@sema-agent/server 7.97.0 → 7.99.0

package/dist/center-credential.d.ts

@@ -0,0 +1,112 @@
+/** 凭证种类闭集。新增一个种类 = 本文件与 `config-center/center-request.ts` 的穷举 switch 当场编译红。 */
+export type CenterCredentialKind = "pull-token" | "user-jwt" | "none";
+/** 凭证在哪里声明(env 形带值 —— 只在本模块内流转)。 */
+export type CenterCredentialDeclaration = {
+    readonly from: "env";
+    readonly token: string;
+} | {
+    readonly from: "file";
+    readonly path: string;
+} | {
+    readonly from: "absent";
+};
+/** 声明形的**非秘密**投影(进日志 / 拒因 / 未来的 caps 读面):env 形不带值。 */
+export type CenterCredentialOrigin = {
+    readonly from: "env";
+} | {
+    readonly from: "file";
+    readonly path: string;
+} | {
+    readonly from: "absent";
+};
+/** 一次取值的结果。`ok:false` 只有文件形会出现(env / absent 形的取值恒成功)。 */
+export type CenterCredentialRead = {
+    readonly ok: true;
+    readonly kind: "pull-token";
+    readonly bearer: string;
+    readonly identity: string;
+    readonly workerScoped: boolean;
+} | {
+    readonly ok: true;
+    readonly kind: "user-jwt";
+    readonly bearer: string;
+    readonly identity: string;
+} | {
+    readonly ok: true;
+    readonly kind: "none";
+    readonly identity: string;
+} | {
+    readonly ok: false;
+    readonly reason: string;
+};
+/** 健康态:最近一次取值的结果(caps `leaseHealth` 之类的读面读它,不自己再判)。 */
+export type CenterCredentialHealth = {
+    readonly state: "ok";
+} | {
+    readonly state: "unreadable";
+    readonly reason: string;
+    readonly since: number;
+    readonly failures: number;
+};
+export interface CenterCredentialSource {
+    /** 声明形(非秘密):`{from:"file", path}` 进日志与拒因用。 */
+    readonly origin: CenterCredentialOrigin;
+    /** 装配判据:声明了凭证(env 值非空 / 文件路径在场)。**按声明装,不按内容装** —— 文件此刻不可读也算声明了。 */
+    readonly declared: boolean;
+    /** 每次出站请求调用一次;文件形每次都读文件。 */
+    read(): CenterCredentialRead;
+    health(): CenterCredentialHealth;
+}
+/** 凭证文件此刻不可读 / 为空。中心请求装配点(`center-request.ts`)取值失败时抛它,各消费方按自己的
+ *  失败臂处置(拉配置保 LKG、caps fail-closed、租约走「鉴权失败」响亮臂 …),**不发一个空 bearer 出去**。 */
+export declare class CenterCredentialUnavailableError extends Error {
+    readonly reason: string;
+    constructor(reason: string);
+}
+export declare const CENTER_TOKEN_ENV = "SEMA_REGISTRY_TOKEN";
+export declare const CENTER_TOKEN_FILE_ENV = "SEMA_REGISTRY_TOKEN_FILE";
+/**
+ * 读两个声明键。两个都非空 ⇒ throw(boot 拒启,拒因点名二选一)。空串 = 未设(与 7.98.0 之前
+ * `SEMA_REGISTRY_TOKEN || ""` 的读法一致)。文件路径在这里解析成绝对路径(之后 cwd 变了也读同一个文件)。
+ */
+export declare function readCenterCredentialDeclaration(env?: NodeJS.ProcessEnv): CenterCredentialDeclaration;
+/** 拉取令牌形的身份 = worker(拉取令牌代表 worker,不是人)。种类判别与 formatVersion 1 LKG 的一次性迁移
+ *  (`config-lkg.ts` `migrateV1Lkg`:v1 信封只记 worker,只有这一形的身份推得出来)共用这一只。 */
+export declare function pullTokenIdentity(worker: string | undefined): string;
+/**
+ * 凭证来源工厂(活对象:文件形每次取值读盘并记健康态)。`worker` = `SEMA_REGISTRY_WORKER`(拉取令牌形的身份)。
+ * `readFile` 只为测试注入。
+ */
+export declare function createCenterCredentialSource(declaration: CenterCredentialDeclaration, worker: string | undefined, deps?: {
+    readFile?: (path: string) => string;
+    now?: () => number;
+}): CenterCredentialSource;
+/** 需要作用域 worker 的拉取令牌(`wpt_<self>`)却没配 `SEMA_REGISTRY_WORKER` ⇒ 中心对 per-principal caps
+ *  逐次 403(caps fail-closed 拒全部 workflow)。boot 期一次性诊断用;判据只读本模块的种类判别。 */
+export declare function scopedTokenNeedsWorker(read: CenterCredentialRead, worker: string | undefined): boolean;
+/**
+ * [ref] E-15 —— 按「worker + 凭证身份」分箱的**唯一键形**(LKG 文件名、prompt 活动状态目录共用)。
+ * 两段都取摘要:worker 名 / 身份任意字节都成单段路径,无 dot-segment,无撞形(codex-5 当年给 prompt 状态
+ * 目录定的姿势,本批推广到 LKG)。
+ */
+export declare function centerStateBin(worker: string | undefined, identity: string): string;
+/** 此刻凭证的身份(每次现读);文件形此刻不可读 ⇒ `undefined`(身份未知)。「我现在是谁」只有这一只读法。 */
+export declare function credentialIdentityNow(source: CenterCredentialSource): string | undefined;
+/**
+ * [ref] E-15 ② —— 一次中心往返的答复**仍属于此刻的凭证**:发出它所用的身份 = 此刻的身份。
+ * 拉配置(`boot/config-center.ts` `pullEffective`)与两条 `?principal=` 视图(`config-center/http-client.ts`)
+ * 都只问这一只;不成立 ⇒ 答复丢弃,当这次拉取失败(各走各的失败臂)。
+ */
+export declare function answerStillCurrent(source: CenterCredentialSource, usedIdentity: string | undefined): usedIdentity is string;
+/**
+ * [ref] E-15 · 内存面 —— 身份绑定的进程内状态(per-principal caps 缓存与在飞表、org 记忆目录)的**唯一分箱规则**,
+ * 与盘上的 {@link centerStateBin} 同一条规则的两面(7.99.0 合并复审 F2:此前两处缓存只按 principal 键)。
+ *  · 箱 = 取箱那一刻的凭证身份(惰建)。凭证此刻不可读 ⇒ 「身份未知」箱。
+ *  · 每个箱只经**钉在它身份上**的凭证来源对中心说话(`make` 拿到的那只):此刻的凭证已换了人 / 不可读 ⇒ 这一箱的
+ *    请求不发(取值失败 ⇒ `CenterCredentialUnavailableError`,消费方走自己的失败臂)。身份未知箱因此从不收任何
+ *    中心答复;缓存 / 在飞 / 条件请求的校验子全在箱里,换了人结构上够不着上一个人的。
+ *  · 请求发出之后才换人:答复到达时由 {@link answerStillCurrent} 判丢弃(请求装配侧,见 http-client.ts)。
+ * 旧身份的箱不淘汰(量级 = 进程生命期内出现过的身份数):换回来的身份在 TTL 内照常命中它自己的缓存。
+ */
+export declare function createIdentityBins<T>(source: CenterCredentialSource, make: (pinned: CenterCredentialSource) => T): () => T;
+//# sourceMappingURL=center-credential.d.ts.map

package/dist/center-credential.js

@@ -0,0 +1,131 @@
+import { readFileSync } from "node:fs";
+import { createHash } from "node:crypto";
+import { resolve as resolvePath } from "node:path";
+import { looksLikeJwt } from "@sema-agent/settings-schema/api/auth-bridge";
+export class CenterCredentialUnavailableError extends Error {
+    reason;
+    constructor(reason) {
+        super(`center credential unavailable: ${reason}`);
+        this.reason = reason;
+        this.name = "CenterCredentialUnavailableError";
+    }
+}
+export const CENTER_TOKEN_ENV = "SEMA_REGISTRY_TOKEN";
+export const CENTER_TOKEN_FILE_ENV = "SEMA_REGISTRY_TOKEN_FILE";
+export function readCenterCredentialDeclaration(env = process.env) {
+    const token = env.SEMA_REGISTRY_TOKEN ?? "";
+    const file = env.SEMA_REGISTRY_TOKEN_FILE ?? "";
+    if (token !== "" && file !== "") {
+        throw new Error(`${CENTER_TOKEN_ENV} and ${CENTER_TOKEN_FILE_ENV} are both set — pick exactly one: ${CENTER_TOKEN_ENV} carries the credential value, ` +
+            `${CENTER_TOKEN_FILE_ENV} names a file re-read on every request (rotation without restart). Two writers on one credential is a guess, not a config.`);
+    }
+    if (file !== "")
+        return { from: "file", path: resolvePath(file) };
+    if (token !== "")
+        return { from: "env", token };
+    return { from: "absent" };
+}
+const digest16 = (s) => createHash("sha256").update(s, "utf8").digest("hex").slice(0, 16);
+function jwtSubject(bearer) {
+    let parsed;
+    try {
+        parsed = JSON.parse(Buffer.from(bearer.split(".")[1] ?? "", "base64url").toString("utf8"));
+    }
+    catch (err) {
+        return { missing: `payload is not JSON (${err instanceof Error ? err.name : "parse error"})` };
+    }
+    if (parsed === null || typeof parsed !== "object" || !("sub" in parsed))
+        return { missing: "no sub claim" };
+    return typeof parsed.sub === "string" && parsed.sub !== "" ? { sub: parsed.sub } : { missing: "sub is not a non-empty string" };
+}
+function classify(bearer, worker) {
+    if (looksLikeJwt(bearer)) {
+        const s = jwtSubject(bearer);
+        return { ok: true, kind: "user-jwt", bearer, identity: "sub" in s ? `user-jwt:${digest16(s.sub)}` : `user-jwt-opaque:${digest16(bearer)}` };
+    }
+    return { ok: true, kind: "pull-token", bearer, identity: pullTokenIdentity(worker), workerScoped: bearer.startsWith("wpt_") };
+}
+export function pullTokenIdentity(worker) {
+    return `pull-token:${worker ?? "global"}`;
+}
+const NONE = { ok: true, kind: "none", identity: "none" };
+export function createCenterCredentialSource(declaration, worker, deps = {}) {
+    switch (declaration.from) {
+        case "absent":
+            return { origin: declaration, declared: false, read: () => NONE, health: () => ({ state: "ok" }) };
+        case "env": {
+            const fixed = classify(declaration.token, worker);
+            return { origin: { from: "env" }, declared: true, read: () => fixed, health: () => ({ state: "ok" }) };
+        }
+        case "file": {
+            const readFile = deps.readFile ?? ((p) => readFileSync(p, "utf8"));
+            const now = deps.now ?? Date.now;
+            let health = { state: "ok" };
+            const fail = (reason) => {
+                health = health.state === "unreadable" ? { ...health, reason, failures: health.failures + 1 } : { state: "unreadable", reason, since: now(), failures: 1 };
+                return { ok: false, reason };
+            };
+            return {
+                origin: declaration,
+                declared: true,
+                read() {
+                    let text;
+                    try {
+                        text = readFile(declaration.path);
+                    }
+                    catch (err) {
+                        const code = err instanceof Error && "code" in err && typeof err.code === "string" ? err.code : "read error";
+                        return fail(`${CENTER_TOKEN_FILE_ENV} ${declaration.path} is unreadable (${code})`);
+                    }
+                    const bearer = text.trim();
+                    if (bearer === "")
+                        return fail(`${CENTER_TOKEN_FILE_ENV} ${declaration.path} is empty`);
+                    health = { state: "ok" };
+                    return classify(bearer, worker);
+                },
+                health: () => health,
+            };
+        }
+    }
+}
+export function scopedTokenNeedsWorker(read, worker) {
+    return read.ok && read.kind === "pull-token" && read.workerScoped && !worker;
+}
+export function centerStateBin(worker, identity) {
+    return `${worker === undefined ? "global" : `worker-${digest16(worker)}`}.id-${digest16(identity)}`;
+}
+export function credentialIdentityNow(source) {
+    const r = source.read();
+    return r.ok ? r.identity : undefined;
+}
+export function answerStillCurrent(source, usedIdentity) {
+    return usedIdentity !== undefined && credentialIdentityNow(source) === usedIdentity;
+}
+export function createIdentityBins(source, make) {
+    const bins = new Map();
+    return () => {
+        const identity = credentialIdentityNow(source);
+        if (bins.has(identity))
+            return bins.get(identity);
+        const made = make(pinCredential(source, identity));
+        bins.set(identity, made);
+        return made;
+    };
+}
+function pinCredential(source, identity) {
+    return {
+        origin: source.origin,
+        declared: source.declared,
+        read() {
+            const r = source.read();
+            if (!r.ok)
+                return r;
+            if (identity === undefined) {
+                return { ok: false, reason: "this state bin was opened while the center credential was unreadable (identity unknown) — it never talks to the center; the next call runs in the current identity's bin" };
+            }
+            return r.identity === identity ? r : { ok: false, reason: "center credential identity changed — this request belongs to the previous identity's state bin and is not sent" };
+        },
+        health: () => source.health(),
+    };
+}
+//# sourceMappingURL=center-credential.js.map

package/dist/config-catalog.js

@@ -74,7 +74,7 @@ export const CONFIG_CATALOG = [
     r("ATTACHMENT_ORPHAN_GRACE_MS", "limitsHttp", "number", "附件孤儿对象 GC 宽限(ms;0=关本腿,坏值回默认+warn)", { staticDefault: "3600000", danger: DATA, center: cLimits("attachmentOrphanGraceMs") }),
     r("ATTACHMENT_UNBOUND_TTL_MS", "limitsHttp", "number", "未绑定附件的 TTL(ms)", { staticDefault: String(24 * 3600 * 1000), danger: DATA, configKey: "attachmentUnboundTtlMs", center: cLimits("attachmentUnboundTtlMs") }),
     r("AUTH_BRIDGE_AUDIENCE", "auth", "string", "registry SSO-JWT 验签期望 aud", { danger: SEC }),
-    r("AUTH_BRIDGE_ISSUER", "auth", "url", "registry SSO-JWT issuer(auth bridge 的开关之一;S-591 起也是托管形判据的一条证据 —— 只认显式值,不认 center 回退)", { danger: SEC, derivedDefaultNote: "缺席 ⇒ 桥的装配处回退到 configCenter.baseUrl(配了 center 即默认开桥);但**托管判据不读那条回退**(fleet 管理轴 ≠ 租户轴)", configKey: "authBridgeIssuer" }),
+    r("AUTH_BRIDGE_ISSUER", "auth", "url", "registry SSO-JWT issuer(auth bridge 的开关之一;S-671 / C-R100 ① 起**不是**托管证据 —— 多租户只认 REQUIRE_PRINCIPAL=true)", { danger: SEC, derivedDefaultNote: "缺席 ⇒ 桥的装配处回退到 configCenter.baseUrl(配了 center 即默认开桥);显式值与回退值在托管判定上同判(都不算)", configKey: "authBridgeIssuer" }),
     r("AUTH_BRIDGE_JWKS_URL", "auth", "url", "registry SSO-JWT 的 JWKS 地址(缺省从 issuer 派生)", { danger: SEC }),
     r("AUTONOMY", "auth", "enum", "运维 autonomy 模式,tighten-only 叠到每个 TaskSpec(read-only/plan ⇒ 只读手,ask ⇒ 恒 shellGate);center 腿热且 non-sticky", { danger: SEC, enumValues: AUTONOMY_MODES, configKey: "autonomy", center: cGov("autonomy") }),
     r("AUTO_MODE_CLASSIFIER_FALLBACK", "approval", "enum", "auto 分类器席答不出裁决时的梯子(main=主模型代判 / none=只留分类器那一级,整条拒)", { enumValues: ["main", "none"], danger: SEC, derivedDefaultNote: "未设/空串 ⇒ 不铸键,跟随引擎缺省 main(core 7.18.0 起;空串按未设,与其余词表旋钮同判);none = 7.77.0 及以前的行为逐字;词表外的值启动期拒启。权限轴放宽,升级须知见 DEPLOY-PREREQS", configKey: "autoModeClassifierFallback" }),
@@ -245,14 +245,14 @@ export const CONFIG_CATALOG = [
     r("MEMORY_SYNC_MAX_PUSH_ENTRIES", "memory", "number", "TOC 同步单轮 push 条数帽(设了必须 ≥1 整数)", { derivedDefaultNote: "缺席 ⇒ 键缺席,core 默认" }),
     r("MEMORY_SYNC_SCOPE", "memory", "string", "TOC 同步 scope 覆写", { derivedDefaultNote: "缺席 ⇒ 从 MEMORY_SCOPE 铸 user 盘键" }),
     r("MEMORY_SYNC_TOKEN", "memory", "secret", "TOC 同步中心面的 Bearer(URL 设了它必须在,半配拒启)", { danger: SEC }),
-    r("MEMORY_SYNC_URL", "memory", "url", "TOC 同步中心地址(设了=开;file 记忆形专用,DB 后端配了拒启)"),
+    r("MEMORY_SYNC_URL", "memory", "url", "TOC 同步中心地址(设了=开;file 记忆形专用,DB 后端配了拒启;同步只覆盖一层 ⇒ 单用户任务不按项目键控、写家落全局层 MEMORY_SCOPE(S-512 让位,启动通知 `memory_project_scope_yields_to_sync`))"),
     r("METRICS_TOKEN", "observability", "secret", "/metrics 只读令牌", { danger: SEC }),
     r("MINIO_ACCESS_KEY", "store", "secret", "对象存储 access key(快照 blob/leader 工作区/公链签发共用)", { danger: SEC }),
     r("MINIO_BUCKET", "store", "string", "leader 工作区快照桶", { derivedDefaultNote: "缺席 ⇒ workspaces" }),
     r("MINIO_ENDPOINT", "store", "url", "对象存储 endpoint(三键齐 ⇒ 快照 blob 走 MinIO,否则 SQL 行)", { danger: DATA }),
     r("MINIO_REGION", "store", "string", "对象存储 region"),
     r("MINIO_SECRET_KEY", "store", "secret", "对象存储 secret key", { danger: SEC }),
-    r("MODEL_API_KEY", "modelPlane", "secret", "网关腿共享 API key(per-model 覆写在 center 侧)", { danger: [...SEC, ...BILL] }),
+    r("MODEL_API_KEY", "modelPlane", "secret", "网关腿共享 API key(per-model 覆写在 center 侧;S-623:只与 MODEL_GATEWAY_BASEURL 配对 —— 网关未设时不装载、不发往任何路由,启动通知 `model_gateway_key_unpaired`)", { danger: [...SEC, ...BILL] }),
     r("MODEL_AUTO_COMPACT_TOKENS", "modelPlane", "number", "主槽 dual-window 触发阈(1M 窗不再隐式 967000,缺席则用普通触发几何)", { derivedDefaultNote: "缺席 ⇒ 不铸键(core W-33000 几何)" }),
     r("MODEL_CASCADE_LADDER", "modelPlane", "csv", "质量门级联梯(目录名 cheapest→strongest;opt-in per-task cascade:true)", { danger: BILL, configKey: "cascadeLadder" }),
     r("MODEL_CB_COOLDOWN_MS", "modelPlane", "number", "熔断冷却窗(ms)", { staticDefault: String(RESILIENCE_DEFAULTS.cooldownMs.value) }),
@@ -286,8 +286,8 @@ export const CONFIG_CATALOG = [
     r("MODEL_EXTRA_BODY", "modelPlane", "opaque", "生成参数直通 JSON(top_k/logit_bias 等;必须静态 —— 前缀缓存键序)", { danger: SEC }),
     r("MODEL_FIRST_TOKEN_TIMEOUT_MS", "modelPlane", "number", "首 token 超时(ms;0=关 —— 开流不吐字的唯一看门狗;自托管长 prefill 后端按此档留足)", { staticDefault: String(RESILIENCE_DEFAULTS.firstTokenTimeoutMs.value) }),
     r("MODEL_FREQUENCY_PENALTY", "modelPlane", "number", "frequency_penalty 直通(压过 EXTRA_BODY 同键)"),
-    r("MODEL_GATEWAY_BASEURL", "modelPlane", "url", "openai 兼容网关 base URL(默认 localhost 占位 —— 公开分发不烤内网坐标;S-475:带 userinfo 拒启,机读码 `config.gateway_url_userinfo` —— WHATWG 禁止用带凭据的 URL 构造 fetch Request,凭据放 MODEL_API_KEY;S-483:解析不动/不透明形拒启,机读码 `config.model_route_url_invalid`;S-514:带 `#fragment` 拒启,机读码 `config.model_route_url_fragment`)", { staticDefault: "http://127.0.0.1:8000/v1", configKey: "gatewayBaseUrl", center: cModels("models[].baseUrl") }),
-    r("MODEL_GATEWAY_FALLBACK_URLS", "modelPlane", "url", "网关故障转移地址表(CSV;S-475:**逐项**判 userinfo,任一项带 ⇒ 拒启,机读码 `config.gateway_url_userinfo`;S-483:逐项判可解析性,机读码 `config.model_route_url_invalid`;S-514:**逐项**判 `#fragment`,机读码 `config.model_route_url_fragment`)", { configKey: "gatewayFallbackUrls" }),
+    r("MODEL_GATEWAY_BASEURL", "modelPlane", "url", "openai 兼容网关 base URL(S-623:**无出厂缺省** —— 配置能派发到的每条 openai 兼容路由都必须解析到显式端点(条目自己的 baseUrl,或本键),否则拒启 / 热路径整批拒,机读码 `config.model_route_endpoint_missing`,拒因点名条目并给出本机写法 `MODEL_GATEWAY_BASEURL=<本机网关>/v1`;anthropic 单路由部署不设本键合法;S-475:带 userinfo 拒启,机读码 `config.gateway_url_userinfo` —— WHATWG 禁止用带凭据的 URL 构造 fetch Request,凭据放 MODEL_API_KEY;S-483:解析不动/不透明形拒启,机读码 `config.model_route_url_invalid`;S-514:带 `#fragment` 拒启,机读码 `config.model_route_url_fragment`)", { derivedDefaultNote: "缺席 ⇒ 本部署没有网关(不铸键);有 openai 路由落不到端点 ⇒ 拒启", configKey: "gatewayBaseUrl", center: cModels("models[].baseUrl") }),
+    r("MODEL_GATEWAY_FALLBACK_URLS", "modelPlane", "url", "网关故障转移地址表(CSV;S-623:主网关 MODEL_GATEWAY_BASEURL 未设而本键设了 ⇒ 拒启,机读码 `config.gateway_fallback_without_primary` —— 备用是主网关的镜像;S-475:**逐项**判 userinfo,任一项带 ⇒ 拒启,机读码 `config.gateway_url_userinfo`;S-483:逐项判可解析性,机读码 `config.model_route_url_invalid`;S-514:**逐项**判 `#fragment`,机读码 `config.model_route_url_fragment`)", { configKey: "gatewayFallbackUrls" }),
     r("MODEL_ID", "modelPlane", "string", "主模型 id(3.0.0 起无出厂缺省,缺 ⇒ 拒启指路)", { configKey: "model", resolve: (c) => c.model.id, center: cModels("models[].id") }),
     r("MODEL_IDLE_TIMEOUT_MS", "modelPlane", "number", "流中静默看门狗(ms;0=关)", { staticDefault: String(RESILIENCE_DEFAULTS.idleTimeoutMs.value) }),
     r("MODEL_MAX_TOKENS", "modelPlane", "number", "主模型输出上限", { derivedDefaultNote: "缺席 ⇒ min(32000, contextWindow)", resolve: (c) => c.model.maxTokens ?? null, center: cModels("models[].maxTokens") }),
@@ -394,7 +394,8 @@ export const CONFIG_CATALOG = [
     r("SEMA_PIP_INDEX", "orchestration", "url", "SANDBOX_PKG_SOURCE=custom 的显式 pip index 地址"),
     r("SEMA_REGISTRY_ADMIN_TOKEN", "integrations", "secret", "写 center 的管理凭证(仅 boot 上报执行公钥用;刻意不入 ServiceConfig —— 不进 configHash/日志面)", { danger: SEC, scope: "bootstrap-only" }),
     r("SEMA_REGISTRY_DRY_RUN", "integrations", "boolean", "center 腿 dry-run(拉而不应用)", { staticDefault: "false" }),
-    r("SEMA_REGISTRY_TOKEN", "integrations", "secret", "center 拉取凭据", { danger: SEC }),
+    r("SEMA_REGISTRY_TOKEN", "integrations", "secret", "center 拉取凭据(值形;与 SEMA_REGISTRY_TOKEN_FILE 二选一,都设=拒启)", { danger: SEC }),
+    r("SEMA_REGISTRY_TOKEN_FILE", "integrations", "path", "center 拉取凭据文件(每条中心请求都重读 ⇒ 轮换 / 换账号不重启;与 SEMA_REGISTRY_TOKEN 二选一,都设=拒启;文件不可读=响亮 + 健康态 unreadable,不当作无凭证)", { danger: SEC }),
     r("SEMA_REGISTRY_URL", "integrations", "url", "sema-registry 地址(设了=remote 配置源开关)"),
     r("SEMA_REGISTRY_WORKER", "integrations", "string", "本 worker 在 center 的名字(per-worker effective)"),
     r("SEMA_UV_INDEX", "orchestration", "url", "SANDBOX_PKG_SOURCE=custom 的显式 uv index 地址"),

package/dist/config-center/apply-effective.js

@@ -7,6 +7,7 @@ import { projectCollabToWorkflows, registerCollabWorkflows } from "../capabiliti
 import { stageLimits } from "./stage-limits.js";
 import { BATCH1_LIMIT_KEYS } from "./hot-keys-registry.js";
 import { buildDisplaySafeUrl } from "../trace/redact.js";
+import { crossInvariant } from "../config-invariants.js";
 const charsPerTokenOf = (v) => (typeof v === "number" && Number.isFinite(v) && v > 0 ? v : undefined);
 function envDerivedModel(config) {
     const m = config.envModel;
@@ -203,7 +204,7 @@ function stageEffective(config, eff, logger, opts) {
                 if (ok)
                     logger?.warn("sema_registry_model_base_url", { model: m.name, baseUrl: buildDisplaySafeUrl(rawBaseUrl), hint: "registry-directed gateway override — this model's key authenticates AGAINST THIS URL" });
                 else {
-                    logger?.warn("sema_registry_model_base_url_rejected", { model: m.name, baseUrl: buildDisplaySafeUrl(String(rawBaseUrl)), hint: "only http(s) URLs are honored — falling back to the boot-env gateway" });
+                    logger?.warn("sema_registry_model_base_url_rejected", { model: m.name, baseUrl: buildDisplaySafeUrl(String(rawBaseUrl)), hint: "only http(s) URLs are honored — falling back to the deployment gateway (MODEL_GATEWAY_BASEURL); with none declared the whole candidate is refused (model-route-endpoint)" });
                     safeUrl = undefined;
                 }
             }
@@ -264,6 +265,11 @@ function stageEffective(config, eff, logger, opts) {
         const activeTiers = resolveActiveTiers(eff.models) ?? {};
         const picked = resolveDefaultModelName(eff, (n) => models[n] !== undefined, enabled[0].name, (source, name) => logger?.warn("sema_registry_default_dangling", { source, name, hint: "explicit default names a model that is not in the enabled catalog — falling to the next source" }));
         models.default = models[picked.name];
+        const endpointRefusal = crossInvariant("model-route-endpoint").check({ live: config, next: { ...config, models } });
+        if (endpointRefusal !== undefined) {
+            throw new Error(`candidate model plane refused whole (cross-invariant model-route-endpoint): ${endpointRefusal} ` +
+                "The current generation keeps serving; the candidate is re-judged on the next pull.");
+        }
         const atModelAllowlist = stageAtModelAllowlist(eff.models?.atModelAllowlist, models, logger);
         modelPlane = {
             models,

package/dist/config-center/center-request.d.ts

@@ -0,0 +1,60 @@
+import { type CenterCredentialSource } from "../center-credential.js";
+export declare const SCHEMA_MAJOR_HEADER = "x-sema-schema-major";
+/** 已装 settings-schema 的 major(机器派生)。版本号不成形 ⇒ 模块装载即抛(装坏了的包不该带着一个猜出来的
+ *  major 去跟中心协商 wire 形)。 */
+export declare const SETTINGS_SCHEMA_MAJOR: string;
+/** 一个中心端点 = 基址 + 凭证来源(`ServiceConfig.configCenter` 结构上满足)。 */
+export interface CenterEndpoint {
+    readonly baseUrl: string;
+    readonly credential: CenterCredentialSource;
+}
+/** 中心路由闭集。 */
+export type CenterRoute = {
+    readonly kind: "effective";
+    readonly worker?: string | undefined;
+    readonly principal?: string | undefined;
+} | {
+    readonly kind: "skill-content";
+    readonly contentHash: string;
+} | {
+    readonly kind: "prompt-artifact";
+    readonly digest: string;
+} | {
+    readonly kind: "prompt-blob";
+    readonly digest: string;
+} | {
+    readonly kind: "fleet-leases";
+} | {
+    readonly kind: "fleet-instances";
+} | {
+    readonly kind: "fleet-usage";
+} | {
+    readonly kind: "execution-keys";
+};
+/**
+ * 拉取视图(`/api/config/effective`)查询串的**唯一拼装点**:`?principal=`(per-principal 视图)、`?worker=`
+ * (worker 作用域视图;对 `wpt_<self>` 是授权必需,对全量令牌无害)。
+ * [ref] E-15:执行体绑 scope 的参数将来加在这里(契约字段 settings-schema 6.0.0;本批不铸)。
+ */
+export declare function pullViewQuery(view: {
+    readonly worker?: string | undefined;
+    readonly principal?: string | undefined;
+}): string;
+export interface CenterRequestInit {
+    readonly method?: "GET" | "POST" | "DELETE";
+    /** JSON 请求体(在场 ⇒ `content-type: application/json`)。 */
+    readonly json?: unknown;
+    /** 条件请求(`if-none-match`)。 */
+    readonly etag?: string | undefined;
+    readonly timeoutMs: number;
+    readonly fetchImpl?: typeof fetch;
+}
+/**
+ * 对中心发一条请求。返回响应与**这次请求所用凭证的身份**(调用方据此给拿回来的候选打分箱标记,
+ * 见 `boot/config-center.ts` 的 LKG / prompt 状态分箱)。
+ */
+export declare function centerFetch(center: CenterEndpoint, route: CenterRoute, init: CenterRequestInit): Promise<{
+    res: Response;
+    identity: string;
+}>;
+//# sourceMappingURL=center-request.d.ts.map

package/dist/config-center/center-request.js

@@ -0,0 +1,71 @@
+import settingsSchemaPackage from "@sema-agent/settings-schema/package.json" with { type: "json" };
+import { CenterCredentialUnavailableError } from "../center-credential.js";
+export const SCHEMA_MAJOR_HEADER = "x-sema-schema-major";
+export const SETTINGS_SCHEMA_MAJOR = (() => {
+    const version = settingsSchemaPackage.version;
+    const m = /^(\d+)\.\d+\.\d+/.exec(version);
+    if (m === null)
+        throw new Error(`cannot derive ${SCHEMA_MAJOR_HEADER}: @sema-agent/settings-schema package.json has version ${JSON.stringify(version)}`);
+    return m[1];
+})();
+export function pullViewQuery(view) {
+    const parts = [];
+    if (view.principal !== undefined)
+        parts.push(`principal=${encodeURIComponent(view.principal)}`);
+    if (view.worker)
+        parts.push(`worker=${encodeURIComponent(view.worker)}`);
+    return parts.length === 0 ? "" : `?${parts.join("&")}`;
+}
+function contentRoot(kind) {
+    switch (kind) {
+        case "user-jwt":
+            return "/api/v1/me";
+        case "pull-token":
+        case "none":
+            return "/api/config";
+    }
+}
+function routePath(route, kind) {
+    switch (route.kind) {
+        case "effective":
+            return `/api/config/effective${pullViewQuery(route)}`;
+        case "skill-content":
+            return `${contentRoot(kind)}/skills/content/${encodeURIComponent(route.contentHash)}`;
+        case "prompt-artifact":
+            return `${contentRoot(kind)}/prompts/epoch-artifacts/${encodeURIComponent(route.digest)}`;
+        case "prompt-blob":
+            return `${contentRoot(kind)}/prompts/blobs/${encodeURIComponent(route.digest)}`;
+        case "fleet-leases":
+            return "/api/fleet/leases";
+        case "fleet-instances":
+            return "/api/fleet/instances";
+        case "fleet-usage":
+            return "/api/fleet/usage";
+        case "execution-keys":
+            return "/api/config/execution-keys";
+    }
+}
+export async function centerFetch(center, route, init) {
+    const scheme = new URL(center.baseUrl).protocol;
+    if (scheme !== "http:" && scheme !== "https:")
+        throw new Error(`SEMA_REGISTRY_URL must be http(s), got "${scheme}"`);
+    const cred = center.credential.read();
+    if (!cred.ok)
+        throw new CenterCredentialUnavailableError(cred.reason);
+    const headers = { [SCHEMA_MAJOR_HEADER]: SETTINGS_SCHEMA_MAJOR };
+    if (cred.kind !== "none")
+        headers.authorization = `Bearer ${cred.bearer}`;
+    if (init.json !== undefined)
+        headers["content-type"] = "application/json";
+    if (init.etag)
+        headers["if-none-match"] = init.etag;
+    const url = `${center.baseUrl.replace(/\/+$/, "")}${routePath(route, cred.kind)}`;
+    const res = await (init.fetchImpl ?? fetch)(url, {
+        method: init.method ?? "GET",
+        headers,
+        ...(init.json !== undefined ? { body: JSON.stringify(init.json) } : {}),
+        signal: AbortSignal.timeout(init.timeoutMs),
+    });
+    return { res, identity: cred.identity };
+}
+//# sourceMappingURL=center-request.js.map

package/dist/config-center/facade.d.ts

@@ -15,7 +15,8 @@
  *     (core 1.45), so each model/cascade-rung authenticates with its own upstream key.
  *
  * Per-model `baseUrl` IS transported (a catalog model may live on a different gateway;
- * core brain honors model.baseUrl, absent = "" = boot-env endpoint).
+ * core brain honors model.baseUrl, absent = "" = the deployment gateway `MODEL_GATEWAY_BASEURL`; S-623: with no gateway
+ * declared, a candidate carrying such an openai-lane entry is refused whole — cross-invariant `model-route-endpoint`).
  *
  * Hot-reload status (复审 2026-07-29 P1-11 — 亲读判定,取代此处旧的 "models/roles are restart-to-apply"
  * TODO, which went stale when `mutateInPlace` landed):

package/dist/config-center/http-client.d.ts

@@ -1,6 +1,7 @@
 import { type EffectiveReadWarning, type EntitlementRuntimeCaps } from "@sema-agent/settings-schema";
 import type { ScenarioRuling } from "../capabilities/scenarios.js";
 import type { EffectiveConfig, ExecutionRuling } from "./types.js";
+import { type CenterEndpoint } from "./center-request.js";
 /** GET the effective config (Bearer + ETag). null = 304 (unchanged). Throws on transport/HTTP error, and on a
  *  payload that is not an effective config at all(非对象 / version 非有限数 / gate 域坏形——[ref] 裁B)。
  *  `domainErrors`:坏 catalog 域(schema default 已落)逐域单列——与本地腿 `FetchEffectiveResult` 同键同义,
@@ -12,8 +13,11 @@ import type { EffectiveConfig, ExecutionRuling } from "./types.js";
  *  `legacy-governance-lifted` 铸出来,理由逐字写在 `legacyGovernanceFromRuntime` 的 SUNSET 注里:
  *  「关窗的前提是有人知道它还开着」。两条读腿各返一份原流,那句话在本仓才成立。
  *  🔐 原流的 `error` 字段**未经** `redactConfigError`(那道脱敏挂在真正进日志流的 `domainErrors` 产出边界上)
- *  —— 任何把本键路由进结构化日志/审计流的消费者必须自己先脱敏。 */
-export declare function fetchEffective(baseUrl: string, token: string, etag: string | undefined, fetchImpl?: typeof fetch, worker?: string): Promise<{
+ *  —— 任何把本键路由进结构化日志/审计流的消费者必须自己先脱敏。
+ *
+ *  `credentialIdentity`(S-651 / [ref] E-15):这次拉取所用凭证的身份(`center-credential.ts`)。调用方拿它给
+ *  候选打分箱标记 —— LKG / prompt 活动状态只许落进**拉到它的那个身份**的箱。 */
+export declare function fetchEffective(center: CenterEndpoint, etag: string | undefined, fetchImpl?: typeof fetch, worker?: string): Promise<{
     effective: EffectiveConfig;
     etag?: string;
     domainErrors?: Array<{
@@ -21,6 +25,7 @@ export declare function fetchEffective(baseUrl: string, token: string, etag: str
         error: string;
     }>;
     readWarnings: readonly EffectiveReadWarning[];
+    credentialIdentity: string;
 } | null>;
 /**
  * [ref] §K (core 1.157 `RunnerDeps.runtimeCapsResolver`) — GET the PER-PRINCIPAL runtime
@@ -41,7 +46,7 @@ export declare function fetchEffective(baseUrl: string, token: string, etag: str
  * fail-closes (core then DENIES the optional `allowWorkflows` cap — an outage must never silently GRANT). ETag is
  * content-hashed (`p-<hash>`); an `if-none-match` poll is cheap. Mirrors `fetchEffective` (Bearer + 8s + scheme guard).
  */
-export declare function fetchPrincipalCaps(baseUrl: string, token: string, principal: string, etag: string | undefined, fetchImpl?: typeof fetch, worker?: string): Promise<{
+export declare function fetchPrincipalCaps(center: CenterEndpoint, principal: string, etag: string | undefined, fetchImpl?: typeof fetch, worker?: string): Promise<{
     runtimeCaps: EntitlementRuntimeCaps | null;
     configured: boolean;
     scenario?: ScenarioRuling;
@@ -68,7 +73,7 @@ export declare function fetchPrincipalCaps(baseUrl: string, token: string, princ
  * 段在场 ⇒ 原值(空表 = 取数成功的负结果,与缺席不同格)。条件请求不适用(本腿恒不带 etag),
  * 因此 304 在传输层就是 fail-loud。
  */
-export declare function fetchPrincipalOrgMemory(baseUrl: string, token: string, principal: string, fetchImpl?: typeof fetch, worker?: string): Promise<unknown>;
+export declare function fetchPrincipalOrgMemory(center: CenterEndpoint, principal: string, fetchImpl?: typeof fetch, worker?: string): Promise<unknown>;
 /** An HTTP error from a config-center fetch that carries the response status so callers can branch on it
  *  (e.g. translate a 404 to "unknown hash → undefined") WITHOUT parsing the message string. */
 export declare class ConfigCenterHttpError extends Error {
@@ -76,18 +81,21 @@ export declare class ConfigCenterHttpError extends Error {
     constructor(message: string, status: number);
 }
 /**
- * Fetch one skill's body by content hash (`GET /api/config/skills/content/<hash>`, Bearer) and VERIFY its
+ * Fetch one skill's body by content hash (`GET <content root>/skills/content/<hash>`, Bearer; the root is
+ * `/api/v1/me` for a user-JWT credential and `/api/config` otherwise — center-request.ts) and VERIFY its
  * sha256 matches the manifest hash (integrity + rewrite check). The content is immutable per hash, so the
  * caller caches by hash and never re-fetches an unchanged skill. Throws a {@link ConfigCenterHttpError}
  * (carrying `.status`) on an HTTP error — INCLUDING 404 — or a plain Error on hash mismatch. Callers that
  * want "unknown hash → undefined" parity with the local backend inspect `.status === 404` and swallow it;
  * the legacy `applyCenterSkills` path keeps treating every throw as "skip this skill, keep baseline".
  */
-export declare function fetchSkillContent(baseUrl: string, token: string, contentHash: string, fetchImpl?: typeof fetch): Promise<string>;
+export declare function fetchSkillContent(center: CenterEndpoint, contentHash: string, fetchImpl?: typeof fetch): Promise<string>;
 /** [ref]b / [ref]① — §9.4 by-digest 补拉二函(fetchSkillContent 同姿势:HTTP+Bearer+8s 超时+
  *  消费侧自证)。artifact=envelope JSON(验真=调用方过 core verifyPromptArtifact,canonical 重算——
  *  本函数只做传输与形读,不超范围解释);blob=段文本 raw-byte(sha256 逐位自证,fetchSkillContent 同款)。
- *  digest 参数收带前缀/裸 hex 两形([ref] 参数口径)。 */
-export declare function fetchPromptArtifact(baseUrl: string, token: string, artifactDigest: string, fetchImpl?: typeof fetch): Promise<unknown>;
-export declare function fetchPromptBlob(baseUrl: string, token: string, contentDigest: string, fetchImpl?: typeof fetch): Promise<string>;
+ *  digest 参数收带前缀/裸 hex 两形([ref] 参数口径)。路径根按凭证种类(B-5,center-request.ts)。
+ *  ⚠️ 现状(S-651 取证车MS 总表第 8 条):`fetchPromptBlob` 在 `src/` 里**没有生产调用点**,真走得到的内容
+ *  拉取只有 skill 正文与 prompt 产物两条;它与另两条共用同一张路由表,本批不为它新接线。 */
+export declare function fetchPromptArtifact(center: CenterEndpoint, artifactDigest: string, fetchImpl?: typeof fetch): Promise<unknown>;
+export declare function fetchPromptBlob(center: CenterEndpoint, contentDigest: string, fetchImpl?: typeof fetch): Promise<string>;
 //# sourceMappingURL=http-client.d.ts.map