@sema-agent/server 7.125.1 → 7.126.0

package/dist/web-admin-client/apply-effective.js

@@ -6,7 +6,6 @@ import { applyAutoCompactWindow, buildModelCostKey, parseAutonomy, unmatchableTo
 import { buildModelCompat, readModelCompat } from "../model-compat.js";
 import { buildModelHeadersKey } from "../model-entry-headers.js";
 import { validateCommandRules } from "../runtime-governance.js";
-import { projectCollabToWorkflows, registerCollabWorkflows } from "../capabilities/collab-workflows.js";
 import { stageLimits } from "./stage-limits.js";
 import { APPROVAL_GROUP_KEYS, BATCH1_LIMIT_KEYS } from "./hot-keys-registry.js";
 import { buildDisplaySafeUrl } from "../trace/redact.js";
@@ -138,12 +137,6 @@ export function applyEffective(config, eff, logger, opts) {
         logger?.info("web_admin_runtime", { version: staged.version, approvalRequire: staged.approvalGate.next });
     if (Object.keys(staged.hot.infoLine).length > 0)
         logger?.info("web_admin_runtime_hot", staged.hot.infoLine);
-    for (const n of staged.modelPlaneGroup.stages.collab?.notices ?? []) {
-        if (n.level === "warn")
-            logger?.warn(n.msg, n.fields);
-        else
-            logger?.info(n.msg, n.fields);
-    }
     if (Object.keys(staged.projects).length > 0)
         logger?.info("web_admin_projects", { projects: Object.keys(staged.projects) });
     return true;
@@ -172,15 +165,11 @@ function commitStaged(config, staged) {
         config.autonomy = staged.hot.autonomyNext;
     if (staged.hot.setCommandPolicy)
         config.commandPolicy = staged.hot.commandPolicyNext;
-    const collab = staged.modelPlaneGroup.stages.collab;
-    if (collab !== undefined)
-        registerCollabWorkflows(collab.workflows);
     mutateInPlace(config.projects, staged.projects);
 }
-export const MODEL_PLANE_DOMAINS = ["models", "collab"];
+export const MODEL_PLANE_DOMAINS = ["models"];
 const MODEL_PLANE_SURFACES = {
     models: ["models", "model", "modelRefusals", "droppedCatalogEntries", "modelApiKeyEnv", "modelApiKeys", "modelQuotaWeights", "roles", "tiers", "atMention"],
-    collab: ["collabWorkflows"],
 };
 const MODEL_PLANE_GROUP_KEYS = MODEL_PLANE_DOMAINS.flatMap((d) => MODEL_PLANE_SURFACES[d]);
 export function withModelPlaneOf(target, source) {
@@ -220,7 +209,7 @@ function stageModelPlane(config, eff, logger, sealedKeys) {
     const enabled = (eff.models?.models ?? []).filter((m) => m.enabled !== false);
     const verdict = judgeCatalogEntries(enabled, { anthropicRouteMounted: config.anthropic !== undefined }, eff.models?.droppedCatalogEntries);
     if (enabled.length === 0 && verdict.malformed.length === 0 && verdict.dropped.every((row) => row.identity?.enabled === false))
-        return { stages: { collab: stageCollabDomain(eff) } };
+        return { stages: {} };
     {
         for (const [name, r] of Object.entries(verdict.refused))
             logger?.warn(refusalEventOf(r.reason), refusalWarnFields(name, r));
@@ -231,7 +220,7 @@ function stageModelPlane(config, eff, logger, sealedKeys) {
                 invariant,
                 reason,
                 ...detail,
-                kept: "the model plane of this candidate is refused as a group — the current model plane (catalog / roles / tiers / refusals / allowlist, and the collab workflows that reference it) keeps serving and the other groups of this candidate still apply; the candidate is not fully applied (LKG / ETag stay on the last fully applied generation) and is re-judged next pull",
+                kept: "the model plane of this candidate is refused as a group — the current model plane (catalog / roles / tiers / refusals / allowlist) keeps serving and the other groups of this candidate still apply; the candidate is not fully applied (LKG / ETag stay on the last fully applied generation) and is re-judged next pull",
             });
             return { stages: {}, rejected: { keys: MODEL_PLANE_GROUP_KEYS, reason, invariant, code }, refused: verdict.refused };
         };
@@ -364,20 +353,13 @@ function stageModelPlane(config, eff, logger, sealedKeys) {
             atMention,
             infoLine: { count: usable.length, ...(Object.keys(verdict.refused).length > 0 ? refusedNamesLogFields("unavailable", Object.keys(verdict.refused)) : {}), default: defaultModel.id, defaultSource: picked.source, roles: Object.keys(roles), tiers: Object.keys(activeTiers), atMention: atMention.mode, sealedKeys: Object.values(modelApiKeys).filter((v) => typeof v === "string").length, sealedPoisoned: Object.values(modelApiKeys).filter((v) => typeof v !== "string").length },
         };
-        return { stages: { models: plane, collab: stageCollabDomain(eff) }, defaultName: picked.name, refused: verdict.refused };
+        return { stages: { models: plane }, defaultName: picked.name, refused: verdict.refused };
     }
 }
-function stageCollabDomain(eff) {
-    const projected = projectCollabToWorkflows(eff.collab?.templates);
-    const notices = [];
-    if (Object.keys(projected.workflows).length > 0)
-        notices.push({ level: "info", msg: "web_admin_collab_workflows", fields: { workflows: Object.keys(projected.workflows) } });
-    if (projected.skipped.length > 0)
-        notices.push({ level: "warn", msg: "web_admin_collab_skipped", fields: { skipped: projected.skipped } });
-    if (projected.notes.length > 0)
-        notices.push({ level: "info", msg: "web_admin_collab_notes", fields: { notes: projected.notes } });
-    return { workflows: projected.workflows, notices };
+export function collabTemplatesNotExecuted(eff) {
+    return (eff.collab?.templates ?? []).filter((t) => t.enabled !== false).map((t) => t.id);
 }
+const COLLAB_NOT_EXECUTED_NOTE = "collab templates are accepted by the config store but nothing on this server executes them — the engine no longer ships a team-discussion runtime (core 7.49.0); run multi-member work as Agent sub-runs, or register a Workflow script in the deployment's workflow-scripts store";
 function stageEffective(config, eff, logger, opts) {
     if (opts.leg === "boot" && !eff.version) {
         logger?.warn("web_admin_unpublished", {
@@ -386,6 +368,9 @@ function stageEffective(config, eff, logger, opts) {
         });
     }
     const modelPlaneGroup = stageModelPlane(config, eff, logger, opts.sealedKeys);
+    const notExecuted = collabTemplatesNotExecuted(eff);
+    if (notExecuted.length > 0)
+        logger?.warn("web_admin_collab_not_executed", { version: eff.version, templates: notExecuted, note: COLLAB_NOT_EXECUTED_NOTE });
     const approvalGate = stageApprovalGate(config, eff.governance, opts, logger);
     const limits = stageLimits(config, { version: typeof eff.version === "number" ? eff.version : 0, ...("limits" in eff ? { limits: eff.limits } : {}) }, logger);
     const hot = stageRuntimeHot(config, eff.governance, logger);
@@ -598,7 +583,7 @@ export function logEffectiveDiff(config, eff, logger) {
         currentDefaultModel: config.model.id,
         models: { center: centerModels, envDerived: envModels },
         roles: { center: centerRoles, current: config.roles },
-        collab: { centerWouldRegister: Object.keys(projectCollabToWorkflows(eff.collab?.templates).workflows) },
+        collab: { notExecuted: collabTemplatesNotExecuted(eff) },
         skills: { centerWouldLoad: (eff.skills?.skills ?? []).filter((s) => s.enabled !== false).map((s) => s.name) },
         mcp: { centerWouldRegister: (eff.mcp?.servers ?? []).filter((s) => s.enabled !== false).map((s) => s.name) },
         limits: {

package/dist/web-admin-client/apply-ledger.d.ts

@@ -26,7 +26,7 @@
  *  · `approvalGate` —— S-668 波 2 审批组(`governance.approvalRequire`;属主 `apply-effective.ts` 的
  *    `stageApprovalGate`:坏形 / 工具名匹配不到 / ④ 门意图不可服务 ⇒ 整组拒)。
  *  · `modelPlane` —— 模型面组(组内有哪些 effective 域的**唯一定义** = `apply-effective.ts` 的 `MODEL_PLANE_DOMAINS`:models 域 =
- *    目录 / roles / tiers / 拒因表 / 名单 / 钥匙表,collab 域 = 引用它的命名 workflow 注册表;属主 `stageModelPlane`:
+ *    目录 / roles / tiers / 拒因表 / 名单 / 钥匙表(今天组内只此一域);属主 `stageModelPlane`:
  *    模型面三条跨键不变量 `default-model-resolvable` / `model-route-endpoint` / `refused-names-not-minted` 任一不成立 ⇒ 整组拒,
  *    组内各域都停在上一代。opus 腿 O3(7.101.0 合并复审):此前这三条是 stage 抛 = 整份候选中止,同候选其余组陪葬)。
  * 各组同姿势、各用各的判据表(审批组**不**复用限额组的跨键不变量表 —— 那张表的候选视图只叠限额键)。
@@ -110,7 +110,7 @@ export declare function refusedGroups(report: ConfigApplyReport): Array<{
     readonly reason: string;
 }>;
 /**
- * O3:这一次 apply 的**模型面组**(组内各域 = `MODEL_PLANE_DOMAINS`,目录与引用它的 collab 模板同进退)落地了没有(整组被拒 ⇒
+ * O3:这一次 apply 的**模型面组**(组内各域 = `MODEL_PLANE_DOMAINS`)落地了没有(整组被拒 ⇒
  * false;报告缺席 = 没走到 commit ⇒ false,如实)。调用方据此决定「Runner 现在跑的是哪一代模型面」(`appliedPlaneEff`,swap 判据的
  * 基准)、名册门开不开、以及 boot 要不要按组回落 LKG —— 都只许从真落地的模型面推进。
  */

package/dist/web-admin-client/candidate-gate.d.ts

@@ -1,8 +1,11 @@
 /**
  * 配置候选的**唯一判官**:一份候选(中心有效视图,或本地 `config.d` 读出的那份)能不能收 —— 只有这一种判法。
  *
- * 判据(两件,缺一即拒):读腿交出的 `domainErrors`(某个域读不懂 / 拼错键 / 坏文件:那个域已落 schema 缺省)与 prompts 面的判形
- * (`validatePromptsDomain`;坏形的 pack 会让 core 在每个任务的装配期抛)。任一不过 ⇒ `rejected`:**整份候选不收**,一个域都不应用。
+ * 判据(三件,任一即拒;每条拒因带成因词,闭集 {@link CandidateRejectReason}):读腿交出的 `domainErrors`(某个域读不懂 / 拼错键 / 坏文件:那个域已落
+ * schema 缺省)与 prompts 面的判形(`validatePromptsDomain`;坏形的 pack 会让 core 在每个任务的装配期抛)—— 成因 `domain_invalid`;读腿交出的
+ * `retiredDomains`(带事实的退役域文档,契约包的墓碑;拒句点名退役版本与一次性迁移)—— 成因 `retired_domain`。任一 ⇒ `rejected`:
+ * **整份候选不收**,一个域都不应用。退役域此前在读腿整包抛、走「源不可达」那条臂(版本读不到、没有拒判行、刷新拍算失败);现在读腿只交数据,
+ * 坏候选只有本判官一种判法。
  * 读腿的逐条丢弃(`droppedEntries`)不在这里 —— 颗粒是条目的失效留在条目上,候选照收(调用方响亮点名)。
  *
  * 调用面(全部只调这一只,不内联第二份):
@@ -30,10 +33,17 @@ export interface CandidateDomainError {
     readonly domain: string;
     readonly error: string;
 }
-/** 判官的输入:一份读出来的候选。 */
+/** 判官拒一份候选的成因(闭集):某个域判形失败(含 prompts 面)/ 带事实的退役域文档(墓碑)。 */
+export type CandidateRejectReason = "domain_invalid" | "retired_domain";
+/** 拒判里的一条:哪一域、为什么(读腿 / 契约包的原句)、成因词。`config_candidate_rejected` 行的 `errors` 就是这一列。 */
+export interface CandidateDomainRejection extends CandidateDomainError {
+    readonly reason: CandidateRejectReason;
+}
+/** 判官的输入:一份读出来的候选。`retiredDomains` = 读腿交出的退役域发现(两条读腿同形,见 `read-warnings.ts` 的 `RetiredDomainFinding`)。 */
 export interface ConfigCandidateRead {
     readonly effective: EffectiveConfig;
     readonly domainErrors?: readonly CandidateDomainError[];
+    readonly retiredDomains?: readonly CandidateDomainError[];
 }
 export type ConfigCandidateVerdict = 
 /** `prompts` = 候选 prompts 面的已判形值(候选不带 prompts 键 ⇒ `undefined` = 撤回中心包、内置提示词服务)。 */
@@ -43,7 +53,7 @@ export type ConfigCandidateVerdict =
 } | {
     readonly verdict: "rejected";
     readonly domains: readonly string[];
-    readonly errors: readonly CandidateDomainError[];
+    readonly errors: readonly CandidateDomainRejection[];
 };
 export declare function judgeConfigCandidate(r: ConfigCandidateRead): ConfigCandidateVerdict;
 /** `config_candidate_rejected` 的 `leg`(闭集):被判官整拒的候选是**哪一拉**的 —— 起服那一拉 / 起服超窗、到货才判的那一拉 / 刷新拍的一拉 /
@@ -64,6 +74,31 @@ export declare function buildCandidateRejectedFields(r: {
     readonly lkgVersion: number | "(env)";
     readonly dir?: string;
 }): Record<string, unknown>;
+/**
+ * 最近一次被判官整拒的候选的**结论**(纯数据)—— 判官判决的持有形:`domains` 就是 {@link judgeConfigCandidate} 交出的 `rejected.domains`(排序去重的域名集),
+ * 一个字没改写;`source` = 这份候选是哪种配置源读出来的(`"local"` 本地 `config.d` / `"remote"` 中心);`at` = 判官判下这份候选的时刻(毫秒)。
+ * 持有者(`boot/web-admin.ts` 的 `candidateRejection`)是它的**唯一**座:`config_candidate_rejected` 日志行的去重键与 `GET /v1/models.candidateRejected`
+ * 的投影({@link buildCandidateRejectedWire})读的是同一份 —— 拒因文案(`errors`)与文件路径(`dir`)只走日志,不进这份结论,也就不上 wire。
+ */
+export interface CandidateRejection {
+    readonly version: number;
+    readonly domains: readonly string[];
+    readonly source: "local" | "remote";
+    readonly at: number;
+}
+export declare function candidateRejectionOf(r: {
+    readonly effective: EffectiveConfig;
+}, verdict: Extract<ConfigCandidateVerdict, {
+    verdict: "rejected";
+}>, source: CandidateRejection["source"], at: number): CandidateRejection;
+/** `GET /v1/models` 顶层 `candidateRejected` 的 wire 形(契约 §A.1d「`GET /v1/models` 的 `candidateRejected`」):域名闭集词 + ISO 时刻 + 源形态,零自由文本。 */
+export interface CandidateRejectedWire {
+    readonly domains: string[];
+    readonly at: string;
+    readonly source: "local" | "remote";
+}
+/** {@link CandidateRejection} → wire:**唯一**出口投影(纯函数;present-iff 由调用方——座里有结论才调——保证)。 */
+export declare function buildCandidateRejectedWire(rejection: CandidateRejection): CandidateRejectedWire;
 /** `config_domain_invalid` 逐域坐标行的 note(各入口同一句):这一行说「哪一域、为什么坏」,判决只有 `config_candidate_rejected` 一行。 */
 export declare const CONFIG_DOMAIN_INVALID_NOTE = "this domain failed its schema \u2014 the candidate judge rejects the whole candidate (see config_candidate_rejected); fix the named file / center data";
 //# sourceMappingURL=candidate-gate.d.ts.map

package/dist/web-admin-client/candidate-gate.js

@@ -3,8 +3,9 @@ export function judgeConfigCandidate(r) {
     const prompts = r.effective.prompts;
     const promptsGate = prompts === undefined ? undefined : validatePromptsDomain(prompts);
     const errors = [
-        ...(r.domainErrors ?? []).map((de) => ({ domain: de.domain, error: de.error })),
-        ...(promptsGate !== undefined && !promptsGate.ok ? [{ domain: "prompts", error: promptsGate.error }] : []),
+        ...(r.domainErrors ?? []).map((de) => ({ domain: de.domain, error: de.error, reason: "domain_invalid" })),
+        ...(promptsGate !== undefined && !promptsGate.ok ? [{ domain: "prompts", error: promptsGate.error, reason: "domain_invalid" }] : []),
+        ...(r.retiredDomains ?? []).map((rd) => ({ domain: rd.domain, error: rd.error, reason: "retired_domain" })),
     ];
     if (errors.length === 0)
         return { verdict: "clean", prompts: promptsGate?.ok ? promptsGate.value : undefined };
@@ -23,5 +24,11 @@ export function buildCandidateRejectedFields(r, verdict, leg, ctx) {
         note: "candidate rejected whole (§9.5-5) — live config keeps the last-known-good; fix the named files to unblock",
     };
 }
+export function candidateRejectionOf(r, verdict, source, at) {
+    return { version: r.effective.version, domains: verdict.domains, source, at };
+}
+export function buildCandidateRejectedWire(rejection) {
+    return { domains: [...rejection.domains], at: new Date(rejection.at).toISOString(), source: rejection.source };
+}
 export const CONFIG_DOMAIN_INVALID_NOTE = "this domain failed its schema — the candidate judge rejects the whole candidate (see config_candidate_rejected); fix the named file / center data";
 //# sourceMappingURL=candidate-gate.js.map

package/dist/web-admin-client/facade.d.ts

@@ -8,8 +8,8 @@
  * this note listed "planned sema-admin" as the next step). The module itself keeps a neutral, product-name-free
  * identifier ("web-admin") and does not chase the rename.)
  *
- *   - the CENTER owns the LOGICAL config: the model roster (names/capabilities/tier), the role map,
- *     and collab (multi-agent discussion) templates;
+ *   - the CENTER owns the LOGICAL config: the model roster (names/capabilities/tier) and the role map
+ *     (its collab templates are reported as not executed — this server runs no team orchestration);
  *   - the SERVICE env still owns the SECRETS: API keys stay in env (the center never stores a secret);
  *     keys are per-model via `apiKeyEnv` → `config.modelApiKeyEnv` → the spec's `getApiKeyAndHeaders`
  *     (core 1.45), so each model/cascade-rung authenticates with its own upstream key.

package/dist/web-admin-client/http-client.d.ts

@@ -1,10 +1,11 @@
 import { type EffectiveReadWarning, type EntitlementRuntimeCaps } from "@sema-agent/settings-schema";
 import type { ScenarioRuling } from "../capabilities/scenarios.js";
 import type { EffectiveConfig, ExecutionRuling } from "./types.js";
-import { type DroppedConfigEntry, type UnreadConfigFile } from "./read-warnings.js";
+import { type DroppedConfigEntry, type RetiredDomainFinding, type UnreadConfigFile } from "./read-warnings.js";
 import { type CenterEndpoint } from "./center-request.js";
 /** GET the effective config (Bearer + ETag). null = 304 (unchanged). Throws on transport/HTTP error, and on a
  *  payload that is not an effective config at all(非对象 / version 非有限数 / gate 域坏形——[ref] 裁B)。
+ *  `retiredDomains`(S-1456):wire 上带事实的退役域(墓碑)不抛 —— 交成发现、那一键不进 effective,候选判官整拒这份候选(与本地腿同键同义)。
  *  `domainErrors`:坏 catalog 域(schema default 已落)逐域单列——与本地腿 `FetchEffectiveResult` 同键同义,
  *  boot/refresh 的候选门直接消费。`droppedEntries`(S-704 ②):schema 逐条丢掉的条目(坐标 + 字段诊断)——
  *  **不**进候选门,调用方响亮点名、其余照用(分面单点 `splitFoldedReadWarnings`,与本地腿同一只)。
@@ -24,6 +25,7 @@ export declare function fetchEffective(center: CenterEndpoint, etag: string | un
     }>;
     droppedEntries?: DroppedConfigEntry[];
     unreadFiles?: UnreadConfigFile[];
+    retiredDomains?: RetiredDomainFinding[];
     readWarnings: readonly EffectiveReadWarning[];
     credentialIdentity: string;
 } | null>;

package/dist/web-admin-client/http-client.js

@@ -1,7 +1,7 @@
 import { createHash } from "node:crypto";
 import { readEffectiveWire, PrincipalCapsWire } from "@sema-agent/settings-schema";
 import { centerPromptsFromEffective } from "../prompts-domain-validate.js";
-import { splitFoldedReadWarnings, withDroppedCatalogEntries } from "./read-warnings.js";
+import { separateRetiredDomains, splitFoldedReadWarnings, withDroppedCatalogEntries } from "./read-warnings.js";
 import { CENTER_PULL_TIMEOUT_MS, centerFetch } from "./center-request.js";
 import { answerStillCurrent } from "../center-credential.js";
 export async function fetchEffective(center, etag, fetchImpl = fetch, worker) {
@@ -11,14 +11,14 @@ export async function fetchEffective(center, etag, fetchImpl = fetch, worker) {
     if (!res.ok)
         throw new Error(`web-admin HTTP ${res.status}`);
     const warnings = [];
-    const body = await res.json();
+    const { body, retiredDomains } = separateRetiredDomains(await res.json());
     const wire = readEffectiveWire(body, (w) => warnings.push(w));
     const centerPrompts = centerPromptsFromEffective(wire);
     if (centerPrompts === undefined)
         delete wire.prompts;
     else
         wire.prompts = centerPrompts;
-    const { domainErrors, droppedEntries, droppedCatalogEntries, unreadFiles } = splitFoldedReadWarnings(warnings);
+    const { domainErrors, droppedEntries, droppedCatalogEntries, unreadFiles } = splitFoldedReadWarnings(warnings, "center");
     const effective = withDroppedCatalogEntries(wire, droppedCatalogEntries);
     return {
         effective,
@@ -28,6 +28,7 @@ export async function fetchEffective(center, etag, fetchImpl = fetch, worker) {
         ...(domainErrors.length > 0 ? { domainErrors } : {}),
         ...(droppedEntries.length > 0 ? { droppedEntries } : {}),
         ...(unreadFiles.length > 0 ? { unreadFiles } : {}),
+        ...(retiredDomains.length > 0 ? { retiredDomains: [...retiredDomains] } : {}),
     };
 }
 export async function fetchPrincipalCaps(center, principal, etag, fetchImpl = fetch, worker) {

package/dist/web-admin-client/read-warnings.d.ts

@@ -25,7 +25,30 @@
  * 留在条目上,只有颗粒更粗的失效才动候选。
  */
 import { z } from "zod";
-import { type DroppedEntryIdentity, type DroppedEntryReasonCode, type EffectiveReadWarning } from "@sema-agent/settings-schema";
+import { type DroppedEntryIdentity, type DroppedEntryReasonCode, type EffectiveReadWarning, type RetiredDomainName } from "@sema-agent/settings-schema";
+/**
+ * 退役域的一条**发现**(两条读腿同形)。读腿只把契约包的墓碑(`RetiredDomainError`)换成数据交出去 —— 判决只在候选判官
+ * (`candidate-gate.ts` 的 `judgeConfigCandidate`,成因 `retired_domain`):与域判形失败同一条回落链(候选 → 盘上 LKG → env)、同一行
+ * `config_candidate_rejected`、刷新拍同形(拍跑完,候选被判拒是结论)。拉取层的抛只剩 I/O 与载荷形(不是一份 effective)两种。
+ * `error` = 契约包铸的整句(墓碑表那一行:退役版本、事实今天住哪、一次性迁移 id)—— 模板句,不含任何配置值,所以不过 `redactConfigError`
+ * (那道脱敏把引号段换成指纹,会把句中点名的域名换掉)。
+ */
+export type RetiredDomainFinding = {
+    readonly domain: RetiredDomainName;
+    readonly error: string;
+    readonly migration: string;
+};
+/** 墓碑 → 发现;不是墓碑 ⇒ `undefined`(调用方照原样抛)。两条读腿的唯一换装点。 */
+export declare function retiredDomainFindingOf(e: unknown): RetiredDomainFinding | undefined;
+/**
+ * 远端读腿在过契约读腿(`readEffectiveWire`)**之前**把退役域键分出去:wire 体上每个退役域键过契约的同一只墓碑(`refuseRetiredDomain`)——
+ * 带事实 ⇒ 一条发现、这一键从体上拿掉(其余域照读、版本照读,判官整拒这份候选);缺席 / `{}` ⇒ 不理会(契约读腿自己丢 `{}`)。
+ * 体不是对象 ⇒ 原样交回、不判(载荷形错,契约读腿抛)。墓碑判据只在契约包,这里只分键。
+ */
+export declare function separateRetiredDomains(body: unknown): {
+    readonly body: unknown;
+    readonly retiredDomains: readonly RetiredDomainFinding[];
+};
 /** 折叠产物:`scope` 决定消费方做什么 —— `"domain"` 进候选门(`domainErrors`),`"entry"` 进逐条丢弃面(`droppedEntries`),
  *  `"unread"` 进读腿不读的文件面(`unreadFiles`;点名不判拒)。 */
 export type FoldedReadWarning = {
@@ -79,18 +102,23 @@ export declare const SCHEMA_OPERAND_HOLE = "\u00ABvalue\u00BB";
  * 引号到最后一个引号整段吞掉,契约拒句里点名的迁移 id(「旧形读写两面响亮拒、拒句点名迁移 id」)就到不了运维眼前。
  */
 export declare function describeDomainIssues(error: unknown): string;
+/**
+ * 读告警来自哪条读腿:`center` = 配置中心(web-admin)下发的有效配置(`http-client.ts`);`local` = 本副本自己的 `config.d` / LKG
+ * (`config-provider.ts`)。只有一处读它:**角色词**被丢时的出路句(见 {@link centerRoleWordSentence})。
+ */
+export type ReadWarningLeg = "center" | "local";
 /** 一条读告警 → 它的诊断面(每一种都进:见文件头「归族判据」)。按 kind 的重载只是让调用方拿到窄型(`unread` 一面没有 `error` 句)。 */
 export declare function foldEffectiveReadWarning(w: Extract<EffectiveReadWarning, {
     kind: "unread-config-file";
-}>): Extract<FoldedReadWarning, {
+}>, leg: ReadWarningLeg): Extract<FoldedReadWarning, {
     scope: "unread";
 }>;
 export declare function foldEffectiveReadWarning(w: Exclude<EffectiveReadWarning, {
     kind: "unread-config-file";
-}>): Exclude<FoldedReadWarning, {
+}>, leg: ReadWarningLeg): Exclude<FoldedReadWarning, {
     scope: "unread";
 }>;
-export declare function foldEffectiveReadWarning(w: EffectiveReadWarning): FoldedReadWarning;
+export declare function foldEffectiveReadWarning(w: EffectiveReadWarning, leg: ReadWarningLeg): FoldedReadWarning;
 /**
  * 🔴 S-712 / S-1295 —— **被丢目录条目的载体行**(载体 = `EffectiveConfig.models.droppedCatalogEntries`,读腿铸,随 effective 走 —— 盘上 LKG
  * 从同一个对象落盘,重启从 LKG 起服时它还在)。形的**唯一定义**(型由它推出;判据按它判盘上来的行)。
@@ -130,7 +158,7 @@ export type DroppedCatalogEntry = z.infer<typeof DroppedCatalogEntryRow>;
  * (键名坐标 + 类型词 + 契约整句,值位是洞)、不含配置里的值,只过 `redactSecrets`(契约句的固定词里有引号 / 撇号,引号段读法会把迁移指路整段吞掉)。
  * 坏行本身照样走 `droppedEntries`(坐标 + 字段 + 词,不带值)。
  */
-export declare function splitFoldedReadWarnings(warnings: readonly EffectiveReadWarning[]): {
+export declare function splitFoldedReadWarnings(warnings: readonly EffectiveReadWarning[], leg: ReadWarningLeg): {
     domainErrors: Array<{
         domain: string;
         error: string;

package/dist/web-admin-client/read-warnings.js

@@ -1,5 +1,27 @@
 import { z } from "zod";
-import { DROPPED_ENTRY_REASON_CODES, formatConfigPath, isDisclosableIdentity, renderQuotedSentence, } from "@sema-agent/settings-schema";
+import { DROPPED_ENTRY_REASON_CODES, ModelRole, RETIRED_DOMAINS, RetiredDomainError, formatConfigPath, isDisclosableIdentity, isRetiredDomainName, refuseRetiredDomain, renderQuotedSentence, } from "@sema-agent/settings-schema";
+export function retiredDomainFindingOf(e) {
+    return e instanceof RetiredDomainError ? { domain: e.domain, error: e.message, migration: e.migration } : undefined;
+}
+export function separateRetiredDomains(body) {
+    if (body === null || typeof body !== "object" || Array.isArray(body))
+        return { body, retiredDomains: [] };
+    const findings = [];
+    const rest = { ...body };
+    for (const domain of Object.keys(RETIRED_DOMAINS).filter(isRetiredDomainName)) {
+        try {
+            refuseRetiredDomain(domain, rest[domain]);
+        }
+        catch (e) {
+            const finding = retiredDomainFindingOf(e);
+            if (finding === undefined)
+                throw e;
+            findings.push(finding);
+            delete rest[domain];
+        }
+    }
+    return findings.length === 0 ? { body, retiredDomains: [] } : { body: rest, retiredDomains: findings };
+}
 export function buildUnreadConfigFileFields(f, dir) {
     return {
         ...(dir !== undefined ? { dir } : {}),
@@ -77,12 +99,25 @@ const keyList = (prefix, keys, truncatedFrom) => {
     }
     return `${prefix}${shown.join(", ")}${suffixFor(shown.length)}`;
 };
-export function foldEffectiveReadWarning(w) {
+function droppedRoleWordOf(w) {
+    const p = w.path;
+    const word = p[p.length - 1];
+    return p.length >= 2 && p[p.length - 2] === "roles" && typeof word === "string" && !ModelRole.options.includes(word) ? word : undefined;
+}
+function centerRoleWordSentence(word) {
+    return (`role word ${JSON.stringify(word.slice(0, 40))} published by the configuration center is not one of ${ModelRole.options.join(" / ")} ` +
+        `(settings-schema 12 / core 7.49.0 removed team / synthesize) — the center is on an older settings-schema: upgrade web-admin to settings-schema 12 ` +
+        `(its store migrates on upgrade); this server binds nothing to that role`);
+}
+export function foldEffectiveReadWarning(w, leg) {
     switch (w.kind) {
         case "domain-defaulted":
             return { scope: "domain", domain: w.domain, error: cap(describeDomainIssues(w.error)) };
-        case "entry-dropped":
-            return { scope: "entry", domain: w.domain, entry: formatConfigPath(w.path), error: cap(`entry dropped by domain schema: ${describeSchemaIssues(w.error) ?? errorText(w.error)}`), reasonCode: droppedReasonCodeOf(w) };
+        case "entry-dropped": {
+            const roleWord = leg === "center" ? droppedRoleWordOf(w) : undefined;
+            const error = roleWord !== undefined ? centerRoleWordSentence(roleWord) : `entry dropped by domain schema: ${describeSchemaIssues(w.error) ?? errorText(w.error)}`;
+            return { scope: "entry", domain: w.domain, entry: formatConfigPath(w.path), error: cap(error), reasonCode: droppedReasonCodeOf(w) };
+        }
         case "unknown-keys-dropped":
             return { scope: "domain", domain: w.domain, error: keyList("unknown keys dropped by domain schema: ", w.keys, w.truncatedFrom) };
         case "unknown-keys-carried":
@@ -119,13 +154,13 @@ function identityOf(i) {
     const out = { ...(i.name !== undefined ? { name: i.name } : {}), ...(i.id !== undefined ? { id: i.id } : {}), ...(i.enabled !== undefined ? { enabled: i.enabled } : {}) };
     return Object.keys(out).length > 0 ? out : undefined;
 }
-export function splitFoldedReadWarnings(warnings) {
+export function splitFoldedReadWarnings(warnings, leg) {
     const domainErrors = [];
     const droppedEntries = [];
     const droppedCatalogEntries = [];
     const unreadFiles = [];
     for (const w of warnings) {
-        const f = foldEffectiveReadWarning(w);
+        const f = foldEffectiveReadWarning(w, leg);
         switch (f.scope) {
             case "domain":
                 domainErrors.push({ domain: f.domain, error: f.error });

package/dist/web-admin-client/types.d.ts

@@ -6,7 +6,6 @@
  * internal-lossless: the facade re-exports every symbol below unchanged).
  */
 import type { ToolContentOrigin } from "@sema-agent/core";
-import type { CollabTemplateWire } from "../capabilities/collab-wire.js";
 import type { Autonomy, CommandRule } from "../runtime-governance.js";
 import type { DroppedCatalogEntry } from "./read-warnings.js";
 export interface CenterModel {
@@ -280,11 +279,18 @@ export interface EffectiveConfig {
          *  挂在 effective 上(而不是读结果旁边)是为了**随 effective 落 LKG**:重启从 LKG 起服时它还在。盘上形不对 ⇒ 模型面整组拒。 */
         droppedCatalogEntries?: DroppedCatalogEntry[];
     };
-    /** registry-core 0.7 collab domain (teams' successor) — consumed by the slice-1.5 projection
-     *  (projectCollabToWorkflows → registerCollabWorkflows). Both lanes carry it: the remote worker /effective view
-     *  ships collab, and local FileConfigStore reads config.d/collab.json (PORTABLE_DOMAINS includes collab). */
+    /** The center's collab domain (multi-member discussion templates). **Nothing on this server executes it**: the
+     *  only executor was the engine's team-discussion script, which core 7.49.0 removed. The server reads exactly one
+     *  fact from it — which enabled template ids were published — and reports them as not executed
+     *  (`collabTemplatesNotExecuted`, one warn per apply; the dry-run line reads the same list). Both lanes carry the
+     *  domain (remote /effective ships it; local FileConfigStore reads config.d/collab.json), so the warn fires on both. The template's
+     *  other members (slots / rounds / finalizer …, settings-schema's shape) ride through unread — hence the open index. */
     collab?: {
-        templates: CollabTemplateWire[];
+        templates: ReadonlyArray<{
+            readonly id: string;
+            readonly enabled?: boolean;
+            readonly [member: string]: unknown;
+        }>;
     };
     skills?: {
         skills: CenterSkillManifest[];

package/dist/workspace-cache.d.ts

@@ -0,0 +1,45 @@
+/** `WORKSPACE_CACHE` closed set. `volume` = one cache volume per space; `off` = no volume (the pod as before). */
+export declare const WORKSPACE_CACHE_WORDS: readonly ["volume", "off"];
+export type WorkspaceCacheWord = (typeof WORKSPACE_CACHE_WORDS)[number];
+export declare const WORKSPACE_CACHE_DEFAULT: WorkspaceCacheWord;
+/** `WORKSPACE_CACHE_SIZE` default (a k8s quantity; the claim's requested storage). */
+export declare const WORKSPACE_CACHE_SIZE_DEFAULT = "20Gi";
+/** `WORKSPACE_CACHE_MOUNT` default (an absolute path outside the workspace mount). */
+export declare const WORKSPACE_CACHE_MOUNT_DEFAULT = "/cache";
+/** The label key every cache claim carries (value = the space's 20-hex digest) — the one handle a cleanup selects by. */
+export declare const WORKSPACE_CACHE_SPACE_LABEL = "sema.space";
+/** The effective cache policy — the `workspaceCache` fact's witness and the value of `GET /v1/capabilities.workspaceSync.cache`. */
+export interface WorkspaceCacheCapability {
+    mount: string;
+    size: string;
+}
+/** A k8s resource quantity as a claim size: a positive decimal with an optional binary (`Ki`…`Ei`) or decimal (`k`…`E`) suffix. */
+export declare function isK8sQuantity(v: string): boolean;
+/**
+ * The cache env CLOSED table — one row per tool, the value its cache directory under the mount. Injected only when this
+ * run's pod really carries the volume; an explicit operator value of the same name wins (the pod env merge seat).
+ * Rust is not covered: Cargo has no download-cache-only env — `CARGO_HOME` is its whole home (the rust band bakes its
+ * toolchain proxies and the registry mirror `config.toml` there), so pointing it at the volume would lose both.
+ */
+declare const CACHE_ENV_ROWS: {
+    readonly GRADLE_USER_HOME: (mount: string) => string;
+    readonly MAVEN_OPTS: (mount: string) => string;
+    readonly npm_config_cache: (mount: string) => string;
+    readonly PIP_CACHE_DIR: (mount: string) => string;
+    readonly UV_CACHE_DIR: (mount: string) => string;
+    readonly GOMODCACHE: (mount: string) => string;
+};
+export type WorkspaceCacheEnvName = keyof typeof CACHE_ENV_ROWS;
+export declare const WORKSPACE_CACHE_ENV_NAMES: readonly WorkspaceCacheEnvName[];
+/** The cache env for a volume mounted at `mount` (every row of the closed table). */
+export declare function workspaceCacheEnv(mount: string): Record<WorkspaceCacheEnvName, string>;
+/** The space's cache claim — the ONE place its name and label are spelled. `spaceKey` = the space partition (the occupant's
+ *  incarnation); only a one-way 20-hex digest of it reaches the cluster (a claim name / label is visible to cluster operators). */
+export declare function workspaceCacheClaimOf(spaceKey: string): {
+    name: string;
+    label: string;
+};
+/** Does the cache mount overlap the workspace mount (equal, or one inside the other)? Both are absolute, normalized paths. */
+export declare function mountsOverlap(a: string, b: string): boolean;
+export {};
+//# sourceMappingURL=workspace-cache.d.ts.map

package/dist/workspace-cache.js

@@ -0,0 +1,30 @@
+import { createHash } from "node:crypto";
+export const WORKSPACE_CACHE_WORDS = ["volume", "off"];
+export const WORKSPACE_CACHE_DEFAULT = "off";
+export const WORKSPACE_CACHE_SIZE_DEFAULT = "20Gi";
+export const WORKSPACE_CACHE_MOUNT_DEFAULT = "/cache";
+export const WORKSPACE_CACHE_SPACE_LABEL = "sema.space";
+export function isK8sQuantity(v) {
+    return /^(?=.*[1-9])[0-9]+(\.[0-9]+)?(Ki|Mi|Gi|Ti|Pi|Ei|k|M|G|T|P|E)?$/.test(v);
+}
+const CACHE_ENV_ROWS = {
+    GRADLE_USER_HOME: (mount) => `${mount}/gradle`,
+    MAVEN_OPTS: (mount) => `-Dmaven.repo.local=${mount}/m2`,
+    npm_config_cache: (mount) => `${mount}/npm`,
+    PIP_CACHE_DIR: (mount) => `${mount}/pip`,
+    UV_CACHE_DIR: (mount) => `${mount}/uv`,
+    GOMODCACHE: (mount) => `${mount}/go`,
+};
+export const WORKSPACE_CACHE_ENV_NAMES = Object.keys(CACHE_ENV_ROWS);
+export function workspaceCacheEnv(mount) {
+    return Object.fromEntries(WORKSPACE_CACHE_ENV_NAMES.map((name) => [name, CACHE_ENV_ROWS[name](mount)]));
+}
+export function workspaceCacheClaimOf(spaceKey) {
+    const digest = createHash("sha256").update(spaceKey).digest("hex").slice(0, 20);
+    return { name: `ws-cache-${digest}`, label: digest };
+}
+export function mountsOverlap(a, b) {
+    const inside = (x, y) => x === y || x.startsWith(y.endsWith("/") ? y : `${y}/`);
+    return inside(a, b) || inside(b, a);
+}
+//# sourceMappingURL=workspace-cache.js.map