@sema-agent/settings-schema 3.0.0 → 4.0.0

package/conformance/cases/t03-prototype-name-key-not-swallowed/expected.json

@@ -0,0 +1,107 @@
+{
+  "domains": {
+    "outcome": "effective",
+    "effective": {
+      "collab": {
+        "templates": []
+      },
+      "entitlement": {
+        "budgetGroups": [],
+        "groupBindings": [],
+        "subjects": [],
+        "tiers": []
+      },
+      "execution": {
+        "allowedLanes": [
+          "host"
+        ],
+        "required": false
+      },
+      "governance": {},
+      "hosts": {
+        "hosts": []
+      },
+      "limits": {},
+      "mcp": {
+        "servers": []
+      },
+      "models": {
+        "models": [
+          {
+            "api": "openai-completions",
+            "apiKeyEnv": "OPENAI_API_KEY",
+            "enabled": true,
+            "id": "m0-id",
+            "name": "m0",
+            "provider": "openai",
+            "quotaWeight": 1,
+            "reasoning": false,
+            "tier": "standard",
+            "vision": false
+          }
+        ],
+        "roles": {},
+        "tierGroups": []
+      },
+      "plugins": {
+        "plugins": []
+      },
+      "projects": {
+        "projects": {}
+      },
+      "prompts": {
+        "bindings": []
+      },
+      "rosters": {
+        "rosters": []
+      },
+      "runtime": {},
+      "scenarios": {
+        "scenarios": []
+      },
+      "skills": {
+        "skills": []
+      },
+      "systems": {
+        "systems": []
+      },
+      "workers": {
+        "workers": []
+      }
+    },
+    "warnings": [
+      {
+        "domain": "models",
+        "keys": [
+          [
+            "models",
+            0,
+            "__proto__"
+          ],
+          [
+            "models",
+            0,
+            "constructor"
+          ],
+          [
+            "models",
+            0,
+            "toString"
+          ]
+        ],
+        "kind": "unknown-keys-dropped"
+      }
+    ],
+    "metadata": {
+      "version": 7,
+      "updatedAt": "2026-09-16T00:00:00.000Z"
+    }
+  },
+  "wire": {
+    "derive": true
+  },
+  "localRoot": {
+    "derive": true,
+    "localVersion": 3232605402901914
+  }
+}

package/conformance/cases/t03-prototype-name-key-not-swallowed/input.json

@@ -0,0 +1,25 @@
+{
+  "meta": {
+    "version": 7,
+    "updatedAt": "2026-09-16T00:00:00.000Z"
+  },
+  "domains": {
+    "models": {
+      "models": [
+        {
+          "name": "m0",
+          "provider": "openai",
+          "id": "m0-id",
+          "apiKeyEnv": "OPENAI_API_KEY",
+          "__proto__": {
+            "polluted": true
+          },
+          "constructor": {
+            "polluted": true
+          },
+          "toString": "nope"
+        }
+      ]
+    }
+  }
+}

package/conformance/cases/t03-prototype-name-key-not-swallowed/meta.json

@@ -0,0 +1,6 @@
+{
+  "contributor": "test",
+  "claim": "`__proto__` / `constructor` / `toString` 作为域内条目的键,**在坏条目上**:告警坐标必须把它当**普通字面键**点名、`effective` 的原型必须不被污染、三腿读法一致。本方在 server 7.87.0 G6 实测过同族(`answer.answers[0].__proto__` ⇒ `400 request.field_invalid` 且 `unknownKeys` 逐字点名);也在本仓自证里把 `__proto__` 的断言方向搞反过一次(`JSON.parse` + spread **保留** own 属性、plain assignment 才污染原型),所以这条同时是护栏。",
+  "firstRedOn": [],
+  "note": "【claim 收窄 2026-09-19,server [7621] ① 指出、主会话亲验】初稿把 `__proto__` **作好条目的 record 键**也算进「当普通字面键报进坐标」。**实测不成立**:`parseDomainLoud('limits', {__proto__:1, ok:2}, …)` 的告警 keys 只有 `['ok']`,`parsed` 上无 own `__proto__`(原型仍是 `Object.prototype`)—— 好条目上的原型名键在 zod 3 正常解析路径上本来就被丢,是 [7617] 已知限制,不是本条要钉的东西。claim 已收窄到**坏条目**那半场(真的、可判、有判别力);好条目那半场不入语料。与契约仓 c12 的差别:c12 打的是**顶层键**(`k in built` 一路问到 Object.prototype ⇒ open-world 承诺失效),本条打的是**域内条目的键**(剥键扫描 `collectDropped` 的 `Object.keys` / `hasOwnProperty` 两处判据,以及 salvage/rebase 路径上的对象重建)。构造坑(本方亲踩,记在此处防下一个人重踩):用 JS 对象字面量 `{\"__proto__\": {...}}` 造这条输入会**设置原型而不是加一个键**,于是 `isPlainJsonObject` 判假、整条扫描被跳过、case 测了个寂寞;语料走 `JSON.parse` 才拿到自有键 —— 这也是为什么这条必须以磁盘语料形存在,而不是测试里一个内联对象。firstRedOn 空是**实跑**出来的:五个旧版(1.0.0/1.5.0/1.10.0/2.0.0/2.1.0)在本条上全绿 —— S-332 那个 bug 只落在**顶层键**那一层(契约 c12 五版全红),域内条目键这一层从 1.0.0 起就一直对 ⇒ 本条是护栏,不是回归凭证。"
+}

package/conformance/cases/t04-secret-literal-never-in-warning-value/expected.json

@@ -0,0 +1,105 @@
+{
+  "domains": {
+    "outcome": "effective",
+    "effective": {
+      "collab": {
+        "templates": []
+      },
+      "entitlement": {
+        "budgetGroups": [],
+        "groupBindings": [],
+        "subjects": [],
+        "tiers": []
+      },
+      "execution": {
+        "allowedLanes": [
+          "host"
+        ],
+        "required": false
+      },
+      "governance": {},
+      "hosts": {
+        "hosts": []
+      },
+      "limits": {},
+      "mcp": {
+        "servers": []
+      },
+      "models": {
+        "models": [
+          {
+            "api": "openai-completions",
+            "apiKeyEnv": "OPENAI_API_KEY",
+            "enabled": true,
+            "id": "keep-id",
+            "name": "keep",
+            "provider": "openai",
+            "quotaWeight": 1,
+            "reasoning": false,
+            "tier": "standard",
+            "vision": false
+          }
+        ],
+        "roles": {},
+        "tierGroups": []
+      },
+      "plugins": {
+        "plugins": []
+      },
+      "projects": {
+        "projects": {}
+      },
+      "prompts": {
+        "bindings": []
+      },
+      "rosters": {
+        "rosters": []
+      },
+      "runtime": {},
+      "scenarios": {
+        "scenarios": []
+      },
+      "skills": {
+        "skills": []
+      },
+      "systems": {
+        "systems": []
+      },
+      "workers": {
+        "workers": []
+      }
+    },
+    "warnings": [
+      {
+        "domain": "models",
+        "kind": "entry-dropped",
+        "path": [
+          "models",
+          1
+        ]
+      },
+      {
+        "domain": "models",
+        "keys": [
+          [
+            "models",
+            0,
+            "apiKeyInline"
+          ]
+        ],
+        "kind": "unknown-keys-dropped"
+      }
+    ],
+    "metadata": {
+      "version": 7,
+      "updatedAt": "2026-09-16T00:00:00.000Z"
+    }
+  },
+  "wire": {
+    "derive": true
+  },
+  "localRoot": {
+    "derive": true,
+    "localVersion": 2614200563056761
+  }
+}

package/conformance/cases/t04-secret-literal-never-in-warning-value/input.json

@@ -0,0 +1,25 @@
+{
+  "meta": {
+    "version": 7,
+    "updatedAt": "2026-09-16T00:00:00.000Z"
+  },
+  "domains": {
+    "models": {
+      "models": [
+        {
+          "name": "keep",
+          "provider": "openai",
+          "id": "keep-id",
+          "apiKeyEnv": "OPENAI_API_KEY",
+          "apiKeyInline": "sk-FAKE-CORPUS-0000000000000000"
+        },
+        {
+          "name": "bad",
+          "provider": "openai",
+          "id": "bad-id",
+          "api": "ghp_FAKE-CORPUS-1111111111111111"
+        }
+      ]
+    }
+  }
+}

package/conformance/cases/t04-secret-literal-never-in-warning-value/meta.json

@@ -0,0 +1,14 @@
+{
+  "contributor": "test",
+  "claim": "坏条目的**值**里埋 `sk-`/`ghp_` 形秘密字面:告警面必须**名字上线、值永不上线**(与 `hosts-grandfathered` 同律)。本方给 web-admin G3 加过同款正控 —— 没有正控时『没打印秘密』与『判据没跑到那一行』同形。",
+  "firstRedOn": [
+    "settings-schema@1.0.0",
+    "settings-schema@1.10.0",
+    "settings-schema@1.5.0"
+  ],
+  "secrets": [
+    "sk-FAKE-CORPUS-0000000000000000",
+    "ghp_FAKE-CORPUS-1111111111111111"
+  ],
+  "note": "两条秘密走**两条不同的告警路径**,所以「值不上线」在两条路上分别被判:①`sk-` 那把是**存活条目**上一个未知键的值 ⇒ 只该出现在 `unknown-keys-dropped` 的键坐标里(键名 `apiKeyInline` 上线、值不上线);②`ghp_` 那把是**被丢条目**上一个 enum 字段的值 ⇒ zod 的 `invalid_enum_value` 会把 `received` 原样回显,只有 `sanitizeZodError`/`redactSecrets` 挡着 ⇒ 它落在 `entry-dropped.error` 的文案面上,而 `findSecretLeaks` 恰恰扫这一面。正控(判据到达性)由 expected 的两条告警坐标承担:`[\"models\",0,\"apiKeyInline\"]` 与 `[\"models\",1]` 必须在场,证明剥键扫描与抢救路径都真跑到了。扫描器自身的判别力由 verify.mjs 的 decoy 臂钉住(把一个**非**秘密形的 enum 值当秘密登记 ⇒ findSecretLeaks 必须命中),否则「零命中」与「扫描器恒返回空」同形。语料里的两把是**假串**,不是任何真凭据。⚠️ firstRedOn 里的三个旧版**不是在秘密轴上红的**:逐版直读 `findSecretLeaks`(1.0.0/1.5.0/1.10.0/2.0.0/2.1.0)**五版全零命中**;那三版红是因为 1.11.0 才有的逐条容错还不存在,整个 `models` 域退默认(只报一条 `domain-defaulted`),于是 effective 与告警多重集都对不上。⇒ 在**秘密轴**上这条同样是护栏;把「这条 case 在旧版上红」读成「旧版泄过秘密」是从读数推到结论的那一类错,读数见 _historical-readout.json#t04SecretAxis。"
+}

package/conformance/historical/settings-schema@1.0.0.json

@@ -8,9 +8,10 @@
     "why": "旧版坐标是点号串、今天是段数组;归一 = 按 `.` 拼串,这正是 3.0.0 要消掉的有损编码(`[\"a.b\"]` 与 `[\"a\",\"b\"]` 归一后同串)"
   },
   "summary": {
-    "pass": 99,
-    "diff": 36,
-    "expected-rejected": 12,
+    "pass": 105,
+    "diff": 39,
+    "diff-ledgered": 0,
+    "expected-rejected": 15,
     "harness-error": 0,
     "skipped": 0
   },
@@ -955,6 +956,86 @@
         }
       }
     },
+    "t01-absent-domain-key-not-null": {
+      "firstRed": false,
+      "legs": {
+        "domains": {
+          "status": "pass",
+          "behaviour": false,
+          "detail": "effective, warnings and metadata all match"
+        },
+        "wire": {
+          "status": "pass",
+          "behaviour": false,
+          "detail": "effective, warnings and metadata all match"
+        },
+        "localRoot": {
+          "status": "pass",
+          "behaviour": false,
+          "detail": "effective, warnings and metadata all match"
+        }
+      }
+    },
+    "t02-entry-salvage-vs-whole-domain-refusal": {
+      "firstRed": false,
+      "legs": {
+        "domains": {
+          "status": "expected-rejected",
+          "behaviour": false,
+          "detail": "rejected at `validate` as expected"
+        },
+        "wire": {
+          "status": "expected-rejected",
+          "behaviour": false,
+          "detail": "rejected at `validate` as expected"
+        },
+        "localRoot": {
+          "status": "expected-rejected",
+          "behaviour": false,
+          "detail": "rejected at `validate` as expected"
+        }
+      }
+    },
+    "t03-prototype-name-key-not-swallowed": {
+      "firstRed": false,
+      "legs": {
+        "domains": {
+          "status": "pass",
+          "behaviour": false,
+          "detail": "effective, warnings and metadata all match"
+        },
+        "wire": {
+          "status": "pass",
+          "behaviour": false,
+          "detail": "effective, warnings and metadata all match"
+        },
+        "localRoot": {
+          "status": "pass",
+          "behaviour": false,
+          "detail": "effective, warnings and metadata all match"
+        }
+      }
+    },
+    "t04-secret-literal-never-in-warning-value": {
+      "firstRed": true,
+      "legs": {
+        "domains": {
+          "status": "diff",
+          "behaviour": true,
+          "detail": "1 effective diff(s), 2 missing / 1 extra warning(s), 0 metadata diff(s)"
+        },
+        "wire": {
+          "status": "diff",
+          "behaviour": true,
+          "detail": "1 effective diff(s), 2 missing / 1 extra warning(s), 0 metadata diff(s)"
+        },
+        "localRoot": {
+          "status": "diff",
+          "behaviour": true,
+          "detail": "1 effective diff(s), 2 missing / 1 extra warning(s), 0 metadata diff(s)"
+        }
+      }
+    },
     "z01-every-domain-empty-object": {
       "firstRed": false,
       "legs": {

package/conformance/historical/settings-schema@1.10.0.json

@@ -8,9 +8,10 @@
     "why": "旧版坐标是点号串、今天是段数组;归一 = 按 `.` 拼串,这正是 3.0.0 要消掉的有损编码(`[\"a.b\"]` 与 `[\"a\",\"b\"]` 归一后同串)"
   },
   "summary": {
-    "pass": 111,
-    "diff": 24,
-    "expected-rejected": 12,
+    "pass": 117,
+    "diff": 27,
+    "diff-ledgered": 0,
+    "expected-rejected": 15,
     "harness-error": 0,
     "skipped": 0
   },
@@ -955,6 +956,86 @@
         }
       }
     },
+    "t01-absent-domain-key-not-null": {
+      "firstRed": false,
+      "legs": {
+        "domains": {
+          "status": "pass",
+          "behaviour": false,
+          "detail": "effective, warnings and metadata all match"
+        },
+        "wire": {
+          "status": "pass",
+          "behaviour": false,
+          "detail": "effective, warnings and metadata all match"
+        },
+        "localRoot": {
+          "status": "pass",
+          "behaviour": false,
+          "detail": "effective, warnings and metadata all match"
+        }
+      }
+    },
+    "t02-entry-salvage-vs-whole-domain-refusal": {
+      "firstRed": false,
+      "legs": {
+        "domains": {
+          "status": "expected-rejected",
+          "behaviour": false,
+          "detail": "rejected at `validate` as expected"
+        },
+        "wire": {
+          "status": "expected-rejected",
+          "behaviour": false,
+          "detail": "rejected at `validate` as expected"
+        },
+        "localRoot": {
+          "status": "expected-rejected",
+          "behaviour": false,
+          "detail": "rejected at `validate` as expected"
+        }
+      }
+    },
+    "t03-prototype-name-key-not-swallowed": {
+      "firstRed": false,
+      "legs": {
+        "domains": {
+          "status": "pass",
+          "behaviour": false,
+          "detail": "effective, warnings and metadata all match"
+        },
+        "wire": {
+          "status": "pass",
+          "behaviour": false,
+          "detail": "effective, warnings and metadata all match"
+        },
+        "localRoot": {
+          "status": "pass",
+          "behaviour": false,
+          "detail": "effective, warnings and metadata all match"
+        }
+      }
+    },
+    "t04-secret-literal-never-in-warning-value": {
+      "firstRed": true,
+      "legs": {
+        "domains": {
+          "status": "diff",
+          "behaviour": true,
+          "detail": "1 effective diff(s), 2 missing / 1 extra warning(s), 0 metadata diff(s)"
+        },
+        "wire": {
+          "status": "diff",
+          "behaviour": true,
+          "detail": "1 effective diff(s), 2 missing / 1 extra warning(s), 0 metadata diff(s)"
+        },
+        "localRoot": {
+          "status": "diff",
+          "behaviour": true,
+          "detail": "1 effective diff(s), 2 missing / 1 extra warning(s), 0 metadata diff(s)"
+        }
+      }
+    },
     "z01-every-domain-empty-object": {
       "firstRed": false,
       "legs": {

package/conformance/historical/settings-schema@1.5.0.json

@@ -8,9 +8,10 @@
     "why": "旧版坐标是点号串、今天是段数组;归一 = 按 `.` 拼串,这正是 3.0.0 要消掉的有损编码(`[\"a.b\"]` 与 `[\"a\",\"b\"]` 归一后同串)"
   },
   "summary": {
-    "pass": 102,
-    "diff": 33,
-    "expected-rejected": 12,
+    "pass": 108,
+    "diff": 36,
+    "diff-ledgered": 0,
+    "expected-rejected": 15,
     "harness-error": 0,
     "skipped": 0
   },
@@ -955,6 +956,86 @@
         }
       }
     },
+    "t01-absent-domain-key-not-null": {
+      "firstRed": false,
+      "legs": {
+        "domains": {
+          "status": "pass",
+          "behaviour": false,
+          "detail": "effective, warnings and metadata all match"
+        },
+        "wire": {
+          "status": "pass",
+          "behaviour": false,
+          "detail": "effective, warnings and metadata all match"
+        },
+        "localRoot": {
+          "status": "pass",
+          "behaviour": false,
+          "detail": "effective, warnings and metadata all match"
+        }
+      }
+    },
+    "t02-entry-salvage-vs-whole-domain-refusal": {
+      "firstRed": false,
+      "legs": {
+        "domains": {
+          "status": "expected-rejected",
+          "behaviour": false,
+          "detail": "rejected at `validate` as expected"
+        },
+        "wire": {
+          "status": "expected-rejected",
+          "behaviour": false,
+          "detail": "rejected at `validate` as expected"
+        },
+        "localRoot": {
+          "status": "expected-rejected",
+          "behaviour": false,
+          "detail": "rejected at `validate` as expected"
+        }
+      }
+    },
+    "t03-prototype-name-key-not-swallowed": {
+      "firstRed": false,
+      "legs": {
+        "domains": {
+          "status": "pass",
+          "behaviour": false,
+          "detail": "effective, warnings and metadata all match"
+        },
+        "wire": {
+          "status": "pass",
+          "behaviour": false,
+          "detail": "effective, warnings and metadata all match"
+        },
+        "localRoot": {
+          "status": "pass",
+          "behaviour": false,
+          "detail": "effective, warnings and metadata all match"
+        }
+      }
+    },
+    "t04-secret-literal-never-in-warning-value": {
+      "firstRed": true,
+      "legs": {
+        "domains": {
+          "status": "diff",
+          "behaviour": true,
+          "detail": "1 effective diff(s), 2 missing / 1 extra warning(s), 0 metadata diff(s)"
+        },
+        "wire": {
+          "status": "diff",
+          "behaviour": true,
+          "detail": "1 effective diff(s), 2 missing / 1 extra warning(s), 0 metadata diff(s)"
+        },
+        "localRoot": {
+          "status": "diff",
+          "behaviour": true,
+          "detail": "1 effective diff(s), 2 missing / 1 extra warning(s), 0 metadata diff(s)"
+        }
+      }
+    },
     "z01-every-domain-empty-object": {
       "firstRed": false,
       "legs": {

package/conformance/historical/settings-schema@2.0.0.json

@@ -8,9 +8,10 @@
     "why": "旧版坐标是点号串、今天是段数组;归一 = 按 `.` 拼串,这正是 3.0.0 要消掉的有损编码(`[\"a.b\"]` 与 `[\"a\",\"b\"]` 归一后同串)"
   },
   "summary": {
-    "pass": 129,
+    "pass": 138,
     "diff": 6,
-    "expected-rejected": 12,
+    "diff-ledgered": 0,
+    "expected-rejected": 15,
     "harness-error": 0,
     "skipped": 0
   },
@@ -955,6 +956,86 @@
         }
       }
     },
+    "t01-absent-domain-key-not-null": {
+      "firstRed": false,
+      "legs": {
+        "domains": {
+          "status": "pass",
+          "behaviour": false,
+          "detail": "effective, warnings and metadata all match"
+        },
+        "wire": {
+          "status": "pass",
+          "behaviour": false,
+          "detail": "effective, warnings and metadata all match"
+        },
+        "localRoot": {
+          "status": "pass",
+          "behaviour": false,
+          "detail": "effective, warnings and metadata all match"
+        }
+      }
+    },
+    "t02-entry-salvage-vs-whole-domain-refusal": {
+      "firstRed": false,
+      "legs": {
+        "domains": {
+          "status": "expected-rejected",
+          "behaviour": false,
+          "detail": "rejected at `validate` as expected"
+        },
+        "wire": {
+          "status": "expected-rejected",
+          "behaviour": false,
+          "detail": "rejected at `validate` as expected"
+        },
+        "localRoot": {
+          "status": "expected-rejected",
+          "behaviour": false,
+          "detail": "rejected at `validate` as expected"
+        }
+      }
+    },
+    "t03-prototype-name-key-not-swallowed": {
+      "firstRed": false,
+      "legs": {
+        "domains": {
+          "status": "pass",
+          "behaviour": false,
+          "detail": "effective, warnings and metadata all match"
+        },
+        "wire": {
+          "status": "pass",
+          "behaviour": false,
+          "detail": "effective, warnings and metadata all match"
+        },
+        "localRoot": {
+          "status": "pass",
+          "behaviour": false,
+          "detail": "effective, warnings and metadata all match"
+        }
+      }
+    },
+    "t04-secret-literal-never-in-warning-value": {
+      "firstRed": false,
+      "legs": {
+        "domains": {
+          "status": "pass",
+          "behaviour": false,
+          "detail": "effective, warnings and metadata all match"
+        },
+        "wire": {
+          "status": "pass",
+          "behaviour": false,
+          "detail": "effective, warnings and metadata all match"
+        },
+        "localRoot": {
+          "status": "pass",
+          "behaviour": false,
+          "detail": "effective, warnings and metadata all match"
+        }
+      }
+    },
     "z01-every-domain-empty-object": {
       "firstRed": false,
       "legs": {