@sema-agent/server 7.52.1 → 7.54.0

package/dist/config-center/apply-effective.d.ts

@@ -10,7 +10,7 @@ import type { EffectiveConfig } from "./types.js";
  *  reference captured at boot, so mutating it (vs reassigning) updates both with no split, no Runner rebuild. */
 export declare function mutateInPlace<V>(target: Record<string, V>, source: Record<string, V>): void;
 /**
- * #233 / A-002.8 —— 无法解读的名单条目的**代表元**。
+ * [ref] / [ref] —— 无法解读的名单条目的**代表元**。
  *
  * 为什么需要它(codex 复审 R1 真 finding):把坏条目**丢掉**会让 `[7, null]` 这种「在场但一条都读不
  * 懂」的名单塌成**空数组**,而空数组在消费端的语义恰恰是「治理关闭 = 全放行」—— 一个表达"我要限制"
@@ -23,14 +23,14 @@ export declare function mutateInPlace<V>(target: Record<string, V>, source: Reco
  * 🔴 只活在内存判定面:不进 wire(`/v1/models` 只发布尔)、不进日志(warn 打的是原始坏值的类型标记)。
  */
 export declare const UNPARSABLE_AT_MODEL_ALLOWLIST_ENTRY = "\0<unparsable-at-model-allowlist-entry>";
-/** 返回值=是否 COMMIT(false 两臂:[2283]③ 世代序 CAS 拒绝 / 5.49 swapPlane 换装拒绝——两臂都在
+/** 返回值=是否 COMMIT(false 两臂:[ref]③ 世代序 CAS 拒绝 / 5.49 swapPlane 换装拒绝——两臂都在
  *  commit 之前,活配置零触碰)。caller 收到 false 必须把**同一世代的旁路消费**(prompts 采用/pricing/
  *  keyResolver/etag 推进/LKG 落盘)一并跳过——否则 applyEffective 拒了主面、旁路却半应用同一个被拒
  *  世代,混合世代从侧门回来。首次 apply(live 未登记)恒 true。 */
-/** #322:一次 apply 的**世代账载荷**(post-commit 发,[2283]② —— commit 段仍是零回调零发射)。 */
+/** [ref]:一次 apply 的**世代账载荷**(post-commit 发,[ref]② —— commit 段仍是零回调零发射)。 */
 export interface ApplyReport {
     readonly version: number;
-    /** #325:本候选的收货序数(= opts.generation 原样带回;世代账按它记拒收,身份标仍是 version)。 */
+    /** [ref]:本候选的收货序数(= opts.generation 原样带回;世代账按它记拒收,身份标仍是 version)。 */
     readonly ordinal?: number;
     readonly limits: {
         /** 本世代真正换了值的键。 */
@@ -63,14 +63,12 @@ export declare function applyEffective(config: ServiceConfig, eff: EffectiveConf
     }) => void;
 }): boolean;
 /**
- * Apply the center `runtime` governance/limit gates OVER the env-derived config (mutates `config`).
- *
- * UNIFORM presence semantics across all 6 gates (center `f95438a` adopted this from our sentinel flag —
- * SERVICE-INTEGRATION「Runtime 治理/限额闸」): all six fields are center `.optional()`, so
+ * UNIFORM presence semantics across the center gates (center `f95438a` adopted this from our sentinel flag —
+ * SERVICE-INTEGRATION「Runtime 治理/限额闸」): every gate field is center `.optional()`, so
  *   `undefined` = center isn't managing it → KEEP env;
  *   present (any value, INCLUDING an explicit 0 / [] = "publish the gate OFF") → OVERRIDE env.
  * (Earlier center had `rateLimitPerMin`/`approvalRequire` as `.default(0/[])`, which would have let a default
- *  silently disable an env-set gate — we flagged it, center made all six optional, so a plain presence rule is
+ *  silently disable an env-set gate — we flagged it, center made them optional, so a plain presence rule is
  *  now both correct and uniform. No sentinel special-casing.)
  *
  * Only guard: `costQuotaWindowSec` must be `> 0` (a 0 window is nonsensical — core divides by it). Center's
@@ -79,29 +77,46 @@ export declare function applyEffective(config: ServiceConfig, eff: EffectiveConf
  * Per-worker overrides ride the per-worker `/effective?worker=` response (center merges WorkerSpec.runtime over
  * the fleet default server-side), so this single "effective beats env" rule already honors per-worker > fleet.
  */
-/** The 6 runtime governance/limit gates, in ONE place (council DRY): the consume loop, the restart-to-apply
- *  signal, and the dry-run diff all derive from this list, so adding a 7th gate is a single edit and can't
- *  silently miss `runtimeHasActiveGate` (which would break the restart-to-apply warning). All six share keys
- *  across `EffectiveConfig["runtime"]` and `ServiceConfig`. Exported (not in the original single-file form) so
- *  the sibling restart-signal module can share the identical key list + presence rule. */
-export declare const RUNTIME_GATE_KEYS: readonly ["rateLimitPerMin", "approvalRequire", "maxTaskCostUsd", "maxTaskTokens", "maxPrincipalCostUsd", "costQuotaWindowSec"];
+/** `runtime` 域的限额五闸(= settings-schema `RuntimeConfig` 的全部键,[ref] 件3 对账门钉集合等式),ONE place:
+ *  legacy 位的 presence 判据({@link runtimeGatePresent} → stage-limits 的 `legacyGates`)、config-catalog 的
+ *  center 在管键、dry-run 现值快照都从这一张表派生。[ref] 批1 起五键**全热**(属主 stage-limits,boot+refresh
+ *  双腿),所以本表与 restart-to-apply 再无关系——审批闸不在这里:它住 governance 域({@link BOOT_GATE_KEYS})。 */
+export declare const RUNTIME_GATE_KEYS: readonly ["rateLimitPerMin", "maxTaskCostUsd", "maxTaskTokens", "maxPrincipalCostUsd", "costQuotaWindowSec"];
 export type RuntimeGateKey = (typeof RUNTIME_GATE_KEYS)[number];
+/** boot-only(restart-to-apply)的治理闸:今天只有 `governance.approvalRequire` 一键——它被 main.ts 在本函数之后
+ *  用 `config` 构造进 approval gate,refresh 腿(teamsOnly)不写,变更由 restart-signal 的 `runtime-gates` 片通告。
+ *  ([ref] 批2 若把它转热,这张表清空、那个片随之退役——一处改动。) */
+export declare const BOOT_GATE_KEYS: readonly ["approvalRequire"];
+export type BootGateKey = (typeof BOOT_GATE_KEYS)[number];
+/** Uniform presence rule (center f95438a) for the `runtime` limit gates: "managed" when the field is present —
+ *  any number (incl. 0). Sole guard: costQuotaWindowSec must be > 0 (a 0 window is nonsensical — core divides by
+ *  it; center's `.positive()` already enforces, belt-and-suspenders here). The approval gate's presence rule
+ *  (`Array.isArray`) lives with its owner, {@link stageApprovalGate}. */
 /**
- * #322 批1:六闸里**已转热**的五个(限额族)——它们的属主是 `stage-limits.ts`(boot+refresh 双腿),
- * 所以 boot-only 的闸车道不再写它们,`runtime-gates` 重启片也不再为它们铸重启理由(键是热的却还要求重启
- * = 白白滚动重启整片 fleet)。剩下的 `approvalRequire` 仍是 restart-to-apply,归批2。
+ * DESIGN-278 §5 S2([ref])—— center 这份 effective **当前在管**哪些 `ServiceConfig` 键(配置目录端点
+ * `GET /v1/config/catalog` 判 `effectiveLane` 的 center 半场)。
+ *
+ * 判据与各消费腿**同源**,不自铸第二份:
+ *  · limits 域 = `hasOwnProperty`(stage-limits 的 published 判据逐字——present 含显式 0);
+ *  · 六闸 legacy 位 = {@link runtimeGatePresent}(旧位 presence 规则的唯一属主);
+ *  · governance/runtime 热二件 + approvalRequire = 键在场(applyRuntimeHot 的 non-sticky 判据同门);
+ *  · readFace 域成员 = 键在场(read-face.ts 的逐键 env-wins 合成看的就是成员在场性);
+ *  · models 面 = 有启用行(markRosterLanded 同判据);atModelAllowlist 单列(整表重算键)。
+ * 纯投影零副作用;`undefined` eff(还没拉到 / 纯 env 形)⇒ 空集。
  */
-export declare const HOT_RUNTIME_GATE_KEYS: ReadonlySet<string>;
-/** Uniform presence rule (center f95438a): a gate is "managed" when the field is present — any number (incl. 0),
- *  or an array for approvalRequire. Sole guard: costQuotaWindowSec must be > 0 (a 0 window is nonsensical — core
- *  divides by it; center's `.positive()` already enforces, belt-and-suspenders here). */
+export declare function centerManagedConfigKeys(eff: EffectiveConfig | undefined): ReadonlySet<string>;
 export declare function runtimeGatePresent(rt: NonNullable<EffectiveConfig["runtime"]>, key: RuntimeGateKey): boolean;
-export declare function applyRuntimeGates(config: ServiceConfig, rt: EffectiveConfig["runtime"], logger?: Logger): void;
-export declare function applyRuntimeHot(config: ServiceConfig, rt: EffectiveConfig["runtime"], logger?: Logger): void;
+/** 独立调用面的兼容壳(测试/外部):stage → 就地赋值 → 通知。applyEffective 不走这里——它把
+ *  assignments 并进自己的 commit 段以保住整世代原子性([ref]②)。入参是 eff 的两个域([ref] 件3:审批闸
+ *  住 governance,限额五闸住 runtime——两位各自的属主判据,这里不再合成视图)。
+ *  [ref]:限额五闸的属主已移交热腿,所以本壳**同样**要过 stage-limits —— 否则一个仍叫 applyRuntimeGates
+ *  的函数会静默漏掉五个限额键(比改名更坏的那种沉默)。 */
+export declare function applyRuntimeGates(config: ServiceConfig, eff: Pick<EffectiveConfig, "runtime" | "governance"> | undefined, logger?: Logger): void;
+export declare function applyRuntimeHot(config: ServiceConfig, gov: EffectiveConfig["governance"], logger?: Logger): void;
 /**
- * [865]① 显式默认解析——applyEffective 与 dry-run(logEffectiveDiff.wouldDefaultModel)共用的单源。优先级
+ * [ref]① 显式默认解析——applyEffective 与 dry-run(logEffectiveDiff.wouldDefaultModel)共用的单源。优先级
  * (显式源指向不在目录/未启用的名 ⇒ onDangling 回调后落下一级,绝不静默指错模型):
- *   1) eff.models.default 结构键 —— ✅ 既得路径([874] registry-core 0.10.11 落 `default?: string` schema
+ *   1) eff.models.default 结构键 —— ✅ 既得路径([ref] registry-core 0.10.11 落 `default?: string` schema
  *      键+per-worker /effective 直通;本地 lane 由 config-provider mapToServiceEffective 直通)。写面悬空 ref
  *      由 registry-core superRefine fail-loud;存量/未经 schema 路径仍走本函数的 warn 降级(双层姿势与
  *      activeTierGroup 同构)。(1.200-1.202 期间此级恒空=当时如实的前行 seam,codex H2 注记已兑现。)
@@ -116,10 +131,7 @@ export declare function resolveDefaultModelName(eff: EffectiveConfig, has: (name
 /**
  * Read-only comparison (SEMA_REGISTRY_DRY_RUN): log what the center config WOULD change vs the current
  * (env-derived) config, WITHOUT applying it. The safe-rollout step the config-center recommends — verify
- * the center's models/roles/teams match (or intentionally differ from) the env baseline before going live.
+ * the center's models/roles/collab match (or intentionally differ from) the env baseline before going live.
  */
 export declare function logEffectiveDiff(config: ServiceConfig, eff: EffectiveConfig, logger?: Logger): void;
-/** True if the center `runtime` carries any managed gate (a PRESENT field) — i.e. a refresh that changed it
- *  needs a restart to take effect (restart-to-apply). Same key list + presence rule as applyRuntimeGates. */
-export declare function runtimeHasActiveGate(rt: EffectiveConfig["runtime"]): boolean;
 //# sourceMappingURL=apply-effective.d.ts.map

package/dist/config-center/apply-effective.js

@@ -4,7 +4,6 @@ import { sealedKeyPoison } from "../sealed-key.js";
 import { applyAutoCompactWindow, findUnmatchableToolNames, formatUnmatchableToolNames, parseAutonomy } from "../config.js";
 import { validateCommandRules } from "../runtime-governance.js";
 import { projectCollabToWorkflows, registerCollabWorkflows } from "../capabilities/collab-workflows.js";
-import { registerTeams } from "../capabilities/team.js";
 import { stageLimits } from "./stage-limits.js";
 import { BATCH1_LIMIT_KEYS } from "./hot-keys-registry.js";
 const asModelThinking = (v) => (v && isThinkingLevel(v) && v !== "off" ? v : undefined);
@@ -124,7 +123,7 @@ export function applyEffective(config, eff, logger, opts = {}) {
         logger?.info("sema_registry_runtime", staged.gatesInfo);
     if (Object.keys(staged.hot.infoLine).length > 0)
         logger?.info("sema_registry_runtime_hot", staged.hot.infoLine);
-    for (const n of staged.teamsPlane?.notices ?? []) {
+    for (const n of staged.collabPlane?.notices ?? []) {
         if (n.level === "warn")
             logger?.warn(n.msg, n.fields);
         else
@@ -158,11 +157,8 @@ function commitStaged(config, staged) {
         config.autonomy = staged.hot.autonomyNext;
     if (staged.hot.setCommandPolicy)
         config.commandPolicy = staged.hot.commandPolicyNext;
-    const tp = staged.teamsPlane;
-    if (tp) {
-        registerTeams(tp.teams);
-        registerCollabWorkflows(tp.workflows);
-    }
+    if (staged.collabPlane)
+        registerCollabWorkflows(staged.collabPlane.workflows);
     mutateInPlace(config.projects, staged.projects);
 }
 function stageEffective(config, eff, logger, opts) {
@@ -267,32 +263,20 @@ function stageEffective(config, eff, logger, opts) {
             infoLine: { count: enabled.length, default: models.default.id, defaultSource: picked.source, roles: Object.keys(roles), tiers: Object.keys(activeTiers), atModelAllowlist: atModelAllowlist.length, sealedKeys: Object.values(modelApiKeys).filter((v) => typeof v === "string").length, sealedPoisoned: Object.values(modelApiKeys).filter((v) => typeof v !== "string").length },
         };
     }
-    const gatesView = eff.governance ? { ...eff.runtime, ...eff.governance } : eff.runtime;
-    const gates = opts.teamsOnly ? undefined : stageRuntimeGates(gatesView, logger);
+    const gates = opts.teamsOnly ? undefined : stageApprovalGate(eff.governance, logger);
     const limits = stageLimits(config, { version: typeof eff.version === "number" ? eff.version : 0, ...("limits" in eff ? { limits: eff.limits } : {}), legacyGates: legacyGateValues(eff.runtime) }, logger);
-    const hot = stageRuntimeHot(config, gatesView, logger);
-    let teamsPlane;
+    const hot = stageRuntimeHot(config, eff.governance, logger);
+    let collabPlane;
     if (opts.deferModelPlane !== true) {
-        const teams = {};
-        for (const t of (eff.teams?.teams ?? []).filter((t) => t.enabled !== false)) {
-            teams[t.name] = {
-                name: t.name,
-                members: t.members.map((mm) => ({ role: mm.role, ...(mm.model ? { model: mm.model } : {}), modelRole: mm.modelRole, systemPrompt: mm.systemPrompt })),
-                rounds: t.rounds,
-                synthesizer: t.synthesizer ? { role: t.synthesizer.role, modelRole: t.synthesizer.modelRole, systemPrompt: t.synthesizer.systemPrompt } : undefined,
-            };
-        }
         const projected = projectCollabToWorkflows(eff.collab?.templates);
         const notices = [];
-        if (Object.keys(teams).length > 0)
-            notices.push({ level: "info", msg: "sema_registry_teams", fields: { teams: Object.keys(teams) } });
         if (Object.keys(projected.workflows).length > 0)
             notices.push({ level: "info", msg: "sema_registry_collab_workflows", fields: { workflows: Object.keys(projected.workflows) } });
         if (projected.skipped.length > 0)
             notices.push({ level: "warn", msg: "sema_registry_collab_skipped", fields: { skipped: projected.skipped } });
         if (projected.notes.length > 0)
             notices.push({ level: "info", msg: "sema_registry_collab_notes", fields: { notes: projected.notes } });
-        teamsPlane = { teams, workflows: projected.workflows, notices };
+        collabPlane = { workflows: projected.workflows, notices };
     }
     const projDomain = eff.projects;
     const rawProjects = (projDomain && typeof projDomain === "object" && !Array.isArray(projDomain) &&
@@ -316,16 +300,55 @@ function stageEffective(config, eff, logger, opts) {
         ...(gates !== undefined ? { gateAssignments: gates.assignments, ...(gates.info !== undefined ? { gatesInfo: gates.info } : {}) } : {}),
         limits,
         hot,
-        ...(teamsPlane !== undefined ? { teamsPlane } : {}),
+        ...(collabPlane !== undefined ? { collabPlane } : {}),
         projects,
     };
 }
-export const RUNTIME_GATE_KEYS = ["rateLimitPerMin", "approvalRequire", "maxTaskCostUsd", "maxTaskTokens", "maxPrincipalCostUsd", "costQuotaWindowSec"];
-export const HOT_RUNTIME_GATE_KEYS = new Set(BATCH1_LIMIT_KEYS);
+export const RUNTIME_GATE_KEYS = ["rateLimitPerMin", "maxTaskCostUsd", "maxTaskTokens", "maxPrincipalCostUsd", "costQuotaWindowSec"];
+export const BOOT_GATE_KEYS = ["approvalRequire"];
+export function centerManagedConfigKeys(eff) {
+    const out = new Set();
+    if (!eff)
+        return out;
+    const limits = eff.limits;
+    if (limits) {
+        for (const k of BATCH1_LIMIT_KEYS)
+            if (Object.prototype.hasOwnProperty.call(limits, k))
+                out.add(k);
+    }
+    const rt = eff.runtime;
+    if (rt) {
+        for (const k of RUNTIME_GATE_KEYS)
+            if (runtimeGatePresent(rt, k))
+                out.add(k);
+    }
+    if (eff.governance) {
+        if (eff.governance.autonomy !== undefined)
+            out.add("autonomy");
+        if (eff.governance.commandPolicy !== undefined)
+            out.add("commandPolicy");
+        if (eff.governance.approvalRequire !== undefined)
+            out.add("approvalRequire");
+    }
+    const rf = eff.readFace;
+    if (rf !== undefined && rf !== null && typeof rf === "object") {
+        if (rf.face !== undefined)
+            out.add("readFace");
+        if (rf.denyPatterns !== undefined)
+            out.add("readDenyPatterns");
+        if (rf.denyBuiltinTiers !== undefined)
+            out.add("readDenyBuiltinTiers");
+        if (rf.denyBuiltinExclude !== undefined)
+            out.add("readDenyBuiltinExclude");
+    }
+    if ((eff.models?.models ?? []).some((m) => m.enabled !== false))
+        out.add("models");
+    if (eff.models?.atModelAllowlist !== undefined)
+        out.add("atModelAllowlist");
+    return out;
+}
 export function runtimeGatePresent(rt, key) {
     const v = rt[key];
-    if (key === "approvalRequire")
-        return Array.isArray(v);
     if (key === "costQuotaWindowSec")
         return typeof v === "number" && v > 0;
     return typeof v === "number";
@@ -356,43 +379,29 @@ function stageApprovalRequire(raw, logger) {
     }
     return { value: names };
 }
-function stageRuntimeGates(rt, logger) {
-    if (!rt)
+function stageApprovalGate(gov, logger) {
+    const raw = gov?.approvalRequire;
+    if (!Array.isArray(raw))
         return { assignments: [] };
-    const assignments = [];
-    const applied = {};
-    for (const key of RUNTIME_GATE_KEYS) {
-        if (HOT_RUNTIME_GATE_KEYS.has(key))
-            continue;
-        if (!runtimeGatePresent(rt, key))
-            continue;
-        if (key === "approvalRequire") {
-            const staged = stageApprovalRequire(rt[key], logger);
-            if (staged.value === undefined)
-                continue;
-            assignments.push([key, staged.value]);
-            applied[key] = staged.value;
-            continue;
-        }
-        assignments.push([key, rt[key]]);
-        applied[key] = rt[key];
-    }
-    return { assignments, ...(Object.keys(applied).length > 0 ? { info: applied } : {}) };
+    const staged = stageApprovalRequire(raw, logger);
+    if (staged.value === undefined)
+        return { assignments: [] };
+    return { assignments: [["approvalRequire", staged.value]], info: { approvalRequire: staged.value } };
 }
 function legacyGateValues(rt) {
     const out = {};
     if (!rt)
         return out;
     for (const k of RUNTIME_GATE_KEYS)
-        if (HOT_RUNTIME_GATE_KEYS.has(k) && runtimeGatePresent(rt, k))
+        if (runtimeGatePresent(rt, k))
             out[k] = rt[k];
     return out;
 }
-export function applyRuntimeGates(config, rt, logger) {
-    const s = stageRuntimeGates(rt, logger);
+export function applyRuntimeGates(config, eff, logger) {
+    const s = stageApprovalGate(eff?.governance, logger);
     for (const [k, v] of s.assignments)
         config[k] = v;
-    const limits = stageLimits(config, { version: 0, legacyGates: legacyGateValues(rt) }, logger);
+    const limits = stageLimits(config, { version: 0, legacyGates: legacyGateValues(eff?.runtime) }, logger);
     for (const [k, v] of limits.assignments)
         config[k] = v;
     for (const k of limits.deletions)
@@ -428,8 +437,8 @@ function stageRuntimeHot(config, rt, logger) {
     }
     return { setAutonomy, autonomyNext, setCommandPolicy, commandPolicyNext, infoLine };
 }
-export function applyRuntimeHot(config, rt, logger) {
-    const s = stageRuntimeHot(config, rt, logger);
+export function applyRuntimeHot(config, gov, logger) {
+    const s = stageRuntimeHot(config, gov, logger);
     if (s.setAutonomy)
         config.autonomy = s.autonomyNext;
     if (s.setCommandPolicy)
@@ -461,7 +470,6 @@ export function logEffectiveDiff(config, eff, logger) {
     const centerModels = enabled.map((m) => ({ name: m.name, id: m.id, provider: m.provider, apiKeyEnv: m.apiKeyEnv ?? null, tier: m.tier ?? null }));
     const envModels = Object.entries(config.models).map(([name, m]) => ({ name, id: m.id, provider: m.provider }));
     const centerRoles = Object.fromEntries(Object.entries(eff.models?.roles ?? {}).map(([r, t]) => [r, "model" in t ? t.model : { select: t.select }]));
-    const centerTeams = (eff.teams?.teams ?? []).filter((t) => t.enabled !== false).map((t) => t.name);
     logger?.warn("sema_registry_dry_run", {
         note: "DRY RUN — registry config NOT applied; unset SEMA_REGISTRY_DRY_RUN to go live",
         version: eff.version,
@@ -470,18 +478,17 @@ export function logEffectiveDiff(config, eff, logger) {
         currentDefaultModel: config.model.id,
         models: { center: centerModels, envDerived: envModels },
         roles: { center: centerRoles, current: config.roles },
-        teams: { centerWouldRegister: centerTeams },
+        collab: { centerWouldRegister: Object.keys(projectCollabToWorkflows(eff.collab?.templates).workflows) },
         skills: { centerWouldLoad: (eff.skills?.skills ?? []).filter((s) => s.enabled !== false).map((s) => s.name) },
         mcp: { centerWouldRegister: (eff.mcp?.servers ?? []).filter((s) => s.enabled !== false).map((s) => s.name) },
         runtime: {
             center: eff.runtime ?? null,
             current: Object.fromEntries(RUNTIME_GATE_KEYS.map((k) => [k, config[k]])),
         },
+        governance: {
+            center: eff.governance ?? null,
+            current: { autonomy: config.autonomy, commandPolicy: config.commandPolicy?.length ?? 0, approvalRequire: config.approvalRequire },
+        },
     });
 }
-export function runtimeHasActiveGate(rt) {
-    if (!rt)
-        return false;
-    return RUNTIME_GATE_KEYS.some((k) => runtimeGatePresent(rt, k));
-}
 //# sourceMappingURL=apply-effective.js.map

package/dist/config-center/apply-ledger.d.ts

@@ -1,11 +1,11 @@
 /**
- * #322 —— **世代账**(design/322 §2 世代账,codex 设计审 F4)。
+ * [ref] —— **世代账**([ref] §2 世代账,codex 设计审 F4)。
  *
  * 身份标 = 上游 `EffectiveConfig.version`,**刻意不造跨进程 epoch**(codex F4 语义不变):
  *  · 同版本幂等重放(etag 未推进的下一拍)不该伪增世代;
  *  · 双副本对账「是不是同一代」必须能跨进程判 —— 同 source version = 同一代。
  *
- * 🔴 #325(test [4809],[4810] 阻断裁定):**序轴与身份标分离**。source version 在
+ * 🔴 [ref](test [ref],[ref] 阻断裁定):**序轴与身份标分离**。source version 在
  * `CONFIG_PROVIDER=local` 下是 registry-core file-store 的内容哈希(u53,上游契约只承诺
  * 「同 files ⇒ 同 number」,从未承诺序)——把它当序数消费,哈希更小的合法新代会被永久
  * 静默忽略且本账双盲(target/applied 都不动)。修后:**推进判断吃收货处铸的进程内单调
@@ -13,7 +13,7 @@
  * `version` 只做对账身份标——configTargetVersion 语义从「max(见过)」变为「**最后**见过的
  * 源代」(remote 单调腿二者等价;local 腿这才是真相)。
  *
- * 读面两个:`/health` 的三键(target / applied / 失败持续时长;#325 起 additive 补
+ * 读面两个:`/health` 的三键(target / applied / 失败持续时长;[ref] 起 additive 补
  * targetOrdinal/appliedOrdinal 两键=推进/停滞的机器判据)给编排器判「这个副本要不要摘」;
  * 诊断端点的 `configApply` 段给运维看**按组**的细节(哪一组停在哪一代、上一次为什么被拒)。
  *
@@ -42,9 +42,9 @@ export interface ConfigApplyLedgerView {
     readonly configTargetVersion: number;
     /** 最后一次成功 commit 的源版本(身份标)。 */
     readonly configAppliedVersion: number;
-    /** #325:target 的收货序数(进程内单调)——「见过多少代」的推进判据,哈希方向免疫。 */
+    /** [ref]:target 的收货序数(进程内单调)——「见过多少代」的推进判据,哈希方向免疫。 */
     readonly configTargetOrdinal: number;
-    /** #325:applied 的收货序数。targetOrdinal 推进而这里停滞 = 「改了没生效」的机器判据。 */
+    /** [ref]:applied 的收货序数。targetOrdinal 推进而这里停滞 = 「改了没生效」的机器判据。 */
     readonly configAppliedOrdinal: number;
     /** target≠applied 的**持续**时长(ms);收敛时键缺席(健康面不制造噪音)。 */
     readonly configApplyStaleMs?: number;
@@ -53,7 +53,7 @@ export interface ConfigApplyLedgerView {
 /** applyEffective 的 post-commit 报告(见 apply-effective.ts `ApplyReport`)。 */
 export interface ConfigApplyReport {
     readonly version: number;
-    /** #325:本候选的收货序数(applyEffective opts.generation 原样带回;缺席=version 兼容臂)。 */
+    /** [ref]:本候选的收货序数(applyEffective opts.generation 原样带回;缺席=version 兼容臂)。 */
     readonly ordinal?: number;
     readonly limits: {
         readonly applied: readonly string[];

package/dist/config-center/effective-keys.d.ts

@@ -0,0 +1,30 @@
+/**
+ * [ref] 件5 —— server 的 settings-schema 消费键账本(对账门 test/settings-schema-consumption-gates.test.ts 的本仓侧输入)。
+ *
+ * 🔴 三条纪律:
+ *  1. `EFFECTIVE_CONFIG_KEYS` 与 {@link EffectiveConfig} **类型级**绑定(`satisfies Record<keyof …, true>`):接口加键 /
+ *     删键而不动这里 = **编译错**——运行时键表永不与类型面漂移(这不是第二份表,是同一份接口的运行时投影;
+ *     runtime / governance 两域的键表同法,用于与 schema zod shape 的集合等式墓碑)。
+ *  2. 三张登记表(非域白名单 / 不消费表 / 远端专属表)每行**必须带理由**;行的成立性由对账门**双向**钉——登记了
+ *     却不成立(死账)与成立了却没登记(半接线)都红,理由失效之日格子自己翻红(墓碑),禁裸豁免。
+ *  3. schema 侧的数据(`DOMAINS` / `PORTABLE_DOMAINS` / zod shape)一律由对账门**读 dist**,绝不抄进这里
+ *     (平行副本病是 DESIGN-282 §0 的病理定性,本文件只登记 server 自己那一侧)。
+ */
+import type { EffectiveConfig } from "./types.js";
+/** EffectiveConfig 的全部顶层键(信封 + 域 + 非域白名单键),类型级绑定见上。 */
+export declare const EFFECTIVE_CONFIG_KEYS: ReadonlyArray<keyof EffectiveConfig>;
+/** 信封键(不是域)。 */
+export declare const EFFECTIVE_ENVELOPE_KEYS: readonly ["version", "updatedAt"];
+/** `runtime` 域(限额残余)的键集——对账门与 schema `RuntimeConfig.shape` 钉集合等式([ref] 件3 退役键墓碑)。 */
+export declare const RUNTIME_DOMAIN_KEYS: readonly string[];
+/** `governance` 域(治理三件)的键集——对账门与 schema `GovernanceConfig.shape` 钉集合等式。 */
+export declare const GOVERNANCE_DOMAIN_KEYS: readonly string[];
+/** EffectiveConfig 上**不是** settings-schema 域的顶层键(键 → 成文理由)。⚠️ 墓碑语义:任一键将来出现在 schema
+ *  `DOMAINS` 里 ⇒ 对账门红 ⇒ 清本行 + 接本地腿投影(mapToServiceEffective)+ 复核 restart 片归属。 */
+export declare const NON_DOMAIN_EFFECTIVE_KEYS: Readonly<Record<string, string>>;
+/** schema `DOMAINS` 里 server **不消费**的域(域 → 成文理由)。⚠️ 新域(如 presets)到货而不入本表也不入
+ *  EffectiveConfig ⇒ 对账门红 ⇒ 逼一行显式决定(「加了域没人接」从此机器可见,[ref]③)。 */
+export declare const DOMAINS_NOT_CONSUMED_BY_SERVER: Readonly<Record<string, string>>;
+/** server 消费但**非便携**(∉ PORTABLE_DOMAINS ⇒ 本地腿无 config.d/<域>.json 可读)的域(域 → 成文理由)。 */
+export declare const LOCAL_LANE_REMOTE_ONLY_DOMAINS: Readonly<Record<string, string>>;
+//# sourceMappingURL=effective-keys.d.ts.map

package/dist/config-center/effective-keys.js

@@ -0,0 +1,49 @@
+const EFFECTIVE_CONFIG_KEY_TABLE = {
+    version: true,
+    updatedAt: true,
+    models: true,
+    collab: true,
+    skills: true,
+    mcp: true,
+    a2a: true,
+    scenarios: true,
+    runtime: true,
+    limits: true,
+    projects: true,
+    governance: true,
+    plugins: true,
+    readFace: true,
+    prompts: true,
+};
+export const EFFECTIVE_CONFIG_KEYS = Object.keys(EFFECTIVE_CONFIG_KEY_TABLE);
+export const EFFECTIVE_ENVELOPE_KEYS = ["version", "updatedAt"];
+const RUNTIME_DOMAIN_KEY_TABLE = {
+    rateLimitPerMin: true,
+    maxTaskCostUsd: true,
+    maxTaskTokens: true,
+    maxPrincipalCostUsd: true,
+    costQuotaWindowSec: true,
+};
+export const RUNTIME_DOMAIN_KEYS = Object.keys(RUNTIME_DOMAIN_KEY_TABLE);
+const GOVERNANCE_DOMAIN_KEY_TABLE = {
+    autonomy: true,
+    commandPolicy: true,
+    approvalRequire: true,
+};
+export const GOVERNANCE_DOMAIN_KEYS = Object.keys(GOVERNANCE_DOMAIN_KEY_TABLE);
+export const NON_DOMAIN_EFFECTIVE_KEYS = {
+    a2a: "R-15 裁开域([4384]),但 settings-schema 至 1.3.0 未开(DOMAINS 无 a2a)——S-31 件2 BLOCKED on schema:远端腿靠 readEffectiveWire 的 open-world verbatim 透传(DESIGN-269),本地腿不可达(FileConfigStore 只读 PORTABLE_DOMAINS)。schema 开域之日按墓碑流程收线。",
+    readFace: "R-15 裁**暂不开域**([4384]:env 逐键恒赢语义下收益薄,⚪ 呈现制过渡)——#A4 的远端腿同靠 open-world 透传;本地腿四键由 env / 引擎默认独占。若来日改裁开域,同上墓碑机制。",
+};
+export const DOMAINS_NOT_CONSUMED_BY_SERVER = {
+    rosters: "center 写面域:center 端 resolveEffectiveForWorker 把 roster 解析进 per-worker /effective 的 models 视图——server 消费的是解析产物,不读原始域。",
+    systems: "控制面登记簿(系统台账),orchestrator / web 消费;worker /effective 视图不含。",
+    workers: "fleet 声明域,orchestrator(reconciler)消费拆建 worker;worker 自身不读。",
+    hosts: "主机登记域,orchestrator / 探活面消费;worker /effective 视图不含。",
+    entitlement: "租户商务数据:裁定为 per-principal caps view 单源(fetchPrincipalCaps),raw 域刻意不上 worker wire(center resolve-roster strips)。",
+    execution: "per-principal 执法面同 entitlement:ruling 骑 caps view(ExecutionRuling),/effective 域面 server 不读。",
+};
+export const LOCAL_LANE_REMOTE_ONLY_DOMAINS = {
+    projects: "身份台账(design/142 §1.4,与租户身份同风险模型):settings-schema 便携表刻意排除(file-store.ts 成文)——本地腿无此域文件,mapToServiceEffective 不投影;远端腿 verbatim 消费(applyEffective → config.projects)。",
+};
+//# sourceMappingURL=effective-keys.js.map

package/dist/config-center/facade.d.ts

@@ -4,11 +4,12 @@
  * "universal internal schema → translate at the boundary" pattern, with our security boundary kept:
  *
  * (name history: this module tracks the control plane's product name, which has changed over time
- * — registry → sema-web → planned sema-admin. The module itself keeps a neutral, product-name-free
+ * — registry → sema-web → sema-web-admin (2026-08-26 repo/product rename; an earlier revision of
+ * this note listed "planned sema-admin" as the next step). The module itself keeps a neutral, product-name-free
  * identifier ("config-center") and does not chase the rename.)
  *
  *   - the CENTER owns the LOGICAL config: the model roster (names/capabilities/tier), the role map,
- *     and team templates;
+ *     and collab (multi-agent discussion) templates;
  *   - the SERVICE env still owns the SECRETS: API keys stay in env (the center never stores a secret);
  *     keys are per-model via `apiKeyEnv` → `config.modelApiKeyEnv` → the spec's `getApiKeyAndHeaders`
  *     (core 1.45), so each model/cascade-rung authenticates with its own upstream key.
@@ -18,7 +19,7 @@
  *
  * Hot-reload status (复审 2026-07-29 P1-11 — 亲读判定,取代此处旧的 "models/roles are restart-to-apply"
  * TODO, which went stale when `mutateInPlace` landed):
- *   - models/roles/roster/teams/projects/autonomy — **HOT**. `applyEffective` mutates `config.models`/
+ *   - models/roles/roster/collab/projects/autonomy — **HOT**. `applyEffective` mutates `config.models`/
  *     `config.roles` IN PLACE, and core's Runner reads `this.deps.models/roles` per task off that very
  *     reference. Both brains re-resolve `model.baseUrl || config.baseUrl` inside `buildRequest()` on every
  *     call (core 2.1.0 `brain/openai.js` + `brain/anthropic.js`), so a moved gateway takes effect on the
@@ -32,7 +33,7 @@
  *     gateway silently on the rate-limit path.
  *   - skills/mcp/scenarios/runtime-gates — restart-to-apply by construction (baked into the boot wiring).
  *
- * (design/158 A13, internal-lossless) This module is now a FACADE: the implementation lives
+ * ([ref] A13, internal-lossless) This module is now a FACADE: the implementation lives
  * alongside it in `src/config-center/` split by responsibility group (HTTP client / EffectiveConfig
  * application / restart-signal detection / skills+MCP consumption). Every symbol below is
  * re-exported UNCHANGED — existing `from ".../config-center/facade.js"` imports need zero changes
@@ -40,7 +41,7 @@
  * importers to update, which was done in the same commit.
  */
 export { fetchEffective, fetchPrincipalCaps, fetchPrincipalOrgMemory, ConfigCenterHttpError, fetchSkillContent, fetchPromptArtifact, fetchPromptBlob, } from "./http-client.js";
-export { mutateInPlace, applyEffective, type ApplyReport, applyRuntimeGates, applyRuntimeHot, resolveDefaultModelName, logEffectiveDiff, runtimeHasActiveGate, } from "./apply-effective.js";
+export { mutateInPlace, applyEffective, type ApplyReport, applyRuntimeGates, applyRuntimeHot, resolveDefaultModelName, logEffectiveDiff, } from "./apply-effective.js";
 export { restartReasons, planeHasActiveTiers, modelPlaneChanged, type RestartSlice, type RestartSliceCtx, type RestartSignal, } from "./restart-signal.js";
 export { applyCenterSkills, resolveMcpServers, mcpForScenario, resolveA2aPeers, a2aForScenario } from "./skills-mcp.js";
 export { applyCenterReadFace } from "./read-face.js";

package/dist/config-center/facade.js

@@ -1,5 +1,5 @@
 export { fetchEffective, fetchPrincipalCaps, fetchPrincipalOrgMemory, ConfigCenterHttpError, fetchSkillContent, fetchPromptArtifact, fetchPromptBlob, } from "./http-client.js";
-export { mutateInPlace, applyEffective, applyRuntimeGates, applyRuntimeHot, resolveDefaultModelName, logEffectiveDiff, runtimeHasActiveGate, } from "./apply-effective.js";
+export { mutateInPlace, applyEffective, applyRuntimeGates, applyRuntimeHot, resolveDefaultModelName, logEffectiveDiff, } from "./apply-effective.js";
 export { restartReasons, planeHasActiveTiers, modelPlaneChanged, } from "./restart-signal.js";
 export { applyCenterSkills, resolveMcpServers, mcpForScenario, resolveA2aPeers, a2aForScenario } from "./skills-mcp.js";
 export { applyCenterReadFace } from "./read-face.js";

package/dist/config-center/hot-keys-registry.d.ts

@@ -1,5 +1,5 @@
 /**
- * #322 —— **热键登记表**(design/322 §4 机器门)。
+ * [ref] —— **热键登记表**([ref] §4 机器门)。
  *
  * 一个键「是不是热的」在本仓有三个互相独立的说法:①代码里真的接了写入面;②测试里真的有黑盒断言;
  * ③文档里对运维的承诺。三者任一漂了,受害者都是运维(改了配置,不知道该不该重启)。本表是**闭集单源**:
@@ -12,7 +12,7 @@
  * 但没接线」的条目正是本表要消灭的那种谎。
  */
 import type { ServiceConfigFlat, ServiceConfigGroups } from "../config-types.js";
-/** 换代手法(design/322 §2):A′=写入面接线(消费侧本就现读);B=值换代座位(对象已建、值被冻住)。 */
+/** 换代手法([ref] §2):A′=写入面接线(消费侧本就现读);B=值换代座位(对象已建、值被冻住)。 */
 export type HotKeyForm = "A-prime" | "B-setter";
 /** 三断言的用例 ID —— 与 test/config-hot 的参数化生成规则(`HK-<key>-<kind>`)逐字一致。 */
 export interface HotKeyCases {

package/dist/config-center/http-client.d.ts

@@ -2,7 +2,7 @@ import { type EntitlementRuntimeCaps } from "@sema-agent/settings-schema";
 import type { ScenarioRuling } from "../capabilities/scenarios.js";
 import type { EffectiveConfig, ExecutionRuling } from "./types.js";
 /** GET the effective config (Bearer + ETag). null = 304 (unchanged). Throws on transport/HTTP error, and on a
- *  payload that is not an effective config at all(非对象 / version 非有限数 / gate 域坏形——[2281] 裁B)。
+ *  payload that is not an effective config at all(非对象 / version 非有限数 / gate 域坏形——[ref] 裁B)。
  *  `domainErrors`:坏 catalog 域(schema default 已落)逐域单列——与本地腿 `FetchEffectiveResult` 同键同义,
  *  boot/refresh 的候选门直接消费。 */
 export declare function fetchEffective(baseUrl: string, token: string, etag: string | undefined, fetchImpl?: typeof fetch, worker?: string): Promise<{
@@ -14,7 +14,7 @@ export declare function fetchEffective(baseUrl: string, token: string, etag: str
     }>;
 } | null>;
 /**
- * design/99 §K (core 1.157 `RunnerDeps.runtimeCapsResolver`) — GET the PER-PRINCIPAL runtime
+ * [ref] §K (core 1.157 `RunnerDeps.runtimeCapsResolver`) — GET the PER-PRINCIPAL runtime
  * ENTITLEMENTS the engine enforces server-side, from center's `GET /api/config/effective?principal=&worker=`.
  * Center pre-resolves the tighten-only intersection (fleet defaults ∩ tier ⊕ roles + overrides) and returns a
  * `runtimeCaps` block — the service passes it through verbatim (no further tightening, per center's ruling).
@@ -42,7 +42,7 @@ export declare function fetchPrincipalCaps(baseUrl: string, token: string, princ
     etag?: string;
 } | null>;
 /**
- * design/170 件A —— 读 `?principal=` 响应里的 org 记忆解析段(org 目录腿的取数口)。
+ * [ref] 件A —— 读 `?principal=` 响应里的 org 记忆解析段(org 目录腿的取数口)。
  *
  * 🔬 **为什么不复用 {@link fetchPrincipalCaps}**(复审车 D-2 修):C3「两张表失败域互不干扰」是在档
  * 裁定,registry-core 的 `PrincipalCapsWire` 也正是为此把 org 段留成 `unknown`(「在本 schema 里校验
@@ -75,10 +75,10 @@ export declare class ConfigCenterHttpError extends Error {
  * the legacy `applyCenterSkills` path keeps treating every throw as "skip this skill, keep baseline".
  */
 export declare function fetchSkillContent(baseUrl: string, token: string, contentHash: string, fetchImpl?: typeof fetch): Promise<string>;
-/** [985]b / [1285]① — §9.4 by-digest 补拉二函(fetchSkillContent 同姿势:HTTP+Bearer+8s 超时+
+/** [ref]b / [ref]① — §9.4 by-digest 补拉二函(fetchSkillContent 同姿势:HTTP+Bearer+8s 超时+
  *  消费侧自证)。artifact=envelope JSON(验真=调用方过 core verifyPromptArtifact,canonical 重算——
  *  本函数只做传输与形读,不超范围解释);blob=段文本 raw-byte(sha256 逐位自证,fetchSkillContent 同款)。
- *  digest 参数收带前缀/裸 hex 两形([1285] 参数口径)。 */
+ *  digest 参数收带前缀/裸 hex 两形([ref] 参数口径)。 */
 export declare function fetchPromptArtifact(baseUrl: string, token: string, artifactDigest: string, fetchImpl?: typeof fetch): Promise<unknown>;
 export declare function fetchPromptBlob(baseUrl: string, token: string, contentDigest: string, fetchImpl?: typeof fetch): Promise<string>;
 //# sourceMappingURL=http-client.d.ts.map

package/dist/config-center/mcp-revocation.d.ts

@@ -1,11 +1,11 @@
 /**
- * #324(core 5.50 design/338 提货件)—— mid-turn MCP 撤销台账:`RunnerDeps.mcpRevocations` 席的宿主实现。
+ * [ref](core 5.50 [ref] 提货件)—— mid-turn MCP 撤销台账:`RunnerDeps.mcpRevocations` 席的宿主实现。
  *
  * 语义(与 core 契约对表,types.d.ts `RunnerDeps.mcpRevocations` 注):
  *  · 权威单点在宿主 —— core 每次 MCP dispatch 前**同步**探 `isRevoked(serverName)`,从不缓存答案。
  *  · 本台账记「中心**曾发布为 enabled、后从 enabled 集移除**」的服务器名。MCP mount 是 boot-baked
  *    (`resolveMcpServers` 只在启动期跑),所以**删除向**在 5.50 前只能等 restart 才生效——这正是
- *    design/338 要消的窗:治理面最要紧的动作(撤销一条对外通道)现在即时生效,restart 信号的
+ *    [ref] 要消的窗:治理面最要紧的动作(撤销一条对外通道)现在即时生效,restart 信号的
  *    删除向豁免见 `restart-signal.ts` 的 mcp 特判(`mcpRevocationLive` 前提,fail-closed:席没接线
  *    的部署保持旧的 restart 语义)。
  *  · **重现恢复是指纹判,不是名字判**(codex F1,confirmed):被撤的名字回到 enabled 集时,只有当
@@ -46,8 +46,10 @@ export declare function createMcpRevocationLedger(onChange?: (ev: {
 }) => void): McpRevocationLedger;
 /** 一拍 EffectiveConfig 的 ENABLED MCP 服务器条目表(`resolveMcpServers` 同判据:`enabled !== false`;
  *  值=整条目的 key 排序 JSON 指纹,Map 插入序=发布序);mcp 域缺席 ⇒ `null`(台账不动)。
- *  指纹口径与 restart-signal 的 stableStringify 同精神(key 序归一),但**刻意独立实现**:两处指纹
- *  只在各自域内自比,不跨域比对,无同源约束。 */
+ *  指纹序列化器 = restart-signal 的 `stableStringify`([ref] 2026-08-31 起同源:此前本文件持一份**逐字相同**的
+ *  私有复刻 `fingerprintOf`,两份在全部输入上字节恒等,合并零行为差,golden 钉 test/canonical-json-golden.test.ts)。
+ *  两处指纹仍只在各自域内自比、不跨域比对——同源只是去掉一份多余的复刻,不引入跨域约束;也**不**改用
+ *  `src/canonical-json.ts`(undefined 值键语义不同,见 restart-signal.ts 该函数顶注)。 */
 export declare function enabledMcpEntries(mcp: {
     servers: Array<{
         name: string;