codebee 0.1.95 → 0.1.97

package/app/core/settings.py

@@ -14,8 +14,9 @@ _FILE = paths.DATA_DIR / "settings.json"
 # default_workdir 为空表示未自定义，用 builtin_workdir() 回落；
 # telemetry_errors：匿名错误回传开关（默认开；关掉后版本 ping/错误上传/诊断包遥测部分全部停发，
 # 「导出诊断包」是用户手动操作不受此开关限制）
-# publish_daily_cap / publish_fail_streak：自动发布护栏——每任务每平台每日
-# 成功发章上限、平台连续失败几次后暂停自动发布（publish/auto.py 读取）
+# publish_daily_cap / publish_fail_streak / publish_fail_window_h：自动发布护栏——
+# 每任务每平台每日成功发章上限、平台连续失败几次后暂停自动发布、连败只统计
+# 最近多少小时内的失败（跨天旧失败不进「连续」口径）（publish/auto.py 读取）
 # pet_enabled / pet_mode：桌面蜜蜂（app/pet.py）开关与显示模式（默认关，设置页
 # 可开）。关闭后看护线程不再拉起、在岗蜜蜂轮询到 false 自行退出；mode=always
 # 不再拉起、在岗蜜蜂轮询到 false 自行退出；mode=always 常驻，tasks_only 仅任务
@@ -26,8 +27,10 @@ _FILE = paths.DATA_DIR / "settings.json"
 # Server酱（微信）/ Telegram Bot。密钥只存本机 settings.json，不出网（推送
 # 时才带着发给对应服务）。bark_server 留空回落官方 api.day.app。
 DEFAULTS = {"max_concurrent_jobs": 12, "default_workdir": "", "hooks_token": "",
+            "hooks_signing_secret": "",
             "telemetry_errors": True, "publish_daily_cap": 10,
-            "publish_fail_streak": 3, "notify_webhook": "", "notify_base_url": "",
+            "publish_fail_streak": 3, "publish_fail_window_h": 12,
+            "notify_webhook": "", "notify_base_url": "",
             "notify_bark_server": "", "notify_bark_key": "",
             "notify_ntfy_topic": "", "notify_serverchan_key": "",
             "notify_telegram_token": "", "notify_telegram_chat_id": "",
@@ -35,6 +38,9 @@ DEFAULTS = {"max_concurrent_jobs": 12, "default_workdir": "", "hooks_token": "",
             # enabled=False 关；days 间隔天数控节流；mcp_servers=内置智能体的
             # MCP 服务器清单（JSON 数组字符串，stdio 形态）
             "bench_auto_enabled": False, "bench_auto_days": 7,
+            # 评测反哺：实测分软信号进绑定链排序（dispatch 读 benchstore.bonus_for，
+            # ±4.5 封顶翻不动硬约束）。默认开——评测了就该去影响；关=纯榜单展示
+            "bench_feedback_enabled": True,
             "mcp_servers": "",
             # 备份远程通道（remotesync）：导出成功后自动 PUT 到 WebDAV/S3 兼容
             # 端点（Basic auth）；密钥只存本机
@@ -49,6 +55,18 @@ DEFAULTS = {"max_concurrent_jobs": 12, "default_workdir": "", "hooks_token": "",
 # 桌宠形象白名单（与 app/pet.py 的 SKINS 对齐；这里不 import pet 模块，避免
 # core 反向依赖 app 根目录脚本）
 PET_SKINS = ("plush", "robot")
+SECRET_KEYS = frozenset({"hooks_token", "hooks_signing_secret", "notify_webhook",
+                         "notify_bark_key", "notify_ntfy_topic", "notify_serverchan_key",
+                         "notify_telegram_token", "notify_telegram_chat_id", "backup_remote_pass"})
+
+
+def public_view(value=None):
+    """Return settings suitable for API responses without credential material."""
+    source = dict(value if isinstance(value, dict) else load())
+    for key in SECRET_KEYS:
+        if key in source:
+            source[key] = "***" if source[key] else ""
+    return source
 # 并发保护上限 24：编排任务有空位即直接启动，满载回滚 queued 排队自动补跑，
 # 不秒判失败；同任务单飞守卫在 jobs 层。该上限保护的是本机资源（CLI 子进程
 # 数），与各 API 厂商的限流无关；direct 对话走 jobs 轻量池不占此额度。
@@ -120,18 +138,26 @@ def save(patch):
             cur["default_workdir"] = wd
         if "hooks_token" in patch:
             cur["hooks_token"] = str(patch.get("hooks_token") or "").strip()[:128]
+        if "hooks_signing_secret" in patch:
+            cur["hooks_signing_secret"] = str(patch.get("hooks_signing_secret") or "").strip()[:256]
         if "telemetry_errors" in patch:
             cur["telemetry_errors"] = bool(patch.get("telemetry_errors"))
         if "publish_daily_cap" in patch:
             try:
-                cur["publish_daily_cap"] = max(1, min(50, int(patch.get("publish_daily_cap"))))
+                v = int(patch.get("publish_daily_cap"))
             except (TypeError, ValueError):
-                return cur, "publish_daily_cap 必须是 1-50 的整数"
+                return cur, "publish_daily_cap 必须是 0-50 的整数（0=不限制）"
+            cur["publish_daily_cap"] = max(0, min(50, v))
         if "publish_fail_streak" in patch:
             try:
                 cur["publish_fail_streak"] = max(1, min(10, int(patch.get("publish_fail_streak"))))
             except (TypeError, ValueError):
                 return cur, "publish_fail_streak 必须是 1-10 的整数"
+        if "publish_fail_window_h" in patch:
+            try:
+                cur["publish_fail_window_h"] = max(1, min(168, float(patch.get("publish_fail_window_h"))))
+            except (TypeError, ValueError):
+                return cur, "publish_fail_window_h 必须是 1-168 的数字"
         if "notify_webhook" in patch:
             cur["notify_webhook"] = str(patch.get("notify_webhook") or "").strip()[:300]
         if "notify_base_url" in patch:
@@ -148,6 +174,8 @@ def save(patch):
                 cur["bench_auto_days"] = max(1, min(90, int(patch.get("bench_auto_days"))))
             except (TypeError, ValueError):
                 return cur, "bench_auto_days 必须是 1-90 的整数"
+        if "bench_feedback_enabled" in patch:
+            cur["bench_feedback_enabled"] = bool(patch.get("bench_feedback_enabled"))
         if "mcp_servers" in patch:
             cur["mcp_servers"] = str(patch.get("mcp_servers") or "").strip()[:4000]
         if "backup_remote_enabled" in patch:

package/app/core/settings_schema.py

@@ -1,271 +1,282 @@
-# -*- coding: utf-8 -*-
-"""Schema 化设置：namespace 注册 + revision CAS + 脱敏 describe。
-
-设计稿：docs/migration/05-model-seams.md §4C（按 Tutti 实际架构落地：
-不替换现有 settings.py——它正被并行迭代且已有原子写+钳制；本模块提供
-「schema 驱动 + revision CAS + secret 脱敏」能力，管理自己的
-data/settings_v2.json，供新增配置项使用，存量 key-value 不迁移）。
-
-参考 dsh packages/settings/settings/src/index.ts:419-637：
-  register(ns, schema, base) / mutate(ops) / describe({redactSecrets}) /
-  SettingsConflictError（revision 单调，乐观并发）。
-
-冲突语义：mutate 带 expected_revision 时做 CAS；不带则最后写赢。
-"""
-from __future__ import annotations
-
-import json
-import re
-import threading
-from pathlib import Path
-
-_LOCK = threading.RLock()
-_FILE = None  # init() 注入
-_NAMESPACES = {}   # ns -> {"fields": {path: FieldDef}, "validate": fn}
-_VALUES = {}       # ns -> {path: value}
-_REVISIONS = {}    # ns -> int
-
-
-class SettingsConflictError(Exception):
-    """CAS 失败：调用方持有的是陈旧 revision。"""
-
-
-class FieldDef:
-    __slots__ = ("path", "ftype", "default", "description", "redact", "choices", "clamp")
-
-    def __init__(self, path, ftype, default, description="", redact=False,
-                 choices=None, clamp=None):
-        self.path = path
-        self.ftype = ftype            # "int" | "float" | "str" | "bool"
-        self.default = default
-        self.description = description
-        self.redact = redact          # True = describe() 输出 __REDACTED__
-        self.choices = choices        # 可选：合法值列表
-        self.clamp = clamp            # 可选：(min, max)，int/float 用
-
-
-def init(data_dir=None):
-    global _FILE, _NAMESPACES, _VALUES, _REVISIONS
-    with _LOCK:
-        base = Path(data_dir) if data_dir else Path(_default_dir())
-        base.mkdir(parents=True, exist_ok=True)
-        _FILE = base / "settings_v2.json"
-        _NAMESPACES, _VALUES, _REVISIONS = {}, {}, {}
-        try:
-            data = json.loads(_FILE.read_text(encoding="utf-8"))
-            _VALUES = data.get("values") or {}
-            _REVISIONS = data.get("revisions") or {}
-        except (OSError, json.JSONDecodeError):
-            pass
-
-
-def _default_dir():
-    from . import paths
-    return str(paths.DATA_DIR)
-
-
-def _persist():
-    if _FILE is None:
-        return
-    tmp = _FILE.with_suffix(".tmp")
-    tmp.write_text(json.dumps({"values": _VALUES, "revisions": _REVISIONS},
-                              ensure_ascii=False, indent=2), encoding="utf-8")
-    tmp.replace(_FILE)
-
-
-# ---- 路径读写（支持 "a.b" 点路径；不实现数组下标——Tutti 配置用不到） ----
-
-def _get_path(d, path):
-    cur = d
-    for seg in path.split("."):
-        if not isinstance(cur, dict) or seg not in cur:
-            return None
-        cur = cur[seg]
-    return cur
-
-
-def _set_path(d, path, value):
-    segs = path.split(".")
-    cur = d
-    for seg in segs[:-1]:
-        cur = cur.setdefault(seg, {})
-        if not isinstance(cur, dict):
-            raise ValueError("路径冲突：%s" % path)
-    cur[segs[-1]] = value
-
-
-# ---- 注册 ----
-
-def register_namespace(ns, fields, validate=None):
-    """注册 namespace 与字段 schema。已注册的 namespace 不可重复注册。"""
-    with _LOCK:
-        if ns in _NAMESPACES:
-            raise ValueError("namespace 已注册：%s" % ns)
-        fmap = {}
-        for f in fields:
-            fmap[f.path] = f
-            if _get_path(_VALUES.get(ns, {}), f.path) is None:
-                _VALUES.setdefault(ns, {})
-                _set_path(_VALUES[ns], f.path, f.default)
-        _NAMESPACES[ns] = {"fields": fmap, "validate": validate}
-        _REVISIONS.setdefault(ns, 1)
-        _persist()
-
-
-def coerce(field, value):
-    """按字段类型强转 + 钳制 + choices 校验。返回 (规范化值, 错误)。"""
-    try:
-        if field.ftype == "int":
-            v = int(value)
-        elif field.ftype == "float":
-            v = float(value)
-        elif field.ftype == "bool":
-            v = bool(value) if not isinstance(value, str) else (
-                value.strip().lower() in ("1", "true", "yes", "on"))
-        else:
-            v = str(value)
-    except (TypeError, ValueError):
-        return None, "%s 必须是 %s" % (field.path, field.ftype)
-    if field.clamp:
-        lo, hi = field.clamp
-        v = max(lo, min(hi, v))
-    if field.choices is not None and v not in field.choices:
-        return None, "%s 必须是 %s 之一" % (field.path, field.choices)
-    return v, None
-
-
-# ---- 读写 ----
-
-def get(ns, path=None):
-    with _LOCK:
-        vals = _VALUES.get(ns)
-        if vals is None:
-            return None
-        return _get_path(vals, path) if path else dict(vals)
-
-
-def revision(ns):
-    with _LOCK:
-        return _REVISIONS.get(ns, 0)
-
-
-def names():
-    """已注册 namespace 清单（GET /api/settings-v2 用）。"""
-    with _LOCK:
-        return sorted(_NAMESPACES)
-
-
-def mutate(ns, ops, expected_revision=None):
-    """写一组操作。ops = [{"op":"set","path":..., "value":...}, ...]。
-
-    值按注册的 FieldDef 强转/钳制/校验；namespace 有 validate 钩子时整体验证。
-    expected_revision 非 None 时做 CAS。成功返回新 revision。
-    """
-    with _LOCK:
-        ndef = _NAMESPACES.get(ns)
-        if not ndef:
-            raise ValueError("namespace 未注册：%s" % ns)
-        if expected_revision is not None and _REVISIONS.get(ns) != expected_revision:
-            raise SettingsConflictError(
-                "%s 期望 rev %s，实际 %s" % (ns, expected_revision, _REVISIONS.get(ns)))
-        # 先全部校验，后统一写入（部分失败不落盘）
-        staged = []
-        for op in ops:
-            if op.get("op") != "set":
-                raise ValueError("仅支持 set 操作：%r" % op.get("op"))
-            path = op.get("path")
-            fdef = ndef["fields"].get(path)
-            if not fdef:
-                raise ValueError("未注册字段：%s" % path)
-            v, err = coerce(fdef, op.get("value"))
-            if err:
-                raise ValueError(err)
-            staged.append((path, v))
-        ns_values = dict(_VALUES.get(ns, {}))
-        for path, v in staged:
-            _set_path(ns_values, path, v)
-        if ndef["validate"]:
-            err = ndef["validate"](ns_values)
-            if err:
-                raise ValueError("namespace 校验失败：%s" % err)
-        _VALUES[ns] = ns_values
-        _REVISIONS[ns] = _REVISIONS.get(ns, 1) + 1
-        _persist()
-        return _REVISIONS[ns]
-
-
-def describe(ns, redact_secrets=True):
-    """给 UI 的视图：默认把 redact 字段替换为 __REDACTED__（不泄露真值）。
-
-    fields 带回字段元数据（类型/说明/choices/clamp），前端调参卡按 schema
-    渲染控件，schema 变更零前端改动。"""
-    with _LOCK:
-        vals = json.loads(json.dumps(_VALUES.get(ns, {})))  # deep copy
-        ndef = _NAMESPACES.get(ns) or {"fields": {}}
-        fields = [{"path": f.path, "type": f.ftype, "description": f.description,
-                   "choices": f.choices, "clamp": f.clamp}
-                  for f in ndef["fields"].values()]
-    for f in ndef["fields"].values():
-        if f.redact and redact_secrets:
-            if _get_path(vals, f.path) not in (None, ""):
-                _set_path(vals, f.path, "__REDACTED__")
-    return {"ns": ns, "revision": _REVISIONS.get(ns, 0), "values": vals,
-            "fields": fields}
-
-
-# ---- 默认 namespace（编排阈值的 schema 化存放处；pipeline 可渐进接入） ----
-
-def register_default_namespaces():
-    """注册 Tutti 默认 namespace。幂等（已注册则跳过）。"""
-    if "orchestrator" in _NAMESPACES and "budget" in _NAMESPACES:
-        return
-    if "orchestrator" not in _NAMESPACES:
-        register_namespace(
-            "orchestrator",
-            fields=[
-                FieldDef("compaction.enabled", "bool", False,
-                         "上下文压缩总开关（灰度：与 TUTTI_COMPACTION 任一开启即生效）"),
-                FieldDef("compaction.pressure_threshold", "float", 0.8,
-                         "触发压缩的压力比阈值",
-                         clamp=(0.1, 0.99)),
-                FieldDef("compaction.retain_tail_tokens", "int", 8000,
-                         "压缩时保留尾部预算（token 估算）",
-                         clamp=(0, 100000)),
-                FieldDef("max_goal_rounds", "int", 5,
-                         "Goal 续行上限",
-                         clamp=(1, 20)),
-                FieldDef("outline_timeout_s", "int", 900,
-                         "大纲/规划 CLI 兜底调用的超时秒数（env TUTTI_OUTLINE_TIMEOUT 优先）",
-                         clamp=(60, 3600)),
-            ],
-            validate=lambda v: None,
-        )
-    if "budget" not in _NAMESPACES:
-        register_namespace(
-            "budget",
-            fields=[
-                # §07 T2.1：0 = 不限；达到上限后 pipeline 停止后续真实调用（ENV_BLOCK）
-                FieldDef("max_tokens_per_run", "int", 0,
-                         "单次运行 token 预算上限（0=不限；超额停止后续步骤，等自动续跑）",
-                         clamp=(0, 100_000_000)),
-                # 花费硬顶（¥，按台账标定单价折算：手标单价优先，回落导入价表；
-                # 未标定单价的调用不记钱也不计入——宁缺毋滥）：0 = 不限。
-                FieldDef("daily_cost_yuan", "float", 0.0,
-                         "每日花费上限（¥，按标定单价折算；0=不限；超额停止后续步骤）",
-                         clamp=(0, 1_000_000)),
-                FieldDef("monthly_cost_yuan", "float", 0.0,
-                         "每月花费上限（¥，按标定单价折算；0=不限；超额停止后续步骤）",
-                         clamp=(0, 1_000_000)),
-            ],
-            validate=lambda v: None,
-        )
-    if "cascade" not in _NAMESPACES:
-        register_namespace(
-            "cascade",
-            fields=[
-                # §07 T3.1：easy 任务先走低档模型，质量闸门不过沿 chain 升级
-                FieldDef("enabled", "bool", False,
-                         "FrugalGPT 式级联：easy 任务按 tier 升序重排模型链（需供应商声明 tier）"),
-            ],
-            validate=lambda v: None,
-        )
+# -*- coding: utf-8 -*-
+"""Schema 化设置：namespace 注册 + revision CAS + 脱敏 describe。
+
+设计稿：docs/migration/05-model-seams.md §4C（按 Tutti 实际架构落地：
+不替换现有 settings.py——它正被并行迭代且已有原子写+钳制；本模块提供
+「schema 驱动 + revision CAS + secret 脱敏」能力，管理自己的
+data/settings_v2.json，供新增配置项使用，存量 key-value 不迁移）。
+
+参考 dsh packages/settings/settings/src/index.ts:419-637：
+  register(ns, schema, base) / mutate(ops) / describe({redactSecrets}) /
+  SettingsConflictError（revision 单调，乐观并发）。
+
+冲突语义：mutate 带 expected_revision 时做 CAS；不带则最后写赢。
+"""
+from __future__ import annotations
+
+import json
+import re
+import threading
+from pathlib import Path
+
+_LOCK = threading.RLock()
+_FILE = None  # init() 注入
+_NAMESPACES = {}   # ns -> {"fields": {path: FieldDef}, "validate": fn}
+_VALUES = {}       # ns -> {path: value}
+_REVISIONS = {}    # ns -> int
+
+
+class SettingsConflictError(Exception):
+    """CAS 失败：调用方持有的是陈旧 revision。"""
+
+
+class FieldDef:
+    __slots__ = ("path", "ftype", "default", "description", "redact", "choices", "clamp")
+
+    def __init__(self, path, ftype, default, description="", redact=False,
+                 choices=None, clamp=None):
+        self.path = path
+        self.ftype = ftype            # "int" | "float" | "str" | "bool"
+        self.default = default
+        self.description = description
+        self.redact = redact          # True = describe() 输出 __REDACTED__
+        self.choices = choices        # 可选：合法值列表
+        self.clamp = clamp            # 可选：(min, max)，int/float 用
+
+
+def init(data_dir=None):
+    global _FILE, _NAMESPACES, _VALUES, _REVISIONS
+    with _LOCK:
+        base = Path(data_dir) if data_dir else Path(_default_dir())
+        base.mkdir(parents=True, exist_ok=True)
+        _FILE = base / "settings_v2.json"
+        _NAMESPACES, _VALUES, _REVISIONS = {}, {}, {}
+        try:
+            data = json.loads(_FILE.read_text(encoding="utf-8"))
+            _VALUES = data.get("values") or {}
+            _REVISIONS = data.get("revisions") or {}
+        except (OSError, json.JSONDecodeError):
+            pass
+
+
+def _default_dir():
+    from . import paths
+    return str(paths.DATA_DIR)
+
+
+def _persist():
+    if _FILE is None:
+        return
+    tmp = _FILE.with_suffix(".tmp")
+    tmp.write_text(json.dumps({"values": _VALUES, "revisions": _REVISIONS},
+                              ensure_ascii=False, indent=2), encoding="utf-8")
+    tmp.replace(_FILE)
+
+
+# ---- 路径读写（支持 "a.b" 点路径；不实现数组下标——Tutti 配置用不到） ----
+
+def _get_path(d, path):
+    cur = d
+    for seg in path.split("."):
+        if not isinstance(cur, dict) or seg not in cur:
+            return None
+        cur = cur[seg]
+    return cur
+
+
+def _set_path(d, path, value):
+    segs = path.split(".")
+    cur = d
+    for seg in segs[:-1]:
+        cur = cur.setdefault(seg, {})
+        if not isinstance(cur, dict):
+            raise ValueError("路径冲突：%s" % path)
+    cur[segs[-1]] = value
+
+
+# ---- 注册 ----
+
+def register_namespace(ns, fields, validate=None):
+    """注册 namespace 与字段 schema。已注册的 namespace 不可重复注册。"""
+    with _LOCK:
+        if ns in _NAMESPACES:
+            raise ValueError("namespace 已注册：%s" % ns)
+        fmap = {}
+        for f in fields:
+            fmap[f.path] = f
+            if _get_path(_VALUES.get(ns, {}), f.path) is None:
+                _VALUES.setdefault(ns, {})
+                _set_path(_VALUES[ns], f.path, f.default)
+        _NAMESPACES[ns] = {"fields": fmap, "validate": validate}
+        _REVISIONS.setdefault(ns, 1)
+        _persist()
+
+
+def coerce(field, value):
+    """按字段类型强转 + 钳制 + choices 校验。返回 (规范化值, 错误)。"""
+    try:
+        if field.ftype == "int":
+            v = int(value)
+        elif field.ftype == "float":
+            v = float(value)
+        elif field.ftype == "bool":
+            v = bool(value) if not isinstance(value, str) else (
+                value.strip().lower() in ("1", "true", "yes", "on"))
+        else:
+            v = str(value)
+    except (TypeError, ValueError):
+        return None, "%s 必须是 %s" % (field.path, field.ftype)
+    if field.clamp:
+        lo, hi = field.clamp
+        v = max(lo, min(hi, v))
+    if field.choices is not None and v not in field.choices:
+        return None, "%s 必须是 %s 之一" % (field.path, field.choices)
+    return v, None
+
+
+# ---- 读写 ----
+
+def get(ns, path=None):
+    with _LOCK:
+        vals = _VALUES.get(ns)
+        if vals is None:
+            return None
+        return _get_path(vals, path) if path else dict(vals)
+
+
+def revision(ns):
+    with _LOCK:
+        return _REVISIONS.get(ns, 0)
+
+
+def names():
+    """已注册 namespace 清单（GET /api/settings-v2 用）。"""
+    with _LOCK:
+        return sorted(_NAMESPACES)
+
+
+def mutate(ns, ops, expected_revision=None):
+    """写一组操作。ops = [{"op":"set","path":..., "value":...}, ...]。
+
+    值按注册的 FieldDef 强转/钳制/校验；namespace 有 validate 钩子时整体验证。
+    expected_revision 非 None 时做 CAS。成功返回新 revision。
+    """
+    with _LOCK:
+        ndef = _NAMESPACES.get(ns)
+        if not ndef:
+            raise ValueError("namespace 未注册：%s" % ns)
+        if expected_revision is not None and _REVISIONS.get(ns) != expected_revision:
+            raise SettingsConflictError(
+                "%s 期望 rev %s，实际 %s" % (ns, expected_revision, _REVISIONS.get(ns)))
+        # 先全部校验，后统一写入（部分失败不落盘）
+        staged = []
+        for op in ops:
+            if op.get("op") != "set":
+                raise ValueError("仅支持 set 操作：%r" % op.get("op"))
+            path = op.get("path")
+            fdef = ndef["fields"].get(path)
+            if not fdef:
+                raise ValueError("未注册字段：%s" % path)
+            v, err = coerce(fdef, op.get("value"))
+            if err:
+                raise ValueError(err)
+            staged.append((path, v))
+        ns_values = dict(_VALUES.get(ns, {}))
+        for path, v in staged:
+            _set_path(ns_values, path, v)
+        if ndef["validate"]:
+            err = ndef["validate"](ns_values)
+            if err:
+                raise ValueError("namespace 校验失败：%s" % err)
+        _VALUES[ns] = ns_values
+        _REVISIONS[ns] = _REVISIONS.get(ns, 1) + 1
+        _persist()
+        return _REVISIONS[ns]
+
+
+def describe(ns, redact_secrets=True):
+    """给 UI 的视图：默认把 redact 字段替换为 __REDACTED__（不泄露真值）。
+
+    fields 带回字段元数据（类型/说明/choices/clamp），前端调参卡按 schema
+    渲染控件，schema 变更零前端改动。"""
+    with _LOCK:
+        vals = json.loads(json.dumps(_VALUES.get(ns, {})))  # deep copy
+        ndef = _NAMESPACES.get(ns) or {"fields": {}}
+        fields = [{"path": f.path, "type": f.ftype, "description": f.description,
+                   "choices": f.choices, "clamp": f.clamp}
+                  for f in ndef["fields"].values()]
+    for f in ndef["fields"].values():
+        if f.redact and redact_secrets:
+            if _get_path(vals, f.path) not in (None, ""):
+                _set_path(vals, f.path, "__REDACTED__")
+    return {"ns": ns, "revision": _REVISIONS.get(ns, 0), "values": vals,
+            "fields": fields}
+
+
+# ---- 默认 namespace（编排阈值的 schema 化存放处；pipeline 可渐进接入） ----
+
+def register_default_namespaces():
+    """注册 Tutti 默认 namespace。幂等（已注册则跳过）。"""
+    if "orchestrator" in _NAMESPACES and "budget" in _NAMESPACES:
+        return
+    if "orchestrator" not in _NAMESPACES:
+        register_namespace(
+            "orchestrator",
+            fields=[
+                FieldDef("compaction.enabled", "bool", True,
+                         "上下文压缩总开关（默认开启；可在设置页或用 TUTTI_COMPACTION=0 关闭）"),
+                FieldDef("compaction.pressure_threshold", "float", 0.8,
+                         "触发压缩的压力比阈值",
+                         clamp=(0.1, 0.99)),
+                FieldDef("compaction.retain_tail_tokens", "int", 8000,
+                         "压缩时保留尾部预算（token 估算）",
+                         clamp=(0, 100000)),
+                FieldDef("max_goal_rounds", "int", 5,
+                         "Goal 续行上限",
+                         clamp=(1, 20)),
+                FieldDef("outline_timeout_s", "int", 900,
+                         "大纲/规划 CLI 兜底调用的超时秒数（env TUTTI_OUTLINE_TIMEOUT 优先）",
+                         clamp=(60, 3600)),
+            ],
+            validate=lambda v: None,
+        )
+    if "budget" not in _NAMESPACES:
+        register_namespace(
+            "budget",
+            fields=[
+                # §07 T2.1：0 = 不限；达到上限后 pipeline 停止后续真实调用（ENV_BLOCK）
+                FieldDef("max_tokens_per_run", "int", 0,
+                         "单次运行 token 预算上限（0=不限；超额停止后续步骤，等自动续跑）",
+                         clamp=(0, 100_000_000)),
+                # 花费硬顶（¥，按台账标定单价折算：手标单价优先，回落导入价表；
+                # 未标定单价的调用不记钱也不计入——宁缺毋滥）：0 = 不限。
+                FieldDef("daily_cost_yuan", "float", 0.0,
+                         "每日花费上限（¥，按标定单价折算；0=不限；超额停止后续步骤）",
+                         clamp=(0, 1_000_000)),
+                FieldDef("monthly_cost_yuan", "float", 0.0,
+                         "每月花费上限（¥，按标定单价折算；0=不限；超额停止后续步骤）",
+                         clamp=(0, 1_000_000)),
+            ],
+            validate=lambda v: None,
+        )
+
+    # Revision 1 is the pre-release schema default (disabled). Values written
+    # by mutate() advance the namespace to revision 2+, so preserve an explicit
+    # user opt-out while migrating untouched installations to the new default.
+    with _LOCK:
+        orchestrator = _VALUES.get("orchestrator", {})
+        if (_REVISIONS.get("orchestrator") == 1 and
+                _get_path(orchestrator, "compaction.enabled") is False):
+            _set_path(orchestrator, "compaction.enabled", True)
+            _REVISIONS["orchestrator"] = 2
+            _persist()
+    if "cascade" not in _NAMESPACES:
+        register_namespace(
+            "cascade",
+            fields=[
+                # §07 T3.1：easy 任务先走低档模型，质量闸门不过沿 chain 升级
+                FieldDef("enabled", "bool", False,
+                         "FrugalGPT 式级联：easy 任务按 tier 升序重排模型链（需供应商声明 tier）"),
+            ],
+            validate=lambda v: None,
+        )