@sema-agent/settings-schema 1.3.0 → 1.4.0

package/dist/types.d.ts

@@ -1929,6 +1929,21 @@ export declare const EntitlementRuntimeCaps: z.ZodObject<{
      *  classifier leg itself. */
     autoMode: z.ZodOptional<z.ZodBoolean>;
     allowUltracode: z.ZodOptional<z.ZodBoolean>;
+    /** Per-principal governance of the session memory-capture OPT-OUT — the consumer's `RuntimeCaps.allowMemoryOptOut`
+     *  (design/383 §3.1): may this principal declare `memory.capture: "off"` for a run? `false` = the deployment
+     *  REQUIRES capture for this principal (compliance / knowledge retention) — the declaration is refused, terminal
+     *  (`memory.capture_optout_denied`). `true` = explicitly no per-principal restriction. Three-state, ABSENT ≠ false:
+     *  ABSENT = center says nothing → key NOT emitted on the wire (never coined into a verdict). The consumer's
+     *  fault-transit contract for THIS member runs opposite to the `{allowWorkflows:false}` degrade habit: a resolver
+     *  FAULT must surface as ABSENT (or a throw), never as a stand-in `false` — on the privacy axis "deny" is the
+     *  IRREVERSIBLE side (capturing a session the user said not to capture), so the default/`open` posture reads a
+     *  fault as "opt-out honoured + named disclosure", and a `governed` posture reads it as "verdict missing ⇒
+     *  refuse the run". The consumer composes this key from its own local grant store FIRST and the center value
+     *  second. Compose polarity across bundles is the allow* family's: `false` (capture required) wins — see
+     *  RUNTIME_CAP_STRICT; the consumer's posture arms are orthogonal to that merge. Consumer-side: the center value
+     *  reaches the engine caps only once the consumer's cap mapping picks this member up; until then its local grant
+     *  store is the sole verdict source (the key parses and is carried on the wire from this version on). */
+    allowMemoryOptOut: z.ZodOptional<z.ZodBoolean>;
     /** Force this principal's run onto durable-approval (per-tool gate) — center's fleet-wide handle for CC-faithful
      *  per-tool interception (K-3, core confirmed it consumes this). Polarity is INVERTED vs the allow* caps:
      *  here `true` is the STRICT/tightening value (forcing the gate ON), so it wins on compose — see RUNTIME_CAP_STRICT.
@@ -1942,6 +1957,7 @@ export declare const EntitlementRuntimeCaps: z.ZodObject<{
     allowObservers?: boolean | undefined;
     autoMode?: boolean | undefined;
     allowUltracode?: boolean | undefined;
+    allowMemoryOptOut?: boolean | undefined;
     forceDurableGate?: boolean | undefined;
 }, {
     allowBypassPermissions?: boolean | undefined;
@@ -1951,6 +1967,7 @@ export declare const EntitlementRuntimeCaps: z.ZodObject<{
     allowObservers?: boolean | undefined;
     autoMode?: boolean | undefined;
     allowUltracode?: boolean | undefined;
+    allowMemoryOptOut?: boolean | undefined;
     forceDurableGate?: boolean | undefined;
 }>;
 export type EntitlementRuntimeCaps = z.infer<typeof EntitlementRuntimeCaps>;
@@ -2070,6 +2087,21 @@ export declare const EntitlementTier: z.ZodObject<{
          *  classifier leg itself. */
         autoMode: z.ZodOptional<z.ZodBoolean>;
         allowUltracode: z.ZodOptional<z.ZodBoolean>;
+        /** Per-principal governance of the session memory-capture OPT-OUT — the consumer's `RuntimeCaps.allowMemoryOptOut`
+         *  (design/383 §3.1): may this principal declare `memory.capture: "off"` for a run? `false` = the deployment
+         *  REQUIRES capture for this principal (compliance / knowledge retention) — the declaration is refused, terminal
+         *  (`memory.capture_optout_denied`). `true` = explicitly no per-principal restriction. Three-state, ABSENT ≠ false:
+         *  ABSENT = center says nothing → key NOT emitted on the wire (never coined into a verdict). The consumer's
+         *  fault-transit contract for THIS member runs opposite to the `{allowWorkflows:false}` degrade habit: a resolver
+         *  FAULT must surface as ABSENT (or a throw), never as a stand-in `false` — on the privacy axis "deny" is the
+         *  IRREVERSIBLE side (capturing a session the user said not to capture), so the default/`open` posture reads a
+         *  fault as "opt-out honoured + named disclosure", and a `governed` posture reads it as "verdict missing ⇒
+         *  refuse the run". The consumer composes this key from its own local grant store FIRST and the center value
+         *  second. Compose polarity across bundles is the allow* family's: `false` (capture required) wins — see
+         *  RUNTIME_CAP_STRICT; the consumer's posture arms are orthogonal to that merge. Consumer-side: the center value
+         *  reaches the engine caps only once the consumer's cap mapping picks this member up; until then its local grant
+         *  store is the sole verdict source (the key parses and is carried on the wire from this version on). */
+        allowMemoryOptOut: z.ZodOptional<z.ZodBoolean>;
         /** Force this principal's run onto durable-approval (per-tool gate) — center's fleet-wide handle for CC-faithful
          *  per-tool interception (K-3, core confirmed it consumes this). Polarity is INVERTED vs the allow* caps:
          *  here `true` is the STRICT/tightening value (forcing the gate ON), so it wins on compose — see RUNTIME_CAP_STRICT.
@@ -2083,6 +2115,7 @@ export declare const EntitlementTier: z.ZodObject<{
         allowObservers?: boolean | undefined;
         autoMode?: boolean | undefined;
         allowUltracode?: boolean | undefined;
+        allowMemoryOptOut?: boolean | undefined;
         forceDurableGate?: boolean | undefined;
     }, {
         allowBypassPermissions?: boolean | undefined;
@@ -2092,6 +2125,7 @@ export declare const EntitlementTier: z.ZodObject<{
         allowObservers?: boolean | undefined;
         autoMode?: boolean | undefined;
         allowUltracode?: boolean | undefined;
+        allowMemoryOptOut?: boolean | undefined;
         forceDurableGate?: boolean | undefined;
     }>>;
     /** design/170 件A(additive 0.15.0):org 记忆授权束——`org:` scope 键 → 授予(`write` 缺席=只读)。
@@ -2139,6 +2173,7 @@ export declare const EntitlementTier: z.ZodObject<{
         allowObservers?: boolean | undefined;
         autoMode?: boolean | undefined;
         allowUltracode?: boolean | undefined;
+        allowMemoryOptOut?: boolean | undefined;
         forceDurableGate?: boolean | undefined;
     } | undefined;
     orgMemory?: Record<string, {
@@ -2176,6 +2211,7 @@ export declare const EntitlementTier: z.ZodObject<{
         allowObservers?: boolean | undefined;
         autoMode?: boolean | undefined;
         allowUltracode?: boolean | undefined;
+        allowMemoryOptOut?: boolean | undefined;
         forceDurableGate?: boolean | undefined;
     } | undefined;
     orgMemory?: Record<string, {
@@ -2413,6 +2449,21 @@ export declare const EntitlementConfig: z.ZodEffects<z.ZodObject<{
              *  classifier leg itself. */
             autoMode: z.ZodOptional<z.ZodBoolean>;
             allowUltracode: z.ZodOptional<z.ZodBoolean>;
+            /** Per-principal governance of the session memory-capture OPT-OUT — the consumer's `RuntimeCaps.allowMemoryOptOut`
+             *  (design/383 §3.1): may this principal declare `memory.capture: "off"` for a run? `false` = the deployment
+             *  REQUIRES capture for this principal (compliance / knowledge retention) — the declaration is refused, terminal
+             *  (`memory.capture_optout_denied`). `true` = explicitly no per-principal restriction. Three-state, ABSENT ≠ false:
+             *  ABSENT = center says nothing → key NOT emitted on the wire (never coined into a verdict). The consumer's
+             *  fault-transit contract for THIS member runs opposite to the `{allowWorkflows:false}` degrade habit: a resolver
+             *  FAULT must surface as ABSENT (or a throw), never as a stand-in `false` — on the privacy axis "deny" is the
+             *  IRREVERSIBLE side (capturing a session the user said not to capture), so the default/`open` posture reads a
+             *  fault as "opt-out honoured + named disclosure", and a `governed` posture reads it as "verdict missing ⇒
+             *  refuse the run". The consumer composes this key from its own local grant store FIRST and the center value
+             *  second. Compose polarity across bundles is the allow* family's: `false` (capture required) wins — see
+             *  RUNTIME_CAP_STRICT; the consumer's posture arms are orthogonal to that merge. Consumer-side: the center value
+             *  reaches the engine caps only once the consumer's cap mapping picks this member up; until then its local grant
+             *  store is the sole verdict source (the key parses and is carried on the wire from this version on). */
+            allowMemoryOptOut: z.ZodOptional<z.ZodBoolean>;
             /** Force this principal's run onto durable-approval (per-tool gate) — center's fleet-wide handle for CC-faithful
              *  per-tool interception (K-3, core confirmed it consumes this). Polarity is INVERTED vs the allow* caps:
              *  here `true` is the STRICT/tightening value (forcing the gate ON), so it wins on compose — see RUNTIME_CAP_STRICT.
@@ -2426,6 +2477,7 @@ export declare const EntitlementConfig: z.ZodEffects<z.ZodObject<{
             allowObservers?: boolean | undefined;
             autoMode?: boolean | undefined;
             allowUltracode?: boolean | undefined;
+            allowMemoryOptOut?: boolean | undefined;
             forceDurableGate?: boolean | undefined;
         }, {
             allowBypassPermissions?: boolean | undefined;
@@ -2435,6 +2487,7 @@ export declare const EntitlementConfig: z.ZodEffects<z.ZodObject<{
             allowObservers?: boolean | undefined;
             autoMode?: boolean | undefined;
             allowUltracode?: boolean | undefined;
+            allowMemoryOptOut?: boolean | undefined;
             forceDurableGate?: boolean | undefined;
         }>>;
         budget: z.ZodOptional<z.ZodObject<{
@@ -2535,6 +2588,7 @@ export declare const EntitlementConfig: z.ZodEffects<z.ZodObject<{
             allowObservers?: boolean | undefined;
             autoMode?: boolean | undefined;
             allowUltracode?: boolean | undefined;
+            allowMemoryOptOut?: boolean | undefined;
             forceDurableGate?: boolean | undefined;
         } | undefined;
         tokenQuota?: {
@@ -2566,6 +2620,7 @@ export declare const EntitlementConfig: z.ZodEffects<z.ZodObject<{
             allowObservers?: boolean | undefined;
             autoMode?: boolean | undefined;
             allowUltracode?: boolean | undefined;
+            allowMemoryOptOut?: boolean | undefined;
             forceDurableGate?: boolean | undefined;
         } | undefined;
         tokenQuota?: {
@@ -2682,6 +2737,21 @@ export declare const EntitlementConfig: z.ZodEffects<z.ZodObject<{
              *  classifier leg itself. */
             autoMode: z.ZodOptional<z.ZodBoolean>;
             allowUltracode: z.ZodOptional<z.ZodBoolean>;
+            /** Per-principal governance of the session memory-capture OPT-OUT — the consumer's `RuntimeCaps.allowMemoryOptOut`
+             *  (design/383 §3.1): may this principal declare `memory.capture: "off"` for a run? `false` = the deployment
+             *  REQUIRES capture for this principal (compliance / knowledge retention) — the declaration is refused, terminal
+             *  (`memory.capture_optout_denied`). `true` = explicitly no per-principal restriction. Three-state, ABSENT ≠ false:
+             *  ABSENT = center says nothing → key NOT emitted on the wire (never coined into a verdict). The consumer's
+             *  fault-transit contract for THIS member runs opposite to the `{allowWorkflows:false}` degrade habit: a resolver
+             *  FAULT must surface as ABSENT (or a throw), never as a stand-in `false` — on the privacy axis "deny" is the
+             *  IRREVERSIBLE side (capturing a session the user said not to capture), so the default/`open` posture reads a
+             *  fault as "opt-out honoured + named disclosure", and a `governed` posture reads it as "verdict missing ⇒
+             *  refuse the run". The consumer composes this key from its own local grant store FIRST and the center value
+             *  second. Compose polarity across bundles is the allow* family's: `false` (capture required) wins — see
+             *  RUNTIME_CAP_STRICT; the consumer's posture arms are orthogonal to that merge. Consumer-side: the center value
+             *  reaches the engine caps only once the consumer's cap mapping picks this member up; until then its local grant
+             *  store is the sole verdict source (the key parses and is carried on the wire from this version on). */
+            allowMemoryOptOut: z.ZodOptional<z.ZodBoolean>;
             /** Force this principal's run onto durable-approval (per-tool gate) — center's fleet-wide handle for CC-faithful
              *  per-tool interception (K-3, core confirmed it consumes this). Polarity is INVERTED vs the allow* caps:
              *  here `true` is the STRICT/tightening value (forcing the gate ON), so it wins on compose — see RUNTIME_CAP_STRICT.
@@ -2695,6 +2765,7 @@ export declare const EntitlementConfig: z.ZodEffects<z.ZodObject<{
             allowObservers?: boolean | undefined;
             autoMode?: boolean | undefined;
             allowUltracode?: boolean | undefined;
+            allowMemoryOptOut?: boolean | undefined;
             forceDurableGate?: boolean | undefined;
         }, {
             allowBypassPermissions?: boolean | undefined;
@@ -2704,6 +2775,7 @@ export declare const EntitlementConfig: z.ZodEffects<z.ZodObject<{
             allowObservers?: boolean | undefined;
             autoMode?: boolean | undefined;
             allowUltracode?: boolean | undefined;
+            allowMemoryOptOut?: boolean | undefined;
             forceDurableGate?: boolean | undefined;
         }>>;
         /** design/170 件A(additive 0.15.0):org 记忆授权束——`org:` scope 键 → 授予(`write` 缺席=只读)。
@@ -2751,6 +2823,7 @@ export declare const EntitlementConfig: z.ZodEffects<z.ZodObject<{
             allowObservers?: boolean | undefined;
             autoMode?: boolean | undefined;
             allowUltracode?: boolean | undefined;
+            allowMemoryOptOut?: boolean | undefined;
             forceDurableGate?: boolean | undefined;
         } | undefined;
         orgMemory?: Record<string, {
@@ -2788,6 +2861,7 @@ export declare const EntitlementConfig: z.ZodEffects<z.ZodObject<{
             allowObservers?: boolean | undefined;
             autoMode?: boolean | undefined;
             allowUltracode?: boolean | undefined;
+            allowMemoryOptOut?: boolean | undefined;
             forceDurableGate?: boolean | undefined;
         } | undefined;
         orgMemory?: Record<string, {
@@ -3089,6 +3163,7 @@ export declare const EntitlementConfig: z.ZodEffects<z.ZodObject<{
             allowObservers?: boolean | undefined;
             autoMode?: boolean | undefined;
             allowUltracode?: boolean | undefined;
+            allowMemoryOptOut?: boolean | undefined;
             forceDurableGate?: boolean | undefined;
         } | undefined;
         orgMemory?: Record<string, {
@@ -3165,6 +3240,7 @@ export declare const EntitlementConfig: z.ZodEffects<z.ZodObject<{
             allowObservers?: boolean | undefined;
             autoMode?: boolean | undefined;
             allowUltracode?: boolean | undefined;
+            allowMemoryOptOut?: boolean | undefined;
             forceDurableGate?: boolean | undefined;
         } | undefined;
         tokenQuota?: {
@@ -3215,6 +3291,7 @@ export declare const EntitlementConfig: z.ZodEffects<z.ZodObject<{
             allowObservers?: boolean | undefined;
             autoMode?: boolean | undefined;
             allowUltracode?: boolean | undefined;
+            allowMemoryOptOut?: boolean | undefined;
             forceDurableGate?: boolean | undefined;
         } | undefined;
         orgMemory?: Record<string, {
@@ -3247,6 +3324,7 @@ export declare const EntitlementConfig: z.ZodEffects<z.ZodObject<{
             allowObservers?: boolean | undefined;
             autoMode?: boolean | undefined;
             allowUltracode?: boolean | undefined;
+            allowMemoryOptOut?: boolean | undefined;
             forceDurableGate?: boolean | undefined;
         } | undefined;
         tokenQuota?: {
@@ -3341,6 +3419,7 @@ export declare const EntitlementConfig: z.ZodEffects<z.ZodObject<{
             allowObservers?: boolean | undefined;
             autoMode?: boolean | undefined;
             allowUltracode?: boolean | undefined;
+            allowMemoryOptOut?: boolean | undefined;
             forceDurableGate?: boolean | undefined;
         } | undefined;
         orgMemory?: Record<string, {
@@ -3417,6 +3496,7 @@ export declare const EntitlementConfig: z.ZodEffects<z.ZodObject<{
             allowObservers?: boolean | undefined;
             autoMode?: boolean | undefined;
             allowUltracode?: boolean | undefined;
+            allowMemoryOptOut?: boolean | undefined;
             forceDurableGate?: boolean | undefined;
         } | undefined;
         tokenQuota?: {
@@ -3467,6 +3547,7 @@ export declare const EntitlementConfig: z.ZodEffects<z.ZodObject<{
             allowObservers?: boolean | undefined;
             autoMode?: boolean | undefined;
             allowUltracode?: boolean | undefined;
+            allowMemoryOptOut?: boolean | undefined;
             forceDurableGate?: boolean | undefined;
         } | undefined;
         orgMemory?: Record<string, {
@@ -3499,6 +3580,7 @@ export declare const EntitlementConfig: z.ZodEffects<z.ZodObject<{
             allowObservers?: boolean | undefined;
             autoMode?: boolean | undefined;
             allowUltracode?: boolean | undefined;
+            allowMemoryOptOut?: boolean | undefined;
             forceDurableGate?: boolean | undefined;
         } | undefined;
         tokenQuota?: {
@@ -3589,7 +3671,7 @@ export declare const PrincipalOrgMemoryWire: z.ZodObject<{
     }>;
 }>;
 export type PrincipalOrgMemoryWire = z.infer<typeof PrincipalOrgMemoryWire>;
-/** `?principal=` caps wire **整体**的读边界 schema(center 铸、server 消费同源锚;clay 令 2026-08-05:
+/** `?principal=` caps wire **整体**的读边界 schema(center 铸、server 消费同源锚;产品令 2026-08-05:
  *  网络边界读入必 schema,禁裸 as-cast)。**逐面容错极性是裁定过的语义**,严格化会翻转极性的面在此
  *  显式保持宽读(每面注明所依裁定),不许硬转严:
  *  - `runtimeCaps`/`budget`(治理面,fail-closed):严格校验已知键 + **passthrough 未知键**——新 center
@@ -3647,6 +3729,21 @@ export declare const PrincipalCapsWire: z.ZodObject<{
          *  classifier leg itself. */
         autoMode: z.ZodOptional<z.ZodBoolean>;
         allowUltracode: z.ZodOptional<z.ZodBoolean>;
+        /** Per-principal governance of the session memory-capture OPT-OUT — the consumer's `RuntimeCaps.allowMemoryOptOut`
+         *  (design/383 §3.1): may this principal declare `memory.capture: "off"` for a run? `false` = the deployment
+         *  REQUIRES capture for this principal (compliance / knowledge retention) — the declaration is refused, terminal
+         *  (`memory.capture_optout_denied`). `true` = explicitly no per-principal restriction. Three-state, ABSENT ≠ false:
+         *  ABSENT = center says nothing → key NOT emitted on the wire (never coined into a verdict). The consumer's
+         *  fault-transit contract for THIS member runs opposite to the `{allowWorkflows:false}` degrade habit: a resolver
+         *  FAULT must surface as ABSENT (or a throw), never as a stand-in `false` — on the privacy axis "deny" is the
+         *  IRREVERSIBLE side (capturing a session the user said not to capture), so the default/`open` posture reads a
+         *  fault as "opt-out honoured + named disclosure", and a `governed` posture reads it as "verdict missing ⇒
+         *  refuse the run". The consumer composes this key from its own local grant store FIRST and the center value
+         *  second. Compose polarity across bundles is the allow* family's: `false` (capture required) wins — see
+         *  RUNTIME_CAP_STRICT; the consumer's posture arms are orthogonal to that merge. Consumer-side: the center value
+         *  reaches the engine caps only once the consumer's cap mapping picks this member up; until then its local grant
+         *  store is the sole verdict source (the key parses and is carried on the wire from this version on). */
+        allowMemoryOptOut: z.ZodOptional<z.ZodBoolean>;
         /** Force this principal's run onto durable-approval (per-tool gate) — center's fleet-wide handle for CC-faithful
          *  per-tool interception (K-3, core confirmed it consumes this). Polarity is INVERTED vs the allow* caps:
          *  here `true` is the STRICT/tightening value (forcing the gate ON), so it wins on compose — see RUNTIME_CAP_STRICT.
@@ -3692,6 +3789,21 @@ export declare const PrincipalCapsWire: z.ZodObject<{
          *  classifier leg itself. */
         autoMode: z.ZodOptional<z.ZodBoolean>;
         allowUltracode: z.ZodOptional<z.ZodBoolean>;
+        /** Per-principal governance of the session memory-capture OPT-OUT — the consumer's `RuntimeCaps.allowMemoryOptOut`
+         *  (design/383 §3.1): may this principal declare `memory.capture: "off"` for a run? `false` = the deployment
+         *  REQUIRES capture for this principal (compliance / knowledge retention) — the declaration is refused, terminal
+         *  (`memory.capture_optout_denied`). `true` = explicitly no per-principal restriction. Three-state, ABSENT ≠ false:
+         *  ABSENT = center says nothing → key NOT emitted on the wire (never coined into a verdict). The consumer's
+         *  fault-transit contract for THIS member runs opposite to the `{allowWorkflows:false}` degrade habit: a resolver
+         *  FAULT must surface as ABSENT (or a throw), never as a stand-in `false` — on the privacy axis "deny" is the
+         *  IRREVERSIBLE side (capturing a session the user said not to capture), so the default/`open` posture reads a
+         *  fault as "opt-out honoured + named disclosure", and a `governed` posture reads it as "verdict missing ⇒
+         *  refuse the run". The consumer composes this key from its own local grant store FIRST and the center value
+         *  second. Compose polarity across bundles is the allow* family's: `false` (capture required) wins — see
+         *  RUNTIME_CAP_STRICT; the consumer's posture arms are orthogonal to that merge. Consumer-side: the center value
+         *  reaches the engine caps only once the consumer's cap mapping picks this member up; until then its local grant
+         *  store is the sole verdict source (the key parses and is carried on the wire from this version on). */
+        allowMemoryOptOut: z.ZodOptional<z.ZodBoolean>;
         /** Force this principal's run onto durable-approval (per-tool gate) — center's fleet-wide handle for CC-faithful
          *  per-tool interception (K-3, core confirmed it consumes this). Polarity is INVERTED vs the allow* caps:
          *  here `true` is the STRICT/tightening value (forcing the gate ON), so it wins on compose — see RUNTIME_CAP_STRICT.
@@ -3737,6 +3849,21 @@ export declare const PrincipalCapsWire: z.ZodObject<{
          *  classifier leg itself. */
         autoMode: z.ZodOptional<z.ZodBoolean>;
         allowUltracode: z.ZodOptional<z.ZodBoolean>;
+        /** Per-principal governance of the session memory-capture OPT-OUT — the consumer's `RuntimeCaps.allowMemoryOptOut`
+         *  (design/383 §3.1): may this principal declare `memory.capture: "off"` for a run? `false` = the deployment
+         *  REQUIRES capture for this principal (compliance / knowledge retention) — the declaration is refused, terminal
+         *  (`memory.capture_optout_denied`). `true` = explicitly no per-principal restriction. Three-state, ABSENT ≠ false:
+         *  ABSENT = center says nothing → key NOT emitted on the wire (never coined into a verdict). The consumer's
+         *  fault-transit contract for THIS member runs opposite to the `{allowWorkflows:false}` degrade habit: a resolver
+         *  FAULT must surface as ABSENT (or a throw), never as a stand-in `false` — on the privacy axis "deny" is the
+         *  IRREVERSIBLE side (capturing a session the user said not to capture), so the default/`open` posture reads a
+         *  fault as "opt-out honoured + named disclosure", and a `governed` posture reads it as "verdict missing ⇒
+         *  refuse the run". The consumer composes this key from its own local grant store FIRST and the center value
+         *  second. Compose polarity across bundles is the allow* family's: `false` (capture required) wins — see
+         *  RUNTIME_CAP_STRICT; the consumer's posture arms are orthogonal to that merge. Consumer-side: the center value
+         *  reaches the engine caps only once the consumer's cap mapping picks this member up; until then its local grant
+         *  store is the sole verdict source (the key parses and is carried on the wire from this version on). */
+        allowMemoryOptOut: z.ZodOptional<z.ZodBoolean>;
         /** Force this principal's run onto durable-approval (per-tool gate) — center's fleet-wide handle for CC-faithful
          *  per-tool interception (K-3, core confirmed it consumes this). Polarity is INVERTED vs the allow* caps:
          *  here `true` is the STRICT/tightening value (forcing the gate ON), so it wins on compose — see RUNTIME_CAP_STRICT.
@@ -3879,6 +4006,21 @@ export declare const PrincipalCapsWire: z.ZodObject<{
          *  classifier leg itself. */
         autoMode: z.ZodOptional<z.ZodBoolean>;
         allowUltracode: z.ZodOptional<z.ZodBoolean>;
+        /** Per-principal governance of the session memory-capture OPT-OUT — the consumer's `RuntimeCaps.allowMemoryOptOut`
+         *  (design/383 §3.1): may this principal declare `memory.capture: "off"` for a run? `false` = the deployment
+         *  REQUIRES capture for this principal (compliance / knowledge retention) — the declaration is refused, terminal
+         *  (`memory.capture_optout_denied`). `true` = explicitly no per-principal restriction. Three-state, ABSENT ≠ false:
+         *  ABSENT = center says nothing → key NOT emitted on the wire (never coined into a verdict). The consumer's
+         *  fault-transit contract for THIS member runs opposite to the `{allowWorkflows:false}` degrade habit: a resolver
+         *  FAULT must surface as ABSENT (or a throw), never as a stand-in `false` — on the privacy axis "deny" is the
+         *  IRREVERSIBLE side (capturing a session the user said not to capture), so the default/`open` posture reads a
+         *  fault as "opt-out honoured + named disclosure", and a `governed` posture reads it as "verdict missing ⇒
+         *  refuse the run". The consumer composes this key from its own local grant store FIRST and the center value
+         *  second. Compose polarity across bundles is the allow* family's: `false` (capture required) wins — see
+         *  RUNTIME_CAP_STRICT; the consumer's posture arms are orthogonal to that merge. Consumer-side: the center value
+         *  reaches the engine caps only once the consumer's cap mapping picks this member up; until then its local grant
+         *  store is the sole verdict source (the key parses and is carried on the wire from this version on). */
+        allowMemoryOptOut: z.ZodOptional<z.ZodBoolean>;
         /** Force this principal's run onto durable-approval (per-tool gate) — center's fleet-wide handle for CC-faithful
          *  per-tool interception (K-3, core confirmed it consumes this). Polarity is INVERTED vs the allow* caps:
          *  here `true` is the STRICT/tightening value (forcing the gate ON), so it wins on compose — see RUNTIME_CAP_STRICT.
@@ -3924,6 +4066,21 @@ export declare const PrincipalCapsWire: z.ZodObject<{
          *  classifier leg itself. */
         autoMode: z.ZodOptional<z.ZodBoolean>;
         allowUltracode: z.ZodOptional<z.ZodBoolean>;
+        /** Per-principal governance of the session memory-capture OPT-OUT — the consumer's `RuntimeCaps.allowMemoryOptOut`
+         *  (design/383 §3.1): may this principal declare `memory.capture: "off"` for a run? `false` = the deployment
+         *  REQUIRES capture for this principal (compliance / knowledge retention) — the declaration is refused, terminal
+         *  (`memory.capture_optout_denied`). `true` = explicitly no per-principal restriction. Three-state, ABSENT ≠ false:
+         *  ABSENT = center says nothing → key NOT emitted on the wire (never coined into a verdict). The consumer's
+         *  fault-transit contract for THIS member runs opposite to the `{allowWorkflows:false}` degrade habit: a resolver
+         *  FAULT must surface as ABSENT (or a throw), never as a stand-in `false` — on the privacy axis "deny" is the
+         *  IRREVERSIBLE side (capturing a session the user said not to capture), so the default/`open` posture reads a
+         *  fault as "opt-out honoured + named disclosure", and a `governed` posture reads it as "verdict missing ⇒
+         *  refuse the run". The consumer composes this key from its own local grant store FIRST and the center value
+         *  second. Compose polarity across bundles is the allow* family's: `false` (capture required) wins — see
+         *  RUNTIME_CAP_STRICT; the consumer's posture arms are orthogonal to that merge. Consumer-side: the center value
+         *  reaches the engine caps only once the consumer's cap mapping picks this member up; until then its local grant
+         *  store is the sole verdict source (the key parses and is carried on the wire from this version on). */
+        allowMemoryOptOut: z.ZodOptional<z.ZodBoolean>;
         /** Force this principal's run onto durable-approval (per-tool gate) — center's fleet-wide handle for CC-faithful
          *  per-tool interception (K-3, core confirmed it consumes this). Polarity is INVERTED vs the allow* caps:
          *  here `true` is the STRICT/tightening value (forcing the gate ON), so it wins on compose — see RUNTIME_CAP_STRICT.
@@ -3969,6 +4126,21 @@ export declare const PrincipalCapsWire: z.ZodObject<{
          *  classifier leg itself. */
         autoMode: z.ZodOptional<z.ZodBoolean>;
         allowUltracode: z.ZodOptional<z.ZodBoolean>;
+        /** Per-principal governance of the session memory-capture OPT-OUT — the consumer's `RuntimeCaps.allowMemoryOptOut`
+         *  (design/383 §3.1): may this principal declare `memory.capture: "off"` for a run? `false` = the deployment
+         *  REQUIRES capture for this principal (compliance / knowledge retention) — the declaration is refused, terminal
+         *  (`memory.capture_optout_denied`). `true` = explicitly no per-principal restriction. Three-state, ABSENT ≠ false:
+         *  ABSENT = center says nothing → key NOT emitted on the wire (never coined into a verdict). The consumer's
+         *  fault-transit contract for THIS member runs opposite to the `{allowWorkflows:false}` degrade habit: a resolver
+         *  FAULT must surface as ABSENT (or a throw), never as a stand-in `false` — on the privacy axis "deny" is the
+         *  IRREVERSIBLE side (capturing a session the user said not to capture), so the default/`open` posture reads a
+         *  fault as "opt-out honoured + named disclosure", and a `governed` posture reads it as "verdict missing ⇒
+         *  refuse the run". The consumer composes this key from its own local grant store FIRST and the center value
+         *  second. Compose polarity across bundles is the allow* family's: `false` (capture required) wins — see
+         *  RUNTIME_CAP_STRICT; the consumer's posture arms are orthogonal to that merge. Consumer-side: the center value
+         *  reaches the engine caps only once the consumer's cap mapping picks this member up; until then its local grant
+         *  store is the sole verdict source (the key parses and is carried on the wire from this version on). */
+        allowMemoryOptOut: z.ZodOptional<z.ZodBoolean>;
         /** Force this principal's run onto durable-approval (per-tool gate) — center's fleet-wide handle for CC-faithful
          *  per-tool interception (K-3, core confirmed it consumes this). Polarity is INVERTED vs the allow* caps:
          *  here `true` is the STRICT/tightening value (forcing the gate ON), so it wins on compose — see RUNTIME_CAP_STRICT.
@@ -4111,6 +4283,21 @@ export declare const PrincipalCapsWire: z.ZodObject<{
          *  classifier leg itself. */
         autoMode: z.ZodOptional<z.ZodBoolean>;
         allowUltracode: z.ZodOptional<z.ZodBoolean>;
+        /** Per-principal governance of the session memory-capture OPT-OUT — the consumer's `RuntimeCaps.allowMemoryOptOut`
+         *  (design/383 §3.1): may this principal declare `memory.capture: "off"` for a run? `false` = the deployment
+         *  REQUIRES capture for this principal (compliance / knowledge retention) — the declaration is refused, terminal
+         *  (`memory.capture_optout_denied`). `true` = explicitly no per-principal restriction. Three-state, ABSENT ≠ false:
+         *  ABSENT = center says nothing → key NOT emitted on the wire (never coined into a verdict). The consumer's
+         *  fault-transit contract for THIS member runs opposite to the `{allowWorkflows:false}` degrade habit: a resolver
+         *  FAULT must surface as ABSENT (or a throw), never as a stand-in `false` — on the privacy axis "deny" is the
+         *  IRREVERSIBLE side (capturing a session the user said not to capture), so the default/`open` posture reads a
+         *  fault as "opt-out honoured + named disclosure", and a `governed` posture reads it as "verdict missing ⇒
+         *  refuse the run". The consumer composes this key from its own local grant store FIRST and the center value
+         *  second. Compose polarity across bundles is the allow* family's: `false` (capture required) wins — see
+         *  RUNTIME_CAP_STRICT; the consumer's posture arms are orthogonal to that merge. Consumer-side: the center value
+         *  reaches the engine caps only once the consumer's cap mapping picks this member up; until then its local grant
+         *  store is the sole verdict source (the key parses and is carried on the wire from this version on). */
+        allowMemoryOptOut: z.ZodOptional<z.ZodBoolean>;
         /** Force this principal's run onto durable-approval (per-tool gate) — center's fleet-wide handle for CC-faithful
          *  per-tool interception (K-3, core confirmed it consumes this). Polarity is INVERTED vs the allow* caps:
          *  here `true` is the STRICT/tightening value (forcing the gate ON), so it wins on compose — see RUNTIME_CAP_STRICT.
@@ -4156,6 +4343,21 @@ export declare const PrincipalCapsWire: z.ZodObject<{
          *  classifier leg itself. */
         autoMode: z.ZodOptional<z.ZodBoolean>;
         allowUltracode: z.ZodOptional<z.ZodBoolean>;
+        /** Per-principal governance of the session memory-capture OPT-OUT — the consumer's `RuntimeCaps.allowMemoryOptOut`
+         *  (design/383 §3.1): may this principal declare `memory.capture: "off"` for a run? `false` = the deployment
+         *  REQUIRES capture for this principal (compliance / knowledge retention) — the declaration is refused, terminal
+         *  (`memory.capture_optout_denied`). `true` = explicitly no per-principal restriction. Three-state, ABSENT ≠ false:
+         *  ABSENT = center says nothing → key NOT emitted on the wire (never coined into a verdict). The consumer's
+         *  fault-transit contract for THIS member runs opposite to the `{allowWorkflows:false}` degrade habit: a resolver
+         *  FAULT must surface as ABSENT (or a throw), never as a stand-in `false` — on the privacy axis "deny" is the
+         *  IRREVERSIBLE side (capturing a session the user said not to capture), so the default/`open` posture reads a
+         *  fault as "opt-out honoured + named disclosure", and a `governed` posture reads it as "verdict missing ⇒
+         *  refuse the run". The consumer composes this key from its own local grant store FIRST and the center value
+         *  second. Compose polarity across bundles is the allow* family's: `false` (capture required) wins — see
+         *  RUNTIME_CAP_STRICT; the consumer's posture arms are orthogonal to that merge. Consumer-side: the center value
+         *  reaches the engine caps only once the consumer's cap mapping picks this member up; until then its local grant
+         *  store is the sole verdict source (the key parses and is carried on the wire from this version on). */
+        allowMemoryOptOut: z.ZodOptional<z.ZodBoolean>;
         /** Force this principal's run onto durable-approval (per-tool gate) — center's fleet-wide handle for CC-faithful
          *  per-tool interception (K-3, core confirmed it consumes this). Polarity is INVERTED vs the allow* caps:
          *  here `true` is the STRICT/tightening value (forcing the gate ON), so it wins on compose — see RUNTIME_CAP_STRICT.
@@ -4201,6 +4403,21 @@ export declare const PrincipalCapsWire: z.ZodObject<{
          *  classifier leg itself. */
         autoMode: z.ZodOptional<z.ZodBoolean>;
         allowUltracode: z.ZodOptional<z.ZodBoolean>;
+        /** Per-principal governance of the session memory-capture OPT-OUT — the consumer's `RuntimeCaps.allowMemoryOptOut`
+         *  (design/383 §3.1): may this principal declare `memory.capture: "off"` for a run? `false` = the deployment
+         *  REQUIRES capture for this principal (compliance / knowledge retention) — the declaration is refused, terminal
+         *  (`memory.capture_optout_denied`). `true` = explicitly no per-principal restriction. Three-state, ABSENT ≠ false:
+         *  ABSENT = center says nothing → key NOT emitted on the wire (never coined into a verdict). The consumer's
+         *  fault-transit contract for THIS member runs opposite to the `{allowWorkflows:false}` degrade habit: a resolver
+         *  FAULT must surface as ABSENT (or a throw), never as a stand-in `false` — on the privacy axis "deny" is the
+         *  IRREVERSIBLE side (capturing a session the user said not to capture), so the default/`open` posture reads a
+         *  fault as "opt-out honoured + named disclosure", and a `governed` posture reads it as "verdict missing ⇒
+         *  refuse the run". The consumer composes this key from its own local grant store FIRST and the center value
+         *  second. Compose polarity across bundles is the allow* family's: `false` (capture required) wins — see
+         *  RUNTIME_CAP_STRICT; the consumer's posture arms are orthogonal to that merge. Consumer-side: the center value
+         *  reaches the engine caps only once the consumer's cap mapping picks this member up; until then its local grant
+         *  store is the sole verdict source (the key parses and is carried on the wire from this version on). */
+        allowMemoryOptOut: z.ZodOptional<z.ZodBoolean>;
         /** Force this principal's run onto durable-approval (per-tool gate) — center's fleet-wide handle for CC-faithful
          *  per-tool interception (K-3, core confirmed it consumes this). Polarity is INVERTED vs the allow* caps:
          *  here `true` is the STRICT/tightening value (forcing the gate ON), so it wins on compose — see RUNTIME_CAP_STRICT.
@@ -7023,6 +7240,15 @@ export declare const McpTransport: z.ZodDiscriminatedUnion<"kind", [z.ZodObject<
     principalHeader?: string | undefined;
 }>]>;
 export type McpTransport = z.infer<typeof McpTransport>;
+/** The closed word table for {@link McpServerSpec}.contentOrigin — a MIRROR literal of the engine's
+ *  `ToolContentOrigin`. This package deliberately carries no engine dependency axis (the same ruling that made
+ *  PROMPT_ARTIFACT_LIMITS a mirror constant), so the cross-package enforcement point is NOT here: the consumer
+ *  compile-pins its own copy against the engine type in both directions (AssertNever pair), and on picking this
+ *  package up it should add a same-source assertion against THIS table too — it is the one repo holding both
+ *  dependencies. Inside this repo the table is pinned as a literal only (a drift surfaces at the consumer's
+ *  pickup gate, never silently on the wire — an out-of-table word is rejected at parse on both sides). */
+export declare const MCP_CONTENT_ORIGINS: readonly ["local", "execution", "external"];
+export type McpContentOrigin = (typeof MCP_CONTENT_ORIGINS)[number];
 export declare const McpServerSpec: z.ZodObject<{
     name: z.ZodString;
     transport: z.ZodDiscriminatedUnion<"kind", [z.ZodObject<{
@@ -7074,6 +7300,23 @@ export declare const McpServerSpec: z.ZodObject<{
      *  OFF = fail-closed: only an opted-in server may prompt the user mid-tool-call. Service forwards this into the
      *  core spec (was read untyped as `(s as {elicitation?})` before this field — service ask). */
     elicitation: z.ZodDefault<z.ZodBoolean>;
+    /** Trust-origin declaration for EVERYTHING this server's tools return — maps 1:1 onto the engine's
+     *  `McpServerSpec.contentOrigin` (closed word table {@link MCP_CONTENT_ORIGINS}):
+     *   · `"local"`     — content the deployment itself produces (its own process / socket / service);
+     *   · `"execution"` — execution-environment output (the consumer's `execIsExternalContent` knob still applies);
+     *   · `"external"`  — third-party content, declared EXPLICITLY: a PIN, not a no-op — it cancels any by-name
+     *                      trusted-tool exemption the consumer would otherwise grant this server.
+     *  ABSENT = the engine's pre-declaration behaviour (protocol namespaces are judged external, fail-closed); the key is
+     *  `.optional()` with NO default so absence is never coined into a word. It affects memory-write governance (the
+     *  "touched foreign content" session mark) only — no gate / policy / roster effect.
+     *  🔴 A TRUST statement, not a routing hint: the class is boundary-relative and independent of transport or
+     *  address (a stdio child can be an untrusted package, a loopback URL can be your own service), so nothing here
+     *  infers it from topology. It is a DEPLOYMENT-plane key: the publication leg (`config.d/mcp.json` locally,
+     *  `/effective.mcp` remotely) is its home; the consumer applies the same word-table gate on its request plane.
+     *  Before this key existed both legs stripped the declaration (default-strip object): the operator believed they
+     *  declared `"local"`, the engine read ABSENT. A value outside the table is REJECTED at parse — a mistyped trust
+     *  word must never be read as a legal one (the consumer's gate is equally severe: no case-folding). */
+    contentOrigin: z.ZodOptional<z.ZodEnum<["local", "execution", "external"]>>;
     notes: z.ZodOptional<z.ZodString>;
 }, "strip", z.ZodTypeAny, {
     name: string;
@@ -7094,6 +7337,7 @@ export declare const McpServerSpec: z.ZodObject<{
     elicitation: boolean;
     notes?: string | undefined;
     allowTools?: string[] | undefined;
+    contentOrigin?: "local" | "execution" | "external" | undefined;
 }, {
     name: string;
     transport: {
@@ -7113,6 +7357,7 @@ export declare const McpServerSpec: z.ZodObject<{
     scenarios?: string[] | undefined;
     allowTools?: string[] | undefined;
     elicitation?: boolean | undefined;
+    contentOrigin?: "local" | "execution" | "external" | undefined;
 }>;
 export type McpServerSpec = z.infer<typeof McpServerSpec>;
 export declare const McpConfig: z.ZodEffects<z.ZodObject<{
@@ -7167,6 +7412,23 @@ export declare const McpConfig: z.ZodEffects<z.ZodObject<{
          *  OFF = fail-closed: only an opted-in server may prompt the user mid-tool-call. Service forwards this into the
          *  core spec (was read untyped as `(s as {elicitation?})` before this field — service ask). */
         elicitation: z.ZodDefault<z.ZodBoolean>;
+        /** Trust-origin declaration for EVERYTHING this server's tools return — maps 1:1 onto the engine's
+         *  `McpServerSpec.contentOrigin` (closed word table {@link MCP_CONTENT_ORIGINS}):
+         *   · `"local"`     — content the deployment itself produces (its own process / socket / service);
+         *   · `"execution"` — execution-environment output (the consumer's `execIsExternalContent` knob still applies);
+         *   · `"external"`  — third-party content, declared EXPLICITLY: a PIN, not a no-op — it cancels any by-name
+         *                      trusted-tool exemption the consumer would otherwise grant this server.
+         *  ABSENT = the engine's pre-declaration behaviour (protocol namespaces are judged external, fail-closed); the key is
+         *  `.optional()` with NO default so absence is never coined into a word. It affects memory-write governance (the
+         *  "touched foreign content" session mark) only — no gate / policy / roster effect.
+         *  🔴 A TRUST statement, not a routing hint: the class is boundary-relative and independent of transport or
+         *  address (a stdio child can be an untrusted package, a loopback URL can be your own service), so nothing here
+         *  infers it from topology. It is a DEPLOYMENT-plane key: the publication leg (`config.d/mcp.json` locally,
+         *  `/effective.mcp` remotely) is its home; the consumer applies the same word-table gate on its request plane.
+         *  Before this key existed both legs stripped the declaration (default-strip object): the operator believed they
+         *  declared `"local"`, the engine read ABSENT. A value outside the table is REJECTED at parse — a mistyped trust
+         *  word must never be read as a legal one (the consumer's gate is equally severe: no case-folding). */
+        contentOrigin: z.ZodOptional<z.ZodEnum<["local", "execution", "external"]>>;
         notes: z.ZodOptional<z.ZodString>;
     }, "strip", z.ZodTypeAny, {
         name: string;
@@ -7187,6 +7449,7 @@ export declare const McpConfig: z.ZodEffects<z.ZodObject<{
         elicitation: boolean;
         notes?: string | undefined;
         allowTools?: string[] | undefined;
+        contentOrigin?: "local" | "execution" | "external" | undefined;
     }, {
         name: string;
         transport: {
@@ -7206,6 +7469,7 @@ export declare const McpConfig: z.ZodEffects<z.ZodObject<{
         scenarios?: string[] | undefined;
         allowTools?: string[] | undefined;
         elicitation?: boolean | undefined;
+        contentOrigin?: "local" | "execution" | "external" | undefined;
     }>, "many">>;
 }, "strip", z.ZodTypeAny, {
     servers: {
@@ -7227,6 +7491,7 @@ export declare const McpConfig: z.ZodEffects<z.ZodObject<{
         elicitation: boolean;
         notes?: string | undefined;
         allowTools?: string[] | undefined;
+        contentOrigin?: "local" | "execution" | "external" | undefined;
     }[];
 }, {
     servers?: {
@@ -7248,6 +7513,7 @@ export declare const McpConfig: z.ZodEffects<z.ZodObject<{
         scenarios?: string[] | undefined;
         allowTools?: string[] | undefined;
         elicitation?: boolean | undefined;
+        contentOrigin?: "local" | "execution" | "external" | undefined;
     }[] | undefined;
 }>, {
     servers: {
@@ -7269,6 +7535,7 @@ export declare const McpConfig: z.ZodEffects<z.ZodObject<{
         elicitation: boolean;
         notes?: string | undefined;
         allowTools?: string[] | undefined;
+        contentOrigin?: "local" | "execution" | "external" | undefined;
     }[];
 }, {
     servers?: {
@@ -7290,10 +7557,11 @@ export declare const McpConfig: z.ZodEffects<z.ZodObject<{
         scenarios?: string[] | undefined;
         allowTools?: string[] | undefined;
         elicitation?: boolean | undefined;
+        contentOrigin?: "local" | "execution" | "external" | undefined;
     }[] | undefined;
 }>;
 export type McpConfig = z.infer<typeof McpConfig>;
-/** A plugin/marketplace ORIGIN string: **https only**(contract freeze board [1362] tightening-① /
+/** A plugin/marketplace ORIGIN string: **https only**(contract freeze [ref] tightening-① /
  *  [1366]①,0.10.23 单真源修:此前这条规则只落在 web UI 层的表单校验,API 直写仍放行任意形——
  *  同一条规则两处真源,API 这处敞了 8 天)。`ssh:`/`scp 形`/`git:`/`file:`/裸 `http:`/`owner/repo`
  *  shorthand 一律拒:worker 只 clone 声明里的 url,能入库的形必须是消费端能安全物化的形;国内镜像
@@ -7546,7 +7814,7 @@ export declare const PromptTextDeclaration: z.ZodObject<{
     contentHash?: string | undefined;
 }>;
 export type PromptTextDeclaration = z.infer<typeof PromptTextDeclaration>;
-/** 三维 binding(board [1050]①a:v1=global/worker/scenario,砍 model 维——per-model 微调走
+/** 三维 binding([ref]①a:v1=global/worker/scenario,砍 model 维——per-model 微调走
  *  ModelEntry.promptGuidance 专用通道)。covering 语义([1050]①b,解析只在 center 一处):
  *  同 slot **层间整体替换**(胜出层该 slot 声明数组整体替换低层同 slot 全部条目;层内数组保序,
  *  与 core assemble「declaration order preserved」无缝);层序 scenario > worker > global。
@@ -8426,7 +8694,7 @@ export declare const PromptsConfig: z.ZodObject<{
     } | undefined;
 }>;
 export type PromptsConfig = z.infer<typeof PromptsConfig>;
-/** effective 下发形(board [1057] 逐字;`GET /api/config/effective?worker=` 的 additive `prompts`
+/** effective 下发形([ref] 逐字;`GET /api/config/effective?worker=` 的 additive `prompts`
  *  key)。语义定死([1057]①):packId=`center:`+contentDigest 前 12(纯内容寻址,无 rev);
  *  contentDigest=canonical JSON 全量 sha256 非盐化(operator 对账位,digest 函数在 /node 绑定
  *  `promptsContentDigest`);sections=covering 已走完的基线终形(worker/core 零解析义务);
@@ -9794,6 +10062,23 @@ export declare const DOMAIN_SCHEMAS: {
              *  OFF = fail-closed: only an opted-in server may prompt the user mid-tool-call. Service forwards this into the
              *  core spec (was read untyped as `(s as {elicitation?})` before this field — service ask). */
             elicitation: z.ZodDefault<z.ZodBoolean>;
+            /** Trust-origin declaration for EVERYTHING this server's tools return — maps 1:1 onto the engine's
+             *  `McpServerSpec.contentOrigin` (closed word table {@link MCP_CONTENT_ORIGINS}):
+             *   · `"local"`     — content the deployment itself produces (its own process / socket / service);
+             *   · `"execution"` — execution-environment output (the consumer's `execIsExternalContent` knob still applies);
+             *   · `"external"`  — third-party content, declared EXPLICITLY: a PIN, not a no-op — it cancels any by-name
+             *                      trusted-tool exemption the consumer would otherwise grant this server.
+             *  ABSENT = the engine's pre-declaration behaviour (protocol namespaces are judged external, fail-closed); the key is
+             *  `.optional()` with NO default so absence is never coined into a word. It affects memory-write governance (the
+             *  "touched foreign content" session mark) only — no gate / policy / roster effect.
+             *  🔴 A TRUST statement, not a routing hint: the class is boundary-relative and independent of transport or
+             *  address (a stdio child can be an untrusted package, a loopback URL can be your own service), so nothing here
+             *  infers it from topology. It is a DEPLOYMENT-plane key: the publication leg (`config.d/mcp.json` locally,
+             *  `/effective.mcp` remotely) is its home; the consumer applies the same word-table gate on its request plane.
+             *  Before this key existed both legs stripped the declaration (default-strip object): the operator believed they
+             *  declared `"local"`, the engine read ABSENT. A value outside the table is REJECTED at parse — a mistyped trust
+             *  word must never be read as a legal one (the consumer's gate is equally severe: no case-folding). */
+            contentOrigin: z.ZodOptional<z.ZodEnum<["local", "execution", "external"]>>;
             notes: z.ZodOptional<z.ZodString>;
         }, "strip", z.ZodTypeAny, {
             name: string;
@@ -9814,6 +10099,7 @@ export declare const DOMAIN_SCHEMAS: {
             elicitation: boolean;
             notes?: string | undefined;
             allowTools?: string[] | undefined;
+            contentOrigin?: "local" | "execution" | "external" | undefined;
         }, {
             name: string;
             transport: {
@@ -9833,6 +10119,7 @@ export declare const DOMAIN_SCHEMAS: {
             scenarios?: string[] | undefined;
             allowTools?: string[] | undefined;
             elicitation?: boolean | undefined;
+            contentOrigin?: "local" | "execution" | "external" | undefined;
         }>, "many">>;
     }, "strip", z.ZodTypeAny, {
         servers: {
@@ -9854,6 +10141,7 @@ export declare const DOMAIN_SCHEMAS: {
             elicitation: boolean;
             notes?: string | undefined;
             allowTools?: string[] | undefined;
+            contentOrigin?: "local" | "execution" | "external" | undefined;
         }[];
     }, {
         servers?: {
@@ -9875,6 +10163,7 @@ export declare const DOMAIN_SCHEMAS: {
             scenarios?: string[] | undefined;
             allowTools?: string[] | undefined;
             elicitation?: boolean | undefined;
+            contentOrigin?: "local" | "execution" | "external" | undefined;
         }[] | undefined;
     }>, {
         servers: {
@@ -9896,6 +10185,7 @@ export declare const DOMAIN_SCHEMAS: {
             elicitation: boolean;
             notes?: string | undefined;
             allowTools?: string[] | undefined;
+            contentOrigin?: "local" | "execution" | "external" | undefined;
         }[];
     }, {
         servers?: {
@@ -9917,6 +10207,7 @@ export declare const DOMAIN_SCHEMAS: {
             scenarios?: string[] | undefined;
             allowTools?: string[] | undefined;
             elicitation?: boolean | undefined;
+            contentOrigin?: "local" | "execution" | "external" | undefined;
         }[] | undefined;
     }>;
     readonly plugins: z.ZodEffects<z.ZodObject<{
@@ -11453,6 +11744,21 @@ export declare const DOMAIN_SCHEMAS: {
                  *  classifier leg itself. */
                 autoMode: z.ZodOptional<z.ZodBoolean>;
                 allowUltracode: z.ZodOptional<z.ZodBoolean>;
+                /** Per-principal governance of the session memory-capture OPT-OUT — the consumer's `RuntimeCaps.allowMemoryOptOut`
+                 *  (design/383 §3.1): may this principal declare `memory.capture: "off"` for a run? `false` = the deployment
+                 *  REQUIRES capture for this principal (compliance / knowledge retention) — the declaration is refused, terminal
+                 *  (`memory.capture_optout_denied`). `true` = explicitly no per-principal restriction. Three-state, ABSENT ≠ false:
+                 *  ABSENT = center says nothing → key NOT emitted on the wire (never coined into a verdict). The consumer's
+                 *  fault-transit contract for THIS member runs opposite to the `{allowWorkflows:false}` degrade habit: a resolver
+                 *  FAULT must surface as ABSENT (or a throw), never as a stand-in `false` — on the privacy axis "deny" is the
+                 *  IRREVERSIBLE side (capturing a session the user said not to capture), so the default/`open` posture reads a
+                 *  fault as "opt-out honoured + named disclosure", and a `governed` posture reads it as "verdict missing ⇒
+                 *  refuse the run". The consumer composes this key from its own local grant store FIRST and the center value
+                 *  second. Compose polarity across bundles is the allow* family's: `false` (capture required) wins — see
+                 *  RUNTIME_CAP_STRICT; the consumer's posture arms are orthogonal to that merge. Consumer-side: the center value
+                 *  reaches the engine caps only once the consumer's cap mapping picks this member up; until then its local grant
+                 *  store is the sole verdict source (the key parses and is carried on the wire from this version on). */
+                allowMemoryOptOut: z.ZodOptional<z.ZodBoolean>;
                 /** Force this principal's run onto durable-approval (per-tool gate) — center's fleet-wide handle for CC-faithful
                  *  per-tool interception (K-3, core confirmed it consumes this). Polarity is INVERTED vs the allow* caps:
                  *  here `true` is the STRICT/tightening value (forcing the gate ON), so it wins on compose — see RUNTIME_CAP_STRICT.
@@ -11466,6 +11772,7 @@ export declare const DOMAIN_SCHEMAS: {
                 allowObservers?: boolean | undefined;
                 autoMode?: boolean | undefined;
                 allowUltracode?: boolean | undefined;
+                allowMemoryOptOut?: boolean | undefined;
                 forceDurableGate?: boolean | undefined;
             }, {
                 allowBypassPermissions?: boolean | undefined;
@@ -11475,6 +11782,7 @@ export declare const DOMAIN_SCHEMAS: {
                 allowObservers?: boolean | undefined;
                 autoMode?: boolean | undefined;
                 allowUltracode?: boolean | undefined;
+                allowMemoryOptOut?: boolean | undefined;
                 forceDurableGate?: boolean | undefined;
             }>>;
             budget: z.ZodOptional<z.ZodObject<{
@@ -11575,6 +11883,7 @@ export declare const DOMAIN_SCHEMAS: {
                 allowObservers?: boolean | undefined;
                 autoMode?: boolean | undefined;
                 allowUltracode?: boolean | undefined;
+                allowMemoryOptOut?: boolean | undefined;
                 forceDurableGate?: boolean | undefined;
             } | undefined;
             tokenQuota?: {
@@ -11606,6 +11915,7 @@ export declare const DOMAIN_SCHEMAS: {
                 allowObservers?: boolean | undefined;
                 autoMode?: boolean | undefined;
                 allowUltracode?: boolean | undefined;
+                allowMemoryOptOut?: boolean | undefined;
                 forceDurableGate?: boolean | undefined;
             } | undefined;
             tokenQuota?: {
@@ -11722,6 +12032,21 @@ export declare const DOMAIN_SCHEMAS: {
                  *  classifier leg itself. */
                 autoMode: z.ZodOptional<z.ZodBoolean>;
                 allowUltracode: z.ZodOptional<z.ZodBoolean>;
+                /** Per-principal governance of the session memory-capture OPT-OUT — the consumer's `RuntimeCaps.allowMemoryOptOut`
+                 *  (design/383 §3.1): may this principal declare `memory.capture: "off"` for a run? `false` = the deployment
+                 *  REQUIRES capture for this principal (compliance / knowledge retention) — the declaration is refused, terminal
+                 *  (`memory.capture_optout_denied`). `true` = explicitly no per-principal restriction. Three-state, ABSENT ≠ false:
+                 *  ABSENT = center says nothing → key NOT emitted on the wire (never coined into a verdict). The consumer's
+                 *  fault-transit contract for THIS member runs opposite to the `{allowWorkflows:false}` degrade habit: a resolver
+                 *  FAULT must surface as ABSENT (or a throw), never as a stand-in `false` — on the privacy axis "deny" is the
+                 *  IRREVERSIBLE side (capturing a session the user said not to capture), so the default/`open` posture reads a
+                 *  fault as "opt-out honoured + named disclosure", and a `governed` posture reads it as "verdict missing ⇒
+                 *  refuse the run". The consumer composes this key from its own local grant store FIRST and the center value
+                 *  second. Compose polarity across bundles is the allow* family's: `false` (capture required) wins — see
+                 *  RUNTIME_CAP_STRICT; the consumer's posture arms are orthogonal to that merge. Consumer-side: the center value
+                 *  reaches the engine caps only once the consumer's cap mapping picks this member up; until then its local grant
+                 *  store is the sole verdict source (the key parses and is carried on the wire from this version on). */
+                allowMemoryOptOut: z.ZodOptional<z.ZodBoolean>;
                 /** Force this principal's run onto durable-approval (per-tool gate) — center's fleet-wide handle for CC-faithful
                  *  per-tool interception (K-3, core confirmed it consumes this). Polarity is INVERTED vs the allow* caps:
                  *  here `true` is the STRICT/tightening value (forcing the gate ON), so it wins on compose — see RUNTIME_CAP_STRICT.
@@ -11735,6 +12060,7 @@ export declare const DOMAIN_SCHEMAS: {
                 allowObservers?: boolean | undefined;
                 autoMode?: boolean | undefined;
                 allowUltracode?: boolean | undefined;
+                allowMemoryOptOut?: boolean | undefined;
                 forceDurableGate?: boolean | undefined;
             }, {
                 allowBypassPermissions?: boolean | undefined;
@@ -11744,6 +12070,7 @@ export declare const DOMAIN_SCHEMAS: {
                 allowObservers?: boolean | undefined;
                 autoMode?: boolean | undefined;
                 allowUltracode?: boolean | undefined;
+                allowMemoryOptOut?: boolean | undefined;
                 forceDurableGate?: boolean | undefined;
             }>>;
             /** design/170 件A(additive 0.15.0):org 记忆授权束——`org:` scope 键 → 授予(`write` 缺席=只读)。
@@ -11791,6 +12118,7 @@ export declare const DOMAIN_SCHEMAS: {
                 allowObservers?: boolean | undefined;
                 autoMode?: boolean | undefined;
                 allowUltracode?: boolean | undefined;
+                allowMemoryOptOut?: boolean | undefined;
                 forceDurableGate?: boolean | undefined;
             } | undefined;
             orgMemory?: Record<string, {
@@ -11828,6 +12156,7 @@ export declare const DOMAIN_SCHEMAS: {
                 allowObservers?: boolean | undefined;
                 autoMode?: boolean | undefined;
                 allowUltracode?: boolean | undefined;
+                allowMemoryOptOut?: boolean | undefined;
                 forceDurableGate?: boolean | undefined;
             } | undefined;
             orgMemory?: Record<string, {
@@ -12129,6 +12458,7 @@ export declare const DOMAIN_SCHEMAS: {
                 allowObservers?: boolean | undefined;
                 autoMode?: boolean | undefined;
                 allowUltracode?: boolean | undefined;
+                allowMemoryOptOut?: boolean | undefined;
                 forceDurableGate?: boolean | undefined;
             } | undefined;
             orgMemory?: Record<string, {
@@ -12205,6 +12535,7 @@ export declare const DOMAIN_SCHEMAS: {
                 allowObservers?: boolean | undefined;
                 autoMode?: boolean | undefined;
                 allowUltracode?: boolean | undefined;
+                allowMemoryOptOut?: boolean | undefined;
                 forceDurableGate?: boolean | undefined;
             } | undefined;
             tokenQuota?: {
@@ -12255,6 +12586,7 @@ export declare const DOMAIN_SCHEMAS: {
                 allowObservers?: boolean | undefined;
                 autoMode?: boolean | undefined;
                 allowUltracode?: boolean | undefined;
+                allowMemoryOptOut?: boolean | undefined;
                 forceDurableGate?: boolean | undefined;
             } | undefined;
             orgMemory?: Record<string, {
@@ -12287,6 +12619,7 @@ export declare const DOMAIN_SCHEMAS: {
                 allowObservers?: boolean | undefined;
                 autoMode?: boolean | undefined;
                 allowUltracode?: boolean | undefined;
+                allowMemoryOptOut?: boolean | undefined;
                 forceDurableGate?: boolean | undefined;
             } | undefined;
             tokenQuota?: {
@@ -12381,6 +12714,7 @@ export declare const DOMAIN_SCHEMAS: {
                 allowObservers?: boolean | undefined;
                 autoMode?: boolean | undefined;
                 allowUltracode?: boolean | undefined;
+                allowMemoryOptOut?: boolean | undefined;
                 forceDurableGate?: boolean | undefined;
             } | undefined;
             orgMemory?: Record<string, {
@@ -12457,6 +12791,7 @@ export declare const DOMAIN_SCHEMAS: {
                 allowObservers?: boolean | undefined;
                 autoMode?: boolean | undefined;
                 allowUltracode?: boolean | undefined;
+                allowMemoryOptOut?: boolean | undefined;
                 forceDurableGate?: boolean | undefined;
             } | undefined;
             tokenQuota?: {
@@ -12507,6 +12842,7 @@ export declare const DOMAIN_SCHEMAS: {
                 allowObservers?: boolean | undefined;
                 autoMode?: boolean | undefined;
                 allowUltracode?: boolean | undefined;
+                allowMemoryOptOut?: boolean | undefined;
                 forceDurableGate?: boolean | undefined;
             } | undefined;
             orgMemory?: Record<string, {
@@ -12539,6 +12875,7 @@ export declare const DOMAIN_SCHEMAS: {
                 allowObservers?: boolean | undefined;
                 autoMode?: boolean | undefined;
                 allowUltracode?: boolean | undefined;
+                allowMemoryOptOut?: boolean | undefined;
                 forceDurableGate?: boolean | undefined;
             } | undefined;
             tokenQuota?: {
@@ -13342,7 +13679,7 @@ export interface EffectiveConfig {
     /** center prompts 战役 v1(0.10.18,[1064]②):存储真形(bindings);effective 下发的解析终形
      *  (EffectivePrompts key)由 center 另行组装,worker lane 剥 bindings 全表([1057]⑤ lane 纪律)。 */
     prompts: PromptsConfig;
-    /** cost/限流族的热更新发布位(0.19.0,sema-server #322 批1)。域缺席 ⇒ `{}`(每一键都 ABSENT =
+    /** cost/限流族的热更新发布位(0.19.0,消费方 #322 批1)。域缺席 ⇒ `{}`(每一键都 ABSENT =
      *  center 不管 ⇒ 消费方回 env 底);与 `runtime` 的五键重叠位的优先级归消费方,见域头注。 */
     limits: LimitsConfig;
 }