@sema-agent/server 3.0.0 → 3.2.0

package/README.md

@@ -132,7 +132,7 @@ The server is configured entirely through environment variables. The most import
 | `PORT` | `8090` | HTTP listen port |
 | `BIND_HOST` (alias `HOST`) | see note | Listen address. An explicit value **always wins**. Default: `127.0.0.1` when the write face is unauthenticated (`ALLOW_UNAUTHED_WRITES=true` **and** no service token configured), otherwise all interfaces — deployments with a token are unaffected. |
 | `MODEL_GATEWAY_BASEURL` | `http://127.0.0.1:8000/v1` | OpenAI-compatible gateway base URL (without `/chat/completions`) |
-| `MODEL_ID` | **required** | Default model id — **no factory default since 3.0.0**. Unset ⇒ the server refuses to boot with a message naming the knob (the old baked-in default was an internal-only model name, so every external deployment failed later and further from the cause: a gateway `400` plus a cascade of title-hook warnings). Set it to whatever model name your gateway serves, or supply the catalog via the sema-registry control plane |
+| `MODEL_ID` | **required** | Default model id — **no factory default since 3.0.0**. Unset ⇒ the server refuses to boot with a message naming the knob (the old baked-in default was an internal-only model name, so every external deployment failed later and further from the cause: a gateway `400` plus a cascade of title-hook warnings). Set it to whatever model name your gateway serves, or supply the catalog via the config-center control plane |
 | `MODEL_API_KEY` | — | Gateway API key (optional) |
 | `SERVICE_AUTH_TOKEN` | — | Callers must send `Authorization: Bearer <token>` |
 | `DB_BACKEND` | `local`* | `mysql` (any MySQL-protocol DB: MySQL/TiDB/MariaDB; `tidb` alias) / `pg` (PostgreSQL) / `local` (file-backed, no DB) / `memory` (explicit in-memory: nothing survives a restart, durable-runs faces 501). *Bare boot (no DB env at all) defaults to `local` so a single-user machine keeps its runs across restarts; any SQL signal (`SESSION_BACKEND` or `TIDB_/MYSQL_/PG_HOST`) keeps the `mysql` engine default, and `REQUIRE_PRINCIPAL=true` bare boots stay `memory` (the local file store has no tenant isolation — a warning says so). A DEFAULT-derived `local` that cannot create its data root degrades to memory with a warning + the `store_backend_degraded` gauge; an EXPLICIT `DB_BACKEND=local` fails loud instead. Setting `mysql`/`pg` explicitly also switches sessions to durable |

package/README.zh-CN.md

@@ -125,7 +125,7 @@ curl -s localhost:8090/v1/tasks -H "Authorization: Bearer <SERVICE_AUTH_TOKEN>"
 | `PORT` | `8090` | HTTP 监听端口 |
 | `BIND_HOST`(兼容 `HOST`) | 见说明 | 监听地址。显式值**恒生效**。缺省:写面无鉴权时(`ALLOW_UNAUTHED_WRITES=true` **且**未配任何 service token)= `127.0.0.1`,否则全接口——配了 token 的部署不受影响。 |
 | `MODEL_GATEWAY_BASEURL` | `http://127.0.0.1:8000/v1` | OpenAI 兼容网关地址(不带 `/chat/completions`) |
-| `MODEL_ID` | **必填** | 缺省模型 id ——**3.0.0 起无出厂缺省**。未设 = 启动即失败并指路该旋钮(旧的烤死缺省是内网模型名,外部部署必炸且炸在离根因最远处:网关 `400` + 标题 hook 连环告警)。填你的网关真正提供的模型名,或改由 sema-registry 控制面下发目录 |
+| `MODEL_ID` | **必填** | 缺省模型 id ——**3.0.0 起无出厂缺省**。未设 = 启动即失败并指路该旋钮(旧的烤死缺省是内网模型名,外部部署必炸且炸在离根因最远处:网关 `400` + 标题 hook 连环告警)。填你的网关真正提供的模型名,或改由配置控制面下发目录 |
 | `MODEL_API_KEY` | — | 网关 key(可选) |
 | `SERVICE_AUTH_TOKEN` | — | 调用方需带 `Authorization: Bearer <token>` |
 | `DB_BACKEND` | `mysql` | SQL 引擎:`mysql`(任何 MySQL 协议库:MySQL/TiDB/MariaDB;`tidb` 为兼容别名)/ `pg`(PostgreSQL)/ `local`(免 DB 文件持久化)。显式设置 `mysql`/`pg` 时 session 自动转 durable |

package/USAGE.md

@@ -78,11 +78,11 @@ MODEL_DEGRADE_REACTIVE=true           # ② 反应式(1.39):主模型 rate_limit
 MODEL_DEGRADE_ON=rate_limit,breaker_open   # 可选,反应式触发器子集;默认两者都开
 ```
 - 反应式降级 brain 包在**最外层**(core council #8);fallback brain 用自己的凭据(decorator 清掉主模型的 per-call key 防泄漏给别的 provider)。**坑**:`MODEL_DEGRADE_TO` 最好别和被限流的是同一网关/账号,否则反应式切过去照样撞同一个 rate_limit。
-- **定价怎么设**:`model.cost` 来自 `MODEL_COST_INPUT/OUTPUT/CACHE_READ/CACHE_WRITE`(**USD per 1M tokens**,默认 0 = `costUsd` 读 0)。云模型(如 review-gw 的 deepseek-v4-pro)必须设,否则 spend 恒为 $0;本地自托管(qwen)留 0 即对(无 per-token 外部花费)。字段名是 `costUsd`,**非美元计价的网关要先折算**(如 DeepSeek 官方 CNY ÷ 汇率)。sema-registry 管的模型走 `CenterModel.cost`(中心存价、不存 secret)。
+- **定价怎么设**:`model.cost` 来自 `MODEL_COST_INPUT/OUTPUT/CACHE_READ/CACHE_WRITE`(**USD per 1M tokens**,默认 0 = `costUsd` 读 0)。云模型(如 review-gw 的 deepseek-v4-pro)必须设,否则 spend 恒为 $0;本地自托管(qwen)留 0 即对(无 per-token 外部花费)。字段名是 `costUsd`,**非美元计价的网关要先折算**(如 DeepSeek 官方 CNY ÷ 汇率)。配置控制面管的模型走 `CenterModel.cost`(中心存价、不存 secret)。
 - 成本计量**自动开**:从 config 的 `model.cost`(per-1M 绝对 USD)注入 `pricing`,core 算出权威的整数 `costMicroUsd`(避免浮点累计误差)。`/metrics` 新增:`model_cost_micro_usd_total{model}`(覆盖所有 brain 调用=主任务+异步+council 子任务的总花费)、`brain_first_token_ms`(网关 hang 早警)、`brain_call_latency_ms`、`tool_calls_total{name,ok}`、`budget_exceeded_total{code}`、`cost_quota_rejected_total`、`degraded_total{reason}`(1.40 降级)。
 - **近预算降级 vs 硬闸**:降级(`MODEL_DEGRADE_TO`,到 `atCostFraction` 切便宜模型)是**撑长**预算、任务仍完成(出口质量下降、发 `task.degraded` 事件可告警);硬闸(`maxCostUsd` 全额)仍在,切了便宜模型还超全额 → `budget.exceeded` 停。
-- **`METRICS_TOKEN`**(可选,只读):设了它,`GET /metrics`+`/metrics/summary` 接受**它或** `SERVICE_AUTH_TOKEN`。**全 fleet 设同一个值** → 控制面(sema-registry)用**一个** token 拉所有 worker 的指标,**无需持有各 worker 的全权 `SERVICE_AUTH_TOKEN`**(不破坏 secret 边界)。即使泄露也只暴露指标(只读)。
-- **`GET /metrics/summary`**(token-gated,同 `/metrics`):`/metrics` 的**精炼 JSON**——`{model, runsActive, tasks{status}, tokensTotal, costUsd, costUsdByModel, taskDurationAvgSec, brainFirstTokenAvgMs, brainCallAvgMs, cacheHitRateAvg, rateLimited, costQuotaRejected, budgetExceeded, degraded, cascade, verifications, councilRuns, toolErrors}`。给**轻量 fleet 看板**用(sema-registry 的 fleet 页按 worker 拉、渲染卡片、按轮询算速率;**不用 Prometheus/Grafana**)。counter 是累计值、histogram 报均值。
+- **`METRICS_TOKEN`**(可选,只读):设了它,`GET /metrics`+`/metrics/summary` 接受**它或** `SERVICE_AUTH_TOKEN`。**全 fleet 设同一个值** → 管理端(sema-web,规划名 sema-admin)用**一个** token 拉所有 worker 的指标,**无需持有各 worker 的全权 `SERVICE_AUTH_TOKEN`**(不破坏 secret 边界)。即使泄露也只暴露指标(只读)。
+- **`GET /metrics/summary`**(token-gated,同 `/metrics`):`/metrics` 的**精炼 JSON**——`{model, runsActive, tasks{status}, tokensTotal, costUsd, costUsdByModel, taskDurationAvgSec, brainFirstTokenAvgMs, brainCallAvgMs, cacheHitRateAvg, rateLimited, costQuotaRejected, budgetExceeded, degraded, cascade, verifications, councilRuns, toolErrors}`。给**轻量 fleet 看板**用(管理端 sema-web 的 fleet 页按 worker 拉、渲染卡片、按轮询算速率;**不用 Prometheus/Grafana**)。counter 是累计值、histogram 报均值。
 - 预算闸是 core 强制的:`maxCostUsd` pre-call 估算(`budget.precall`,没花钱就拒)+ 流中途取消 + turn 边界(`budget.exceeded`);`maxTokens` 超 → `budget.exceeded`。**review 网关**建议设 `MAX_TASK_COST_USD` 防单任务烧掉共享云 key。
 - **per-principal 累计配额**:用 `AsyncLocalStorage` 把 principal 透传到 cost tracer,所以**council/team 子任务的花费也算到发起人头上**。**配了 `SESSION_BACKEND=tidb` 时自动跨副本共享**(`cost_quota` 表,写后聚合的**原子自增** `micro=micro+delta`,对齐固定窗,最终一致——多副本花费 SUM 到一起、不丢增量);否则 in-memory per-replica 滚动窗(单副本兜底)。启动日志 `costQuota` 字段回显 `shared(tidb)`/`in-process`/`off`。跨副本是最终一致(flush 间隔内峰值可能略超,由**硬 per-task `maxCostUsd` 兜底**)。
 - **`RATE_LIMIT_RPM` 请求限流同样自动跨副本**(`SESSION_BACKEND=tidb` 时,`rate_limit` 表,与配额共用 `WriteBehindCounter`;启动日志 `rateLimit` 回显)。注意:写后聚合 = **软限流**(边界上短暂略超 OK,适合公平/热调用方防护);要**硬合规上限**得另走 CAS/原子计数,不靠写后聚合——和断路器跨副本同款权衡。
@@ -130,7 +130,7 @@ MODEL_CODE_ROLES=default,subagent     # 不设=全中立;仅这些角色在「
 MODEL_CASCADE_LADDER=deepseek-flash,deepseek-pro   # 目录里的模型名,cheapest→strongest;不设=cascade 不可用
 ```
 - 结果带 `cascadeOutcome:"passed"|"exhausted"` + `escalated`/`finalRung`/`attempts[]`。`/metrics` 加 `cascade_total{outcome}`。
-- **每档用自己的上游 key**:从 sema-registry 模型的 `apiKeyEnv`(env 变量**名**,非密钥值)解析——同一网关下不同模型/账号各用各的 key,没配 `apiKeyEnv` 的模型回落到网关 key(`MODEL_API_KEY`)。`baseUrl` 仍由 brain 层统一持有(非目标)。启动日志 `perModelKeys=N` 报有几个模型带了自己的 key。
+- **每档用自己的上游 key**:从配置控制面模型的 `apiKeyEnv`(env 变量**名**,非密钥值)解析——同一网关下不同模型/账号各用各的 key,没配 `apiKeyEnv` 的模型回落到网关 key(`MODEL_API_KEY`)。`baseUrl` 仍由 brain 层统一持有(非目标)。启动日志 `perModelKeys=N` 报有几个模型带了自己的 key。
 
 **嵌入形契约(1.309+;桌面宿主把引擎作为依赖内嵌启动的正门)**
 - 入口:`import "@sema-agent/server/main"`(exports 正门;此前宿主只能用 node_modules 路径字符串定位
@@ -184,16 +184,16 @@ SEND_USER_FILE_SANDBOX_PUT_ENDPOINT=…         # 可选:沙箱直传 PUT 的端
 - **执行 lane 与租户门**:e2b/k8s 沙箱 lane 任意租户可用(沙箱文件系统=租户边界,沙箱内 `curl -T` 直传、字节不中转、凭据不进沙箱);host/ssh lane 仅单用户部署(`REQUIRE_PRINCIPAL` 未开)时挂载。
 - **web 侧感知**:`GET /v1/capabilities` 透出 `sendUserFile`(READY 语义:工具真挂载**且**公网端点在场——调用真能成功才 yes)与 `s3PublicEndpoint`(渲染用公网 base;绝不透出密钥/内网端点)。
 
-**可选 — 接 sema-registry(中心化模型/角色/团队配置)**
+**可选 — 接配置控制面(中心化模型/角色/团队配置)**
 ```bash
 # 新名(orchestrator 现注入);旧名 CONFIG_CENTER_* 仍兼容(dual-read,新名优先、旧名回退)
-SEMA_REGISTRY_URL=http://<sema-registry-host>:3100   # 启动拉 GET /api/config/effective(Bearer+ETag),覆盖 env 兜底
-SEMA_REGISTRY_TOKEN=<SERVICE_PULL_TOKEN 的值>   # 取自 sema-registry 主机 .env;只读拉取令牌
+SEMA_REGISTRY_URL=http://<config-center-host>:3100   # 启动拉 GET /api/config/effective(Bearer+ETag),覆盖 env 兜底
+SEMA_REGISTRY_TOKEN=<SERVICE_PULL_TOKEN 的值>   # 取自配置控制面主机 .env;只读拉取令牌
 SEMA_REGISTRY_DRY_RUN=true                     # 安全灰度:只 LOG 中心配置 vs env 推导的差异,不 apply
 SEMA_REGISTRY_WORKER=<worker名>                # 可选:拉取 /effective?worker=<名> 取该 worker 的 roster(reconciler 按 worker 注);不设=全局 roster(向后兼容)
 ```
 - 中心**空/未发布** → `applyEffective` 回落 env + 内建 teams 并 warn `config_center_unpublished`,**不影响在跑的服务**(接了也安全)。
-- **灰度姿势**(sema-registry AI 建议):先 `SEMA_REGISTRY_DRY_RUN=true` 起一轮,看日志 `sema_registry_dry_run`(中心给的 models/roles/teams + 会否覆盖 default、per-model apiKeyEnv)对得上 env 再去掉该 flag 真正 apply。
+- **灰度姿势**(配置控制面 AI 建议):先 `SEMA_REGISTRY_DRY_RUN=true` 起一轮,看日志 `sema_registry_dry_run`(中心给的 models/roles/teams + 会否覆盖 default、per-model apiKeyEnv)对得上 env 再去掉该 flag 真正 apply。
 - 拉取**只读、只取逻辑配置**(模型名册/角色/团队);密钥/网关仍在本服务 env(中心只发 env-**名** 引用,不发密钥值)。models/roles 改动需重启生效,teams 60s 热刷。回滚=去掉 `SEMA_REGISTRY_URL` 即纯 env。
 - **仅 `/v1/tasks`(同步)+ `/v1/runs`(异步)**——`/v1/tasks/stream` 不支持(多次尝试非单流,400)。与 `verify` **互斥**(同时给 → 400)。
 - 成本上界 = 任务的 `maxCostUsd`(防冷重跑税)。**三条 core 警示**:① 每档**冷重跑**重付输入成本(便宜档常过才划算);② 门收到**未脱敏**输出(自定义门转发外部 verifier 要脱敏);③ **写工具会跑 N 次**——**只用于只读/幂等任务**(每次升级整任务重跑)。开放式任务(找全 bug/文笔)没有可判定 oracle、级联会空转,那种用 `team`(广度对抗)而非级联(深度阶梯)。
@@ -239,6 +239,10 @@ SEMA_REGISTRY_WORKER=<worker名>                # 可选:拉取 /effective?worke
 🪦 `LSP_ENABLED=false`(拆分前唯一的 host 腿逃生舱)自 3.0.0 起是墓碑:拒启并指路 `LSP_HOST_ENABLED`。
 `LSP_ENABLED=true` 不受影响——那是沙箱腿自己的 opt-in,语义没变。
 
+**`CONFIG_REQUIRE_ROSTER=true`(3.1.0,可选,缺省关)**:远程 registry 非 dryRun 车道的 fleet worker
+可布防「roster 落地前拒接计费提交(503)」——3.0.0 起 MODEL_ID 必填,每个 worker 都带 boot 模型起服,
+旧的「无 env 模型即等 roster」推断失效;要那个保护语义现在需显式声明。
+
 ---
 
 ## 1. 请求与响应的通用规则
@@ -260,7 +264,7 @@ SEMA_REGISTRY_WORKER=<worker名>                # 可选:拉取 /effective?worke
 | `sessionId` | — | 续聊:带上次返回的 `sessionId`,服务端自动 wake 历史 |
 | `images` | — | 图文输入 `[{data,mimeType}|{url}]`(模型需支持 vision) |
 | `attachmentIds` | — | D-1 通用文件上传(1.289+):先 `POST /v1/attachments?name=…`(raw body,content-type=mime)拿句柄,提交时引用 ≤16 个;文件物化到执行环境工作目录 `attachments/` 下,objective 尾部自动追加文件清单(内容不进会话流)。单文件缺省 ≤32 MiB(`ATTACHMENT_MAX_BYTES`);可配 mime 白名单(`ATTACHMENT_MIME_ALLOWLIST` CSV,缺省不限);上传后未引用的按 `ATTACHMENT_UNBOUND_TTL_MS`(缺省 24h)回收。**云形态(tidb/pg)字节本体存对象存储——MinIO 必配**(`MINIO_ENDPOINT/MINIO_ACCESS_KEY/MINIO_SECRET_KEY`,与快照 lane 同一组变量),未配则附件面 501;local 形走本地文件店。 |
-| `scenario` | — | `default`(默认)/ `code-review`(见 §5)/ `scan`(同 §5 的 repo 只读工具但**中性无框架提示词**——objective+中心下发 skill 全权主导输出,OA 扫描类用)/ **sema-registry 可声明任意新场景**(`{name, toolset: none\|repo-readonly, prompt?}`,组合即配置、能力钉死在部署;restart-to-apply;center 可覆盖内建名,boot 日志 `config_center_scenarios.shadowsBuiltin` 可审计) |
+| `scenario` | — | `default`(默认)/ `code-review`(见 §5)/ `scan`(同 §5 的 repo 只读工具但**中性无框架提示词**——objective+中心下发 skill 全权主导输出,OA 扫描类用)/ **配置控制面可声明任意新场景**(`{name, toolset: none\|repo-readonly, prompt?}`,组合即配置、能力钉死在部署;restart-to-apply;center 可覆盖内建名,boot 日志 `config_center_scenarios.shadowsBuiltin` 可审计) |
 | `repo` / `council` / `debate` | — | `repo` 为 `code-review`/`scan` 必填;`council`/`debate` 仅 `code-review`,见 §5 |
 | ~~model / tools / prompt~~ | 🚫 | **不接受**——服务端注入 |
 

package/dist/approval-hmac.js

@@ -4,8 +4,7 @@
  * ./principal-jwt.ts imports {@link verifyApprovalHmac} from here for the combined proof).
  *
  * ✅ WIRED into the resolve path (was "🔴 SCAFFOLD — NOT YET WIRED" — that claim went STALE; a 2026-07-25 doc-rot
- * sweep traced the real call chain: {@link verifyApprovalHmac} ← `verifyDirectDoorProof` ← the live decide
- * routes at `http/server.ts:4796` and `:4907`). So "not wired" was wrong; "not turned on" is right, and turning it
+ * sweep traced the real call chain: {@link verifyApprovalHmac} ← `verifyDirectDoorProof` ←  * routes at `http/server.ts`(resumeCheckpoint 链;A9 拆分后行级坐标弃用,文件级指路+grep verifyDirectDoorProof 取证). So "not wired" was wrong; "not turned on" is right, and turning it
  * on is a DEPLOYMENT + KEY-PROVISIONING task (sema-registry mints/rotates the set), not a coding task.
  *
  * FULL activation chain (an independent 2026-07-25 cross-check caught the first draft of this note naming only the

package/dist/bench/s1/live-deps.js

@@ -66,7 +66,7 @@ export function liveRuntimeConfigFromEnv(env = process.env) {
     if (!(costInput > 0) || !(costOutput > 0))
         return undefined;
     return {
-        modelId: env.MODEL_ID || "deepseek-v4-pro",
+        modelId: env.MODEL_ID ?? (() => { throw new Error("MODEL_ID is required for the S1 bench harness (no factory default since server 3.0.0 — same invariant as loadConfig)"); })(),
         gatewayBaseUrl: env.MODEL_GATEWAY_BASEURL || "https://api.deepseek.com",
         deepseekApiKey,
         e2bApiKey,

package/dist/boot/config-center.d.ts

@@ -6,7 +6,7 @@ import type { LoadedSkill } from "../capabilities/skills.js";
 import { type ServiceConfig } from "../config.js";
 import type { Logger } from "../observability/logger.js";
 import type { Metrics } from "../observability/metrics.js";
-import { type RestartSignal } from "../sema-registry.js";
+import { type RestartSignal } from "../config-center/facade.js";
 export interface ConfigCenterRuntimeCtx {
     config: ServiceConfig;
     logger: Logger;
@@ -47,7 +47,8 @@ export interface ConfigCenterRuntime {
     } | undefined>) | undefined;
     /** 晚绑取值:center 提示词面(热采用,新任务边界生效)。 */
     getCenterPrompts(): PromptsDomainFaces | undefined;
-    /** boot ready 门:roster 未落地 = 计费提交 503 + /health ready:false。 */
+    /** boot ready 门:布防(`CONFIG_REQUIRE_ROSTER=true`,远程 registry 非 dryRun)且 roster 未落地 =
+     *  计费提交 503 + /health ready:false。缺省未布防 ⇒ 恒 true。 */
     modelReady(): boolean;
     /** /health.restart(orchestrator 自动重启信号)。 */
     restartState(): RestartSignal | undefined;

package/dist/boot/config-center.js

@@ -45,10 +45,10 @@ import { defaultLkgPath, defaultSkillCacheDir, saveLkg, loadLkg } from "../confi
 import { createConfigProvider, raceBootFetch, BOOT_FETCH_DEFERRED } from "../config-provider.js";
 import { createKeyResolver } from "../key-resolver.js";
 import { ensureSealedKeyStore, reportExecutionPublicKey } from "../sealed-key.js";
-import { applyEffective, mutateInPlace, logEffectiveDiff, applyCenterSkills, resolveMcpServers, restartReasons, modelPlaneChanged, planeHasActiveTiers, fetchPromptArtifact } from "../sema-registry.js";
+import { applyEffective, mutateInPlace, logEffectiveDiff, applyCenterSkills, resolveMcpServers, restartReasons, modelPlaneChanged, planeHasActiveTiers, fetchPromptArtifact } from "../config-center/facade.js";
 export async function createConfigCenterRuntime(ctx) {
     const { config, logger, metrics, localRoot } = ctx;
-    // Sema registry (sema-registry): pull the effective config on boot and apply it OVER the env
+    // Config-center: pull the effective config on boot and apply it OVER the env
     // defaults — env is the fallback. Unset or unreachable → keep the env-derived config. Applied BEFORE
     // the Runner is built so models/roles/teams take effect. (Logical config only; secrets stay in env.)
     let ccEtag;
@@ -81,10 +81,10 @@ export async function createConfigCenterRuntime(ctx) {
     // same-generation 200 recomputes reasons vs boot as [] and would otherwise silently clear the signal).
     // Set at the boot writer (R34 arms); folded into every tick's reasons; only a restart resolves it.
     let bootSkillStale = false;
-    // Sema-registry restart signal: set by the refresh loop when a pull's restart-to-apply slices
+    // Config-center restart signal: set by the refresh loop when a pull's restart-to-apply slices
     // (skills/mcp/scenarios/runtime-gates) differ from boot; read by GET /health for orchestrator auto-restart.
     let pendingRestart;
-    // DUAL-MODE-DESIGN §4: the config SOURCE is a backend-selectable seam — remote (sema-registry HTTP, the fleet
+    // DUAL-MODE-DESIGN §4: the config SOURCE is a backend-selectable seam — remote (config-center HTTP, the fleet
     // default) | local (.env + config.d via @sema-agent/registry-core FileConfigStore, the single-machine/TOC source).
     // The provider exists when SEMA_REGISTRY_URL (legacy CONFIG_CENTER_URL) is set OR CONFIG_PROVIDER=local is explicit; neither = pure-env
     // (byte-identical to before). The remote provider DELEGATES verbatim to fetchEffective, so the fleet path is
@@ -119,17 +119,24 @@ export async function createConfigCenterRuntime(ctx) {
             ...(config.configProvider === "local" ? { localDir: localRoot } : {}),
         })
         : undefined;
-    // boot ready 门 latch:仅「远程 registry 部署(非 dryRun)+ 无显式 env MODEL_ID」时等 roster——
-    // 首次 effective 落 ≥1 enabled 模型即翻 true(one-way)。其余姿势(env 模型在/local provider/dryRun/纯 env)
-    // 恒 ready=现有部署零影响。E3 废除 workers.model 后,fleet worker 的占位模型窗口由此门 fail-closed。
+    // boot ready 门 latch:布防时等中心 roster 落地——首次 effective 落 ≥1 enabled 模型即翻 true(one-way);
+    // 未布防则恒 ready。守的危险=**registry 部署的 fleet worker 在 roster 落地前拿占位模型跑计费任务**
+    // (E3 废除 workers.model 之后,占位模型正是 fleet worker 的常态起服姿势)。
     //
-    // ⚠️ 如实记账(复审 2026-07-29 C1):**server 3.0.0 起 `MODEL_ID` 是必填**(未设 = loadConfig throw,
-    // 见 config.ts parseModelDomain),所以走到这一行时 `process.env.MODEL_ID` 必非空 ⇒ 这个初值**当前恒为
-    // true**,「等 roster」那条臂在今天的配置面上不可达。保留原式不改行为,原因有二:① latch 与
-    // `markRosterLanded` 是同一套机制,删掉初值里的判据不会让代码变简单,只会让重新开门时无处可挂;
-    // ② registry 轴一旦允许「无 env MODEL_ID、模型全由中心 roster 下发」(E3 之后这正是 fleet worker 的目标
-    // 形态),这条臂就要重新活过来 —— 届时应连同 MODEL_ID 必填的口径一起重估,而不是各改各的。
-    const modelReadyState = { ready: !(cc && !cc.dryRun) || Boolean(process.env.MODEL_ID) };
+    // 🔧 复审 2026-07-29 P1-6 —— 布防判据从**推断**改成**运营者声明**。原式是
+    // `!(cc && !cc.dryRun) || Boolean(process.env.MODEL_ID)`,其中 `Boolean(process.env.MODEL_ID)` 是
+    // 3.0.0 前「运营者手上除了中心 roster 什么都没有」的代理判据。**server 3.0.0 起 `MODEL_ID` 必填**
+    // (未设 = loadConfig throw,见 config.ts parseModelDomain)⇒ 走到这一行时它必非空 ⇒ 初值恒 true ⇒
+    // 「等 roster」那条臂不可达、markRosterLanded 的门体是死码、/health 的 ready:false 与计费提交的 503
+    // 全不可能发生。注意这不是「危险消失了」:必填 MODEL_ID 恰恰让**每个** fleet worker 都带着占位模型
+    // 起服,危险比以前更常见——只是那个代理判据从此写不出来了。
+    //
+    // 于是改成显式声明:`CONFIG_REQUIRE_ROSTER=true`(与 CONFIG_LKG_* / CONFIG_BOOT_FETCH_BUDGET_MS 同族,
+    // 直读 env,不进 ServiceConfig——纯 boot 期姿势旋钮)。**缺省关 = 现有部署逐字节零变化**;开了才真的
+    // fail-closed 等 roster。仅远程 registry 且非 dryRun 车道可布防:dryRun 是 compare-only(中心 roster
+    // 从不被应用,拿它当就绪判据无意义),local provider / 纯 env 部署则没有「中心」可等。
+    const rosterGateArmed = cc !== undefined && !cc.dryRun && process.env.CONFIG_REQUIRE_ROSTER === "true";
+    const modelReadyState = { ready: !rosterGateArmed };
     const markRosterLanded = (eff) => {
         if (!modelReadyState.ready && (eff.models?.models ?? []).some((m) => m.enabled !== false)) {
             modelReadyState.ready = true;
@@ -463,12 +470,19 @@ export async function createConfigCenterRuntime(ctx) {
         }
     }
     if (!modelReadyState.ready)
-        logger.warn("model_roster_pending", { note: "registry deployment without an env model and no roster yet — billable submissions 503 until the first effective pull lands models" });
-    // Per-model API key (sema-registry `apiKeyEnv`): resolve each model's own upstream key per brain call /
+        logger.warn("model_roster_pending", {
+            note: "CONFIG_REQUIRE_ROSTER=true and no center roster has landed yet — the env MODEL_ID is treated as a PLACEHOLDER, so billable submissions 503 (and /health reports ready:false) until the first effective pull lands ≥1 enabled model. Unset the knob if this worker's env model is authoritative.",
+        });
+    // Per-model API key (config-center `apiKeyEnv`): resolve each model's own upstream key per brain call /
     // cascade rung. undefined when no per-model keys are configured → spec field stays unset (core default).
-    // `let` (not const): rebuilt on a sema-registry refresh so per-model key ADDITIONS hot-apply too (the
+    // `let` (not const): rebuilt on a config-center refresh so per-model key ADDITIONS hot-apply too (the
     // resolver is undefined when no per-model keys exist, so in-place mutation alone wouldn't cover empty→non-empty).
     let keyResolver;
+    // 复审 2026-07-29 P1-11:restart 片里唯一一块 EffectiveConfig **看不见**的输入 —— 反应式降级车道由 env
+    // (MODEL_DEGRADE_TO / MODEL_DEGRADE_REACTIVE)开关,而它焊死的是 CENTER 目录里那条模型的路由面。读成
+    // 函数而非常量:`config.degrade` 今天由 env 独占(applyEffective 不写它),但若哪天中心接管这面,这里
+    // 自动跟着走,不会退化成 boot 期快照。车道关(默认)⇒ ctx 空 ⇒ 该片恒 null ⇒ 零行为变化。
+    const restartCtx = () => (config.degrade?.reactive ? { reactiveDegradeTo: config.degrade.to } : {});
     return {
         providerKind: configProvider?.kind,
         promptSource,
@@ -794,7 +808,7 @@ export async function createConfigCenterRuntime(ctx) {
                                 // 顺序=先持久化(含 skill 正文预热,F1)再发信号;持久化失败=warn+照发(不发=配置永不生效;
                                 // 「盘坏+中心挂」双故障下环重现,接受并点名)。
                                 const lkgPersisted = await persistLkgDurable(r.effective, r.etag);
-                                const reasons = restartReasons(effective, r.effective);
+                                const reasons = restartReasons(effective, r.effective, restartCtx());
                                 // codex R35: the sticky boot skill debt rides EVERY tick's reasons — change-detection vs boot is
                                 // blind to it (the stale table IS the boot baseline). Under a no-handoff deferral it folds into
                                 // blocked (promoted later); otherwise it keeps pendingRestart alive until the restart happens.
@@ -956,7 +970,7 @@ export async function createConfigCenterRuntime(ctx) {
                     latestEffective = r.effective;
                     ccEtag = r.etag;
                     const lkgPersistedLate = await persistLkgDurable(r.effective, r.etag); // F2 parity:信号可见前落盘+skill 正文预热
-                    const reasons = restartReasons(undefined, r.effective); // (prompts 不在 restart slices——热采用已在上方 adopt)
+                    const reasons = restartReasons(undefined, r.effective, restartCtx()); // (prompts 不在 restart slices——热采用已在上方 adopt)
                     // codex R15 (late-boot twin): tiered env boot + tier-less late candidate ⇒ deferral fires but BOTH slice
                     // fingerprints reduce to null (undefined baseline, tier-less candidate) — no models-tiers reason, plane
                     // deferred forever. Deferral is the ground truth; force the reason so the orchestrator restarts and the

package/dist/boot/resolve-spec.js

@@ -40,7 +40,7 @@ import { isIsolatedExecEnv, routeServiceTask, supPostureOverrides } from "../rou
 import { gateExecutionLane } from "../runtime-caps-resolver.js";
 import { applyRuntimeGovernance, stripDelegationTools } from "../runtime-governance.js";
 import { HttpError, memorySpecForRequest } from "../security.js";
-import { mcpForScenario } from "../sema-registry.js";
+import { mcpForScenario } from "../config-center/facade.js";
 import { normalizeAttachments, normalizeResilience, normalizeResumeAtMode, normalizeSuggestNextPrompts, promptProfileFromBody, resolveTaskLimits, retainBackgroundProcessesFromBody, taskAgentsSpecFragment, toolNameListFromBody } from "../spec-fields.js";
 import { cwdHonored, effectiveHostWorkspace, inProcessSingleUserLane, isValidCwd, parseAdditionalDirectories, satisfiedByProcessCwd, shellEnvMismatchCount } from "../task-cwd.js";
 import { resolveRequestMcp } from "../task-mcp.js";
@@ -312,8 +312,8 @@ export function createResolveSpec(ctx) {
         // them to bounded text placeholders per current model (the pass-through posture above). That modality drop
         // was invisible fleet-side; count + warn at submit. modelSupportsImages is false-safe (undeclared input →
         // true → no signal), matching core's "never wrongly strip" posture — no false positives for verbatim
-        // pass-through models. ⚠️ sema-registry lane caveat (review LOW-2): the roster maps `vision?: boolean` to
-        // an EXPLICIT input list (sema-registry.ts) — a vision-capable roster model that FORGOT the flag becomes
+        // pass-through models. ⚠️ config-center lane caveat (review LOW-2): the roster maps `vision?: boolean` to
+        // an EXPLICIT input list (config-center/facade.ts) — a vision-capable roster model that FORGOT the flag becomes
         // declared text-only, so this signal fires AND core really does degrade its images (signal matches
         // behavior; the fix for that footgun is the roster entry, not this counter). The per-run durable event rides core's vision.placeholder trace kind once we
         // consume >=1.245 (the authoritative replacement-time signal), not this submit-time predictor.
@@ -586,7 +586,7 @@ export function createResolveSpec(ctx) {
             // L2 ultracode (design/111): the preset FLOORS thinking at the ultra tier (= max, via core resolveReasoningProfile);
             // awareness rides for free (core composes it from thinking∈{xhigh,max}). Else the explicit reasoningEffort.
             thinking: effectiveThinking(body.reasoningEffort, parsedSettings.settings?.ultracode === true),
-            // Per-model auth (sema-registry apiKeyEnv): core calls this per brain call / cascade rung so each
+            // Per-model auth (config-center apiKeyEnv): core calls this per brain call / cascade rung so each
             // model uses its own upstream key; a model without one falls back to the gateway key. undefined
             // when no per-model keys are configured → unchanged single-key behavior.
             getApiKeyAndHeaders: getKeyResolver(), // A10 搬运改写②:活引用取值(原 `keyResolver`)
@@ -950,7 +950,7 @@ export function createResolveSpec(ctx) {
                 throw new HttpError(400, "sandboxImageProfile is only supported on the k8s sandbox backend");
             }
             if (!imageIndex) {
-                throw new HttpError(400, "sandboxImageProfile requires the image index (sema-registry backend not configured)");
+                throw new HttpError(400, "sandboxImageProfile requires the image index (config-center backend not configured)");
             }
             if (!auth?.sessionId) {
                 throw new HttpError(400, "sandboxImageProfile requires a resolved session");

package/dist/brain.js

@@ -1,4 +1,5 @@
 import { createAnthropicBrain, createCircuitBreakerBrain, createDegradingBrain, createFailoverBrain, createOpenAIBrain, createRoutingBrain, } from "@sema-agent/core";
+import { resolveModelApiKey } from "./key-resolver.js";
 const DEFAULT_RESILIENCE = {
     // Watchdog defaults ON — mirrors config.ts env defaults so a config object without a
     // resilience block gets the same posture. connect/firstToken per the [880] fleet audit
@@ -95,20 +96,52 @@ export function createBrain(config, deps = {}) {
     // credentials (the decorator clears the primary's per-call apiKey so it can't leak to a different
     // provider). fallbackModel resolved from the catalog.
     if (config.degrade?.reactive) {
-        const fallbackModel = config.models[config.degrade.to];
+        const degradeTo = config.degrade.to;
+        const fallbackModel = config.models[degradeTo];
         if (fallbackModel) {
             // Cross-gateway degrade (audit B, brain.ts): the degrading decorator clears the per-call apiKey
             // (so the primary's key can't leak to another provider), which left the fallback authenticating
             // with the PRIMARY gateway key even when the catalog points the target at a different gateway.
-            // Resolve the target's own key at construction via the existing per-model apiKeyEnv mechanism
-            // (sema-registry catalog); `model.baseUrl` already wins inside the openai brain — pass it
-            // explicitly so the route is visible here. Unset catalog baseUrl/apiKeyEnv = same-gateway degrade
-            // (unchanged), which stays meaningful for per-model limits (e.g. deepseek pro→flash).
-            const fbKeyEnv = config.modelApiKeyEnv?.[fallbackModel.name] ?? config.modelApiKeyEnv?.[config.degrade.to];
-            const fbApiKey = (fbKeyEnv ? process.env[fbKeyEnv] : undefined) || config.gatewayApiKey;
+            // Resolve the target's own key via the SAME chain the main path uses; `model.baseUrl` already wins
+            // inside the openai brain — pass it explicitly so the route is visible here. No per-model key =
+            // same-gateway degrade (unchanged), which stays meaningful for per-model limits (e.g. deepseek pro→flash).
+            //
+            // 复审 2026-07-29(同族缺口): this resolution used to read `config.modelApiKeyEnv` ONLY — half of the
+            // main path's chain. A degrade target under sealed-box custody lands in `config.modelApiKeys` and, by the
+            // registry-core mutual-exclusion contract, NEVER in `modelApiKeyEnv` ⇒ the hop silently authenticated the
+            // target's own gateway with the PRIMARY gateway key (wrong key upstream, not fail-loud), and a poison pill
+            // (unsealable key) degraded to "no per-model key configured" = the exact silent gateway-account burn the
+            // poison pill exists to prevent. Now it calls `resolveModelApiKey` — one chain, one implementation:
+            // sealed → env-NAME reference → gateway key, poison throws.
+            const fbApiKey = () => {
+                // Two lookups for the same reason the pre-fix code had them: `degrade.to` may name the catalog's
+                // `default` alias, whose Model carries the REAL name that the key maps are keyed by (and vice versa on
+                // env-lane catalogs). Poison in either lookup throws — never falls through to the gateway key.
+                const own = resolveModelApiKey(fallbackModel.name, config.modelApiKeyEnv ?? {}, process.env, config.modelApiKeys ?? {}) ??
+                    resolveModelApiKey(degradeTo, config.modelApiKeyEnv ?? {}, process.env, config.modelApiKeys ?? {});
+                return own ?? config.gatewayApiKey;
+            };
             const fallback = fallbackModel.provider === "anthropic" && anthropicBrain
-                ? anthropicBrain
-                : createOpenAIBrain({ baseUrl: fallbackModel.baseUrl || config.gatewayBaseUrl, apiKey: fbApiKey, maxRetries: 2, fetchImpl, ...timeouts });
+                ? // Cloud Anthropic target: the shared cloud route (its own ANTHROPIC_* credential) — a per-model key
+                    // on an anthropic degrade target is NOT honored here (the hop shares the primary's brain instance).
+                    // Named residual, not an oversight: the openai-compatible lane below is where catalog-directed
+                    // per-model credentials live (every sema-registry `apiKeyEnv`/`sealedApiKey` deployment to date).
+                    anthropicBrain
+                : createOpenAIBrain({
+                    baseUrl: fallbackModel.baseUrl || config.gatewayBaseUrl,
+                    // HOT by getter (core reads `config.apiKey` per request inside buildRequest, openai.js:296): the key
+                    // VALUE tracks refreshes exactly like the main path's rebuilt keyResolver — `applyEffective`
+                    // REASSIGNS config.modelApiKeys/modelApiKeyEnv, and this closure holds `config`, so it always reads
+                    // the live tables. Freezing it at boot would make a rotated/newly-sealed key take effect only after a
+                    // restart, silently. The STRUCTURAL half (target present/absent, its baseUrl/id/apiKeyEnv/sealedApiKey)
+                    // stays boot-frozen by construction and is registered as the `degrade-route` restart slice.
+                    get apiKey() {
+                        return fbApiKey();
+                    },
+                    maxRetries: 2,
+                    fetchImpl,
+                    ...timeouts,
+                });
             brain = createDegradingBrain({ primary: brain, fallback, fallbackModel, downgradeOn: config.degrade.downgradeOn });
         }
     }

package/dist/config-center/apply-effective.d.ts

@@ -77,7 +77,7 @@ export declare function resolveDefaultModelName(eff: EffectiveConfig, has: (name
 };
 /**
  * Read-only comparison (SEMA_REGISTRY_DRY_RUN): log what the center config WOULD change vs the current
- * (env-derived) config, WITHOUT applying it. The safe-rollout step the sema-registry recommends — verify
+ * (env-derived) config, WITHOUT applying it. The safe-rollout step the config-center recommends — verify
  * the center's models/roles/teams match (or intentionally differ from) the env baseline before going live.
  */
 export declare function logEffectiveDiff(config: ServiceConfig, eff: EffectiveConfig, logger?: Logger): void;

package/dist/config-center/apply-effective.js

@@ -2,7 +2,7 @@
  * EffectiveConfig application — mutate the boot `ServiceConfig` OVER with a pulled `EffectiveConfig`
  * (models/roles/tiers/projects `applyEffective`, the 6 runtime gates `applyRuntimeGates`, the per-request-hot
  * governance baton `applyRuntimeHot`) plus their shared helpers (`toModel`, `mutateInPlace`,
- * `resolveDefaultModelName`, `logEffectiveDiff`, `runtimeHasActiveGate`). Split out of `sema-registry.ts`
+ * `resolveDefaultModelName`, `logEffectiveDiff`, `runtimeHasActiveGate`). Split out of `facade.ts`
  * (design/158 A13, internal-lossless — the facade re-exports every symbol below unchanged).
  */
 import { isThinkingLevel } from "@sema-agent/core";
@@ -79,11 +79,11 @@ export function mutateInPlace(target, source) {
     Object.assign(target, source);
 }
 export function applyEffective(config, eff, logger, opts = {}) {
-    // version 0 / empty effective = the sema-registry has nothing for us yet — typically CONFIG_PUBLISH_MODE
+    // version 0 / empty effective = the config-center has nothing for us yet — typically CONFIG_PUBLISH_MODE
     // is ON but nothing has been published. We do NOT wipe: models/roles fall back to env (the enabled>0
     // guard below), teams to BUILTIN_TEAMS (registerTeams resets to built-ins). Warn once at boot so the
     // operator knows their config isn't live (publish a version, or disable the publish gate). See the
-    // sema-registry's ORCHESTRATOR-REVIEW §④ publish-gate contract.
+    // config-center's ORCHESTRATOR-REVIEW §④ publish-gate contract.
     if (!opts.teamsOnly && !eff.version) {
         logger?.warn("sema_registry_unpublished", {
             version: eff.version,
@@ -437,7 +437,7 @@ export function resolveDefaultModelName(eff, has, fallback, onDangling) {
 }
 /**
  * Read-only comparison (SEMA_REGISTRY_DRY_RUN): log what the center config WOULD change vs the current
- * (env-derived) config, WITHOUT applying it. The safe-rollout step the sema-registry recommends — verify
+ * (env-derived) config, WITHOUT applying it. The safe-rollout step the config-center recommends — verify
  * the center's models/roles/teams match (or intentionally differ from) the env baseline before going live.
  */
 export function logEffectiveDiff(config, eff, logger) {

package/dist/config-center/facade.d.ts

@@ -0,0 +1,47 @@
+/**
+ * Config-center adapter — pull the effective config from the config-center control plane and
+ * apply it OVER the env-derived defaults (env = fallback, center = override). Follows the
+ * "universal internal schema → translate at the boundary" pattern, with our security boundary kept:
+ *
+ * (name history: this module tracks the control plane's product name, which has changed over time
+ * — registry → sema-web → planned sema-admin. The module itself keeps a neutral, product-name-free
+ * identifier ("config-center") and does not chase the rename.)
+ *
+ *   - the CENTER owns the LOGICAL config: the model roster (names/capabilities/tier), the role map,
+ *     and team templates;
+ *   - the SERVICE env still owns the SECRETS: API keys stay in env (the center never stores a secret);
+ *     keys are per-model via `apiKeyEnv` → `config.modelApiKeyEnv` → the spec's `getApiKeyAndHeaders`
+ *     (core 1.45), so each model/cascade-rung authenticates with its own upstream key.
+ *
+ * Per-model `baseUrl` IS transported (a catalog model may live on a different gateway;
+ * core brain honors model.baseUrl, absent = "" = boot-env endpoint).
+ *
+ * Hot-reload status (复审 2026-07-29 P1-11 — 亲读判定,取代此处旧的 "models/roles are restart-to-apply"
+ * TODO, which went stale when `mutateInPlace` landed):
+ *   - models/roles/roster/teams/projects/autonomy — **HOT**. `applyEffective` mutates `config.models`/
+ *     `config.roles` IN PLACE, and core's Runner reads `this.deps.models/roles` per task off that very
+ *     reference. Both brains re-resolve `model.baseUrl || config.baseUrl` inside `buildRequest()` on every
+ *     call (core 2.1.0 `brain/openai.js` + `brain/anthropic.js`), so a moved gateway takes effect on the
+ *     next task with no restart.
+ *   - the same plane under a **tier-frozen** Runner — deferred, not hot: core expands a PRIVATE catalog copy
+ *     at construction, so `main` defers the whole plane and the `models-tiers` restart slice signals.
+ *   - **`degrade-route`** — the one genuinely boot-frozen catalog consumer left: reactive degrade
+ *     (`MODEL_DEGRADE_REACTIVE`) bakes the target Model + its gateway + its key into the brain composition
+ *     at boot. It cannot be hot-applied without rebuilding the brain, so it is registered on the existing
+ *     restartRequired /health contract instead (see `restart-signal.ts`). Fail-loud beats serving a stale
+ *     gateway silently on the rate-limit path.
+ *   - skills/mcp/scenarios/runtime-gates — restart-to-apply by construction (baked into the boot wiring).
+ *
+ * (design/158 A13, internal-lossless) This module is now a FACADE: the implementation lives
+ * alongside it in `src/config-center/` split by responsibility group (HTTP client / EffectiveConfig
+ * application / restart-signal detection / skills+MCP consumption). Every symbol below is
+ * re-exported UNCHANGED — existing `from ".../config-center/facade.js"` imports need zero changes
+ * across a rename of this file's *contents*; a path rename (this move, 2026-07-29) does require the
+ * importers to update, which was done in the same commit.
+ */
+export { fetchEffective, fetchPrincipalCaps, ConfigCenterHttpError, fetchSkillContent, fetchPromptArtifact, fetchPromptBlob, } from "./http-client.js";
+export { mutateInPlace, applyEffective, applyRuntimeGates, applyRuntimeHot, resolveDefaultModelName, logEffectiveDiff, runtimeHasActiveGate, } from "./apply-effective.js";
+export { restartReasons, planeHasActiveTiers, modelPlaneChanged, type RestartSlice, type RestartSliceCtx, type RestartSignal, } from "./restart-signal.js";
+export { applyCenterSkills, resolveMcpServers, mcpForScenario } from "./skills-mcp.js";
+export type { CenterSkillManifest, CenterMcpServer, EffectiveConfig, ExecutionRuling, SessionMirrorRuling, } from "./types.js";
+//# sourceMappingURL=facade.d.ts.map

package/dist/config-center/facade.js

@@ -0,0 +1,46 @@
+/**
+ * Config-center adapter — pull the effective config from the config-center control plane and
+ * apply it OVER the env-derived defaults (env = fallback, center = override). Follows the
+ * "universal internal schema → translate at the boundary" pattern, with our security boundary kept:
+ *
+ * (name history: this module tracks the control plane's product name, which has changed over time
+ * — registry → sema-web → planned sema-admin. The module itself keeps a neutral, product-name-free
+ * identifier ("config-center") and does not chase the rename.)
+ *
+ *   - the CENTER owns the LOGICAL config: the model roster (names/capabilities/tier), the role map,
+ *     and team templates;
+ *   - the SERVICE env still owns the SECRETS: API keys stay in env (the center never stores a secret);
+ *     keys are per-model via `apiKeyEnv` → `config.modelApiKeyEnv` → the spec's `getApiKeyAndHeaders`
+ *     (core 1.45), so each model/cascade-rung authenticates with its own upstream key.
+ *
+ * Per-model `baseUrl` IS transported (a catalog model may live on a different gateway;
+ * core brain honors model.baseUrl, absent = "" = boot-env endpoint).
+ *
+ * Hot-reload status (复审 2026-07-29 P1-11 — 亲读判定,取代此处旧的 "models/roles are restart-to-apply"
+ * TODO, which went stale when `mutateInPlace` landed):
+ *   - models/roles/roster/teams/projects/autonomy — **HOT**. `applyEffective` mutates `config.models`/
+ *     `config.roles` IN PLACE, and core's Runner reads `this.deps.models/roles` per task off that very
+ *     reference. Both brains re-resolve `model.baseUrl || config.baseUrl` inside `buildRequest()` on every
+ *     call (core 2.1.0 `brain/openai.js` + `brain/anthropic.js`), so a moved gateway takes effect on the
+ *     next task with no restart.
+ *   - the same plane under a **tier-frozen** Runner — deferred, not hot: core expands a PRIVATE catalog copy
+ *     at construction, so `main` defers the whole plane and the `models-tiers` restart slice signals.
+ *   - **`degrade-route`** — the one genuinely boot-frozen catalog consumer left: reactive degrade
+ *     (`MODEL_DEGRADE_REACTIVE`) bakes the target Model + its gateway + its key into the brain composition
+ *     at boot. It cannot be hot-applied without rebuilding the brain, so it is registered on the existing
+ *     restartRequired /health contract instead (see `restart-signal.ts`). Fail-loud beats serving a stale
+ *     gateway silently on the rate-limit path.
+ *   - skills/mcp/scenarios/runtime-gates — restart-to-apply by construction (baked into the boot wiring).
+ *
+ * (design/158 A13, internal-lossless) This module is now a FACADE: the implementation lives
+ * alongside it in `src/config-center/` split by responsibility group (HTTP client / EffectiveConfig
+ * application / restart-signal detection / skills+MCP consumption). Every symbol below is
+ * re-exported UNCHANGED — existing `from ".../config-center/facade.js"` imports need zero changes
+ * across a rename of this file's *contents*; a path rename (this move, 2026-07-29) does require the
+ * importers to update, which was done in the same commit.
+ */
+export { fetchEffective, fetchPrincipalCaps, ConfigCenterHttpError, fetchSkillContent, fetchPromptArtifact, fetchPromptBlob, } from "./http-client.js";
+export { mutateInPlace, applyEffective, applyRuntimeGates, applyRuntimeHot, resolveDefaultModelName, logEffectiveDiff, runtimeHasActiveGate, } from "./apply-effective.js";
+export { restartReasons, planeHasActiveTiers, modelPlaneChanged, } from "./restart-signal.js";
+export { applyCenterSkills, resolveMcpServers, mcpForScenario } from "./skills-mcp.js";
+//# sourceMappingURL=facade.js.map

package/dist/config-center/http-client.d.ts

@@ -33,7 +33,7 @@ export declare function fetchPrincipalCaps(baseUrl: string, token: string, princ
     executionDrift?: string;
     etag?: string;
 } | null>;
-/** An HTTP error from a sema-registry fetch that carries the response status so callers can branch on it
+/** An HTTP error from a config-center fetch that carries the response status so callers can branch on it
  *  (e.g. translate a 404 to "unknown hash → undefined") WITHOUT parsing the message string. */
 export declare class ConfigCenterHttpError extends Error {
     readonly status: number;

package/dist/config-center/http-client.js

@@ -1,7 +1,7 @@
 /**
- * sema-registry HTTP client — the transport calls the service makes against the config-center
+ * config-center HTTP client — the transport calls the service makes against the config-center
  * (`fetchEffective`/`fetchPrincipalCaps`/`fetchSkillContent`/`fetchPromptArtifact`/`fetchPromptBlob`) plus
- * the shared HTTP-error type. Split out of `sema-registry.ts` (design/158 A13, internal-lossless — the
+ * the shared HTTP-error type. Split out of `facade.ts` (design/158 A13, internal-lossless — the
  * facade re-exports every symbol below unchanged).
  */
 import { createHash } from "node:crypto";
@@ -22,7 +22,7 @@ export async function fetchEffective(baseUrl, token, etag, fetchImpl = fetch, wo
     if (res.status === 304)
         return null;
     if (!res.ok)
-        throw new Error(`sema-registry HTTP ${res.status}`);
+        throw new Error(`config-center HTTP ${res.status}`);
     return { effective: (await res.json()), etag: res.headers.get("etag") ?? undefined };
 }
 /**
@@ -62,11 +62,11 @@ export async function fetchPrincipalCaps(baseUrl, token, principal, etag, fetchI
         // misbehaving — DON'T treat it as "unchanged" (that surfaces undefined caps = no restriction = fail OPEN).
         // Throw so the resolver fail-closes (review B). With an etag, 304 = genuine "unchanged" → null.
         if (!etag)
-            throw new Error("sema-registry returned 304 to a non-conditional principal-caps request");
+            throw new Error("config-center returned 304 to a non-conditional principal-caps request");
         return null;
     }
     if (!res.ok)
-        throw new Error(`sema-registry principal-caps HTTP ${res.status}`);
+        throw new Error(`config-center principal-caps HTTP ${res.status}`);
     const body = (await res.json());
     return {
         runtimeCaps: body.runtimeCaps ?? null,
@@ -118,7 +118,7 @@ export async function fetchPrincipalCaps(baseUrl, token, principal, etag, fetchI
         etag: res.headers.get("etag") ?? undefined,
     };
 }
-/** An HTTP error from a sema-registry fetch that carries the response status so callers can branch on it
+/** An HTTP error from a config-center fetch that carries the response status so callers can branch on it
  *  (e.g. translate a 404 to "unknown hash → undefined") WITHOUT parsing the message string. */
 export class ConfigCenterHttpError extends Error {
     status;

package/dist/config-center/restart-signal.d.ts

@@ -1,5 +1,13 @@
 import type { EffectiveConfig } from "./types.js";
-export type RestartSlice = "skills" | "mcp" | "scenarios" | "runtime-gates" | "models-tiers";
+export type RestartSlice = "skills" | "mcp" | "scenarios" | "runtime-gates" | "models-tiers" | "degrade-route";
+/** What the CALLER must contribute about boot-baked catalog consumers that live OUTSIDE the Runner — the
+ *  slices cannot see them, because they are configured from env (`ServiceConfig`), not from the center's
+ *  EffectiveConfig. Absent/empty = that lane is off ⇒ its slice is inert (null on both sides). */
+export interface RestartSliceCtx {
+    /** `config.degrade.to` when REACTIVE degrade is on (env `MODEL_DEGRADE_TO` + `MODEL_DEGRADE_REACTIVE`);
+     *  undefined = the lane is off ⇒ no degrading brain was composed ⇒ nothing is boot-frozen. */
+    reactiveDegradeTo?: string;
+}
 /** Structured restart signal an orchestrator consumes (GET /health → `restart`). Change-detected against the
  *  process's BOOT config, NOT presence — so it stays absent when nothing baked-at-boot changed (presence would
  *  re-fire every refresh → a restart LOOP). `restartRequired` is always true when this object exists. */
@@ -7,7 +15,7 @@ export interface RestartSignal {
     restartRequired: true;
     /** Which restart-to-apply slices differ from the value baked at boot. */
     reasons: RestartSlice[];
-    /** The sema-registry version that currently differs from boot (latest seen). */
+    /** The config-center version that currently differs from boot (latest seen). */
     version: number;
     /** Epoch ms when this restart first became required (stable across refreshes while `reasons` is unchanged). */
     since: number;
@@ -16,7 +24,7 @@ export interface RestartSignal {
  *  nothing baked-at-boot changed (only hot-apply slices moved, or nothing) → no restart needed. An orchestrator
  *  can auto rolling-restart on a non-empty result WITHOUT a restart loop, because the comparison is always
  *  against boot (a refresh that re-fires the same diff is idempotent, not a fresh trigger). */
-export declare function restartReasons(boot: EffectiveConfig | undefined, current: EffectiveConfig): RestartSlice[];
+export declare function restartReasons(boot: EffectiveConfig | undefined, current: EffectiveConfig, ctx?: RestartSliceCtx): RestartSlice[];
 /** codex R10 (models-tiers 窗收口): TRUE when the MODEL PLANE (enabled models + active tier table + resolved
  *  default) of `next` differs from the last-APPLIED plane `prev`. Under a tier-frozen Runner (tiers non-empty at
  *  construction → private expanded copy) main.ts DEFERS the whole plane mutation until restart when this is true —