@sema-agent/server 7.98.0 → 7.100.0

package/dist/config-center/http-client.d.ts

@@ -1,6 +1,7 @@
 import { type EffectiveReadWarning, type EntitlementRuntimeCaps } from "@sema-agent/settings-schema";
 import type { ScenarioRuling } from "../capabilities/scenarios.js";
 import type { EffectiveConfig, ExecutionRuling } from "./types.js";
+import { type CenterEndpoint } from "./center-request.js";
 /** GET the effective config (Bearer + ETag). null = 304 (unchanged). Throws on transport/HTTP error, and on a
  *  payload that is not an effective config at all(非对象 / version 非有限数 / gate 域坏形——[ref] 裁B)。
  *  `domainErrors`:坏 catalog 域(schema default 已落)逐域单列——与本地腿 `FetchEffectiveResult` 同键同义,
@@ -12,8 +13,11 @@ import type { EffectiveConfig, ExecutionRuling } from "./types.js";
  *  `legacy-governance-lifted` 铸出来,理由逐字写在 `legacyGovernanceFromRuntime` 的 SUNSET 注里:
  *  「关窗的前提是有人知道它还开着」。两条读腿各返一份原流,那句话在本仓才成立。
  *  🔐 原流的 `error` 字段**未经** `redactConfigError`(那道脱敏挂在真正进日志流的 `domainErrors` 产出边界上)
- *  —— 任何把本键路由进结构化日志/审计流的消费者必须自己先脱敏。 */
-export declare function fetchEffective(baseUrl: string, token: string, etag: string | undefined, fetchImpl?: typeof fetch, worker?: string): Promise<{
+ *  —— 任何把本键路由进结构化日志/审计流的消费者必须自己先脱敏。
+ *
+ *  `credentialIdentity`(S-651 / [ref] E-15):这次拉取所用凭证的身份(`center-credential.ts`)。调用方拿它给
+ *  候选打分箱标记 —— LKG / prompt 活动状态只许落进**拉到它的那个身份**的箱。 */
+export declare function fetchEffective(center: CenterEndpoint, etag: string | undefined, fetchImpl?: typeof fetch, worker?: string): Promise<{
     effective: EffectiveConfig;
     etag?: string;
     domainErrors?: Array<{
@@ -21,6 +25,7 @@ export declare function fetchEffective(baseUrl: string, token: string, etag: str
         error: string;
     }>;
     readWarnings: readonly EffectiveReadWarning[];
+    credentialIdentity: string;
 } | null>;
 /**
  * [ref] §K (core 1.157 `RunnerDeps.runtimeCapsResolver`) — GET the PER-PRINCIPAL runtime
@@ -41,7 +46,7 @@ export declare function fetchEffective(baseUrl: string, token: string, etag: str
  * fail-closes (core then DENIES the optional `allowWorkflows` cap — an outage must never silently GRANT). ETag is
  * content-hashed (`p-<hash>`); an `if-none-match` poll is cheap. Mirrors `fetchEffective` (Bearer + 8s + scheme guard).
  */
-export declare function fetchPrincipalCaps(baseUrl: string, token: string, principal: string, etag: string | undefined, fetchImpl?: typeof fetch, worker?: string): Promise<{
+export declare function fetchPrincipalCaps(center: CenterEndpoint, principal: string, etag: string | undefined, fetchImpl?: typeof fetch, worker?: string): Promise<{
     runtimeCaps: EntitlementRuntimeCaps | null;
     configured: boolean;
     scenario?: ScenarioRuling;
@@ -68,7 +73,7 @@ export declare function fetchPrincipalCaps(baseUrl: string, token: string, princ
  * 段在场 ⇒ 原值(空表 = 取数成功的负结果,与缺席不同格)。条件请求不适用(本腿恒不带 etag),
  * 因此 304 在传输层就是 fail-loud。
  */
-export declare function fetchPrincipalOrgMemory(baseUrl: string, token: string, principal: string, fetchImpl?: typeof fetch, worker?: string): Promise<unknown>;
+export declare function fetchPrincipalOrgMemory(center: CenterEndpoint, principal: string, fetchImpl?: typeof fetch, worker?: string): Promise<unknown>;
 /** An HTTP error from a config-center fetch that carries the response status so callers can branch on it
  *  (e.g. translate a 404 to "unknown hash → undefined") WITHOUT parsing the message string. */
 export declare class ConfigCenterHttpError extends Error {
@@ -76,18 +81,21 @@ export declare class ConfigCenterHttpError extends Error {
     constructor(message: string, status: number);
 }
 /**
- * Fetch one skill's body by content hash (`GET /api/config/skills/content/<hash>`, Bearer) and VERIFY its
+ * Fetch one skill's body by content hash (`GET <content root>/skills/content/<hash>`, Bearer; the root is
+ * `/api/v1/me` for a user-JWT credential and `/api/config` otherwise — center-request.ts) and VERIFY its
  * sha256 matches the manifest hash (integrity + rewrite check). The content is immutable per hash, so the
  * caller caches by hash and never re-fetches an unchanged skill. Throws a {@link ConfigCenterHttpError}
  * (carrying `.status`) on an HTTP error — INCLUDING 404 — or a plain Error on hash mismatch. Callers that
  * want "unknown hash → undefined" parity with the local backend inspect `.status === 404` and swallow it;
  * the legacy `applyCenterSkills` path keeps treating every throw as "skip this skill, keep baseline".
  */
-export declare function fetchSkillContent(baseUrl: string, token: string, contentHash: string, fetchImpl?: typeof fetch): Promise<string>;
+export declare function fetchSkillContent(center: CenterEndpoint, contentHash: string, fetchImpl?: typeof fetch): Promise<string>;
 /** [ref]b / [ref]① — §9.4 by-digest 补拉二函(fetchSkillContent 同姿势:HTTP+Bearer+8s 超时+
  *  消费侧自证)。artifact=envelope JSON(验真=调用方过 core verifyPromptArtifact,canonical 重算——
  *  本函数只做传输与形读,不超范围解释);blob=段文本 raw-byte(sha256 逐位自证,fetchSkillContent 同款)。
- *  digest 参数收带前缀/裸 hex 两形([ref] 参数口径)。 */
-export declare function fetchPromptArtifact(baseUrl: string, token: string, artifactDigest: string, fetchImpl?: typeof fetch): Promise<unknown>;
-export declare function fetchPromptBlob(baseUrl: string, token: string, contentDigest: string, fetchImpl?: typeof fetch): Promise<string>;
+ *  digest 参数收带前缀/裸 hex 两形([ref] 参数口径)。路径根按凭证种类(B-5,center-request.ts)。
+ *  ⚠️ 现状(S-651 取证车MS 总表第 8 条):`fetchPromptBlob` 在 `src/` 里**没有生产调用点**,真走得到的内容
+ *  拉取只有 skill 正文与 prompt 产物两条;它与另两条共用同一张路由表,本批不为它新接线。 */
+export declare function fetchPromptArtifact(center: CenterEndpoint, artifactDigest: string, fetchImpl?: typeof fetch): Promise<unknown>;
+export declare function fetchPromptBlob(center: CenterEndpoint, contentDigest: string, fetchImpl?: typeof fetch): Promise<string>;
 //# sourceMappingURL=http-client.d.ts.map

package/dist/config-center/http-client.js

@@ -2,15 +2,11 @@ import { createHash } from "node:crypto";
 import { readEffectiveWire, PrincipalCapsWire } from "@sema-agent/settings-schema";
 import { centerPromptsFromEffective } from "../prompts-domain-validate.js";
 import { foldEffectiveReadWarning } from "./read-warnings.js";
-export async function fetchEffective(baseUrl, token, etag, fetchImpl = fetch, worker) {
-    const scheme = new URL(baseUrl).protocol;
-    if (scheme !== "http:" && scheme !== "https:")
-        throw new Error(`SEMA_REGISTRY_URL must be http(s), got "${scheme}"`);
-    const url = `${baseUrl.replace(/\/+$/, "")}/api/config/effective${worker ? `?worker=${encodeURIComponent(worker)}` : ""}`;
-    const res = await fetchImpl(url, {
-        headers: { authorization: `Bearer ${token}`, ...(etag ? { "if-none-match": etag } : {}) },
-        signal: AbortSignal.timeout(8000),
-    });
+import { centerFetch } from "./center-request.js";
+import { answerStillCurrent } from "../center-credential.js";
+const CENTER_PULL_TIMEOUT_MS = 8000;
+export async function fetchEffective(center, etag, fetchImpl = fetch, worker) {
+    const { res, identity } = await centerFetch(center, { kind: "effective", worker }, { etag, timeoutMs: CENTER_PULL_TIMEOUT_MS, fetchImpl });
     if (res.status === 304)
         return null;
     if (!res.ok)
@@ -29,10 +25,10 @@ export async function fetchEffective(baseUrl, token, etag, fetchImpl = fetch, wo
             domainErrors.push(f);
     }
     const effective = wire;
-    return { effective, etag: res.headers.get("etag") ?? undefined, readWarnings: warnings, ...(domainErrors.length > 0 ? { domainErrors } : {}) };
+    return { effective, etag: res.headers.get("etag") ?? undefined, readWarnings: warnings, credentialIdentity: identity, ...(domainErrors.length > 0 ? { domainErrors } : {}) };
 }
-export async function fetchPrincipalCaps(baseUrl, token, principal, etag, fetchImpl = fetch, worker) {
-    const raw = await requestPrincipalView(baseUrl, token, principal, etag, fetchImpl, worker);
+export async function fetchPrincipalCaps(center, principal, etag, fetchImpl = fetch, worker) {
+    const raw = await requestPrincipalView(center, principal, etag, fetchImpl, worker);
     if (raw === null)
         return null;
     const parsedBody = PrincipalCapsWire.safeParse(raw.json);
@@ -84,31 +80,29 @@ function assertPrincipalEcho(echoed, principal) {
         throw new Error(`config-center principal-caps response echoes principal ${JSON.stringify(echoed)} but ${JSON.stringify(principal)} was requested — discarding the whole response`);
     }
 }
-async function requestPrincipalView(baseUrl, token, principal, etag, fetchImpl, worker) {
-    const scheme = new URL(baseUrl).protocol;
-    if (scheme !== "http:" && scheme !== "https:")
-        throw new Error(`SEMA_REGISTRY_URL must be http(s), got "${scheme}"`);
-    const params = new URLSearchParams({ principal });
-    if (worker)
-        params.set("worker", worker);
-    const url = `${baseUrl.replace(/\/+$/, "")}/api/config/effective?${params.toString()}`;
-    const res = await fetchImpl(url, {
-        headers: { authorization: `Bearer ${token}`, ...(etag ? { "if-none-match": etag } : {}) },
-        signal: AbortSignal.timeout(8000),
-    });
+async function requestPrincipalView(center, principal, etag, fetchImpl, worker) {
+    const { res, identity } = await centerFetch(center, { kind: "effective", principal, worker }, { etag, timeoutMs: CENTER_PULL_TIMEOUT_MS, fetchImpl });
+    const stillCurrent = () => {
+        if (!answerStillCurrent(center.credential, identity)) {
+            throw new Error("center credential identity changed while the principal view was in flight — response discarded; the next lookup runs under the current credential");
+        }
+    };
     if (res.status === 304) {
         if (!etag)
             throw new Error("config-center returned 304 to a non-conditional principal-caps request");
+        stillCurrent();
         return null;
     }
     if (!res.ok)
         throw new Error(`config-center principal-caps HTTP ${res.status}`);
     const responseEtag = res.headers.get("etag");
-    return { json: await res.json(), ...(responseEtag !== null ? { etag: responseEtag } : {}) };
+    const json = await res.json();
+    stillCurrent();
+    return { json, ...(responseEtag !== null ? { etag: responseEtag } : {}) };
 }
 const PrincipalOrgMemoryEnvelope = PrincipalCapsWire.pick({ principal: true, orgMemory: true });
-export async function fetchPrincipalOrgMemory(baseUrl, token, principal, fetchImpl = fetch, worker) {
-    const raw = await requestPrincipalView(baseUrl, token, principal, undefined, fetchImpl, worker);
+export async function fetchPrincipalOrgMemory(center, principal, fetchImpl = fetch, worker) {
+    const raw = await requestPrincipalView(center, principal, undefined, fetchImpl, worker);
     if (raw === null)
         throw new Error("config-center returned 304 to a non-conditional org-directory fetch");
     const parsed = PrincipalOrgMemoryEnvelope.safeParse(raw.json);
@@ -126,9 +120,8 @@ export class ConfigCenterHttpError extends Error {
         this.name = "ConfigCenterHttpError";
     }
 }
-export async function fetchSkillContent(baseUrl, token, contentHash, fetchImpl = fetch) {
-    const url = `${baseUrl.replace(/\/+$/, "")}/api/config/skills/content/${encodeURIComponent(contentHash)}`;
-    const res = await fetchImpl(url, { headers: { authorization: `Bearer ${token}` }, signal: AbortSignal.timeout(8000) });
+export async function fetchSkillContent(center, contentHash, fetchImpl = fetch) {
+    const { res } = await centerFetch(center, { kind: "skill-content", contentHash }, { timeoutMs: CENTER_PULL_TIMEOUT_MS, fetchImpl });
     if (!res.ok)
         throw new ConfigCenterHttpError(`skill content HTTP ${res.status} for ${contentHash}`, res.status);
     const content = await res.text();
@@ -138,16 +131,14 @@ export async function fetchSkillContent(baseUrl, token, contentHash, fetchImpl =
         throw new Error(`skill content hash mismatch for ${contentHash}: computed sha256:${got}`);
     return content;
 }
-export async function fetchPromptArtifact(baseUrl, token, artifactDigest, fetchImpl = fetch) {
-    const url = `${baseUrl.replace(/\/+$/, "")}/api/config/prompts/epoch-artifacts/${encodeURIComponent(artifactDigest)}`;
-    const res = await fetchImpl(url, { headers: { authorization: `Bearer ${token}` }, signal: AbortSignal.timeout(8000) });
+export async function fetchPromptArtifact(center, artifactDigest, fetchImpl = fetch) {
+    const { res } = await centerFetch(center, { kind: "prompt-artifact", digest: artifactDigest }, { timeoutMs: CENTER_PULL_TIMEOUT_MS, fetchImpl });
     if (!res.ok)
         throw new ConfigCenterHttpError(`prompt artifact HTTP ${res.status} for ${artifactDigest}`, res.status);
     return await res.json();
 }
-export async function fetchPromptBlob(baseUrl, token, contentDigest, fetchImpl = fetch) {
-    const url = `${baseUrl.replace(/\/+$/, "")}/api/config/prompts/blobs/${encodeURIComponent(contentDigest)}`;
-    const res = await fetchImpl(url, { headers: { authorization: `Bearer ${token}` }, signal: AbortSignal.timeout(8000) });
+export async function fetchPromptBlob(center, contentDigest, fetchImpl = fetch) {
+    const { res } = await centerFetch(center, { kind: "prompt-blob", digest: contentDigest }, { timeoutMs: CENTER_PULL_TIMEOUT_MS, fetchImpl });
     if (!res.ok)
         throw new ConfigCenterHttpError(`prompt blob HTTP ${res.status} for ${contentDigest}`, res.status);
     const bytes = new Uint8Array(await res.arrayBuffer());

package/dist/config-center/restart-signal.d.ts

@@ -1,5 +1,5 @@
 import type { EffectiveConfig } from "./types.js";
-export type RestartSlice = "skills" | "mcp" | "a2a" | "scenarios" | "runtime-gates" | "models-tiers" | "degrade-route" | "read-face";
+export type RestartSlice = "skills" | "mcp" | "a2a" | "scenarios" | "degrade-route" | "read-face" | "memory-consolidation";
 /** What the CALLER must contribute about boot-baked catalog consumers that live OUTSIDE the Runner — the
  *  slices cannot see them, because they are configured from env (`ServiceConfig`), not from the center's
  *  EffectiveConfig. Absent/empty = that lane is off ⇒ its slice is inert (null on both sides). */
@@ -18,6 +18,18 @@ export interface RestartSliceCtx {
      *  新增/改址/域整体出现或消失仍签(新 mount / 改址只能 restart 才生效)。缺席/false = 旧语义照签
      *  (fail-closed:没接席的部署里删除向没人承接,restart 是它唯一的生效路径)。 */
     mcpRevocationLive?: boolean;
+    /** S-668 波 0(过渡;**波 1 转热后删**):记忆整理驱动席的两侧读数 —— `baked` = boot 期 core 解析器选中的
+     *  那只 Model 的指纹,`current` = 同一只解析器对本拍活配置再解一次的指纹(读法见
+     *  boot/memory-consolidation.ts `createConsolidationSeatWatch`)。缺席 = 阀门关着(`MEMORY_CONSOLIDATION_DRIVER`
+     *  不是 on,或记忆引擎没接线)⇒ 没有 boot 烤死的席 ⇒ `memory-consolidation` 片恒不签。 */
+    consolidationSeat?: {
+        readonly baked: unknown;
+        readonly current: unknown;
+    };
+    /** S-668 波 0(codex r1 [medium]):插件 host 白名单(env `PLUGINS_ALLOW_HOSTS`,boot 常量)—— 白名单外的声明
+     *  装载器整条跳过,它们的变化不是重启理由。生产 `restartCtx` 恒传 `config.pluginsAllowHosts`;缺席(单元调用)
+     *  = 装载器的出厂名单 `DEFAULT_PLUGIN_ALLOW_HOSTS`。 */
+    pluginsAllowHosts?: readonly string[];
 }
 /** Structured restart signal an orchestrator consumes (GET /health → `restart`). Change-detected against the
  *  process's BOOT config, NOT presence — so it stays absent when nothing baked-at-boot changed (presence would
@@ -46,18 +58,13 @@ export declare function stableStringify(v: unknown): string;
  *  can auto rolling-restart on a non-empty result WITHOUT a restart loop, because the comparison is always
  *  against boot (a refresh that re-fires the same diff is idempotent, not a fresh trigger). */
 export declare function restartReasons(boot: EffectiveConfig | undefined, current: EffectiveConfig, ctx?: RestartSliceCtx): RestartSlice[];
-/** codex R10 (models-tiers 窗收口): TRUE when the MODEL PLANE (enabled models + active tier table + resolved
- *  default) of `next` differs from the last-APPLIED plane `prev`. Under a tier-frozen Runner (tiers non-empty at
- *  construction → private expanded copy) main.ts DEFERS the whole plane mutation until restart when this is true —
- *  admission (/v1/models, the catalog gates) and the Runner then stay on ONE generation through the restart
- *  window, so a same-key retarget can never silently route/bill the stale Model object. `prev === undefined`
- *  (env-boot plane, no EffectiveConfig to compare) is conservatively "changed" — one deferred adoption + restart
- *  converges. Deliberately NOT gated on tier activity of either side (unlike the restart slice): a frozen Runner
- *  goes stale on ANY plane change, including a tiers-off flip. */
-/** codex R12: TRUE when this candidate resolves an ACTIVE tier table. Used by main.ts's defer predicate — a
- *  tier-less-booted Runner never re-runs expandTiers, so hot-applying an ARRIVING tier table splits admission
- *  (tier words pass the expanded gate) from execution (core throws "Unknown model ref"). Hot-apply of the model
- *  plane is safe only when BOTH the constructed generation and the candidate are tier-less. */
-export declare function planeHasActiveTiers(eff: EffectiveConfig): boolean;
+/** The refresh loop's SWAP gate: TRUE when the MODEL PLANE (enabled models + active tier table + resolved
+ *  default) of `next` differs from `prev`, the last plane handed to `swapRunnerDeps` — only then does the tick
+ *  pass `swapPlane` to applyEffective, so a candidate that moved only hot fields (pricing values / quota weights /
+ *  the `enabled:true` spelling, see catalogEntryFingerprint) or nothing on the plane swaps nothing. `prev ===
+ *  undefined` (env-boot plane, no EffectiveConfig to compare) is conservatively "changed": the first center plane
+ *  always swaps. Not gated on tier activity: a Runner's expanded catalog goes stale on ANY plane change,
+ *  including a tiers-off flip, and the default entry rides the fingerprint because the Runner's copy carries its
+ *  own `default` (codex R8; SAME resolver as applyEffective — resolveDefaultModelName, single source). */
 export declare function modelPlaneChanged(prev: EffectiveConfig | undefined, next: EffectiveConfig): boolean;
 //# sourceMappingURL=restart-signal.d.ts.map

package/dist/config-center/restart-signal.js

@@ -1,7 +1,8 @@
 import { resolveActiveTiers } from "@sema-agent/settings-schema";
+import { DEFAULT_PLUGIN_ALLOW_HOSTS, materializablePlugins } from "../capabilities/center-plugins.js";
 import { resolveDefaultModelName } from "./apply-effective.js";
 import { CENTER_READ_FACE_LIVE_KEYS } from "./read-face.js";
-const RESTART_SLICES = ["skills", "mcp", "a2a", "scenarios", "runtime-gates", "models-tiers", "degrade-route", "read-face"];
+const RESTART_SLICES = ["skills", "mcp", "a2a", "scenarios", "degrade-route", "read-face", "memory-consolidation"];
 export function stableStringify(v) {
     if (v === null || typeof v !== "object")
         return JSON.stringify(v) ?? "null";
@@ -26,31 +27,29 @@ function planeEntriesFingerprint(rows) {
     const enabled = enabledOnly(rows);
     return enabled ? enabled.map((m) => catalogEntryFingerprint(m)) : null;
 }
+function restartSlicePair(boot, current, slice, ctx) {
+    if (slice === "memory-consolidation") {
+        const seat = ctx?.consolidationSeat;
+        return seat === undefined ? [null, null] : [seat.baked, seat.current];
+    }
+    return [restartSliceValue(boot, slice, ctx), restartSliceValue(current, slice, ctx)];
+}
 function restartSliceValue(eff, slice, ctx) {
     if (!eff)
         return null;
     switch (slice) {
-        case "skills":
-            return enabledOnly(eff.skills?.skills);
+        case "skills": {
+            const skills = enabledOnly(eff.skills?.skills);
+            const materialized = materializablePlugins(eff, ctx?.pluginsAllowHosts ?? DEFAULT_PLUGIN_ALLOW_HOSTS);
+            const plugins = materialized.length > 0 ? materialized : null;
+            return skills === null && plugins === null ? null : { skills, plugins };
+        }
         case "mcp":
             return enabledOnly(eff.mcp?.servers);
         case "a2a":
             return enabledOnly(eff.a2a?.peers);
         case "scenarios":
             return enabledOnly(eff.scenarios?.scenarios);
-        case "runtime-gates": {
-            const ar = eff.governance?.approvalRequire;
-            return Array.isArray(ar) ? { approvalRequire: ar } : null;
-        }
-        case "models-tiers": {
-            const active = eff.models ? resolveActiveTiers(eff.models) : undefined;
-            if (!active || Object.keys(active).length === 0)
-                return null;
-            const enabled = enabledOnly(eff.models?.models);
-            const names = new Set((enabled ?? []).map((m) => m.name));
-            const def = resolveDefaultModelName(eff, (n) => names.has(n), enabled?.[0]?.name ?? "");
-            return { models: planeEntriesFingerprint(eff.models?.models), tiers: active, default: def.name };
-        }
         case "read-face": {
             const d = eff.readFace;
             if (!d)
@@ -70,8 +69,7 @@ function restartSliceValue(eff, slice, ctx) {
 }
 export function restartReasons(boot, current, ctx) {
     return RESTART_SLICES.filter((s) => {
-        const b = restartSliceValue(boot, s, ctx);
-        const c = restartSliceValue(current, s, ctx);
+        const [b, c] = restartSlicePair(boot, current, s, ctx);
         if (stableStringify(b) === stableStringify(c))
             return false;
         if (s === "mcp" && ctx?.mcpRevocationLive === true && Array.isArray(b) && Array.isArray(c) && c.length < b.length) {
@@ -89,10 +87,6 @@ export function restartReasons(boot, current, ctx) {
         return true;
     });
 }
-export function planeHasActiveTiers(eff) {
-    const active = eff.models ? resolveActiveTiers(eff.models) : undefined;
-    return active !== undefined && Object.keys(active).length > 0;
-}
 export function modelPlaneChanged(prev, next) {
     if (!prev)
         return true;

package/dist/config-center/skills-mcp.d.ts

@@ -2,6 +2,7 @@ import type { A2aServerSpec, McpServerSpec } from "@sema-agent/core";
 import type { CenterMcp, ScopedA2aPeer } from "../config-types.js";
 import type { Logger } from "../observability/logger.js";
 import type { LoadedSkill } from "../capabilities/skills.js";
+import type { CenterEndpoint } from "./center-request.js";
 import type { CenterA2aPeer, CenterMcpServer, CenterSkillManifest } from "./types.js";
 /**
  * Merge center skills OVER the image baseline ([ref]-sibling B1; `sema-registry docs/MCP-SKILLS.md`). Load order =
@@ -13,7 +14,9 @@ import type { CenterA2aPeer, CenterMcpServer, CenterSkillManifest } from "./type
  */
 export declare function applyCenterSkills(baseline: LoadedSkill[], manifest: {
     skills: CenterSkillManifest[];
-}, baseUrl: string, token: string, logger?: Logger, fetchImpl?: typeof fetch, 
+}, 
+/** S-651:中心端点(基址 + 凭证来源;每次正文拉取取一次值)。 */
+center: CenterEndpoint, logger?: Logger, fetchImpl?: typeof fetch, 
 /** LKG 姊妹面(clay 拍 2026-07-18):skill 正文的 content-addressed 盘缓存目录。读序=内存→盘(验
  *  hash,坏文件忽略)→中心(成功后 best-effort 回写)。让 LKG-boot 在中心不可达时不再于正文拉取上
  *  挂数秒(live 实测黑洞 +5.3s/skill 批),顺带省正常 refresh 的重复拉取。undefined=无盘缓存(原行为)。 */

package/dist/config-center/skills-mcp.js

@@ -5,7 +5,7 @@ import { CONTENT_ORIGIN_WORDS, describeBadContentOrigin, isContentOriginWord } f
 import { fetchSkillContent } from "./http-client.js";
 import { SHA256_HEX_RE } from "../digest-form.js";
 import { describeBadWireName, isUsableWireName } from "../wire-name-bound.js";
-export async function applyCenterSkills(baseline, manifest, baseUrl, token, logger, fetchImpl = fetch, diskCacheDir) {
+export async function applyCenterSkills(baseline, manifest, center, logger, fetchImpl = fetch, diskCacheDir) {
     const { promises: fsp } = await import("node:fs");
     const { join: joinPath } = await import("node:path");
     const diskRead = async (hash) => {
@@ -50,7 +50,7 @@ export async function applyCenterSkills(baseline, manifest, baseUrl, token, logg
             if (content === undefined)
                 content = await diskRead(m.contentHash);
             if (content === undefined) {
-                content = await fetchSkillContent(baseUrl, token, m.contentHash, fetchImpl);
+                content = await fetchSkillContent(center, m.contentHash, fetchImpl);
                 diskWrite(m.contentHash, content);
             }
             contentCache.set(m.contentHash, content);

package/dist/config-center/types.d.ts

@@ -303,7 +303,7 @@ export interface EffectiveConfig {
      *  settings-schema 0.6 起住 `governance` 域,0.7.1 撤了 runtime 位的双写镜像;此后 `RuntimeConfig` 是 strip
      *  的 zod object,两条腿(远端 `readEffectiveWire` / 本地 FileConfigStore→`buildEffective`)都把旧位 strip
      *  掉、由 `legacyGovernanceFromRuntime` 抬进 governance ⇒ 本仓在 runtime 位上读它们的每一行都是死码。
-     *  旧类型面上留着这三键,让 `runtime-gates` 重启片一直读着一个生产上恒缺席的位(审批闸收紧静默不生效)。 */
+     *  旧类型面上留着这三键,让(已于 S-668 波 2 退役的)`runtime-gates` 重启片一直读着一个生产上恒缺席的位(审批闸收紧静默不生效)。 */
     runtime?: {
         rateLimitPerMin?: number;
         maxTaskCostUsd?: number;
@@ -342,8 +342,8 @@ export interface EffectiveConfig {
     /** settings-schema 0.6 起治理三件(autonomy/commandPolicy/approvalRequire)的**唯一**承运域(0.7.1 撤
      *  runtime 位双写镜像;顺序契约当年已走完:消费端先切、center 再撤)。键集与 schema `GovernanceConfig.shape`
      *  逐字相等([ref] 件3 对账门钉)。消费:autonomy/commandPolicy 逐请求热(`stageRuntimeHot`,boot+refresh);
-     *  approvalRequire boot-baked(`stageApprovalGate`,refresh 不写)⇒ 变更由 `runtime-gates` 重启片通告。
-     *  同一 presence 规则(undefined = 不管 → 保 env / 回基线)。 */
+     *  approvalRequire 自 S-668 波 2 起同样热(`stageApprovalGate`,boot+refresh 双腿,有自己的拒绝臂)。
+     *  同一 presence 规则(undefined = 不管 → 回 env 基线,非粘)。 */
     governance?: {
         autonomy?: Autonomy;
         commandPolicy?: CommandRule[];

package/dist/config-invariants.d.ts

@@ -28,9 +28,9 @@ import type { ServiceConfigFlat } from "./config-types.js";
  */
 export declare const LIVENESS_HEARTBEAT_MS = 30000;
 /** 闭集:新增一条不变量必须在这里加词(拼错 = 编译红,而不是运行期悄悄不判)。 */
-export type CrossInvariantId = "run-stale-heartbeat" | "bind-posture" | "bake-runner-credential" | "direct-door-anchors" | "operator-principals-required" | "bake-operator-principals" | "sensitive-write-patterns" | "leader-host-lane" | "leader-durable-store" | "device-durable-store" | "device-durable-approval" | "model-provider-word" | "gateway-url-userinfo" | "model-route-endpoint" | "require-execution-lane" | "hosted-requires-principal";
+export type CrossInvariantId = "run-stale-heartbeat" | "bind-posture" | "bake-runner-credential" | "direct-door-anchors" | "operator-principals-required" | "bake-operator-principals" | "sensitive-write-patterns" | "leader-host-lane" | "leader-durable-store" | "device-durable-store" | "device-durable-approval" | "model-provider-word" | "gateway-url-userinfo" | "model-route-endpoint" | "require-execution-lane";
 /** 表读的键集(取自平铺配置型 ⇒ 键名/类型永不与真配置漂)。 */
-export type CrossInvariantView = Readonly<Pick<ServiceConfigFlat, "runStaleSec" | "authToken" | "authTokens" | "allowUnauthedWrites" | "imageBakes" | "directApprovalDoor" | "durableApproval" | "approvalHmacKeys" | "principalJwtPubkeys" | "principalJwtIss" | "principalJwtAud" | "requirePrincipal" | "operatorPrincipals" | "sensitiveWritePatterns" | "leaderEnabled" | "remoteExec" | "requireExecutionLane" | "dbBackend" | "tidb" | "pg" | "envModel" | "gatewayBaseUrl" | "gatewayFallbackUrls" | "anthropic" | "models" | "authBridgeIssuer">>;
+export type CrossInvariantView = Readonly<Pick<ServiceConfigFlat, "runStaleSec" | "authToken" | "authTokens" | "allowUnauthedWrites" | "imageBakes" | "directApprovalDoor" | "durableApproval" | "approvalHmacKeys" | "principalJwtPubkeys" | "principalJwtIss" | "principalJwtAud" | "requirePrincipal" | "operatorPrincipals" | "sensitiveWritePatterns" | "leaderEnabled" | "remoteExec" | "requireExecutionLane" | "dbBackend" | "tidb" | "pg" | "envModel" | "gatewayBaseUrl" | "gatewayFallbackUrls" | "anthropic" | "models">>;
 export interface CrossInvariantInput {
     /** 现役配置(boot 期 = 候选自身)。 */
     readonly live: CrossInvariantView;

package/dist/config-invariants.js

@@ -1,5 +1,4 @@
 import { assertGuardPatternsUsable } from "./deployment-governance.js";
-import { hostedPrincipalRefusal } from "./hosted-posture.js";
 import { modelProviderRefusal } from "./model-provider.js";
 import { modelRouteUrlRefusal } from "./model-route-url.js";
 import { modelRouteEndpointRefusal } from "./model-route-endpoint.js";
@@ -82,13 +81,6 @@ export const CONFIG_CROSS_INVARIANTS = [
             ? "IMAGE_BAKES_ENABLED with an EMPTY OPERATOR_PRINCIPALS is a world-writable bake door (the runner runs build.sh on the privileged build host)"
             : undefined,
     },
-    {
-        id: "hosted-requires-principal",
-        keys: ["requirePrincipal", "principalJwtPubkeys", "principalJwtIss", "principalJwtAud", "authBridgeIssuer"],
-        restartReason: "hosted-posture",
-        bootAnchor: { file: "src/config.ts", marker: "CROSS-INVARIANT:hosted-requires-principal" },
-        check: ({ next }) => hostedPrincipalRefusal(next),
-    },
     {
         id: "sensitive-write-patterns",
         keys: ["sensitiveWritePatterns"],

package/dist/config-lkg.d.ts

@@ -1,8 +1,10 @@
 /** 落盘信封。`effective`/`etag` 逐字=当时的 fetchEffective 返回(JSON verbatim 面)。 */
 export interface PersistedLkg {
-    formatVersion: 1;
+    formatVersion: 2;
     savedAt: string;
     worker: string;
+    /** 拉到这份候选时所用凭证的身份(`center-credential.ts`;摘要形,不含凭证原文)。 */
+    identity: string;
     etag?: string;
     effective: Record<string, unknown>;
 }
@@ -10,21 +12,58 @@ export interface PersistedLkg {
  *  hash 另拉)——黑洞中心下 LKG-boot 会在 skill 正文拉取上再挂数秒(live 实测 +5.3s)。正文按
  *  `<dir>/<sha-hex>` 落盘,读侧**必验 hash**(content-addressed 的全部意义;坏文件=忽略重拉)。 */
 export declare function defaultSkillCacheDir(): string;
-/** 默认路径(scheduler store 同门:SEMA_CONFIG_DIR → ~/.sema)。`CONFIG_LKG_PATH` 覆写;
- *  `CONFIG_LKG_ENABLED=false` 关闭(读写双关)。🪦 正名前的 `CONFIG_LKG_DISABLED` 自 server 3.0.0 起是
- *  **fail-loud 墓碑**——设了(任何值)即拒启并指路新名,不再被读取。 */
-export declare function defaultLkgPath(worker: string | undefined): string;
+/** 默认路径(scheduler store 同门:SEMA_CONFIG_DIR → ~/.sema),按「worker + 凭证身份」分箱。`CONFIG_LKG_PATH`
+ *  覆写(单一路径 ⇒ 不分箱,信封的 worker + identity 核仍守读回);`CONFIG_LKG_ENABLED=false` 关闭(读写双关)。
+ *  🪦 正名前的 `CONFIG_LKG_DISABLED` 自 server 3.0.0 起是**fail-loud 墓碑**——设了(任何值)即拒启并指路新名,不再被读取。 */
+export declare function defaultLkgPath(worker: string | undefined, identity: string): string;
 /** 原子落盘一个干净候选(tmp+rename,0600)。BEST-EFFORT:失败=一条 warn 的素材(调用方发),绝不
  *  影响在飞的应用链——LKG 缓存丢失的代价只是下次冷启动回到 env 兜底。 */
-export declare function saveLkg(path: string, worker: string | undefined, effective: Record<string, unknown>, etag: string | undefined): Promise<void>;
+export declare function saveLkg(path: string, worker: string | undefined, identity: string, effective: Record<string, unknown>, etag: string | undefined): Promise<void>;
 /**
  * 读盘上 LKG。返回 undefined 的所有情形都「安静地回 env 兜底」(调用方 warn 点名 reason):
- * 文件缺席/JSON 坏/信封形不对/worker 不匹配(防同名文件跨 worker 串包)/prompts 面复判失败。
+ * 文件缺席/JSON 坏/信封形不对/worker 或凭证身份不匹配(防同名文件跨 worker / 跨账号串包;`CONFIG_LKG_PATH`
+ * 单一路径时这是唯一的一道)/prompts 面复判失败。
  */
-export declare function loadLkg(path: string, worker: string | undefined): Promise<{
+export declare function loadLkg(path: string, worker: string | undefined, identity: string): Promise<{
     lkg: PersistedLkg;
 } | {
     lkg?: undefined;
     reason: string;
 }>;
+/** 7.98.0 及以前的默认 LKG 路径(按当时的写法逐字保留 —— 这是盘上已有文件的名字,不是现行分箱规则)。 */
+export declare function legacyV1LkgPath(worker: string | undefined): string;
+export type LegacyLkgMigration = {
+    readonly outcome: "none";
+}
+/** `retireError`:新箱已写好,只是旧文件没退役成(改名 / 留副本失败)—— 只响一行,不影响已写好的箱。 */
+ | {
+    readonly outcome: "migrated";
+    readonly from: string;
+    readonly retiredTo: string;
+    readonly retireError?: string;
+} | {
+    readonly outcome: "not-migrated";
+    readonly path: string;
+    readonly reason: string;
+};
+/**
+ * formatVersion 1 LKG 的一次性迁移(规则一句:**身份推得出来才迁,推不出来就响亮拒**)。判序:
+ *  1. `legacyPath` ≠ `binPath` 时**先看本身份的箱**:箱里已有文件 ⇒ `none`(箱自己说话,旧文件是好是坏都不再相关,
+ *     不许一个坏旧文件把有效的箱挡成 env 兜底 —— 7.99.0 修复验证 N4)。箱查不了(非 ENOENT)⇒ 响亮拒。
+ *  2. 旧文件没有(ENOENT / ENOTDIR)或不是 formatVersion 1 信封 ⇒ `none`。旧默认路径上却读不了 / 不是 JSON ⇒
+ *     `not-migrated`(响亮,不当它不存在);`CONFIG_LKG_PATH` 同路径时这两形由 loadLkg 自己报(不重复打一行)。
+ *  3. v1 信封只记 worker:唯一推得出身份的形是拉取令牌(身份 = worker,`pullTokenIdentity`)。此刻身份正是它、worker
+ *     对得上、载荷过 {@link lkgPayloadProblem} ⇒ **先写后退役**(修复验证 N9):先按新格式把它写进 `binPath`(原子写,
+ *     0600),写成了才把旧文件改名 `<legacyPath>.migrated-v1`。写失败 ⇒ `not-migrated`,旧文件原样留在原位,下一次
+ *     照常可迁;写成之后改名失败 ⇒ 仍是 `migrated`(`retireError` 响一行),箱已在 ⇒ 下一次按判序 1 不再看旧文件。
+ *     同路径(`CONFIG_LKG_PATH`)时新箱的写入会原子替换旧文件本身,所以旧字节在写之前留一份 `.migrated-v1` 副本
+ *     (副本失败同样只进 `retireError`:载荷正要写进新箱,不是丢数据)。
+ *  4. 其余一律 `not-migrated`:拒因点名旧文件路径与出路(删掉它;中心下一份干净候选会写本身份自己的 LKG),不改名、不读回。
+ */
+export declare function migrateV1Lkg(o: {
+    legacyPath: string;
+    binPath: string;
+    worker: string | undefined;
+    identity: string;
+}): Promise<LegacyLkgMigration>;
 //# sourceMappingURL=config-lkg.d.ts.map