@sema-agent/server 7.123.0 → 7.124.1

package/dist/config-types.d.ts

@@ -1,5 +1,5 @@
 /** [ref] A1: the ServiceConfig TYPE face, split out of the 1.8k-line loader module (config.ts)
- *  so pure-type consumers (http/server, plugins/*, hooks/hook-llm, security, brain, sema-registry)
+ *  so pure-type consumers (http/server, plugins/*, hooks/hook-llm, security, brain, web-admin)
  *  depend on a LEAF with zero runtime edges — this is the substantive step that dissolves the
  *  type-closed edges into config.ts (lens2 §A). TYPES ONLY: loadConfig and every runtime value stay
  *  in config.ts, which re-exports these names so existing `from "./config.js"` importers keep
@@ -9,7 +9,7 @@ import type { ReadFaceSource } from "./read-face-posture.js";
 import type { PostureSource } from "./posture-source.js";
 import type { SealedCustodyPoison } from "./key-resolver.js";
 import type { ModelEntryRefusal } from "./model-entry-refusal.js";
-import type { DroppedCatalogEntry } from "./config-center/read-warnings.js";
+import type { DroppedCatalogEntry } from "./web-admin-client/read-warnings.js";
 import type { A2aServerSpec, CompliancePosture, CrossSessionDialogExpiry, CrossSessionInboundSetting, FileHistoryRetentionPolicy, LockedKey, McpServerSpec, Model, ModelRoles, RetentionPolicy, ShellGateDoctrine, WriteProtectedEntry } from "@sema-agent/core";
 import type { ApprovalHmacKey, PrincipalJwtKey } from "./auth-keys.js";
 import type { ElicitationThrottle } from "./elicitation.js";
@@ -21,6 +21,7 @@ import type { CenterCredentialSource } from "./center-credential.js";
 import type { GitApiKind } from "./git-api-kind.js";
 import type { MemoryEngineBackend, StoreBackend as StoreBackendWord } from "@sema-agent/settings-schema/execution-lanes";
 import { DRAIN_GRACE_FLOOR_MS } from "@sema-agent/settings-schema/fleet";
+import type { AtMention } from "@sema-agent/settings-schema";
 /** [ref]:记忆向量面的 embedder 坐标(env `MEMORY_EMBEDDER_*` 解析结果;单一属主 = 本类型,
  *  `plugins/memory-embedder.ts` 的工厂直接消费它,不复制形状)。语义与三问见
  *  {@link ServiceConfigFlat.memoryEmbedder}。纯数据 —— 端点原文照存(拼 `/embeddings` 是 transport
@@ -50,8 +51,8 @@ export type TaskWriteFaceEscalation = (typeof TASK_WRITE_FACE_ESCALATIONS)[numbe
 export declare const RETENTION_MODES: readonly ["audit-only", "enforce"];
 export type RetentionMode = (typeof RETENTION_MODES)[number];
 /**
- * S-841 —— `CONFIG_PROVIDER` 的词表闭集(**属主在此**:`loadConfig` 的唯一读点、config-center 工厂、执行车道合成步、
- * 配置目录的 enum 行共读这一份)。缺席 / 空串 = 未表态(配了 `SEMA_REGISTRY_URL` ⇒ 中心,否则纯 env);两词之外 ⇒ 拒启。
+ * S-841 —— `CONFIG_PROVIDER` 的词表闭集(**属主在此**:`loadConfig` 的唯一读点、web-admin 工厂、执行车道合成步、
+ * 配置目录的 enum 行共读这一份)。缺席 / 空串 = 未表态(配了 `SEMA_WEB_ADMIN_URL` ⇒ 中心,否则纯 env);两词之外 ⇒ 拒启。
  * 修前是开放词:认不出的词被配置源判官当 `local`、被隐式 host 臂当「不是 local」,一个旋钮在一个进程里有两种读法。
  */
 export declare const CONFIG_PROVIDER_WORDS: readonly ["local", "remote"];
@@ -128,7 +129,7 @@ export declare const DRAIN_SECOND_SIGNAL_MIN_GAP_DEFAULT_MS = 250;
  * 住在本叶(而不在 `fleet/drain-entry.ts`):`config.ts` 读它,而 drain-entry 值引 `plugins/store-contracts.ts`,config 不值引 plugins 层。
  */
 export declare function fleetScopeOf(raw: string | undefined): string;
-/** 中心基址三席(`SEMA_REGISTRY_URL` / `SEMA_REGISTRY_LIVE_URL` / `SEMA_REGISTRY_WEB_URL`)与公告地址的形句 —— 判官 `config-center/center-request.ts` `pathBaseUrlRefusal` 一只(形判 = `url-shape.ts`),配置目录四行同读这一句。 */
+/** 中心基址三席(`SEMA_WEB_ADMIN_URL` / `SEMA_WEB_ADMIN_LIVE_URL` / `SEMA_WEB_ADMIN_WEB_URL`)与公告地址的形句 —— 判官 `web-admin-client/center-request.ts` `pathBaseUrlRefusal` 一只(形判 = settings-schema `httpUrlFlaws`),配置目录四行同读这一句。 */
 export declare const CENTER_BASE_URL_RULE = "\u8BBE\u4E86\u5C31\u5FC5\u987B\u662F\u53EF\u89E3\u6790\u7684 http(s) URL,\u4E14\u4E0D\u5E26\u51ED\u636E / query / fragment(\u57FA\u5740\u540E\u9762\u8981\u62FC\u8DEF\u5F84);\u574F\u5F62\u62D2\u542F(\u6CA1\u63A5\u4E2D\u5FC3\u4E5F\u62D2),\u62D2\u53E5\u53EA\u70B9\u540D\u89C4\u5219,\u4E0D\u56DE\u663E scheme";
 /** 编排器片 2:`FLEET_LEASE_OUTAGE_MAX_MS` 的缺省(24 h)—— 中心 / 库故障、中心降级在今天都靠 LKG 无限期容忍,10 分钟级的窗会把它们变成数据面停服。 */
 export declare const FLEET_LEASE_OUTAGE_MAX_DEFAULT_MS = 86400000;
@@ -266,7 +267,7 @@ export interface MemoryConsolidationDriverConfig {
      */
     autoRunOnRecommendation?: boolean;
 }
-/** A sema-registry MCP server resolved to a core spec (env-NAME refs already → real values) plus the
+/** A web-admin MCP server resolved to a core spec (env-NAME refs already → real values) plus the
  *  scenarios it applies to (empty = all). `resolveSpec` filters by scenario and passes `spec` to core. */
 export interface ScopedMcpServer {
     scenarios: string[];
@@ -532,7 +533,7 @@ export interface ServiceConfigFlat {
         cooldownMs: number;
     };
     /** Default model the service runs tasks on. **活的** —— center 热应用会整只换掉它
-     *  (`config.model = config.models.default!`,config-center/apply-effective.ts 的 commit 段)。 */
+     *  (`config.model = config.models.default!`,web-admin-client/apply-effective.ts 的 commit 段)。 */
     model: Model;
     /**
      * S-188 —— **boot 期 env 派生的那只模型**,`loadConfig()` 铸一次,此后**永不换**(与 `model` 在 boot
@@ -552,7 +553,7 @@ export interface ServiceConfigFlat {
      *  Used to resolve roles and to allow-list `@-model` mentions. */
     models: Record<string, Model>;
     /** Per-model API-key override: catalog model NAME → the env var NAME holding that model's key (from
-     *  sema-registry `apiKeyEnv`). Drives the spec's `getApiKeyAndHeaders` so each model/rung authenticates
+     *  web-admin `apiKeyEnv`). Drives the spec's `getApiKeyAndHeaders` so each model/rung authenticates
      *  with its own upstream account; a model absent here falls back to the gateway key. Env path: empty. */
     modelApiKeyEnv: Record<string, string>;
     /** sealed-box 托管密钥的解封产物:catalog model NAME → PLAINTEXT api key(`ModelEntry.
@@ -605,21 +606,21 @@ export interface ServiceConfigFlat {
     /** Role → model map (1.24): `subagent`/`summarize` → the cheap model when `MODEL_CHEAP_ID` is set
      *  (council lenses + compaction get cheap), `default`/`team`/`synthesize` stay on the main model. */
     roles: ModelRoles;
-    /** [ref] / [ref] —— **`@`-mention 允许名单**(registry-core `models.atModelAllowlist` 的服务端消费面)。
-     *  语义(registry-core `ModelsDomain.atModelAllowlist` 的 JSDoc 同源):**缺席/空 = 全部启用模型都可被用户点选**;非空 = 用户
-     *  逐 turn 选择通道只能落在名单内的 catalog name 上。
+    /** [ref] / [ref] —— **「`@` 能点名哪些模型」**(settings-schema 11 `models.atMention` 的服务端消费面;三态闭集
+     *  `{mode:"all"}` / `{mode:"none"}` / `{mode:"only", models}`,形与缺省读法的属主是契约,本仓读法 = `model-select.ts`
+     *  `readAtMention` / `DEFAULT_AT_MENTION`,判据 = `isAtMentionable`)。
      *
      *  辖域(设计稿 233 v2 终裁,施工侧成文):
      *   - **受限**=用户通道:`body.model` / `settings.model`(同属请求体,untrusted) / objective 内联
      *     `@name` / `body.compactionModel` / `POST /v1/side-query` 的 `body.model`;
-     *   - **不受限**=operator 配置通道:`models.roles` / `models.default` / 档位绑定表 / side-query 的
-     *     `modelRole`(角色表选路)——名单管「用户可点什么」,不管「operator 配什么」。
+     *   - **不受限**=operator 配置通道:`models.roles` / 档位绑定表 / side-query 的 `modelRole`(角色表选路)
+     *     —— 它管「用户可点什么」,不管「operator 配什么」。
      *   - **提交时门**:core 运行时路由(degrade / cascade / roles 解析)**不在射程**——那些是引擎按配置
      *     自己走的路,不是一次用户选择(诚实声明,非运行时执法)。
      *
-     *  NO env source —— env lane 恒空(INERT=全放行,ship-dark 缺省=旧行为);只由 applyEffective 从
-     *  `models.atModelAllowlist` 整表重算填充(**非粘**:center 撤名单 ⇒ 本表清空 ⇒ 回全放行)。 */
-    atModelAllowlist: readonly string[];
+     *  NO env source —— env lane = 契约缺省(`{mode:"all"}`);只由 applyEffective 从 `models.atMention` 整只重算填充
+     *  (**非粘**:中心改回 `all` ⇒ 本席回 `all`),`only` 的名在 stage 期按本世代可用目录收窄(settings-schema `narrowAtMention`)。 */
+    atMention: AtMention;
     /**
      * Session backend: in-memory (default), tidb (durable L1 event-log center), or `auto` — probe a
      * configured DB at startup and fall back to in-memory if it's unreachable (for local/intranet binaries:
@@ -786,7 +787,7 @@ export interface ServiceConfigFlat {
      *  core 侧 `prepareConfigDoors` 另有同判门(`config.memory_capture_policy`),两道同向不冲突。
      *
      *  🔴 **`governed` 的半配置拒启**:该姿态要求本部署有 per-principal verdict 源。源**两条**(析取,[ref] 起):
-     *  SQL 后端上的 `memory_optout_grant` 表(S-2),或非 dry-run 的 config center 发 `EntitlementRuntimeCaps.allowMemoryOptOut`
+     *  SQL 后端上的 `memory_optout_grant` 表(S-2),或非 dry-run 的 web-admin 发 `EntitlementRuntimeCaps.allowMemoryOptOut`
      *  (settings-schema 1.4.0 到货)。两源皆无 ⇒ 每个 opt-out 声明都被 core 拒且没人知道为什么 ⇒
      *  `boot/runtime-caps.ts` 的 `assertMemoryCapturePolicyWirable` 在启动期拒启(与 consolidation 阀门 D1 同姿态)。
      *  ⚠️ [ref]:center 那一臂只证「源在场」,不证 center 会**发**这个可选键 —— center-only 的部署起动后仍可能次次拒,
@@ -819,7 +820,7 @@ export interface ServiceConfigFlat {
     };
     /** 件A 单机形目录:env `MEMORY_ORG_DIRECTORY_JSON` 原文(`Record<principal, Record<org:scope, {write?}>>`)。
      *  config 解析期即整段校验(parseOrgDirectoryStatic,fail-loud);此处存**原文**(config=纯数据,
-     *  Map 在装配点重建)。与 config-center 目录腿互斥的裁决在装配点(两者都在=center 腿胜,env 表忽略
+     *  Map 在装配点重建)。与 web-admin 目录腿互斥的裁决在装配点(两者都在=center 腿胜,env 表忽略
      *  并 warn——授权面不做双源合并)。 */
     memoryOrgDirectoryJson?: string;
     /** 件A 目录 granted(含负结果)缓存 TTL(ms)。新任务/新 resume 腿的准入判决滞后上限=此值(「TTL 即
@@ -983,15 +984,15 @@ export interface ServiceConfigFlat {
         /** Base commit/ref for every worktree (default core's `HEAD` at creation time). */
         commit?: string;
     };
-    /** MCP servers from sema-registry (`/effective.mcp`), resolved at startup (env-NAME refs → values) and
-     *  filtered per scenario in `resolveSpec`. Not env-derived — populated by the sema-registry adapter when
+    /** MCP servers from web-admin (`/effective.mcp`), resolved at startup (env-NAME refs → values) and
+     *  filtered per scenario in `resolveSpec`. Not env-derived — populated by the web-admin adapter when
      *  present (restart-to-apply, like models/roles); undefined = no center MCP (scenarios use no MCP).
      *  Carries both the mounted list and the full declared-name set — see {@link CenterMcp}. */
     mcpServers?: CenterMcp;
-    /** DESIGN-269 §2.1 —— A2A peers from the config center (`/effective.a2a`), resolved at startup
+    /** DESIGN-269 §2.1 —— A2A peers from the web-admin (`/effective.a2a`), resolved at startup
      *  (header-NAME refs → values) and filtered per scenario in `resolveSpec` (`a2aForScenario`). Same
      *  posture as {@link mcpServers}: not env-derived (no A2A_* env leg — a peer is a structured record,
-     *  not a scalar), populated by the config-center adapter when present, restart-to-apply.
+     *  not a scalar), populated by the web-admin adapter when present, restart-to-apply.
      *  undefined = no center peers ⇒ **the whole leg does not exist** for a task (`TaskSpec.a2a` stays
      *  absent unless a single-user caller injects `body.a2aPeers`). */
     a2aPeers?: ScopedA2aPeer[];
@@ -1012,7 +1013,7 @@ export interface ServiceConfigFlat {
      *  = any MySQL-protocol server — MySQL, TiDB, MariaDB — over the same mysql2 pool; `pg` (PostgreSQL
      *  dialect) reads `pg` below. [ref]/[ref]B-3(5.0.0):the env value `tidb` and the TIDB_* coord names
      *  are RETIRED — `tidb` is rejected by the enum and any TIDB_* env in place refuses to start with the
-     *  MYSQL_* replacement named (see RETIRED_ENVS in config.ts). `mysql` reads MYSQL_* coords only.
+     *  MYSQL_* replacement named (see settings-schema `RETIRED_ENVS`). `mysql` reads MYSQL_* coords only.
      *  TiDB itself stays fully supported (any MySQL-protocol engine works — memory no longer needs a VECTOR
      *  column since [ref] moved it onto the file engine). Env: DB_BACKEND. */
     dbBackend: StoreBackendWord;
@@ -1162,11 +1163,11 @@ export interface ServiceConfigFlat {
      *  (半配置绕行=隐藏入口,刻意优先级)。 */
     allowUnauthedWrites?: boolean;
     /** Optional READ-ONLY token that ALSO authorizes GET /metrics + /metrics/summary (in addition to
-     *  authToken). Set the SAME value fleet-wide so a control plane (sema-registry) can pull every worker's
+     *  authToken). Set the SAME value fleet-wide so a control plane (web-admin) can pull every worker's
      *  metrics with ONE token it holds — without ever holding each worker's full `authToken`. */
     metricsToken?: string;
     /** Read-only Task Trace API token (S1). Like `metricsToken` but for GET /v1/tasks[/:id/turns|/stream] — lets
-     *  sema-registry pull worker traces fleet-wide with ONE read-only token, never holding each worker's full
+     *  web-admin pull worker traces fleet-wide with ONE read-only token, never holding each worker's full
      *  `authToken`. Read-only: cannot run tasks or change config. `TRACE_TOKEN`. */
     traceToken?: string;
     /** CORS v2(2026-07-11):`CORS_ORIGIN` 接受 CSV **白名单**。单值=v1 兼容
@@ -1190,13 +1191,13 @@ export interface ServiceConfigFlat {
     requirePrincipal: boolean;
     /** Runtime governance "second baton" (center §10): operator autonomy mode, expanded TIGHTEN-ONLY onto each
      *  task's TaskSpec (`read-only`/`plan` → read-only hands, `ask` → shellGate always, `auto`/unset → no extra
-     *  tightening). Per-request HOT (read live in resolveSpec); primarily sema-registry-managed, `AUTONOMY` env for
+     *  tightening). Per-request HOT (read live in resolveSpec); primarily web-admin-managed, `AUTONOMY` env for
      *  the env/local path. See runtime-governance.ts. undefined = unmanaged. */
     autonomy?: Autonomy;
     /** Runtime governance "second baton" (center §10): per-command coarse name-level rules, compiled into a
      *  `combinePolicies`-layered ToolPolicy on top of the deployment baseline (deny-wins, tighten-only). COARSE
      *  filter, NOT a sandbox (sh -c/$()/pipes bypass argv[0] → fail toward ask). Per-request HOT; sourced from
-     *  sema-registry `EffectiveConfig.runtime` (structured config, not an env scalar). undefined = unmanaged. */
+     *  the `governance` domain of the effective config (structured config, not an env scalar). undefined = unmanaged. */
     commandPolicy?: CommandRule[];
     /**
      * [ref] 件B —— 本部署的**合规档位**(core `RunnerDeps.compliancePostureResolver` 的供数)。
@@ -1354,16 +1355,16 @@ export interface ServiceConfigFlat {
      * 三问(7.117.0 语义变宽):谁需要 = 没有请求体的腿(`run-local` / leader)上接了 MCP 服务器、或想一句话放掉自家某只工具的运维;谁受伤 = 表里写了内置工具名的部署
      * (7.115.0–7.116.x 本键只回答「没人表态」,`Bash` / `Write` 写进来什么也不放;本版起这两只不再问);补偿 = 起服行 `approval_grant_in_force` 的 note 写着当前效果、
      * `GET /v1/diagnostics/wiring` 的 `serverGates.approvalGrant`、`MIGRATION.md` 升级前必读一段;要某只工具必须问,用上面那几只本键清不掉的旋钮。
-     * v1 只有 env 一个写入通道(无 config-center 座位,不进 settings-schema)= 进程常量,与 Runner 席位的寿命一致。空表 = 席位缺席(引擎读作「部署没有 allow 规则」)。
+     * v1 只有 env 一个写入通道(无 web-admin 座位,不进 settings-schema)= 进程常量,与 Runner 席位的寿命一致。空表 = 席位缺席(引擎读作「部署没有 allow 规则」)。
      */
     approvalGrant: string[];
     /** [ref] D-G (HMAC = integrity, not identity; ✅ WIRED — the "SCAFFOLD, not yet wired" note here was STALE,
      *  corrected 2026-07-25: consumed by `verifyDirectDoorProof` → `verifyApprovalHmac`, reached from the live decide
      *  routes — the two `verifyDirectDoorProof(` call sites in `http/routes/approvals-assistant.ts`): the
-     *  sema-registry-managed, ROTATING key-set used to verify an
+     *  web-admin-managed, ROTATING key-set used to verify an
      *  approval-decision envelope's integrity on a direct-connect door. Empty (unset `APPROVAL_HMAC_KEYS`) ⇒ D-G
      *  inactive (BFF-minted-principal is the only /decide door — back-compat), which is why "wired but off" is the
-     *  accurate description of every stock deployment. sema-registry mints + rotates the set; the shape is
+     *  accurate description of every stock deployment. web-admin mints + rotates the set; the shape is
      *  provisional (ASK-CENTER-2026-06-17). */
     approvalHmacKeys: ApprovalHmacKey[];
     /** [ref] D-G: open the DIRECT-connect /decide door (a CLI/desktop client without the BFF). When true, this
@@ -1379,7 +1380,7 @@ export interface ServiceConfigFlat {
     principalJwtIss?: string;
     principalJwtAud?: string;
     /** S-591:registry SSO-JWT 的**显式** issuer(`AUTH_BRIDGE_ISSUER`)。
-     *  🔴 **只是显式 env,不含 boot 期那条 `?? configCenter.baseUrl` 回退**(回退仍在
+     *  🔴 **只是显式 env,不含 boot 期那条 `?? webAdmin.baseUrl` 回退**(回退仍在
      *  `boot/stage-09-leader.ts` 的桥装配处)。唯一消费方是桥;S-671([ref] ①)起它**不是**托管证据 ——
      *  显式与回退 issuer 在租户轴上同判(理由见 `hosted-posture.ts`)。 */
     authBridgeIssuer?: string;
@@ -1972,7 +1973,7 @@ export interface ServiceConfigFlat {
     readFace?: "open" | "roots";
     /** S-167:上面那一档**是谁定的**(闭集四词,见 `read-face-posture.ts`)。不变量:
      *  `readFace === undefined` ⟺ `readFaceSource === "engine-default"`。
-     *  🔴 承重面**不是**装饰:`config-center/read-face.ts` 的「env 恒赢」逐键判据读的就是它(修前读的是
+     *  🔴 承重面**不是**装饰:`web-admin-client/read-face.ts` 的「env 恒赢」逐键判据读的就是它(修前读的是
      *  「键在不在场」这个代理,posture 会铸键 ⇒ 代理当场失真,center 的 face 会被从没设过 env 的机器挡掉)。 */
     readFaceSource: ReadFaceSource;
     /** S-591(7.95.0,车LT):任务层**掀开写围栏**这条声明的**运维天花板档位**(`TASK_WRITE_FACE_ESCALATION`)。
@@ -2018,10 +2019,10 @@ export interface ServiceConfigFlat {
      *  ⇒ 引擎读字面 `~/.sema`(与 LKG / skill 缓存 / scheduler 店的缺省落点同一处)。读法单一属主 `sema-config-dir.ts`。 */
     agentConfigDir?: string;
     /** LKG 落盘路径的覆写(`CONFIG_LKG_PATH`,绝对路径;单一读法 `config-lkg.ts` `lkgPathOverrideOf`)。缺席 = LKG 落在配置根下按箱派生。
-     *  读者:LKG 的落盘 / 读回(`boot/config-center.ts`)与读拒行(部署姿态座席族 —— LKG 在哪,读拒就守哪,`lkgReadDenyRows`)。 */
+     *  读者:LKG 的落盘 / 读回(`boot/web-admin.ts`)与读拒行(部署姿态座席族 —— LKG 在哪,读拒就守哪,`lkgReadDenyRows`)。 */
     configLkgPath?: string;
     /** 远程配置的 LKG(last-known-good)盘缓存读写开关(`CONFIG_LKG_ENABLED`,缺省开;只对远程 provider 有意义)。单一读法:`loadConfig` 铸这一席
-     *  (同时登记极性行),`boot/config-center.ts` 的两个读点(boot 的 LKG 来源判定、skill 正文缓存目录)只读它 —— 起服之后改环境变量不影响。 */
+     *  (同时登记极性行),`boot/web-admin.ts` 的两个读点(boot 的 LKG 来源判定、skill 正文缓存目录)只读它 —— 起服之后改环境变量不影响。 */
     configLkgEnabled: boolean;
     /** Structured log level. */
     logLevel: "debug" | "info" | "warn" | "error";
@@ -2102,22 +2103,22 @@ export interface ServiceConfigFlat {
     defaultScenario: string;
     /** Directory of baked-in skill Markdown files, loaded once at startup. */
     skillsDir: string;
-    /** Central sema registry (sema-registry). When set, the service pulls the effective config
+    /** Central web-admin (web-admin). When set, the service pulls the effective config
      *  on boot (and refreshes) and applies it OVER the env defaults — env is the fallback. Logical config
      *  only (model roster/roles/teams); secrets/gateways stay in this service's env.
-     *  `dryRun` (SEMA_REGISTRY_DRY_RUN=true; legacy CONFIG_CENTER_DRY_RUN now boot-rejects, no dual-read): pull + LOG what the registry would change vs the env-derived
+     *  `dryRun` (SEMA_WEB_ADMIN_DRY_RUN=true): pull + LOG what the registry would change vs the env-derived
      *  config, but do NOT apply it — a safe-rollout verification step before flipping to live.
-     *  `worker` (SEMA_REGISTRY_WORKER=<name>; legacy CONFIG_CENTER_WORKER now boot-rejects, no dual-read; injected per-worker by the reconciler): scopes the pull to
+     *  `worker` (SEMA_WEB_ADMIN_WORKER=<name>; injected per-worker by the reconciler): scopes the pull to
      *  that worker's roster via `/effective?worker=<name>`. Unset → the global roster (backward compatible).
      *  `credential`(S-651,BREAKING:取代 7.98.0 及以前的 `token: string` 启动快照):凭证来源活对象
-     *  (`center-credential.ts`),每条出站请求经它取一次值 —— `SEMA_REGISTRY_TOKEN`(值)或
-     *  `SEMA_REGISTRY_TOKEN_FILE`(每次读文件,轮换 / 换账号不重启)二选一(两键名与判官的属主 = settings-schema
-     *  `CENTER_CREDENTIAL_ENV` / `judgeCenterCredentialDeclaration`,S-742)。
-     *  `liveBaseUrl`(编排器片 2,env `SEMA_REGISTRY_LIVE_URL`):fleet 活性组(心跳 / 注销、服务租约 —— settings-schema `FLEET_LIVE_PATHS`)的基址,
+     *  (`center-credential.ts`),每条出站请求经它取一次值 —— `SEMA_WEB_ADMIN_TOKEN`(值)或
+     *  `SEMA_WEB_ADMIN_TOKEN_FILE`(每次读文件,轮换 / 换账号不重启)二选一(两键名与判官的属主 = settings-schema
+     *  `WEB_ADMIN_ENV` / `judgeWebAdminCredentialDeclaration`,S-742)。
+     *  `liveBaseUrl`(编排器片 2,env `SEMA_WEB_ADMIN_LIVE_URL`):fleet 活性组(心跳 / 注销、服务租约 —— settings-schema `FLEET_LIVE_PATHS`)的基址,
      *  给「管理面在就绪门后、活性面另走一条不看就绪的入口」的部署;缺席 ⇒ 活性组也打 `baseUrl`(这条缺省只在 `centerFetch` 读)。
-     *  `webBaseUrl`(7.121.0,env `SEMA_REGISTRY_WEB_URL`):这个中心的 **web 面固定基址**,运维声明、引擎原样转述到 `/health.center.webBaseUrl`
+     *  `webBaseUrl`(7.121.0,env `SEMA_WEB_ADMIN_WEB_URL`):这个中心的 **web 面固定基址**,运维声明、引擎原样转述到 `/health.center.webBaseUrl`
      *  (壳按它拼会话深链;路径怎么拼归壳)。起服时判成「可拼路径的基址」:http(s)、不带凭据 / query / fragment,否则拒启;缺席即缺席,引擎不拼不猜。 */
-    configCenter?: {
+    webAdmin?: {
         baseUrl: string;
         liveBaseUrl?: string;
         webBaseUrl?: string;
@@ -2150,14 +2151,14 @@ export interface ServiceConfigFlat {
      *  不自停;中心恢复授予即恢复。② 排空口 `POST /v1/admin/drain` 的**期限准入上界**(`fleet/drain-entry.ts` 规则 2):`deadlineAt` 离此刻超过它 ⇒
      *  400 `request.field_invalid`。 */
     fleetLeaseOutageMaxMs: number;
-    /** S-698(design-325 §2):中心凭证**续签提前量**(ms)—— `SEMA_REGISTRY_TOKEN_FILE` 指向人的登录会话信封
+    /** S-698(design-325 §2):中心凭证**续签提前量**(ms)—— `SEMA_WEB_ADMIN_TOKEN_FILE` 指向人的登录会话信封
      *  (`kind:"user-session"`)时,访问令牌离到期 ≤ 本值即由引擎续签并原子改写同一文件(`center-credential-renewer.ts`)。
      *  缺省 5 min;`0` = 关续签、只读信封(壳负责续);其余必须是整数毫秒且落在 `CENTER_CREDENTIAL_RENEW_LEAD_MIN_MS`(一次续签请求的
      *  传输上界)与 `CENTER_CREDENTIAL_RENEW_LEAD_MAX_MS`(访问令牌寿命之半)之间,坏值拒启(解析口 `parseCenterCredentialRenewLeadMs`)。
-     *  裸行文件 / `SEMA_REGISTRY_TOKEN` 值形不受它影响(不续签)。`CENTER_CREDENTIAL_RENEW_LEAD_MS`。 */
+     *  裸行文件 / `SEMA_WEB_ADMIN_TOKEN` 值形不受它影响(不续签)。`CENTER_CREDENTIAL_RENEW_LEAD_MS`。 */
     centerCredentialRenewLeadMs: number;
-    /** Dual-mode config SOURCE (DUAL-MODE-DESIGN §4): "remote" (sema-registry HTTP) | "local" (.env + config.d
-     *  via @sema-agent/settings-schema FileConfigStore) | unset → remote if SEMA_REGISTRY_URL (legacy CONFIG_CENTER_URL now boot-rejects, no dual-read) is set, else pure-env.
+    /** Dual-mode config SOURCE (DUAL-MODE-DESIGN §4): "remote" (web-admin HTTP) | "local" (.env + config.d
+     *  via @sema-agent/settings-schema FileConfigStore) | unset → remote if SEMA_WEB_ADMIN_URL is set, else pure-env.
      *  Env: CONFIG_PROVIDER —— S-841 起闭集 {@link CONFIG_PROVIDER_WORDS}(认不出的词拒启;空串 = 未设)。
      *  The same resolver/EffectiveConfig either way (can't drift). */
     configProvider?: ConfigProviderWord;
@@ -2167,13 +2168,13 @@ export interface ServiceConfigFlat {
 /** 组:store(持久化)—— DB 引擎三态、session 后端、SQL coords、快照 BLOB / SendUserFile 对象存储。 */
 export type ServiceStoreConfig = Pick<ServiceConfigFlat, "sessionBackend" | "sessionCacheTtlSec" | "storeProbeIntervalMs" | "storeLockWaitMs" | "dbBackend" | "dbBackendExplicit" | "localDataRoot" | "runStoreStrictHydrate" | "tidb" | "pg" | "dbQueryTimeoutMs" | "snapshotBlobStore" | "snapshotBlobSqlMaxBytes" | "snapshotBlobAllowSql" | "fileHistory" | "fileHistoryCapture" | "sendUserFile">;
 /** 组:modelPlane(模型面)—— 网关坐标、Anthropic 路线、韧性旋钮、主/廉价 model entry、role 表、降级梯。 */
-export type ServiceModelPlaneConfig = Pick<ServiceConfigFlat, "gatewayBaseUrl" | "gatewayApiKey" | "gatewayFallbackUrls" | "gatewayMaxRetries" | "anthropic" | "resilience" | "model" | "envModel" | "models" | "modelApiKeyEnv" | "modelApiKeys" | "modelRefusals" | "droppedCatalogEntries" | "modelQuotaWeights" | "tiers" | "projects" | "roles" | "atModelAllowlist" | "cascadeLadder" | "degrade">;
+export type ServiceModelPlaneConfig = Pick<ServiceConfigFlat, "gatewayBaseUrl" | "gatewayApiKey" | "gatewayFallbackUrls" | "gatewayMaxRetries" | "anthropic" | "resilience" | "model" | "envModel" | "models" | "modelApiKeyEnv" | "modelApiKeys" | "modelRefusals" | "droppedCatalogEntries" | "modelQuotaWeights" | "tiers" | "projects" | "roles" | "atMention" | "cascadeLadder" | "degrade">;
 /** 组:approval(审批 / HITL 门)。`directDoorActive` 无 env 解析腿(装配层三域合取的产物),但语义上
  *  就是本组的门状态,故进组;`parseApprovalDomain` 的返回类型相应是 `Omit<…, "directDoorActive">`。 */
 export type ServiceApprovalConfig = Pick<ServiceConfigFlat, "approvalRequire" | "approvalDeny" | "approvalTimeoutSec" | "approvalAutoBudget" | "approvalNeverAuto" | "approvalGrant" | "approvalHmacKeys" | "durableApproval" | "durableApprovalSource" | "streamAskWindowMsSource" | "directApprovalDoor" | "directDoorActive" | "resourceSuspend" | "resourceSuspendTtlSec" | "resourceSuspendTotalTokens" | "resourceSuspendTotalBudgetUsd" | "resourceSuspendMaxSlices" | "askQuestionEnabled" | "questionThrottle" | "toolApprovalEnabled" | "permissionRulesEnabled" | "permissionRulesEnabledExplicit" | "streamAskWindowMarginMs" | "streamApproval" | "unattendedApprovalPolicy" | "mcpElicitation" | "sensitiveWritePatterns" | "writeProtectedPaths" | "manualModeShellGate" | "permissionsDisableAutoMode" | "autoModeClassifierFallback" | "autoModeClassifierTimeoutMs" | "crossSessionInbound" | "crossSessionDialogExpiry">;
 /** 组:memory(记忆面 + TOC 同步腿)。 */
 export type ServiceMemoryConfig = Pick<ServiceConfigFlat, "memoryEngineEnabled" | "memoryEngineDir" | "memoryEngineRemoteLaneAllowed" | "memoryEngineBackend" | "memoryScope" | "memoryPersistenceCapable" | "memorySync" | "memoryEmbedder" | "memoryOrgAdmissionMode" | "memoryDelegationEvidence" | "memoryProvenance" | "memoryCapturePolicy" | "memoryConsolidationDriver" | "memoryOrgDirectoryJson" | "memoryOrgGrantTtlMs" | "memoryOrgUnavailableBackoffMs" | "projectMemoryEnabled" | "syncImportLeaseStaleSec">;
-/** 组:auth(鉴权 / 身份 / 治理棒)。`commandPolicy` 只有 sema-registry 腿(无 env 标量形),故 env 解析
+/** 组:auth(鉴权 / 身份 / 治理棒)。`commandPolicy` 只有 web-admin 腿(无 env 标量形),故 env 解析
  *  函数不产出它,但它与 `autonomy` 是同一根治理棒的两半,归本组。
  *  [ref] 的三件部署治理声明(`compliancePosture`/`lockedConfigKeys`/`retentionPolicy`)同归本组:
  *  三者都是 operator 在配置面写下的**治理声明**(与 autonomy/commandPolicy 同族),不是存储旋钮
@@ -2186,8 +2187,8 @@ export type ServiceOrchestrationConfig = Pick<ServiceConfigFlat, "remoteExec" |
 export type ServiceLimitsHttpConfig = Pick<ServiceConfigFlat, "port" | "attachmentOrphanGraceMs" | "workspaceFileMaxBytes" | "attachmentMaxBytes" | "attachmentMimeAllowlist" | "attachmentUnboundTtlMs" | "infraCostRates" | "drainGraceMs" | "drainSecondSignalMinGapMs" | "sighupIdleGraceMs" | "parentPid" | "engineAutoExit" | "engineLingerMs" | "engineOrphanLingerMs" | "rateLimitPerMin" | "maxTaskCostUsd" | "maxTaskTokens" | "maxPrincipalCostUsd" | "costQuotaWindowSec" | "reapIntervalSec" | "runStaleSec" | "toolResultTtlSec">;
 /** 组:observability(可观测)。 */
 export type ServiceObservabilityConfig = Pick<ServiceConfigFlat, "metricsToken" | "traceToken" | "toolTrace" | "traceThinking" | "logLevel" | "otel">;
-/** 组:integrations(外部集成)。`mcpServers` / `a2aPeers` 由 sema-registry 适配器填(无 env 腿),归本组。 */
-export type ServiceIntegrationsConfig = Pick<ServiceConfigFlat, "pluginsAllowHosts" | "mcpServers" | "a2aPeers" | "a2aServe" | "configBootFetchBudgetMs" | "gitApiBaseUrl" | "gitApiToken" | "gitApiKind" | "defaultScenario" | "skillsDir" | "centerCredentialRenewLeadMs" | "configCenter" | "fleetLeaseFailClosed" | "fleetGeneration" | "fleetScope" | "fleetAdvertiseAddress" | "fleetLeaseOutageMaxMs" | "configProvider" | "configLocalDir">;
+/** 组:integrations(外部集成)。`mcpServers` / `a2aPeers` 由 web-admin 适配器填(无 env 腿),归本组。 */
+export type ServiceIntegrationsConfig = Pick<ServiceConfigFlat, "pluginsAllowHosts" | "mcpServers" | "a2aPeers" | "a2aServe" | "configBootFetchBudgetMs" | "gitApiBaseUrl" | "gitApiToken" | "gitApiKind" | "defaultScenario" | "skillsDir" | "centerCredentialRenewLeadMs" | "webAdmin" | "fleetLeaseFailClosed" | "fleetGeneration" | "fleetScope" | "fleetAdvertiseAddress" | "fleetLeaseOutageMaxMs" | "configProvider" | "configLocalDir">;
 /** 九个组槽。每组恒在场(`loadConfig` / `attachConfigGroups` 装好才交出配置),故不可选——新代码写
  *  `config.modelPlane.model` 不需要 `?.`(可选组会把 `Model` 污染成 `Model | undefined`)。 */
 export interface ServiceConfigGroups {

package/dist/config.d.ts

@@ -1,5 +1,5 @@
 import { type Model, type PathRuleBases, type PermissionRule } from "@sema-agent/core";
-import { type CenterEndpoint } from "./config-center/center-request.js";
+import { type CenterEndpoint } from "./web-admin-client/center-request.js";
 import { type Autonomy } from "./runtime-governance.js";
 import { type RunnerEnvNameAllowlistKnob, type ServerEnvNameAllowlistKnob } from "./env-name-allowlist-knobs.js";
 import type { ServiceConfig, ServiceConfigFlat, ServiceConfigGroups } from "./config-types.js";
@@ -12,7 +12,7 @@ export { RETENTION_MODES, MEMORY_CONSOLIDATION_MIN_INTERVAL_SEC } from "./config
 /** Parse the AUTONOMY env into a validated autonomy mode. Unset/empty → undefined (unmanaged → no extra
  *  tightening). An UNKNOWN value FAILS at startup rather than silently becoming a no-op (a typo'd `AUTONOMY=readonly`
  *  must not silently leave a deployment ungoverned — fail-loud, same discipline as numEnv). Exported so the HOT
- *  config overlay (config-center/facade.ts `applyRuntimeHot`) can re-derive the ENV BASELINE to revert to when center
+ *  config overlay (web-admin-client/facade.ts `applyRuntimeHot`) can re-derive the ENV BASELINE to revert to when center
  *  stops managing `autonomy` (a stale center override must not stick — see applyRuntimeHot). */
 export declare function parseAutonomy(raw: string | undefined): Autonomy | undefined;
 /** [ref]-T1 — parse `USAGE_WINDOWS`(单键 JSON 数组;逐窗散键在窗数可变时组合爆炸,JSON 是唯一
@@ -32,43 +32,6 @@ export declare function parseUsageWindows(raw: string | undefined): readonly {
     maxCostUsd?: number;
     anchor: "first-use" | "rolling";
 }[] | undefined;
-/** [ref] 兼容面全清:退役 env 名墓碑——老名**在场即拒启**带新名指引。静默忽略=部署带着失效配置无感跑;双读=兼容层吸收
- *  下游冒烟。都不要。
- *
- *  🪦 **墓碑是永久的响亮拒,不设到期**(S-588)。一行墓碑就是那句拒启句本身,成本一行;删掉它 = 旧名重新被悄悄忽略。
- *  ⇒ 本表只增不减,**唯一的删除条件是这个名字要被赋予新含义**:那一次提交同时删掉墓碑行,并在 MIGRATION 写明旧名改作何用。
- *  (与一次性迁移不是一回事:迁移码每次起服都跑、碰真数据,所以有窗、窗关即删码 —— 见 `plugins/one-time-migrations.ts`
- *  的登记表;墓碑不碰数据,只拒启。)
- *  A tombstone is a permanent loud refusal with no expiry: deleting a row lets the retired name be silently ignored again,
- *  so a row goes only when the name is given a new meaning — in that same commit, with a MIGRATION note.
- *
- *  **旧名在场即拒,替代名在不在都一样**:判据只问旧名在不在场,不看替代键设没设、设成什么 ——「新旧两个名字都留着」正是
- *  迁移到一半的部署最常见的形,旧名在那一形里若被静默忽略,运维会以为它还在生效。server 3.0.0 的旧负名(`X_DISABLED` →
- *  `X_ENABLED`)同在本表(`replaced` 族:极性相反,照抄旧值过去恰好是反义),与其余墓碑走同一只 {@link rejectRetiredEnvs};
- *  那几个旋钮的读点只读正名(`boolEnv`),不再有第二套「正名缺席才看旧名」的判据(S-588 之前的 `boolEnvWithLegacyNegated`)。
- *
- *  墓碑分三族(A4 两族 + S-753 第三族),每族各说各的尾句 —— 族是**闭集**,渲染是穷举表(加一族不写尾句 = 编译红):
- *   · `renamed`  = 同一能力换了个键名,值语义逐字不变 ⇒ 「照新名改写即可」;
- *   · `replaced` = 有替代键,但**值语义变了**(缺省 / `0` 义 / 计量段 / 极性不同)⇒ 点名新键 + 说清变了什么,**不许**说「语义不变」
- *                  —— 照抄旧值过去就是另一个意思(S-753:`MODEL_CONNECT_TIMEOUT_MS` → `MODEL_FIRST_BYTE_TIMEOUT_MS`);
- *   · `removed`  = 能力本身没了,`why` 是「为什么没了」,**没有可 rename 的目标**。
- *  拒句带码 `[config.env_key_retired]`(拒启码,拼法随 `config.*` 家族;与中心凭证两码同形,出现在拒句方括号里)。
- *  空串 = 未设(与 `env()` 同一条约定:compose `${X:-}` 透传的空值不是一次表态),不拒。 */
-export type RetiredEnv = readonly [old: string, to: string, kind: "renamed"] | readonly [old: string, to: string, kind: "replaced", why: string] | readonly [old: string, why: string, kind: "removed"];
-export type RetiredEnvKind = RetiredEnv[2];
-/** 墓碑拒启码(机读;拒句方括号里)。 */
-export declare const RETIRED_ENV_REFUSAL_CODE = "config.env_key_retired";
-export declare const RETIRED_ENVS: readonly RetiredEnv[];
-/** S-885 —— 墓碑表的 wire 投影一行(`GET /v1/config/catalog` 的 `retired[]`):按族定形 —— renamed 只带 `replacement`;replaced 带
- *  `replacement` + `reason`(值语义怎么变了);removed 只带 `reason`(能力为什么没了)。 */
-export interface RetiredEnvWire {
-    readonly name: string;
-    readonly kind: RetiredEnvKind;
-    readonly replacement?: string;
-    readonly reason?: string;
-}
-/** 墓碑表 → wire 投影(纯数据 ⇒ `build*`)。**同一张表、同序**;族是闭集,穷举 switch(加一族不写这里 ⇒ 编译红)。 */
-export declare function buildRetiredEnvWire(): RetiredEnvWire[];
 /** Numeric env with validation: a non-numeric value FAILS at startup instead of silently becoming `NaN`
  *  (which e.g. slips past the `runStaleSec` liveness guard and silently disables the reaper). */
 export declare function numEnv(name: string, fallback: string): number;
@@ -156,7 +119,7 @@ export declare function logConfigDiagnostics(logger: {
 type ModelCost = NonNullable<Model["cost"]>;
 /**
  * 🔴 B-089 —— `Model.cost` 这**一个键**的唯一铸点(可展开片段):有价目表 ⇒ 键在;没配 ⇒ **键不出**。
- * 三个铸点(env 主槽 / env cheap 槽 / config-center 车道)共用它,所以「缺席怎么表达」在本仓只有一处答案。
+ * 三个铸点(env 主槽 / env cheap 槽 / web-admin 车道)共用它,所以「缺席怎么表达」在本仓只有一处答案。
  *
  * `Model.cost` 自 core 7.16.0([ref])起在**类型面**上也是可选的(`dist/engine/llm/types.d.ts` 的
  * `cost?:`),与它一直以来的运行期读法([ref] 的 `isModelPriced`:这个键在不在)对齐 ——
@@ -178,7 +141,7 @@ export declare function buildModelCostKey(cost: ModelCost | undefined): Pick<Mod
  * `loadConfig` 只见 env 车道,而 `main.ts` 在第一次 effective 拉取**之前**就把 boot 诊断排空了 ——
  * 在那里判会同时犯两个方向的错:center 名册已配价、env 未配 ⇒ **假警**;env 已配价、center 名册撤了价
  * (或天花板只由 center 的 limits 下发)⇒ **漏警**。故本函数只给判据,席位在两只入口各自的
- * **采纳之后**(`main.ts` 的 `createConfigCenterRuntime` 之后 / `run-local.ts` 的 `applyEffective` 之后)。
+ * **采纳之后**(`main.ts` 的 `createWebAdminRuntime` 之后 / `run-local.ts` 的 `applyEffective` 之后)。
  *
  * 判据 = **目录里没有任何一只带价模型**,问法与 `budget.buildPricing` 的填表判据是**同一只函数**
  * (S-231:core 7.16.0 导出的 `isModelPriced`;第二参传 `undefined` = 这一问发生在注入表建起来之前,
@@ -263,17 +226,17 @@ export declare function parseEnvNameAllowlist(knob: RunnerEnvNameAllowlistKnob):
  *  here claiming this was "the exact CC alignment core recommends embedders set" mis-read core's per-model
  *  advice as a width rule). Returns a discriminant so the env lane can turn the removed implicit value into
  *  a loud CONFIG_NOTICES line ("removed-1m"); the center lane's roster culture is explicit declaration.
- *  Shared by the env lane (main + cheap models) and the center lane (sema-registry toModel). */
+ *  Shared by the env lane (main + cheap models) and the center lane (web-admin toModel). */
 export declare function applyAutoCompactWindow(m: Model, explicit?: number): "explicit" | "sonnet5" | "removed-1m" | "removed";
 /**
- * **严格名册布防**的唯一判据(boot 就绪门 `boot/config-center.ts` 与 S-623 端点判据同调这一只)。
+ * **严格名册布防**的唯一判据(boot 就绪门 `boot/web-admin.ts` 与 S-623 端点判据同调这一只)。
  *
  * 布防 = 远程 registry ∧ 非 dryRun ∧ `CONFIG_REQUIRE_ROSTER=true`(严格 `"true"`,直读 env、不进 ServiceConfig —— 纯
  * boot 期姿势旋钮,原判据逐字搬来,零语义变化)。布防时运维声明 env MODEL_ID 是**占位**:名册落地前计费提交 503、
  * `/health` ready:false,落地后整张模型表被中心目录换装。dryRun 是 compare-only(名册从不被应用),local / 纯 env
  * 部署没有「中心」可等 ⇒ 都不布防。
  */
-export declare function isRosterGateArmed(configCenter: ServiceConfig["configCenter"]): boolean;
+export declare function isRosterGateArmed(webAdmin: ServiceConfig["webAdmin"]): boolean;
 /**
  * 一条工具名**永不匹配任何现役工具**的三种拼法,及其修正指引。审批/权限名单是 server 侧 ToolPolicy 的
  * RAW 逐字比对(canonicalToolName 折叠面已随 core 5.0.0 [ref] 退役),所以写错的名字不会报错、只会静默
@@ -281,7 +244,7 @@ export declare function isRosterGateArmed(configCenter: ServiceConfig["configCen
  *
  * 判据在此**单点成文**,三条腿共用(它们此前各自为政,拼法覆盖面不一致才是真缺口):
  *   ① env 腿(`APPROVAL_REQUIRE`/`DENY`/`NEVER_AUTO`,下方)—— boot 拒启;
- *   ② 中心下发腿(`runtime.approvalRequire`,config-center/apply-effective.ts)—— 域级拒绝+保前值+warn
+ *   ② 中心下发腿(`runtime.approvalRequire`,web-admin-client/apply-effective.ts)—— 域级拒绝+保前值+warn
  *      (常驻进程不 crash);
  *   ③ per-request 腿(`settings.permissions.{ask,deny}`,task-settings.ts)—— 该请求 422。
  * (两张 allow 表 —— 请求的 `settings.permissions.allow` 与运维的 `APPROVAL_GRANT` —— 自 7.117.0 / core 7.42.0 起不经这里:它们整份交给引擎的
@@ -426,7 +389,7 @@ export interface FleetFenceLane {
  */
 export declare function fleetFenceLaneOf(cfg: {
     readonly fleetGeneration?: string | undefined;
-    readonly configCenter?: (CenterEndpoint & {
+    readonly webAdmin?: (CenterEndpoint & {
         readonly worker?: string | undefined;
     }) | undefined;
     readonly fleetAdvertiseAddress?: string | undefined;