@sema-agent/settings-schema 6.3.0 → 7.0.0

package/conformance/cases/c65-s784-pg-without-db/input.json

@@ -0,0 +1,27 @@
+{
+  "meta": {
+    "version": 7,
+    "updatedAt": "2026-10-03T00:00:00.000Z"
+  },
+  "domains": {
+    "workers": {
+      "workers": [
+        {
+          "name": "w",
+          "secretRefs": {
+            "apiKeyEnv": "MODEL_KEY",
+            "dbPasswordEnv": "HOST_DB_PW"
+          },
+          "runtime": {
+            "execution": {
+              "lane": "host"
+            },
+            "store": {
+              "backend": "pg"
+            }
+          }
+        }
+      ]
+    }
+  }
+}

package/conformance/cases/c65-s784-pg-without-db/meta.json

@@ -0,0 +1,5 @@
+{
+  "contributor": "contract",
+  "claim": "store.backend pg 缺 runtime.store.db ⇒ 拒:SQL 坐标 ⇔ SQL 店。打 WA-50「PG 部署无坐标可写」的另一面 —— 声明了 pg 却没坐标。",
+  "firstRedOn": []
+}

package/conformance/cases/c66-s784-memory-backend-mismatch/expected.json

@@ -0,0 +1,83 @@
+{
+  "domains": {
+    "outcome": "rejected",
+    "stage": "validate",
+    "why": "7.0.0 写闸(WorkerSpec)拒 —— workers 是 gate 域,一只坏 worker 整域拒,不逐条容错"
+  },
+  "wire": {
+    "outcome": "rejected",
+    "stage": "validate",
+    "why": "wire 腿把同一份文档交给同一个 buildEffective,拒绝层相同"
+  },
+  "localRoot": {
+    "outcome": "effective",
+    "effective": {
+      "collab": {
+        "templates": []
+      },
+      "entitlement": {
+        "budgetGroups": [],
+        "groupBindings": [],
+        "subjects": [],
+        "tiers": []
+      },
+      "execution": {
+        "allowedLanes": [
+          "host"
+        ],
+        "required": false
+      },
+      "governance": {},
+      "hosts": {
+        "hosts": []
+      },
+      "limits": {},
+      "mcp": {
+        "servers": []
+      },
+      "models": {
+        "models": [],
+        "roles": {},
+        "tierGroups": []
+      },
+      "plugins": {
+        "plugins": []
+      },
+      "projects": {
+        "projects": {}
+      },
+      "prompts": {
+        "bindings": []
+      },
+      "rosters": {
+        "rosters": []
+      },
+      "runtime": {},
+      "scenarios": {
+        "scenarios": []
+      },
+      "skills": {
+        "skills": []
+      },
+      "systems": {
+        "systems": []
+      },
+      "workers": {
+        "workers": []
+      }
+    },
+    "warnings": [
+      {
+        "domain": "workers",
+        "file": "workers.json",
+        "kind": "unread-config-file",
+        "why": "non-portable-domain"
+      }
+    ],
+    "metadata": {
+      "version": 2617555914511015,
+      "updatedAt": "1970-01-01T00:00:00.000Z"
+    },
+    "why": "workers 是非便携域:本机腿不读 config.d/workers.json(只报 unread-config-file),写闸判据只在 domains / wire 两腿上可观察"
+  }
+}

package/conformance/cases/c66-s784-memory-backend-mismatch/input.json

@@ -0,0 +1,36 @@
+{
+  "meta": {
+    "version": 7,
+    "updatedAt": "2026-10-03T00:00:00.000Z"
+  },
+  "domains": {
+    "workers": {
+      "workers": [
+        {
+          "name": "w",
+          "secretRefs": {
+            "apiKeyEnv": "MODEL_KEY",
+            "dbPasswordEnv": "HOST_DB_PW"
+          },
+          "runtime": {
+            "execution": {
+              "lane": "host"
+            },
+            "store": {
+              "backend": "mysql",
+              "db": {
+                "host": "db.internal",
+                "port": 3306,
+                "user": "svc",
+                "database": "sema"
+              },
+              "memory": {
+                "backend": "pg"
+              }
+            }
+          }
+        }
+      ]
+    }
+  }
+}

package/conformance/cases/c66-s784-memory-backend-mismatch/meta.json

@@ -0,0 +1,5 @@
+{
+  "contributor": "contract",
+  "claim": "store.memory.backend pg 而 store.backend mysql ⇒ 拒(pg 记忆面要 pg 店;tidb 要 mysql)。",
+  "firstRedOn": []
+}

package/conformance/cases/c67-s784-retired-field-loud/expected.json

@@ -0,0 +1,83 @@
+{
+  "domains": {
+    "outcome": "rejected",
+    "stage": "validate",
+    "why": "7.0.0 写闸(WorkerSpec)拒 —— workers 是 gate 域,一只坏 worker 整域拒,不逐条容错"
+  },
+  "wire": {
+    "outcome": "rejected",
+    "stage": "validate",
+    "why": "wire 腿把同一份文档交给同一个 buildEffective,拒绝层相同"
+  },
+  "localRoot": {
+    "outcome": "effective",
+    "effective": {
+      "collab": {
+        "templates": []
+      },
+      "entitlement": {
+        "budgetGroups": [],
+        "groupBindings": [],
+        "subjects": [],
+        "tiers": []
+      },
+      "execution": {
+        "allowedLanes": [
+          "host"
+        ],
+        "required": false
+      },
+      "governance": {},
+      "hosts": {
+        "hosts": []
+      },
+      "limits": {},
+      "mcp": {
+        "servers": []
+      },
+      "models": {
+        "models": [],
+        "roles": {},
+        "tierGroups": []
+      },
+      "plugins": {
+        "plugins": []
+      },
+      "projects": {
+        "projects": {}
+      },
+      "prompts": {
+        "bindings": []
+      },
+      "rosters": {
+        "rosters": []
+      },
+      "runtime": {},
+      "scenarios": {
+        "scenarios": []
+      },
+      "skills": {
+        "skills": []
+      },
+      "systems": {
+        "systems": []
+      },
+      "workers": {
+        "workers": []
+      }
+    },
+    "warnings": [
+      {
+        "domain": "workers",
+        "file": "workers.json",
+        "kind": "unread-config-file",
+        "why": "non-portable-domain"
+      }
+    ],
+    "metadata": {
+      "version": 2617555914511015,
+      "updatedAt": "1970-01-01T00:00:00.000Z"
+    },
+    "why": "workers 是非便携域:本机腿不读 config.d/workers.json(只报 unread-config-file),写闸判据只在 domains / wire 两腿上可观察"
+  }
+}

package/conformance/cases/c67-s784-retired-field-loud/input.json

@@ -0,0 +1,22 @@
+{
+  "meta": {
+    "version": 7,
+    "updatedAt": "2026-10-03T00:00:00.000Z"
+  },
+  "domains": {
+    "workers": {
+      "workers": [
+        {
+          "name": "w",
+          "secretRefs": {
+            "apiKeyEnv": "MODEL_KEY"
+          },
+          "runtime": {
+            "sessionBackend": "auto"
+          },
+          "enabled": false
+        }
+      ]
+    }
+  }
+}

package/conformance/cases/c67-s784-retired-field-loud/meta.json

@@ -0,0 +1,5 @@
+{
+  "contributor": "contract",
+  "claim": "7.0.0 删除项读到即**响亮拒**(runtime.sessionBackend,哪怕是停用的 worker),拒因指路 migrateWorkersDomain / settings-schema migrate-workers —— 不被 zod 静默剥成「什么都没声明」。",
+  "firstRedOn": []
+}

package/conformance/cases/c68-s784-device-local-store/expected.json

@@ -0,0 +1,83 @@
+{
+  "domains": {
+    "outcome": "rejected",
+    "stage": "validate",
+    "why": "7.0.0 写闸(WorkerSpec)拒 —— workers 是 gate 域,一只坏 worker 整域拒,不逐条容错"
+  },
+  "wire": {
+    "outcome": "rejected",
+    "stage": "validate",
+    "why": "wire 腿把同一份文档交给同一个 buildEffective,拒绝层相同"
+  },
+  "localRoot": {
+    "outcome": "effective",
+    "effective": {
+      "collab": {
+        "templates": []
+      },
+      "entitlement": {
+        "budgetGroups": [],
+        "groupBindings": [],
+        "subjects": [],
+        "tiers": []
+      },
+      "execution": {
+        "allowedLanes": [
+          "host"
+        ],
+        "required": false
+      },
+      "governance": {},
+      "hosts": {
+        "hosts": []
+      },
+      "limits": {},
+      "mcp": {
+        "servers": []
+      },
+      "models": {
+        "models": [],
+        "roles": {},
+        "tierGroups": []
+      },
+      "plugins": {
+        "plugins": []
+      },
+      "projects": {
+        "projects": {}
+      },
+      "prompts": {
+        "bindings": []
+      },
+      "rosters": {
+        "rosters": []
+      },
+      "runtime": {},
+      "scenarios": {
+        "scenarios": []
+      },
+      "skills": {
+        "skills": []
+      },
+      "systems": {
+        "systems": []
+      },
+      "workers": {
+        "workers": []
+      }
+    },
+    "warnings": [
+      {
+        "domain": "workers",
+        "file": "workers.json",
+        "kind": "unread-config-file",
+        "why": "non-portable-domain"
+      }
+    ],
+    "metadata": {
+      "version": 2617555914511015,
+      "updatedAt": "1970-01-01T00:00:00.000Z"
+    },
+    "why": "workers 是非便携域:本机腿不读 config.d/workers.json(只报 unread-config-file),写闸判据只在 domains / wire 两腿上可观察"
+  }
+}

package/conformance/cases/c68-s784-device-local-store/input.json

@@ -0,0 +1,26 @@
+{
+  "meta": {
+    "version": 7,
+    "updatedAt": "2026-10-03T00:00:00.000Z"
+  },
+  "domains": {
+    "workers": {
+      "workers": [
+        {
+          "name": "w",
+          "secretRefs": {
+            "apiKeyEnv": "MODEL_KEY"
+          },
+          "runtime": {
+            "execution": {
+              "lane": "device"
+            },
+            "store": {
+              "backend": "local"
+            }
+          }
+        }
+      ]
+    }
+  }
+}

package/conformance/cases/c68-s784-device-local-store/meta.json

@@ -0,0 +1,5 @@
+{
+  "contributor": "contract",
+  "claim": "device 车道 ∧ 非 SQL 店(local)⇒ 拒:设备注册簿 / session↔设备绑定 / 审计都在 SQL 里,引擎 `device-durable-store` 起服即拒 —— 写闸前置同判,不让「声明得了、起不来」的 device worker 过闸(gpt-6 腿 F2)。",
+  "firstRedOn": []
+}

package/conformance/cases/cli04-env-value-with-newline/expected.json

@@ -65,10 +65,21 @@
             "image": "sema-server:latest",
             "name": "w1",
             "runtime": {
-              "memoryBackend": "off",
+              "execution": {
+                "coords": {},
+                "lane": "host",
+                "secretRefs": {}
+              },
               "rateLimitRpm": 0,
               "requirePrincipal": false,
-              "sessionBackend": "auto"
+              "store": {
+                "backend": "local",
+                "memory": {
+                  "backend": "file",
+                  "engine": "on"
+                },
+                "session": "auto"
+              }
             },
             "secretRefs": {
               "apiKeyEnv": "OPENAI_API_KEY"

package/conformance/cases/cli04-env-value-with-newline/input.json

@@ -8,7 +8,14 @@
       "workers": [
         {
           "name": "w1",
-          "runtime": {},
+          "runtime": {
+            "execution": {
+              "lane": "host"
+            },
+            "store": {
+              "backend": "local"
+            }
+          },
           "secretRefs": {
             "apiKeyEnv": "OPENAI_API_KEY"
           },

package/conformance/cases/cli04-env-value-with-newline/meta.json

@@ -1,5 +1,5 @@
 {
   "contributor": "cli",
-  "claim": "壳视角④:worker 的 env 值里有换行 / 回车 ⇒ 读侧**原样承运**(不折叠、不截断、不静默改写)。壳的 `/config show` 单行渲染会断行,那是显示面的事;读侧一改,配置就与运维写下的不是同一份。注意这一域是非便携域:local-root 腿看不到它,只报 unread-config-file —— 三腿三样,壳要知道自己问的是哪一腿。",
+  "claim": "壳视角④:worker 的 env 值里有换行 / 回车 ⇒ 读侧**原样承运**(不折叠、不截断、不静默改写)。壳的 `/config show` 单行渲染会断行,那是显示面的事;读侧一改,配置就与运维写下的不是同一份。注意这一域是非便携域:local-root 腿看不到它,只报 unread-config-file —— 三腿三样,壳要知道自己问的是哪一腿。 (7.0.0:输入的 worker 改成 7.0.0 形 —— 显式声明 `runtime.execution {lane: host}` + `runtime.store {backend: local}`。6.x 原输入是 enabled 且无车道的 `runtime: {}`,正是 WA-49 病例,一次性迁移对它是 refused,迁不出可读形;本条要打的是 env 值的承运,与车道无关,所以按新形写明车道,不是放宽读侧。)",
   "firstRedOn": []
 }

package/conformance/migrate-workers/m01-g5-k8s-env-lifted/expected.json

@@ -0,0 +1,49 @@
+{
+  "doc": {
+    "workers": [
+      {
+        "name": "direct",
+        "enabled": true,
+        "host": "default",
+        "image": "sema-server:latest",
+        "secretRefs": {
+          "apiKeyEnv": "MODEL_KEY"
+        },
+        "runtime": {
+          "requirePrincipal": false,
+          "rateLimitRpm": 0,
+          "execution": {
+            "lane": "k8s",
+            "coords": {
+              "K8S_SANDBOX_IMAGE": "registry.internal/sandbox@sha256:abc",
+              "K8S_NAMESPACE": "sandboxes"
+            },
+            "secretRefs": {}
+          },
+          "store": {
+            "backend": "local",
+            "session": "auto"
+          }
+        },
+        "coords": {},
+        "env": {
+          "LOG_LEVEL": "debug"
+        }
+      }
+    ]
+  },
+  "changed": [
+    "direct"
+  ],
+  "dropped": [
+    {
+      "name": "direct",
+      "index": 0,
+      "field": [
+        "runtime",
+        "memoryBackend"
+      ]
+    }
+  ],
+  "refused": []
+}

package/conformance/migrate-workers/m01-g5-k8s-env-lifted/input.json

@@ -0,0 +1,26 @@
+{
+  "workers": [
+    {
+      "name": "direct",
+      "enabled": true,
+      "host": "default",
+      "image": "sema-server:latest",
+      "secretRefs": {
+        "apiKeyEnv": "MODEL_KEY"
+      },
+      "runtime": {
+        "sessionBackend": "auto",
+        "memoryBackend": "off",
+        "requirePrincipal": false,
+        "rateLimitRpm": 0
+      },
+      "coords": {},
+      "env": {
+        "REMOTE_EXEC": "k8s",
+        "K8S_SANDBOX_IMAGE": "registry.internal/sandbox@sha256:abc",
+        "K8S_NAMESPACE": "sandboxes",
+        "LOG_LEVEL": "debug"
+      }
+    }
+  ]
+}

package/conformance/migrate-workers/m01-g5-k8s-env-lifted/meta.json

@@ -0,0 +1,4 @@
+{
+  "contributor": "contract",
+  "claim": "G5 正臂:6.x 活舰队形(env.REMOTE_EXEC=k8s + 同车道 K8S_*)⇒ runtime.execution {lane: k8s, coords 搬入},env 里两键消失、非车道键留下;memoryBackend 进 dropped(从未生效);无 SQL 坐标 ⇒ store.backend local。"
+}

package/conformance/migrate-workers/m02-g5-idempotent/expected.json

@@ -0,0 +1,38 @@
+{
+  "doc": {
+    "workers": [
+      {
+        "name": "direct",
+        "enabled": true,
+        "host": "default",
+        "image": "sema-server:latest",
+        "secretRefs": {
+          "apiKeyEnv": "MODEL_KEY"
+        },
+        "runtime": {
+          "requirePrincipal": false,
+          "rateLimitRpm": 0,
+          "execution": {
+            "lane": "k8s",
+            "coords": {
+              "K8S_SANDBOX_IMAGE": "registry.internal/sandbox@sha256:abc",
+              "K8S_NAMESPACE": "sandboxes"
+            },
+            "secretRefs": {}
+          },
+          "store": {
+            "backend": "local",
+            "session": "auto"
+          }
+        },
+        "coords": {},
+        "env": {
+          "LOG_LEVEL": "debug"
+        }
+      }
+    ]
+  },
+  "changed": [],
+  "dropped": [],
+  "refused": []
+}

package/conformance/migrate-workers/m02-g5-idempotent/input.json

@@ -0,0 +1,33 @@
+{
+  "workers": [
+    {
+      "name": "direct",
+      "enabled": true,
+      "host": "default",
+      "image": "sema-server:latest",
+      "secretRefs": {
+        "apiKeyEnv": "MODEL_KEY"
+      },
+      "runtime": {
+        "requirePrincipal": false,
+        "rateLimitRpm": 0,
+        "execution": {
+          "lane": "k8s",
+          "coords": {
+            "K8S_SANDBOX_IMAGE": "registry.internal/sandbox@sha256:abc",
+            "K8S_NAMESPACE": "sandboxes"
+          },
+          "secretRefs": {}
+        },
+        "store": {
+          "backend": "local",
+          "session": "auto"
+        }
+      },
+      "coords": {},
+      "env": {
+        "LOG_LEVEL": "debug"
+      }
+    }
+  ]
+}

package/conformance/migrate-workers/m02-g5-idempotent/meta.json

@@ -0,0 +1,5 @@
+{
+  "contributor": "contract",
+  "claim": "G5 幂等:输入 = m01 的迁移输出(已迁形)⇒ changed / dropped / refused 全空,doc 字节相等。input.json 由加冕脚本从 m01 的 expected 生成,不手写。",
+  "inputFrom": "m01-g5-k8s-env-lifted"
+}

package/conformance/migrate-workers/m03-g5-refused-no-lane/expected.json

@@ -0,0 +1,71 @@
+{
+  "doc": {
+    "workers": [
+      {
+        "name": "canary",
+        "enabled": true,
+        "host": "default",
+        "image": "sema-server:latest",
+        "secretRefs": {
+          "apiKeyEnv": "MODEL_KEY"
+        },
+        "runtime": {
+          "requirePrincipal": false,
+          "rateLimitRpm": 0,
+          "execution": {
+            "lane": "e2b",
+            "coords": {},
+            "secretRefs": {
+              "E2B_API_KEY": "HOST_E2B_KEY"
+            }
+          },
+          "store": {
+            "backend": "local",
+            "session": "auto"
+          }
+        },
+        "coords": {}
+      }
+    ]
+  },
+  "changed": [
+    "canary"
+  ],
+  "dropped": [
+    {
+      "name": "canary",
+      "index": 1,
+      "field": [
+        "runtime",
+        "memoryBackend"
+      ]
+    }
+  ],
+  "refused": [
+    {
+      "name": "handless",
+      "index": 0,
+      "field": [
+        "env",
+        "REMOTE_EXEC"
+      ],
+      "reason": "an enabled worker names no execution lane (env.REMOTE_EXEC is unset) — it boots with no hands and still reports tasks completed. The migration does not guess a lane: set runtime.execution.lane (host | e2b | k8s | ssh | adb | local-docker | device) by hand, or disable the worker",
+      "original": {
+        "name": "handless",
+        "enabled": true,
+        "host": "default",
+        "image": "sema-server:latest",
+        "secretRefs": {
+          "apiKeyEnv": "MODEL_KEY"
+        },
+        "runtime": {
+          "sessionBackend": "auto",
+          "memoryBackend": "off",
+          "requirePrincipal": false,
+          "rateLimitRpm": 0
+        },
+        "coords": {}
+      }
+    }
+  ]
+}