@sema-agent/settings-schema 6.4.0 → 7.0.0

package/dist/migrate-workers.js

@@ -0,0 +1,331 @@
+/**
+ * workers 域的**一次性迁移**(7.0.0,M-R2 WorkerSpec 结构块)—— 持久面唯一允许的过渡,窗口关了就整文件删除
+ * (连同 `types.ts` 里「删除项读到即拒」那一只预处理)。纯函数、无 I/O、不改入参;文件形的入口是
+ * `settings-schema migrate-workers <file>`(`bin/settings-schema.mjs`,同一只函数)。
+ *
+ * ## 谁跑、在哪
+ * 读前抬升:在 `parseDomain("workers", raw)` / `DOMAIN_SCHEMAS.workers.safeParse` **之前**对**原始 JSON** 跑 —— workers 是
+ * 「读即抛」的 gate 域,6.x 存下来的行在 7.0.0 schema 上整域读不出来(删除项响亮拒、enabled 的 worker 缺两块)。中心在它唯一的
+ * workers 读口跑一次,结果写回;CLI 给文件后端 / 离线用。
+ *
+ * ## 规则(每个旧键恰好一种去处)
+ *  · **车道**:`env.REMOTE_EXEC` 是车道词 ⇒ `runtime.execution.lane`;同车道的 env 键 ⇒ `coords`,同车道的 `secretEnv` 密钥 ⇒
+ *    `secretRefs`(都按导出表 `EXECUTION_LANES` 的栏判)。别车道的键、`REQUIRE_EXECUTION_LANE` ⇒ **dropped**(引擎只读被点名车道
+ *    那一臂;声明了车道就恒渲 true)—— 今天就是惰性的。**enabled 且无 `REMOTE_EXEC` ⇒ refused**:那是「无手照回 completed」的
+ *    病例本身,迁移不替运维猜车道。停用且无 `REMOTE_EXEC` ⇒ 不写车道,残留车道键 dropped。
+ *  · **店**:`sessionBackend` ⇒ `store.session`(`tidb` ⇒ `mysql`,且 `store.backend` 由此为 `mysql`);`memoryBackend` ⇒ **dropped**
+ *    (它从未到达引擎);`coords.tidbHost` 在 ⇒ `store.backend = mysql`,`coords.tidb*` + `runtime.db` ⇒ `store.db`(缺端口 ⇒ 引擎
+ *    `MYSQL_PORT` 的缺省 3306),`secretRefs.tidbPasswordEnv` ⇒ `secretRefs.dbPasswordEnv`;没有 host ⇒ `store.backend = local`
+ *    (设计稿 §3.4:推一次、写死),零散坐标惰性 ⇒ dropped。`env` 逃生口里的 `DB_BACKEND` / `MEMORY_ENGINE` /
+ *    `MEMORY_ENGINE_BACKEND`(渲染器以前不渲,运维只能写在那里)⇒ 搬进 `store`,显式的 `DB_BACKEND` 优先。停用且旧形没点名任何店
+ *    (无 host、无 `DB_BACKEND`、无 `tidb` 词)⇒ 不写店,旧字段 dropped。
+ *  · **表达不了 ⇒ refused**:值写错了栏(密钥以字面值写在 env、坐标来自宿主密钥)、不认识的词、新旧两形并存、`DB_BACKEND=pg`
+ *    配 MySQL 族坐标 —— 迁移不搬值进密钥位、不读宿主密钥、不替运维挑赢家、不换库。
+ *  · **终判 = 7.0.0 schema**:迁出来的每只 worker 都过 `WorkerSpec.safeParse`;不过 ⇒ refused,拒因是 schema 自己的 issue
+ *    (例:多租户 + host 车道、点了车道却缺必需坐标)。迁移不复述任何一条写闸规则。
+ *
+ * refused 的 worker **不进**输出 `doc`(中心不加载它、在列表标红点名 `field`;CLI 有 refused 就一字不写),但随 `refused[].original`
+ * 逐字带回:`doc` ∪ `refused[].original` 覆盖输入的全部 worker,中心写回前按 `index` 放回(或另存),运维的 spec 不会随迁移消失。
+ * 拒因 / dropped 只点名字段,不回显值。
+ *
+ * ## 幂等
+ * 已迁形(没有任何旧键、该有的块都在)⇒ 原样(同一引用)返回、`changed = []`。所以再跑一次 ⇒ 零变化、`doc` 字节相等。
+ */
+import { formatConfigPath, redactSecrets } from "./config-fns.js";
+import { LANE_ENV_OWNER } from "./execution-lane-index.js";
+import { EXECUTION_LANE_WORDS, MEMORY_ENGINE_BACKENDS, STORE_BACKENDS } from "./execution-lanes.js";
+import { WorkerSpec } from "./types.js";
+function isRec(v) {
+    return v !== null && typeof v === "object" && !Array.isArray(v);
+}
+/** 车道块的两个特殊键(不在车道表里,但归车道块)。 */
+const LANE_WORD_KEYS = ["REMOTE_EXEC", "REQUIRE_EXECUTION_LANE"];
+/** 渲染器以前不渲、运维只能写在 env 逃生口里的店键(7.0.0 起归 `runtime.store`)。 */
+const STORE_ENV_KEYS = ["DB_BACKEND", "MEMORY_ENGINE", "MEMORY_ENGINE_BACKEND"];
+/** 6.x 删除项:`[容器, 键]`。 */
+const SIX_X_STORE_FIELDS = [
+    ["runtime", "sessionBackend"],
+    ["runtime", "memoryBackend"],
+    ["runtime", "db"],
+    ["coords", "tidbHost"],
+    ["coords", "tidbPort"],
+    ["coords", "tidbUser"],
+    ["secretRefs", "tidbPasswordEnv"],
+];
+/** 引擎 `MEMORY_ENGINE` 的两族词(server `src/config.ts` :3011–3012,比较前 trim + 小写)。 */
+const MEMORY_ENGINE_ON_WORDS = ["on", "true", "1", "yes", "enabled"];
+const MEMORY_ENGINE_OFF_WORDS = ["off", "false", "0", "no", "disabled"];
+/** 引擎 `MYSQL_PORT` 的缺省(server `src/config.ts` :1818)—— 旧形没写端口时引擎连的就是它。 */
+const MYSQL_DEFAULT_PORT = 3306;
+function isLaneWord(v) {
+    return typeof v === "string" && EXECUTION_LANE_WORDS.some((w) => w === v);
+}
+function isStoreWord(v) {
+    return typeof v === "string" && STORE_BACKENDS.some((w) => w === v);
+}
+function isMemoryBackendWord(v) {
+    return typeof v === "string" && MEMORY_ENGINE_BACKENDS.some((w) => w === v);
+}
+/** 拒因里只点名形如词的值(短、小写);其余一律不回显(值可能是粘错位置的凭据)。 */
+function describeWord(v) {
+    return typeof v === "string" && /^[a-z0-9][a-z0-9-]{0,31}$/.test(v) ? `"${v}"` : "(value not shown)";
+}
+const UNCHANGED = { kind: "unchanged" };
+function migrateEntry(raw, index) {
+    if (!isRec(raw) || typeof raw.name !== "string")
+        return UNCHANGED; // 不是一只可辨认的 worker:判形是 parseDomain 的事
+    const name = raw.name;
+    const refuse = (field, reason) => ({ kind: "refused", refusal: { name, index, field, reason: redactSecrets(reason), original: raw } });
+    const enabled = raw.enabled !== false;
+    const has = (container, key) => isRec(container) && Object.hasOwn(container, key);
+    const laneKeysOf = (rec) => isRec(rec) ? Object.keys(rec).filter((k) => LANE_WORD_KEYS.some((w) => w === k) || LANE_ENV_OWNER.has(k)) : [];
+    const storeKeysOf = (rec) => (isRec(rec) ? STORE_ENV_KEYS.filter((k) => Object.hasOwn(rec, k)) : []);
+    const envLaneKeys = laneKeysOf(raw.env);
+    const secretLaneKeys = laneKeysOf(raw.secretEnv);
+    const envStoreKeys = storeKeysOf(raw.env);
+    const secretStoreKeys = storeKeysOf(raw.secretEnv);
+    const oldStoreFields = SIX_X_STORE_FIELDS.filter(([c, k]) => has(raw[c], k));
+    const hasExecution = has(raw.runtime, "execution");
+    const hasStore = has(raw.runtime, "store");
+    const laneTouched = envLaneKeys.length + secretLaneKeys.length > 0;
+    const storeTouched = oldStoreFields.length + envStoreKeys.length + secretStoreKeys.length > 0;
+    if (hasExecution && laneTouched) {
+        return refuse(["runtime", "execution"], `declares runtime.execution AND execution-lane keys in env / secretEnv (${[...envLaneKeys, ...secretLaneKeys].join(", ")}) — keep one form; the migration does not pick a winner`);
+    }
+    // 新形的店字段有两处:`runtime.store` 与 `secretRefs.dbPasswordEnv`(gpt-6 腿 F1:只看前者时,手填过新口令引用、又留着旧
+    // `tidbPasswordEnv` 的行会被旧引用静默覆盖)。任一在场 ∧ 还有旧店字段 ⇒ 两形并存,不挑赢家。
+    const newStoreFields = [...(hasStore ? ["runtime.store"] : []), ...(has(raw.secretRefs, "dbPasswordEnv") ? ["secretRefs.dbPasswordEnv"] : [])];
+    if (newStoreFields.length > 0 && storeTouched) {
+        const old = [...oldStoreFields.map(([c, k]) => `${c}.${k}`), ...envStoreKeys.map((k) => `env.${k}`), ...secretStoreKeys.map((k) => `secretEnv.${k}`)];
+        return refuse(["runtime", "store"], `declares the 7.0.0 store fields (${newStoreFields.join(", ")}) AND 6.x store fields (${old.join(", ")}) — keep one form; the migration does not pick a winner`);
+    }
+    const secretStoreKey = secretStoreKeys[0];
+    if (secretStoreKey !== undefined)
+        return refuse(["secretEnv", secretStoreKey], `${secretStoreKey} is set from a host secret — the migration cannot read it; declare runtime.store by hand`);
+    if (has(raw.secretEnv, "REMOTE_EXEC"))
+        return refuse(["secretEnv", "REMOTE_EXEC"], "the execution lane is set from a host secret — the migration cannot read it; declare runtime.execution.lane by hand");
+    const needLane = !hasExecution && (enabled || laneTouched);
+    const needStore = !hasStore && (enabled || storeTouched);
+    if (!needLane && !needStore)
+        return UNCHANGED;
+    const w = structuredClone(raw);
+    const runtime = isRec(w.runtime) ? w.runtime : {};
+    w.runtime = runtime;
+    const env = isRec(w.env) ? w.env : {};
+    const secretEnv = isRec(w.secretEnv) ? w.secretEnv : {};
+    const coords = isRec(w.coords) ? w.coords : {};
+    const secretRefs = isRec(w.secretRefs) ? w.secretRefs : {};
+    const dropped = [];
+    const drop = (container, slot, key) => {
+        delete container[key];
+        dropped.push({ name, index, field: [slot, key] });
+    };
+    // ── 车道 ─────────────────────────────────────────────────────────────────────────────────────────
+    if (needLane) {
+        const rx = env.REMOTE_EXEC;
+        if (rx === undefined || rx === "") {
+            if (enabled) {
+                return refuse(["env", "REMOTE_EXEC"], `an enabled worker names no execution lane (env.REMOTE_EXEC is unset) — it boots with no hands and still reports tasks completed. ` +
+                    `The migration does not guess a lane: set runtime.execution.lane (${EXECUTION_LANE_WORDS.join(" | ")}) by hand, or disable the worker`);
+            }
+            for (const k of envLaneKeys)
+                drop(env, "env", k); // 停用且没点名车道 ⇒ 每个车道键都是惰性的
+            for (const k of secretLaneKeys)
+                drop(secretEnv, "secretEnv", k);
+        }
+        else {
+            if (!isLaneWord(rx)) {
+                return refuse(["env", "REMOTE_EXEC"], `env.REMOTE_EXEC ${describeWord(rx)} is not an execution lane (${EXECUTION_LANE_WORDS.join(" | ")}) — the engine refuses to start with it; set runtime.execution.lane by hand`);
+            }
+            const lane = rx;
+            const laneCoords = {};
+            const laneSecretRefs = {};
+            for (const k of envLaneKeys) {
+                if (k === "REMOTE_EXEC") {
+                    delete env[k];
+                    continue;
+                }
+                const owner = LANE_ENV_OWNER.get(k);
+                if (owner === undefined || owner.lane !== lane) {
+                    drop(env, "env", k); // REQUIRE_EXECUTION_LANE(声明了车道就恒渲 true)与别车道的键(引擎只读被点名那一臂)
+                    continue;
+                }
+                const v = env[k];
+                if (owner.secret) {
+                    return refuse(["env", k], `${k} is a secret of lane "${lane}" but env carries it as a literal value — the migration does not move a value into a secret slot: put it in the host secret source and reference it from runtime.execution.secretRefs.${k}`);
+                }
+                if (typeof v !== "string")
+                    return refuse(["env", k], `env.${k} is not a string`);
+                laneCoords[k] = v;
+                delete env[k];
+            }
+            for (const k of secretLaneKeys) {
+                const owner = LANE_ENV_OWNER.get(k);
+                if (owner === undefined || owner.lane !== lane) {
+                    drop(secretEnv, "secretEnv", k);
+                    continue;
+                }
+                const v = secretEnv[k];
+                if (!owner.secret) {
+                    return refuse(["secretEnv", k], `${k} is a non-secret coordinate of lane "${lane}" but is set from a host secret — the migration cannot read the value; write it in runtime.execution.coords.${k} by hand`);
+                }
+                if (typeof v !== "string")
+                    return refuse(["secretEnv", k], `secretEnv.${k} is not a string`);
+                laneSecretRefs[k] = v;
+                delete secretEnv[k];
+            }
+            runtime.execution = { lane, coords: laneCoords, secretRefs: laneSecretRefs };
+        }
+    }
+    // ── 店 ───────────────────────────────────────────────────────────────────────────────────────────
+    if (needStore) {
+        if (Object.hasOwn(runtime, "memoryBackend"))
+            drop(runtime, "runtime", "memoryBackend"); // 从未到达引擎
+        const sessionRaw = runtime.sessionBackend;
+        const host = coords.tidbHost;
+        const hostSet = typeof host === "string" && host !== "";
+        const dbBackendRaw = env.DB_BACKEND;
+        const dbBackendSet = dbBackendRaw !== undefined && dbBackendRaw !== "";
+        const named = hostSet || dbBackendSet || sessionRaw === "tidb";
+        const sqlCoordFields = [
+            [runtime, "runtime", "db"],
+            [coords, "coords", "tidbHost"],
+            [coords, "coords", "tidbPort"],
+            [coords, "coords", "tidbUser"],
+            [secretRefs, "secretRefs", "tidbPasswordEnv"],
+        ];
+        if (!enabled && !named) {
+            // 停用、旧形没点名任何店 ⇒ 不替它发明一个;旧字段全是惰性的
+            if (Object.hasOwn(runtime, "sessionBackend"))
+                drop(runtime, "runtime", "sessionBackend");
+            for (const [c, slot, k] of sqlCoordFields)
+                if (Object.hasOwn(c, k))
+                    drop(c, slot, k);
+            for (const k of STORE_ENV_KEYS)
+                if (Object.hasOwn(env, k))
+                    drop(env, "env", k);
+        }
+        else {
+            let session;
+            if (sessionRaw === undefined)
+                session = "auto"; // 6.x 的缺省
+            else if (sessionRaw === "tidb")
+                session = "mysql";
+            else if (sessionRaw === "memory" || sessionRaw === "auto")
+                session = sessionRaw;
+            else
+                return refuse(["runtime", "sessionBackend"], `runtime.sessionBackend ${describeWord(sessionRaw)} is not a 6.x session backend (tidb | memory | auto)`);
+            delete runtime.sessionBackend;
+            let backend;
+            if (dbBackendSet) {
+                if (!isStoreWord(dbBackendRaw))
+                    return refuse(["env", "DB_BACKEND"], `env.DB_BACKEND ${describeWord(dbBackendRaw)} is not a store backend (${STORE_BACKENDS.join(" | ")}) — the engine refuses to start with it`);
+                backend = dbBackendRaw;
+            }
+            else {
+                backend = hostSet || sessionRaw === "tidb" ? "mysql" : "local";
+            }
+            delete env.DB_BACKEND;
+            const sqlCoordsPresent = sqlCoordFields.filter(([c, , k]) => Object.hasOwn(c, k));
+            const store = { backend, session };
+            if (backend === "mysql") {
+                if (hostSet) {
+                    const port = coords.tidbPort;
+                    store.db = {
+                        host,
+                        port: port === undefined ? MYSQL_DEFAULT_PORT : port,
+                        ...(Object.hasOwn(coords, "tidbUser") ? { user: coords.tidbUser } : {}),
+                        ...(Object.hasOwn(runtime, "db") ? { database: runtime.db } : {}),
+                    };
+                }
+                if (Object.hasOwn(secretRefs, "tidbPasswordEnv"))
+                    secretRefs.dbPasswordEnv = secretRefs.tidbPasswordEnv;
+                for (const [c, , k] of sqlCoordsPresent)
+                    delete c[k];
+            }
+            else if (backend === "pg") {
+                if (sqlCoordsPresent.length > 0) {
+                    return refuse(["env", "DB_BACKEND"], `env.DB_BACKEND=pg but the SQL coordinates are the MySQL family (coords.tidb* / runtime.db / secretRefs.tidbPasswordEnv, rendered as MYSQL_*) — the migration does not move a MySQL server's coordinates onto pg; declare runtime.store by hand`);
+                }
+            }
+            else {
+                for (const [c, slot, k] of sqlCoordsPresent)
+                    drop(c, slot, k); // 非 SQL 店:SQL 坐标在引擎里是「声明不用」的惰性件
+            }
+            const memory = {};
+            const engineRaw = env.MEMORY_ENGINE;
+            if (engineRaw !== undefined) {
+                const word = typeof engineRaw === "string" ? engineRaw.trim().toLowerCase() : undefined;
+                if (word !== undefined && MEMORY_ENGINE_ON_WORDS.includes(word))
+                    memory.engine = "on";
+                else if (word !== undefined && MEMORY_ENGINE_OFF_WORDS.includes(word))
+                    memory.engine = "off";
+                else if (word !== "")
+                    return refuse(["env", "MEMORY_ENGINE"], "env.MEMORY_ENGINE is not an on/off word — the engine refuses to start with it");
+                delete env.MEMORY_ENGINE;
+            }
+            const memoryBackendRaw = env.MEMORY_ENGINE_BACKEND;
+            if (memoryBackendRaw !== undefined) {
+                if (!isMemoryBackendWord(memoryBackendRaw)) {
+                    return refuse(["env", "MEMORY_ENGINE_BACKEND"], `env.MEMORY_ENGINE_BACKEND ${describeWord(memoryBackendRaw)} is not a memory backend (${MEMORY_ENGINE_BACKENDS.join(" | ")}) — the engine refuses to start with it`);
+                }
+                memory.backend = memoryBackendRaw;
+                delete env.MEMORY_ENGINE_BACKEND;
+            }
+            if (Object.keys(memory).length > 0)
+                store.memory = memory;
+            runtime.store = store;
+        }
+    }
+    // 被搬空的 env / secretEnv 整键去掉(它们是可选字段;留一个 `{}` 只是噪声)
+    if (isRec(w.env) && Object.keys(env).length === 0 && isRec(raw.env) && Object.keys(raw.env).length > 0)
+        delete w.env;
+    if (isRec(w.secretEnv) && Object.keys(secretEnv).length === 0 && isRec(raw.secretEnv) && Object.keys(raw.secretEnv).length > 0)
+        delete w.secretEnv;
+    // 终判 = 7.0.0 schema 本身(迁移不复述写闸规则)
+    const verdict = WorkerSpec.safeParse(w);
+    if (!verdict.success) {
+        const issues = verdict.error.issues;
+        const shown = issues.slice(0, 3).map((i) => `${formatConfigPath(i.path)}: ${i.message}`);
+        const more = issues.length > shown.length ? ` (+${issues.length - shown.length} more)` : "";
+        const first = issues[0];
+        return refuse(first === undefined ? [] : first.path, `after migration the worker is not a valid 7.0.0 WorkerSpec — ${shown.join("; ")}${more}`);
+    }
+    return { kind: "migrated", entry: w, dropped };
+}
+/**
+ * 迁移一份 workers 域**原始**文档(`{ workers: [...] }`)。不是这个形 ⇒ 原样返回(判形是 `parseDomain` 的事,迁移不抛)。
+ * 规则、幂等与 refused 的处置见文件头。
+ */
+export function migrateWorkersDomain(doc) {
+    if (!isRec(doc) || !Array.isArray(doc.workers))
+        return { doc, changed: [], dropped: [], refused: [] };
+    const workers = doc.workers;
+    const kept = [];
+    const changed = [];
+    const dropped = [];
+    const refused = [];
+    workers.forEach((entry, index) => {
+        const out = migrateEntry(entry, index);
+        switch (out.kind) {
+            case "unchanged":
+                kept.push(entry);
+                break;
+            case "migrated":
+                kept.push(out.entry);
+                changed.push(String(out.entry.name));
+                dropped.push(...out.dropped);
+                break;
+            case "refused":
+                refused.push(out.refusal);
+                break;
+            default: {
+                const unhandled = out;
+                throw new Error(`migrateWorkersDomain: unhandled outcome ${JSON.stringify(unhandled)}`);
+            }
+        }
+    });
+    if (changed.length === 0 && refused.length === 0)
+        return { doc, changed: [], dropped: [], refused: [] };
+    return { doc: { ...doc, workers: kept }, changed, dropped, refused };
+}

package/dist/remote-exec.d.ts

@@ -1,26 +1,29 @@
 /**
  * `remoteExec` — the execution-substrate contract (NET-NEW; not part of DOMAIN_SCHEMAS today).
  *
- * Per the product owner's decision the exec layer is user-configurable & pluggable. This SCHEMA is a
- * FORWARD-COMPATIBLE SUPERSET: it carries both the backends the worker service already implements today AND the
- * TOC single-machine backends the product owner added (the service implements those in PHASES — host + e2b first,
- * local/remote-docker fast-follow). The schema LEADS; runtime support is phased. The discriminator is `provider`:
- *   FLEET (implemented today, the worker service's config module):
+ * The exec layer is user-configurable & pluggable. This SCHEMA carries the per-machine `config.d/remote-exec.json`
+ * shape for the lanes a consumer can drive from that file. The discriminator is `provider`:
+ *   FLEET:
  *   - `e2b`           per-task E2B Firecracker VM (isolated, suspendable). The default code-agent worker.
  *   - `k8s`           per-task Kata pod on our k3s (isolated, NOT suspendable). Self-hosted sandbox lane.
  *   - `ssh`           a real host over SSH (NOT isolated/suspendable). AI-orchestrated batch deploy.
  *   - `adb`           a real device over ADB (NOT isolated/suspendable). On-device APP testing.
- *   TOC single-machine (product-owner scope; service implements in phases — macOS + Linux first):
+ *   TOC single-machine (macOS + Linux):
  *   - `host`          run tools DIRECTLY on this machine, no container (the TOC default, like a local coding
- *                     agent). No isolation. macOS/Linux.
+ *                     agent). No isolation.
  *   - `local-docker`  containers on THIS machine's docker (isolation for parallel/untrusted fan-out).
- *   - `remote-docker` a user-specified REMOTE host's docker (offload; isolated).
+ *
+ * 7.0.0: every `provider` word here is an execution lane word (`EXECUTION_LANE_WORDS`, `execution-lanes.ts` — the ONE
+ * vocabulary; `test/execution-lanes-7.0.0.test.ts` pins `provider ⊆ EXECUTION_LANE_WORDS`, at runtime and at compile time).
+ * The `remote-docker` variant was DELETED (zero aliases): no engine read point ever turned that word into a running lane
+ * (the engine refuses `REMOTE_EXEC=remote-docker` at boot and only warned "unwired" when this file named it). A remote
+ * docker daemon is the `local-docker` lane pointed at it (`DOCKER_HOST` — in a WorkerSpec, `runtime.execution.coords`).
  *
  * SECRET BOUNDARY (identical to the rest of the contract): every secret VALUE the consumer reads from its own
- * env (E2B_API_KEY, K8S_TOKEN, SSH_PRIVATE_KEY, MINIO_*, the remote-docker TLS/SSH creds) is carried here as an
- * env-NAME ref (the `ENV_NAME` regex from types.ts) — NEVER a literal value. The consumer resolves NAME → value
- * from its own env (service env / k8s secret / the TOC local `.env`), so this package never carries a
- * credential. This is SCHEMA + secret-as-env-NAME ONLY; the service owns the adapter implementations.
+ * env (E2B_API_KEY, K8S_TOKEN, SSH_PRIVATE_KEY, MINIO_*) is carried here as an env-NAME ref (the `ENV_NAME` regex
+ * from types.ts) — NEVER a literal value. The consumer resolves NAME → value from its own env (service env / k8s
+ * secret / the TOC local `.env`), so this package never carries a credential. This is SCHEMA + secret-as-env-NAME
+ * ONLY; the service owns the adapter implementations.
  */
 import { z } from "zod";
 export declare const RemoteExecSpec: z.ZodDiscriminatedUnion<"provider", [z.ZodObject<{
@@ -61,7 +64,7 @@ export declare const RemoteExecSpec: z.ZodDiscriminatedUnion<"provider", [z.ZodO
     memory?: string | undefined;
     workdir?: string | undefined;
     cpus?: number | undefined;
-    network?: "none" | "host" | "bridge" | undefined;
+    network?: "host" | "none" | "bridge" | undefined;
     mountPath?: string | undefined;
 }, {
     provider: "local-docker";
@@ -69,52 +72,8 @@ export declare const RemoteExecSpec: z.ZodDiscriminatedUnion<"provider", [z.ZodO
     memory?: string | undefined;
     workdir?: string | undefined;
     cpus?: number | undefined;
-    network?: "none" | "host" | "bridge" | undefined;
-    mountPath?: string | undefined;
-}>, z.ZodObject<{
-    /** The remote docker endpoint — a DOCKER_HOST url: `ssh://user@host` or `tcp://host:2376`. A `user@` is OK
-     *  (it's the ssh target, not a secret); an embedded PASSWORD is rejected — credentials go in the env-NAME
-     *  fields below, NEVER in the URL (the secret-as-env-NAME boundary). */
-    dockerHost: z.ZodEffects<z.ZodString, string, string>;
-    /** env-NAMEs for a tcp+TLS endpoint (NEVER the cert/key bytes). */
-    tlsCertEnv: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
-    tlsKeyEnv: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
-    tlsCaEnv: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
-    /** env-NAME for the SSH private key when dockerHost is `ssh://…` (NEVER the key value). */
-    sshKeyEnv: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
-    image: z.ZodEffects<z.ZodString, string, string>;
-    memory: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
-    cpus: z.ZodOptional<z.ZodNumber>;
-    network: z.ZodOptional<z.ZodEnum<["none", "bridge", "host"]>>;
-    workdir: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
-    mountPath: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
-    provider: z.ZodLiteral<"remote-docker">;
-}, "strip", z.ZodTypeAny, {
-    provider: "remote-docker";
-    image: string;
-    dockerHost: string;
-    memory?: string | undefined;
-    workdir?: string | undefined;
-    cpus?: number | undefined;
-    network?: "none" | "host" | "bridge" | undefined;
-    mountPath?: string | undefined;
-    tlsCertEnv?: string | undefined;
-    tlsKeyEnv?: string | undefined;
-    tlsCaEnv?: string | undefined;
-    sshKeyEnv?: string | undefined;
-}, {
-    provider: "remote-docker";
-    image: string;
-    dockerHost: string;
-    memory?: string | undefined;
-    workdir?: string | undefined;
-    cpus?: number | undefined;
-    network?: "none" | "host" | "bridge" | undefined;
+    network?: "host" | "none" | "bridge" | undefined;
     mountPath?: string | undefined;
-    tlsCertEnv?: string | undefined;
-    tlsKeyEnv?: string | undefined;
-    tlsCaEnv?: string | undefined;
-    sshKeyEnv?: string | undefined;
 }>, z.ZodObject<{
     provider: z.ZodLiteral<"e2b">;
     /** env-NAME holding the E2B API key (service: E2B_API_KEY). NEVER the key. */
@@ -192,8 +151,8 @@ export declare const RemoteExecSpec: z.ZodDiscriminatedUnion<"provider", [z.ZodO
 }, "strip", z.ZodTypeAny, {
     provider: "k8s";
     image: string;
-    cpu?: string | undefined;
     memory?: string | undefined;
+    cpu?: string | undefined;
     mountPath?: string | undefined;
     timeoutMs?: number | undefined;
     apiUrl?: string | undefined;
@@ -214,8 +173,8 @@ export declare const RemoteExecSpec: z.ZodDiscriminatedUnion<"provider", [z.ZodO
 }, {
     provider: "k8s";
     image: string;
-    cpu?: string | undefined;
     memory?: string | undefined;
+    cpu?: string | undefined;
     mountPath?: string | undefined;
     timeoutMs?: number | undefined;
     apiUrl?: string | undefined;
@@ -242,19 +201,19 @@ export declare const RemoteExecSpec: z.ZodDiscriminatedUnion<"provider", [z.ZodO
     privateKeyEnv: z.ZodEffects<z.ZodString, string, string>;
     mountPath: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
 }, "strip", z.ZodTypeAny, {
-    provider: "ssh";
     host: string;
+    provider: "ssh";
     username: string;
     privateKeyEnv: string;
-    mountPath?: string | undefined;
     port?: number | undefined;
+    mountPath?: string | undefined;
 }, {
-    provider: "ssh";
     host: string;
+    provider: "ssh";
     username: string;
     privateKeyEnv: string;
-    mountPath?: string | undefined;
     port?: number | undefined;
+    mountPath?: string | undefined;
 }>, z.ZodObject<{
     provider: z.ZodLiteral<"adb">;
     serial: z.ZodEffects<z.ZodString, string, string>;

package/dist/remote-exec.js

@@ -1,34 +1,37 @@
 /**
  * `remoteExec` — the execution-substrate contract (NET-NEW; not part of DOMAIN_SCHEMAS today).
  *
- * Per the product owner's decision the exec layer is user-configurable & pluggable. This SCHEMA is a
- * FORWARD-COMPATIBLE SUPERSET: it carries both the backends the worker service already implements today AND the
- * TOC single-machine backends the product owner added (the service implements those in PHASES — host + e2b first,
- * local/remote-docker fast-follow). The schema LEADS; runtime support is phased. The discriminator is `provider`:
- *   FLEET (implemented today, the worker service's config module):
+ * The exec layer is user-configurable & pluggable. This SCHEMA carries the per-machine `config.d/remote-exec.json`
+ * shape for the lanes a consumer can drive from that file. The discriminator is `provider`:
+ *   FLEET:
  *   - `e2b`           per-task E2B Firecracker VM (isolated, suspendable). The default code-agent worker.
  *   - `k8s`           per-task Kata pod on our k3s (isolated, NOT suspendable). Self-hosted sandbox lane.
  *   - `ssh`           a real host over SSH (NOT isolated/suspendable). AI-orchestrated batch deploy.
  *   - `adb`           a real device over ADB (NOT isolated/suspendable). On-device APP testing.
- *   TOC single-machine (product-owner scope; service implements in phases — macOS + Linux first):
+ *   TOC single-machine (macOS + Linux):
  *   - `host`          run tools DIRECTLY on this machine, no container (the TOC default, like a local coding
- *                     agent). No isolation. macOS/Linux.
+ *                     agent). No isolation.
  *   - `local-docker`  containers on THIS machine's docker (isolation for parallel/untrusted fan-out).
- *   - `remote-docker` a user-specified REMOTE host's docker (offload; isolated).
+ *
+ * 7.0.0: every `provider` word here is an execution lane word (`EXECUTION_LANE_WORDS`, `execution-lanes.ts` — the ONE
+ * vocabulary; `test/execution-lanes-7.0.0.test.ts` pins `provider ⊆ EXECUTION_LANE_WORDS`, at runtime and at compile time).
+ * The `remote-docker` variant was DELETED (zero aliases): no engine read point ever turned that word into a running lane
+ * (the engine refuses `REMOTE_EXEC=remote-docker` at boot and only warned "unwired" when this file named it). A remote
+ * docker daemon is the `local-docker` lane pointed at it (`DOCKER_HOST` — in a WorkerSpec, `runtime.execution.coords`).
  *
  * SECRET BOUNDARY (identical to the rest of the contract): every secret VALUE the consumer reads from its own
- * env (E2B_API_KEY, K8S_TOKEN, SSH_PRIVATE_KEY, MINIO_*, the remote-docker TLS/SSH creds) is carried here as an
- * env-NAME ref (the `ENV_NAME` regex from types.ts) — NEVER a literal value. The consumer resolves NAME → value
- * from its own env (service env / k8s secret / the TOC local `.env`), so this package never carries a
- * credential. This is SCHEMA + secret-as-env-NAME ONLY; the service owns the adapter implementations.
+ * env (E2B_API_KEY, K8S_TOKEN, SSH_PRIVATE_KEY, MINIO_*) is carried here as an env-NAME ref (the `ENV_NAME` regex
+ * from types.ts) — NEVER a literal value. The consumer resolves NAME → value from its own env (service env / k8s
+ * secret / the TOC local `.env`), so this package never carries a credential. This is SCHEMA + secret-as-env-NAME
+ * ONLY; the service owns the adapter implementations.
  */
 import { z } from "zod";
-import { ENV_NAME, K8S_QUANTITY, NON_SECRET_URL, TCP_PORT, containsSecretToken, hasNul, urlQueryFragmentHasSecret } from "./types.js";
+import { ENV_NAME, K8S_QUANTITY, NON_SECRET_URL, TCP_PORT, containsSecretToken, hasNul } from "./types.js";
 /** A non-empty exec-bound string (an image / path / shell / arg the adapter feeds to spawn()/fs). Rejects a NUL
  *  byte uniformly — a NUL validates here but makes Node throw at spawn/boot (fail-OPEN → runtime crash). R20. */
 const execStr = z.string().min(1).refine((s) => !hasNul(s), "must not contain a NUL byte");
-/** Container knobs shared by the two docker lanes (local-docker / remote-docker). `network` defaults to
- *  `none` at the adapter (the safe posture for untrusted code — see the dual-mode design note). */
+/** Container knobs of the `local-docker` lane. `network` defaults to `none` at the adapter (the safe posture for
+ *  untrusted code — see the dual-mode design note). */
 const DOCKER_FIELDS = {
     /** Sandbox image (required — a run must be reproducible). */
     image: execStr,
@@ -58,60 +61,6 @@ export const RemoteExecSpec = z.discriminatedUnion("provider", [
     // ── local-docker: containers on this machine's docker (isolated; enables parallel fan-out). No secrets
     //    (local docker.sock). Service implements this fast-follow after host.
     z.object({ provider: z.literal("local-docker"), ...DOCKER_FIELDS }),
-    // ── remote-docker: a user-specified remote host's docker. Creds (TLS for tcp://, key for ssh://) are
-    //    env-NAME refs, never bytes. Service implements this fast-follow.
-    z.object({
-        provider: z.literal("remote-docker"),
-        ...DOCKER_FIELDS,
-        /** The remote docker endpoint — a DOCKER_HOST url: `ssh://user@host` or `tcp://host:2376`. A `user@` is OK
-         *  (it's the ssh target, not a secret); an embedded PASSWORD is rejected — credentials go in the env-NAME
-         *  fields below, NEVER in the URL (the secret-as-env-NAME boundary). */
-        dockerHost: z
-            .string()
-            .min(1)
-            .refine((s) => {
-            if (hasNul(s))
-                return false; // a NUL in DOCKER_HOST crashes the adapter at spawn — reject (R20)
-            try {
-                const u = new URL(s);
-                if (u.password)
-                    return false; // a `user@` ssh target is fine; an embedded PASSWORD is not
-                // a secret can also ride in the username (`ssh://sk-live-…@host`) or the query/fragment — scan them
-                // (Round-4). The userinfo password is already rejected above.
-                let user = u.username;
-                try {
-                    user = decodeURIComponent(u.username);
-                }
-                catch {
-                    /* keep raw */
-                }
-                if (user && containsSecretToken(user))
-                    return false;
-                return !urlQueryFragmentHasSecret(u);
-            }
-            catch {
-                // unparseable (e.g. a bare socket path) → reject a `:pw@` userinfo-password pattern AND any
-                // secret-shaped TOKEN anywhere (containsSecretToken tokenizes on URL/query delimiters incl =&, so a
-                // mid-string `/var/run/sk-…` or `socket?token=sk-…` is caught despite the ^-anchored regex). R4/5.
-                if (/:[^/@]+@/.test(s))
-                    return false;
-                if (containsSecretToken(s))
-                    return false;
-                try {
-                    return !containsSecretToken(decodeURIComponent(s)); // also catch percent-encoded secrets
-                }
-                catch {
-                    return true; // malformed %-escape → the raw scan above already passed
-                }
-            }
-        }, "no credentials in dockerHost (password / secret-shaped user/query/fragment) — put them in the env-NAME fields (sshKeyEnv / tls*Env)"),
-        /** env-NAMEs for a tcp+TLS endpoint (NEVER the cert/key bytes). */
-        tlsCertEnv: ENV_NAME.optional(),
-        tlsKeyEnv: ENV_NAME.optional(),
-        tlsCaEnv: ENV_NAME.optional(),
-        /** env-NAME for the SSH private key when dockerHost is `ssh://…` (NEVER the key value). */
-        sshKeyEnv: ENV_NAME.optional(),
-    }),
     // ── e2b: the user's E2B account (service provider "e2b"; REMOTE_EXEC=e2b + E2B_API_KEY).
     z.object({
         provider: z.literal("e2b"),
@@ -163,8 +112,8 @@ export const RemoteExecSpec = z.discriminatedUnion("provider", [
     // ── ssh: a real host over SSH (service provider "ssh"; REMOTE_EXEC=ssh + SSH_HOST/SSH_USER/SSH_PRIVATE_KEY).
     z.object({
         provider: z.literal("ssh"),
-        // host + username are persisted to config.d/remote-exec.json — scan for a secret-shaped literal, same as the
-        // remote-docker dockerHost scans its embedded ssh user (a secret must go in privateKeyEnv, not the login). R14.
+        // host + username are persisted to config.d/remote-exec.json — scan for a secret-shaped literal (a secret must go
+        // in privateKeyEnv, not the login). R14.
         host: execStr.refine((s) => !containsSecretToken(s), "no secret literal in ssh host — credentials go in privateKeyEnv"),
         port: TCP_PORT.optional(),
         username: execStr.refine((s) => !containsSecretToken(s), "no secret literal in ssh username — credentials go in privateKeyEnv"),

package/dist/secret-refs.d.ts

@@ -22,7 +22,8 @@ export interface EnvRef {
  *  (integrations domain DELETED in 0.6.0 — OA/Gitea coordinates ride worker.env/secretEnv, EXPERT-REDESIGN §9.) */
 export declare function collectEnvRefs(eff: EffectiveConfig): EnvRef[];
 /**
- * Names of workers that reference a given env-NAME — via any of the 4 structured `secretRefs` OR the general
+ * Names of workers that reference a given env-NAME — via any of the structured `secretRefs`, the execution lane's
+ * `runtime.execution.secretRefs` (7.0.0: where E2B_API_KEY / SSH_PRIVATE_KEY / K8S_TOKEN … live now), OR the general
  * `secretEnv` passthrough. Drives batch-rotate (POST /secrets/<name>/rotate): after a credential write, recreate
  * exactly the workers that project it. Reads the raw workers domain (the same shape collectEnvRefs would see).
  */
@@ -30,4 +31,9 @@ export declare function workersReferencingSecret(workers: {
     name: string;
     secretRefs?: Record<string, string | undefined>;
     secretEnv?: Record<string, string>;
+    runtime?: {
+        execution?: {
+            secretRefs?: Record<string, string>;
+        };
+    };
 }[], envName: string): string[];