@furongjun1999/dsh-memory 0.4.5 → 0.4.6

package/md_cg/test_p43_pooling.py

@@ -233,17 +233,27 @@ def main():
 
         # ============================================== (8) 降权可复算
         print("\n(8) 硬约束二 · 降权显式可复算")
-        sc = {r[0]["id"]: round(r[1], 6) for r in on}
-        ok(sc["code_0"] == round(0.6 * 1.0, 6), f"(8) 索引类命中分 == 0.6（实得 {sc.get('code_0')}）")
-        ok(max(sc[f"kp_{i}"] for i in range(6)) == 1.0, "(8) 知识类命中分不被削")
+        # 降权断言与打分口径解耦：以关闭分池（权重恒 1.0）时同一条目的分数为 base，
+        # 断言 final == base × weight。口径由 legacy 切 jaccard 后 base ≠ 1.0，
+        # 但「乘数可复算」这一被测语义不变。
+        base = {r[0]["id"]: r[1] for r in off}
+        sc = {r[0]["id"]: r[1] for r in on}
+        ok(abs(sc["code_0"] - base.get("code_0", 0.0) * 0.6) < 1e-9,
+           f"(8) 索引类命中分 == 基础分 × 0.6（base={base.get('code_0', 0.0):.6f} → "
+           f"{sc.get('code_0', float('nan')):.6f}）")
+        common = [i for i in range(6) if f"kp_{i}" in base and f"kp_{i}" in sc]
+        ok(common and all(abs(sc[f"kp_{i}"] - base[f"kp_{i}"]) < 1e-9 for i in common),
+           f"(8) 知识类命中分不被削（权重 1.0；逐条比对 {len(common)} 条）")
         ok(PL.weight_of("code_x", {}, True) == PL.WEIGHTS["index"]["weight"],
            "(8) weight_of 与表内系数一致")
         alt = {"knowledge": {"cap_ratio": 0.5, "weight": 1.0},
                "index": {"cap_ratio": 0.4, "weight": 0.3},
                "negative": {"cap_ratio": 0.1, "weight": 0.5}}
         on2, _m2 = cg.search(QUERY, k=20, record=False, pools=alt)
-        sc2 = {r[0]["id"]: round(r[1], 6) for r in on2}
-        ok(sc2["code_0"] == 0.3, f"(8) 换表即换行为（实得 {sc2.get('code_0')}）")
+        sc2 = {r[0]["id"]: r[1] for r in on2}
+        ok(abs(sc2["code_0"] - base.get("code_0", 0.0) * 0.3) < 1e-9,
+           f"(8) 换表即换行为（base×0.3={base.get('code_0', 0.0) * 0.3:.6f} → "
+           f"{sc2.get('code_0', float('nan')):.6f}）")
         ok(PL.caps(10, PL.resolve(alt)) == {"knowledge": 4, "index": 4, "negative": 2},
            f"(8) 换表额度同步可复算（实得 {PL.caps(10, PL.resolve(alt))}）")
 

package/md_cg/test_p45_session_identity.py

@@ -0,0 +1,220 @@
+# -*- coding: utf-8 -*-
+"""md_cg · 第 45 篇：嵌套身份归因与会话切片（(harness, session) 不参与授权）
+
+设计口径（设计者，2026-09-11）：
+  · 唯一设计者 = 外部用户；被授权端 codebuddy / dsh / zcode 是本机三个进程，
+    权限域一致（同一最高权限），区别只在单元分工（工程内容）；
+  · 身份靠 (harness, session) 归因，而不是靠多令牌/多实例提权；
+  · 会话产物落薄卡（单例）的 session 维度切片 + 富索引指针，卡本身仍是单例。
+
+覆盖：
+  A Principal 归因字段（harness/unit/session；与授权正交）
+  B _normalize_session：DSH 形态 + 目录存在 → 采用；不存在 → anonymous；
+    非 DSH 形态 → 采用；根可配置（MDCG_DSH_SESSIONS_ROOT）
+  C _apply_attribution：MDCG_SESSION / DSH_SESSION_ID / MDCG_HARNESS / MDCG_UNIT
+  D self_state 会话切片：refresh(session=) 登记维度 / summary(session=) 回报 /
+    单例卡语义不变 / 不覆盖显式维度
+  E 会话要点：session_note 缺省用 Principal.session；recall 带回会话自我切片
+  F 审计归因：_audit.jsonl 条目带 harness/unit
+  G MCP 入口：_self_state_call 缺省会话透传 + index 快捷反查
+
+运行：python -m md_cg.test_p45_session_identity
+"""
+from __future__ import annotations
+
+import json
+import os
+import tempfile
+
+from .mdcos import MdCGOS, MdCGSecure
+from .security import Principal
+from . import self_state as ss
+from . import mcp_server as ms
+
+PASS = FAIL = 0
+FAILS = []
+
+
+def check(name, cond, detail=""):
+    global PASS, FAIL
+    if cond:
+        PASS += 1
+        print(f"  [PASS] {name}" + (f"  · {detail}" if detail else ""))
+    else:
+        FAIL += 1
+        FAILS.append(name)
+        print(f"  [FAIL] {name}  · {detail}")
+
+
+def _setenv(**kw):
+    old = {k: os.environ.get(k) for k in kw}
+    for k, v in kw.items():
+        if v is None:
+            os.environ.pop(k, None)
+        else:
+            os.environ[k] = v
+    return old
+
+
+def _restore(old):
+    for k, v in old.items():
+        if v is None:
+            os.environ.pop(k, None)
+        else:
+            os.environ[k] = v
+
+
+def main():
+    # ---------- A. Principal 归因字段 ----------
+    print("\n[A] Principal 归因字段（与授权正交）")
+    p0 = Principal(actor="a0")
+    check("A1 默认会话是进程随机 id", (p0.session or "").startswith("sess_"),
+          p0.session)
+    check("A2 harness/unit 默认为 None", p0.harness is None and p0.unit is None)
+    p1 = Principal(actor="a1", session="session-x", harness="dsh", unit="record",
+                   ops_allow=("read",))
+    d = p1.as_dict()
+    check("A3 as_dict 暴露 harness/unit/session",
+          d.get("harness") == "dsh" and d.get("unit") == "record"
+          and d.get("session") == "session-x")
+    check("A4 归因不影响授权（ops 仍按记录）",
+          p1.allows_op("read") and not p1.allows_op("write"))
+
+    # ---------- B. _normalize_session ----------
+    print("\n[B] 会话 id 归一与轻校验")
+    sdir = tempfile.mkdtemp(prefix="mdcg_p45_sess_")
+    # 人造 id：不得使用任何真实 DSH 会话 id，否则断言会依赖运行机器的磁盘现状
+    # （若该 id 恰好在 ~/.dsh/sessions 下存在，B5 的 fail-soft 断言会被偶然满足）。
+    sid = "session-deadbeef-6abc-4a71-a1f2-b658712be0fb"
+    os.makedirs(os.path.join(sdir, "--ws--", sid))
+    # 形态自检：id 若不满足 DSH 五段形态，B1/B5 会退化成「非 DSH 形态原样采用」
+    # 而仍然通过——断言落空且看不出来，故先钉死前提。
+    check("B0 测试用 id 满足 DSH 形态（防断言落空）", ms._is_dsh_session(sid))
+    old = _setenv(MDCG_DSH_SESSIONS_ROOT=sdir)
+    try:
+        check("B1 DSH 形态 + 目录存在 → 采用",
+              ms._normalize_session(sid) == sid)
+        check("B2 DSH 形态 + 目录不存在 → anonymous",
+              ms._normalize_session(
+                  "session-00000000-0000-0000-0000-000000000000") == "anonymous")
+        check("B3 非 DSH 形态 → 原样采用",
+              ms._normalize_session("dsl-web-main") == "dsl-web-main")
+        check("B4 空值 → anonymous", ms._normalize_session("") == "anonymous")
+    finally:
+        _restore(old)
+    # 必须显式指向「不存在的根」：若沿用默认根，在装了 DSH 的机器上根目录存在，
+    # 会落到「根可读但无该会话 → anonymous」分支，测不到 fail-soft（易假 PASS）。
+    old = _setenv(MDCG_DSH_SESSIONS_ROOT=os.path.join(sdir, "_no_such_root_"))
+    try:
+        check("B5 根不存在/不可读 → fail-soft（保留标记，不丢会话）",
+              ms._normalize_session(sid) == sid, "根不存在时不因环境差异丢弃会话标记")
+    finally:
+        _restore(old)
+
+    # ---------- C. _apply_attribution ----------
+    print("\n[C] 归因注入（MDCG_SESSION / DSH_SESSION_ID / HARNESS / UNIT）")
+    old = _setenv(MDCG_SESSION="dsl-web-main", DSH_SESSION_ID=None,
+                  MDCG_HARNESS="dsh", MDCG_UNIT="record")
+    try:
+        p = Principal(actor="a2")
+        ms._apply_attribution(p)
+        check("C1 MDCG_SESSION 优先", p.session == "dsl-web-main", p.session)
+        check("C2 harness/unit 注入",
+              p.harness == "dsh" and p.unit == "record")
+        # 原实现此处复述了 C1（测的仍是 MDCG_SESSION），未覆盖「后备不越权覆盖」。
+        old_dsh = _setenv(DSH_SESSION_ID="session-abc")
+        try:
+            pm = Principal(actor="a2b")
+            ms._apply_attribution(pm)
+            check("C3 两者并存时 MDCG_SESSION 优先（后备不覆盖）",
+                  pm.session == "dsl-web-main", pm.session)
+        finally:
+            _restore(old_dsh)
+    finally:
+        _restore(old)
+    old = _setenv(MDCG_SESSION=None, DSH_SESSION_ID="session-abc",
+                  MDCG_HARNESS=None, MDCG_UNIT=None)
+    try:
+        p = Principal(actor="a3")
+        ms._apply_attribution(p)
+        check("C4 无 MDCG_SESSION 时用 DSH_SESSION_ID",
+              p.session == "session-abc", p.session)
+        check("C5 无归因环境时保留进程随机 id",
+              (p := Principal()).session.startswith("sess_"))
+    finally:
+        _restore(old)
+
+    # ---------- D. self_state 会话切片 ----------
+    print("\n[D] 薄卡 + 会话维度切片（单例语义不变）")
+    root = tempfile.mkdtemp(prefix="mdcg_p45_")
+    SESS = ms._normalize_session("dsl-web-main")
+    cg = MdCGSecure(root, principal=Principal(
+        actor="dsh", session=SESS, harness="dsh", unit="record"))
+    r = cg.self_state_refresh(ss.DEFAULT_SUBJECT)
+    check("D1 refresh 缺省带会话维度",
+          bool(r.get("ok")) and SESS in (
+              (r.get("state") or {}).get("dimensions") or {}).get("session", []),
+          str(r.get("changed")))
+    card = cg.self_state_snapshot(ss.DEFAULT_SUBJECT)
+    check("D2 单例卡 id 未因会话改变",
+          card.get("node_id") == ss.state_node_id(ss.DEFAULT_SUBJECT))
+    summ = cg.self_state_summary(ss.DEFAULT_SUBJECT, session=SESS)
+    check("D3 summary 回报本会话已登记",
+          summ.get("session_registered") is True and summ.get("session") == SESS)
+    other = cg.self_state_summary(ss.DEFAULT_SUBJECT, session="session-other")
+    check("D4 其它会话未登记且指针为空",
+          other.get("session_registered") is False
+          and (other.get("session_refs") or {}).get("count") == 0)
+    r2 = cg.self_state_refresh(ss.DEFAULT_SUBJECT,
+                               dimensions={"session": ["manual-x"]})
+    dims = ((r2.get("state") or {}).get("dimensions") or {}).get("session", [])
+    check("D5 会话并入而不覆盖显式维度",
+          "manual-x" in dims and SESS in dims, str(dims))
+    check("D6 窄刷新仍以单例卡为准（同 subject 一张卡）",
+          cg.self_state_snapshot(ss.DEFAULT_SUBJECT).get("node_id")
+          == ss.state_node_id(ss.DEFAULT_SUBJECT))
+
+    # ---------- E. 会话要点 ----------
+    print("\n[E] 会话要点：缺省会话 = Principal.session")
+    n = cg.session_note("P45 会话要点：嵌套身份归因联调")
+    check("E1 session_note 缺省采用进程会话", n.get("session") == SESS,
+          str(n.get("session")))
+    rec = cg.session_recall(session=SESS, include_state=True)
+    check("E2 recall 命中本会话要点",
+          any(x.get("id") == n.get("id") for x in rec.get("notes") or []))
+    check("E3 recall 的自我状态带会话切片",
+          (rec.get("self_state") or {}).get("session") == SESS)
+
+    # ---------- F. 审计归因 ----------
+    print("\n[F] 审计归因（harness/unit 只入审计）")
+    with open(os.path.join(root, "_audit.jsonl"), encoding="utf-8") as f:
+        rows = [json.loads(x) for x in f if x.strip()]
+    last = rows[-1] if rows else {}
+    check("F1 审计条目带 harness", last.get("harness") == "dsh", str(last.get("op")))
+    check("F2 审计条目带 unit", last.get("unit") == "record")
+    check("F3 审计条目带会话", bool(last.get("session")))
+
+    # ---------- G. MCP 入口 ----------
+    print("\n[G] MCP 分发：会话缺省透传")
+    out = ms._self_state_call(cg, {"action": "summary"})
+    check("G1 summary 缺省取 Principal 会话",
+          out.get("session") == SESS and out.get("session_registered") is True)
+    idx = ms._self_state_call(cg, {"action": "index"})
+    check("G2 index 不传 dim → 按当前会话反查",
+          idx.get("dimension") == "session" and idx.get("value") == SESS,
+          str(idx.get("count")))
+    out2 = ms._self_state_call(cg, {"action": "refresh"})
+    check("G3 refresh 经 MCP 缺省登记会话",
+          bool(out2.get("ok")))
+
+    print("\n" + "=" * 68)
+    print(f"通过 {PASS} / 失败 {FAIL}")
+    if FAILS:
+        print("失败项：" + "，".join(FAILS))
+    print("=" * 68)
+    return FAIL
+
+
+if __name__ == "__main__":
+    import sys
+    sys.exit(1 if main() else 0)

package/md_cg/test_p46_unit_scope.py

@@ -0,0 +1,272 @@
+# -*- coding: utf-8 -*-
+"""md_cg · 第 46 篇：请求级单元收窄（单进程多身份 · as_unit）
+
+设计口径（2026-09-11）
+--------------------
+两个身份维度**职责分离**：
+  · env 身份（MDCG_TOKEN）—— 「谁装了这个大脑」，进程级恒定，是权限**上限**；
+  · 请求参数 `as_unit`  —— 「这一次调用以哪个单元执行」，请求级、可缺省。
+
+与第 45 篇不冲突：第 45 篇确立「不靠多令牌 / 多实例提权」；本篇是**单令牌内收窄**
+——`as_unit` 参与授权时**只做减法**（与 owner 求交 + 管理权恒 False），故伪造
+`as_unit` 的最坏结果等于不传，**不可能提权**。`unit` 字段本身仍是归因维度。
+
+`as_unit`（受限枚举，参与授权，未知值 fail-closed 报错）与 `unit`（自由文本，
+仅归因）职责分离：拼错单元名必须报错，**绝不静默退回 owner 全权**。
+
+覆盖
+----
+A narrowed_principal：单元 → ROLE_SPECS 收窄（层 / op / 密级 / 写权 / 管理权）
+B 不放大不变量：五单元逐一 can_admin=False；只读 owner 收不成可写；求交语义
+C fail-closed：未知单元报错；大小写 / 角色别名归一
+D call_tool 包装：as_unit 生效 / 调用后 principal 复原 / 非法值拒绝 / 缺省不变
+E 真实闸门联动：收窄后的 require_layer_write / require_op / require_admin 拦得住
+
+运行：python -m md_cg.test_p46_unit_scope
+"""
+import os
+import sys
+
+sys.path.insert(0, os.path.dirname(os.path.dirname(os.path.abspath(__file__))))
+
+from md_cg import mcp_server as ms
+from md_cg import tokens
+from md_cg.security import AccessDenied, Principal, _rank
+
+_N = {"pass": 0, "fail": 0}
+
+
+def check(name, cond, detail=""):
+    if cond:
+        _N["pass"] += 1
+        print(f"  PASS  {name}")
+    else:
+        _N["fail"] += 1
+        print(f"  FAIL  {name}" + (f"  <- {detail}" if detail else ""))
+
+
+def _designer(**kw):
+    """owner：设计者载体全权（模拟 env 身份 = MDCG_TOKEN 的权限域）。"""
+    base = dict(actor="dsh", role="designer", clearance="secret",
+                can_write=True, can_admin=True,
+                layers_allow=["*"], ops_allow=["*"])
+    base.update(kw)
+    return Principal(**base)
+
+
+def test_a_unit_scope():
+    print("[A] narrowed_principal 单元收窄")
+    p = _designer()
+    rec = tokens.narrowed_principal(p, "record")
+    check("A1 unit 与 role 均记为执行单元",
+          rec.unit == "record" and rec.role == "record",
+          f"unit={rec.unit} role={rec.role}")
+    check("A2 管理权被剥夺（单元永无管理权）", rec.can_admin is False)
+    check("A3 写权保留（record 可写）", rec.can_write is True)
+    check("A4 层白名单 = record spec（含 contextual，不含 self）",
+          rec.allows_layer("contextual") and not rec.allows_layer("self"),
+          f"layers={list(rec.layers_allow or ())}")
+    check("A5 op 白名单 = record spec（含 write，不含 verify）",
+          rec.allows_op("write") and not rec.allows_op("verify"),
+          f"ops={list(rec.ops_allow or ())}")
+    check("A6 密级被 spec 上限夹紧（secret -> internal）",
+          rec.clearance == "internal", f"clearance={rec.clearance}")
+
+    out = tokens.narrowed_principal(p, "output")
+    check("A7 output 只读（can_write False）", out.can_write is False)
+    check("A8 output 层白名单为空", not out.allows_layer("knowledge"))
+
+    sus = tokens.narrowed_principal(p, "sustain")
+    check("A9 sustain 仅可写 self 层",
+          sus.allows_layer("self") and not sus.allows_layer("knowledge"),
+          f"layers={list(sus.layers_allow or ())}")
+
+    ver = tokens.narrowed_principal(p, "verify")
+    check("A10 verify 可执行 verify op", ver.allows_op("verify"))
+    # 取证修正（2026-09-11）：verify.ops_allow **含** write（验证器要写裁决证据
+    # rejected/contextual），故「无 write op」是错误假设；真正的护栏在**层白名单**。
+    check("A11 verify 可写但仅限 rejected/contextual（不得写 knowledge）",
+          ver.allows_layer("rejected") and ver.allows_layer("contextual")
+          and not ver.allows_layer("knowledge"),
+          f"layers={list(ver.layers_allow or ())}")
+
+    ref = tokens.narrowed_principal(p, "reflect")
+    check("A14 reflect 仅可写 contextual（不得写 knowledge）",
+          ref.allows_layer("contextual") and not ref.allows_layer("knowledge"),
+          f"layers={list(ref.layers_allow or ())}")
+    check("A15 record 可写 knowledge 但不得写 self 层",
+          rec.allows_layer("knowledge") and not rec.allows_layer("self"))
+
+    check("A12 归因维度继承（actor/session/tenant 不变）",
+          rec.actor == p.actor and rec.session == p.session and rec.tenant == p.tenant)
+    check("A13 令牌溯源保留（token_id/parent 与 owner 一致）",
+          rec.token_id == p.token_id and rec.parent == p.parent)
+
+
+def test_b_no_escalation():
+    print("[B] 不放大不变量（核心安全论证）")
+    p = _designer()
+    for u in tokens.POSITION_ROLES:
+        n = tokens.narrowed_principal(p, u)
+        check(f"B1.{u} 管理权恒 False", n.can_admin is False)
+        check(f"B2.{u} 密级 <= owner",
+              _rank(n.clearance) <= _rank(p.clearance),
+              f"{n.clearance} vs {p.clearance}")
+
+    g = Principal(actor="g", role="guest", clearance="internal",
+                  can_write=False, can_admin=False, layers_allow=[], ops_allow=["read"])
+    for u in tokens.POSITION_ROLES:
+        check(f"B3.{u} 只读 owner 收不成可写",
+              tokens.narrowed_principal(g, u).can_write is False)
+
+    lim = _designer(ops_allow=["read"])
+    n = tokens.narrowed_principal(lim, "record")
+    check("B4 op 求交（owner 限 read -> 收窄后仍只有 read）",
+          n.allows_op("read") and not n.allows_op("write"),
+          f"ops={list(n.ops_allow or ())}")
+
+    lim2 = _designer(layers_allow=["knowledge"])
+    n2 = tokens.narrowed_principal(lim2, "record")
+    check("B5 层求交（owner 限 knowledge -> 不含 contextual）",
+          n2.allows_layer("knowledge") and not n2.allows_layer("contextual"),
+          f"layers={list(n2.layers_allow or ())}")
+
+    low = _designer(clearance="internal")
+    check("B6 密级不会因单元而上浮",
+          tokens.narrowed_principal(low, "record").clearance == "internal")
+
+    # 强 owner（*）经收窄后，对每个单元都不得比 owner 更宽
+    check("B7 收窄结果恒为 spec 与 owner 的并集下界（抽查 output/record 不相交扩张）",
+          not tokens.narrowed_principal(p, "output").allows_op("forget")
+          and not tokens.narrowed_principal(p, "record").allows_op("forget"))
+
+
+def test_c_failclosed():
+    print("[C] fail-closed 与归一")
+    p = _designer()
+    # 'root' / 'admin' 是 designer 的别名 -> 归一后不在五单元内 -> 必须拒绝
+    for bad in ("root", "admin", "designer", "", "   ", "recorder2", "executor"):
+        try:
+            tokens.narrowed_principal(p, bad)
+            check(f"C1 未知单元 {bad!r} 必须报错", False, "未抛 TokenError")
+        except tokens.TokenError:
+            check(f"C1 未知单元 {bad!r} 报错", True)
+    check("C2 大小写归一（RECORD -> record）",
+          tokens.narrowed_principal(p, "RECORD").unit == "record")
+    check("C3 角色别名归一（recorder -> record）",
+          tokens.narrowed_principal(p, "recorder").unit == "record")
+    check("C4 空白归一（' verify ' -> verify）",
+          tokens.narrowed_principal(p, " verify ").unit == "verify")
+    check("C5 verifier 别名归一（verifier -> verify）",
+          tokens.narrowed_principal(p, "verifier").unit == "verify")
+
+
+class _ProbeCG:
+    """最小 cg 替身：只供 call_tool 收窄 / 复原验证，不触碰磁盘。
+
+    字段恰好满足 `mdcg_service_info` 的读取需求
+    （root / actor / index["nodes"] / principal.as_dict()）。
+    """
+    root = "."
+    actor = "probe"
+    index = {"nodes": {}}
+
+    def __init__(self, principal):
+        self.principal = principal
+
+
+def test_d_call_tool_wrapper():
+    print("[D] call_tool 包装：生效 / 复原 / 拒绝")
+    owner = _designer()
+    cg = _ProbeCG(owner)
+
+    ok = ms.call_tool(cg, "mdcg_service_info", {"as_unit": "record"})
+    pr = (ok or {}).get("principal") or {}
+    check("D1 as_unit 生效（返回身份为执行单元）", pr.get("unit") == "record",
+          f"principal={pr}")
+    check("D2 收窄后管理权 False", pr.get("can_admin") is False)
+    check("D3 调用结束后 principal 复原（不泄漏到后续调用）",
+          cg.principal is owner)
+
+    nxt = ms.call_tool(cg, "mdcg_service_info", {})
+    pr2 = (nxt or {}).get("principal") or {}
+    check("D4 缺省 as_unit 不改身份（等价改动前行为）",
+          pr2.get("unit") is None and pr2.get("can_admin") is True,
+          f"principal={pr2}")
+
+    bad = ms.call_tool(cg, "mdcg_service_info", {"as_unit": "root"})
+    check("D5 非法 as_unit fail-closed",
+          isinstance(bad, dict) and bad.get("ok") is False
+          and "as_unit" in str(bad.get("error", "")), f"resp={bad}")
+    check("D6 非法 as_unit 不改变 principal", cg.principal is owner)
+
+    # 空串 / 纯空白视为「未声明」，走 owner 全权（不报错）
+    for blank in ("", "   "):
+        r = ms.call_tool(cg, "mdcg_service_info", {"as_unit": blank})
+        pr3 = (r or {}).get("principal") or {}
+        check(f"D7 空白 as_unit={blank!r} 视为缺省",
+              pr3.get("unit") is None and cg.principal is owner)
+
+
+def test_e_gates():
+    print("[E] 真实权限闸门联动（收窄后确实拦得住）")
+    p = _designer()
+    rec = tokens.narrowed_principal(p, "record")
+
+    rec.require_layer_write("contextual", "internal")
+    check("E1 record 可写 contextual", True)
+
+    try:
+        rec.require_layer_write("self", "internal")
+        check("E2 record 不可写 self 层", False, "未抛 AccessDenied")
+    except AccessDenied:
+        check("E2 record 不可写 self 层", True)
+
+    try:
+        rec.require_admin("forget")
+        check("E3 record 无管理权", False, "未抛 AccessDenied")
+    except AccessDenied:
+        check("E3 record 无管理权", True)
+
+    try:
+        rec.require_op("verify")
+        check("E4 record 不可执行 verify op", False, "未抛 AccessDenied")
+    except AccessDenied:
+        check("E4 record 不可执行 verify op", True)
+
+    out = tokens.narrowed_principal(p, "output")
+    try:
+        out.require_write("internal")
+        check("E5 output 不可写", False, "未抛 AccessDenied")
+    except AccessDenied:
+        check("E5 output 不可写", True)
+
+    rec.require_op("read")
+    check("E6 record 仍可读（未误伤读路径）", True)
+
+    sus = tokens.narrowed_principal(p, "sustain")
+    sus.require_layer_write("self", "internal")
+    check("E7 sustain 可写 self（互维维护路径未被误伤）", True)
+    try:
+        sus.require_layer_write("knowledge", "internal")
+        check("E8 sustain 不可写 knowledge", False, "未抛 AccessDenied")
+    except AccessDenied:
+        check("E8 sustain 不可写 knowledge", True)
+
+
+def main():
+    print("=" * 68)
+    print("md_cg 第 46 篇 · 请求级单元收窄（as_unit）—— 单进程多身份")
+    print("=" * 68)
+    test_a_unit_scope()
+    test_b_no_escalation()
+    test_c_failclosed()
+    test_d_call_tool_wrapper()
+    test_e_gates()
+    print("-" * 68)
+    print(f"PASS {_N['pass']} / FAIL {_N['fail']}")
+    return 1 if _N["fail"] else 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())

package/md_cg/tokens.py

@@ -376,6 +376,42 @@ def derive(parent_token: str, role: str, actor: str = None, ttl: float = None,
             "expires_at": rec["expires_at"]}
 
 
+def narrowed_principal(p: Principal, unit: str) -> Principal:
+    """按「单元」收窄 principal 权限（**请求级**身份，只能变小不能变大）。
+
+    与 `derive()` 同源——复用 `_narrow()` 求交语义——但**不签发令牌**，只在
+    单次 MCP 调用内生效（见 `mcp_server.call_tool` 的 `as_unit` 参数）。
+    动机：单进程多身份。MCP 子进程的 env 身份（令牌）只回答「谁装了这个
+    大脑」；而**这一次调用**该以哪个单元执行，由请求参数决定。
+
+    硬约束（调用方无法绕过）：
+      · `can_admin` 恒为 False —— 任何单元都拿不到管理权（改不了大脑结构）；
+      · clearance / layers / ops 一律与 owner **求交** → 结果 ≤ owner 权限；
+      · `can_write` 与 owner 取「与」 —— owner 只读时单元不可能变可写。
+
+    因为收窄是单调的，调用方伪造 `as_unit` 的最坏结果等于不传（owner 全权），
+    **不可能提权** —— 这是本机制不需要对 `as_unit` 额外鉴权的根据。
+
+    unit 不在 `POSITION_ROLES`（五单元）内 → `TokenError`（fail-closed：
+    拼错单元名必须报错，绝不静默退回 owner 全权）。
+    """
+    u = normalize_role(unit)
+    if u not in POSITION_ROLES:
+        raise TokenError(f"未知单元：{unit!r}（可选 {list(POSITION_ROLES)}）")
+    spec = role_spec(u)
+    return Principal(
+        tenant=p.tenant, actor=p.actor, session=p.session, harness=p.harness,
+        unit=u, role=u,
+        clearance=_clamp_level(spec["clearance_cap"], p.clearance),
+        can_write=bool(spec["can_write"]) and bool(p.can_write),
+        can_admin=False,
+        layers_allow=_narrow(spec["layers_allow"], p.layers_allow),
+        ops_allow=_narrow(spec["ops_allow"], p.ops_allow),
+        token_id=p.token_id, parent=p.parent, expires_at=p.expires_at,
+        auth_mode=p.auth_mode,
+        theory_ok=p.theory_ok, theory_version=p.theory_version)
+
+
 def revoke(token_id: str, path: str = None):
     data = _load(path)
     rec = (data.get("tokens") or {}).get(token_id)

package/md_cg/whitebox_kb/aeis_core/core.py

@@ -4979,7 +4979,11 @@ class SpacetimeMemoryEngine:
         检索时命中相似节点会附「这两个的区别」提示——细化条件得到精确知识。"""
         try:
             import sys as _s
-            _kb = r'D:\Program Files\2_ai\knowledge-base'
+            # knowledge-base 为可选增强库（与本仓库同级）；可用 LINGSHU_KB 显式指定
+            _repo = os.path.dirname(os.path.dirname(os.path.dirname(
+                os.path.dirname(os.path.abspath(__file__)))))
+            _kb = os.environ.get("LINGSHU_KB") or os.path.join(
+                os.path.dirname(_repo), "knowledge-base")
             if _kb not in _s.path:
                 _s.path.insert(0, _kb)
             from pattern_separation import PatternSeparation
@@ -4996,7 +5000,11 @@ class SpacetimeMemoryEngine:
         不代表真实发生的过去就是如此（0.0.3 局部不可知）。"""
         try:
             import sys as _s
-            _kb = r'D:\Program Files\2_ai\knowledge-base'
+            # knowledge-base 为可选增强库（与本仓库同级）；可用 LINGSHU_KB 显式指定
+            _repo = os.path.dirname(os.path.dirname(os.path.dirname(
+                os.path.dirname(os.path.abspath(__file__)))))
+            _kb = os.environ.get("LINGSHU_KB") or os.path.join(
+                os.path.dirname(_repo), "knowledge-base")
             if _kb not in _s.path:
                 _s.path.insert(0, _kb)
             from scene_reconstruction import SceneReconstruction