@capybara-hq/kernel 0.1.0-rc.4 → 0.1.0-rc.6

package/dist/extensions/hooks.js

@@ -1,4 +1,5 @@
 import { HOOKS_AVAILABLE, POLICY_HOOKS, } from "@capybara-hq/plugin-sdk";
+import { NEEDS_CONFIG_REASON } from "./effective-config.js";
 import { ExtensionUnloadedError } from "./inflight.js";
 /** Default of `hooks.timeoutMs` (used when a host is built without kernel config, e.g. in tests). */
 export const DEFAULT_HOOK_TIMEOUT_MS = 5000;
@@ -13,6 +14,18 @@ export const OBSERVE_INFLIGHT_MAX = 64;
 export const EMPTY_DENY_REASON = "(no reason given)";
 /** Warnings about a plugin's hooks are logged at most once per plugin, mount and kind in this window. */
 const WARN_WINDOW_MS = 60_000;
+/**
+ * Thrown by a `usage.report` handler wrapper (see {@link HookRegistry.handlers}) instead of calling
+ * a handler whose extension's effective config is not valid in the payload's organization.
+ */
+export class HookNeedsConfigError extends Error {
+    plugin;
+    constructor(plugin) {
+        super(`extension ${plugin} ${NEEDS_CONFIG_REASON}`);
+        this.plugin = plugin;
+        this.name = "HookNeedsConfigError";
+    }
+}
 const AVAILABLE = new Set(HOOKS_AVAILABLE);
 const POLICY = new Set(POLICY_HOOKS);
 /** Error text that never throws itself (a hostile `message` getter or `toString`). */
@@ -110,7 +123,12 @@ const clipDetail = (s) => clipText(s, HOOK_DETAIL_MAX_CHARS);
  *    If a plugin the organization enabled is expected to run policy hooks on the mount (deployment
  *    state, `expectedPolicy`) but is not loaded on this replica, deny with a generic reason
  *    (`hook_error`, `notLoaded`) without running any policy hook (M-1: fail closed). Observe hooks
- *    of plugins that are not loaded are simply missing.
+ *    of plugins that are not loaded are simply missing. Then each enabled plugin with a hook on the
+ *    mount gets its effective config for the organization (layering spec A §6; one read per plugin
+ *    and call, failing like the lookup above). A plugin whose config is not valid behaves as one
+ *    that is not loaded: with a policy hook on the mount the call is denied (`hook_error`,
+ *    `needsConfig`) without running any policy hook, and its observe hooks are skipped. Every
+ *    hook is called with `{ config }` as its third argument.
  * 3. Policy hooks run serially by plugin name (registration order within a plugin), each limited
  *    by `hooks.timeoutMs` (read on every run, hot). `{ deny }`, an error or a timeout stops the chain
  *    and denies (`deny` / `hook_error` / `timeout`). A policy hook cut off by its instance being
@@ -156,13 +174,18 @@ export class HookRegistry {
     }
     /**
      * `usage.report` handlers by plugin name (delivered by the usage queue, not by {@link run}); each
-     * call runs through the instance's `inflight.run`.
+     * call runs through the instance's `inflight.run` with the plugin's effective config for the
+     * payload's organization, and throws {@link HookNeedsConfigError} without calling the handler
+     * when that config is not valid (layering spec A §6).
      */
     handlers(mount) {
         return this.entries(mount).map(({ src, hook }) => ({
             plugin: src.name,
             handler: (payload, signal) => src.inflight.run(signal, async (s) => {
-                await hook.handler(payload, s);
+                const effective = await this.d.effectiveConfig(payload.orgId, src.name);
+                if (!effective.ok)
+                    throw new HookNeedsConfigError(src.name);
+                await hook.handler(payload, s, { config: effective.config });
             }),
         }));
     }
@@ -177,6 +200,8 @@ export class HookRegistry {
         let enabled;
         let frozen;
         let missing;
+        /** Effective config per enabled plugin with a hook here; null = not valid in the org. */
+        const configs = new Map();
         try {
             const abort = abortOf(signal);
             try {
@@ -194,6 +219,19 @@ export class HookRegistry {
             }
             if (!all.some((e) => enabled.has(e.src.name)))
                 return { allowed: true };
+            for (const name of new Set(all.map((e) => e.src.name).filter((n) => enabled.has(n)))) {
+                const abortCfg = abortOf(signal);
+                try {
+                    const e = await Promise.race([
+                        this.d.effectiveConfig(payload.orgId, name),
+                        abortCfg.aborted,
+                    ]);
+                    configs.set(name, e.ok ? { config: e.config } : null);
+                }
+                finally {
+                    abortCfg.cleanup();
+                }
+            }
             // Cost: one clone + deep-freeze per call. The model.request payload carries no media bytes
             // (hookRequestOf, I-3), so it stays small. Freezing in place would freeze the logged object.
             // The clone is skipped when has() is false or no enabled plugin has a hook on this mount.
@@ -207,7 +245,7 @@ export class HookRegistry {
             if (firstPolicy !== undefined) {
                 // R10: no plugin ran; the named plugin is only the first policy plugin on this mount, so
                 // the detail says so instead of blaming it
-                const detail = clipDetail(`Hooks could not run (organization lookup or payload copy failed) before any plugin was called; ${firstPolicy} is named only as the first policy plugin on ${mount}: ${raw}`);
+                const detail = clipDetail(`Hooks could not run (organization lookup, config read or payload copy failed) before any plugin was called; ${firstPolicy} is named only as the first policy plugin on ${mount}: ${raw}`);
                 this.d.log.warn("plugin hooks could not run; denying the call", {
                     mount,
                     firstPolicyPlugin: firstPolicy,
@@ -227,9 +265,19 @@ export class HookRegistry {
             }
             return { allowed: true };
         }
-        const active = all.filter((e) => enabled.has(e.src.name));
+        const active = all.filter((e) => enabled.has(e.src.name) && configs.get(e.src.name));
         const timeoutMs = this.d.config().hooks.timeoutMs;
-        let outcome = missing.length > 0 ? this.notLoadedDenial(mount, missing) : { allowed: true };
+        // spec A §6: a policy plugin without a valid config in the org behaves as one not loaded
+        const needy = [
+            ...new Set(all
+                .filter((e) => e.hook.mode === "policy" && configs.get(e.src.name) === null)
+                .map((e) => e.src.name)),
+        ];
+        let outcome = missing.length > 0
+            ? this.notLoadedDenial(mount, missing)
+            : needy.length > 0
+                ? this.needsConfigDenial(mount, needy)
+                : { allowed: true };
         // policy hooks grouped per plugin (entries are sorted, so groups are contiguous)
         const groups = [];
         for (const e of active) {
@@ -242,7 +290,8 @@ export class HookRegistry {
                 groups.push({ src: e.src, hooks: [e.hook] });
         }
         for (const g of outcome.allowed ? groups : []) {
-            const denied = await this.runPolicies(mount, g.src, g.hooks, frozen, signal, timeoutMs);
+            const call = configs.get(g.src.name);
+            const denied = await this.runPolicies(mount, g.src, g.hooks, frozen, call, signal, timeoutMs);
             if (denied) {
                 outcome = denied;
                 break;
@@ -251,8 +300,10 @@ export class HookRegistry {
         // observe hooks are resolved again now: if the plugin was upgraded while the policy hooks ran,
         // the current generation observes (the retiring one no longer accepts calls)
         for (const e of this.entries(mount)) {
-            if (e.hook.mode === "observe" && enabled.has(e.src.name)) {
-                this.dispatchObserve(mount, e.src, e.hook, frozen, signal);
+            const call = configs.get(e.src.name);
+            // no config read for it (not valid in the org, or a plugin that appeared meanwhile): skipped
+            if (e.hook.mode === "observe" && enabled.has(e.src.name) && call) {
+                this.dispatchObserve(mount, e.src, e.hook, frozen, call, signal);
             }
         }
         return outcome;
@@ -277,6 +328,21 @@ export class HookRegistry {
             notLoaded: true,
         };
     }
+    /**
+     * The layering spec A §6 denial: `needy` (sorted) are enabled policy plugins whose effective
+     * config is not valid in the organization. Generic model-visible reason, as for M-1.
+     */
+    needsConfigDenial(mount, needy) {
+        const plugin = needy[0];
+        return {
+            allowed: false,
+            plugin,
+            reason: unavailableReason(plugin),
+            cause: "hook_error",
+            detail: `extension ${needy.join(", ")} declares a policy hook on ${mount} but ${NEEDS_CONFIG_REASON}; the call was denied without running any policy hook`,
+            needsConfig: true,
+        };
+    }
     /** Active entries of a mount point, sorted by plugin name (stable: registration order within). */
     entries(mount) {
         return this.d
@@ -285,14 +351,14 @@ export class HookRegistry {
             .sort((a, b) => (a.src.name < b.src.name ? -1 : a.src.name > b.src.name ? 1 : 0));
     }
     /** One plugin's policy hooks in registration order; reruns once on a newer generation if revoked. */
-    async runPolicies(mount, src, hooks, payload, signal, timeoutMs, rerun = false) {
+    async runPolicies(mount, src, hooks, payload, call, signal, timeoutMs, rerun = false) {
         const plugin = src.name;
         for (const hook of hooks) {
             if (signal.aborted)
                 throw signal.reason;
             let r;
             try {
-                r = await src.inflight.run(signal, (s) => this.call(hook, payload, s, timeoutMs));
+                r = await src.inflight.run(signal, (s) => this.call(hook, payload, call, s, timeoutMs));
             }
             catch (err) {
                 if (signal.aborted)
@@ -301,7 +367,7 @@ export class HookRegistry {
                     const cur = this.d.current(plugin);
                     if (!rerun && cur && cur !== src) {
                         const again = cur.hooks.filter((h) => h.mount === mount && h.mode === "policy");
-                        return this.runPolicies(mount, cur, again, payload, signal, timeoutMs, true);
+                        return this.runPolicies(mount, cur, again, payload, call, signal, timeoutMs, true);
                     }
                 }
                 r = { kind: "error", message: errMsg(err) };
@@ -338,7 +404,7 @@ export class HookRegistry {
         return undefined;
     }
     /** Fire-and-forget observe call through the instance's in-flight tracker, capped per plugin. */
-    dispatchObserve(mount, src, hook, payload, signal) {
+    dispatchObserve(mount, src, hook, payload, call, signal) {
         const plugin = src.name;
         const n = this.observing.get(plugin) ?? 0;
         if (n >= OBSERVE_INFLIGHT_MAX) {
@@ -349,7 +415,7 @@ export class HookRegistry {
         this.observing.set(plugin, n + 1);
         void (async () => {
             try {
-                const r = await src.inflight.run(signal, (s) => this.call(hook, payload, s, timeoutMs));
+                const r = await src.inflight.run(signal, (s) => this.call(hook, payload, call, s, timeoutMs));
                 if (r.kind === "error" || r.kind === "timeout") {
                     await this.warnOnce(plugin, mount, "failed", "plugin observe hook failed; the call continued", r.kind === "timeout" ? `timed out after ${timeoutMs} ms` : r.message);
                 }
@@ -371,7 +437,7 @@ export class HookRegistry {
      * Calls one handler with its own signal (aborted on timeout or when `s` aborts). Rejects with
      * `s.reason` when `s` aborts first, so callers can tell an abort from a hook failure.
      */
-    async call(hook, payload, s, timeoutMs) {
+    async call(hook, payload, call, s, timeoutMs) {
         const ac = new AbortController();
         const onAbort = () => ac.abort(s.reason);
         if (s.aborted)
@@ -385,7 +451,7 @@ export class HookRegistry {
                 timer = setTimeout(() => resolve("timeout"), timeoutMs);
             });
             const handled = Promise.resolve()
-                .then(() => hook.handler(payload, ac.signal))
+                .then(() => hook.handler(payload, ac.signal, { config: call.config }))
                 .then((v) => ({ v }), (err) => ({ err }));
             const result = await Promise.race([handled, timedOut, abort.aborted]);
             if (result === "timeout") {

package/dist/extensions/host.d.ts

@@ -10,9 +10,12 @@ import { KernelConfigService } from "../infra/config/kernel-config.service.js";
 import { KernelDb } from "../infra/database/kernel-db.js";
 import { LockService } from "../infra/lock/lock.service.js";
 import type { KernelLogger } from "../log.js";
+import { ModelEmbeddings } from "../models/embeddings.js";
 import { EmbedTokens } from "../ui/embed-token.js";
 import type { UiActionHandler, UiRender } from "../ui/registry.js";
 import { ExtensionApprovals, type PendingExtension } from "./approvals.js";
+import { deploymentConfigHash } from "./config-hash.js";
+import { EffectiveConfigs } from "./effective-config.js";
 import { HookRegistry } from "./hooks.js";
 import type { InflightTracker } from "./inflight.js";
 import { type DesiredExtension, ExtensionInstalls } from "./installs.js";
@@ -20,15 +23,7 @@ import { type ExtensionInstance } from "./instance.js";
 import { type PermissionSet } from "./permission-set.js";
 import { type ExtensionPointEntry, ExtensionRegistry } from "./registry.js";
 import { type ExtensionSource, ReplicaStatusStore } from "./sources.js";
-/**
- * 插件部署配置（校验后）中非密钥部分的摘要：先把 schema 里所有 secret 叶子（`configFields` 可达路径，
- * 加载时 `assertSecretsReachable` 已保证密钥都在这些路径上）换成固定占位值，再取 sha256(键排序 JSON) 前 16 位十六进制。
- * 给需要「配置变了就失效」的缓存键用（如模型列表）。密钥不参与摘要：不加盐的短摘要写进 Redis 键名后，
- * 低熵密钥可被离线猜测、泄露的密钥可被确认；代价是轮换密钥不会让缓存失效（缓存内容本来就不该依赖密钥）。
- * 没有部署配置 schema 时无从得知哪些是密钥，摘要不按配置区分。同一份配置在各副本上得到同一摘要。
- * 函数自己按 schema 遮蔽，调用方不必（也不能忘记）先打码。
- */
-export declare function deploymentConfigHash(schema: core.$ZodType | undefined, config: unknown): string;
+export { deploymentConfigHash };
 /** One item of {@link ExtensionHost.uiContributions}: a UI contribution from the manifest with its registered view / action (embeds have none). */
 export interface LoadedUiContribution {
     plugin: string;
@@ -112,6 +107,11 @@ export declare class ExtensionHost {
     private readonly status;
     private readonly config;
     private readonly log;
+    /**
+     * Each hook call's effective config for its organization, and the providers excluded from an
+     * org's point resolution (layering spec A §6).
+     */
+    private readonly effective;
     /**
      * Only resolves extensions and runs migrations in dependency order: no deployment config check, no
      * setup, no Redis (for `capybara migrate`). Like `load()` it checks secret markers first
@@ -244,7 +244,14 @@ export declare class ExtensionHost {
      */
     installs: ExtensionInstalls, approvals: ExtensionApprovals, 
     /** This replica's load status table (`extension_replica_status`): every load result writes a row. */
-    status: ReplicaStatusStore, config: KernelConfigService, kdb: KernelDb, redis: Redis, busSubscriber: BusSubscriber, keyring: Keyring, embedTokens: EmbedTokens, locks: LockService, log: KernelLogger, options: Pick<KernelAppOptions, "resolveFrom">);
+    status: ReplicaStatusStore, config: KernelConfigService, kdb: KernelDb, redis: Redis, busSubscriber: BusSubscriber, keyring: Keyring, embedTokens: EmbedTokens, locks: LockService, log: KernelLogger, options: Pick<KernelAppOptions, "resolveFrom">, 
+    /**
+     * Each hook call's effective config for its organization, and the providers excluded from an
+     * org's point resolution (layering spec A §6).
+     */
+    effective: Pick<EffectiveConfigs, "get">, 
+    /** `ctx.models`: the embeddings broker (spec B §5.4). */
+    models: Pick<ModelEmbeddings, "embed" | "describe">);
     /** The startup config's `extensionConfig` (file / Nacos merged with env). */
     private get extensionConfig();
     /** `extensionPermissions.autoApprove` (development and trials only; see `planApprovals`). */
@@ -489,6 +496,13 @@ export declare class ExtensionHost {
      * （如 `identity-source@1` 的登录配置）；未加载返回 undefined。不得回显到响应或日志。
      */
     deploymentConfig(plugin: string): unknown;
+    /**
+     * The raw (unparsed) deployment config of a running extension: the startup config merged with
+     * the PG values, as the host reads it before parsing (secrets included; never echo it). An org
+     * copy is applied to this and parsed once (layering spec A §6), so schema transforms are not
+     * run twice. Without a running instance, the stored values without a schema.
+     */
+    rawDeploymentConfig(plugin: string): Promise<unknown>;
     /**
      * 本副本拿得到的插件清单里的部署级 schema（生效实例 → 配置声明 → 安装记录准备好的候选）；
      * 都没有返回 undefined（如未加载的安装记录：调用方改用包内静态清单）。

package/dist/extensions/host.js

@@ -7,14 +7,13 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
 var __param = (this && this.__param) || function (paramIndex, decorator) {
     return function (target, key) { decorator(target, key, paramIndex); }
 };
-import { createHash } from "node:crypto";
 import { readFile } from "node:fs/promises";
 import { createRequire } from "node:module";
 import { dirname, isAbsolute, join, resolve as resolvePath } from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import { EXTENSION_POINT_CARDINALITY, parseExtensionPoint, SDK_VERSION, } from "@capybara-hq/plugin-sdk";
 import { Inject, Injectable } from "@nestjs/common";
-import { changedPaths, configFields, getPath, secretValues, setPath, unreachableSecrets, } from "../config/fields.js";
+import { changedPaths, configFields, secretValues, unreachableSecrets } from "../config/fields.js";
 import { pluginSchemaName, queryEnabledPlugins, } from "../ctx/create-ctx.js";
 import { kernelDb } from "../db/kernel-schema.js";
 import { migrate } from "../db/migrator.js";
@@ -25,57 +24,26 @@ import { KernelDb } from "../infra/database/kernel-db.js";
 import { LockService } from "../infra/lock/lock.service.js";
 import { KERNEL_LOGGER, KEYRING, REDIS, REDIS_SUBSCRIBER } from "../infra/tokens.js";
 import { KERNEL_APP_OPTIONS } from "../lifecycle/tokens.js";
+import { ModelEmbeddings } from "../models/embeddings.js";
 import { packagePath } from "../packages/tgz.js";
 import { EmbedTokens } from "../ui/embed-token.js";
 import { ExtensionApprovals, planApprovals, readSnapshots, withPreApproved, } from "./approvals.js";
 import { ExtensionBlobIntegrityError } from "./blobs.js";
+import { deploymentConfigHash } from "./config-hash.js";
 import { toIssues } from "./config-issues.js";
 import { configFormSchema, describeConfigUiProblems } from "./config-json-schema.js";
+import { EffectiveConfigs } from "./effective-config.js";
 import { HookRegistry } from "./hooks.js";
 import { ExtensionInstalls } from "./installs.js";
 import { ImportTracker, importExtensionModule, ManifestMismatchError, matchesSection, setupInstance, warnUpgrades, } from "./instance.js";
+import { parseLoadGate } from "./org-levels.js";
 import { declaredDisplayName, permissionSetOfSection, readMigrationSql } from "./package.js";
 import { blockingKeys, computePermissionSet, UI_VIEW_KEY_PREFIX, } from "./permission-set.js";
 import { ExtensionRegistry } from "./registry.js";
 import { ExtensionResolveError, resolveExtensions } from "./resolve.js";
 import { ReplicaStatusStore, } from "./sources.js";
 import { PackageShaMismatchError, packageRootOf } from "./sync.js";
-/** 键排序后的 JSON（对象键顺序不影响结果）；undefined 字段与 JSON.stringify 一样省略。 */
-const canonicalJson = (v) => {
-    if (Array.isArray(v))
-        return `[${v.map((x) => (x === undefined ? "null" : canonicalJson(x))).join(",")}]`;
-    if (v !== null && typeof v === "object") {
-        const entries = Object.entries(v)
-            .filter(([, x]) => x !== undefined)
-            .sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0));
-        return `{${entries.map(([k, x]) => `${JSON.stringify(k)}:${canonicalJson(x)}`).join(",")}}`;
-    }
-    return JSON.stringify(v) ?? "null";
-};
-/** 遮蔽 secret 字段后参与摘要的固定占位值。 */
-const SECRET_PLACEHOLDER = "<secret>";
-/**
- * 插件部署配置（校验后）中非密钥部分的摘要：先把 schema 里所有 secret 叶子（`configFields` 可达路径，
- * 加载时 `assertSecretsReachable` 已保证密钥都在这些路径上）换成固定占位值，再取 sha256(键排序 JSON) 前 16 位十六进制。
- * 给需要「配置变了就失效」的缓存键用（如模型列表）。密钥不参与摘要：不加盐的短摘要写进 Redis 键名后，
- * 低熵密钥可被离线猜测、泄露的密钥可被确认；代价是轮换密钥不会让缓存失效（缓存内容本来就不该依赖密钥）。
- * 没有部署配置 schema 时无从得知哪些是密钥，摘要不按配置区分。同一份配置在各副本上得到同一摘要。
- * 函数自己按 schema 遮蔽，调用方不必（也不能忘记）先打码。
- */
-export function deploymentConfigHash(schema, config) {
-    let redacted = null;
-    if (schema) {
-        redacted = structuredClone(config);
-        if (redacted !== null && typeof redacted === "object") {
-            for (const f of configFields(schema)) {
-                if (f.meta?.secret && getPath(redacted, f.path) !== undefined) {
-                    setPath(redacted, f.path, SECRET_PLACEHOLDER);
-                }
-            }
-        }
-    }
-    return createHash("sha256").update(canonicalJson(redacted)).digest("hex").slice(0, 16);
-}
+export { deploymentConfigHash };
 const CLOSED_DURING_LOAD = "plugin host closed during load";
 /** 停机时等进行中的 unload / reload 的上限（之后直接关闭 setup 中的 ctx、撤销其余实例）。 */
 const CLOSE_LIFECYCLE_WAIT_MS = 2_000;
@@ -172,7 +140,7 @@ function warnPending(log, p) {
             : "extension not loaded: a required extension point is only provided by extensions awaiting permission approval", { plugin: p.plugin, version: p.version, blockedBy: p.blockedBy });
         return;
     }
-    log.warn("extension not loaded: permissions awaiting approval (an enterprise admin approves it in the admin console, or run `capybara extensions review`, then `capybara extensions approve <name>`; running replicas load it without a restart)", { plugin: p.plugin, version: p.version, reason: p.reason, added: p.added, removed: p.removed });
+    log.warn("extension not loaded: permissions awaiting approval (a super admin approves it in the admin console, or run `capybara extensions review`, then `capybara extensions approve <name>`; running replicas load it without a restart)", { plugin: p.plugin, version: p.version, reason: p.reason, added: p.added, removed: p.removed });
 }
 /**
  * 跑单个插件的迁移（`migrationsDir` 为迁移目录的绝对路径；没有迁移时为 undefined）；返回已应用的文件，
@@ -235,6 +203,7 @@ let ExtensionHost = class ExtensionHost {
     status;
     config;
     log;
+    effective;
     /**
      * Only resolves extensions and runs migrations in dependency order: no deployment config check, no
      * setup, no Redis (for `capybara migrate`). Like `load()` it checks secret markers first
@@ -407,14 +376,32 @@ let ExtensionHost = class ExtensionHost {
      */
     installs, approvals, 
     /** This replica's load status table (`extension_replica_status`): every load result writes a row. */
-    status, config, kdb, redis, busSubscriber, keyring, embedTokens, locks, log, options) {
+    status, config, kdb, redis, busSubscriber, keyring, embedTokens, locks, log, options, 
+    /**
+     * Each hook call's effective config for its organization, and the providers excluded from an
+     * org's point resolution (layering spec A §6).
+     */
+    effective, 
+    /** `ctx.models`: the embeddings broker (spec B §5.4). */
+    models) {
         this.registry = registry;
         this.installs = installs;
         this.approvals = approvals;
         this.status = status;
         this.config = config;
         this.log = log;
+        this.effective = effective;
         const c = config.get();
+        this.hooks = new HookRegistry({
+            instances: () => this.registry.all(),
+            current: (plugin) => this.registry.current(plugin),
+            expectedPolicy: (mount) => this.expectedPolicy(mount),
+            enabledPlugins: (orgId) => this.enabledPlugins(orgId),
+            effectiveConfig: (orgId, plugin) => effective.get(orgId, plugin),
+            locks,
+            config: () => ({ hooks: { timeoutMs: this.config.get().hooks.timeoutMs } }),
+            log,
+        });
         this.deps = {
             db: kdb.pool,
             dbUrl: c.db.url,
@@ -424,19 +411,13 @@ let ExtensionHost = class ExtensionHost {
             redisUrl: c.redis.url,
             keyring,
             embedTokens,
+            models,
+            // ctx.models.embed fires model.request through the same registry (spec B §5.4)
+            hooks: this.hooks,
             locks,
             runWorkers: c.roles.includes("worker"),
             log,
         };
-        this.hooks = new HookRegistry({
-            instances: () => this.registry.all(),
-            current: (plugin) => this.registry.current(plugin),
-            expectedPolicy: (mount) => this.expectedPolicy(mount),
-            enabledPlugins: (orgId) => this.enabledPlugins(orgId),
-            locks,
-            config: () => ({ hooks: { timeoutMs: this.config.get().hooks.timeoutMs } }),
-            log,
-        });
         this.registry.onChange(() => {
             this.installedCache = undefined;
         });
@@ -1190,7 +1171,9 @@ let ExtensionHost = class ExtensionHost {
             return undefined;
         }
         let config = raw;
-        const parsed = readConfig ? schema?.safeParse(raw) : undefined;
+        // the load gate (spec A §5.4a): overridable fields may stay empty on the platform, so
+        // `ctx.config` may lack them; hidden and read-only fields must be complete
+        const parsed = readConfig && schema ? parseLoadGate(schema, raw) : undefined;
         if (a.source !== "install")
             this.configValidity.set(name, parsed?.success ?? true);
         if (decision.action === "pending") {
@@ -1365,7 +1348,7 @@ let ExtensionHost = class ExtensionHost {
                 permissions: d.set,
                 configurable: schema !== undefined,
                 configValid: this.configValidity.get(name) ??
-                    (schema ? schema.safeParse(this.extensionConfig[name] ?? {}).success : true),
+                    (schema ? parseLoadGate(schema, this.extensionConfig[name] ?? {}).success : true),
                 displayName: this.declaredDisplayNames.get(name) ?? null,
             };
         });
@@ -1604,6 +1587,7 @@ let ExtensionHost = class ExtensionHost {
             .all()
             .flatMap((i) => i.provided.has(ref) ? [{ plugin: i.name, impl: i.provided.get(ref) }] : []),
         enabledPlugins: (orgId) => this.enabledPlugins(orgId),
+        configOk: async (orgId, plugin) => (await this.effective.get(orgId, plugin)).ok,
     };
     get loadDeps() {
         return {
@@ -1711,6 +1695,15 @@ let ExtensionHost = class ExtensionHost {
     deploymentConfig(plugin) {
         return this.registry.deploymentConfig(plugin);
     }
+    /**
+     * The raw (unparsed) deployment config of a running extension: the startup config merged with
+     * the PG values, as the host reads it before parsing (secrets included; never echo it). An org
+     * copy is applied to this and parsed once (layering spec A §6), so schema transforms are not
+     * run twice. Without a running instance, the stored values without a schema.
+     */
+    rawDeploymentConfig(plugin) {
+        return this.rawConfigOf(plugin, this.registry.current(plugin)?.manifest.config?.deployment);
+    }
     /**
      * 本副本拿得到的插件清单里的部署级 schema（生效实例 → 配置声明 → 安装记录准备好的候选）；
      * 都没有返回 undefined（如未加载的安装记录：调用方改用包内静态清单）。
@@ -1746,7 +1739,7 @@ let ExtensionHost = class ExtensionHost {
                 if (schema) {
                     try {
                         const raw = await this.rawConfigOf(plugin, schema);
-                        this.configValidity.set(plugin, schema.safeParse(raw).success);
+                        this.configValidity.set(plugin, parseLoadGate(schema, raw).success);
                     }
                     catch (err) {
                         this.log.warn("cannot read the stored deployment config of plugin", {
@@ -1768,7 +1761,7 @@ let ExtensionHost = class ExtensionHost {
                 this.log.error("cannot read the stored deployment config of plugin; keeping its current config", { plugin, err });
                 return "invalid";
             }
-            const r = schema.safeParse(raw);
+            const r = parseLoadGate(schema, raw);
             if (!r.success) {
                 this.log.warn("plugin deployment config changed but is invalid on this replica; keeping the current config", {
                     plugin,
@@ -2178,6 +2171,8 @@ ExtensionHost = __decorate([
     __param(9, Inject(EmbedTokens)),
     __param(10, Inject(LockService)),
     __param(11, Inject(KERNEL_LOGGER)),
-    __param(12, Inject(KERNEL_APP_OPTIONS))
+    __param(12, Inject(KERNEL_APP_OPTIONS)),
+    __param(13, Inject(EffectiveConfigs)),
+    __param(14, Inject(ModelEmbeddings))
 ], ExtensionHost);
 export { ExtensionHost };

package/dist/extensions/installs.d.ts

@@ -1,10 +1,11 @@
 import { type PluginExtensionSection } from "@capybara-hq/plugin-sdk";
 import type { core } from "zod";
 import type { Keyring } from "../ctx/secrets.js";
-import { EnterpriseAdminLock } from "../identity/enterprise-admin.js";
+import { SuperAdminLock } from "../identity/super-admin.js";
 import { KernelConfigService } from "../infra/config/kernel-config.service.js";
 import { KernelDb } from "../infra/database/kernel-db.js";
 import { TransactionHost } from "../infra/database/transaction-host.js";
+import { OrgLock } from "../orgs/org-lock.js";
 import { type ProvenanceResult } from "../packages/provenance.js";
 import { ExtensionApprovals } from "./approvals.js";
 import { ExtensionBlobs } from "./blobs.js";
@@ -83,7 +84,7 @@ export interface IngestSource {
 export declare class ExtensionInstalls {
     private readonly db;
     readonly txHost: TransactionHost;
-    /** The enterprise admin lock (identity/enterprise-admin.ts): joins the transaction. */
+    /** The super admin lock (identity/super-admin.ts): joins the transaction. */
     private readonly adminLock;
     private readonly blobs;
     private readonly approvals;
@@ -91,11 +92,15 @@ export declare class ExtensionInstalls {
     private readonly registry;
     private readonly config;
     private readonly keyring;
+    /** The owner org's lock: an org upload re-checks its org admin instead (ruling P3-10). */
+    private readonly orgLock;
     constructor(db: KernelDb, txHost: TransactionHost, 
-    /** The enterprise admin lock (identity/enterprise-admin.ts): joins the transaction. */
-    adminLock: EnterpriseAdminLock, blobs: ExtensionBlobs, approvals: ExtensionApprovals, 
+    /** The super admin lock (identity/super-admin.ts): joins the transaction. */
+    adminLock: SuperAdminLock, blobs: ExtensionBlobs, approvals: ExtensionApprovals, 
     /** The config-declared extension names (an install cannot take them, C15). */
-    registry: ExtensionRegistry, config: KernelConfigService, keyring: Keyring);
+    registry: ExtensionRegistry, config: KernelConfigService, keyring: Keyring, 
+    /** The owner org's lock: an org upload re-checks its org admin instead (ruling P3-10). */
+    orgLock: OrgLock);
     /**
      * An extension's effective deployment config, not validated yet (C10): the startup config
      * (`fileValue`, file / Nacos merged with env) completed by the fields stored in PG; merged by
@@ -112,19 +117,26 @@ export declare class ExtensionInstalls {
      * - extension name equal to a config-declared one -> `extension.config_declared`;
      * - an install record of the same name comes from another npm package -> `extension.name_conflict`
      *   (a new version of the same package is an upgrade, handled elsewhere).
-     * `actor` null means the CLI (no enterprise admin re-check, audit without an actor).
+     * `actor` null means the CLI (no super admin re-check, audit without an actor). `owner`: an org
+     * upload (spec §14, P3-10): the actor is re-checked as an org admin of that org (`catalog.upload`)
+     * instead of a super admin; the package is only stored, as always (nothing runs, no install).
      */
     ingest(actor: string | null, bytes: Uint8Array, src: IngestSource, opts?: {
         actorTokenId?: string;
         store?: "object" | "pg";
         expectPackageName?: string;
+        owner?: {
+            orgId: string;
+        };
     }): Promise<PackageReview>;
     /**
-     * The enterprise admin re-check under its lock, in a transaction of its own (`requires_new`, as
+     * The super admin re-check under its lock, in a transaction of its own (`requires_new`, as
      * before the conversion): the package write that follows never runs inside a caller's
      * transaction holding the lock.
      */
     private authorize;
+    /** The super admin, or for an org upload the owner org's admin, re-checked under its lock. */
+    private authorizeIn;
     /**
      * The `extension.package_uploaded` audit, re-checking the actor under the lock, committed on its
      * own (`requires_new`): the stored package it records is not rolled back by a caller either.
@@ -138,7 +150,7 @@ export declare class ExtensionInstalls {
     /**
      * Fetches one package from the configured npm registry (verified by `dist.integrity`, see
      * packages/npm.ts), downloading only, not storing: download failure -> `packages.npm_failed` (502);
-     * over `packages.maxBytes` -> `extension.package_too_large`. Enterprise catalog npm imports use it
+     * over `packages.maxBytes` -> `extension.package_too_large`. Platform catalog npm imports use it
      * too.
      */
     fetchNpm(input: {