@sema-agent/settings-schema 11.2.0 → 12.0.0

package/CHANGELOG.md

@@ -6,6 +6,118 @@
 > `@sema-agent/registry-core`(更早还曾是 `@sema-ai/registry-core`)。本档 `0.19.0` 以下各节里的
 > 包名是**历史记录**,如实保留不追改。
 
+## 12.0.0 — 2026-10-12 — 角色词随引擎收缩(`ModelRole` 8 → 6,一次性迁移 SS-M8)· 写失败按 errno 落点分句 · `config.d` 每份文档同一只文本判 · 扣名条目的可比记号 `identity.token`(major)
+
+> 本节一处硬破坏(角色词表收缩,持久面走一次性迁移 SS-M8)外加三件:命令行写失败按落点分句、`config.d` 每份文档同一只文本判(`remote-exec.json` 非对象不再被 `migrate`
+> 当成无事可做)、扣名条目带可比记号(新导出 `withheldNameToken`,additive)。车道表的租户依据列 `tenantSeparationBasis` 11.0.0 起已是数据,本版无改动。
+> 消费方:server 与引擎 core 7.49.0 同批提货(读点见各条);web-admin 的角色编辑面读 `ModelRole.options`,随表收缩、零改动。版号日期与节标题由发版方写。
+
+### BREAKING:`ModelRole` 收成 6 词 —— 删 `team` / `synthesize`(随引擎 core 7.49.0)
+
+- **删什么**:`ModelRole` = `default` / `summarize` / `subagent` / `verifier` / `classifier` / `consolidate`;`team` / `synthesize` 直接删,零别名、零双读。
+  `ROSTER_PRIMARY_ROLES` = `["default"]`:roster 的 `primaryModel` 标记只派生 `roles.default`(`ROSTER_CHEAP_ROLES` 不变)。`advisor` 本包从未收。
+- **谁会红**:把 `"team"` / `"synthesize"` 当 `ModelRole` 写的代码 tsc 红;存着 `roles.team` / `roles.synthesize`(`models.roles` 或任一 `rosters[].roles`)的文档
+  在迁移之前到达判官 —— 写侧拒;读侧丢那一条角色(models 里只剩它时整域降级到缺省;rosters 是闸域,整个 scope 读不出)—— 拒句点名一次性迁移 SS-M8。
+- **怎么办**:起服 / 提货前跑 SS-M8(函数 `migrateStoredDocuments`,或 `npx @sema-agent/settings-schema migrate <config.d directory>`),把读 `team` / `synthesize`
+  角色的地方改成读 `default` 或删掉。
+
+| 迁移 | 改写什么 | 收据 | 删码之后谁接住 |
+|---|---|---|---|
+| SS-M8 | `models.roles` 与每个 `rosters[].roles` 上的 `team` / `synthesize` 键删掉(值不论);别的角色与别的键原样 | 逐坐标一张 `dropped-inert`(`roles.team` / `rosters.<i>.roles.synthesize` …);再跑零收据 | 退役角色词墓碑(永久):残留的键读写两面拒 |
+
+窗与删法照例只登记在 `ONE_TIME_MIGRATIONS`。收据的迁移 id 闭集多一个 `SS-M8`(`ONE_TIME_MIGRATION_IDS`)。
+- **谁要改**:server 按 `ROSTER_PRIMARY_ROLES` 给每个词写角色的那一处随表只剩 `default`;读 `team` / `synthesize` 角色的消费点(团队 / 合议 / 协作类能力)改读 `default`
+  或随引擎退役;起服对本地 `config.d` 的迁移与提货前对存量文档跑一次 SS-M8。
+
+### 行为修复:命令行写失败按 errno 落点分句
+
+`migrate` 写回阶段写盘失败以前一句话包打天下:「cannot write <文件>: <Node 的错误句> … fix the cause and re-run」—— 目录不可写时点名的却是文件(Node 句子里是临时文件的路径),
+而可写目录里的只读文件照常迁;「fix the cause」也没说是哪个。现在原子写器按失败的那一步出句子,句尾是对应出路:
+- 临时文件建不出(目录不可写:`EACCES` / `EPERM` / `EROFS` / `ENOENT`)⇒ `cannot write into directory <dir> (<errno>): make the directory writable`;
+- `rename` 被拒(`EACCES` / `EPERM`:不可变标志、粘滞目录里别人的文件)⇒ `cannot replace <file> (<errno>): make the file replaceable — …`;
+- 别的 errno(磁盘满、I/O 错 …)⇒ 同两种开头,句尾是 Node 自己的句子。
+命令行 stderr 一行 = `settings-schema: <那一句> — files written before it keep their migrated form; re-run once that is fixed`,rc 2 不变。
+库写口(`writeDomainFile` / `writeRemoteExec` / 调度店写口)抛的是同一句的错误:`code` 照抄底层 errno、原错误在 `cause`(按 `code` 分支的调用方不受影响)。
+
+### 行为修复:`config.d` 每份文档同一只文本判 —— `remote-exec.json` 非对象不再被 `migrate` 当成「无事可做」
+
+同一条 `migrate`,`models.json` 写成 `[]` ⇒ rc 2,`remote-exec.json` 写成 `[]` / `null` / `5` / `"x"` / `true` ⇒ noop rc 0、文件不动(它走的是另一只只拒空与坏 JSON 的文本判)。
+现在 `config.d` 里每份文档(域文档、退役域文档、`remote-exec.json`)过同一只文本判,三种坏形每种一句、点名 `config.d/<名>.json` 与形,句尾出路按文档类:
+- 空 / 纯空白 ⇒ `config.d/<名>.json is empty/whitespace — <出路>`;坏 JSON ⇒ `invalid JSON in config.d/<名>.json — <出路>`;不是对象 ⇒ `config.d/<名>.json must be a JSON object (got <形>) — <出路>`;
+- 出路:域 ⇒ `delete it for the domain default, or write a valid object`;`remote-exec` ⇒ `delete it for the host default, or write a valid remoteExec spec`。
+`FileConfigStore` / `readBundle` / `loadRemoteExec` / 命令行读同一只。措辞随之归一的两处:域文档的坏 JSON 句补上出路;非对象句「delete the file」改成「delete it」(与空文件句同)。
+`loadRemoteExec` 的三句改点名 `config.d/remote-exec.json`(不再是绝对路径),非对象改为上面那句(以前是联合判的 zod 句)—— 抛不抛都不变。
+- **订正 11.3.0 节**:那一节「行为变(命令行)」第二句说「`remote-exec.json` 是空 / 坏 JSON 时 … ⇒ 读不进 rc 2」—— 在 11.3.0 上只对空与坏 JSON 成立,
+  非对象(数组 / `null` / 数 / 串 / 布尔)仍是 noop rc 0。从本版起五种形一律 rc 2,那句话才完整为真。
+
+### 新导出:`withheldNameToken` —— 扣名条目带可比记号 `identity.token`(additive)
+
+被丢条目的名不能原样出门(秘密形 / 超长 / 字符集外)时,身份以前只带 `nameWithheld: true`:两条扣名行在消费方眼里一模一样,「请求点名的那个模型是不是这条坏行」也无从比对。
+现在扣名的同时带 `token` = `withheld:` + SHA-256(域分隔前缀 + 原名的 JSON 串形 —— 逐个 UTF-16 码元保留,孤立代理项不会与 U+FFFD 撞成同一输入)的前 12 个十六进制位 ——
+稳定(同名恒同记号)、不可逆、原名一个字节都不出门;
+`DroppedEntryIdentity` 加可选键 `token`(与 `nameWithheld` 同在同缺)。唯一铸法 `withheldNameToken(name)`(主桶与 `./config-fns` 各 +1)。
+身份只回答「丢的是谁」:在场与否是消费方按原文判的事(注释里「没有名的行不是在场条目」一句删去,与消费方更严的读法一致)。
+一致性语料里带扣名身份的 6 条 case,金样随之多 `token` 一键。
+- **谁要改**:server 读被丢条目身份的那一处,对请求里显式点名的模型调 `withheldNameToken` 与扣名行的 `token` 比对 —— 命中即「点名的是一条坏行」(而不是「未知模型」);不另写摘要。
+
+## 11.3.0 — 2026-10-11 — 六件 additive:运行期成员表三张(AUTONOMY_MODES / COMMAND_DECISIONS / PROMPT_SLOTS)· 项目登记扩形(goal / contextItems / archivedAt / icon / color,displayName 上界 200)+ PATCH 形 · 命令行环境错一臂(I/O 错 rc 2 一句点名路径)· 一次性迁移 SS-M7 走到 remote-exec.json · 每条自铸 custom issue 带结构化句子(QuotedIssueParams)· hookMatcherForm(minor:新导出主桶 19 / hooks 2 / remote-exec 1 / node 1 型,零删零改名)
+
+> 本节六件,全部 additive(零删导出、零改名;minor):运行期成员表三张 · 项目登记扩形 + PATCH 形 · 命令行环境错一臂 · 一次性迁移 SS-M7 走到 `remote-exec.json` ·
+> 每条自铸 custom issue 一律带结构化句子 · `hookMatcherForm`。新导出:主桶 19 个(其中 16 个也在 `./types`)、`./hooks` 2 个、`./remote-exec` 1 个、`./node` 1 个型。
+> 消费方:server 7.125.0 提货(读点见各条);web-admin 的 projects 编辑面跟扩形。
+
+### 新导出:运行期成员表 `AUTONOMY_MODES` / `COMMAND_DECISIONS` / `PROMPT_SLOTS`
+
+与 `REF_CHECKED_DOMAINS` 同形:`as const` 只读数组是正本,zod enum(`AutonomyMode` / `CommandDecision` / `PromptSlot`)与类型都从表派生 ——
+`governance.autonomy`、`commandPolicy[].decision`、提示声明与 catalog 的 `slot` 引用的就是这几只 enum(同词同序,判法不变)。
+- **谁要改**:server 今天经 `GovernanceConfig.shape.autonomy.unwrap().options` / `….commandPolicy.unwrap().element.shape.decision.options` 取词表,提示域校验手抄一份三词槽位表 —— 换成 import 这三张表。
+
+### 新导出:项目登记 additive 扩形 —— `goal` / `contextItems` / `archivedAt` / `icon` / `color`,`displayName` 上界 120 → 200;PATCH 形
+
+`ProjectRegistration` 原六键不改名,加五个可选键:`goal`(≤ 2000)、`contextItems`(≤ 64 条,`{ kind: "folder" | "file" | "note", value }`;folder / file 的值过
+**与任务 `cwd` 同一只**主机路径形判官 `isAbsoluteHostPath` —— 非空、≤ 4096、无 NUL、以 `/` 开头、无 `..` 段;note ≤ 4000)、`archivedAt`(RFC 3339 时刻,与凭证信封
+`expiresAt` 同一只判)、`icon`(`^[a-z][a-z0-9-]{0,63}$`)、`color`(`^#[0-9a-f]{6}$`)。`displayName` 上界放宽到 200(放宽 = 旧数据全部照读)。
+上界常量导出:`PROJECT_LIMITS`、`ABSOLUTE_HOST_PATH_MAX`、`PROJECT_ICON_REGEX`、`PROJECT_COLOR_REGEX`、`PROJECT_CONTEXT_ITEM_KINDS` —— 读方 import,不手抄数字。
+PATCH 形 `ProjectRegistrationPatch`(strict:`registeredBy` / `registeredAt` 与未知键拒;可选键给 `null` = 清掉,如 `archivedAt: null` 取消归档)+ `applyProjectPatch(doc, id, patch)`:
+它先自己按 PATCH 形判入参(调用方原样递进请求体也改不了 `registeredBy` / `registeredAt`、带不进未知键;失败的坐标是文档坐标 `projects.<id>.…`),
+合并后由**同一只** `ProjectsConfig`(同一个 remote 全局唯一判)整文档再判,被改的项目排在最后判 —— 冲突恒落在被改的项目上、句子点名已占用的项目;成功时保持原键序;
+没登记的 id ⇒ 抛(调用方先答「没有这个项目」)。一致性语料 +3(合法扩形 / 超界拒 / PATCH 形 remote 唯一)。
+- **谁要改**:server 的项目读写面读新键与这些常量、PATCH 走 `applyProjectPatch`;server 受理任务 `cwd` 的形判改调 `isAbsoluteHostPath`(同一条律,posix 宿主上与现判逐字同);
+  web-admin 的 projects 编辑面渲染 / 写新键,`displayName` 输入上界跟到 200。
+
+### 行为修复:命令行退出码闭集补「环境错」一臂(rc 2)
+
+`migrate` 写回阶段的 I/O 错(写盘 / 删文件:权限、磁盘、悬空符号链接……)以前原样抛出 —— Node 打裸栈、进程 rc 1,而 rc 1 是 `outcome=refused`(拒迁)的约定码,
+只看 rc 的脚本会把权限错读成「拒绝迁移」。现在并入 rc 2(与读目录 / 读文件错同一臂):stdout 空,stderr **一行**点名要写的那份文件与原错误句(含 errno 码),不打栈;
+之前已写完的文档留在新形上,修好再跑一次幂等收尾。函数形 `migrateConfigDirectory` 的契约不变(写回阶段的 I/O 错仍原样抛给调用方)。
+读阶段遇**悬空符号链接**(域文件或 `config.d` 目录本身):读口先过原子写器同一只链接判法,句子与写器**同一句**(以前读阶段先撞 ENOENT,句子不提链接)。
+写器那一句的措辞随之改成读写通用(去掉 `writeFileAtomic:` 前缀;判法与抛不抛都不变)。
+
+### 行为变:一次性迁移 SS-M7(URL fragment)走到 `config.d/remote-exec.json`
+
+`remote-exec.json` 的两个端点(k8s `apiUrl`、`s3Snapshot.endpoint`)与域文档里的 URL 座位改为同一只带迁移指路的判官:规则句不变,fragment 拒句尾多一句 SS-M7 指路;
+座位仍由 schema 派生(`urlSeatPatterns()` 多两行)。命令行 `migrate` 把 `remote-exec.json` 当又一份文档:读(文本判与 `loadRemoteExec` 同一只)、剥 fragment、
+改过的整文档终判、写回(与 `writeRemoteExec` 同一只原子写器、同一种文本形)。收据的 `document` 闭集多一个 `remote-exec`;文档名的唯一拼写导出为 `REMOTE_EXEC_DOCUMENT`;
+`migrateConfigDirectory` 的覆盖面可含它(`./node` 的型 `ConfigDirectoryDocument`)。凭证信封的 `issuer` 是 wire 输入、不是存量,不走迁移,拒句照旧不指路。
+11.0.0 起披露的「`remote-exec.json` 里带 `#` 的端点只能手改」就此收口。
+- **行为变(命令行)**:目录里只有 `remote-exec.json`(外加非文档条目)时,以前报「没有域文档」rc 2,现在读到了文档、零改动 ⇒ `noop` rc 0;
+  `remote-exec.json` 是空 / 坏 JSON 时,以前命令行不读它,现在与其它文档一样 ⇒ 读不进 rc 2(这样的文件引擎读侧本就拒)。
+- **谁要改**:server 起服的本地目录迁移若要一并迁 `remote-exec.json`,把它加进覆盖面(读回面本就读它);不加则照旧只由命令行迁。
+
+### 新契约:本包自铸的每一条 custom issue 都带结构化句子 `QuotedIssueParams`
+
+全包只剩一只铸点:每条 `code: "custom"` 的 issue(`.refine` / `z.custom` / `addIssue` / 合成 issue / 引用完整性 `RefIssue`)都带 `params.template` + `params.operands`
+(值位是洞),`message` 由 `renderQuotedSentence` 从它渲出、铸点不手写第二遍;没有值的定句 `operands` 为空。句子逐字不变。URL 形判官的 issue 的 `params` 是
+`{ template, operands, flaw }`(`flaw` = 判官的规则词,保留);`RefIssue` 加 `params`,`renderRefIssue` 经同一只渲染器。不在此列的(如实):zod 内建码的 issue ——
+`.max(n, 句)` / `.regex(re, 句)`、墓碑字段的 `invalid_type`、联合的错误映射 —— 它们的句子是定句、读 `message`。
+- **谁要改**:server 读 issue 句子的那一处对 custom issue 可以只读 `params`(不再退回 `message`);zod 内建码的 issue 照旧读 `message`。
+
+### 新导出:`hookMatcherForm(matcher)` —— `"literal" | "regex" | "invalid"`
+
+与 `hookMatcherSelects` 调**同一只解析步**(不另写判形):缺席 / `""` / `"*"`(选中一切)与名字表形 = `literal`(不编、不跑正则),其余编得出的 = `regex`(不锚定),
+编不出 = `invalid`;对任一 matcher,`hookMatcherForm === "invalid"` ⇔ `hookMatcherSelects(…) === "invalid"`。给要在求值前分流的调用方(字面形直接跑、正则形进有预算的求值)。
+- **谁要改**:server 的 hooks 执行器今天自带一只「无回溯形」判断(字符扫描)决定要不要进预算求值,改问这一只后删掉自带的。
+
 ## 11.2.0 — 2026-10-10 — 六小件:SEMA_REGISTRY_* 八名加回退役墓碑(换名窗期与保留表交集写明)· 断言令牌 / 凭证文件键进保留表 · 会话网页链接模板函数与配对解析 · CLI 命令路径 shell 引用 · 原子写器保留符号链接 · node 侧目录迁移函数导出(minor:新导出与新墓碑行,零删零改名)
 
 > 本节六件:上一代连接名 `SEMA_REGISTRY_*` 八名进墓碑表(硬破坏,读侧同代要求)· 断言令牌两键进保留 env 名表 · 会话网页链接模板函数与配对解析 · 命令行印出的命令路径加 shell 引用 ·

package/README.md

@@ -300,7 +300,8 @@ therefore shows only `zod`. Node built-ins only (`node:crypto`, `node:fs`).
   `WebAdminCredentialEnvelope` (strict JSON: `kind: "user-session"` = `WEB_ADMIN_CREDENTIAL_ENVELOPE_KIND`, a JWT
   `accessToken` and a `refreshToken` under the same token law as the bare line, RFC 3339
   `expiresAt` with seconds and a `Z` / `±hh:mm` offset in range, `issuer` = the issuing web-admin's base URL judged
-  by the same judge the `remoteExec` endpoints use (`NON_SECRET_URL_NO_MIGRATION`) — same-origin is the reader's comparison).
+  by the URL shape judge for seats no one-time migration reaches (`NON_SECRET_URL_NO_MIGRATION` — the issuer is a wire input, not stored
+  data) — same-origin is the reader's comparison).
   `parseWebAdminCredentialFile(text)` is the ONE discrimination law — trimmed text starting with `{` is read ONLY
   as an envelope (a failure is `unreadable`, never a fallback to a bare line); anything else is a bare line,
   and a first line that is not a token is `unreadable` too (never sent as a bearer); empty is `unreadable`. The `reason` names envelope fields / zod issue codes / an unknown-key COUNT, never file

package/conformance/VERSION

@@ -1 +1 @@
-11.2.0
+12.0.0

package/conformance/cases/c40-s712-identity-only-what-reads-out/expected.json

@@ -80,7 +80,8 @@
         "domain": "models",
         "identity": {
           "id": "withheld-id",
-          "nameWithheld": true
+          "nameWithheld": true,
+          "token": "withheld:5c1dac79e895"
         },
         "kind": "entry-dropped",
         "path": [
@@ -107,7 +108,8 @@
         "domain": "models",
         "identity": {
           "id": "short-bearer-id",
-          "nameWithheld": true
+          "nameWithheld": true,
+          "token": "withheld:8d196a0cf81a"
         },
         "kind": "entry-dropped",
         "path": [
@@ -120,7 +122,8 @@
         "domain": "models",
         "identity": {
           "id": "pem-id",
-          "nameWithheld": true
+          "nameWithheld": true,
+          "token": "withheld:ffe22d022741"
         },
         "kind": "entry-dropped",
         "path": [

package/conformance/cases/c41-s792-encoded-pem-identity/expected.json

@@ -93,7 +93,8 @@
         "domain": "models",
         "identity": {
           "id": "in-charset-secret-name-id",
-          "nameWithheld": true
+          "nameWithheld": true,
+          "token": "withheld:e4c2e8ebcfc8"
         },
         "kind": "entry-dropped",
         "path": [
@@ -106,7 +107,8 @@
         "domain": "models",
         "identity": {
           "id": "one-dot-jwt-name-id",
-          "nameWithheld": true
+          "nameWithheld": true,
+          "token": "withheld:c30e4531b782"
         },
         "kind": "entry-dropped",
         "path": [

package/conformance/cases/c45-s792-identity-bounds-and-decode-depth/expected.json

@@ -112,7 +112,8 @@
         "domain": "models",
         "identity": {
           "id": "cap-257-id",
-          "nameWithheld": true
+          "nameWithheld": true,
+          "token": "withheld:389e8c0da200"
         },
         "kind": "entry-dropped",
         "path": [
@@ -174,7 +175,8 @@
       {
         "domain": "hosts",
         "identity": {
-          "nameWithheld": true
+          "nameWithheld": true,
+          "token": "withheld:56d720b6a52f"
         },
         "kind": "entry-dropped",
         "path": [

package/conformance/cases/c46-s811-host-name-url-userinfo-withheld/expected.json

@@ -70,7 +70,8 @@
       {
         "domain": "hosts",
         "identity": {
-          "nameWithheld": true
+          "nameWithheld": true,
+          "token": "withheld:e2bdf1a6eb87"
         },
         "kind": "entry-dropped",
         "path": [

package/conformance/cases/c73-projects-extended-registration-reads/expected.json

@@ -0,0 +1,150 @@
+{
+  "domains": {
+    "outcome": "effective",
+    "effective": {
+      "collab": {
+        "templates": []
+      },
+      "entitlement": {
+        "budgetGroups": [],
+        "groupBindings": [],
+        "subjects": [],
+        "tiers": []
+      },
+      "execution": {
+        "allowedLanes": [
+          "host"
+        ],
+        "required": false
+      },
+      "governance": {},
+      "hosts": {
+        "hosts": []
+      },
+      "limits": {},
+      "mcp": {
+        "servers": []
+      },
+      "models": {
+        "atMention": {
+          "mode": "all"
+        },
+        "models": [],
+        "roles": {},
+        "tierGroups": []
+      },
+      "plugins": {
+        "plugins": []
+      },
+      "projects": {
+        "projects": {
+          "01890a5d-ac96-774b-bcce-b302099a8057": {
+            "archivedAt": "2026-10-11T08:00:00.000Z",
+            "color": "#1f6feb",
+            "contextItems": [
+              {
+                "kind": "folder",
+                "value": "/home/alice/webapp"
+              },
+              {
+                "kind": "file",
+                "value": "/home/alice/webapp/README.md"
+              },
+              {
+                "kind": "note",
+                "value": "release gates first"
+              }
+            ],
+            "defaultScopes": [
+              "proj"
+            ],
+            "displayName": "pppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppp",
+            "gitRemotes": [
+              "example.com/acme/webapp"
+            ],
+            "goal": "ship the project object",
+            "icon": "rocket",
+            "notes": "free notes",
+            "registeredAt": "2026-10-01T00:00:00.000Z",
+            "registeredBy": "alice"
+          }
+        }
+      },
+      "prompts": {
+        "bindings": []
+      },
+      "rosters": {
+        "rosters": []
+      },
+      "scenarios": {
+        "scenarios": []
+      },
+      "skills": {
+        "skills": []
+      },
+      "systems": {
+        "systems": []
+      },
+      "workers": {
+        "workers": []
+      }
+    },
+    "warnings": [],
+    "metadata": {
+      "version": 17,
+      "updatedAt": "2026-10-12T00:00:00.000Z"
+    }
+  },
+  "strictWrite": {
+    "outcome": "effective",
+    "effective": {
+      "projects": {
+        "projects": {
+          "01890a5d-ac96-774b-bcce-b302099a8057": {
+            "archivedAt": "2026-10-11T08:00:00.000Z",
+            "color": "#1f6feb",
+            "contextItems": [
+              {
+                "kind": "folder",
+                "value": "/home/alice/webapp"
+              },
+              {
+                "kind": "file",
+                "value": "/home/alice/webapp/README.md"
+              },
+              {
+                "kind": "note",
+                "value": "release gates first"
+              }
+            ],
+            "defaultScopes": [
+              "proj"
+            ],
+            "displayName": "pppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppp",
+            "gitRemotes": [
+              "example.com/acme/webapp"
+            ],
+            "goal": "ship the project object",
+            "icon": "rocket",
+            "notes": "free notes",
+            "registeredAt": "2026-10-01T00:00:00.000Z",
+            "registeredBy": "alice"
+          }
+        }
+      }
+    },
+    "warnings": [],
+    "metadata": {
+      "version": 17,
+      "updatedAt": "2026-10-12T00:00:00.000Z"
+    },
+    "why": "受理:扩形五键与放宽后的 displayName 上界都是本版契约的合法形,严写腿与读腿同答。"
+  },
+  "wire": {
+    "derive": true
+  },
+  "localRoot": {
+    "derive": true,
+    "localVersion": 2617555914511015
+  }
+}

package/conformance/cases/c73-projects-extended-registration-reads/input.json

@@ -0,0 +1,42 @@
+{
+  "meta": {
+    "version": 17,
+    "updatedAt": "2026-10-12T00:00:00.000Z"
+  },
+  "domains": {
+    "projects": {
+      "projects": {
+        "01890a5d-ac96-774b-bcce-b302099a8057": {
+          "gitRemotes": [
+            "example.com/acme/webapp"
+          ],
+          "defaultScopes": [
+            "proj"
+          ],
+          "registeredBy": "alice",
+          "registeredAt": "2026-10-01T00:00:00.000Z",
+          "displayName": "pppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppp",
+          "notes": "free notes",
+          "goal": "ship the project object",
+          "contextItems": [
+            {
+              "kind": "folder",
+              "value": "/home/alice/webapp"
+            },
+            {
+              "kind": "file",
+              "value": "/home/alice/webapp/README.md"
+            },
+            {
+              "kind": "note",
+              "value": "release gates first"
+            }
+          ],
+          "archivedAt": "2026-10-11T08:00:00.000Z",
+          "icon": "rocket",
+          "color": "#1f6feb"
+        }
+      }
+    }
+  }
+}

package/conformance/cases/c73-projects-extended-registration-reads/meta.json

@@ -0,0 +1,6 @@
+{
+  "contributor": "contract",
+  "claim": "项目登记的 additive 扩形:原六键之外带 goal / contextItems(folder / file / note)/ archivedAt / icon / color,displayName 150 字(上界 120 → 200 放宽之后才合法)。读腿与严写腿都原样收、零告警。打的是「读方按旧形把新键剥掉」或「仍按 120 的旧上界拒」两种读法分歧(11.2.0 及更早:150 字的 displayName 整域拒)。",
+  "firstRedOn": [],
+  "note": "firstRedOn 为空:historical 阶梯(≤ 2.1.0)不覆盖 11.3.0 的新键;对 11.2.0 这一条会红(displayName 150 > 120),那一版不在入库的真跑证据里。"
+}

package/conformance/cases/c74-projects-over-bound-refused/expected.json

@@ -0,0 +1,89 @@
+{
+  "domains": {
+    "outcome": "rejected",
+    "stage": "validate"
+  },
+  "strictWrite": {
+    "outcome": "rejected",
+    "stage": "validate",
+    "why": "拒:displayName 超过 200、folder 不是主机绝对路径 —— 与读腿同一只 schema。"
+  },
+  "wire": {
+    "outcome": "rejected",
+    "stage": "validate",
+    "why": "domains 腿是拒绝态,不派生;wire 腿把同一份文档交给同一个 buildEffective,拒绝层相同"
+  },
+  "localRoot": {
+    "outcome": "effective",
+    "effective": {
+      "collab": {
+        "templates": []
+      },
+      "entitlement": {
+        "budgetGroups": [],
+        "groupBindings": [],
+        "subjects": [],
+        "tiers": []
+      },
+      "execution": {
+        "allowedLanes": [
+          "host"
+        ],
+        "required": false
+      },
+      "governance": {},
+      "hosts": {
+        "hosts": []
+      },
+      "limits": {},
+      "mcp": {
+        "servers": []
+      },
+      "models": {
+        "atMention": {
+          "mode": "all"
+        },
+        "models": [],
+        "roles": {},
+        "tierGroups": []
+      },
+      "plugins": {
+        "plugins": []
+      },
+      "projects": {
+        "projects": {}
+      },
+      "prompts": {
+        "bindings": []
+      },
+      "rosters": {
+        "rosters": []
+      },
+      "scenarios": {
+        "scenarios": []
+      },
+      "skills": {
+        "skills": []
+      },
+      "systems": {
+        "systems": []
+      },
+      "workers": {
+        "workers": []
+      }
+    },
+    "warnings": [
+      {
+        "domain": "projects",
+        "file": "projects.json",
+        "kind": "unread-config-file",
+        "why": "non-portable-domain"
+      }
+    ],
+    "metadata": {
+      "version": 2617555914511015,
+      "updatedAt": "1970-01-01T00:00:00.000Z"
+    },
+    "why": "projects 不是便携域:config.d 腿不读它(T3),文件报 unread-config-file、域取默认 —— 本地读腿看不见这份坏登记"
+  }
+}

package/conformance/cases/c74-projects-over-bound-refused/input.json

@@ -0,0 +1,29 @@
+{
+  "meta": {
+    "version": 17,
+    "updatedAt": "2026-10-12T00:00:00.000Z"
+  },
+  "domains": {
+    "projects": {
+      "projects": {
+        "01890a5d-ac96-774b-bcce-b302099a8057": {
+          "gitRemotes": [
+            "example.com/acme/webapp"
+          ],
+          "defaultScopes": [
+            "proj"
+          ],
+          "registeredBy": "alice",
+          "registeredAt": "2026-10-01T00:00:00.000Z",
+          "displayName": "ppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppp",
+          "contextItems": [
+            {
+              "kind": "folder",
+              "value": "relative/dir"
+            }
+          ]
+        }
+      }
+    }
+  }
+}

package/conformance/cases/c74-projects-over-bound-refused/meta.json

@@ -0,0 +1,5 @@
+{
+  "contributor": "contract",
+  "claim": "超界与坏形整域拒:displayName 201 字(新上界 200 之外)、folder 条目是相对路径(过与任务 cwd 同一只路径形判官 —— 必须绝对、无 .. 段)。projects 是读侧整域拒(throw)的域。打的是「放宽上界放过了头」或「folder 值只当自由文本收」两种读法(相对路径落到读方进程的 cwd 上 = 静默换目录)。",
+  "firstRedOn": []
+}

package/conformance/cases/c75-projects-patch-remote-uniqueness/expected.json

@@ -0,0 +1,89 @@
+{
+  "domains": {
+    "outcome": "rejected",
+    "stage": "validate"
+  },
+  "strictWrite": {
+    "outcome": "rejected",
+    "stage": "validate",
+    "why": "拒:example.com/acme/shared 已登记给前一个项目;坐标 projects.<后来者>.gitRemotes[1]。"
+  },
+  "wire": {
+    "outcome": "rejected",
+    "stage": "validate",
+    "why": "domains 腿是拒绝态,不派生;wire 腿把同一份文档交给同一个 buildEffective,拒绝层相同"
+  },
+  "localRoot": {
+    "outcome": "effective",
+    "effective": {
+      "collab": {
+        "templates": []
+      },
+      "entitlement": {
+        "budgetGroups": [],
+        "groupBindings": [],
+        "subjects": [],
+        "tiers": []
+      },
+      "execution": {
+        "allowedLanes": [
+          "host"
+        ],
+        "required": false
+      },
+      "governance": {},
+      "hosts": {
+        "hosts": []
+      },
+      "limits": {},
+      "mcp": {
+        "servers": []
+      },
+      "models": {
+        "atMention": {
+          "mode": "all"
+        },
+        "models": [],
+        "roles": {},
+        "tierGroups": []
+      },
+      "plugins": {
+        "plugins": []
+      },
+      "projects": {
+        "projects": {}
+      },
+      "prompts": {
+        "bindings": []
+      },
+      "rosters": {
+        "rosters": []
+      },
+      "scenarios": {
+        "scenarios": []
+      },
+      "skills": {
+        "skills": []
+      },
+      "systems": {
+        "systems": []
+      },
+      "workers": {
+        "workers": []
+      }
+    },
+    "warnings": [
+      {
+        "domain": "projects",
+        "file": "projects.json",
+        "kind": "unread-config-file",
+        "why": "non-portable-domain"
+      }
+    ],
+    "metadata": {
+      "version": 2617555914511015,
+      "updatedAt": "1970-01-01T00:00:00.000Z"
+    },
+    "why": "projects 不是便携域:config.d 腿不读它(T3),文件报 unread-config-file、域取默认"
+  }
+}