@sema-agent/server 3.0.0 → 3.2.0

package/dist/config-center/restart-signal.js

@@ -3,11 +3,11 @@
  * `restart`), computed against the process's BOOT config (not presence, else a refresh would re-fire the same
  * diff and loop-restart). Also owns the model-plane deferral predicates (`planeHasActiveTiers`/
  * `modelPlaneChanged`) main.ts uses to decide whether a hot-apply is safe under a tier-frozen Runner. Split out
- * of `sema-registry.ts` (design/158 A13, internal-lossless — the facade re-exports every symbol below unchanged).
+ * of `facade.ts` (design/158 A13, internal-lossless — the facade re-exports every symbol below unchanged).
  */
 import { resolveActiveTiers } from "@sema-agent/registry-core";
 import { RUNTIME_GATE_KEYS, runtimeGatePresent, resolveDefaultModelName } from "./apply-effective.js";
-const RESTART_SLICES = ["skills", "mcp", "scenarios", "runtime-gates", "models-tiers"];
+const RESTART_SLICES = ["skills", "mcp", "scenarios", "runtime-gates", "models-tiers", "degrade-route"];
 /** Canonical, key-sorted JSON (array order preserved) so two semantically-equal effective slices fingerprint
  *  identically regardless of object key order from the center serializer. */
 function stableStringify(v) {
@@ -31,7 +31,38 @@ function enabledOnly(rows) {
         return null;
     return rows.filter((r) => r.enabled !== false);
 }
-function restartSliceValue(eff, slice) {
+/** One catalog entry, reduced to the fields whose change is genuinely restart-to-apply. Consumers of a
+ *  boot-frozen catalog entry read almost every field on the FULLY-DERIVED Model (`toModel`) — id → body.model,
+ *  baseUrl → the endpoint, provider → which brain, maxTokens/compat/extraBody/input → the request body,
+ *  apiKeyEnv/sealedApiKey → the credential — so we fingerprint the WHOLE entry minus the three provably HOT
+ *  fields:
+ *    - `cost`        — refreshed by `mutateInPlace(pricing, buildPricing(config.models))`, and core prefers
+ *                      `deps.pricing[model.id]` over the (possibly frozen) `Model.cost`; `toModel` always emits
+ *                      a cost object, so every center-lane model has a live pricing entry.
+ *    - `quotaWeight` — refreshed by `mutateInPlace(config.modelQuotaWeights, …)`, read live per burn.
+ *    - `enabled`     — `enabledOnly` already filtered on it, so among the entries that reach here it is
+ *                      `true`-or-absent: two encodings of ONE state. Keeping it would let a center serializer
+ *                      that starts/stops emitting the explicit `true` manufacture a restart out of nothing.
+ *                      Every real enable/disable FLIP changes the filtered SET, so it still signals.
+ *  A DENY-list (not an allow-list) on purpose: a catalog field added later rides the fingerprint automatically,
+ *  so the failure mode of drift is a spurious restart, never a silently missed one.
+ *
+ *  Shared by BOTH catalog-entry fingerprints (`degrade-route`, `models-tiers` + `modelPlaneChanged`) since the
+ *  复审 2026-07-29 留档: models-tiers had kept all three, so on a tiers-active deployment a pure re-pricing /
+ *  weight tweak / serializer writing `enabled:true` rolling-restarted the fleet. The two fingerprints must
+ *  subtract the SAME set — under active tiers `modelPlaneChanged` defers the plane and the refresh loop then
+ *  FORCE-pushes the `models-tiers` reason for a deferred candidate (boot/config-center.ts R15/R22), so
+ *  subtracting in only one of them is either no-op (restart still fires) or incoherent (applied yet signalled). */
+function catalogEntryFingerprint(entry) {
+    const { cost: _cost, quotaWeight: _quotaWeight, enabled: _enabled, ...route } = entry;
+    return route;
+}
+/** The enabled entries of a model plane, each reduced by `catalogEntryFingerprint` (null = no plane published). */
+function planeEntriesFingerprint(rows) {
+    const enabled = enabledOnly(rows);
+    return enabled ? enabled.map((m) => catalogEntryFingerprint(m)) : null;
+}
+function restartSliceValue(eff, slice, ctx) {
     if (!eff)
         return null;
     switch (slice) {
@@ -67,7 +98,17 @@ function restartSliceValue(eff, slice) {
             // dangling candidates fall through silently here — applyEffective owns the warn.
             const names = new Set((enabled ?? []).map((m) => m.name));
             const def = resolveDefaultModelName(eff, (n) => names.has(n), enabled?.[0]?.name ?? "");
-            return { models: enabled, tiers: active, default: def.name };
+            // Entries reduced by the shared deny-list (cost/quotaWeight/enabled are hot — see catalogEntryFingerprint).
+            return { models: planeEntriesFingerprint(eff.models?.models), tiers: active, default: def.name };
+        }
+        case "degrade-route": {
+            const to = ctx?.reactiveDegradeTo;
+            if (to === undefined)
+                return null; // lane off — no degrading brain exists to go stale
+            // Present↔absent is itself a change: with no enabled entry named `to`, createBrain composes NO
+            // degrading shell at all, so the flip only takes effect at the next boot.
+            const target = (enabledOnly(eff.models?.models) ?? []).find((m) => m.name === to);
+            return target ? catalogEntryFingerprint(target) : null;
         }
     }
 }
@@ -75,8 +116,8 @@ function restartSliceValue(eff, slice) {
  *  nothing baked-at-boot changed (only hot-apply slices moved, or nothing) → no restart needed. An orchestrator
  *  can auto rolling-restart on a non-empty result WITHOUT a restart loop, because the comparison is always
  *  against boot (a refresh that re-fires the same diff is idempotent, not a fresh trigger). */
-export function restartReasons(boot, current) {
-    return RESTART_SLICES.filter((s) => stableStringify(restartSliceValue(boot, s)) !== stableStringify(restartSliceValue(current, s)));
+export function restartReasons(boot, current, ctx) {
+    return RESTART_SLICES.filter((s) => stableStringify(restartSliceValue(boot, s, ctx)) !== stableStringify(restartSliceValue(current, s, ctx)));
 }
 /** codex R10 (models-tiers 窗收口): TRUE when the MODEL PLANE (enabled models + active tier table + resolved
  *  default) of `next` differs from the last-APPLIED plane `prev`. Under a tier-frozen Runner (tiers non-empty at
@@ -102,7 +143,10 @@ export function modelPlaneChanged(prev, next) {
         const active = e.models ? (resolveActiveTiers(e.models) ?? null) : null;
         const names = new Set((enabled ?? []).map((m) => m.name));
         const def = resolveDefaultModelName(e, (n) => names.has(n), enabled?.[0]?.name ?? "");
-        return stableStringify({ models: enabled, tiers: active, default: def.name });
+        // Same reduction as the models-tiers slice — the two MUST subtract the same hot fields (see
+        // catalogEntryFingerprint): a deferred candidate force-pushes that slice's reason, so any divergence
+        // either re-manufactures the restart we just subtracted or signals a plane that was applied hot.
+        return stableStringify({ models: planeEntriesFingerprint(e.models?.models), tiers: active, default: def.name });
     };
     return fp(prev) !== fp(next);
 }

package/dist/config-center/skills-mcp.js

@@ -2,7 +2,7 @@
  * Two small consumption lanes that both project a center manifest domain onto a per-request runtime shape:
  * skills application (`applyCenterSkills` — merge center skills OVER the image baseline, content-addressed
  * fetch+verify+cache) and MCP server resolution (`resolveMcpServers`/`mcpForScenario` — env-NAME ref
- * resolution + per-scenario filtering). Split out of `sema-registry.ts` (design/158 A13, internal-lossless —
+ * resolution + per-scenario filtering). Split out of `facade.ts` (design/158 A13, internal-lossless —
  * the facade re-exports every symbol below unchanged).
  */
 import { skillContentHash } from "@sema-agent/registry-core";

package/dist/config-center/types.d.ts

@@ -1,8 +1,8 @@
 /**
- * config-center wire types — the sema-registry `/api/config/effective` payload shapes (`CenterModel`,
+ * config-center wire types — the config-center `/api/config/effective` payload shapes (`CenterModel`,
  * `CenterTeam`, `CenterSkillManifest`, `CenterMcpServer`, `EffectiveConfig`) plus the per-principal
  * execution/session-mirror ruling shapes riding the caps view (`ExecutionRuling`/`SessionMirrorRuling`).
- * Pure type/interface declarations — no runtime logic. Split out of `sema-registry.ts` (design/158 A13,
+ * Pure type/interface declarations — no runtime logic. Split out of `facade.ts` (design/158 A13,
  * internal-lossless: the facade re-exports every symbol below unchanged).
  */
 import type { CollabTemplateWire } from "../capabilities/collab-wire.js";

package/dist/config-provider.d.ts

@@ -1,7 +1,7 @@
 import { FileConfigStore } from "@sema-agent/registry-core/node";
 import { type EffectiveConfig as AgentConfigEffective } from "@sema-agent/registry-core";
-import { fetchEffective as remoteFetchEffective, fetchSkillContent as remoteFetchSkillContent, type EffectiveConfig } from "./sema-registry.js";
-/** Result of a `fetchEffective` — EXACTLY sema-registry's return: the effective config + its etag, or
+import { fetchEffective as remoteFetchEffective, fetchSkillContent as remoteFetchSkillContent, type EffectiveConfig } from "./config-center/facade.js";
+/** Result of a `fetchEffective` — EXACTLY the config-center's return: the effective config + its etag, or
  *  `null` for "unchanged" (remote 304; local: the version matched the caller's prior etag).
  *  `domainErrors`([898] registry-core 0.10.12 tolerant seam,local lane only):catalog 域坏文件不再
  *  连坐全包回落 env——坏域按该域 schema default 落+错误单列,好域照常生效;caller(main.ts)对每条打
@@ -29,12 +29,12 @@ export declare const BOOT_FETCH_DEFERRED: unique symbol;
 export declare function raceBootFetch<T>(fetch: Promise<T>, budgetMs: number): Promise<T | typeof BOOT_FETCH_DEFERRED>;
 /**
  * The two transport calls the service makes to obtain config, behind a backend-selectable seam. Both
- * signatures and return shapes match `sema-registry.fetchEffective` / `sema-registry.fetchSkillContent`
+ * signatures and return shapes match `facade.fetchEffective` / `facade.fetchSkillContent`
  * EXACTLY so that, ONCE WIRED, the caller (main.ts) could swap remote↔local without touching applyEffective
  * et al. (main.ts does not swap on this seam yet — see the NOT-YET-WIRED note at the top of this module).
  */
 export interface ConfigProvider {
-    /** "remote" = sema-registry HTTP; "local" = on-disk FileConfigStore. */
+    /** "remote" = config-center HTTP; "local" = on-disk FileConfigStore. */
     readonly kind: "remote" | "local";
     /**
      * Pull the effective config. `etag` is the caller's last-seen version token (`if-none-match` on remote;
@@ -72,9 +72,9 @@ export interface ConfigProviderInput {
     localDir?: string;
 }
 /**
- * RemoteConfigProvider — DELEGATES to the exported sema-registry HTTP functions. No HTTP is reimplemented;
+ * RemoteConfigProvider — DELEGATES to the exported config-center HTTP functions. No HTTP is reimplemented;
  * baseUrl/token/worker are bound once and passed through. The two delegate fns are injectable (defaulting
- * to the real sema-registry exports) so a unit test can assert delegation without module-mocking.
+ * to the real config-center exports) so a unit test can assert delegation without module-mocking.
  */
 export declare class RemoteConfigProvider implements ConfigProvider {
     private readonly cc;
@@ -120,7 +120,7 @@ export declare class LocalConfigProvider implements ConfigProvider {
 export declare function mapToServiceEffective(eff: AgentConfigEffective, version: number): EffectiveConfig;
 /**
  * Pick the backend off a CLOSED `provider` enum (`local` | `remote` | undefined): LOCAL when
- * `CONFIG_PROVIDER=local`, OR when no sema-registry URL is configured (a lone box with config.d/ on disk
+ * `CONFIG_PROVIDER=local`, OR when no config-center URL is configured (a lone box with config.d/ on disk
  * and no control plane). REMOTE otherwise (a configured center URL, the default fleet posture). A
  * `CONFIG_PROVIDER=remote` with no URL is a misconfiguration — we fall through to local rather than
  * constructing a remote provider with no endpoint (the caller would have skipped the remote pull entirely

package/dist/config-provider.js

@@ -2,7 +2,7 @@
  * ConfigProvider — the dual-mode seam over WHERE the effective config comes from (see
  * sema-registry docs/DUAL-MODE-DESIGN.md §4).
  *
- * The service consumes sema-registry through EXACTLY two transport calls — `fetchEffective` (pull the
+ * The service consumes the config-center through EXACTLY two transport calls — `fetchEffective` (pull the
  * effective config, ETag-conditional) and `fetchSkillContent` (lazy-pull one skill body by content hash).
  * Everything downstream (applyEffective / applyRuntimeGates / resolveMcpServers / mcpForScenario / the
  * skill overlay) is transport-agnostic: it operates on the returned `EffectiveConfig` / skill string.
@@ -17,7 +17,7 @@
  * This module factors those two calls behind a `ConfigProvider` interface with two backends:
  *
  *   - {@link RemoteConfigProvider} — the existing behaviour. DELEGATES verbatim to the exported
- *     `sema-registry.fetchEffective` / `sema-registry.fetchSkillContent` (HTTP + Bearer + ETag + hash
+ *     `facade.fetchEffective` / `facade.fetchSkillContent` (HTTP + Bearer + ETag + hash
  *     verify). No HTTP is reimplemented here; this is a thin wrapper that binds baseUrl/token/worker.
  *
  *   - {@link LocalConfigProvider} — reads the SAME config contract from the local filesystem via
@@ -30,7 +30,7 @@
  *
  * SECRET BOUNDARY (unchanged in both modes): the config plane carries only env-NAME refs — `apiKeyEnv`,
  * `envRefs`/`headerRefs`, `tokenEnv`. The real secret VALUE is never stored in config.d/<domain>.json and
- * never read by this module; it is resolved from `process.env` downstream (sema-registry.ts
+ * never read by this module; it is resolved from `process.env` downstream (config-center/facade.ts
  * `applyEffective`/`resolveMcpServers`). The local store is symmetric with the remote center on this: it
  * ships NAMEs only. (Unit test asserts the local path resolves env-NAME→value via process.env and never
  * persists a value.)
@@ -39,7 +39,7 @@ import { createHmac, randomBytes } from "node:crypto";
 import { FileConfigStore } from "@sema-agent/registry-core/node";
 import { findSkillContent, skillContentHash, refIntegrityIssues, siblingResolver, } from "@sema-agent/registry-core";
 import { redactSecrets } from "./trace/redact.js";
-import { fetchEffective as remoteFetchEffective, fetchSkillContent as remoteFetchSkillContent, ConfigCenterHttpError, } from "./sema-registry.js";
+import { fetchEffective as remoteFetchEffective, fetchSkillContent as remoteFetchSkillContent, ConfigCenterHttpError, } from "./config-center/facade.js";
 import { createLogger } from "./observability/logger.js";
 const logger = createLogger();
 /**
@@ -79,9 +79,9 @@ export function raceBootFetch(fetch, budgetMs) {
     return Promise.race([fetch.finally(() => clearTimeout(timer)), budget]);
 }
 /**
- * RemoteConfigProvider — DELEGATES to the exported sema-registry HTTP functions. No HTTP is reimplemented;
+ * RemoteConfigProvider — DELEGATES to the exported config-center HTTP functions. No HTTP is reimplemented;
  * baseUrl/token/worker are bound once and passed through. The two delegate fns are injectable (defaulting
- * to the real sema-registry exports) so a unit test can assert delegation without module-mocking.
+ * to the real config-center exports) so a unit test can assert delegation without module-mocking.
  */
 export class RemoteConfigProvider {
     cc;
@@ -93,7 +93,7 @@ export class RemoteConfigProvider {
     }
     fetchEffective(etag) {
         const fn = this.deps.fetchEffective ?? remoteFetchEffective;
-        // 5th arg = worker scope; transport (fetchImpl) stays sema-registry's default.
+        // 5th arg = worker scope; transport (fetchImpl) stays the config-center's default.
         return fn(this.cc.baseUrl, this.cc.token, etag, undefined, this.cc.worker);
     }
     async fetchSkillContent(contentHash) {
@@ -219,7 +219,7 @@ export function mapToServiceEffective(eff, version) {
             // [874] registry-core 0.10.11:池结构级 `default?`(catalog name 目录键,与 roles.default 角色词两回事)。
             // 本 mapper 是 CLOSED 投影——不直通则本地 lane 静默丢键(autoCompactTokens 同类病),applyEffective 的
             // resolveDefaultModelName 第一优先级在本地 lane 永远点不亮。写面悬空 ref 由 registry-core superRefine
-            // fail-loud;存量/未经 schema 的路径仍由消费方 warn 降级(sema-registry.ts resolveDefaultModelName)。
+            // fail-loud;存量/未经 schema 的路径仍由消费方 warn 降级(config-center/facade.ts resolveDefaultModelName)。
             ...(eff.models.default !== undefined ? { default: eff.models.default } : {}),
             ...(eff.models.atModelAllowlist !== undefined ? { atModelAllowlist: eff.models.atModelAllowlist } : {}),
             // registry-core 0.9.0 档位组: verbatim passthrough — applyEffective's resolveActiveTiers reads
@@ -322,7 +322,7 @@ export function mapToServiceEffective(eff, version) {
 }
 /**
  * Pick the backend off a CLOSED `provider` enum (`local` | `remote` | undefined): LOCAL when
- * `CONFIG_PROVIDER=local`, OR when no sema-registry URL is configured (a lone box with config.d/ on disk
+ * `CONFIG_PROVIDER=local`, OR when no config-center URL is configured (a lone box with config.d/ on disk
  * and no control plane). REMOTE otherwise (a configured center URL, the default fleet posture). A
  * `CONFIG_PROVIDER=remote` with no URL is a misconfiguration — we fall through to local rather than
  * constructing a remote provider with no endpoint (the caller would have skipped the remote pull entirely

package/dist/config.d.ts

@@ -8,7 +8,7 @@ export type { ServiceConfig, ScopedMcpServer, ImageBakeConfig, ServiceConfigFlat
 /** Parse the AUTONOMY env into a validated autonomy mode. Unset/empty → undefined (unmanaged → no extra
  *  tightening). An UNKNOWN value FAILS at startup rather than silently becoming a no-op (a typo'd `AUTONOMY=readonly`
  *  must not silently leave a deployment ungoverned — fail-loud, same discipline as numEnv). Exported so the HOT
- *  config overlay (sema-registry.ts `applyRuntimeHot`) can re-derive the ENV BASELINE to revert to when center
+ *  config overlay (config-center/facade.ts `applyRuntimeHot`) can re-derive the ENV BASELINE to revert to when center
  *  stops managing `autonomy` (a stale center override must not stick — see applyRuntimeHot). */
 export declare function parseAutonomy(raw: string | undefined): Autonomy | undefined;
 export declare function drainConfigWarnings(): Array<{

package/dist/config.js

@@ -15,7 +15,7 @@ const AUTONOMY_MODES = ["read-only", "ask", "plan", "auto"];
 /** Parse the AUTONOMY env into a validated autonomy mode. Unset/empty → undefined (unmanaged → no extra
  *  tightening). An UNKNOWN value FAILS at startup rather than silently becoming a no-op (a typo'd `AUTONOMY=readonly`
  *  must not silently leave a deployment ungoverned — fail-loud, same discipline as numEnv). Exported so the HOT
- *  config overlay (sema-registry.ts `applyRuntimeHot`) can re-derive the ENV BASELINE to revert to when center
+ *  config overlay (config-center/facade.ts `applyRuntimeHot`) can re-derive the ENV BASELINE to revert to when center
  *  stops managing `autonomy` (a stale center override must not stick — see applyRuntimeHot). */
 export function parseAutonomy(raw) {
     const v = raw?.trim();
@@ -534,8 +534,8 @@ function parseModelDomain() {
         // when body.images hits a text-only model) AND the vision flag on GET /v1/models. The env-lane default model
         // declares vision via MODEL_VISION — DEFAULT "true" keeps the historical image-capable behavior, so set
         // MODEL_VISION=false for a text-only model (e.g. deepseek) to make the precheck actually fire instead of letting
-        // images透传 to an opaque downstream-gateway 400. (The centralized sema-registry lane derives input from its own
-        // per-model vision flag — see sema-registry.ts.)
+        // images透传 to an opaque downstream-gateway 400. (The centralized config-center lane derives input from its own
+        // per-model vision flag — see config-center/facade.ts.)
         input: env("MODEL_VISION", "true") === "true" ? ["text", "image"] : ["text"],
         // Per-1M-token USD pricing (core `modelCostToPricing`: input→inputPer1M, …). Default 0 keeps the
         // historical behavior (spend reads $0) — set MODEL_COST_* on a deploy to make `model_cost_micro_usd`
@@ -624,7 +624,7 @@ function parseModelDomain() {
     // Static catalog audit for this batch: ZERO baked 1M entries exist (env lane defaults 262144; center lane
     // inherits/declares per roster) — so this is a DERIVATION on the declared window, not a data edit: any
     // deployment that sets MODEL_CONTEXT_WINDOW>=1e6 (or a center roster with a 1M contextWindow —
-    // sema-registry.ts applies the same helper) gets the field automatically. <1M ⇒ field ABSENT (core's plain
+    // config-center/facade.ts applies the same helper) gets the field automatically. <1M ⇒ field ABSENT (core's plain
     // W-33000/0.7W geometry already matches CC there).
     applyAutoCompactWindow(model);
     if (cheapModel)
@@ -849,7 +849,7 @@ function parseMemoryDomain(ctx) {
         memoryEngineBackend,
         memoryScope, // hoisted above (the 142-S2.5-W1 sync-scope default consumes it)
         ...(memorySync ? { memorySync } : {}),
-        projectMemoryEnabled, // design/113 C4 opt-out, flipped positive in design/158 B4 (legacy PROJECT_MEMORY_DISABLED still honored)
+        projectMemoryEnabled, // design/113 C4 opt-out, flipped positive in design/158 B4 (3.0.0 起 legacy PROJECT_MEMORY_DISABLED = fail-loud 墓碑)
         syncImportLeaseStaleSec: Math.max(0, numEnv("SYNC_IMPORT_LEASE_STALE_SEC", "600")),
     };
 }

package/dist/http/routes/approvals-assistant.js

@@ -209,7 +209,7 @@ async function handleApprovalsAssistantBody(req, res, url, ctx, miss) {
             // (yields a task, runs no model — see the billable-route classifier) → NO lease gate, else an exhausted
             // tenant could not stop its own spending.
             if (!deps.runStore) {
-                sendError(res, 501, "capability.run_store_required", "preemption requires the TiDB run store");
+                sendError(res, 501, "capability.run_store_required", "preemption requires a durable run store (DB_BACKEND=mysql|pg)");
                 return;
             }
             // requirePrincipal parity with the sibling mutating endpoints (runOwnerOk / cancel / runs): 401 before the
@@ -282,7 +282,7 @@ async function handleApprovalsAssistantBody(req, res, url, ctx, miss) {
             if (rateLimited(req, res) || quotaExceeded(req, res))
                 return; // 🔴 复审 C2:lease admitted INSIDE driveResumeIntoRunLog on the CHECKPOINT-OWNER principal (the billed tenant), not the request principal — a cross-tenant operator resume must charge the owner's lease, not the operator's. resume hits TiDB + runs the model
             if (!deps.runStore) {
-                sendError(res, 501, "capability.run_store_required", "resume requires the TiDB run store");
+                sendError(res, 501, "capability.run_store_required", "resume requires a durable run store (DB_BACKEND=mysql|pg)");
                 return;
             }
             if (deps.config.requirePrincipal && principal === undefined) {
@@ -319,7 +319,7 @@ async function handleApprovalsAssistantBody(req, res, url, ctx, miss) {
             if (rateLimited(req, res) || quotaExceeded(req, res))
                 return; // 🔴 复审 C2:lease admitted in driveResumeIntoRunLog (owner principal). resume hits TiDB + runs the model (approve/edit)
             if (!deps.runStore) {
-                sendError(res, 501, "capability.run_store_required", "plan_review requires the TiDB run store");
+                sendError(res, 501, "capability.run_store_required", "plan_review requires a durable run store (DB_BACKEND=mysql|pg)");
                 return;
             }
             if (deps.config.requirePrincipal && principal === undefined) {

package/dist/http/routes/runs.js

@@ -93,7 +93,7 @@ async function handleRunsBody(req, res, url, ctx, miss) {
     // Async run: create + return ids immediately, execute in the background.
     if (req.method === "POST" && url === "/v1/runs") {
         if (!deps.runStore) {
-            sendError(res, 501, "capability.run_store_required", "async runs require the TiDB run store (SESSION_BACKEND=tidb)");
+            sendError(res, 501, "capability.run_store_required", "async runs require a durable run store (DB_BACKEND=mysql|pg) (SESSION_BACKEND=tidb)");
             return;
         }
         // Idempotency-Key dedup (center blocker): a retried create returns the SAME taskId instead of starting a
@@ -222,7 +222,7 @@ async function handleRunsBody(req, res, url, ctx, miss) {
     const runMatch = req.method === "GET" ? RUN_ID_RE.exec(url) : null;
     if (runMatch) {
         if (!deps.runStore) {
-            sendError(res, 501, "capability.run_store_required", "async runs require the TiDB run store");
+            sendError(res, 501, "capability.run_store_required", "async runs require a durable run store (DB_BACKEND=mysql|pg)");
             return;
         }
         const taskId = runMatch[1];
@@ -310,7 +310,7 @@ async function handleRunsBody(req, res, url, ctx, miss) {
     const cancelMatch = req.method === "POST" ? RUN_CANCEL_RE.exec(url) : null;
     if (cancelMatch) {
         if (!deps.runStore) {
-            sendError(res, 501, "capability.run_store_required", "async runs require the TiDB run store");
+            sendError(res, 501, "capability.run_store_required", "async runs require a durable run store (DB_BACKEND=mysql|pg)");
             return;
         }
         // Principal check BEFORE the lookup (parity with GET /v1/runs/:id): no 404-vs-401 existence oracle.
@@ -496,7 +496,7 @@ async function handleRunsBody(req, res, url, ctx, miss) {
         if (rateLimited(req, res) || quotaExceeded(req, res) || (await leaseDenied(req, res)))
             return; // mutating + hits TiDB / runs the model
         if (!deps.runStore) {
-            sendError(res, 501, "capability.run_store_required", "async runs require the TiDB run store");
+            sendError(res, 501, "capability.run_store_required", "async runs require a durable run store (DB_BACKEND=mysql|pg)");
             return;
         }
         // Per-tenant identity MUST come from gatedPrincipal (direct-door secure single point), NOT principalFrom:
@@ -713,7 +713,7 @@ async function handleRunsBody(req, res, url, ctx, miss) {
         if (rateLimited(req, res) || quotaExceeded(req, res) || (await leaseDenied(req, res)))
             return; // mutating + runs the model (compaction summarizes)
         if (!deps.runStore) {
-            sendError(res, 501, "capability.run_store_required", "async runs require the TiDB run store");
+            sendError(res, 501, "capability.run_store_required", "async runs require a durable run store (DB_BACKEND=mysql|pg)");
             return;
         }
         const principal = gatedPrincipal(req, deps.config); // direct-door-secure identity, never the spoofable header
@@ -818,7 +818,7 @@ async function handleRunsBody(req, res, url, ctx, miss) {
         if (rateLimited(req, res))
             return; // mutating, but runs no model (no quota gate — parity with cancel, not steer)
         if (!deps.runStore) {
-            sendError(res, 501, "capability.run_store_required", "async runs require the TiDB run store");
+            sendError(res, 501, "capability.run_store_required", "async runs require a durable run store (DB_BACKEND=mysql|pg)");
             return;
         }
         const principal = gatedPrincipal(req, deps.config); // direct-door-secure identity, never the spoofable header
@@ -1183,7 +1183,7 @@ async function handleRunVerbsBody(req, res, url, ctx, miss) {
         if (rateLimited(req, res) || quotaExceeded(req, res) || (await leaseDenied(req, res)))
             return; // mutating + drives a model agent
         if (!deps.runStore) {
-            sendError(res, 501, "capability.run_store_required", "async runs require the TiDB run store");
+            sendError(res, 501, "capability.run_store_required", "async runs require a durable run store (DB_BACKEND=mysql|pg)");
             return;
         }
         // Identity from gatedPrincipal (direct-door-secure single point), NEVER the spoofable header — `trusted`

package/dist/http/routes/sessions.js

@@ -1,5 +1,5 @@
 import { materializeMcpTools, sanitizePathComponent, SessionPolicyError } from "@sema-agent/core";
-import { mcpForScenario } from "../../sema-registry.js";
+import { mcpForScenario } from "../../config-center/facade.js";
 import { isUuidV7, isUuidShape } from "../../security.js";
 import { windowMessages, truncateMessageBlobs } from "../../audit.js";
 import { redactSecrets } from "../../trace/redact.js";

package/dist/http/routes/trace-usage.js

@@ -36,7 +36,7 @@ async function handleTraceUsageBody(req, res, url, ctx, miss) {
             return;
         }
         if (!deps.runStore) {
-            sendError(res, 501, "capability.run_store_required", "trace API requires the TiDB run store (SESSION_BACKEND=tidb)");
+            sendError(res, 501, "capability.run_store_required", "trace API requires a durable run store (DB_BACKEND=mysql|pg) (SESSION_BACKEND=tidb)");
             return;
         }
         const q = new URL(req.url ?? "", "http://x").searchParams;
@@ -56,7 +56,7 @@ async function handleTraceUsageBody(req, res, url, ctx, miss) {
             return;
         }
         if (!deps.runStore) {
-            sendError(res, 501, "capability.run_store_required", "trace API requires the TiDB run store (SESSION_BACKEND=tidb)");
+            sendError(res, 501, "capability.run_store_required", "trace API requires a durable run store (DB_BACKEND=mysql|pg) (SESSION_BACKEND=tidb)");
             return;
         }
         const query = new URL(req.url ?? "", "http://x").searchParams;

package/dist/http/server.d.ts

@@ -3,7 +3,7 @@ import type { IncomingMessage } from "node:http";
 import { type Runner, type TaskSpec, type TaskResult, type WorkflowRunStore, type MemoryEntry } from "@sema-agent/core";
 import type { TaskRequestBody } from "./wire-types.js";
 import type { ServiceConfig } from "../config-types.js";
-import { type RestartSignal, type SessionMirrorRuling } from "../sema-registry.js";
+import { type RestartSignal, type SessionMirrorRuling } from "../config-center/facade.js";
 import { type OwnerAwareSessionStore } from "../security.js";
 import type { RunStore, ApprovalStore, ImageIndex, ImageBake, CheckpointStoreFull, ResumeAnchorStore, ApprovalExemptionStore, ServiceSessionPolicyStore, ServiceFileSnapshotStore, StoreBackend } from "../plugins/store-backend.js";
 import { type MemorySyncRequest, type MemorySyncResponse } from "../memory-sync.js";

package/dist/http/server.js

@@ -4,7 +4,7 @@ import { createHash } from "node:crypto";
 import { uuidv7, isThinkingLevel, expandTiers, resumeWithVerification, CheckpointError, HAND_TOOL_EFFECTS, canonicalToolName, defaultTaskRegistry, validatePendingSteer, subscribeWorkflow } from "@sema-agent/core"; // canonicalToolName = core single-source (1.162; replaced the transitional service mirror)
 import { decideParkedAgent, findParkedAgentForCheckpoint } from "../parked-decide.js";
 import { matchCatalogModel } from "../model-select.js";
-import {} from "../sema-registry.js";
+import {} from "../config-center/facade.js";
 import { HttpError, principalFrom, verifiedPrincipal, setSsoPrincipal, ssoVerifiedPrincipal, setSsoScope, isUuidV7, verifyDirectDoorProof } from "../security.js";
 import { exportSession, importSession } from "../session-sync.js";
 import {} from "../memory-sync.js";
@@ -407,7 +407,7 @@ export function createHttpServer(rawDeps) {
             return;
         }
         // Metrics (read-only): authorized by EITHER the full authToken OR a read-only metricsToken — so a
-        // control plane (sema-registry) can pull metrics fleet-wide with one token, never holding each
+        // control plane (config-center) can pull metrics fleet-wide with one token, never holding each
         // worker's full authToken. Handled BEFORE the global gate so metricsToken-only callers aren't 401'd.
         if (req.method === "GET" && (url === "/metrics" || url === "/metrics/summary" || url === "/metrics/plan-cache")) {
             if (!deps.metrics) {
@@ -495,7 +495,7 @@ export function createHttpServer(rawDeps) {
         reqState.source = source;
         // Mandatory service token on submission endpoints (center: a worker MUST validate a service-to-service
         // token on task creation — not "if auth is configured" — else anything in-cluster can submit & bill
-        // directly, bypassing sema-registry's auth/audit). Fail-closed: the POST task/run/leader endpoints refuse
+        // directly, bypassing config-center's auth/audit). Fail-closed: the POST task/run/leader endpoints refuse
         // when no authToken is set, unless explicitly opted out for local dev (ALLOW_UNAUTHED_WRITES=true).
         // The bake door (POST /v1/images/bakes*) is build-host-RCE-capable and authed by the Bearer-token-no-cookie
         // model (§P2.4b) — it MUST also refuse when no service token is configured (else a forged principal header

package/dist/key-resolver.d.ts

@@ -26,4 +26,18 @@ import { type SealedKeyPoison } from "./sealed-key.js";
 export declare function createKeyResolver(modelApiKeyEnv: Record<string, string>, env?: NodeJS.ProcessEnv, modelApiKeys?: Record<string, string | SealedKeyPoison>): ((model: Model) => Promise<{
     apiKey: string;
 } | undefined>) | undefined;
+/**
+ * The ONE per-model key chain, synchronous: **sealed custody → env-NAME reference → (caller's) gateway key**,
+ * with a poisoned sealed entry THROWING instead of returning undefined. `createKeyResolver` is the async
+ * `getApiKeyAndHeaders` face of exactly this function — every other consumer must call it rather than
+ * re-implement a subset of the chain.
+ *
+ * 复审 2026-07-29(同族缺口):`brain.ts` 的反应式降级 hop 曾只查 `modelApiKeyEnv` —— sealed-box 托管密钥的
+ * 降级目标(按互斥契约**永不**落 modelApiKeyEnv)于是静默拿网关 key 打自己的网关(错 key 打上游),毒丸更
+ * 被当成"没配 key"。链只有一条,重复实现就会长出这种半条链的偏差,故此处抽出同步内核共用。
+ *
+ * `undefined` = this model has no per-model key ⇒ the CALLER's gateway/default credential applies (the
+ * additive contract). An empty env value counts as unset (unchanged from the original inline chain).
+ */
+export declare function resolveModelApiKey(modelName: string, modelApiKeyEnv: Record<string, string>, env?: NodeJS.ProcessEnv, modelApiKeys?: Record<string, string | SealedKeyPoison>): string | undefined;
 //# sourceMappingURL=key-resolver.d.ts.map

package/dist/key-resolver.js

@@ -26,18 +26,34 @@ export function createKeyResolver(modelApiKeyEnv, env = process.env, modelApiKey
     if (Object.keys(modelApiKeyEnv).length === 0 && Object.keys(modelApiKeys).length === 0)
         return undefined;
     return async (model) => {
-        const sealed = modelApiKeys[model.name];
-        // Poison pill: the operator configured a sealed key for this model but it cannot be unsealed —
-        // fail the brain call LOUD (never undefined = never the gateway fallback).
-        if (isSealedKeyPoison(sealed))
-            throw new SealedKeyPoisonedError(model.name, sealed);
-        if (sealed)
-            return { apiKey: sealed }; // sealed-box custody wins (registry-core: sealed 压过 apiKeyEnv)
-        const envName = modelApiKeyEnv[model.name];
-        if (!envName)
-            return undefined; // model has no per-model key → core uses the gateway key
-        const apiKey = env[envName];
+        const apiKey = resolveModelApiKey(model.name, modelApiKeyEnv, env, modelApiKeys);
         return apiKey ? { apiKey } : undefined;
     };
 }
+/**
+ * The ONE per-model key chain, synchronous: **sealed custody → env-NAME reference → (caller's) gateway key**,
+ * with a poisoned sealed entry THROWING instead of returning undefined. `createKeyResolver` is the async
+ * `getApiKeyAndHeaders` face of exactly this function — every other consumer must call it rather than
+ * re-implement a subset of the chain.
+ *
+ * 复审 2026-07-29(同族缺口):`brain.ts` 的反应式降级 hop 曾只查 `modelApiKeyEnv` —— sealed-box 托管密钥的
+ * 降级目标(按互斥契约**永不**落 modelApiKeyEnv)于是静默拿网关 key 打自己的网关(错 key 打上游),毒丸更
+ * 被当成"没配 key"。链只有一条,重复实现就会长出这种半条链的偏差,故此处抽出同步内核共用。
+ *
+ * `undefined` = this model has no per-model key ⇒ the CALLER's gateway/default credential applies (the
+ * additive contract). An empty env value counts as unset (unchanged from the original inline chain).
+ */
+export function resolveModelApiKey(modelName, modelApiKeyEnv, env = process.env, modelApiKeys = {}) {
+    const sealed = modelApiKeys[modelName];
+    // Poison pill: the operator configured a sealed key for this model but it cannot be unsealed —
+    // fail the brain call LOUD (never undefined = never the gateway fallback).
+    if (isSealedKeyPoison(sealed))
+        throw new SealedKeyPoisonedError(modelName, sealed);
+    if (sealed)
+        return sealed; // sealed-box custody wins (registry-core: sealed 压过 apiKeyEnv)
+    const envName = modelApiKeyEnv[modelName];
+    if (!envName)
+        return undefined; // model has no per-model key → core uses the gateway key
+    return env[envName] || undefined;
+}
 //# sourceMappingURL=key-resolver.js.map

package/dist/plugins/remote-env-host.d.ts

@@ -280,22 +280,40 @@ export declare class RemoteHostExecutionEnv implements RemoteExecutionEnv, Sched
  * `ctx.sessionId` into the workspace dir id so two concurrent tasks never share a working directory.
  */
 export declare function hostExecutionEnvFactory(config?: HostEnvConfig): ExecutionEnvFactory;
-export { localDockerExecutionEnvFactory, type LocalDockerEnvConfig, RemoteLocalDockerExecutionEnv } from "./remote-env-local-docker.js";
-/** Config for the (not-yet-implemented) `remote-docker` provider: run each task in a container on a REMOTE
- *  docker daemon (e.g. over a TLS docker endpoint). Fast-follow per DUAL-MODE-DESIGN §5. */
-export interface RemoteDockerEnvConfig {
-    /** Container image to run the task in. */
-    image: string;
-    /** Workspace mount path inside the container. */
-    mountPath?: string;
-    /** Remote docker daemon endpoint (e.g. tcp://host:2376 or ssh://user@host). Required for remote-docker. */
+export { localDockerExecutionEnvFactory, type LocalDockerEnvConfig, type LocalDockerEnvDeps, RemoteLocalDockerExecutionEnv } from "./remote-env-local-docker.js";
+import { type LocalDockerEnvConfig, type LocalDockerEnvDeps } from "./remote-env-local-docker.js";
+/**
+ * Config for the `remote-docker` provider: run each task in a container on a REMOTE docker daemon
+ * (DUAL-MODE-DESIGN §5 — "a user-specified REMOTE host's docker"; registry-core `RemoteExecSpec`).
+ *
+ * It is {@link LocalDockerEnvConfig} with the endpoint made REQUIRED — that is the whole difference, by design:
+ * the container adapter is already daemon-agnostic (workspace `mkdir`'d INSIDE the container, never a host
+ * bind-mount; bytes over `docker cp` / `docker exec cat`, which stream through the daemon API), and the endpoint
+ * rides as `-H <dockerHost>` on every invocation. So every local-docker knob (memory/cpus/pidsLimit/dropAllCaps/
+ * network/timeouts/env/dockerPath) applies unchanged to the remote lane.
+ */
+export interface RemoteDockerEnvConfig extends Omit<LocalDockerEnvConfig, "dockerHost" | "providerLabel"> {
+    /** Remote docker daemon endpoint (e.g. `tcp://host:2376` or `ssh://user@host`). REQUIRED for remote-docker. */
     dockerHost: string;
-    /** Out-of-band env injected into the container (secrets resolved by the control plane). */
-    env?: Record<string, string>;
 }
 /**
- * `remote-docker` factory entry point — wired but an explicit TODO (DUAL-MODE-DESIGN §5 fast-follow). Throws
- * at factory-BUILD time so selecting it before it exists fails loud rather than degrading isolation silently.
+ * `ExecutionEnvFactory` for the TOC `remote-docker` backend (DUAL-MODE-DESIGN §5): a per-task container on
+ * SOMEONE ELSE'S docker daemon (offload — the operator's box stays free; isolation:true, suspendable:false).
+ * Same lifetime contract as local-docker: unconnected/lazy, one container per task, `destroy()` = `docker rm -f`.
+ *
+ * 🔴 **Endpoint credentials are the docker CLI's own** — this adapter deliberately carries none. The docker CLI
+ * reads `DOCKER_CERT_PATH` + `DOCKER_TLS_VERIFY` from the worker's environment (inherited by every spawn) for a
+ * `tcp://` + TLS daemon, and uses `ssh-agent` / `~/.ssh/config` for an `ssh://` one. That keeps key material out
+ * of this process's config objects entirely. Consequence to know: `tcp://…:2376` WITHOUT those env vars fails
+ * loud at connect (the daemon refuses plaintext) — it does not silently downgrade; a plaintext `tcp://…:2375`
+ * daemon is unauthenticated and remains the operator's decision, exactly as in the registry-core schema.
+ * (The registry-core `remote-docker` arm additionally models `tlsCertEnv`/`tlsKeyEnv`/`tlsCaEnv`/`sshKeyEnv` =
+ * env-NAMEs the control plane resolves to PEM BYTES. Materializing those bytes to short-lived 0600 files and
+ * passing `--tlsverify --tlscert/--tlskey/--tlscacert` is the remaining config-surface follow-up, together with
+ * the `provider:"remote-docker"` arm on `AppConfig.remoteExec` — see the note on that union in config-types.ts.)
+ *
+ * Throws at factory-BUILD time on a missing/blank endpoint: a "remote" lane with no endpoint would otherwise
+ * quietly become the LOCAL daemon — an isolation-topology surprise, so it fails loud instead.
  */
-export declare function remoteDockerExecutionEnvFactory(_config: RemoteDockerEnvConfig): ExecutionEnvFactory;
+export declare function remoteDockerExecutionEnvFactory(config: RemoteDockerEnvConfig, deps?: LocalDockerEnvDeps): ExecutionEnvFactory;
 //# sourceMappingURL=remote-env-host.d.ts.map