@sema-agent/settings-schema 10.1.0 → 11.0.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (235) hide show
  1. package/CHANGELOG.md +419 -0
  2. package/README.md +141 -65
  3. package/bin/settings-schema.mjs +13 -6
  4. package/conformance/VERSION +1 -1
  5. package/conformance/baseline.json +3 -1
  6. package/conformance/cases/c01-entry-salvage-then-typo/expected.json +3 -1
  7. package/conformance/cases/c02-hosts-clamp-stacked/expected.json +12 -5
  8. package/conformance/cases/c02-hosts-clamp-stacked/meta.json +1 -1
  9. package/conformance/cases/c03-literal-dotted-top-key/expected.json +22 -2
  10. package/conformance/cases/c04-all-bad-collection-not-salvaged/expected.json +3 -1
  11. package/conformance/cases/c06-legacy-governance-lift/expected.json +11 -101
  12. package/conformance/cases/c06-legacy-governance-lift/meta.json +1 -1
  13. package/conformance/cases/c07-hooks-is-not-a-config-domain/expected.json +3 -1
  14. package/conformance/cases/c08-limits-unknown-carried-64/expected.json +203 -2
  15. package/conformance/cases/c09-limits-unknown-carried-65/expected.json +204 -2
  16. package/conformance/cases/c10-record-key-secret-redacted-twice/expected.json +3 -1
  17. package/conformance/cases/c11-unicode-unknown-keys/expected.json +20 -2
  18. package/conformance/cases/c12-prototype-name-top-keys/expected.json +3 -1
  19. package/conformance/cases/c13-models-field-null/expected.json +3 -1
  20. package/conformance/cases/c14-models-field-empty-array/expected.json +6 -1
  21. package/conformance/cases/c15-models-field-number/expected.json +3 -1
  22. package/conformance/cases/c16-deep-nesting-205/expected.json +14 -2
  23. package/conformance/cases/c17-empty-domain-file/expected.json +3 -1
  24. package/conformance/cases/c18-wire-envelope-not-an-object/expected.json +3 -1
  25. package/conformance/cases/c19-wire-envelope-no-version/expected.json +3 -1
  26. package/conformance/cases/c20-governance-absent-lifts/expected.json +11 -86
  27. package/conformance/cases/c20-governance-absent-lifts/meta.json +1 -1
  28. package/conformance/cases/c21-governance-empty-object-wins/expected.json +6 -5
  29. package/conformance/cases/c21-governance-empty-object-wins/input.json +1 -4
  30. package/conformance/cases/c21-governance-empty-object-wins/meta.json +1 -1
  31. package/conformance/cases/c23-mixed-validity-models/expected.json +3 -1
  32. package/conformance/cases/c24-valid-entries-with-unknown-keys/expected.json +22 -2
  33. package/conformance/cases/c25-published-roundtrip-zero-warnings/expected.json +6 -1
  34. package/conformance/cases/c26-hosts-array-1024/expected.json +3 -1
  35. package/conformance/cases/c27-hosts-array-1025/expected.json +6 -7175
  36. package/conformance/cases/c27-hosts-array-1025/meta.json +1 -1
  37. package/conformance/cases/c28-large-document-over-1mb/expected.json +14 -2
  38. package/conformance/cases/c29-salvage-then-domain-refine-fails/expected.json +3 -1
  39. package/conformance/cases/c30-version-triple-a-first/expected.json +6 -1
  40. package/conformance/cases/c31-version-triple-b-changed/expected.json +6 -1
  41. package/conformance/cases/c32-version-triple-a-restored/expected.json +6 -1
  42. package/conformance/cases/c33-limits-nested-carried-key/expected.json +18 -2
  43. package/conformance/cases/c34-skills-content-vs-manifest/expected.json +19 -3
  44. package/conformance/cases/c35-portable-domain-file-is-null/expected.json +3 -1
  45. package/conformance/cases/c36-skills-entry-without-content/expected.json +6 -2
  46. package/conformance/cases/c37-skills-field-null/expected.json +6 -2
  47. package/conformance/cases/c38-remote-exec-is-a-non-domain-file/expected.json +3 -1
  48. package/conformance/cases/c39-hidden-file-in-config-d/expected.json +3 -1
  49. package/conformance/cases/c40-s712-identity-only-what-reads-out/expected.json +11 -4
  50. package/conformance/cases/c41-s792-encoded-pem-identity/expected.json +9 -3
  51. package/conformance/cases/c42-s792-unknown-key-secret-redacted/expected.json +39 -2
  52. package/conformance/cases/c43-s792-form-and-deep-encoded-pem/expected.json +4 -1
  53. package/conformance/cases/c44-s792-utf8-escape-glued-token/expected.json +3 -1
  54. package/conformance/cases/c45-s792-identity-bounds-and-decode-depth/expected.json +19 -10
  55. package/conformance/cases/c45-s792-identity-bounds-and-decode-depth/meta.json +1 -1
  56. package/conformance/cases/{c46-s811-host-name-url-userinfo-characterization → c46-s811-host-name-url-userinfo-withheld}/expected.json +12 -5
  57. package/conformance/cases/c46-s811-host-name-url-userinfo-withheld/meta.json +9 -0
  58. package/conformance/cases/{c47-s811-roles-key-url-userinfo-characterization → c47-s811-roles-key-url-userinfo-withheld}/expected.json +23 -3
  59. package/conformance/cases/{c47-s811-roles-key-url-userinfo-characterization → c47-s811-roles-key-url-userinfo-withheld}/input.json +6 -0
  60. package/conformance/cases/c47-s811-roles-key-url-userinfo-withheld/meta.json +10 -0
  61. package/conformance/cases/c48-s935-model-headers-transported/expected.json +6 -1
  62. package/conformance/cases/c49-s935-model-headers-secret-entry-dropped/expected.json +3 -1
  63. package/conformance/cases/c50-s784-lane-host-legal/expected.json +3 -1
  64. package/conformance/cases/c51-s784-lane-e2b-legal/expected.json +3 -1
  65. package/conformance/cases/c52-s784-lane-k8s-legal/expected.json +3 -1
  66. package/conformance/cases/c53-s784-lane-ssh-legal/expected.json +3 -1
  67. package/conformance/cases/c54-s784-lane-adb-legal/expected.json +3 -1
  68. package/conformance/cases/c55-s784-lane-local-docker-legal/expected.json +3 -1
  69. package/conformance/cases/c56-s784-lane-device-legal/expected.json +3 -1
  70. package/conformance/cases/c57-s784-g1-enabled-no-lane/expected.json +3 -1
  71. package/conformance/cases/c58-s784-g2-multitenant-host/expected.json +3 -1
  72. package/conformance/cases/c59-s784-g3-k8s-missing-image/expected.json +3 -1
  73. package/conformance/cases/c60-s784-g3-e2b-missing-key/expected.json +3 -1
  74. package/conformance/cases/c61-s784-g3-other-lane-key/expected.json +3 -1
  75. package/conformance/cases/c62-s784-g7a-session-tidb/expected.json +3 -1
  76. package/conformance/cases/c63-s784-host-two-replicas/expected.json +3 -1
  77. package/conformance/cases/c64-s784-multitenant-local-store/expected.json +3 -1
  78. package/conformance/cases/c65-s784-pg-without-db/expected.json +3 -1
  79. package/conformance/cases/c66-s784-memory-backend-mismatch/expected.json +3 -1
  80. package/conformance/cases/c67-s784-retired-field-loud/expected.json +3 -1
  81. package/conformance/cases/c67-s784-retired-field-loud/meta.json +1 -1
  82. package/conformance/cases/c68-s784-device-local-store/expected.json +3 -1
  83. package/conformance/cases/c69-deep-encoded-token-past-every-reading/expected.json +3 -1
  84. package/conformance/cases/c70-rewritten-token-in-front-of-encoded-pem-header/expected.json +3 -1
  85. package/conformance/cases/c71-one-scanner-write-reads-display-forms/expected.json +119 -0
  86. package/conformance/cases/c71-one-scanner-write-reads-display-forms/input.json +24 -0
  87. package/conformance/cases/c71-one-scanner-write-reads-display-forms/meta.json +10 -0
  88. package/conformance/cases/c72-dangling-reference-write-seat-refuses/expected.json +111 -0
  89. package/conformance/cases/c72-dangling-reference-write-seat-refuses/input.json +26 -0
  90. package/conformance/cases/c72-dangling-reference-write-seat-refuses/meta.json +6 -0
  91. package/conformance/cases/cc01-mcp-toolfaces-non-object/expected.json +3 -1
  92. package/conformance/cases/cc02-mcp-source-key-is-transported/expected.json +3 -1
  93. package/conformance/cases/cc03-model-compat-unknown-subkey/expected.json +6 -1
  94. package/conformance/cases/cli01-model-name-nfc-vs-nfd/expected.json +11 -1
  95. package/conformance/cases/cli02-control-and-zero-width-chars/expected.json +11 -1
  96. package/conformance/cases/cli03-credential-pasted-into-unknown-key/expected.json +16 -2
  97. package/conformance/cases/cli04-env-value-with-newline/expected.json +3 -1
  98. package/conformance/cases/cli05-long-and-prefix-colliding-names/expected.json +6 -1
  99. package/conformance/cases/t01-absent-domain-key-not-null/expected.json +3 -1
  100. package/conformance/cases/t03-prototype-name-key-not-swallowed/expected.json +29 -2
  101. package/conformance/cases/t04-secret-literal-never-in-warning-value/expected.json +3 -1
  102. package/conformance/cases/z01-every-domain-empty-object/expected.json +8 -4
  103. package/conformance/cases/z01-every-domain-empty-object/input.json +0 -1
  104. package/conformance/cases/z01-every-domain-empty-object/meta.json +1 -1
  105. package/conformance/cases/z02-every-domain-unknown-key/expected.json +163 -23
  106. package/conformance/cases/z02-every-domain-unknown-key/input.json +0 -3
  107. package/conformance/cases/z02-every-domain-unknown-key/meta.json +1 -1
  108. package/dist/api/auth-bridge.d.ts +51 -181
  109. package/dist/api/auth-bridge.js +58 -33
  110. package/dist/api/auth.d.ts +37 -146
  111. package/dist/api/auth.js +16 -26
  112. package/dist/api/feedback.d.ts +87 -0
  113. package/dist/api/feedback.js +66 -0
  114. package/dist/api/pull-token.d.ts +32 -0
  115. package/dist/api/pull-token.js +88 -0
  116. package/dist/api/scopes.d.ts +82 -174
  117. package/dist/api/scopes.js +23 -18
  118. package/dist/bundle.d.ts +15 -7
  119. package/dist/bundle.js +28 -27
  120. package/dist/cli.d.ts +3 -1
  121. package/dist/cli.js +132 -81
  122. package/dist/config-d-file.d.ts +14 -0
  123. package/dist/config-d-file.js +67 -0
  124. package/dist/config-fns.d.ts +87 -186
  125. package/dist/config-fns.js +207 -262
  126. package/dist/conformance/contract-adapter.d.ts +9 -2
  127. package/dist/conformance/contract-adapter.js +15 -7
  128. package/dist/conformance/corpus.d.ts +3 -0
  129. package/dist/conformance/corpus.js +5 -0
  130. package/dist/conformance/derive.d.ts +3 -0
  131. package/dist/conformance/index.d.ts +2 -2
  132. package/dist/conformance/index.js +2 -2
  133. package/dist/conformance/run.js +67 -22
  134. package/dist/conformance/types.d.ts +31 -15
  135. package/dist/conformance/types.js +5 -0
  136. package/dist/conformance/warnings.d.ts +1 -1
  137. package/dist/conformance/warnings.js +1 -4
  138. package/dist/cross-domain.d.ts +66 -22
  139. package/dist/cross-domain.js +164 -93
  140. package/dist/cross-session.d.ts +29 -11
  141. package/dist/default-model.d.ts +43 -0
  142. package/dist/default-model.js +34 -0
  143. package/dist/execution-lane-index.d.ts +4 -8
  144. package/dist/execution-lane-index.js +4 -8
  145. package/dist/execution-lanes.d.ts +31 -8
  146. package/dist/execution-lanes.js +23 -5
  147. package/dist/file-edit.js +5 -2
  148. package/dist/file-store.d.ts +7 -6
  149. package/dist/file-store.js +37 -50
  150. package/dist/fleet.d.ts +364 -762
  151. package/dist/fleet.js +277 -224
  152. package/dist/hooks.d.ts +1151 -4737
  153. package/dist/hooks.js +59 -15
  154. package/dist/index.d.ts +10 -4
  155. package/dist/index.js +13 -7
  156. package/dist/integer.d.ts +11 -0
  157. package/dist/integer.js +11 -0
  158. package/dist/issue-path.d.ts +10 -0
  159. package/dist/issue-path.js +10 -0
  160. package/dist/loopback.d.ts +26 -0
  161. package/dist/loopback.js +54 -0
  162. package/dist/migration-receipt.d.ts +42 -0
  163. package/dist/migration-receipt.js +12 -0
  164. package/dist/one-time-migrations.d.ts +56 -0
  165. package/dist/one-time-migrations.js +819 -0
  166. package/dist/prompts-digest.d.ts +1 -1
  167. package/dist/prompts-digest.js +3 -2
  168. package/dist/reader.d.ts +2 -2
  169. package/dist/remote-exec.d.ts +45 -187
  170. package/dist/remote-exec.js +13 -7
  171. package/dist/resolve-roster.d.ts +18 -3
  172. package/dist/resolve-roster.js +28 -25
  173. package/dist/retired-envs.d.ts +24 -0
  174. package/dist/retired-envs.js +114 -0
  175. package/dist/retired-form.d.ts +31 -0
  176. package/dist/retired-form.js +28 -0
  177. package/dist/safety-merge-spec.d.ts +131 -191
  178. package/dist/safety-merge-spec.js +18 -14
  179. package/dist/scheduler-lifetime.d.ts +5 -0
  180. package/dist/scheduler-lifetime.js +7 -0
  181. package/dist/scheduler-store-migration.d.ts +14 -0
  182. package/dist/scheduler-store-migration.js +14 -0
  183. package/dist/scheduler-store-node.d.ts +24 -9
  184. package/dist/scheduler-store-node.js +25 -15
  185. package/dist/scheduler-store.d.ts +47 -14
  186. package/dist/scheduler-store.js +32 -61
  187. package/dist/secret-refs.d.ts +3 -3
  188. package/dist/secret-refs.js +1 -1
  189. package/dist/secret-scan.d.ts +14 -24
  190. package/dist/secret-scan.js +45 -23
  191. package/dist/sha256-core.d.ts +16 -0
  192. package/dist/sha256-core.js +138 -0
  193. package/dist/sha256.d.ts +6 -1
  194. package/dist/sha256.js +8 -98
  195. package/dist/skills-manifest.js +1 -1
  196. package/dist/types.d.ts +1501 -13536
  197. package/dist/types.js +494 -438
  198. package/dist/url-shape.d.ts +34 -0
  199. package/dist/url-shape.js +61 -0
  200. package/dist/web-admin-credential.d.ts +96 -0
  201. package/dist/{center-credential.js → web-admin-credential.js} +46 -43
  202. package/dist/web-admin-env.d.ts +33 -0
  203. package/dist/web-admin-env.js +33 -0
  204. package/dist/worker-row-verdict.d.ts +16 -0
  205. package/dist/worker-row-verdict.js +31 -0
  206. package/dist/workers-rows.d.ts +34 -0
  207. package/dist/workers-rows.js +42 -0
  208. package/dist/zod-unwrap.d.ts +11 -0
  209. package/dist/zod-unwrap.js +25 -0
  210. package/package.json +17 -9
  211. package/conformance/cases/c46-s811-host-name-url-userinfo-characterization/meta.json +0 -6
  212. package/conformance/cases/c47-s811-roles-key-url-userinfo-characterization/meta.json +0 -6
  213. package/conformance/migrate-workers/m01-g5-k8s-env-lifted/expected.json +0 -49
  214. package/conformance/migrate-workers/m01-g5-k8s-env-lifted/input.json +0 -26
  215. package/conformance/migrate-workers/m01-g5-k8s-env-lifted/meta.json +0 -4
  216. package/conformance/migrate-workers/m02-g5-idempotent/expected.json +0 -38
  217. package/conformance/migrate-workers/m02-g5-idempotent/input.json +0 -33
  218. package/conformance/migrate-workers/m02-g5-idempotent/meta.json +0 -5
  219. package/conformance/migrate-workers/m03-g5-refused-no-lane/expected.json +0 -71
  220. package/conformance/migrate-workers/m03-g5-refused-no-lane/input.json +0 -42
  221. package/conformance/migrate-workers/m03-g5-refused-no-lane/meta.json +0 -4
  222. package/conformance/migrate-workers/m04-g7b-session-tidb-lifted/expected.json +0 -52
  223. package/conformance/migrate-workers/m04-g7b-session-tidb-lifted/input.json +0 -30
  224. package/conformance/migrate-workers/m04-g7b-session-tidb-lifted/meta.json +0 -4
  225. package/conformance/migrate-workers/m05-row-verdict-reserved-env/expected.json +0 -82
  226. package/conformance/migrate-workers/m05-row-verdict-reserved-env/input.json +0 -68
  227. package/conformance/migrate-workers/m05-row-verdict-reserved-env/meta.json +0 -4
  228. package/dist/center-credential.d.ts +0 -116
  229. package/dist/issue-text.d.ts +0 -10
  230. package/dist/issue-text.js +0 -8
  231. package/dist/migrate-workers.d.ts +0 -71
  232. package/dist/migrate-workers.js +0 -351
  233. package/dist/migrate.d.ts +0 -255
  234. package/dist/migrate.js +0 -542
  235. /package/conformance/cases/{c46-s811-host-name-url-userinfo-characterization → c46-s811-host-name-url-userinfo-withheld}/input.json +0 -0
@@ -1,5 +1,5 @@
1
1
  {
2
2
  "contributor": "contract",
3
- "claim": "hosts 数组 1025 ⇒ 读侧夹紧到 1024 并报 hosts-grandfathered{truncatedFrom:1025}(纯截断保留前缀,幸存者下标不动 ⇒ 不登记位移表)。哪一腿不报,运维就不知道自己有一台机器从此不存在。",
3
+ "claim": "hosts 数组 1025 ⇒ 11.0.0 起读侧不再截断:数组上界是域级判据,hosts 整域降级(domain-defaulted,拒句点名一次性迁移 SS-M2 —— 0.8.0 前存下的超界数据由它改写一次)。读写同一只 schema;改前读腿截到 1024 并报 hosts-grandfathered。",
4
4
  "firstRedOn": []
5
5
  }
@@ -26,6 +26,9 @@
26
26
  "servers": []
27
27
  },
28
28
  "models": {
29
+ "atMention": {
30
+ "mode": "all"
31
+ },
29
32
  "models": [],
30
33
  "roles": {},
31
34
  "tierGroups": []
@@ -42,7 +45,6 @@
42
45
  "rosters": {
43
46
  "rosters": []
44
47
  },
45
- "runtime": {},
46
48
  "scenarios": {
47
49
  "scenarios": []
48
50
  },
@@ -79,7 +81,17 @@
79
81
  "scenarios": []
80
82
  }
81
83
  },
82
- "warnings": [],
84
+ "warnings": [
85
+ {
86
+ "domain": "scenarios",
87
+ "keys": [
88
+ [
89
+ "zzzHuge"
90
+ ]
91
+ ],
92
+ "kind": "unknown-keys-dropped"
93
+ }
94
+ ],
83
95
  "metadata": {
84
96
  "version": 7,
85
97
  "updatedAt": "2026-09-16T00:00:00.000Z"
@@ -26,6 +26,9 @@
26
26
  "servers": []
27
27
  },
28
28
  "models": {
29
+ "atMention": {
30
+ "mode": "all"
31
+ },
29
32
  "models": [],
30
33
  "roles": {},
31
34
  "tierGroups": []
@@ -42,7 +45,6 @@
42
45
  "rosters": {
43
46
  "rosters": []
44
47
  },
45
- "runtime": {},
46
48
  "scenarios": {
47
49
  "scenarios": []
48
50
  },
@@ -26,6 +26,9 @@
26
26
  "servers": []
27
27
  },
28
28
  "models": {
29
+ "atMention": {
30
+ "mode": "all"
31
+ },
29
32
  "models": [
30
33
  {
31
34
  "api": "openai-completions",
@@ -55,7 +58,6 @@
55
58
  "rosters": {
56
59
  "rosters": []
57
60
  },
58
- "runtime": {},
59
61
  "scenarios": {
60
62
  "scenarios": []
61
63
  },
@@ -79,6 +81,9 @@
79
81
  "outcome": "effective",
80
82
  "effective": {
81
83
  "models": {
84
+ "atMention": {
85
+ "mode": "all"
86
+ },
82
87
  "models": [
83
88
  {
84
89
  "api": "openai-completions",
@@ -26,6 +26,9 @@
26
26
  "servers": []
27
27
  },
28
28
  "models": {
29
+ "atMention": {
30
+ "mode": "all"
31
+ },
29
32
  "models": [
30
33
  {
31
34
  "api": "openai-completions",
@@ -55,7 +58,6 @@
55
58
  "rosters": {
56
59
  "rosters": []
57
60
  },
58
- "runtime": {},
59
61
  "scenarios": {
60
62
  "scenarios": []
61
63
  },
@@ -79,6 +81,9 @@
79
81
  "outcome": "effective",
80
82
  "effective": {
81
83
  "models": {
84
+ "atMention": {
85
+ "mode": "all"
86
+ },
82
87
  "models": [
83
88
  {
84
89
  "api": "openai-completions",
@@ -26,6 +26,9 @@
26
26
  "servers": []
27
27
  },
28
28
  "models": {
29
+ "atMention": {
30
+ "mode": "all"
31
+ },
29
32
  "models": [
30
33
  {
31
34
  "api": "openai-completions",
@@ -55,7 +58,6 @@
55
58
  "rosters": {
56
59
  "rosters": []
57
60
  },
58
- "runtime": {},
59
61
  "scenarios": {
60
62
  "scenarios": []
61
63
  },
@@ -79,6 +81,9 @@
79
81
  "outcome": "effective",
80
82
  "effective": {
81
83
  "models": {
84
+ "atMention": {
85
+ "mode": "all"
86
+ },
82
87
  "models": [
83
88
  {
84
89
  "api": "openai-completions",
@@ -31,6 +31,9 @@
31
31
  "servers": []
32
32
  },
33
33
  "models": {
34
+ "atMention": {
35
+ "mode": "all"
36
+ },
34
37
  "models": [],
35
38
  "roles": {},
36
39
  "tierGroups": []
@@ -47,7 +50,6 @@
47
50
  "rosters": {
48
51
  "rosters": []
49
52
  },
50
- "runtime": {},
51
53
  "scenarios": {
52
54
  "scenarios": []
53
55
  },
@@ -91,7 +93,21 @@
91
93
  "maxConcurrentRuns": 3
92
94
  }
93
95
  },
94
- "warnings": [],
96
+ "warnings": [
97
+ {
98
+ "domain": "limits",
99
+ "keys": [
100
+ [
101
+ "maxConcurrentRuns"
102
+ ],
103
+ [
104
+ "infraCostRates",
105
+ "zzzNestedTypo"
106
+ ]
107
+ ],
108
+ "kind": "unknown-keys-carried"
109
+ }
110
+ ],
95
111
  "metadata": {
96
112
  "version": 7,
97
113
  "updatedAt": "2026-09-16T00:00:00.000Z"
@@ -26,6 +26,9 @@
26
26
  "servers": []
27
27
  },
28
28
  "models": {
29
+ "atMention": {
30
+ "mode": "all"
31
+ },
29
32
  "models": [],
30
33
  "roles": {},
31
34
  "tierGroups": []
@@ -42,7 +45,6 @@
42
45
  "rosters": {
43
46
  "rosters": []
44
47
  },
45
- "runtime": {},
46
48
  "scenarios": {
47
49
  "scenarios": []
48
50
  },
@@ -99,7 +101,19 @@
99
101
  ]
100
102
  }
101
103
  },
102
- "warnings": [],
104
+ "warnings": [
105
+ {
106
+ "domain": "skills",
107
+ "keys": [
108
+ [
109
+ "skills",
110
+ 0,
111
+ "zzzTypo"
112
+ ]
113
+ ],
114
+ "kind": "unknown-keys-dropped"
115
+ }
116
+ ],
103
117
  "metadata": {
104
118
  "version": 7,
105
119
  "updatedAt": "2026-09-16T00:00:00.000Z"
@@ -133,6 +147,9 @@
133
147
  "servers": []
134
148
  },
135
149
  "models": {
150
+ "atMention": {
151
+ "mode": "all"
152
+ },
136
153
  "models": [],
137
154
  "roles": {},
138
155
  "tierGroups": []
@@ -146,7 +163,6 @@
146
163
  "rosters": {
147
164
  "rosters": []
148
165
  },
149
- "runtime": {},
150
166
  "scenarios": {
151
167
  "scenarios": []
152
168
  },
@@ -26,6 +26,9 @@
26
26
  "servers": []
27
27
  },
28
28
  "models": {
29
+ "atMention": {
30
+ "mode": "all"
31
+ },
29
32
  "models": [],
30
33
  "roles": {},
31
34
  "tierGroups": []
@@ -42,7 +45,6 @@
42
45
  "rosters": {
43
46
  "rosters": []
44
47
  },
45
- "runtime": {},
46
48
  "scenarios": {
47
49
  "scenarios": []
48
50
  },
@@ -26,6 +26,9 @@
26
26
  "servers": []
27
27
  },
28
28
  "models": {
29
+ "atMention": {
30
+ "mode": "all"
31
+ },
29
32
  "models": [],
30
33
  "roles": {},
31
34
  "tierGroups": []
@@ -42,7 +45,6 @@
42
45
  "rosters": {
43
46
  "rosters": []
44
47
  },
45
- "runtime": {},
46
48
  "scenarios": {
47
49
  "scenarios": []
48
50
  },
@@ -121,6 +123,9 @@
121
123
  "servers": []
122
124
  },
123
125
  "models": {
126
+ "atMention": {
127
+ "mode": "all"
128
+ },
124
129
  "models": [],
125
130
  "roles": {},
126
131
  "tierGroups": []
@@ -134,7 +139,6 @@
134
139
  "rosters": {
135
140
  "rosters": []
136
141
  },
137
- "runtime": {},
138
142
  "scenarios": {
139
143
  "scenarios": []
140
144
  },
@@ -26,6 +26,9 @@
26
26
  "servers": []
27
27
  },
28
28
  "models": {
29
+ "atMention": {
30
+ "mode": "all"
31
+ },
29
32
  "models": [],
30
33
  "roles": {},
31
34
  "tierGroups": []
@@ -42,7 +45,6 @@
42
45
  "rosters": {
43
46
  "rosters": []
44
47
  },
45
- "runtime": {},
46
48
  "scenarios": {
47
49
  "scenarios": []
48
50
  },
@@ -99,6 +101,9 @@
99
101
  "servers": []
100
102
  },
101
103
  "models": {
104
+ "atMention": {
105
+ "mode": "all"
106
+ },
102
107
  "models": [],
103
108
  "roles": {},
104
109
  "tierGroups": []
@@ -112,7 +117,6 @@
112
117
  "rosters": {
113
118
  "rosters": []
114
119
  },
115
- "runtime": {},
116
120
  "scenarios": {
117
121
  "scenarios": []
118
122
  },
@@ -26,6 +26,9 @@
26
26
  "servers": []
27
27
  },
28
28
  "models": {
29
+ "atMention": {
30
+ "mode": "all"
31
+ },
29
32
  "models": [],
30
33
  "roles": {},
31
34
  "tierGroups": []
@@ -42,7 +45,6 @@
42
45
  "rosters": {
43
46
  "rosters": []
44
47
  },
45
- "runtime": {},
46
48
  "scenarios": {
47
49
  "scenarios": []
48
50
  },
@@ -26,6 +26,9 @@
26
26
  "servers": []
27
27
  },
28
28
  "models": {
29
+ "atMention": {
30
+ "mode": "all"
31
+ },
29
32
  "models": [],
30
33
  "roles": {},
31
34
  "tierGroups": []
@@ -42,7 +45,6 @@
42
45
  "rosters": {
43
46
  "rosters": []
44
47
  },
45
- "runtime": {},
46
48
  "scenarios": {
47
49
  "scenarios": []
48
50
  },
@@ -26,6 +26,9 @@
26
26
  "servers": []
27
27
  },
28
28
  "models": {
29
+ "atMention": {
30
+ "mode": "all"
31
+ },
29
32
  "models": [
30
33
  {
31
34
  "api": "openai-completions",
@@ -59,7 +62,6 @@
59
62
  "rosters": {
60
63
  "rosters": []
61
64
  },
62
- "runtime": {},
63
65
  "scenarios": {
64
66
  "scenarios": []
65
67
  },
@@ -77,7 +79,8 @@
77
79
  {
78
80
  "domain": "models",
79
81
  "identity": {
80
- "id": "withheld-id"
82
+ "id": "withheld-id",
83
+ "nameWithheld": true
81
84
  },
82
85
  "kind": "entry-dropped",
83
86
  "path": [
@@ -103,7 +106,8 @@
103
106
  {
104
107
  "domain": "models",
105
108
  "identity": {
106
- "id": "short-bearer-id"
109
+ "id": "short-bearer-id",
110
+ "nameWithheld": true
107
111
  },
108
112
  "kind": "entry-dropped",
109
113
  "path": [
@@ -115,7 +119,8 @@
115
119
  {
116
120
  "domain": "models",
117
121
  "identity": {
118
- "id": "pem-id"
122
+ "id": "pem-id",
123
+ "nameWithheld": true
119
124
  },
120
125
  "kind": "entry-dropped",
121
126
  "path": [
@@ -127,6 +132,7 @@
127
132
  {
128
133
  "domain": "models",
129
134
  "identity": {
135
+ "idWithheld": true,
130
136
  "name": "prefixed-pem"
131
137
  },
132
138
  "kind": "entry-dropped",
@@ -139,6 +145,7 @@
139
145
  {
140
146
  "domain": "models",
141
147
  "identity": {
148
+ "idWithheld": true,
142
149
  "name": "glued-pem"
143
150
  },
144
151
  "kind": "entry-dropped",
@@ -26,6 +26,9 @@
26
26
  "servers": []
27
27
  },
28
28
  "models": {
29
+ "atMention": {
30
+ "mode": "all"
31
+ },
29
32
  "models": [
30
33
  {
31
34
  "api": "openai-completions",
@@ -59,7 +62,6 @@
59
62
  "rosters": {
60
63
  "rosters": []
61
64
  },
62
- "runtime": {},
63
65
  "scenarios": {
64
66
  "scenarios": []
65
67
  },
@@ -77,6 +79,7 @@
77
79
  {
78
80
  "domain": "models",
79
81
  "identity": {
82
+ "idWithheld": true,
80
83
  "name": "encoded-pem"
81
84
  },
82
85
  "kind": "entry-dropped",
@@ -89,7 +92,8 @@
89
92
  {
90
93
  "domain": "models",
91
94
  "identity": {
92
- "id": "in-charset-secret-name-id"
95
+ "id": "in-charset-secret-name-id",
96
+ "nameWithheld": true
93
97
  },
94
98
  "kind": "entry-dropped",
95
99
  "path": [
@@ -101,7 +105,8 @@
101
105
  {
102
106
  "domain": "models",
103
107
  "identity": {
104
- "id": "one-dot-jwt-name-id"
108
+ "id": "one-dot-jwt-name-id",
109
+ "nameWithheld": true
105
110
  },
106
111
  "kind": "entry-dropped",
107
112
  "path": [
@@ -139,6 +144,7 @@
139
144
  {
140
145
  "domain": "models",
141
146
  "identity": {
147
+ "idWithheld": true,
142
148
  "name": "deep-encoded-pem"
143
149
  },
144
150
  "kind": "entry-dropped",
@@ -29,6 +29,9 @@
29
29
  "servers": []
30
30
  },
31
31
  "models": {
32
+ "atMention": {
33
+ "mode": "all"
34
+ },
32
35
  "models": [
33
36
  {
34
37
  "api": "openai-completions",
@@ -58,7 +61,6 @@
58
61
  "rosters": {
59
62
  "rosters": []
60
63
  },
61
- "runtime": {},
62
64
  "scenarios": {
63
65
  "scenarios": []
64
66
  },
@@ -118,6 +120,9 @@
118
120
  "sk-live-FAKEC42CARRIEDKEY000000000": 5
119
121
  },
120
122
  "models": {
123
+ "atMention": {
124
+ "mode": "all"
125
+ },
121
126
  "models": [
122
127
  {
123
128
  "api": "openai-completions",
@@ -136,7 +141,39 @@
136
141
  "tierGroups": []
137
142
  }
138
143
  },
139
- "warnings": [],
144
+ "warnings": [
145
+ {
146
+ "domain": "models",
147
+ "keys": [
148
+ [
149
+ "models",
150
+ 0,
151
+ "[redacted-secret]"
152
+ ],
153
+ [
154
+ "models",
155
+ 0,
156
+ "typoKey"
157
+ ],
158
+ [
159
+ "[redacted-secret]"
160
+ ]
161
+ ],
162
+ "kind": "unknown-keys-dropped"
163
+ },
164
+ {
165
+ "domain": "limits",
166
+ "keys": [
167
+ [
168
+ "[redacted-secret]"
169
+ ],
170
+ [
171
+ "maxToolCallz"
172
+ ]
173
+ ],
174
+ "kind": "unknown-keys-carried"
175
+ }
176
+ ],
140
177
  "metadata": {
141
178
  "version": 13,
142
179
  "updatedAt": "2026-09-27T00:00:00.000Z"
@@ -26,6 +26,9 @@
26
26
  "servers": []
27
27
  },
28
28
  "models": {
29
+ "atMention": {
30
+ "mode": "all"
31
+ },
29
32
  "models": [
30
33
  {
31
34
  "api": "openai-completions",
@@ -59,7 +62,6 @@
59
62
  "rosters": {
60
63
  "rosters": []
61
64
  },
62
- "runtime": {},
63
65
  "scenarios": {
64
66
  "scenarios": []
65
67
  },
@@ -77,6 +79,7 @@
77
79
  {
78
80
  "domain": "models",
79
81
  "identity": {
82
+ "idWithheld": true,
80
83
  "name": "flat-plus-pem"
81
84
  },
82
85
  "kind": "entry-dropped",
@@ -26,6 +26,9 @@
26
26
  "servers": []
27
27
  },
28
28
  "models": {
29
+ "atMention": {
30
+ "mode": "all"
31
+ },
29
32
  "models": [
30
33
  {
31
34
  "api": "openai-completions",
@@ -59,7 +62,6 @@
59
62
  "rosters": {
60
63
  "rosters": []
61
64
  },
62
- "runtime": {},
63
65
  "scenarios": {
64
66
  "scenarios": []
65
67
  },
@@ -49,6 +49,9 @@
49
49
  ]
50
50
  },
51
51
  "models": {
52
+ "atMention": {
53
+ "mode": "all"
54
+ },
52
55
  "models": [
53
56
  {
54
57
  "api": "openai-completions",
@@ -78,7 +81,6 @@
78
81
  "rosters": {
79
82
  "rosters": []
80
83
  },
81
- "runtime": {},
82
84
  "scenarios": {
83
85
  "scenarios": []
84
86
  },
@@ -93,13 +95,6 @@
93
95
  }
94
96
  },
95
97
  "warnings": [
96
- {
97
- "domain": "hosts",
98
- "droppedNames": [
99
- "[redacted-secret]"
100
- ],
101
- "kind": "hosts-grandfathered"
102
- },
103
98
  {
104
99
  "domain": "models",
105
100
  "identity": {
@@ -116,7 +111,8 @@
116
111
  {
117
112
  "domain": "models",
118
113
  "identity": {
119
- "id": "cap-257-id"
114
+ "id": "cap-257-id",
115
+ "nameWithheld": true
120
116
  },
121
117
  "kind": "entry-dropped",
122
118
  "path": [
@@ -128,6 +124,7 @@
128
124
  {
129
125
  "domain": "models",
130
126
  "identity": {
127
+ "idWithheld": true,
131
128
  "name": "db-url-id"
132
129
  },
133
130
  "kind": "entry-dropped",
@@ -173,6 +170,18 @@
173
170
  1
174
171
  ],
175
172
  "reasonCode": "entry-schema-invalid"
173
+ },
174
+ {
175
+ "domain": "hosts",
176
+ "identity": {
177
+ "nameWithheld": true
178
+ },
179
+ "kind": "entry-dropped",
180
+ "path": [
181
+ "hosts",
182
+ 1
183
+ ],
184
+ "reasonCode": "entry-schema-invalid"
176
185
  }
177
186
  ],
178
187
  "metadata": {
@@ -183,7 +192,7 @@
183
192
  "strictWrite": {
184
193
  "outcome": "rejected",
185
194
  "stage": "validate",
186
- "why": "拒:三个域里都有读腿要抢救的东西 —— models / mcp 逐条丢(entry-dropped)、hosts 超长名夹紧(hosts-grandfathered);严写在任何一份不受理时整次不受理。"
195
+ "why": "拒:三个域里都有读腿要逐条丢的条目(models / mcp / hosts,entry-dropped);严写在任何一份不受理时整次不受理。"
187
196
  },
188
197
  "wire": {
189
198
  "derive": true
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "contributor": "contract",
3
- "claim": "6.3.0(合并复审 opus 腿 L5 / M1 / M2 / L1,S-792):给语料里此前没有杀手的几道边补上 —— ① 长度上界 256(身份白名单与出门坐标段同一只常量):256 字的合法模型名被丢时身份照带 name、257 字不带;256 字的良性未知键名逐字点名、257 字整段 `[redacted-secret]`。② 解码层数 3(校验侧探测器):mcp stdio 参数里三重百分号编码的 `sk-` 形令牌照旧被拒、条目被丢(层数少一层就放行进 effective)。③ 身份否决里的 URL userinfo 判定:`postgres://svc:…@db…` 作被丢条目 id 不带;路径里的 `@`(`https://…/@scope/pkg`)照带。④ `hosts-grandfathered.droppedNames` 过同一道出门:`sk-live-…` 形超长主机名读 `[redacted-secret]`,不再是 63 字原文前缀。",
3
+ "claim": "6.3.0(合并复审 opus 腿 L5 / M1 / M2 / L1,S-792):给语料里此前没有杀手的几道边补上 —— ① 长度上界 256(身份白名单与出门坐标段同一只常量):256 字的合法模型名被丢时身份照带 name、257 字不带;256 字的良性未知键名逐字点名、257 字整段 `[redacted-secret]`。② 解码层数 3(校验侧探测器):mcp stdio 参数里三重百分号编码的 `sk-` 形令牌照旧被拒、条目被丢(层数少一层就放行进 effective)。③ 身份否决里的 URL userinfo 判定:`postgres://svc:…@db…` 作被丢条目 id 不带;路径里的 `@`(`https://…/@scope/pkg`)照带。④(11.0.0 起 hosts 读侧夹紧臂退役)超长主机名作被丢条目出门、身份过同一道披露判据:`sk-live-…` 形超长主机名读 `[redacted-secret]`,不再是 63 字原文前缀。",
4
4
  "firstRedOn": [],
5
5
  "secrets": [
6
6
  "FAKEC45USERINFOPW",