@sema-agent/server 7.123.0 → 7.124.0

package/dist/config-provider.d.ts

@@ -1,10 +1,10 @@
-import { type DroppedConfigEntry } from "./config-center/read-warnings.js";
+import { type DroppedConfigEntry } from "./web-admin-client/read-warnings.js";
 import { FileConfigStore } from "@sema-agent/settings-schema/node";
 import { type EffectiveConfig as AgentConfigEffective, type EffectiveReadWarning } from "@sema-agent/settings-schema";
-import { fetchEffective as remoteFetchEffective, fetchSkillContent as remoteFetchSkillContent, type EffectiveConfig } from "./config-center/facade.js";
-import type { CenterEndpoint } from "./config-center/center-request.js";
+import { fetchEffective as remoteFetchEffective, fetchSkillContent as remoteFetchSkillContent, type EffectiveConfig } from "./web-admin-client/facade.js";
+import type { CenterEndpoint } from "./web-admin-client/center-request.js";
 import type { ConfigProviderWord } from "./config-types.js";
-/** Result of a `fetchEffective` — EXACTLY the config-center's return: the effective config + its etag, or
+/** Result of a `fetchEffective` — EXACTLY the web-admin's return: the effective config + its etag, or
  *  `null` for "unchanged" (remote 304; local: the version matched the caller's prior etag).
  *  `domainErrors`([ref] registry-core 0.10.12 tolerant seam,local lane only):catalog 域坏文件不再
  *  连坐全包回落 env——坏域按该域 schema default 落+错误单列,好域照常生效;caller(main.ts)对每条打
@@ -13,10 +13,8 @@ import type { ConfigProviderWord } from "./config-types.js";
 /** 壳写在 `config.d/models.json` 条目上的装饰键(`sema*`)自 settings-schema 1.5.0 起是**声明过的扩展命名空间**
  *  (`EXTENSION_NAMESPACES`):schema 照旧 strip、但不再报「未知键」,所以本函数收到的每一个未知键都是拼错/越界 ⇒ 候选门错误。
  *  此前把这类键当「通知」放行的整套下游机制(域豁免/键路径闭集/满额特判/单独的通知面)已全部撤回——意图在声明处说,消费方不猜。 */
-/** `readWarnings`:契约 `onWarning` 流的**原值**(未折叠),两条读腿同键同义。折叠是有损的——
- *  `hosts-grandfathered` / `legacy-governance-lifted` 按律折成 `null`,只看 `domainErrors` 的人永远看不见
- *  兼容臂还开着,而契约铸出 `legacy-governance-lifted` 的理由正是「关窗的前提是有人知道它还开着」
- *  (`legacyGovernanceFromRuntime` SUNSET 注)。恒在场(空数组 = 这次读零告警),不用缺席表达「没有」
+/** `readWarnings`:契约 `onWarning` 流的**原值**(未折叠),两条读腿同键同义 —— 读者是一致性门的读腿适配器(它要逐条对契约语料的
+ *  告警多重集,折叠后的诊断面带不回 `kind` / 坐标段)。恒在场(空数组 = 这次读零告警),不用缺席表达「没有」
  *  ——缺席/空两形并存就是又一处二义。
  *  🔐 原流的 `error` 未经 {@link redactConfigError}(那道脱敏挂在真正进日志流的 `domainErrors` 产出边界上),
  *  路由进日志/审计流的消费者必须自己先脱敏。 */
@@ -52,6 +50,12 @@ export type FetchEffectiveResult = {
  * 不回声值(上游 settings-schema)。
  */
 export declare function redactConfigError(text: string): string;
+/**
+ * 一个配置值的单向短指纹(`#` + 8 位十六进制;HMAC 的钥匙每进程一把 —— 只在同一条日志流里可对照,不是一份可查字典的摘要)。
+ * 句子由契约从**结构化操作数**铸的地方(settings-schema 11 的 `renderRefIssue(issue, show)`)把它当 `show` 传进去:值逐个换成指纹,
+ * 句子的固定词与坐标原样 —— 不需要 {@link redactConfigError} 那种从引号猜值边界的读法。
+ */
+export declare function fingerprintConfigOperand(operand: string): string;
 /** Sentinel returned by {@link raceBootFetch} when the boot pull outlived its budget — the caller
  *  starts serving on the env fallback and the SAME promise settles in the background (never cancelled). */
 export declare const BOOT_FETCH_DEFERRED: unique symbol;
@@ -71,7 +75,7 @@ export declare function raceBootFetch<T>(fetch: Promise<T>, budgetMs: number): P
  * et al. (main.ts does not swap on this seam yet — see the NOT-YET-WIRED note at the top of this module).
  */
 export interface ConfigProvider {
-    /** "remote" = config-center HTTP; "local" = on-disk FileConfigStore. */
+    /** "remote" = web-admin HTTP; "local" = on-disk FileConfigStore. */
     readonly kind: "remote" | "local";
     /**
      * Pull the effective config. `etag` is the caller's last-seen version token (`if-none-match` on remote;
@@ -90,10 +94,10 @@ export interface ConfigProvider {
 /** The config-provider knobs read off ServiceConfig (a structural subset — avoids importing the whole
  *  ServiceConfig type and keeps this module testable with a plain object). */
 export interface ConfigProviderInput {
-    /** Set when SEMA_REGISTRY_URL (legacy CONFIG_CENTER_URL now boot-rejects, no dual-read) is configured (config.ts `configCenter`). `dryRun` is carried through so a
+    /** Set when SEMA_WEB_ADMIN_URL is configured (config.ts `webAdmin`). `dryRun` is carried through so a
      *  remote↔local swap via this seam does NOT drop the dry-run posture main.ts branches on (config.ts
-     *  `configCenter.dryRun`); the provider itself does not consume it (the caller still branches on it). */
-    configCenter?: CenterEndpoint & {
+     *  `webAdmin.dryRun`); the provider itself does not consume it (the caller still branches on it). */
+    webAdmin?: CenterEndpoint & {
         worker?: string;
         dryRun?: boolean;
     };
@@ -108,10 +112,10 @@ export interface ConfigProviderInput {
     localDir: string;
 }
 /**
- * RemoteConfigProvider — DELEGATES to the exported config-center HTTP functions. No HTTP is reimplemented;
+ * RemoteConfigProvider — DELEGATES to the exported web-admin HTTP functions. No HTTP is reimplemented;
  * the center endpoint (baseUrl + credential SOURCE — S-651: read per request, never a bound token) and worker
  * are passed through. The two delegate fns are injectable (defaulting
- * to the real config-center exports) so a unit test can assert delegation without module-mocking.
+ * to the real web-admin exports) so a unit test can assert delegation without module-mocking.
  */
 export declare class RemoteConfigProvider implements ConfigProvider {
     private readonly cc;
@@ -156,7 +160,7 @@ export declare class LocalConfigProvider implements ConfigProvider {
 export declare function mapToServiceEffective(eff: AgentConfigEffective, version: number): EffectiveConfig;
 /**
  * Pick the backend off a CLOSED `provider` enum (`local` | `remote` | undefined): LOCAL when
- * `CONFIG_PROVIDER=local`, OR when no config-center URL is configured (a lone box with config.d/ on disk
+ * `CONFIG_PROVIDER=local`, OR when no web-admin URL is configured (a lone box with config.d/ on disk
  * and no control plane). REMOTE otherwise (a configured center URL, the default fleet posture). A
  * `CONFIG_PROVIDER=remote` with no URL is a misconfiguration — we fall through to local rather than
  * constructing a remote provider with no endpoint (the caller would have skipped the remote pull entirely
@@ -168,7 +172,7 @@ export declare function mapToServiceEffective(eff: AgentConfigEffective, version
 export declare function createConfigProvider(input: ConfigProviderInput): ConfigProvider;
 /**
  * S-841 —— **本地配置根的唯一来源**:`CONFIG_LOCAL_DIR` → `AGENT_DATA_DIR` → `~/.ai-agent`。两个入口(HTTP 服务的第 1 段、
- * run-local)各调一次,算出来的那一个值同时交给 config-center 工厂(`createConfigProvider` 的 `localDir`)与执行车道合成步
+ * run-local)各调一次,算出来的那一个值同时交给 web-admin 工厂(`createConfigProvider` 的 `localDir`)与执行车道合成步
  * (`composeExecutionLane` 的 `localRoot`)—— 修前两个入口各写一份这条链(run-local 还多一个与之等价的三元),工厂又在
  * 字面 `"local"` 之外回落 `process.cwd()`。
  *
@@ -185,14 +189,14 @@ export declare function configLocalRoot(config: {
  */
 export declare function configProviderKind(input: {
     readonly provider?: ConfigProviderWord | undefined;
-    readonly configCenter?: unknown;
+    readonly webAdmin?: unknown;
 }): "local" | "remote";
 /**
- * HTTP 服务这一侧的配置源:config-center 工厂**建不建** provider(`CONFIG_PROVIDER=local` 或配了中心才建)、建出来是哪一种。
+ * HTTP 服务这一侧的配置源:web-admin 工厂**建不建** provider(`CONFIG_PROVIDER=local` 或配了中心才建)、建出来是哪一种。
  * `undefined` = 纯 env 部署(没有配置源)。工厂与执行车道合成步读这同一只(车PI 修复轮 ①:合成步排在工厂之前)。
  */
 export declare function serviceConfigSourceKind(config: {
     readonly configProvider?: ConfigProviderWord | undefined;
-    readonly configCenter?: unknown;
+    readonly webAdmin?: unknown;
 }): "local" | "remote" | undefined;
 //# sourceMappingURL=config-provider.d.ts.map

package/dist/config-provider.js

@@ -1,10 +1,10 @@
 import { readMcpSourceLabel } from "./mcp-source-label.js";
 import { createHmac, randomBytes } from "node:crypto";
-import { splitFoldedReadWarnings, withDroppedCatalogEntries } from "./config-center/read-warnings.js";
+import { splitFoldedReadWarnings, withDroppedCatalogEntries } from "./web-admin-client/read-warnings.js";
 import { FileConfigStore } from "@sema-agent/settings-schema/node";
-import { findSkillContent, skillContentHash, refIntegrityIssues, createSiblingResolver, formatConfigPath, REF_CHECKED_DOMAINS, } from "@sema-agent/settings-schema";
+import { danglingRefs, findSkillContent, renderRefIssue, skillContentHash, } from "@sema-agent/settings-schema";
 import { redactSecrets } from "./trace/redact.js";
-import { fetchEffective as remoteFetchEffective, fetchSkillContent as remoteFetchSkillContent, ConfigCenterHttpError, } from "./config-center/facade.js";
+import { fetchEffective as remoteFetchEffective, fetchSkillContent as remoteFetchSkillContent, WebAdminHttpError, } from "./web-admin-client/facade.js";
 import { homedir } from "node:os";
 import { join } from "node:path";
 const OPERAND_FINGERPRINT_KEY = randomBytes(16);
@@ -14,12 +14,16 @@ export function redactConfigError(text) {
     if (first === -1)
         return s;
     const count = (q) => s.split(q).length - 1;
-    const fingerprint = (operand) => `"#${createHmac("sha256", OPERAND_FINGERPRINT_KEY).update(operand).digest("hex").slice(0, 8)}"`;
+    const fingerprint = (operand) => `"${fingerprintConfigOperand(operand)}"`;
     if (count('"') % 2 === 1 || count("'") % 2 === 1)
         return `${s.slice(0, first)}${fingerprint(s.slice(first + 1))}`;
     const last = Math.max(s.lastIndexOf('"'), s.lastIndexOf("'"));
     return `${s.slice(0, first)}${fingerprint(s.slice(first + 1, last))}${s.slice(last + 1)}`;
 }
+export function fingerprintConfigOperand(operand) {
+    return `#${createHmac("sha256", OPERAND_FINGERPRINT_KEY).update(operand).digest("hex").slice(0, 8)}`;
+}
+const redactDroppedEntry = (d) => ({ ...d, error: redactSecrets(d.error) });
 export const BOOT_FETCH_DEFERRED = Symbol("boot-fetch-deferred");
 export function raceBootFetch(fetch, budgetMs) {
     if (budgetMs <= 0)
@@ -47,7 +51,7 @@ export class RemoteConfigProvider {
         return {
             ...r,
             ...(r.domainErrors !== undefined ? { domainErrors: r.domainErrors.map((de) => ({ domain: de.domain, error: redactConfigError(de.error) })) } : {}),
-            ...(r.droppedEntries !== undefined ? { droppedEntries: r.droppedEntries.map((d) => ({ ...d, error: redactConfigError(d.error) })) } : {}),
+            ...(r.droppedEntries !== undefined ? { droppedEntries: r.droppedEntries.map(redactDroppedEntry) } : {}),
         };
     }
     async fetchSkillContent(contentHash) {
@@ -56,7 +60,7 @@ export class RemoteConfigProvider {
             return await fn(this.cc, contentHash);
         }
         catch (err) {
-            if (err instanceof ConfigCenterHttpError && err.status === 404)
+            if (err instanceof WebAdminHttpError && err.status === 404)
                 return undefined;
             throw err;
         }
@@ -85,15 +89,17 @@ export class LocalConfigProvider {
         if (etag !== undefined && etag === tag)
             return null;
         const refErrors = [];
-        const resolve = createSiblingResolver(store, eff);
-        for (const d of REF_CHECKED_DOMAINS) {
-            const issues = await refIntegrityIssues(d, eff[d], resolve);
-            if (issues.length > 0)
-                refErrors.push({ domain: d, error: issues.map((i) => `${formatConfigPath(i.path)}: ${redactConfigError(i.message)}`).join("; ") });
+        const byReferrer = new Map();
+        for (const issue of danglingRefs(eff)) {
+            const rows = byReferrer.get(issue.referrer.domain) ?? [];
+            rows.push(renderRefIssue(issue, fingerprintConfigOperand));
+            byReferrer.set(issue.referrer.domain, rows);
         }
+        for (const [domain, rows] of byReferrer)
+            refErrors.push({ domain, error: rows.join("; ") });
         const folded = splitFoldedReadWarnings(readWarnings);
         const parseErrors = folded.domainErrors.map((w) => ({ domain: w.domain, error: redactConfigError(w.error) }));
-        const droppedEntries = folded.droppedEntries.map((d) => ({ ...d, error: redactConfigError(d.error) }));
+        const droppedEntries = folded.droppedEntries.map(redactDroppedEntry);
         const errors = [...domainErrors.map((de) => ({ domain: de.domain, error: redactConfigError(de.error) })), ...parseErrors, ...refErrors];
         return {
             effective: withDroppedCatalogEntries(mapToServiceEffective(eff, eff.version), folded.droppedCatalogEntries),
@@ -139,8 +145,7 @@ export function mapToServiceEffective(eff, version) {
                 enabled: m.enabled,
             })),
             roles: eff.models.roles ?? {},
-            ...(eff.models.default !== undefined ? { default: eff.models.default } : {}),
-            ...(eff.models.atModelAllowlist !== undefined ? { atModelAllowlist: eff.models.atModelAllowlist } : {}),
+            atMention: eff.models.atMention,
             ...(eff.models.tierGroups !== undefined ? { tierGroups: eff.models.tierGroups } : {}),
             ...(eff.models.activeTierGroup !== undefined ? { activeTierGroup: eff.models.activeTierGroup } : {}),
         },
@@ -199,13 +204,6 @@ export function mapToServiceEffective(eff, version) {
                 enabled: sc.enabled,
             })),
         },
-        runtime: {
-            ...(eff.runtime.rateLimitPerMin !== undefined ? { rateLimitPerMin: eff.runtime.rateLimitPerMin } : {}),
-            ...(eff.runtime.maxTaskCostUsd !== undefined ? { maxTaskCostUsd: eff.runtime.maxTaskCostUsd } : {}),
-            ...(eff.runtime.maxTaskTokens !== undefined ? { maxTaskTokens: eff.runtime.maxTaskTokens } : {}),
-            ...(eff.runtime.maxPrincipalCostUsd !== undefined ? { maxPrincipalCostUsd: eff.runtime.maxPrincipalCostUsd } : {}),
-            ...(eff.runtime.costQuotaWindowSec !== undefined ? { costQuotaWindowSec: eff.runtime.costQuotaWindowSec } : {}),
-        },
         ...(eff.limits !== undefined ? { limits: eff.limits } : {}),
         governance: {
             ...(eff.governance.autonomy !== undefined ? { autonomy: eff.governance.autonomy } : {}),
@@ -215,21 +213,21 @@ export function mapToServiceEffective(eff, version) {
     };
 }
 export function createConfigProvider(input) {
-    return configProviderKind(input) === "remote" && input.configCenter !== undefined
-        ? new RemoteConfigProvider(input.configCenter)
+    return configProviderKind(input) === "remote" && input.webAdmin !== undefined
+        ? new RemoteConfigProvider(input.webAdmin)
         : new LocalConfigProvider(input.localDir);
 }
 export function configLocalRoot(config) {
     return config.configLocalDir ?? process.env.AGENT_DATA_DIR ?? join(homedir(), ".ai-agent");
 }
 export function configProviderKind(input) {
-    if (input.provider === "local" || input.configCenter === undefined)
+    if (input.provider === "local" || input.webAdmin === undefined)
         return "local";
     return "remote";
 }
 export function serviceConfigSourceKind(config) {
-    if (config.configCenter === undefined && config.configProvider !== "local")
+    if (config.webAdmin === undefined && config.configProvider !== "local")
         return undefined;
-    return configProviderKind({ provider: config.configProvider, configCenter: config.configCenter });
+    return configProviderKind({ provider: config.configProvider, webAdmin: config.webAdmin });
 }
 //# sourceMappingURL=config-provider.js.map

package/dist/config-types.d.ts

@@ -1,5 +1,5 @@
 /** [ref] A1: the ServiceConfig TYPE face, split out of the 1.8k-line loader module (config.ts)
- *  so pure-type consumers (http/server, plugins/*, hooks/hook-llm, security, brain, sema-registry)
+ *  so pure-type consumers (http/server, plugins/*, hooks/hook-llm, security, brain, web-admin)
  *  depend on a LEAF with zero runtime edges — this is the substantive step that dissolves the
  *  type-closed edges into config.ts (lens2 §A). TYPES ONLY: loadConfig and every runtime value stay
  *  in config.ts, which re-exports these names so existing `from "./config.js"` importers keep
@@ -9,7 +9,7 @@ import type { ReadFaceSource } from "./read-face-posture.js";
 import type { PostureSource } from "./posture-source.js";
 import type { SealedCustodyPoison } from "./key-resolver.js";
 import type { ModelEntryRefusal } from "./model-entry-refusal.js";
-import type { DroppedCatalogEntry } from "./config-center/read-warnings.js";
+import type { DroppedCatalogEntry } from "./web-admin-client/read-warnings.js";
 import type { A2aServerSpec, CompliancePosture, CrossSessionDialogExpiry, CrossSessionInboundSetting, FileHistoryRetentionPolicy, LockedKey, McpServerSpec, Model, ModelRoles, RetentionPolicy, ShellGateDoctrine, WriteProtectedEntry } from "@sema-agent/core";
 import type { ApprovalHmacKey, PrincipalJwtKey } from "./auth-keys.js";
 import type { ElicitationThrottle } from "./elicitation.js";
@@ -21,6 +21,7 @@ import type { CenterCredentialSource } from "./center-credential.js";
 import type { GitApiKind } from "./git-api-kind.js";
 import type { MemoryEngineBackend, StoreBackend as StoreBackendWord } from "@sema-agent/settings-schema/execution-lanes";
 import { DRAIN_GRACE_FLOOR_MS } from "@sema-agent/settings-schema/fleet";
+import type { AtMention } from "@sema-agent/settings-schema";
 /** [ref]:记忆向量面的 embedder 坐标(env `MEMORY_EMBEDDER_*` 解析结果;单一属主 = 本类型,
  *  `plugins/memory-embedder.ts` 的工厂直接消费它,不复制形状)。语义与三问见
  *  {@link ServiceConfigFlat.memoryEmbedder}。纯数据 —— 端点原文照存(拼 `/embeddings` 是 transport
@@ -50,8 +51,8 @@ export type TaskWriteFaceEscalation = (typeof TASK_WRITE_FACE_ESCALATIONS)[numbe
 export declare const RETENTION_MODES: readonly ["audit-only", "enforce"];
 export type RetentionMode = (typeof RETENTION_MODES)[number];
 /**
- * S-841 —— `CONFIG_PROVIDER` 的词表闭集(**属主在此**:`loadConfig` 的唯一读点、config-center 工厂、执行车道合成步、
- * 配置目录的 enum 行共读这一份)。缺席 / 空串 = 未表态(配了 `SEMA_REGISTRY_URL` ⇒ 中心,否则纯 env);两词之外 ⇒ 拒启。
+ * S-841 —— `CONFIG_PROVIDER` 的词表闭集(**属主在此**:`loadConfig` 的唯一读点、web-admin 工厂、执行车道合成步、
+ * 配置目录的 enum 行共读这一份)。缺席 / 空串 = 未表态(配了 `SEMA_WEB_ADMIN_URL` ⇒ 中心,否则纯 env);两词之外 ⇒ 拒启。
  * 修前是开放词:认不出的词被配置源判官当 `local`、被隐式 host 臂当「不是 local」,一个旋钮在一个进程里有两种读法。
  */
 export declare const CONFIG_PROVIDER_WORDS: readonly ["local", "remote"];
@@ -128,7 +129,7 @@ export declare const DRAIN_SECOND_SIGNAL_MIN_GAP_DEFAULT_MS = 250;
  * 住在本叶(而不在 `fleet/drain-entry.ts`):`config.ts` 读它,而 drain-entry 值引 `plugins/store-contracts.ts`,config 不值引 plugins 层。
  */
 export declare function fleetScopeOf(raw: string | undefined): string;
-/** 中心基址三席(`SEMA_REGISTRY_URL` / `SEMA_REGISTRY_LIVE_URL` / `SEMA_REGISTRY_WEB_URL`)与公告地址的形句 —— 判官 `config-center/center-request.ts` `pathBaseUrlRefusal` 一只(形判 = `url-shape.ts`),配置目录四行同读这一句。 */
+/** 中心基址三席(`SEMA_WEB_ADMIN_URL` / `SEMA_WEB_ADMIN_LIVE_URL` / `SEMA_WEB_ADMIN_WEB_URL`)与公告地址的形句 —— 判官 `web-admin-client/center-request.ts` `pathBaseUrlRefusal` 一只(形判 = settings-schema `httpUrlFlaws`),配置目录四行同读这一句。 */
 export declare const CENTER_BASE_URL_RULE = "\u8BBE\u4E86\u5C31\u5FC5\u987B\u662F\u53EF\u89E3\u6790\u7684 http(s) URL,\u4E14\u4E0D\u5E26\u51ED\u636E / query / fragment(\u57FA\u5740\u540E\u9762\u8981\u62FC\u8DEF\u5F84);\u574F\u5F62\u62D2\u542F(\u6CA1\u63A5\u4E2D\u5FC3\u4E5F\u62D2),\u62D2\u53E5\u53EA\u70B9\u540D\u89C4\u5219,\u4E0D\u56DE\u663E scheme";
 /** 编排器片 2:`FLEET_LEASE_OUTAGE_MAX_MS` 的缺省(24 h)—— 中心 / 库故障、中心降级在今天都靠 LKG 无限期容忍,10 分钟级的窗会把它们变成数据面停服。 */
 export declare const FLEET_LEASE_OUTAGE_MAX_DEFAULT_MS = 86400000;
@@ -266,7 +267,7 @@ export interface MemoryConsolidationDriverConfig {
      */
     autoRunOnRecommendation?: boolean;
 }
-/** A sema-registry MCP server resolved to a core spec (env-NAME refs already → real values) plus the
+/** A web-admin MCP server resolved to a core spec (env-NAME refs already → real values) plus the
  *  scenarios it applies to (empty = all). `resolveSpec` filters by scenario and passes `spec` to core. */
 export interface ScopedMcpServer {
     scenarios: string[];
@@ -532,7 +533,7 @@ export interface ServiceConfigFlat {
         cooldownMs: number;
     };
     /** Default model the service runs tasks on. **活的** —— center 热应用会整只换掉它
-     *  (`config.model = config.models.default!`,config-center/apply-effective.ts 的 commit 段)。 */
+     *  (`config.model = config.models.default!`,web-admin-client/apply-effective.ts 的 commit 段)。 */
     model: Model;
     /**
      * S-188 —— **boot 期 env 派生的那只模型**,`loadConfig()` 铸一次,此后**永不换**(与 `model` 在 boot
@@ -552,7 +553,7 @@ export interface ServiceConfigFlat {
      *  Used to resolve roles and to allow-list `@-model` mentions. */
     models: Record<string, Model>;
     /** Per-model API-key override: catalog model NAME → the env var NAME holding that model's key (from
-     *  sema-registry `apiKeyEnv`). Drives the spec's `getApiKeyAndHeaders` so each model/rung authenticates
+     *  web-admin `apiKeyEnv`). Drives the spec's `getApiKeyAndHeaders` so each model/rung authenticates
      *  with its own upstream account; a model absent here falls back to the gateway key. Env path: empty. */
     modelApiKeyEnv: Record<string, string>;
     /** sealed-box 托管密钥的解封产物:catalog model NAME → PLAINTEXT api key(`ModelEntry.
@@ -605,21 +606,21 @@ export interface ServiceConfigFlat {
     /** Role → model map (1.24): `subagent`/`summarize` → the cheap model when `MODEL_CHEAP_ID` is set
      *  (council lenses + compaction get cheap), `default`/`team`/`synthesize` stay on the main model. */
     roles: ModelRoles;
-    /** [ref] / [ref] —— **`@`-mention 允许名单**(registry-core `models.atModelAllowlist` 的服务端消费面)。
-     *  语义(registry-core `ModelsDomain.atModelAllowlist` 的 JSDoc 同源):**缺席/空 = 全部启用模型都可被用户点选**;非空 = 用户
-     *  逐 turn 选择通道只能落在名单内的 catalog name 上。
+    /** [ref] / [ref] —— **「`@` 能点名哪些模型」**(settings-schema 11 `models.atMention` 的服务端消费面;三态闭集
+     *  `{mode:"all"}` / `{mode:"none"}` / `{mode:"only", models}`,形与缺省读法的属主是契约,本仓读法 = `model-select.ts`
+     *  `readAtMention` / `DEFAULT_AT_MENTION`,判据 = `isAtMentionable`)。
      *
      *  辖域(设计稿 233 v2 终裁,施工侧成文):
      *   - **受限**=用户通道:`body.model` / `settings.model`(同属请求体,untrusted) / objective 内联
      *     `@name` / `body.compactionModel` / `POST /v1/side-query` 的 `body.model`;
-     *   - **不受限**=operator 配置通道:`models.roles` / `models.default` / 档位绑定表 / side-query 的
-     *     `modelRole`(角色表选路)——名单管「用户可点什么」,不管「operator 配什么」。
+     *   - **不受限**=operator 配置通道:`models.roles` / 档位绑定表 / side-query 的 `modelRole`(角色表选路)
+     *     —— 它管「用户可点什么」,不管「operator 配什么」。
      *   - **提交时门**:core 运行时路由(degrade / cascade / roles 解析)**不在射程**——那些是引擎按配置
      *     自己走的路,不是一次用户选择(诚实声明,非运行时执法)。
      *
-     *  NO env source —— env lane 恒空(INERT=全放行,ship-dark 缺省=旧行为);只由 applyEffective 从
-     *  `models.atModelAllowlist` 整表重算填充(**非粘**:center 撤名单 ⇒ 本表清空 ⇒ 回全放行)。 */
-    atModelAllowlist: readonly string[];
+     *  NO env source —— env lane = 契约缺省(`{mode:"all"}`);只由 applyEffective 从 `models.atMention` 整只重算填充
+     *  (**非粘**:中心改回 `all` ⇒ 本席回 `all`),`only` 的名在 stage 期按本世代可用目录收窄(settings-schema `narrowAtMention`)。 */
+    atMention: AtMention;
     /**
      * Session backend: in-memory (default), tidb (durable L1 event-log center), or `auto` — probe a
      * configured DB at startup and fall back to in-memory if it's unreachable (for local/intranet binaries:
@@ -786,7 +787,7 @@ export interface ServiceConfigFlat {
      *  core 侧 `prepareConfigDoors` 另有同判门(`config.memory_capture_policy`),两道同向不冲突。
      *
      *  🔴 **`governed` 的半配置拒启**:该姿态要求本部署有 per-principal verdict 源。源**两条**(析取,[ref] 起):
-     *  SQL 后端上的 `memory_optout_grant` 表(S-2),或非 dry-run 的 config center 发 `EntitlementRuntimeCaps.allowMemoryOptOut`
+     *  SQL 后端上的 `memory_optout_grant` 表(S-2),或非 dry-run 的 web-admin 发 `EntitlementRuntimeCaps.allowMemoryOptOut`
      *  (settings-schema 1.4.0 到货)。两源皆无 ⇒ 每个 opt-out 声明都被 core 拒且没人知道为什么 ⇒
      *  `boot/runtime-caps.ts` 的 `assertMemoryCapturePolicyWirable` 在启动期拒启(与 consolidation 阀门 D1 同姿态)。
      *  ⚠️ [ref]:center 那一臂只证「源在场」,不证 center 会**发**这个可选键 —— center-only 的部署起动后仍可能次次拒,
@@ -819,7 +820,7 @@ export interface ServiceConfigFlat {
     };
     /** 件A 单机形目录:env `MEMORY_ORG_DIRECTORY_JSON` 原文(`Record<principal, Record<org:scope, {write?}>>`)。
      *  config 解析期即整段校验(parseOrgDirectoryStatic,fail-loud);此处存**原文**(config=纯数据,
-     *  Map 在装配点重建)。与 config-center 目录腿互斥的裁决在装配点(两者都在=center 腿胜,env 表忽略
+     *  Map 在装配点重建)。与 web-admin 目录腿互斥的裁决在装配点(两者都在=center 腿胜,env 表忽略
      *  并 warn——授权面不做双源合并)。 */
     memoryOrgDirectoryJson?: string;
     /** 件A 目录 granted(含负结果)缓存 TTL(ms)。新任务/新 resume 腿的准入判决滞后上限=此值(「TTL 即
@@ -983,15 +984,15 @@ export interface ServiceConfigFlat {
         /** Base commit/ref for every worktree (default core's `HEAD` at creation time). */
         commit?: string;
     };
-    /** MCP servers from sema-registry (`/effective.mcp`), resolved at startup (env-NAME refs → values) and
-     *  filtered per scenario in `resolveSpec`. Not env-derived — populated by the sema-registry adapter when
+    /** MCP servers from web-admin (`/effective.mcp`), resolved at startup (env-NAME refs → values) and
+     *  filtered per scenario in `resolveSpec`. Not env-derived — populated by the web-admin adapter when
      *  present (restart-to-apply, like models/roles); undefined = no center MCP (scenarios use no MCP).
      *  Carries both the mounted list and the full declared-name set — see {@link CenterMcp}. */
     mcpServers?: CenterMcp;
-    /** DESIGN-269 §2.1 —— A2A peers from the config center (`/effective.a2a`), resolved at startup
+    /** DESIGN-269 §2.1 —— A2A peers from the web-admin (`/effective.a2a`), resolved at startup
      *  (header-NAME refs → values) and filtered per scenario in `resolveSpec` (`a2aForScenario`). Same
      *  posture as {@link mcpServers}: not env-derived (no A2A_* env leg — a peer is a structured record,
-     *  not a scalar), populated by the config-center adapter when present, restart-to-apply.
+     *  not a scalar), populated by the web-admin adapter when present, restart-to-apply.
      *  undefined = no center peers ⇒ **the whole leg does not exist** for a task (`TaskSpec.a2a` stays
      *  absent unless a single-user caller injects `body.a2aPeers`). */
     a2aPeers?: ScopedA2aPeer[];
@@ -1012,7 +1013,7 @@ export interface ServiceConfigFlat {
      *  = any MySQL-protocol server — MySQL, TiDB, MariaDB — over the same mysql2 pool; `pg` (PostgreSQL
      *  dialect) reads `pg` below. [ref]/[ref]B-3(5.0.0):the env value `tidb` and the TIDB_* coord names
      *  are RETIRED — `tidb` is rejected by the enum and any TIDB_* env in place refuses to start with the
-     *  MYSQL_* replacement named (see RETIRED_ENVS in config.ts). `mysql` reads MYSQL_* coords only.
+     *  MYSQL_* replacement named (see settings-schema `RETIRED_ENVS`). `mysql` reads MYSQL_* coords only.
      *  TiDB itself stays fully supported (any MySQL-protocol engine works — memory no longer needs a VECTOR
      *  column since [ref] moved it onto the file engine). Env: DB_BACKEND. */
     dbBackend: StoreBackendWord;
@@ -1162,11 +1163,11 @@ export interface ServiceConfigFlat {
      *  (半配置绕行=隐藏入口,刻意优先级)。 */
     allowUnauthedWrites?: boolean;
     /** Optional READ-ONLY token that ALSO authorizes GET /metrics + /metrics/summary (in addition to
-     *  authToken). Set the SAME value fleet-wide so a control plane (sema-registry) can pull every worker's
+     *  authToken). Set the SAME value fleet-wide so a control plane (web-admin) can pull every worker's
      *  metrics with ONE token it holds — without ever holding each worker's full `authToken`. */
     metricsToken?: string;
     /** Read-only Task Trace API token (S1). Like `metricsToken` but for GET /v1/tasks[/:id/turns|/stream] — lets
-     *  sema-registry pull worker traces fleet-wide with ONE read-only token, never holding each worker's full
+     *  web-admin pull worker traces fleet-wide with ONE read-only token, never holding each worker's full
      *  `authToken`. Read-only: cannot run tasks or change config. `TRACE_TOKEN`. */
     traceToken?: string;
     /** CORS v2(2026-07-11):`CORS_ORIGIN` 接受 CSV **白名单**。单值=v1 兼容
@@ -1190,13 +1191,13 @@ export interface ServiceConfigFlat {
     requirePrincipal: boolean;
     /** Runtime governance "second baton" (center §10): operator autonomy mode, expanded TIGHTEN-ONLY onto each
      *  task's TaskSpec (`read-only`/`plan` → read-only hands, `ask` → shellGate always, `auto`/unset → no extra
-     *  tightening). Per-request HOT (read live in resolveSpec); primarily sema-registry-managed, `AUTONOMY` env for
+     *  tightening). Per-request HOT (read live in resolveSpec); primarily web-admin-managed, `AUTONOMY` env for
      *  the env/local path. See runtime-governance.ts. undefined = unmanaged. */
     autonomy?: Autonomy;
     /** Runtime governance "second baton" (center §10): per-command coarse name-level rules, compiled into a
      *  `combinePolicies`-layered ToolPolicy on top of the deployment baseline (deny-wins, tighten-only). COARSE
      *  filter, NOT a sandbox (sh -c/$()/pipes bypass argv[0] → fail toward ask). Per-request HOT; sourced from
-     *  sema-registry `EffectiveConfig.runtime` (structured config, not an env scalar). undefined = unmanaged. */
+     *  the `governance` domain of the effective config (structured config, not an env scalar). undefined = unmanaged. */
     commandPolicy?: CommandRule[];
     /**
      * [ref] 件B —— 本部署的**合规档位**(core `RunnerDeps.compliancePostureResolver` 的供数)。
@@ -1354,16 +1355,16 @@ export interface ServiceConfigFlat {
      * 三问(7.117.0 语义变宽):谁需要 = 没有请求体的腿(`run-local` / leader)上接了 MCP 服务器、或想一句话放掉自家某只工具的运维;谁受伤 = 表里写了内置工具名的部署
      * (7.115.0–7.116.x 本键只回答「没人表态」,`Bash` / `Write` 写进来什么也不放;本版起这两只不再问);补偿 = 起服行 `approval_grant_in_force` 的 note 写着当前效果、
      * `GET /v1/diagnostics/wiring` 的 `serverGates.approvalGrant`、`MIGRATION.md` 升级前必读一段;要某只工具必须问,用上面那几只本键清不掉的旋钮。
-     * v1 只有 env 一个写入通道(无 config-center 座位,不进 settings-schema)= 进程常量,与 Runner 席位的寿命一致。空表 = 席位缺席(引擎读作「部署没有 allow 规则」)。
+     * v1 只有 env 一个写入通道(无 web-admin 座位,不进 settings-schema)= 进程常量,与 Runner 席位的寿命一致。空表 = 席位缺席(引擎读作「部署没有 allow 规则」)。
      */
     approvalGrant: string[];
     /** [ref] D-G (HMAC = integrity, not identity; ✅ WIRED — the "SCAFFOLD, not yet wired" note here was STALE,
      *  corrected 2026-07-25: consumed by `verifyDirectDoorProof` → `verifyApprovalHmac`, reached from the live decide
      *  routes — the two `verifyDirectDoorProof(` call sites in `http/routes/approvals-assistant.ts`): the
-     *  sema-registry-managed, ROTATING key-set used to verify an
+     *  web-admin-managed, ROTATING key-set used to verify an
      *  approval-decision envelope's integrity on a direct-connect door. Empty (unset `APPROVAL_HMAC_KEYS`) ⇒ D-G
      *  inactive (BFF-minted-principal is the only /decide door — back-compat), which is why "wired but off" is the
-     *  accurate description of every stock deployment. sema-registry mints + rotates the set; the shape is
+     *  accurate description of every stock deployment. web-admin mints + rotates the set; the shape is
      *  provisional (ASK-CENTER-2026-06-17). */
     approvalHmacKeys: ApprovalHmacKey[];
     /** [ref] D-G: open the DIRECT-connect /decide door (a CLI/desktop client without the BFF). When true, this
@@ -1379,7 +1380,7 @@ export interface ServiceConfigFlat {
     principalJwtIss?: string;
     principalJwtAud?: string;
     /** S-591:registry SSO-JWT 的**显式** issuer(`AUTH_BRIDGE_ISSUER`)。
-     *  🔴 **只是显式 env,不含 boot 期那条 `?? configCenter.baseUrl` 回退**(回退仍在
+     *  🔴 **只是显式 env,不含 boot 期那条 `?? webAdmin.baseUrl` 回退**(回退仍在
      *  `boot/stage-09-leader.ts` 的桥装配处)。唯一消费方是桥;S-671([ref] ①)起它**不是**托管证据 ——
      *  显式与回退 issuer 在租户轴上同判(理由见 `hosted-posture.ts`)。 */
     authBridgeIssuer?: string;
@@ -1972,7 +1973,7 @@ export interface ServiceConfigFlat {
     readFace?: "open" | "roots";
     /** S-167:上面那一档**是谁定的**(闭集四词,见 `read-face-posture.ts`)。不变量:
      *  `readFace === undefined` ⟺ `readFaceSource === "engine-default"`。
-     *  🔴 承重面**不是**装饰:`config-center/read-face.ts` 的「env 恒赢」逐键判据读的就是它(修前读的是
+     *  🔴 承重面**不是**装饰:`web-admin-client/read-face.ts` 的「env 恒赢」逐键判据读的就是它(修前读的是
      *  「键在不在场」这个代理,posture 会铸键 ⇒ 代理当场失真,center 的 face 会被从没设过 env 的机器挡掉)。 */
     readFaceSource: ReadFaceSource;
     /** S-591(7.95.0,车LT):任务层**掀开写围栏**这条声明的**运维天花板档位**(`TASK_WRITE_FACE_ESCALATION`)。
@@ -2018,10 +2019,10 @@ export interface ServiceConfigFlat {
      *  ⇒ 引擎读字面 `~/.sema`(与 LKG / skill 缓存 / scheduler 店的缺省落点同一处)。读法单一属主 `sema-config-dir.ts`。 */
     agentConfigDir?: string;
     /** LKG 落盘路径的覆写(`CONFIG_LKG_PATH`,绝对路径;单一读法 `config-lkg.ts` `lkgPathOverrideOf`)。缺席 = LKG 落在配置根下按箱派生。
-     *  读者:LKG 的落盘 / 读回(`boot/config-center.ts`)与读拒行(部署姿态座席族 —— LKG 在哪,读拒就守哪,`lkgReadDenyRows`)。 */
+     *  读者:LKG 的落盘 / 读回(`boot/web-admin.ts`)与读拒行(部署姿态座席族 —— LKG 在哪,读拒就守哪,`lkgReadDenyRows`)。 */
     configLkgPath?: string;
     /** 远程配置的 LKG(last-known-good)盘缓存读写开关(`CONFIG_LKG_ENABLED`,缺省开;只对远程 provider 有意义)。单一读法:`loadConfig` 铸这一席
-     *  (同时登记极性行),`boot/config-center.ts` 的两个读点(boot 的 LKG 来源判定、skill 正文缓存目录)只读它 —— 起服之后改环境变量不影响。 */
+     *  (同时登记极性行),`boot/web-admin.ts` 的两个读点(boot 的 LKG 来源判定、skill 正文缓存目录)只读它 —— 起服之后改环境变量不影响。 */
     configLkgEnabled: boolean;
     /** Structured log level. */
     logLevel: "debug" | "info" | "warn" | "error";
@@ -2102,22 +2103,22 @@ export interface ServiceConfigFlat {
     defaultScenario: string;
     /** Directory of baked-in skill Markdown files, loaded once at startup. */
     skillsDir: string;
-    /** Central sema registry (sema-registry). When set, the service pulls the effective config
+    /** Central web-admin (web-admin). When set, the service pulls the effective config
      *  on boot (and refreshes) and applies it OVER the env defaults — env is the fallback. Logical config
      *  only (model roster/roles/teams); secrets/gateways stay in this service's env.
-     *  `dryRun` (SEMA_REGISTRY_DRY_RUN=true; legacy CONFIG_CENTER_DRY_RUN now boot-rejects, no dual-read): pull + LOG what the registry would change vs the env-derived
+     *  `dryRun` (SEMA_WEB_ADMIN_DRY_RUN=true): pull + LOG what the registry would change vs the env-derived
      *  config, but do NOT apply it — a safe-rollout verification step before flipping to live.
-     *  `worker` (SEMA_REGISTRY_WORKER=<name>; legacy CONFIG_CENTER_WORKER now boot-rejects, no dual-read; injected per-worker by the reconciler): scopes the pull to
+     *  `worker` (SEMA_WEB_ADMIN_WORKER=<name>; injected per-worker by the reconciler): scopes the pull to
      *  that worker's roster via `/effective?worker=<name>`. Unset → the global roster (backward compatible).
      *  `credential`(S-651,BREAKING:取代 7.98.0 及以前的 `token: string` 启动快照):凭证来源活对象
-     *  (`center-credential.ts`),每条出站请求经它取一次值 —— `SEMA_REGISTRY_TOKEN`(值)或
-     *  `SEMA_REGISTRY_TOKEN_FILE`(每次读文件,轮换 / 换账号不重启)二选一(两键名与判官的属主 = settings-schema
-     *  `CENTER_CREDENTIAL_ENV` / `judgeCenterCredentialDeclaration`,S-742)。
-     *  `liveBaseUrl`(编排器片 2,env `SEMA_REGISTRY_LIVE_URL`):fleet 活性组(心跳 / 注销、服务租约 —— settings-schema `FLEET_LIVE_PATHS`)的基址,
+     *  (`center-credential.ts`),每条出站请求经它取一次值 —— `SEMA_WEB_ADMIN_TOKEN`(值)或
+     *  `SEMA_WEB_ADMIN_TOKEN_FILE`(每次读文件,轮换 / 换账号不重启)二选一(两键名与判官的属主 = settings-schema
+     *  `WEB_ADMIN_ENV` / `judgeWebAdminCredentialDeclaration`,S-742)。
+     *  `liveBaseUrl`(编排器片 2,env `SEMA_WEB_ADMIN_LIVE_URL`):fleet 活性组(心跳 / 注销、服务租约 —— settings-schema `FLEET_LIVE_PATHS`)的基址,
      *  给「管理面在就绪门后、活性面另走一条不看就绪的入口」的部署;缺席 ⇒ 活性组也打 `baseUrl`(这条缺省只在 `centerFetch` 读)。
-     *  `webBaseUrl`(7.121.0,env `SEMA_REGISTRY_WEB_URL`):这个中心的 **web 面固定基址**,运维声明、引擎原样转述到 `/health.center.webBaseUrl`
+     *  `webBaseUrl`(7.121.0,env `SEMA_WEB_ADMIN_WEB_URL`):这个中心的 **web 面固定基址**,运维声明、引擎原样转述到 `/health.center.webBaseUrl`
      *  (壳按它拼会话深链;路径怎么拼归壳)。起服时判成「可拼路径的基址」:http(s)、不带凭据 / query / fragment,否则拒启;缺席即缺席,引擎不拼不猜。 */
-    configCenter?: {
+    webAdmin?: {
         baseUrl: string;
         liveBaseUrl?: string;
         webBaseUrl?: string;
@@ -2150,14 +2151,14 @@ export interface ServiceConfigFlat {
      *  不自停;中心恢复授予即恢复。② 排空口 `POST /v1/admin/drain` 的**期限准入上界**(`fleet/drain-entry.ts` 规则 2):`deadlineAt` 离此刻超过它 ⇒
      *  400 `request.field_invalid`。 */
     fleetLeaseOutageMaxMs: number;
-    /** S-698(design-325 §2):中心凭证**续签提前量**(ms)—— `SEMA_REGISTRY_TOKEN_FILE` 指向人的登录会话信封
+    /** S-698(design-325 §2):中心凭证**续签提前量**(ms)—— `SEMA_WEB_ADMIN_TOKEN_FILE` 指向人的登录会话信封
      *  (`kind:"user-session"`)时,访问令牌离到期 ≤ 本值即由引擎续签并原子改写同一文件(`center-credential-renewer.ts`)。
      *  缺省 5 min;`0` = 关续签、只读信封(壳负责续);其余必须是整数毫秒且落在 `CENTER_CREDENTIAL_RENEW_LEAD_MIN_MS`(一次续签请求的
      *  传输上界)与 `CENTER_CREDENTIAL_RENEW_LEAD_MAX_MS`(访问令牌寿命之半)之间,坏值拒启(解析口 `parseCenterCredentialRenewLeadMs`)。
-     *  裸行文件 / `SEMA_REGISTRY_TOKEN` 值形不受它影响(不续签)。`CENTER_CREDENTIAL_RENEW_LEAD_MS`。 */
+     *  裸行文件 / `SEMA_WEB_ADMIN_TOKEN` 值形不受它影响(不续签)。`CENTER_CREDENTIAL_RENEW_LEAD_MS`。 */
     centerCredentialRenewLeadMs: number;
-    /** Dual-mode config SOURCE (DUAL-MODE-DESIGN §4): "remote" (sema-registry HTTP) | "local" (.env + config.d
-     *  via @sema-agent/settings-schema FileConfigStore) | unset → remote if SEMA_REGISTRY_URL (legacy CONFIG_CENTER_URL now boot-rejects, no dual-read) is set, else pure-env.
+    /** Dual-mode config SOURCE (DUAL-MODE-DESIGN §4): "remote" (web-admin HTTP) | "local" (.env + config.d
+     *  via @sema-agent/settings-schema FileConfigStore) | unset → remote if SEMA_WEB_ADMIN_URL is set, else pure-env.
      *  Env: CONFIG_PROVIDER —— S-841 起闭集 {@link CONFIG_PROVIDER_WORDS}(认不出的词拒启;空串 = 未设)。
      *  The same resolver/EffectiveConfig either way (can't drift). */
     configProvider?: ConfigProviderWord;
@@ -2167,13 +2168,13 @@ export interface ServiceConfigFlat {
 /** 组:store(持久化)—— DB 引擎三态、session 后端、SQL coords、快照 BLOB / SendUserFile 对象存储。 */
 export type ServiceStoreConfig = Pick<ServiceConfigFlat, "sessionBackend" | "sessionCacheTtlSec" | "storeProbeIntervalMs" | "storeLockWaitMs" | "dbBackend" | "dbBackendExplicit" | "localDataRoot" | "runStoreStrictHydrate" | "tidb" | "pg" | "dbQueryTimeoutMs" | "snapshotBlobStore" | "snapshotBlobSqlMaxBytes" | "snapshotBlobAllowSql" | "fileHistory" | "fileHistoryCapture" | "sendUserFile">;
 /** 组:modelPlane(模型面)—— 网关坐标、Anthropic 路线、韧性旋钮、主/廉价 model entry、role 表、降级梯。 */
-export type ServiceModelPlaneConfig = Pick<ServiceConfigFlat, "gatewayBaseUrl" | "gatewayApiKey" | "gatewayFallbackUrls" | "gatewayMaxRetries" | "anthropic" | "resilience" | "model" | "envModel" | "models" | "modelApiKeyEnv" | "modelApiKeys" | "modelRefusals" | "droppedCatalogEntries" | "modelQuotaWeights" | "tiers" | "projects" | "roles" | "atModelAllowlist" | "cascadeLadder" | "degrade">;
+export type ServiceModelPlaneConfig = Pick<ServiceConfigFlat, "gatewayBaseUrl" | "gatewayApiKey" | "gatewayFallbackUrls" | "gatewayMaxRetries" | "anthropic" | "resilience" | "model" | "envModel" | "models" | "modelApiKeyEnv" | "modelApiKeys" | "modelRefusals" | "droppedCatalogEntries" | "modelQuotaWeights" | "tiers" | "projects" | "roles" | "atMention" | "cascadeLadder" | "degrade">;
 /** 组:approval(审批 / HITL 门)。`directDoorActive` 无 env 解析腿(装配层三域合取的产物),但语义上
  *  就是本组的门状态,故进组;`parseApprovalDomain` 的返回类型相应是 `Omit<…, "directDoorActive">`。 */
 export type ServiceApprovalConfig = Pick<ServiceConfigFlat, "approvalRequire" | "approvalDeny" | "approvalTimeoutSec" | "approvalAutoBudget" | "approvalNeverAuto" | "approvalGrant" | "approvalHmacKeys" | "durableApproval" | "durableApprovalSource" | "streamAskWindowMsSource" | "directApprovalDoor" | "directDoorActive" | "resourceSuspend" | "resourceSuspendTtlSec" | "resourceSuspendTotalTokens" | "resourceSuspendTotalBudgetUsd" | "resourceSuspendMaxSlices" | "askQuestionEnabled" | "questionThrottle" | "toolApprovalEnabled" | "permissionRulesEnabled" | "permissionRulesEnabledExplicit" | "streamAskWindowMarginMs" | "streamApproval" | "unattendedApprovalPolicy" | "mcpElicitation" | "sensitiveWritePatterns" | "writeProtectedPaths" | "manualModeShellGate" | "permissionsDisableAutoMode" | "autoModeClassifierFallback" | "autoModeClassifierTimeoutMs" | "crossSessionInbound" | "crossSessionDialogExpiry">;
 /** 组:memory(记忆面 + TOC 同步腿)。 */
 export type ServiceMemoryConfig = Pick<ServiceConfigFlat, "memoryEngineEnabled" | "memoryEngineDir" | "memoryEngineRemoteLaneAllowed" | "memoryEngineBackend" | "memoryScope" | "memoryPersistenceCapable" | "memorySync" | "memoryEmbedder" | "memoryOrgAdmissionMode" | "memoryDelegationEvidence" | "memoryProvenance" | "memoryCapturePolicy" | "memoryConsolidationDriver" | "memoryOrgDirectoryJson" | "memoryOrgGrantTtlMs" | "memoryOrgUnavailableBackoffMs" | "projectMemoryEnabled" | "syncImportLeaseStaleSec">;
-/** 组:auth(鉴权 / 身份 / 治理棒)。`commandPolicy` 只有 sema-registry 腿(无 env 标量形),故 env 解析
+/** 组:auth(鉴权 / 身份 / 治理棒)。`commandPolicy` 只有 web-admin 腿(无 env 标量形),故 env 解析
  *  函数不产出它,但它与 `autonomy` 是同一根治理棒的两半,归本组。
  *  [ref] 的三件部署治理声明(`compliancePosture`/`lockedConfigKeys`/`retentionPolicy`)同归本组:
  *  三者都是 operator 在配置面写下的**治理声明**(与 autonomy/commandPolicy 同族),不是存储旋钮
@@ -2186,8 +2187,8 @@ export type ServiceOrchestrationConfig = Pick<ServiceConfigFlat, "remoteExec" |
 export type ServiceLimitsHttpConfig = Pick<ServiceConfigFlat, "port" | "attachmentOrphanGraceMs" | "workspaceFileMaxBytes" | "attachmentMaxBytes" | "attachmentMimeAllowlist" | "attachmentUnboundTtlMs" | "infraCostRates" | "drainGraceMs" | "drainSecondSignalMinGapMs" | "sighupIdleGraceMs" | "parentPid" | "engineAutoExit" | "engineLingerMs" | "engineOrphanLingerMs" | "rateLimitPerMin" | "maxTaskCostUsd" | "maxTaskTokens" | "maxPrincipalCostUsd" | "costQuotaWindowSec" | "reapIntervalSec" | "runStaleSec" | "toolResultTtlSec">;
 /** 组:observability(可观测)。 */
 export type ServiceObservabilityConfig = Pick<ServiceConfigFlat, "metricsToken" | "traceToken" | "toolTrace" | "traceThinking" | "logLevel" | "otel">;
-/** 组:integrations(外部集成)。`mcpServers` / `a2aPeers` 由 sema-registry 适配器填(无 env 腿),归本组。 */
-export type ServiceIntegrationsConfig = Pick<ServiceConfigFlat, "pluginsAllowHosts" | "mcpServers" | "a2aPeers" | "a2aServe" | "configBootFetchBudgetMs" | "gitApiBaseUrl" | "gitApiToken" | "gitApiKind" | "defaultScenario" | "skillsDir" | "centerCredentialRenewLeadMs" | "configCenter" | "fleetLeaseFailClosed" | "fleetGeneration" | "fleetScope" | "fleetAdvertiseAddress" | "fleetLeaseOutageMaxMs" | "configProvider" | "configLocalDir">;
+/** 组:integrations(外部集成)。`mcpServers` / `a2aPeers` 由 web-admin 适配器填(无 env 腿),归本组。 */
+export type ServiceIntegrationsConfig = Pick<ServiceConfigFlat, "pluginsAllowHosts" | "mcpServers" | "a2aPeers" | "a2aServe" | "configBootFetchBudgetMs" | "gitApiBaseUrl" | "gitApiToken" | "gitApiKind" | "defaultScenario" | "skillsDir" | "centerCredentialRenewLeadMs" | "webAdmin" | "fleetLeaseFailClosed" | "fleetGeneration" | "fleetScope" | "fleetAdvertiseAddress" | "fleetLeaseOutageMaxMs" | "configProvider" | "configLocalDir">;
 /** 九个组槽。每组恒在场(`loadConfig` / `attachConfigGroups` 装好才交出配置),故不可选——新代码写
  *  `config.modelPlane.model` 不需要 `?.`(可选组会把 `Model` 污染成 `Model | undefined`)。 */
 export interface ServiceConfigGroups {