@sema-agent/server 4.3.0 → 5.0.1

package/dist/boot/resolve-spec.js

@@ -20,7 +20,7 @@
 import { realpathSync } from "node:fs";
 import { join } from "node:path";
 import { NodeExecutionEnv, QUESTION_AWAITS_RESUME, combinePolicies, createAllowDenyPolicy, createDurableQuestionPolicy, expandTiers, tightenTaskSpec } from "@sema-agent/core";
-import { createOaApprovalPolicy, createDurableAskPolicy } from "../approval.js";
+import { createDurableAskPolicy } from "../approval.js";
 import { cappedCeiling } from "../budget.js";
 import { centerPromptProvider, centerIdentityAssembled } from "../capabilities/center-prompts.js";
 import { SessionEnvironmentSelection, selectEnvironmentTool } from "../capabilities/select-environment-tool.js";
@@ -39,7 +39,8 @@ import { resourceSuspendOptIn } from "../resource-suspend.js";
 import { isIsolatedExecEnv, routeServiceTask, supPostureOverrides } from "../router/route-orchestration.js";
 import { gateExecutionLane } from "../runtime-caps-resolver.js";
 import { applyRuntimeGovernance, stripDelegationTools } from "../runtime-governance.js";
-import { HttpError, memorySpecForRequest, encodeCheckpointScope } from "../security.js";
+import { HttpError, encodeCheckpointScope } from "../security.js";
+import { memorySpecForRequest } from "../memory-scope.js";
 import { mcpForScenario } from "../config-center/facade.js";
 import { normalizeAttachments, normalizeResilience, normalizeResumeAtMode, normalizeSuggestNextPrompts, promptProfileFromBody, resolveTaskLimits, retainBackgroundProcessesFromBody, taskAgentsSpecFragment, toolNameListFromBody } from "../spec-fields.js";
 import { cwdHonored, effectiveHostWorkspace, inProcessSingleUserLane, isValidCwd, parseAdditionalDirectories, satisfiedByProcessCwd, shellEnvMismatchCount } from "../task-cwd.js";
@@ -48,7 +49,7 @@ import { MAX_SETTINGS_OUTPUT_STYLE_CHARS, acceptAppendSystemPrompt, applyTaskSet
 import { enableForkFromBody, normalizeRetainSubagentSessions, selfOrchestrationFromBody } from "../task-workflow.js";
 import { redactSecrets } from "../trace/redact.js";
 export function createResolveSpec(ctx) {
-    const { config, logger, metrics, localRoot, scenarios, principalCaps, centerRuntimeCapsResolver, getCenterPrompts, getKeyResolver, taskAttachmentStore, perSessionCwd, setSessionCwd, setSessionShellEnv, hookLlm, hookAgent, fleetBus, hookWakeBus, resumeAnchorStore, ownerAware, taskLimitCaps, taskTimeoutSec, selectEnvTool, sendUserFileToolSpec, memoryEngine, durableEnabled, approvalExemptionStore, approvalEnabled, approvalStore, singleUserAutoAcceptBaseline, checkpointStore, deploymentHooks, imageIndex, perTaskImage, sessionEnvSelection, } = ctx;
+    const { config, logger, metrics, localRoot, scenarios, principalCaps, centerRuntimeCapsResolver, getCenterPrompts, getKeyResolver, taskAttachmentStore, perSessionCwd, setSessionCwd, setSessionShellEnv, hookLlm, hookAgent, fleetBus, hookWakeBus, resumeAnchorStore, ownerAware, taskLimitCaps, taskTimeoutSec, selectEnvTool, sendUserFileToolSpec, memoryEngine, durableEnabled, approvalExemptionStore, singleUserAutoAcceptBaseline, checkpointStore, deploymentHooks, imageIndex, perTaskImage, sessionEnvSelection, } = ctx;
     // Deployment-owned mapping. Tools/prompt/skills come from the selected scenario (assembled once,
     // bound per request); identity/session/policy stay server-side. Never taken from the request body.
     // design/158 A8:从 createHttpServer 实参里提出来(原地占该字面量 1,093 行中的 967 行)——
@@ -692,8 +693,9 @@ export function createResolveSpec(ctx) {
             // provider 才不会各看一版(TOCTOU:门判安全、pick 到已组装包=core 侧静默丢 rider 复活)。
             promptProvider: centerDecls ? centerPromptProvider(centerDecls, scenarioName) : cap.promptProvider,
             // F4: high-risk write approval gate. DURABLE (design/45, opt-in): the gated `ask` SUSPENDS the task
-            // (durable checkpoint, resumable on any replica). Else the legacy POLL gate: the call waits on a
-            // durable pending row any instance can decide via /v1/approvals, releasing at the task deadline.
+            // (durable checkpoint, resumable on any replica). [2354]/[2356] A-5(5.0.0): the legacy POLL gate
+            // (createOaApprovalPolicy over ApprovalStore pending rows) is retired — durable is the ONLY gate; an
+            // operator with approval intent but no checkpointStore falls to `undefined` (core's UNGATED warning).
             // Durable ask (TC-5.4, core 1.95): in durable mode an AskUserQuestion call suspends like an F4 gate —
             // the question policy adjudicates it `ask`, the operator answers out-of-band, and the resume carries
             // the QuestionAnswer (server.ts `body.answer` → onQuestion closure). Suspend side mounts the tool with
@@ -711,36 +713,20 @@ export function createResolveSpec(ctx) {
                         }
                         : {}),
                 }))
-                : approvalEnabled && approvalStore
-                    ? createOaApprovalPolicy({
-                        store: approvalStore,
-                        requireApproval: config.approvalRequire,
-                        deny: config.approvalDeny,
-                        pollMs: config.approvalPollMs,
-                        context: () => ({ sessionId: auth?.sessionId ?? null, owner: auth?.principal ?? null }),
-                        neverAuto: config.approvalNeverAuto, // workflow audit 2026-07-13: the ordering lock must hold on the OA leg too
-                        // Same probe on the legacy poll gate (sessionId threaded via ctx here).
-                        ...(approvalExemptionStore
-                            ? {
-                                exempt: (sessionId, toolName) => approvalExemptionStore.has(sessionId, toolName),
-                                onExempted: (sessionId, toolName) => logger.info("approval_exempted", { sessionId, toolName }),
-                            }
-                            : {}),
-                    })
-                    : singleUserAutoAcceptBaseline
-                        // 🔴 (live finding: single-user host-lane Bash ran UNGATED, no adjudication): a
-                        // single-user turnkey worker with NO expressed gate intent previously left `toolPolicy` UNDEFINED →
-                        // core's write-capable hand tools mount UNADJUDICATED (core error-logs it every task; host lane has NO
-                        // sandbox to fall back on). CC's trust model is auto-accept, but the GATE MECHANISM must be PRESENT
-                        // (core 原则: "机制留、默认可更宽 auto-accept"). So wire an adjudicated auto-accept BASELINE
-                        // (`createAllowDenyPolicy({})` = a present, effect-aware policy that allows all): satisfies core's
-                        // `hasEffectAwareGate`, restores observability + a hook/tighten point, and the operator STILL tightens
-                        // irreversible ops via `AUTONOMY` / `commandPolicy` (layered TIGHTEN-ONLY by applyRuntimeGovernance).
-                        // Interactive approval routed to the shell HITL = follow-on. 🔴 `singleUserAutoAcceptBaseline` requires
-                        // ZERO gate intent — a single-user op who SET approval flags but wired no store falls to `undefined`
-                        // (core warns = real misconfig, not masked); multi-tenant likewise stays `undefined` (approval required).
-                        ? createAllowDenyPolicy({})
-                        : undefined,
+                : singleUserAutoAcceptBaseline
+                    // 🔴 (live finding: single-user host-lane Bash ran UNGATED, no adjudication): a
+                    // single-user turnkey worker with NO expressed gate intent previously left `toolPolicy` UNDEFINED →
+                    // core's write-capable hand tools mount UNADJUDICATED (core error-logs it every task; host lane has NO
+                    // sandbox to fall back on). CC's trust model is auto-accept, but the GATE MECHANISM must be PRESENT
+                    // (core 原则: "机制留、默认可更宽 auto-accept"). So wire an adjudicated auto-accept BASELINE
+                    // (`createAllowDenyPolicy({})` = a present, effect-aware policy that allows all): satisfies core's
+                    // `hasEffectAwareGate`, restores observability + a hook/tighten point, and the operator STILL tightens
+                    // irreversible ops via `AUTONOMY` / `commandPolicy` (layered TIGHTEN-ONLY by applyRuntimeGovernance).
+                    // Interactive approval routed to the shell HITL = follow-on. 🔴 `singleUserAutoAcceptBaseline` requires
+                    // ZERO gate intent — a single-user op who SET approval flags but wired no store falls to `undefined`
+                    // (core warns = real misconfig, not masked); multi-tenant likewise stays `undefined` (approval required).
+                    ? createAllowDenyPolicy({})
+                    : undefined,
             // Durable suspend needs both the store (here, per-task) and the opt-in scope key (multi-tenant =
             // principal; "_" when auth is off). core suspends on a policy `ask` only when these are present.
             ...(durableEnabled

package/dist/boot/stores.js

@@ -27,7 +27,7 @@ import { LocalTaskAttachmentStore } from "../plugins/local-task-attachment-store
 import { PgTaskAttachmentStore, TiDBTaskAttachmentStore, ensurePgTaskAttachmentSchema, ensureTiDBTaskAttachmentSchema } from "../plugins/task-attachment-store.js";
 import { createSessionStore } from "../plugins/session-store.js";
 import { assertCloudSnapshotBlobPosture, openStoreBackendWithFallback } from "../plugins/store-backend.js";
-import { memoryEngineBackendFor, memoryEngineRemoteLanePosture } from "../security.js";
+import { memoryEngineBackendFor, memoryEngineRemoteLanePosture } from "../memory-scope.js";
 export async function openStores(ctx) {
     const { config, logger, metrics, localRoot } = ctx;
     // One shared SQL store backend for L1 + L2 (TiDB/MySQL or PostgreSQL per DB_BACKEND). Owned here.

package/dist/brain.js

@@ -183,7 +183,9 @@ export function createBrain(config, deps = {}) {
                     fetchImpl,
                     ...timeouts,
                 });
-            brain = createDegradingBrain({ primary: brain, fallback, fallbackModel, downgradeOn: config.degrade.downgradeOn });
+            // core 5.1.0([2390]②):chain-of-one 链形;downgradeOn 缺席时 core 默认含 server_error(默认门
+            // 变宽)——MODEL_DEGRADE_ON 是运维收窄旋钮,词表验门在 config.ts parseDegradeOn。
+            brain = createDegradingBrain({ primary: brain, fallbacks: [{ brain: fallback, model: fallbackModel }], downgradeOn: config.degrade.downgradeOn });
         }
     }
     return brain;

package/dist/capabilities/center-prompts.d.ts

@@ -22,9 +22,8 @@
 import { type PromptProvider, type PublishedPromptArtifactEnvelope } from "@sema-agent/core";
 import { type EffectiveCenterPrompts, type PromptsDomainFaces } from "../prompts-domain-validate.js";
 /** 判形半场(validateCenterPrompts/validatePromptsDomain/CORE_ENGINE_VERSION 及两 interface)已下沉到
- *  中立叶子 `src/prompts-domain-validate.ts`(design/158 S6,lens2 §G:消 config-lkg → capabilities 的
- *  唯一分层反向边)。此处 re-export 保兼容——既有消费者(main/run-local/测试)零改动。 */
-export { validateCenterPrompts, validatePromptsDomain, CORE_ENGINE_VERSION, type EffectiveCenterPrompts, type PromptsDomainFaces } from "../prompts-domain-validate.js";
+ *  中立叶子 `src/prompts-domain-validate.ts`(design/158 S6);消费者直引真源([2354] 兼容面全清,
+ *  此处兼容 re-export 已删)。 */
 /** [985]b / [1285] — §9.4 by-digest 补拉组合店:local miss ⇒ fetchRaw(digest) 从 center 拉 envelope ⇒
  *  core verifyPromptArtifact 全管线 + **回验「拿到的=要的」digest 逐位**(center 答非所问=丢弃)⇒
  *  best-effort 回写 inner(下次直命中)。任何失败=undefined(诚实缺席,fail-loud 归 core 的

package/dist/capabilities/center-prompts.js

@@ -23,9 +23,8 @@ import { verifyPromptArtifact } from "@sema-agent/core";
 import { CORE_ENGINE_VERSION } from "../prompts-domain-validate.js";
 import { SHA256_HEX_RE } from "../digest-form.js";
 /** 判形半场(validateCenterPrompts/validatePromptsDomain/CORE_ENGINE_VERSION 及两 interface)已下沉到
- *  中立叶子 `src/prompts-domain-validate.ts`(design/158 S6,lens2 §G:消 config-lkg → capabilities 的
- *  唯一分层反向边)。此处 re-export 保兼容——既有消费者(main/run-local/测试)零改动。 */
-export { validateCenterPrompts, validatePromptsDomain, CORE_ENGINE_VERSION } from "../prompts-domain-validate.js";
+ *  中立叶子 `src/prompts-domain-validate.ts`(design/158 S6);消费者直引真源([2354] 兼容面全清,
+ *  此处兼容 re-export 已删)。 */
 /** [985]b / [1285] — §9.4 by-digest 补拉组合店:local miss ⇒ fetchRaw(digest) 从 center 拉 envelope ⇒
  *  core verifyPromptArtifact 全管线 + **回验「拿到的=要的」digest 逐位**(center 答非所问=丢弃)⇒
  *  best-effort 回写 inner(下次直命中)。任何失败=undefined(诚实缺席,fail-loud 归 core 的

package/dist/capabilities/sandbox-file-send.d.ts

@@ -35,7 +35,6 @@
  */
 import type { ExecutionEnv, ExecutionEnvFactory } from "@sema-agent/core";
 import type { IssuedFileLink, PreparedDirectUpload } from "../plugins/send-user-file.js";
-import { shellQuote as shq } from "../plugins/remote-shell.js";
 /** Leak backstop (codex review HIGH): core skips destroy on suspend/review paths and a crash may skip it
  *  entirely — the suspendVM wrap covers the common case, this bound covers the rest. Far above any real
  *  per-replica concurrency. 修6: at the cap the registry REFUSES the new registration instead of FIFO-evicting
@@ -92,7 +91,6 @@ export declare class TaskEnvRegistry {
  *    adb/local-docker remain a follow-on).
  */
 export declare function sandboxSendLaneEnabled(provider: string | undefined, requirePrincipal: boolean): boolean;
-export { shq };
 /** Strip the capability URL (and any SigV4 signature) from text before it reaches an error/log — including
  *  the percent-encoded forms an adapter may echo (the k8s exec transport carries the command in a request
  *  URI, so an error can quote the URL re-encoded; codex review MED). */

package/dist/capabilities/sandbox-file-send.js

@@ -139,11 +139,8 @@ export function sandboxSendLaneEnabled(provider, requirePrincipal) {
         return requirePrincipal !== true;
     return false;
 }
-// design/158 R10: the quoting logic itself now lives solely in remote-shell.ts's shellQuote (this module's
-// former standalone copy was byte-identical; its JSDoc note was folded into that owner). `shq` stays a
-// re-exported alias — not a plain call-through rename — because two test files import `shq` by name from
-// this module.
-export { shq };
+// [2354] clay 令兼容面全清:R10 曾留的 `export { shq }` 兼容转口已删——quoting 唯一真源=
+// remote-shell.ts 的 shellQuote(原先仅有的两个消费者是测试文件,已改从真源导入)。
 /** Strip the capability URL (and any SigV4 signature) from text before it reaches an error/log — including
  *  the percent-encoded forms an adapter may echo (the k8s exec transport carries the command in a request
  *  URI, so an error can quote the URL re-encoded; codex review MED). */

package/dist/capabilities/scenarios.d.ts

@@ -45,17 +45,6 @@ export interface ScenarioDeps {
     webFetchSummarize?: NonNullable<NonNullable<WebFetchConfig["summarize"]>>;
     metrics?: Metrics;
     logger?: Logger;
-    /** OA backend coordinates for the `oa` scenario (read /api/v1, write /api/assets). */
-    oaApiBaseUrl?: string;
-    oaServiceToken?: string;
-    /** 可选：`oa` 场景注入"开 Gitea issue"工具(OA AI 请求#5)；repo/token/labels 固定，模型只填 title/body。 */
-    oaIssue?: {
-        baseUrl: string;
-        owner: string;
-        repo: string;
-        token: string;
-        defaultLabels?: number[];
-    };
     /**
      * When true, the `default` scenario carries the Sema product identity (see {@link semaIdentityProvider}).
      * Set by the local/TOC deployment (CONFIG_PROVIDER=local / run-local) so the local engine answers "who
@@ -159,8 +148,8 @@ export interface ScenarioDetail {
     promptSummary: string;
     enabled: boolean;
 }
-/** 内建六场景详情。default/autonomous/team 工厂对良性请求无副作用可真调(拿真实工具名单);code-review/scan/oa 是
- *  fail-loud 语义(缺 GIT_API/OA 配置/principal 即 throw)→ 探针失败落静态表兜底(表↔工厂一致性由测试锁:
+/** 内建五场景详情。default/autonomous/team 工厂对良性请求无副作用可真调(拿真实工具名单);code-review/scan 是
+ *  fail-loud 语义(缺 GIT_API 配置/principal 即 throw)→ 探针失败落静态表兜底(表↔工厂一致性由测试锁:
  *  测试喂 fake deps 真调工厂对账工具名)。enabled 对内建恒 true(约定②)。 */
 export declare function builtinScenarioDetails(scenarios: Record<string, Scenario>, deps: Pick<ScenarioDeps, "brandIdentity">): Record<string, ScenarioDetail>;
 /** center 条目详情(有效性判定与 centerScenarios 完全同款:无效条目既不进 overlay 也不进详情——

package/dist/capabilities/scenarios.js

@@ -1,11 +1,10 @@
-import { CODE_AGENT_PROMPT, CODE_SYSTEM_PROMPT, DEFAULT_SYSTEM_PROMPT, assembleCodeTools, createGiteaIssueTool, defaultTaskRegistry } from "@sema-agent/core";
+import { CODE_AGENT_PROMPT, CODE_SYSTEM_PROMPT, DEFAULT_SYSTEM_PROMPT, assembleCodeTools, defaultTaskRegistry } from "@sema-agent/core";
 import { HttpError } from "../security.js";
 import { nowTool } from "./builtin-tools.js";
 import { GiteaClient, parseRepo, repoToolsFor } from "./repo-tools.js";
 import { createCouncilTool, clampRounds } from "./code-review-council.js";
 import { stablePrompt } from "./prompt.js";
 import { createTeamTool, teamCoordinatorPrompt, getTeam, teamNames } from "./team.js";
-import { oaTools, oaPrompt } from "./oa-tools.js";
 import { createWebSearchBackend, webSearchConfigFromSettings } from "../plugins/web-search.js";
 import { skillsForScenario } from "./skills.js";
 /**
@@ -205,23 +204,6 @@ export function buildScenarios(deps) {
                 skills: skillsForScenario(deps.skills, "scan"),
             };
         },
-        oa: (req, principal) => {
-            if (!deps.oaApiBaseUrl || !deps.oaServiceToken)
-                throw new HttpError(501, "oa scenario needs OA_API_BASEURL + OA_SERVICE_TOKEN configured");
-            // OA enforces the END USER's RBAC from the forwarded principal — without one, every OA call would
-            // run unattributed. Refuse rather than silently send a null principal.
-            if (!principal)
-                throw new HttpError(401, "oa scenario requires an authenticated principal (set REQUIRE_PRINCIPAL + x-agent-principal)");
-            // 写权限的"开 issue"工具仅当配置了 OA_ISSUE_* 时注入；token/repo 固定，模型只填 title/body。
-            const issueTool = deps.oaIssue
-                ? [createGiteaIssueTool({ ...deps.oaIssue, name: "open_gitea_issue", description: "把用户的 bug/需求开成 Gitea issue 报给老板。只填 title(简洁)/body(现象、影响、复现/建议)。仓库与标签由部署固定。" })]
-                : [];
-            return {
-                tools: [...oaTools({ baseUrl: deps.oaApiBaseUrl, token: deps.oaServiceToken, principal }), ...issueTool],
-                skills: skillsForScenario(deps.skills, "oa"),
-                promptProvider: oaPrompt,
-            };
-        },
         // Multi-agent team: pick a template, the consumer (OA) injects business context, we run it.
         // Templates resolve from the live registry (`getTeam`) = BUILTIN_TEAMS overridden/extended by the
         // sema registry at runtime (applyEffective → registerTeams), so a team is config-driven; built-ins
@@ -246,8 +228,8 @@ export function buildScenarios(deps) {
 export function selectScenario(scenarios, name) {
     return (name && scenarios[name]) || scenarios.default;
 }
-/** 内建六场景详情。default/autonomous/team 工厂对良性请求无副作用可真调(拿真实工具名单);code-review/scan/oa 是
- *  fail-loud 语义(缺 GIT_API/OA 配置/principal 即 throw)→ 探针失败落静态表兜底(表↔工厂一致性由测试锁:
+/** 内建五场景详情。default/autonomous/team 工厂对良性请求无副作用可真调(拿真实工具名单);code-review/scan 是
+ *  fail-loud 语义(缺 GIT_API 配置/principal 即 throw)→ 探针失败落静态表兜底(表↔工厂一致性由测试锁:
  *  测试喂 fake deps 真调工厂对账工具名)。enabled 对内建恒 true(约定②)。 */
 export function builtinScenarioDetails(scenarios, deps) {
     const probe = (name, req, principal, fallback) => {
@@ -270,7 +252,6 @@ export function builtinScenarioDetails(scenarios, deps) {
             : "core 编码完全体提示词(= code 场景;finalVerification 固定开)"),
         "code-review": mk("code-review", "代码评审(clone-free 只读仓库工具;council=true 升多镜头评审团)", "repo-readonly", probe("code-review", { repo: "probe/probe" }, undefined, REPO_TOOLS), "评审员/评审团协调提示词(镜头分工+产出契约)"),
         scan: mk("scan", "中性只读仓库扫描(输出契约由 objective+skills 决定)", "repo-readonly", probe("scan", { repo: "probe/probe" }, undefined, REPO_TOOLS), "无场景附加提示词(objective+center skills 拥有输出契约)"),
-        oa: mk("oa", "OA 资产运营助手(以最终用户 principal 走 OA API,RBAC+审计在 OA 侧)", "oa-api", probe("oa", {}, "probe:meta", ["oa_schema", "oa_alerts", "oa_list", "oa_get", "oa_lookup", "oa_create", "oa_update", "oa_transition"]), "OA 运营助手提示词(先 schema 后操作、写走受控流转)"),
         team: mk("team", "多智能体团队圆桌(模板成员+synthesizer,模板可由 registry 配置)", "team", probe("team", {}, undefined, ["run_team"]), "团队协调者提示词(圆桌纪律+合成流程)"),
     };
 }

package/dist/capabilities/send-user-file-tool.js

@@ -24,7 +24,7 @@
  */
 import { AsyncLocalStorage } from "node:async_hooks";
 import { Type } from "typebox";
-import { builtinAgentDefinitions, canonicalToolName } from "@sema-agent/core";
+import { builtinAgentDefinitions } from "@sema-agent/core";
 /** Per-run ALS carrier (QuestionCoordinator pattern): run legs wrap their body via runWithContext; the tool
  *  recovers the ambient emit at execute time. No pending state, no respond face — emission is one-way. */
 export class SendUserFileEmitter {
@@ -155,7 +155,7 @@ const READONLY_BUILTIN_AGENT_TYPES = new Set(builtinAgentDefinitions().map((d) =
  * definition's name (core subagent.js); membership in core's builtin catalog ⇒ inject nothing for that spawn.
  */
 export function subagentSendUserFileExtraTools(deps) {
-    const canonical = canonicalToolName(SEND_USER_FILE_TOOL_NAME);
+    const canonical = SEND_USER_FILE_TOOL_NAME; // RAW(5.0.0):本名恒 canonical,折叠面退役
     return (ctx) => {
         // F2: read-only builtin child (Explore/Plan) — never inject.
         if (ctx.agentType !== undefined && READONLY_BUILTIN_AGENT_TYPES.has(ctx.agentType))
@@ -163,7 +163,7 @@ export function subagentSendUserFileExtraTools(deps) {
         // F1: deployment policy gates SendUserFile (deny/ask) — withhold from ALL children (fail-closed stopgap
         // until core propagates the parent toolPolicy into child specs). Canonical-space match (S8 discipline).
         const gate = deps.approvalGate();
-        const gated = [...(gate.deny ?? []), ...(gate.require ?? []), ...(gate.neverAuto ?? [])].some((t) => canonicalToolName(t) === canonical);
+        const gated = [...(gate.deny ?? []), ...(gate.require ?? []), ...(gate.neverAuto ?? [])].some((t) => t === canonical);
         return gated ? [] : [deps.spec];
     };
 }

package/dist/config-center/apply-effective.js

@@ -8,7 +8,7 @@
 import { isThinkingLevel } from "@sema-agent/core";
 import { resolveActiveTiers, SEALED_BOX_ALG } from "@sema-agent/registry-core";
 import { sealedKeyPoison } from "../sealed-key.js";
-import { applyAutoCompactWindow, parseAutonomy } from "../config.js";
+import { applyAutoCompactWindow, findUnmatchableToolNames, formatUnmatchableToolNames, parseAutonomy } from "../config.js";
 import { validateCommandRules } from "../runtime-governance.js";
 import { projectCollabToWorkflows, registerCollabWorkflows } from "../capabilities/collab-workflows.js";
 import { registerTeams } from "../capabilities/team.js";
@@ -292,8 +292,8 @@ function stageEffective(config, eff, logger, opts) {
         // → undefined = INERT). Values are catalog NAME strings (open, not enum'd); dangling bindings were already
         // culled center-side. mutateInPlace keeps the reference RunnerDeps.tiers holds — the expansion itself happens
         // at Runner CONSTRUCTION (core 1.265 expandTiers), so a refresh-time change is restart-to-apply like models.
-        // NOTE: the wire face (this module's EffectiveConfig) carries the JSON body verbatim, so tierGroups ride
-        // eff.models even though CenterModel doesn't type them — resolveActiveTiers reads them structurally.
+        // [2373]B-6:EffectiveConfig.models 已声明 tierGroups/activeTierGroup(types.ts)——旧「CenterModel
+        // doesn't type them」注随宽铸一起退役;resolveActiveTiers 收 registry-core 形,窄化一步即可。
         const activeTiers = resolveActiveTiers(eff.models) ?? {};
         // [865]①(生产实锤:面板上选了 A 模型,实际跑的是目录里的另一个)显式默认解析——enabled[0] 会被任何改变 pool 顺序的写
         // 静默翻转,default 必须消费 wire 里已有的显式意图。解析单源 = resolveDefaultModelName(dry-run 的
@@ -316,7 +316,7 @@ function stageEffective(config, eff, logger, opts) {
     // governance 切新位:治理三件优先读 governance 域(真值),runtime 旧位(双写镜像)fallback——
     // 双写期两处逐键相等语义不变;center 撤双写后 governance 即唯一来源。限额残余(rateLimit/cost 五件)仍在 runtime。
     const gatesView = eff.governance ? { ...eff.runtime, ...eff.governance } : eff.runtime;
-    const gates = opts.teamsOnly ? undefined : stageRuntimeGates(gatesView);
+    const gates = opts.teamsOnly ? undefined : stageRuntimeGates(gatesView, logger);
     // Runtime governance "second baton" (center §10): autonomy + commandPolicy are per-request HOT (read live in
     // resolveSpec), NOT baked into boot middleware → apply on BOTH boot and refresh (outside the teamsOnly guard) so
     // they hot-reload. No restart-to-apply signal (they take effect on the next task without a restart).
@@ -360,13 +360,13 @@ function stageEffective(config, eff, logger, opts) {
     // 142-S4 projects 域(registry-core 0.10.0):center 项目登记簿 → config.projects(键=
     // projectId)。消费是 per-request 查表(memoryScope 派生 + defaultScopes 种子,security.ts/main.ts),
     // 所以 boot+refresh 双腿都 mutateInPlace 热应用(整表替换,非粘——center 停发即清空);env lane 恒空。
-    // 宽读:域包裹 `{projects:{...}}`(registry-core ProjectsConfig 真形状)与裸 Record 都认(projectId=UUID,
-    // 永不撞 "projects" 字面键);防御:非 object 条目跳过,字段逐个验型(wire verbatim,不信任形状)。
+    // [2373]B-8:裸 Record 臂删——registry-core 0.13.0 ProjectsConfig 只有包裹形 `{projects:{...}}`
+    // (types.d.ts:3599,且 :12231 钉进 EffectiveConfig),裸形无 producer(与 Q15 declared 双形容忍同族)。
+    // 防御保留:非 object 条目跳过,字段逐个验型(wire verbatim,不信任形状)。
     const projDomain = eff.projects;
-    const rawProjects = (projDomain && typeof projDomain === "object" && !Array.isArray(projDomain)
-        ? "projects" in projDomain && typeof projDomain.projects === "object"
-            ? (projDomain.projects ?? {})
-            : projDomain
+    const rawProjects = (projDomain && typeof projDomain === "object" && !Array.isArray(projDomain) &&
+        "projects" in projDomain && typeof projDomain.projects === "object"
+        ? (projDomain.projects ?? {})
         : {}) ?? {};
     const projects = {};
     for (const [pid, reg] of Object.entries(rawProjects)) {
@@ -422,8 +422,38 @@ export function runtimeGatePresent(rt, key) {
         return typeof v === "number" && v > 0;
     return typeof v === "number";
 }
-/** [2283] stage 半场:六闸的赋值清单(纯计算,零变异)。commit 段照单赋值,通知载荷 post-commit 发。 */
-function stageRuntimeGates(rt) {
+/**
+ * A1:中心下发的 `approvalRequire` 名单**按 env 腿同款判据**验过再落配。此前只验 `Array.isArray` 就逐字
+ * 落配——含退役工具名(`bash`/`Task`/`KillShell`)或 pre-prefix/不完整 MCP 名(`figma__x`/`mcp__figma`)时
+ * 该名单项永不匹配任何现役工具,审批门静默失守,而同一拼法从 env 腿(`APPROVAL_REQUIRE`)进来是 boot 拒启
+ * ——两腿判据不对称,写配置的人无从知道自己踩的是哪一条。判据单点=config.ts `findUnmatchableToolNames`。
+ *
+ * 处置形照本文件既有的域级拒绝先例(`commandPolicy` 非法 ⇒ fail-loud + 保留前值):常驻进程不能因为一次
+ * 坏发布 crash,所以**只拒这一个域**(其余五闸照常应用)、保留前值、留一条响亮 warn。「半应用一个被静默
+ * 削弱的门」才是要堵的那种失败。
+ *
+ * 顺带 C1-2:数组项 trim + 去空串,与 env csv 归一(`csv()` 的 `.map(trim).filter(Boolean)`)一致——
+ * 否则 `" Bash "` 从中心腿进来会是个永不匹配的名字,正是本条要消灭的那类静默失效。
+ */
+function stageApprovalRequire(raw, logger) {
+    // wire verbatim ⇒ 不信任元素形状(整表是 center 发的):非串项与空串一并落地板,与 env csv 归一同形。
+    const names = (Array.isArray(raw) ? raw : [])
+        .map((n) => (typeof n === "string" ? n.trim() : n))
+        .filter((n) => typeof n === "string" && n.length > 0);
+    const bad = findUnmatchableToolNames(names);
+    if (bad.length > 0) {
+        logger?.warn("sema_registry_approval_require_invalid", {
+            detail: formatUnmatchableToolNames("published runtime.approvalRequire", bad),
+            names: bad.map((b) => b.name),
+            kept: "the prior approvalRequire is unchanged — the published list would have silently matched nothing",
+        });
+        return {};
+    }
+    return { value: names };
+}
+/** [2283] stage 半场:六闸的赋值清单(纯计算,零变异)。commit 段照单赋值,通知载荷 post-commit 发。
+ *  A1 的名单校验是**内容判定**(描述 eff 的真伪,与是否 commit 无关)⇒ 与 commandPolicy 同,stage 期发 warn。 */
+function stageRuntimeGates(rt, logger) {
     if (!rt)
         return { assignments: [] };
     const assignments = [];
@@ -431,6 +461,14 @@ function stageRuntimeGates(rt) {
     for (const key of RUNTIME_GATE_KEYS) {
         if (!runtimeGatePresent(rt, key))
             continue; // undefined / sentinel → keep env
+        if (key === "approvalRequire") {
+            const staged = stageApprovalRequire(rt[key], logger);
+            if (staged.value === undefined)
+                continue; // 判据未过 ⇒ 只拒该域,保留前值(其余闸不受牵连)
+            assignments.push([key, staged.value]);
+            applied[key] = staged.value;
+            continue;
+        }
         assignments.push([key, rt[key]]); // present (incl. explicit 0/[]) → override
         applied[key] = rt[key];
     }
@@ -439,7 +477,7 @@ function stageRuntimeGates(rt) {
 export function applyRuntimeGates(config, rt, logger) {
     // 独立调用面的兼容壳(测试/外部):stage → 就地赋值 → 通知。applyEffective 不走这里——它把
     // assignments 并进自己的 commit 段以保住整世代原子性([2283]②)。
-    const s = stageRuntimeGates(rt);
+    const s = stageRuntimeGates(rt, logger);
     for (const [k, v] of s.assignments)
         config[k] = v;
     if (s.info)

package/dist/config-center/types.d.ts

@@ -126,10 +126,17 @@ export interface CenterMcpServer {
 export interface EffectiveConfig {
     version: number;
     updatedAt: string;
+    /** [2373]B-6:default/tierGroups/activeTierGroup 收进类型面(registry-core 0.13.0 已声明,
+     *  types.d.ts:641/679/724)——此前 wire 面靠「JSON verbatim + 消费方结构读」逃逸,投影/消费两侧
+     *  各自 as 宽铸。tierGroups 上游是 ZodDefault(合规 center 恒发),但本类型描述的是**到货 JSON**
+     *  (含非合规/旧存量 center),故仍标 optional——消费方 resolveActiveTiers 自身容缺。 */
     models: {
         models: CenterModel[];
         roles: Record<string, CenterRoleTarget>;
         atModelAllowlist?: string[];
+        default?: string;
+        tierGroups?: unknown;
+        activeTierGroup?: string;
     };
     /** OPTIONAL since registry-core 0.7 deleted the teams domain: a 0.7+ center /effective payload
      *  has NO teams key (collab is its successor). Absent/empty ⇒ registerTeams resets to BUILTIN_TEAMS (the
@@ -180,12 +187,12 @@ export interface EffectiveConfig {
     };
     /** 142-S4(registry-core 0.10.0 第 15 域):center 项目登记簿。wire 面 verbatim JSON —
      *  registry-core `ProjectsConfig` 的形状是 `{projects: Record<projectId, ProjectRegistration>}`(skills/mcp
-     *  同款域包裹),但本 interface 宽读两种形态(包裹/裸 Record——projectId 是 UUID,永远不会撞 "projects"
-     *  字面键,判包裹无歧义)。消费=applyEffective → config.projects(displayName/gitRemotes/defaultScopes
+     *  同款域包裹)。[2373]B-8:裸 Record 联合臂随 apply-effective 的宽读一起删(0.13.0 只有包裹形,
+     *  裸形无 producer)。消费=applyEffective → config.projects(displayName/gitRemotes/defaultScopes
      *  三个 runtime 字段;审计字段不进 ServiceConfig)。 */
     projects?: {
         projects?: Record<string, unknown>;
-    } | Record<string, unknown>;
+    };
     /** registry-core 0.6:治理三件(autonomy/commandPolicy/approvalRequire)拆新 governance 域=真值;
      *  过渡期 effective 在 runtime 位双写镜像。读取优先 governance 新位、runtime 旧位 fallback(顺序契约:
      *  消费端先切换、确认后 center 才撤双写,治理闸零 fail-open 窗口)。 */

package/dist/config-provider.d.ts

@@ -53,7 +53,7 @@ export interface ConfigProvider {
 /** The config-provider knobs read off ServiceConfig (a structural subset — avoids importing the whole
  *  ServiceConfig type and keeps this module testable with a plain object). */
 export interface ConfigProviderInput {
-    /** Set when SEMA_REGISTRY_URL (legacy CONFIG_CENTER_URL) is configured (config.ts `configCenter`). `dryRun` is carried through so a
+    /** Set when SEMA_REGISTRY_URL (legacy CONFIG_CENTER_URL now boot-rejects, no dual-read) is configured (config.ts `configCenter`). `dryRun` is carried through so a
      *  remote↔local swap via this seam does NOT drop the dry-run posture main.ts branches on (config.ts
      *  `configCenter.dryRun`); the provider itself does not consume it (the caller still branches on it). */
     configCenter?: {

package/dist/config-provider.js

@@ -210,16 +210,9 @@ export function mapToServiceEffective(eff, version) {
                 ...(m.contextWindow !== undefined ? { contextWindow: m.contextWindow } : {}),
                 ...(m.maxTokens !== undefined ? { maxTokens: m.maxTokens } : {}),
                 // codex F5 ([818]① 1M dual-window): an EXPLICIT `autoCompactTokens` must survive this CLOSED
-                // projection — the remote lane ships the roster JSON verbatim and toModel reads the field
-                // structurally, but the local lane funnels through this mapper, which silently ATE the explicit
-                // value (it then fell back to the contextWindow derivation). Structural read (registry-core's
-                // ModelEntry doesn't declare it — same passthrough posture as tierGroups below). NOTE (honest
-                // gap): registry-core's zod ModelEntry is "strip"-mode, so a value in a config.d/models.json read
-                // through FileConfigStore is ALSO dropped upstream of this mapper — that half needs a registry-core
-                // schema addition; this fix removes OUR projection's drop for any caller of this seam.
-                ...(typeof m.autoCompactTokens === "number"
-                    ? { autoCompactTokens: m.autoCompactTokens }
-                    : {}),
+                // projection. [2373]B-6d:registry-core 0.13.0 已把它收进 ModelEntry schema(types.d.ts:157/212)
+                // ——旧注的「strip-mode 会在上游丢值」的 honest gap 已随那次 schema addition 关闭,结构读改类型直读。
+                ...(typeof m.autoCompactTokens === "number" ? { autoCompactTokens: m.autoCompactTokens } : {}),
                 ...(m.cost !== undefined ? { cost: m.cost } : {}),
                 ...(m.extraBody !== undefined ? { extraBody: m.extraBody } : {}),
                 // registry-core 0.10.13 promptGuidance ([998]⑤c): the CLOSED projection must pass it through or
@@ -232,10 +225,12 @@ export function mapToServiceEffective(eff, version) {
             // 本 mapper 是 CLOSED 投影——不直通则本地 lane 静默丢键(autoCompactTokens 同类病),applyEffective 的
             // resolveDefaultModelName 第一优先级在本地 lane 永远点不亮。写面悬空 ref 由 registry-core superRefine
             // fail-loud;存量/未经 schema 的路径仍由消费方 warn 降级(config-center/facade.ts resolveDefaultModelName)。
-            ...(eff.models.default !== undefined ? { default: eff.models.default } : {}),
+            ...(eff.models.default !== undefined ? { default: eff.models.default } : {}), // [2373]B-6c:0.13.0 类型直读(types.d.ts:641)
             ...(eff.models.atModelAllowlist !== undefined ? { atModelAllowlist: eff.models.atModelAllowlist } : {}),
             // registry-core 0.9.0 档位组: verbatim passthrough — applyEffective's resolveActiveTiers reads
             // these structurally off eff.models (the remote lane ships them JSON-verbatim; the local lane must too).
+            // [2373]B-6b:0.13.0 类型直读(EffectiveConfig.models 面已声明四键,宽铸删)。本地 lane 的
+            // eff 来自 FileConfigStore 原始 JSON(非 zod 输出),tierGroups 的 ZodDefault 恒在场性不适用——门保留。
             ...(eff.models.tierGroups !== undefined ? { tierGroups: eff.models.tierGroups } : {}),
             ...(eff.models.activeTierGroup !== undefined ? { activeTierGroup: eff.models.activeTierGroup } : {}),
         },

package/dist/config-types.d.ts

@@ -299,13 +299,13 @@ export interface ServiceConfigFlat {
         database: string;
         connectionLimit?: number;
     };
-    /** Which SQL engine the durable stores run on (clay 2026-06-21 PG migration; 2026-07-06 wording: canonical
-     *  value is `mysql` = any MySQL-protocol server — MySQL, TiDB, MariaDB — over the same mysql2 pool; the env
-     *  value `tidb` is a back-compat alias normalized to `mysql` at parse). `mysql` reads the `tidb`-named
-     *  connection coords above (MYSQL_* env preferred, TIDB_* accepted); `pg` (PostgreSQL dialect) reads `pg`
-     *  below. A subsystem that selects a DB backend (sessionBackend === "tidb", read as "the SQL DB") then
-     *  runs on the engine `dbBackend` picks. TiDB is fully supported (any MySQL-protocol engine works —
-     *  memory no longer needs a VECTOR column since design/138 moved it onto the file engine). Env: DB_BACKEND. */
+    /** Which SQL engine the durable stores run on (clay 2026-06-21 PG migration). Canonical value is `mysql`
+     *  = any MySQL-protocol server — MySQL, TiDB, MariaDB — over the same mysql2 pool; `pg` (PostgreSQL
+     *  dialect) reads `pg` below. [2354]/[2373]B-3(5.0.0):the env value `tidb` and the TIDB_* coord names
+     *  are RETIRED — `tidb` is rejected by the enum and any TIDB_* env in place refuses to start with the
+     *  MYSQL_* replacement named (see RETIRED_ENVS in config.ts). `mysql` reads MYSQL_* coords only.
+     *  TiDB itself stays fully supported (any MySQL-protocol engine works — memory no longer needs a VECTOR
+     *  column since design/138 moved it onto the file engine). Env: DB_BACKEND. */
     dbBackend: "mysql" | "pg" | "local" | "memory";
     /** clay 拍(2026-07-27):operator 是否显式设了 DB_BACKEND。main.ts 的降级判据——**默认推导**的
      *  local(裸 boot)在 mkdir/ensure 失败时降级 memory + warn + gauge(auto-DB 不可达先例);
@@ -468,11 +468,10 @@ export interface ServiceConfigFlat {
     operatorPrincipals: string[];
     /** Tool names that are always denied. */
     approvalDeny: string[];
-    /** Poll interval (ms) for an approval decision. */
-    approvalPollMs: number;
     /** design/45 durable-checkpoint (core 1.67): when true (+ a TiDB pool), F4 uses durable **suspend/resume**
      *  instead of poll-blocking — a gated tool `ask` suspends the task (status:"suspended" + checkpoint), an
-     *  operator resumes it on any replica. Default OFF → unchanged poll-policy. `DURABLE_APPROVAL=true`. */
+     *  operator resumes it on any replica. Default OFF([2354] A-5:轮询车道已退役,OFF+门意图 ⇒ core UNGATED
+     *  告警,不再有回退门形). `DURABLE_APPROVAL=true`. */
     durableApproval: boolean;
     /** design/80 seam #2 (preemption) / design/74 ("失败≠没做完" third state): when true (+ durable mode), the
      *  /v1/runs durable path opts every task into core `resourceSuspend` — a budget/turns/walltime limit OR a
@@ -797,7 +796,7 @@ export interface ServiceConfigFlat {
         to: string;
         atCostFraction: number;
         reactive: boolean;
-        downgradeOn?: ("rate_limit" | "breaker_open")[];
+        downgradeOn?: import("@sema-agent/core").DegradeReason[];
         toSupportsImages: boolean;
     };
     /** Quality-gate cascade ladder (core 1.45 `runCascade`, opt-in via `cascade:true`): catalog model
@@ -847,25 +846,12 @@ export interface ServiceConfigFlat {
     defaultScenario: string;
     /** Directory of baked-in skill Markdown files, loaded once at startup. */
     skillsDir: string;
-    /** OA backend base URL for the `oa` scenario tools (read /api/v1, write /api/assets). */
-    oaApiBaseUrl?: string;
-    /** Shared trust token forwarded to OA (= OA AGENT_SERVICE_TOKEN); OA enforces per-principal RBAC. */
-    oaServiceToken?: string;
-    /** `oa` 场景的"开 Gitea issue"工具配置(OA AI 请求#5)；仅当 OA_ISSUE_TOKEN 配置时启用。token 来自 env，不入模型/日志。
-     *  上线建议：OA_ISSUE_TOKEN 用**最小权限**(仅 issue:write 的 scope)，别用全权 token。 */
-    oaIssue?: {
-        baseUrl: string;
-        owner: string;
-        repo: string;
-        token: string;
-        defaultLabels?: number[];
-    };
     /** Central sema registry (sema-registry). When set, the service pulls the effective config
      *  on boot (and refreshes) and applies it OVER the env defaults — env is the fallback. Logical config
      *  only (model roster/roles/teams); secrets/gateways stay in this service's env.
-     *  `dryRun` (SEMA_REGISTRY_DRY_RUN=true, legacy CONFIG_CENTER_DRY_RUN): pull + LOG what the registry would change vs the env-derived
+     *  `dryRun` (SEMA_REGISTRY_DRY_RUN=true; legacy CONFIG_CENTER_DRY_RUN now boot-rejects, no dual-read): pull + LOG what the registry would change vs the env-derived
      *  config, but do NOT apply it — a safe-rollout verification step before flipping to live.
-     *  `worker` (SEMA_REGISTRY_WORKER=<name>, legacy CONFIG_CENTER_WORKER; injected per-worker by the reconciler): scopes the pull to
+     *  `worker` (SEMA_REGISTRY_WORKER=<name>; legacy CONFIG_CENTER_WORKER now boot-rejects, no dual-read; injected per-worker by the reconciler): scopes the pull to
      *  that worker's roster via `/effective?worker=<name>`. Unset → the global roster (backward compatible). */
     configCenter?: {
         baseUrl: string;
@@ -874,7 +860,7 @@ export interface ServiceConfigFlat {
         worker?: string;
     };
     /** Dual-mode config SOURCE (DUAL-MODE-DESIGN §4): "remote" (sema-registry HTTP) | "local" (.env + config.d
-     *  via @sema-agent/registry-core FileConfigStore) | unset → remote if SEMA_REGISTRY_URL (legacy CONFIG_CENTER_URL) is set, else pure-env.
+     *  via @sema-agent/registry-core FileConfigStore) | unset → remote if SEMA_REGISTRY_URL (legacy CONFIG_CENTER_URL now boot-rejects, no dual-read) is set, else pure-env.
      *  Env: CONFIG_PROVIDER. The same resolver/EffectiveConfig either way (can't drift). */
     configProvider?: string;
     /** Root dir holding `config.d/<domain>.json` for the local config source. Env: CONFIG_LOCAL_DIR. */
@@ -886,7 +872,7 @@ export type ServiceStoreConfig = Pick<ServiceConfigFlat, "sessionBackend" | "ses
 export type ServiceModelPlaneConfig = Pick<ServiceConfigFlat, "gatewayBaseUrl" | "gatewayApiKey" | "gatewayFallbackUrls" | "gatewayMaxRetries" | "anthropic" | "resilience" | "model" | "models" | "modelApiKeyEnv" | "modelApiKeys" | "modelQuotaWeights" | "tiers" | "projects" | "roles" | "cascadeLadder" | "degrade">;
 /** 组:approval(审批 / HITL 门)。`directDoorActive` 无 env 解析腿(装配层三域合取的产物),但语义上
  *  就是本组的门状态,故进组;`parseApprovalDomain` 的返回类型相应是 `Omit<…, "directDoorActive">`。 */
-export type ServiceApprovalConfig = Pick<ServiceConfigFlat, "approvalRequire" | "approvalDeny" | "approvalPollMs" | "approvalTimeoutSec" | "approvalAutoBudget" | "approvalNeverAuto" | "approvalHmacKeys" | "durableApproval" | "directApprovalDoor" | "directDoorActive" | "resourceSuspend" | "resourceSuspendTtlSec" | "askQuestionEnabled" | "toolApprovalEnabled" | "mcpElicitation" | "sensitiveWritePatterns" | "manualModeShellGate">;
+export type ServiceApprovalConfig = Pick<ServiceConfigFlat, "approvalRequire" | "approvalDeny" | "approvalTimeoutSec" | "approvalAutoBudget" | "approvalNeverAuto" | "approvalHmacKeys" | "durableApproval" | "directApprovalDoor" | "directDoorActive" | "resourceSuspend" | "resourceSuspendTtlSec" | "askQuestionEnabled" | "toolApprovalEnabled" | "mcpElicitation" | "sensitiveWritePatterns" | "manualModeShellGate">;
 /** 组:memory(记忆面 + TOC 同步腿)。 */
 export type ServiceMemoryConfig = Pick<ServiceConfigFlat, "memoryEngineEnabled" | "memoryEngineDir" | "memoryEngineRemoteLaneAllowed" | "memoryEngineBackend" | "memoryScope" | "memorySync" | "projectMemoryEnabled" | "syncImportLeaseStaleSec">;
 /** 组:auth(鉴权 / 身份 / 治理棒)。`commandPolicy` 只有 sema-registry 腿(无 env 标量形),故 env 解析
@@ -899,7 +885,7 @@ export type ServiceLimitsHttpConfig = Pick<ServiceConfigFlat, "port" | "attachme
 /** 组:observability(可观测)。 */
 export type ServiceObservabilityConfig = Pick<ServiceConfigFlat, "metricsToken" | "traceToken" | "toolTrace" | "traceThinking" | "logLevel" | "otel">;
 /** 组:integrations(外部集成)。`mcpServers` 由 sema-registry 适配器填(无 env 腿),归本组。 */
-export type ServiceIntegrationsConfig = Pick<ServiceConfigFlat, "pluginsAllowHosts" | "mcpServers" | "configBootFetchBudgetMs" | "gitApiBaseUrl" | "gitApiToken" | "defaultScenario" | "skillsDir" | "oaApiBaseUrl" | "oaServiceToken" | "oaIssue" | "configCenter" | "configProvider" | "configLocalDir">;
+export type ServiceIntegrationsConfig = Pick<ServiceConfigFlat, "pluginsAllowHosts" | "mcpServers" | "configBootFetchBudgetMs" | "gitApiBaseUrl" | "gitApiToken" | "defaultScenario" | "skillsDir" | "configCenter" | "configProvider" | "configLocalDir">;
 /** 九个组槽。每组恒在场(`loadConfig` / `attachConfigGroups` 装好才交出配置),故不可选——新代码写
  *  `config.modelPlane.model` 不需要 `?.`(可选组会把 `Model` 污染成 `Model | undefined`)。 */
 export interface ServiceConfigGroups {