@sema-agent/server 7.99.0 → 7.101.0

package/dist/config-center/apply-effective.js

@@ -1,13 +1,16 @@
-import { resolveActiveTiers, SEALED_BOX_ALG } from "@sema-agent/settings-schema";
+import { resolveActiveTiers } from "@sema-agent/settings-schema";
 import { sealedKeyPoison } from "../sealed-key.js";
 import { applyAutoCompactWindow, buildModelCostKey, findUnmatchableToolNames, formatUnmatchableToolNames, parseAutonomy } from "../config.js";
 import { buildModelCompat, readModelCompat } from "../model-compat.js";
 import { validateCommandRules } from "../runtime-governance.js";
 import { projectCollabToWorkflows, registerCollabWorkflows } from "../capabilities/collab-workflows.js";
 import { stageLimits } from "./stage-limits.js";
-import { BATCH1_LIMIT_KEYS } from "./hot-keys-registry.js";
+import { APPROVAL_GROUP_KEYS, BATCH1_LIMIT_KEYS } from "./hot-keys-registry.js";
 import { buildDisplaySafeUrl } from "../trace/redact.js";
 import { crossInvariant } from "../config-invariants.js";
+import { judgeCatalogEntries, mintedRefusedNames, refusalEventOf, refusalWarnFields, REFUSED_NAME_MINTED_CODE, unreadableDroppedRefusal } from "../model-entry-refusal.js";
+import { gateIntentUnserviceableReason } from "../approval.js";
+import { refusedGroups } from "./apply-ledger.js";
 const charsPerTokenOf = (v) => (typeof v === "number" && Number.isFinite(v) && v > 0 ? v : undefined);
 function envDerivedModel(config) {
     const m = config.envModel;
@@ -93,7 +96,7 @@ function stageAtModelAllowlist(raw, models, logger) {
     }
     return names;
 }
-export function applyEffective(config, eff, logger, opts = {}) {
+export function applyEffective(config, eff, logger, opts) {
     const staged = stageEffective(config, eff, logger, opts);
     const gen = opts.generation ?? staged.version;
     const live = appliedGeneration.get(config);
@@ -102,9 +105,10 @@ export function applyEffective(config, eff, logger, opts = {}) {
         logger?.warn("sema_registry_stale_generation_refused", { staged: staged.version, stagedOrdinal: gen, live, note: "an older staged generation must not overwrite a newer committed one — refused whole; next poll replays" });
         return false;
     }
-    if (staged.modelPlane !== undefined && opts.swapPlane !== undefined) {
+    const mp = staged.modelPlaneGroup.stages.models;
+    if (mp !== undefined && opts.swapPlane !== undefined) {
         try {
-            opts.swapPlane({ models: staged.modelPlane.models, tiers: staged.modelPlane.activeTiers });
+            opts.swapPlane({ models: mp.models, tiers: mp.activeTiers });
         }
         catch (err) {
             logger?.warn("sema_registry_model_plane_swap_refused", {
@@ -118,25 +122,31 @@ export function applyEffective(config, eff, logger, opts = {}) {
     commitStaged(config, staged);
     if (ordered)
         appliedGeneration.set(config, gen);
-    opts.report?.({
-        version: staged.version,
-        ...(opts.generation !== undefined ? { ordinal: opts.generation } : {}),
-        limits: {
-            applied: staged.limits.changed,
-            ...(staged.limits.deferred.length > 0 ? { deferred: staged.limits.deferred } : {}),
-            ...(staged.limits.rejected ? { rejected: staged.limits.rejected } : {}),
-        },
-        fullyApplied: staged.limits.rejected === undefined,
-    });
+    if (opts.report) {
+        const report = {
+            version: staged.version,
+            ...(opts.generation !== undefined ? { ordinal: opts.generation } : {}),
+            groups: {
+                limitsHttp: {
+                    applied: staged.limits.changed,
+                    ...(staged.limits.deferred.length > 0 ? { deferred: staged.limits.deferred } : {}),
+                    ...(staged.limits.rejected ? { rejected: staged.limits.rejected } : {}),
+                },
+                approvalGate: groupReportOf(staged.approvalGate),
+                modelPlane: modelPlaneGroupReport(staged.modelPlaneGroup),
+            },
+        };
+        opts.report({ ...report, fullyApplied: refusedGroups(report).length === 0 });
+    }
     if (staged.limits.changed.length > 0)
         logger?.info("sema_registry_limits", { version: staged.version, keys: staged.limits.changed });
-    if (staged.modelPlane)
-        logger?.info("sema_registry_models", staged.modelPlane.infoLine);
-    if (staged.gatesInfo)
-        logger?.info("sema_registry_runtime", staged.gatesInfo);
+    if (mp)
+        logger?.info("sema_registry_models", mp.infoLine);
+    if (staged.approvalGate.next !== undefined)
+        logger?.info("sema_registry_runtime", { version: staged.version, approvalRequire: staged.approvalGate.next });
     if (Object.keys(staged.hot.infoLine).length > 0)
         logger?.info("sema_registry_runtime_hot", staged.hot.infoLine);
-    for (const n of staged.collabPlane?.notices ?? []) {
+    for (const n of staged.modelPlaneGroup.stages.collab?.notices ?? []) {
         if (n.level === "warn")
             logger?.warn(n.msg, n.fields);
         else
@@ -147,10 +157,11 @@ export function applyEffective(config, eff, logger, opts = {}) {
     return true;
 }
 function commitStaged(config, staged) {
-    const mp = staged.modelPlane;
+    const mp = staged.modelPlaneGroup.stages.models;
     if (mp) {
         config.modelApiKeyEnv = mp.modelApiKeyEnv;
         config.modelApiKeys = mp.modelApiKeys;
+        config.modelRefusals = mp.modelRefusals;
         mutateInPlace(config.modelQuotaWeights, mp.quotaWeights);
         mutateInPlace(config.models, mp.models);
         config.model = config.models.default;
@@ -158,10 +169,8 @@ function commitStaged(config, staged) {
         mutateInPlace(config.tiers, mp.activeTiers);
         config.atModelAllowlist = mp.atModelAllowlist;
     }
-    if (staged.gateAssignments) {
-        for (const [k, v] of staged.gateAssignments)
-            config[k] = v;
-    }
+    if (staged.approvalGate.next !== undefined)
+        config.approvalRequire = staged.approvalGate.next;
     for (const [k, v] of staged.limits.assignments)
         config[k] = v;
     for (const k of staged.limits.deletions)
@@ -170,62 +179,90 @@ function commitStaged(config, staged) {
         config.autonomy = staged.hot.autonomyNext;
     if (staged.hot.setCommandPolicy)
         config.commandPolicy = staged.hot.commandPolicyNext;
-    if (staged.collabPlane)
-        registerCollabWorkflows(staged.collabPlane.workflows);
+    const collab = staged.modelPlaneGroup.stages.collab;
+    if (collab !== undefined)
+        registerCollabWorkflows(collab.workflows);
     mutateInPlace(config.projects, staged.projects);
 }
-function stageEffective(config, eff, logger, opts) {
-    if (!opts.teamsOnly && !eff.version) {
-        logger?.warn("sema_registry_unpublished", {
-            version: eff.version,
-            note: "empty/unpublished effective config — using env + built-in fallback; publish a config or unset CONFIG_PUBLISH_MODE",
-        });
-    }
+export const MODEL_PLANE_DOMAINS = ["models", "collab"];
+const MODEL_PLANE_SURFACES = {
+    models: ["models", "model", "modelRefusals", "modelApiKeyEnv", "modelApiKeys", "modelQuotaWeights", "roles", "tiers", "atModelAllowlist"],
+    collab: ["collabWorkflows"],
+};
+const MODEL_PLANE_GROUP_KEYS = MODEL_PLANE_DOMAINS.flatMap((d) => MODEL_PLANE_SURFACES[d]);
+export function withModelPlaneOf(target, source) {
+    const out = { ...target };
+    for (const d of MODEL_PLANE_DOMAINS)
+        takeModelPlaneDomain(out, source, d);
+    return out;
+}
+function takeModelPlaneDomain(out, source, d) {
+    const v = source[d];
+    if (v === undefined)
+        delete out[d];
+    else
+        out[d] = v;
+}
+export function buildEnvOnlyModelPlane() {
+    return { models: { models: [], roles: {} } };
+}
+function modelPlaneGroupReport(group) {
+    return {
+        applied: MODEL_PLANE_DOMAINS.flatMap((d) => (group.stages[d] !== undefined ? MODEL_PLANE_SURFACES[d] : [])),
+        ...(group.rejected !== undefined ? { rejected: { keys: group.rejected.keys, reason: group.rejected.reason } } : {}),
+    };
+}
+const ROLE_BINDING_UNAVAILABLE_HINT = "tasks resolving this role fail: alias/tier expansion cannot mint this name; the engine refuses it loud — bind the role to a usable model, or make the entry usable (see the entry's own warn)";
+function stageModelPlane(config, eff, logger, sealedKeys) {
     const enabled = (eff.models?.models ?? []).filter((m) => m.enabled !== false);
-    let modelPlane;
-    if (enabled.length > 0 && opts.deferModelPlane !== true) {
+    const droppedEnabled = eff.models?.droppedIdentities;
+    if (enabled.length === 0 && !(Array.isArray(droppedEnabled) && droppedEnabled.length > 0))
+        return { stages: { collab: stageCollabDomain(eff) } };
+    {
+        const verdict = judgeCatalogEntries(enabled, { anthropicRouteMounted: config.anthropic !== undefined }, eff.models.droppedIdentities);
+        for (const [name, r] of Object.entries(verdict.refused))
+            logger?.warn(refusalEventOf(r.reason), refusalWarnFields(name, r));
+        const refuse = (invariant, reason, detail = {}) => {
+            logger?.warn("sema_registry_model_plane_refused", {
+                version: typeof eff.version === "number" ? eff.version : 0,
+                invariant,
+                reason,
+                ...detail,
+                kept: "the model plane of this candidate is refused as a group — the current model plane (catalog / roles / tiers / refusals / allowlist, and the collab workflows that reference it) keeps serving and the other groups of this candidate still apply; the candidate is not fully applied (LKG / ETag stay on the last fully applied generation) and is re-judged next pull",
+            });
+            return { stages: {}, rejected: { keys: MODEL_PLANE_GROUP_KEYS, reason, invariant }, refused: verdict.refused };
+        };
+        if (verdict.unreadable.length > 0) {
+            logger?.warn("sema_registry_model_entry_dropped_unproven", {
+                entries: [...verdict.unreadable],
+                code: REFUSED_NAME_MINTED_CODE,
+                hint: "these catalog entries were dropped by the settings-schema read and the raw document could not be matched to the snapshot that was parsed (e.g. the local file changed between two reads) — their names cannot be proven, so no tombstone can be minted and the candidate's model plane is refused (a name nobody can prove cannot be shown not to be re-minted by the tier/alias expansion); the next read re-judges",
+            });
+            return refuse("refused-names-not-minted", unreadableDroppedRefusal(verdict.unreadable));
+        }
+        const usable = verdict.usable;
         const models = {};
         const modelApiKeyEnv = {};
         const modelApiKeys = {};
         const envModel = envDerivedModel(config);
         const envDefaults = { maxTokens: envModel.maxTokens, contextWindow: envModel.contextWindow, reasoning: envModel.reasoning, charsPerToken: envModel.charsPerToken, defaultThinking: envModel.defaultThinking, compat: envModel.compat };
-        for (const m of enabled) {
-            const rawBaseUrl = m.baseUrl;
-            let safeUrl = rawBaseUrl;
-            if (rawBaseUrl) {
-                let ok = false;
-                try {
-                    const u = new URL(rawBaseUrl);
-                    ok = u.protocol === "http:" || u.protocol === "https:";
-                }
-                catch {
-                    ok = false;
-                }
-                if (ok)
-                    logger?.warn("sema_registry_model_base_url", { model: m.name, baseUrl: buildDisplaySafeUrl(rawBaseUrl), hint: "registry-directed gateway override — this model's key authenticates AGAINST THIS URL" });
-                else {
-                    logger?.warn("sema_registry_model_base_url_rejected", { model: m.name, baseUrl: buildDisplaySafeUrl(String(rawBaseUrl)), hint: "only http(s) URLs are honored — falling back to the deployment gateway (MODEL_GATEWAY_BASEURL); with none declared the whole candidate is refused (model-route-endpoint)" });
-                    safeUrl = undefined;
-                }
-            }
-            models[m.name] = toModel(safeUrl === rawBaseUrl ? m : { ...m, baseUrl: safeUrl }, envDefaults, logger);
+        for (const m of usable) {
+            if (m.baseUrl)
+                logger?.warn("sema_registry_model_base_url", { model: m.name, baseUrl: buildDisplaySafeUrl(m.baseUrl), hint: "registry-directed gateway override — this model's key authenticates AGAINST THIS URL" });
+            models[m.name] = toModel(m, envDefaults, logger);
             if (m.sealedApiKey) {
                 const s = m.sealedApiKey;
-                if (s.alg !== SEALED_BOX_ALG) {
-                    logger?.warn("sema_registry_model_sealed_key_bad_alg", { model: m.name, alg: String(s.alg), expected: SEALED_BOX_ALG, hint: "unsupported sealed-box alg — key POISONED: tasks on this model fail loud (no apiKeyEnv fallback, no gateway fallback; contract v1 pins the alg)" });
-                    modelApiKeys[m.name] = sealedKeyPoison(s.publicKeyId, "unsupported_alg");
-                }
-                else if (!opts.sealedKeys) {
+                if (!sealedKeys) {
                     logger?.warn("sema_registry_model_sealed_key_no_store", { model: m.name, publicKeyId: s.publicKeyId, hint: "no sealed-key store on this host (boot custody init failed or lane unwired) — key POISONED: tasks on this model fail loud (no apiKeyEnv fallback, no gateway fallback)" });
                     modelApiKeys[m.name] = sealedKeyPoison(s.publicKeyId, "no_key_store");
                 }
-                else if (!opts.sealedKeys.has(s.publicKeyId)) {
-                    logger?.warn("sema_registry_model_sealed_key_no_private_key", { model: m.name, publicKeyId: s.publicKeyId, held: opts.sealedKeys.ids(), hint: "ciphertext targets a private key this host doesn't hold (rotated away / other host) — key POISONED: tasks on this model fail loud until the operator re-pastes the key in the web UI (it seals against the newest registered public key)" });
+                else if (!sealedKeys.has(s.publicKeyId)) {
+                    logger?.warn("sema_registry_model_sealed_key_no_private_key", { model: m.name, publicKeyId: s.publicKeyId, held: sealedKeys.ids(), hint: "ciphertext targets a private key this host doesn't hold (rotated away / other host) — key POISONED: tasks on this model fail loud until the operator re-pastes the key in the web UI (it seals against the newest registered public key)" });
                     modelApiKeys[m.name] = sealedKeyPoison(s.publicKeyId, "stale_ciphertext");
                 }
                 else {
                     try {
-                        modelApiKeys[m.name] = opts.sealedKeys.open(s.ciphertext, s.publicKeyId);
+                        modelApiKeys[m.name] = sealedKeys.open(s.ciphertext, s.publicKeyId);
                     }
                     catch (err) {
                         logger?.warn("sema_registry_model_sealed_key_open_failed", { model: m.name, publicKeyId: s.publicKeyId, err: String(err), hint: "corrupt/foreign ciphertext — key POISONED: tasks on this model fail loud (no apiKeyEnv fallback, no gateway fallback)" });
@@ -239,12 +276,9 @@ function stageEffective(config, eff, logger, opts) {
                 else
                     logger?.warn("sema_registry_model_key_env_missing", { model: m.name, apiKeyEnv: m.apiKeyEnv, hint: "env var not set in this service — model falls back to the gateway key" });
             }
-            if (m.provider === "anthropic" && !config.anthropic) {
-                logger?.warn("sema_registry_model_no_brain", { model: m.name, provider: m.provider, hint: "set ANTHROPIC_API_KEY in this service's env, else it mis-routes to the gateway brain" });
-            }
         }
         const quotaWeights = {};
-        for (const m of enabled) {
+        for (const m of usable) {
             const qw = typeof m.quotaWeight === "number" && Number.isFinite(m.quotaWeight) && m.quotaWeight > 0 ? m.quotaWeight : undefined;
             if (qw !== undefined) {
                 quotaWeights[m.name] = qw;
@@ -262,41 +296,80 @@ function stageEffective(config, eff, logger, opts) {
                 centerRoles[role] = { select: tgt.select };
         }
         const roles = { ...envRolesBaseline.get(config), ...centerRoles };
-        const activeTiers = resolveActiveTiers(eff.models) ?? {};
-        const picked = resolveDefaultModelName(eff, (n) => models[n] !== undefined, enabled[0].name, (source, name) => logger?.warn("sema_registry_default_dangling", { source, name, hint: "explicit default names a model that is not in the enabled catalog — falling to the next source" }));
-        models.default = models[picked.name];
-        const endpointRefusal = crossInvariant("model-route-endpoint").check({ live: config, next: { ...config, models } });
-        if (endpointRefusal !== undefined) {
-            throw new Error(`candidate model plane refused whole (cross-invariant model-route-endpoint): ${endpointRefusal} ` +
-                "The current generation keeps serving; the candidate is re-judged on the next pull.");
+        let picked;
+        if (usable.length > 0) {
+            picked = resolveDefaultModelName(eff, (n) => models[n] !== undefined, usable[0].name, (source, name) => logger?.warn("sema_registry_default_dangling", {
+                source,
+                name,
+                ...(Object.hasOwn(verdict.refused, name) ? { unavailable: verdict.refused[name].code } : {}),
+                hint: "explicit default names a model that is not in the usable catalog (not enabled, or unavailable on this host — see `unavailable`) — falling to the next source",
+            }));
+            models.default = models[picked.name];
+        }
+        const activeTiers = {};
+        for (const [tier, target] of Object.entries(resolveActiveTiers(eff.models) ?? {})) {
+            if (models[target] !== undefined) {
+                activeTiers[tier] = target;
+                continue;
+            }
+            const refusal = Object.hasOwn(verdict.refused, target) ? verdict.refused[target] : undefined;
+            logger?.warn("sema_registry_tier_binding_unavailable", { tier, model: target, ...(refusal !== undefined ? { code: refusal.code } : {}), hint: "this tier binding names a model that is not in this generation's usable catalog — the binding is dropped (the tier word falls to the next lower bound tier, core's ladder); fix the entry or rebind the tier" });
+        }
+        const nextView = { ...config, models, tiers: activeTiers, modelRefusals: verdict.refused };
+        const noDefault = crossInvariant("default-model-resolvable").check({ live: config, next: nextView });
+        if (noDefault !== undefined)
+            return refuse("default-model-resolvable", noDefault);
+        const endpointRefusal = crossInvariant("model-route-endpoint").check({ live: config, next: nextView });
+        if (endpointRefusal !== undefined)
+            return refuse("model-route-endpoint", endpointRefusal);
+        const minted = crossInvariant("refused-names-not-minted").check({ live: config, next: nextView });
+        if (minted !== undefined)
+            return refuse("refused-names-not-minted", minted, { minted: mintedRefusedNames(nextView) });
+        for (const [role, spec] of Object.entries(roles)) {
+            const target = typeof spec === "string" ? spec : spec !== null && typeof spec === "object" && "model" in spec && typeof spec.model === "string" ? spec.model : undefined;
+            const refusal = target !== undefined && Object.hasOwn(verdict.refused, target) ? verdict.refused[target] : undefined;
+            if (refusal !== undefined) {
+                logger?.warn("sema_registry_role_binding_unavailable", { role, model: target, code: refusal.code, hint: ROLE_BINDING_UNAVAILABLE_HINT });
+            }
         }
         const atModelAllowlist = stageAtModelAllowlist(eff.models?.atModelAllowlist, models, logger);
-        modelPlane = {
+        const defaultModel = models.default;
+        const plane = {
             models,
             modelApiKeyEnv,
             modelApiKeys,
+            modelRefusals: { ...verdict.refused },
             quotaWeights,
             roles,
             activeTiers,
             atModelAllowlist,
-            infoLine: { count: enabled.length, default: models.default.id, defaultSource: picked.source, roles: Object.keys(roles), tiers: Object.keys(activeTiers), atModelAllowlist: atModelAllowlist.length, sealedKeys: Object.values(modelApiKeys).filter((v) => typeof v === "string").length, sealedPoisoned: Object.values(modelApiKeys).filter((v) => typeof v !== "string").length },
+            infoLine: { count: usable.length, ...(Object.keys(verdict.refused).length > 0 ? { unavailable: Object.keys(verdict.refused) } : {}), default: defaultModel.id, defaultSource: picked.source, roles: Object.keys(roles), tiers: Object.keys(activeTiers), atModelAllowlist: atModelAllowlist.length, sealedKeys: Object.values(modelApiKeys).filter((v) => typeof v === "string").length, sealedPoisoned: Object.values(modelApiKeys).filter((v) => typeof v !== "string").length },
         };
+        return { stages: { models: plane, collab: stageCollabDomain(eff) }, defaultName: picked.name, refused: verdict.refused };
+    }
+}
+function stageCollabDomain(eff) {
+    const projected = projectCollabToWorkflows(eff.collab?.templates);
+    const notices = [];
+    if (Object.keys(projected.workflows).length > 0)
+        notices.push({ level: "info", msg: "sema_registry_collab_workflows", fields: { workflows: Object.keys(projected.workflows) } });
+    if (projected.skipped.length > 0)
+        notices.push({ level: "warn", msg: "sema_registry_collab_skipped", fields: { skipped: projected.skipped } });
+    if (projected.notes.length > 0)
+        notices.push({ level: "info", msg: "sema_registry_collab_notes", fields: { notes: projected.notes } });
+    return { workflows: projected.workflows, notices };
+}
+function stageEffective(config, eff, logger, opts) {
+    if (opts.leg === "boot" && !eff.version) {
+        logger?.warn("sema_registry_unpublished", {
+            version: eff.version,
+            note: "empty/unpublished effective config — using env + built-in fallback; publish a config or unset CONFIG_PUBLISH_MODE",
+        });
     }
-    const gates = opts.teamsOnly ? undefined : stageApprovalGate(eff.governance, logger);
+    const modelPlaneGroup = stageModelPlane(config, eff, logger, opts.sealedKeys);
+    const approvalGate = stageApprovalGate(config, eff.governance, opts, logger);
     const limits = stageLimits(config, { version: typeof eff.version === "number" ? eff.version : 0, ...("limits" in eff ? { limits: eff.limits } : {}), legacyGates: legacyGateValues(eff.runtime) }, logger);
     const hot = stageRuntimeHot(config, eff.governance, logger);
-    let collabPlane;
-    if (opts.deferModelPlane !== true) {
-        const projected = projectCollabToWorkflows(eff.collab?.templates);
-        const notices = [];
-        if (Object.keys(projected.workflows).length > 0)
-            notices.push({ level: "info", msg: "sema_registry_collab_workflows", fields: { workflows: Object.keys(projected.workflows) } });
-        if (projected.skipped.length > 0)
-            notices.push({ level: "warn", msg: "sema_registry_collab_skipped", fields: { skipped: projected.skipped } });
-        if (projected.notes.length > 0)
-            notices.push({ level: "info", msg: "sema_registry_collab_notes", fields: { notes: projected.notes } });
-        collabPlane = { workflows: projected.workflows, notices };
-    }
     const projDomain = eff.projects;
     const rawProjects = (projDomain && typeof projDomain === "object" && !Array.isArray(projDomain) &&
         "projects" in projDomain && typeof projDomain.projects === "object"
@@ -315,16 +388,14 @@ function stageEffective(config, eff, logger, opts) {
     }
     return {
         version: typeof eff.version === "number" && Number.isFinite(eff.version) ? eff.version : 0,
-        ...(modelPlane !== undefined ? { modelPlane } : {}),
-        ...(gates !== undefined ? { gateAssignments: gates.assignments, ...(gates.info !== undefined ? { gatesInfo: gates.info } : {}) } : {}),
+        modelPlaneGroup,
+        approvalGate,
         limits,
         hot,
-        ...(collabPlane !== undefined ? { collabPlane } : {}),
         projects,
     };
 }
 export const RUNTIME_GATE_KEYS = ["rateLimitPerMin", "maxTaskCostUsd", "maxTaskTokens", "maxPrincipalCostUsd", "costQuotaWindowSec"];
-export const BOOT_GATE_KEYS = ["approvalRequire"];
 export function centerManagedConfigKeys(eff) {
     const out = new Set();
     if (!eff)
@@ -372,40 +443,76 @@ export function runtimeGatePresent(rt, key) {
         return typeof v === "number" && v > 0;
     return typeof v === "number";
 }
-function stageApprovalRequire(raw, logger) {
-    const refuse = (detail, names, kept) => {
-        logger?.warn("sema_registry_approval_require_invalid", { detail, names: [...names], kept });
-        return {};
-    };
-    const KEPT_WOULD_MATCH_NOTHING = "the prior approvalRequire is unchanged — the published list would have silently matched nothing";
-    const KEPT_WOULD_REMOVE_GATE = "the prior approvalRequire is unchanged — coercing this malformed value would have silently REMOVED the approval gate";
+const KEPT_WOULD_MATCH_NOTHING = "the prior approvalRequire is unchanged — the published list would have silently matched nothing";
+const KEPT_WOULD_REMOVE_GATE = "the prior approvalRequire is unchanged — coercing this malformed value would have silently REMOVED the approval gate";
+const KEPT_WOULD_NEVER_PARK = "the prior approvalRequire is unchanged — this deployment has nowhere to park a gated call, so applying the list would leave it silently unenforced";
+function stageApprovalRequire(raw) {
     if (!Array.isArray(raw)) {
-        return refuse(`published runtime.approvalRequire must be an ARRAY of whole tool names — got ${raw === null ? "null" : typeof raw}. ` +
-            `Refusing the domain instead of coercing it: an empty list means "no approval gate", so coercing a malformed value would SILENTLY remove the gate.`, [], KEPT_WOULD_REMOVE_GATE);
+        const detail = `published governance.approvalRequire must be an ARRAY of whole tool names — got ${raw === null ? "null" : typeof raw}. ` +
+            `Refusing the group instead of coercing it: an empty list means "no approval gate", so coercing a malformed value would SILENTLY remove the gate.`;
+        return { ok: false, detail, reason: detail, names: [], kept: KEPT_WOULD_REMOVE_GATE };
     }
     const nonString = raw
         .map((n, i) => (typeof n === "string" ? undefined : { i, t: n === null ? "null" : typeof n }))
         .filter((e) => e !== undefined);
     if (nonString.length > 0) {
-        return refuse(`published runtime.approvalRequire contains ${nonString.length} non-string entr${nonString.length === 1 ? "y" : "ies"} ` +
+        const detail = `published governance.approvalRequire contains ${nonString.length} non-string entr${nonString.length === 1 ? "y" : "ies"} ` +
             `(${nonString.map((e) => `[${e.i}]:${e.t}`).join(", ")}) — every entry must be a whole tool name string. ` +
-            `Refusing the domain instead of dropping them: dropping every entry would SILENTLY remove the approval gate.`, nonString.map((e) => `[${e.i}]`), KEPT_WOULD_REMOVE_GATE);
+            `Refusing the group instead of dropping them: dropping every entry would SILENTLY remove the approval gate.`;
+        return { ok: false, detail, reason: detail, names: nonString.map((e) => `[${e.i}]`), kept: KEPT_WOULD_REMOVE_GATE };
     }
     const names = raw.filter((n) => typeof n === "string").map((n) => n.trim()).filter((n) => n.length > 0);
     const bad = findUnmatchableToolNames(names, { consumer: "tool-name-table", behavior: "deny" });
     if (bad.length > 0) {
-        return refuse(formatUnmatchableToolNames("published runtime.approvalRequire", bad), bad.map((b) => b.name), KEPT_WOULD_MATCH_NOTHING);
+        return {
+            ok: false,
+            detail: formatUnmatchableToolNames("published governance.approvalRequire", bad),
+            reason: `published governance.approvalRequire has ${bad.length} entr${bad.length === 1 ? "y" : "ies"} that match no live tool (retired name / incomplete MCP name / CC-form rule) — the offending entries are named in the sema_registry_approval_require_invalid log line`,
+            names: bad.map((b) => b.name),
+            kept: KEPT_WOULD_MATCH_NOTHING,
+        };
     }
-    return { value: names };
+    return { ok: true, value: names };
 }
-function stageApprovalGate(gov, logger) {
+function unserviceableOnLeg(leg, candidate) {
+    switch (leg.leg) {
+        case "boot":
+            return undefined;
+        case "hot":
+            return gateIntentUnserviceableReason(candidate, leg.checkpointStorePresent);
+        default: {
+            const unknownLeg = leg;
+            throw new Error(`applyEffective: unknown apply leg ${JSON.stringify(unknownLeg)}`);
+        }
+    }
+}
+function groupReportOf(g) {
+    return { applied: g.next !== undefined ? [...APPROVAL_GROUP_KEYS] : [], ...(g.rejected ? { rejected: g.rejected } : {}) };
+}
+const approvalEnvBaseline = new WeakMap();
+function stageApprovalGate(config, gov, leg, logger) {
+    if (!approvalEnvBaseline.has(config))
+        approvalEnvBaseline.set(config, Object.freeze([...config.approvalRequire]));
+    const refuse = (r) => {
+        logger?.warn("sema_registry_approval_require_invalid", { keys: [...APPROVAL_GROUP_KEYS], detail: r.detail, names: [...r.names], kept: r.kept });
+        return { rejected: { keys: [...APPROVAL_GROUP_KEYS], reason: r.reason } };
+    };
     const raw = gov?.approvalRequire;
-    if (!Array.isArray(raw))
-        return { assignments: [] };
-    const staged = stageApprovalRequire(raw, logger);
-    if (staged.value === undefined)
-        return { assignments: [] };
-    return { assignments: [["approvalRequire", staged.value]], info: { approvalRequire: staged.value } };
+    let next;
+    if (raw === undefined) {
+        next = [...approvalEnvBaseline.get(config)];
+    }
+    else {
+        const verdict = stageApprovalRequire(raw);
+        if (!verdict.ok)
+            return refuse(verdict);
+        next = verdict.value;
+    }
+    const unserviceable = unserviceableOnLeg(leg, { ...config, approvalRequire: next });
+    if (unserviceable !== undefined)
+        return refuse({ detail: unserviceable, reason: unserviceable, names: next, kept: KEPT_WOULD_NEVER_PARK });
+    const same = next.length === config.approvalRequire.length && next.every((n, i) => n === config.approvalRequire[i]);
+    return same ? {} : { next };
 }
 function legacyGateValues(rt) {
     const out = {};
@@ -416,16 +523,16 @@ function legacyGateValues(rt) {
             out[k] = rt[k];
     return out;
 }
-export function applyRuntimeGates(config, eff, logger) {
-    const s = stageApprovalGate(eff?.governance, logger);
-    for (const [k, v] of s.assignments)
-        config[k] = v;
+export function applyRuntimeGates(config, eff, leg, logger) {
+    const approval = stageApprovalGate(config, eff?.governance, leg, logger);
+    if (approval.next !== undefined)
+        config.approvalRequire = approval.next;
     const limits = stageLimits(config, { version: 0, legacyGates: legacyGateValues(eff?.runtime) }, logger);
     for (const [k, v] of limits.assignments)
         config[k] = v;
     for (const k of limits.deletions)
         delete config[k];
-    const info = { ...s.info, ...Object.fromEntries(limits.assignments) };
+    const info = { ...(approval.next !== undefined ? { approvalRequire: approval.next } : {}), ...Object.fromEntries(limits.assignments) };
     if (Object.keys(info).length > 0)
         logger?.info("sema_registry_runtime", info);
 }
@@ -486,6 +593,8 @@ export function resolveDefaultModelName(eff, has, fallback, onDangling) {
 }
 export function logEffectiveDiff(config, eff, logger) {
     const enabled = (eff.models?.models ?? []).filter((m) => m.enabled !== false);
+    const plane = stageModelPlane(config, eff, undefined, undefined);
+    const refused = plane.refused ?? {};
     const centerModels = enabled.map((m) => ({ name: m.name, id: m.id, provider: m.provider, apiKeyEnv: m.apiKeyEnv ?? null, tier: m.tier ?? null }));
     const envModels = Object.entries(config.models).map(([name, m]) => ({ name, id: m.id, provider: m.provider }));
     const centerRoles = Object.fromEntries(Object.entries(eff.models?.roles ?? {}).map(([r, t]) => [r, "model" in t ? t.model : { select: t.select }]));
@@ -493,7 +602,9 @@ export function logEffectiveDiff(config, eff, logger) {
         note: "DRY RUN — registry config NOT applied; unset SEMA_REGISTRY_DRY_RUN to go live",
         version: eff.version,
         wouldOverrideModels: enabled.length > 0,
-        wouldDefaultModel: enabled.length > 0 ? resolveDefaultModelName(eff, (n) => enabled.some((m) => m.name === n), enabled[0].name).name : null,
+        wouldDefaultModel: plane.defaultName ?? null,
+        ...(Object.keys(refused).length > 0 ? { wouldRefuse: Object.fromEntries(Object.entries(refused).map(([n, r]) => [n, r.code])) } : {}),
+        ...(plane.rejected !== undefined ? { wouldRefuseModelPlane: { invariant: plane.rejected.invariant, reason: plane.rejected.reason } } : {}),
         currentDefaultModel: config.model.id,
         models: { center: centerModels, envDerived: envModels },
         roles: { center: centerRoles, current: config.roles },

package/dist/config-center/apply-ledger.d.ts

@@ -20,7 +20,20 @@
  * 🔴 原子承诺的**域**是单进程(§2):本账记的是「本副本的收敛状态」,不是 fleet 的。fleet 级判据 = 各副本
  * /health 的 applied == target,拉齐工具归运维面。
  */
-/** 一组的收敛状态(批1 只有 limitsHttp 组;后续批次按组追加,读面形不变)。 */
+/**
+ * 世代账按组记账的**组闭集**(读面 `groups` 的键集;加组 = 这里加词,报告形 `Record<组, …>` 随之编译红)。
+ *  · `limitsHttp` —— [ref] 批1 限额组(属主 `stage-limits.ts`);
+ *  · `approvalGate` —— S-668 波 2 审批组(`governance.approvalRequire`;属主 `apply-effective.ts` 的
+ *    `stageApprovalGate`:坏形 / 工具名匹配不到 / ④ 门意图不可服务 ⇒ 整组拒)。
+ *  · `modelPlane` —— 模型面组(组内有哪些 effective 域的**唯一定义** = `apply-effective.ts` 的 `MODEL_PLANE_DOMAINS`:models 域 =
+ *    目录 / roles / tiers / 拒因表 / 名单 / 钥匙表,collab 域 = 引用它的命名 workflow 注册表;属主 `stageModelPlane`:
+ *    模型面三条跨键不变量 `default-model-resolvable` / `model-route-endpoint` / `refused-names-not-minted` 任一不成立 ⇒ 整组拒,
+ *    组内各域都停在上一代。opus 腿 O3(7.101.0 合并复审):此前这三条是 stage 抛 = 整份候选中止,同候选其余组陪葬)。
+ * 各组同姿势、各用各的判据表(审批组**不**复用限额组的跨键不变量表 —— 那张表的候选视图只叠限额键)。
+ */
+export declare const CONFIG_APPLY_GROUPS: readonly ["limitsHttp", "approvalGate", "modelPlane"];
+export type ConfigApplyGroup = (typeof CONFIG_APPLY_GROUPS)[number];
+/** 一组的收敛状态(读面形对所有组相同)。 */
 export interface ConfigApplyGroupState {
     /** 本组最后一次**真的落地**的源版本(身份标)。 */
     readonly appliedVersion: number;
@@ -48,27 +61,43 @@ export interface ConfigApplyLedgerView {
     readonly configAppliedOrdinal: number;
     /** target≠applied 的**持续**时长(ms);收敛时键缺席(健康面不制造噪音)。 */
     readonly configApplyStaleMs?: number;
-    readonly groups: Readonly<Record<string, ConfigApplyGroupState>>;
+    readonly groups: Readonly<Partial<Record<ConfigApplyGroup, ConfigApplyGroupState>>>;
+}
+/** 一组在一次 apply 里的报告(所有组同形)。 */
+export interface ConfigApplyGroupReport {
+    /** 本世代真正换了值的键。 */
+    readonly applied: readonly string[];
+    /** 值合法但**不热**的键(逐键 defer:变更只能重启生效)。 */
+    readonly deferred?: ReadonlyArray<{
+        readonly key: string;
+        readonly reason: string;
+    }>;
+    /** 整组被拒时的成因(消毒:键名 + 判据文案,绝不带值)。 */
+    readonly rejected?: {
+        readonly keys: readonly string[];
+        readonly reason: string;
+        readonly restartReason?: string;
+    };
 }
-/** applyEffective 的 post-commit 报告(见 apply-effective.ts `ApplyReport`)。 */
+/** applyEffective 的 post-commit 报告(见 apply-effective.ts `ApplyReport`)—— **每一组都报**。 */
 export interface ConfigApplyReport {
     readonly version: number;
     /** [ref]:本候选的收货序数(applyEffective opts.generation 原样带回;缺席=version 兼容臂)。 */
     readonly ordinal?: number;
-    readonly limits: {
-        readonly applied: readonly string[];
-        readonly deferred?: ReadonlyArray<{
-            readonly key: string;
-            readonly reason: string;
-        }>;
-        readonly rejected?: {
-            readonly keys: readonly string[];
-            readonly reason: string;
-            readonly restartReason?: string;
-        };
-    };
-    readonly fullyApplied?: boolean;
+    readonly groups: Readonly<Record<ConfigApplyGroup, ConfigApplyGroupReport>>;
 }
+/** 本报告里被整组拒的那些组(按组闭集序)。空 ⇒ 候选完整应用。两条 commit 腿的「部分应用」warn 与世代账共用。 */
+export declare function refusedGroups(report: ConfigApplyReport): Array<{
+    readonly group: ConfigApplyGroup;
+    readonly keys: readonly string[];
+    readonly reason: string;
+}>;
+/**
+ * O3:这一次 apply 的**模型面组**(组内各域 = `MODEL_PLANE_DOMAINS`,目录与引用它的 collab 模板同进退)落地了没有(整组被拒 ⇒
+ * false;报告缺席 = 没走到 commit ⇒ false,如实)。调用方据此决定「Runner 现在跑的是哪一代模型面」(`appliedPlaneEff`,swap 判据的
+ * 基准)、名册门开不开、以及 boot 要不要按组回落 LKG —— 都只许从真落地的模型面推进。
+ */
+export declare function modelPlaneCommitted(report: ConfigApplyReport | undefined): boolean;
 export interface ConfigApplyLedger {
     /** 拉到一个候选(无论后续是否应用)。ordinal=收货序数,version=身份标。 */
     seenTarget(ordinal: number, version: number): void;