重构主控编排与运行时预热链路，统一工作区提示词/专家调度协议并补齐 wiki 记忆注入与写回闭环。

同时收敛启动与运维脚本默认行为（含 wiki worker）、更新 Admin 可观测性与相关测试，降低首轮时延并提高运行稳定性。

Made-with: Cursor

openclaw/extensions/device-pair/pair-command-auth.test.ts

@@ -0,0 +1,53 @@
+import { describe, expect, it } from "vitest";
+import { resolvePairingCommandAuthState } from "./pair-command-auth.js";
+
+describe("device-pair pairing command auth", () => {
+  it("treats non-gateway channels as external approvals", () => {
+    expect(
+      resolvePairingCommandAuthState({
+        channel: "telegram",
+        gatewayClientScopes: undefined,
+      }),
+    ).toEqual({
+      isInternalGatewayCaller: false,
+      isMissingInternalPairingPrivilege: false,
+      approvalCallerScopes: undefined,
+    });
+  });
+
+  it("fails closed for webchat when scopes are absent", () => {
+    expect(
+      resolvePairingCommandAuthState({
+        channel: "webchat",
+        gatewayClientScopes: undefined,
+      }),
+    ).toEqual({
+      isInternalGatewayCaller: true,
+      isMissingInternalPairingPrivilege: true,
+      approvalCallerScopes: [],
+    });
+  });
+
+  it("accepts pairing and admin scopes for internal callers", () => {
+    expect(
+      resolvePairingCommandAuthState({
+        channel: "webchat",
+        gatewayClientScopes: ["operator.write", "operator.pairing"],
+      }),
+    ).toEqual({
+      isInternalGatewayCaller: true,
+      isMissingInternalPairingPrivilege: false,
+      approvalCallerScopes: ["operator.write", "operator.pairing"],
+    });
+    expect(
+      resolvePairingCommandAuthState({
+        channel: "webchat",
+        gatewayClientScopes: ["operator.admin"],
+      }),
+    ).toEqual({
+      isInternalGatewayCaller: true,
+      isMissingInternalPairingPrivilege: false,
+      approvalCallerScopes: ["operator.admin"],
+    });
+  });
+});