@hongmaple0820/scale-engine 0.20.0 → 0.21.1

package/examples/demo-projects/agent-governance-demo/README.md

@@ -1,37 +1,48 @@
 # Agent Governance Demo
 
-这是 SCALE Engine 的最小官方 demo 项目，用来演示 Agent 如何在治理工作流下完成一个安全敏感任务。
+这是 SCALE Engine 的最小官方 demo 项目，用一个 OAuth state 校验场景展示 Agent 工程治理如何落到真实代码、测试、证据和报告里。
 
-业务场景：OAuth callback 必须拒绝过期、已消费或不匹配的 state。
+业务目标很小：OAuth callback 必须拒绝缺失、过期、已消费或不匹配的 state。
 
-## 运行
+治理目标更重要：Agent 不能只说“我完成了”，必须留下可验证证据。
+
+## 快速运行
 
 ```bash
 npm install
 npm test
 ```
 
-## 接入 SCALE
+## 一键治理烟测
+
+```bash
+npm run workflow:smoke
+```
+
+这个命令会依次运行：
+
+- `npm test`：验证业务行为。
+- `scale eval run --dir .`：运行工作流基线评测。
+- `scale context budget --dir .`：检查上下文预算，避免无节制读取。
+- `scale artifact dashboard --dir . --lang zh`：生成本地治理 HTML 看板。
+
+## 适合演示的 SCALE 命令
 
 ```bash
-scale init --governance-pack node-library
-scale preflight --preflight-profile quick
-scale context init --name "Agent Governance Demo"
-scale runtime start --session-id 2026-05-18-oauth-state --task-id 2026-05-18-oauth-state --level M --agent codex
-scale context grill --task-id 2026-05-18-oauth-state --task "加固 OAuth state 校验"
-scale diagnose plan --task-id 2026-05-18-oauth-state --symptom "OAuth callback 在 state 过期或不匹配时行为不明确"
-scale tdd slice --task-id 2026-05-18-oauth-state --behavior "拒绝过期、已消费或不匹配的 OAuth state" --public-interface "verifyOAuthState(record, providedState, now)" --failing-test "expired, consumed, mismatched state should return ok=false" --test-file tests/oauth-state.test.ts --impl-files src/oauth-state.ts
-scale runtime record --title "demo business tests" --kind command --status passed --command "npm test" --exit-code 0 --summary "official demo OAuth state tests passed"
-scale runtime final-check --task-id 2026-05-18-oauth-state --session-id 2026-05-18-oauth-state --level M
-scale memory pack --task-id 2026-05-18-oauth-state --session-id 2026-05-18-oauth-state --task "加固 OAuth state 校验" --level M --budget 4000
-scale memory settle --task-id 2026-05-18-oauth-state --session-id 2026-05-18-oauth-state --task "加固 OAuth state 校验" --level M
-scale artifact render --task-id 2026-05-18-oauth-state --artifact-dir docs/worklog/tasks/2026-05-18-oauth-state
-scale artifact doctor --artifact-dir docs/worklog/tasks/2026-05-18-oauth-state
+scale governance mode --task "修复 OAuth state 校验绕过问题" --files "src/oauth-state.ts,tests/oauth-state.test.ts"
+scale skill radar --dir . --task "修复 OAuth state 校验绕过问题" --phase verify --level M --files "src/oauth-state.ts,tests/oauth-state.test.ts"
+scale codegraph status --dir .
+scale eval run --dir .
+scale artifact dashboard --dir . --lang zh
 ```
 
-## 看点
+## 观察点
+
+- `src/oauth-state.ts` 保持很小，便于核对 Agent 是否过度设计。
+- `tests/oauth-state.test.ts` 覆盖成功、缺失、过期、已消费和不匹配 state。
+- `CONTEXT.md` 和 `docs/CONTEXT-MAP.md` 只提供必要上下文，避免 demo 自己变成 token 污染源。
+- `.scale/evals/suites/workflow-baseline.json` 可由 `scale eval init --dir .` 重新生成。
 
-- 业务逻辑很小，但风险边界明确。
-- 测试覆盖成功、过期、已消费、不匹配和缺失记录。
-- SCALE 命令会生成任务证据、运行证据、记忆候选和 HTML 交付视图，避免 Agent 只口头说“已完成”。
+## 这不是业务模板
 
+这个 demo 不是 OAuth 产品模板，而是治理闭环模板。真实项目接入时，应保留 SCALE 的证据、评测、上下文预算和看板机制，再替换成自己的业务代码、服务矩阵和验证脚本。

package/examples/demo-projects/agent-governance-demo/docs/CONTEXT-MAP.md

@@ -0,0 +1,14 @@
+# CONTEXT-MAP.md
+
+Project: Agent Governance Demo
+
+| Module | Owner | Product Doc | Architecture Doc |
+| --- | --- | --- | --- |
+| OAuth state verifier | SCALE demo | `README.md` | `src/oauth-state.ts` |
+| Workflow evidence | SCALE demo | `README.md` | `.scale/evals/suites/workflow-baseline.json` |
+
+## Cross-Module Rules
+
+- Behavior changes in `src/oauth-state.ts` must update `tests/oauth-state.test.ts`.
+- Workflow command changes must update `README.md`.
+- Generated reports under `.scale/reports/` are review artifacts, not source of truth.

package/examples/demo-projects/agent-governance-demo/package.json

@@ -6,9 +6,14 @@
   "scripts": {
     "build": "tsc --noEmit --module NodeNext --moduleResolution NodeNext --target ES2022 src/oauth-state.ts tests/oauth-state.test.ts",
     "lint": "tsc --noEmit --module NodeNext --moduleResolution NodeNext --target ES2022 src/oauth-state.ts tests/oauth-state.test.ts",
-    "test": "vitest run"
+    "test": "vitest run",
+    "scale:eval": "scale eval run --dir .",
+    "scale:budget": "scale context budget --dir .",
+    "scale:dashboard": "scale artifact dashboard --dir . --lang zh",
+    "workflow:smoke": "npm test && npm run scale:eval && npm run scale:budget && npm run scale:dashboard"
   },
   "devDependencies": {
+    "@hongmaple0820/scale-engine": "^0.20.0",
     "typescript": "^5.5.0",
     "vitest": "^2.1.9"
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hongmaple0820/scale-engine",
-  "version": "0.20.0",
+  "version": "0.21.1",
   "description": "Executable AI agent governance with workflow gates, evidence, skill/tool orchestration, and traceable HTML artifacts",
   "type": "module",
   "bin": {
@@ -25,6 +25,7 @@
     "docs/GOVERNANCE_DASHBOARD.md",
     "docs/MEMORY_FABRIC.md",
     "docs/RUNTIME_EVIDENCE.md",
+    "docs/RESOURCE_GOVERNANCE.md",
     "docs/start",
     "examples/demo-projects/agent-governance-demo"
   ],