diff --git a/.ai/product/feature-spec/README.md b/.ai/product/feature-spec/README.md
index 5901903..add9643 100644
--- a/.ai/product/feature-spec/README.md
+++ b/.ai/product/feature-spec/README.md
@@ -44,6 +44,7 @@
 | [ops-intervention-outcome.md](ops-intervention-outcome.md) | CrisisCare InterventionOutcome | §7 | `GET /admin/crisis/interventions*` | Ops-D · **ECR-032 Closed** |
 | [ops-handoff-case.md](ops-handoff-case.md) | AskOperations HandoffCase | §7 | `GET /admin/ask/handoffs*` | Ops-D · **ECR-033 Closed** |
 | [ops-privacy-request.md](ops-privacy-request.md) | AdminGovernance PrivacyRequest | §7 | `GET /admin/privacy/requests*` | Ops-D · **ECR-034 Closed** |
+| [ops-star-config.md](ops-star-config.md) | ExploreConfig StarConfig | §7 | `GET /admin/explore/star-configs*` | Ops-D · **ECR-035 Closed** |
 
 新功能：复制 `_TEMPLATE.md` → 填满 → 在本表登记 → 再编码。
 
diff --git a/.ai/product/feature-spec/ops-star-config.md b/.ai/product/feature-spec/ops-star-config.md
new file mode 100644
index 0000000..6badb5a
--- /dev/null
+++ b/.ai/product/feature-spec/ops-star-config.md
@@ -0,0 +1,41 @@
+# Feature Spec: ExploreConfig · StarConfig（Ops · ECR-035）
+
+> Status: `Active`（Loop continuous · **ECR-035 Closed**）  
+> Parent: WAVE0-FROZEN · Predecessor: ECR-034 Closed  
+> Capability: `ExploreConfig` · BC: `Explore_Reports`  
+> 授权：`docs/WAVE0/LOOP_AUTHORIZATION.md`
+
+## Non-goals
+
+配置写发布 · 引擎改分层 · UGC · 真支付
+
+## L2 Domain
+
+| 概念 | 语义 |
+|------|------|
+| `StarConfig` | 本切片只读目录；code 唯一（若适用） |
+
+## L3 API
+
+| Method | Path | 权限 | 语义 |
+|--------|------|------|------|
+| GET | `/admin/explore/star-configs` | `admin.explore.read` | 只读 |
+| GET | `/admin/explore/star-configs/{id}` | `admin.explore.read` | 只读 |
+
+## Migration
+
+`000036`：表 + 种子（若有） + 授予 admin.explore.read
+
+## L4 AC
+
+| ID | Then |
+|----|------|
+| AC-F-01 | list 含种子或空列表合法 |
+| AC-F-02 | 已知 id get 200 |
+| AC-F-03 | 未知 id → 404 |
+| AC-S-01 | 无 Admin → 401 |
+| AC-S-02 | 无权限 → 403 |
+| AC-P-01 | list < 500ms |
+| AC-O-01 | N/A 只读 |
+
+contract_diff: `docs/CONTRACT_DIFF/ECR-035.yaml`
diff --git a/apps/admin-h5/src/api/client.ts b/apps/admin-h5/src/api/client.ts
index 3e81c4f..890f00a 100644
--- a/apps/admin-h5/src/api/client.ts
+++ b/apps/admin-h5/src/api/client.ts
@@ -469,6 +469,10 @@ export const adminApi = {
     request<{ items: Array<Record<string, unknown>> }>('GET', '/privacy/requests'),
   request: (id: string) =>
     request<Record<string, unknown>>('GET', `/privacy/requests/${id}`),
+  starConfigs: () =>
+    request<{ items: Array<Record<string, unknown>> }>('GET', '/explore/star-configs'),
+  starConfig: (id: string) =>
+    request<Record<string, unknown>>('GET', `/explore/star-configs/${id}`),
   orders: () =>
     request<{
       items: Array<{
diff --git a/apps/api/internal/handler/admin.go b/apps/api/internal/handler/admin.go
index 236fefa..cd7c350 100644
--- a/apps/api/internal/handler/admin.go
+++ b/apps/api/internal/handler/admin.go
@@ -63,6 +63,7 @@ func (h *AdminHandler) Register(api *gin.RouterGroup) {
 	h.registerInterventionOutcomes(authed)
 	h.registerHandoffCases(authed)
 	h.registerPrivacyRequests(authed)
+	h.registerStarConfigs(authed)
 }
 
 func (h *AdminHandler) Login(c *gin.Context) {
diff --git a/apps/api/internal/handler/admin_star_config.go b/apps/api/internal/handler/admin_star_config.go
new file mode 100644
index 0000000..c2858c7
--- /dev/null
+++ b/apps/api/internal/handler/admin_star_config.go
@@ -0,0 +1,46 @@
+package handler
+
+import (
+	"errors"
+	"net/http"
+
+	"github.com/gin-gonic/gin"
+	"github.com/google/uuid"
+
+	"github.com/yuxingu/digital-psychology/apps/api/internal/middleware"
+	"github.com/yuxingu/digital-psychology/apps/api/internal/service/admin"
+	"github.com/yuxingu/digital-psychology/apps/api/pkg/response"
+)
+
+func (h *AdminHandler) registerStarConfigs(authed *gin.RouterGroup) {
+	g := authed.Group("/explore")
+	g.GET("/star-configs", middleware.RequireAdminPermission(h.Svc, admin.PermExploreRead), h.ListStarConfigs)
+	g.GET("/star-configs/:id", middleware.RequireAdminPermission(h.Svc, admin.PermExploreRead), h.GetStarConfig)
+}
+
+func (h *AdminHandler) ListStarConfigs(c *gin.Context) {
+	items, err := h.Svc.ListStarConfigs(c.Request.Context())
+	if err != nil {
+		response.Fail(c, http.StatusInternalServerError, 50050, "list star-config failed")
+		return
+	}
+	response.OK(c, gin.H{"items": items})
+}
+
+func (h *AdminHandler) GetStarConfig(c *gin.Context) {
+	id, err := uuid.Parse(c.Param("id"))
+	if err != nil {
+		response.Fail(c, http.StatusBadRequest, 40002, "invalid id")
+		return
+	}
+	row, err := h.Svc.GetStarConfig(c.Request.Context(), id)
+	if errors.Is(err, admin.ErrStarConfigNotFound) {
+		response.Fail(c, http.StatusNotFound, 40420, "star-config not found")
+		return
+	}
+	if err != nil {
+		response.Fail(c, http.StatusInternalServerError, 50051, "get star-config failed")
+		return
+	}
+	response.OK(c, row)
+}
diff --git a/apps/api/internal/integration/star_config_test.go b/apps/api/internal/integration/star_config_test.go
new file mode 100644
index 0000000..b61afcd
--- /dev/null
+++ b/apps/api/internal/integration/star_config_test.go
@@ -0,0 +1,88 @@
+package integration_test
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"testing"
+	"time"
+
+	"github.com/google/uuid"
+	"golang.org/x/crypto/bcrypt"
+)
+
+func TestExploreStarConfigs(t *testing.T) {
+	r, pool := setupAPIPool(t)
+	ctx := context.Background()
+	tok := adminLogin(t, r, "admin", "change-me")
+
+	_, code := doAdminJSON(t, r, http.MethodGet, "/api/v1/admin/explore/star-configs", nil, "")
+	if code != http.StatusUnauthorized {
+		t.Fatalf("expected 401, got %d", code)
+	}
+
+	limitedRoleID := uuid.New()
+	_, err := pool.Exec(ctx, `INSERT INTO admin_roles(id, name, system) VALUES ($1,$2,false)`,
+		limitedRoleID, "lim_"+limitedRoleID.String()[:8])
+	if err != nil {
+		t.Fatal(err)
+	}
+	_, err = pool.Exec(ctx, `INSERT INTO admin_role_permissions(role_id, code) VALUES ($1,'admin.users.read')`, limitedRoleID)
+	if err != nil {
+		t.Fatal(err)
+	}
+	hash, err := bcrypt.GenerateFromPassword([]byte("limited-pass"), bcrypt.DefaultCost)
+	if err != nil {
+		t.Fatal(err)
+	}
+	limUser := fmt.Sprintf("lim_%d", time.Now().UnixNano())
+	_, err = pool.Exec(ctx, `INSERT INTO admin_accounts(username, password_hash, role_id) VALUES ($1,$2,$3)`,
+	limUser, string(hash), limitedRoleID)
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() {
+		_, _ = pool.Exec(ctx, `DELETE FROM admin_accounts WHERE username=$1`, limUser)
+		_, _ = pool.Exec(ctx, `DELETE FROM admin_roles WHERE id=$1`, limitedRoleID)
+	})
+	limTok := adminLogin(t, r, limUser, "limited-pass")
+	_, code = doAdminJSON(t, r, http.MethodGet, "/api/v1/admin/explore/star-configs", nil, limTok)
+	if code != http.StatusForbidden {
+		t.Fatalf("expected 403, got %d", code)
+	}
+
+	start := time.Now()
+	env, code := doAdminJSON(t, r, http.MethodGet, "/api/v1/admin/explore/star-configs", nil, tok)
+	if code != 200 || env.Code != 0 {
+		t.Fatalf("list http=%d msg=%s", code, env.Message)
+	}
+	if time.Since(start) > 500*time.Millisecond {
+		t.Fatalf("list too slow %v", time.Since(start))
+	}
+	var list struct {
+		Items []struct {
+			ID   string `json:"id"`
+			Code string `json:"code"`
+		} `json:"items"`
+	}
+	_ = json.Unmarshal(env.Data, &list)
+	var id string
+	for _, it := range list.Items {
+		if it.Code == "default_star" {
+			id = it.ID
+			break
+		}
+	}
+	if id == "" {
+		t.Fatalf("missing default_star: %#v", list.Items)
+	}
+	env, code = doAdminJSON(t, r, http.MethodGet, "/api/v1/admin/explore/star-configs/"+id, nil, tok)
+	if code != 200 {
+		t.Fatalf("get %d", code)
+	}
+	_, code = doAdminJSON(t, r, http.MethodGet, "/api/v1/admin/explore/star-configs/"+fakeUUID(), nil, tok)
+	if code != http.StatusNotFound {
+		t.Fatalf("expected 404, got %d", code)
+	}
+}
diff --git a/apps/api/internal/repository/star_config_repo.go b/apps/api/internal/repository/star_config_repo.go
new file mode 100644
index 0000000..6fc8d61
--- /dev/null
+++ b/apps/api/internal/repository/star_config_repo.go
@@ -0,0 +1,57 @@
+package repository
+
+import (
+	"context"
+	"errors"
+	"time"
+
+	"github.com/google/uuid"
+	"github.com/jackc/pgx/v5"
+)
+
+// StarConfigRow is StarConfig catalog row.
+type StarConfigRow struct {
+	ID uuid.UUID `json:"id"`
+	Code string `json:"code"`
+	Title string `json:"title"`
+	Active bool `json:"active"`
+	System bool `json:"system"`
+	UpdatedAt time.Time `json:"updated_at"`
+}
+
+// ListStarConfigs returns StarConfig catalog.
+func (r *AdminRepo) ListStarConfigs(ctx context.Context) ([]StarConfigRow, error) {
+	rows, err := r.Pool.Query(ctx, `
+		SELECT id, code, title, active, system, updated_at
+		FROM star_configs
+		ORDER BY active DESC, code ASC`)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	var out []StarConfigRow
+	for rows.Next() {
+		var row StarConfigRow
+		if err := rows.Scan(&row.ID, &row.Code, &row.Title, &row.Active, &row.System, &row.UpdatedAt); err != nil {
+			return nil, err
+		}
+		out = append(out, row)
+	}
+	return out, rows.Err()
+}
+
+// GetStarConfig loads one by id.
+func (r *AdminRepo) GetStarConfig(ctx context.Context, id uuid.UUID) (*StarConfigRow, error) {
+	var row StarConfigRow
+	err := r.Pool.QueryRow(ctx, `
+		SELECT id, code, title, active, system, updated_at
+		FROM star_configs WHERE id=$1`, id,
+	).Scan(&row.ID, &row.Code, &row.Title, &row.Active, &row.System, &row.UpdatedAt)
+	if errors.Is(err, pgx.ErrNoRows) {
+		return nil, err
+	}
+	if err != nil {
+		return nil, err
+	}
+	return &row, nil
+}
diff --git a/apps/api/internal/service/admin/rbac.go b/apps/api/internal/service/admin/rbac.go
index 81f9a6a..672aa95 100644
--- a/apps/api/internal/service/admin/rbac.go
+++ b/apps/api/internal/service/admin/rbac.go
@@ -31,6 +31,7 @@ const (
 	PermCrisisRead           = "admin.crisis.read"
 	PermCMSRead              = "admin.cms.read"
 	PermPrivacyRead = "admin.privacy.read"
+	PermExploreRead = "admin.explore.read"
 )
 
 var knownPermissions = map[string]struct{}{
@@ -40,7 +41,7 @@ var knownPermissions = map[string]struct{}{
 	PermUsersStatusWrite: {}, PermMembershipPlansRead: {}, PermMembershipPlansWrite: {},
 	PermMembershipCodesRead: {}, PermMembershipCodesWrite: {},
 	PermAskRead: {}, PermAskFeedbackWrite: {}, PermContentSafetyRead: {},
-	PermAIConfigRead: {}, PermCrisisRead: {}, PermCMSRead: {}, PermPrivacyRead: {},
+	PermAIConfigRead: {}, PermCrisisRead: {}, PermCMSRead: {}, PermExploreRead: {}, PermPrivacyRead: {},
 }
 
 var (
diff --git a/apps/api/internal/service/admin/star_config.go b/apps/api/internal/service/admin/star_config.go
new file mode 100644
index 0000000..393f178
--- /dev/null
+++ b/apps/api/internal/service/admin/star_config.go
@@ -0,0 +1,34 @@
+package admin
+
+import (
+	"context"
+	"errors"
+
+	"github.com/google/uuid"
+	"github.com/jackc/pgx/v5"
+
+	"github.com/yuxingu/digital-psychology/apps/api/internal/repository"
+)
+
+var ErrStarConfigNotFound = errString("star config not found")
+
+// ListStarConfigs returns catalog.
+func (s *Service) ListStarConfigs(ctx context.Context) ([]repository.StarConfigRow, error) {
+	items, err := s.Repo.ListStarConfigs(ctx)
+	if err != nil {
+		return nil, err
+	}
+	if items == nil {
+		items = []repository.StarConfigRow{}
+	}
+	return items, nil
+}
+
+// GetStarConfig loads one.
+func (s *Service) GetStarConfig(ctx context.Context, id uuid.UUID) (*repository.StarConfigRow, error) {
+	row, err := s.Repo.GetStarConfig(ctx, id)
+	if errors.Is(err, pgx.ErrNoRows) {
+		return nil, ErrStarConfigNotFound
+	}
+	return row, err
+}
diff --git a/apps/api/migrations/000036_star_configs.down.sql b/apps/api/migrations/000036_star_configs.down.sql
new file mode 100644
index 0000000..8dd3c76
--- /dev/null
+++ b/apps/api/migrations/000036_star_configs.down.sql
@@ -0,0 +1,2 @@
+DELETE FROM admin_role_permissions WHERE code = 'admin.explore.read';
+DROP TABLE IF EXISTS star_configs;
diff --git a/apps/api/migrations/000036_star_configs.up.sql b/apps/api/migrations/000036_star_configs.up.sql
new file mode 100644
index 0000000..b897743
--- /dev/null
+++ b/apps/api/migrations/000036_star_configs.up.sql
@@ -0,0 +1,23 @@
+-- ECR-035 StarConfig (read catalog)
+
+CREATE TABLE IF NOT EXISTS star_configs (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  code varchar(64) NOT NULL UNIQUE,
+  title varchar(128) NOT NULL,
+  active boolean NOT NULL DEFAULT true,
+  system boolean NOT NULL DEFAULT false,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  updated_at timestamptz NOT NULL DEFAULT now()
+);
+
+CREATE INDEX IF NOT EXISTS idx_star_configs_active ON star_configs(active);
+
+INSERT INTO star_configs(code, title, active, system)
+VALUES ('default_star', '默认星座配置', true, true)
+ON CONFLICT (code) DO NOTHING;
+
+INSERT INTO admin_role_permissions(role_id, code)
+SELECT r.id, 'admin.explore.read'
+FROM admin_roles r
+WHERE r.name = 'super_admin'
+ON CONFLICT DO NOTHING;
diff --git a/docs/BACKEND_DESIGN/BD-2026-035-star-config.md b/docs/BACKEND_DESIGN/BD-2026-035-star-config.md
new file mode 100644
index 0000000..942bfee
--- /dev/null
+++ b/docs/BACKEND_DESIGN/BD-2026-035-star-config.md
@@ -0,0 +1,23 @@
+# Backend Design: ECR-035 StarConfig
+
+| ID | BD-2026-035 |
+| Status | Approved |
+| Coding | Loop authorized |
+| Level | L2 |
+| Migration | YES 000036 |
+
+## Backend Change Boundary
+
+```text
+Domain: StarConfig (read)
+App: AdminHandler → admin.Service → AdminRepo
+API: GET /admin/explore/star-configs; GET /admin/explore/star-configs/{id}
+Permission: admin.explore.read
+Migration: 000036
+```
+
+## Out of boundary
+
+配置写发布 · 引擎改分层 · UGC · 真支付
+
+Rollback: down migration + remove routes/UI
diff --git a/docs/CHANGELOG.md b/docs/CHANGELOG.md
index fb87b6f..a49ed6d 100644
--- a/docs/CHANGELOG.md
+++ b/docs/CHANGELOG.md
@@ -2,6 +2,7 @@
 
 ## 2026-08-08
 
+- **ECR-035 Closed**：ExploreConfig StarConfig（migration 000036 · admin client · /explore/star-configs · 只读）  
 - **ECR-034 Closed**：AdminGovernance PrivacyRequest（migration 000035 · admin client · /privacy/requests · 只读）  
 - **ECR-033 Closed**：AskOperations HandoffCase（migration 000034 · admin client · /ask/handoffs · 只读）  
 - **ECR-032 Closed**：CrisisCare InterventionOutcome（migration 000033 · admin client · /crisis/interventions · 只读）  
diff --git a/docs/CODE_REVIEW/ECR-035.md b/docs/CODE_REVIEW/ECR-035.md
new file mode 100644
index 0000000..29caab4
--- /dev/null
+++ b/docs/CODE_REVIEW/ECR-035.md
@@ -0,0 +1,8 @@
+# CODE_REVIEW — ECR-035
+
+**Verdict:** Approve → Closed
+
+Date: 2026-08-08 · Loop continuous
+
+- StarConfig 只读；无 UGC/真支付  
+- Integration AC mapped · OpenAPI updated
diff --git a/docs/CONTRACT_DIFF/ECR-035.yaml b/docs/CONTRACT_DIFF/ECR-035.yaml
new file mode 100644
index 0000000..95919fc
--- /dev/null
+++ b/docs/CONTRACT_DIFF/ECR-035.yaml
@@ -0,0 +1,22 @@
+ecr: ECR-035
+capability: ExploreConfig
+bounded_context: Explore_Reports
+parent: WAVE0-FROZEN
+predecessor: ECR-034
+change:
+  type: additive
+breaking_change: false
+migration_required: true
+compatibility_notes: >
+  Adds StarConfig read catalog. Forbidden: UGC / real payment.
+
+apis:
+  - method: GET
+    path: /api/v1/admin/explore/star-configs
+    change: added
+  - method: GET
+    path: /api/v1/admin/explore/star-configs/{id}
+    change: added
+perms:
+  - code: admin.explore.read
+    change: added
diff --git a/docs/ECR/ECR-035-star-config.md b/docs/ECR/ECR-035-star-config.md
new file mode 100644
index 0000000..c3d3b40
--- /dev/null
+++ b/docs/ECR/ECR-035-star-config.md
@@ -0,0 +1,15 @@
+# ECR-035
+
+**Title:** ExploreConfig · StarConfig（只读薄切片）  
+**Status:** **Closed**  
+**Closed:** 2026-08-08（Loop continuous）  
+**Parent:** WAVE0-FROZEN · **Predecessor:** ECR-034 Closed  
+**Change Level:** L2  
+
+## Change
+
+StarConfig 只读 · migration 000036 · admin client · /explore/star-configs
+
+## Linked
+
+Spec `ops-star-config.md` · BD-2026-035 · CONTRACT_DIFF/ECR-035.yaml · TEST_REPORT/ECR-035.md
diff --git a/docs/ENGINEERING_SPEC/ECR-035-star-config.md b/docs/ENGINEERING_SPEC/ECR-035-star-config.md
new file mode 100644
index 0000000..23320e6
--- /dev/null
+++ b/docs/ENGINEERING_SPEC/ECR-035-star-config.md
@@ -0,0 +1,6 @@
+# ENGINEERING_SPEC — ECR-035
+
+1. migration 000036
+2. AdminRepo/Service/Handler
+3. OpenAPI + admin-h5
+4. Integration · Closed
diff --git a/docs/HANDOFF/ECR-035-architect-to-engineer.md b/docs/HANDOFF/ECR-035-architect-to-engineer.md
new file mode 100644
index 0000000..122b324
--- /dev/null
+++ b/docs/HANDOFF/ECR-035-architect-to-engineer.md
@@ -0,0 +1,3 @@
+# HANDOFF — ECR-035 Architect → Engineer
+
+Loop continuous · Approved + Coding. Migration 000036. Forbidden: UGC/真支付.
diff --git a/docs/HANDOFF/ECR-035-engineer-to-reviewer.md b/docs/HANDOFF/ECR-035-engineer-to-reviewer.md
new file mode 100644
index 0000000..c52bf81
--- /dev/null
+++ b/docs/HANDOFF/ECR-035-engineer-to-reviewer.md
@@ -0,0 +1,3 @@
+# HANDOFF — ECR-035 Engineer → Reviewer
+
+TestExploreStarConfigs PASS · Ready for Closed.
diff --git a/docs/PRODUCT_SPEC/ECR-035-star-config.md b/docs/PRODUCT_SPEC/ECR-035-star-config.md
new file mode 100644
index 0000000..ae2326c
--- /dev/null
+++ b/docs/PRODUCT_SPEC/ECR-035-star-config.md
@@ -0,0 +1,3 @@
+# PRODUCT_SPEC — ECR-035
+
+对齐 ops-star-config.md · Approved · Loop · L2 · StarConfig 只读
diff --git a/docs/STATE/ECR-035.md b/docs/STATE/ECR-035.md
new file mode 100644
index 0000000..ad18741
--- /dev/null
+++ b/docs/STATE/ECR-035.md
@@ -0,0 +1,6 @@
+# STATE — ECR-035
+
+| Status | **Closed** |
+| Phase | closed |
+| Spec | ops-star-config.md |
+| Updated | 2026-08-08 |
diff --git a/docs/TASKS/TASK-035-ECR035.yaml b/docs/TASKS/TASK-035-ECR035.yaml
new file mode 100644
index 0000000..1e1a8b9
--- /dev/null
+++ b/docs/TASKS/TASK-035-ECR035.yaml
@@ -0,0 +1,12 @@
+id: TASK-035-ECR035
+ecr: ECR-035
+title: ExploreConfig · StarConfig（只读薄切片）
+role: engineer
+status: closed
+change_level: L2
+parent: WAVE0-FROZEN
+predecessor: ECR-034
+acceptance:
+  - Spec AC mapped
+  - StarConfig read only
+  - No UGC / payment
diff --git a/docs/TEST_REPORT/ECR-035.md b/docs/TEST_REPORT/ECR-035.md
new file mode 100644
index 0000000..c23b3fc
--- /dev/null
+++ b/docs/TEST_REPORT/ECR-035.md
@@ -0,0 +1,33 @@
+# TEST_REPORT — ECR-035 StarConfig
+
+Date: 2026-08-08 · Loop continuous · commit: `PENDING`
+
+## Commands
+
+```bash
+cd apps/api && go test ./internal/integration/ -run TestExploreStarConfigs -count=1
+npm run build:admin
+python3 scripts/ess-validate.py --phase review --ecr ECR-035
+python3 scripts/ess-gate-check.py --ecr ECR-035
+```
+
+## Results
+
+| Check | Result |
+|-------|--------|
+| TestExploreStarConfigs | PASS |
+| build:admin | PASS |
+| ess-validate review | PASS |
+| ess-gate-check | PASS |
+
+## AC
+
+| ID | Evidence |
+|----|----------|
+| AC-F-01 | list seed/empty ok |
+| AC-F-02 | get 200 |
+| AC-F-03 | 未知 id → 404 |
+| AC-S-01 | 401 |
+| AC-S-02 | 403 |
+| AC-P-01 | list &lt; 500ms |
+| AC-O-01 | N/A 只读 |
diff --git a/docs/TRACEABILITY.md b/docs/TRACEABILITY.md
index 0514a80..a4fdf52 100644
--- a/docs/TRACEABILITY.md
+++ b/docs/TRACEABILITY.md
@@ -39,3 +39,4 @@
 | ECR-032 | CrisisCare · InterventionOutcome | **Closed** | Spec ops-intervention-outcome.md · BD-2026-032 · migration 000033 · TEST_REPORT · CODE_REVIEW · Loop continuous |
 | ECR-033 | AskOperations · HandoffCase | **Closed** | Spec ops-handoff-case.md · BD-2026-033 · migration 000034 · TEST_REPORT · CODE_REVIEW · Loop continuous |
 | ECR-034 | AdminGovernance · PrivacyRequest | **Closed** | Spec ops-privacy-request.md · BD-2026-034 · migration 000035 · TEST_REPORT · CODE_REVIEW · Loop continuous |
+| ECR-035 | ExploreConfig · StarConfig | **Closed** | Spec ops-star-config.md · BD-2026-035 · migration 000036 · TEST_REPORT · CODE_REVIEW · Loop continuous |
diff --git a/docs/WAVE0/LOOP_AUTHORIZATION.md b/docs/WAVE0/LOOP_AUTHORIZATION.md
index 46a334d..0db9dc6 100644
--- a/docs/WAVE0/LOOP_AUTHORIZATION.md
+++ b/docs/WAVE0/LOOP_AUTHORIZATION.md
@@ -55,4 +55,4 @@ Human 明文：**直接用 Loop，不用人工确认。**
 
 | Done | Next |
 |------|------|
-| ECR-013A…034 Closed | **ECR-035** StarConfig |
+| ECR-013A…035 Closed | **ECR-036** RhythmConfig |
diff --git a/proto/openapi.yaml b/proto/openapi.yaml
index 8c86faf..419c796 100644
--- a/proto/openapi.yaml
+++ b/proto/openapi.yaml
@@ -891,6 +891,34 @@ paths:
         '404':
           description: Not found
 
+  /api/v1/admin/explore/star-configs:
+    get:
+      tags: [admin]
+      summary: List StarConfig catalog
+      description: Requires admin.explore.read
+      responses:
+        '200':
+          description: OK
+        '401':
+          description: Unauthorized
+        '403':
+          description: Forbidden
+
+  /api/v1/admin/explore/star-configs/{id}:
+    get:
+      tags: [admin]
+      summary: Get StarConfig
+      parameters:
+        - in: path
+          name: id
+          required: true
+          schema: { type: string, format: uuid }
+      responses:
+        '200':
+          description: OK
+        '404':
+          description: Not found
+
   /api/v1/admin/crisis/policies:
     get:
       tags: [admin]