@sema-agent/server 7.123.0 → 7.124.0

package/dist/http/routes/admin-drain.js

@@ -1,10 +1,11 @@
-import { readDrainRequest } from "@sema-agent/settings-schema/fleet";
+import { DRAIN_ACTION_ID, readDrainRequest } from "@sema-agent/settings-schema/fleet";
 import { sendJson, sendError } from "../send.js";
 import { gatedPrincipal, explicitOperatorOk, sendOperatorPrincipalsRequired, sendPrincipalRefusal } from "../principal-gate.js";
 import * as facts from "../../capability-facts.js";
 import { fleetScopeOf } from "../../config-types.js";
 import { drainIdentityMismatches } from "../../fleet/drain-entry.js";
 import { assertNever } from "../route-ctx.js";
+import { WEB_ADMIN_ENV } from "@sema-agent/settings-schema";
 export const ADMIN_DRAIN_PATH = "/v1/admin/drain";
 const OPERATOR_ONLY_MESSAGE = "drain declaration is operator-only: the caller principal is not in OPERATOR_PRINCIPALS";
 export async function handleAdminDrain(req, res, match, ctx) {
@@ -26,7 +27,7 @@ export async function handleAdminDrain(req, res, match, ctx) {
             }
             const request = readDrainRequest(await ctx.helpers.readJson(req));
             if (request === undefined) {
-                sendError(res, 400, "request.field_invalid", "the drain request must be { actionId, worker, deadlineAt, scope?, expectedGeneration?, instanceId?, term? }: actionId a non-empty idempotency key, worker this engine's worker name, deadlineAt epoch milliseconds, expectedGeneration a canonical decimal string (\"7\") — nothing was changed");
+                sendError(res, 400, "request.field_invalid", `the drain request must be { actionId, worker, deadlineAt, scope?, expectedGeneration?, instanceId?, term? }: actionId an idempotency key in identifier form (${DRAIN_ACTION_ID.source} — it is republished on GET /health, so no spaces or free text), worker this engine's worker name, deadlineAt epoch milliseconds, expectedGeneration a canonical decimal string ("7") — nothing was changed`);
                 return;
             }
             const enter = deps.drainState?.enter;
@@ -34,9 +35,9 @@ export async function handleAdminDrain(req, res, match, ctx) {
                 sendError(res, 501, "capability.drain_state_required", "this deployment has no drain entry wired (embedded in another process?) — there is no drain for this request to enter");
                 return;
             }
-            const mismatched = drainIdentityMismatches(request, { scope: deps.config.fleetScope, worker: deps.config.configCenter?.worker, generation: deps.config.fleetGeneration, instanceId: deps.instanceId });
+            const mismatched = drainIdentityMismatches(request, { scope: deps.config.fleetScope, worker: deps.config.webAdmin?.worker, generation: deps.config.fleetGeneration, instanceId: deps.instanceId });
             if (mismatched.length > 0) {
-                sendError(res, 409, "conflict.fleet_identity", `the drain request names a different instance than this engine (mismatched: ${mismatched.join(", ")}) — nothing was changed; compare with this engine's GET /health (worker comes from SEMA_REGISTRY_WORKER, generation from FLEET_GENERATION, scope from FLEET_SCOPE — unset, and a request without scope, mean "${fleetScopeOf(undefined)}")`);
+                sendError(res, 409, "conflict.fleet_identity", `the drain request names a different instance than this engine (mismatched: ${mismatched.join(", ")}) — nothing was changed; compare with this engine's GET /health (worker comes from ${WEB_ADMIN_ENV.worker}, generation from FLEET_GENERATION, scope from FLEET_SCOPE — unset, and a request without scope, mean "${fleetScopeOf(undefined)}")`);
                 return;
             }
             const answer = enter({ actionId: request.actionId, deadlineAt: request.deadlineAt, deadlineBoundMs: deps.config.fleetLeaseOutageMaxMs });

package/dist/http/routes/approvals-assistant.js

@@ -11,7 +11,7 @@ import { PLAN_APPROVE_PERMISSION_MODES_AFTER, isPlanApprovePermissionModeAfter,
 import { MAX_APPROVAL_NONCE_CHARS } from "../../plugins/approval-nonce-store.js";
 import { redactedPreview, redactSecrets } from "../../trace/redact.js";
 import { redactRiskDescriptor } from "../../observability/run-terminal.js";
-import { fleetRunLabels } from "../../fleet/fleet-bus.js";
+import { buildRunName } from "../../fleet/fleet-bus.js";
 import { sleep } from "../sse-log.js";
 import { bindSseLifecycle } from "../sse-lifecycle.js";
 import { sendJson, sendError, sseHeaders, SSE_MAX_STREAM_MS, SSE_HEARTBEAT_IDLE_MS } from "../send.js";
@@ -384,12 +384,12 @@ export async function handleApprovalsAssistant(req, res, match, ctx) {
                 .map((r) => {
                 const s = byGate.get(r.sessionId);
                 const gate = s ? { kind: s.gateKind, severity: s.severity ?? null, spentMicroUsd: s.spentMicroUsd ?? null, deadline: s.deadline ?? null } : null;
-                const preview = r.objectivePreview?.trim() ? r.objectivePreview : undefined;
-                const label = preview !== undefined ? fleetRunLabels(preview).name : undefined;
+                const preview = r.objectivePreview ?? undefined;
+                const label = preview === undefined ? undefined : buildRunName(preview);
                 return {
                     taskId: r.taskId, sessionId: r.sessionId, status: r.status, needsAttention: !!gate, gate,
                     ...(label !== undefined ? { name: label } : {}),
-                    ...(preview !== undefined && label !== preview ? { description: preview } : {}),
+                    ...(preview !== undefined && preview.trim() !== "" && label !== preview ? { description: preview } : {}),
                     createdAt: r.createdAt, updatedAt: r.updatedAt,
                 };
             })

package/dist/http/routes/capabilities.js

@@ -1,6 +1,6 @@
 import { PERMISSION_MODES, expandTiers, reasoningEffortLevelsOf, routePairingStatus } from "@sema-agent/core";
-import { modelImageInput, isModelAllowlisted, selectableCatalog } from "../../model-select.js";
-import { buildDroppedEntriesWire } from "../../config-center/read-warnings.js";
+import { modelImageInput, isAtMentionable, selectableCatalog } from "../../model-select.js";
+import { buildDroppedEntriesWire } from "../../web-admin-client/read-warnings.js";
 import { modelKeyPoisonOf, resolveModelApiKey } from "../../key-resolver.js";
 import { projectSealedKeyCapability } from "../../sealed-key.js";
 import { cwdHonored, deviceCwdHonored } from "../../task-cwd.js";
@@ -10,7 +10,7 @@ import { autonomyKeepsOpenWriteFace, autonomyModeFloor } from "../../runtime-gov
 import { DEVICE_PROTOCOL_VERSION, DEVICE_WS_PATH } from "../../device-ws-protocol.js";
 import { a2aInjectionHonored } from "../../task-a2a.js";
 import { buildEmptyMcpProbeFace, buildMcpInjectionRefusal, buildMcpProbeCacheKey, buildMcpProbeInflightRefusal, buildMcpProbeRateKey, buildMcpProbeRateRefusal, createMcpProbeLocal, buildMcpProbeDeclarationRefusal, buildMcpProbeIncompleteRefusal, McpProbeIncomplete, MCP_PROBE_HTTP_STATUS, MCP_PROBE_MAX_INFLIGHT, MCP_PROBE_VERDICT_TIMEOUT_MS, createMcpProbeWalk, readMcpProbeBody, } from "../../capabilities/mcp-probe.js";
-import { mcpForScenario } from "../../config-center/facade.js";
+import { mcpForScenario } from "../../web-admin-client/facade.js";
 import { sendJson, sendError } from "../send.js";
 import { assertNever } from "../route-ctx.js";
 import { fileHistoryCaptureOf } from "../../file-history-capture.js";
@@ -237,7 +237,7 @@ export async function handleCapabilities(req, res, match, ctx) {
         }
         case "models": {
             const atCatalog = selectableCatalog(deps.config.models, deps.config.tiers, deps.config.modelRefusals);
-            const atAllowlist = deps.config.atModelAllowlist ?? [];
+            const atMention = deps.config.atMention;
             const models = Object.entries(deps.config.models)
                 .filter(([name]) => name !== "default")
                 .map(([name, m]) => ({
@@ -250,7 +250,7 @@ export async function handleCapabilities(req, res, match, ctx) {
                 ...(m.maxTokens ? { maxOutputTokens: m.maxTokens } : {}),
                 ...((levels) => (levels !== undefined ? { supportedEffortLevels: [...levels] } : {}))(reasoningEffortLevelsOf(m)),
                 ...(m.compat !== undefined ? { compat: m.compat } : {}),
-                ...(atAllowlist.length > 0 ? { atMentionable: isModelAllowlisted(name, atCatalog, atAllowlist, deps.config.modelRefusals) } : {}),
+                ...(atMention.mode !== "all" ? { atMentionable: isAtMentionable(name, atCatalog, atMention, deps.config.modelRefusals) } : {}),
                 routePairing: routePairingOf(deps, name, m),
             }));
             const nonAlias = Object.entries(deps.config.models).filter(([n]) => n !== "default");

package/dist/http/routes/config-catalog.js

@@ -3,7 +3,7 @@ import { sendJson, sendError } from "../send.js";
 import { gatedPrincipal, explicitOperatorOk, sendPrincipalRefusal, sendOperatorPrincipalsRequired } from "../principal-gate.js";
 import { assertNever } from "../route-ctx.js";
 import * as facts from "../../capability-facts.js";
-import { buildRetiredEnvWire, configKnobTable } from "../../config.js";
+import { configKnobTable } from "../../config.js";
 import { buildConfigCatalog } from "../../config-catalog.js";
 export const CONFIG_CATALOG_PATH = "/v1/config/catalog";
 const OPERATOR_ONLY_MESSAGE = "the config catalog is operator-only: the caller principal is not in OPERATOR_PRINCIPALS";
@@ -40,8 +40,7 @@ export async function handleConfigCatalog(req, res, match, ctx) {
                 boot: { ...(deps.memoryConsolidationValve !== undefined ? { memoryConsolidationValve: deps.memoryConsolidationValve } : {}) },
                 knobs: configKnobTable(),
                 centerDomains: DOMAINS,
-                centerManagedKeys: deps.configCenterManagedKeys?.(),
-                retired: buildRetiredEnvWire(),
+                centerManagedKeys: deps.webAdminManagedKeys?.(),
             }));
             return;
         }

package/dist/http/routes/diagnostics.js

@@ -14,7 +14,7 @@ export function buildServerWiringGates(input) {
         backend: input.backend,
         parkFacility: input.checkpointStore !== undefined,
     });
-    const noCenterArm = (knob) => `this knob has no config-center arm on this deployment — it is set by ${knob} on this machine, or derived from the deployment posture`;
+    const noCenterArm = (knob) => `this knob has no web-admin arm on this deployment — it is set by ${knob} on this machine, or derived from the deployment posture`;
     return {
         streamApproval: gate.active ? "active" : gate.reason,
         durableApproval: buildPostureKnobReading(input.durableApproval, {

package/dist/http/routes/runs.js

@@ -18,6 +18,7 @@ import { buildApprovalPreamble, buildApprovalPreambleSseFrames, readClosedWordSe
 import { heldAskOf, liveSettledBy, readDecidedBy, retiredDecisionKeyFacts, DECIDED_BY_NOT_IN_PROOF, DECIDED_BY_OUTSIDE_CLOSED_SET, POLICY_CANNOT_ALLOW_PERSON_ASK } from "../../host-decision.js";
 import { ASK_DECISION_CONSUMER_ABSENT, outcomeOfDecidedRow, resolveStreamApprovalGate } from "../../tool-approval.js";
 import { MAX_DECISION_NOTE_CHARS } from "../../approval-ask-machine.js";
+import { causeOfAskRow } from "../../approval-deny-reasons.js";
 import { normalizeRunEventType, screenedStoredEventData } from "../../trace/project.js";
 import { sendJson, sendError, httpErrorCode, sseHeaders } from "../send.js";
 import { readTurnActivityMs } from "../../turn-activity.js";
@@ -34,6 +35,7 @@ import { RUN_NOT_FOUND_MESSAGE, runNotFoundMessage } from "../route-ctx.js";
 import { withPrincipal } from "../../observability/principal-context.js";
 import { readResumeCtx } from "../resume-ctx-read.js";
 import { storedBodyReplayAnswer, storedBodyReplayLogFields } from "../checkpoint-ctx.js";
+import { serviceVersion } from "../../service-version.js";
 import { storedBodyReplayRefusal } from "../stored-body-replay.js";
 const STEER_PRIORITY_WORDS = INJECTION_TIERS.map((tier) => `'${tier}'`);
 const STEER_PRIORITY_UNION = STEER_PRIORITY_WORDS.join(" | ");
@@ -709,7 +711,7 @@ export async function handleRuns(req, res, match, ctx) {
             }
             if (mintResult.unservable !== undefined) {
                 deps.logger?.warn?.("steer_wake_park_refused_stored_body", { taskId, sessionId: run.sessionId, ...storedBodyReplayLogFields(mintResult.unservable) });
-                const { status, body: { error, errorCode, ...rest } } = storedBodyReplayAnswer(mintResult.unservable);
+                const { status, body: { error, errorCode, ...rest } } = storedBodyReplayAnswer(mintResult.unservable, serviceVersion());
                 sendError(res, status, errorCode, error, rest);
                 return;
             }
@@ -1485,12 +1487,14 @@ export async function handleRunVerbs(req, res, match, ctx) {
                     });
                     return;
                 case "DENIED":
-                case "VOID":
-                    sendError(res, 410, "gone.ask", "this ask reached a terminal state without a human decision (deniedReason says why: a routing failure, a cancellation or batch abort, or the process that held it ended) and can no longer be decided", {
+                case "VOID": {
+                    const rowCause = causeOfAskRow(row);
+                    sendError(res, 410, "gone.ask", "this ask reached a terminal state without a human decision (cause says why: a routing failure, a cancellation or batch withdrawal or abort, or the process that held it ended) and can no longer be decided", {
                         state: row.state,
-                        ...(row.deniedReason !== null ? { deniedReason: row.deniedReason } : {}),
+                        ...(rowCause?.kind === "ending" ? { cause: rowCause.cause } : {}),
                     });
                     return;
+                }
                 case "PARKING":
                     res.setHeader("retry-after", String(ASK_PARKING_RETRY_AFTER_SEC));
                     sendError(res, 425, "parking.ask_retry", "this ask is mid-park — retrying tells you where it finally landed; a retry does NOT queue this decision for acceptance", {

package/dist/http/routes/sessions-list.js

@@ -127,7 +127,8 @@ async function handleSessionList(res, lister, query, forceOwner, includeUnowned
     const nextCursor = hasMore && last ? encodeSessionCursor({ lastActivityAt: last.lastActivityAt, sessionId: last.sessionId }, f) : undefined;
     const sessions = page.map((r) => {
         const tempo = sessionTempoOfRunStatus(r.lastStatus);
-        return tempo === undefined ? r : { ...r, tempo };
+        const row = r.objectivePreview === "" ? { ...r, objectivePreview: null } : r;
+        return tempo === undefined ? row : { ...row, tempo };
     });
     sendJson(res, 200, { sessions, ...(nextCursor ? { nextCursor } : {}) });
 }

package/dist/http/routes/sessions.js

@@ -1,5 +1,5 @@
 import { SessionError, materializeA2aTools, materializeMcpTools, sanitizePathComponent } from "@sema-agent/core";
-import { a2aForScenario, mcpForScenario } from "../../config-center/facade.js";
+import { a2aForScenario, mcpForScenario } from "../../web-admin-client/facade.js";
 import { isUuidV7, isUuidShape, legacyUnownedSessionOk } from "../../security.js";
 import { windowMessages, truncateMessageBlobs, redactSessionViewForRead } from "../../audit.js";
 import { redactSecrets } from "../../trace/redact.js";

package/dist/http/routes/side-query.js

@@ -1,6 +1,6 @@
 import { expandTiers, isThinkingLevel } from "@sema-agent/core";
 import { HttpError } from "../../security.js";
-import { isModelAllowlisted, matchCatalogModel, refusedCatalogEntry, selectableCatalog } from "../../model-select.js";
+import { isAtMentionable, matchCatalogModel, refusedCatalogEntry, selectableCatalog } from "../../model-select.js";
 import { modelUnavailableMessage } from "../../model-entry-refusal.js";
 import { redactSecrets } from "../../trace/redact.js";
 import { admitProviderEcho, redactErrorMessage } from "../../observability/run-terminal.js";
@@ -88,8 +88,8 @@ export async function handleSideQuery(req, res, match, ctx) {
                         sendError(res, 400, "request.model_unavailable", message);
                         return;
                     }
-                    if (!isModelAllowlisted(body.model, catalog, deps.config.atModelAllowlist, deps.config.modelRefusals)) {
-                        sendError(res, 400, "request.model_not_allowed", `model is not in this deployment's @-mention allowlist: "${body.model.slice(0, 120)}" — the allowlist is configured by the operator (config-center models.atModelAllowlist)`);
+                    if (!isAtMentionable(body.model, catalog, deps.config.atMention, deps.config.modelRefusals)) {
+                        sendError(res, 400, "request.model_not_allowed", `model is not @-mentionable on this deployment: "${body.model.slice(0, 120)}" — which models can be @-mentioned is configured by the operator (models.atMention)`);
                         return;
                     }
                 }

package/dist/http/routes/tasks.js

@@ -29,6 +29,7 @@ import { buildSyncSubmitBody } from "../sync-submit-body.js";
 import { assertNever } from "../route-ctx.js";
 import * as facts from "../../capability-facts.js";
 import { buildCheckpointCtx } from "../checkpoint-ctx.js";
+import { serviceVersion } from "../../service-version.js";
 import { withModelReachScope } from "../../model-reach-scope.js";
 import { createInstructionSelectionLeg } from "../../instruction-selection.js";
 const DISCONNECT_PARK_GRACE_MS = 10_000;
@@ -254,7 +255,7 @@ export async function handleTasks(req, res, match, ctx) {
                 let ledgerSink;
                 let ledgerTerminal = false;
                 if (deps.checkpointStore && prepared.spec.sessionId) {
-                    await deps.checkpointStore.putCtx(prepared.spec.sessionId, buildCheckpointCtx({ body: prepared.body, memoryScope: prepared.auth?.memoryScope }));
+                    await deps.checkpointStore.putCtx(prepared.spec.sessionId, buildCheckpointCtx({ body: prepared.body, memoryScope: prepared.auth?.memoryScope, writerVersion: serviceVersion() }));
                 }
                 if (durableTaskId && deps.runStore) {
                     const rs = deps.runStore;
@@ -806,7 +807,7 @@ export async function handleTasks(req, res, match, ctx) {
                 }
                 commitSessionInheritEnv(deps, prepared.spec.sessionId, prepared.body);
                 if (deps.checkpointStore && prepared.spec.sessionId) {
-                    await deps.checkpointStore.putCtx(prepared.spec.sessionId, buildCheckpointCtx({ body: prepared.body, memoryScope: prepared.auth?.memoryScope }));
+                    await deps.checkpointStore.putCtx(prepared.spec.sessionId, buildCheckpointCtx({ body: prepared.body, memoryScope: prepared.auth?.memoryScope, writerVersion: serviceVersion() }));
                 }
                 const syncCancelCtrl = createRunAbort();
                 if (prepared.spec.sessionId)

package/dist/http/run-meta.d.ts

@@ -14,7 +14,7 @@ export declare function runMeta(prepared: {
 }, source: string | null): {
     jobId: string | null;
     source: string | null;
-    objectivePreview: string | null;
+    objectivePreview: string;
 };
 /** Build the cascade config from the operator ladder. Default gate = `status==="completed"` (escalate
  *  on a cheap-rung failure); cost-ceiling from the task's budget bounds the cold-rerun tax. */

package/dist/http/run-meta.js

@@ -1,10 +1,10 @@
-import { redactSecrets } from "../trace/redact.js";
+import { buildRunObjectivePreview } from "../user-authored-text.js";
 export function runMeta(prepared, source) {
     const obj = prepared.spec.objective ?? "";
     return {
         jobId: prepared.jobId ?? null,
         source,
-        objectivePreview: obj ? redactSecrets(obj).slice(0, 120) : null,
+        objectivePreview: buildRunObjectivePreview(obj),
     };
 }
 export function cascadeConfig(ladder, maxCostUsd) {

package/dist/http/server.d.ts

@@ -3,7 +3,7 @@ import type { IncomingMessage } from "node:http";
 import { type Runner, type TaskSpec, type TaskResult, type WorkflowRunStore, type MemoryEntry, type MemoryExportBundle, type MemoryImportReport, type EntryProvenanceAccount, type MemoryErasureAttestation, type MemoryEntryOrigin, type OriginClearanceRow, type SessionMemoryStatus, type ConsolidationRunReceipt, type ConsolidationDriverRunRow, type SideQuerySpec, type SideQueryResult, type Brain, type EngineNotice } from "@sema-agent/core";
 import type { TaskRequestBody } from "./wire-types.js";
 import type { ServiceConfig } from "../config-types.js";
-import { type SessionMirrorRuling } from "../config-center/facade.js";
+import { type SessionMirrorRuling } from "../web-admin-client/facade.js";
 import type { RestartSignal } from "@sema-agent/settings-schema/fleet";
 import { type OwnerAwareSessionStore } from "../security.js";
 import type { RunStore, ImageIndex, ImageBake, CheckpointStoreFull, ResumeAnchorStore, ApprovalExemptionStore, ApprovalNonceStore, ServiceSessionPolicyStore, ServiceFileHistoryStore, ToolResultStoreFull, StoreBackend } from "../plugins/store-backend.js";
@@ -628,7 +628,7 @@ export interface ServiceGovernanceDeps {
     }) => Promise<RequestAuth>;
     /** 鉴权桥(registry-core api/auth-bridge):registry 用户 JWT → principal。缺席=分支不存在
      *  (bearer 只认 SERVICE_AUTH_TOKEN(S),现状不变)。 */
-    registryJwtVerifier?: {
+    webAdminJwtVerifier?: {
         verify: (bearer: string) => Promise<import("../auth-bridge.js").VerifyOutcome>;
     };
     /** Per-principal rate limiter for task/run endpoints. In-memory (single replica) or TiDB-backed
@@ -694,7 +694,7 @@ export interface ServiceDeploymentDeps {
     servingLease?: () => import("../fleet/engine-signal.js").ServingLeaseView;
     /** boot ready 门(b):false = 布防(`CONFIG_REQUIRE_ROSTER=true`)且首次 effective pull 尚未落 roster
      *  (worker 只有占位模型)。就绪原因 `model_roster_pending`(`http/readiness.ts`):计费提交 503 + `/readyz` 503 +
-     *  /health 加性 `ready:false`。absent = 恒 ready(未布防 / 非 registry 部署),现有部署零影响。config-center 的
+     *  /health 加性 `ready:false`。absent = 恒 ready(未布防 / 非 registry 部署),现有部署零影响。web-admin 的
      *  markRosterLanded 在落模型后翻 true(one-way latch)。 */
     modelReady?: () => boolean;
     /** Sema-registry restart signal: the refresh loop sets this when a pull carries restart-to-apply
@@ -709,7 +709,7 @@ export interface ServiceDeploymentDeps {
      *  (configTargetVersion / configAppliedVersion / configApplyStaleMs),`GET /v1/diagnostics/wiring` 取整份
      *  (按组的 appliedVersion / deferredKeys+铸因 / lastRejected 消毒形)。缺席 = 这个进程没有配置管道
      *  (纯 env 部署 / 测试夹具)⇒ 两个面的形状逐字不变(additive)。 */
-    configApplyState?: () => import("../config-center/apply-ledger.js").ConfigApplyLedgerView | undefined;
+    configApplyState?: () => import("../web-admin-client/apply-ledger.js").ConfigApplyLedgerView | undefined;
     /** S-698:中心凭证健康位(`/health.centerCredential`)—— 凭证来源的健康态 + 续签器状态(`center-credential-renewer.ts`
      *  `buildCenterCredentialHealthView` 铸形,只有闭集词 / 时刻 / 计数,不带路径与令牌)。缺席 / 返回 undefined = 健康或没有中心
      *  ⇒ `/health` 形状逐字不变(additive)。 */
@@ -718,7 +718,7 @@ export interface ServiceDeploymentDeps {
      *  (`boot/stage-10-http-server.ts` → `modelRefusals: () => deployment.modelRefusalsState?.()`)—— 一处铸、两出口。缺席 / 返回 undefined =
      *  没有可报的拒或没有配置管道 ⇒ `/health` 形状逐字不变(additive)。 */
     modelRefusalsState?: () => import("@sema-agent/settings-schema").ModelRefusalsSignal | undefined;
-    /** `/health.configHandoff`(只上 `/health`):在场 ⇔ 部署声明了耐久接力 ∧ 应用着的那一代没被确认(config-center 接力账的 `configHandoffState()`;合成律
+    /** `/health.configHandoff`(只上 `/health`):在场 ⇔ 部署声明了耐久接力 ∧ 应用着的那一代没被确认(web-admin 接力账的 `configHandoffState()`;合成律
      *  `fleet/engine-signal.ts` 的 `buildConfigHandoff`)。缺席 / 返回 undefined = 有接力、没有中心或本地腿 ⇒ 键缺席。 */
     configHandoffState?: () => import("../fleet/engine-signal.js").ConfigHandoff | undefined;
     /** [ref] 追加件:`POST /v1/admin/config/refresh` 的实现面 —— 触发**一次既有**的 refresh 拍(在飞则 join)。
@@ -727,7 +727,7 @@ export interface ServiceDeploymentDeps {
     /** DESIGN-278 §5 S2([ref]):center **当前在管**的 ServiceConfig 键集 —— `GET /v1/config/catalog`
      *  判 `effectiveLane`(env 占位/center 在管/默认)的 center 半场。缺席或返回 undefined = 本部署
      *  没有配置管道(纯 env worker / 测试夹具)⇒ 目录把每条 center 腿如实标「不在管」(additive)。 */
-    configCenterManagedKeys?: () => ReadonlySet<string> | undefined;
+    webAdminManagedKeys?: () => ReadonlySet<string> | undefined;
     /** [ref](core 5.50 [ref]):mid-turn MCP 撤销台账读口 —— GET /v1/sessions/:id/mcp 的展示面与
      *  引擎执行面同一权威(被撤服务器的工具不再进面板)。缺席 = 无中心撤销面(pre-338 展示语义)。 */
     mcpRevocations?: {
@@ -783,7 +783,7 @@ export interface ServiceDeploymentDeps {
      *  (它在场景装配里每请求现算),所以本位不会随调用方漂。 */
     webSearchProvider?: import("../plugins/web-search.js").WebSearchProvider;
     /** S-737:本进程模型钥匙保管店的**公钥面** —— `GET /v1/capabilities` 的 `sealedKey` 段唯一席位。值**逐字**取自
-     *  config-center 运行时(`boot/config-center.ts` 的 `sealedKeyPublic`,boot 期建的那一只店),路由里不再建店、不读全局。
+     *  web-admin 运行时(`boot/web-admin.ts` 的 `sealedKeyPublic`,boot 期建的那一只店),路由里不再建店、不读全局。
      *  类型只有最新那把公钥(`sealed-key.ts` `SealedKeyPublicFace`):私钥、保管路径、持有的旧 id 列表从这一层结构上够不着。
      *  缺席 = 本进程没有保管店(boot 建店失败,或不是由 composition root 装起来的测试夹具形)⇒ caps 的 `sealedKey` 键缺席。 */
     sealedKeyPublic?: import("../sealed-key.js").SealedKeyPublicFace;

package/dist/http/server.js

@@ -2,7 +2,7 @@ import http from "node:http";
 import { outwardPlane } from "../terminal.js";
 import { redactHead } from "../observability/run-terminal.js";
 import { validatePendingSteer } from "@sema-agent/core";
-import {} from "../config-center/facade.js";
+import {} from "../web-admin-client/facade.js";
 import { HttpError } from "../security.js";
 import {} from "../memory-sync.js";
 import { evictIfConflict } from "../runs.js";

package/dist/http/stored-body-replay.js

@@ -9,14 +9,15 @@ export function permissionModeReadingUnstated(ctx, floor) {
     return entryPermissionMode(stored, floor).effective === stored ? undefined : { stored, floor };
 }
 export function storedBodyReplayRefusal(ctx, autonomy) {
+    const writer = ctx.writerVersion !== undefined ? { writerVersion: ctx.writerVersion } : {};
     if (allowListReadingUnstated(ctx))
-        return { kind: "allow_list_reading", era: allowListReadingEraOf(ctx) };
+        return { kind: "allow_list_reading", era: allowListReadingEraOf(ctx), ...writer };
     const entry = skillDenyInertEntryOf(ctx.body);
     if (entry !== undefined)
         return { kind: "skill_deny_inert", entry };
     const mode = permissionModeReadingUnstated(ctx, autonomyModeFloor(autonomy));
     if (mode !== undefined)
-        return { kind: "permission_mode_reading", ...mode };
+        return { kind: "permission_mode_reading", ...mode, ...writer };
     return undefined;
 }
 //# sourceMappingURL=stored-body-replay.js.map

package/dist/index.d.ts

@@ -27,7 +27,6 @@ export { createHttpServer, type ServiceDeps, type RequestAuth, type FlatServiceD
 export { createSideQueryLane, createPerModelKeyBrain, type KeyResolver, type SideQueryLane, type SideQueryLaneCtx } from "./boot/side-query-lane.js";
 export { createKeyResolver, resolveModelApiKey, type ModelKeyRef } from "./key-resolver.js";
 export { isModelKeyPoison, ModelKeyPoisonedError, type ModelKeyPoison, type ModelKeyPoisonReason } from "./key-resolver.js";
-export { RETIRED_ENVS, type RetiredEnv, type RetiredEnvKind, type RetiredEnvWire } from "./config.js";
 export { CATALOG_ENTRY_HEADER_LANES, CATALOG_ENTRY_HEADER_NAMES, type CatalogEntryHeaderName } from "./model-entry-headers.js";
 export { judgeModelRouteGap, type ModelRouteGapReading, type ModelRouteGapOptions } from "./model-route-gap.js";
 export type { ModelRouteGap } from "./model-route-endpoint.js";

package/dist/index.js

@@ -24,7 +24,6 @@ export { createHttpServer, } from "./http/server.js";
 export { createSideQueryLane, createPerModelKeyBrain } from "./boot/side-query-lane.js";
 export { createKeyResolver, resolveModelApiKey } from "./key-resolver.js";
 export { isModelKeyPoison, ModelKeyPoisonedError } from "./key-resolver.js";
-export { RETIRED_ENVS } from "./config.js";
 export { CATALOG_ENTRY_HEADER_LANES, CATALOG_ENTRY_HEADER_NAMES } from "./model-entry-headers.js";
 export { judgeModelRouteGap } from "./model-route-gap.js";
 //# sourceMappingURL=index.js.map

package/dist/key-resolver.d.ts

@@ -56,7 +56,7 @@ export declare class ModelKeyPoisonedError extends Error {
 }
 /**
  * Build a per-model API-key resolver for `TaskSpec.getApiKeyAndHeaders` from the catalog's
- * name → env-var-NAME map (sema-registry `apiKeyEnv`). core threads this per brain call — and per cascade
+ * name → env-var-NAME map (web-admin `apiKeyEnv`). core threads this per brain call — and per cascade
  * rung — so each model/rung authenticates with its OWN upstream account/key.
  *
  * A model absent from BOTH maps returns `undefined`, so core falls back to the brain's construction-time

package/dist/leader/wire.d.ts

@@ -69,7 +69,7 @@ export interface LeaderWireConfig {
      * 得出这条 run 的入口体(`LeaderDeps.entry`);本 run 铸的每一条 spec 与 worker 的续跑体都从它取词。入口词是 `plan` 的 run 进不了这条车道
      * (`leaderEntryRefusal`:worker 会话没有计划审阅通道)⇒ 出生处即以拒句收场;HTTP 受理口用同一只判据先答 422。
      *
-     * 🔴 **函数席**(与 `deploymentPosture` / `durable` 同一条先例):`config.autonomy` 被 config-center 原地热改,boot 期取一次值会把这条腿钉在起服那一刻。
+     * 🔴 **函数席**(与 `deploymentPosture` / `durable` 同一条先例):`config.autonomy` 被 web-admin 原地热改,boot 期取一次值会把这条腿钉在起服那一刻。
      * **必填**:没有 AUTONOMY 的装配递 `() => undefined` —— 缺席不是「没有地板」的合法拼法(权限轴上不许静默放宽)。
      */
     autonomy: () => Autonomy | undefined;
@@ -101,7 +101,7 @@ export interface LeaderWireConfig {
     usageWindowStore?: RunnerDeps["usageWindowStore"];
     /**
      * [ref]([ref])—— **center 发布的 prompt catalog** 席,原样递给本车道的每一只 Runner。唯一属主 =
-     * `boot/config-center.ts` 的 `configCenter.promptSource`(主 runner / subRunner 同一只;run-local 有自己
+     * `boot/web-admin.ts` 的 `webAdmin.promptSource`(主 runner / subRunner 同一只;run-local 有自己
      * 的等价腿)。缺席 ⇒ leader 的 planner/worker/repair/conflict 四类**顶层**任务跑引擎内置提示词,而同一
      * 部署的 `/v1/tasks`、`/v1/runs` 跑运维发布的那一份 —— 且 core 顶层新任务走的是**静默**臂(pinned /
      * parentCenterArtifactDigest 两支才 `prompt.snapshot_unavailable` fail-loud),运维面零信号。

package/dist/leader/wire.js

@@ -7,6 +7,7 @@ import { tmpdir } from "node:os";
 import { Runner, combinePolicies, createDurableQuestionPolicy, QUESTION_AWAITS_RESUME, delimitUntrusted, hasDestroy, } from "@sema-agent/core";
 import { leaderEntryRefusal, leaderRunEntry } from "./run-entry.js";
 import { buildCheckpointCtx } from "../http/checkpoint-ctx.js";
+import { serviceVersion } from "../service-version.js";
 import { RemoteContainerExecutionEnv } from "../plugins/remote-env-e2b.js";
 import { E2B_SANDBOX_HOME } from "../execution-lane-caps.js";
 import { createDurableAskPolicy } from "../approval.js";
@@ -272,7 +273,7 @@ export function createLeaderRunner(cfg) {
         const provisionWorker = async (sub) => {
             const sessionId = `leader-${sub.workerId}-${Date.now()}`;
             const durable = cfg.durable?.();
-            const resumeCtx = buildCheckpointCtx({ body: { ...entry, objective: sub.spec.objective }, unattendedLeg: true });
+            const resumeCtx = buildCheckpointCtx({ body: { ...entry, objective: sub.spec.objective }, unattendedLeg: true, writerVersion: serviceVersion() });
             let durableSpec = {};
             if (durable) {
                 const d = durable;

package/dist/main.js

@@ -1,6 +1,6 @@
 import { fatalExit } from "./boot/fatal-exit.js";
 import { runStage01 } from "./boot/stage-01-config.js";
-import { runStage02 } from "./boot/stage-02-registry-pull.js";
+import { runStage02 } from "./boot/stage-02-web-admin-pull.js";
 import { runStage03 } from "./boot/stage-03-store-backend.js";
 import { runStage04 } from "./boot/stage-04-stores.js";
 import { runStage05 } from "./boot/stage-05-execution-env.js";

package/dist/mcp-tool-faces.d.ts

@@ -1,7 +1,7 @@
 /**
  * `McpServerSpec.toolFaces` —— MCP 工具的**面覆盖层**(core 7.8.0 [ref] §1.1/§2.7;声明面
  * settings-schema 1.9.0)。一条规则、三条腿共用(请求腿 `task-mcp.ts normalizeServer` / center 腿
- * `config-center/skills-mcp.ts resolveMcpServers` / 本地 config.d 腿 `config-provider.ts` 只做承载),
+ * `web-admin-client/skills-mcp.ts resolveMcpServers` / 本地 config.d 腿 `config-provider.ts` 只做承载),
  * 与 {@link import("./mcp-source-label.js").readMcpSourceLabel} 同一个「判据单点、三腿一致」的形。
  *
  * ## 分工(为什么本层**不**复述 core 的那张表)
@@ -35,7 +35,7 @@
  *     该条、兄弟 server 照挂)。代价是真的(少一套工具),但它**响亮且立刻**;反方向的代价是一条
  *     **静默失效的安全声明**,而后者按 [ref] 不许存在于安全轴上;
  *  ③ 拿什么补偿 —— 报出来的名字本身:请求腿 `mcp_injection_dropped{dropped:[name]}`、center 腿
- *     `sema_registry_mcp_tool_faces_invalid{server,problem,note}` 一条点名 warn(`problem` 里带工具名与哪一段不合;运维照着改那一行即可)。
+ *     `web_admin_mcp_tool_faces_invalid{server,problem,note}` 一条点名 warn(`problem` 里带工具名与哪一段不合;运维照着改那一行即可)。
  * 每只工具的面是**整只**判(core 明写 "applied whole or not at all");而**任一只**判不出形 ⇒ 整条 server
  * 不进 —— 「留下好的那几只」同样是让坏的那一只无面挂载,与整张丢没有区别。
  */

package/dist/model-entry-refusal.d.ts

@@ -1,5 +1,5 @@
 import { type ModelEntryRefusalCode, type ModelPlaneRefusalCode, type ModelRefusalsSignal } from "@sema-agent/settings-schema";
-import { type DroppedCatalogEntry } from "./config-center/read-warnings.js";
+import { type DroppedCatalogEntry } from "./web-admin-client/read-warnings.js";
 /**
  * 条目拒因码 → 本仓铸它的成因 —— **以码为键**(S-768):码闭集的属主是 settings-schema(`MODEL_ENTRY_REFUSAL_CODES`,6.2.0 起;此前本仓
  * 自持一份同名码表,撞名已消灭、零别名)。那边加一个条目码 ⇒ 本表缺键 ⇒ 本仓 tsc 红(只拿 `satisfies` 约束码值证明的是「子集」,
@@ -109,10 +109,10 @@ export declare function buildModelRefusalsSignal(v: ModelRefusalVerdict | undefi
  * 不各写一份 `isReportableRefusalName` 判断。
  */
 export declare function refusedNameLogField(key: string, name: string): Record<string, unknown>;
-/** 一串被拒条目名的日志字段(`sema_registry_models` 行的 `unavailable`):只列可披露的名,被扣下的名**只数个数**(`<key>NamesWithheld`,0 个时键缺席)。 */
+/** 一串被拒条目名的日志字段(`web_admin_models` 行的 `unavailable`):只列可披露的名,被扣下的名**只数个数**(`<key>NamesWithheld`,0 个时键缺席)。 */
 export declare function refusedNamesLogFields(key: string, names: readonly string[]): Record<string, unknown>;
 /** 成因 → 它那一条 warn 的事件名(**穷举**)。两个名字是票面点名的既有/新事件,运维的告警规则按名挂。 */
-export declare function refusalEventOf(reason: ModelEntryRefusalReason): "sema_registry_model_no_brain" | "sema_registry_model_entry_invalid";
+export declare function refusalEventOf(reason: ModelEntryRefusalReason): "web_admin_model_no_brain" | "web_admin_model_entry_invalid";
 /** warn 字段(不含值):`field` = 第一处坏字段(告警规则最常按它分组),`fields` = 全部。S-805:`model` 只在名可披露时写。 */
 export declare function refusalWarnFields(name: string, r: ModelEntryRefusal): Record<string, unknown>;
 /**

package/dist/model-entry-refusal.js

@@ -2,7 +2,7 @@ import { CC_MODEL_TIER_ALIASES, DEFAULT_TIER_ORDER, expandTiers } from "@sema-ag
 import { ModelEntry, formatConfigPath, isReportableRefusalName } from "@sema-agent/settings-schema";
 import { catalogBrainLane } from "./model-provider.js";
 import { readCatalogEntryHeaders } from "./model-entry-headers.js";
-import { DroppedCatalogEntryRow, describeSchemaIssueFields, describeSchemaIssues } from "./config-center/read-warnings.js";
+import { DroppedCatalogEntryRow, describeSchemaIssueFields, describeSchemaIssues } from "./web-admin-client/read-warnings.js";
 import { DEFAULT_MODEL_REF } from "./model-select.js";
 export const ENTRY_REFUSAL_REASON_OF = {
     "config.model_no_brain": "no_brain",
@@ -118,9 +118,9 @@ function nameSlot(name) {
 export function refusalEventOf(reason) {
     switch (reason) {
         case "no_brain":
-            return "sema_registry_model_no_brain";
+            return "web_admin_model_no_brain";
         case "entry_invalid":
-            return "sema_registry_model_entry_invalid";
+            return "web_admin_model_entry_invalid";
     }
 }
 export function refusalWarnFields(name, r) {
@@ -146,7 +146,7 @@ export function defaultModelRefusal(view, leg) {
             return (`MODEL_ID is required when no catalog default resolves [${DEFAULT_MODEL_MISSING_CODE}] — this model table has no default model` +
                 unavailable +
                 ". Set MODEL_ID=<model name your gateway serves>, or enable at least one model this host can serve in the catalog " +
-                "(config.d/models.json, or the config center) — either one is enough (a config center that answers after the boot budget " +
+                "(config.d/models.json, or the web-admin) — either one is enough (a web-admin that answers after the boot budget " +
                 "counts as absent at boot: raise CONFIG_BOOT_FETCH_BUDGET_MS to wait for it).");
         case "catalog":
             return (`this catalog candidate has no default model [${DEFAULT_MODEL_MISSING_CODE}]` +

package/dist/model-provider.d.ts

@@ -60,7 +60,7 @@ export declare function modelBrainLane(provider: ModelProvider): ModelBrainLane;
  *
  * 🔴 为什么它与 {@link modelBrainLane} 不是同一只函数:两者的**输入保证不同**。
  *  · `MODEL_PROVIDER` 走 boot 闸(域外拒启)⇒ 到达 {@link modelBrainLane} 的恒是闭集词;
- *  · **目录条目**来自 settings-schema 的 `z.string()`,可以从 config-center **热应用**进来 —— 那条路上
+ *  · **目录条目**来自 settings-schema 的 `z.string()`,可以从 web-admin **热应用**进来 —— 那条路上
  *    没有、也不该有「拒启」这回事(一次热发布不能让在跑的副本死),所以这里必然存在一条「认不出」的臂。
  *
  * 🔴 那条臂**就是今天的语义,本批一个字节都没改**([ref]「不可避免的运行期 miss 臂必须说出来」):
@@ -82,7 +82,7 @@ export declare function catalogBrainLane(provider: string | undefined): ModelBra
  * `createBrain` 只在 anthropic 路由**装上**(`ANTHROPIC_API_KEY` / `ANTHROPIC_AUTH_TOKEN` 在场 ⇒
  * `config.anthropic` 在场)时才铸 `createRoutingBrain({anthropic}, {fallback: gatewayStack})`;没装时整台机器
  * 只有网关栈这一只 brain,**一切**条目(包括 `provider:"anthropic"` 的)都落 openai 兼容腿 ——
- * `apply-effective.ts` 那条 `sema_registry_model_no_brain` warn 说的「mis-routes to the gateway brain」即此。
+ * `apply-effective.ts` 那条 `web_admin_model_no_brain` warn 说的「mis-routes to the gateway brain」即此。
  *
  * 所以「这条路由要不要一个 openai 端点」的判据必须同时看词与装配:词判 {@link catalogBrainLane},
  * 装配判路由在不在。本函数是这一合取的**唯一**写法 —— 端点判官(`model-route-endpoint.ts`)、降级腿与

package/dist/model-route-endpoint.d.ts

@@ -18,7 +18,7 @@
  *  · boot:`config.ts` 九域解析之后的跨域不变量区(锚 `CROSS-INVARIANT:model-route-endpoint`)⇒ 拒启;经 `model-route-gap.ts`
  *    的 {@link judgeModelRouteGap}(env 读成本文件判据要的切面,与包根导出的纯判官是**同一只**);严格名册
  *    布防(`isRosterGateArmed`)时 env 腿是占位、从不被派发 ⇒ 不判它(备用网关那一条照判);
- *  · 热路径:`config-center/apply-effective.ts` 的模型面 stage ⇒ 模型面组拒(opus 腿 O3:同候选其余组照落)、上一代模型面继续服务;
+ *  · 热路径:`web-admin-client/apply-effective.ts` 的模型面 stage ⇒ 模型面组拒(opus 腿 O3:同候选其余组照落)、上一代模型面继续服务;
  *  · run-local:配置源解析完之后按真要派发的表再判一次(`run-local.ts`,7.98.0 合并复审 F2)—— 本入口没有名册门,
  *    loadConfig 对严格名册布防的占位豁免在这里兑现不了;没布防时恒惰性;
  *  · 登记:`config-invariants.ts` 的 `model-route-endpoint` 条(表的「不许有表外不变量」职责);

package/dist/model-route-url.d.ts

@@ -12,7 +12,7 @@ export declare const MODEL_ROUTE_URL_INVALID_CODE = "config.model_route_url_inva
  */
 export declare const MODEL_ROUTE_URL_FRAGMENT_CODE = "config.model_route_url_fragment";
 /**
- * 模型路由 base URL 的拒因(`undefined` = 这一位合法)—— 判由 `url-shape.ts` 那一只,本函数按**首个**拒因选码与出路句:
+ * 模型路由 base URL 的拒因(`undefined` = 这一位合法)—— 判由 settings-schema 的 `httpUrlFlaws`,本函数按**首个**拒因选码与出路句:
  *  ① 不是层级式 http(s) URL ⇒ `config.model_route_url_invalid`;
  *  ② 带 userinfo ⇒ `config.gateway_url_userinfo`;
  *  ③ 带 `#fragment` ⇒ `config.model_route_url_fragment`。

package/dist/model-route-url.js

@@ -1,4 +1,5 @@
-import { buildHttpUrlRefusal, httpUrlFlaws } from "./url-shape.js";
+import { httpUrlFlaws } from "@sema-agent/settings-schema";
+import { buildHttpUrlRefusal } from "./url-refusal.js";
 export const GATEWAY_URL_USERINFO_CODE = "config.gateway_url_userinfo";
 export const MODEL_ROUTE_URL_INVALID_CODE = "config.model_route_url_invalid";
 export const MODEL_ROUTE_URL_FRAGMENT_CODE = "config.model_route_url_fragment";