@sema-agent/server 7.53.0 → 7.55.0

package/dist/boot/runner-deps.js

@@ -25,6 +25,19 @@ export function createEngineNoticeSeat(logger, router = defaultEngineNoticeRoute
     const warn = logger?.warn?.bind(logger);
     return warn ? { onNotice: createEngineNoticeForwarder({ warn }, router) } : {};
 }
+export function buildDeploymentPostureSeats(config) {
+    const seats = {
+        readFace: config.readFace ? config.readFace : undefined,
+        readDenyPatterns: config.readDenyPatterns ? config.readDenyPatterns : undefined,
+        readDenyBuiltinTiers: config.readDenyBuiltinTiers ?? undefined,
+        readDenyBuiltinExclude: config.readDenyBuiltinExclude ?? undefined,
+        memoryDelegationEvidence: config.memoryDelegationEvidence ?? undefined,
+        memoryProvenance: config.memoryProvenance ?? undefined,
+        memoryCapturePolicy: config.memoryCapturePolicy ?? undefined,
+        delegationEntryCaps: config.delegationEntryCaps ?? undefined,
+    };
+    return seats;
+}
 export function createSharedRunnerDeps(ctx) {
     const shared = {
         brain: ctx.brain,
@@ -35,14 +48,7 @@ export function createSharedRunnerDeps(ctx) {
         pricing: ctx.pricing,
         tracer: ctx.tracer,
         promptSource: ctx.promptSource,
-        readFace: ctx.config.readFace ? ctx.config.readFace : undefined,
-        readDenyPatterns: ctx.config.readDenyPatterns ? ctx.config.readDenyPatterns : undefined,
-        readDenyBuiltinTiers: ctx.config.readDenyBuiltinTiers ?? undefined,
-        readDenyBuiltinExclude: ctx.config.readDenyBuiltinExclude ?? undefined,
-        memoryDelegationEvidence: ctx.config.memoryDelegationEvidence ?? undefined,
-        memoryProvenance: ctx.config.memoryProvenance ?? undefined,
-        memoryCapturePolicy: ctx.config.memoryCapturePolicy ?? undefined,
-        delegationEntryCaps: ctx.config.delegationEntryCaps ?? undefined,
+        ...buildDeploymentPostureSeats(ctx.config),
         executionEnvFactory: ctx.executionEnvFactory ? ctx.executionEnvFactory : undefined,
         lspManager: ctx.lspManager ? ctx.lspManager : undefined,
         backgroundAgentStore: ctx.backgroundAgentStore ? ctx.backgroundAgentStore : undefined,

package/dist/boot/shutdown.js

@@ -108,7 +108,7 @@ export function installShutdownHandlers(ctx) {
         }
         draining = true;
         drainState.draining = true;
-        deviceHub?.beginDrain();
+        deviceHub?.beginDrain({ graceMs: () => config.drainGraceMs });
         drainState.since = Date.now();
         void fleetClient?.announceNow();
         const inflight = drainState.inflight?.() ?? 0;

package/dist/boot/stores.js

@@ -17,7 +17,8 @@ import { PgTaskAttachmentStore, TiDBTaskAttachmentStore, ensurePgTaskAttachmentS
 import { createSessionStore } from "../plugins/session-store.js";
 import { createTaskListLane } from "./task-list-lane.js";
 import { ensurePgTaskListSchema, ensureTiDBTaskListSchema } from "../plugins/task-list-store-sql.js";
-import { ensurePgDeviceSchema, ensureTiDBDeviceSchema } from "../plugins/device-store-sql.js";
+import { assertDeviceAuditRebindEventSchema, ensurePgDeviceSchema, ensureTiDBDeviceSchema } from "../plugins/device-store-sql.js";
+import { mysqlDriver, pgDriver } from "../plugins/sql-driver.js";
 import { assertCloudSnapshotBlobPosture, openStoreBackendWithFallback } from "../plugins/store-backend.js";
 import { buildMemoryRemoteLaneWarn, memoryEngineBackendFor, memoryEngineRemoteLanePosture } from "../memory-scope.js";
 import { assertToolResultProvenanceSchema } from "../plugins/tool-result-store-sql.js";
@@ -386,6 +387,12 @@ export async function openStores(ctx) {
             await ensurePgDeviceSchema(async (text, params) => pgPool.query(text, params));
         if (mysqlPool)
             await ensureTiDBDeviceSchema(mysqlPool);
+        if (config.remoteExec?.provider === "device") {
+            if (pgPool)
+                await assertDeviceAuditRebindEventSchema(pgDriver(pgPool));
+            else if (mysqlPool)
+                await assertDeviceAuditRebindEventSchema(mysqlDriver(mysqlPool));
+        }
     }
     const sessionStore = createSessionStore(config, backend, metrics);
     if (config.requirePrincipal && backend?.kind === "local") {

package/dist/capabilities/team.d.ts

@@ -8,17 +8,18 @@ import type { Logger } from "../observability/logger.js";
  * ── 词汇([ref] / [ref],clay 直裁 [ref])──────────────────────────────────────────────────────
  * 「team」= agent-teams(持久具名团队)专用词;一次性多 agent 讨论叫「discuss」。所以**面向调用方/
  * 模型的名字**全部是 discussion:场景 `discuss`、工具 `run_discussion`、协调者提示词。
- * 而**模板注册面**(`BUILTIN_TEAMS` / `registerTeams` / `getTeam` / center 的 `teams` 键)保留 team
- * 词汇 —— 它是 registry-core 的配置契约(docs/TEAMS.md、`GET /api/config/effective → teams`),跨仓
- * 同改要另立件+center 侧同款 alias;本批刻意不单方面改一半(半改的配置键比不改更坏)。
+ * 而**模板注册面**(`BUILTIN_TEAMS` / `registerTeams` / `getTeam`)保留 team 词汇(历史命名,注册表是本仓
+ * 自己的模块级单例,不再对应任何中心配置键——见下段)。
  *
- * HYBRID layering (mirrors sema-registry docs/TEAMS.md): the TEMPLATE here carries only the
- * GENERIC orchestration skeleton (member roles + generic personas, rounds, synthesizer); the CONSUMER
- * (OA) injects the business prompt/context at call time (`businessContext`); this service composes them.
+ * HYBRID layering: the TEMPLATE here carries only the GENERIC orchestration skeleton (member roles + generic
+ * personas, rounds, synthesizer); the CONSUMER (OA) injects the business prompt/context at call time
+ * (`businessContext`); this service composes them.
  *
- * Templates: BUILTIN_TEAMS are the defaults; the sema registry pushes more at runtime via
- * `applyEffective → registerTeams` (GET /api/config/effective → `teams`), and `getTeam` resolves from
- * that merged registry. So rosters are config-driven; the built-ins are the fallback.
+ * Templates: BUILTIN_TEAMS are the defaults. ⚠️ 中心的 `teams` 配置域自 settings-schema 0.7 **已删除**
+ * (DOMAIN_SCHEMAS 无此域、FileConfigStore 不读、/effective 不铸),[ref] 件3 又拆掉了本仓 `applyEffective →
+ * registerTeams` 那条消费腿——本文件旧注里「registry pushes more at runtime via GET /api/config/effective → teams」
+ * 是 doc-rot。今天 `registerTeams` 只剩公共信任边界这一层意义(调用方=测试),注册表在生产上恒等于 BUILTIN_TEAMS;
+ * 中心侧的多 agent 讨论配置面是 `collab` 域(0.7 继任者),投影成命名 workflow(capabilities/collab-workflows.ts)。
  */
 type TeamFn = typeof runTeamDiscussion;
 export interface TeamMemberTemplate {

package/dist/config-center/apply-effective.d.ts

@@ -63,14 +63,12 @@ export declare function applyEffective(config: ServiceConfig, eff: EffectiveConf
     }) => void;
 }): boolean;
 /**
- * Apply the center `runtime` governance/limit gates OVER the env-derived config (mutates `config`).
- *
- * UNIFORM presence semantics across all 6 gates (center `f95438a` adopted this from our sentinel flag —
- * SERVICE-INTEGRATION「Runtime 治理/限额闸」): all six fields are center `.optional()`, so
+ * UNIFORM presence semantics across the center gates (center `f95438a` adopted this from our sentinel flag —
+ * SERVICE-INTEGRATION「Runtime 治理/限额闸」): every gate field is center `.optional()`, so
  *   `undefined` = center isn't managing it → KEEP env;
  *   present (any value, INCLUDING an explicit 0 / [] = "publish the gate OFF") → OVERRIDE env.
  * (Earlier center had `rateLimitPerMin`/`approvalRequire` as `.default(0/[])`, which would have let a default
- *  silently disable an env-set gate — we flagged it, center made all six optional, so a plain presence rule is
+ *  silently disable an env-set gate — we flagged it, center made them optional, so a plain presence rule is
  *  now both correct and uniform. No sentinel special-casing.)
  *
  * Only guard: `costQuotaWindowSec` must be `> 0` (a 0 window is nonsensical — core divides by it). Center's
@@ -79,22 +77,21 @@ export declare function applyEffective(config: ServiceConfig, eff: EffectiveConf
  * Per-worker overrides ride the per-worker `/effective?worker=` response (center merges WorkerSpec.runtime over
  * the fleet default server-side), so this single "effective beats env" rule already honors per-worker > fleet.
  */
-/** The 6 runtime governance/limit gates, in ONE place (council DRY): the consume loop, the restart-to-apply
- *  signal, and the dry-run diff all derive from this list, so adding a 7th gate is a single edit and can't
- *  silently miss `runtimeHasActiveGate` (which would break the restart-to-apply warning). All six share keys
- *  across `EffectiveConfig["runtime"]` and `ServiceConfig`. Exported (not in the original single-file form) so
- *  the sibling restart-signal module can share the identical key list + presence rule. */
-export declare const RUNTIME_GATE_KEYS: readonly ["rateLimitPerMin", "approvalRequire", "maxTaskCostUsd", "maxTaskTokens", "maxPrincipalCostUsd", "costQuotaWindowSec"];
+/** `runtime` 域的限额五闸(= settings-schema `RuntimeConfig` 的全部键,[ref] 件3 对账门钉集合等式),ONE place:
+ *  legacy 位的 presence 判据({@link runtimeGatePresent} → stage-limits 的 `legacyGates`)、config-catalog 的
+ *  center 在管键、dry-run 现值快照都从这一张表派生。[ref] 批1 起五键**全热**(属主 stage-limits,boot+refresh
+ *  双腿),所以本表与 restart-to-apply 再无关系——审批闸不在这里:它住 governance 域({@link BOOT_GATE_KEYS})。 */
+export declare const RUNTIME_GATE_KEYS: readonly ["rateLimitPerMin", "maxTaskCostUsd", "maxTaskTokens", "maxPrincipalCostUsd", "costQuotaWindowSec"];
 export type RuntimeGateKey = (typeof RUNTIME_GATE_KEYS)[number];
-/**
- * [ref] 批1:六闸里**已转热**的五个(限额族)——它们的属主是 `stage-limits.ts`(boot+refresh 双腿),
- * 所以 boot-only 的闸车道不再写它们,`runtime-gates` 重启片也不再为它们铸重启理由(键是热的却还要求重启
- * = 白白滚动重启整片 fleet)。剩下的 `approvalRequire` 仍是 restart-to-apply,归批2。
- */
-export declare const HOT_RUNTIME_GATE_KEYS: ReadonlySet<string>;
-/** Uniform presence rule (center f95438a): a gate is "managed" when the field is present — any number (incl. 0),
- *  or an array for approvalRequire. Sole guard: costQuotaWindowSec must be > 0 (a 0 window is nonsensical — core
- *  divides by it; center's `.positive()` already enforces, belt-and-suspenders here). */
+/** boot-only(restart-to-apply)的治理闸:今天只有 `governance.approvalRequire` 一键——它被 main.ts 在本函数之后
+ *  用 `config` 构造进 approval gate,refresh 腿(teamsOnly)不写,变更由 restart-signal 的 `runtime-gates` 片通告。
+ *  ([ref] 批2 若把它转热,这张表清空、那个片随之退役——一处改动。) */
+export declare const BOOT_GATE_KEYS: readonly ["approvalRequire"];
+export type BootGateKey = (typeof BOOT_GATE_KEYS)[number];
+/** Uniform presence rule (center f95438a) for the `runtime` limit gates: "managed" when the field is present —
+ *  any number (incl. 0). Sole guard: costQuotaWindowSec must be > 0 (a 0 window is nonsensical — core divides by
+ *  it; center's `.positive()` already enforces, belt-and-suspenders here). The approval gate's presence rule
+ *  (`Array.isArray`) lives with its owner, {@link stageApprovalGate}. */
 /**
  * DESIGN-278 §5 S2([ref])—— center 这份 effective **当前在管**哪些 `ServiceConfig` 键(配置目录端点
  * `GET /v1/config/catalog` 判 `effectiveLane` 的 center 半场)。
@@ -109,8 +106,13 @@ export declare const HOT_RUNTIME_GATE_KEYS: ReadonlySet<string>;
  */
 export declare function centerManagedConfigKeys(eff: EffectiveConfig | undefined): ReadonlySet<string>;
 export declare function runtimeGatePresent(rt: NonNullable<EffectiveConfig["runtime"]>, key: RuntimeGateKey): boolean;
-export declare function applyRuntimeGates(config: ServiceConfig, rt: EffectiveConfig["runtime"], logger?: Logger): void;
-export declare function applyRuntimeHot(config: ServiceConfig, rt: EffectiveConfig["runtime"], logger?: Logger): void;
+/** 独立调用面的兼容壳(测试/外部):stage → 就地赋值 → 通知。applyEffective 不走这里——它把
+ *  assignments 并进自己的 commit 段以保住整世代原子性([ref]②)。入参是 eff 的两个域([ref] 件3:审批闸
+ *  住 governance,限额五闸住 runtime——两位各自的属主判据,这里不再合成视图)。
+ *  [ref]:限额五闸的属主已移交热腿,所以本壳**同样**要过 stage-limits —— 否则一个仍叫 applyRuntimeGates
+ *  的函数会静默漏掉五个限额键(比改名更坏的那种沉默)。 */
+export declare function applyRuntimeGates(config: ServiceConfig, eff: Pick<EffectiveConfig, "runtime" | "governance"> | undefined, logger?: Logger): void;
+export declare function applyRuntimeHot(config: ServiceConfig, gov: EffectiveConfig["governance"], logger?: Logger): void;
 /**
  * [ref]① 显式默认解析——applyEffective 与 dry-run(logEffectiveDiff.wouldDefaultModel)共用的单源。优先级
  * (显式源指向不在目录/未启用的名 ⇒ onDangling 回调后落下一级,绝不静默指错模型):
@@ -129,10 +131,7 @@ export declare function resolveDefaultModelName(eff: EffectiveConfig, has: (name
 /**
  * Read-only comparison (SEMA_REGISTRY_DRY_RUN): log what the center config WOULD change vs the current
  * (env-derived) config, WITHOUT applying it. The safe-rollout step the config-center recommends — verify
- * the center's models/roles/teams match (or intentionally differ from) the env baseline before going live.
+ * the center's models/roles/collab match (or intentionally differ from) the env baseline before going live.
  */
 export declare function logEffectiveDiff(config: ServiceConfig, eff: EffectiveConfig, logger?: Logger): void;
-/** True if the center `runtime` carries any managed gate (a PRESENT field) — i.e. a refresh that changed it
- *  needs a restart to take effect (restart-to-apply). Same key list + presence rule as applyRuntimeGates. */
-export declare function runtimeHasActiveGate(rt: EffectiveConfig["runtime"]): boolean;
 //# sourceMappingURL=apply-effective.d.ts.map

package/dist/config-center/apply-effective.js

@@ -4,7 +4,6 @@ import { sealedKeyPoison } from "../sealed-key.js";
 import { applyAutoCompactWindow, findUnmatchableToolNames, formatUnmatchableToolNames, parseAutonomy } from "../config.js";
 import { validateCommandRules } from "../runtime-governance.js";
 import { projectCollabToWorkflows, registerCollabWorkflows } from "../capabilities/collab-workflows.js";
-import { registerTeams } from "../capabilities/team.js";
 import { stageLimits } from "./stage-limits.js";
 import { BATCH1_LIMIT_KEYS } from "./hot-keys-registry.js";
 const asModelThinking = (v) => (v && isThinkingLevel(v) && v !== "off" ? v : undefined);
@@ -124,7 +123,7 @@ export function applyEffective(config, eff, logger, opts = {}) {
         logger?.info("sema_registry_runtime", staged.gatesInfo);
     if (Object.keys(staged.hot.infoLine).length > 0)
         logger?.info("sema_registry_runtime_hot", staged.hot.infoLine);
-    for (const n of staged.teamsPlane?.notices ?? []) {
+    for (const n of staged.collabPlane?.notices ?? []) {
         if (n.level === "warn")
             logger?.warn(n.msg, n.fields);
         else
@@ -158,11 +157,8 @@ function commitStaged(config, staged) {
         config.autonomy = staged.hot.autonomyNext;
     if (staged.hot.setCommandPolicy)
         config.commandPolicy = staged.hot.commandPolicyNext;
-    const tp = staged.teamsPlane;
-    if (tp) {
-        registerTeams(tp.teams);
-        registerCollabWorkflows(tp.workflows);
-    }
+    if (staged.collabPlane)
+        registerCollabWorkflows(staged.collabPlane.workflows);
     mutateInPlace(config.projects, staged.projects);
 }
 function stageEffective(config, eff, logger, opts) {
@@ -267,32 +263,20 @@ function stageEffective(config, eff, logger, opts) {
             infoLine: { count: enabled.length, default: models.default.id, defaultSource: picked.source, roles: Object.keys(roles), tiers: Object.keys(activeTiers), atModelAllowlist: atModelAllowlist.length, sealedKeys: Object.values(modelApiKeys).filter((v) => typeof v === "string").length, sealedPoisoned: Object.values(modelApiKeys).filter((v) => typeof v !== "string").length },
         };
     }
-    const gatesView = eff.governance ? { ...eff.runtime, ...eff.governance } : eff.runtime;
-    const gates = opts.teamsOnly ? undefined : stageRuntimeGates(gatesView, logger);
+    const gates = opts.teamsOnly ? undefined : stageApprovalGate(eff.governance, logger);
     const limits = stageLimits(config, { version: typeof eff.version === "number" ? eff.version : 0, ...("limits" in eff ? { limits: eff.limits } : {}), legacyGates: legacyGateValues(eff.runtime) }, logger);
-    const hot = stageRuntimeHot(config, gatesView, logger);
-    let teamsPlane;
+    const hot = stageRuntimeHot(config, eff.governance, logger);
+    let collabPlane;
     if (opts.deferModelPlane !== true) {
-        const teams = {};
-        for (const t of (eff.teams?.teams ?? []).filter((t) => t.enabled !== false)) {
-            teams[t.name] = {
-                name: t.name,
-                members: t.members.map((mm) => ({ role: mm.role, ...(mm.model ? { model: mm.model } : {}), modelRole: mm.modelRole, systemPrompt: mm.systemPrompt })),
-                rounds: t.rounds,
-                synthesizer: t.synthesizer ? { role: t.synthesizer.role, modelRole: t.synthesizer.modelRole, systemPrompt: t.synthesizer.systemPrompt } : undefined,
-            };
-        }
         const projected = projectCollabToWorkflows(eff.collab?.templates);
         const notices = [];
-        if (Object.keys(teams).length > 0)
-            notices.push({ level: "info", msg: "sema_registry_teams", fields: { teams: Object.keys(teams) } });
         if (Object.keys(projected.workflows).length > 0)
             notices.push({ level: "info", msg: "sema_registry_collab_workflows", fields: { workflows: Object.keys(projected.workflows) } });
         if (projected.skipped.length > 0)
             notices.push({ level: "warn", msg: "sema_registry_collab_skipped", fields: { skipped: projected.skipped } });
         if (projected.notes.length > 0)
             notices.push({ level: "info", msg: "sema_registry_collab_notes", fields: { notes: projected.notes } });
-        teamsPlane = { teams, workflows: projected.workflows, notices };
+        collabPlane = { workflows: projected.workflows, notices };
     }
     const projDomain = eff.projects;
     const rawProjects = (projDomain && typeof projDomain === "object" && !Array.isArray(projDomain) &&
@@ -316,12 +300,12 @@ function stageEffective(config, eff, logger, opts) {
         ...(gates !== undefined ? { gateAssignments: gates.assignments, ...(gates.info !== undefined ? { gatesInfo: gates.info } : {}) } : {}),
         limits,
         hot,
-        ...(teamsPlane !== undefined ? { teamsPlane } : {}),
+        ...(collabPlane !== undefined ? { collabPlane } : {}),
         projects,
     };
 }
-export const RUNTIME_GATE_KEYS = ["rateLimitPerMin", "approvalRequire", "maxTaskCostUsd", "maxTaskTokens", "maxPrincipalCostUsd", "costQuotaWindowSec"];
-export const HOT_RUNTIME_GATE_KEYS = new Set(BATCH1_LIMIT_KEYS);
+export const RUNTIME_GATE_KEYS = ["rateLimitPerMin", "maxTaskCostUsd", "maxTaskTokens", "maxPrincipalCostUsd", "costQuotaWindowSec"];
+export const BOOT_GATE_KEYS = ["approvalRequire"];
 export function centerManagedConfigKeys(eff) {
     const out = new Set();
     if (!eff)
@@ -337,10 +321,6 @@ export function centerManagedConfigKeys(eff) {
         for (const k of RUNTIME_GATE_KEYS)
             if (runtimeGatePresent(rt, k))
                 out.add(k);
-        if (rt.autonomy !== undefined)
-            out.add("autonomy");
-        if (rt.commandPolicy !== undefined)
-            out.add("commandPolicy");
     }
     if (eff.governance) {
         if (eff.governance.autonomy !== undefined)
@@ -369,8 +349,6 @@ export function centerManagedConfigKeys(eff) {
 }
 export function runtimeGatePresent(rt, key) {
     const v = rt[key];
-    if (key === "approvalRequire")
-        return Array.isArray(v);
     if (key === "costQuotaWindowSec")
         return typeof v === "number" && v > 0;
     return typeof v === "number";
@@ -401,43 +379,29 @@ function stageApprovalRequire(raw, logger) {
     }
     return { value: names };
 }
-function stageRuntimeGates(rt, logger) {
-    if (!rt)
+function stageApprovalGate(gov, logger) {
+    const raw = gov?.approvalRequire;
+    if (!Array.isArray(raw))
         return { assignments: [] };
-    const assignments = [];
-    const applied = {};
-    for (const key of RUNTIME_GATE_KEYS) {
-        if (HOT_RUNTIME_GATE_KEYS.has(key))
-            continue;
-        if (!runtimeGatePresent(rt, key))
-            continue;
-        if (key === "approvalRequire") {
-            const staged = stageApprovalRequire(rt[key], logger);
-            if (staged.value === undefined)
-                continue;
-            assignments.push([key, staged.value]);
-            applied[key] = staged.value;
-            continue;
-        }
-        assignments.push([key, rt[key]]);
-        applied[key] = rt[key];
-    }
-    return { assignments, ...(Object.keys(applied).length > 0 ? { info: applied } : {}) };
+    const staged = stageApprovalRequire(raw, logger);
+    if (staged.value === undefined)
+        return { assignments: [] };
+    return { assignments: [["approvalRequire", staged.value]], info: { approvalRequire: staged.value } };
 }
 function legacyGateValues(rt) {
     const out = {};
     if (!rt)
         return out;
     for (const k of RUNTIME_GATE_KEYS)
-        if (HOT_RUNTIME_GATE_KEYS.has(k) && runtimeGatePresent(rt, k))
+        if (runtimeGatePresent(rt, k))
             out[k] = rt[k];
     return out;
 }
-export function applyRuntimeGates(config, rt, logger) {
-    const s = stageRuntimeGates(rt, logger);
+export function applyRuntimeGates(config, eff, logger) {
+    const s = stageApprovalGate(eff?.governance, logger);
     for (const [k, v] of s.assignments)
         config[k] = v;
-    const limits = stageLimits(config, { version: 0, legacyGates: legacyGateValues(rt) }, logger);
+    const limits = stageLimits(config, { version: 0, legacyGates: legacyGateValues(eff?.runtime) }, logger);
     for (const [k, v] of limits.assignments)
         config[k] = v;
     for (const k of limits.deletions)
@@ -473,8 +437,8 @@ function stageRuntimeHot(config, rt, logger) {
     }
     return { setAutonomy, autonomyNext, setCommandPolicy, commandPolicyNext, infoLine };
 }
-export function applyRuntimeHot(config, rt, logger) {
-    const s = stageRuntimeHot(config, rt, logger);
+export function applyRuntimeHot(config, gov, logger) {
+    const s = stageRuntimeHot(config, gov, logger);
     if (s.setAutonomy)
         config.autonomy = s.autonomyNext;
     if (s.setCommandPolicy)
@@ -506,7 +470,6 @@ export function logEffectiveDiff(config, eff, logger) {
     const centerModels = enabled.map((m) => ({ name: m.name, id: m.id, provider: m.provider, apiKeyEnv: m.apiKeyEnv ?? null, tier: m.tier ?? null }));
     const envModels = Object.entries(config.models).map(([name, m]) => ({ name, id: m.id, provider: m.provider }));
     const centerRoles = Object.fromEntries(Object.entries(eff.models?.roles ?? {}).map(([r, t]) => [r, "model" in t ? t.model : { select: t.select }]));
-    const centerTeams = (eff.teams?.teams ?? []).filter((t) => t.enabled !== false).map((t) => t.name);
     logger?.warn("sema_registry_dry_run", {
         note: "DRY RUN — registry config NOT applied; unset SEMA_REGISTRY_DRY_RUN to go live",
         version: eff.version,
@@ -515,18 +478,17 @@ export function logEffectiveDiff(config, eff, logger) {
         currentDefaultModel: config.model.id,
         models: { center: centerModels, envDerived: envModels },
         roles: { center: centerRoles, current: config.roles },
-        teams: { centerWouldRegister: centerTeams },
+        collab: { centerWouldRegister: Object.keys(projectCollabToWorkflows(eff.collab?.templates).workflows) },
         skills: { centerWouldLoad: (eff.skills?.skills ?? []).filter((s) => s.enabled !== false).map((s) => s.name) },
         mcp: { centerWouldRegister: (eff.mcp?.servers ?? []).filter((s) => s.enabled !== false).map((s) => s.name) },
         runtime: {
             center: eff.runtime ?? null,
             current: Object.fromEntries(RUNTIME_GATE_KEYS.map((k) => [k, config[k]])),
         },
+        governance: {
+            center: eff.governance ?? null,
+            current: { autonomy: config.autonomy, commandPolicy: config.commandPolicy?.length ?? 0, approvalRequire: config.approvalRequire },
+        },
     });
 }
-export function runtimeHasActiveGate(rt) {
-    if (!rt)
-        return false;
-    return RUNTIME_GATE_KEYS.some((k) => runtimeGatePresent(rt, k));
-}
 //# sourceMappingURL=apply-effective.js.map

package/dist/config-center/effective-keys.d.ts

@@ -0,0 +1,30 @@
+/**
+ * [ref] 件5 —— server 的 settings-schema 消费键账本(对账门 test/settings-schema-consumption-gates.test.ts 的本仓侧输入)。
+ *
+ * 🔴 三条纪律:
+ *  1. `EFFECTIVE_CONFIG_KEYS` 与 {@link EffectiveConfig} **类型级**绑定(`satisfies Record<keyof …, true>`):接口加键 /
+ *     删键而不动这里 = **编译错**——运行时键表永不与类型面漂移(这不是第二份表,是同一份接口的运行时投影;
+ *     runtime / governance 两域的键表同法,用于与 schema zod shape 的集合等式墓碑)。
+ *  2. 三张登记表(非域白名单 / 不消费表 / 远端专属表)每行**必须带理由**;行的成立性由对账门**双向**钉——登记了
+ *     却不成立(死账)与成立了却没登记(半接线)都红,理由失效之日格子自己翻红(墓碑),禁裸豁免。
+ *  3. schema 侧的数据(`DOMAINS` / `PORTABLE_DOMAINS` / zod shape)一律由对账门**读 dist**,绝不抄进这里
+ *     (平行副本病是 DESIGN-282 §0 的病理定性,本文件只登记 server 自己那一侧)。
+ */
+import type { EffectiveConfig } from "./types.js";
+/** EffectiveConfig 的全部顶层键(信封 + 域 + 非域白名单键),类型级绑定见上。 */
+export declare const EFFECTIVE_CONFIG_KEYS: ReadonlyArray<keyof EffectiveConfig>;
+/** 信封键(不是域)。 */
+export declare const EFFECTIVE_ENVELOPE_KEYS: readonly ["version", "updatedAt"];
+/** `runtime` 域(限额残余)的键集——对账门与 schema `RuntimeConfig.shape` 钉集合等式([ref] 件3 退役键墓碑)。 */
+export declare const RUNTIME_DOMAIN_KEYS: readonly string[];
+/** `governance` 域(治理三件)的键集——对账门与 schema `GovernanceConfig.shape` 钉集合等式。 */
+export declare const GOVERNANCE_DOMAIN_KEYS: readonly string[];
+/** EffectiveConfig 上**不是** settings-schema 域的顶层键(键 → 成文理由)。⚠️ 墓碑语义:任一键将来出现在 schema
+ *  `DOMAINS` 里 ⇒ 对账门红 ⇒ 清本行 + 接本地腿投影(mapToServiceEffective)+ 复核 restart 片归属。 */
+export declare const NON_DOMAIN_EFFECTIVE_KEYS: Readonly<Record<string, string>>;
+/** schema `DOMAINS` 里 server **不消费**的域(域 → 成文理由)。⚠️ 新域(如 presets)到货而不入本表也不入
+ *  EffectiveConfig ⇒ 对账门红 ⇒ 逼一行显式决定(「加了域没人接」从此机器可见,[ref]③)。 */
+export declare const DOMAINS_NOT_CONSUMED_BY_SERVER: Readonly<Record<string, string>>;
+/** server 消费但**非便携**(∉ PORTABLE_DOMAINS ⇒ 本地腿无 config.d/<域>.json 可读)的域(域 → 成文理由)。 */
+export declare const LOCAL_LANE_REMOTE_ONLY_DOMAINS: Readonly<Record<string, string>>;
+//# sourceMappingURL=effective-keys.d.ts.map

package/dist/config-center/effective-keys.js

@@ -0,0 +1,49 @@
+const EFFECTIVE_CONFIG_KEY_TABLE = {
+    version: true,
+    updatedAt: true,
+    models: true,
+    collab: true,
+    skills: true,
+    mcp: true,
+    a2a: true,
+    scenarios: true,
+    runtime: true,
+    limits: true,
+    projects: true,
+    governance: true,
+    plugins: true,
+    readFace: true,
+    prompts: true,
+};
+export const EFFECTIVE_CONFIG_KEYS = Object.keys(EFFECTIVE_CONFIG_KEY_TABLE);
+export const EFFECTIVE_ENVELOPE_KEYS = ["version", "updatedAt"];
+const RUNTIME_DOMAIN_KEY_TABLE = {
+    rateLimitPerMin: true,
+    maxTaskCostUsd: true,
+    maxTaskTokens: true,
+    maxPrincipalCostUsd: true,
+    costQuotaWindowSec: true,
+};
+export const RUNTIME_DOMAIN_KEYS = Object.keys(RUNTIME_DOMAIN_KEY_TABLE);
+const GOVERNANCE_DOMAIN_KEY_TABLE = {
+    autonomy: true,
+    commandPolicy: true,
+    approvalRequire: true,
+};
+export const GOVERNANCE_DOMAIN_KEYS = Object.keys(GOVERNANCE_DOMAIN_KEY_TABLE);
+export const NON_DOMAIN_EFFECTIVE_KEYS = {
+    a2a: "R-15 裁开域([4384]),但 settings-schema 至 1.3.0 未开(DOMAINS 无 a2a)——S-31 件2 BLOCKED on schema:远端腿靠 readEffectiveWire 的 open-world verbatim 透传(DESIGN-269),本地腿不可达(FileConfigStore 只读 PORTABLE_DOMAINS)。schema 开域之日按墓碑流程收线。",
+    readFace: "R-15 裁**暂不开域**([4384]:env 逐键恒赢语义下收益薄,⚪ 呈现制过渡)——#A4 的远端腿同靠 open-world 透传;本地腿四键由 env / 引擎默认独占。若来日改裁开域,同上墓碑机制。",
+};
+export const DOMAINS_NOT_CONSUMED_BY_SERVER = {
+    rosters: "center 写面域:center 端 resolveEffectiveForWorker 把 roster 解析进 per-worker /effective 的 models 视图——server 消费的是解析产物,不读原始域。",
+    systems: "控制面登记簿(系统台账),orchestrator / web 消费;worker /effective 视图不含。",
+    workers: "fleet 声明域,orchestrator(reconciler)消费拆建 worker;worker 自身不读。",
+    hosts: "主机登记域,orchestrator / 探活面消费;worker /effective 视图不含。",
+    entitlement: "租户商务数据:裁定为 per-principal caps view 单源(fetchPrincipalCaps),raw 域刻意不上 worker wire(center resolve-roster strips)。",
+    execution: "per-principal 执法面同 entitlement:ruling 骑 caps view(ExecutionRuling),/effective 域面 server 不读。",
+};
+export const LOCAL_LANE_REMOTE_ONLY_DOMAINS = {
+    projects: "身份台账(design/142 §1.4,与租户身份同风险模型):settings-schema 便携表刻意排除(file-store.ts 成文)——本地腿无此域文件,mapToServiceEffective 不投影;远端腿 verbatim 消费(applyEffective → config.projects)。",
+};
+//# sourceMappingURL=effective-keys.js.map

package/dist/config-center/facade.d.ts

@@ -9,7 +9,7 @@
  * identifier ("config-center") and does not chase the rename.)
  *
  *   - the CENTER owns the LOGICAL config: the model roster (names/capabilities/tier), the role map,
- *     and team templates;
+ *     and collab (multi-agent discussion) templates;
  *   - the SERVICE env still owns the SECRETS: API keys stay in env (the center never stores a secret);
  *     keys are per-model via `apiKeyEnv` → `config.modelApiKeyEnv` → the spec's `getApiKeyAndHeaders`
  *     (core 1.45), so each model/cascade-rung authenticates with its own upstream key.
@@ -19,7 +19,7 @@
  *
  * Hot-reload status (复审 2026-07-29 P1-11 — 亲读判定,取代此处旧的 "models/roles are restart-to-apply"
  * TODO, which went stale when `mutateInPlace` landed):
- *   - models/roles/roster/teams/projects/autonomy — **HOT**. `applyEffective` mutates `config.models`/
+ *   - models/roles/roster/collab/projects/autonomy — **HOT**. `applyEffective` mutates `config.models`/
  *     `config.roles` IN PLACE, and core's Runner reads `this.deps.models/roles` per task off that very
  *     reference. Both brains re-resolve `model.baseUrl || config.baseUrl` inside `buildRequest()` on every
  *     call (core 2.1.0 `brain/openai.js` + `brain/anthropic.js`), so a moved gateway takes effect on the
@@ -41,7 +41,7 @@
  * importers to update, which was done in the same commit.
  */
 export { fetchEffective, fetchPrincipalCaps, fetchPrincipalOrgMemory, ConfigCenterHttpError, fetchSkillContent, fetchPromptArtifact, fetchPromptBlob, } from "./http-client.js";
-export { mutateInPlace, applyEffective, type ApplyReport, applyRuntimeGates, applyRuntimeHot, resolveDefaultModelName, logEffectiveDiff, runtimeHasActiveGate, } from "./apply-effective.js";
+export { mutateInPlace, applyEffective, type ApplyReport, applyRuntimeGates, applyRuntimeHot, resolveDefaultModelName, logEffectiveDiff, } from "./apply-effective.js";
 export { restartReasons, planeHasActiveTiers, modelPlaneChanged, type RestartSlice, type RestartSliceCtx, type RestartSignal, } from "./restart-signal.js";
 export { applyCenterSkills, resolveMcpServers, mcpForScenario, resolveA2aPeers, a2aForScenario } from "./skills-mcp.js";
 export { applyCenterReadFace } from "./read-face.js";

package/dist/config-center/facade.js

@@ -1,5 +1,5 @@
 export { fetchEffective, fetchPrincipalCaps, fetchPrincipalOrgMemory, ConfigCenterHttpError, fetchSkillContent, fetchPromptArtifact, fetchPromptBlob, } from "./http-client.js";
-export { mutateInPlace, applyEffective, applyRuntimeGates, applyRuntimeHot, resolveDefaultModelName, logEffectiveDiff, runtimeHasActiveGate, } from "./apply-effective.js";
+export { mutateInPlace, applyEffective, applyRuntimeGates, applyRuntimeHot, resolveDefaultModelName, logEffectiveDiff, } from "./apply-effective.js";
 export { restartReasons, planeHasActiveTiers, modelPlaneChanged, } from "./restart-signal.js";
 export { applyCenterSkills, resolveMcpServers, mcpForScenario, resolveA2aPeers, a2aForScenario } from "./skills-mcp.js";
 export { applyCenterReadFace } from "./read-face.js";

package/dist/config-center/restart-signal.js

@@ -1,5 +1,5 @@
 import { resolveActiveTiers } from "@sema-agent/settings-schema";
-import { RUNTIME_GATE_KEYS, HOT_RUNTIME_GATE_KEYS, runtimeGatePresent, resolveDefaultModelName } from "./apply-effective.js";
+import { resolveDefaultModelName } from "./apply-effective.js";
 const RESTART_SLICES = ["skills", "mcp", "a2a", "scenarios", "runtime-gates", "models-tiers", "degrade-route", "read-face"];
 export function stableStringify(v) {
     if (v === null || typeof v !== "object")
@@ -38,14 +38,8 @@ function restartSliceValue(eff, slice, ctx) {
         case "scenarios":
             return enabledOnly(eff.scenarios?.scenarios);
         case "runtime-gates": {
-            const rt = eff.runtime;
-            if (!rt)
-                return null;
-            const present = {};
-            for (const k of RUNTIME_GATE_KEYS)
-                if (!HOT_RUNTIME_GATE_KEYS.has(k) && runtimeGatePresent(rt, k))
-                    present[k] = rt[k];
-            return Object.keys(present).length ? present : null;
+            const ar = eff.governance?.approvalRequire;
+            return Array.isArray(ar) ? { approvalRequire: ar } : null;
         }
         case "models-tiers": {
             const active = eff.models ? resolveActiveTiers(eff.models) : undefined;