@sema-agent/server 7.98.0 → 7.100.0

package/dist/capabilities/center-prompts.js

@@ -55,7 +55,7 @@ export async function applyCatalogToSource(source, next, prev, log, phase) {
             log.warn("center_prompts_catalog_apply_failed", { phase, code: r.code, reason: r.reason, note: "validate passed but the source apply failed (disk/state) — declaration axis and built-ins unaffected; candidate unchanged; the transition retries on the next refresh tick" });
             return false;
         }
-        if (prev?.catalog || source.current?.() !== undefined) {
+        if (prev?.catalog || source.current?.() !== undefined || source.persistedActive?.() === true) {
             await source.applyDisabled(`${phase}:catalog-absent`);
             log.info("center_prompts_catalog_disabled", { phase, note: "catalog axis withdrawn — core candidate cleared (does not revive offline)" });
         }

package/dist/capabilities/hands-lane.js

@@ -18,8 +18,9 @@ export const HANDS_BAND_TOOL_NAMES = Object.freeze([
     "Monitor",
     "EnterWorktree",
     "ExitWorktree",
+    "ListAgents",
 ].filter((n, i, all) => !RETIRED_TOOL_NAMES.has(n) && all.indexOf(n) === i));
-export const HANDS_DUAL_USE_TOOL_NAMES = Object.freeze(["TaskOutput", "TaskStop", "SendMessage", "AgentTranscript"]);
+export const HANDS_DUAL_USE_TOOL_NAMES = Object.freeze(["TaskOutput", "TaskStop", "SendMessage", "AgentTranscript", "ListAgents"]);
 export const HANDS_EXCLUSIVE_TOOL_NAMES = Object.freeze(HANDS_BAND_TOOL_NAMES.filter((n) => !HANDS_DUAL_USE_TOOL_NAMES.includes(n)));
 export function handsDenyPolicy() {
     return createAllowDenyPolicy({ deny: [...HANDS_EXCLUSIVE_TOOL_NAMES] });

package/dist/capabilities/scenarios.js

@@ -5,7 +5,7 @@ import { parseRepo, repoToolsFor } from "./repo-tools.js";
 import { createCouncilTool, clampRounds } from "./code-review-council.js";
 import { stablePrompt } from "./prompt.js";
 import { createDiscussionTools, discussionCoordinatorPrompt, getTeam, teamNames } from "./team.js";
-import { createWebSearchBackend, webSearchConfigFromSettings } from "../plugins/web-search.js";
+import { createWebSearchBackend, judgeRequestWebSearch } from "../plugins/web-search.js";
 import { skillsForScenario } from "./skills.js";
 import { pickHandsRunner } from "./hands-lane.js";
 export { SEMA_IDENTITY } from "./prompts/identity.js";
@@ -31,12 +31,25 @@ export function codePromptProvider(brand) {
 function subRunnerFor(deps, hands) {
     return pickHandsRunner(hands, { full: deps.subRunner, handsless: deps.handslessSubRunner });
 }
+function requestWebSearchBackend(verdict, deployment, logger) {
+    switch (verdict.kind) {
+        case "absent":
+            return deployment;
+        case "honored":
+            return createWebSearchBackend(verdict.config);
+        case "malformed":
+            logger?.warn("web_search_settings_unusable", {
+                issue: verdict.issue,
+                note: "this request carries a settings.webSearch block that is not well-formed (stored before the submit-time check, or assembled without it); WebSearch is not mounted for this call rather than sending the searches to a different backend",
+            });
+            return undefined;
+    }
+}
 export function buildScenarios(deps) {
     const defaultScenario = (req, _principal, ctx) => {
-        const reqWebSearch = deps.requirePrincipal !== true
-            ? webSearchConfigFromSettings(req?.settings?.webSearch)
-            : undefined;
-        const webSearch = reqWebSearch ? createWebSearchBackend(reqWebSearch) : deps.webSearch;
+        const webSearch = requestWebSearchBackend(deps.requirePrincipal !== true
+            ? judgeRequestWebSearch(req?.settings?.webSearch)
+            : { kind: "absent" }, deps.webSearch, deps.logger);
         return {
             tools: [
                 nowTool(),

package/dist/capabilities/tool-defer.d.ts

@@ -18,8 +18,8 @@
  *    在本仓缺省场景下那会连 Agent 与 Task 四件一起卷进候选(与 CC 姿态相反),所以我们**刻意不开**;
  *    🔴 该判断在 core 5.40.0 / 7.15.0 上**逐字仍成立**(亲验):两次收窄动的都是「候选集是谁」,而
  *    Agent / Task 四件是 **caller spec 工具**,收窄后照样在候选池里 —— 不开 auto 的理由没有被消解。
- *    我方**从不接线**这个座:全树零 `RunnerDeps.deferMode` 赋值(`deferModelPlane` 是 config-center 的
- *    同形近名,与本轴无关)。机器钉见 test/tool-defer.test.ts 的 [ref] 件⑤ 格 —— 这条「零接线」正是本仓
+ *    我方**从不接线**这个座:全树零 `RunnerDeps.deferMode` 赋值(config-center 曾有同形近名 `deferModelPlane`,
+ *    与本轴无关,已于 S-668 波 0 退役)。机器钉见 test/tool-defer.test.ts 的 [ref] 件⑤ 格 —— 这条「零接线」正是本仓
  *    在两个 core 世代之间行为逐字不变的**全部**依据,所以它值一根钉而不只是一句注。
  *  - per-tool `ToolSpec.defer:true` 是本 helper 施加的那一位。**7.15.0 起它是一次「进候选集」的声明,
  *    不再是「一定占位」的保证** —— 长尾集单独一只(下面实测 ≈842 字符)远在阈值之下,于是这根旋钮在

package/dist/center-credential.d.ts

@@ -0,0 +1,112 @@
+/** 凭证种类闭集。新增一个种类 = 本文件与 `config-center/center-request.ts` 的穷举 switch 当场编译红。 */
+export type CenterCredentialKind = "pull-token" | "user-jwt" | "none";
+/** 凭证在哪里声明(env 形带值 —— 只在本模块内流转)。 */
+export type CenterCredentialDeclaration = {
+    readonly from: "env";
+    readonly token: string;
+} | {
+    readonly from: "file";
+    readonly path: string;
+} | {
+    readonly from: "absent";
+};
+/** 声明形的**非秘密**投影(进日志 / 拒因 / 未来的 caps 读面):env 形不带值。 */
+export type CenterCredentialOrigin = {
+    readonly from: "env";
+} | {
+    readonly from: "file";
+    readonly path: string;
+} | {
+    readonly from: "absent";
+};
+/** 一次取值的结果。`ok:false` 只有文件形会出现(env / absent 形的取值恒成功)。 */
+export type CenterCredentialRead = {
+    readonly ok: true;
+    readonly kind: "pull-token";
+    readonly bearer: string;
+    readonly identity: string;
+    readonly workerScoped: boolean;
+} | {
+    readonly ok: true;
+    readonly kind: "user-jwt";
+    readonly bearer: string;
+    readonly identity: string;
+} | {
+    readonly ok: true;
+    readonly kind: "none";
+    readonly identity: string;
+} | {
+    readonly ok: false;
+    readonly reason: string;
+};
+/** 健康态:最近一次取值的结果(caps `leaseHealth` 之类的读面读它,不自己再判)。 */
+export type CenterCredentialHealth = {
+    readonly state: "ok";
+} | {
+    readonly state: "unreadable";
+    readonly reason: string;
+    readonly since: number;
+    readonly failures: number;
+};
+export interface CenterCredentialSource {
+    /** 声明形(非秘密):`{from:"file", path}` 进日志与拒因用。 */
+    readonly origin: CenterCredentialOrigin;
+    /** 装配判据:声明了凭证(env 值非空 / 文件路径在场)。**按声明装,不按内容装** —— 文件此刻不可读也算声明了。 */
+    readonly declared: boolean;
+    /** 每次出站请求调用一次;文件形每次都读文件。 */
+    read(): CenterCredentialRead;
+    health(): CenterCredentialHealth;
+}
+/** 凭证文件此刻不可读 / 为空。中心请求装配点(`center-request.ts`)取值失败时抛它,各消费方按自己的
+ *  失败臂处置(拉配置保 LKG、caps fail-closed、租约走「鉴权失败」响亮臂 …),**不发一个空 bearer 出去**。 */
+export declare class CenterCredentialUnavailableError extends Error {
+    readonly reason: string;
+    constructor(reason: string);
+}
+export declare const CENTER_TOKEN_ENV = "SEMA_REGISTRY_TOKEN";
+export declare const CENTER_TOKEN_FILE_ENV = "SEMA_REGISTRY_TOKEN_FILE";
+/**
+ * 读两个声明键。两个都非空 ⇒ throw(boot 拒启,拒因点名二选一)。空串 = 未设(与 7.98.0 之前
+ * `SEMA_REGISTRY_TOKEN || ""` 的读法一致)。文件路径在这里解析成绝对路径(之后 cwd 变了也读同一个文件)。
+ */
+export declare function readCenterCredentialDeclaration(env?: NodeJS.ProcessEnv): CenterCredentialDeclaration;
+/** 拉取令牌形的身份 = worker(拉取令牌代表 worker,不是人)。种类判别与 formatVersion 1 LKG 的一次性迁移
+ *  (`config-lkg.ts` `migrateV1Lkg`:v1 信封只记 worker,只有这一形的身份推得出来)共用这一只。 */
+export declare function pullTokenIdentity(worker: string | undefined): string;
+/**
+ * 凭证来源工厂(活对象:文件形每次取值读盘并记健康态)。`worker` = `SEMA_REGISTRY_WORKER`(拉取令牌形的身份)。
+ * `readFile` 只为测试注入。
+ */
+export declare function createCenterCredentialSource(declaration: CenterCredentialDeclaration, worker: string | undefined, deps?: {
+    readFile?: (path: string) => string;
+    now?: () => number;
+}): CenterCredentialSource;
+/** 需要作用域 worker 的拉取令牌(`wpt_<self>`)却没配 `SEMA_REGISTRY_WORKER` ⇒ 中心对 per-principal caps
+ *  逐次 403(caps fail-closed 拒全部 workflow)。boot 期一次性诊断用;判据只读本模块的种类判别。 */
+export declare function scopedTokenNeedsWorker(read: CenterCredentialRead, worker: string | undefined): boolean;
+/**
+ * [ref] E-15 —— 按「worker + 凭证身份」分箱的**唯一键形**(LKG 文件名、prompt 活动状态目录共用)。
+ * 两段都取摘要:worker 名 / 身份任意字节都成单段路径,无 dot-segment,无撞形(codex-5 当年给 prompt 状态
+ * 目录定的姿势,本批推广到 LKG)。
+ */
+export declare function centerStateBin(worker: string | undefined, identity: string): string;
+/** 此刻凭证的身份(每次现读);文件形此刻不可读 ⇒ `undefined`(身份未知)。「我现在是谁」只有这一只读法。 */
+export declare function credentialIdentityNow(source: CenterCredentialSource): string | undefined;
+/**
+ * [ref] E-15 ② —— 一次中心往返的答复**仍属于此刻的凭证**:发出它所用的身份 = 此刻的身份。
+ * 拉配置(`boot/config-center.ts` `pullEffective`)与两条 `?principal=` 视图(`config-center/http-client.ts`)
+ * 都只问这一只;不成立 ⇒ 答复丢弃,当这次拉取失败(各走各的失败臂)。
+ */
+export declare function answerStillCurrent(source: CenterCredentialSource, usedIdentity: string | undefined): usedIdentity is string;
+/**
+ * [ref] E-15 · 内存面 —— 身份绑定的进程内状态(per-principal caps 缓存与在飞表、org 记忆目录)的**唯一分箱规则**,
+ * 与盘上的 {@link centerStateBin} 同一条规则的两面(7.99.0 合并复审 F2:此前两处缓存只按 principal 键)。
+ *  · 箱 = 取箱那一刻的凭证身份(惰建)。凭证此刻不可读 ⇒ 「身份未知」箱。
+ *  · 每个箱只经**钉在它身份上**的凭证来源对中心说话(`make` 拿到的那只):此刻的凭证已换了人 / 不可读 ⇒ 这一箱的
+ *    请求不发(取值失败 ⇒ `CenterCredentialUnavailableError`,消费方走自己的失败臂)。身份未知箱因此从不收任何
+ *    中心答复;缓存 / 在飞 / 条件请求的校验子全在箱里,换了人结构上够不着上一个人的。
+ *  · 请求发出之后才换人:答复到达时由 {@link answerStillCurrent} 判丢弃(请求装配侧,见 http-client.ts)。
+ * 旧身份的箱不淘汰(量级 = 进程生命期内出现过的身份数):换回来的身份在 TTL 内照常命中它自己的缓存。
+ */
+export declare function createIdentityBins<T>(source: CenterCredentialSource, make: (pinned: CenterCredentialSource) => T): () => T;
+//# sourceMappingURL=center-credential.d.ts.map

package/dist/center-credential.js

@@ -0,0 +1,131 @@
+import { readFileSync } from "node:fs";
+import { createHash } from "node:crypto";
+import { resolve as resolvePath } from "node:path";
+import { looksLikeJwt } from "@sema-agent/settings-schema/api/auth-bridge";
+export class CenterCredentialUnavailableError extends Error {
+    reason;
+    constructor(reason) {
+        super(`center credential unavailable: ${reason}`);
+        this.reason = reason;
+        this.name = "CenterCredentialUnavailableError";
+    }
+}
+export const CENTER_TOKEN_ENV = "SEMA_REGISTRY_TOKEN";
+export const CENTER_TOKEN_FILE_ENV = "SEMA_REGISTRY_TOKEN_FILE";
+export function readCenterCredentialDeclaration(env = process.env) {
+    const token = env.SEMA_REGISTRY_TOKEN ?? "";
+    const file = env.SEMA_REGISTRY_TOKEN_FILE ?? "";
+    if (token !== "" && file !== "") {
+        throw new Error(`${CENTER_TOKEN_ENV} and ${CENTER_TOKEN_FILE_ENV} are both set — pick exactly one: ${CENTER_TOKEN_ENV} carries the credential value, ` +
+            `${CENTER_TOKEN_FILE_ENV} names a file re-read on every request (rotation without restart). Two writers on one credential is a guess, not a config.`);
+    }
+    if (file !== "")
+        return { from: "file", path: resolvePath(file) };
+    if (token !== "")
+        return { from: "env", token };
+    return { from: "absent" };
+}
+const digest16 = (s) => createHash("sha256").update(s, "utf8").digest("hex").slice(0, 16);
+function jwtSubject(bearer) {
+    let parsed;
+    try {
+        parsed = JSON.parse(Buffer.from(bearer.split(".")[1] ?? "", "base64url").toString("utf8"));
+    }
+    catch (err) {
+        return { missing: `payload is not JSON (${err instanceof Error ? err.name : "parse error"})` };
+    }
+    if (parsed === null || typeof parsed !== "object" || !("sub" in parsed))
+        return { missing: "no sub claim" };
+    return typeof parsed.sub === "string" && parsed.sub !== "" ? { sub: parsed.sub } : { missing: "sub is not a non-empty string" };
+}
+function classify(bearer, worker) {
+    if (looksLikeJwt(bearer)) {
+        const s = jwtSubject(bearer);
+        return { ok: true, kind: "user-jwt", bearer, identity: "sub" in s ? `user-jwt:${digest16(s.sub)}` : `user-jwt-opaque:${digest16(bearer)}` };
+    }
+    return { ok: true, kind: "pull-token", bearer, identity: pullTokenIdentity(worker), workerScoped: bearer.startsWith("wpt_") };
+}
+export function pullTokenIdentity(worker) {
+    return `pull-token:${worker ?? "global"}`;
+}
+const NONE = { ok: true, kind: "none", identity: "none" };
+export function createCenterCredentialSource(declaration, worker, deps = {}) {
+    switch (declaration.from) {
+        case "absent":
+            return { origin: declaration, declared: false, read: () => NONE, health: () => ({ state: "ok" }) };
+        case "env": {
+            const fixed = classify(declaration.token, worker);
+            return { origin: { from: "env" }, declared: true, read: () => fixed, health: () => ({ state: "ok" }) };
+        }
+        case "file": {
+            const readFile = deps.readFile ?? ((p) => readFileSync(p, "utf8"));
+            const now = deps.now ?? Date.now;
+            let health = { state: "ok" };
+            const fail = (reason) => {
+                health = health.state === "unreadable" ? { ...health, reason, failures: health.failures + 1 } : { state: "unreadable", reason, since: now(), failures: 1 };
+                return { ok: false, reason };
+            };
+            return {
+                origin: declaration,
+                declared: true,
+                read() {
+                    let text;
+                    try {
+                        text = readFile(declaration.path);
+                    }
+                    catch (err) {
+                        const code = err instanceof Error && "code" in err && typeof err.code === "string" ? err.code : "read error";
+                        return fail(`${CENTER_TOKEN_FILE_ENV} ${declaration.path} is unreadable (${code})`);
+                    }
+                    const bearer = text.trim();
+                    if (bearer === "")
+                        return fail(`${CENTER_TOKEN_FILE_ENV} ${declaration.path} is empty`);
+                    health = { state: "ok" };
+                    return classify(bearer, worker);
+                },
+                health: () => health,
+            };
+        }
+    }
+}
+export function scopedTokenNeedsWorker(read, worker) {
+    return read.ok && read.kind === "pull-token" && read.workerScoped && !worker;
+}
+export function centerStateBin(worker, identity) {
+    return `${worker === undefined ? "global" : `worker-${digest16(worker)}`}.id-${digest16(identity)}`;
+}
+export function credentialIdentityNow(source) {
+    const r = source.read();
+    return r.ok ? r.identity : undefined;
+}
+export function answerStillCurrent(source, usedIdentity) {
+    return usedIdentity !== undefined && credentialIdentityNow(source) === usedIdentity;
+}
+export function createIdentityBins(source, make) {
+    const bins = new Map();
+    return () => {
+        const identity = credentialIdentityNow(source);
+        if (bins.has(identity))
+            return bins.get(identity);
+        const made = make(pinCredential(source, identity));
+        bins.set(identity, made);
+        return made;
+    };
+}
+function pinCredential(source, identity) {
+    return {
+        origin: source.origin,
+        declared: source.declared,
+        read() {
+            const r = source.read();
+            if (!r.ok)
+                return r;
+            if (identity === undefined) {
+                return { ok: false, reason: "this state bin was opened while the center credential was unreadable (identity unknown) — it never talks to the center; the next call runs in the current identity's bin" };
+            }
+            return r.identity === identity ? r : { ok: false, reason: "center credential identity changed — this request belongs to the previous identity's state bin and is not sent" };
+        },
+        health: () => source.health(),
+    };
+}
+//# sourceMappingURL=center-credential.js.map

package/dist/config-catalog.d.ts

@@ -10,14 +10,14 @@ export type CatalogDangerAxis = (typeof CATALOG_DANGER_AXES)[number];
 /** 域 = 配置九组(类型锁步:组集变了这里跟着红)。 */
 export type CatalogDomain = keyof ServiceConfigGroups;
 export declare const CATALOG_RESTART_SLICES: readonly RestartSlice[];
-/** center 联接座(spec 层)。`models-plane` 是内部时机词:build 时按 tier 表在场性实算成 hot/restart。 */
+/** center 联接座(spec 层)。 */
 export interface CatalogCenterSeatSpec {
     readonly domain: string;
     readonly path: string;
     /** `centerManagedKeys`(config-center 在管键集)里查「在管」用的键;models 面统一 "models"。 */
     readonly centerKey: string;
     readonly precedence: "center-wins" | "env-wins";
-    readonly timing: "hot" | "restart" | "inert" | "models-plane";
+    readonly timing: "hot" | "restart" | "inert";
     readonly restartSlice?: RestartSlice;
     readonly restartReason?: string;
 }

package/dist/config-catalog.js

@@ -1,7 +1,7 @@
 import { CROSS_SESSION_INBOUND_SETTINGS, CROSS_SESSION_DIALOG_EXPIRY_VALUES } from "@sema-agent/core";
 import { THINKING_FORMATS } from "./model-compat.js";
 import { RESILIENCE_DEFAULTS, TASK_WRITE_FACE_ESCALATIONS } from "./config-types.js";
-import { webSearchConfigFromEnv, WEB_SEARCH_PROVIDERS } from "./plugins/web-search.js";
+import { webSearchProviderFromEnv, WEB_SEARCH_PROVIDERS } from "./plugins/web-search.js";
 import { AUTONOMY_MODES } from "./runtime-governance.js";
 import { REMOTE_EXEC_PROVIDER_WORDS } from "./execution-lane-caps.js";
 import { CENTER_READ_FACE_LIVE_KEYS } from "./config-center/read-face.js";
@@ -15,10 +15,9 @@ const RESTART_SLICE_SET = {
     mcp: true,
     a2a: true,
     scenarios: true,
-    "runtime-gates": true,
-    "models-tiers": true,
     "degrade-route": true,
     "read-face": true,
+    "memory-consolidation": true,
 };
 export const CATALOG_RESTART_SLICES = Object.keys(RESTART_SLICE_SET);
 const r = (name, domain, type, semantics, opts = {}) => ({ name, domain, type, semantics, ...opts });
@@ -31,7 +30,7 @@ const cLimits = (path, over = {}) => ({
     ...over,
 });
 const cGov = (path, over = {}) => ({ domain: "governance", path, centerKey: path, precedence: "center-wins", timing: "hot", ...over });
-const cModels = (path) => ({ domain: "models", path, centerKey: "models", precedence: "center-wins", timing: "models-plane" });
+const cModels = (path) => ({ domain: "models", path, centerKey: "models", precedence: "center-wins", timing: "hot" });
 const cRead = (path, centerKey, over = {}) => ({
     domain: "readFace",
     path,
@@ -65,7 +64,7 @@ export const CONFIG_CATALOG = [
     r("APPROVAL_DENY", "approval", "csv", "始终拒绝的工具名单(装配期拒不可匹配名)", { danger: SEC, configKey: "approvalDeny" }),
     r("APPROVAL_HMAC_KEYS", "approval", "secret", "直连门(D-G)HMAC 完整性密钥集(空=直连门不激活)", { danger: SEC }),
     r("APPROVAL_NEVER_AUTO", "approval", "csv", "永不被 AUTO_BUDGET 自动放行的工具集(不可逆动作恒要人)", { danger: SEC, configKey: "approvalNeverAuto" }),
-    r("APPROVAL_REQUIRE", "approval", "csv", "必须人审的工具名单(F4 门;center 腿走 runtime-gates 重启片)", { danger: SEC, configKey: "approvalRequire", center: cGov("approvalRequire", { timing: "restart", restartSlice: "runtime-gates" }) }),
+    r("APPROVAL_REQUIRE", "approval", "csv", "必须人审的工具名单(F4 门;center 腿热:refresh 拍整表换代,无 checkpoint 店的部署发非空名单 ⇒ 审批组整组拒)", { danger: SEC, configKey: "approvalRequire", center: cGov("approvalRequire") }),
     r("APPROVAL_TERMINAL_BACKSTOP_MS", "approval", "number", "SQL checkpoint 店 pending 行的 crash-safe 绝对 GC 上限(ms;下限 60s,非有限值落默认)", { staticDefault: String(30 * 86_400_000), danger: DATA }),
     r("APPROVAL_TIMEOUT_SEC", "approval", "number", "durable HITL 等人上限(秒);0=无限期等,时间型 suspended 回收不跑", { staticDefault: "0", configKey: "approvalTimeoutSec" }),
     r("ASK_QUESTION_ENABLED", "approval", "boolean", "AskUserQuestion 活流 HITL 装配开关", { derivedDefaultNote: "posture 三态:显式词恒赢,缺席 = 单用户(REQUIRE_PRINCIPAL≠true)⇒ on / 多租户 ⇒ off", configKey: "askQuestionEnabled" }),
@@ -74,7 +73,7 @@ export const CONFIG_CATALOG = [
     r("ATTACHMENT_ORPHAN_GRACE_MS", "limitsHttp", "number", "附件孤儿对象 GC 宽限(ms;0=关本腿,坏值回默认+warn)", { staticDefault: "3600000", danger: DATA, center: cLimits("attachmentOrphanGraceMs") }),
     r("ATTACHMENT_UNBOUND_TTL_MS", "limitsHttp", "number", "未绑定附件的 TTL(ms)", { staticDefault: String(24 * 3600 * 1000), danger: DATA, configKey: "attachmentUnboundTtlMs", center: cLimits("attachmentUnboundTtlMs") }),
     r("AUTH_BRIDGE_AUDIENCE", "auth", "string", "registry SSO-JWT 验签期望 aud", { danger: SEC }),
-    r("AUTH_BRIDGE_ISSUER", "auth", "url", "registry SSO-JWT issuer(auth bridge 的开关之一;S-591 起也是托管形判据的一条证据 —— 只认显式值,不认 center 回退)", { danger: SEC, derivedDefaultNote: "缺席 ⇒ 桥的装配处回退到 configCenter.baseUrl(配了 center 即默认开桥);但**托管判据不读那条回退**(fleet 管理轴 ≠ 租户轴)", configKey: "authBridgeIssuer" }),
+    r("AUTH_BRIDGE_ISSUER", "auth", "url", "registry SSO-JWT issuer(auth bridge 的开关之一;S-671 / C-R100 ① 起**不是**托管证据 —— 多租户只认 REQUIRE_PRINCIPAL=true)", { danger: SEC, derivedDefaultNote: "缺席 ⇒ 桥的装配处回退到 configCenter.baseUrl(配了 center 即默认开桥);显式值与回退值在托管判定上同判(都不算)", configKey: "authBridgeIssuer" }),
     r("AUTH_BRIDGE_JWKS_URL", "auth", "url", "registry SSO-JWT 的 JWKS 地址(缺省从 issuer 派生)", { danger: SEC }),
     r("AUTONOMY", "auth", "enum", "运维 autonomy 模式,tighten-only 叠到每个 TaskSpec(read-only/plan ⇒ 只读手,ask ⇒ 恒 shellGate);center 腿热且 non-sticky", { danger: SEC, enumValues: AUTONOMY_MODES, configKey: "autonomy", center: cGov("autonomy") }),
     r("AUTO_MODE_CLASSIFIER_FALLBACK", "approval", "enum", "auto 分类器席答不出裁决时的梯子(main=主模型代判 / none=只留分类器那一级,整条拒)", { enumValues: ["main", "none"], danger: SEC, derivedDefaultNote: "未设/空串 ⇒ 不铸键,跟随引擎缺省 main(core 7.18.0 起;空串按未设,与其余词表旋钮同判);none = 7.77.0 及以前的行为逐字;词表外的值启动期拒启。权限轴放宽,升级须知见 DEPLOY-PREREQS", configKey: "autoModeClassifierFallback" }),
@@ -102,7 +101,7 @@ export const CONFIG_CATALOG = [
     r("CORS_ORIGIN", "auth", "csv", "CORS 白名单(单值 v1 兼容回显;多值按请求 Origin 匹配 + Vary;未设=无 CORS 面)", { danger: SEC, configKey: "corsOrigins" }),
     r("COST_QUOTA_WINDOW_SEC", "limitsHttp", "number", "per-principal 成本配额窗长(秒);SQL 腿窗长进桶主键 ⇒ center 腿显式 deferred(重启生效)", { staticDefault: "86400", danger: BILL, configKey: "costQuotaWindowSec", center: cLimits("costQuotaWindowSec", { timing: "restart", restartReason: "cost-quota-window" }) }),
     r("CROSS_SESSION_DIALOG_EXPIRY", "approval", "enum", "held 跨会话消息等待人审的期限(CC settings 键名 dialogExpiry;未设=不铸键,引擎自落缺省 5m;词表外拒启)", { danger: SEC, enumValues: [...CROSS_SESSION_DIALOG_EXPIRY_VALUES], configKey: "crossSessionDialogExpiry", derivedDefaultNote: "缺席 ⇒ 不铸键,core 自缺省 5m", resolve: (c) => c.crossSessionDialogExpiry ?? null }),
-    r("CROSS_SESSION_INBOUND", "approval", "enum", "入站跨会话消息的部署/组织层治理(CC settings 键名 crossSessionInbound 的 managed 层;未设=本层不表态≠accept;词表外拒启)", { danger: SEC, enumValues: [...CROSS_SESSION_INBOUND_SETTINGS], configKey: "crossSessionInbound", derivedDefaultNote: "缺席 ⇒ managed 层不设,由其余层与 mode-parity 决定", resolve: (c) => c.crossSessionInbound ?? null }),
+    r("CROSS_SESSION_INBOUND", "approval", "enum", "入站跨会话消息的部署/组织层治理(CC settings 键名 crossSessionInbound 的 managed 层;未设=本层不表态≠ next-turn;词表外拒启)", { danger: SEC, enumValues: [...CROSS_SESSION_INBOUND_SETTINGS], configKey: "crossSessionInbound", derivedDefaultNote: "缺席 ⇒ managed 层不设,由其余层与 mode-parity 决定", resolve: (c) => c.crossSessionInbound ?? null }),
     r("DB_BACKEND", "store", "enum", "store 后端引擎选择(mysql 兼容/pg/本机文件店/纯内存)", { enumValues: ["mysql", "pg", "local", "memory"], danger: DATA, derivedDefaultNote: "裸 boot ⇒ local(多租户裸 boot ⇒ memory + notice);有 SQL 信号 ⇒ mysql", configKey: "dbBackend", resolve: (c) => c.dbBackend }),
     r("DB_QUERY_TIMEOUT_MS", "store", "number", "per-query DB 超时(ms;坏值回默认姿态+warn,绝不 NaN 进 driver)", { derivedDefaultNote: "缺席 ⇒ 池级不设/计数族 30s(按引擎)", configKey: "dbQueryTimeoutMs" }),
     r("DEFAULT_SCENARIO", "integrations", "string", "出厂缺省场景(编码产品出厂态;通用中性 persona 用 default 显式选回)", { staticDefault: "code", configKey: "defaultScenario" }),
@@ -394,7 +393,8 @@ export const CONFIG_CATALOG = [
     r("SEMA_PIP_INDEX", "orchestration", "url", "SANDBOX_PKG_SOURCE=custom 的显式 pip index 地址"),
     r("SEMA_REGISTRY_ADMIN_TOKEN", "integrations", "secret", "写 center 的管理凭证(仅 boot 上报执行公钥用;刻意不入 ServiceConfig —— 不进 configHash/日志面)", { danger: SEC, scope: "bootstrap-only" }),
     r("SEMA_REGISTRY_DRY_RUN", "integrations", "boolean", "center 腿 dry-run(拉而不应用)", { staticDefault: "false" }),
-    r("SEMA_REGISTRY_TOKEN", "integrations", "secret", "center 拉取凭据", { danger: SEC }),
+    r("SEMA_REGISTRY_TOKEN", "integrations", "secret", "center 拉取凭据(值形;与 SEMA_REGISTRY_TOKEN_FILE 二选一,都设=拒启)", { danger: SEC }),
+    r("SEMA_REGISTRY_TOKEN_FILE", "integrations", "path", "center 拉取凭据文件(每条中心请求都重读 ⇒ 轮换 / 换账号不重启;与 SEMA_REGISTRY_TOKEN 二选一,都设=拒启;文件不可读=响亮 + 健康态 unreadable,不当作无凭证)", { danger: SEC }),
     r("SEMA_REGISTRY_URL", "integrations", "url", "sema-registry 地址(设了=remote 配置源开关)"),
     r("SEMA_REGISTRY_WORKER", "integrations", "string", "本 worker 在 center 的名字(per-worker effective)"),
     r("SEMA_UV_INDEX", "orchestration", "url", "SANDBOX_PKG_SOURCE=custom 的显式 uv index 地址"),
@@ -453,12 +453,12 @@ export const CONFIG_CATALOG = [
     r("UNREACHED_ASK_TTL_MS", "approval", "number", "零活流铸造的 ask 悬挂窗(ms;[60s,24h] 拒启带界)", { staticDefault: "3600000" }),
     r("USAGE_WINDOWS", "orchestration", "opaque", "部署级治理窗(JSON 数组;滑动窗内跨任务 token/$ 预算,key=principal)", { danger: BILL }),
     r("WEB_SEARCH_API_KEY", "orchestration", "secret", "web search 后端 API 凭据(brave/tavily)", { danger: [...SEC, ...BILL] }),
-    r("WEB_SEARCH_ENDPOINT", "orchestration", "url", "web search 后端 endpoint 覆写(searxng 自建面)"),
-    r("WEB_SEARCH_MAX_RESULTS", "orchestration", "number", "web search 单次结果数上限", { derivedDefaultNote: "缺席/非正 ⇒ backend 默认" }),
+    r("WEB_SEARCH_ENDPOINT", "orchestration", "url", "web search 后端 endpoint 覆写(searxng 实例地址;brave 下可指向 Brave 兼容网关的完整搜索 URL,如 Nólë;空 = 未设;不是 scheme://host 形的绝对 URL ⇒ 拒启)"),
+    r("WEB_SEARCH_MAX_RESULTS", "orchestration", "number", "web search 单次结果数上限(非数 / < 1 ⇒ 拒启;> 20 夹到 20)", { derivedDefaultNote: "缺席/空 ⇒ backend 默认 10" }),
     r("WEB_SEARCH_PROBE_ON_BOOT", "orchestration", "boolean", "boot 期 web search 连通性探测(只认 true/1;含糊值当没开——猜错方向是凭空出网)", { staticDefault: "false" }),
-    r("WEB_SEARCH_PROVIDER", "orchestration", "enum", "web search 工具后端(设合法词=装配 WebSearch;其它/缺席=不装配)", { enumValues: WEB_SEARCH_PROVIDERS, danger: SEC, resolve: (_c, env) => webSearchConfigFromEnv(env)?.provider ?? null }),
-    r("WEB_SEARCH_SEARXNG_PARAMS", "orchestration", "string", "searxng 额外查询参数(k=v 对;解析不出任何一对 ⇒ 键不铸)"),
-    r("WEB_SEARCH_TIMEOUT_MS", "orchestration", "number", "web search 单次超时(ms)", { derivedDefaultNote: "缺席/非正 ⇒ backend 默认" }),
+    r("WEB_SEARCH_PROVIDER", "orchestration", "enum", "web search 工具后端(设合法词=装配 WebSearch;其它/缺席=不装配)", { enumValues: WEB_SEARCH_PROVIDERS, danger: SEC, resolve: (_c, env) => webSearchProviderFromEnv(env) ?? null }),
+    r("WEB_SEARCH_SEARXNG_PARAMS", "orchestration", "string", "searxng 额外查询参数(name=value;name=value;空 ⇒ 不铸;任一段不成形 / 名不是参数名 / 同名两次 ⇒ 拒启)"),
+    r("WEB_SEARCH_TIMEOUT_MS", "orchestration", "number", "web search 单次超时(ms;非数 / < 1 ⇒ 拒启;< 1000 抬到 1000)", { derivedDefaultNote: "缺席/空 ⇒ backend 默认 10000" }),
     r("WORKFLOW_AGENTS_READONLY", "orchestration", "boolean", "workflow 子 agent 只读钳(TOB 保守旋钮;默认同权 CC parity)", { staticDefault: "false", danger: SEC, configKey: "workflowAgentsReadOnly" }),
     r("WORKFLOW_JOURNAL_RETENTION_MS", "orchestration", "number", "workflow_journal GC 保留期(ms)", { staticDefault: String(7 * 24 * 60 * 60 * 1000), danger: DATA, configKey: "workflowJournalRetentionMs" }),
     r("WORKFLOW_ORPHAN_GRACE_MS", "orchestration", "number", "running workflow 判崩溃孤儿的年龄阈(ms)", { staticDefault: String(24 * 60 * 60 * 1000), configKey: "workflowOrphanGraceMs" }),
@@ -536,8 +536,8 @@ export function buildConfigCatalog(inputs) {
         const seat = spec.center;
         const domainExists = seat !== undefined && centerDomains.includes(seat.domain);
         const managedNow = seat !== undefined && (centerManagedKeys?.has(seat.centerKey) ?? false);
-        const centerTiming = seat === undefined ? undefined : seat.timing === "models-plane" ? "hot" : seat.timing;
-        const centerRestartSlice = seat === undefined || seat.timing === "models-plane" ? undefined : seat.restartSlice;
+        const centerTiming = seat?.timing;
+        const centerRestartSlice = seat?.restartSlice;
         const centerEffective = seat !== undefined && managedNow && centerTiming === "hot" && (seat.precedence === "center-wins" || !envHeld);
         const effectiveLane = centerEffective ? "center" : envHeld ? "env" : "default";
         let effectiveValue;

package/dist/config-center/apply-effective.d.ts

@@ -1,6 +1,6 @@
 /**
  * EffectiveConfig application — mutate the boot `ServiceConfig` OVER with a pulled `EffectiveConfig`
- * (models/roles/tiers/projects `applyEffective`, the boot-only approval gate + runtime limit residue
+ * (models/roles/tiers/projects `applyEffective`, the approval group + runtime limit residue
  * `applyRuntimeGates`, the per-request-hot governance baton `applyRuntimeHot`) plus their shared helpers
  * (`toModel`, `mutateInPlace`, `resolveDefaultModelName`, `logEffectiveDiff`). Split out of `facade.ts`
  * ([ref] A13, internal-lossless — the facade re-exports every symbol below unchanged).
@@ -10,6 +10,7 @@ import type { ServiceConfig } from "../config-types.js";
 import { type SealedKeyOpener } from "../sealed-key.js";
 import type { Logger } from "../observability/logger.js";
 import type { EffectiveConfig } from "./types.js";
+import { type ConfigApplyReport } from "./apply-ledger.js";
 /** Apply center config OVER the env-derived config (mutates `config`). Empty domains keep env defaults. */
 /** Replace a record's contents IN PLACE (clear keys, copy source) so holders of the SAME reference see the
  *  change. This is what makes models/roles/pricing HOT-apply: core's Runner reads
@@ -34,41 +35,38 @@ export declare const UNPARSABLE_AT_MODEL_ALLOWLIST_ENTRY = "\0<unparsable-at-mod
  *  commit 之前,活配置零触碰)。caller 收到 false 必须把**同一世代的旁路消费**(prompts 采用/pricing/
  *  keyResolver/etag 推进/LKG 落盘)一并跳过——否则 applyEffective 拒了主面、旁路却半应用同一个被拒
  *  世代,混合世代从侧门回来。首次 apply(live 未登记)恒 true。 */
-/** [ref]:一次 apply 的**世代账载荷**(post-commit 发,[ref]② —— commit 段仍是零回调零发射)。 */
-export interface ApplyReport {
-    readonly version: number;
-    /** [ref]:本候选的收货序数(= opts.generation 原样带回;世代账按它记拒收,身份标仍是 version)。 */
-    readonly ordinal?: number;
-    readonly limits: {
-        /** 本世代真正换了值的键。 */
-        readonly applied: readonly string[];
-        /** 值合法但**不热**的键(逐键 defer:变更只能重启生效)。 */
-        readonly deferred?: ReadonlyArray<{
-            readonly key: string;
-            readonly reason: string;
-        }>;
-        /** 整批被拒时的成因(消毒:键名 + 判据文案,绝不带值)。 */
-        readonly rejected?: {
-            readonly keys: string[];
-            readonly reason: string;
-            readonly restartReason?: string;
-        };
-    };
+/** [ref]:一次 apply 的**世代账载荷**(post-commit 发,[ref]② —— commit 段仍是零回调零发射)。形 = 世代账的
+ *  `ConfigApplyReport`(**每一组都报**,组闭集 `CONFIG_APPLY_GROUPS` 在 apply-ledger.ts)+ 整代判决。 */
+export interface ApplyReport extends ConfigApplyReport {
     /** 🔴 codex R2-F1:本候选是否**完整**应用 —— 有任何一组被拒 ⇒ false。调用方据此决定要不要把它发布成
      *  LKG / 推进 etag(一个「其余面提交了但某组被拒」的候选覆盖掉好 LKG,重启后就再也回不去了)。 */
     readonly fullyApplied: boolean;
 }
-export declare function applyEffective(config: ServiceConfig, eff: EffectiveConfig, logger?: Logger, opts?: {
-    teamsOnly?: boolean;
-    sealedKeys?: SealedKeyOpener;
-    deferModelPlane?: boolean;
-    generation?: number;
-    report?: (r: ApplyReport) => void;
-    swapPlane?: (plane: {
+/**
+ * S-668 波 2 —— 一次 apply 在**哪条腿**上跑,以及这条腿知道的**部署事实**。必填(没有缺省腿):安全轴上「忘了说是哪条
+ * 腿」不许静默落成某一种语义([ref])。
+ *  · `boot` —— 装配期(stage-02 的 boot 拉取 / LKG 起服;run-local 的一次性装配)。此刻 checkpoint 店**还没建**,
+ *    审批组的「门意图可服务」由装配完之后的 stage-07 对**整份** config 判(拒启)—— 与热腿是同一只
+ *    `gateIntentUnserviceableReason`,不是两份判据。
+ *  · `hot` —— 进程已起(refresh 拍 / 迟到 boot 到货)。`checkpointStorePresent` = 本进程建没建出 checkpoint 店
+ *    (stage-06 的产物,**不在 ServiceConfig 里**),审批组 stage 当场对候选判,不可服务 ⇒ 整组拒。
+ */
+export type ApplyLeg = {
+    readonly leg: "boot";
+} | {
+    readonly leg: "hot";
+    readonly checkpointStorePresent: boolean;
+};
+export type ApplyEffectiveOpts = ApplyLeg & {
+    readonly sealedKeys?: SealedKeyOpener;
+    readonly generation?: number;
+    readonly report?: (r: ApplyReport) => void;
+    readonly swapPlane?: (plane: {
         models: Record<string, Model>;
         tiers: Record<string, string>;
     }) => void;
-}): boolean;
+};
+export declare function applyEffective(config: ServiceConfig, eff: EffectiveConfig, logger: Logger | undefined, opts: ApplyEffectiveOpts): boolean;
 /**
  * UNIFORM presence semantics across the center gates (center `f95438a` adopted this from our sentinel flag —
  * SERVICE-INTEGRATION「Runtime 治理/限额闸」): every gate field is center `.optional()`, so
@@ -87,14 +85,9 @@ export declare function applyEffective(config: ServiceConfig, eff: EffectiveConf
 /** `runtime` 域的限额五闸(= settings-schema `RuntimeConfig` 的全部键,[ref] 件3 对账门钉集合等式),ONE place:
  *  legacy 位的 presence 判据({@link runtimeGatePresent} → stage-limits 的 `legacyGates`)、config-catalog 的
  *  center 在管键、dry-run 现值快照都从这一张表派生。[ref] 批1 起五键**全热**(属主 stage-limits,boot+refresh
- *  双腿),所以本表与 restart-to-apply 再无关系——审批闸不在这里:它住 governance 域({@link BOOT_GATE_KEYS})。 */
+ *  双腿),所以本表与 restart-to-apply 再无关系——审批闸不在这里:它住 governance 域({@link stageApprovalGate})。 */
 export declare const RUNTIME_GATE_KEYS: readonly ["rateLimitPerMin", "maxTaskCostUsd", "maxTaskTokens", "maxPrincipalCostUsd", "costQuotaWindowSec"];
 export type RuntimeGateKey = (typeof RUNTIME_GATE_KEYS)[number];
-/** boot-only(restart-to-apply)的治理闸:今天只有 `governance.approvalRequire` 一键——它被 main.ts 在本函数之后
- *  用 `config` 构造进 approval gate,refresh 腿(teamsOnly)不写,变更由 restart-signal 的 `runtime-gates` 片通告。
- *  ([ref] 批2 若把它转热,这张表清空、那个片随之退役——一处改动。) */
-export declare const BOOT_GATE_KEYS: readonly ["approvalRequire"];
-export type BootGateKey = (typeof BOOT_GATE_KEYS)[number];
 /** Uniform presence rule (center f95438a) for the `runtime` limit gates: "managed" when the field is present —
  *  any number (incl. 0). Sole guard: costQuotaWindowSec must be > 0 (a 0 window is nonsensical — core divides by
  *  it; center's `.positive()` already enforces, belt-and-suspenders here). The approval gate's presence rule
@@ -106,7 +99,8 @@ export type BootGateKey = (typeof BOOT_GATE_KEYS)[number];
  * 判据与各消费腿**同源**,不自铸第二份:
  *  · limits 域 = `hasOwnProperty`(stage-limits 的 published 判据逐字——present 含显式 0);
  *  · 六闸 legacy 位 = {@link runtimeGatePresent}(旧位 presence 规则的唯一属主);
- *  · governance/runtime 热二件 + approvalRequire = 键在场(applyRuntimeHot 的 non-sticky 判据同门);
+ *  · governance 三件(autonomy / commandPolicy / approvalRequire)= 键在场(applyRuntimeHot 与 stageApprovalGate
+ *    的 non-sticky presence 判据同门:`!== undefined`);
  *  · readFace 域成员 = 键在场(read-face.ts 的逐键 env-wins 合成看的就是成员在场性);
  *  · models 面 = 有启用行(markRosterLanded 同判据);atModelAllowlist 单列(整表重算键)。
  * 纯投影零副作用;`undefined` eff(还没拉到 / 纯 env 形)⇒ 空集。
@@ -114,11 +108,12 @@ export type BootGateKey = (typeof BOOT_GATE_KEYS)[number];
 export declare function centerManagedConfigKeys(eff: EffectiveConfig | undefined): ReadonlySet<string>;
 export declare function runtimeGatePresent(rt: NonNullable<EffectiveConfig["runtime"]>, key: RuntimeGateKey): boolean;
 /** 独立调用面的兼容壳(测试/外部):stage → 就地赋值 → 通知。applyEffective 不走这里——它把
- *  assignments 并进自己的 commit 段以保住整世代原子性([ref]②)。入参是 eff 的两个域([ref] 件3:审批闸
+ *  赋值并进自己的 commit 段以保住整世代原子性([ref]②)。入参是 eff 的两个域([ref] 件3:审批闸
  *  住 governance,限额五闸住 runtime——两位各自的属主判据,这里不再合成视图)。
  *  [ref]:限额五闸的属主已移交热腿,所以本壳**同样**要过 stage-limits —— 否则一个仍叫 applyRuntimeGates
- *  的函数会静默漏掉五个限额键(比改名更坏的那种沉默)。 */
-export declare function applyRuntimeGates(config: ServiceConfig, eff: Pick<EffectiveConfig, "runtime" | "governance"> | undefined, logger?: Logger): void;
+ *  的函数会静默漏掉五个限额键(比改名更坏的那种沉默)。S-668 波 2:审批组的判据依赖腿(④ 只在热腿判),
+ *  所以本壳与 applyEffective 一样**必须**说是哪条腿。 */
+export declare function applyRuntimeGates(config: ServiceConfig, eff: Pick<EffectiveConfig, "runtime" | "governance"> | undefined, leg: ApplyLeg, logger?: Logger): void;
 export declare function applyRuntimeHot(config: ServiceConfig, gov: EffectiveConfig["governance"], logger?: Logger): void;
 /**
  * [ref]① 显式默认解析——applyEffective 与 dry-run(logEffectiveDiff.wouldDefaultModel)共用的单源。优先级