@sema-agent/server 7.122.0 → 7.124.0

package/dist/{config-center → web-admin-client}/apply-effective.js

@@ -1,5 +1,7 @@
-import { resolveActiveTiers } from "@sema-agent/settings-schema";
+import { expandTiers, resolveTaskModel as coreResolveTaskModel } from "@sema-agent/core";
+import { WEB_ADMIN_ENV, narrowAtMention, resolveActiveTiers, resolveCatalogDefaultModel } from "@sema-agent/settings-schema";
 import { modelKeyPoison } from "../key-resolver.js";
+import { readAtMention } from "../model-select.js";
 import { applyAutoCompactWindow, buildModelCostKey, parseAutonomy, unmatchableToolNamesRefusal } from "../config.js";
 import { buildModelCompat, readModelCompat } from "../model-compat.js";
 import { buildModelHeadersKey } from "../model-entry-headers.js";
@@ -64,41 +66,27 @@ export function mutateInPlace(target, source) {
 }
 const appliedGeneration = new WeakMap();
 const envRolesBaseline = new WeakMap();
-export const UNPARSABLE_AT_MODEL_ALLOWLIST_ENTRY = "\u0000<unparsable-at-model-allowlist-entry>";
-function stageAtModelAllowlist(raw, models, logger) {
-    if (raw === undefined || raw === null)
-        return [];
-    if (!Array.isArray(raw)) {
-        logger?.warn("sema_registry_at_model_allowlist_invalid", {
-            type: typeof raw,
-            hint: "models.atModelAllowlist must be an array of catalog model names — an unreadable allowlist is treated as ALLOWING NOTHING (fail-closed: a broken restriction must not read as 'no restriction'); tasks still run on the default/role models",
+function stageAtMention(raw, usableNames, logger) {
+    const read = readAtMention(raw);
+    if (read === undefined) {
+        logger?.warn("web_admin_at_mention_invalid", {
+            hint: "models.atMention does not read as {mode:\"all\"} | {mode:\"none\"} | {mode:\"only\", models:[…]} — treated as {mode:\"none\"} (fail-closed: a broken restriction must not read as 'no restriction'); tasks still run on the default/role models",
         });
-        return [UNPARSABLE_AT_MODEL_ALLOWLIST_ENTRY];
+        return { mode: "none" };
     }
-    const names = [];
-    const bad = [];
-    for (const entry of raw) {
-        if (typeof entry === "string" && entry.length > 0)
-            names.push(entry);
-        else {
-            bad.push(typeof entry === "string" ? "<empty-string>" : `<non-string:${typeof entry}>`);
-            names.push(UNPARSABLE_AT_MODEL_ALLOWLIST_ENTRY);
+    const narrowed = narrowAtMention(read, usableNames);
+    if (read.mode === "only") {
+        const kept = new Set(narrowed.mode === "only" ? narrowed.models : []);
+        const dangling = read.models.filter((n) => !kept.has(n));
+        if (dangling.length > 0) {
+            logger?.warn("web_admin_at_mention_dangling", {
+                dangling,
+                narrowedTo: narrowed.mode,
+                hint: "these models.atMention names are not in this generation's usable catalog (not enabled, or unavailable on this host) — they allow nothing; when none is left the reading is {mode:\"none\"} and every user model pick is refused",
+            });
         }
     }
-    if (bad.length > 0) {
-        logger?.warn("sema_registry_at_model_allowlist_bad_entries", {
-            bad,
-            hint: "non-string / empty entries in models.atModelAllowlist allow NOTHING (they are kept as unresolvable placeholders, never dropped — dropping them would silently WIDEN the allowlist, and an all-bad list would collapse to the empty = allow-everything form)",
-        });
-    }
-    const dangling = names.filter((n) => n !== UNPARSABLE_AT_MODEL_ALLOWLIST_ENTRY && models[n] === undefined);
-    if (dangling.length > 0) {
-        logger?.warn("sema_registry_at_model_allowlist_dangling", {
-            dangling,
-            hint: "these @-mention allowlist entries name a model that is not in the enabled catalog — they allow nothing; an allowlist that is ENTIRELY dangling refuses every user model pick",
-        });
-    }
-    return names;
+    return narrowed;
 }
 export function applyEffective(config, eff, logger, opts) {
     const staged = stageEffective(config, eff, logger, opts);
@@ -106,7 +94,7 @@ export function applyEffective(config, eff, logger, opts) {
     const live = appliedGeneration.get(config);
     const ordered = opts.generation !== undefined || staged.version > 0;
     if (ordered && live !== undefined && gen < live) {
-        logger?.warn("sema_registry_stale_generation_refused", { staged: staged.version, stagedOrdinal: gen, live, note: "an older staged generation must not overwrite a newer committed one — refused whole; next poll replays" });
+        logger?.warn("web_admin_stale_generation_refused", { staged: staged.version, stagedOrdinal: gen, live, note: "an older staged generation must not overwrite a newer committed one — refused whole; next poll replays" });
         return false;
     }
     const mp = staged.modelPlaneGroup.stages.models;
@@ -115,7 +103,7 @@ export function applyEffective(config, eff, logger, opts) {
             opts.swapPlane({ models: mp.models, tiers: mp.activeTiers });
         }
         catch (err) {
-            logger?.warn("sema_registry_model_plane_swap_refused", {
+            logger?.warn("web_admin_model_plane_swap_refused", {
                 version: staged.version,
                 error: err instanceof Error ? err.message : String(err),
                 note: "the Runner refused the candidate model plane (swapDeps screens the whole candidate atomically — the current generation stays in force untouched); candidate refused whole, re-judged next poll (/health shows target≠applied while it persists)",
@@ -143,13 +131,13 @@ export function applyEffective(config, eff, logger, opts) {
         opts.report({ ...report, fullyApplied: refusedGroups(report).length === 0, modelRefusals: modelRefusalVerdictOf(staged.modelPlaneGroup) });
     }
     if (staged.limits.changed.length > 0)
-        logger?.info("sema_registry_limits", { version: staged.version, keys: staged.limits.changed });
+        logger?.info("web_admin_limits", { version: staged.version, keys: staged.limits.changed });
     if (mp)
-        logger?.info("sema_registry_models", mp.infoLine);
+        logger?.info("web_admin_models", mp.infoLine);
     if (staged.approvalGate.next !== undefined)
-        logger?.info("sema_registry_runtime", { version: staged.version, approvalRequire: staged.approvalGate.next });
+        logger?.info("web_admin_runtime", { version: staged.version, approvalRequire: staged.approvalGate.next });
     if (Object.keys(staged.hot.infoLine).length > 0)
-        logger?.info("sema_registry_runtime_hot", staged.hot.infoLine);
+        logger?.info("web_admin_runtime_hot", staged.hot.infoLine);
     for (const n of staged.modelPlaneGroup.stages.collab?.notices ?? []) {
         if (n.level === "warn")
             logger?.warn(n.msg, n.fields);
@@ -157,7 +145,7 @@ export function applyEffective(config, eff, logger, opts) {
             logger?.info(n.msg, n.fields);
     }
     if (Object.keys(staged.projects).length > 0)
-        logger?.info("sema_registry_projects", { projects: Object.keys(staged.projects) });
+        logger?.info("web_admin_projects", { projects: Object.keys(staged.projects) });
     return true;
 }
 function commitStaged(config, staged) {
@@ -166,12 +154,13 @@ function commitStaged(config, staged) {
         config.modelApiKeyEnv = mp.modelApiKeyEnv;
         config.modelApiKeys = mp.modelApiKeys;
         config.modelRefusals = mp.modelRefusals;
+        config.droppedCatalogEntries = mp.droppedCatalogEntries;
         mutateInPlace(config.modelQuotaWeights, mp.quotaWeights);
         mutateInPlace(config.models, mp.models);
         config.model = config.models.default;
         mutateInPlace(config.roles, mp.roles);
         mutateInPlace(config.tiers, mp.activeTiers);
-        config.atModelAllowlist = mp.atModelAllowlist;
+        config.atMention = mp.atMention;
     }
     if (staged.approvalGate.next !== undefined)
         config.approvalRequire = staged.approvalGate.next;
@@ -190,7 +179,7 @@ function commitStaged(config, staged) {
 }
 export const MODEL_PLANE_DOMAINS = ["models", "collab"];
 const MODEL_PLANE_SURFACES = {
-    models: ["models", "model", "modelRefusals", "modelApiKeyEnv", "modelApiKeys", "modelQuotaWeights", "roles", "tiers", "atModelAllowlist"],
+    models: ["models", "model", "modelRefusals", "droppedCatalogEntries", "modelApiKeyEnv", "modelApiKeys", "modelQuotaWeights", "roles", "tiers", "atMention"],
     collab: ["collabWorkflows"],
 };
 const MODEL_PLANE_GROUP_KEYS = MODEL_PLANE_DOMAINS.flatMap((d) => MODEL_PLANE_SURFACES[d]);
@@ -230,15 +219,15 @@ function modelPlaneGroupReport(group) {
 const ROLE_BINDING_UNAVAILABLE_HINT = "tasks resolving this role fail: alias/tier expansion cannot mint this name; the engine refuses it loud — bind the role to a usable model, or make the entry usable (see the entry's own warn)";
 function stageModelPlane(config, eff, logger, sealedKeys) {
     const enabled = (eff.models?.models ?? []).filter((m) => m.enabled !== false);
-    const verdict = judgeCatalogEntries(enabled, { anthropicRouteMounted: config.anthropic !== undefined }, eff.models?.droppedIdentities);
-    if (enabled.length === 0 && Object.keys(verdict.refused).length === 0 && verdict.malformed.length === 0)
+    const verdict = judgeCatalogEntries(enabled, { anthropicRouteMounted: config.anthropic !== undefined }, eff.models?.droppedCatalogEntries);
+    if (enabled.length === 0 && verdict.malformed.length === 0 && verdict.dropped.every((row) => row.identity?.enabled === false))
         return { stages: { collab: stageCollabDomain(eff) } };
     {
         for (const [name, r] of Object.entries(verdict.refused))
             logger?.warn(refusalEventOf(r.reason), refusalWarnFields(name, r));
         const refuse = (code, reason, detail = {}) => {
             const invariant = PLANE_REFUSAL_INVARIANT_OF[code];
-            logger?.warn("sema_registry_model_plane_refused", {
+            logger?.warn("web_admin_model_plane_refused", {
                 version: typeof eff.version === "number" ? eff.version : 0,
                 invariant,
                 reason,
@@ -257,16 +246,16 @@ function stageModelPlane(config, eff, logger, sealedKeys) {
         const envDefaults = { maxTokens: envModel.maxTokens, contextWindow: envModel.contextWindow, reasoning: envModel.reasoning, charsPerToken: envModel.charsPerToken, defaultThinking: envModel.defaultThinking, compat: envModel.compat };
         for (const m of usable) {
             if (m.baseUrl)
-                logger?.warn("sema_registry_model_base_url", { model: m.name, baseUrl: buildDisplaySafeUrl(m.baseUrl), hint: "registry-directed gateway override — this model's key authenticates AGAINST THIS URL" });
+                logger?.warn("web_admin_model_base_url", { model: m.name, baseUrl: buildDisplaySafeUrl(m.baseUrl), hint: "registry-directed gateway override — this model's key authenticates AGAINST THIS URL" });
             models[m.name] = toModel(m, envDefaults, logger);
             if (m.sealedApiKey) {
                 const s = m.sealedApiKey;
                 if (!sealedKeys) {
-                    logger?.warn("sema_registry_model_sealed_key_no_store", { model: m.name, publicKeyId: s.publicKeyId, hint: "no sealed-key store on this host (boot custody init failed or lane unwired) — key POISONED: tasks on this model fail loud (no apiKeyEnv fallback, no gateway fallback)" });
+                    logger?.warn("web_admin_model_sealed_key_no_store", { model: m.name, publicKeyId: s.publicKeyId, hint: "no sealed-key store on this host (boot custody init failed or lane unwired) — key POISONED: tasks on this model fail loud (no apiKeyEnv fallback, no gateway fallback)" });
                     modelApiKeys[m.name] = modelKeyPoison({ source: "sealed", reason: "no_key_store", publicKeyId: s.publicKeyId });
                 }
                 else if (!sealedKeys.has(s.publicKeyId)) {
-                    logger?.warn("sema_registry_model_sealed_key_no_private_key", { model: m.name, publicKeyId: s.publicKeyId, held: sealedKeys.ids(), hint: "ciphertext targets a private key this host doesn't hold (rotated away / other host) — key POISONED: tasks on this model fail loud until the operator re-pastes the key in the web UI (it seals against the newest registered public key)" });
+                    logger?.warn("web_admin_model_sealed_key_no_private_key", { model: m.name, publicKeyId: s.publicKeyId, held: sealedKeys.ids(), hint: "ciphertext targets a private key this host doesn't hold (rotated away / other host) — key POISONED: tasks on this model fail loud until the operator re-pastes the key in the web UI (it seals against the newest registered public key)" });
                     modelApiKeys[m.name] = modelKeyPoison({ source: "sealed", reason: "stale_ciphertext", publicKeyId: s.publicKeyId });
                 }
                 else {
@@ -274,7 +263,7 @@ function stageModelPlane(config, eff, logger, sealedKeys) {
                         modelApiKeys[m.name] = sealedKeys.open(s.ciphertext, s.publicKeyId);
                     }
                     catch (err) {
-                        logger?.warn("sema_registry_model_sealed_key_open_failed", { model: m.name, publicKeyId: s.publicKeyId, err: String(err), hint: "corrupt/foreign ciphertext — key POISONED: tasks on this model fail loud (no apiKeyEnv fallback, no gateway fallback)" });
+                        logger?.warn("web_admin_model_sealed_key_open_failed", { model: m.name, publicKeyId: s.publicKeyId, err: String(err), hint: "corrupt/foreign ciphertext — key POISONED: tasks on this model fail loud (no apiKeyEnv fallback, no gateway fallback)" });
                         modelApiKeys[m.name] = modelKeyPoison({ source: "sealed", reason: "sealed_decrypt_failed", publicKeyId: s.publicKeyId, errKind: err instanceof Error ? err.name : "unknown" });
                     }
                 }
@@ -282,7 +271,7 @@ function stageModelPlane(config, eff, logger, sealedKeys) {
             else if (m.apiKeyEnv) {
                 modelApiKeyEnv[m.name] = m.apiKeyEnv;
                 if (!process.env[m.apiKeyEnv])
-                    logger?.warn("sema_registry_model_key_env_missing", { model: m.name, apiKeyEnv: m.apiKeyEnv, hint: `env var ${m.apiKeyEnv} not set (or empty) in this service — key POISONED: tasks on this model fail loud naming ${m.apiKeyEnv} (no gateway fallback) until it is set; or drop apiKeyEnv from the entry to use the gateway key on purpose` });
+                    logger?.warn("web_admin_model_key_env_missing", { model: m.name, apiKeyEnv: m.apiKeyEnv, hint: `env var ${m.apiKeyEnv} not set (or empty) in this service — key POISONED: tasks on this model fail loud naming ${m.apiKeyEnv} (no gateway fallback) until it is set; or drop apiKeyEnv from the entry to use the gateway key on purpose` });
             }
         }
         const quotaWeights = {};
@@ -304,16 +293,6 @@ function stageModelPlane(config, eff, logger, sealedKeys) {
                 centerRoles[role] = { select: tgt.select };
         }
         const roles = { ...envRolesBaseline.get(config), ...centerRoles };
-        let picked;
-        if (usable.length > 0) {
-            picked = resolveDefaultModelName(eff, (n) => models[n] !== undefined, usable[0].name, (source, name) => logger?.warn("sema_registry_default_dangling", {
-                source,
-                ...(Object.hasOwn(verdict.refused, name) ? refusedNameLogField("name", name) : { name }),
-                ...(Object.hasOwn(verdict.refused, name) ? { unavailable: verdict.refused[name].code } : {}),
-                hint: "explicit default names a model that is not in the usable catalog (not enabled, or unavailable on this host — see `unavailable`) — falling to the next source",
-            }));
-            models.default = models[picked.name];
-        }
         const activeTiers = {};
         for (const [tier, target] of Object.entries(resolveActiveTiers(eff.models) ?? {})) {
             if (models[target] !== undefined) {
@@ -321,7 +300,39 @@ function stageModelPlane(config, eff, logger, sealedKeys) {
                 continue;
             }
             const refusal = Object.hasOwn(verdict.refused, target) ? verdict.refused[target] : undefined;
-            logger?.warn("sema_registry_tier_binding_unavailable", { tier, ...(refusal !== undefined ? refusedNameLogField("model", target) : { model: target }), ...(refusal !== undefined ? { code: refusal.code } : {}), hint: "this tier binding names a model that is not in this generation's usable catalog — the binding is dropped (the tier word falls to the next lower bound tier, core's ladder); fix the entry or rebind the tier" });
+            logger?.warn("web_admin_tier_binding_unavailable", { tier, ...(refusal !== undefined ? refusedNameLogField("model", target) : { model: target }), ...(refusal !== undefined ? { code: refusal.code } : {}), hint: "this tier binding names a model that is not in this generation's usable catalog — the binding is dropped (the tier word falls to the next lower bound tier, core's ladder); fix the entry or rebind the tier" });
+        }
+        let picked;
+        if (usable.length > 0) {
+            const decided = resolveCatalogDefaultModel(eff.models, (n) => models[n] !== undefined, usable[0].name);
+            switch (decided.kind) {
+                case "named":
+                    for (const d of decided.dangling) {
+                        logger?.warn("web_admin_default_dangling", {
+                            source: d.source,
+                            ...(Object.hasOwn(verdict.refused, d.name) ? refusedNameLogField("name", d.name) : { name: d.name }),
+                            ...(Object.hasOwn(verdict.refused, d.name) ? { unavailable: verdict.refused[d.name].code } : {}),
+                            hint: "explicit default names a model that is not in the usable catalog (not enabled, or unavailable on this host — see `unavailable`) — falling to the next source",
+                        });
+                    }
+                    picked = { name: decided.name, source: decided.source };
+                    break;
+                case "select": {
+                    const engine = engineDefaultOfSelect(decided.select, models, activeTiers);
+                    if ("unresolved" in engine) {
+                        return refuse(DEFAULT_MODEL_MISSING_CODE, `this catalog candidate has no default model [${DEFAULT_MODEL_MISSING_CODE}] — roles.default is a {select} that the engine resolves to no usable catalog entry ` +
+                            "(no enabled entry this host can serve matches its criteria, and no tier binding catches the default role); widen the criteria, enable a matching entry, or bind roles.default to a model by name", { engine: engine.unresolved });
+                    }
+                    picked = { name: engine.name, source: "roles.default.select" };
+                    break;
+                }
+                default: {
+                    const unhandled = decided;
+                    throw new Error(`catalog default: unknown kind ${JSON.stringify(unhandled)}`);
+                }
+            }
+            if (picked !== undefined)
+                models.default = models[picked.name];
         }
         const nextView = { ...config, models, tiers: activeTiers, modelRefusals: verdict.refused };
         const noDefault = crossInvariant("default-model-resolvable").check({ live: config, next: nextView });
@@ -337,21 +348,22 @@ function stageModelPlane(config, eff, logger, sealedKeys) {
             const target = typeof spec === "string" ? spec : spec !== null && typeof spec === "object" && "model" in spec && typeof spec.model === "string" ? spec.model : undefined;
             const refusal = target !== undefined && Object.hasOwn(verdict.refused, target) ? verdict.refused[target] : undefined;
             if (refusal !== undefined) {
-                logger?.warn("sema_registry_role_binding_unavailable", { role, ...refusedNameLogField("model", target), code: refusal.code, hint: ROLE_BINDING_UNAVAILABLE_HINT });
+                logger?.warn("web_admin_role_binding_unavailable", { role, ...refusedNameLogField("model", target), code: refusal.code, hint: ROLE_BINDING_UNAVAILABLE_HINT });
             }
         }
-        const atModelAllowlist = stageAtModelAllowlist(eff.models?.atModelAllowlist, models, logger);
+        const atMention = stageAtMention(eff.models?.atMention, new Set(usable.map((m) => m.name)), logger);
         const defaultModel = models.default;
         const plane = {
             models,
             modelApiKeyEnv,
             modelApiKeys,
             modelRefusals: { ...verdict.refused },
+            droppedCatalogEntries: [...verdict.dropped],
             quotaWeights,
             roles,
             activeTiers,
-            atModelAllowlist,
-            infoLine: { count: usable.length, ...(Object.keys(verdict.refused).length > 0 ? refusedNamesLogFields("unavailable", Object.keys(verdict.refused)) : {}), default: defaultModel.id, defaultSource: picked.source, roles: Object.keys(roles), tiers: Object.keys(activeTiers), atModelAllowlist: atModelAllowlist.length, sealedKeys: Object.values(modelApiKeys).filter((v) => typeof v === "string").length, sealedPoisoned: Object.values(modelApiKeys).filter((v) => typeof v !== "string").length },
+            atMention,
+            infoLine: { count: usable.length, ...(Object.keys(verdict.refused).length > 0 ? refusedNamesLogFields("unavailable", Object.keys(verdict.refused)) : {}), default: defaultModel.id, defaultSource: picked.source, roles: Object.keys(roles), tiers: Object.keys(activeTiers), atMention: atMention.mode, sealedKeys: Object.values(modelApiKeys).filter((v) => typeof v === "string").length, sealedPoisoned: Object.values(modelApiKeys).filter((v) => typeof v !== "string").length },
         };
         return { stages: { models: plane, collab: stageCollabDomain(eff) }, defaultName: picked.name, refused: verdict.refused };
     }
@@ -360,23 +372,23 @@ function stageCollabDomain(eff) {
     const projected = projectCollabToWorkflows(eff.collab?.templates);
     const notices = [];
     if (Object.keys(projected.workflows).length > 0)
-        notices.push({ level: "info", msg: "sema_registry_collab_workflows", fields: { workflows: Object.keys(projected.workflows) } });
+        notices.push({ level: "info", msg: "web_admin_collab_workflows", fields: { workflows: Object.keys(projected.workflows) } });
     if (projected.skipped.length > 0)
-        notices.push({ level: "warn", msg: "sema_registry_collab_skipped", fields: { skipped: projected.skipped } });
+        notices.push({ level: "warn", msg: "web_admin_collab_skipped", fields: { skipped: projected.skipped } });
     if (projected.notes.length > 0)
-        notices.push({ level: "info", msg: "sema_registry_collab_notes", fields: { notes: projected.notes } });
+        notices.push({ level: "info", msg: "web_admin_collab_notes", fields: { notes: projected.notes } });
     return { workflows: projected.workflows, notices };
 }
 function stageEffective(config, eff, logger, opts) {
     if (opts.leg === "boot" && !eff.version) {
-        logger?.warn("sema_registry_unpublished", {
+        logger?.warn("web_admin_unpublished", {
             version: eff.version,
             note: "empty/unpublished effective config — using env + built-in fallback; publish a config or unset CONFIG_PUBLISH_MODE",
         });
     }
     const modelPlaneGroup = stageModelPlane(config, eff, logger, opts.sealedKeys);
     const approvalGate = stageApprovalGate(config, eff.governance, opts, logger);
-    const limits = stageLimits(config, { version: typeof eff.version === "number" ? eff.version : 0, ...("limits" in eff ? { limits: eff.limits } : {}), legacyGates: legacyGateValues(eff.runtime) }, logger);
+    const limits = stageLimits(config, { version: typeof eff.version === "number" ? eff.version : 0, ...("limits" in eff ? { limits: eff.limits } : {}) }, logger);
     const hot = stageRuntimeHot(config, eff.governance, logger);
     const projDomain = eff.projects;
     const rawProjects = (projDomain && typeof projDomain === "object" && !Array.isArray(projDomain) &&
@@ -403,7 +415,6 @@ function stageEffective(config, eff, logger, opts) {
         projects,
     };
 }
-export const RUNTIME_GATE_KEYS = ["rateLimitPerMin", "maxTaskCostUsd", "maxTaskTokens", "maxPrincipalCostUsd", "costQuotaWindowSec"];
 export function centerManagedConfigKeys(eff) {
     const out = new Set();
     if (!eff)
@@ -414,12 +425,6 @@ export function centerManagedConfigKeys(eff) {
             if (Object.prototype.hasOwnProperty.call(limits, k))
                 out.add(k);
     }
-    const rt = eff.runtime;
-    if (rt) {
-        for (const k of RUNTIME_GATE_KEYS)
-            if (runtimeGatePresent(rt, k))
-                out.add(k);
-    }
     if (eff.governance) {
         if (eff.governance.autonomy !== undefined)
             out.add("autonomy");
@@ -441,16 +446,10 @@ export function centerManagedConfigKeys(eff) {
     }
     if ((eff.models?.models ?? []).some((m) => m.enabled !== false))
         out.add("models");
-    if (eff.models?.atModelAllowlist !== undefined)
-        out.add("atModelAllowlist");
+    if (eff.models?.atMention !== undefined)
+        out.add("atMention");
     return out;
 }
-export function runtimeGatePresent(rt, key) {
-    const v = rt[key];
-    if (key === "costQuotaWindowSec")
-        return typeof v === "number" && v > 0;
-    return typeof v === "number";
-}
 const KEPT_WOULD_MATCH_NOTHING = "the prior approvalRequire is unchanged — the published list would have silently matched nothing";
 const KEPT_WOULD_REMOVE_GATE = "the prior approvalRequire is unchanged — coercing this malformed value would have silently REMOVED the approval gate";
 const KEPT_WOULD_NEVER_PARK = "the prior approvalRequire is unchanged — this deployment has nowhere to park a gated call, so applying the list would leave it silently unenforced";
@@ -475,7 +474,7 @@ function stageApprovalRequire(raw) {
         return {
             ok: false,
             detail: unmatchable.message,
-            reason: `published governance.approvalRequire has ${unmatchable.names.length} entr${unmatchable.names.length === 1 ? "y" : "ies"} that match no live tool (retired name / incomplete protocol name / server segment the engine never mints / CC-form rule) — the offending entries are named in the sema_registry_approval_require_invalid log line`,
+            reason: `published governance.approvalRequire has ${unmatchable.names.length} entr${unmatchable.names.length === 1 ? "y" : "ies"} that match no live tool (retired name / incomplete protocol name / server segment the engine never mints / CC-form rule) — the offending entries are named in the web_admin_approval_require_invalid log line`,
             names: unmatchable.names,
             kept: KEPT_WOULD_MATCH_NOTHING,
         };
@@ -502,7 +501,7 @@ function stageApprovalGate(config, gov, leg, logger) {
     if (!approvalEnvBaseline.has(config))
         approvalEnvBaseline.set(config, Object.freeze([...config.approvalRequire]));
     const refuse = (r) => {
-        logger?.warn("sema_registry_approval_require_invalid", { keys: [...APPROVAL_GROUP_KEYS], detail: r.detail, names: [...r.names], kept: r.kept });
+        logger?.warn("web_admin_approval_require_invalid", { keys: [...APPROVAL_GROUP_KEYS], detail: r.detail, names: [...r.names], kept: r.kept });
         return { rejected: { keys: [...APPROVAL_GROUP_KEYS], reason: r.reason } };
     };
     const raw = gov?.approvalRequire;
@@ -522,27 +521,18 @@ function stageApprovalGate(config, gov, leg, logger) {
     const same = next.length === config.approvalRequire.length && next.every((n, i) => n === config.approvalRequire[i]);
     return same ? {} : { next };
 }
-function legacyGateValues(rt) {
-    const out = {};
-    if (!rt)
-        return out;
-    for (const k of RUNTIME_GATE_KEYS)
-        if (runtimeGatePresent(rt, k))
-            out[k] = rt[k];
-    return out;
-}
 export function applyRuntimeGates(config, eff, leg, logger) {
     const approval = stageApprovalGate(config, eff?.governance, leg, logger);
     if (approval.next !== undefined)
         config.approvalRequire = approval.next;
-    const limits = stageLimits(config, { version: 0, legacyGates: legacyGateValues(eff?.runtime) }, logger);
+    const limits = stageLimits(config, { version: 0, ...(eff !== undefined && "limits" in eff ? { limits: eff.limits } : {}) }, logger);
     for (const [k, v] of limits.assignments)
         config[k] = v;
     for (const k of limits.deletions)
         delete config[k];
     const info = { ...(approval.next !== undefined ? { approvalRequire: approval.next } : {}), ...Object.fromEntries(limits.assignments) };
     if (Object.keys(info).length > 0)
-        logger?.info("sema_registry_runtime", info);
+        logger?.info("web_admin_runtime", info);
 }
 function stageRuntimeHot(config, rt, logger) {
     const infoLine = {};
@@ -556,7 +546,7 @@ function stageRuntimeHot(config, rt, logger) {
     if (rt?.commandPolicy !== undefined) {
         const errors = validateCommandRules(rt.commandPolicy);
         if (errors.length > 0) {
-            logger?.error("sema_registry_commandpolicy_invalid", { errors, kept: config.commandPolicy?.length ?? 0 });
+            logger?.error("web_admin_commandpolicy_invalid", { errors, kept: config.commandPolicy?.length ?? 0 });
         }
         else if (JSON.stringify(config.commandPolicy) !== JSON.stringify(rt.commandPolicy)) {
             setCommandPolicy = true;
@@ -578,26 +568,19 @@ export function applyRuntimeHot(config, gov, logger) {
     if (s.setCommandPolicy)
         config.commandPolicy = s.commandPolicyNext;
     if (Object.keys(s.infoLine).length > 0)
-        logger?.info("sema_registry_runtime_hot", s.infoLine);
+        logger?.info("web_admin_runtime_hot", s.infoLine);
 }
-const DEFAULT_ROLE_TIER_LADDER = ["pro", "flash", "lite"];
-export function resolveDefaultModelName(eff, has, fallback, onDangling) {
-    const activeTiers = resolveActiveTiers(eff.models) ?? {};
-    const structural = eff.models?.default;
-    const rolesDefault = eff.models?.roles?.default?.model;
-    const candidates = [
-        { source: "models.default", name: typeof structural === "string" && structural.length > 0 ? structural : undefined },
-        { source: "roles.default", name: typeof rolesDefault === "string" && rolesDefault.length > 0 ? rolesDefault : undefined },
-        ...DEFAULT_ROLE_TIER_LADDER.map((t) => ({ source: `tierGroup.${t}`, name: activeTiers[t] })),
-    ];
-    for (const c of candidates) {
-        if (!c.name)
-            continue;
-        if (has(c.name))
-            return { name: c.name, source: c.source };
-        onDangling?.(c.source, c.name);
+function engineDefaultOfSelect(select, models, activeTiers) {
+    const catalog = expandTiers(models, activeTiers) ?? models;
+    let picked;
+    try {
+        picked = coreResolveTaskModel({ modelRole: "default" }, { models: catalog, roles: { default: { select } } }).model;
+    }
+    catch (err) {
+        return { unresolved: err instanceof Error ? err.message : String(err) };
     }
-    return { name: fallback, source: "enabled[0]" };
+    const name = Object.keys(models).find((n) => models[n] === picked);
+    return name !== undefined ? { name } : { unresolved: "the engine picked a model object that is not an entry of the usable catalog" };
 }
 export function logEffectiveDiff(config, eff, logger) {
     const enabled = (eff.models?.models ?? []).filter((m) => m.enabled !== false);
@@ -606,8 +589,8 @@ export function logEffectiveDiff(config, eff, logger) {
     const centerModels = enabled.map((m) => ({ name: m.name, id: m.id, provider: m.provider, apiKeyEnv: m.apiKeyEnv ?? null, tier: m.tier ?? null }));
     const envModels = Object.entries(config.models).map(([name, m]) => ({ name, id: m.id, provider: m.provider }));
     const centerRoles = Object.fromEntries(Object.entries(eff.models?.roles ?? {}).map(([r, t]) => [r, "model" in t ? t.model : { select: t.select }]));
-    logger?.warn("sema_registry_dry_run", {
-        note: "DRY RUN — registry config NOT applied; unset SEMA_REGISTRY_DRY_RUN to go live",
+    logger?.warn("web_admin_dry_run", {
+        note: `DRY RUN — web-admin config NOT applied; unset ${WEB_ADMIN_ENV.dryRun} to go live`,
         version: eff.version,
         wouldOverrideModels: enabled.length > 0,
         wouldDefaultModel: plane.defaultName ?? null,
@@ -619,9 +602,9 @@ export function logEffectiveDiff(config, eff, logger) {
         collab: { centerWouldRegister: Object.keys(projectCollabToWorkflows(eff.collab?.templates).workflows) },
         skills: { centerWouldLoad: (eff.skills?.skills ?? []).filter((s) => s.enabled !== false).map((s) => s.name) },
         mcp: { centerWouldRegister: (eff.mcp?.servers ?? []).filter((s) => s.enabled !== false).map((s) => s.name) },
-        runtime: {
-            center: eff.runtime ?? null,
-            current: Object.fromEntries(RUNTIME_GATE_KEYS.map((k) => [k, config[k]])),
+        limits: {
+            center: eff.limits ?? null,
+            current: Object.fromEntries(BATCH1_LIMIT_KEYS.map((k) => [k, config[k]])),
         },
         governance: {
             center: eff.governance ?? null,

package/dist/{config-center → web-admin-client}/apply-ledger.d.ts

@@ -9,7 +9,7 @@
  * `CONFIG_PROVIDER=local` 下是 registry-core file-store 的内容哈希(u53,上游契约只承诺
  * 「同 files ⇒ 同 number」,从未承诺序)——把它当序数消费,哈希更小的合法新代会被永久
  * 静默忽略且本账双盲(target/applied 都不动)。修后:**推进判断吃收货处铸的进程内单调
- * ordinal**(config-center `generationOf`;等版本重放沿用同 ordinal=幂等语义保留),
+ * ordinal**(web-admin `generationOf`;等版本重放沿用同 ordinal=幂等语义保留),
  * `version` 只做对账身份标——configTargetVersion 语义从「max(见过)」变为「**最后**见过的
  * 源代」(remote 单调腿二者等价;local 腿这才是真相)。
  *
@@ -36,7 +36,7 @@ export type ConfigApplyGroup = (typeof CONFIG_APPLY_GROUPS)[number];
 /**
  * S-810(车QU codex r1 [high] F1,验真后修)—— 一组在**热腿**被整组拒之后,新进程在 **boot 腿**上对同一候选重判会怎样。每组一格的闭集
  * (`satisfies Record<ConfigApplyGroup, …>`:加一组 ⇒ 这里编译红,不许静默落进某一格)。部分应用的拍据此决定能不能发重启信号
- * (`boot/config-center.ts` 的 `signalRestart`):
+ * (`boot/web-admin.ts` 的 `signalRestart`):
  *  · `"refuses-group"` —— boot 腿同一判据、同样整组拒,其余组照落 ⇒ 重启收敛(新进程的 boot 快照就是这份候选,同一差异不再签)。
  *    `limitsHttp`:`stageLimits` 不分腿。
  *  · `"may-refuse-boot"` —— boot 腿的结局取决于那一刻的部署事实,可能整个进程起不来 ⇒ 照信号重启不保证收敛(可能把一台还在服务的

package/dist/{config-center → web-admin-client}/center-request.d.ts

@@ -5,10 +5,10 @@ export declare const CENTER_PULL_TIMEOUT_MS = 8000;
 /** 已装 settings-schema 的 major(机器派生)。版本号不成形 ⇒ 模块装载即抛(装坏了的包不该带着一个猜出来的
  *  major 去跟中心协商 wire 形)。 */
 export declare const SETTINGS_SCHEMA_MAJOR: string;
-/** 一个中心端点 = 基址 + 凭证来源(`ServiceConfig.configCenter` 结构上满足)。 */
+/** 一个中心端点 = 基址 + 凭证来源(`ServiceConfig.webAdmin` 结构上满足)。 */
 export interface CenterEndpoint {
     readonly baseUrl: string;
-    /** 活性组的基址(env `SEMA_REGISTRY_LIVE_URL` 的回声;缺席 ⇒ 活性组也打 {@link baseUrl})。「缺席 = 主基址」这条规则只在 {@link centerFetch} 读。 */
+    /** 活性组的基址(env `SEMA_WEB_ADMIN_LIVE_URL` 的回声;缺席 ⇒ 活性组也打 {@link baseUrl})。「缺席 = 主基址」这条规则只在 {@link centerFetch} 读。 */
     readonly liveBaseUrl?: string | undefined;
     readonly credential: CenterCredentialSource;
 }
@@ -21,11 +21,11 @@ export interface CenterEndpoint {
  * (7.105.0 及以前累加器与用量环都挂在公告地址上,不公告的引擎于是从不报用量,租约的已耗量只剩中心自己的估计)。
  */
 export declare function centerLaneConfigured<C extends {
-    readonly configCenter?: (CenterEndpoint & {
+    readonly webAdmin?: (CenterEndpoint & {
         readonly worker?: string | undefined;
     }) | undefined;
 }>(cfg: C): cfg is C & {
-    readonly configCenter: NonNullable<C["configCenter"]> & {
+    readonly webAdmin: NonNullable<C["webAdmin"]> & {
         readonly worker: string;
     };
 };
@@ -73,8 +73,8 @@ export interface CenterRequestInit {
     readonly fetchImpl?: typeof fetch;
 }
 /**
- * 「后面要拼路径的基址」的拒句 —— 中心基址三席(`SEMA_REGISTRY_URL` / `SEMA_REGISTRY_LIVE_URL` / `SEMA_REGISTRY_WEB_URL`)与本实例的
- * 公告地址(`FLEET_ADVERTISE_ADDRESS`,中心往它后面拼 `/v1/...`)同读。判官是 `url-shape.ts` 那一只(层级式 http(s) URL;Node 的 fetch
+ * 「后面要拼路径的基址」的拒句 —— 中心基址三席(`SEMA_WEB_ADMIN_URL` / `SEMA_WEB_ADMIN_LIVE_URL` / `SEMA_WEB_ADMIN_WEB_URL`)与本实例的
+ * 公告地址(`FLEET_ADVERTISE_ADDRESS`,中心往它后面拼 `/v1/...`)同读。判官是 settings-schema 的 `httpUrlFlaws`(层级式 http(s) URL;Node 的 fetch
  * 认 `file://` / `data:`,配错的地址不许变成读本地文件),本函数只声明这一席禁哪几件({@link PATH_BASE_FORBIDS})。起服时 `config.ts` 判
  * (拒启),请求期 {@link centerFetch} 对同一份基址再判一次(自拼 `ServiceConfig` 的嵌入方也吃同一条规则)。合格 ⇒ `undefined`;否则交回
  * `<subject> <规则词>; got "<展示面安全形>"` —— 拒句里没有从值里解析出来的任何记号(scheme / userinfo / 主机名),捕获点照原样落日志即可。
@@ -93,7 +93,7 @@ export declare function centerTokenRefresh(issuer: string, refreshToken: string,
 }): Promise<Response>;
 /**
  * 对中心发一条请求。返回响应与**这次请求所用凭证的身份**(调用方据此给拿回来的候选打分箱标记,
- * 见 `boot/config-center.ts` 的 LKG / prompt 状态分箱)。
+ * 见 `boot/web-admin.ts` 的 LKG / prompt 状态分箱)。
  */
 export declare function centerFetch(center: CenterEndpoint, route: CenterRoute, init: CenterRequestInit): Promise<{
     res: Response;

package/dist/{config-center → web-admin-client}/center-request.js

@@ -2,7 +2,8 @@ import settingsSchemaPackage from "@sema-agent/settings-schema/package.json" wit
 import { AUTH_V1_PATHS } from "@sema-agent/settings-schema/api/auth";
 import { FLEET_LIVE_PATHS, FLEET_PATHS } from "@sema-agent/settings-schema/fleet";
 import { CenterCredentialUnavailableError } from "../center-credential.js";
-import { buildHttpUrlRefusal, httpUrlFlaws } from "../url-shape.js";
+import { WEB_ADMIN_ENV, httpUrlFlaws } from "@sema-agent/settings-schema";
+import { buildHttpUrlRefusal } from "../url-refusal.js";
 export const SCHEMA_MAJOR_HEADER = "x-sema-schema-major";
 export const CENTER_PULL_TIMEOUT_MS = 8000;
 export const SETTINGS_SCHEMA_MAJOR = (() => {
@@ -13,7 +14,7 @@ export const SETTINGS_SCHEMA_MAJOR = (() => {
     return m[1];
 })();
 export function centerLaneConfigured(cfg) {
-    const cc = cfg.configCenter;
+    const cc = cfg.webAdmin;
     return cc !== undefined && cc.baseUrl !== "" && cc.credential.declared && cc.worker !== undefined && cc.worker !== "";
 }
 export function pullViewQuery(view) {
@@ -83,7 +84,7 @@ export async function centerTokenRefresh(issuer, refreshToken, init) {
     });
 }
 export async function centerFetch(center, route, init) {
-    assertPathBaseUrl(center.baseUrl, "SEMA_REGISTRY_URL");
+    assertPathBaseUrl(center.baseUrl, WEB_ADMIN_ENV.url);
     const cred = center.credential.read();
     if (!cred.ok)
         throw new CenterCredentialUnavailableError(cred.reason);
@@ -97,7 +98,7 @@ export async function centerFetch(center, route, init) {
     const path = routePath(route, cred.kind);
     const liveBase = FLEET_LIVE_PATHS.includes(path) ? center.liveBaseUrl : undefined;
     if (liveBase !== undefined)
-        assertPathBaseUrl(liveBase, "SEMA_REGISTRY_LIVE_URL");
+        assertPathBaseUrl(liveBase, WEB_ADMIN_ENV.liveUrl);
     const url = `${(liveBase ?? center.baseUrl).replace(/\/+$/, "")}${path}`;
     const res = await (init.fetchImpl ?? fetch)(url, {
         method: init.method ?? "GET",

package/dist/{config-center → web-admin-client}/effective-keys.d.ts

@@ -4,7 +4,7 @@
  * 🔴 三条纪律:
  *  1. `EFFECTIVE_CONFIG_KEYS` 与 {@link EffectiveConfig} **类型级**绑定(`satisfies Record<keyof …, true>`):接口加键 /
  *     删键而不动这里 = **编译错**——运行时键表永不与类型面漂移(这不是第二份表,是同一份接口的运行时投影;
- *     runtime / governance 两域的键表同法,用于与 schema zod shape 的集合等式墓碑)。
+ *     governance 域的键表同法,用于与 schema zod shape 的集合等式墓碑;settings-schema 11 退役了 `runtime` 域,它的键表随之删)。
  *  2. 三张登记表(非域白名单 / 不消费表 / 远端专属表)每行**必须带理由**;行的成立性由对账门**双向**钉——登记了
  *     却不成立(死账)与成立了却没登记(半接线)都红,理由失效之日格子自己翻红(墓碑),禁裸豁免。
  *  3. schema 侧的数据(`DOMAINS` / `PORTABLE_DOMAINS` / zod shape)一律由对账门**读 dist**,绝不抄进这里
@@ -15,8 +15,6 @@ import type { EffectiveConfig } from "./types.js";
 export declare const EFFECTIVE_CONFIG_KEYS: ReadonlyArray<keyof EffectiveConfig>;
 /** 信封键(不是域)。 */
 export declare const EFFECTIVE_ENVELOPE_KEYS: readonly ["version", "updatedAt"];
-/** `runtime` 域(限额残余)的键集——对账门与 schema `RuntimeConfig.shape` 钉集合等式([ref] 件3 退役键墓碑)。 */
-export declare const RUNTIME_DOMAIN_KEYS: readonly string[];
 /** `governance` 域(治理三件)的键集——对账门与 schema `GovernanceConfig.shape` 钉集合等式。 */
 export declare const GOVERNANCE_DOMAIN_KEYS: readonly string[];
 /** EffectiveConfig 上**不是** settings-schema 域的顶层键(键 → 成文理由)。⚠️ 墓碑语义:任一键将来出现在 schema

package/dist/{config-center → web-admin-client}/effective-keys.js

@@ -7,7 +7,6 @@ const EFFECTIVE_CONFIG_KEY_TABLE = {
     mcp: true,
     a2a: true,
     scenarios: true,
-    runtime: true,
     limits: true,
     projects: true,
     governance: true,
@@ -17,14 +16,6 @@ const EFFECTIVE_CONFIG_KEY_TABLE = {
 };
 export const EFFECTIVE_CONFIG_KEYS = Object.keys(EFFECTIVE_CONFIG_KEY_TABLE);
 export const EFFECTIVE_ENVELOPE_KEYS = ["version", "updatedAt"];
-const RUNTIME_DOMAIN_KEY_TABLE = {
-    rateLimitPerMin: true,
-    maxTaskCostUsd: true,
-    maxTaskTokens: true,
-    maxPrincipalCostUsd: true,
-    costQuotaWindowSec: true,
-};
-export const RUNTIME_DOMAIN_KEYS = Object.keys(RUNTIME_DOMAIN_KEY_TABLE);
 const GOVERNANCE_DOMAIN_KEY_TABLE = {
     autonomy: true,
     commandPolicy: true,