@sema-agent/server 7.134.0 → 7.136.0

package/dist/web-admin-client/read-face.d.ts

@@ -5,7 +5,7 @@
  * 此前是这条轴上的唯一入口:一个用 web-admin 管理整片 worker 的组织,想统一收紧 READ 面只能逐机改 env。本模块把
  * `EffectiveConfig.readFace`(见 types.ts {@link CenterReadFace})投影到同样的四个 `ServiceConfig` 键上。
  *
- * ── 生效时机:**逐席由引擎答**(S-174 起 face;S-1560 / core 7.51.0 起四席全热)──────────────────────────
+ * ── 生效时机:**逐席由引擎答**([ref] 起 face;[ref] / core 7.51.0 起四席全热)──────────────────────────
  * 哪些席能热换,不是本仓的意见:`KEY_MAP` 每行的 `cfgKey` 就是 core 的席名,能不能热换由 core 的 `isSwappableDepSeat` 亲答
  * ({@link CENTER_READ_FACE_LIVE_KEYS})。本模块按这**一个**判据分相({@link CenterReadFaceApply}):
  *  · `boot` 相 —— 四键全落(Runner 还没建,每一席都还会 bake);
@@ -15,7 +15,7 @@
  *    轴上最危险的谎(读面说收紧了、执行面没有)。
  * 落配、`applied` 日志、换席候选、重启片的指纹读的是**同一个**判据 —— core 把某席移进 / 移出闭集,四处自动一起走
  * (core 7.51.0 把读拒三席移了进去,而 live 相的落配当时是一句手写的「deny 三键只在 boot 相落」,与另三处的派生读法分家:
- * 重启片说「热了」、落配说「不落」,组织收紧读拒规则 ⇒ 既不生效也不要求重启。S-1560 收成一个判据)。
+ * 重启片说「热了」、落配说「不落」,组织收紧读拒规则 ⇒ 既不生效也不要求重启。[ref] 收成一个判据)。
  *
  * ── 三条规则,每条都有失败方向的论证 ──────────────────────────────────────────────────────────
  *

package/dist/web-admin-client/read-warnings.d.ts

@@ -18,7 +18,7 @@
  * 此前「值已被收编接受」的两种告警 `hosts-grandfathered` / `legacy-governance-lifted` 随抬升臂一起退役,旧形由一次性迁移改写,
  * 读侧遇旧形一律拒 —— 没有「不入诊断面」的那一族了。)
  *
- * 🔴 S-704 ②(2026-09-24,凭据轴):此前 `entry-dropped` 归「候选门错误」(settings-schema 2.0.0 提货时的归族),于是
+ * 🔴 [ref] ②(2026-09-24,凭据轴):此前 `entry-dropped` 归「候选门错误」(settings-schema 2.0.0 提货时的归族),于是
  * schema 的**逐条容错**在本仓的 refresh / 迟到 boot 两条腿上被**还原成整份拒** —— 目录里一条 `contextWindow:"abc"`
  * 就让整份目录停在上一代;而上一代若还是 env(boot 拉取失败 / 超窗且无 LKG),env 模型就一直服务、env 钥匙一直被送到
  * 网关缺省端点(红先实测:`config_candidate_rejected` + env 模型继续服务)。粒度对了规则反而更少:颗粒是条目的失效
@@ -86,7 +86,7 @@ export declare function buildUnreadConfigKeyFields(k: UnreadConfigKey, dir: stri
 /** `config_unread_file` 一行的体(纯数据;起服 / 刷新 / 迟到起服与 `run-local` 同一体):`dir` = 本地读腿的配置根。 */
 export declare function buildUnreadConfigFileFields(f: UnreadConfigFile, dir: string | undefined): Record<string, unknown>;
 /** 逐条丢弃面的一行(两条读腿的 `droppedEntries` 同形,`config_entry_dropped` 日志行读它):`entry` = 被丢那条的出门形坐标(`models.1`),
- *  `error` = 哪些字段、为什么(人读),`reasonCode` = 为什么丢的**闭集词**(S-1295:settings-schema 铸、原样过境 —— 目录行的
+ *  `error` = 哪些字段、为什么(人读),`reasonCode` = 为什么丢的**闭集词**([ref]:settings-schema 铸、原样过境 —— 目录行的
  *  `GET /v1/models.droppedEntries[].reasonCode` 就是这同一个词,取自同一次折叠的同一行)。 */
 export type DroppedConfigEntry = {
     readonly domain: string;
@@ -133,14 +133,14 @@ export declare function foldEffectiveReadWarning(w: Exclude<EffectiveReadWarning
 }>;
 export declare function foldEffectiveReadWarning(w: EffectiveReadWarning, leg: ReadWarningLeg): FoldedReadWarning;
 /**
- * 🔴 S-712 / S-1295 —— **被丢目录条目的载体行**(载体 = `EffectiveConfig.models.droppedCatalogEntries`,读腿铸,随 effective 走 —— 盘上 LKG
+ * 🔴 [ref] / [ref] —— **被丢目录条目的载体行**(载体 = `EffectiveConfig.models.droppedCatalogEntries`,读腿铸,随 effective 走 —— 盘上 LKG
  * 从同一个对象落盘,重启从 LKG 起服时它还在)。形的**唯一定义**(型由它推出;判据按它判盘上来的行)。
  *
  * **规则一条:读腿把 schema 逐条丢掉的每一条目录条目(`models` 域的 `["models", <下标>]`)记一行,写入时不挑;每个读者读自己要的那一部分。**
  *  · 墓碑判据(`model-entry-refusal.ts` `judgeCatalogEntries`)—— 有名(`identity.name`)且未停用(`identity.enabled !== false`)的行;
  *  · `GET /v1/models` 的 `droppedEntries`({@link buildDroppedEntriesWire})—— 每一行的下标、闭集词与可披露身份;
  *  · `config_entry_dropped` 日志行读的是这一行由之而来的那条折叠行({@link DroppedConfigEntry},同一次折叠、同一个词)。
- * (修前 S-712 的载体 `droppedIdentities` 在写入时只收「有名且启用」的行 —— 那是墓碑读者的筛子,装在了写入处;同一件事于是没有
+ * (修前 [ref] 的载体 `droppedIdentities` 在写入时只收「有名且启用」的行 —— 那是墓碑读者的筛子,装在了写入处;同一件事于是没有
  * 第二个读者可用。筛子回到读者那里,载体就只剩「记下发生了什么」这一条律。)
  *
  * 🔐 不含值:`identity` 取告警自带的身份(settings-schema 只铸可披露的标识符 —— 秘密形 / 非标识符的串 ⇒ 该键缺席,三键都没有 ⇒ 整个缺席);
@@ -191,7 +191,7 @@ export interface DroppedEntryWireRow {
     readonly identity?: DroppedEntryIdentity;
 }
 /**
- * S-1295 —— 本代目录的被丢条目(`config.droppedCatalogEntries`)→ `GET /v1/models` 的 `droppedEntries`。纯投影,**唯一**出口。
+ * [ref] —— 本代目录的被丢条目(`config.droppedCatalogEntries`)→ `GET /v1/models` 的 `droppedEntries`。纯投影,**唯一**出口。
  *  · 词:settings-schema 的闭集原样过境({@link reasonCodeForWire} 穷举:包加词 / 删词 ⇒ 本仓编译红,逼一次「这个词能不能上 wire」的显式决定);
  *  · 身份:`name` / `id` 在出口再问一次包的 `isDisclosableIdentity`(唯一判据,import 不复制)—— 载体可能来自被手改的盘上 LKG,读腿铸的身份
  *    本来就过了同一只判据;不可披露 ⇒ 该键不出门(不打码:打过码的串不再是身份);`enabled` 是布尔照带;三键都不剩 ⇒ `identity` 缺席;

package/dist/web-admin-client/restart-signal.d.ts

@@ -5,7 +5,7 @@ export type RestartSlice = "skills" | "mcp" | "a2a" | "scenarios" | "degrade-rou
  *  slices cannot see them, because they are configured from env (`ServiceConfig`), not from the center's
  *  EffectiveConfig. Absent/empty = that lane is off ⇒ its slice is inert (null on both sides). */
 export interface RestartSliceCtx {
-    /** S-794:反应式降级壳的两侧读数 —— `baked` = createBrain 组壳那一刻焊进去的目标路由指纹,`current` = 同一只
+    /** [ref]:反应式降级壳的两侧读数 —— `baked` = createBrain 组壳那一刻焊进去的目标路由指纹,`current` = 同一只
      *  指纹函数(brain.ts `degradeRouteFingerprint`)对本拍活配置再读一次(`baked` 的出处见 brain.ts `createBrainAssembly`)。
      *  缺席 = 调用方没有递席(单元调用)⇒ `degrade-route` 片恒不签;车道没开 / 没焊壳在席内表达为两侧同为 null。
      *  (此前的 `reactiveDegradeTo` 位只剩「阀门开着」一义,已并进本席 —— 一位不留两义。) */
@@ -24,7 +24,7 @@ export interface RestartSliceCtx {
      *  新增/改址/域整体出现或消失仍签(新 mount / 改址只能 restart 才生效)。缺席/false = 旧语义照签
      *  (fail-closed:没接席的部署里删除向没人承接,restart 是它唯一的生效路径)。 */
     mcpRevocationLive?: boolean;
-    /** S-668 波 0(过渡;**波 1 转热后删**)+ 车PI 修复轮 ⑥:记忆整理**阀门判决**的两侧读数(一只 watch,读法见
+    /** [ref] 波 0(过渡;**波 1 转热后删**)+ 车PI 修复轮 ⑥:记忆整理**阀门判决**的两侧读数(一只 watch,读法见
      *  boot/memory-consolidation.ts `createConsolidationValveWatch`)—— `baked` = boot 判决的投影,`current` = 拿本拍活配置
      *  重判一次的投影;投影 = 开着 ⇒ `{ valve: "on", seat: 整理座指纹 }`、关着 ⇒ `{ valve: "off" }`。判决翻了(派生开 ↔ 关)或
      *  开着而座漂了 ⇒ 两侧不等 ⇒ 签。缺席 = 判决不随目录变(显式 off,或结构上跑不起来的派生关)⇒ 恒不签。 */
@@ -32,12 +32,12 @@ export interface RestartSliceCtx {
         readonly baked: unknown;
         readonly current: unknown;
     };
-    /** S-668 波 0(codex r1 [medium]):插件 host 白名单(env `PLUGINS_ALLOW_HOSTS`,boot 常量)—— 白名单外的声明
+    /** [ref] 波 0(codex r1 [medium]):插件 host 白名单(env `PLUGINS_ALLOW_HOSTS`,boot 常量)—— 白名单外的声明
      *  装载器整条跳过,它们的变化不是重启理由。生产 `restartCtx` 恒传 `config.pluginsAllowHosts`;缺席(单元调用)
      *  = 装载器的出厂名单 `DEFAULT_PLUGIN_ALLOW_HOSTS`。 */
     pluginsAllowHosts?: readonly string[];
 }
-/** S-741(车OG):本引擎发布的重启信号。形的唯一定义是 settings-schema 6.1.0 `RestartSignal`(`{ reasons, version, since }`,在场即信号,
+/** [ref](车OG):本引擎发布的重启信号。形的唯一定义是 settings-schema 6.1.0 `RestartSignal`(`{ reasons, version, since }`,在场即信号,
  *  不夹 `restartRequired` 布尔;本地手写的那份接口已删),这里只把 `reasons` 收窄到本文件的闭集 {@link RestartSlice} —— 写口
  *  (`boot/web-admin.ts` `publishRestart`)按它收,拼错 / 已退役的词编译红(opus 对抗腿 #2:直接用上游型时 `reasons` 是
  *  `string[]`,闭集的编译期判据丢了)。`/health.restart` 与 fleet 心跳 `restart` 两个出口交 web-admin 同一只 `restartState()`
@@ -52,7 +52,7 @@ export type EngineRestartSignal = RestartSignal & {
  *  fields:
  *    - `cost`'s VALUES — refreshed by `mutateInPlace(pricing, buildPricing(config.models))`, and core prefers
  *                      `deps.pricing[model.id]` over the (possibly frozen) `Model.cost`, so a pure re-pricing
- *                      needs neither a swap nor a restart. 🔴 B-089:its PRESENCE is subtracted no longer —
+ *                      needs neither a swap nor a restart. 🔴 [ref]:its PRESENCE is subtracted no longer —
  *                      a roster row WITHOUT `cost` now mints no `cost` key (unpriced) and therefore no pricing
  *                      row, and core's fallback is literally `deps.pricing?.[id] ?? modelCostToPricing(model.cost)`
  *                      (core 7.13.0 run-settle-and-teardown.js and three siblings) — so a FROZEN generation
@@ -67,7 +67,7 @@ export type EngineRestartSignal = RestartSignal & {
  *  so the failure mode of drift is a spurious restart, never a silently missed one.
  *
  *  Shared by BOTH frozen-entry consumers — the `modelPlaneChanged` swap gate (over catalog entries) and brain.ts
- *  `degradeRouteFingerprint` (over the Model the reactive-degrade shell welded, S-794) — so "which fields are hot"
+ *  `degradeRouteFingerprint` (over the Model the reactive-degrade shell welded, [ref]) — so "which fields are hot"
  *  is answered once. (复审 2026-07-29 留档:the since-retired `models-tiers` slice had
  *  kept all three, so on a tiers-active deployment a pure re-pricing / weight tweak / serializer writing
  *  `enabled:true` rolling-restarted the fleet.) For the swap gate a subtracted field means "no swap needed": the

package/dist/web-admin-client/skills-mcp.d.ts

@@ -1,17 +1,42 @@
-import { type A2aServerSpec, type McpServerSpec } from "@sema-agent/core";
+import { type A2aServerSpec, type McpServerSpec, type SkillSpec } from "@sema-agent/core";
 import type { CenterMcp, ScopedA2aPeer } from "../config-types.js";
 import type { Logger } from "../observability/logger.js";
 import type { LoadedSkill } from "../capabilities/skills.js";
 import type { ConfigProvider } from "../config-provider.js";
 import type { CenterA2aPeer, CenterMcpServer, CenterSkillManifest } from "./types.js";
 /**
- * 技能正文的来源 = **拉到这份清单的配置源自己**(S-1556):`fetchSkillContent(contentHash)` 按 hash 答正文 —— 远程 = 中心内容端点
+ * 技能正文的来源 = **拉到这份清单的配置源自己**([ref]):`fetchSkillContent(contentHash)` 按 hash 答正文 —— 远程 = 中心内容端点
  * (传输自验 hash;未知 hash ⇒ `undefined`),本地 = config.d 里内联的正文(与清单同一种容错读);`skillBodyCacheDir` = 这只配置源
  * 声明的正文盘缓存目录(远程且开着 LKG 才有;本地恒缺席 —— 正文本就在这块盘上)。本函数不知道、也不问是哪一种。
  */
 export type SkillBodySource = Pick<ConfigProvider, "fetchSkillContent" | "skillBodyCacheDir">;
 /**
- * The skills domain's ONE read port (S-1556; [ref]-sibling B1; `web-admin docs/MCP-SKILLS.md`). Load order =
+ * 技能两只工具名单(`allowedTools` / `disallowedTools`)的**唯一承运口**([ref]):配置源交来的名单 → 引擎 `SkillSpec` 上的同名两键。**缺席 ⇒ 键不出现**(不物化成 `undefined`、不填 `[]`);
+ * **在场 ⇒ 整只数组原样**(含 `[]`;不去重、不排序、不判拼写 —— settings-schema 14.4.0 的读法一句话,判官在引擎:`allowedTools` 是 allow 规则来源、`disallowedTools` 拒侧读成空的条目让
+ * 那次激活 fail-closed)。数组复制一份:规格上的数组是引擎规格自己的,不与配置源手里的 manifest / 本地店对象共享。
+ *
+ * 本函数住在技能域的读口旁,三个读者共用 —— 本地腿 CLOSED 投影(`config-provider.ts` 的 `mapToServiceEffective`)、manifest → 规格的铸点({@link applySkillsManifest})、
+ * 已装技能 ↔ manifest 的投影一致判据({@link installedSkillMatchesManifest}):三处各写一份键表就是下一次同形丢位([ref] 族)。契约再加一个技能键时的看守不在这里,
+ * 在 `test/skill-tool-lists-carry.test.ts` 的键处置表(按 `keyof SkillSpec` 铸型)与 `test/settings-schema-consumption-gates.test.ts` 门 4(叶路径由契约形状派生)。
+ */
+export declare function skillToolListsOf(source: {
+    readonly allowedTools?: readonly string[];
+    readonly disallowedTools?: readonly string[];
+}): Pick<SkillSpec, "allowedTools" | "disallowedTools">;
+/**
+ * 一只**已装**技能的运行期投影与配置源 manifest 条目一致吗(启动期 LKG 复核用:同名出厂技能在中心正文拉取失败后留任,名 / 正文 hash / 描述 / 场景可能碰巧相同,
+ * 运行期投影却不同 —— 此时进程跑着旧规格,必须算「未装上」)。判据 = {@link applySkillsManifest} 铸 {@link LoadedSkill} 时从 manifest 取的**全部**运行期成员:名、正文(按 hash)、
+ * 描述、场景集合(与顺序无关)、两只工具名单(逐条,{@link skillToolListsOf} 的承运形)。铸点多取一位,这里同拍多比一位 —— 两处放在一起就是为了不再漂。
+ */
+export declare function installedSkillMatchesManifest(installed: LoadedSkill, m: CenterSkillManifest): boolean;
+/**
+ * 启动期复核:manifest 里**要求已装上**的条目哪些没装上(见 {@link installedSkillMatchesManifest} 的判据)。「要求已装上」的集合与 {@link applySkillsManifest} 铸点是同一条规则:
+ * `enabled:false` 的不参与;**同名多条后者赢**(铸点对重名发一行 `web_admin_skill_duplicate_name` 并以最后一条为准)—— 前面被盖掉的重名条目不是『没装上』,
+ * 否则一份只在名单上有差的重名发布(合法解析、零告警)会让每次起服都发一次 skills 重启信号。后者装不上(正文缺席 / 读失败)而前者留任 ⇒ 后者算没装上。
+ */
+export declare function skillManifestEntriesNotInstalled(installed: readonly LoadedSkill[], entries: readonly CenterSkillManifest[]): CenterSkillManifest[];
+/**
+ * The skills domain's ONE read port ([ref]; [ref]-sibling B1; `web-admin docs/MCP-SKILLS.md`). Load order =
  * `loadSkills(SKILLS_DIR)` baseline → the config source's skills (web-admin center OR local `config.d` — same manifest
  * shape, same code path) overlaid BY NAME (config wins on a clash → can override a built-in; guarded center-side by
  * publisher RBAC + the publish gate). `enabled:false` is skipped and never fetched. Bodies come from `bodies` by content

package/dist/web-admin-client/skills-mcp.js

@@ -4,6 +4,34 @@ import { readMcpToolAxes, readToolFaces } from "@sema-agent/core";
 import { MCP_CONTENT_ORIGINS, describeBadContentOrigin, describeBadWireName, isContentOriginWord, isUsableWireName } from "@sema-agent/settings-schema";
 import { noteMcpAssertionHeaderNotSent, sentMcpAssertionHeaderMember, withholdsMcpAssertionHeader } from "../mcp-assertion-header.js";
 import { SHA256_HEX_RE } from "../digest-form.js";
+export function skillToolListsOf(source) {
+    return {
+        ...(source.allowedTools !== undefined ? { allowedTools: [...source.allowedTools] } : {}),
+        ...(source.disallowedTools !== undefined ? { disallowedTools: [...source.disallowedTools] } : {}),
+    };
+}
+function sameToolList(a, b) {
+    if (a === undefined || b === undefined)
+        return a === b;
+    return a.length === b.length && a.every((entry, i) => entry === b[i]);
+}
+export function installedSkillMatchesManifest(installed, m) {
+    const canonScenarios = (a) => [...(a ?? [])].sort().join("\u0000");
+    const lists = skillToolListsOf(m);
+    return (installed.spec.name === m.name &&
+        skillContentHash(installed.spec.content) === m.contentHash &&
+        installed.spec.description === m.description &&
+        canonScenarios(installed.scenarios) === canonScenarios(m.scenarios) &&
+        sameToolList(installed.spec.allowedTools, lists.allowedTools) &&
+        sameToolList(installed.spec.disallowedTools, lists.disallowedTools));
+}
+export function skillManifestEntriesNotInstalled(installed, entries) {
+    const winners = new Map();
+    for (const m of entries)
+        if (m.enabled !== false)
+            winners.set(m.name, m);
+    return [...winners.values()].filter((m) => !installed.some((sk) => installedSkillMatchesManifest(sk, m)));
+}
 function skillBodyPresent(body) {
     return body !== undefined && body !== "";
 }
@@ -63,7 +91,7 @@ export async function applySkillsManifest(baseline, manifest, bodies, logger) {
             }
             contentCache.set(m.contentHash, content);
             const overrodeBuiltin = byName.has(m.name);
-            byName.set(m.name, { spec: { name: m.name, description: m.description, content }, scenarios: m.scenarios ?? [] });
+            byName.set(m.name, { spec: { name: m.name, description: m.description, content, ...skillToolListsOf(m) }, scenarios: m.scenarios ?? [], source: "center" });
             logger?.info("web_admin_skill", { name: m.name, hash: m.contentHash, scenarios: m.scenarios, overrodeBuiltin });
         }
         catch (err) {

package/dist/web-admin-client/types.d.ts

@@ -48,7 +48,7 @@ export interface CenterModel {
      *  此后记账,不回算窗口内历史(registry types.d.ts 同句契约)。 */
     quotaWeight?: number;
     /**
-     * S-188(settings-schema 1.10.0 `ModelEntry.compat`)—— 这条目录条目对 **openai-completions 线路**的
+     * [ref](settings-schema 1.10.0 `ModelEntry.compat`)—— 这条目录条目对 **openai-completions 线路**的
      * 兼容声明,上 core `Model.compat`(`OpenAICompletionsCompat` 五键)。真需求 = vLLM / Qwen 类**缺省开
      * 思考**的网关:关思考只能靠 `thinkingFormat: "qwen-chat-template"`(`chat_template_kwargs.
      * enable_thinking=false`),而 `extraBody` 穿不过引擎的 OpenAI 保留键表。
@@ -82,9 +82,9 @@ export interface CenterModel {
      *  the missing leg made every promptGuidance pilot a false control). */
     promptGuidance?: string[];
     /**
-     * S-931(7.108.0)—— 这条条目发给供应商的**附加请求头**(部署 ↔ 供应商的契约;今天只有 `anthropic-beta`),上 core 的 per-model
+     * [ref](7.108.0)—— 这条条目发给供应商的**附加请求头**(部署 ↔ 供应商的契约;今天只有 `anthropic-beta`),上 core 的 per-model
      * 头座 `Model.headers`。类型是 `unknown` 而不是那个结构,理由与 {@link CenterModel.compat} 逐字同:本类型是承载形,判据(闭集白名单 +
-     * 线路 + 值形)与坏形处置的单一属主是 `model-entry-headers.ts`(执法点 = S-704 逐条判据,判不过 ⇒ 条目不可用)。
+     * 线路 + 值形)与坏形处置的单一属主是 `model-entry-headers.ts`(执法点 = [ref] 逐条判据,判不过 ⇒ 条目不可用)。
      * ⚠️ 两条读腿今天**剥掉**它(settings-schema 6.3.0 `ModelEntry` 无此键;候裁加字段):今天到得了这里的只有绕过读腿的输入。
      */
     headers?: unknown;
@@ -102,6 +102,13 @@ export interface CenterSkillManifest {
     scenarios: string[];
     contentHash: string;
     enabled?: boolean;
+    /**
+     * 技能自带的两只工具名单(settings-schema 14.4.0 `SkillSpec.allowedTools?` / `disallowedTools?`,与引擎 `SkillSpec` 同名同形)。**缺席 ⇒ 键不出现;在场 ⇒ 整只数组原样
+     * 交给引擎**(逐条按作者所写:不去重 / 不排序 / 不判拼写;`[]` 与缺席是两种承运形,读成什么由引擎定)。本仓只承载,不判 —— 判官是引擎(拒侧读成空的条目 fail-closed)。
+     * 承运单点 = {@link skillToolListsOf}(`skills-mcp.ts`):本地腿投影与 manifest → 引擎规格的铸点读同一只。
+     */
+    allowedTools?: string[];
+    disallowedTools?: string[];
 }
 /** MCP server registry entry. `envRefs`/`headerRefs` are env-NAME refs (target-key → ENV_NAME), NOT secrets. */
 export interface CenterMcpServer {
@@ -137,7 +144,7 @@ export interface CenterMcpServer {
      * 自动翻红逼销账。
      */
     contentOrigin?: ToolContentOrigin;
-    /** B-036 / S-143:声明方自述的分组标签(开集,非空 ≤80;settings-schema 1.7.0 `McpServerSpec.source`)——上 core
+    /** [ref] / [ref]:声明方自述的分组标签(开集,非空 ≤80;settings-schema 1.7.0 `McpServerSpec.source`)——上 core
      *  `McpServerSpec.source`,由 `wiring_manifest.mcp[].source` 逐字回显。显示用,不进信任轴。 */
     source?: string;
     /**
@@ -152,13 +159,13 @@ export interface CenterMcpServer {
      */
     toolFaces?: unknown;
     /**
-     * S-1475(settings-schema 12.2.x `McpServerSpec.toolAxes`,解析透明 `z.unknown()`)—— 部署侧为这台 server 的**每只工具**声明的
+     * [ref](settings-schema 12.2.x `McpServerSpec.toolAxes`,解析透明 `z.unknown()`)—— 部署侧为这台 server 的**每只工具**声明的
      * 风险轴(`effect` / `egress` / `irreversibility`),键 = server 的**原始(未加命名空间)**工具名,上 core
      * `McpServerSpec.toolAxes`。
      *
      * 🔴 类型是 `unknown` 而不是那个结构,**刻意的**(与 {@link CenterMcpServer.toolFaces} 逐字同姿):本类型是两条部署腿的**承载形**
      * (本地 config.d 经 `z.unknown()` 解析透明地过来、远端 /effective 是直读 JSON),形判与投影的单一属主是**引擎**根导出的
-     * `readMcpToolAxes`(core 7.51.2 #1763;`resolveMcpServers` 在铸 spec 那一刻调它;产出的型是引擎的 `McpServerSpec["toolAxes"]`;本仓自铸的那一只
+     * `readMcpToolAxes`(core 7.51.2 [ref];`resolveMcpServers` 在铸 spec 那一刻调它;产出的型是引擎的 `McpServerSpec["toolAxes"]`;本仓自铸的那一只
      * 7.129.0 退役)。坏形 ⇒ 整条 server 不进 + 一行 `web_admin_mcp_tool_axes_invalid`。
      * (同批解析透明键 `authForm` / `entryKind` 的语义归连接器,本层仍只承载。)
      */
@@ -290,7 +297,7 @@ export interface EffectiveConfig {
         atMention?: unknown;
         tierGroups?: unknown;
         activeTierGroup?: string;
-        /** 🔴 S-712 / S-1295 —— **本仓读腿铸的**载体(不是 wire 键:中心在模型域里写同名键会被 schema 当未知键剥掉并进候选门):这次读
+        /** 🔴 [ref] / [ref] —— **本仓读腿铸的**载体(不是 wire 键:中心在模型域里写同名键会被 schema 当未知键剥掉并进候选门):这次读
          *  被 schema 逐条丢掉的**每一条**目录条目一行(下标 + settings-schema 闭集词 `reasonCode` + 告警自带的 `identity` + 字段诊断;形与律见
          *  `read-warnings.ts` {@link DroppedCatalogEntry})。读者各取所需:模型面 stage 把有名且启用的行铸成 `config.model_entry_invalid` 墓碑
          *  (不变量 `refused-names-not-minted` 据此判增广),每一行与 `models` 同 commit 进 `config.droppedCatalogEntries`(`GET /v1/models.droppedEntries` 的源)。
@@ -353,7 +360,7 @@ export interface EffectiveConfig {
     /** settings-schema 0.6 起治理三件(autonomy/commandPolicy/approvalRequire)的**唯一**承运域(0.7.1 撤
      *  runtime 位双写镜像;顺序契约当年已走完:消费端先切、center 再撤)。键集与 schema `GovernanceConfig.shape`
      *  逐字相等([ref] 件3 对账门钉)。消费:autonomy/commandPolicy 逐请求热(`stageRuntimeHot`,boot+refresh);
-     *  approvalRequire 自 S-668 波 2 起同样热(`stageApprovalGate`,boot+refresh 双腿,有自己的拒绝臂)。
+     *  approvalRequire 自 [ref] 波 2 起同样热(`stageApprovalGate`,boot+refresh 双腿,有自己的拒绝臂)。
      *  同一 presence 规则(undefined = 不管 → 回 env 基线,非粘)。 */
     governance?: {
         autonomy?: Autonomy;
@@ -379,7 +386,7 @@ export interface EffectiveConfig {
  *  ruling riding the caps view. `required=false` / ruling absent = no enforcement (legacy). `allowedLanes` is
  *  an OPEN value domain (adding one is never BREAKING; consumers tolerate unknown names). Known lane names:
  *  `host`/`e2b`/`k8s`/`ssh`/`adb`/`local-docker`/`device` (the REMOTE_EXEC providers) **plus `in-process`**
- *  — the REMOTE_EXEC-unset fleet posture (S-601: previously "OA/review-style workers", a scenario family retired in 5.0.0; named distinctly from the explicit
+ *  — the REMOTE_EXEC-unset fleet posture ([ref]: previously "OA/review-style workers", a scenario family retired in 5.0.0; named distinctly from the explicit
  *  `host` lane on purpose). ⚠️ Admins writing `required=true` policies must include `in-process` when such
  *  workers should stay admittable — center UI/doc 词表待补齐。
  *

package/dist/workspace-space.d.ts

@@ -63,6 +63,33 @@ export interface WorkspaceSpacePolicy {
 export interface WorkspaceSyncCapability extends WorkspaceSpacePolicy {
     timeoutMs: number;
 }
+/** `WORKSPACE_SNAPSHOT_PREFIX` unset ⇒ this prefix (the first segment of every snapshot object key of both lanes). */
+export declare const WORKSPACE_SNAPSHOT_PREFIX_DEFAULT = "kata";
+/**
+ * The ONE form of a snapshot-key segment — the partition (incarnation / session id), the snapshot id, the object name and each segment of
+ * the key prefix all pass it before a key is signed: it starts with a letter or digit, then letters, digits, `.`, `_`, `-`. No `/`, no `..`,
+ * no empty segment, no character a key could be rewritten or traversed by.
+ */
+export declare const SNAPSHOT_KEY_SEGMENT: RegExp;
+/** The refusal code of a `WORKSPACE_SNAPSHOT_PREFIX` outside the closed form (the `config.*` family; fatal-exit prints it). */
+export declare const WORKSPACE_SNAPSHOT_PREFIX_INVALID = "config.workspace_snapshot_prefix_invalid";
+/**
+ * Why a snapshot key prefix is outside the closed form (`undefined` = inside): a prefix is a `/`-separated path of {@link SNAPSHOT_KEY_SEGMENT}s —
+ * one segment (`kata`, the form every release has accepted) or several (`libA/ws`, so one bucket can be partitioned by owner). Answers the
+ * first bad segment (1-based) and why. The ONE judge: the config loader refuses boot with it, the adapter refuses to sign a key with it.
+ */
+export declare function snapshotKeyPrefixProblem(prefix: string): {
+    readonly segment: number;
+    readonly of: number;
+    readonly value: string;
+    readonly why: string;
+} | undefined;
+/**
+ * `WORKSPACE_SNAPSHOT_PREFIX` — the key prefix of both lanes' snapshot objects (`<prefix>/<incarnation>/space/…`, `<prefix>/<sessionId>/…`): a
+ * `/`-separated path of plain segments, one or more (`kata`, `libA/ws`). Unset / empty ⇒ `undefined` (the adapter's default
+ * {@link WORKSPACE_SNAPSHOT_PREFIX_DEFAULT} holds). A bad value refuses boot naming the first bad segment — the value is a path, never a secret, so it is echoed.
+ */
+export declare function parseWorkspaceSnapshotPrefix(raw: string | undefined): string | undefined;
 /** The refusal code of a `WORKSPACE_SNAPSHOT_EXCLUDE` item outside the closed form (the `config.*` family; fatal-exit prints it). */
 export declare const WORKSPACE_SNAPSHOT_EXCLUDE_INVALID = "config.workspace_snapshot_exclude_invalid";
 /**
@@ -90,9 +117,11 @@ export interface EndedSpace {
     readonly sessionId: string;
     readonly spaceKey: string;
 }
-/** The closed word set of `workspace_cache_reclaim_failed.reason` — ONE owner for both legs of the reclaim (the seat in
- *  `plugins/remote-env-k8s.ts` says `delete_failed` / `budget`; the session-delete coordinator says `occupant_unreadable`). */
-export type CacheReclaimReason = "delete_failed" | "budget" | "occupant_unreadable";
+/** The closed word set of `workspace_cache_reclaim_failed.reason` — said by the ONE reclaim seat (`plugins/remote-env-k8s.ts`). The
+ *  session-delete coordinator's third word (`occupant_unreadable`, a second read of the deleted session's occupant that could fail on its own)
+ *  is retired: the coordinator takes the space key from the same head read its owner fence judges (`boot/session-faces.ts`), so there is
+ *  no second read to fail — a head read that throws fails the delete itself (retried to convergence). */
+export type CacheReclaimReason = "delete_failed" | "budget";
 /**
  * The ONE reclaim seat for an ended space — called where a space ENDS: the session-delete coordinator (`boot/session-faces.ts` `purgeSession`)
  * and the managed-retention sweep after it deletes session trees (`boot/retention-lane.ts`); neither writes a reclaim of its own. It reclaims

package/dist/workspace-space.js

@@ -9,6 +9,32 @@ export const WORKSPACE_SNAPSHOT_TIMEOUT_MS_RANGE = { min: 30_000, max: 3_600_000
 export function workspaceSnapshotTimeoutOf(lane) {
     return lane.workspaceSnapshotTimeoutMs ?? WORKSPACE_SNAPSHOT_TIMEOUT_MS_DEFAULT;
 }
+export const WORKSPACE_SNAPSHOT_PREFIX_DEFAULT = "kata";
+export const SNAPSHOT_KEY_SEGMENT = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
+export const WORKSPACE_SNAPSHOT_PREFIX_INVALID = "config.workspace_snapshot_prefix_invalid";
+export function snapshotKeyPrefixProblem(prefix) {
+    const segments = prefix.split("/");
+    for (const [i, value] of segments.entries()) {
+        if (SNAPSHOT_KEY_SEGMENT.test(value))
+            continue;
+        const why = value === ""
+            ? "empty (a leading, trailing or doubled /)"
+            : value === "." || value === ".."
+                ? "a . / .. segment (it would walk out of its own prefix)"
+                : "not a plain key segment (it must start with a letter or digit and hold only letters, digits, . _ -)";
+        return { segment: i + 1, of: segments.length, value, why };
+    }
+    return undefined;
+}
+export function parseWorkspaceSnapshotPrefix(raw) {
+    if (raw === undefined || raw === "")
+        return undefined;
+    const bad = snapshotKeyPrefixProblem(raw);
+    if (bad === undefined)
+        return raw;
+    throw Object.assign(new Error(`env WORKSPACE_SNAPSHOT_PREFIX: segment #${bad.segment} of ${bad.of} (${JSON.stringify(bad.value)}) is ${bad.why} — the prefix is a "/"-separated path of plain key segments ` +
+        "(each starts with a letter or digit, then letters, digits, . _ -; e.g. WORKSPACE_SNAPSHOT_PREFIX=kata or libA/ws); refusing to start rather than sign snapshot keys under a prefix that does not say what it means"), { code: WORKSPACE_SNAPSHOT_PREFIX_INVALID });
+}
 export const WORKSPACE_SNAPSHOT_EXCLUDE_INVALID = "config.workspace_snapshot_exclude_invalid";
 export function parseWorkspaceSnapshotExclude(raw) {
     if (raw === undefined || raw.trim() === "")

package/dist/write-protection.d.ts

@@ -1,8 +1,8 @@
 /**
- * S-138 —— **写保护表**(core `RunnerDeps.writeProtectedPaths` 座)的姿态推导点(形制照
+ * [ref] —— **写保护表**(core `RunnerDeps.writeProtectedPaths` 座)的姿态推导点(形制照
  * `memory-posture.ts` / `sql-engine-posture.ts`:一次推导,两个读面)。
  *
- * ## 病(B-023 F2 的根)
+ * ## 病([ref] F2 的根)
  *
  * core 的写保护表是**字面名表**(CC `DANGEROUS_FILES` / `DANGEROUS_DIRECTORIES` /
  * `DANGEROUS_DIRECTORY_PATHS` 三形对位):一次落在表行上的可定路径写(Write/Edit/NotebookEdit)会把

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/server",
-  "version": "7.134.0",
+  "version": "7.136.0",
   "description": "Sema Server — the server/API implementation layer for Sema, wiring core, registry, model providers, and cloud agent execution. Built on @sema-agent/core.",
   "type": "module",
   "license": "BUSL-1.1",
@@ -37,6 +37,7 @@
     "scripts/drain-check.pg.sql",
     "deploy/sema-up",
     "docs/DEVICE-EXECUTOR-PROTOCOL.md",
+    "wire-changes/",
     "USAGE.md",
     "MIGRATION.md"
   ],
@@ -68,8 +69,8 @@
     "build:binary:run-local:darwin-arm64": "bun build --compile --target=bun-darwin-arm64 src/run-local.ts --outfile dist/run-local-darwin-arm64"
   },
   "dependencies": {
-    "@sema-agent/core": "7.54.1",
-    "@sema-agent/settings-schema": "14.2.0",
+    "@sema-agent/core": "7.55.0",
+    "@sema-agent/settings-schema": "14.5.0",
     "e2b": "^2.28.0",
     "libsodium-wrappers": "^0.8.4",
     "mysql2": "^3.22.4",
@@ -92,6 +93,7 @@
     "@types/ws": "^8.18.1",
     "ajv": "^8.20.0",
     "ajv-formats": "^3.0.1",
+    "core-mixed-version-reader": "npm:@sema-agent/core@7.54.1",
     "tsx": "4.19.2",
     "typescript": "5.7.2",
     "vitest": "^4.1.8",

package/scripts/drain-check-local.mjs

@@ -31,7 +31,7 @@
  *    `dist/orchestration/workflow-agent-session-index.js` 取 —— 本脚本只按 runId 折叠;读不出的行计入 `corrupt`(rc 2:读不出的那一行可能正是点名某张待批卡的那一份);
  *    窗与删码:本判据是一次性迁移 M9 的读侧半场 —— 窗口与删码清单见引擎启动期一次性迁移登记表(one-time-migrations)M9 一行,随 M9 一起删;这里不写第二份窗。
  *  · `parked-tool-lists`(升级到 7.132.0 前)/ `own-tool-lists-rollback`(从 7.132.0 回滚前):停驻行记下的工具名清单 / 7.52 写下的 `ownToolLists`(判据与出路见判据表那两条的注);
- *  · `sealed-credentials-rollback`(从 7.134.0 回滚前):续跑上下文的凭据位上带封签的 pending 行(7.133.x 读不懂封签,续跑时把这些位当没有;判据与出路见判据表那一条的注);
+ *  · `sealed-credentials-rollback`(从 7.134.0 回滚前;从 7.135.0 / 7.136.0 回滚到上一版前同用):续跑上下文的凭据位上带封签的 pending 行(7.133.x 读不懂封签,续跑时把这些位当没有;判据与出路见判据表那一条的注);
  *  · `retired-mode-seed`(换钉 7.113.0 前,core 7.39.0 删掉退役 mode-seed 的一次性迁移):pending 行的 `state.inheritedGate` 仍带退役成员;
  *  · `permissions-allow-list`(换钉 7.117.0 前,本服务把 `settings.permissions.allow` 整份交给引擎的 allow 层):pending 行所在会话的续跑上下文
  *    (`checkpoint-ctx/*.json` 的信封 `{ sessionId, updatedAt, ctx }`)里,`ctx.body.settings.permissions.allow` 是非空数组,且 `ctx.permissionsAllowReading` 不是 `"allow_layer"`
@@ -464,7 +464,9 @@ export const DRAIN_CRITERIA = [
     judge: (row) => (isObject(row.state) && Object.hasOwn(/** @type {Record<string, unknown>} */ (row.state), "ownToolLists") ? "" : undefined),
   },
   {
-    // 从 7.134.0 回滚到 7.133.x 之前:pending 行所在会话的续跑上下文里,提交体的凭据位(MCP / A2A 请求头与 env、settings.env、settings.webSearch.apiKey、http hook 请求头)
+    // 从 7.134.0 回滚到 7.133.x 之前:pending 行所在会话的续跑上下文里,提交体的凭据位(MCP / A2A 请求头与 env、settings.env、settings.webSearch.apiKey、http hook 请求头;7.135.0 起另有 command hook 的插件选项)
+    // (从 7.135.0 回滚到 7.134.x 之前同用本判据:7.134.x 不认插件选项上的封签,续跑时那份 hooks 整只不采纳;本判据数任何凭据位上的封签,这一类在候选里)
+    // (从 7.136.0 回滚到 7.135.x 之前同用本判据:7.136.0 起子进程的命令行 —— MCP stdio 传输与 command hook 条目的 command / args —— 也封成封签,带它们的行盖第 3 代,7.135.x 整行拒续跑;这一类在候选里)
     // 上带封签 —— 7.134.0 封好才落盘,7.133.x 读不懂封签、续跑时把这些位当作没有(无凭据照跑、不报错)。出路:回滚前把它们决掉或取消(随包 `MIGRATION.md` 7.134.0 节)。
     // 判据函数是服务里那一只(`sealedCredentialFieldOf`,经编译产物 `dist/http/checkpoint-ctx.js` 取;走法与封口 / 开口 / 一次性迁移同一只),本脚本不写第二份;
     // 命中行点名第一处凭据位(`field=`,键名;值从不出来);读不懂的 ctx 档 / 索引账本行计入 `corrupt`(rc 2)。

package/scripts/drain-check.mysql.sql

@@ -17,7 +17,7 @@
 --   workflow-park-holder    换钉 7.118.0 之前 / 从 7.118.0 回滚到 7.117.x 之前:此刻待批、且子会话被 workflow park 索引点名的卡(workflow 子代卡;见该段注)。
 --   parked-tool-lists       升级到 7.132.0 之前:停驻行记着子代工具天花板 / 冻结的父约束链 / Skill 卡的清单绑定(7.52 在认领前按规范拼写读它们)的**候选**(见该段注)。
 --   own-tool-lists-rollback 从 7.132.0 回滚到 7.131.x 之前:7.132.0 停驻、带 state.ownToolLists 的行(7.131.x 读不了)。
---   sealed-credentials-rollback 从 7.134.0 回滚到 7.133.x 之前:停驻、续跑上下文里提交体的凭据位上带封签的行(7.133.x 读不懂封签,续跑时把这些位当没有)的**候选**(见该段注)。
+--   sealed-credentials-rollback 从 7.134.0 回滚到 7.133.x(或从 7.135.0 回滚到 7.134.x、从 7.136.0 回滚到 7.135.x)之前:停驻、续跑上下文里提交体的凭据位上带封签的行(7.133.x 读不懂封签,续跑时把这些位当没有)的**候选**(见该段注)。
 --   permissions-allow-list  换钉 7.117.0 之前:停驻、提交体 settings.permissions.allow 是非空数组且读法记号不是当前的 "allow_layer"(无记号 = 名单时代;"statement" = 表态时代)。
 --   retired-mode-seed       换钉 7.113.0 之前:检查点的 inheritedGate 里仍带退役 mode-seed 成员。
 
@@ -117,10 +117,14 @@ WHERE k.status = 'pending'
   AND JSON_CONTAINS_PATH(k.checkpoint, 'one', '$.state.ownToolLists');
 
 -- drain-check:sealed-credentials-rollback:mysql —— 期望 hit_rows = 0;每一行 = 一条**候选**:从 7.134.0 回滚到 7.133.x 后续跑会丢掉请求凭据的停驻行。
--- 在**回滚之前**、对 7.134.0 的数据跑:7.134.0 把续跑上下文里提交体的凭据位(MCP / A2A 请求头与 env、settings.env、settings.webSearch.apiKey、http hook 请求头)
+-- 在**回滚之前**、对 7.134.0 的数据跑:7.134.0 把续跑上下文里提交体的凭据位(MCP / A2A 请求头与 env、settings.env、settings.webSearch.apiKey、http hook 请求头;7.135.0 起另有 command hook 的插件选项)
 -- 封成封签(对象,格式词 "checkpoint-ctx-sealedbox-v1")才落盘;7.133.x 读不懂封签,续跑时把这些位当作没有(无凭据照跑、不报错)。出路:回滚前把它们决掉或取消(见随包 MIGRATION.md 7.134.0 节)。
 -- 读哪一份续跑上下文:与续跑腿同(连接形与 permissions-allow-list 段逐字同,理由见该段注)。SQL 不走凭据位闭集 ⇒ 数的是**真超集**:提交体里任何一处有一个
 -- JSON 串值恰为这个格式词即数(封签只落在凭据位上;体里别处恰好写着这个词的串值也会被数到 —— 多数,不漏)。本地脚本同名判据走服务里那一只凭据位走法(精确)。
+-- 从 7.135.0 回滚到 7.134.x 之前同用本判据:7.135.0 起 command hook 条目的插件选项(settings.hooks.<事件>[].hooks[].plugin.options)也封成封签,7.134.x 不认这一位,
+-- 续跑时那份 hooks 整只不采纳(其中的守卫不再拦)。本判据数任何凭据位上带封签的行,所以这一类也在候选里(超集)。
+-- 从 7.136.0 回滚到 7.135.x 之前同用本判据:7.136.0 起子进程的命令行(MCP stdio 传输与 command hook 条目的 command / args)也封成封签,带它们的行
+-- 盖第 3 代读法记号,7.135.x 对这样的行整行拒续跑(409 conflict.checkpoint_ctx_unsealable)。这一类同样在候选里(超集)。
 SELECT 'sealed-credentials-rollback' AS criterion, COUNT(*) AS hit_rows,
        COALESCE(GROUP_CONCAT(k.session_id ORDER BY k.created_at_ms DESC SEPARATOR ','), '') AS sessions
 FROM checkpoint k

package/scripts/drain-check.pg.sql

@@ -16,7 +16,7 @@
 --   workflow-park-holder    换钉 7.118.0 之前 / 从 7.118.0 回滚到 7.117.x 之前:此刻待批、且子会话被 workflow park 索引点名的卡(workflow 子代卡;见该段注)。
 --   parked-tool-lists       升级到 7.132.0 之前:停驻行记着子代工具天花板 / 冻结的父约束链 / Skill 卡的清单绑定(7.52 在认领前按规范拼写读它们)的**候选**(见该段注)。
 --   own-tool-lists-rollback 从 7.132.0 回滚到 7.131.x 之前:7.132.0 停驻、带 state.ownToolLists 的行(7.131.x 读不了)。
---   sealed-credentials-rollback 从 7.134.0 回滚到 7.133.x 之前:停驻、续跑上下文里提交体的凭据位上带封签的行(7.133.x 读不懂封签,续跑时把这些位当没有)的**候选**(见该段注)。
+--   sealed-credentials-rollback 从 7.134.0 回滚到 7.133.x(或从 7.135.0 回滚到 7.134.x、从 7.136.0 回滚到 7.135.x)之前:停驻、续跑上下文里提交体的凭据位上带封签的行(7.133.x 读不懂封签,续跑时把这些位当没有)的**候选**(见该段注)。
 --   permissions-allow-list  换钉 7.117.0 之前:停驻、提交体 settings.permissions.allow 是非空数组且读法记号不是当前的 "allow_layer"(无记号 = 名单时代;"statement" = 表态时代)。
 --   retired-mode-seed       换钉 7.113.0 之前:检查点的 inheritedGate 里仍带退役 mode-seed 成员。
 
@@ -125,10 +125,14 @@ WHERE k.status = 'pending'
   AND (k.checkpoint -> 'state') ? 'ownToolLists';
 
 -- drain-check:sealed-credentials-rollback:pg —— 期望 hit_rows = 0;每一行 = 一条**候选**:从 7.134.0 回滚到 7.133.x 后续跑会丢掉请求凭据的停驻行。
--- 在**回滚之前**、对 7.134.0 的数据跑:7.134.0 把续跑上下文里提交体的凭据位(MCP / A2A 请求头与 env、settings.env、settings.webSearch.apiKey、http hook 请求头)
+-- 在**回滚之前**、对 7.134.0 的数据跑:7.134.0 把续跑上下文里提交体的凭据位(MCP / A2A 请求头与 env、settings.env、settings.webSearch.apiKey、http hook 请求头;7.135.0 起另有 command hook 的插件选项)
 -- 封成封签(对象,格式词 "checkpoint-ctx-sealedbox-v1")才落盘;7.133.x 读不懂封签,续跑时把这些位当作没有(无凭据照跑、不报错)。出路:回滚前把它们决掉或取消(见随包 MIGRATION.md 7.134.0 节)。
 -- 读哪一份续跑上下文:与续跑腿同(连接形与 permissions-allow-list 段逐字同,理由见该段注)。SQL 不走凭据位闭集 ⇒ 数的是**真超集**:提交体里任何一处有一个
 -- JSON 串值恰为这个格式词即数(封签只落在凭据位上;体里别处恰好写着这个词的串值也会被数到 —— 多数,不漏)。本地脚本同名判据走服务里那一只凭据位走法(精确)。
+-- 从 7.135.0 回滚到 7.134.x 之前同用本判据:7.135.0 起 command hook 条目的插件选项(settings.hooks.<事件>[].hooks[].plugin.options)也封成封签,7.134.x 不认这一位,
+-- 续跑时那份 hooks 整只不采纳(其中的守卫不再拦)。本判据数任何凭据位上带封签的行,所以这一类也在候选里(超集)。
+-- 从 7.136.0 回滚到 7.135.x 之前同用本判据:7.136.0 起子进程的命令行(MCP stdio 传输与 command hook 条目的 command / args)也封成封签,带它们的行
+-- 盖第 3 代读法记号,7.135.x 对这样的行整行拒续跑(409 conflict.checkpoint_ctx_unsealable)。这一类同样在候选里(超集)。
 SELECT 'sealed-credentials-rollback' AS criterion, count(*) AS hit_rows,
        coalesce(string_agg(k.session_id, ',' ORDER BY k.created_at_ms DESC), '') AS sessions
 FROM checkpoint k

package/skills/loop.md

@@ -35,7 +35,7 @@ Then briefly confirm what's scheduled (id, human cadence, how to cancel with `Cr
 With no interval, run one iteration of the task now, then call `ScheduleWakeup` to schedule when you resume:
 
 - `delaySeconds`: how long to sleep (runtime clamps to [60, 3600]).
-- `reason`: one short, specific sentence ("watching CI run #4521" beats "waiting") — shown to the user and telemetry.
+- `reason`: one short, specific sentence ("watching the release-branch CI run" beats "waiting") — shown to the user and telemetry.
 - `prompt`: the same /loop input verbatim, so the next firing re-enters this skill and continues the loop. For an autonomous loop with no user prompt, pass the literal sentinel `<<autonomous-loop-dynamic>>` (never the CronCreate-mode `<<autonomous-loop>>` sentinel — ScheduleWakeup always uses the `-dynamic` variant).
 - To END the loop: call `ScheduleWakeup` with `stop: true` and omit every other field — the loop ends immediately and no further wakeups fire.
 

package/skills/schedule.md

@@ -13,7 +13,7 @@ Parameters:
 
 - `prompt` (string, required): fully self-contained instructions for the future task. It runs unattended — inline every path, id, and acceptance criterion it needs; never reference "the file we discussed".
 - `schedule` (union, required) — pick the kind by intent:
-  - Recurring: `{ "kind": "cron", "expr": "M H DoM Mon DoW" }` — standard 5-field cron in the user's LOCAL timezone (a 6-field form with leading seconds is also accepted). `"0 9 * * *"` means 9am local; no timezone conversion needed.
+  - Recurring: `{ "kind": "cron", "expr": "M H DoM Mon DoW" }` — standard 5-field cron in the user's LOCAL timezone. There is no seconds field: a 6-field expression is rejected ("its leading seconds field is not supported — the resident scheduler fires on 5-field cron, so one minute is the finest granularity available."), so drop the leading field and retry. `"0 9 * * *"` means 9am local; no timezone conversion needed.
   - One-shot at a wall-clock time: `{ "kind": "at", "atMs": <epoch ms> }`.
   - One-shot after a delay: `{ "kind": "delay", "delaySec": <seconds> }`.
 - `label` (string, optional): short name. Also the dedup key — creating again with the same schedule+label upserts (idempotent), so use a stable label when updating a task instead of piling up duplicates.