@sema-agent/settings-schema 7.0.0 → 8.0.0

package/conformance/cases/c27-hosts-array-1025/expected.json

@@ -7238,6 +7238,11 @@
       "updatedAt": "2026-09-16T00:00:00.000Z"
     }
   },
+  "strictWrite": {
+    "outcome": "rejected",
+    "stage": "validate",
+    "why": "拒:hosts 1025 条,读腿截断到 1024(hosts-grandfathered,存量夹紧只活在读路径);严写按现行 schema 的数组上界拒。"
+  },
   "wire": {
     "derive": true
   },

package/conformance/cases/c28-large-document-over-1mb/expected.json

@@ -72,6 +72,20 @@
       "updatedAt": "2026-09-16T00:00:00.000Z"
     }
   },
+  "strictWrite": {
+    "outcome": "effective",
+    "effective": {
+      "scenarios": {
+        "scenarios": []
+      }
+    },
+    "warnings": [],
+    "metadata": {
+      "version": 7,
+      "updatedAt": "2026-09-16T00:00:00.000Z"
+    },
+    "why": "受理:>1MB 的超大未知值被 schema 剥掉(读腿只报键路径);严写同样剥、不铸告警,受理形等于读腿 scenarios 那一格。"
+  },
   "wire": {
     "derive": true
   },

package/conformance/cases/c29-salvage-then-domain-refine-fails/expected.json

@@ -67,6 +67,11 @@
       "updatedAt": "2026-09-16T00:00:00.000Z"
     }
   },
+  "strictWrite": {
+    "outcome": "rejected",
+    "stage": "validate",
+    "why": "拒:丢掉坏条目之后域级判据(重名)仍不过,读腿整域降级(domain-defaulted);严写在第一条坏条目上就不受理。"
+  },
   "wire": {
     "derive": true
   },

package/conformance/cases/c30-version-triple-a-first/expected.json

@@ -75,6 +75,35 @@
       "updatedAt": "2026-09-16T00:00:00.000Z"
     }
   },
+  "strictWrite": {
+    "outcome": "effective",
+    "effective": {
+      "models": {
+        "models": [
+          {
+            "api": "openai-completions",
+            "apiKeyEnv": "OPENAI_API_KEY",
+            "enabled": true,
+            "id": "v-a-id",
+            "name": "v-a",
+            "provider": "openai",
+            "quotaWeight": 1,
+            "reasoning": false,
+            "tier": "standard",
+            "vision": false
+          }
+        ],
+        "roles": {},
+        "tierGroups": []
+      }
+    },
+    "warnings": [],
+    "metadata": {
+      "version": 7,
+      "updatedAt": "2026-09-16T00:00:00.000Z"
+    },
+    "why": "受理:干净的 models 文档(本条打的是本地腿的内容寻址版本号);严写受理,受理形等于读腿 models 那一格,元数据 = harness 注入的那一份。"
+  },
   "wire": {
     "derive": true
   },

package/conformance/cases/c31-version-triple-b-changed/expected.json

@@ -75,6 +75,35 @@
       "updatedAt": "2026-09-16T00:00:00.000Z"
     }
   },
+  "strictWrite": {
+    "outcome": "effective",
+    "effective": {
+      "models": {
+        "models": [
+          {
+            "api": "openai-completions",
+            "apiKeyEnv": "OPENAI_API_KEY",
+            "enabled": true,
+            "id": "v-b-id",
+            "name": "v-b",
+            "provider": "openai",
+            "quotaWeight": 1,
+            "reasoning": false,
+            "tier": "standard",
+            "vision": false
+          }
+        ],
+        "roles": {},
+        "tierGroups": []
+      }
+    },
+    "warnings": [],
+    "metadata": {
+      "version": 7,
+      "updatedAt": "2026-09-16T00:00:00.000Z"
+    },
+    "why": "受理:干净的 models 文档(三连之「变」);严写受理,受理形等于读腿 models 那一格。"
+  },
   "wire": {
     "derive": true
   },

package/conformance/cases/c32-version-triple-a-restored/expected.json

@@ -75,6 +75,35 @@
       "updatedAt": "2026-09-16T00:00:00.000Z"
     }
   },
+  "strictWrite": {
+    "outcome": "effective",
+    "effective": {
+      "models": {
+        "models": [
+          {
+            "api": "openai-completions",
+            "apiKeyEnv": "OPENAI_API_KEY",
+            "enabled": true,
+            "id": "v-a-id",
+            "name": "v-a",
+            "provider": "openai",
+            "quotaWeight": 1,
+            "reasoning": false,
+            "tier": "standard",
+            "vision": false
+          }
+        ],
+        "roles": {},
+        "tierGroups": []
+      }
+    },
+    "warnings": [],
+    "metadata": {
+      "version": 7,
+      "updatedAt": "2026-09-16T00:00:00.000Z"
+    },
+    "why": "受理:与 c30 逐字节相同的文档(三连之「还原」);严写受理,受理形与 c30 相同。"
+  },
   "wire": {
     "derive": true
   },

package/conformance/cases/c33-limits-nested-carried-key/expected.json

@@ -81,6 +81,23 @@
       "updatedAt": "2026-09-16T00:00:00.000Z"
     }
   },
+  "strictWrite": {
+    "outcome": "effective",
+    "effective": {
+      "limits": {
+        "infraCostRates": {
+          "zzzNestedTypo": 7
+        },
+        "maxConcurrentRuns": 3
+      }
+    },
+    "warnings": [],
+    "metadata": {
+      "version": 7,
+      "updatedAt": "2026-09-16T00:00:00.000Z"
+    },
+    "why": "受理:limits 嵌套的未知键原样承运(读腿报 unknown-keys-carried 全段坐标);严写同样承运,告警面为空。"
+  },
   "wire": {
     "derive": true
   },

package/conformance/cases/c34-skills-content-vs-manifest/expected.json

@@ -83,6 +83,29 @@
       "updatedAt": "2026-09-16T00:00:00.000Z"
     }
   },
+  "strictWrite": {
+    "outcome": "effective",
+    "effective": {
+      "skills": {
+        "skills": [
+          {
+            "content": "# hello",
+            "description": "d",
+            "enabled": true,
+            "name": "sk1",
+            "rosters": [],
+            "scenarios": []
+          }
+        ]
+      }
+    },
+    "warnings": [],
+    "metadata": {
+      "version": 7,
+      "updatedAt": "2026-09-16T00:00:00.000Z"
+    },
+    "why": "受理:严写收的是域形(带 content,不是 wire 的 manifest 形);条目里拼错的 `zzzTypo` 被 schema 剥掉(读腿报 unknown-keys-dropped),严写同样剥、不铸告警,受理形等于读腿 skills 那一格。"
+  },
   "wire": {
     "outcome": "effective",
     "effective": {

package/conformance/cases/c35-portable-domain-file-is-null/expected.json

@@ -67,6 +67,11 @@
       "updatedAt": "2026-09-16T00:00:00.000Z"
     }
   },
+  "strictWrite": {
+    "outcome": "rejected",
+    "stage": "validate",
+    "why": "拒:mcp 文档是 null,读腿整域降级成默认(domain-defaulted);写入席不把 null 当空域存下。"
+  },
   "wire": {
     "derive": true
   },

package/conformance/cases/c36-skills-entry-without-content/expected.json

@@ -71,6 +71,29 @@
       "updatedAt": "2026-09-16T00:00:00.000Z"
     }
   },
+  "strictWrite": {
+    "outcome": "effective",
+    "effective": {
+      "skills": {
+        "skills": [
+          {
+            "content": "",
+            "description": "d",
+            "enabled": true,
+            "name": "sk-no-content",
+            "rosters": [],
+            "scenarios": []
+          }
+        ]
+      }
+    },
+    "warnings": [],
+    "metadata": {
+      "version": 7,
+      "updatedAt": "2026-09-16T00:00:00.000Z"
+    },
+    "why": "受理:skills 条目不写 content,域形把它补成空串(合法条目),读腿零告警;严写受理,受理形等于读腿 skills 那一格(wire 腿的 manifest 判坏与严写无关)。"
+  },
   "wire": {
     "outcome": "effective",
     "effective": {

package/conformance/cases/c37-skills-field-null/expected.json

@@ -67,6 +67,11 @@
       "updatedAt": "2026-09-16T00:00:00.000Z"
     }
   },
+  "strictWrite": {
+    "outcome": "rejected",
+    "stage": "validate",
+    "why": "拒:skills 文档是 null,读腿整域降级成默认(domain-defaulted);写入席不把 null 当空域存下。"
+  },
   "wire": {
     "outcome": "effective",
     "effective": {

package/conformance/cases/c38-remote-exec-is-a-non-domain-file/expected.json

@@ -62,6 +62,11 @@
       "updatedAt": "2026-09-16T00:00:00.000Z"
     }
   },
+  "strictWrite": {
+    "outcome": "rejected",
+    "stage": "validate",
+    "why": "拒:`remote-exec` 不是域名 —— 它是执行后端文件,有自己的写入口与校验(writeRemoteExec / validateRemoteExec),不走域写受理;本地腿把它归为专用文件不报,严写拒。"
+  },
   "wire": {
     "derive": true
   },

package/conformance/cases/c39-hidden-file-in-config-d/expected.json

@@ -62,6 +62,11 @@
       "updatedAt": "2026-09-16T00:00:00.000Z"
     }
   },
+  "strictWrite": {
+    "outcome": "rejected",
+    "stage": "validate",
+    "why": "拒:`.hidden` 不是域名 —— 本地腿把隐藏文件当扫描忽略,那是目录扫描的规矩;写入席收到一个不是域的键就是拒。"
+  },
   "wire": {
     "derive": true
   },

package/conformance/cases/c40-s712-identity-only-what-reads-out/expected.json

@@ -156,6 +156,11 @@
       "updatedAt": "2026-09-25T00:00:00.000Z"
     }
   },
+  "strictWrite": {
+    "outcome": "rejected",
+    "stage": "validate",
+    "why": "拒:models 第 2 条名字形不合法、apiKeyEnv 不是变量名,读腿逐条抢救(entry-dropped + 只带可披露的身份);严写不删条目 ⇒ 整次不受理。"
+  },
   "wire": {
     "derive": true
   },

package/conformance/cases/c41-s792-encoded-pem-identity/expected.json

@@ -156,6 +156,11 @@
       "updatedAt": "2026-09-27T00:00:00.000Z"
     }
   },
+  "strictWrite": {
+    "outcome": "rejected",
+    "stage": "validate",
+    "why": "拒:models 里两条的 apiKeyEnv 是编码过的私钥形(不是变量名),读腿逐条丢(entry-dropped,身份不可披露);严写 ⇒ 整次不受理。"
+  },
   "wire": {
     "derive": true
   },

package/conformance/cases/c42-s792-unknown-key-secret-redacted/expected.json

@@ -110,6 +110,39 @@
       "updatedAt": "2026-09-27T00:00:00.000Z"
     }
   },
+  "strictWrite": {
+    "outcome": "effective",
+    "effective": {
+      "limits": {
+        "maxToolCallz": 3,
+        "sk-live-FAKEC42CARRIEDKEY000000000": 5
+      },
+      "models": {
+        "models": [
+          {
+            "api": "openai-completions",
+            "apiKeyEnv": "OPENAI_API_KEY",
+            "enabled": true,
+            "id": "keep-id",
+            "name": "keep",
+            "provider": "openai",
+            "quotaWeight": 1,
+            "reasoning": false,
+            "tier": "standard",
+            "vision": false
+          }
+        ],
+        "roles": {},
+        "tierGroups": []
+      }
+    },
+    "warnings": [],
+    "metadata": {
+      "version": 13,
+      "updatedAt": "2026-09-27T00:00:00.000Z"
+    },
+    "why": "受理:models 的密钥形未知键被剥(读腿报 unknown-keys-dropped,坐标脱敏)、limits 的未知键承运(unknown-keys-carried);严写同样剥 / 承运、不铸告警,受理形等于读腿两格。"
+  },
   "wire": {
     "derive": true
   },

package/conformance/cases/c43-s792-form-and-deep-encoded-pem/expected.json

@@ -127,6 +127,11 @@
       "updatedAt": "2026-09-27T00:00:00.000Z"
     }
   },
+  "strictWrite": {
+    "outcome": "rejected",
+    "stage": "validate",
+    "why": "拒:models 里两条的 apiKeyEnv 是表单编码 / 深层编码的私钥形,读腿逐条丢(entry-dropped);严写 ⇒ 整次不受理。"
+  },
   "wire": {
     "derive": true
   },

package/conformance/cases/c44-s792-utf8-escape-glued-token/expected.json

@@ -105,6 +105,11 @@
       "updatedAt": "2026-09-27T00:00:00.000Z"
     }
   },
+  "strictWrite": {
+    "outcome": "rejected",
+    "stage": "validate",
+    "why": "拒:models.roles 里有编码粘连令牌形的坏键,读腿逐条丢(entry-dropped)并剥未知键;严写 ⇒ 整次不受理。"
+  },
   "wire": {
     "derive": true
   },

package/conformance/cases/c45-s792-identity-bounds-and-decode-depth/expected.json

@@ -175,6 +175,11 @@
       "updatedAt": "2026-09-27T00:00:00.000Z"
     }
   },
+  "strictWrite": {
+    "outcome": "rejected",
+    "stage": "validate",
+    "why": "拒:三个域里都有读腿要抢救的东西 —— models / mcp 逐条丢(entry-dropped)、hosts 超长名夹紧(hosts-grandfathered);严写在任何一份不受理时整次不受理。"
+  },
   "wire": {
     "derive": true
   },

package/conformance/cases/c46-s811-host-name-url-userinfo-characterization/expected.json

@@ -78,6 +78,11 @@
       "updatedAt": "2026-09-27T00:00:00.000Z"
     }
   },
+  "strictWrite": {
+    "outcome": "rejected",
+    "stage": "validate",
+    "why": "拒:hosts 第 2 条名字是一条带 userinfo 的 URL(超长且形不合法),读腿夹紧剔除(hosts-grandfathered);严写按现行 schema 拒。"
+  },
   "wire": {
     "derive": true
   },

package/conformance/cases/c47-s811-roles-key-url-userinfo-characterization/expected.json

@@ -88,6 +88,11 @@
       "updatedAt": "2026-09-27T00:00:00.000Z"
     }
   },
+  "strictWrite": {
+    "outcome": "rejected",
+    "stage": "validate",
+    "why": "拒:models.roles 里有一个带 userinfo 的 URL 形坏键,读腿逐条丢(entry-dropped);严写 ⇒ 整次不受理(拒因文案的脱敏面与本格无关:kit 不比对 diagnostics)。"
+  },
   "wire": {
     "derive": true
   },

package/conformance/cases/c48-s935-model-headers-transported/expected.json

@@ -105,6 +105,65 @@
       "updatedAt": "2026-10-01T00:00:00.000Z"
     }
   },
+  "strictWrite": {
+    "outcome": "effective",
+    "effective": {
+      "models": {
+        "models": [
+          {
+            "api": "anthropic-messages",
+            "apiKeyEnv": "ANTHROPIC_API_KEY",
+            "enabled": true,
+            "headers": {
+              "anthropic-beta": "context-1m-2025-08-07"
+            },
+            "id": "claude-x",
+            "name": "claude-1m",
+            "provider": "anthropic",
+            "quotaWeight": 1,
+            "reasoning": false,
+            "tier": "standard",
+            "vision": false
+          },
+          {
+            "api": "openai-completions",
+            "apiKeyEnv": "OPENAI_API_KEY",
+            "enabled": true,
+            "headers": [
+              "Anthropic-Beta: not-a-header-bag"
+            ],
+            "id": "gw-id",
+            "name": "gw",
+            "provider": "openai",
+            "quotaWeight": 1,
+            "reasoning": false,
+            "tier": "standard",
+            "vision": false
+          },
+          {
+            "api": "openai-completions",
+            "apiKeyEnv": "OPENAI_API_KEY",
+            "enabled": true,
+            "id": "plain-id",
+            "name": "plain",
+            "provider": "openai",
+            "quotaWeight": 1,
+            "reasoning": false,
+            "tier": "standard",
+            "vision": false
+          }
+        ],
+        "roles": {},
+        "tierGroups": []
+      }
+    },
+    "warnings": [],
+    "metadata": {
+      "version": 7,
+      "updatedAt": "2026-10-01T00:00:00.000Z"
+    },
+    "why": "受理:models[].headers 是解析透明键,读腿逐字交出、零告警;严写同样逐字收下,受理形等于读腿 models 那一格。"
+  },
   "wire": {
     "derive": true
   },

package/conformance/cases/c49-s935-model-headers-secret-entry-dropped/expected.json

@@ -88,6 +88,11 @@
       "updatedAt": "2026-10-01T00:00:00.000Z"
     }
   },
+  "strictWrite": {
+    "outcome": "rejected",
+    "stage": "validate",
+    "why": "拒:models[0].headers 里粘了密钥形值,自由形安全判据拒,读腿逐条丢(entry-dropped);严写 ⇒ 整次不受理。"
+  },
   "wire": {
     "derive": true
   },

package/conformance/cases/c50-s784-lane-host-legal/expected.json

@@ -92,6 +92,50 @@
       "updatedAt": "2026-10-03T00:00:00.000Z"
     }
   },
+  "strictWrite": {
+    "outcome": "effective",
+    "effective": {
+      "workers": {
+        "workers": [
+          {
+            "coords": {},
+            "enabled": true,
+            "host": "default",
+            "image": "sema-server:latest",
+            "name": "w-host",
+            "runtime": {
+              "execution": {
+                "coords": {
+                  "HOST_WORKSPACE_BASE": "/work"
+                },
+                "lane": "host",
+                "secretRefs": {}
+              },
+              "rateLimitRpm": 0,
+              "requirePrincipal": false,
+              "store": {
+                "backend": "local",
+                "memory": {
+                  "backend": "file",
+                  "engine": "on"
+                },
+                "session": "auto"
+              }
+            },
+            "secretRefs": {
+              "apiKeyEnv": "MODEL_KEY"
+            }
+          }
+        ]
+      }
+    },
+    "warnings": [],
+    "metadata": {
+      "version": 7,
+      "updatedAt": "2026-10-03T00:00:00.000Z"
+    },
+    "why": "受理:合法的 host 车道 worker,读腿零告警;严写受理(workers 写闸 = WorkerSpec 本身),受理形等于读腿 workers 那一格。"
+  },
   "wire": {
     "derive": true
   },

package/conformance/cases/c51-s784-lane-e2b-legal/expected.json

@@ -94,6 +94,52 @@
       "updatedAt": "2026-10-03T00:00:00.000Z"
     }
   },
+  "strictWrite": {
+    "outcome": "effective",
+    "effective": {
+      "workers": {
+        "workers": [
+          {
+            "coords": {},
+            "enabled": true,
+            "host": "default",
+            "image": "sema-server:latest",
+            "name": "w-e2b",
+            "runtime": {
+              "execution": {
+                "coords": {
+                  "E2B_TEMPLATE": "base"
+                },
+                "lane": "e2b",
+                "secretRefs": {
+                  "E2B_API_KEY": "HOST_E2B_KEY"
+                }
+              },
+              "rateLimitRpm": 0,
+              "requirePrincipal": false,
+              "store": {
+                "backend": "local",
+                "memory": {
+                  "backend": "file",
+                  "engine": "on"
+                },
+                "session": "auto"
+              }
+            },
+            "secretRefs": {
+              "apiKeyEnv": "MODEL_KEY"
+            }
+          }
+        ]
+      }
+    },
+    "warnings": [],
+    "metadata": {
+      "version": 7,
+      "updatedAt": "2026-10-03T00:00:00.000Z"
+    },
+    "why": "受理:合法的 e2b 车道 worker;严写受理,受理形等于读腿 workers 那一格。"
+  },
   "wire": {
     "derive": true
   },

package/conformance/cases/c52-s784-lane-k8s-legal/expected.json

@@ -96,6 +96,54 @@
       "updatedAt": "2026-10-03T00:00:00.000Z"
     }
   },
+  "strictWrite": {
+    "outcome": "effective",
+    "effective": {
+      "workers": {
+        "workers": [
+          {
+            "coords": {},
+            "enabled": true,
+            "host": "default",
+            "image": "sema-server:latest",
+            "name": "w-k8s",
+            "runtime": {
+              "execution": {
+                "coords": {
+                  "K8S_NAMESPACE": "sandboxes",
+                  "K8S_RUNTIME_CLASS": "",
+                  "K8S_SANDBOX_IMAGE": "registry.internal/sandbox@sha256:abc"
+                },
+                "lane": "k8s",
+                "secretRefs": {
+                  "K8S_TOKEN": "HOST_K8S_TOKEN"
+                }
+              },
+              "rateLimitRpm": 0,
+              "requirePrincipal": false,
+              "store": {
+                "backend": "local",
+                "memory": {
+                  "backend": "file",
+                  "engine": "on"
+                },
+                "session": "auto"
+              }
+            },
+            "secretRefs": {
+              "apiKeyEnv": "MODEL_KEY"
+            }
+          }
+        ]
+      }
+    },
+    "warnings": [],
+    "metadata": {
+      "version": 7,
+      "updatedAt": "2026-10-03T00:00:00.000Z"
+    },
+    "why": "受理:合法的 k8s 车道 worker;严写受理,受理形等于读腿 workers 那一格。"
+  },
   "wire": {
     "derive": true
   },