静的兜底臂([ref])。
- *
- * 🔴 **`settings.env` 那一条的射程要说准**(亲读 `plugins/remote-env-host.ts` 的 `mergeEnv`):适配器的
- * `env` 是**并**到 `process.env` 上的逐键覆盖(不是替),而 `task-settings.ts` 的 `cleanEnvMap` 只判
- * 类型/键长/值长/条数、**没有任何键名拒集** ⇒ `PATH` / `LD_PRELOAD` / `NODE_OPTIONS` 一视同仁。
- * 那条面唯一的防线就是上面那道闸;闸一漂,面全开。
- */
-export declare function hostedPrincipalRefusal(c: HostedPostureInput): string | undefined;
 /** 腿② 读的键集 = 射程判据 + 天花板旋钮。
  *  🔴 档位的**词表属主在 `config-types.ts`**(`TASK_WRITE_FACE_ESCALATIONS`)—— 本模块刻意**不留第二份**:
  *  施工期真犯过一次(两处各写一份 `["allow","refuse"]`,加词的那天两边会分家),[ref] 第一排查点。 */

package/dist/hosted-posture.js

@@ -1,45 +1,21 @@
 import { TASK_WRITE_FACE_ESCALATIONS } from "./config-types.js";
 import { deviceCwdHonored } from "./task-cwd.js";
-export const HOSTED_EVIDENCE_WORDS = ["require-principal", "principal-jwt", "auth-bridge-issuer"];
+export const HOSTED_EVIDENCE_WORDS = ["require-principal"];
 export function buildHostedPosture(c) {
     const evidence = [];
     if (c.requirePrincipal === true)
         evidence.push("require-principal");
-    if (c.principalJwtPubkeys.length > 0 || c.principalJwtIss !== undefined || c.principalJwtAud !== undefined)
-        evidence.push("principal-jwt");
-    if (c.authBridgeIssuer !== undefined)
-        evidence.push("auth-bridge-issuer");
     return { hosted: evidence.length > 0, evidence };
 }
-export const HOSTED_EVIDENCE_ENV_KEYS = ["PRINCIPAL_JWT_PUBKEYS", "PRINCIPAL_JWT_ISS", "PRINCIPAL_JWT_AUD", "AUTH_BRIDGE_ISSUER"];
-export function clearHostedEvidenceEnv() {
-    delete process.env.PRINCIPAL_JWT_PUBKEYS;
-    delete process.env.PRINCIPAL_JWT_ISS;
-    delete process.env.PRINCIPAL_JWT_AUD;
-    delete process.env.AUTH_BRIDGE_ISSUER;
-}
 export function hostedEvidenceNote(e) {
     switch (e) {
         case "require-principal":
             return "REQUIRE_PRINCIPAL=true (this deployment declares itself multi-tenant)";
-        case "principal-jwt":
-            return "PRINCIPAL_JWT_PUBKEYS/ISS/AUD is configured (principal identities are verified against an external issuer — a single-user turnkey box has no issuer)";
-        case "auth-bridge-issuer":
-            return "AUTH_BRIDGE_ISSUER is set explicitly (a second external SSO-JWT issuer; the registry-URL fallback is deliberately NOT read here — that fact is fleet management, not tenancy)";
     }
 }
 function hostedBecause(facts) {
     return facts.evidence.map(hostedEvidenceNote).join("; ");
 }
-export function hostedPrincipalRefusal(c) {
-    const facts = buildHostedPosture(c);
-    if (!facts.hosted || c.requirePrincipal === true)
-        return undefined;
-    return (`this deployment looks HOSTED/multi-tenant (${hostedBecause(facts)}) but REQUIRE_PRINCIPAL is not set — ` +
-        `an absent principal takes the single-user "default" amnesty, which would list every ownerless session to every caller ` +
-        `and open the single-user capability grants (settings.hooks / settings.env / cwd / additionalDirectories) to all of them. ` +
-        `Set REQUIRE_PRINCIPAL=true (and OPERATOR_PRINCIPALS for the operator-only routes), or remove the hosted-deployment configuration if this really is a single-user box.`);
-}
 export const HOST_POSTURE_REFUSED_CODE = "request.host_posture_refused";
 function hostPostureDeclarationsHonored(c) {
     if (deviceCwdHonored(c))

package/dist/observability/secret-env-scrub.d.ts

@@ -1,28 +1,4 @@
-/**
- * [ref]([ref])—— **密钥形 env 剥除的留痕面**(core D1 `scrubSecretEnv` 的可观测半场)。
- *
- * ## 它解决的问题
- * `scrubSecretEnv` 是本仓两条 shell/子进程腿的**安全默认**:模型可驱动的 shell(`inheritEnv:"scrub"`)与
- * git 子进程(钩子/凭证助手)拿到的 env 里,`*_KEY`/`*_TOKEN`/`*_SECRET`/`*_PASSWORD`… 一律先丢掉。
- * 两处都以**单参形**调用,于是「这一次到底丢了哪些 key、按哪条规则(suffix-rule / exact-name)、置信度多少」
- * **零留痕** —— 部署方既证明不了保护生效过,也发现不了它悄悄不生效了(词表漂移 / 一个新的密钥命名法从
- * 规则的缝里穿过去 / 某条腿被改成 `inheritEnv:"all"`)。core 早就把收集口开好了(`findings?:
- * SecretEnvFinding[]`,d.ts 原话:the VALUE is never carried — this record is meant to be loggable),
- * 缺的只是本仓这半场。本模块就是那半场,**不是**一个新的执法面:它一个字节也不改变剥除行为。
- *
- * ## 形(照 `fail-open.ts` 的仓内先例)
- *  1. **计数(逐次)** —— `secret_env_scrubbed_total{site,kind,confidence}`;
- *  2. **结构化披露(每 site×key 一次)** —— 首次在某条腿上丢掉某个 key 时一条 `info`,之后同 key 只走计数。
- *     不是「每 site 一次」:一个**新**的密钥形 key 后来才出现(部署加了一个凭证)时,那才是最该看见的一行。
- * 值永不进任何一件(core 的 finding 本身就不携带值)。
- *
- * ## 为什么是进程级自由函数而不是注入
- * 与 `recordFailOpen` 同因:两个调用点都在**没有 logger/metrics 句柄**的深处
- * (`plugins/remote-env-host.ts` 的 `mergeEnv` 全文零观测通道;`project-memory.ts` 的 `git()` 是个自由函数)。
- * 装配层用 {@link installSecretEnvScrubRecorder} 把句柄接上,装配之前命中的次数不会丢(计数照常累加,
- * install 时一次性补进 metrics),披露行则在下一次命中时补发(未成功披露的 key 不进 `disclosed` 集)。
- */
-import { type SecretEnvFinding } from "@sema-agent/core";
+import type { ServerSecretEnvFinding } from "../server-secret-env.js";
 import type { Logger } from "./logger.js";
 import type { Metrics } from "./metrics.js";
 /** 登记过的剥除现场。闭集:未登记的 site 传不进 {@link recordSecretEnvScrub}(编译期拒,同 FAIL_OPEN_TAGS 纪律)。 */
@@ -40,7 +16,7 @@ interface Sink {
  * 记一次剥除。**总不抛** —— 观测本身绝不能变成故障(同 `recordFailOpen` / reapers 的判据)。
  * `findings` 为空(这一次没丢任何 key)时什么也不做:那不是事件,是常态。
  */
-export declare function recordSecretEnvScrub(site: SecretEnvScrubSite, findings: readonly SecretEnvFinding[]): void;
+export declare function recordSecretEnvScrub(site: SecretEnvScrubSite, findings: readonly ServerSecretEnvFinding[]): void;
 /** 装配层把 logger/metrics 接上(main.ts,与 `installFailOpenRecorder` 同一处)。装配前累计的次数在此补进 metrics。 */
 export declare function installSecretEnvScrubRecorder(deps: Sink): void;
 /** 已留驻的「现场×键」条数(测试/诊断读面)。恒 ≤ {@link DISCLOSED_CAP}。 */

package/dist/observability/secret-env-scrub.js

@@ -62,7 +62,7 @@ export function recordSecretEnvScrub(site, findings) {
 }
 export function installSecretEnvScrubRecorder(deps) {
     sink = { ...deps };
-    deps.metrics?.counter(SCRUB_COUNTER, "secret-pattern env entries dropped before spawning a child process, by site/rule/confidence (core scrubSecretEnv findings)");
+    deps.metrics?.counter(SCRUB_COUNTER, "secret env entries dropped before spawning a child process, by site/rule/confidence (core scrubSecretEnv shape rule + server config-catalog secret names)");
     drainToMetrics();
 }
 export function secretEnvScrubDisclosedSize() {
@@ -76,6 +76,6 @@ export function resetSecretEnvScrubRecorderForTest(deps = {}) {
     pushed = new Map();
     disclosed = new Set();
     sink = { ...deps };
-    deps.metrics?.counter(SCRUB_COUNTER, "secret-pattern env entries dropped before spawning a child process, by site/rule/confidence (core scrubSecretEnv findings)");
+    deps.metrics?.counter(SCRUB_COUNTER, "secret env entries dropped before spawning a child process, by site/rule/confidence (core scrubSecretEnv shape rule + server config-catalog secret names)");
 }
 //# sourceMappingURL=secret-env-scrub.js.map

package/dist/plugins/remote-env-host.d.ts

@@ -33,6 +33,8 @@ export interface HostEnvConfig {
     commandTimeoutMs?: number;
     /** Shell-child env policy (D1; mirrors core's `NodeExecutionEnv`). Default `"scrub"`: inherit the worker's
      *  `process.env` but DROP secret-pattern keys (core's `scrubSecretEnv` — `*_KEY`/`*_TOKEN`/`*_SECRET`/`*_PASSWORD`…)
+     *  AND every env name the server's config catalog types as `secret` (`server-secret-env.ts`; 7.99.0 F7 —
+     *  `SERVICE_AUTH_TOKENS` / `APPROVAL_HMAC_KEYS` slip the shape rule)
      *  so a model-driven shell can't `printenv DEEPSEEK_API_KEY` and exfiltrate orchestrator secrets — keeps PATH/HOME/
      *  locale/build (low breakage). `"all"` = inherit everything (explicit opt-out, trusted local dev). A `string[]` =
      *  strict allowlist. `env`/per-command `options.env` ALWAYS pass through verbatim. */
@@ -386,7 +388,7 @@ export declare class RemoteHostExecutionEnv implements RemoteExecutionEnv, Sched
     private fsReady;
     /** Base env (process.env when inheriting) merged with the adapter's secret env, then per-command overrides win. */
     /** D1 secure default = `"scrub"`: inherit `process.env` minus secret-pattern keys (core's `scrubSecretEnv`, single
-     *  source of truth). `"all"` = full inherit (opt-out); a `string[]` = strict allowlist. Legacy `inheritProcessEnv`
+     *  source of the shape rule) minus the config catalog's `secret`-typed names (`scrubServerSecrets`, 7.99.0 F7). `"all"` = full inherit (opt-out); a `string[]` = strict allowlist. Legacy `inheritProcessEnv`
      *  maps `true`→`"all"` / `false`→`[]`. */
     private inheritMode;
     private mergeEnv;

package/dist/plugins/remote-env-host.js

@@ -9,8 +9,9 @@ import { armPipeDestroyGrace, numEnvOr, SYMLINK_CHAIN_MAX_HOPS } from "./remote-
 import { hostBackgroundShellEnabled, hostExecSpoolEnabled } from "../config.js";
 import { resolveHostShell, hostShell, spawnGroupOptions, killTreeHard, killTreeSoft, collapseWin32EnvKeys, adoptHostForegroundChild } from "./host-platform.js";
 import { BackgroundShellManager, seedMemStream, feedMemStream, drainMemStream } from "./background-shell-support.js";
-import { FileError, ExecutionError, RemoteExecutionError, scrubSecretEnv, RollingTailBuffer, markTruncated, SchedulerError, BackgroundShellError, } from "@sema-agent/core";
+import { FileError, ExecutionError, RemoteExecutionError, RollingTailBuffer, markTruncated, SchedulerError, BackgroundShellError, } from "@sema-agent/core";
 import { recordSecretEnvScrub } from "../observability/secret-env-scrub.js";
+import { scrubServerSecrets } from "../server-secret-env.js";
 import { trackEphemeralHostWorkspace, untrackEphemeralHostWorkspace } from "./host-workspace-registry.js";
 const PROVIDER = "host";
 const DEFAULT_COMMAND_TIMEOUT_MS = 30 * 60_000;
@@ -1312,7 +1313,7 @@ export class RemoteHostExecutionEnv {
         }
         else {
             const findings = [];
-            base = scrubSecretEnv(process.env, findings);
+            base = scrubServerSecrets(process.env, findings);
             recordSecretEnvScrub("server.remote-env-host.inherit-scrub", findings);
         }
         if (this.cfg.env)

package/dist/project-memory.d.ts

@@ -1,3 +1,4 @@
+import { type PlatformPath } from "node:path";
 import type { ProjectMemoryLoad } from "@sema-agent/core";
 interface ProjectMemoryCtx {
     cwd: string;
@@ -7,9 +8,35 @@ interface ProjectMemoryCtx {
     sessionId?: string;
     phase?: "fresh" | "resume" | "post-compact" | "post-clear";
 }
+/** The instruction-file name chain: the CLAUDE family first, the AGENTS family only when no CLAUDE file is
+ *  present. The FIRST hit is the single declared instruction source.
+ *
+ *  Order follows CC 2.1.280 (clay ruling [ref], 2026-09-23, board [ref] RG-2). It replaces the core 1.302 S-1
+ *  order, where AGENTS.md won over CLAUDE.md; [ref] supersedes that. In CC 2.1.280:
+ *   - cli280.js:185162 — the default mode `claude-md-or-agents-md`: "a project with no CLAUDE.md of its own gets its
+ *     AGENTS.md files instead, loaded exactly where and how CLAUDE.md would be";
+ *   - cli280.js:245920 — the two name families: AGENTS `["AGENTS.md", ".claude/AGENTS.md"]`,
+ *     CLAUDE `["CLAUDE.md", ".claude/CLAUDE.md", "CLAUDE.local.md"]`;
+ *   - cli280.js:226831 — the 2.1.277 changelog entry "in a project with no CLAUDE.md, Claude Code reads AGENTS.md
+ *     instead".
+ *  Not followed here (CC divergences, registration drafted in the che-MN closing note): `CLAUDE.local.md` is not read;
+ *  CC's other `instructionFiles` modes (`claude-md-and-agents-md` loads both, `managed-only`) are not offered; CC loads
+ *  every CLAUDE file it finds, per directory level up the ancestor chain, whereas this loader reads one root and
+ *  takes the single first hit. */
+declare const INSTRUCTION_FILE_CHAIN: readonly ["CLAUDE.md", ".claude/CLAUDE.md", "AGENTS.md", ".claude/AGENTS.md"];
+type ChainMember = (typeof INSTRUCTION_FILE_CHAIN)[number];
+/** Recover (root, rel) for a path the LOADER declared — every declared path is `root + one chain member`.
+ *  The probe needs this to re-run the loader's parent-directory symlink gate each round (self-review: the probe
+ *  checked only the final component, so swapping `.claude` for a symlink out of the repo MID-RUN made the probe
+ *  fingerprint an outside file). Exported only for its path-matrix pin (posix / win32 through `p`); the probe
+ *  calls it with the host `node:path`. */
+export declare function instructionChainCoordinates(absPath: string, p?: PlatformPath): {
+    root: string;
+    rel: ChainMember;
+} | null;
 /**
  * Build a `loadProjectMemory` for the host lane. Returns null (skip) unless hands are enabled AND cwd is a local
- * directory. Reads the instruction-file chain (AGENTS.md → CLAUDE.md → .claude/CLAUDE.md, S-1) + (non-subagent)
+ * directory. Reads the instruction-file chain (CLAUDE.md → .claude/CLAUDE.md → AGENTS.md → .claude/AGENTS.md, [ref]) + (non-subagent)
  * `git log -5` / `git status`, redacts secrets, and caps the total. A subagent gets a trimmed instruction file and
  * no git narrative (cost control, H7). When an instruction file is hit the return is a `ProjectMemoryLoad`
  * declaring it in `instructionSources` (path + sha256 over the raw bounded-read window) so core's

package/dist/project-memory.js

@@ -1,11 +1,11 @@
 import { promises as fs, constants as fsConstants } from "node:fs";
 import { execFile } from "node:child_process";
 import { createHmac, randomBytes } from "node:crypto";
-import { isAbsolute, join, sep } from "node:path";
-import { scrubSecretEnv } from "@sema-agent/core";
+import hostPath, { isAbsolute, join } from "node:path";
 import { recordSecretEnvScrub } from "./observability/secret-env-scrub.js";
+import { scrubServerSecrets } from "./server-secret-env.js";
 import { redactSecrets } from "./trace/redact.js";
-const INSTRUCTION_FILE_CHAIN = ["AGENTS.md", "CLAUDE.md", ".claude/CLAUDE.md"];
+const INSTRUCTION_FILE_CHAIN = ["CLAUDE.md", ".claude/CLAUDE.md", "AGENTS.md", ".claude/AGENTS.md"];
 const INSTRUCTION_READ_CAP = 24 * 1024;
 function capUtf8(s, maxBytes) {
     const buf = Buffer.from(s, "utf8");
@@ -41,15 +41,16 @@ function instructionHash(raw) {
     return `hmac-sha256:${createHmac("sha256", INSTRUCTION_HASH_KEY).update(raw).digest("hex")}`;
 }
 const ABSENT_HASH = null;
-function chainCoordinates(absPath) {
-    let best = null;
-    for (const rel of INSTRUCTION_FILE_CHAIN) {
-        const suffix = sep + rel.split("/").join(sep);
-        if (absPath.endsWith(suffix) && (best === null || suffix.length > best.len)) {
-            best = { root: absPath.slice(0, -suffix.length), rel, len: suffix.length };
-        }
+export function instructionChainCoordinates(absPath, p = hostPath) {
+    const candidates = INSTRUCTION_FILE_CHAIN.filter((rel) => absPath.endsWith(p.sep + rel.split("/").join(p.sep))).sort((a, b) => b.length - a.length);
+    for (const rel of candidates) {
+        let root = absPath;
+        for (let i = 0; i < rel.split("/").length; i++)
+            root = p.dirname(root);
+        if (p.join(root, rel) === absPath)
+            return { root, rel };
     }
-    return best && { root: best.root, rel: best.rel };
+    return null;
 }
 async function hasSymlinkedParent(root, rel) {
     const parts = rel.split("/").slice(0, -1);
@@ -62,10 +63,15 @@ async function hasSymlinkedParent(root, rel) {
     }
     return false;
 }
+async function readChainMember(root, rel, maxBytes, truncatedFlag) {
+    if (rel.includes("/") && (await hasSymlinkedParent(root, rel)))
+        return null;
+    return readRawCapped(join(root, rel), maxBytes, truncatedFlag);
+}
 function git(root, args, maxBytes) {
     const safeArgs = ["-c", "core.fsmonitor=false", "-c", "core.hooksPath=/dev/null", ...args];
     const scrubFindings = [];
-    const scrubbedEnv = scrubSecretEnv(process.env, scrubFindings);
+    const scrubbedEnv = scrubServerSecrets(process.env, scrubFindings);
     recordSecretEnvScrub("server.project-memory.git-subprocess", scrubFindings);
     return new Promise((res) => {
         execFile("git", safeArgs, { cwd: root, timeout: 5000, maxBuffer: maxBytes, env: { ...scrubbedEnv, GIT_CONFIG_GLOBAL: "/dev/null", GIT_CONFIG_SYSTEM: "/dev/null" } }, (err, stdout, stderr) => {
@@ -156,9 +162,7 @@ export function makeLoadProjectMemory(opts) {
             hitIndex = -1;
             for (let i = 0; i < INSTRUCTION_FILE_CHAIN.length; i++) {
                 const rel = INSTRUCTION_FILE_CHAIN[i];
-                if (rel.includes("/") && (await hasSymlinkedParent(root, rel)))
-                    continue;
-                const raw = await readRawCapped(join(root, rel), claudeCap, claudeTrunc);
+                const raw = await readChainMember(root, rel, claudeCap, claudeTrunc);
                 if (raw !== null) {
                     claudeRaw = capUtf8(raw.toString("utf8"), claudeCap);
                     hitFile = rel;
@@ -171,8 +175,7 @@ export function makeLoadProjectMemory(opts) {
                 break;
             let appeared = false;
             for (const rel of INSTRUCTION_FILE_CHAIN.slice(0, hitIndex)) {
-                const higher = await fs.lstat(join(root, rel)).catch(() => null);
-                if (higher && !higher.isSymbolicLink()) {
+                if ((await readChainMember(root, rel, claudeCap)) !== null) {
                     appeared = true;
                     break;
                 }
@@ -229,11 +232,8 @@ export function makeProbeInstructionSources() {
             return await Promise.all(sources.map(async ({ path }) => {
                 if (!isAbsolute(path))
                     return { path, contentHash: null };
-                const coords = chainCoordinates(path);
-                if (coords && coords.rel.includes("/") && (await hasSymlinkedParent(coords.root, coords.rel))) {
-                    return { path, contentHash: null };
-                }
-                const raw = await readRawCapped(path, INSTRUCTION_READ_CAP);
+                const coords = instructionChainCoordinates(path);
+                const raw = coords ? await readChainMember(coords.root, coords.rel, INSTRUCTION_READ_CAP) : await readRawCapped(path, INSTRUCTION_READ_CAP);
                 return { path, contentHash: raw === null ? null : instructionHash(raw) };
             }));
         }

package/dist/run-local.js

@@ -18,7 +18,6 @@ import { taskWallClockSec } from "./task-workflow.js";
 import { applyCatalogToSource } from "./capabilities/center-prompts.js";
 import { validatePromptsDomain, CORE_ENGINE_VERSION } from "./prompts-domain-validate.js";
 import { buildUnpricedCeilingNotice, loadConfig, logConfigDiagnostics, parseNumOrFailNonNegative } from "./config.js";
-import { clearHostedEvidenceEnv } from "./hosted-posture.js";
 import { buildStoreOpenRefusalTail } from "./plugins/store-open-refusal.js";
 import { acquireLocalBackendWithWait } from "./plugins/store-lock-wait.js";
 import { createConfigProvider } from "./config-provider.js";
@@ -176,7 +175,6 @@ export async function runLocal(argv, deps = {}) {
         process.env.CONFIG_PROVIDER = "local";
     process.env.SESSION_BACKEND = "memory";
     process.env.REQUIRE_PRINCIPAL = "false";
-    clearHostedEvidenceEnv();
     const root = args.root ?? process.env.CONFIG_LOCAL_DIR ?? process.env.AGENT_DATA_DIR ?? join(homedir(), ".ai-agent");
     if (args.root)
         process.env.CONFIG_LOCAL_DIR = args.root;

package/dist/runtime-caps-resolver.d.ts

@@ -54,6 +54,11 @@
  * `allowObservers` 是 `=== true` opt-in，缺席已等于关；`allowMemoryOptOut` 是隐私轴的 FAULT-TRANSIT 契约
  * （core types.d.ts 逐字禁止在 fault 上自造一个显式值）—— 铸 false 就是把故障臂默默换成判决臂。
  *
+ * 🔐 [ref] E-15(7.99.0 合并复审 F2):缓存、在飞去重与 ETag 都在**凭证身份的箱**里(`center-credential.ts`
+ * `createIdentityBins`,org 记忆目录同一只)——此前只按 principal 键,同机换账号后 TTL 内同一 principal 吃上一个
+ * 人的授予、搭上一个人的在飞请求、带上一个人的 etag 去换 304。在飞期间换了人,答复由传输层丢弃
+ * (`http-client.ts` `requestPrincipalView`),按这一次取数失败走下面的 fail-closed 臂(降级项落在发起那一箱)。
+ *
  * The resolver maps center's `EntitlementRuntimeCaps` → the SUBSET core enforces ({@link RuntimeCaps}): center
  * also carries `allowUltracode` (a shell/UX reasoning-tier cap the engine has no primitive for), which we DROP —
  * this seam feeds the ENGINE, and `allowUltracode` is enforced at the service settings-resolution layer, not here.
@@ -61,14 +66,15 @@
 import type { RuntimeCaps } from "@sema-agent/core";
 import type { EntitlementRuntimeCaps } from "@sema-agent/settings-schema";
 import { fetchPrincipalCaps, type ExecutionRuling } from "./config-center/facade.js";
+import type { CenterEndpoint } from "./config-center/center-request.js";
 import type { ScenarioRuling } from "./capabilities/scenarios.js";
 import type { ServiceConfig } from "./config-types.js";
 import { type Logger } from "./observability/logger.js";
 /** test-only: reset the once-per-process trace so each test observes a fresh "first hit". */
 export declare function resetExecutionLaneDefaultTraceForTest(): void;
 export interface EntitlementsResolverOpts {
-    baseUrl: string;
-    token: string;
+    /** S-651:中心端点(基址 + 凭证**来源**;每次抓取取一次值,不持有启动快照)。 */
+    center: CenterEndpoint;
     /** This worker's name (`SEMA_REGISTRY_WORKER`), passed as `?worker=` so a worker-scoped `wpt_<self>` token can
      *  resolve its OWN worker's principal caps (caps-only); harmless on a full token (the caps value
      *  is worker-independent). Omitted ⇒ no `?worker=` (a full-token, non-fleet deployment). */
@@ -136,12 +142,6 @@ export declare function toCoreRuntimeCaps(ent: EntitlementRuntimeCaps | null | u
  * 所以本谓词为 false **不再**意味着 auto 不武装;「会不会武装」由 `auto-mode-face.ts` 的三项合取答。
  */
 export declare function centerEntitlementSourceWired(config: Pick<ServiceConfig, "configCenter">): boolean;
-/** A MISCONFIG diagnostic (review MEDIUM): a worker-scoped `wpt_<self>` pull token REQUIRES `?worker=<self>` to
- *  resolve per-principal caps — so a `wpt_` token with NO `SEMA_REGISTRY_WORKER` set will 403
- *  on every caps fetch → fail-closed DENY ALL workflows for ALL principals (correct degrade, but otherwise silent
- *  bar per-task warns). True ⇒ the caller should log a one-shot BOOT warning so the misconfig is diagnosable.
- *  (The orchestrator normally injects SEMA_REGISTRY_WORKER alongside a wpt_ token, so this is a hand-misconfig.) */
-export declare function scopedTokenNeedsWorker(token: string, worker: string | undefined): boolean;
 /** The two per-principal faces served off ONE caps fetch + cache. */
 export interface PrincipalEntitlementsClient {
     /** core's `RunnerDeps.runtimeCapsResolver` seam — FAIL-CLOSED on error (deny workflows/fork/autoMode;

package/dist/runtime-caps-resolver.js

@@ -1,4 +1,5 @@
 import { fetchPrincipalCaps } from "./config-center/facade.js";
+import { createIdentityBins } from "./center-credential.js";
 import { HttpError } from "./security.js";
 import { createLogger } from "./observability/logger.js";
 import { recordFailOpen } from "./observability/fail-open.js";
@@ -54,9 +55,6 @@ export function toCoreRuntimeCaps(ent) {
 export function centerEntitlementSourceWired(config) {
     return config.configCenter !== undefined && !config.configCenter.dryRun;
 }
-export function scopedTokenNeedsWorker(token, worker) {
-    return token.startsWith("wpt_") && !worker;
-}
 export function gateExecutionLane(ruling, ownLane, logger = defaultLogger) {
     if (!ruling) {
         traceExecutionLaneDefault("no_ruling", ownLane, logger);
@@ -80,11 +78,14 @@ export function createPrincipalEntitlementsClient(opts) {
     const fetchCaps = opts.fetchCaps ?? fetchPrincipalCaps;
     const now = opts.now ?? (() => Date.now());
     const onError = opts.onError ?? ((err, principal) => defaultLogger.warn("runtime_caps_resolve_failed", { principal, err: String(err) }));
-    const cache = new Map();
-    const inflight = new Map();
+    const binNow = createIdentityBins(opts.center.credential, (credential) => ({
+        center: { baseUrl: opts.center.baseUrl, credential },
+        cache: new Map(),
+        inflight: new Map(),
+    }));
     const readMintedDeny = new WeakSet();
     const MAX_CACHE = 10_000;
-    const putCache = (key, entry) => {
+    const putCache = (cache, key, entry) => {
         if (cache.size >= MAX_CACHE) {
             const t = now();
             for (const [k, v] of cache)
@@ -100,15 +101,16 @@ export function createPrincipalEntitlementsClient(opts) {
         return entry;
     }
     async function loadRaw(principal, recordDeny) {
-        const cached = cache.get(principal);
+        const bin = binNow();
+        const cached = bin.cache.get(principal);
         if (cached && cached.expiresAt > now() && !(recordDeny && readMintedDeny.has(cached)))
             return cached;
-        const dup = inflight.get(principal);
+        const dup = bin.inflight.get(principal);
         if (dup)
             return dup;
         const p = (async () => {
             try {
-                const r = await fetchCaps(opts.baseUrl, opts.token, principal, cached?.etag, fetchImpl, opts.worker);
+                const r = await fetchCaps(bin.center, principal, cached?.etag, fetchImpl, opts.worker);
                 if (r === null) {
                     const entry = {
                         caps: cached?.caps,
@@ -117,7 +119,7 @@ export function createPrincipalEntitlementsClient(opts) {
                         ...(cached?.etag ? { etag: cached.etag } : {}),
                         expiresAt: now() + ttlMs,
                     };
-                    putCache(principal, entry);
+                    putCache(bin.cache, principal, entry);
                     return entry;
                 }
                 if (r.executionDrift) {
@@ -133,7 +135,7 @@ export function createPrincipalEntitlementsClient(opts) {
                     ...(r.etag ? { etag: r.etag } : {}),
                     expiresAt: now() + ttlMs,
                 };
-                putCache(principal, entry);
+                putCache(bin.cache, principal, entry);
                 return entry;
             }
             catch (err) {
@@ -147,7 +149,7 @@ export function createPrincipalEntitlementsClient(opts) {
                 const entry = { caps: { allowWorkflows: false, allowFork: false, autoMode: false, autoModeDenySource: "org" }, expiresAt: now() + denyTtlMs };
                 if (!recordDeny)
                     readMintedDeny.add(entry);
-                putCache(principal, entry);
+                putCache(bin.cache, principal, entry);
                 try {
                     onError(e, principal);
                 }
@@ -155,10 +157,10 @@ export function createPrincipalEntitlementsClient(opts) {
                 return entry;
             }
             finally {
-                inflight.delete(principal);
+                bin.inflight.delete(principal);
             }
         })();
-        inflight.set(principal, p);
+        bin.inflight.set(principal, p);
         return p;
     }
     return {