weichen 716fe9541c Enforce system-managed settings scope with admin system settings API ...

Why: P2——模型、密钥、Tavily、遥测与运行基础设施属系统受管项；user/project 层须整笔拒绝（含嵌套、点路径与子树覆盖），生效链剥除存量覆盖，管理员经新系统面统一配置。
Evidence: go test ./... 全绿；settings 单测覆盖嵌套/点路径/祖先标量拒绝、系统层生效、读面剥除；server e2e 覆盖 400/系统面读写/掩码；认证档 admin 门测试（普通 403、admin 200、密钥不泄漏）。
Impact: settings.go 受管标记与 mergeScope 拦截、Effective 增系统层、server 新增 GET/PUT /api/settings/system（无认证档本机即管理员）、SecretLookup 系统行回退、插件 schema 受管注入；测试基建 mock seed 与三处用例迁到系统层；svc.sh 播种改走系统面（仅 admin，无管理员时明确跳过）。Core gitlink 升至 9150e6f。
Refs: modules/documents/docs/proposals/2026-10-13-rdm-settings-members-duties-perms-increment.md P2

2026-10-13 04:05:15 +00:00

..

app

Enforce system-managed settings scope with admin system settings API

2026-10-13 04:05:15 +00:00

blobstore

Fall back to local artifacts when the blob store is a typed nil

2026-10-13 01:22:57 +00:00

bus

Recover interrupted runs and commit terminal state once

2026-10-03 14:37:49 +00:00

cardsvc

Close request atomicity: locked message append, card versions, atomic rate limit, recovery holds (U3 slice 1)

2026-10-11 04:37:50 +00:00

cmdbus

Add AdminProvider capability and HostProjectID context (EXT-18)

2026-10-11 16:23:15 +00:00

config

Add the team PG tier, atomic migrations and the connection budget (U2)

2026-10-11 03:10:55 +00:00

ctxasm

Add the generative-ui plugin, capability gating, and surface projection

2026-10-11 10:38:15 +00:00

docgen

Generate styled Word deliverables and pin artifact cards in chat

2026-10-01 02:48:49 +00:00

evalgold

Add the public extension surface and platform services

2026-10-01 10:35:02 +00:00

genui

Add EXT-8b resource-level authorization contract

2026-10-12 11:44:00 +00:00

hostapi

Close the EXT-8 remaining blocks: vector sharing, hostapi face, citation consistency

2026-10-08 17:16:10 +00:00

ingest

Keep tracked-change and hyperlink text in DOCX and add an exec hard switch

2026-10-09 10:36:02 +00:00

intentgate

Wire the intent slow lane behind settings flags (I2 WP3)

2026-10-07 11:20:41 +00:00

intentsem

Wire the intent slow lane behind settings flags (I2 WP3)

2026-10-07 11:20:41 +00:00

pgbus

Catch up event streams by cursor with real reconnect and periodic rescue (U6 slice 1)

2026-10-11 09:30:29 +00:00

plugins

Keep only hard facts in the blocking gate and add fact-consistency checks

2026-10-10 00:04:57 +00:00

profiles

Stream tool progress and drop hard agent limits

2026-10-02 02:17:02 +00:00

prompts

Unwrap item-style spec wrappers, pair bare table cells, let subagents present pages

2026-10-12 03:03:26 +00:00

quality

Keep only hard facts in the blocking gate and add fact-consistency checks

2026-10-10 00:04:57 +00:00

rag

Enforce system-managed settings scope with admin system settings API

2026-10-13 04:05:15 +00:00

ratelimit

Close request atomicity: locked message append, card versions, atomic rate limit, recovery holds (U3 slice 1)

2026-10-11 04:37:50 +00:00

route

Keep only hard facts in the blocking gate and add fact-consistency checks

2026-10-10 00:04:57 +00:00

runmgr

Map background card failures to CardFailed with L1 body

2026-10-12 07:43:31 +00:00

runtime

Add deliverable-choice chain: confirm_choice tool, notice contract, backstops

2026-10-11 16:53:53 +00:00

server

Enforce system-managed settings scope with admin system settings API

2026-10-13 04:05:15 +00:00

settings

Enforce system-managed settings scope with admin system settings API

2026-10-13 04:05:15 +00:00

skills

Open the kernel workspace tools and the markdown-source build pipeline

2026-10-09 18:01:06 +00:00

squadadapter

Keep only hard facts in the blocking gate and add fact-consistency checks

2026-10-10 00:04:57 +00:00

store

Fall back to local artifacts when the blob store is a typed nil

2026-10-13 01:22:57 +00:00

surfacesvc

Flatten surface action data into command params

2026-10-12 04:16:34 +00:00

tools

Remove the empty -ws shell directory after each apply

2026-10-11 02:18:01 +00:00

wfcompile

Keep only hard facts in the blocking gate and add fact-consistency checks

2026-10-10 00:04:57 +00:00

workflow

Run workflow scripts through a capped callback host

2026-10-01 16:18:59 +00:00