@sema-agent/server 7.101.1 → 7.103.0

package/dist/center-credential.js

@@ -2,6 +2,7 @@ import { readFileSync } from "node:fs";
 import { createHash } from "node:crypto";
 import { resolve as resolvePath } from "node:path";
 import { looksLikeJwt } from "@sema-agent/settings-schema/api/auth-bridge";
+import { CENTER_CREDENTIAL_ENV, judgeCenterCredentialDeclaration, parseCenterCredentialFile } from "@sema-agent/settings-schema";
 export class CenterCredentialUnavailableError extends Error {
     reason;
     constructor(reason) {
@@ -10,20 +11,9 @@ export class CenterCredentialUnavailableError extends Error {
         this.name = "CenterCredentialUnavailableError";
     }
 }
-export const CENTER_TOKEN_ENV = "SEMA_REGISTRY_TOKEN";
-export const CENTER_TOKEN_FILE_ENV = "SEMA_REGISTRY_TOKEN_FILE";
 export function readCenterCredentialDeclaration(env = process.env) {
-    const token = env.SEMA_REGISTRY_TOKEN ?? "";
-    const file = env.SEMA_REGISTRY_TOKEN_FILE ?? "";
-    if (token !== "" && file !== "") {
-        throw new Error(`${CENTER_TOKEN_ENV} and ${CENTER_TOKEN_FILE_ENV} are both set — pick exactly one: ${CENTER_TOKEN_ENV} carries the credential value, ` +
-            `${CENTER_TOKEN_FILE_ENV} names a file re-read on every request (rotation without restart). Two writers on one credential is a guess, not a config.`);
-    }
-    if (file !== "")
-        return { from: "file", path: resolvePath(file) };
-    if (token !== "")
-        return { from: "env", token };
-    return { from: "absent" };
+    const declared = judgeCenterCredentialDeclaration(env);
+    return declared.from === "file" ? { from: "file", path: resolvePath(declared.path) } : declared;
 }
 const digest16 = (s) => createHash("sha256").update(s, "utf8").digest("hex").slice(0, 16);
 function jwtSubject(bearer) {
@@ -38,56 +28,142 @@ function jwtSubject(bearer) {
         return { missing: "no sub claim" };
     return typeof parsed.sub === "string" && parsed.sub !== "" ? { sub: parsed.sub } : { missing: "sub is not a non-empty string" };
 }
+function userTokenIdentity(bearer) {
+    const s = jwtSubject(bearer);
+    return "sub" in s ? `user-jwt:${digest16(s.sub)}` : `user-jwt-opaque:${digest16(bearer)}`;
+}
 function classify(bearer, worker) {
-    if (looksLikeJwt(bearer)) {
-        const s = jwtSubject(bearer);
-        return { ok: true, kind: "user-jwt", bearer, identity: "sub" in s ? `user-jwt:${digest16(s.sub)}` : `user-jwt-opaque:${digest16(bearer)}` };
-    }
+    if (looksLikeJwt(bearer))
+        return { ok: true, kind: "user-jwt", bearer, identity: userTokenIdentity(bearer) };
     return { ok: true, kind: "pull-token", bearer, identity: pullTokenIdentity(worker), workerScoped: bearer.startsWith("wpt_") };
 }
 export function pullTokenIdentity(worker) {
     return `pull-token:${worker ?? "global"}`;
 }
 const NONE = { ok: true, kind: "none", identity: "none" };
-export function createCenterCredentialSource(declaration, worker, deps = {}) {
-    switch (declaration.from) {
+const PARSER_EMPTY_REASON = "empty";
+function readCredentialText(text, spec, worker, now) {
+    const where = `${CENTER_CREDENTIAL_ENV.tokenFile} ${spec.path}`;
+    const file = parseCenterCredentialFile(text);
+    switch (file.kind) {
+        case "bare":
+            return classify(file.bearer, worker);
+        case "unreadable":
+            return file.reason === PARSER_EMPTY_REASON
+                ? { ok: false, failure: "missing", reason: `${where} is empty` }
+                : { ok: false, failure: "malformed", reason: `${where} does not hold a center credential (${file.reason})` };
+        case "envelope":
+            return readSession(file.envelope, where, spec.multiTenant, now);
+    }
+}
+function readSession(envelope, where, multiTenant, now) {
+    if (multiTenant) {
+        return {
+            ok: false,
+            failure: "multi_tenant_session",
+            reason: `${where} holds a personal sign-in session (a "user-session" envelope) and this deployment is multi-tenant (REQUIRE_PRINCIPAL=true) — a multi-tenant service never acts as one person's session; give it the worker pull token (one bare line) instead`,
+        };
+    }
+    const expiresAt = Date.parse(envelope.expiresAt);
+    if (!Number.isFinite(expiresAt)) {
+        return { ok: false, failure: "malformed", reason: `${where} holds an envelope whose expiresAt is not a readable instant` };
+    }
+    const identity = userTokenIdentity(envelope.accessToken);
+    if (expiresAt <= now) {
+        return { ok: false, failure: "expired", reason: `${where} holds a sign-in session whose access token expired at ${envelope.expiresAt} — not sent (the renewer re-mints it; sign in again if renewal keeps failing)`, identity, expiresAt };
+    }
+    return { ok: true, kind: "user-session", bearer: envelope.accessToken, identity, expiresAt };
+}
+export function createCenterCredentialSource(spec, worker, deps = {}) {
+    const listeners = new Set();
+    const onRead = (listener) => {
+        listeners.add(listener);
+        return () => {
+            listeners.delete(listener);
+        };
+    };
+    const observed = (r) => {
+        for (const listener of listeners)
+            listener(r);
+        return r;
+    };
+    switch (spec.from) {
         case "absent":
-            return { origin: declaration, declared: false, read: () => NONE, health: () => ({ state: "ok" }) };
+            return { origin: spec, declared: false, read: () => observed(NONE), health: () => ({ state: "ok" }), onRead };
         case "env": {
-            const fixed = classify(declaration.token, worker);
-            return { origin: { from: "env" }, declared: true, read: () => fixed, health: () => ({ state: "ok" }) };
+            const fixed = classify(spec.token, worker);
+            return { origin: { from: "env" }, declared: true, read: () => observed(fixed), health: () => ({ state: "ok" }), onRead };
         }
         case "file": {
             const readFile = deps.readFile ?? ((p) => readFileSync(p, "utf8"));
             const now = deps.now ?? Date.now;
             let health = { state: "ok" };
-            const fail = (reason) => {
-                health = health.state === "unreadable" ? { ...health, reason, failures: health.failures + 1 } : { state: "unreadable", reason, since: now(), failures: 1 };
-                return { ok: false, reason };
+            const readOnce = () => {
+                let text;
+                try {
+                    text = readFile(spec.path);
+                }
+                catch (err) {
+                    const code = err instanceof Error && "code" in err && typeof err.code === "string" ? err.code : "read error";
+                    return { ok: false, failure: "missing", reason: `${CENTER_CREDENTIAL_ENV.tokenFile} ${spec.path} is unreadable (${code})` };
+                }
+                return readCredentialText(text, spec, worker, now());
             };
             return {
-                origin: declaration,
+                origin: { from: "file", path: spec.path },
                 declared: true,
                 read() {
-                    let text;
-                    try {
-                        text = readFile(declaration.path);
-                    }
-                    catch (err) {
-                        const code = err instanceof Error && "code" in err && typeof err.code === "string" ? err.code : "read error";
-                        return fail(`${CENTER_TOKEN_FILE_ENV} ${declaration.path} is unreadable (${code})`);
-                    }
-                    const bearer = text.trim();
-                    if (bearer === "")
-                        return fail(`${CENTER_TOKEN_FILE_ENV} ${declaration.path} is empty`);
-                    health = { state: "ok" };
-                    return classify(bearer, worker);
+                    const r = readOnce();
+                    if (r.ok)
+                        health = { state: "ok" };
+                    else if (health.state === "unreadable")
+                        health = { ...health, failure: r.failure, reason: r.reason, failures: health.failures + 1 };
+                    else
+                        health = { state: "unreadable", failure: r.failure, reason: r.reason, since: now(), failures: 1 };
+                    return observed(r);
                 },
                 health: () => health,
+                onRead,
             };
         }
     }
 }
+export const CENTER_CREDENTIAL_REFUSAL_CODES = {
+    malformed: "config.center_credential_malformed",
+    multi_tenant_session: "config.center_credential_user_session_multi_tenant",
+};
+export function judgeCenterCredentialAtBoot(read) {
+    if (read.ok)
+        return { verdict: "serve" };
+    switch (read.failure) {
+        case "missing":
+            return {
+                verdict: "loud",
+                failure: read.failure,
+                reason: read.reason,
+                effect: "every center request fails its own failure arm until the file is readable (config pull keeps env/LKG-less boot, caps fail-closed, lease takes the loud auth-error arm); no on-disk LKG / prompt state is read back (credential identity unknown)",
+            };
+        case "expired":
+            return {
+                verdict: "loud",
+                failure: read.failure,
+                reason: read.reason,
+                effect: "no center request carries the expired token; the renewer re-mints it now when renewal is on (CENTER_CREDENTIAL_RENEW_LEAD_MS > 0), otherwise requests fail their own failure arms until the shell rewrites the file; the on-disk LKG / prompt state of this identity is read back as usual",
+            };
+        case "malformed": {
+            const code = CENTER_CREDENTIAL_REFUSAL_CODES.malformed;
+            return {
+                verdict: "refuse",
+                code,
+                sentence: `center credential refused at boot [${code}]: ${read.reason}. The file must hold one bare token line, or the sign-in envelope the shell writes (a CenterCredentialEnvelope JSON object); sign in again so the shell rewrites it, or fix the file — its content is never echoed.`,
+            };
+        }
+        case "multi_tenant_session": {
+            const code = CENTER_CREDENTIAL_REFUSAL_CODES.multi_tenant_session;
+            return { verdict: "refuse", code, sentence: `center credential refused at boot [${code}]: ${read.reason}.` };
+        }
+    }
+}
 export function scopedTokenNeedsWorker(read, worker) {
     return read.ok && read.kind === "pull-token" && read.workerScoped && !worker;
 }
@@ -95,8 +171,7 @@ export function centerStateBin(worker, identity) {
     return `${worker === undefined ? "global" : `worker-${digest16(worker)}`}.id-${digest16(identity)}`;
 }
 export function credentialIdentityNow(source) {
-    const r = source.read();
-    return r.ok ? r.identity : undefined;
+    return source.read().identity;
 }
 export function answerStillCurrent(source, usedIdentity) {
     return usedIdentity !== undefined && credentialIdentityNow(source) === usedIdentity;
@@ -121,11 +196,12 @@ function pinCredential(source, identity) {
             if (!r.ok)
                 return r;
             if (identity === undefined) {
-                return { ok: false, reason: "this state bin was opened while the center credential was unreadable (identity unknown) — it never talks to the center; the next call runs in the current identity's bin" };
+                return { ok: false, failure: "missing", reason: "this state bin was opened while the center credential was unreadable (identity unknown) — it never talks to the center; the next call runs in the current identity's bin" };
             }
-            return r.identity === identity ? r : { ok: false, reason: "center credential identity changed — this request belongs to the previous identity's state bin and is not sent" };
+            return r.identity === identity ? r : { ok: false, failure: "missing", reason: "center credential identity changed — this request belongs to the previous identity's state bin and is not sent" };
         },
         health: () => source.health(),
+        onRead: (listener) => source.onRead(listener),
     };
 }
 //# sourceMappingURL=center-credential.js.map

package/dist/config-catalog.js

@@ -1,6 +1,8 @@
 import { CROSS_SESSION_INBOUND_SETTINGS, CROSS_SESSION_DIALOG_EXPIRY_VALUES } from "@sema-agent/core";
+import { CENTER_CREDENTIAL_ENV } from "@sema-agent/settings-schema";
+import { CENTER_CREDENTIAL_RENEW_LEAD_DEFAULT_MS, CENTER_CREDENTIAL_RENEW_LEAD_MAX_MS, CENTER_CREDENTIAL_RENEW_LEAD_MIN_MS } from "./center-credential-renewer.js";
 import { THINKING_FORMATS } from "./model-compat.js";
-import { RESILIENCE_DEFAULTS, TASK_WRITE_FACE_ESCALATIONS } from "./config-types.js";
+import { AUTO_MODE_CLASSIFIER_TIMEOUT_BOUNDS, DRAIN_SECOND_SIGNAL_MIN_GAP_BOUNDS, DRAIN_SECOND_SIGNAL_MIN_GAP_DEFAULT_MS, FIRST_BYTE_TIMEOUT_BOUNDS, RESILIENCE_DEFAULTS, TASK_WRITE_FACE_ESCALATIONS } from "./config-types.js";
 import { webSearchProviderFromEnv, WEB_SEARCH_PROVIDERS } from "./plugins/web-search.js";
 import { AUTONOMY_MODES } from "./runtime-governance.js";
 import { REMOTE_EXEC_PROVIDER_WORDS } from "./execution-lane-caps.js";
@@ -8,6 +10,7 @@ import { CENTER_READ_FACE_LIVE_KEYS } from "./config-center/read-face.js";
 import { MODEL_PROVIDER_WORDS } from "./model-provider.js";
 import { buildDisplaySafeUrl } from "./trace/redact.js";
 import { describeAllowlistPostures } from "./env-name-allowlist-knobs.js";
+import { buildOutboundProxyPosture } from "./outbound-dispatcher.js";
 export const CATALOG_VALUE_TYPES = ["boolean", "number", "string", "enum", "csv", "json", "path", "url", "secret", "opaque"];
 export const CATALOG_TIMINGS = ["hot", "restart", "deploy", "inert"];
 export const CATALOG_DANGER_AXES = ["security", "billing", "data"];
@@ -78,6 +81,7 @@ export const CONFIG_CATALOG = [
     r("AUTH_BRIDGE_JWKS_URL", "auth", "url", "registry SSO-JWT 的 JWKS 地址(缺省从 issuer 派生)", { danger: SEC }),
     r("AUTONOMY", "auth", "enum", "运维 autonomy 模式,tighten-only 叠到每个 TaskSpec(read-only/plan ⇒ 只读手,ask ⇒ 恒 shellGate);center 腿热且 non-sticky", { danger: SEC, enumValues: AUTONOMY_MODES, configKey: "autonomy", center: cGov("autonomy") }),
     r("AUTO_MODE_CLASSIFIER_FALLBACK", "approval", "enum", "auto 分类器席答不出裁决时的梯子(main=主模型代判 / none=只留分类器那一级,整条拒)", { enumValues: ["main", "none"], danger: SEC, derivedDefaultNote: "未设/空串 ⇒ 不铸键,跟随引擎缺省 main(core 7.18.0 起;空串按未设,与其余词表旋钮同判);none = 7.77.0 及以前的行为逐字;词表外的值启动期拒启。权限轴放宽,升级须知见 DEPLOY-PREREQS", configKey: "autoModeClassifierFallback" }),
+    r("AUTO_MODE_CLASSIFIER_TIMEOUT_MS", "approval", "number", `auto 分类器单级判决上限(ms;缺席 = core 缺省;自托管慢网关按排队 + prefill 留足;一级到点没裁 ⇒ 走下一级,走完仍没裁 ⇒ 这次门控调用整条拒;须为 [${AUTO_MODE_CLASSIFIER_TIMEOUT_BOUNDS.minMs}, ${AUTO_MODE_CLASSIFIER_TIMEOUT_BOUNDS.maxMs}] 内十进制整数,0 / 小数 / 越界拒启)`, { derivedDefaultNote: "未设/空串 ⇒ 不铸键,跟随 core 缺省(本仓不复制上游数字;core 改缺省本旋钮照映不改)", configKey: "autoModeClassifierTimeoutMs" }),
     r("BAKE_CACHE_BASE", "orchestration", "url", "烤镜像 fetch-once 缓存源 base(注入 --cache-base;绝不受调用方控制)"),
     r("BAKE_IMAGE_REGISTRY", "orchestration", "string", "烤镜像自动登记的 registry host 前缀(repo=registry/profile)"),
     r("BAKE_LEASE_MS", "orchestration", "number", "bake 租约窗(ms;runner 心跳推进,过期被 reaper 抢)", { staticDefault: "90000" }),
@@ -89,6 +93,7 @@ export const CONFIG_CATALOG = [
     r("BG_AGENT_RETENTION_MS", "orchestration", "number", "TERMINAL 后台 agent 行保留期(ms,reaper 按 scope 清)", { staticDefault: String(7 * 24 * 60 * 60 * 1000), danger: DATA, configKey: "backgroundAgentRetentionMs" }),
     r("BG_AGENT_STALE_RUNNING_MS", "orchestration", "number", "running 后台 agent 行写者心跳断更超此值翻 failed(ms;下限 10min 硬钳)", { staticDefault: String(15 * 60_000), configKey: "backgroundAgentStaleRunningMs" }),
     r("BIND_HOST", "auth", "string", "监听绑址(显式值恒生效)", { danger: SEC, derivedDefaultNote: "缺席:无鉴权写面(allowUnauthedWrites ∧ 零凭证)自动收窄 127.0.0.1,其余全接口", resolve: (c) => c.bindHost ?? null }),
+    r("CENTER_CREDENTIAL_RENEW_LEAD_MS", "integrations", "number", `center 凭证续签提前量(ms;${CENTER_CREDENTIAL_ENV.tokenFile} 指向人的登录会话信封时,访问令牌离到期 ≤ 本值即由引擎续签并原子改写同一文件;0 = 关续签只读信封;其余须为 [${CENTER_CREDENTIAL_RENEW_LEAD_MIN_MS}, ${CENTER_CREDENTIAL_RENEW_LEAD_MAX_MS}] 内整数,坏值拒启;裸行 / 值形凭证不续签)`, { staticDefault: String(CENTER_CREDENTIAL_RENEW_LEAD_DEFAULT_MS), danger: SEC, configKey: "centerCredentialRenewLeadMs" }),
     r("COMPLIANCE_ADDITIONAL_DENIES", "auth", "csv", "合规档位之上额外拒绝的能力名(只能收紧;词表=core 闭集,拼错拒启)", { danger: SEC }),
     r("COMPLIANCE_PROFILE", "auth", "enum", "本部署合规档位(core compliancePostureResolver 供数;拼错拒启)", { danger: SEC, enumValues: ["hipaa", "zdr"], resolve: (c) => c.compliancePosture?.profile ?? null }),
     r("CONFIG_BOOT_FETCH_BUDGET_MS", "integrations", "number", "boot 首拉配置的抢答窗(ms;过窗以 env/兜底起服,拉取转后台热应用)", { staticDefault: "1500", configKey: "configBootFetchBudgetMs" }),
@@ -128,6 +133,7 @@ export const CONFIG_CATALOG = [
     r("DOCKER_PIDS_LIMIT", "orchestration", "number", "local-docker fork-bomb 背栓(--pids-limit;非法值回 adapter 默认 512+warn)", { danger: SEC, derivedDefaultNote: "缺席 ⇒ adapter 默认 512" }),
     r("DOCKER_SANDBOX_ENV", "orchestration", "secret", "local-docker 车道每条 docker exec 以 -e 注入的本进程 env 点名表(NAME,NAME;点到的键从 worker env 原样取,值不进 spec/center/日志;与 LSP_ENV_ALLOW / E2B_SANDBOX_ENV 同一只解析器与「点名放行」谓词:形错 / 点名名单型旋钮拒启且不回显值;本进程环境里没有的名按序号 warn、不转发;只在本车道被选中时求值;原文按凭据类对待:只回在场位、不进任何子进程)", { danger: SEC }),
     r("DRAIN_GRACE_MS", "limitsHttp", "number", "SIGTERM 优雅排空窗(ms;期间新计费提交 503+Retry-After)。出厂默认是**服务器部署**的取值;壳自 spawn 的引擎会被壳注入更短的窗 ⇒ 排壳形关机预算时以本行的 effectiveValue(= 本进程实际生效值)为准,不照抄 staticDefault", { staticDefault: String(10 * 60 * 1000), configKey: "drainGraceMs", center: cLimits("drainGraceMs") }),
+    r("DRAIN_SECOND_SIGNAL_MIN_GAP_MS", "limitsHttp", "number", `排空期「第二发信号 = 硬停」的最小间隔(ms;锚 = 排空起点。SIGTERM / SIGINT 与起点相隔不足 ⇒ 同一拍的重复投递,一行 drain_duplicate_signal_ignored 后忽略、排空继续;0 = 关,恒按第二发硬停;须为 [${DRAIN_SECOND_SIGNAL_MIN_GAP_BOUNDS.minMs}, ${DRAIN_SECOND_SIGNAL_MIN_GAP_BOUNDS.maxMs}] 内十进制整数(上界 = DRAIN_GRACE_MS 地板),小数 / 负数 / 越界拒启)`, { staticDefault: String(DRAIN_SECOND_SIGNAL_MIN_GAP_DEFAULT_MS), configKey: "drainSecondSignalMinGapMs" }),
     r("DURABLE_APPROVAL", "approval", "boolean", "durable suspend/resume HITL(需 SQL 店;决定 checkpointStore 与 /v1/approvals 面的存在性)", { danger: SEC, derivedDefaultNote: "posture 三态(S-178):显式词恒赢,缺席 = 单用户(REQUIRE_PRINCIPAL≠true)且有耐久店 ⇒ on / 多租户或无耐久店 ⇒ off;生效来源见 GET /v1/diagnostics/wiring 的 serverGates.durableApproval.source", configKey: "durableApproval" }),
     r("E2B_ALLOW_NET", "orchestration", "boolean", "e2b 沙箱出网许可", { danger: SEC, derivedDefaultNote: "缺席 ⇒ 不铸键(adapter 默认允许)" }),
     r("E2B_API_KEY", "orchestration", "secret", "E2B 车道 API 凭据(REMOTE_EXEC=e2b 必需件)", { danger: [...SEC, ...BILL] }),
@@ -157,7 +163,7 @@ export const CONFIG_CATALOG = [
     r("HOST_BG_DEFAULT_TIMEOUT_SEC", "orchestration", "number", "host 后台 shell 缺省超时(秒)", { staticDefault: "300" }),
     r("HOST_BG_ENABLED", "orchestration", "boolean", "host 车道后台 shell 开关", { staticDefault: "true" }),
     r("HOST_BG_FILE_CAP", "orchestration", "number", "host 后台 shell 磁盘护栏(字节;失控输出被 reap)", { staticDefault: String(64 * 1024 * 1024) }),
-    r("HOST_BG_KILL_GRACE_MS", "orchestration", "number", "host 后台 shell SIGTERM→SIGKILL 宽限(ms)", { staticDefault: "1000" }),
+    r("HOST_BG_KILL_GRACE_MS", "orchestration", "number", "host 后台 shell SIGTERM→SIGKILL 宽限(ms);会话删除 / 会话停止口在软停与硬收之间等同一只", { staticDefault: "1000" }),
     r("HOST_BG_MAX_CONCURRENT", "orchestration", "number", "host 后台 shell 并发帽", { staticDefault: "8" }),
     r("HOST_BG_MAX_TIMEOUT_SEC", "orchestration", "number", "host 后台 shell 超时上限(秒)", { staticDefault: "1800" }),
     r("HOST_BG_MEM_CAP", "orchestration", "number", "host 后台 shell 内存流护栏(字节)", { staticDefault: String(8 * 1024 * 1024) }),
@@ -167,6 +173,8 @@ export const CONFIG_CATALOG = [
     r("HOST_FS_DRAIN_WAIT_MS", "orchestration", "number", "host 执行环境拆除时等在飞文件写落地的上界(ms;到点 destroy 返回,rm 仍排在那批写之后;下限 1)", { staticDefault: "10000" }),
     r("HOST_SHELL_PATH", "orchestration", "path", "host 车道 shell 覆写口(POSIX 与 win32 同源解析)"),
     r("HOST_WORKSPACE_BASE", "orchestration", "path", "host 车道工作区 base"),
+    r("HTTPS_PROXY", "limitsHttp", "url", "https: 目标的出网代理 —— 平台标准变量(小写 `https_proxy` 同认且优先 —— 与 undici 读 env 逐字同序);server 进程**所有走 undici 的出网跳**都认:引擎 → 网关、中心拉取 / 公告 / 凭证续签、WebSearch、对象存储、OTLP …(e2b / k8s SDK、ws、git 子进程不在此列,见 USAGE「出网代理」);**回环 / 未指定地址目标恒直连,不看 NO_PROXY**;userinfo 译成 `Proxy-Authorization`,回显 display-safe;Node 运行时下 undici 用不了的值(无 scheme、带路径 / 查询)拒启,机读码 `config.outbound_proxy_invalid`(Bun 运行时不校验);回显只出 scheme//host[:port],形不干净整只占位;boot 冻结;只设小写拼法时本行 envHeld 读 false(目录按大写名判在场),值照实回显", { danger: SEC, derivedDefaultNote: "缺席 / 空 ⇒ https 目标走 HTTP_PROXY(undici 的回落,不是本仓的发明);两者都缺 ⇒ 直连", resolve: (_c, env) => buildOutboundProxyPosture(env).httpsProxy }),
+    r("HTTP_PROXY", "limitsHttp", "url", "http: 目标的出网代理(https 目标在 HTTPS_PROXY 缺席时也走它)—— 平台标准变量(小写 `http_proxy` 同认且优先 —— 与 undici 读 env 逐字同序);server 进程**所有走 undici 的出网跳**都认:引擎 → 网关、中心拉取 / 公告 / 凭证续签、WebSearch、对象存储、OTLP …(e2b / k8s SDK、ws、git 子进程不在此列,见 USAGE「出网代理」);**回环 / 未指定地址目标恒直连,不看 NO_PROXY**;userinfo 译成 `Proxy-Authorization`,回显 display-safe;Node 运行时下 undici 用不了的值(无 scheme、带路径 / 查询)拒启,机读码 `config.outbound_proxy_invalid`(Bun 运行时不校验);回显只出 scheme//host[:port],形不干净整只占位;boot 冻结;只设小写拼法时本行 envHeld 读 false(目录按大写名判在场),值照实回显", { danger: SEC, derivedDefaultNote: "缺席 ⇒ http 目标直连", resolve: (_c, env) => buildOutboundProxyPosture(env).httpProxy }),
     r("IMAGE_BAKES_ENABLED", "orchestration", "boolean", "烤镜像 job API(/v1/images/bakes*;需 SQL 池 + 非空 operator 名单,boot 断言)", { staticDefault: "false", danger: SEC }),
     r("INFRA_COST_EGRESS_GB", "limitsHttp", "number", "出网计费费率(per-run 出网计量未接,恒乘 0 —— 设非零会 boot 点名)", { staticDefault: "0", danger: BILL, envTiming: "inert", center: cLimits("infraCostRates.egressGbMicroUsd", { timing: "inert" }) }),
     r("INFRA_COST_SANDBOX_SEC", "limitsHttp", "number", "沙箱秒基建费率(0=不计价)", { staticDefault: "0", danger: BILL, center: cLimits("infraCostRates.sandboxSecMicroUsd") }),
@@ -209,7 +217,7 @@ export const CONFIG_CATALOG = [
     r("LOCKED_CONFIG_KEYS", "auth", "csv", "管理员锁定层声明(词表=core 闭集注册表,未知键拒启)", { danger: SEC, configKey: "lockedConfigKeys" }),
     r("LOG_LEVEL", "observability", "string", "日志档位", { staticDefault: "info", configKey: "logLevel" }),
     r("LSP_ENABLED", "orchestration", "boolean", "LSP 沙箱腿 opt-in(需烤好的 LSP 模板;host 腿另有 LSP_HOST_ENABLED)", { staticDefault: "false", configKey: "lspEnabled" }),
-    r("LSP_ENV_ALLOW", "orchestration", "secret", `host 腿语言服务器子进程 env 的点名放行名单(点到的键从服务 env 原样放回、部署方显式承担;没点到的照剥;与 host shell inheritEnv:[names] 同一只谓词;形错 / 点名名单型旋钮(自己或两只沙箱名单)拒启且不回显值;本进程环境里没有的名按序号 warn、不放行、不回显;多租户姿态(忽略时起服 warn 一次):${describeAllowlistPostures()};原文按凭据类对待:只回在场位、不进任何子进程,生效名单见起服披露行 allowed)`, { danger: SEC, derivedDefaultNote: "缺席 / 空串 ⇒ 空名单 = 全剥(7.100.0 行为)" }),
+    r("LSP_ENV_ALLOW", "orchestration", "secret", `host 腿语言服务器子进程 env 的点名放行名单(点到的键从服务 env 原样放回、部署方显式承担;没点到的照剥;与 host shell inheritEnv:[names] 同一只谓词;形错 / 点名任一只名单型旋钮(含自己)拒启且不回显值;本进程环境里没有的名按序号 warn、不放行、不回显;多租户姿态(忽略时起服 warn 一次):${describeAllowlistPostures()};原文按凭据类对待:只回在场位、不进任何子进程,生效名单见起服披露行 allowed)`, { danger: SEC, derivedDefaultNote: "缺席 / 空串 ⇒ 空名单 = 全剥(7.100.0 行为)" }),
     r("LSP_HOST_ENABLED", "orchestration", "boolean", "LSP host 腿开关(本机 language server,优雅降级)", { staticDefault: "true", configKey: "lspHostEnabled" }),
     r("MANUAL_MODE_SHELL_GATE", "approval", "enum", "手动模式 shell 门收紧腿(off=no-op 非放松 —— 本键只有收紧半场;拼错拒启)", { danger: SEC, enumValues: ["always", "classify", "off"], echoWords: ["always", "classify"], resolve: (c) => c.manualModeShellGate ?? null, derivedDefaultNote: "off/未设 ⇒ 本键不贡献任何东西(归一成键缺席)⇒ 回显 null;真姿态只有 always/classify 两个" }),
     r("MAX_PRINCIPAL_COST_USD", "limitsHttp", "number", "per-principal 窗内成本天花板(0=关)", { staticDefault: "0", danger: BILL, configKey: "maxPrincipalCostUsd", center: cLimits("maxPrincipalCostUsd") }),
@@ -272,7 +280,6 @@ export const CONFIG_CATALOG = [
     r("MODEL_CHEAP_VISION", "modelPlane", "boolean", "cheap 槽 vision 声明(三态:缺席继承主模型;text-only cheap 必设 false 让预检真拦)", { derivedDefaultNote: "缺席 ⇒ 继承主模型" }),
     r("MODEL_CIRCUIT_BREAKER", "modelPlane", "boolean", "模型腿熔断开关", { staticDefault: String(RESILIENCE_DEFAULTS.circuitBreaker.value) }),
     r("MODEL_CODE_ROLES", "modelPlane", "csv", "给点名 role 附编码 persona(role 表内名字才生效)"),
-    r("MODEL_CONNECT_TIMEOUT_MS", "modelPlane", "number", "连接超时(ms;0=关)", { staticDefault: String(RESILIENCE_DEFAULTS.connectTimeoutMs.value) }),
     r("MODEL_CONTEXT_WINDOW", "modelPlane", "number", "主模型上下文窗声明", { staticDefault: "262144", configKey: "model", resolve: (c) => c.model.contextWindow ?? null, center: cModels("models[].contextWindow") }),
     r("MODEL_COST_CACHE_READ", "modelPlane", "number", "主模型 cache-read 单价(per-1M USD;显式 0=声明免费,不是「没配」)", { derivedDefaultNote: "四键全缺席 ⇒ 未定价(不铸 cost 键,成本读面缺席);任一设 ⇒ 四键在场,未设的按 0 显式", danger: BILL, resolve: (c) => c.model.cost?.cacheRead ?? null, center: cModels("models[].cost.cacheRead") }),
     r("MODEL_COST_CACHE_WRITE", "modelPlane", "number", "主模型 cache-write 单价", { derivedDefaultNote: "四键全缺席 ⇒ 未定价(不铸 cost 键,成本读面缺席);任一设 ⇒ 四键在场,未设的按 0 显式", danger: BILL, resolve: (c) => c.model.cost?.cacheWrite ?? null, center: cModels("models[].cost.cacheWrite") }),
@@ -285,12 +292,13 @@ export const CONFIG_CATALOG = [
     r("MODEL_DEGRADE_TO", "modelPlane", "string", "降级目标模型(设了=开降级;外部网关名不必在目录)", { danger: BILL }),
     r("MODEL_DEGRADE_TO_VISION", "modelPlane", "boolean", "降级目标的 vision 声明(false ⇒ 带图任务丢降级不丢图)", { staticDefault: "false" }),
     r("MODEL_EXTRA_BODY", "modelPlane", "opaque", "生成参数直通 JSON(top_k/logit_bias 等;必须静态 —— 前缀缓存键序)", { danger: SEC }),
-    r("MODEL_FIRST_TOKEN_TIMEOUT_MS", "modelPlane", "number", "首 token 超时(ms;0=关 —— 开流不吐字的唯一看门狗;自托管长 prefill 后端按此档留足)", { staticDefault: String(RESILIENCE_DEFAULTS.firstTokenTimeoutMs.value) }),
+    r("MODEL_FIRST_BYTE_TIMEOUT_MS", "modelPlane", "number", `请求发出 → 响应头的等待(ms;缺席 = core 缺省 + 上传宽限;到点 core 自有一次加宽重试,配了 MODEL_GATEWAY_FALLBACK_URLS 也一样(之后才切备;server 不铸 firstByteRetries);0 = 该段不设引擎钟、传输层的响应头 / 响应体钟也关(TCP + TLS 建连仍归传输层自己的钟);自托管慢网关按排队 + prefill 留足;failover 拓扑想快切须显式设小;须为 [${FIRST_BYTE_TIMEOUT_BOUNDS.minMs}, ${FIRST_BYTE_TIMEOUT_BOUNDS.maxMs}] 内十进制整数,其余拒启)`, { derivedDefaultNote: "未设/空串 ⇒ 不铸键,跟随 core 缺省(本仓不复制上游数字;core 改缺省本旋钮照映不改)", resolve: (c) => c.resilience.firstByteTimeoutMs ?? null }),
+    r("MODEL_FIRST_TOKEN_TIMEOUT_MS", "modelPlane", "number", "首 token 超时(ms;0 = 该段不设引擎钟、传输层的响应体钟也关 —— 开流不吐字的唯一看门狗;自托管长 prefill 后端按此档留足)", { staticDefault: String(RESILIENCE_DEFAULTS.firstTokenTimeoutMs.value) }),
     r("MODEL_FREQUENCY_PENALTY", "modelPlane", "number", "frequency_penalty 直通(压过 EXTRA_BODY 同键)"),
     r("MODEL_GATEWAY_BASEURL", "modelPlane", "url", "openai 兼容网关 base URL(S-623:**无出厂缺省** —— 配置能派发到的每条 openai 兼容路由都必须解析到显式端点(条目自己的 baseUrl,或本键),否则拒启 / 热路径整批拒,机读码 `config.model_route_endpoint_missing`,拒因点名条目并给出本机写法 `MODEL_GATEWAY_BASEURL=<本机网关>/v1`;anthropic 单路由部署不设本键合法;S-475:带 userinfo 拒启,机读码 `config.gateway_url_userinfo` —— WHATWG 禁止用带凭据的 URL 构造 fetch Request,凭据放 MODEL_API_KEY;S-483:解析不动/不透明形拒启,机读码 `config.model_route_url_invalid`;S-514:带 `#fragment` 拒启,机读码 `config.model_route_url_fragment`)", { derivedDefaultNote: "缺席 ⇒ 本部署没有网关(不铸键);有 openai 路由落不到端点 ⇒ 拒启", configKey: "gatewayBaseUrl", center: cModels("models[].baseUrl") }),
     r("MODEL_GATEWAY_FALLBACK_URLS", "modelPlane", "url", "网关故障转移地址表(CSV;S-623:主网关 MODEL_GATEWAY_BASEURL 未设而本键设了 ⇒ 拒启,机读码 `config.gateway_fallback_without_primary` —— 备用是主网关的镜像;S-475:**逐项**判 userinfo,任一项带 ⇒ 拒启,机读码 `config.gateway_url_userinfo`;S-483:逐项判可解析性,机读码 `config.model_route_url_invalid`;S-514:**逐项**判 `#fragment`,机读码 `config.model_route_url_fragment`)", { configKey: "gatewayFallbackUrls" }),
     r("MODEL_ID", "modelPlane", "string", "主模型 id(3.0.0 起无出厂缺省,缺 ⇒ 拒启指路)", { configKey: "model", resolve: (c) => c.model.id, center: cModels("models[].id") }),
-    r("MODEL_IDLE_TIMEOUT_MS", "modelPlane", "number", "流中静默看门狗(ms;0=关)", { staticDefault: String(RESILIENCE_DEFAULTS.idleTimeoutMs.value) }),
+    r("MODEL_IDLE_TIMEOUT_MS", "modelPlane", "number", "流中静默看门狗(ms;0 = 该段不设引擎钟、传输层的响应体钟也关)", { staticDefault: String(RESILIENCE_DEFAULTS.idleTimeoutMs.value) }),
     r("MODEL_MAX_TOKENS", "modelPlane", "number", "主模型输出上限", { derivedDefaultNote: "缺席 ⇒ min(32000, contextWindow)", resolve: (c) => c.model.maxTokens ?? null, center: cModels("models[].maxTokens") }),
     r("MODEL_PRESENCE_PENALTY", "modelPlane", "number", "presence_penalty 直通"),
     r("MODEL_PROVIDER", "modelPlane", "enum", "主模型 provider(路由选 brain;S-461 起是闭集,词表外的值启动期拒启并点名机读码 `config.model_provider_invalid`)", { enumValues: MODEL_PROVIDER_WORDS, derivedDefaultNote: "缺席:ANTHROPIC base+cred 同在 ⇒ anthropic,否则 gateway", resolve: (c) => c.model.provider, center: cModels("models[].provider") }),
@@ -323,6 +331,7 @@ export const CONFIG_CATALOG = [
     r("MYSQL_POOL_SIZE", "store", "number", "MySQL 连接池上限(坏值回 driver 默认+warn)", { derivedDefaultNote: "缺席 ⇒ driver 默认池" }),
     r("MYSQL_PORT", "store", "number", "MySQL 协议端口", { staticDefault: "3306" }),
     r("MYSQL_USER", "store", "string", "MySQL 协议用户", { danger: DATA }),
+    r("NO_PROXY", "limitsHttp", "csv", "不走代理的目标(小写 `no_proxy` 同认且优先);语法 = undici 的:逗号或空白分隔,`host` 精确且含其子域、`.host` / `*.host` 后缀、`host:port` 限端口、`*` 全直连;**回环 / 未指定地址目标无论写没写都直连**(本仓的无条件规则,不是 NO_PROXY 的一条);boot 冻结", { danger: SEC, derivedDefaultNote: "缺席 ⇒ 除回环外一律按 HTTP(S)_PROXY 走", resolve: (_c, env) => buildOutboundProxyPosture(env).noProxy }),
     r("OPERATOR_PRINCIPALS", "auth", "csv", "operator 名单(operator lane 全族门;审批队列上空名单=旧行为 token 即 operator,explicitOperatorOk 族空名单=谁都不是)", { danger: SEC, configKey: "operatorPrincipals" }),
     r("OTEL_EXPORTER_OTLP_ENDPOINT", "observability", "url", "OTLP 出口(设了=开 otel)"),
     r("OTEL_EXPORTER_OTLP_HEADERS", "observability", "secret", "OTLP 出口头(k=v CSV;常载鉴权头 ⇒ 按凭据处置)", { danger: SEC }),
@@ -395,8 +404,8 @@ export const CONFIG_CATALOG = [
     r("SEMA_PIP_INDEX", "orchestration", "url", "SANDBOX_PKG_SOURCE=custom 的显式 pip index 地址"),
     r("SEMA_REGISTRY_ADMIN_TOKEN", "integrations", "secret", "写 center 的管理凭证(仅 boot 上报执行公钥用;刻意不入 ServiceConfig —— 不进 configHash/日志面)", { danger: SEC, scope: "bootstrap-only" }),
     r("SEMA_REGISTRY_DRY_RUN", "integrations", "boolean", "center 腿 dry-run(拉而不应用)", { staticDefault: "false" }),
-    r("SEMA_REGISTRY_TOKEN", "integrations", "secret", "center 拉取凭据(值形;与 SEMA_REGISTRY_TOKEN_FILE 二选一,都设=拒启)", { danger: SEC }),
-    r("SEMA_REGISTRY_TOKEN_FILE", "integrations", "path", "center 拉取凭据文件(每条中心请求都重读 ⇒ 轮换 / 换账号不重启;与 SEMA_REGISTRY_TOKEN 二选一,都设=拒启;文件不可读=响亮 + 健康态 unreadable,不当作无凭证)", { danger: SEC }),
+    r(CENTER_CREDENTIAL_ENV.token, "integrations", "secret", `center 拉取凭据(值形;与 ${CENTER_CREDENTIAL_ENV.tokenFile} 二选一,都设=拒启)`, { danger: SEC }),
+    r(CENTER_CREDENTIAL_ENV.tokenFile, "integrations", "path", `center 拉取凭据文件(每条中心请求都重读 ⇒ 轮换 / 换账号不重启;与 ${CENTER_CREDENTIAL_ENV.token} 二选一,都设=拒启;内容两种类:裸行 = 静态 bearer / JSON 信封 user-session = 人的登录会话(可续签,S-698);文件不可读 / 为空 = 响亮 + 健康态 unreadable,不当作无凭证;内容读不成 / 多租户读到信封 = 拒启)`, { danger: SEC }),
     r("SEMA_REGISTRY_URL", "integrations", "url", "sema-registry 地址(设了=remote 配置源开关)"),
     r("SEMA_REGISTRY_WORKER", "integrations", "string", "本 worker 在 center 的名字(per-worker effective)"),
     r("SEMA_UV_INDEX", "orchestration", "url", "SANDBOX_PKG_SOURCE=custom 的显式 uv index 地址"),

package/dist/config-center/apply-effective.d.ts

@@ -10,6 +10,7 @@ import type { ServiceConfig } from "../config-types.js";
 import { type SealedKeyOpener } from "../sealed-key.js";
 import type { Logger } from "../observability/logger.js";
 import type { EffectiveConfig } from "./types.js";
+import { type ModelRefusalVerdict } from "../model-entry-refusal.js";
 import { type ConfigApplyReport } from "./apply-ledger.js";
 /** Apply center config OVER the env-derived config (mutates `config`). Empty domains keep env defaults. */
 /** Replace a record's contents IN PLACE (clear keys, copy source) so holders of the SAME reference see the
@@ -41,6 +42,10 @@ export interface ApplyReport extends ConfigApplyReport {
     /** 🔴 codex R2-F1:本候选是否**完整**应用 —— 有任何一组被拒 ⇒ false。调用方据此决定要不要把它发布成
      *  LKG / 推进 etag(一个「其余面提交了但某组被拒」的候选覆盖掉好 LKG,重启后就再也回不去了)。 */
     readonly fullyApplied: boolean;
+    /** S-768:本候选目录的模型拒因判决 —— 逐条(`entries`,stage 判出的那份候选的,键已过名筛)+ 组拒码(`plane`,模型面组被拒时在场,
+     *  判决那刻当数据带出)。落地与组拒同一只来源:两者都描述**这一份**候选(组拒时引擎自己的拒因表不换代,这里仍报被拒的那份)。
+     *  候选不管模型面(零启用条目、零墓碑)⇒ `entries` 空、无 `plane`。`/health.modelRefusals` 与心跳的唯一数据源(config-center 投影)。 */
+    readonly modelRefusals: ModelRefusalVerdict;
 }
 /**
  * S-668 波 2 —— 一次 apply 在**哪条腿**上跑,以及这条腿知道的**部署事实**。必填(没有缺省腿):安全轴上「忘了说是哪条
@@ -92,6 +97,17 @@ export type ModelPlaneOf = Pick<EffectiveConfig, ModelPlaneDomain>;
 export declare function withModelPlaneOf<E extends EffectiveConfig>(target: E, source: ModelPlaneOf): E;
 /** 「没有中心模型面」—— 组拒且无 LKG 时进程真正服务的那一代(env 表:没有目录、没有中心 collab 模板)。纯数据,每次新铸。 */
 export declare function buildEnvOnlyModelPlane(): ModelPlaneOf;
+/**
+ * S-768:组拒码 → 铸它的那条模型面不变量 —— **以码为键**(组拒码闭集的属主是 settings-schema `MODEL_PLANE_REFUSAL_CODES`;那边加一个码
+ * ⇒ 本表缺键 ⇒ 本仓 tsc 红)。模型面 stage 的组拒按**码**铸(码是判决那刻的数据),不变量 id 由本表派生 —— 一个 id 两个码
+ * (`model-route-endpoint`)时码不可能从 id 反推,反过来查才是全函数。
+ */
+export declare const PLANE_REFUSAL_INVARIANT_OF: {
+    readonly "config.default_model_missing": "default-model-resolvable";
+    readonly "config.model_refused_name_minted": "refused-names-not-minted";
+    readonly "config.model_route_endpoint_missing": "model-route-endpoint";
+    readonly "config.gateway_fallback_without_primary": "model-route-endpoint";
+};
 /**
  * UNIFORM presence semantics across the center gates (center `f95438a` adopted this from our sentinel flag —
  * SERVICE-INTEGRATION「Runtime 治理/限额闸」): every gate field is center `.optional()`, so

package/dist/config-center/apply-effective.js

@@ -8,7 +8,8 @@ import { stageLimits } from "./stage-limits.js";
 import { APPROVAL_GROUP_KEYS, BATCH1_LIMIT_KEYS } from "./hot-keys-registry.js";
 import { buildDisplaySafeUrl } from "../trace/redact.js";
 import { crossInvariant } from "../config-invariants.js";
-import { judgeCatalogEntries, mintedRefusedNames, refusalEventOf, refusalWarnFields, REFUSED_NAME_MINTED_CODE, unreadableDroppedRefusal } from "../model-entry-refusal.js";
+import { DEFAULT_MODEL_MISSING_CODE, REFUSED_NAME_MINTED_CODE, judgeCatalogEntries, mintedRefusedNames, refusalEventOf, refusalWarnFields, malformedDroppedCarrierRefusal } from "../model-entry-refusal.js";
+import { judgeModelRouteEndpoint } from "../model-route-endpoint.js";
 import { gateIntentUnserviceableReason } from "../approval.js";
 import { refusedGroups } from "./apply-ledger.js";
 const charsPerTokenOf = (v) => (typeof v === "number" && Number.isFinite(v) && v > 0 ? v : undefined);
@@ -136,7 +137,7 @@ export function applyEffective(config, eff, logger, opts) {
                 modelPlane: modelPlaneGroupReport(staged.modelPlaneGroup),
             },
         };
-        opts.report({ ...report, fullyApplied: refusedGroups(report).length === 0 });
+        opts.report({ ...report, fullyApplied: refusedGroups(report).length === 0, modelRefusals: modelRefusalVerdictOf(staged.modelPlaneGroup) });
     }
     if (staged.limits.changed.length > 0)
         logger?.info("sema_registry_limits", { version: staged.version, keys: staged.limits.changed });
@@ -206,6 +207,16 @@ function takeModelPlaneDomain(out, source, d) {
 export function buildEnvOnlyModelPlane() {
     return { models: { models: [], roles: {} } };
 }
+function modelRefusalVerdictOf(group) {
+    const entries = group.refused ?? {};
+    return group.rejected !== undefined ? { entries, plane: group.rejected.code } : { entries };
+}
+export const PLANE_REFUSAL_INVARIANT_OF = {
+    "config.default_model_missing": "default-model-resolvable",
+    "config.model_refused_name_minted": "refused-names-not-minted",
+    "config.model_route_endpoint_missing": "model-route-endpoint",
+    "config.gateway_fallback_without_primary": "model-route-endpoint",
+};
 function modelPlaneGroupReport(group) {
     return {
         applied: MODEL_PLANE_DOMAINS.flatMap((d) => (group.stages[d] !== undefined ? MODEL_PLANE_SURFACES[d] : [])),
@@ -215,14 +226,14 @@ function modelPlaneGroupReport(group) {
 const ROLE_BINDING_UNAVAILABLE_HINT = "tasks resolving this role fail: alias/tier expansion cannot mint this name; the engine refuses it loud — bind the role to a usable model, or make the entry usable (see the entry's own warn)";
 function stageModelPlane(config, eff, logger, sealedKeys) {
     const enabled = (eff.models?.models ?? []).filter((m) => m.enabled !== false);
-    const droppedEnabled = eff.models?.droppedIdentities;
-    if (enabled.length === 0 && !(Array.isArray(droppedEnabled) && droppedEnabled.length > 0))
+    const verdict = judgeCatalogEntries(enabled, { anthropicRouteMounted: config.anthropic !== undefined }, eff.models?.droppedIdentities);
+    if (enabled.length === 0 && Object.keys(verdict.refused).length === 0 && verdict.malformed.length === 0)
         return { stages: { collab: stageCollabDomain(eff) } };
     {
-        const verdict = judgeCatalogEntries(enabled, { anthropicRouteMounted: config.anthropic !== undefined }, eff.models.droppedIdentities);
         for (const [name, r] of Object.entries(verdict.refused))
             logger?.warn(refusalEventOf(r.reason), refusalWarnFields(name, r));
-        const refuse = (invariant, reason, detail = {}) => {
+        const refuse = (code, reason, detail = {}) => {
+            const invariant = PLANE_REFUSAL_INVARIANT_OF[code];
             logger?.warn("sema_registry_model_plane_refused", {
                 version: typeof eff.version === "number" ? eff.version : 0,
                 invariant,
@@ -230,16 +241,10 @@ function stageModelPlane(config, eff, logger, sealedKeys) {
                 ...detail,
                 kept: "the model plane of this candidate is refused as a group — the current model plane (catalog / roles / tiers / refusals / allowlist, and the collab workflows that reference it) keeps serving and the other groups of this candidate still apply; the candidate is not fully applied (LKG / ETag stay on the last fully applied generation) and is re-judged next pull",
             });
-            return { stages: {}, rejected: { keys: MODEL_PLANE_GROUP_KEYS, reason, invariant }, refused: verdict.refused };
+            return { stages: {}, rejected: { keys: MODEL_PLANE_GROUP_KEYS, reason, invariant, code }, refused: verdict.refused };
         };
-        if (verdict.unreadable.length > 0) {
-            logger?.warn("sema_registry_model_entry_dropped_unproven", {
-                entries: [...verdict.unreadable],
-                code: REFUSED_NAME_MINTED_CODE,
-                hint: "these catalog entries were dropped by the settings-schema read and the raw document could not be matched to the snapshot that was parsed (e.g. the local file changed between two reads) — their names cannot be proven, so no tombstone can be minted and the candidate's model plane is refused (a name nobody can prove cannot be shown not to be re-minted by the tier/alias expansion); the next read re-judges",
-            });
-            return refuse("refused-names-not-minted", unreadableDroppedRefusal(verdict.unreadable));
-        }
+        if (verdict.malformed.length > 0)
+            return refuse(REFUSED_NAME_MINTED_CODE, malformedDroppedCarrierRefusal(verdict.malformed), { entries: [...verdict.malformed] });
         const usable = verdict.usable;
         const models = {};
         const modelApiKeyEnv = {};
@@ -318,13 +323,13 @@ function stageModelPlane(config, eff, logger, sealedKeys) {
         const nextView = { ...config, models, tiers: activeTiers, modelRefusals: verdict.refused };
         const noDefault = crossInvariant("default-model-resolvable").check({ live: config, next: nextView });
         if (noDefault !== undefined)
-            return refuse("default-model-resolvable", noDefault);
-        const endpointRefusal = crossInvariant("model-route-endpoint").check({ live: config, next: nextView });
-        if (endpointRefusal !== undefined)
-            return refuse("model-route-endpoint", endpointRefusal);
+            return refuse(DEFAULT_MODEL_MISSING_CODE, noDefault);
+        const endpoint = judgeModelRouteEndpoint(nextView);
+        if (endpoint !== undefined)
+            return refuse(endpoint.code, endpoint.reason);
         const minted = crossInvariant("refused-names-not-minted").check({ live: config, next: nextView });
         if (minted !== undefined)
-            return refuse("refused-names-not-minted", minted, { minted: mintedRefusedNames(nextView) });
+            return refuse(REFUSED_NAME_MINTED_CODE, minted, { minted: mintedRefusedNames(nextView) });
         for (const [role, spec] of Object.entries(roles)) {
             const target = typeof spec === "string" ? spec : spec !== null && typeof spec === "object" && "model" in spec && typeof spec.model === "string" ? spec.model : undefined;
             const refusal = target !== undefined && Object.hasOwn(verdict.refused, target) ? verdict.refused[target] : undefined;
@@ -604,7 +609,7 @@ export function logEffectiveDiff(config, eff, logger) {
         wouldOverrideModels: enabled.length > 0,
         wouldDefaultModel: plane.defaultName ?? null,
         ...(Object.keys(refused).length > 0 ? { wouldRefuse: Object.fromEntries(Object.entries(refused).map(([n, r]) => [n, r.code])) } : {}),
-        ...(plane.rejected !== undefined ? { wouldRefuseModelPlane: { invariant: plane.rejected.invariant, reason: plane.rejected.reason } } : {}),
+        ...(plane.rejected !== undefined ? { wouldRefuseModelPlane: { invariant: plane.rejected.invariant, code: plane.rejected.code, reason: plane.rejected.reason } } : {}),
         currentDefaultModel: config.model.id,
         models: { center: centerModels, envDerived: envModels },
         roles: { center: centerRoles, current: config.roles },

package/dist/config-center/center-request.d.ts

@@ -1,5 +1,7 @@
 import { type CenterCredentialSource } from "../center-credential.js";
 export declare const SCHEMA_MAJOR_HEADER = "x-sema-schema-major";
+/** 8s:对中心请求 / 响应式调用的传输上界(拉配置 / 两条 principal 视图 / 内容拉取 / 凭证续签同一值)。 */
+export declare const CENTER_PULL_TIMEOUT_MS = 8000;
 /** 已装 settings-schema 的 major(机器派生)。版本号不成形 ⇒ 模块装载即抛(装坏了的包不该带着一个猜出来的
  *  major 去跟中心协商 wire 形)。 */
 export declare const SETTINGS_SCHEMA_MAJOR: string;
@@ -49,6 +51,17 @@ export interface CenterRequestInit {
     readonly timeoutMs: number;
     readonly fetchImpl?: typeof fetch;
 }
+/**
+ * S-698 —— 凭证续签:`POST {issuer}/api/v1/auth/token/refresh`,form `refresh_token=…`(settings-schema `AUTH_V1_PATHS.tokenRefresh`)。
+ *  · 以 `issuer` 为根(可带路径前缀;同源与否由续签器先判,本函数只装配);query / fragment 不带过去。
+ *  · **不带 Authorization**:这条端点凭 refresh token 认人,手里的 access token 可能已经过期。
+ *  · `redirect: "manual"`:3xx 不跟 —— POST 307/308 会把体(= refresh token)原样带去 `Location`,同源判据在重定向面前失效。
+ *    3xx 原样交回,续签器按「被拒」处置。
+ */
+export declare function centerTokenRefresh(issuer: string, refreshToken: string, init: {
+    readonly timeoutMs: number;
+    readonly fetchImpl?: typeof fetch;
+}): Promise<Response>;
 /**
  * 对中心发一条请求。返回响应与**这次请求所用凭证的身份**(调用方据此给拿回来的候选打分箱标记,
  * 见 `boot/config-center.ts` 的 LKG / prompt 状态分箱)。

package/dist/config-center/center-request.js

@@ -1,6 +1,8 @@
 import settingsSchemaPackage from "@sema-agent/settings-schema/package.json" with { type: "json" };
+import { AUTH_V1_PATHS } from "@sema-agent/settings-schema/api/auth";
 import { CenterCredentialUnavailableError } from "../center-credential.js";
 export const SCHEMA_MAJOR_HEADER = "x-sema-schema-major";
+export const CENTER_PULL_TIMEOUT_MS = 8000;
 export const SETTINGS_SCHEMA_MAJOR = (() => {
     const version = settingsSchemaPackage.version;
     const m = /^(\d+)\.\d+\.\d+/.exec(version);
@@ -19,6 +21,7 @@ export function pullViewQuery(view) {
 function contentRoot(kind) {
     switch (kind) {
         case "user-jwt":
+        case "user-session":
             return "/api/v1/me";
         case "pull-token":
         case "none":
@@ -45,10 +48,27 @@ function routePath(route, kind) {
             return "/api/config/execution-keys";
     }
 }
-export async function centerFetch(center, route, init) {
-    const scheme = new URL(center.baseUrl).protocol;
+function assertHttpScheme(url, what) {
+    const scheme = url.protocol;
     if (scheme !== "http:" && scheme !== "https:")
-        throw new Error(`SEMA_REGISTRY_URL must be http(s), got "${scheme}"`);
+        throw new Error(`${what} must be http(s), got "${scheme}"`);
+}
+export async function centerTokenRefresh(issuer, refreshToken, init) {
+    const url = new URL(issuer);
+    assertHttpScheme(url, "center credential issuer");
+    url.pathname = `${url.pathname.replace(/\/+$/, "")}${AUTH_V1_PATHS.tokenRefresh}`;
+    url.search = "";
+    url.hash = "";
+    return (init.fetchImpl ?? fetch)(url, {
+        method: "POST",
+        headers: { [SCHEMA_MAJOR_HEADER]: SETTINGS_SCHEMA_MAJOR, "content-type": "application/x-www-form-urlencoded" },
+        body: new URLSearchParams({ refresh_token: refreshToken }).toString(),
+        redirect: "manual",
+        signal: AbortSignal.timeout(init.timeoutMs),
+    });
+}
+export async function centerFetch(center, route, init) {
+    assertHttpScheme(new URL(center.baseUrl), "SEMA_REGISTRY_URL");
     const cred = center.credential.read();
     if (!cred.ok)
         throw new CenterCredentialUnavailableError(cred.reason);

package/dist/config-center/facade.d.ts

@@ -49,7 +49,7 @@
  */
 export { fetchEffective, fetchPrincipalCaps, fetchPrincipalOrgMemory, ConfigCenterHttpError, fetchSkillContent, fetchPromptArtifact, fetchPromptBlob, } from "./http-client.js";
 export { mutateInPlace, applyEffective, type ApplyReport, applyRuntimeGates, applyRuntimeHot, resolveDefaultModelName, logEffectiveDiff, MODEL_PLANE_DOMAINS, type ModelPlaneDomain, type ModelPlaneOf, withModelPlaneOf, buildEnvOnlyModelPlane, } from "./apply-effective.js";
-export { restartReasons, modelPlaneChanged, type RestartSlice, type RestartSliceCtx, type RestartSignal, } from "./restart-signal.js";
+export { restartReasons, modelPlaneChanged, type RestartSlice, type RestartSliceCtx, type EngineRestartSignal, } from "./restart-signal.js";
 export { applyCenterSkills, resolveMcpServers, mcpForScenario, resolveA2aPeers, a2aForScenario } from "./skills-mcp.js";
 export { applyCenterReadFace, CENTER_READ_FACE_LIVE_KEYS, type CenterReadFaceApply, type CenterReadFaceReport, type ReadFaceBaseline } from "./read-face.js";
 export type { CenterSkillManifest, CenterMcpServer, CenterA2aPeer, CenterModel, CenterReadFace, EffectiveConfig, ExecutionRuling, SessionMirrorRuling, } from "./types.js";

package/dist/config-center/http-client.js

@@ -2,9 +2,8 @@ import { createHash } from "node:crypto";
 import { readEffectiveWire, PrincipalCapsWire } from "@sema-agent/settings-schema";
 import { centerPromptsFromEffective } from "../prompts-domain-validate.js";
 import { splitFoldedReadWarnings, withDroppedIdentities } from "./read-warnings.js";
-import { centerFetch } from "./center-request.js";
+import { CENTER_PULL_TIMEOUT_MS, centerFetch } from "./center-request.js";
 import { answerStillCurrent } from "../center-credential.js";
-const CENTER_PULL_TIMEOUT_MS = 8000;
 export async function fetchEffective(center, etag, fetchImpl = fetch, worker) {
     const { res, identity } = await centerFetch(center, { kind: "effective", worker }, { etag, timeoutMs: CENTER_PULL_TIMEOUT_MS, fetchImpl });
     if (res.status === 304)
@@ -19,9 +18,7 @@ export async function fetchEffective(center, etag, fetchImpl = fetch, worker) {
         delete wire.prompts;
     else
         wire.prompts = centerPrompts;
-    const rawModels = typeof body === "object" && body !== null && !Array.isArray(body) ? body.models : undefined;
-    const parsedModels = wire.models?.models;
-    const { domainErrors, droppedEntries, droppedIdentities } = splitFoldedReadWarnings(warnings, { raw: rawModels, parsed: Array.isArray(parsedModels) ? parsedModels : undefined });
+    const { domainErrors, droppedEntries, droppedIdentities } = splitFoldedReadWarnings(warnings);
     const effective = withDroppedIdentities(wire, droppedIdentities);
     return {
         effective,