@sema-agent/settings-schema 6.3.0 → 7.0.0

package/conformance/cases/c54-s784-lane-adb-legal/input.json

@@ -0,0 +1,29 @@
+{
+  "meta": {
+    "version": 7,
+    "updatedAt": "2026-10-03T00:00:00.000Z"
+  },
+  "domains": {
+    "workers": {
+      "workers": [
+        {
+          "name": "w-adb",
+          "secretRefs": {
+            "apiKeyEnv": "MODEL_KEY"
+          },
+          "runtime": {
+            "execution": {
+              "lane": "adb",
+              "coords": {
+                "ADB_SERIAL": "emulator-5554"
+              }
+            },
+            "store": {
+              "backend": "local"
+            }
+          }
+        }
+      ]
+    }
+  }
+}

package/conformance/cases/c54-s784-lane-adb-legal/meta.json

@@ -0,0 +1,5 @@
+{
+  "contributor": "contract",
+  "claim": "7.0.0 M-R2:`adb` 车道的一份合法 WorkerSpec(必需坐标 / 密钥齐、可选键在本车道栏内)三腿读出、零告警。打的是「写闸把合法车道块判成坏的」或「读腿把 runtime.execution / runtime.store 剥掉」两种读法分歧(6.4.0 两块都会被静默剥)。",
+  "firstRedOn": []
+}

package/conformance/cases/c55-s784-lane-local-docker-legal/expected.json

@@ -0,0 +1,103 @@
+{
+  "domains": {
+    "outcome": "effective",
+    "effective": {
+      "collab": {
+        "templates": []
+      },
+      "entitlement": {
+        "budgetGroups": [],
+        "groupBindings": [],
+        "subjects": [],
+        "tiers": []
+      },
+      "execution": {
+        "allowedLanes": [
+          "host"
+        ],
+        "required": false
+      },
+      "governance": {},
+      "hosts": {
+        "hosts": []
+      },
+      "limits": {},
+      "mcp": {
+        "servers": []
+      },
+      "models": {
+        "models": [],
+        "roles": {},
+        "tierGroups": []
+      },
+      "plugins": {
+        "plugins": []
+      },
+      "projects": {
+        "projects": {}
+      },
+      "prompts": {
+        "bindings": []
+      },
+      "rosters": {
+        "rosters": []
+      },
+      "runtime": {},
+      "scenarios": {
+        "scenarios": []
+      },
+      "skills": {
+        "skills": []
+      },
+      "systems": {
+        "systems": []
+      },
+      "workers": {
+        "workers": [
+          {
+            "coords": {},
+            "enabled": true,
+            "host": "default",
+            "image": "sema-server:latest",
+            "name": "w-local-docker",
+            "runtime": {
+              "execution": {
+                "coords": {
+                  "DOCKER_HOST": "tcp://docker.internal:2376",
+                  "DOCKER_IMAGE": "registry.internal/sandbox:1"
+                },
+                "lane": "local-docker",
+                "secretRefs": {}
+              },
+              "rateLimitRpm": 0,
+              "requirePrincipal": false,
+              "store": {
+                "backend": "local",
+                "memory": {
+                  "backend": "file",
+                  "engine": "on"
+                },
+                "session": "auto"
+              }
+            },
+            "secretRefs": {
+              "apiKeyEnv": "MODEL_KEY"
+            }
+          }
+        ]
+      }
+    },
+    "warnings": [],
+    "metadata": {
+      "version": 7,
+      "updatedAt": "2026-10-03T00:00:00.000Z"
+    }
+  },
+  "wire": {
+    "derive": true
+  },
+  "localRoot": {
+    "derive": true,
+    "localVersion": 2617555914511015
+  }
+}

package/conformance/cases/c55-s784-lane-local-docker-legal/input.json

@@ -0,0 +1,30 @@
+{
+  "meta": {
+    "version": 7,
+    "updatedAt": "2026-10-03T00:00:00.000Z"
+  },
+  "domains": {
+    "workers": {
+      "workers": [
+        {
+          "name": "w-local-docker",
+          "secretRefs": {
+            "apiKeyEnv": "MODEL_KEY"
+          },
+          "runtime": {
+            "execution": {
+              "lane": "local-docker",
+              "coords": {
+                "DOCKER_IMAGE": "registry.internal/sandbox:1",
+                "DOCKER_HOST": "tcp://docker.internal:2376"
+              }
+            },
+            "store": {
+              "backend": "local"
+            }
+          }
+        }
+      ]
+    }
+  }
+}

package/conformance/cases/c55-s784-lane-local-docker-legal/meta.json

@@ -0,0 +1,5 @@
+{
+  "contributor": "contract",
+  "claim": "7.0.0 M-R2:`local-docker` 车道的一份合法 WorkerSpec(必需坐标 / 密钥齐、可选键在本车道栏内)三腿读出、零告警。打的是「写闸把合法车道块判成坏的」或「读腿把 runtime.execution / runtime.store 剥掉」两种读法分歧(6.4.0 两块都会被静默剥)。",
+  "firstRedOn": []
+}

package/conformance/cases/c56-s784-lane-device-legal/expected.json

@@ -0,0 +1,109 @@
+{
+  "domains": {
+    "outcome": "effective",
+    "effective": {
+      "collab": {
+        "templates": []
+      },
+      "entitlement": {
+        "budgetGroups": [],
+        "groupBindings": [],
+        "subjects": [],
+        "tiers": []
+      },
+      "execution": {
+        "allowedLanes": [
+          "host"
+        ],
+        "required": false
+      },
+      "governance": {},
+      "hosts": {
+        "hosts": []
+      },
+      "limits": {},
+      "mcp": {
+        "servers": []
+      },
+      "models": {
+        "models": [],
+        "roles": {},
+        "tierGroups": []
+      },
+      "plugins": {
+        "plugins": []
+      },
+      "projects": {
+        "projects": {}
+      },
+      "prompts": {
+        "bindings": []
+      },
+      "rosters": {
+        "rosters": []
+      },
+      "runtime": {},
+      "scenarios": {
+        "scenarios": []
+      },
+      "skills": {
+        "skills": []
+      },
+      "systems": {
+        "systems": []
+      },
+      "workers": {
+        "workers": [
+          {
+            "coords": {},
+            "enabled": true,
+            "host": "default",
+            "image": "sema-server:latest",
+            "name": "w-device",
+            "runtime": {
+              "execution": {
+                "coords": {
+                  "DEVICE_SUPERSEDE": "deny"
+                },
+                "lane": "device",
+                "secretRefs": {}
+              },
+              "rateLimitRpm": 0,
+              "requirePrincipal": false,
+              "store": {
+                "backend": "pg",
+                "db": {
+                  "database": "sema",
+                  "host": "pg.internal",
+                  "port": 5432,
+                  "user": "svc"
+                },
+                "memory": {
+                  "backend": "file",
+                  "engine": "on"
+                },
+                "session": "auto"
+              }
+            },
+            "secretRefs": {
+              "apiKeyEnv": "MODEL_KEY",
+              "dbPasswordEnv": "HOST_DB_PW"
+            }
+          }
+        ]
+      }
+    },
+    "warnings": [],
+    "metadata": {
+      "version": 7,
+      "updatedAt": "2026-10-03T00:00:00.000Z"
+    }
+  },
+  "wire": {
+    "derive": true
+  },
+  "localRoot": {
+    "derive": true,
+    "localVersion": 2617555914511015
+  }
+}

package/conformance/cases/c56-s784-lane-device-legal/input.json

@@ -0,0 +1,36 @@
+{
+  "meta": {
+    "version": 7,
+    "updatedAt": "2026-10-03T00:00:00.000Z"
+  },
+  "domains": {
+    "workers": {
+      "workers": [
+        {
+          "name": "w-device",
+          "secretRefs": {
+            "apiKeyEnv": "MODEL_KEY",
+            "dbPasswordEnv": "HOST_DB_PW"
+          },
+          "runtime": {
+            "execution": {
+              "lane": "device",
+              "coords": {
+                "DEVICE_SUPERSEDE": "deny"
+              }
+            },
+            "store": {
+              "backend": "pg",
+              "db": {
+                "host": "pg.internal",
+                "port": 5432,
+                "user": "svc",
+                "database": "sema"
+              }
+            }
+          }
+        }
+      ]
+    }
+  }
+}

package/conformance/cases/c56-s784-lane-device-legal/meta.json

@@ -0,0 +1,5 @@
+{
+  "contributor": "contract",
+  "claim": "7.0.0 M-R2:`device` 车道的一份合法 WorkerSpec(必需坐标 / 密钥齐、可选键在本车道栏内)三腿读出、零告警。打的是「写闸把合法车道块判成坏的」或「读腿把 runtime.execution / runtime.store 剥掉」两种读法分歧(6.4.0 两块都会被静默剥)。 device 这一份用 pg 店:引擎 `device-durable-store` 拒没有 SQL 坐标的 device(gpt-6 腿 F2),local 店的 device 是拒因语料 c68。",
+  "firstRedOn": []
+}

package/conformance/cases/c57-s784-g1-enabled-no-lane/expected.json

@@ -0,0 +1,83 @@
+{
+  "domains": {
+    "outcome": "rejected",
+    "stage": "validate",
+    "why": "7.0.0 写闸(WorkerSpec)拒 —— workers 是 gate 域,一只坏 worker 整域拒,不逐条容错"
+  },
+  "wire": {
+    "outcome": "rejected",
+    "stage": "validate",
+    "why": "wire 腿把同一份文档交给同一个 buildEffective,拒绝层相同"
+  },
+  "localRoot": {
+    "outcome": "effective",
+    "effective": {
+      "collab": {
+        "templates": []
+      },
+      "entitlement": {
+        "budgetGroups": [],
+        "groupBindings": [],
+        "subjects": [],
+        "tiers": []
+      },
+      "execution": {
+        "allowedLanes": [
+          "host"
+        ],
+        "required": false
+      },
+      "governance": {},
+      "hosts": {
+        "hosts": []
+      },
+      "limits": {},
+      "mcp": {
+        "servers": []
+      },
+      "models": {
+        "models": [],
+        "roles": {},
+        "tierGroups": []
+      },
+      "plugins": {
+        "plugins": []
+      },
+      "projects": {
+        "projects": {}
+      },
+      "prompts": {
+        "bindings": []
+      },
+      "rosters": {
+        "rosters": []
+      },
+      "runtime": {},
+      "scenarios": {
+        "scenarios": []
+      },
+      "skills": {
+        "skills": []
+      },
+      "systems": {
+        "systems": []
+      },
+      "workers": {
+        "workers": []
+      }
+    },
+    "warnings": [
+      {
+        "domain": "workers",
+        "file": "workers.json",
+        "kind": "unread-config-file",
+        "why": "non-portable-domain"
+      }
+    ],
+    "metadata": {
+      "version": 2617555914511015,
+      "updatedAt": "1970-01-01T00:00:00.000Z"
+    },
+    "why": "workers 是非便携域:本机腿不读 config.d/workers.json(只报 unread-config-file),写闸判据只在 domains / wire 两腿上可观察"
+  }
+}

package/conformance/cases/c57-s784-g1-enabled-no-lane/input.json

@@ -0,0 +1,23 @@
+{
+  "meta": {
+    "version": 7,
+    "updatedAt": "2026-10-03T00:00:00.000Z"
+  },
+  "domains": {
+    "workers": {
+      "workers": [
+        {
+          "name": "w",
+          "secretRefs": {
+            "apiKeyEnv": "MODEL_KEY"
+          },
+          "runtime": {
+            "store": {
+              "backend": "local"
+            }
+          }
+        }
+      ]
+    }
+  }
+}

package/conformance/cases/c57-s784-g1-enabled-no-lane/meta.json

@@ -0,0 +1,5 @@
+{
+  "contributor": "contract",
+  "claim": "G1:enabled 的 worker 没有 runtime.execution ⇒ 拒(拒因点名 runtime.execution.lane)。打「声明不了车道也能过闸、起服落进程内 stub、无手照回 completed」那条静默路(WA-49)。",
+  "firstRedOn": []
+}

package/conformance/cases/c58-s784-g2-multitenant-host/expected.json

@@ -0,0 +1,83 @@
+{
+  "domains": {
+    "outcome": "rejected",
+    "stage": "validate",
+    "why": "7.0.0 写闸(WorkerSpec)拒 —— workers 是 gate 域,一只坏 worker 整域拒,不逐条容错"
+  },
+  "wire": {
+    "outcome": "rejected",
+    "stage": "validate",
+    "why": "wire 腿把同一份文档交给同一个 buildEffective,拒绝层相同"
+  },
+  "localRoot": {
+    "outcome": "effective",
+    "effective": {
+      "collab": {
+        "templates": []
+      },
+      "entitlement": {
+        "budgetGroups": [],
+        "groupBindings": [],
+        "subjects": [],
+        "tiers": []
+      },
+      "execution": {
+        "allowedLanes": [
+          "host"
+        ],
+        "required": false
+      },
+      "governance": {},
+      "hosts": {
+        "hosts": []
+      },
+      "limits": {},
+      "mcp": {
+        "servers": []
+      },
+      "models": {
+        "models": [],
+        "roles": {},
+        "tierGroups": []
+      },
+      "plugins": {
+        "plugins": []
+      },
+      "projects": {
+        "projects": {}
+      },
+      "prompts": {
+        "bindings": []
+      },
+      "rosters": {
+        "rosters": []
+      },
+      "runtime": {},
+      "scenarios": {
+        "scenarios": []
+      },
+      "skills": {
+        "skills": []
+      },
+      "systems": {
+        "systems": []
+      },
+      "workers": {
+        "workers": []
+      }
+    },
+    "warnings": [
+      {
+        "domain": "workers",
+        "file": "workers.json",
+        "kind": "unread-config-file",
+        "why": "non-portable-domain"
+      }
+    ],
+    "metadata": {
+      "version": 2617555914511015,
+      "updatedAt": "1970-01-01T00:00:00.000Z"
+    },
+    "why": "workers 是非便携域:本机腿不读 config.d/workers.json(只报 unread-config-file),写闸判据只在 domains / wire 两腿上可观察"
+  }
+}

package/conformance/cases/c58-s784-g2-multitenant-host/input.json

@@ -0,0 +1,34 @@
+{
+  "meta": {
+    "version": 7,
+    "updatedAt": "2026-10-03T00:00:00.000Z"
+  },
+  "domains": {
+    "workers": {
+      "workers": [
+        {
+          "name": "w",
+          "secretRefs": {
+            "apiKeyEnv": "MODEL_KEY",
+            "dbPasswordEnv": "HOST_DB_PW"
+          },
+          "runtime": {
+            "execution": {
+              "lane": "host"
+            },
+            "store": {
+              "backend": "mysql",
+              "db": {
+                "host": "db.internal",
+                "port": 3306,
+                "user": "svc",
+                "database": "sema"
+              }
+            },
+            "requirePrincipal": true
+          }
+        }
+      ]
+    }
+  }
+}

package/conformance/cases/c58-s784-g2-multitenant-host/meta.json

@@ -0,0 +1,5 @@
+{
+  "contributor": "contract",
+  "claim": "G2:requirePrincipal + host(不分租户的车道)⇒ 拒;出路 = 导出表里 tenantSeparation=supported 的车道。打「多租户 worker 把每个租户的 Bash 落在同一台宿主」。",
+  "firstRedOn": []
+}

package/conformance/cases/c59-s784-g3-k8s-missing-image/expected.json

@@ -0,0 +1,83 @@
+{
+  "domains": {
+    "outcome": "rejected",
+    "stage": "validate",
+    "why": "7.0.0 写闸(WorkerSpec)拒 —— workers 是 gate 域,一只坏 worker 整域拒,不逐条容错"
+  },
+  "wire": {
+    "outcome": "rejected",
+    "stage": "validate",
+    "why": "wire 腿把同一份文档交给同一个 buildEffective,拒绝层相同"
+  },
+  "localRoot": {
+    "outcome": "effective",
+    "effective": {
+      "collab": {
+        "templates": []
+      },
+      "entitlement": {
+        "budgetGroups": [],
+        "groupBindings": [],
+        "subjects": [],
+        "tiers": []
+      },
+      "execution": {
+        "allowedLanes": [
+          "host"
+        ],
+        "required": false
+      },
+      "governance": {},
+      "hosts": {
+        "hosts": []
+      },
+      "limits": {},
+      "mcp": {
+        "servers": []
+      },
+      "models": {
+        "models": [],
+        "roles": {},
+        "tierGroups": []
+      },
+      "plugins": {
+        "plugins": []
+      },
+      "projects": {
+        "projects": {}
+      },
+      "prompts": {
+        "bindings": []
+      },
+      "rosters": {
+        "rosters": []
+      },
+      "runtime": {},
+      "scenarios": {
+        "scenarios": []
+      },
+      "skills": {
+        "skills": []
+      },
+      "systems": {
+        "systems": []
+      },
+      "workers": {
+        "workers": []
+      }
+    },
+    "warnings": [
+      {
+        "domain": "workers",
+        "file": "workers.json",
+        "kind": "unread-config-file",
+        "why": "non-portable-domain"
+      }
+    ],
+    "metadata": {
+      "version": 2617555914511015,
+      "updatedAt": "1970-01-01T00:00:00.000Z"
+    },
+    "why": "workers 是非便携域:本机腿不读 config.d/workers.json(只报 unread-config-file),写闸判据只在 domains / wire 两腿上可观察"
+  }
+}

package/conformance/cases/c59-s784-g3-k8s-missing-image/input.json

@@ -0,0 +1,26 @@
+{
+  "meta": {
+    "version": 7,
+    "updatedAt": "2026-10-03T00:00:00.000Z"
+  },
+  "domains": {
+    "workers": {
+      "workers": [
+        {
+          "name": "w",
+          "secretRefs": {
+            "apiKeyEnv": "MODEL_KEY"
+          },
+          "runtime": {
+            "execution": {
+              "lane": "k8s"
+            },
+            "store": {
+              "backend": "local"
+            }
+          }
+        }
+      ]
+    }
+  }
+}

package/conformance/cases/c59-s784-g3-k8s-missing-image/meta.json

@@ -0,0 +1,5 @@
+{
+  "contributor": "contract",
+  "claim": "G3a:k8s 车道缺 coords.K8S_SANDBOX_IMAGE ⇒ 拒点名。打「点了车道却配不齐,引擎起服才拒」—— 写闸先判同一张表。",
+  "firstRedOn": []
+}