@sema-agent/server 7.52.1 → 7.53.0

package/dist/config-catalog.js

@@ -0,0 +1,556 @@
+export const CATALOG_VALUE_TYPES = ["boolean", "number", "string", "enum", "csv", "json", "path", "url", "secret", "opaque"];
+export const CATALOG_TIMINGS = ["hot", "restart", "deploy", "inert"];
+export const CATALOG_DANGER_AXES = ["security", "billing", "data"];
+const RESTART_SLICE_SET = {
+    skills: true,
+    mcp: true,
+    a2a: true,
+    scenarios: true,
+    "runtime-gates": true,
+    "models-tiers": true,
+    "degrade-route": true,
+    "read-face": true,
+};
+export const CATALOG_RESTART_SLICES = Object.keys(RESTART_SLICE_SET);
+const r = (name, domain, type, semantics, opts = {}) => ({ name, domain, type, semantics, ...opts });
+const cLimits = (path, over = {}) => ({
+    domain: "limits",
+    path,
+    centerKey: path.includes(".") ? path.slice(0, path.indexOf(".")) : path,
+    precedence: "center-wins",
+    timing: "hot",
+    ...over,
+});
+const cGov = (path, over = {}) => ({ domain: "governance", path, centerKey: path, precedence: "center-wins", timing: "hot", ...over });
+const cModels = (path) => ({ domain: "models", path, centerKey: "models", precedence: "center-wins", timing: "models-plane" });
+const cRead = (path, centerKey) => ({ domain: "readFace", path, centerKey, precedence: "env-wins", timing: "restart", restartSlice: "read-face" });
+const SEC = ["security"];
+const BILL = ["billing"];
+const DATA = ["data"];
+export const CONFIG_CATALOG = [
+    r("A2A_SERVE_BLOCKING_WAIT_MS", "integrations", "number", "A2A 入站 message/send blocking:true 的服务端等待窗(ms);到期回 working 转 tasks/get 轮询,硬帽 5min", { staticDefault: "45000" }),
+    r("A2A_SERVE_DESCRIPTION", "integrations", "string", "agent card 的 description(公网匿名可读)"),
+    r("A2A_SERVE_ENABLED", "integrations", "boolean", "server-as-peer 总开关:开 ⇒ 发布 agent card + POST /v1/a2a;关 ⇒ 两路由 404(卡都不发=对外不存在)", { staticDefault: "false", danger: SEC }),
+    r("A2A_SERVE_NAME", "integrations", "string", "agent card 的 name", { staticDefault: "sema-server" }),
+    r("A2A_SERVE_SKILLS", "integrations", "opaque", "agent card 声明的 skills(JSON 数组;坏形拒启 —— 声明面没有静默丢的合法语义)"),
+    r("A2A_SERVE_URL", "integrations", "url", "agent card 公告的公网 JSON-RPC 地址(开启时必填;禁 userinfo —— 卡是匿名可拉的公开文档)", { danger: SEC }),
+    r("ADB_MOUNT_PATH", "orchestration", "path", "adb 车道工作区挂载路径(缺省由 adapter 定)"),
+    r("ADB_PATH", "orchestration", "path", "adb 二进制路径(缺省 PATH 上的 adb)"),
+    r("ADB_SERIAL", "orchestration", "string", "adb 车道目标设备 serial(REMOTE_EXEC=adb 的必需件,缺 ⇒ 拒启)"),
+    r("AGENT_DATA_DIR", "store", "path", "本机数据根回落链一环(LOCAL_DATA_ROOT → CONFIG_LOCAL_DIR → AGENT_DATA_DIR → ~/.ai-agent);记忆引擎缺省根同链", { danger: DATA, derivedDefaultNote: "缺席 ⇒ 链上下一环,最终 ~/.ai-agent" }),
+    r("ALLOW_UNAUTHED_WRITES", "auth", "boolean", "无 service token 时仍接受任务提交(本地开发逃生口;缺省 fail-closed 拒提交)", { staticDefault: "false", danger: SEC, configKey: "allowUnauthedWrites" }),
+    r("ANTHROPIC_API_KEY", "modelPlane", "secret", "Anthropic 协议路线的 x-api-key 凭据(与 AUTH_TOKEN 二选一,AUTH_TOKEN 优先;与 BASE_URL 同在时可推断 provider)", { danger: [...SEC, ...BILL] }),
+    r("ANTHROPIC_AUTH_TOKEN", "modelPlane", "secret", "Anthropic 兼容生态的 Bearer 凭据(设了则不发 x-api-key)", { danger: [...SEC, ...BILL] }),
+    r("ANTHROPIC_BASE_URL", "modelPlane", "url", "Anthropic 协议路线 base URL(与凭据同在且 MODEL_PROVIDER 未设 ⇒ 推断 provider=anthropic 并 boot notice)"),
+    r("ANTHROPIC_CACHE_BREAKPOINTS", "modelPlane", "boolean", "Anthropic 路线 prompt-cache breakpoints 开关", { staticDefault: "true" }),
+    r("ANTHROPIC_MAX_RETRIES", "modelPlane", "number", "Anthropic 路线 SDK 每次调用重试上限", { derivedDefaultNote: "缺席 ⇒ 不传引擎,core/SDK 默认当家" }),
+    r("ANTHROPIC_VERSION", "modelPlane", "string", "Anthropic API version 头(缺省由 SDK 定)"),
+    r("APPROVAL_AUTO_BUDGET", "approval", "number", "每 run-leg 自动放行的普通门控工具调用数上限(0=关;防审批循环的熔断,不是安全 ask 的帽)", { staticDefault: "0", danger: SEC, configKey: "approvalAutoBudget" }),
+    r("APPROVAL_DENY", "approval", "csv", "始终拒绝的工具名单(装配期拒不可匹配名)", { danger: SEC, configKey: "approvalDeny" }),
+    r("APPROVAL_HMAC_KEYS", "approval", "secret", "直连门(D-G)HMAC 完整性密钥集(空=直连门不激活)", { danger: SEC }),
+    r("APPROVAL_NEVER_AUTO", "approval", "csv", "永不被 AUTO_BUDGET 自动放行的工具集(不可逆动作恒要人)", { danger: SEC, configKey: "approvalNeverAuto" }),
+    r("APPROVAL_REQUIRE", "approval", "csv", "必须人审的工具名单(F4 门;center 腿走 runtime-gates 重启片)", { danger: SEC, configKey: "approvalRequire", center: cGov("approvalRequire", { timing: "restart", restartSlice: "runtime-gates" }) }),
+    r("APPROVAL_TERMINAL_BACKSTOP_MS", "approval", "number", "SQL checkpoint 店 pending 行的 crash-safe 绝对 GC 上限(ms;下限 60s,非有限值落默认)", { staticDefault: String(30 * 86_400_000), danger: DATA }),
+    r("APPROVAL_TIMEOUT_SEC", "approval", "number", "durable HITL 等人上限(秒);0=无限期等,时间型 suspended 回收不跑", { staticDefault: "0", configKey: "approvalTimeoutSec" }),
+    r("ASK_QUESTION_ENABLED", "approval", "boolean", "AskUserQuestion 活流 HITL 装配开关", { derivedDefaultNote: "posture 三态:显式词恒赢,缺席 = 单用户(REQUIRE_PRINCIPAL≠true)⇒ on / 多租户 ⇒ off", configKey: "askQuestionEnabled" }),
+    r("ATTACHMENT_MAX_BYTES", "limitsHttp", "number", "附件单文件字节上限(上传整段内存缓冲的 RAM 束)", { staticDefault: String(32 * 1024 * 1024), configKey: "attachmentMaxBytes", center: cLimits("attachmentMaxBytes") }),
+    r("ATTACHMENT_MIME_ALLOWLIST", "limitsHttp", "csv", "附件 mime 白名单(内容策略,不是安全边界;缺省不设限,拒答 415)", { center: cLimits("attachmentMimeAllowlist") }),
+    r("ATTACHMENT_ORPHAN_GRACE_MS", "limitsHttp", "number", "附件孤儿对象 GC 宽限(ms;0=关本腿,坏值回默认+warn)", { staticDefault: "3600000", danger: DATA, center: cLimits("attachmentOrphanGraceMs") }),
+    r("ATTACHMENT_UNBOUND_TTL_MS", "limitsHttp", "number", "未绑定附件的 TTL(ms)", { staticDefault: String(24 * 3600 * 1000), danger: DATA, configKey: "attachmentUnboundTtlMs", center: cLimits("attachmentUnboundTtlMs") }),
+    r("AUTH_BRIDGE_AUDIENCE", "auth", "string", "registry SSO-JWT 验签期望 aud", { danger: SEC }),
+    r("AUTH_BRIDGE_ISSUER", "auth", "string", "registry SSO-JWT issuer(auth bridge 的开关之一)", { danger: SEC, derivedDefaultNote: "缺席 ⇒ 用 configCenter.baseUrl(配了 center 即默认开桥)" }),
+    r("AUTH_BRIDGE_JWKS_URL", "auth", "url", "registry SSO-JWT 的 JWKS 地址(缺省从 issuer 派生)", { danger: SEC }),
+    r("AUTONOMY", "auth", "enum", "运维 autonomy 模式,tighten-only 叠到每个 TaskSpec(read-only/plan ⇒ 只读手,ask ⇒ 恒 shellGate);center 腿热且 non-sticky", { danger: SEC, enumValues: ["read-only", "ask", "plan", "auto"], configKey: "autonomy", center: cGov("autonomy") }),
+    r("BAKE_CACHE_BASE", "orchestration", "url", "烤镜像 fetch-once 缓存源 base(注入 --cache-base;绝不受调用方控制)"),
+    r("BAKE_IMAGE_REGISTRY", "orchestration", "string", "烤镜像自动登记的 registry host 前缀(repo=registry/profile)"),
+    r("BAKE_LEASE_MS", "orchestration", "number", "bake 租约窗(ms;runner 心跳推进,过期被 reaper 抢)", { staticDefault: "90000" }),
+    r("BAKE_RUNNER_PRINCIPAL", "orchestration", "string", "bake-runner 在内部 claim/ingest 路由上的专用 principal(路由要求逐字相等)", { staticDefault: "system:bake-runner", danger: SEC }),
+    r("BAKE_STALE_MS", "orchestration", "number", "running bake 租约陈旧超此值即被清算成 failed(ms;须 >2 个心跳窗)", { staticDefault: "180000" }),
+    r("BAKE_SUBMIT_RATE_MAX", "orchestration", "number", "per-principal bake 提交限流窗内最大次数(0=关)", { staticDefault: "10" }),
+    r("BAKE_SUBMIT_RATE_WINDOW_SEC", "orchestration", "number", "per-principal bake 提交限流窗长(秒)", { staticDefault: "60" }),
+    r("BG_AGENT_PARK_CLAIM_STALE_MS", "orchestration", "number", "parked 后台 agent 的 stale-claim 清算窗(ms;claimer 崩死的行由此解卡)", { staticDefault: String(60 * 60_000), configKey: "backgroundAgentParkClaimStaleMs" }),
+    r("BG_AGENT_RETENTION_MS", "orchestration", "number", "TERMINAL 后台 agent 行保留期(ms,reaper 按 scope 清)", { staticDefault: String(7 * 24 * 60 * 60 * 1000), danger: DATA, configKey: "backgroundAgentRetentionMs" }),
+    r("BG_AGENT_STALE_RUNNING_MS", "orchestration", "number", "running 后台 agent 行写者心跳断更超此值翻 failed(ms;下限 10min 硬钳)", { staticDefault: String(15 * 60_000), configKey: "backgroundAgentStaleRunningMs" }),
+    r("BIND_HOST", "auth", "string", "监听绑址(显式值恒生效)", { danger: SEC, derivedDefaultNote: "缺席:无鉴权写面(allowUnauthedWrites ∧ 零凭证)自动收窄 127.0.0.1,其余全接口", resolve: (c) => c.bindHost ?? null }),
+    r("COMPLIANCE_ADDITIONAL_DENIES", "auth", "csv", "合规档位之上额外拒绝的能力名(只能收紧;词表=core 闭集,拼错拒启)", { danger: SEC }),
+    r("COMPLIANCE_PROFILE", "auth", "enum", "本部署合规档位(core compliancePostureResolver 供数;拼错拒启)", { danger: SEC, enumValues: ["hipaa", "zdr"] }),
+    r("CONFIG_BOOT_FETCH_BUDGET_MS", "integrations", "number", "boot 首拉配置的抢答窗(ms;过窗以 env/兜底起服,拉取转后台热应用)", { staticDefault: "1500", configKey: "configBootFetchBudgetMs" }),
+    r("CONFIG_CATALOG_ENABLED", "auth", "boolean", "本目录端点 GET /v1/config/catalog 的旋钮(operator-only 面;合规部署可关 ⇒ 路径 404 + 能力位翻假)", { staticDefault: "true", danger: SEC, configKey: "configCatalogEnabled" }),
+    r("CONFIG_LKG_DURABLE", "integrations", "boolean", "LKG 跨重启 handoff(严格 'true' 才开:重启先用 LKG 起服,tier 候选借此落地)", { staticDefault: "false" }),
+    r("CONFIG_LKG_ENABLED", "integrations", "boolean", "last-known-good 配置盘缓存读写开关(仅远程 provider 有意义)", { staticDefault: "true" }),
+    r("CONFIG_LKG_PATH", "integrations", "path", "LKG 落盘路径", { derivedDefaultNote: "缺席 ⇒ SEMA_CONFIG_DIR(~/.sema)下按 worker 名派生" }),
+    r("CONFIG_LOCAL_DIR", "integrations", "path", "本地配置源根(config.d/<domain>.json);兼作数据根回落链一环", { configKey: "configLocalDir", danger: DATA }),
+    r("CONFIG_PROVIDER", "integrations", "enum", "配置源双模选择", { enumValues: ["remote", "local"], derivedDefaultNote: "缺席:SEMA_REGISTRY_URL 在场 ⇒ remote,否则纯 env(无管道)", configKey: "configProvider" }),
+    r("CONFIG_REQUIRE_ROSTER", "integrations", "boolean", "远程 registry 非 dryRun 时布防 ready 门:roster 未落地 ⇒ 计费提交 503 + /health ready:false(严格 'true')", { staticDefault: "false" }),
+    r("CORS_ORIGIN", "auth", "csv", "CORS 白名单(单值 v1 兼容回显;多值按请求 Origin 匹配 + Vary;未设=无 CORS 面)", { danger: SEC, configKey: "corsOrigins" }),
+    r("COST_QUOTA_WINDOW_SEC", "limitsHttp", "number", "per-principal 成本配额窗长(秒);SQL 腿窗长进桶主键 ⇒ center 腿显式 deferred(重启生效)", { staticDefault: "86400", danger: BILL, configKey: "costQuotaWindowSec", center: cLimits("costQuotaWindowSec", { timing: "restart", restartReason: "cost-quota-window" }) }),
+    r("DB_BACKEND", "store", "enum", "store 后端引擎选择(mysql 兼容/pg/本机文件店/纯内存)", { enumValues: ["mysql", "pg", "local", "memory"], danger: DATA, derivedDefaultNote: "裸 boot ⇒ local(多租户裸 boot ⇒ memory + notice);有 SQL 信号 ⇒ mysql", configKey: "dbBackend", resolve: (c) => c.dbBackend }),
+    r("DB_QUERY_TIMEOUT_MS", "store", "number", "per-query DB 超时(ms;坏值回默认姿态+warn,绝不 NaN 进 driver)", { derivedDefaultNote: "缺席 ⇒ 池级不设/计数族 30s(按引擎)", configKey: "dbQueryTimeoutMs" }),
+    r("DEFAULT_SCENARIO", "integrations", "string", "出厂缺省场景(编码产品出厂态;通用中性 persona 用 default 显式选回)", { staticDefault: "code", configKey: "defaultScenario" }),
+    r("DELEGATION_MAX_CONCURRENT", "orchestration", "number", "委派入口并发帽", { derivedDefaultNote: "缺席 ⇒ 不铸键,core 自缺省(CC parity 20)" }),
+    r("DELEGATION_MAX_PER_SESSION", "orchestration", "number", "委派入口每会话累计帽", { derivedDefaultNote: "缺席 ⇒ 不铸键,core 自缺省(CC parity 200)" }),
+    r("DEVICE_DELIVERY_TIMEOUT_MS", "orchestration", "number", "device 车道等在途槽上限(ms;到期 device.busy)", { derivedDefaultNote: "缺席 ⇒ adapter 默认 10s" }),
+    r("DEVICE_EXEC_TIMEOUT_MS", "orchestration", "number", "device 车道指令级默认超时(ms;per-command 可收紧)", { derivedDefaultNote: "缺席 ⇒ adapter 默认 1800s" }),
+    r("DEVICE_MAX_INFLIGHT_PER_DEVICE", "orchestration", "number", "per-device 在途上限(超额云侧排队)", { derivedDefaultNote: "缺席 ⇒ 4(§11-O3 裁定值)" }),
+    r("DEVICE_MAX_PREAUTH_PER_REMOTE", "orchestration", "number", "未鉴权握手的 per-remote 并发帽(正整数或字面 off;XFF/NAT 形用 off+全局帽)", { danger: SEC, derivedDefaultNote: "缺席 ⇒ 8" }),
+    r("DEVICE_RECONNECT_GRACE_MS", "orchestration", "number", "device 断连后在途不判丢的窗(ms;同 epoch 重连续接)", { derivedDefaultNote: "缺席 ⇒ adapter 默认 120s" }),
+    r("DEVICE_SUPERSEDE", "orchestration", "enum", "同 deviceId 二连的顶替策略", { enumValues: ["stale_only", "deny"], staticDefault: "stale_only", danger: SEC }),
+    r("DIRECT_APPROVAL_DOOR", "approval", "boolean", "直连 /decide 门(无 BFF 的桌面/CLI 客户端;开 ⇒ 要求签名 JWT+HMAC 信封,principal 头降级不可信)", { staticDefault: "false", danger: SEC, configKey: "directApprovalDoor" }),
+    r("DOCKER_COMMAND_TIMEOUT_MS", "orchestration", "number", "local-docker 车道单命令超时(ms)"),
+    r("DOCKER_CPUS", "orchestration", "number", "local-docker 容器 CPU 限额"),
+    r("DOCKER_DROP_CAPS", "orchestration", "boolean", "local-docker 容器 drop 全部 capabilities", { staticDefault: "false", danger: SEC }),
+    r("DOCKER_HOST", "orchestration", "string", "docker daemon 地址覆写"),
+    r("DOCKER_IMAGE", "orchestration", "string", "local-docker 车道镜像(必需件,无 docker.io 默认 —— 国内源铁律)"),
+    r("DOCKER_MEMORY", "orchestration", "string", "local-docker 容器内存限额"),
+    r("DOCKER_MOUNT_PATH", "orchestration", "path", "local-docker 工作区挂载路径"),
+    r("DOCKER_NETWORK", "orchestration", "enum", "local-docker 容器网络模式", { enumValues: ["none", "bridge", "host"], staticDefault: "bridge", danger: SEC }),
+    r("DOCKER_PATH", "orchestration", "path", "docker 二进制路径"),
+    r("DOCKER_PIDS_LIMIT", "orchestration", "number", "local-docker fork-bomb 背栓(--pids-limit;非法值回 adapter 默认 512+warn)", { danger: SEC, derivedDefaultNote: "缺席 ⇒ adapter 默认 512" }),
+    r("DOCKER_SANDBOX_ENV", "orchestration", "csv", "转发进容器的本进程 env **名字**表(值只在 worker env,不进 spec/center)", { danger: SEC }),
+    r("DRAIN_GRACE_MS", "limitsHttp", "number", "SIGTERM 优雅排空窗(ms;期间新计费提交 503+Retry-After)", { staticDefault: String(10 * 60 * 1000), configKey: "drainGraceMs", center: cLimits("drainGraceMs") }),
+    r("DURABLE_APPROVAL", "approval", "boolean", "durable suspend/resume HITL(需 SQL 店;决定 checkpointStore 与 /v1/approvals 面的存在性)", { staticDefault: "false", danger: SEC, configKey: "durableApproval" }),
+    r("E2B_ALLOW_NET", "orchestration", "boolean", "e2b 沙箱出网许可", { danger: SEC, derivedDefaultNote: "缺席 ⇒ 不铸键(adapter 默认允许)" }),
+    r("E2B_API_KEY", "orchestration", "secret", "E2B 车道 API 凭据(REMOTE_EXEC=e2b 必需件)", { danger: [...SEC, ...BILL] }),
+    r("E2B_BG_DEFAULT_TIMEOUT_SEC", "orchestration", "number", "e2b 后台 shell 缺省超时(秒)", { staticDefault: "300" }),
+    r("E2B_BG_MAX_CONCURRENT", "orchestration", "number", "e2b 后台 shell 并发帽", { staticDefault: "8" }),
+    r("E2B_BG_MAX_TIMEOUT_SEC", "orchestration", "number", "e2b 后台 shell 超时上限(秒)", { staticDefault: "1800" }),
+    r("E2B_LIVENESS_MS", "orchestration", "number", "e2b 单命令静默活性上限(长静默构建请调大;后台+轮询仍是首选)", { derivedDefaultNote: "缺席 ⇒ adapter 默认 120s" }),
+    r("E2B_MOUNT_PATH", "orchestration", "path", "e2b 工作区根(resume 用当前值,改前先 drain 挂起任务)"),
+    r("E2B_ORPHAN_RECLAIM", "orchestration", "boolean", "崩溃遗留沙盒回收腿(boot 一次+周期;判据保守,拿不准恒不杀)", { staticDefault: "true", danger: BILL }),
+    r("E2B_SANDBOX_ENV", "orchestration", "csv", "转发进 e2b 沙箱的本进程 env 名字表(值不进 spec/center/事件日志)", { danger: SEC }),
+    r("E2B_SANDBOX_MAX_MS", "orchestration", "number", "e2b 沙箱最长存活(ms)", { staticDefault: "3600000", danger: BILL }),
+    r("E2B_TEMPLATE", "orchestration", "string", "e2b 模板名(缺省 adapter 基础模板)"),
+    r("E2B_TIMEOUT_MS", "orchestration", "number", "e2b 单命令总超时(ms)"),
+    r("ENGINE_AUTO_EXIT", "limitsHttp", "boolean", "引擎附着租约自退总开关(壳 spawn 形注 true;三合取持续 linger 窗才自退,走 SIGTERM 同一条 drain 腿)", { staticDefault: "false", configKey: "engineAutoExit" }),
+    r("ENGINE_LINGER_MS", "limitsHttp", "number", "自退前三合取须持续成立的静默窗(ms;[1000,24h] 拒启带界)", { staticDefault: "60000", configKey: "engineLingerMs" }),
+    r("EXPERIMENTAL_OBSERVER_AGENTS", "orchestration", "boolean", "observer 开闸线(实验面 ship-dark;多租户只认 center caps,env 被忽略)", { staticDefault: "false", configKey: "experimentalObserverAgents" }),
+    r("FILE_HISTORY_RETENTION_KEEP", "store", "number", "per-file rewind 历史的保留上限(与 core FileStorageBackend 同域键形,三条车道一套语义)", { danger: DATA, derivedDefaultNote: "缺席 ⇒ core 缺省 100" }),
+    r("FLEET_ADVERTISE_ADDRESS", "integrations", "url", "fleet 面向 center 公告的本 worker 可达地址(与 center 腿同在 ⇒ 启 fleet client;坏形拒启)"),
+    r("FORK_ENABLED", "orchestration", "boolean", "CC /fork(core Fork 工具)装配开关", { derivedDefaultNote: "posture 三态:缺席 = 单用户 ⇒ on / 多租户 ⇒ off(per-principal entitlement 另判)", configKey: "forkEnabled" }),
+    r("GATEWAY_MAX_RETRIES", "modelPlane", "number", "openai 兼容腿每次调用重试上限", { derivedDefaultNote: "缺席 ⇒ 不传引擎,引擎默认当家" }),
+    r("GIT_API_BASEURL", "integrations", "url", "repo 工具的 Git host API base", { configKey: "gitApiBaseUrl" }),
+    r("GIT_API_KIND", "integrations", "enum", "Git host API 方言", { enumValues: ["gitea", "github"], staticDefault: "gitea", configKey: "gitApiKind" }),
+    r("GIT_API_TOKEN", "integrations", "secret", "repo 工具的 Git host 凭据", { danger: SEC }),
+    r("HOOKS_TIMEOUT_MS", "orchestration", "number", "每只 hook 席位单次调用时限(ms;0=立即到期是合法值)", { derivedDefaultNote: "缺席 ⇒ 不铸键,core 自默认 600s" }),
+    r("HOST_BG_DEFAULT_TIMEOUT_SEC", "orchestration", "number", "host 后台 shell 缺省超时(秒)", { staticDefault: "300" }),
+    r("HOST_BG_ENABLED", "orchestration", "boolean", "host 车道后台 shell 开关", { staticDefault: "true" }),
+    r("HOST_BG_FILE_CAP", "orchestration", "number", "host 后台 shell 磁盘护栏(字节;失控输出被 reap)", { staticDefault: String(64 * 1024 * 1024) }),
+    r("HOST_BG_KILL_GRACE_MS", "orchestration", "number", "host 后台 shell SIGTERM→SIGKILL 宽限(ms)", { staticDefault: "1000" }),
+    r("HOST_BG_MAX_CONCURRENT", "orchestration", "number", "host 后台 shell 并发帽", { staticDefault: "8" }),
+    r("HOST_BG_MAX_TIMEOUT_SEC", "orchestration", "number", "host 后台 shell 超时上限(秒)", { staticDefault: "1800" }),
+    r("HOST_BG_MEM_CAP", "orchestration", "number", "host 后台 shell 内存流护栏(字节)", { staticDefault: String(8 * 1024 * 1024) }),
+    r("HOST_BG_READ_CAP", "orchestration", "number", "host 后台 shell 每次轮询增量读上限(字节)", { staticDefault: String(1024 * 1024) }),
+    r("HOST_COMMAND_TIMEOUT_MS", "orchestration", "number", "host 车道单命令超时(ms)"),
+    r("HOST_EXEC_SPOOL_ENABLED", "orchestration", "boolean", "host 车道执行 spool 开关", { staticDefault: "true" }),
+    r("HOST_SHELL_PATH", "orchestration", "path", "host 车道 shell 覆写口(POSIX 与 win32 同源解析)"),
+    r("HOST_WORKSPACE_BASE", "orchestration", "path", "host 车道工作区 base"),
+    r("IMAGE_BAKES_ENABLED", "orchestration", "boolean", "烤镜像 job API(/v1/images/bakes*;需 SQL 池 + 非空 operator 名单,boot 断言)", { staticDefault: "false", danger: SEC }),
+    r("INFRA_COST_EGRESS_GB", "limitsHttp", "number", "出网计费费率(per-run 出网计量未接,恒乘 0 —— 设非零会 boot 点名)", { staticDefault: "0", danger: BILL, envTiming: "inert", center: cLimits("infraCostRates.egressGbMicroUsd", { timing: "inert" }) }),
+    r("INFRA_COST_SANDBOX_SEC", "limitsHttp", "number", "沙箱秒基建费率(0=不计价)", { staticDefault: "0", danger: BILL, center: cLimits("infraCostRates.sandboxSecMicroUsd") }),
+    r("INFRA_COST_TOOL_CALL", "limitsHttp", "number", "工具调用基建费率(0=不计价;负值夹 0 点名)", { staticDefault: "0", danger: BILL, center: cLimits("infraCostRates.toolCallMicroUsd") }),
+    r("K8S_API_URL", "orchestration", "url", "k8s API 地址(缺席走 in-cluster SA 自动发现)"),
+    r("K8S_BG_DEFAULT_TIMEOUT_SEC", "orchestration", "number", "k8s 后台 shell 缺省超时(秒)", { staticDefault: "300" }),
+    r("K8S_BG_FILE_CAP", "orchestration", "number", "k8s 后台 shell pod 侧文件护栏(字节)", { staticDefault: String(64 * 1024 * 1024) }),
+    r("K8S_BG_MAX_CONCURRENT", "orchestration", "number", "k8s 后台 shell 并发帽", { staticDefault: "8" }),
+    r("K8S_BG_MAX_TIMEOUT_SEC", "orchestration", "number", "k8s 后台 shell 超时上限(秒)", { staticDefault: "1800" }),
+    r("K8S_BG_MEM_CAP", "orchestration", "number", "k8s adopted shell 控制面内存护栏(字节)", { staticDefault: String(8 * 1024 * 1024) }),
+    r("K8S_BG_READ_CAP", "orchestration", "number", "k8s 后台 shell 每次轮询读上限(字节)", { staticDefault: String(1024 * 1024) }),
+    r("K8S_CA_CERT_B64", "orchestration", "opaque", "k8s API CA 证书(base64;registry secrets 无换行约束)", { danger: SEC }),
+    r("K8S_CPU", "orchestration", "string", "沙箱 pod CPU 限额(profile 数据)"),
+    r("K8S_INSECURE_TLS", "orchestration", "boolean", "跳过 k8s API TLS 校验", { staticDefault: "false", danger: SEC }),
+    r("K8S_MEMORY", "orchestration", "string", "沙箱 pod 内存限额(2Gi 默认曾被真 OOM)"),
+    r("K8S_MOUNT_PATH", "orchestration", "path", "k8s 工作区挂载路径"),
+    r("K8S_NAMESPACE", "orchestration", "string", "沙箱 pod namespace"),
+    r("K8S_RUNTIME_CLASS", "orchestration", "string", "沙箱 pod runtimeClass(Kata 等)"),
+    r("K8S_SANDBOX_IMAGE", "orchestration", "string", "k8s 车道沙箱镜像(REMOTE_EXEC=k8s 必需件)"),
+    r("K8S_TIMEOUT_MS", "orchestration", "number", "k8s 单命令超时(ms)"),
+    r("K8S_TOKEN", "orchestration", "secret", "k8s API token(缺席走 in-cluster SA)", { danger: SEC }),
+    r("KUBERNETES_SERVICE_HOST", "orchestration", "string", "平台注入的 in-cluster k8s API host(K8S_API_URL 缺席时用)"),
+    r("KUBERNETES_SERVICE_PORT", "orchestration", "string", "平台注入的 in-cluster k8s API 端口(缺省 443)"),
+    r("LEADER_BUDGET_USD", "orchestration", "number", "leader replan-lite 扇出花费帽(USD)", { danger: BILL, derivedDefaultNote: "缺席 ⇒ replan-lite 自默认" }),
+    r("LEADER_CONFLICT_ROUNDS", "orchestration", "number", "leader 合并冲突修复轮数", { danger: BILL, derivedDefaultNote: "缺席 ⇒ 场景配置 conflictRounds(默认 0)" }),
+    r("LEADER_ENABLED", "orchestration", "boolean", "leader 端点(POST/GET /v1/leader;需隔离执行后端 + durable leader_run 店,缺则拒启)", { staticDefault: "false", configKey: "leaderEnabled" }),
+    r("LEADER_FANOUT_ENABLED", "orchestration", "boolean", "leader 扇出许可(false=钉死单路由零 router 成本)", { staticDefault: "true", danger: BILL, configKey: "leaderFanoutEnabled" }),
+    r("LEADER_MEASURE_GATES", "orchestration", "boolean", "leader 合并 push-hold-on-signal + measure-drives-repair 门(严格 'true' 才开)", { staticDefault: "false" }),
+    r("LEADER_ORACLE_FLAKY_K", "orchestration", "number", "leader oracle flaky-settle 重隔离次数(下限 1)", { staticDefault: "2" }),
+    r("LEADER_REPAIR_BUDGET_USD", "orchestration", "number", "leader 修复轮花费帽(USD)", { staticDefault: "4", danger: BILL }),
+    r("LEADER_REPAIR_LOOP", "orchestration", "boolean", "runRepairLoop 单代理自修复引擎总开关(master;严格 'true' 才开)", { staticDefault: "false", danger: BILL }),
+    r("LEADER_REPAIR_LOOP_ATTEMPTS", "orchestration", "number", "修复环内尝试上限(钳 [2,3])", { staticDefault: "2" }),
+    r("LEADER_REPAIR_ROUNDS", "orchestration", "number", "leader 修复轮数", { danger: BILL, derivedDefaultNote: "缺席 ⇒ 场景配置值" }),
+    r("LEADER_RESOURCE_SUSPEND", "orchestration", "boolean", "leader worker 分片 resourceSuspend opt-in(严格 'true' 才开)", { staticDefault: "false" }),
+    r("LEADER_RUN_STALE_MS", "orchestration", "number", "running leader_run 停超此值清算成 failed(ms;不是接管)", { staticDefault: String(26 * 60 * 60 * 1000), configKey: "leaderRunStaleMs" }),
+    r("LEADER_TIMEOUT_MS", "orchestration", "number", "leader 总墙钟(ms;下限 10min)", { staticDefault: "86400000" }),
+    r("LEADER_WORKER_BUDGET_USD", "orchestration", "number", "leader 每 worker 花费帽(USD)", { staticDefault: "100", danger: BILL }),
+    r("LEADER_WORKER_MAX_TURNS", "orchestration", "number", "leader 每 worker 轮数帽", { staticDefault: "10000", danger: BILL }),
+    r("LEADER_WORKER_SLICE_BUDGET_USD", "orchestration", "number", "leader worker 单分片花费帽(USD)", { danger: BILL, derivedDefaultNote: "缺席 ⇒ max(1, workerBudgetUsd/4)" }),
+    r("LOCAL_DATA_ROOT", "store", "path", "file 店数据根的最高优先覆写(设了则与配置根分家,boot 出声)", { danger: DATA }),
+    r("LOCKED_CONFIG_KEYS", "auth", "csv", "管理员锁定层声明(词表=core 闭集注册表,未知键拒启)", { danger: SEC, configKey: "lockedConfigKeys" }),
+    r("LOG_LEVEL", "observability", "string", "日志档位", { staticDefault: "info", configKey: "logLevel" }),
+    r("LSP_ENABLED", "orchestration", "boolean", "LSP 沙箱腿 opt-in(需烤好的 LSP 模板;host 腿另有 LSP_HOST_ENABLED)", { staticDefault: "false", configKey: "lspEnabled" }),
+    r("LSP_HOST_ENABLED", "orchestration", "boolean", "LSP host 腿开关(本机 language server,优雅降级)", { staticDefault: "true", configKey: "lspHostEnabled" }),
+    r("MANUAL_MODE_SHELL_GATE", "approval", "enum", "手动模式 shell 门收紧腿(off=no-op 非放松 —— 本键只有收紧半场;拼错拒启)", { danger: SEC, enumValues: ["always", "classify", "off"] }),
+    r("MAX_PRINCIPAL_COST_USD", "limitsHttp", "number", "per-principal 窗内成本天花板(0=关)", { staticDefault: "0", danger: BILL, configKey: "maxPrincipalCostUsd", center: cLimits("maxPrincipalCostUsd") }),
+    r("MAX_TASK_COST_USD", "limitsHttp", "number", "单任务成本天花板(0=关)", { staticDefault: "0", danger: BILL, configKey: "maxTaskCostUsd", center: cLimits("maxTaskCostUsd") }),
+    r("MAX_TASK_TOKENS", "limitsHttp", "number", "单任务 token 天花板(per-slice 窗;0=关)", { staticDefault: "0", danger: BILL, configKey: "maxTaskTokens", center: cLimits("maxTaskTokens") }),
+    r("MCP_ELICITATION_ENABLED", "approval", "boolean", "入站 MCP elicitation HITL(per-server opt-in 另有一道)", { staticDefault: "false", danger: SEC }),
+    r("MCP_ELICITATION_MAX_CONCURRENT", "approval", "number", "elicitation 每 run 并发帽", { derivedDefaultNote: "缺席 ⇒ core 出厂窗(DEFAULT_ELICITATION_THROTTLE)" }),
+    r("MCP_ELICITATION_MAX_TOTAL", "approval", "number", "elicitation 每 run 总量帽", { derivedDefaultNote: "缺席 ⇒ core 出厂窗" }),
+    r("MCP_ELICITATION_MIN_INTERVAL_MS", "approval", "number", "elicitation per-server 最小间隔(ms)", { derivedDefaultNote: "缺席 ⇒ core 出厂窗" }),
+    r("MCP_ELICITATION_TTL_MS", "approval", "number", "elicitation 无人应答释放窗(ms)", { derivedDefaultNote: "缺席 ⇒ core 出厂窗" }),
+    r("MEMORY_CAPTURE_POLICY", "memory", "enum", "记忆 capture 姿态(open=声明按面值;governed=按 per-principal verdict;capture-required=恒采)", { enumValues: ["open", "governed", "capture-required"], staticDefault: "open", danger: SEC, configKey: "memoryCapturePolicy" }),
+    r("MEMORY_CONSOLIDATION_DRIVER", "memory", "enum", "记忆折叠阀门(off=零装配零探针,两 admin 口 404 族)", { enumValues: ["on", "off"], staticDefault: "off", danger: BILL }),
+    r("MEMORY_CONSOLIDATION_INTERVAL_SEC", "memory", "number", "折叠周期腿节律(秒;本 build 任何正值拒启 —— 周期腿未落地,恒 0)", { staticDefault: "0" }),
+    r("MEMORY_CONSOLIDATION_SCOPES", "memory", "csv", "折叠阀门 scope 表(恰一条时=admin 口缺省;不是授权边界)"),
+    r("MEMORY_DELEGATION_EVIDENCE", "memory", "enum", "委派臂污染标记的证据标准", { enumValues: ["static-face", "attested-only"], staticDefault: "static-face", danger: SEC, configKey: "memoryDelegationEvidence" }),
+    r("MEMORY_EMBEDDER_API_KEY", "memory", "secret", "记忆向量面 embeddings 端点凭据", { danger: SEC }),
+    r("MEMORY_EMBEDDER_DIM", "memory", "number", "embeddings 维度声明"),
+    r("MEMORY_EMBEDDER_ENDPOINT", "memory", "url", "OpenAI 兼容 /embeddings 端点(pg 记忆后端的向量面)"),
+    r("MEMORY_EMBEDDER_MODEL", "memory", "string", "embeddings 模型名"),
+    r("MEMORY_EMBEDDER_TIMEOUT_MS", "memory", "number", "单次 embed 活性上限(ms)", { staticDefault: "30000" }),
+    r("MEMORY_ENGINE", "memory", "enum", "记忆引擎总开关(注入式文件记忆面;双族词表,未知词拒启)", { enumValues: ["on", "off"], staticDefault: "on" }),
+    r("MEMORY_ENGINE_BACKEND", "memory", "enum", "记忆持久面方言(file=现状;pg/tidb=DB 真身,多租户点亮的唯一门)", { enumValues: ["file", "pg", "tidb"], staticDefault: "file", danger: DATA, configKey: "memoryEngineBackend" }),
+    r("MEMORY_ENGINE_DIR", "memory", "path", "记忆引擎根覆写", { derivedDefaultNote: "缺席 ⇒ core 默认链(AGENT_DATA_DIR → ~/.ai-agent)", configKey: "memoryEngineDir" }),
+    r("MEMORY_ENGINE_REMOTE_LANE", "memory", "enum", "远端执行车道上放行 file 记忆引擎的 plane-split 覆写", { enumValues: ["allow"] }),
+    r("MEMORY_ORG_ADMISSION_MODE", "memory", "enum", "org 记忆准入模式(audit=判决照算纯观察)", { enumValues: ["audit", "enforce"], staticDefault: "enforce", danger: SEC, configKey: "memoryOrgAdmissionMode" }),
+    r("MEMORY_ORG_DIRECTORY_JSON", "memory", "opaque", "单机形 org 目录原文(principal→org:scope 授权表;解析期整段校验)", { danger: SEC }),
+    r("MEMORY_ORG_GRANT_TTL_MS", "memory", "number", "org 目录判决缓存 TTL(ms;准入判决滞后上限)", { staticDefault: "60000", configKey: "memoryOrgGrantTtlMs" }),
+    r("MEMORY_ORG_UNAVAILABLE_BACKOFF_MS", "memory", "number", "org 目录取数失败退避窗(ms)", { staticDefault: "10000", configKey: "memoryOrgUnavailableBackoffMs" }),
+    r("MEMORY_PERSISTENCE_CAPABLE", "memory", "enum", "本部署能否把「记住 X」落到持久处的自我声明(三态;未知词拒启)", { enumValues: ["on", "off"], derivedDefaultNote: "缺席 ⇒ 键不上 TaskSpec,core 按 roster 推断" }),
+    r("MEMORY_PROVENANCE", "memory", "enum", "已暴露会话的记忆写处置(carry=带 origin 标记照写;off=关)", { enumValues: ["off", "carry"], staticDefault: "carry", danger: SEC, configKey: "memoryProvenance" }),
+    r("MEMORY_SCOPE", "memory", "string", "单用户部署的记忆 scope 名", { derivedDefaultNote: "缺席:引擎开 ∧ 单用户 ⇒ local;其余 ⇒ 缺席(记忆暗)", configKey: "memoryScope" }),
+    r("MEMORY_SYNC_MAX_PULL_ENTRIES", "memory", "number", "TOC 同步单轮 pull 条数帽(设了必须 ≥1 整数)", { derivedDefaultNote: "缺席 ⇒ 键缺席,core 默认" }),
+    r("MEMORY_SYNC_MAX_PUSH_ENTRIES", "memory", "number", "TOC 同步单轮 push 条数帽(设了必须 ≥1 整数)", { derivedDefaultNote: "缺席 ⇒ 键缺席,core 默认" }),
+    r("MEMORY_SYNC_SCOPE", "memory", "string", "TOC 同步 scope 覆写", { derivedDefaultNote: "缺席 ⇒ 从 MEMORY_SCOPE 铸 user 盘键" }),
+    r("MEMORY_SYNC_TOKEN", "memory", "secret", "TOC 同步中心面的 Bearer(URL 设了它必须在,半配拒启)", { danger: SEC }),
+    r("MEMORY_SYNC_URL", "memory", "url", "TOC 同步中心地址(设了=开;file 记忆形专用,DB 后端配了拒启)"),
+    r("METRICS_TOKEN", "observability", "secret", "/metrics 只读令牌", { danger: SEC }),
+    r("MINIO_ACCESS_KEY", "store", "secret", "对象存储 access key(快照 blob/leader 工作区/公链签发共用)", { danger: SEC }),
+    r("MINIO_BUCKET", "store", "string", "leader 工作区快照桶", { derivedDefaultNote: "缺席 ⇒ workspaces" }),
+    r("MINIO_ENDPOINT", "store", "url", "对象存储 endpoint(三键齐 ⇒ 快照 blob 走 MinIO,否则 SQL 行)", { danger: DATA }),
+    r("MINIO_REGION", "store", "string", "对象存储 region"),
+    r("MINIO_SECRET_KEY", "store", "secret", "对象存储 secret key", { danger: SEC }),
+    r("MODEL_API_KEY", "modelPlane", "secret", "网关腿共享 API key(per-model 覆写在 center 侧)", { danger: [...SEC, ...BILL] }),
+    r("MODEL_AUTO_COMPACT_TOKENS", "modelPlane", "number", "主槽 dual-window 触发阈(1M 窗不再隐式 967000,缺席则用普通触发几何)", { derivedDefaultNote: "缺席 ⇒ 不铸键(core W-33000 几何)" }),
+    r("MODEL_CASCADE_LADDER", "modelPlane", "csv", "质量门级联梯(目录名 cheapest→strongest;opt-in per-task cascade:true)", { danger: BILL, configKey: "cascadeLadder" }),
+    r("MODEL_CB_COOLDOWN_MS", "modelPlane", "number", "熔断冷却窗(ms)", { staticDefault: "30000" }),
+    r("MODEL_CB_FAILURE_THRESHOLD", "modelPlane", "number", "熔断失败阈", { staticDefault: "5" }),
+    r("MODEL_CHARS_PER_TOKEN", "modelPlane", "number", "结构估 token 系数(CJK 密集模型建议 2-3;坏值回 core 默认)", { derivedDefaultNote: "缺席 ⇒ core 默认 4" }),
+    r("MODEL_CHEAP_AUTO_COMPACT_TOKENS", "modelPlane", "number", "cheap 槽 dual-window 触发阈(主槽值刻意不外溢)", { derivedDefaultNote: "缺席 ⇒ 不铸键" }),
+    r("MODEL_CHEAP_CHARS_PER_TOKEN", "modelPlane", "number", "cheap 槽结构估 token 系数", { derivedDefaultNote: "缺席 ⇒ 继承主模型" }),
+    r("MODEL_CHEAP_CONTEXT_WINDOW", "modelPlane", "number", "cheap 槽上下文窗", { derivedDefaultNote: "缺席 ⇒ 继承主模型", center: cModels("models[].contextWindow") }),
+    r("MODEL_CHEAP_COST_CACHE_READ", "modelPlane", "number", "cheap 槽 cache-read 单价(per-1M USD)", { danger: BILL, derivedDefaultNote: "缺席 ⇒ 继承主模型;空串=0 点名", center: cModels("models[].cost.cacheRead") }),
+    r("MODEL_CHEAP_COST_CACHE_WRITE", "modelPlane", "number", "cheap 槽 cache-write 单价", { danger: BILL, derivedDefaultNote: "缺席 ⇒ 继承主模型", center: cModels("models[].cost.cacheWrite") }),
+    r("MODEL_CHEAP_COST_INPUT", "modelPlane", "number", "cheap 槽 input 单价", { danger: BILL, derivedDefaultNote: "缺席 ⇒ 继承主模型", center: cModels("models[].cost.input") }),
+    r("MODEL_CHEAP_COST_OUTPUT", "modelPlane", "number", "cheap 槽 output 单价", { danger: BILL, derivedDefaultNote: "缺席 ⇒ 继承主模型", center: cModels("models[].cost.output") }),
+    r("MODEL_CHEAP_ID", "modelPlane", "string", "cheap 槽模型 id(subagent/summarize 两 role 走它;未设=全落主模型)", { danger: BILL, center: cModels("models[].id") }),
+    r("MODEL_CHEAP_MAX_TOKENS", "modelPlane", "number", "cheap 槽输出上限", { derivedDefaultNote: "缺席 ⇒ 继承主模型", center: cModels("models[].maxTokens") }),
+    r("MODEL_CHEAP_REASONING", "modelPlane", "boolean", "cheap 槽 reasoning 声明(三态:缺席继承主模型)", { derivedDefaultNote: "缺席 ⇒ 继承主模型" }),
+    r("MODEL_CHEAP_VISION", "modelPlane", "boolean", "cheap 槽 vision 声明(三态:缺席继承主模型;text-only cheap 必设 false 让预检真拦)", { derivedDefaultNote: "缺席 ⇒ 继承主模型" }),
+    r("MODEL_CIRCUIT_BREAKER", "modelPlane", "boolean", "模型腿熔断开关", { staticDefault: "false" }),
+    r("MODEL_CODE_ROLES", "modelPlane", "csv", "给点名 role 附编码 persona(role 表内名字才生效)"),
+    r("MODEL_CONNECT_TIMEOUT_MS", "modelPlane", "number", "连接超时(ms;0=关)", { staticDefault: "30000" }),
+    r("MODEL_CONTEXT_WINDOW", "modelPlane", "number", "主模型上下文窗声明", { staticDefault: "262144", configKey: "model", resolve: (c) => c.model.contextWindow ?? null, center: cModels("models[].contextWindow") }),
+    r("MODEL_COST_CACHE_READ", "modelPlane", "number", "主模型 cache-read 单价(per-1M USD;0=不计价)", { staticDefault: "0", danger: BILL, resolve: (c) => c.model.cost?.cacheRead ?? null, center: cModels("models[].cost.cacheRead") }),
+    r("MODEL_COST_CACHE_WRITE", "modelPlane", "number", "主模型 cache-write 单价", { staticDefault: "0", danger: BILL, resolve: (c) => c.model.cost?.cacheWrite ?? null, center: cModels("models[].cost.cacheWrite") }),
+    r("MODEL_COST_INPUT", "modelPlane", "number", "主模型 input 单价(NaN 会让成本天花板整条消失 ⇒ 坏值拒启)", { staticDefault: "0", danger: BILL, resolve: (c) => c.model.cost?.input ?? null, center: cModels("models[].cost.input") }),
+    r("MODEL_COST_OUTPUT", "modelPlane", "number", "主模型 output 单价", { staticDefault: "0", danger: BILL, resolve: (c) => c.model.cost?.output ?? null, center: cModels("models[].cost.output") }),
+    r("MODEL_DEFAULT_THINKING", "modelPlane", "enum", "主模型默认思考档(llm-core ThinkingLevel,无 off)", { enumValues: ["minimal", "low", "medium", "high", "max"] }),
+    r("MODEL_DEGRADE_AT_COST_FRACTION", "modelPlane", "number", "预算降级触发比(spent/budget;>1=实际别降级)", { staticDefault: "0.7", danger: BILL }),
+    r("MODEL_DEGRADE_ON", "modelPlane", "csv", "反应式降级触发词表(core DegradeReason 全集;拼错拒启)", { center: { domain: "models", path: "degrade", centerKey: "models", precedence: "center-wins", timing: "restart", restartSlice: "degrade-route" } }),
+    r("MODEL_DEGRADE_REACTIVE", "modelPlane", "boolean", "反应式降级开关(degrade-route 重启片只在它开时活)", { staticDefault: "false", center: { domain: "models", path: "degrade", centerKey: "models", precedence: "center-wins", timing: "restart", restartSlice: "degrade-route" } }),
+    r("MODEL_DEGRADE_TO", "modelPlane", "string", "降级目标模型(设了=开降级;外部网关名不必在目录)", { danger: BILL }),
+    r("MODEL_DEGRADE_TO_VISION", "modelPlane", "boolean", "降级目标的 vision 声明(false ⇒ 带图任务丢降级不丢图)", { staticDefault: "false" }),
+    r("MODEL_EXTRA_BODY", "modelPlane", "opaque", "生成参数直通 JSON(top_k/logit_bias 等;必须静态 —— 前缀缓存键序)", { danger: SEC }),
+    r("MODEL_FIRST_TOKEN_TIMEOUT_MS", "modelPlane", "number", "首 token 超时(ms;0=关 —— 开流不吐字的唯一看门狗)", { staticDefault: "120000" }),
+    r("MODEL_FREQUENCY_PENALTY", "modelPlane", "number", "frequency_penalty 直通(压过 EXTRA_BODY 同键)"),
+    r("MODEL_GATEWAY_BASEURL", "modelPlane", "url", "openai 兼容网关 base URL(默认 localhost 占位 —— 公开分发不烤内网坐标)", { staticDefault: "http://127.0.0.1:8000/v1", configKey: "gatewayBaseUrl", center: cModels("models[].baseUrl") }),
+    r("MODEL_GATEWAY_FALLBACK_URLS", "modelPlane", "url", "网关故障转移地址表(CSV)", { configKey: "gatewayFallbackUrls" }),
+    r("MODEL_ID", "modelPlane", "string", "主模型 id(3.0.0 起无出厂缺省,缺 ⇒ 拒启指路)", { configKey: "model", resolve: (c) => c.model.id, center: cModels("models[].id") }),
+    r("MODEL_IDLE_TIMEOUT_MS", "modelPlane", "number", "流中静默看门狗(ms;0=关)", { staticDefault: "300000" }),
+    r("MODEL_MAX_TOKENS", "modelPlane", "number", "主模型输出上限", { derivedDefaultNote: "缺席 ⇒ min(32000, contextWindow)", resolve: (c) => c.model.maxTokens ?? null, center: cModels("models[].maxTokens") }),
+    r("MODEL_PRESENCE_PENALTY", "modelPlane", "number", "presence_penalty 直通"),
+    r("MODEL_PROVIDER", "modelPlane", "string", "主模型 provider(路由选 brain)", { derivedDefaultNote: "缺席:ANTHROPIC base+cred 同在 ⇒ anthropic,否则 gateway", resolve: (c) => c.model.provider, center: cModels("models[].provider") }),
+    r("MODEL_REASONING", "modelPlane", "boolean", "主模型 reasoning 声明", { staticDefault: "true", resolve: (c) => c.model.reasoning ?? null, center: cModels("models[].reasoning") }),
+    r("MODEL_REASONING_EFFORT_LEVELS", "modelPlane", "csv", "openai 端点接受的思考档集(高档 clamp-down 不 422;anthropic 腿不需要)"),
+    r("MODEL_ROUTER_ID", "modelPlane", "string", "leader 路由分类模型覆写", { derivedDefaultNote: "缺席 ⇒ MODEL_CHEAP_ID,再退 default", danger: BILL }),
+    r("MODEL_VERIFIER", "modelPlane", "string", "verify 门的异构 verifier(须命中目录;typo 回 default 并 boot warn=自评自批)", { derivedDefaultNote: "缺席/不在目录 ⇒ default(=implementer,去相关性失效警告)" }),
+    r("MODEL_VISION", "modelPlane", "boolean", "主模型 vision 声明(false 让 model_no_vision 预检真拦)", { staticDefault: "true", resolve: (c) => (Array.isArray(c.model.input) ? c.model.input.includes("image") : true), center: cModels("models[].vision") }),
+    r("MYSQL_DATABASE", "store", "string", "MySQL 协议库名(选中该引擎时必填)", { danger: DATA }),
+    r("MYSQL_HOST", "store", "string", "MySQL 协议主机(在场即算 SQL 信号,参与 DB_BACKEND 默认推导)", { danger: DATA }),
+    r("MYSQL_PASSWORD", "store", "secret", "MySQL 协议口令", { danger: SEC }),
+    r("MYSQL_POOL_SIZE", "store", "number", "MySQL 连接池上限(坏值回 driver 默认+warn)", { derivedDefaultNote: "缺席 ⇒ driver 默认池" }),
+    r("MYSQL_PORT", "store", "number", "MySQL 协议端口", { staticDefault: "3306" }),
+    r("MYSQL_USER", "store", "string", "MySQL 协议用户", { danger: DATA }),
+    r("OPERATOR_PRINCIPALS", "auth", "csv", "operator 名单(operator lane 全族门;审批队列上空名单=旧行为 token 即 operator,explicitOperatorOk 族空名单=谁都不是)", { danger: SEC, configKey: "operatorPrincipals" }),
+    r("OTEL_EXPORTER_OTLP_ENDPOINT", "observability", "url", "OTLP 出口(设了=开 otel)"),
+    r("OTEL_EXPORTER_OTLP_HEADERS", "observability", "secret", "OTLP 出口头(k=v CSV;常载鉴权头 ⇒ 按凭据处置)", { danger: SEC }),
+    r("OTEL_EXPORT_INTERVAL_MS", "observability", "number", "OTLP 批报周期(ms)", { staticDefault: "15000" }),
+    r("OTEL_SERVICE_NAME", "observability", "string", "OTLP service.name", { staticDefault: "sema-server" }),
+    r("PERMISSION_RULES_ENABLED", "approval", "boolean", "持久化权限规则车道总开关(撤销面已建 ⇒ 默认 ON)", { staticDefault: "true", danger: SEC, configKey: "permissionRulesEnabled" }),
+    r("PG_DATABASE", "store", "string", "PostgreSQL 库名", { danger: DATA }),
+    r("PG_HOST", "store", "string", "PostgreSQL 主机(在场即算 SQL 信号)", { danger: DATA }),
+    r("PG_PASSWORD", "store", "secret", "PostgreSQL 口令", { danger: SEC }),
+    r("PG_POOL_SIZE", "store", "number", "PostgreSQL 连接池上限", { derivedDefaultNote: "缺席 ⇒ driver 默认池" }),
+    r("PG_PORT", "store", "number", "PostgreSQL 端口", { staticDefault: "5432" }),
+    r("PG_USER", "store", "string", "PostgreSQL 用户", { danger: DATA }),
+    r("PLAN_MODE_ENABLED", "orchestration", "boolean", "模型自驱 plan mode(enter_plan_mode 工具)", { staticDefault: "true", configKey: "planModeEnabled" }),
+    r("PLUGINS_ALLOW_HOSTS", "integrations", "csv", "plugins 域 clone host 白名单", { staticDefault: "github.com", danger: SEC, configKey: "pluginsAllowHosts" }),
+    r("PORT", "limitsHttp", "number", "监听端口(0=随机,测试用)", { staticDefault: "8090", configKey: "port" }),
+    r("PRINCIPAL_HEADER", "auth", "string", "principal 头名(跨仓冻结默认)", { staticDefault: "x-agent-principal", danger: SEC, configKey: "principalHeader" }),
+    r("PRINCIPAL_JWT_AUD", "auth", "string", "直连 principal JWT 期望 aud", { danger: SEC, configKey: "principalJwtAud" }),
+    r("PRINCIPAL_JWT_ISS", "auth", "string", "直连 principal JWT 期望 iss", { danger: SEC, configKey: "principalJwtIss" }),
+    r("PRINCIPAL_JWT_MAX_TTL_SEC", "auth", "number", "接受的 principal JWT 最长寿命(秒;0=不设帽;负值拒启 —— 收紧意图不许翻成最松)", { staticDefault: "120", danger: SEC, configKey: "principalJwtMaxTtlSec" }),
+    r("PRINCIPAL_JWT_PUBKEYS", "auth", "opaque", "直连门 issuer 公钥 JWKS(非密但整段;空=直连门开不了)", { danger: SEC }),
+    r("PROJECT_MEMORY_ENABLED", "memory", "boolean", "host 车道项目记忆注入(CLAUDE.md + git 叙事)", { staticDefault: "true", configKey: "projectMemoryEnabled" }),
+    r("QUESTION_MAX_CONCURRENT_PER_RUN", "approval", "number", "AskUserQuestion 每 run 并发帽", { derivedDefaultNote: "缺席 ⇒ 出厂窗 2" }),
+    r("QUESTION_MAX_TOTAL_PER_RUN", "approval", "number", "AskUserQuestion 每 run 总量帽", { derivedDefaultNote: "缺席 ⇒ 出厂窗 20" }),
+    r("QUESTION_TTL_MS", "approval", "number", "AskUserQuestion 无人应答释放窗(ms)", { derivedDefaultNote: "缺席 ⇒ 出厂窗 300000" }),
+    r("RATE_LIMIT_RPM", "limitsHttp", "number", "计费提交每分钟限流(0=关)", { staticDefault: "0", danger: BILL, configKey: "rateLimitPerMin", center: cLimits("rateLimitPerMin") }),
+    r("READ_DENY_BUILTIN_EXCLUDE", "orchestration", "csv", "按行名删内建 deny 条目(档位之后生效;绝不削任务显式 deny)", { danger: SEC, configKey: "readDenyBuiltinExclude", center: cRead("denyBuiltinExclude", "readDenyBuiltinExclude") }),
+    r("READ_DENY_BUILTIN_TIERS", "orchestration", "csv", "内建 deny 表档位选择(闭集四档;none=显式空姿态)", { danger: SEC, configKey: "readDenyBuiltinTiers", center: cRead("denyBuiltinTiers", "readDenyBuiltinTiers") }),
+    r("READ_DENY_PATTERNS", "orchestration", "csv", "READ 面额外 deny pattern 表", { danger: SEC, configKey: "readDenyPatterns", center: cRead("denyPatterns", "readDenyPatterns") }),
+    r("READ_FACE", "orchestration", "enum", "READ 容纳面档位(env 逐键恒赢 center —— 部署主权表达)", { enumValues: ["open", "roots"], danger: SEC, derivedDefaultNote: "缺席 ⇒ 不铸键,core 默认 roots", configKey: "readFace", center: cRead("face", "readFace") }),
+    r("REAP_INTERVAL_SEC", "limitsHttp", "number", "reaper 周期(秒)", { staticDefault: "60", configKey: "reapIntervalSec" }),
+    r("REAP_RUN_STALE_SEC", "limitsHttp", "number", "run 活性判陈旧阈(秒)", { staticDefault: "120", configKey: "runStaleSec", center: cLimits("runStaleSec") }),
+    r("REMOTE_EXEC", "orchestration", "enum", "执行车道选择(点名而配不齐/认不出 ⇒ 拒启,绝不静默降级到 host/stub)", { enumValues: ["e2b", "k8s", "ssh", "adb", "host", "local-docker", "device"], danger: SEC, derivedDefaultNote: "缺席:CONFIG_PROVIDER=local ⇒ host;其余 ⇒ 进程内 stub", configKey: "remoteExec", resolve: (c) => c.remoteExec?.provider ?? null }),
+    r("REQUIRE_PRINCIPAL", "auth", "boolean", "多租户开关(posture 判别位:true ⇒ CC 能力族默认收紧)", { staticDefault: "false", danger: SEC, configKey: "requirePrincipal" }),
+    r("RESOURCE_SUSPEND", "approval", "boolean", "durable 路径 opt-in core resourceSuspend(预算/preempt ⇒ 可恢复挂起)", { staticDefault: "false", configKey: "resourceSuspend" }),
+    r("RESOURCE_SUSPEND_MAX_SLICES", "approval", "number", "resume 链片数上限(0=不设;零进展循环兜底)", { staticDefault: "0", configKey: "resourceSuspendMaxSlices" }),
+    r("RESOURCE_SUSPEND_TOTAL_BUDGET_USD", "approval", "number", "跨片 $ 总额(0=不设;坏值拒启 —— 被吃掉的总额=没设)", { staticDefault: "0", danger: BILL, configKey: "resourceSuspendTotalBudgetUsd" }),
+    r("RESOURCE_SUSPEND_TOTAL_TOKENS", "approval", "number", "跨片 token 总额(0=不设;与 MAX_TASK_TOKENS 的 per-slice 窗是两根轴)", { staticDefault: "0", danger: BILL, configKey: "resourceSuspendTotalTokens" }),
+    r("RESOURCE_SUSPEND_TTL_SEC", "approval", "number", "resource/preempt checkpoint 的弃置 GC TTL(秒;0 ⇒ core 默认 30d)", { staticDefault: "0", danger: DATA, configKey: "resourceSuspendTtlSec" }),
+    r("RETENTION_MAX_AGE_DAYS", "auth", "number", "托管留存期声明(core 启动期能力校验;真删除归 sweep lane)", { danger: DATA }),
+    r("RETENTION_MODE", "auth", "enum", "留存 sweep 灰度档(拼错拒启 —— audit-only 谎成 enforce 两个方向都致命)", { enumValues: ["audit-only", "enforce"], staticDefault: "audit-only", danger: DATA }),
+    r("RETENTION_SWEEP_INTERVAL_SEC", "auth", "number", "留存 sweep 节律(秒;0=lane 关)", { staticDefault: "0", danger: DATA }),
+    r("REWIND_SNAPSHOT_MAX_MB", "store", "number", "已退役(S-15 整树快照纪元退役):设了只 boot warn 一次,零行为", { envTiming: "inert" }),
+    r("ROSTER_RETENTION_MS", "orchestration", "number", "agent_roster 行 TTL(ms;SQL twins 扩展面)", { staticDefault: String(30 * 24 * 60 * 60 * 1000), danger: DATA, configKey: "rosterRetentionMs" }),
+    r("ROUTER_ENABLED", "orchestration", "boolean", "A 价值路由(per-task 编排自动决策;ship-dark)", { staticDefault: "false", configKey: "routerEnabled" }),
+    r("RUN_STORE_STRICT_HYDRATE", "store", "enum", "file run-store 列不出 runs/ 时拒启的 fail-closed 门(缺省带病起动+响亮披露)", { enumValues: ["on", "off"], staticDefault: "off", danger: DATA, configKey: "runStoreStrictHydrate" }),
+    r("S3_ENDPOINT", "store", "url", "外接 S3 兼容位(单独在场即开公链签发,兼作公网面)", { danger: DATA }),
+    r("S3_PUBLIC_BUCKET", "store", "string", "SendUserFile 公链桶", { derivedDefaultNote: "缺席 ⇒ sema-public" }),
+    r("S3_PUBLIC_ENDPOINT", "store", "url", "SendUserFile 公网面 endpoint(跨仓契约名,禁改)"),
+    r("SANDBOX_BASE_REF", "orchestration", "string", "bake 缺省 base ref(缺席回落 index 最新 sandbox-base)"),
+    r("SANDBOX_ENV_FACTS", "orchestration", "boolean", "沙箱 envFacts 注入(# Environment 块)", { staticDefault: "true", configKey: "envFactsEnabled" }),
+    r("SANDBOX_PKG_SOURCE", "orchestration", "enum", "沙箱包源选择(cn/global/custom;none=完全不注入)", { enumValues: ["global", "cn", "custom", "none"], staticDefault: "global" }),
+    r("SCHEDULER_ENABLED", "orchestration", "boolean", "自唤醒 scheduler(host 车道单用户形)", { derivedDefaultNote: "posture 三态:缺席 = 单用户 ⇒ on / 多租户 ⇒ off(调度归 center)", configKey: "schedulerEnabled" }),
+    r("SCHEDULER_SESSION_LIFETIME", "orchestration", "boolean", "session-lifetime 记录 host-signal(headless 壳注 false ⇒ CronCreate 前门拒)", { staticDefault: "true", configKey: "schedulerSessionLifetime" }),
+    r("SCHEDULER_SESSION_WAKEUP", "orchestration", "boolean", "session 唤醒 host-signal(无常驻 daemon 的壳注 false)", { staticDefault: "true", configKey: "schedulerSessionWakeup" }),
+    r("SCHEDULER_STORE_PATH", "orchestration", "path", "scheduler 共享店路径(server 写者与壳 daemon 读者必须一致)", { derivedDefaultNote: "缺席 ⇒ SEMA_CONFIG_DIR(~/.sema)/scheduled_tasks.json", configKey: "schedulerStorePath" }),
+    r("SCRATCHPAD_SWEEP_TTL_MS", "limitsHttp", "number", "per-session scratchpad 目录 sweep TTL(ms;≤0=关,<1m 夹到 1m 点名)", { staticDefault: String(7 * 24 * 60 * 60 * 1000), danger: DATA, configKey: "scratchpadSweepTtlMs" }),
+    r("SELECT_ENVIRONMENT_TOOL", "orchestration", "boolean", "SelectEnvironment 工具挂载(另需 k8s+镜像目录活链)", { staticDefault: "true", configKey: "selectEnvironmentTool" }),
+    r("SELF_ORCHESTRATION_ENABLED", "orchestration", "boolean", "run_workflow 自编排(硬化 vm 沙箱)", { derivedDefaultNote: "posture 三态:缺席 = 单用户 ⇒ on / 多租户 ⇒ off", configKey: "selfOrchestrationEnabled" }),
+    r("SELF_ORCHESTRATION_MODELS", "orchestration", "csv", "workflow agent({modelName}) 显式词表(恒赢;缺席单用户=目录键全集/多租户 fail-closed)", { configKey: "selfOrchestrationModels" }),
+    r("SELF_ORCHESTRATION_WORKER_ISOLATION", "orchestration", "boolean", "workflow 脚本跑 worker_thread(堆帽+terminate 的 DoS 隔离)", { staticDefault: "false", danger: SEC, configKey: "selfOrchestrationWorkerIsolation" }),
+    r("SEMA_APT_MIRROR", "orchestration", "url", "SANDBOX_PKG_SOURCE=custom 的显式 apt 源地址(注入沙箱 pkg-source hook)"),
+    r("SEMA_CONFIG_DIR", "integrations", "path", "~/.sema 配置目录覆写(LKG/skill 缓存/scheduler 店同门)", { derivedDefaultNote: "缺席 ⇒ ~/.sema" }),
+    r("SEMA_FAILOPEN_PROBE", "observability", "path", "F 类 fail-open 命中的探针文件路径(在场时逐次追加 fail-open 行;缺席只走计数+一次性 warn)"),
+    r("SEMA_NODE_MIRROR", "orchestration", "url", "SANDBOX_PKG_SOURCE=custom 的显式 node 分发镜像地址"),
+    r("SEMA_NPM_REGISTRY", "orchestration", "url", "SANDBOX_PKG_SOURCE=custom 的显式 npm registry 地址"),
+    r("SEMA_PARENT_PID", "limitsHttp", "number", "引擎 parent 监视(壳 pid;连续两拍 ESRCH 判死走 drain 腿;0/负数语义完全不同 ⇒ 拒启)", { derivedDefaultNote: "缺席 ⇒ 整件不装配", configKey: "parentPid" }),
+    r("SEMA_PIP_INDEX", "orchestration", "url", "SANDBOX_PKG_SOURCE=custom 的显式 pip index 地址"),
+    r("SEMA_REGISTRY_ADMIN_TOKEN", "integrations", "secret", "写 center 的管理凭证(仅 boot 上报执行公钥用;刻意不入 ServiceConfig —— 不进 configHash/日志面)", { danger: SEC, scope: "bootstrap-only" }),
+    r("SEMA_REGISTRY_DRY_RUN", "integrations", "boolean", "center 腿 dry-run(拉而不应用)", { staticDefault: "false" }),
+    r("SEMA_REGISTRY_TOKEN", "integrations", "secret", "center 拉取凭据", { danger: SEC }),
+    r("SEMA_REGISTRY_URL", "integrations", "url", "sema-registry 地址(设了=remote 配置源开关)"),
+    r("SEMA_REGISTRY_WORKER", "integrations", "string", "本 worker 在 center 的名字(per-worker effective)"),
+    r("SEMA_UV_INDEX", "orchestration", "url", "SANDBOX_PKG_SOURCE=custom 的显式 uv index 地址"),
+    r("SEMA_UV_PY_MIRROR", "orchestration", "url", "SANDBOX_PKG_SOURCE=custom 的显式 uv python 分发镜像地址"),
+    r("SEND_USER_FILE_SANDBOX_PUT_ENDPOINT", "store", "url", "沙箱侧 presigned PUT Host 绑定 endpoint(in-cluster 可用内网面)", { derivedDefaultNote: "缺席 ⇒ publicEndpoint" }),
+    r("SEND_USER_FILE_URL_TTL", "store", "number", "公链 TTL(秒;非法值回 0=永久轨,绝不 NaN 进签名)", { staticDefault: "0" }),
+    r("SENSITIVE_WRITE_PATTERNS", "approval", "csv", "敏感路径写 deny 集(unset=core 推荐集;显式值整表替换;off/空=关 —— 真放松杆)", { danger: SEC, derivedDefaultNote: "缺席 ⇒ core RECOMMENDED_SENSITIVE_PATTERNS", configKey: "sensitiveWritePatterns" }),
+    r("SERVICE_AUTH_TOKEN", "auth", "secret", "共享 service token(写面门;缺席且未开 ALLOW_UNAUTHED_WRITES ⇒ 拒提交)", { danger: SEC }),
+    r("SERVICE_AUTH_TOKENS", "auth", "secret", "per-system 凭据表(tok=system CSV;source 从凭据派生,绝不自报)", { danger: SEC }),
+    r("SESSION_AUTO_TITLE", "orchestration", "boolean", "首次提交自动铸 session 标题(一次 cheap 调用)", { staticDefault: "true", danger: BILL, configKey: "sessionAutoTitle" }),
+    r("SESSION_BACKEND", "store", "enum", "session 店引擎(auto=探到 DB 用 DB,探不到回内存)", { enumValues: ["memory", "mysql", "auto"], danger: DATA, derivedDefaultNote: "缺席:显式 DB_BACKEND=mysql|pg ⇒ mysql,否则 memory", configKey: "sessionBackend", resolve: (c) => c.sessionBackend }),
+    r("SESSION_CACHE_TTL_SEC", "store", "number", "session 读缓存 TTL(秒;0=关)", { staticDefault: "300", configKey: "sessionCacheTtlSec" }),
+    r("SESSION_EVENTS_HOT_MS", "limitsHttp", "number", "session SSE 订阅热探针间隔(ms)", { derivedDefaultNote: "缺席 ⇒ 200" }),
+    r("SESSION_EVENTS_MAX_CONNS", "limitsHttp", "number", "session SSE 并发连接帽", { derivedDefaultNote: "缺席 ⇒ 256" }),
+    r("SESSION_EVENTS_MAX_PROBES", "limitsHttp", "number", "session SSE 共享探针数帽", { derivedDefaultNote: "缺席 ⇒ 512" }),
+    r("SESSION_EVENTS_WARM_MS", "limitsHttp", "number", "session SSE 温探针间隔(ms)", { derivedDefaultNote: "缺席 ⇒ 2000" }),
+    r("SESSION_SNAPSHOT_BUCKET", "store", "string", "快照 blob 桶(兼 SendUserFile 私桶)", { derivedDefaultNote: "缺席 ⇒ session-snapshots" }),
+    r("SESSION_SNAPSHOT_PREFIX", "store", "string", "快照 blob key 前缀", { derivedDefaultNote: "缺席 ⇒ blobs/(MinioBlobBackend 默认)" }),
+    r("SESSION_SNAPSHOT_TTL_SEC", "store", "number", "快照 presign TTL(秒;坏值省略走默认,绝不 NaN 签名)", { derivedDefaultNote: "缺席 ⇒ 3600(MinioBlobBackend 默认)" }),
+    r("SIGHUP_IDLE_GRACE_MS", "limitsHttp", "number", "SIGHUP 空闲关停窗(ms;共享引擎形防误杀)", { staticDefault: "120000", configKey: "sighupIdleGraceMs" }),
+    r("SKILLS_DIR", "integrations", "path", "出厂 skill 目录", { derivedDefaultNote: "缺席 ⇒ 包内 skills/(相对模块解析,不是 cwd)", configKey: "skillsDir" }),
+    r("SNAPSHOT_BLOB_ALLOW_SQL_BYTES", "store", "boolean", "云形缺 MinIO 时显式接受 SQL 店放快照字节(严格 'true';安全姿势开关不收宽松真值)", { staticDefault: "false", danger: DATA, configKey: "snapshotBlobAllowSql" }),
+    r("SNAPSHOT_BLOB_SQL_MAX_BYTES", "store", "number", "SQL 店单 blob 帽(字节)", { derivedDefaultNote: "缺席:mysql 引擎 ⇒ 内建默认帽;pg ⇒ 不设", configKey: "snapshotBlobSqlMaxBytes" }),
+    r("SSH_HOST", "orchestration", "string", "ssh 车道目标主机(必需件)"),
+    r("SSH_HOST_FINGERPRINT", "orchestration", "string", "主机密钥指纹校验(坏值拒启;仅 ssh 车道被选中时求值)", { danger: SEC }),
+    r("SSH_KNOWN_HOSTS", "orchestration", "path", "known_hosts 路径(坏路径拒启)", { danger: SEC }),
+    r("SSH_MOUNT_PATH", "orchestration", "path", "ssh 车道工作区路径"),
+    r("SSH_PORT", "orchestration", "number", "ssh 端口", { derivedDefaultNote: "缺席 ⇒ 22" }),
+    r("SSH_PRIVATE_KEY", "orchestration", "secret", "ssh 私钥(adapter 持有,绝不进 workspace)", { danger: SEC }),
+    r("SSH_USER", "orchestration", "string", "ssh 用户(必需件)"),
+    r("STORE_PROBE_INTERVAL_MS", "store", "number", "/health 活体 store 后台探针间隔(ms;0=显式关;仅 SQL 后端挂环)", { staticDefault: "15000", configKey: "storeProbeIntervalMs" }),
+    r("STREAM_APPROVAL_ADHOC_GRACE_MS", "approval", "number", "流内审批 adhoc 腿窗后宽限(ms;须 window+grace < orphanTtl,破坏形拒启)", { staticDefault: "60000" }),
+    r("STREAM_APPROVAL_ADMIT_MAX_PER_OWNER", "approval", "number", "流内审批 per-owner 未决帽", { staticDefault: "256" }),
+    r("STREAM_APPROVAL_ADMIT_MAX_PER_TASK", "approval", "number", "流内审批 per-task 未决帽(超限 unavailable ⇒ park 路由)", { staticDefault: "32" }),
+    r("STREAM_APPROVAL_ENABLED", "approval", "boolean", "流内审批协议总开关(false=整链回 7.3.0 前行为的唯一干净还原键)", { staticDefault: "true", danger: SEC, configKey: "streamApproval" }),
+    r("STREAM_APPROVAL_ORPHAN_TTL_MS", "approval", "number", "遗孤 ask 最终可判上界(ms,量 createdAt)", { staticDefault: String(7 * 24 * 60 * 60 * 1000) }),
+    r("STREAM_APPROVAL_PENDING_GRACE_MS", "approval", "number", "崩溃恢复扫描宽限(ms;活属主常态必胜,reaper 只兜纯崩溃)", { staticDefault: "30000" }),
+    r("STREAM_APPROVAL_RECONCILE_BATCH", "approval", "number", "对账收敛器每 tick 每段行数帽(整数)", { staticDefault: "200" }),
+    r("STREAM_APPROVAL_REPLAY_MAX", "approval", "number", "开流 preamble 重放帽", { staticDefault: "50" }),
+    r("STREAM_ASK_WINDOW_MARGIN_MS", "approval", "number", "审批窗长三元安全余量(ms)", { staticDefault: "10000", configKey: "streamAskWindowMarginMs" }),
+    r("STREAM_ASK_WINDOW_MS", "approval", "number", "流内 ask 窗长(ms)", { staticDefault: "300000" }),
+    r("SYNC_IMPORT_LEASE_STALE_SEC", "memory", "number", "session-sync staged import 租约陈旧阈(秒)", { staticDefault: "600", configKey: "syncImportLeaseStaleSec" }),
+    r("TASK_MAX_OUTPUT_TOKENS_MAX", "limitsHttp", "number", "调用方自报 limits.maxOutputTokens 的运营方封顶(Math.min 钳显式请求值;坏值=封顶不生效+响亮 warn)", { danger: BILL, derivedDefaultNote: "缺席 ⇒ 不封顶" }),
+    r("TASK_MAX_TURNS_MAX", "limitsHttp", "number", "调用方自报 limits.maxTurns 的运营方封顶(同族三旋钮;只钳显式请求值,不是全队默认限额)", { danger: BILL, derivedDefaultNote: "缺席 ⇒ 不封顶" }),
+    r("TASK_TIMEOUT_MAX_SEC", "limitsHttp", "number", "调用方自报 limits.timeoutSec 的运营方封顶(同族三旋钮)", { danger: BILL, derivedDefaultNote: "缺席 ⇒ 不封顶" }),
+    r("TASK_TIMEOUT_SEC", "limitsHttp", "number", "任务墙钟超时(秒;0=关)", { staticDefault: "0" }),
+    r("TOOL_APPROVAL_ENABLED", "approval", "boolean", "活体工具审批 HITL(onAsk 装配;关 ⇒ core resolveAsk 走 headless 缺省)", { danger: SEC, derivedDefaultNote: "posture 三态:显式词恒赢,缺席 = 单用户(REQUIRE_PRINCIPAL≠true)⇒ on / 多租户 ⇒ off", configKey: "toolApprovalEnabled" }),
+    r("TOOL_DEFER_LONGTAIL", "orchestration", "boolean", "长尾一方工具 defer 呈现(实验)", { staticDefault: "false", configKey: "toolDeferLongtail" }),
+    r("TOOL_RESULT_TTL_SEC", "limitsHttp", "number", "工具结果店 TTL(秒)", { staticDefault: "86400", danger: DATA, configKey: "toolResultTtlSec", center: cLimits("toolResultTtlSec") }),
+    r("TOOL_TRACE", "observability", "boolean", "逐工具调用 trace 日志(诊断用)", { staticDefault: "false", configKey: "toolTrace" }),
+    r("TRACE_THINKING", "observability", "boolean", "思考轨迹入 durable 事件日志(敏感部署可关;落盘前脱敏)", { staticDefault: "true", danger: DATA, configKey: "traceThinking" }),
+    r("TRACE_TOKEN", "observability", "secret", "Task Trace API 只读令牌(fleet 拉轨迹,不授任务/配置权)", { danger: SEC }),
+    r("UNATTENDED_APPROVAL_POLICY", "approval", "enum", "无人能答的治理 ask 终局(park=durable 等人;deny=当场拒 —— 自声明无人值守)", { enumValues: ["park", "deny"], staticDefault: "park", danger: SEC, configKey: "unattendedApprovalPolicy" }),
+    r("UNREACHED_ASK_TTL_MS", "approval", "number", "零活流铸造的 ask 悬挂窗(ms;[60s,24h] 拒启带界)", { staticDefault: "3600000" }),
+    r("USAGE_WINDOWS", "orchestration", "opaque", "部署级治理窗(JSON 数组;滑动窗内跨任务 token/$ 预算,key=principal)", { danger: BILL }),
+    r("WEB_SEARCH_API_KEY", "orchestration", "secret", "web search 后端 API 凭据(brave/tavily)", { danger: [...SEC, ...BILL] }),
+    r("WEB_SEARCH_ENDPOINT", "orchestration", "url", "web search 后端 endpoint 覆写(searxng 自建面)"),
+    r("WEB_SEARCH_MAX_RESULTS", "orchestration", "number", "web search 单次结果数上限", { derivedDefaultNote: "缺席/非正 ⇒ backend 默认" }),
+    r("WEB_SEARCH_PROBE_ON_BOOT", "orchestration", "boolean", "boot 期 web search 连通性探测(只认 true/1;含糊值当没开——猜错方向是凭空出网)", { staticDefault: "false" }),
+    r("WEB_SEARCH_PROVIDER", "orchestration", "enum", "web search 工具后端(设合法词=装配 WebSearch;其它/缺席=不装配)", { enumValues: ["brave", "tavily", "searxng"], danger: SEC }),
+    r("WEB_SEARCH_SEARXNG_PARAMS", "orchestration", "string", "searxng 额外查询参数(k=v 对;解析不出任何一对 ⇒ 键不铸)"),
+    r("WEB_SEARCH_TIMEOUT_MS", "orchestration", "number", "web search 单次超时(ms)", { derivedDefaultNote: "缺席/非正 ⇒ backend 默认" }),
+    r("WORKFLOW_AGENTS_READONLY", "orchestration", "boolean", "workflow 子 agent 只读钳(TOB 保守旋钮;默认同权 CC parity)", { staticDefault: "false", danger: SEC, configKey: "workflowAgentsReadOnly" }),
+    r("WORKFLOW_JOURNAL_RETENTION_MS", "orchestration", "number", "workflow_journal GC 保留期(ms)", { staticDefault: String(7 * 24 * 60 * 60 * 1000), danger: DATA, configKey: "workflowJournalRetentionMs" }),
+    r("WORKFLOW_ORPHAN_GRACE_MS", "orchestration", "number", "running workflow 判崩溃孤儿的年龄阈(ms)", { staticDefault: String(24 * 60 * 60 * 1000), configKey: "workflowOrphanGraceMs" }),
+    r("WORKFLOW_RUN_RETENTION_MS", "orchestration", "number", "TERMINAL workflow_run 行保留期(ms;SQL twins)", { staticDefault: String(30 * 24 * 60 * 60 * 1000), danger: DATA, configKey: "workflowRunRetentionMs" }),
+    r("WORKFLOW_RUN_STORE", "orchestration", "enum", "后台 workflow run 店后端(auto=有 SQL 用 SQL,否则 File)", { enumValues: ["auto", "file", "memory"], staticDefault: "auto", configKey: "workflowRunStoreBackend" }),
+    r("WORKFLOW_SIZE_GUIDELINE", "orchestration", "enum", "Workflow 工具卡的规模建议(advisory;typo 拒启)", { enumValues: ["small", "medium", "large", "unrestricted"], configKey: "workflowSizeGuideline" }),
+    r("WORKFLOW_TOTAL_TIMEOUT_MS", "orchestration", "number", "workflow 脚本总时限(ms;0/负不是禁用 —— 无禁用臂)", { staticDefault: "3600000" }),
+    r("WORKSPACE_FILE_MAX_BYTES", "limitsHttp", "number", "已随 workspace 浏览面退役(S-15):值照常校验/落值,应用于空(重启也不生效)", { envTiming: "inert", configKey: "workspaceFileMaxBytes", center: cLimits("workspaceFileMaxBytes", { timing: "inert" }) }),
+    r("WORKSPACE_SNAPSHOT_BUCKET", "orchestration", "string", "k8s 工作区快照桶", { derivedDefaultNote: "缺席 ⇒ workspaces" }),
+    r("WORKSPACE_SNAPSHOT_PREFIX", "orchestration", "string", "k8s 工作区快照 key 前缀"),
+    r("WORKSPACE_SNAPSHOT_TTL_SEC", "orchestration", "number", "k8s 工作区快照 presign TTL(秒)"),
+    r("WORKTREE_ALLOWED_ROOTS", "orchestration", "csv", "worktree 隔离纵深白名单(缺省 = [repoRoot])", { danger: SEC }),
+    r("WORKTREE_BASE_COMMIT", "orchestration", "string", "worktree 基准 ref(缺省 core HEAD)"),
+    r("WORKTREE_ISOLATION_ENABLED", "orchestration", "boolean", "git-worktree 隔离(与 REPO_ROOT 同在才开,半配保持 OFF)", { staticDefault: "false", danger: SEC }),
+    r("WORKTREE_REPO_ROOT", "orchestration", "path", "worktree 隔离的受信 base repo"),
+];
+function primitiveConfigValue(config, key) {
+    const v = Reflect.get(config, key);
+    if (typeof v === "string" || typeof v === "number" || typeof v === "boolean")
+        return v;
+    if (Array.isArray(v) && v.every((x) => typeof x === "string"))
+        return v;
+    return undefined;
+}
+const REDACTED_UNPARSEABLE_URL = "(redacted:unparseable-url)";
+function stripUrlUserinfo(v) {
+    if (!URL.canParse(v))
+        return REDACTED_UNPARSEABLE_URL;
+    const u = new URL(v);
+    u.username = "";
+    u.password = "";
+    if (u.search === "" && u.hash === "" && u.href === v)
+        return v;
+    u.search = "";
+    u.hash = "";
+    return u.href;
+}
+function sanitizeValue(type, v) {
+    if (type === "url") {
+        if (typeof v === "string")
+            return v.includes(",") ? v.split(",").map((s) => stripUrlUserinfo(s.trim())).filter((s) => s.length > 0) : stripUrlUserinfo(v);
+        if (Array.isArray(v))
+            return v.map((s) => stripUrlUserinfo(s));
+        return v;
+    }
+    if (type === "csv" && typeof v === "string")
+        return v.split(",").map((s) => s.trim()).filter((s) => s.length > 0);
+    return v;
+}
+function valueClassOf(type) {
+    if (type === "secret")
+        return "secret";
+    if (type === "opaque")
+        return "opaque";
+    return "plain";
+}
+export function buildConfigCatalog(inputs) {
+    const { config, env, knobs, centerDomains, centerManagedKeys } = inputs;
+    const knobByName = new Map(knobs.map((k) => [k.name, k]));
+    const rows = [...CONFIG_CATALOG]
+        .sort((a, b) => (a.name < b.name ? -1 : 1))
+        .map((spec) => {
+        const raw = env[spec.name];
+        const envHeld = raw !== undefined && raw !== "";
+        const valueClass = valueClassOf(spec.type);
+        const knob = valueClass === "plain" ? knobByName.get(spec.name) : undefined;
+        const seat = spec.center;
+        const domainExists = seat !== undefined && centerDomains.includes(seat.domain);
+        const managedNow = seat !== undefined && (centerManagedKeys?.has(seat.centerKey) ?? false);
+        const centerTiming = seat === undefined ? undefined : seat.timing === "models-plane" ? "hot" : seat.timing;
+        const centerRestartSlice = seat === undefined || seat.timing === "models-plane" ? undefined : seat.restartSlice;
+        const centerEffective = seat !== undefined && managedNow && centerTiming === "hot" && (seat.precedence === "center-wins" || !envHeld);
+        const effectiveLane = centerEffective ? "center" : envHeld ? "env" : "default";
+        let effectiveValue;
+        if (valueClass === "secret") {
+            effectiveValue = { present: envHeld };
+        }
+        else if (valueClass === "opaque") {
+            effectiveValue = envHeld ? { present: true, length: raw.length } : { present: false };
+        }
+        else {
+            const resolved = spec.resolve !== undefined ? spec.resolve(config) : spec.configKey !== undefined ? primitiveConfigValue(config, spec.configKey) : undefined;
+            effectiveValue =
+                resolved !== undefined
+                    ? sanitizeValue(spec.type, resolved)
+                    : knob !== undefined
+                        ? knob.value
+                        : envHeld
+                            ? sanitizeValue(spec.type, raw)
+                            : spec.staticDefault ?? null;
+        }
+        return {
+            name: spec.name,
+            domain: spec.domain,
+            type: spec.type,
+            semantics: spec.semantics,
+            writeLanes: seat !== undefined && domainExists ? ["env", "center"] : ["env"],
+            effectiveLane,
+            envHeld,
+            envTiming: spec.envTiming ?? "deploy",
+            ...(spec.staticDefault !== undefined ? { staticDefault: spec.staticDefault } : {}),
+            ...(spec.derivedDefaultNote !== undefined ? { derivedDefaultNote: spec.derivedDefaultNote } : {}),
+            effectiveValue,
+            valueClass,
+            danger: spec.danger ?? [],
+            ...(seat !== undefined && centerTiming !== undefined
+                ? {
+                    center: {
+                        domain: seat.domain,
+                        path: seat.path,
+                        precedence: seat.precedence,
+                        timing: centerTiming,
+                        ...(centerRestartSlice !== undefined ? { restartSlice: centerRestartSlice } : {}),
+                        ...(seat.restartReason !== undefined ? { restartReason: seat.restartReason } : {}),
+                        domainExists,
+                        managedNow,
+                        effectiveNow: centerEffective,
+                    },
+                    centerDomain: seat.domain,
+                    centerPath: seat.path,
+                }
+                : {}),
+            ...(spec.scope !== undefined ? { scope: spec.scope } : {}),
+            ...(spec.enumValues !== undefined ? { enumValues: spec.enumValues } : {}),
+        };
+    });
+    return {
+        catalogVersion: 1,
+        envLaneTiming: "deploy",
+        restartSlices: CATALOG_RESTART_SLICES,
+        centerDomains,
+        summary: {
+            total: rows.length,
+            envHeld: rows.filter((x) => x.envHeld).length,
+            secret: rows.filter((x) => x.valueClass === "secret").length,
+            centerManaged: rows.filter((x) => x.center?.managedNow === true).length,
+        },
+        rows,
+    };
+}
+//# sourceMappingURL=config-catalog.js.map