@sema-agent/server 7.122.0 → 7.124.0

package/dist/fleet/engine-signal.d.ts

@@ -5,31 +5,35 @@
  *
  *  1. **一只铸点,三个出口**:{@link mintEngineSignal} 是「引擎此刻自己说自己什么」的唯一来源。`GET /health`(诊断面)、
  *     `GET /readyz`(就绪探针)与 fleet 心跳(`fleet-client.ts`)各读它**一次**,再按各自的出口形投影;没有出口另算一遍
- *     就绪 / 重启 / 代际 / 租约。
+ *     就绪 / 排空 / 重启 / 代际 / 租约 / 世代账,也没有出口绕过它去读 `deps` 上的这些输入。
  *  2. **就绪**仍只有一只谓词(`http/readiness.ts` 的 `readinessOf`),铸点把它的判决原样带上(`verdict`)。`/readyz` 200 ⇔
  *     `ready ∧ ¬draining ∧ leaseState ≠ denied` —— 后两项不是新判据:`draining` 本来就是就绪原因,而租约被拒**同一拍**经
  *     唯一的排空入口进入排空(`fleet/serving-lease.ts`),所以「被拒 ⇒ 排空 ⇒ 不就绪」是构造出来的,不靠第二只谓词。
  *     `leaseState = expired` **不**进就绪(中心不可达不是本实例的病,见租约模块头注)。
- *  3. **重启**:`restart` = 已发布的重启信号;没有已发布信号而有一只**扣着**的候选(config-center 的保留候选状态机)且它确有被扣的片时,
+ *  3. **重启**:`restart` = 已发布的重启信号;没有已发布信号而有一只**扣着**的候选(web-admin 的保留候选状态机)且它确有被扣的片时,
  *     铸 `{reasons: 被扣的片, version, since, withheld: true}`(「要重启,但此刻换掉本实例会丢它手里的候选」)。已发布的信号恒胜(那几片
  *     是安全可重启的,扣着的片不阻止它们);被扣的片为空(只差发布重试)⇒ 不是重启事实,不铸(契约 `RestartSignal.reasons` 至少一词;
  *     那一形的面只有每拍一行运维 warn + 计数)。「扣着」在两出口上只有这一种读法(7.120.x 的 `/health.modelPlaneDeferred` 本版删除)。
  *     合成只在 {@link buildRestartSignal} 一处,`restartState()` 是它唯一的调用方 —— 两个出口读的是同一只取值口。
- *  4. **代际与实例**:`generation` = env `FLEET_GENERATION` 的回声(规范十进制串;非规范在 boot 拒启,见 `config.ts`);
- *     缺席 ⇔ 非 fleet 成员。`instanceId` = 本进程起步自铸的那一只(`boot/stage-03` 的 uuidv7),不读 env。
- *  5. **出口方言**(契约 `EngineSignal` 与今天两出口的既有形两处不同:`draining` 是布尔、`/health` 就绪时不带 `ready` —— 契约包
- *     自己的 `EngineSignal` 头注写明了这两处;世代账两键 settings-schema 9.0.0 起契约也是数,与引擎同形)—— 两出口**照旧**用 8.0 方言。心跳体的类型
- *     **就是**契约 `InstanceAnnouncement`(中心按它 `safeParse`;8.2.0 起它类型化 `generation` / `leaseState` / `leaseUntil`),没有
- *     契约外的键:世代账(`configTargetVersion` / `configAppliedVersion`)契约心跳形没有座位,只上 `/health`。新增的键
- *     (`generation` / `leaseState` / `leaseUntil`、`restart.withheld`)只在 fleet 成员 / 扣着的候选在场时出现 ⇒ 非 fleet 部署的
- *     两出口逐字节同 7.120.0。方言收口归契约包下一个 major(布尔 `draining` 对退役、两出口整只承载 `EngineSignal`)与中心提货之后,
- *     由引擎同版翻转 —— 不在本层另造第二方言。
+ *  4. **代际**:`generation` = env `FLEET_GENERATION` 的回声(规范十进制串;非规范在 boot 拒启,见 `config.ts`);缺席 ⇔ 非 fleet 成员。
+ *     **身份不是引擎态**:`instanceId`(本进程起步自铸的那一只,`boot/stage-03` 的 uuidv7)是体的身份,只在两出口体的**顶层**说一次,
+ *     铸点不读它、契约形里不重复它。
+ *  5. **两形一读(展开 / 收缩)**:两出口今天各发两形 —— 嵌套键 {@link ENGINE_SIGNAL_KEY}(契约 `EngineSignal` 整只,{@link buildEngineSignal}),
+ *     与 8.0 扁平方言(布尔 `draining` + `drainingSince`、`/health` 就绪时不带 `ready`、`restart`、成员三键、`/health` 的世代账)。两形读的是
+ *     **同一次**铸点读数里的**同一个字段**,投影全在本模块({@link buildEngineSignal} / {@link heartbeatReadinessKeys} / {@link healthDrainingKeys} /
+ *     {@link fleetMembershipKeys} / {@link healthConfigLedgerKeys}),出口文件不拼引擎态的键。排空在两形上读的都是排空**事实**(`EngineDraining`,
+ *     三键齐才在),不是就绪原因 —— 所以「`engineSignal.draining` 在场 ⇔ 扁平 `draining` 为真、`drainingSince` = `engineSignal.draining.since`」
+ *     是构造出来的,不靠「唯一入口整组写四键」这条运行时不变量(那条不变量只管就绪原因与事实一致)。
+ *     心跳体 = 契约 `InstanceAnnouncement` + 嵌套键这一只:契约包 10.x 的心跳形还没有它的座位,10.x 中心按默认 strip 解析丢掉它、照收心跳;
+ *     世代账扁平两键契约心跳形没有座位,只上 `/health`(嵌套形里有,两出口都带)。非 fleet 部署的扁平键与 7.122.0 逐字同。
+ *     收缩:扁平布尔对(`draining` / `drainingSince`)settings-schema 12.0.0 从契约形删、本引擎 7.124.0+ 删发(届时删它们的投影);嵌套键名在
+ *     契约包自有这只常量的那一版提货时改读它。
  *  6. **租约四态的词表属主是契约包**(`LeaseState`):本模块的读数型 {@link ServingLeaseView} 按它逐词对齐(下面的编译期断言两向钉),
  *     契约加一个词 ⇒ 本仓编译红,不会悄悄多出一个本仓读不出的态。
  *
- * 模块形:纯函数(只值 import 契约包与 `http/readiness.ts`)—— `http/` 与 `fleet-client.ts` 都读它,不许长出回环。
+ * 模块形:纯函数(契约包只 import 型;值 import 只有两只纯叶 `http/readiness.ts` 与 `fleet/drain-entry.ts`)—— `http/` 与 `fleet-client.ts` 都读它,不许长出回环。
  */
-import type { EngineDraining, InstanceAnnouncement, LeaseState, RestartSignal } from "@sema-agent/settings-schema/fleet";
+import type { EngineDraining, EngineSignal, InstanceAnnouncement, LeaseState, RestartSignal } from "@sema-agent/settings-schema/fleet";
 import { type ReadinessInputs, type ReadinessVerdict } from "../http/readiness.js";
 /**
  * 租约此刻的读数(租约客户端交出;纯数据)。态的词表 = 契约 `LeaseState`(四词的语义在契约注里:`none` 不生效 / `granted` 持有 /
@@ -50,7 +54,7 @@ export type ServingLeaseView = {
 export type FleetMembershipKeys = Pick<InstanceAnnouncement, "generation" | "leaseState" | "leaseUntil">;
 /** 非 fleet 成员 / 没装租约客户端时的读数(唯一拼法)。 */
 export declare const LEASE_NONE: ServingLeaseView;
-/** 扣着的候选(config-center 的 `planeDeferredNoHandoff` 投影):版本、起扣时刻、被扣的重启片。 */
+/** 扣着的候选(web-admin 的 `planeDeferredNoHandoff` 投影):版本、起扣时刻、被扣的重启片。 */
 export interface RetainedCandidate {
     readonly version: number;
     readonly since: number;
@@ -58,7 +62,7 @@ export interface RetainedCandidate {
 }
 /**
  * 重启事实的**唯一**合成点(规则 3):已发布信号恒胜;否则扣着的候选有被扣的片 ⇒ `withheld:true` 的信号;否则缺席。
- * `build*` = 纯数据。泛型让 config-center 交进来的窄型(`EngineRestartSignal`,`reasons` 是片闭集)原样回来。
+ * `build*` = 纯数据。泛型让 web-admin 交进来的窄型(`EngineRestartSignal`,`reasons` 是片闭集)原样回来。
  */
 export declare function buildRestartSignal<R extends RestartSignal>(published: R | undefined, retained: (RetainedCandidate & {
     readonly blocked?: readonly R["reasons"][number][];
@@ -68,8 +72,8 @@ export declare const CONFIG_HANDOFF_STATES: readonly ["missing"];
 export type ConfigHandoffState = (typeof CONFIG_HANDOFF_STATES)[number];
 /**
  * `/health.configHandoff`(只在 `/health`,不上心跳)—— 一件**事故**:**在场 ⇔ 部署声明了耐久接力 ∧ 应用着的那一代没在下一次起服将用的身份的桶里确认耐久落盘**
- * (config-center 的接力账 {@link ConfigHandoffLedger}:最后确认耐久的那一代 + 写进的那只身份桶,对比应用着的那一代 + 此刻的凭证身份 —— 离线起服按此刻
- * 的身份选桶;部署形门在 config-center 的取值口,读判「handoff confirmed」的同一只谓词)。凭证换了人(换了身份)而新身份的桶里没有这一代 ⇒ 在场。覆盖 LKG 发布失败(含保留候选、启动期技能债)与部分应用(某组被整拒、其余组已热应用,LKG 停在上一个完整世代)两形。**部署形**不在这里报:
+ * (web-admin 的接力账 {@link ConfigHandoffLedger}:最后确认耐久的那一代 + 写进的那只身份桶,对比应用着的那一代 + 此刻的凭证身份 —— 离线起服按此刻
+ * 的身份选桶;部署形门在 web-admin 的取值口,读判「handoff confirmed」的同一只谓词)。凭证换了人(换了身份)而新身份的桶里没有这一代 ⇒ 在场。覆盖 LKG 发布失败(含保留候选、启动期技能债)与部分应用(某组被整拒、其余组已热应用,LKG 停在上一个完整世代)两形。**部署形**不在这里报:
  * 没有耐久声明(`CONFIG_LKG_DURABLE` 不真 / LKG 关)的部署「重启靠中心重拉」是配置时声明的事实 ⇒ 恒缺席;本地腿 / 没有配置管道 ⇒ 缺席。
  * 与 `restart.withheld` 两个事实两张脸(可同在):要不要重启归 `restart`,声明了的接力缺不缺归本键。
  * `version` = 应用着的那一代;`since` = 这一代开始没有确认接力的时刻(持续缺着时不刷新,确认即清)。
@@ -79,7 +83,7 @@ export interface ConfigHandoff {
     readonly version: number;
     readonly since: number;
 }
-/** 配置接力账(config-center 持有,`/health.configHandoff` 的唯一来源):应用着的那一代、最后一次确认耐久接力的那一代与它写进的身份桶、
+/** 配置接力账(web-admin 持有,`/health.configHandoff` 的唯一来源):应用着的那一代、最后一次确认耐久接力的那一代与它写进的身份桶、
  *  下一次起服将用的身份(此刻的凭证身份 —— 离线起服选桶读的同一只)。 */
 export interface ConfigHandoffLedger {
     readonly applied?: number;
@@ -92,11 +96,18 @@ export interface ConfigHandoffLedger {
 /** 「接力缺着」的**唯一**判据(纯):应用过一代 ∧ 最后确认耐久的不是「这一代 ∧ 下一次起服将用的身份桶」。 */
 export declare function configHandoffMissing(ledger: ConfigHandoffLedger): boolean;
 /** `configHandoff` 的**唯一**合成点(纯):缺着 ⇒ `{ state: "missing", version: 应用着的那一代, since }`;否则缺席。`since` 由持账方锁存(发现缺着的那一拍)。
- *  `build*` = 纯数据;config-center 的 `configHandoffState()` 是唯一调用方。 */
+ *  `build*` = 纯数据;web-admin 的 `configHandoffState()` 是唯一调用方。 */
 export declare function buildConfigHandoff(ledger: ConfigHandoffLedger, since: number | undefined): ConfigHandoff | undefined;
+/** 世代账的一次读数(web-admin 的 `configApplyState()` 交出的那一份里本模块读的五键;`/health` 扁平五键与嵌套形的两键读同一份)。 */
+export interface ConfigLedgerReading {
+    readonly configTargetVersion: number;
+    readonly configAppliedVersion: number;
+    readonly configTargetOrdinal: number;
+    readonly configAppliedOrdinal: number;
+    readonly configApplyStaleMs?: number;
+}
 /** 铸点读的输入 —— `ServiceDeps` 上的同名键(HTTP 面与心跳读的是**同一个**对象)。 */
 export interface EngineSignalInputs extends ReadinessInputs {
-    readonly instanceId?: string;
     /** `config.fleetGeneration` = env `FLEET_GENERATION` 的回声(boot 已判规范;缺席 ⇔ 非 fleet 成员)。 */
     readonly config?: {
         readonly fleetGeneration?: string;
@@ -108,34 +119,54 @@ export interface EngineSignalInputs extends ReadinessInputs {
     };
     readonly restartState?: () => RestartSignal | undefined;
     readonly servingLease?: () => ServingLeaseView;
-    readonly configApplyState?: () => {
-        readonly configTargetVersion: number;
-        readonly configAppliedVersion: number;
-    } | undefined;
+    readonly configApplyState?: () => ConfigLedgerReading | undefined;
 }
 /** 铸出的信号(纯数据)。 */
 export interface EngineSignalFacts {
     /** 就绪判(`readinessOf` 原样)。 */
     readonly verdict: ReadinessVerdict;
-    /** 在场 ⇔ 排空中(契约 `EngineDraining`:动作 / 起点 / 期限)。 */
+    /** 在场 ⇔ 排空中(契约 `EngineDraining`:动作 / 起点 / 期限)—— 两出口两形读排空的唯一字段(规则 5)。 */
     readonly draining?: EngineDraining;
     readonly restart?: RestartSignal;
     readonly generation?: string;
-    readonly instanceId?: string;
     readonly lease: ServingLeaseView;
-    readonly configTargetVersion?: number;
-    readonly configAppliedVersion?: number;
+    /** 世代账的那一次读数(未接线 ⇒ 缺席)。 */
+    readonly configApply?: ConfigLedgerReading;
 }
 /** **唯一**铸点(活判,每次调用现读输入)。 */
 export declare function mintEngineSignal(deps: EngineSignalInputs): EngineSignalFacts;
+/**
+ * 两出口体上嵌套引擎信号的键名(规则 5;两出口同一只拼法)。契约包 10.x 没有这只常量(它的心跳形也没有这一座位);契约包自有它的那一版
+ * 提货时,本常量删、改读契约包的。
+ */
+export declare const ENGINE_SIGNAL_KEY = "engineSignal";
+/** 体上的嵌套引擎信号:键 {@link ENGINE_SIGNAL_KEY},值 = 契约 `EngineSignal`。 */
+export type EngineSignalCarrier = {
+    readonly [ENGINE_SIGNAL_KEY]: EngineSignal;
+};
+/**
+ * 契约形 `EngineSignal` 的**唯一**投影(规则 5;两出口同调,同一次读数 ⇒ 同值同序)。键序照契约形:`ready` 恒说;`draining` = 排空事实;
+ * `restart` = 取值口交出的那个对象;成员三键 = {@link fleetMembershipKeys};世代账两键 = 同一次读数。身份不在这里(规则 4)。`build*` = 纯数据。
+ */
+export declare function buildEngineSignal(s: EngineSignalFacts): EngineSignal;
 /**
  * fleet 成员身份三键的**唯一**投影(两出口同调,同值同序):`generation` / `leaseState` / `leaseUntil`。
  * 在场律:非 fleet 成员(无 `generation`)⇒ 空对象(两出口逐字节同 7.120.0);成员 ⇒ `generation` + `leaseState` 恒在,
  * `leaseUntil` 只在 `granted`。
  */
 export declare function fleetMembershipKeys(s: EngineSignalFacts): FleetMembershipKeys;
-/** 出口的 8.0 方言布尔 `draining`(心跳 `InstanceAnnouncement.draining` / `/health.draining`):就绪原因含排空。 */
-export declare function drainingFlag(s: EngineSignalFacts): boolean;
+/** 心跳的 8.0 扁平方言 `ready` / `draining`(恒带,`false` 也带):`ready` = 就绪判,`draining` = 排空事实在场(规则 5,与嵌套形读同一个字段)。 */
+export declare function heartbeatReadinessKeys(s: EngineSignalFacts): Pick<InstanceAnnouncement, "ready" | "draining">;
+/** `/health` 的 8.0 扁平排空对:只在排空中带 —— `draining: true` + `drainingSince` = 排空事实的 `since`(规则 5,与嵌套形读同一个字段)。 */
+export declare function healthDrainingKeys(s: EngineSignalFacts): {
+    readonly draining?: true;
+    readonly drainingSince?: number;
+};
+/**
+ * `/health` 的世代账扁平键(未接线 ⇒ 全缺席):target / applied 两版本(与嵌套形同一次读数)+ 两只收货序数(进程内单调,「见过多少代 / 停在哪一代」
+ * 的推进判据)+ `configApplyStaleMs`(两者持续不等的时长,收敛即缺席)。只上 `/health`(契约心跳形没有这些座位)。
+ */
+export declare function healthConfigLedgerKeys(s: EngineSignalFacts): Partial<ConfigLedgerReading>;
 /**
  * `/health.restartRequired`(冗余顶层布尔,壳读它决定要不要问用户重启)的投影:在场 ⇔ 有**可执行**的重启信号
  * (`restart` 在场且未被扣)—— 与 7.120.0 的读数逐字同(那时被扣的候选根本不出 `restart`)。

package/dist/fleet/engine-signal.js

@@ -23,15 +23,24 @@ export function mintEngineSignal(deps) {
     const ds = deps.drainState;
     const draining = ds === undefined ? undefined : drainingFactOf(ds);
     const restart = deps.restartState?.();
-    const gen = deps.configApplyState?.();
+    const configApply = deps.configApplyState?.();
     return {
         verdict,
         ...(draining !== undefined ? { draining } : {}),
         ...(restart !== undefined ? { restart } : {}),
         ...(deps.config?.fleetGeneration !== undefined ? { generation: deps.config.fleetGeneration } : {}),
-        ...(deps.instanceId !== undefined ? { instanceId: deps.instanceId } : {}),
         lease: deps.servingLease?.() ?? LEASE_NONE,
-        ...(gen !== undefined ? { configTargetVersion: gen.configTargetVersion, configAppliedVersion: gen.configAppliedVersion } : {}),
+        ...(configApply !== undefined ? { configApply } : {}),
+    };
+}
+export const ENGINE_SIGNAL_KEY = "engineSignal";
+export function buildEngineSignal(s) {
+    return {
+        ready: s.verdict.ready,
+        ...(s.draining !== undefined ? { draining: s.draining } : {}),
+        ...(s.restart !== undefined ? { restart: s.restart } : {}),
+        ...fleetMembershipKeys(s),
+        ...(s.configApply !== undefined ? { configTargetVersion: s.configApply.configTargetVersion, configAppliedVersion: s.configApply.configAppliedVersion } : {}),
     };
 }
 export function fleetMembershipKeys(s) {
@@ -51,8 +60,23 @@ export function fleetMembershipKeys(s) {
         }
     }
 }
-export function drainingFlag(s) {
-    return !s.verdict.ready && s.verdict.reasons.includes("draining");
+export function heartbeatReadinessKeys(s) {
+    return { ready: s.verdict.ready, draining: s.draining !== undefined };
+}
+export function healthDrainingKeys(s) {
+    return s.draining === undefined ? {} : { draining: true, drainingSince: s.draining.since };
+}
+export function healthConfigLedgerKeys(s) {
+    const g = s.configApply;
+    if (g === undefined)
+        return {};
+    return {
+        configTargetVersion: g.configTargetVersion,
+        configAppliedVersion: g.configAppliedVersion,
+        configTargetOrdinal: g.configTargetOrdinal,
+        configAppliedOrdinal: g.configAppliedOrdinal,
+        ...(g.configApplyStaleMs !== undefined ? { configApplyStaleMs: g.configApplyStaleMs } : {}),
+    };
 }
 export function restartActionable(s) {
     return s.restart !== undefined && s.restart.withheld !== true;

package/dist/fleet/fleet-bus.d.ts

@@ -566,6 +566,7 @@ export declare function fleetRunPublisher(bus: FleetEventBus | undefined, run: {
         name?: string;
         toolName?: string;
         parentToolCallId?: string;
+        workflowRunId?: string;
         status?: string;
         seq?: number;
     }) => void;
@@ -576,6 +577,7 @@ export declare function fleetRunPublisher(bus: FleetEventBus | undefined, run: {
         name?: string;
         usage?: unknown;
         parentToolCallId?: string;
+        workflowRunId?: string;
         status?: string;
         seq?: number;
     }) => void;
@@ -639,13 +641,20 @@ export declare function fleetRunResiduals(result: {
  * session attribution → unscoped, back-compat visible). Names ride the same redactSecrets discipline.
  */
 export declare function fleetBackgroundChildPublisher(bus?: FleetEventBus, log?: (msg: string, fields: Record<string, unknown>) => void): (e: import("@sema-agent/core").BackgroundChildEvent) => void;
+/**
+ * 🔴 **run 的短名 —— 一只折法、一个输入**:输入 = run 行的预览(`user-authored-text.ts` 的 `buildRunObjectivePreview` 的产物,run 行上存的就是它);
+ * fleet 行的 `name`(发布时由 objective 现算同一只预览)与 `GET /v1/assistant/tasks` 的 `name`(读 run 行上存的预览)读同一只,
+ * 同一个 run 两面同名。预览是 `""`(有记录、剥完没有用户正文)⇒ `(notification turn)`;否则单行折叠、超过 48 字截断带 `…`。预览已脱敏。
+ * 入参只收「有记录」的预览:列上的 NULL(没记录)不是通告轮,由读面自己按契约缺席,不进这只折法。
+ */
+export declare function buildRunName(preview: string): string;
 /** BC-1 (clay-decided 2026-06-27): a top-level run's fleet-row `name` = a SHORT, single-line **objective preview**
  *  (the readable "what is this task" label) — NOT the full objective dumped in, and NOT duplicated into `description`.
  *  `description` is left to the publisher's LIVE-ACTIVITY update (`onEvent` tool_start → the current tool), so the row
  *  shows `name`=objective + `description`=current activity (two DISTINCT things, killing the earlier "objective shown
- *  twice" dup). Whitespace-collapsed + capped ≤48. (A subagent CHILD row's name = its agent-type — BC-2.)
- *  SECRET-SAFE: redact secret shapes (redactSecrets) BEFORE truncating — a secret in the objective must not leak in
- *  the row name. The durable objective is already redacted; the name preview was asymmetric (raw) until this. */
+ *  twice" dup). (A subagent CHILD row's name = its agent-type — BC-2.)
+ *  一只折法({@link buildRunName}),输入 = 与 run 行同一只预览(用户写的那段 → 脱敏 → 截):`GET /v1/assistant/tasks`
+ *  读 run 行上存的预览、过同一只折法 ⇒ 同一个 run 两面同名。剥完没有用户正文 ⇒ `(notification turn)`;闭集外的 XML 头当普通正文标。 */
 export declare function fleetRunLabels(objective: string | undefined): {
     name: string;
 };

package/dist/fleet/fleet-bus.js

@@ -3,6 +3,7 @@ import { DURABLE_AGENT_HANDLE_RE, deriveAgentDisplayStatus, isDelegatedAgentTerm
 import { persistedPlaneOf } from "../terminal.js";
 import { recordFailOpen } from "../observability/fail-open.js";
 import { redactSecrets } from "../trace/redact.js";
+import { buildRunObjectivePreview } from "../user-authored-text.js";
 export function isFleetAgentTerminalNotification(n) {
     return isDelegatedAgentTerminal(n);
 }
@@ -206,6 +207,7 @@ export function fleetRunPublisher(bus, run) {
     let settledLeg = false;
     const childId = (taskId) => `${run.runId} ${taskId}`;
     const tickStatus = (st) => (st === "completed" ? "completed" : st === "failed" ? "failed" : "running");
+    const workflowRunIdField = (ev) => (ev.workflowRunId ? { workflowRunId: ev.workflowRunId } : {});
     const toolUsesOf = (usage) => {
         const t = usage?.toolUses;
         return typeof t === "number" ? t : undefined;
@@ -269,7 +271,7 @@ export function fleetRunPublisher(bus, run) {
                     childStartedAt.set(cid, Date.now());
                 if (ev.parentToolCallId)
                     childByToolCall.set(ev.parentToolCallId, cid);
-                bus.publishTask({ id: cid, sourceLane: "run-leg", ...(childName !== undefined ? { name: childName, agentType: childName } : {}), parentId: run.runId, scope: run.scope, ...sessionField, status: tickStatus(ev.status), tokens: sumTokens(ev.usage), ...(typeof ev.seq === "number" ? { cycleSeq: ev.seq } : {}), ...(() => { const t = toolUsesOf(ev.usage); return t !== undefined ? { toolUses: t } : {}; })(), elapsedMs: Date.now() - childStartedAt.get(cid) });
+                bus.publishTask({ id: cid, sourceLane: "run-leg", ...(childName !== undefined ? { name: childName, agentType: childName } : {}), parentId: run.runId, scope: run.scope, ...sessionField, ...workflowRunIdField(ev), status: tickStatus(ev.status), tokens: sumTokens(ev.usage), ...(typeof ev.seq === "number" ? { cycleSeq: ev.seq } : {}), ...(() => { const t = toolUsesOf(ev.usage); return t !== undefined ? { toolUses: t } : {}; })(), elapsedMs: Date.now() - childStartedAt.get(cid) });
             }
             else if (ev.type === "tool_start" && ev.toolName) {
                 bus.publishTask({ id: run.runId, description: ev.toolName });
@@ -290,7 +292,7 @@ export function fleetRunPublisher(bus, run) {
                 childStartedAt.set(cid, Date.now());
             if (ev.parentToolCallId)
                 childByToolCall.set(ev.parentToolCallId, cid);
-            bus.publishTask({ id: cid, sourceLane: "run-leg", ...(fwdName !== undefined ? { name: fwdName, agentType: fwdName } : {}), parentId, scope: run.scope, ...sessionField, status: tickStatus(ev.status), tokens: sumTokens(ev.usage), ...(typeof ev.seq === "number" ? { cycleSeq: ev.seq } : {}), ...(() => { const t = toolUsesOf(ev.usage); return t !== undefined ? { toolUses: t } : {}; })(), elapsedMs: Date.now() - childStartedAt.get(cid) });
+            bus.publishTask({ id: cid, sourceLane: "run-leg", ...(fwdName !== undefined ? { name: fwdName, agentType: fwdName } : {}), parentId, scope: run.scope, ...sessionField, ...workflowRunIdField(ev), status: tickStatus(ev.status), tokens: sumTokens(ev.usage), ...(typeof ev.seq === "number" ? { cycleSeq: ev.seq } : {}), ...(() => { const t = toolUsesOf(ev.usage); return t !== undefined ? { toolUses: t } : {}; })(), elapsedMs: Date.now() - childStartedAt.get(cid) });
         },
         onChildTerminal(taskId, status, altId, toolUseId) {
             if (settledLeg)
@@ -612,14 +614,16 @@ export function fleetBackgroundChildPublisher(bus, log) {
         handleTerminal(e, m);
     };
 }
+const NOTIFICATION_TURN_NAME = "(notification turn)";
+const RUN_NAME_CHARS = 48;
+export function buildRunName(preview) {
+    const oneLine = preview.replace(/\s+/g, " ").trim();
+    if (oneLine === "")
+        return NOTIFICATION_TURN_NAME;
+    return oneLine.length > RUN_NAME_CHARS ? `${oneLine.slice(0, RUN_NAME_CHARS - 1)}…` : oneLine;
+}
 export function fleetRunLabels(objective) {
-    const oneLine = redactSecrets((objective ?? "").replace(/\s+/g, " ")).trim();
-    if (!oneLine)
-        return { name: "task" };
-    if (/^<[a-z][a-z0-9_-]*[\s>/]/i.test(oneLine))
-        return { name: "(notification turn)" };
-    const name = oneLine.length > 48 ? `${oneLine.slice(0, 47)}…` : oneLine;
-    return { name };
+    return { name: buildRunName(buildRunObjectivePreview(objective ?? "")) };
 }
 export function isTerminalFleetStatus(status) {
     switch (status) {

package/dist/fleet/serving-lease.d.ts

@@ -1,5 +1,5 @@
-import { type CenterCapabilities } from "@sema-agent/settings-schema/fleet";
-import { type CenterEndpoint } from "../config-center/center-request.js";
+import { type WebAdminCapabilities } from "@sema-agent/settings-schema/fleet";
+import { type CenterEndpoint } from "../web-admin-client/center-request.js";
 import { type DrainEntry } from "./drain-entry.js";
 import type { ServingLeaseView } from "./engine-signal.js";
 /** 续租请求的上界(ms)—— 与 fleet 心跳同量级(不在提交热路径上)。 */
@@ -34,7 +34,7 @@ export interface ServingLeaseClientOpts {
 }
 export interface ServingLeaseClient {
     /** 一次中心能力读数(`undefined` = `undeclared`,中心没宣告 = 不支持)。每一次读数调一次;`unreadable` 不是读数,不调(`fleet-client.ts` `capabilityReadingOf`)。 */
-    noteCenterCapabilities(caps: CenterCapabilities | undefined): void;
+    noteCenterCapabilities(caps: WebAdminCapabilities | undefined): void;
     /** 此刻的租约读数(铸点与准入判读它)。 */
     view(): ServingLeaseView;
     /** 起步读黏性拒(装配层在唯一排空入口装好之后调一次)。 */

package/dist/fleet/serving-lease.js

@@ -1,7 +1,7 @@
 import { readFileSync, renameSync, rmSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { SERVING_LEASE_TTL_DEFAULT_MS, readServingLeaseResponse } from "@sema-agent/settings-schema/fleet";
-import { centerFetch } from "../config-center/center-request.js";
+import { centerFetch } from "../web-admin-client/center-request.js";
 import { recordFailOpen } from "../observability/fail-open.js";
 import { leaseDrainActionId } from "./drain-entry.js";
 export const SERVING_LEASE_FETCH_TIMEOUT_MS = 5_000;

package/dist/fleet-client.d.ts

@@ -1,23 +1,25 @@
 /**
  * Fleet worker-side wiring(announce/heartbeat + usage 批报;契约 = registry-core 0.1.48+
- * `/fleet`,center 端点 = sema-registry `/api/fleet/*`)。设计要点:
+ * `/fleet`,center 端点 = web-admin `/api/fleet/*`)。设计要点:
  *  - **可选分层(D3),两条环各自有门(S-866 ④)**:客户端在中心车道配齐时启动(`centerLaneConfigured` —— baseUrl + 声明了
  *    凭证 + worker,与租约管理器、用量累加器**同一只**谓词);**用量环**只要这三件;**公告环**(announce / 心跳 / 注销)另要
  *    配置席 `fleetAdvertiseAddress`(env `FLEET_ADVERTISE_ADDRESS`,`loadConfig` 解析一次;可达性是运维的话,不自猜:k8s pod IP /
  *    docker alias / 127.0.0.1:port 只有部署环境自己知道)。不配中心的部署零行为变化;配了中心而不公告的引擎只报用量、不注册(7.105.0 及以前它连用量都不报)。
  *  - **announce=注册=心跳同形状幂等 upsert**:boot 后(listen 之后)POST 一次 + 每 heartbeatMs 续。
- *    `ready` / `draining` 两字段由**同一只**就绪谓词的同一次读铸(S-740:`http/readiness.ts` 的 `readinessOf`,
- *    与 `/health.ready`、`GET /readyz`、计费提交门同源):`ready = verdict.ready`(= roster 已落 ∧ ¬draining),
- *    `draining = reasons ∋ "draining"`。修前 `ready = !isDraining()`,不含 roster ⇒ roster 未落时心跳说「就绪」
- *    而计费提交在 503。
+ *    `ready` / `draining` 两字段由引擎信号铸点的同一次读铸(S-740:`ready` = `http/readiness.ts` `readinessOf` 的判,
+ *    与 `/health.ready`、`GET /readyz`、计费提交门同源;= roster 已落 ∧ ¬draining),`draining` = 排空事实在场(与嵌套
+ *    `engineSignal.draining` 同一个字段,`fleet/engine-signal.ts` 规则 5)。修前 `ready = !isDraining()`,不含 roster ⇒ roster 未落时
+ *    心跳说「就绪」而计费提交在 503。
+ *  - **`engineSignal`(7.123.0)**:引擎态整只(契约 `EngineSignal`),与扁平键同一次读数;契约包 10.x 的心跳形没有它的座位(10.x 中心
+ *    默认 strip 解析丢掉它、照收心跳);扁平布尔 `draining` settings-schema 12.0.0 删、本引擎 7.124.0+ 删发。
  *  - **`restart?`(S-741)**:在场 ⇔ 本副本必须重启才能应用配置 —— 取自 `/health.restart` **同一只**取值口(装配层接
- *    `deployment.restartState`,config-center 的 `restartState()`),同一个对象,形 = settings-schema `RestartSignal`;
+ *    `deployment.restartState`,web-admin 的 `restartState()`),同一个对象,形 = settings-schema `RestartSignal`;
  *    缺席即键缺席(中心按行整体替换,不合并 —— 一条不带它的心跳就是「不再需要」)。
  *  - **`modelRefusals?`(S-768)**:在场 ⇔ 本副本对最近一次被判的中心候选目录有可报的拒(逐条名 → 码 / 模型面组拒码)—— 取自
  *    `/health.modelRefusals` **同一只**取值口(装配层接 `deployment.modelRefusalsState`),同一个对象,形 = settings-schema
  *    `ModelRefusalsSignal`;缺席即键缺席(同 `restart`)。
  *  - **自报状态翻转即刻再 announce**(第一时间自摘流 / 自挂流 / 报重启 / 报拒因,比任何观测都快):draining 翻转由收尾链直调
- *    `announceNow`;roster 落地、restart 信号与模型拒因变化由装配层把 config-center 的 `onSelfReportChange` 接到 `announceNow`
+ *    `announceNow`;roster 落地、restart 信号与模型拒因变化由装配层把 web-admin 的 `onSelfReportChange` 接到 `announceNow`
  *    (两处 = 两类输入各自的唯一写者,触发都是 `announceNow`)。退出前 DELETE(显式注销,幂等)。
  *  - **usage 批报**:tracer 的 `brain.call` 已带 ALS principal —— FleetUsageAccumulator 按 principal×model
  *    累计,每窗口(默认 60s,半开 [windowStartMs, windowEndMs))POST /api/fleet/usage。幂等键
@@ -25,9 +27,9 @@
  *    向前合并不会双计 —— 只延迟,不丢量)。
  *  - 全部 fire-and-forget + swallow-guarded:fleet 面是运维旁路,绝不影响任务面;网络错误只 warn 一次/连败类。
  */
-import { UsageReport, type CapabilityReading, type CenterCapabilities, type ModelRefusalsSignal } from "@sema-agent/settings-schema/fleet";
+import { UsageReport, type CapabilityReading, type WebAdminCapabilities, type ModelRefusalsSignal } from "@sema-agent/settings-schema/fleet";
 import { type EngineSignalFacts } from "./fleet/engine-signal.js";
-import { type CenterEndpoint } from "./config-center/center-request.js";
+import { type CenterEndpoint } from "./web-admin-client/center-request.js";
 /** Bound on distinct principal×model keys per window — a runaway/multi-tenant burst collapses into
  *  `__other__` instead of growing unbounded (same posture as budget.ts cardinalityGuard). */
 export declare const FLEET_USAGE_KEY_CAP = 1024;
@@ -80,8 +82,8 @@ export interface FleetClientOpts {
     advertiseAddress?: string | undefined;
     version: string;
     /** 编排器片 2 件 1:引擎信号的**一只铸点**(装配层接 `mintEngineSignal(deployment)` —— `/health` 与 `/readyz` 读的同一只、同一个 deps 组)。
-     *  每条公告现铸**一次**,`ready` / `draining` / `restart` / 代际与租约三键 / 世代账都取自这一次(不会撕裂成 `ready:true` + `draining:true`,
-     *  也不会出现心跳与 `/health` 各算一份重启或租约)。修前是 `readiness` + `restart` 两只取值口(S-740 / S-741),合进这一只。 */
+     *  每条公告现铸**一次**,嵌套 `engineSignal` 与扁平 `ready` / `draining` / `restart` / 代际与租约三键都取自这一次(不会撕裂成 `ready:true` +
+     *  `draining:true`,也不会出现心跳与 `/health` 各算一份重启或租约)。修前是 `readiness` + `restart` 两只取值口(S-740 / S-741),合进这一只。 */
     signal: () => EngineSignalFacts;
     /** S-768:模型拒因信号(装配层接 `/health` 同一只取值口 `deployment.modelRefusalsState`)。每条公告现读一次;`undefined` ⇒ 公告不带
      *  `modelRefusals` 键。必填:与 `restart` 同 —— 心跳面没有「不知道有没有拒」这一形(老引擎不发这个键,中心按 `version` 判「不可知」)。 */
@@ -89,7 +91,7 @@ export interface FleetClientOpts {
     /** 编排器片 2:每一次**能力读数**交出去一次(装配层接服务租约客户端的 `noteCenterCapabilities`)。规则见 {@link capabilityReadingOf}:
      *  只有 `declared`(交出宣告的位)与 `undeclared`(交 `undefined` = 老中心没宣告)是读数;`unreadable`(体读不出 / 不是对象 /
      *  `capabilities` 键在场而形坏)不是读数 ⇒ 不调,上一次读数与它的钟原样。失败的公告同样不调(没听到 ≠ 没有)。 */
-    onCenterCapabilities?: (caps: CenterCapabilities | undefined) => void;
+    onCenterCapabilities?: (caps: WebAdminCapabilities | undefined) => void;
     usage?: FleetUsageAccumulator;
     heartbeatMs?: number;
     usageWindowMs?: number;
@@ -146,7 +148,7 @@ export declare function startFleetClient(opts: FleetClientOpts): FleetClient;
  * deployments); an address set while only the worker is missing is warned (half-configured announce).
  */
 export declare function startFleetClientFromConfig(cfg: {
-    configCenter?: (CenterEndpoint & {
+    webAdmin?: (CenterEndpoint & {
         worker?: string;
     }) | undefined;
     fleetAdvertiseAddress?: string | undefined;

package/dist/fleet-client.js

@@ -1,7 +1,8 @@
 import { InstanceAnnouncement, UsageReport, DEFAULT_HEARTBEAT_MS, readCapabilityReading } from "@sema-agent/settings-schema/fleet";
-import { drainingFlag, fleetMembershipKeys } from "./fleet/engine-signal.js";
-import { centerFetch, centerLaneConfigured } from "./config-center/center-request.js";
+import { ENGINE_SIGNAL_KEY, buildEngineSignal, fleetMembershipKeys, heartbeatReadinessKeys } from "./fleet/engine-signal.js";
+import { centerFetch, centerLaneConfigured } from "./web-admin-client/center-request.js";
 import { recordFailOpen } from "./observability/fail-open.js";
+import { WEB_ADMIN_ENV } from "@sema-agent/settings-schema";
 export const FLEET_USAGE_KEY_CAP = 1024;
 export const FLEET_CLIENT_FETCH_TIMEOUT_MS = 5000;
 export class FleetUsageAccumulator {
@@ -99,18 +100,19 @@ export function startFleetClient(opts) {
             return;
         try {
             const signal = opts.signal();
+            const engineSignal = buildEngineSignal(signal);
             const modelRefusals = opts.modelRefusals();
             const body = {
                 instanceId: opts.instanceId,
                 worker: opts.center.worker,
                 address,
                 version: opts.version,
-                ready: signal.verdict.ready,
-                draining: drainingFlag(signal),
+                ...heartbeatReadinessKeys(signal),
                 heartbeatMs,
                 ...(signal.restart !== undefined ? { restart: signal.restart } : {}),
                 ...(modelRefusals !== undefined ? { modelRefusals } : {}),
                 ...fleetMembershipKeys(signal),
+                [ENGINE_SIGNAL_KEY]: engineSignal,
             };
             const { res } = await send("fleet-instances", "POST", body);
             if (!res.ok)
@@ -229,14 +231,14 @@ export function startFleetClient(opts) {
     return { announceNow, stopRouting, flushFinalUsage };
 }
 export function startFleetClientFromConfig(cfg, opts) {
-    const cc = cfg.configCenter;
+    const cc = cfg.webAdmin;
     const address = cfg.fleetAdvertiseAddress;
     if (!centerLaneConfigured(cfg)) {
         if (address !== undefined && cc?.baseUrl && cc.credential.declared) {
-            opts.logger?.warn("fleet_client_no_worker_scope", { note: "FLEET_ADVERTISE_ADDRESS set but SEMA_REGISTRY_WORKER missing — announce needs the worker (dispatch key); fleet client not started" });
+            opts.logger?.warn("fleet_client_no_worker_scope", { note: `FLEET_ADVERTISE_ADDRESS set but ${WEB_ADMIN_ENV.worker} missing — announce needs the worker (dispatch key); fleet client not started` });
         }
         return undefined;
     }
-    return startFleetClient({ ...opts, center: cfg.configCenter, advertiseAddress: address });
+    return startFleetClient({ ...opts, center: cfg.webAdmin, advertiseAddress: address });
 }
 //# sourceMappingURL=fleet-client.js.map

package/dist/fleet-lease.d.ts

@@ -1,4 +1,4 @@
-import { type CenterEndpoint } from "./config-center/center-request.js";
+import { type CenterEndpoint } from "./web-admin-client/center-request.js";
 /** 负缓存 TTL:非 lease-enforced 的 principal 多久后再问一次 center(entitlement 升级为 lease 的收敛上界)。 */
 export declare const NOT_LEASE_TTL_MS: number;
 /** center 判 budget exhausted 后,多久内的重复提交直接拒绝而不再打 center(防 per-request 打爆)。 */
@@ -141,11 +141,11 @@ export declare class FleetLeaseManager {
 /**
  * Env/config gate:中心车道配齐({@link centerLaneConfigured} —— 与 fleet 用量环 / 用量累加器**同一只**谓词,S-866 ④)即启;
  * 不需要 FLEET_ADVERTISE_ADDRESS(它是出站消费面,不是入站可达性声明)。缺任一件 → undefined,非 fleet 部署零行为变化。
- * S-651:按**声明**装、不按内容装 —— `SEMA_REGISTRY_TOKEN_FILE`(`CENTER_CREDENTIAL_ENV.tokenFile`)在场而
+ * S-651:按**声明**装、不按内容装 —— `SEMA_WEB_ADMIN_TOKEN_FILE`(`WEB_ADMIN_ENV.tokenFile`)在场而
  * 文件此刻不可读,管理器照样装上(每次协商取值,失败走响亮的鉴权失败臂;文件恢复即恢复)。
  */
 export declare function createFleetLeaseFromEnv(cfg: {
-    configCenter?: (CenterEndpoint & {
+    webAdmin?: (CenterEndpoint & {
         worker?: string;
     }) | undefined;
     fleetLeaseFailClosed: boolean;

package/dist/fleet-lease.js

@@ -1,6 +1,6 @@
 import { QuotaLease, leaseExhausted, shouldRenewLease } from "@sema-agent/settings-schema/fleet";
 import { CenterCredentialUnavailableError } from "./center-credential.js";
-import { centerFetch, centerLaneConfigured } from "./config-center/center-request.js";
+import { centerFetch, centerLaneConfigured } from "./web-admin-client/center-request.js";
 export const NOT_LEASE_TTL_MS = 10 * 60 * 1000;
 export const EXHAUSTED_RETRY_MS = 30 * 1000;
 export const LEASE_PRINCIPAL_CAP = 4096;
@@ -174,7 +174,7 @@ export class FleetLeaseManager {
 export function createFleetLeaseFromEnv(cfg, opts) {
     if (!centerLaneConfigured(cfg))
         return undefined;
-    const cc = cfg.configCenter;
+    const cc = cfg.webAdmin;
     return new FleetLeaseManager({ ...opts, center: { baseUrl: cc.baseUrl, credential: cc.credential, worker: cc.worker }, failMode: cfg.fleetLeaseFailClosed ? "closed" : "open" });
 }
 //# sourceMappingURL=fleet-lease.js.map

package/dist/host-lsp-manager.d.ts

@@ -18,7 +18,7 @@
  *
  * ## 时刻
  * env 在**构造时**取一次快照(boot / run-local 起腿时),而不是 core 默认那样每次 spawn 现取:`NodeLspManagerOptions.env`
- * 是一份静态记录。本仓的 `process.env` 是 boot 期输入(热配置走配置中心,不改 `process.env`),两者在本仓部署上同值。
+ * 是一份静态记录。本仓的 `process.env` 是 boot 期输入(热配置走 web-admin,不改 `process.env`),两者在本仓部署上同值。
  *
  * ## 点名放行(S-699,`LSP_ENV_ALLOW`)
  * 剥除会连语言服务器自己的真实依赖一起剥掉(`.npmrc` 的 `${NPM_TOKEN}` 插值、rust-analyzer `cargo metadata` 私有 registry 的

package/dist/hosted-posture.d.ts

@@ -30,11 +30,11 @@
  * (`PRINCIPAL_JWT_PUBKEYS/ISS/AUD` 任一在场;`AUTH_BRIDGE_ISSUER` 显式在场),[ref] ① 裁 (a) 撤回:
  *  · **真假阳**:本机自起引擎、配了 principal-JWT / auth-bridge 签发方的单用户部署(web-admin 8090 真案)
  *    在 7.98.0 被判托管而拒启,只能滚回 7.93.5;
- *  · **与回退 issuer 不同判**:auth-bridge 的 `?? configCenter.baseUrl` 回退(`boot/stage-09-leader.ts`)
+ *  · **与回退 issuer 不同判**:auth-bridge 的 `?? webAdmin.baseUrl` 回退(`boot/stage-09-leader.ts`)
  *    从来不算证据,而回退桥的引擎同样把单用户授予开给每一个验签通过的 registry JWT 调用者 —— 同一个
  *    租户轴事实,「显式写了 issuer」与「从 center 推出 issuer」是同一形。裁定后两者同判。
  * ⇒ 签发方配置是**身份验签轴**(谁的 JWT 算数),不是租户轴(这台机器有几个主人)。「受控于控制面」
- * (`SEMA_REGISTRY_*`,含 worker 名)同理是 fleet 管理轴,本判据同样不读。
+ * (`SEMA_WEB_ADMIN_*`,含 worker 名)同理是 fleet 管理轴,本判据同样不读。
  *
  * 随两臂一起删掉的(按类删干净,规则集变小):S-564 腿①「托管 ∧ 未开 `REQUIRE_PRINCIPAL` ⇒ 拒启」
  * (判据只剩读 `requirePrincipal` 的那一臂之后,那条合取恒假 ⇒ 结构上不可达)及其跨键不变量行;
@@ -44,9 +44,9 @@
  *
  * 假阳 = 一台单用户部署被收走一个它一直在用的能力(7.98.0 时还会被拒启)。词表不收任何推断臂:
  *  · ❌ `PRINCIPAL_JWT_*` / `AUTH_BRIDGE_ISSUER` 在场 —— 见上一段([ref] ① 撤回;加回来 = 翻案,要新裁定)。
- *  · ❌ `configCenter`(含 `worker` 名)/ auth-bridge 的 center 回退 —— fleet 管理轴。初版(车LT)收过
+ *  · ❌ `webAdmin`(含 `worker` 名)/ auth-bridge 的 center 回退 —— fleet 管理轴。初版(车LT)收过
  *    `managed-worker` 臂,实测两个反例后撤回:`run-local.ts` 强设 `REQUIRE_PRINCIPAL=false` 的本机 CLI 在一个
- *    带 registry 键的共享 `.env` 上拒启;本仓自己的 `test/config-coverage-blocks.test.ts` configCenter 两格当场红。
+ *    带 registry 键的共享 `.env` 上拒启;本仓自己的 `test/config-coverage-blocks.test.ts` webAdmin 两格当场红。
  *  · ❌ `operatorPrincipals` 非空 —— **真假阳**:`IMAGE_BAKES_ENABLED` 那条既有不变量
  *    (`config-invariants.ts` 的 `bake-operator-principals`)**强制**开烤门的部署把它填非空。
  *  · ❌ `SERVICE_AUTH_TOKENS` 条目数 —— 一台机器上同时给 cli 与 web-admin 发一只令牌是单用户常态。

package/dist/http/admission.js

@@ -1,5 +1,5 @@
 import { APPROVAL_REACH, MCP_IMAGE_MAX_BASE64, isApprovalReach, isPermissionMode, isThinkingLevel, expandTiers } from "@sema-agent/core";
-import { isModelAllowlisted, matchCatalogModel, refusedCatalogEntry, selectableCatalog } from "../model-select.js";
+import { isAtMentionable, matchCatalogModel, refusedCatalogEntry, selectableCatalog } from "../model-select.js";
 import { modelUnavailableMessage } from "../model-entry-refusal.js";
 import { HttpError } from "../security.js";
 import { MAX_SETTINGS_OUTPUT_STYLE_CHARS, MAX_SETTINGS_ENV_VARS, MAX_SETTINGS_ENV_KEY_CHARS, MAX_SETTINGS_ENV_VALUE_CHARS, PERMISSION_MODE_WORDS, parseTaskSettings, settingsPermissionBucketIssue, skillListingBudgetFractionOk, skillListingMaxDescOk, stampEntryPermissionMode, taskHooksHonored, taskSettingsKeyIssue } from "../task-settings.js";
@@ -15,6 +15,7 @@ import { verifyRoundsFromBody } from "./verify-rounds.js";
 import { skillCarriesRetiredManifest } from "./retired-skill-manifest.js";
 import { resolveDevicePlacementIntent } from "./device-placement.js";
 import { sendError, httpErrorCode } from "./send.js";
+import { WEB_ADMIN_ENV } from "@sema-agent/settings-schema";
 const APPROVAL_REACH_WORDS = APPROVAL_REACH.map((word) => JSON.stringify(word)).join(" / ");
 export const MAX_SKILL_CONTENT_CHARS = 1_048_576;
 export const MAX_SYSTEM_PROMPT_CHARS = 16_384;
@@ -51,8 +52,7 @@ export const SKILL_MANIFEST_RETIRED = "skill.manifest was retired in core 7.41.0
 const MAX_IMAGES_PER_REQUEST = 20;
 const MAX_IMAGE_BASE64_BYTES = MCP_IMAGE_MAX_BASE64;
 function mentionableNames(config, catalog) {
-    const allowlist = config.atModelAllowlist ?? [];
-    return Object.keys(catalog).filter((n) => n !== "default" && isModelAllowlisted(n, catalog, allowlist, config.modelRefusals));
+    return Object.keys(catalog).filter((n) => n !== "default" && isAtMentionable(n, catalog, config.atMention, config.modelRefusals));
 }
 function refuseUnavailableModel(res, config, field, ref) {
     const hit = refusedCatalogEntry(ref, config.modelRefusals);
@@ -377,7 +377,7 @@ export function createAdmission(ctx) {
             const wantsSelfOrchestration = body.selfOrchestration === true
                 || parseTaskSettings(body.settings).settings?.ultracode === true;
             if (!admission.available && wantsSelfOrchestration) {
-                sendError(res, 501, "capability.self_orchestration_required", "self-orchestration is enabled on this worker (SELF_ORCHESTRATION_ENABLED) but it is multi-tenant (REQUIRE_PRINCIPAL) and wires NO per-principal entitlement source, so the engine's allowWorkflows gate — which is tighten-only, meaning an absent resolver leaves it UNGATED — is fail-closed for every principal: no request can ever get the workflow engine here (GET /v1/capabilities reports workflows:false with workflowsGate.denial \"entitlement_resolver_absent\"). Wire a config center (SEMA_REGISTRY_URL + token, not dry-run) to gate it per principal, or set SELF_ORCHESTRATION_ENABLED=false — the honest posture for a worker that cannot grant it. To submit this task without the workflow engine, drop selfOrchestration / settings.ultracode; ultracode's other half (the max thinking tier) is available as reasoningEffort: \"max\"");
+                sendError(res, 501, "capability.self_orchestration_required", `self-orchestration is enabled on this worker (SELF_ORCHESTRATION_ENABLED) but it is multi-tenant (REQUIRE_PRINCIPAL) and wires NO per-principal entitlement source, so the engine's allowWorkflows gate — which is tighten-only, meaning an absent resolver leaves it UNGATED — is fail-closed for every principal: no request can ever get the workflow engine here (GET /v1/capabilities reports workflows:false with workflowsGate.denial "entitlement_resolver_absent"). Wire a web-admin (${WEB_ADMIN_ENV.url} + token, not dry-run) to gate it per principal, or set SELF_ORCHESTRATION_ENABLED=false — the honest posture for a worker that cannot grant it. To submit this task without the workflow engine, drop selfOrchestration / settings.ultracode; ultracode's other half (the max thinking tier) is available as reasoningEffort: "max"`);
                 return null;
             }
         }