@sema-agent/server 7.123.0 → 7.124.1

package/dist/capabilities/composite-members.js

@@ -3,7 +3,7 @@ export const COMPOSITE_CAPABILITY_MEMBERS = {
     fleet: ["stream", "sessionScope", "observe", "resume", "bgNotifyFailClosed", "steerPriority", "hookFailureNotice", "leaseClient", "generationEcho"],
     memoryEngine: ["backend", "vectorMode"],
     store: ["declared", "backend", "durable", "degradedReason", "sql"],
-    centerWiring: ["effectivePull", "effectiveRevision", "lease", "leaseHealth", "failMode", "usageReport", "issuer", "caller"],
+    centerWiring: ["effectivePull", "effectiveRevision", "lease", "leaseHealth", "failMode", "usageReport", "issuer", "worker", "caller"],
     webSearch: ["backend"],
     background: ["listFace", "exitFaces"],
     taskSettings: ["permissions", "permissionMode", "model", "outputStyle", "env", "hooks"],

package/dist/capabilities/scenarios.js

@@ -222,12 +222,12 @@ export function centerScenarios(deps, specs, builtinNames, logger) {
         if (spec.enabled === false)
             continue;
         if (typeof spec.name !== "string" || !SCENARIO_NAME_RE.test(spec.name)) {
-            logger?.warn("sema_registry_scenario_invalid", { name: String(spec?.name), reason: "name must match " + String(SCENARIO_NAME_RE) });
+            logger?.warn("web_admin_scenario_invalid", { name: String(spec?.name), reason: "name must match " + String(SCENARIO_NAME_RE) });
             continue;
         }
         const toolset = Object.hasOwn(TOOLSETS, spec.toolset) ? TOOLSETS[spec.toolset] : undefined;
         if (!toolset) {
-            logger?.warn("sema_registry_scenario_invalid", { name: spec.name, reason: `unknown toolset "${String(spec.toolset)}" (have: ${Object.keys(TOOLSETS).join(", ")})` });
+            logger?.warn("web_admin_scenario_invalid", { name: spec.name, reason: `unknown toolset "${String(spec.toolset)}" (have: ${Object.keys(TOOLSETS).join(", ")})` });
             continue;
         }
         const name = spec.name;

package/dist/capabilities/team.d.ts

@@ -83,7 +83,7 @@ export interface TeamTemplate {
         systemPrompt?: string;
     };
 }
-/** Built-in team templates (placeholder until the sema registry supplies them). */
+/** Built-in team templates (placeholder until the web-admin supplies them). */
 export declare const BUILTIN_TEAMS: Record<string, TeamTemplate>;
 export declare function registerTeams(extra: Record<string, TeamTemplate>): void;
 export declare function getTeam(name: string): TeamTemplate | undefined;

package/dist/capabilities/tool-defer.d.ts

@@ -18,7 +18,7 @@
  *    在本仓缺省场景下那会连 Agent 与 Task 四件一起卷进候选(与 CC 姿态相反),所以我们**刻意不开**;
  *    🔴 该判断在 core 5.40.0 / 7.15.0 上**逐字仍成立**(亲验):两次收窄动的都是「候选集是谁」,而
  *    Agent / Task 四件是 **caller spec 工具**,收窄后照样在候选池里 —— 不开 auto 的理由没有被消解。
- *    我方**从不接线**这个座:全树零 `RunnerDeps.deferMode` 赋值(config-center 曾有同形近名 `deferModelPlane`,
+ *    我方**从不接线**这个座:全树零 `RunnerDeps.deferMode` 赋值(web-admin 曾有同形近名 `deferModelPlane`,
  *    与本轴无关,已于 S-668 波 0 退役)。机器钉见 test/tool-defer.test.ts 的 [ref] 件⑤ 格 —— 这条「零接线」正是本仓
  *    在两个 core 世代之间行为逐字不变的**全部**依据,所以它值一根钉而不只是一句注。
  *  - per-tool `ToolSpec.defer:true` 是本 helper 施加的那一位。**7.15.0 起它是一次「进候选集」的声明,

package/dist/center-credential-renewer.d.ts

@@ -59,7 +59,7 @@ export declare function buildCenterCredentialHealthView(health: CenterCredential
 export interface CenterCredentialRenewerDeps {
     /** 文件形凭证来源(续签器只从它的取值被触发;文件路径取自它的 `origin`)。 */
     readonly source: CenterCredentialSource;
-    /** `configCenter.url` —— 续签只向与它同源的 `issuer` 发。 */
+    /** `webAdmin.url` —— 续签只向与它同源的 `issuer` 发。 */
     readonly centerUrl: string;
     /** `CENTER_CREDENTIAL_RENEW_LEAD_MS`(已过 {@link parseCenterCredentialRenewLeadMs});0 = 关续签。 */
     readonly leadMs: number;

package/dist/center-credential-renewer.js

@@ -1,9 +1,9 @@
 import { createHash, randomBytes } from "node:crypto";
 import { closeSync, fchmodSync, fsyncSync, openSync, readdirSync, readFileSync, renameSync, rmSync, writeFileSync } from "node:fs";
 import { basename, dirname, join } from "node:path";
-import { CENTER_CREDENTIAL_ENV, CenterCredentialEnvelope, parseCenterCredentialFile } from "@sema-agent/settings-schema";
+import { WEB_ADMIN_ENV, WebAdminCredentialEnvelope, parseWebAdminCredentialFile } from "@sema-agent/settings-schema";
 import { ACCESS_TOKEN_TTL_SECONDS, OAuthErrorResponse, TokenGrantResponse } from "@sema-agent/settings-schema/api/auth";
-import { CENTER_PULL_TIMEOUT_MS, centerTokenRefresh } from "./config-center/center-request.js";
+import { CENTER_PULL_TIMEOUT_MS, centerTokenRefresh } from "./web-admin-client/center-request.js";
 export const CENTER_CREDENTIAL_RENEW_LEAD_KEY = "CENTER_CREDENTIAL_RENEW_LEAD_MS";
 export const CENTER_CREDENTIAL_RENEW_LEAD_DEFAULT_MS = 5 * 60_000;
 export const CENTER_CREDENTIAL_RENEW_LEAD_MIN_MS = CENTER_PULL_TIMEOUT_MS;
@@ -42,7 +42,7 @@ function readFileNow(path) {
         const code = err instanceof Error && "code" in err && typeof err.code === "string" ? err.code : "read error";
         return code === "ENOENT" ? { kind: "no-session" } : { kind: "unreadable", code };
     }
-    const file = parseCenterCredentialFile(text);
+    const file = parseWebAdminCredentialFile(text);
     return file.kind === "envelope" ? { kind: "session", envelope: file.envelope, refreshDigest: digest16(file.envelope.refreshToken) } : { kind: "no-session" };
 }
 const TMP_RANDOM_BYTES = 6;
@@ -83,7 +83,7 @@ function sessionExpiryOf(read) {
 export function createCenterCredentialRenewer(deps) {
     const { source, centerUrl, leadMs, logger } = deps;
     if (source.origin.from !== "file")
-        throw new Error(`center credential renewer needs the ${CENTER_CREDENTIAL_ENV.tokenFile} form (got ${source.origin.from})`);
+        throw new Error(`center credential renewer needs the ${WEB_ADMIN_ENV.tokenFile} form (got ${source.origin.from})`);
     const path = source.origin.path;
     const now = deps.now ?? Date.now;
     const tickMs = Math.min(Math.max(leadMs / 2, 1000), 60_000);
@@ -147,7 +147,7 @@ export function createCenterCredentialRenewer(deps) {
             return;
         unavailableStreak = read.failure;
         logger.warn("center_credential_unreadable", {
-            key: CENTER_CREDENTIAL_ENV.tokenFile,
+            key: WEB_ADMIN_ENV.tokenFile,
             failure: read.failure,
             reason: read.reason,
             note: "no center request carries this credential until the file holds a usable one again (each consumer takes its own failure arm); warned once per unavailability streak",
@@ -172,7 +172,7 @@ export function createCenterCredentialRenewer(deps) {
         subject = refreshDigest;
         held = undefined;
         if (reason === "issuer_mismatch") {
-            logger.warn("center_credential_issuer_mismatch", { ...fields, note: "the sign-in envelope was issued by a different center than SEMA_REGISTRY_URL — its refresh token is never sent there; the access token is used until it expires, then sign in again against this center" });
+            logger.warn("center_credential_issuer_mismatch", { ...fields, note: `the sign-in envelope was issued by a different center than ${WEB_ADMIN_ENV.url} — its refresh token is never sent there; the access token is used until it expires, then sign in again against this center` });
             return;
         }
         logger.warn("center_credential_renew_failed", {
@@ -297,7 +297,7 @@ export function createCenterCredentialRenewer(deps) {
             judgeRefusal(usedDigest, "malformed_grant", { status: res.status });
             return;
         }
-        const next = CenterCredentialEnvelope.safeParse({
+        const next = WebAdminCredentialEnvelope.safeParse({
             kind: envelope.kind,
             accessToken: grant.data.access_token,
             refreshToken: grant.data.refresh_token,

package/dist/center-credential.d.ts

@@ -1,5 +1,5 @@
-import { type CenterCredentialDeclaration } from "@sema-agent/settings-schema";
-/** 凭证种类闭集。新增一个种类 = 本文件与 `config-center/center-request.ts` 的穷举 switch 当场编译红。 */
+import { type WebAdminCredentialDeclaration } from "@sema-agent/settings-schema";
+/** 凭证种类闭集。新增一个种类 = 本文件与 `web-admin-client/center-request.ts` 的穷举 switch 当场编译红。 */
 export type CenterCredentialKind = "pull-token" | "user-jwt" | "user-session" | "none";
 /** 一次取值失败的成因闭集(见模块头注「四个成因」;boot 判决 {@link judgeCenterCredentialAtBoot} 对它穷举)。 */
 export type CenterCredentialFailure = "missing" | "malformed" | "multi_tenant_session" | "expired";
@@ -84,7 +84,7 @@ export declare class CenterCredentialUnavailableError extends Error {
  * 凭证来源的构造入参:settings-schema 的声明形,文件形**必须**带上本部署的租户姿态(多租户拒人的会话信封,见模块头注)——
  * 姿态只在文件形有意义(env 值形是部署注入的拉取令牌,永远不是信封),所以只在那一臂上必填:漏传 = 编译红,不是静默单租户。
  */
-export type CenterCredentialSourceSpec = Exclude<CenterCredentialDeclaration, {
+export type CenterCredentialSourceSpec = Exclude<WebAdminCredentialDeclaration, {
     from: "file";
 }> | {
     readonly from: "file";
@@ -92,16 +92,16 @@ export type CenterCredentialSourceSpec = Exclude<CenterCredentialDeclaration, {
     readonly multiTenant: boolean;
 };
 /**
- * 读两个声明键 —— 判定全交 settings-schema 的判官 `judgeCenterCredentialDeclaration`(S-742:二选一规则的**唯一**实现;空串 = 未设、
+ * 读两个声明键 —— 判定全交 settings-schema 的判官 `judgeWebAdminCredentialDeclaration`(S-742:二选一规则的**唯一**实现;空串 = 未设、
  * 不 trim;两个都设 ⇒ throw,boot 拒启,拒句点名两个键、不回显值)。本仓只多读方自己的那一步:文件路径按本进程 cwd 解析成绝对
  * 路径(之后 cwd 变了也读同一个文件 —— 纯契约不碰 `node:path`,这一步归读方)。
  */
-export declare function readCenterCredentialDeclaration(env?: Readonly<Record<string, string | undefined>>): CenterCredentialDeclaration;
+export declare function readCenterCredentialDeclaration(env?: Readonly<Record<string, string | undefined>>): WebAdminCredentialDeclaration;
 /** 拉取令牌形的身份 = worker(拉取令牌代表 worker,不是人)。种类判别与 formatVersion 1 LKG 的一次性迁移
  *  (`config-lkg.ts` `migrateV1Lkg`:v1 信封只记 worker,只有这一形的身份推得出来)共用这一只。 */
 export declare function pullTokenIdentity(worker: string | undefined): string;
 /**
- * 凭证来源工厂(活对象:文件形每次取值读盘并记健康态)。`worker` = `SEMA_REGISTRY_WORKER`(拉取令牌形的身份)。
+ * 凭证来源工厂(活对象:文件形每次取值读盘并记健康态)。`worker` = `SEMA_WEB_ADMIN_WORKER`(拉取令牌形的身份)。
  * `readFile` / `now` 只为测试注入。
  */
 export declare function createCenterCredentialSource(spec: CenterCredentialSourceSpec, worker: string | undefined, deps?: {
@@ -128,13 +128,13 @@ export declare const CENTER_CREDENTIAL_REFUSAL_CODES: {
 };
 export type CenterCredentialRefusalCode = (typeof CENTER_CREDENTIAL_REFUSAL_CODES)[keyof typeof CENTER_CREDENTIAL_REFUSAL_CODES];
 /**
- * S-698 —— boot 读到的凭证怎么处置(`boot/config-center.ts` 执行,规则只在这里):
+ * S-698 —— boot 读到的凭证怎么处置(`boot/web-admin.ts` 执行,规则只在这里):
  *  · `missing` / `expired` ⇒ 响亮(error 级一行),照常起服 —— 前者是「此刻没有凭证」(登出形,文件出现即恢复),
  *    后者续签器立刻续签;
  *  · `malformed` / `multi_tenant_session` ⇒ **拒启**,拒句带码、点名文件键,不回显内容(`reason` 由本模块铸,本来就不含内容)。
  */
 export declare function judgeCenterCredentialAtBoot(read: CenterCredentialRead): CenterCredentialBootVerdict;
-/** 需要作用域 worker 的拉取令牌(`wpt_<self>`)却没配 `SEMA_REGISTRY_WORKER` ⇒ 中心对 per-principal caps
+/** 需要作用域 worker 的拉取令牌(`wpt_<self>`)却没配 `SEMA_WEB_ADMIN_WORKER` ⇒ 中心对 per-principal caps
  *  逐次 403(caps fail-closed 拒全部 workflow)。boot 期一次性诊断用;判据只读本模块的种类判别。 */
 export declare function scopedTokenNeedsWorker(read: CenterCredentialRead, worker: string | undefined): boolean;
 /**
@@ -148,7 +148,7 @@ export declare function centerStateBin(worker: string | undefined, identity: str
 export declare function credentialIdentityNow(source: CenterCredentialSource): string | undefined;
 /**
  * [ref] E-15 ② —— 一次中心往返的答复**仍属于此刻的凭证**:发出它所用的身份 = 此刻的身份。
- * 拉配置(`boot/config-center.ts` `pullEffective`)与两条 `?principal=` 视图(`config-center/http-client.ts`)
+ * 拉配置(`boot/web-admin.ts` `pullEffective`)与两条 `?principal=` 视图(`web-admin-client/http-client.ts`)
  * 都只问这一只;不成立 ⇒ 答复丢弃,当这次拉取失败(各走各的失败臂)。
  */
 export declare function answerStillCurrent(source: CenterCredentialSource, usedIdentity: string | undefined): usedIdentity is string;

package/dist/center-credential.js

@@ -2,7 +2,7 @@ import { readFileSync } from "node:fs";
 import { createHash } from "node:crypto";
 import { resolve as resolvePath } from "node:path";
 import { looksLikeJwt } from "@sema-agent/settings-schema/api/auth-bridge";
-import { CENTER_CREDENTIAL_ENV, judgeCenterCredentialDeclaration, parseCenterCredentialFile } from "@sema-agent/settings-schema";
+import { WEB_ADMIN_ENV, judgeWebAdminCredentialDeclaration, parseWebAdminCredentialFile } from "@sema-agent/settings-schema";
 export class CenterCredentialUnavailableError extends Error {
     reason;
     constructor(reason) {
@@ -12,7 +12,7 @@ export class CenterCredentialUnavailableError extends Error {
     }
 }
 export function readCenterCredentialDeclaration(env = process.env) {
-    const declared = judgeCenterCredentialDeclaration(env);
+    const declared = judgeWebAdminCredentialDeclaration(env, "access");
     return declared.from === "file" ? { from: "file", path: resolvePath(declared.path) } : declared;
 }
 const digest16 = (s) => createHash("sha256").update(s, "utf8").digest("hex").slice(0, 16);
@@ -43,8 +43,8 @@ export function pullTokenIdentity(worker) {
 const NONE = { ok: true, kind: "none", identity: "none" };
 const PARSER_EMPTY_REASON = "empty";
 function readCredentialText(text, spec, worker, now) {
-    const where = `${CENTER_CREDENTIAL_ENV.tokenFile} ${spec.path}`;
-    const file = parseCenterCredentialFile(text);
+    const where = `${WEB_ADMIN_ENV.tokenFile} ${spec.path}`;
+    const file = parseWebAdminCredentialFile(text);
     switch (file.kind) {
         case "bare":
             return classify(file.bearer, worker);
@@ -105,7 +105,7 @@ export function createCenterCredentialSource(spec, worker, deps = {}) {
                 }
                 catch (err) {
                     const code = err instanceof Error && "code" in err && typeof err.code === "string" ? err.code : "read error";
-                    return { ok: false, failure: "missing", reason: `${CENTER_CREDENTIAL_ENV.tokenFile} ${spec.path} is unreadable (${code})` };
+                    return { ok: false, failure: "missing", reason: `${WEB_ADMIN_ENV.tokenFile} ${spec.path} is unreadable (${code})` };
                 }
                 return readCredentialText(text, spec, worker, now());
             };
@@ -155,7 +155,7 @@ export function judgeCenterCredentialAtBoot(read) {
             return {
                 verdict: "refuse",
                 code,
-                sentence: `center credential refused at boot [${code}]: ${read.reason}. The file must hold one bare token line, or the sign-in envelope the shell writes (a CenterCredentialEnvelope JSON object); sign in again so the shell rewrites it, or fix the file — its content is never echoed.`,
+                sentence: `center credential refused at boot [${code}]: ${read.reason}. The file must hold one bare token line, or the sign-in envelope the shell writes (a WebAdminCredentialEnvelope JSON object); sign in again so the shell rewrites it, or fix the file — its content is never echoed.`,
             };
         }
         case "multi_tenant_session": {

package/dist/config-catalog.d.ts

@@ -1,6 +1,7 @@
+import { type RetiredEnvWire } from "@sema-agent/settings-schema";
 import type { ServiceConfig, ServiceConfigGroups } from "./config-types.js";
-import type { ConfigKnobRecord, RetiredEnvWire } from "./config.js";
-import type { RestartSlice } from "./config-center/restart-signal.js";
+import type { ConfigKnobRecord } from "./config.js";
+import type { RestartSlice } from "./web-admin-client/restart-signal.js";
 export declare const CATALOG_VALUE_TYPES: readonly ["boolean", "number", "string", "enum", "csv", "json", "path", "url", "secret", "opaque"];
 export type CatalogValueType = (typeof CATALOG_VALUE_TYPES)[number];
 export declare const CATALOG_TIMINGS: readonly ["hot", "restart", "deploy", "inert"];
@@ -14,7 +15,7 @@ export declare const CATALOG_RESTART_SLICES: readonly RestartSlice[];
 export interface CatalogCenterSeatSpec {
     readonly domain: string;
     readonly path: string;
-    /** `centerManagedKeys`(config-center 在管键集)里查「在管」用的键;models 面统一 "models"。 */
+    /** `centerManagedKeys`(web-admin 在管键集)里查「在管」用的键;models 面统一 "models"。 */
     readonly centerKey: string;
     readonly precedence: "center-wins" | "env-wins";
     readonly timing: "hot" | "restart" | "inert";
@@ -144,12 +145,8 @@ export interface ConfigCatalogInputs {
      *  它值级 import 了 core 与契约包(词表 / 中心凭证键名 / S-866 ⑤a 的 `DOMAIN_SCHEMAS` 座位门);这一格照旧由调用方传,
      *  只因为它是 wire 上的一段列表、由路由决定取哪一份。 */
     readonly centerDomains: readonly string[];
-    /** config-center 当前在管的 ServiceConfig 键集(缺席 = 没有配置管道)。 */
+    /** web-admin 当前在管的 ServiceConfig 键集(缺席 = 没有配置管道)。 */
     readonly centerManagedKeys?: ReadonlySet<string> | undefined;
-    /** S-885:退役 env 墓碑表的投影 —— 调用方传 `config.ts` 的 `buildRetiredEnvWire()`(同一张 `RETIRED_ENVS`,不手抄)。**必填**:
-     *  本模块不能值引 config.ts(`server-secret-env.ts` 值引本模块 ⇒ config → server-secret-env → config-catalog → config 成环,
-     *  干净进程直接 import 本模块即 TDZ 崩;codex r1 F2)⇒ 由调用方注入,缺了就是编译错而不是一张静默空表。 */
-    readonly retired: readonly RetiredEnvWire[];
 }
 export interface ConfigCatalogWire {
     readonly catalogVersion: 1;
@@ -164,8 +161,8 @@ export interface ConfigCatalogWire {
         readonly centerManaged: number;
     };
     readonly rows: readonly ConfigCatalogRow[];
-    /** S-885(7.106.0)—— 退役 env 墓碑表(`config.ts` 的 `RETIRED_ENVS`,在场即拒启)的投影,**恒在场**(可为空数组)。与 `rows` 分开:
-     *  rows 是「本进程会读的 env」,这里是「本进程会拒的旧名」—— 一个名字不会同时在两处(墓碑名没有读取点)。 */
+    /** S-885(7.106.0)—— 退役 env 墓碑表(settings-schema `RETIRED_ENVS`,本进程起服按它拒启)的投影 `buildRetiredEnvWire()`,**恒在场**
+     *  (可为空数组)。与 `rows` 分开:rows 是「本进程会读的 env」,这里是「本进程会拒的旧名」—— 一个名字不会同时在两处(墓碑名没有读取点)。 */
     readonly retired: readonly RetiredEnvWire[];
 }
 /**

package/dist/config-catalog.js

@@ -1,6 +1,6 @@
 import { CROSS_SESSION_INBOUND_SETTINGS, CROSS_SESSION_DIALOG_EXPIRY_VALUES } from "@sema-agent/core";
 import { GLOBAL_SCOPE } from "@sema-agent/settings-schema/api/scopes";
-import { CENTER_CREDENTIAL_ENV, DOMAIN_SCHEMAS } from "@sema-agent/settings-schema";
+import { WEB_ADMIN_ENV, DOMAIN_SCHEMAS, buildRetiredEnvWire } from "@sema-agent/settings-schema";
 import { CENTER_CREDENTIAL_RENEW_LEAD_DEFAULT_MS, CENTER_CREDENTIAL_RENEW_LEAD_MAX_MS, CENTER_CREDENTIAL_RENEW_LEAD_MIN_MS } from "./center-credential-renewer.js";
 import { THINKING_FORMATS } from "./model-compat.js";
 import { AUTO_MODE_CLASSIFIER_TIMEOUT_BOUNDS, CENTER_BASE_URL_RULE, CONFIG_PROVIDER_WORDS, DRAIN_SECOND_SIGNAL_MIN_GAP_BOUNDS, DRAIN_SECOND_SIGNAL_MIN_GAP_DEFAULT_MS, FIRST_BYTE_TIMEOUT_BOUNDS, FLEET_LEASE_OUTAGE_MAX_DEFAULT_MS, RESILIENCE_DEFAULTS, TASK_WRITE_FACE_ESCALATIONS } from "./config-types.js";
@@ -72,7 +72,7 @@ export const CONFIG_CATALOG = [
     r("ATTACHMENT_ORPHAN_GRACE_MS", "limitsHttp", "number", "附件孤儿对象 GC 宽限(ms;0=关本腿,坏值回默认+warn)", { staticDefault: "3600000", danger: DATA, center: cLimits("attachmentOrphanGraceMs") }),
     r("ATTACHMENT_UNBOUND_TTL_MS", "limitsHttp", "number", "未绑定附件的 TTL(ms)", { staticDefault: String(24 * 3600 * 1000), danger: DATA, configKey: "attachmentUnboundTtlMs", center: cLimits("attachmentUnboundTtlMs") }),
     r("AUTH_BRIDGE_AUDIENCE", "auth", "string", "registry SSO-JWT 验签期望 aud", { danger: SEC }),
-    r("AUTH_BRIDGE_ISSUER", "auth", "url", "registry SSO-JWT issuer(auth bridge 的开关之一;S-671 / C-R100 ① 起**不是**托管证据 —— 多租户只认 REQUIRE_PRINCIPAL=true)", { danger: SEC, derivedDefaultNote: "缺席 ⇒ 桥的装配处回退到 configCenter.baseUrl(配了 center 即默认开桥);显式值与回退值在托管判定上同判(都不算)", configKey: "authBridgeIssuer" }),
+    r("AUTH_BRIDGE_ISSUER", "auth", "url", "registry SSO-JWT issuer(auth bridge 的开关之一;S-671 / C-R100 ① 起**不是**托管证据 —— 多租户只认 REQUIRE_PRINCIPAL=true)", { danger: SEC, derivedDefaultNote: "缺席 ⇒ 桥的装配处回退到 webAdmin.baseUrl(配了 center 即默认开桥);显式值与回退值在托管判定上同判(都不算)", configKey: "authBridgeIssuer" }),
     r("AUTH_BRIDGE_JWKS_URL", "auth", "url", "registry SSO-JWT 的 JWKS 地址(缺省从 issuer 派生)", { danger: SEC }),
     r("AUTONOMY", "auth", "enum", "运维 autonomy 模式(read-only ⇒ 只读手 + 写面 roots,每段续跑重折,子代同受、委派照挂;ask ⇒ 恒 shellGate,每段重折;plan ⇒ 提交入口的模式词地板:新提交的任务以 permissionMode:plan 起步,请求词钳到它之下,写与非只读调用在调用时问 / 拒,批准计划之后整条 run 按批准的档跑完);center 腿热且 non-sticky(plan 地板只作用于之后提交的任务)", { danger: SEC, enumValues: AUTONOMY_MODES, configKey: "autonomy", center: cGov("autonomy") }),
     r("AUTO_MODE_CLASSIFIER_FALLBACK", "approval", "enum", "auto 分类器席答不出裁决时的梯子(main=主模型代判 / none=只留分类器那一级,整条拒)", { enumValues: ["main", "none"], danger: SEC, derivedDefaultNote: "未设/空串 ⇒ 不铸键,跟随引擎缺省 main(core 7.18.0 起;空串按未设,与其余词表旋钮同判);none = 7.77.0 及以前的行为逐字;词表外的值启动期拒启。权限轴放宽,升级须知见 DEPLOY-PREREQS", configKey: "autoModeClassifierFallback" }),
@@ -88,7 +88,7 @@ export const CONFIG_CATALOG = [
     r("BG_AGENT_RETENTION_MS", "orchestration", "number", "TERMINAL 后台 agent 行保留期(ms,reaper 按 scope 清)", { staticDefault: String(7 * 24 * 60 * 60 * 1000), danger: DATA, configKey: "backgroundAgentRetentionMs" }),
     r("BG_AGENT_STALE_RUNNING_MS", "orchestration", "number", "running 后台 agent 行写者心跳断更超此值翻 failed(ms;下限 10min 硬钳)", { staticDefault: String(15 * 60_000), configKey: "backgroundAgentStaleRunningMs" }),
     r("BIND_HOST", "auth", "string", "监听绑址(显式值恒生效)", { danger: SEC, derivedDefaultNote: "缺席:无鉴权写面(allowUnauthedWrites ∧ 零凭证)自动收窄 127.0.0.1,其余全接口", resolve: (c) => c.bindHost ?? null }),
-    r("CENTER_CREDENTIAL_RENEW_LEAD_MS", "integrations", "number", `center 凭证续签提前量(ms;${CENTER_CREDENTIAL_ENV.tokenFile} 指向人的登录会话信封时,访问令牌离到期 ≤ 本值即由引擎续签并原子改写同一文件;0 = 关续签只读信封;其余须为 [${CENTER_CREDENTIAL_RENEW_LEAD_MIN_MS}, ${CENTER_CREDENTIAL_RENEW_LEAD_MAX_MS}] 内整数,坏值拒启;裸行 / 值形凭证不续签)`, { staticDefault: String(CENTER_CREDENTIAL_RENEW_LEAD_DEFAULT_MS), danger: SEC, configKey: "centerCredentialRenewLeadMs" }),
+    r("CENTER_CREDENTIAL_RENEW_LEAD_MS", "integrations", "number", `center 凭证续签提前量(ms;${WEB_ADMIN_ENV.tokenFile} 指向人的登录会话信封时,访问令牌离到期 ≤ 本值即由引擎续签并原子改写同一文件;0 = 关续签只读信封;其余须为 [${CENTER_CREDENTIAL_RENEW_LEAD_MIN_MS}, ${CENTER_CREDENTIAL_RENEW_LEAD_MAX_MS}] 内整数,坏值拒启;裸行 / 值形凭证不续签)`, { staticDefault: String(CENTER_CREDENTIAL_RENEW_LEAD_DEFAULT_MS), danger: SEC, configKey: "centerCredentialRenewLeadMs" }),
     r("COMPLIANCE_ADDITIONAL_DENIES", "auth", "csv", "合规档位之上额外拒绝的能力名(只能收紧;词表=core 闭集,拼错拒启)", { danger: SEC }),
     r("COMPLIANCE_PROFILE", "auth", "enum", "本部署合规档位(core compliancePostureResolver 供数;拼错拒启)", { danger: SEC, enumValues: ["hipaa", "zdr"], resolve: (c) => c.compliancePosture?.profile ?? null }),
     r("CONFIG_BOOT_FETCH_BUDGET_MS", "integrations", "number", "boot 首拉配置的抢答窗(ms;过窗以 env/兜底起服,拉取转后台热应用)", { staticDefault: "1500", configKey: "configBootFetchBudgetMs" }),
@@ -97,7 +97,7 @@ export const CONFIG_CATALOG = [
     r("CONFIG_LKG_ENABLED", "integrations", "boolean", "last-known-good 配置盘缓存读写开关(仅远程 provider 有意义)", { staticDefault: "true", configKey: "configLkgEnabled" }),
     r("CONFIG_LKG_PATH", "integrations", "path", "LKG 落盘路径(设了 ⇒ 派生一条读拒行 = 这条绝对路径:根锚定,只守这一个文件,经符号链接的目录时引擎沿链连目标一起守;大小写不敏感;用户仓里同尾的路径读得到;空串拒启)", { derivedDefaultNote: "缺席 ⇒ 配置根(SEMA_CONFIG_DIR,缺省 ~/.sema)下按 worker + 凭证身份分箱派生", configKey: "configLkgPath" }),
     r("CONFIG_LOCAL_DIR", "integrations", "path", "本地配置源根(config.d/<domain>.json);兼作数据根回落链一环", { configKey: "configLocalDir", danger: DATA }),
-    r("CONFIG_PROVIDER", "integrations", "enum", "配置源双模选择(闭集,逐字比较;认不出的词 ⇒ 拒启,S-841)", { enumValues: CONFIG_PROVIDER_WORDS, derivedDefaultNote: "缺席:SEMA_REGISTRY_URL 在场 ⇒ remote,否则纯 env(无管道)", configKey: "configProvider" }),
+    r("CONFIG_PROVIDER", "integrations", "enum", "配置源双模选择(闭集,逐字比较;认不出的词 ⇒ 拒启,S-841)", { enumValues: CONFIG_PROVIDER_WORDS, derivedDefaultNote: `缺席:${WEB_ADMIN_ENV.url} 在场 ⇒ remote,否则纯 env(无管道)`, configKey: "configProvider" }),
     r("CONFIG_REQUIRE_ROSTER", "integrations", "boolean", "远程 registry 非 dryRun 时布防 ready 门:roster 未落地 ⇒ 计费提交 503 + /health ready:false(严格 'true')", { staticDefault: "false" }),
     r("CORS_ORIGIN", "auth", "csv", "CORS 白名单(单值 v1 兼容回显;多值按请求 Origin 匹配 + Vary;未设=无 CORS 面)", { danger: SEC, configKey: "corsOrigins" }),
     r("COST_QUOTA_WINDOW_SEC", "limitsHttp", "number", "per-principal 成本配额窗长(秒);SQL 腿窗长进桶主键 ⇒ center 腿显式 deferred(重启生效)", { staticDefault: "86400", danger: BILL, configKey: "costQuotaWindowSec", center: cLimits("costQuotaWindowSec", { timing: "restart", restartReason: "cost-quota-window" }) }),
@@ -105,7 +105,7 @@ export const CONFIG_CATALOG = [
     r("CROSS_SESSION_INBOUND", "approval", "enum", "入站跨会话消息的部署/组织层治理(CC settings 键名 crossSessionInbound 的 managed 层;未设=本层不表态≠ next-turn;词表外拒启)", { danger: SEC, enumValues: [...CROSS_SESSION_INBOUND_SETTINGS], configKey: "crossSessionInbound", derivedDefaultNote: "缺席 ⇒ managed 层不设,由其余层与 mode-parity 决定", resolve: (c) => c.crossSessionInbound ?? null }),
     r("DB_BACKEND", "store", "enum", "store 后端引擎选择(mysql 兼容/pg/本机文件店/纯内存)", { enumValues: STORE_BACKENDS, danger: DATA, derivedDefaultNote: "裸 boot ⇒ local(多租户裸 boot ⇒ memory + notice);有 SQL 信号 ⇒ mysql", configKey: "dbBackend", resolve: (c) => c.dbBackend }),
     r("DB_QUERY_TIMEOUT_MS", "store", "number", "per-query DB 超时(ms;坏值回默认姿态+warn,绝不 NaN 进 driver)", { derivedDefaultNote: "缺席 ⇒ 池级不设/计数族 30s(按引擎)", configKey: "dbQueryTimeoutMs" }),
-    r("DEFAULT_SCENARIO", "integrations", "string", "出厂缺省场景(编码产品出厂态;通用中性 persona 用 default 显式选回);必须是本部署在册的场景名(内建 ∪ 配置中心声明的),不在册 ⇒ 拒启", { staticDefault: "code", configKey: "defaultScenario" }),
+    r("DEFAULT_SCENARIO", "integrations", "string", "出厂缺省场景(编码产品出厂态;通用中性 persona 用 default 显式选回);必须是本部署在册的场景名(内建 ∪ web-admin 声明的),不在册 ⇒ 拒启", { staticDefault: "code", configKey: "defaultScenario" }),
     r("DELEGATION_MAX_CONCURRENT", "orchestration", "number", "委派入口并发帽", { derivedDefaultNote: "缺席 ⇒ 不铸键,core 自缺省(CC parity 20)" }),
     r("DELEGATION_MAX_PER_SESSION", "orchestration", "number", "委派入口每会话累计帽", { derivedDefaultNote: "缺席 ⇒ 不铸键,core 自缺省(CC parity 200)" }),
     r("DEVICE_DELIVERY_TIMEOUT_MS", "orchestration", "number", "device 车道等在途槽上限(ms;到期 device.busy)", { derivedDefaultNote: "缺席 ⇒ adapter 默认 10s" }),
@@ -401,16 +401,16 @@ export const CONFIG_CATALOG = [
     r("SEMA_NPM_REGISTRY", "orchestration", "url", "SANDBOX_PKG_SOURCE=custom 的显式 npm registry 地址"),
     r("SEMA_PARENT_PID", "limitsHttp", "number", "引擎 parent 监视(壳 pid;被过继走或该 pid 不存在即把引擎标成孤儿——不直接停机,改用 ENGINE_ORPHAN_LINGER_MS 窗走同一条租约自退;0/负数语义完全不同 ⇒ 拒启)", { derivedDefaultNote: "缺席 ⇒ 看门狗不装配", configKey: "parentPid" }),
     r("SEMA_PIP_INDEX", "orchestration", "url", "SANDBOX_PKG_SOURCE=custom 的显式 pip index 地址"),
-    r("SEMA_REGISTRY_ADMIN_TOKEN", "integrations", "secret", "写 center 的管理凭证(仅 boot 上报执行公钥用;刻意不入 ServiceConfig —— 不进 configHash/日志面)", { danger: SEC, scope: "bootstrap-only" }),
-    r("SEMA_REGISTRY_DRY_RUN", "integrations", "boolean", "center 腿 dry-run(拉而不应用)", { staticDefault: "false" }),
-    r("SEMA_REGISTRY_LIVE_URL", "integrations", "url", `fleet 活性组(心跳 / 注销、服务租约 = settings-schema FLEET_LIVE_PATHS)的中心基址:给管理面在就绪门后、活性面另走一条不看就绪的入口的部署。缺席 = SEMA_REGISTRY_URL。${CENTER_BASE_URL_RULE}`),
-    r(CENTER_CREDENTIAL_ENV.token, "integrations", "secret", `center 拉取凭据(值形;与 ${CENTER_CREDENTIAL_ENV.tokenFile} 二选一,都设=拒启)`, { danger: SEC }),
-    r(CENTER_CREDENTIAL_ENV.tokenFile, "integrations", "path", `center 拉取凭据文件(每条中心请求都重读 ⇒ 轮换 / 换账号不重启;与 ${CENTER_CREDENTIAL_ENV.token} 二选一,都设=拒启;内容两种类:裸行 = 静态 bearer / JSON 信封 user-session = 人的登录会话(可续签,S-698);文件不可读 / 为空 = 响亮 + 健康态 unreadable,不当作无凭证;内容读不成 / 多租户读到信封 = 拒启)`, { danger: SEC }),
-    r("SEMA_REGISTRY_URL", "integrations", "url", `sema-registry 地址(设了=remote 配置源开关)。${CENTER_BASE_URL_RULE}`),
-    r("SEMA_REGISTRY_WEB_URL", "integrations", "url", `中心 web 面的固定基址:引擎原样转述到 /health 的 center.webBaseUrl,壳按它拼会话深链(路径归壳)。缺席即缺席(引擎不拼不猜);只在接了中心(SEMA_REGISTRY_URL)时挂。${CENTER_BASE_URL_RULE}`),
-    r("SEMA_REGISTRY_WORKER", "integrations", "string", "本 worker 在 center 的名字(per-worker effective)"),
     r("SEMA_UV_INDEX", "orchestration", "url", "SANDBOX_PKG_SOURCE=custom 的显式 uv index 地址"),
     r("SEMA_UV_PY_MIRROR", "orchestration", "url", "SANDBOX_PKG_SOURCE=custom 的显式 uv python 分发镜像地址"),
+    r(WEB_ADMIN_ENV.adminToken, "integrations", "secret", "写 web-admin 的管理凭证(仅 boot 上报执行公钥用;刻意不入 ServiceConfig —— 不进 configHash/日志面)", { danger: SEC, scope: "bootstrap-only" }),
+    r(WEB_ADMIN_ENV.dryRun, "integrations", "boolean", "web-admin 腿 dry-run(拉而不应用)", { staticDefault: "false" }),
+    r(WEB_ADMIN_ENV.liveUrl, "integrations", "url", `fleet 活性组(心跳 / 注销、服务租约 = settings-schema FLEET_LIVE_PATHS)的 web-admin 基址:给管理面在就绪门后、活性面另走一条不看就绪的入口的部署。缺席 = ${WEB_ADMIN_ENV.url}。传输地址,不参与中心身份互证。${CENTER_BASE_URL_RULE}`),
+    r(WEB_ADMIN_ENV.token, "integrations", "secret", `center 拉取凭据(值形;与 ${WEB_ADMIN_ENV.tokenFile} 二选一,都设=拒启)`, { danger: SEC }),
+    r(WEB_ADMIN_ENV.tokenFile, "integrations", "path", `center 拉取凭据文件(每条中心请求都重读 ⇒ 轮换 / 换账号不重启;与 ${WEB_ADMIN_ENV.token} 二选一,都设=拒启;内容两种类:裸行 = 静态 bearer / JSON 信封 user-session = 人的登录会话(可续签,S-698);文件不可读 / 为空 = 响亮 + 健康态 unreadable,不当作无凭证;内容读不成 / 多租户读到信封 = 拒启)`, { danger: SEC }),
+    r(WEB_ADMIN_ENV.url, "integrations", "url", `web-admin 基址(设了=remote 配置源开关;传输地址 —— 编排器注入的可以是集群内地址;AUTH_BRIDGE_ISSUER 缺席时它也是中心身份)。${CENTER_BASE_URL_RULE}`),
+    r(WEB_ADMIN_ENV.webUrl, "integrations", "url", `web-admin 人用界面的固定基址:引擎原样转述到 /health 的 center.webBaseUrl,壳按它拼会话深链(路径归壳)。缺席即缺席(引擎不拼不猜);只在接了中心(${WEB_ADMIN_ENV.url})时挂;必须与中心身份(AUTH_BRIDGE_ISSUER,缺席 = ${WEB_ADMIN_ENV.url})同主机同端口(http ↔ https 同族),否则拒启。${CENTER_BASE_URL_RULE}`),
+    r(WEB_ADMIN_ENV.worker, "integrations", "string", "本 worker 在 web-admin 上的名字(per-worker effective)"),
     r("SEND_USER_FILE_SANDBOX_PUT_ENDPOINT", "store", "url", "沙箱侧 presigned PUT Host 绑定 endpoint(in-cluster 可用内网面)", { derivedDefaultNote: "缺席 ⇒ publicEndpoint" }),
     r("SEND_USER_FILE_URL_TTL", "store", "number", "公链 TTL(秒;非法值回 0=永久轨,绝不 NaN 进签名)", { staticDefault: "0" }),
     r("SENSITIVE_WRITE_PATTERNS", "approval", "csv", "敏感路径写 deny 集(unset=core 推荐集;显式值整表替换;off/空=关 —— 真放松杆)", { danger: SEC, derivedDefaultNote: "缺席 ⇒ core RECOMMENDED_SENSITIVE_PATTERNS", configKey: "sensitiveWritePatterns" }),
@@ -609,7 +609,7 @@ function valueClassOf(type) {
     return "plain";
 }
 export function buildConfigCatalog(inputs) {
-    const { config, env, boot, knobs, centerDomains, centerManagedKeys, retired } = inputs;
+    const { config, env, boot, knobs, centerDomains, centerManagedKeys } = inputs;
     const knobByName = new Map(knobs.map((k) => [k.name, k]));
     const rows = [...CONFIG_CATALOG]
         .sort((a, b) => (a.name < b.name ? -1 : 1))
@@ -686,7 +686,7 @@ export function buildConfigCatalog(inputs) {
             centerManaged: rows.filter((x) => x.center?.managedNow === true).length,
         },
         rows,
-        retired,
+        retired: buildRetiredEnvWire(),
     };
 }
 //# sourceMappingURL=config-catalog.js.map

package/dist/config-d-migration.d.ts

@@ -0,0 +1,32 @@
+import { type ConfigDirectoryMigration } from "@sema-agent/settings-schema/node";
+/** 一次起服迁移的结果:契约的结果闭集,外加本仓入口的两形(目录不在 ⇒ 不调;调用抛 ⇒ 失败)。纯数据。 */
+export type ConfigDirMigration = {
+    readonly kind: "no-config-dir";
+    readonly dir: string;
+} | {
+    readonly kind: "threw";
+    readonly dir: string;
+    readonly reason: string;
+} | (ConfigDirectoryMigration & {
+    readonly dir: string;
+});
+/**
+ * 对 `<root>/config.d` 的读回面跑一次契约的目录迁移(见文件头)。`root` = 本地配置根(`FileConfigStore` 吃的同一个)。
+ * 不抛:每一形都是一个结果,调用方 {@link logConfigDirMigration}。
+ */
+export declare function migrateLocalConfigDirectory(root: string): Promise<ConfigDirMigration>;
+/** 迁移结果的日志口(logger 的子集)。 */
+export interface ConfigDirMigrationLog {
+    info(msg: string, meta?: Record<string, unknown>): void;
+    warn(msg: string, meta?: Record<string, unknown>): void;
+}
+/**
+ * 一次起服迁移的**唯一**说法(两个入口同调),对契约结果穷举:
+ *  · `applied` ⇒ info `config_dir_migrated`(收据:迁移 id / 文档 / 坐标 / 处置,不带值;写回 / 删除的文件名);
+ *  · `noop` / `no-documents` / 目录不在 ⇒ 不出声(没有东西可迁);
+ *  · `refused` ⇒ warn `config_dir_migration_refused`(一字未写;逐条点名迁移 id、坐标与契约的拒句 —— 读侧随后对这些旧形照旧响亮拒);
+ *  · `unreadable` / 调用抛 ⇒ warn `config_dir_migration_failed`(一字未写或写到一半;原因 —— 坏文件的句子与读腿同一只判官)。
+ *  · `pending` 只在契约的 `check: true` 下出现,本仓从不传 ⇒ 撞上即是接线错,响亮抛。
+ */
+export declare function logConfigDirMigration(log: ConfigDirMigrationLog, m: ConfigDirMigration): void;
+//# sourceMappingURL=config-d-migration.d.ts.map

package/dist/config-d-migration.js

@@ -0,0 +1,59 @@
+import { stat } from "node:fs/promises";
+import { join } from "node:path";
+import { RETIRED_DOMAINS, formatConfigPath, isRetiredDomainName } from "@sema-agent/settings-schema";
+import { PORTABLE_DOMAINS, migrateConfigDirectory, nodeConfigDirectoryIo } from "@sema-agent/settings-schema/node";
+const READ_BACK_DOCUMENTS = [...PORTABLE_DOMAINS, ...Object.keys(RETIRED_DOMAINS).filter(isRetiredDomainName)];
+const errnoOf = (err) => (err instanceof Error && "code" in err && typeof err.code === "string" ? err.code : undefined);
+export async function migrateLocalConfigDirectory(root) {
+    const dir = join(root, "config.d");
+    try {
+        if (!(await stat(dir)).isDirectory())
+            return { kind: "no-config-dir", dir };
+    }
+    catch (err) {
+        if (errnoOf(err) === "ENOENT")
+            return { kind: "no-config-dir", dir };
+    }
+    try {
+        return { ...(await migrateConfigDirectory(dir, { documents: READ_BACK_DOCUMENTS, io: nodeConfigDirectoryIo })), dir };
+    }
+    catch (err) {
+        return { kind: "threw", dir, reason: `${err instanceof Error ? err.message : String(err)}${errnoOf(err) !== undefined ? ` (${errnoOf(err)})` : ""}` };
+    }
+}
+export function logConfigDirMigration(log, m) {
+    switch (m.kind) {
+        case "no-config-dir":
+        case "no-documents":
+        case "noop":
+            return;
+        case "applied":
+            log.info("config_dir_migrated", {
+                dir: m.dir,
+                receipts: m.applied.map((r) => ({ migration: r.migration, document: r.document, path: formatConfigPath(r.path), appliedAs: r.appliedAs })),
+                written: m.written,
+                removed: m.removed,
+                note: "settings-schema one-time migrations rewrote the documents the local reader reads, once (idempotent: the next run changes nothing); files outside the reader's coverage were not touched",
+            });
+            return;
+        case "refused":
+            log.warn("config_dir_migration_refused", {
+                dir: m.dir,
+                refusals: m.refused,
+                why: m.why,
+                note: "nothing was written — the named coordinates cannot be migrated automatically; the reader refuses those old forms (each refusal names its migration id) until they are fixed by hand",
+            });
+            return;
+        case "unreadable":
+        case "threw":
+            log.warn("config_dir_migration_failed", { dir: m.dir, reason: m.reason, note: "the one-time migration did not complete — the reader judges the files as they are (old forms are refused loudly)" });
+            return;
+        case "pending":
+            throw new Error(`config.d migration: the contract answered "pending" (check-only) but this engine never asks for a check-only run — wiring error at ${m.dir}`);
+        default: {
+            const unhandled = m;
+            throw new Error(`config.d migration: unknown result ${JSON.stringify(unhandled)}`);
+        }
+    }
+}
+//# sourceMappingURL=config-d-migration.js.map

package/dist/config-invariants.d.ts

@@ -6,14 +6,14 @@
  * 打开、bake runner 凭据被删、直连门半开、reaper 追杀活 run……),而进程照跑。逐条在 stage 里手抄一遍
  * 是必错的形(抄漏一条没人会发现),所以本文件是**唯一**的表:
  *
- *  · stage 面(config-center):批1 的任一键触发**全表**校验,过不了 ⇒ 整批拒 + 旧值继续服务 + 铸
+ *  · stage 面(web-admin):批1 的任一键触发**全表**校验,过不了 ⇒ 整批拒 + 旧值继续服务 + 铸
  *    `restartReason`(运维据此知道「这个变更只能重启生效」,而不是被静默吞掉)。
  *  · boot 面:每条 throw 点旁挂 `CROSS-INVARIANT:<id>` 锚,由 test/config-hot/batch1-cross-invariants.test.ts
  *    双向对表 —— 新增一条拒启却不登记 = 门红。boot 的判据文本与拒启行为**逐字不变**(本批不改拒启),
  *    表在这一侧承担的是「不许有表外不变量」的登记职责。
  *
  * 🔴 **报文次序**(车PI 验修轮 F7,如实登记):boot 期一次只报一条。条目按 `bootAnchor` 分住几个区 —— `config.ts` 的 loadConfig 区与
- * `boot/stage-01-config.ts`(第 1 段)、`boot/execution-lane.ts`(第 2 段开头的车道合成步)、`boot/stage-02-registry-pull.ts`(第 2 段
+ * `boot/stage-01-config.ts`(第 1 段)、`boot/execution-lane.ts`(第 2 段开头的车道合成步)、`boot/stage-02-web-admin-pull.ts`(第 2 段
  * 目录应用之后)。**跨区次序 = 段序,区内次序 = 表序**:同时撞上两个区的两条,先到的区先报,与表序无关(例:`LEADER_ENABLED` + host
  * + 无 SQL 先报 loadConfig 区的 `leader-durable-store`,改完再在合成步撞 `leader-host-lane`)。锚点按「读什么键、那个键在哪一段定形」定,
  * 不为报文次序挪区 —— 多一次往返,没有安全后果。
@@ -34,9 +34,9 @@ import type { ServiceConfigFlat } from "./config-types.js";
  */
 export declare const LIVENESS_HEARTBEAT_MS = 30000;
 /** 闭集:新增一条不变量必须在这里加词(拼错 = 编译红,而不是运行期悄悄不判)。 */
-export type CrossInvariantId = "run-stale-heartbeat" | "bind-posture" | "bake-runner-credential" | "direct-door-anchors" | "operator-principals-required" | "bake-operator-principals" | "sensitive-write-patterns" | "leader-host-lane" | "multi-tenant-shared-lane" | "leader-durable-store" | "device-durable-store" | "device-durable-approval" | "model-provider-word" | "gateway-url-userinfo" | "model-route-endpoint" | "default-model-resolvable" | "refused-names-not-minted" | "require-execution-lane";
+export type CrossInvariantId = "run-stale-heartbeat" | "bind-posture" | "bake-runner-credential" | "direct-door-anchors" | "operator-principals-required" | "bake-operator-principals" | "sensitive-write-patterns" | "leader-host-lane" | "multi-tenant-shared-lane" | "leader-durable-store" | "device-durable-store" | "device-durable-approval" | "model-provider-word" | "gateway-url-userinfo" | "model-route-endpoint" | "default-model-resolvable" | "refused-names-not-minted" | "require-execution-lane" | "center-one-identity";
 /** 表读的键集(取自平铺配置型 ⇒ 键名/类型永不与真配置漂)。 */
-export type CrossInvariantView = Readonly<Pick<ServiceConfigFlat, "runStaleSec" | "authToken" | "authTokens" | "allowUnauthedWrites" | "imageBakes" | "directApprovalDoor" | "durableApproval" | "approvalHmacKeys" | "principalJwtPubkeys" | "principalJwtIss" | "principalJwtAud" | "requirePrincipal" | "operatorPrincipals" | "sensitiveWritePatterns" | "leaderEnabled" | "remoteExec" | "requireExecutionLane" | "dbBackend" | "tidb" | "pg" | "envModel" | "gatewayBaseUrl" | "gatewayFallbackUrls" | "anthropic" | "models" | "modelRefusals" | "tiers">>;
+export type CrossInvariantView = Readonly<Pick<ServiceConfigFlat, "runStaleSec" | "authToken" | "authTokens" | "allowUnauthedWrites" | "imageBakes" | "directApprovalDoor" | "durableApproval" | "approvalHmacKeys" | "principalJwtPubkeys" | "principalJwtIss" | "principalJwtAud" | "requirePrincipal" | "operatorPrincipals" | "sensitiveWritePatterns" | "leaderEnabled" | "remoteExec" | "requireExecutionLane" | "dbBackend" | "tidb" | "pg" | "envModel" | "gatewayBaseUrl" | "gatewayFallbackUrls" | "anthropic" | "models" | "modelRefusals" | "tiers" | "authBridgeIssuer" | "webAdmin">>;
 export interface CrossInvariantInput {
     /** 现役配置(boot 期 = 候选自身)。 */
     readonly live: CrossInvariantView;
@@ -84,6 +84,16 @@ export declare function bakeRunnerCredentialRefusal(v: Pick<CrossInvariantView,
  * 「多副本」在 config 层判不了(副本数不是本进程的知识),可判的**代理**就是 durable 前提本身。
  */
 export declare function leaderDurableStoreRefusal(v: Pick<CrossInvariantView, "leaderEnabled" | "dbBackend">): string | undefined;
+/**
+ * `center-one-identity`(7.124.0)—— **中心只有一个身份**。引擎接的 web-admin 由三只旋钮描述:基址(`WEB_ADMIN_ENV.url`,传输地址)、
+ * 鉴权桥 issuer(`AUTH_BRIDGE_ISSUER`,缺席 = 基址 —— {@link authBridgeIssuerOf} 一只取值口)、web 基址(`WEB_ADMIN_ENV.webUrl`,上
+ * `/health.center.webBaseUrl`)。壳先判 `center.issuer` 是不是自己登录的那个中心,再按 `center.webBaseUrl` 拼会话深链 ⇒ 两者不是同一个中心
+ * = 把人带到另一个中心。规则:**web 基址必须落在身份(issuer)的 origin 族**。**origin 族 = `URL.host` 相同**(主机 + 非缺省端口;scheme 不比 ⇒ http ↔ https 同族:TLS 终结在
+ * 前面的部署两种写法都见)。判不出主机(issuer 不是 http(s) 的层级式 URL)= 证不了同一个中心 ⇒ 同样拒(fail-closed)。
+ * 基址 / 活性基址是**传输地址**,不参与:编排器给 worker 注入的基址是集群内地址,issuer 是对外域名 —— 两者天然不同主机,拿基址互证会拒掉
+ * 标准部署形。没有 web 基址 ⇒ 无可互证,过。
+ */
+export declare function centerIdentityRefusal(v: Pick<CrossInvariantView, "authBridgeIssuer" | "webAdmin">): string | undefined;
 export declare const CONFIG_CROSS_INVARIANTS: readonly CrossInvariant[];
 /**
  * 按 id 取**一条**(S-157②:boot 面的单源化出口)。

package/dist/config-invariants.js

@@ -3,6 +3,9 @@ import { modelProviderRefusal } from "./model-provider.js";
 import { modelRouteUrlRefusal } from "./model-route-url.js";
 import { modelRouteEndpointRefusal } from "./model-route-endpoint.js";
 import { defaultModelRefusal, refusedNameMintedRefusal } from "./model-entry-refusal.js";
+import { WEB_ADMIN_ENV, httpUrlFlaws } from "@sema-agent/settings-schema";
+import { authBridgeIssuerOf } from "./auth-bridge.js";
+import { buildDisplaySafeUrl } from "./trace/redact.js";
 import { executionLaneCaps, executionLaneOf, executionLaneRequiredRefusal, laneCapabilityHolds, REMOTE_EXEC_PROVIDER_WORDS } from "./execution-lane-caps.js";
 export const LIVENESS_HEARTBEAT_MS = 30_000;
 const anyServiceAuth = (v) => Boolean(v.authToken) || Object.keys(v.authTokens ?? {}).length > 0;
@@ -61,6 +64,25 @@ export function leaderDurableStoreRefusal(v) {
             "(#193 车4 件2 / staleness ledger P1-9+P1-10 boot invariant)"
         : undefined;
 }
+export function centerIdentityRefusal(v) {
+    const webBaseUrl = v.webAdmin?.webBaseUrl;
+    if (webBaseUrl === undefined)
+        return undefined;
+    const identity = authBridgeIssuerOf(v);
+    if (identity === undefined)
+        return undefined;
+    const hostOf = (raw) => (httpUrlFlaws(raw, []).length === 0 ? new URL(raw).host : undefined);
+    const issuerHost = hostOf(identity.issuer);
+    const webHost = hostOf(webBaseUrl);
+    if (issuerHost !== undefined && issuerHost === webHost)
+        return undefined;
+    const issuerSeat = identity.source === "explicit" ? "AUTH_BRIDGE_ISSUER" : `AUTH_BRIDGE_ISSUER (unset, so ${WEB_ADMIN_ENV.url})`;
+    const issuerShown = issuerHost === undefined ? `${buildDisplaySafeUrl(identity.issuer)}, which is not an http(s) URL with a host` : `${buildDisplaySafeUrl(identity.issuer)} (host ${issuerHost})`;
+    return (`${WEB_ADMIN_ENV.webUrl}=${buildDisplaySafeUrl(webBaseUrl)} (host ${webHost ?? "?"}) is not on this engine's web-admin identity — ${issuerSeat} = ${issuerShown}. ` +
+        `A client checks the reported issuer against the web-admin it signed in to and then links sessions under the reported web console base, so both must name ` +
+        `the same web-admin: same host and port (http and https on one host count as one). Set ${WEB_ADMIN_ENV.webUrl} to that web-admin's console, set ` +
+        `AUTH_BRIDGE_ISSUER to the web-admin's public origin, or unset ${WEB_ADMIN_ENV.webUrl}. Refusing to boot.`);
+}
 export const CONFIG_CROSS_INVARIANTS = [
     {
         id: "run-stale-heartbeat",
@@ -217,16 +239,23 @@ export const CONFIG_CROSS_INVARIANTS = [
         id: "default-model-resolvable",
         keys: ["models", "modelRefusals"],
         restartReason: "default-model",
-        bootAnchor: { file: "src/boot/stage-02-registry-pull.ts", marker: "CROSS-INVARIANT:default-model-resolvable" },
+        bootAnchor: { file: "src/boot/stage-02-web-admin-pull.ts", marker: "CROSS-INVARIANT:default-model-resolvable" },
         check: ({ live, next }) => (next.models === live.models ? undefined : defaultModelRefusal(next, "catalog")),
     },
     {
         id: "refused-names-not-minted",
         keys: ["models", "tiers", "modelRefusals"],
         restartReason: "refused-model-name",
-        bootAnchor: { file: "src/boot/stage-02-registry-pull.ts", marker: "CROSS-INVARIANT:refused-names-not-minted" },
+        bootAnchor: { file: "src/boot/stage-02-web-admin-pull.ts", marker: "CROSS-INVARIANT:refused-names-not-minted" },
         check: ({ live, next }) => (next.models === live.models ? undefined : refusedNameMintedRefusal(next)),
     },
+    {
+        id: "center-one-identity",
+        keys: ["authBridgeIssuer", "webAdmin"],
+        restartReason: "center-identity",
+        bootAnchor: { file: "src/config.ts", marker: "CROSS-INVARIANT:center-one-identity" },
+        check: ({ next }) => centerIdentityRefusal(next),
+    },
 ];
 export function crossInvariant(id) {
     const inv = CONFIG_CROSS_INVARIANTS.find((i) => i.id === id);