@sema-agent/settings-schema 7.0.0 → 8.0.0

package/conformance/cases/c53-s784-lane-ssh-legal/expected.json

@@ -96,6 +96,54 @@
       "updatedAt": "2026-10-03T00:00:00.000Z"
     }
   },
+  "strictWrite": {
+    "outcome": "effective",
+    "effective": {
+      "workers": {
+        "workers": [
+          {
+            "coords": {},
+            "enabled": true,
+            "host": "default",
+            "image": "sema-server:latest",
+            "name": "w-ssh",
+            "runtime": {
+              "execution": {
+                "coords": {
+                  "SSH_HOST": "deploy.internal",
+                  "SSH_PORT": "2222",
+                  "SSH_USER": "deploy"
+                },
+                "lane": "ssh",
+                "secretRefs": {
+                  "SSH_PRIVATE_KEY": "HOST_SSH_KEY"
+                }
+              },
+              "rateLimitRpm": 0,
+              "requirePrincipal": false,
+              "store": {
+                "backend": "local",
+                "memory": {
+                  "backend": "file",
+                  "engine": "on"
+                },
+                "session": "auto"
+              }
+            },
+            "secretRefs": {
+              "apiKeyEnv": "MODEL_KEY"
+            }
+          }
+        ]
+      }
+    },
+    "warnings": [],
+    "metadata": {
+      "version": 7,
+      "updatedAt": "2026-10-03T00:00:00.000Z"
+    },
+    "why": "受理:合法的 ssh 车道 worker;严写受理,受理形等于读腿 workers 那一格。"
+  },
   "wire": {
     "derive": true
   },

package/conformance/cases/c54-s784-lane-adb-legal/expected.json

@@ -92,6 +92,50 @@
       "updatedAt": "2026-10-03T00:00:00.000Z"
     }
   },
+  "strictWrite": {
+    "outcome": "effective",
+    "effective": {
+      "workers": {
+        "workers": [
+          {
+            "coords": {},
+            "enabled": true,
+            "host": "default",
+            "image": "sema-server:latest",
+            "name": "w-adb",
+            "runtime": {
+              "execution": {
+                "coords": {
+                  "ADB_SERIAL": "emulator-5554"
+                },
+                "lane": "adb",
+                "secretRefs": {}
+              },
+              "rateLimitRpm": 0,
+              "requirePrincipal": false,
+              "store": {
+                "backend": "local",
+                "memory": {
+                  "backend": "file",
+                  "engine": "on"
+                },
+                "session": "auto"
+              }
+            },
+            "secretRefs": {
+              "apiKeyEnv": "MODEL_KEY"
+            }
+          }
+        ]
+      }
+    },
+    "warnings": [],
+    "metadata": {
+      "version": 7,
+      "updatedAt": "2026-10-03T00:00:00.000Z"
+    },
+    "why": "受理:合法的 adb 车道 worker;严写受理,受理形等于读腿 workers 那一格。"
+  },
   "wire": {
     "derive": true
   },

package/conformance/cases/c55-s784-lane-local-docker-legal/expected.json

@@ -93,6 +93,51 @@
       "updatedAt": "2026-10-03T00:00:00.000Z"
     }
   },
+  "strictWrite": {
+    "outcome": "effective",
+    "effective": {
+      "workers": {
+        "workers": [
+          {
+            "coords": {},
+            "enabled": true,
+            "host": "default",
+            "image": "sema-server:latest",
+            "name": "w-local-docker",
+            "runtime": {
+              "execution": {
+                "coords": {
+                  "DOCKER_HOST": "tcp://docker.internal:2376",
+                  "DOCKER_IMAGE": "registry.internal/sandbox:1"
+                },
+                "lane": "local-docker",
+                "secretRefs": {}
+              },
+              "rateLimitRpm": 0,
+              "requirePrincipal": false,
+              "store": {
+                "backend": "local",
+                "memory": {
+                  "backend": "file",
+                  "engine": "on"
+                },
+                "session": "auto"
+              }
+            },
+            "secretRefs": {
+              "apiKeyEnv": "MODEL_KEY"
+            }
+          }
+        ]
+      }
+    },
+    "warnings": [],
+    "metadata": {
+      "version": 7,
+      "updatedAt": "2026-10-03T00:00:00.000Z"
+    },
+    "why": "受理:合法的 local-docker 车道 worker;严写受理,受理形等于读腿 workers 那一格。"
+  },
   "wire": {
     "derive": true
   },

package/conformance/cases/c56-s784-lane-device-legal/expected.json

@@ -99,6 +99,57 @@
       "updatedAt": "2026-10-03T00:00:00.000Z"
     }
   },
+  "strictWrite": {
+    "outcome": "effective",
+    "effective": {
+      "workers": {
+        "workers": [
+          {
+            "coords": {},
+            "enabled": true,
+            "host": "default",
+            "image": "sema-server:latest",
+            "name": "w-device",
+            "runtime": {
+              "execution": {
+                "coords": {
+                  "DEVICE_SUPERSEDE": "deny"
+                },
+                "lane": "device",
+                "secretRefs": {}
+              },
+              "rateLimitRpm": 0,
+              "requirePrincipal": false,
+              "store": {
+                "backend": "pg",
+                "db": {
+                  "database": "sema",
+                  "host": "pg.internal",
+                  "port": 5432,
+                  "user": "svc"
+                },
+                "memory": {
+                  "backend": "file",
+                  "engine": "on"
+                },
+                "session": "auto"
+              }
+            },
+            "secretRefs": {
+              "apiKeyEnv": "MODEL_KEY",
+              "dbPasswordEnv": "HOST_DB_PW"
+            }
+          }
+        ]
+      }
+    },
+    "warnings": [],
+    "metadata": {
+      "version": 7,
+      "updatedAt": "2026-10-03T00:00:00.000Z"
+    },
+    "why": "受理:合法的 device 车道 worker(配 SQL 店);严写受理,受理形等于读腿 workers 那一格。"
+  },
   "wire": {
     "derive": true
   },

package/conformance/cases/c57-s784-g1-enabled-no-lane/expected.json

@@ -4,6 +4,11 @@
     "stage": "validate",
     "why": "7.0.0 写闸(WorkerSpec)拒 —— workers 是 gate 域,一只坏 worker 整域拒,不逐条容错"
   },
+  "strictWrite": {
+    "outcome": "rejected",
+    "stage": "validate",
+    "why": "拒:enabled 的 worker 没声明执行车道,workers 是 gate 域,读腿本就整域拒;严写同一份文档同样过不了写闸。"
+  },
   "wire": {
     "outcome": "rejected",
     "stage": "validate",

package/conformance/cases/c58-s784-g2-multitenant-host/expected.json

@@ -4,6 +4,11 @@
     "stage": "validate",
     "why": "7.0.0 写闸(WorkerSpec)拒 —— workers 是 gate 域,一只坏 worker 整域拒,不逐条容错"
   },
+  "strictWrite": {
+    "outcome": "rejected",
+    "stage": "validate",
+    "why": "拒:多租户 worker 落在不分租户的 host 车道,读腿整域拒;严写同样拒。"
+  },
   "wire": {
     "outcome": "rejected",
     "stage": "validate",

package/conformance/cases/c59-s784-g3-k8s-missing-image/expected.json

@@ -4,6 +4,11 @@
     "stage": "validate",
     "why": "7.0.0 写闸(WorkerSpec)拒 —— workers 是 gate 域,一只坏 worker 整域拒,不逐条容错"
   },
+  "strictWrite": {
+    "outcome": "rejected",
+    "stage": "validate",
+    "why": "拒:k8s 车道缺必需坐标 K8S_SANDBOX_IMAGE,读腿整域拒;严写同样拒。"
+  },
   "wire": {
     "outcome": "rejected",
     "stage": "validate",

package/conformance/cases/c60-s784-g3-e2b-missing-key/expected.json

@@ -4,6 +4,11 @@
     "stage": "validate",
     "why": "7.0.0 写闸(WorkerSpec)拒 —— workers 是 gate 域,一只坏 worker 整域拒,不逐条容错"
   },
+  "strictWrite": {
+    "outcome": "rejected",
+    "stage": "validate",
+    "why": "拒:e2b 车道缺必需密钥引用 E2B_API_KEY,读腿整域拒;严写同样拒。"
+  },
   "wire": {
     "outcome": "rejected",
     "stage": "validate",

package/conformance/cases/c61-s784-g3-other-lane-key/expected.json

@@ -4,6 +4,11 @@
     "stage": "validate",
     "why": "7.0.0 写闸(WorkerSpec)拒 —— workers 是 gate 域,一只坏 worker 整域拒,不逐条容错"
   },
+  "strictWrite": {
+    "outcome": "rejected",
+    "stage": "validate",
+    "why": "拒:k8s 车道上写了属于 e2b 车道的坐标,读腿整域拒;严写同样拒。"
+  },
   "wire": {
     "outcome": "rejected",
     "stage": "validate",

package/conformance/cases/c62-s784-g7a-session-tidb/expected.json

@@ -4,6 +4,11 @@
     "stage": "validate",
     "why": "7.0.0 写闸(WorkerSpec)拒 —— workers 是 gate 域,一只坏 worker 整域拒,不逐条容错"
   },
+  "strictWrite": {
+    "outcome": "rejected",
+    "stage": "validate",
+    "why": "拒:store.session 写了不在闭集里的词,读腿整域拒;严写同样拒。"
+  },
   "wire": {
     "outcome": "rejected",
     "stage": "validate",

package/conformance/cases/c63-s784-host-two-replicas/expected.json

@@ -4,6 +4,11 @@
     "stage": "validate",
     "why": "7.0.0 写闸(WorkerSpec)拒 —— workers 是 gate 域,一只坏 worker 整域拒,不逐条容错"
   },
+  "strictWrite": {
+    "outcome": "rejected",
+    "stage": "validate",
+    "why": "拒:host 车道两副本,读腿整域拒;严写同样拒。"
+  },
   "wire": {
     "outcome": "rejected",
     "stage": "validate",

package/conformance/cases/c64-s784-multitenant-local-store/expected.json

@@ -4,6 +4,11 @@
     "stage": "validate",
     "why": "7.0.0 写闸(WorkerSpec)拒 —— workers 是 gate 域,一只坏 worker 整域拒,不逐条容错"
   },
+  "strictWrite": {
+    "outcome": "rejected",
+    "stage": "validate",
+    "why": "拒:多租户 worker 配非 SQL 店,读腿整域拒;严写同样拒。"
+  },
   "wire": {
     "outcome": "rejected",
     "stage": "validate",

package/conformance/cases/c65-s784-pg-without-db/expected.json

@@ -4,6 +4,11 @@
     "stage": "validate",
     "why": "7.0.0 写闸(WorkerSpec)拒 —— workers 是 gate 域,一只坏 worker 整域拒,不逐条容错"
   },
+  "strictWrite": {
+    "outcome": "rejected",
+    "stage": "validate",
+    "why": "拒:pg 店缺 store.db 坐标,读腿整域拒;严写同样拒。"
+  },
   "wire": {
     "outcome": "rejected",
     "stage": "validate",

package/conformance/cases/c66-s784-memory-backend-mismatch/expected.json

@@ -4,6 +4,11 @@
     "stage": "validate",
     "why": "7.0.0 写闸(WorkerSpec)拒 —— workers 是 gate 域,一只坏 worker 整域拒,不逐条容错"
   },
+  "strictWrite": {
+    "outcome": "rejected",
+    "stage": "validate",
+    "why": "拒:记忆后端与店不匹配,读腿整域拒;严写同样拒。"
+  },
   "wire": {
     "outcome": "rejected",
     "stage": "validate",

package/conformance/cases/c67-s784-retired-field-loud/expected.json

@@ -4,6 +4,11 @@
     "stage": "validate",
     "why": "7.0.0 写闸(WorkerSpec)拒 —— workers 是 gate 域,一只坏 worker 整域拒,不逐条容错"
   },
+  "strictWrite": {
+    "outcome": "rejected",
+    "stage": "validate",
+    "why": "拒:写了 7.0.0 删除的旧字段 runtime.sessionBackend(读到即拒、拒因指路迁移),读腿整域拒;严写同样拒 —— 写入席同样不静默剥掉它。"
+  },
   "wire": {
     "outcome": "rejected",
     "stage": "validate",

package/conformance/cases/c67-s784-retired-field-loud/meta.json

@@ -1,5 +1,5 @@
 {
   "contributor": "contract",
-  "claim": "7.0.0 删除项读到即**响亮拒**(runtime.sessionBackend,哪怕是停用的 worker),拒因指路 migrateWorkersDomain / settings-schema migrate-workers —— 不被 zod 静默剥成「什么都没声明」。",
+  "claim": "7.0.0 删除项读到即**响亮拒**(runtime.sessionBackend,哪怕是停用的 worker),拒因指路 migrateWorkersDomain / npx @sema-agent/settings-schema migrate-workers —— 不被 zod 静默剥成「什么都没声明」。",
   "firstRedOn": []
 }

package/conformance/cases/c68-s784-device-local-store/expected.json

@@ -4,6 +4,11 @@
     "stage": "validate",
     "why": "7.0.0 写闸(WorkerSpec)拒 —— workers 是 gate 域,一只坏 worker 整域拒,不逐条容错"
   },
+  "strictWrite": {
+    "outcome": "rejected",
+    "stage": "validate",
+    "why": "拒:device 车道配非 SQL 店,读腿整域拒;严写同样拒。"
+  },
   "wire": {
     "outcome": "rejected",
     "stage": "validate",

package/conformance/cases/cc01-mcp-toolfaces-non-object/expected.json

@@ -102,6 +102,60 @@
       "updatedAt": "2026-09-16T00:00:00.000Z"
     }
   },
+  "strictWrite": {
+    "outcome": "effective",
+    "effective": {
+      "mcp": {
+        "servers": [
+          {
+            "elicitation": false,
+            "enabled": true,
+            "name": "s-null",
+            "rosters": [],
+            "scenarios": [],
+            "toolFaces": null,
+            "transport": {
+              "kind": "http",
+              "url": "https://a.example"
+            }
+          },
+          {
+            "elicitation": false,
+            "enabled": true,
+            "name": "s-array",
+            "rosters": [],
+            "scenarios": [],
+            "toolFaces": [
+              1,
+              2
+            ],
+            "transport": {
+              "kind": "http",
+              "url": "https://b.example"
+            }
+          },
+          {
+            "elicitation": false,
+            "enabled": true,
+            "name": "s-string",
+            "rosters": [],
+            "scenarios": [],
+            "toolFaces": "not-an-object",
+            "transport": {
+              "kind": "http",
+              "url": "https://c.example"
+            }
+          }
+        ]
+      }
+    },
+    "warnings": [],
+    "metadata": {
+      "version": 7,
+      "updatedAt": "2026-09-16T00:00:00.000Z"
+    },
+    "why": "受理:mcp[].toolFaces 是解析透明键,数组 / null / 串三形读腿都逐字透传;严写同样逐字收下,受理形等于读腿 mcp 那一格。"
+  },
   "wire": {
     "derive": true
   },

package/conformance/cases/cc02-mcp-source-key-is-transported/expected.json

@@ -75,6 +75,33 @@
       "updatedAt": "2026-09-16T00:00:00.000Z"
     }
   },
+  "strictWrite": {
+    "outcome": "effective",
+    "effective": {
+      "mcp": {
+        "servers": [
+          {
+            "elicitation": false,
+            "enabled": true,
+            "name": "s1",
+            "rosters": [],
+            "scenarios": [],
+            "source": "plugin",
+            "transport": {
+              "kind": "http",
+              "url": "https://x.example"
+            }
+          }
+        ]
+      }
+    },
+    "warnings": [],
+    "metadata": {
+      "version": 7,
+      "updatedAt": "2026-09-16T00:00:00.000Z"
+    },
+    "why": "受理:mcp[].source 是解析透明键,读腿逐字透传;严写同样逐字收下,受理形等于读腿 mcp 那一格。"
+  },
   "wire": {
     "derive": true
   },

package/conformance/cases/cc03-model-compat-unknown-subkey/expected.json

@@ -79,6 +79,39 @@
       "updatedAt": "2026-09-16T00:00:00.000Z"
     }
   },
+  "strictWrite": {
+    "outcome": "effective",
+    "effective": {
+      "models": {
+        "models": [
+          {
+            "api": "openai-completions",
+            "apiKeyEnv": "OPENAI_API_KEY",
+            "compat": {
+              "thinkingFormat": "anthropic",
+              "zzz": 1
+            },
+            "enabled": true,
+            "id": "m0-id",
+            "name": "m0",
+            "provider": "openai",
+            "quotaWeight": 1,
+            "reasoning": false,
+            "tier": "standard",
+            "vision": false
+          }
+        ],
+        "roles": {},
+        "tierGroups": []
+      }
+    },
+    "warnings": [],
+    "metadata": {
+      "version": 7,
+      "updatedAt": "2026-09-16T00:00:00.000Z"
+    },
+    "why": "受理:models[].compat 的未知子键同形保留(自由形 + 安全判据);严写同样保留,受理形等于读腿 models 那一格。"
+  },
   "wire": {
     "derive": true
   },

package/conformance/cases/cli01-model-name-nfc-vs-nfd/expected.json

@@ -92,6 +92,11 @@
       "updatedAt": "2026-09-16T00:00:00.000Z"
     }
   },
+  "strictWrite": {
+    "outcome": "rejected",
+    "stage": "validate",
+    "why": "拒:两条模型名带组合字符(不在名字字符集里),读腿逐条丢(entry-dropped);严写 ⇒ 整次不受理。"
+  },
   "wire": {
     "derive": true
   },

package/conformance/cases/cli02-control-and-zero-width-chars/expected.json

@@ -105,6 +105,11 @@
       "updatedAt": "2026-09-16T00:00:00.000Z"
     }
   },
+  "strictWrite": {
+    "outcome": "rejected",
+    "stage": "validate",
+    "why": "拒:models 里两条名字带控制 / 零宽字符,读腿逐条丢(entry-dropped);mcp 那一份干净,但严写在任何一份不受理时整次不受理。"
+  },
   "wire": {
     "derive": true
   },

package/conformance/cases/cli03-credential-pasted-into-unknown-key/expected.json

@@ -82,6 +82,28 @@
       "updatedAt": "2026-09-16T00:00:00.000Z"
     }
   },
+  "strictWrite": {
+    "outcome": "effective",
+    "effective": {
+      "hosts": {
+        "hosts": [
+          {
+            "approved": false,
+            "drain": false,
+            "enabled": true,
+            "labels": [],
+            "name": "h1"
+          }
+        ]
+      }
+    },
+    "warnings": [],
+    "metadata": {
+      "version": 7,
+      "updatedAt": "2026-09-16T00:00:00.000Z"
+    },
+    "why": "受理:粘进 hosts 条目的 `url`(带凭据)是未知键,被 schema 剥掉(读腿只报键路径);严写同样剥 —— 凭据既不进受理形、也不进告警(告警面为空)。"
+  },
   "wire": {
     "derive": true
   },

package/conformance/cases/cli04-env-value-with-newline/expected.json

@@ -94,6 +94,52 @@
       "updatedAt": "2026-09-16T00:00:00.000Z"
     }
   },
+  "strictWrite": {
+    "outcome": "effective",
+    "effective": {
+      "workers": {
+        "workers": [
+          {
+            "coords": {},
+            "enabled": true,
+            "env": {
+              "BAR": "c\rd",
+              "FOO": "a\nb"
+            },
+            "host": "default",
+            "image": "sema-server:latest",
+            "name": "w1",
+            "runtime": {
+              "execution": {
+                "coords": {},
+                "lane": "host",
+                "secretRefs": {}
+              },
+              "rateLimitRpm": 0,
+              "requirePrincipal": false,
+              "store": {
+                "backend": "local",
+                "memory": {
+                  "backend": "file",
+                  "engine": "on"
+                },
+                "session": "auto"
+              }
+            },
+            "secretRefs": {
+              "apiKeyEnv": "OPENAI_API_KEY"
+            }
+          }
+        ]
+      }
+    },
+    "warnings": [],
+    "metadata": {
+      "version": 7,
+      "updatedAt": "2026-09-16T00:00:00.000Z"
+    },
+    "why": "受理:worker 的 env 值里有换行 / 回车,读腿原样承运;严写同样原样收下,受理形等于读腿 workers 那一格。"
+  },
   "wire": {
     "derive": true
   },