@sema-agent/settings-schema 6.4.0 → 7.0.1

package/conformance/cases/c52-s784-lane-k8s-legal/expected.json

@@ -0,0 +1,106 @@
+{
+  "domains": {
+    "outcome": "effective",
+    "effective": {
+      "collab": {
+        "templates": []
+      },
+      "entitlement": {
+        "budgetGroups": [],
+        "groupBindings": [],
+        "subjects": [],
+        "tiers": []
+      },
+      "execution": {
+        "allowedLanes": [
+          "host"
+        ],
+        "required": false
+      },
+      "governance": {},
+      "hosts": {
+        "hosts": []
+      },
+      "limits": {},
+      "mcp": {
+        "servers": []
+      },
+      "models": {
+        "models": [],
+        "roles": {},
+        "tierGroups": []
+      },
+      "plugins": {
+        "plugins": []
+      },
+      "projects": {
+        "projects": {}
+      },
+      "prompts": {
+        "bindings": []
+      },
+      "rosters": {
+        "rosters": []
+      },
+      "runtime": {},
+      "scenarios": {
+        "scenarios": []
+      },
+      "skills": {
+        "skills": []
+      },
+      "systems": {
+        "systems": []
+      },
+      "workers": {
+        "workers": [
+          {
+            "coords": {},
+            "enabled": true,
+            "host": "default",
+            "image": "sema-server:latest",
+            "name": "w-k8s",
+            "runtime": {
+              "execution": {
+                "coords": {
+                  "K8S_NAMESPACE": "sandboxes",
+                  "K8S_RUNTIME_CLASS": "",
+                  "K8S_SANDBOX_IMAGE": "registry.internal/sandbox@sha256:abc"
+                },
+                "lane": "k8s",
+                "secretRefs": {
+                  "K8S_TOKEN": "HOST_K8S_TOKEN"
+                }
+              },
+              "rateLimitRpm": 0,
+              "requirePrincipal": false,
+              "store": {
+                "backend": "local",
+                "memory": {
+                  "backend": "file",
+                  "engine": "on"
+                },
+                "session": "auto"
+              }
+            },
+            "secretRefs": {
+              "apiKeyEnv": "MODEL_KEY"
+            }
+          }
+        ]
+      }
+    },
+    "warnings": [],
+    "metadata": {
+      "version": 7,
+      "updatedAt": "2026-10-03T00:00:00.000Z"
+    }
+  },
+  "wire": {
+    "derive": true
+  },
+  "localRoot": {
+    "derive": true,
+    "localVersion": 2617555914511015
+  }
+}

package/conformance/cases/c52-s784-lane-k8s-legal/input.json

@@ -0,0 +1,34 @@
+{
+  "meta": {
+    "version": 7,
+    "updatedAt": "2026-10-03T00:00:00.000Z"
+  },
+  "domains": {
+    "workers": {
+      "workers": [
+        {
+          "name": "w-k8s",
+          "secretRefs": {
+            "apiKeyEnv": "MODEL_KEY"
+          },
+          "runtime": {
+            "execution": {
+              "lane": "k8s",
+              "coords": {
+                "K8S_SANDBOX_IMAGE": "registry.internal/sandbox@sha256:abc",
+                "K8S_NAMESPACE": "sandboxes",
+                "K8S_RUNTIME_CLASS": ""
+              },
+              "secretRefs": {
+                "K8S_TOKEN": "HOST_K8S_TOKEN"
+              }
+            },
+            "store": {
+              "backend": "local"
+            }
+          }
+        }
+      ]
+    }
+  }
+}

package/conformance/cases/c52-s784-lane-k8s-legal/meta.json

@@ -0,0 +1,5 @@
+{
+  "contributor": "contract",
+  "claim": "7.0.0 M-R2:`k8s` 车道的一份合法 WorkerSpec(必需坐标 / 密钥齐、可选键在本车道栏内)三腿读出、零告警。打的是「写闸把合法车道块判成坏的」或「读腿把 runtime.execution / runtime.store 剥掉」两种读法分歧(6.4.0 两块都会被静默剥)。",
+  "firstRedOn": []
+}

package/conformance/cases/c53-s784-lane-ssh-legal/expected.json

@@ -0,0 +1,106 @@
+{
+  "domains": {
+    "outcome": "effective",
+    "effective": {
+      "collab": {
+        "templates": []
+      },
+      "entitlement": {
+        "budgetGroups": [],
+        "groupBindings": [],
+        "subjects": [],
+        "tiers": []
+      },
+      "execution": {
+        "allowedLanes": [
+          "host"
+        ],
+        "required": false
+      },
+      "governance": {},
+      "hosts": {
+        "hosts": []
+      },
+      "limits": {},
+      "mcp": {
+        "servers": []
+      },
+      "models": {
+        "models": [],
+        "roles": {},
+        "tierGroups": []
+      },
+      "plugins": {
+        "plugins": []
+      },
+      "projects": {
+        "projects": {}
+      },
+      "prompts": {
+        "bindings": []
+      },
+      "rosters": {
+        "rosters": []
+      },
+      "runtime": {},
+      "scenarios": {
+        "scenarios": []
+      },
+      "skills": {
+        "skills": []
+      },
+      "systems": {
+        "systems": []
+      },
+      "workers": {
+        "workers": [
+          {
+            "coords": {},
+            "enabled": true,
+            "host": "default",
+            "image": "sema-server:latest",
+            "name": "w-ssh",
+            "runtime": {
+              "execution": {
+                "coords": {
+                  "SSH_HOST": "deploy.internal",
+                  "SSH_PORT": "2222",
+                  "SSH_USER": "deploy"
+                },
+                "lane": "ssh",
+                "secretRefs": {
+                  "SSH_PRIVATE_KEY": "HOST_SSH_KEY"
+                }
+              },
+              "rateLimitRpm": 0,
+              "requirePrincipal": false,
+              "store": {
+                "backend": "local",
+                "memory": {
+                  "backend": "file",
+                  "engine": "on"
+                },
+                "session": "auto"
+              }
+            },
+            "secretRefs": {
+              "apiKeyEnv": "MODEL_KEY"
+            }
+          }
+        ]
+      }
+    },
+    "warnings": [],
+    "metadata": {
+      "version": 7,
+      "updatedAt": "2026-10-03T00:00:00.000Z"
+    }
+  },
+  "wire": {
+    "derive": true
+  },
+  "localRoot": {
+    "derive": true,
+    "localVersion": 2617555914511015
+  }
+}

package/conformance/cases/c53-s784-lane-ssh-legal/input.json

@@ -0,0 +1,34 @@
+{
+  "meta": {
+    "version": 7,
+    "updatedAt": "2026-10-03T00:00:00.000Z"
+  },
+  "domains": {
+    "workers": {
+      "workers": [
+        {
+          "name": "w-ssh",
+          "secretRefs": {
+            "apiKeyEnv": "MODEL_KEY"
+          },
+          "runtime": {
+            "execution": {
+              "lane": "ssh",
+              "coords": {
+                "SSH_HOST": "deploy.internal",
+                "SSH_USER": "deploy",
+                "SSH_PORT": "2222"
+              },
+              "secretRefs": {
+                "SSH_PRIVATE_KEY": "HOST_SSH_KEY"
+              }
+            },
+            "store": {
+              "backend": "local"
+            }
+          }
+        }
+      ]
+    }
+  }
+}

package/conformance/cases/c53-s784-lane-ssh-legal/meta.json

@@ -0,0 +1,5 @@
+{
+  "contributor": "contract",
+  "claim": "7.0.0 M-R2:`ssh` 车道的一份合法 WorkerSpec(必需坐标 / 密钥齐、可选键在本车道栏内)三腿读出、零告警。打的是「写闸把合法车道块判成坏的」或「读腿把 runtime.execution / runtime.store 剥掉」两种读法分歧(6.4.0 两块都会被静默剥)。",
+  "firstRedOn": []
+}

package/conformance/cases/c54-s784-lane-adb-legal/expected.json

@@ -0,0 +1,102 @@
+{
+  "domains": {
+    "outcome": "effective",
+    "effective": {
+      "collab": {
+        "templates": []
+      },
+      "entitlement": {
+        "budgetGroups": [],
+        "groupBindings": [],
+        "subjects": [],
+        "tiers": []
+      },
+      "execution": {
+        "allowedLanes": [
+          "host"
+        ],
+        "required": false
+      },
+      "governance": {},
+      "hosts": {
+        "hosts": []
+      },
+      "limits": {},
+      "mcp": {
+        "servers": []
+      },
+      "models": {
+        "models": [],
+        "roles": {},
+        "tierGroups": []
+      },
+      "plugins": {
+        "plugins": []
+      },
+      "projects": {
+        "projects": {}
+      },
+      "prompts": {
+        "bindings": []
+      },
+      "rosters": {
+        "rosters": []
+      },
+      "runtime": {},
+      "scenarios": {
+        "scenarios": []
+      },
+      "skills": {
+        "skills": []
+      },
+      "systems": {
+        "systems": []
+      },
+      "workers": {
+        "workers": [
+          {
+            "coords": {},
+            "enabled": true,
+            "host": "default",
+            "image": "sema-server:latest",
+            "name": "w-adb",
+            "runtime": {
+              "execution": {
+                "coords": {
+                  "ADB_SERIAL": "emulator-5554"
+                },
+                "lane": "adb",
+                "secretRefs": {}
+              },
+              "rateLimitRpm": 0,
+              "requirePrincipal": false,
+              "store": {
+                "backend": "local",
+                "memory": {
+                  "backend": "file",
+                  "engine": "on"
+                },
+                "session": "auto"
+              }
+            },
+            "secretRefs": {
+              "apiKeyEnv": "MODEL_KEY"
+            }
+          }
+        ]
+      }
+    },
+    "warnings": [],
+    "metadata": {
+      "version": 7,
+      "updatedAt": "2026-10-03T00:00:00.000Z"
+    }
+  },
+  "wire": {
+    "derive": true
+  },
+  "localRoot": {
+    "derive": true,
+    "localVersion": 2617555914511015
+  }
+}

package/conformance/cases/c54-s784-lane-adb-legal/input.json

@@ -0,0 +1,29 @@
+{
+  "meta": {
+    "version": 7,
+    "updatedAt": "2026-10-03T00:00:00.000Z"
+  },
+  "domains": {
+    "workers": {
+      "workers": [
+        {
+          "name": "w-adb",
+          "secretRefs": {
+            "apiKeyEnv": "MODEL_KEY"
+          },
+          "runtime": {
+            "execution": {
+              "lane": "adb",
+              "coords": {
+                "ADB_SERIAL": "emulator-5554"
+              }
+            },
+            "store": {
+              "backend": "local"
+            }
+          }
+        }
+      ]
+    }
+  }
+}

package/conformance/cases/c54-s784-lane-adb-legal/meta.json

@@ -0,0 +1,5 @@
+{
+  "contributor": "contract",
+  "claim": "7.0.0 M-R2:`adb` 车道的一份合法 WorkerSpec(必需坐标 / 密钥齐、可选键在本车道栏内)三腿读出、零告警。打的是「写闸把合法车道块判成坏的」或「读腿把 runtime.execution / runtime.store 剥掉」两种读法分歧(6.4.0 两块都会被静默剥)。",
+  "firstRedOn": []
+}

package/conformance/cases/c55-s784-lane-local-docker-legal/expected.json

@@ -0,0 +1,103 @@
+{
+  "domains": {
+    "outcome": "effective",
+    "effective": {
+      "collab": {
+        "templates": []
+      },
+      "entitlement": {
+        "budgetGroups": [],
+        "groupBindings": [],
+        "subjects": [],
+        "tiers": []
+      },
+      "execution": {
+        "allowedLanes": [
+          "host"
+        ],
+        "required": false
+      },
+      "governance": {},
+      "hosts": {
+        "hosts": []
+      },
+      "limits": {},
+      "mcp": {
+        "servers": []
+      },
+      "models": {
+        "models": [],
+        "roles": {},
+        "tierGroups": []
+      },
+      "plugins": {
+        "plugins": []
+      },
+      "projects": {
+        "projects": {}
+      },
+      "prompts": {
+        "bindings": []
+      },
+      "rosters": {
+        "rosters": []
+      },
+      "runtime": {},
+      "scenarios": {
+        "scenarios": []
+      },
+      "skills": {
+        "skills": []
+      },
+      "systems": {
+        "systems": []
+      },
+      "workers": {
+        "workers": [
+          {
+            "coords": {},
+            "enabled": true,
+            "host": "default",
+            "image": "sema-server:latest",
+            "name": "w-local-docker",
+            "runtime": {
+              "execution": {
+                "coords": {
+                  "DOCKER_HOST": "tcp://docker.internal:2376",
+                  "DOCKER_IMAGE": "registry.internal/sandbox:1"
+                },
+                "lane": "local-docker",
+                "secretRefs": {}
+              },
+              "rateLimitRpm": 0,
+              "requirePrincipal": false,
+              "store": {
+                "backend": "local",
+                "memory": {
+                  "backend": "file",
+                  "engine": "on"
+                },
+                "session": "auto"
+              }
+            },
+            "secretRefs": {
+              "apiKeyEnv": "MODEL_KEY"
+            }
+          }
+        ]
+      }
+    },
+    "warnings": [],
+    "metadata": {
+      "version": 7,
+      "updatedAt": "2026-10-03T00:00:00.000Z"
+    }
+  },
+  "wire": {
+    "derive": true
+  },
+  "localRoot": {
+    "derive": true,
+    "localVersion": 2617555914511015
+  }
+}

package/conformance/cases/c55-s784-lane-local-docker-legal/input.json

@@ -0,0 +1,30 @@
+{
+  "meta": {
+    "version": 7,
+    "updatedAt": "2026-10-03T00:00:00.000Z"
+  },
+  "domains": {
+    "workers": {
+      "workers": [
+        {
+          "name": "w-local-docker",
+          "secretRefs": {
+            "apiKeyEnv": "MODEL_KEY"
+          },
+          "runtime": {
+            "execution": {
+              "lane": "local-docker",
+              "coords": {
+                "DOCKER_IMAGE": "registry.internal/sandbox:1",
+                "DOCKER_HOST": "tcp://docker.internal:2376"
+              }
+            },
+            "store": {
+              "backend": "local"
+            }
+          }
+        }
+      ]
+    }
+  }
+}

package/conformance/cases/c55-s784-lane-local-docker-legal/meta.json

@@ -0,0 +1,5 @@
+{
+  "contributor": "contract",
+  "claim": "7.0.0 M-R2:`local-docker` 车道的一份合法 WorkerSpec(必需坐标 / 密钥齐、可选键在本车道栏内)三腿读出、零告警。打的是「写闸把合法车道块判成坏的」或「读腿把 runtime.execution / runtime.store 剥掉」两种读法分歧(6.4.0 两块都会被静默剥)。",
+  "firstRedOn": []
+}

package/conformance/cases/c56-s784-lane-device-legal/expected.json

@@ -0,0 +1,109 @@
+{
+  "domains": {
+    "outcome": "effective",
+    "effective": {
+      "collab": {
+        "templates": []
+      },
+      "entitlement": {
+        "budgetGroups": [],
+        "groupBindings": [],
+        "subjects": [],
+        "tiers": []
+      },
+      "execution": {
+        "allowedLanes": [
+          "host"
+        ],
+        "required": false
+      },
+      "governance": {},
+      "hosts": {
+        "hosts": []
+      },
+      "limits": {},
+      "mcp": {
+        "servers": []
+      },
+      "models": {
+        "models": [],
+        "roles": {},
+        "tierGroups": []
+      },
+      "plugins": {
+        "plugins": []
+      },
+      "projects": {
+        "projects": {}
+      },
+      "prompts": {
+        "bindings": []
+      },
+      "rosters": {
+        "rosters": []
+      },
+      "runtime": {},
+      "scenarios": {
+        "scenarios": []
+      },
+      "skills": {
+        "skills": []
+      },
+      "systems": {
+        "systems": []
+      },
+      "workers": {
+        "workers": [
+          {
+            "coords": {},
+            "enabled": true,
+            "host": "default",
+            "image": "sema-server:latest",
+            "name": "w-device",
+            "runtime": {
+              "execution": {
+                "coords": {
+                  "DEVICE_SUPERSEDE": "deny"
+                },
+                "lane": "device",
+                "secretRefs": {}
+              },
+              "rateLimitRpm": 0,
+              "requirePrincipal": false,
+              "store": {
+                "backend": "pg",
+                "db": {
+                  "database": "sema",
+                  "host": "pg.internal",
+                  "port": 5432,
+                  "user": "svc"
+                },
+                "memory": {
+                  "backend": "file",
+                  "engine": "on"
+                },
+                "session": "auto"
+              }
+            },
+            "secretRefs": {
+              "apiKeyEnv": "MODEL_KEY",
+              "dbPasswordEnv": "HOST_DB_PW"
+            }
+          }
+        ]
+      }
+    },
+    "warnings": [],
+    "metadata": {
+      "version": 7,
+      "updatedAt": "2026-10-03T00:00:00.000Z"
+    }
+  },
+  "wire": {
+    "derive": true
+  },
+  "localRoot": {
+    "derive": true,
+    "localVersion": 2617555914511015
+  }
+}