@lqc123qwe/car-runtime 1.0.0-rc.1

package/test/s2.spec.ts

@@ -0,0 +1,245 @@
+import { test } from 'node:test'
+import assert from 'node:assert/strict'
+import { declareEvent, EventBus } from '../src/kernel/events.ts'
+import { runTurn, type ModelStep, type ToolDef, type ToolCall } from '../src/loop/stop.ts'
+import { SessionLog } from '../src/session/log.ts'
+import { mountPlugin, parseManifest } from '../src/load/loader.ts'
+import { writeFileSync, rmSync } from 'node:fs'
+
+// ==================== F7 事件分发契约 ====================
+
+test('F7: 未声明事件的订阅 = 启动期静态报错（US-7 AC2）', () => {
+  const bus = new EventBus()
+  assert.throws(() => bus.on('undeclared/event', () => {}), /undeclared event/)
+})
+
+test('F7: bail 模式——首断即止（短路是设计意图）', async () => {
+  declareEvent('guard/check', 'bail')
+  const bus = new EventBus()
+  const calls: string[] = []
+  bus.on('guard/check', () => { calls.push('h1'); return 'BLOCK' })
+  bus.on('guard/check', () => { calls.push('h2'); return 'BLOCK2' })
+  const r = await bus.dispatch('guard/check', {})
+  assert.equal(r, 'BLOCK')
+  assert.deepEqual(calls, ['h1'])
+})
+
+test('F7: serial 模式——有序检查点链式传值', async () => {
+  declareEvent('ctx/enrich', 'serial')
+  const bus = new EventBus()
+  bus.on('ctx/enrich', (_p: unknown, next: () => string) => next() + '!A')
+  bus.on('ctx/enrich', (_p: unknown, next: () => string) => next() + '!B')
+  assert.equal(await bus.dispatch<string>('ctx/enrich', 'x', () => 'base'), 'base!A!B')
+})
+
+test('F7: waterfall 模式——环绕中间件（next() 前后均可介入）', async () => {
+  declareEvent('tools/around', 'waterfall')
+  const bus = new EventBus()
+  const trace: string[] = []
+  bus.on('tools/around', async (_p: unknown, next: () => Promise<string>) => {
+    trace.push('before')
+    const r = await next()
+    trace.push('after')
+    return r.toUpperCase()
+  })
+  bus.on('tools/around', () => Promise.resolve('raw'))
+  const r = await bus.dispatch<string>('tools/around', {})
+  assert.equal(r, 'RAW')
+  assert.deepEqual(trace, ['before', 'after'])
+})
+
+test('F7: parallel 模式扇出聚合；emit 模式广播无返回', async () => {
+  declareEvent('audit/fanout', 'parallel')
+  declareEvent('lifecycle/notify', 'emit')
+  const bus = new EventBus()
+  bus.on('audit/fanout', (p: number) => p * 2)
+  bus.on('audit/fanout', (p: number) => p * 3)
+  assert.deepEqual(await bus.dispatch<number, number>('audit/fanout', 5), [10, 15])
+  const seen: number[] = []
+  bus.on('lifecycle/notify', () => { seen.push(1) })
+  assert.equal(await bus.dispatch('lifecycle/notify', {}), undefined)
+  assert.deepEqual(seen, [1])
+})
+
+test('F7: 契约重复声明且模式不一致 = 显式报错', () => {
+  declareEvent('dup/e', 'serial')
+  assert.throws(() => declareEvent('dup/e', 'bail'), /re-declared/)
+})
+
+// ==================== F5 停止语义（ADR-001） ====================
+
+test('F5 AC1: 工具批次 → step null 续走，无异常', async () => {
+  const log = new SessionLog()
+  let n = 0
+  const tools = new Map([['t', { declaredSideEffect: 'readonly', run: async () => 'ok' } as ToolDef]])
+  const r = await runTurn({
+    log, turnId: 'T', tools,
+    model: async (): Promise<ModelStep> => n++ === 0
+      ? { stopReason: 'toolUse', toolCalls: [{ id: 'c1', tool: 't', args: {} }] }
+      : { stopReason: 'stop', text: 'done' },
+  })
+  assert.equal(r.reason, 'completed')
+  const kinds = log.events.map(e => e.kind)
+  assert.ok(kinds.includes('toolCall') && kinds.includes('toolResult'))
+})
+
+test('F5 AC2: step1 max-tokens + steering 续跑 → turn/end 保留 max-tokens（不被冲销）', async () => {
+  const log = new SessionLog()
+  let n = 0
+  const r = await runTurn({
+    log, turnId: 'T',
+    model: async (): Promise<ModelStep> => n++ === 0 ? { stopReason: 'length' } : { stopReason: 'stop', text: 'recovered' },
+  })
+  assert.equal(r.reason, 'max-tokens')
+  const end = log.events.find(e => e.kind === 'turnEnd') as any
+  assert.equal(end.meta.reason, 'max-tokens')
+})
+
+test('F5 AC3: 截断响应含写工具 → 解析前收口（无副作用落地）', async () => {
+  const log = new SessionLog()
+  let executed = false
+  const tools = new Map([['writeFile', { declaredSideEffect: 'write', run: async () => { executed = true } } as ToolDef]])
+  const r = await runTurn({
+    log, turnId: 'T', tools,
+    model: async (): Promise<ModelStep> => ({ stopReason: 'length', truncatedTools: [{ id: 'c1', tool: 'writeFile' }] }),
+  })
+  assert.equal(r.reason, 'max-tokens')
+  assert.equal(executed, false)
+})
+
+test('F5 AC4: 只读白名单 + retryReadOnly → 补错重试（Pi 式）', async () => {
+  const log = new SessionLog()
+  let n = 0
+  const tools = new Map([['search', { declaredSideEffect: 'readonly', run: async () => 'results' } as ToolDef]])
+  const r = await runTurn({
+    log, turnId: 'T', tools,
+    preset: { maxTokensRetryReadOnly: true },
+    model: async (): Promise<ModelStep> => {
+      if (n++ === 0) return { stopReason: 'length', truncatedTools: [{ id: 'c1', tool: 'search' }] }
+      return { stopReason: 'stop', text: 'done' }
+    },
+  })
+  // I4 一致性：即便只读重试续走，turn/end 仍保留 max-tokens（与 AC2 同语义）
+  assert.equal(r.reason, 'max-tokens')
+  assert.equal(r.steps, 2, '重试后续走了一个 step')
+  const err = log.events.find(e => e.kind === 'toolResult' && JSON.stringify((e.payload as any)?.error || '').includes('truncated'))
+  assert.ok(err, '只读工具收到截断错误结果')
+})
+
+test('F5: 取消 → 未派发调用补记成对事件，reason=aborted（日志无缺口）', async () => {
+  const log = new SessionLog()
+  const signal = { aborted: false }
+  let i = 0
+  const tools = new Map([['t1', { declaredSideEffect: 'readonly', run: async () => { if (++i === 1) signal.aborted = true; return 'x' } } as ToolDef]])
+  const r = await runTurn({
+    log, turnId: 'T', tools, signal,
+    model: async (): Promise<ModelStep> => ({ stopReason: 'toolUse', toolCalls: [
+      { id: 'c1', tool: 't1', args: {} }, { id: 'c2', tool: 't1', args: {} },
+    ] }),
+  })
+  assert.equal(r.reason, 'aborted')
+  // 日志无缺口：c2 的 toolCall 与合成错误 toolResult 成对存在
+  const c2call = log.events.some(e => e.kind === 'toolCall' && (e.payload as any).id === 'c2')
+  const c2result = log.events.some(e => e.kind === 'toolResult' && (e.payload as any).id === 'c2' && (e.payload as any).error === 'aborted-before-dispatch')
+  assert.ok(c2call && c2result, '未派发调用补记成对事件')
+})
+
+test('F5: concludesTurn=OR——任一工具收口即 completed', async () => {
+  const log = new SessionLog()
+  const tools = new Map([
+    ['commit', { declaredSideEffect: 'write', concludesTurn: true, run: async () => 'committed' } as ToolDef],
+    ['probe', { declaredSideEffect: 'readonly', run: async () => 'p' } as ToolDef],
+  ])
+  const r = await runTurn({
+    log, turnId: 'T', tools, preset: { mode: 'full' },
+    model: async (): Promise<ModelStep> => ({ stopReason: 'toolUse', toolCalls: [
+      { id: 'c1', tool: 'probe', args: {} }, { id: 'c2', tool: 'commit', args: {} },
+    ] }),
+  })
+  assert.equal(r.reason, 'completed')
+})
+
+test('F5: terminate=AND——整批全部 terminate 才 aborted；权限门拒绝写操作', async () => {
+  const log = new SessionLog()
+  const tools = new Map([
+    ['danger', { declaredSideEffect: 'write', terminate: true, run: async () => 'never' } as ToolDef],
+  ])
+  let authorizeCalled = false
+  let n = 0
+  const r = await runTurn({
+    log, turnId: 'T', tools,
+    preset: { mode: 'confirm', authorize: async () => { authorizeCalled = true; return false } },
+    model: async (): Promise<ModelStep> => n++ === 0
+      ? { stopReason: 'toolUse', toolCalls: [{ id: 'c1', tool: 'danger', args: {} }] }
+      : { stopReason: 'stop', text: 'acknowledged' },
+  })
+  assert.equal(r.reason, 'completed') // 单工具被拒后无收口信号 → 模型继续 → stop
+  assert.equal(authorizeCalled, true)
+  const denied = log.events.some(e => e.kind === 'toolResult' && (e.payload as any)?.error === 'authorization-denied')
+  assert.ok(denied, '拒绝记录落日志')
+})
+
+// ==================== F6 装配层（Stub/invalidate/manifest） ====================
+
+test('F6: manifest 校验——version 非精确 semver = 冲突链报错', () => {
+  assert.throws(() => parseManifest({ name: 'p', version: '^1.0.0' }, 'plugin.ts'), /exact semver.*plugin\.ts/)
+  assert.throws(() => parseManifest({ version: '1.0.0' }, 'plugin.ts'), /"name" is required/)
+  assert.throws(() => parseManifest({ name: 'p', version: '1.0.0', peerPolicyOverride: { relaxed: true } as any }, 'm.ts'), /reason.*required/)
+  const ok = parseManifest({ name: 'p', version: '1.0.0' }, 'm.ts')
+  assert.equal(ok.name, 'p')
+})
+
+test('F6: Stub 占位——bindCore 前调用显式抛错，bind 后可用；invalidate 后再访问报错', async () => {
+  const file = new URL('./fixture-plugin.ts', import.meta.url).pathname.replace(/^\/([A-Za-z]:)/, '$1')
+  writeFileSync(file, `export default function apply(api) {\n  api.registerTool({ name: 'tool-v1', run: async () => 'v1' })\n}\n`)
+  try {
+    const p = await mountPlugin({ file, manifest: { name: 'hot', version: '1.0.0' } })
+    // 注册类动作 Stub 期可用（收集待注册项）；能力查询 bind 前显式抛错
+    assert.throws(() => p.api.getRegisteredTools(), /CAR-STUB/)
+    const hostTools: Array<{ name: string }> = []
+    p.bindCore({
+      registerTool: (t) => { hostTools.push(t) },
+      getRegisteredTools: () => hostTools,
+    })
+    // bind 后冲刷 pending 注册
+    assert.deepEqual(p.api.getRegisteredTools().map((t) => t.name), ['tool-v1'])
+    assert.deepEqual(hostTools.map((t) => t.name), ['tool-v1'])
+    p.invalidate()
+    assert.throws(() => p.api.getRegisteredTools(), /CAR-INVALIDATED/)
+  } finally { try { rmSync(file, { force: true }) } catch {} }
+})
+
+test('F6: 热重载——同文件 epoch 击穿缓存，新代码生效 + 旧句柄失效', async () => {
+  const file = new URL('./fixture-reload.ts', import.meta.url).pathname.replace(/^\/([A-Za-z]:)/, '$1')
+  let p1: Awaited<ReturnType<typeof mountPlugin>> | undefined
+  try {
+    writeFileSync(file, `export default function apply(api) { api.registerTool({ name: 'tool-v1', run: async () => 1 }) }\n`)
+    p1 = await mountPlugin({ file, manifest: { name: 'r', version: '1.0.0' } })
+    p1.bindCore({
+      registerTool(t: { name: string }) {},
+      getRegisteredTools: () => [{ name: 'tool-v1' }],
+    })
+    assert.deepEqual(p1.api.getRegisteredTools(), [{ name: 'tool-v1' }])
+    // 重写源文件 → epoch+1 重载
+    writeFileSync(file, `export default function apply(api) { api.registerTool({ name: 'tool-v2', run: async () => 2 }) }\n`)
+    const p2 = await mountPlugin({ file, manifest: { name: 'r', version: '1.0.1' }, reloadEpoch: 1 })
+    p2.bindCore({
+      registerTool(t: { name: string }) {},
+      getRegisteredTools: () => [{ name: 'tool-v2' }],
+    })
+    assert.deepEqual(p2.api.getRegisteredTools(), [{ name: 'tool-v2' }])
+    p1.invalidate()
+    assert.throws(() => p1!.api.getRegisteredTools(), /CAR-INVALIDATED/)
+  } finally {
+    try { rmSync(file, { force: true }) } catch {}
+    void p1
+  }
+})
+
+test('F6: 非工厂默认导出 = 冲突链报错', async () => {
+  const file = new URL('./fixture-bad.ts', import.meta.url).pathname.replace(/^\/([A-Za-z]:)/, '$1')
+  writeFileSync(file, `export default 42\n`)
+  try {
+    await assert.rejects(() => mountPlugin({ file, manifest: { name: 'b', version: '1.0.0' } }), /default-export a factory/)
+  } finally { try { rmSync(file, { force: true }) } catch {} }
+})

package/test/s3.spec.ts

@@ -0,0 +1,179 @@
+import { test } from 'node:test'
+import assert from 'node:assert/strict'
+import { probeCapabilities, SandboxExecutor } from '../src/sandbox/sandbox.ts'
+import { AuthzService, checkCapability } from '../src/authz/authz.ts'
+import { McpGateway, containsPlaintextCredential, type McpTransport, type JsonRpcRequest, type JsonRpcResponse } from '../src/mcp/gateway.ts'
+import { SessionLog } from '../src/session/log.ts'
+
+// ==================== F3 沙箱：探测/降级/Q-04 约束 ====================
+
+test('F3: Windows 平台探测 → 显式降级（BD-01，经中间确认② Linux 先行）', async () => {
+  const probe = await probeCapabilities({ platform: 'win32' })
+  assert.equal(probe.degraded, true)
+  assert.ok(probe.reason)
+})
+
+test('F3: Linux 无 landlock-run 二进制 → 探测失败降级（容器环境同路径）', async () => {
+  const probe = await probeCapabilities({ platform: 'linux' })
+  assert.equal(probe.degraded, true)
+  assert.match(probe.reason!, /landlock-run/)
+})
+
+test('F3 Q-04: 降级态 env-read 一律拒绝（DENIED，不进审批）', async () => {
+  const events: any[] = []
+  const exec = new SandboxExecutor({
+    probe: { platform: 'win32', landlock: false, seccomp: false, degraded: true, reason: 'test' },
+    audit: (e) => events.push(e),
+    workspace: process.cwd(),
+  })
+  const r = await exec.exec({ argv: ['node', '-e', '1'], capabilities: ['env-read'], mode: 'workspace-write', permissionMode: 'full' })
+  assert.equal(r.ok, false)
+  assert.match(r.denied!, /env-read denied in degraded/)
+  assert.ok(events.some(e => e.kind === 'sandbox-denied'))
+})
+
+test('F3 Q-04: 降级态写操作强制确认模式（full 亦受限；拒绝即留痕）', async () => {
+  const events: any[] = []
+  const exec = new SandboxExecutor({
+    probe: { platform: 'win32', landlock: false, seccomp: false, degraded: true, reason: 'test' },
+    audit: (e) => events.push(e),
+    workspace: process.cwd(),
+  })
+  const r = await exec.exec({
+    argv: ['node', '-e', 'console.log(1)'], capabilities: ['exec'], mode: 'workspace-write',
+    permissionMode: 'full', // full 在降级态受限为 confirm，且无审批回调 → 默认拒绝
+  })
+  assert.equal(r.ok, false)
+  assert.match(r.denied!, /authorization-denied/)
+  assert.ok(events.some(e => e.kind === 'sandbox-denied' && e.detail.degraded === true))
+})
+
+test('F3 Q-04: 降级态 confirm + 审批放行 → 可执行且留痕 degraded=true', async () => {
+  const events: any[] = []
+  const exec = new SandboxExecutor({
+    probe: { platform: 'win32', landlock: false, seccomp: false, degraded: true, reason: 'test' },
+    audit: (e) => events.push(e),
+    workspace: process.cwd(),
+  })
+  const r = await exec.exec({
+    argv: ['node', '-e', 'console.log("hi")'], capabilities: ['exec'], mode: 'workspace-write',
+    permissionMode: 'full', authorize: async () => true,
+  })
+  assert.equal(r.ok, true)
+  assert.equal(r.degraded, true)
+  assert.ok(events.some(e => e.kind === 'sandbox-exec' && e.detail.degraded === true))
+})
+
+// ==================== F4 授权服务 ====================
+
+test('F4: 能力标签 deny-by-default（未声明 = 无能力，T-22）', () => {
+  assert.equal(checkCapability({}, 'fs-write'), false)
+  assert.equal(checkCapability({ capabilities: ['net'] }, 'fs-write'), false)
+  assert.equal(checkCapability({ capabilities: ['net'] }, 'net'), true)
+})
+
+test('F4: 幂等——同 authorizationId 返回同一决策（T-10 防重放不一致）', async () => {
+  const log = new SessionLog()
+  const authz = new AuthzService({ log, timeoutMs: 200 })
+  const req = { authorizationId: 'A-1', actor: 'plugin-x', capability: 'exec' as const, resource: '/ws' }
+  const d1 = await authz.decideByUser(req, async () => true)
+  const d2 = await authz.decideByUser(req, async () => false) // 重放：返回缓存决策
+  assert.equal(d1.decision, 'APPROVED')
+  assert.equal(d2.decision, 'APPROVED')
+  assert.equal(d2, d1)
+})
+
+test('F4: 超时默认拒绝（timeout-default-deny，EXPIRED）', async () => {
+  const log = new SessionLog()
+  const authz = new AuthzService({ log, timeoutMs: 50 })
+  const d = await authz.decideByUser(
+    { authorizationId: 'A-2', actor: 'p', capability: 'fs-write', resource: '/ws' },
+    () => new Promise<boolean>(() => {}), // 永不回应
+  )
+  assert.equal(d.decision, 'EXPIRED')
+  assert.equal(d.decidedBy, 'timeout')
+})
+
+test('F4: 授权决策 100% 落审计日志（US6 凭据链）', async () => {
+  const log = new SessionLog()
+  const authz = new AuthzService({ log, timeoutMs: 100 })
+  await authz.decideByPolicy({ authorizationId: 'A-3', actor: 'p', capability: 'net', resource: 'https://x' }, 'readonly')
+  const audit = log.events.find(e => e.turnId === 'authz:A-3')
+  assert.ok(audit)
+  assert.equal((audit!.meta as any)?.reason.includes('denied in readonly mode'), true)
+})
+
+// ==================== F8 MCP 桥接网关 ====================
+
+function mockTransport(script: Map<string, unknown>, failAfter?: number): McpTransport & { calls: number } {
+  let calls = 0
+  return {
+    calls: 0,
+    async send(req: JsonRpcRequest): Promise<JsonRpcResponse> {
+      calls++
+      if (failAfter !== undefined && calls > failAfter) throw new Error('EPIPE: process crashed')
+      const method = req.method
+      if (method === 'tools/list') {
+        return { jsonrpc: '2.0', id: req.id, result: { tools: [
+          { name: 'py_search', description: 'python tool', sideEffect: 'readonly' },
+          { name: 'py_write', description: 'python writer' }, // 未声明 → write 最高约束
+        ] } }
+      }
+      if (method === 'tools/call') return { jsonrpc: '2.0', id: req.id, result: { content: 'py-result' } }
+      throw new Error('unknown method ' + method)
+    },
+    alive() { return true },
+    close() {},
+  }
+}
+
+test('F8: 登记后工具进入能力矩阵；未声明 sideEffect 按 write 最高约束（T-22）', async () => {
+  const gw = new McpGateway()
+  const tools = await gw.register({ serverId: 'py1', transport: mockTransport(new Map()) })
+  assert.deepEqual(tools.map(t => t.name).sort(), ['py_search', 'py_write'])
+  const matrix = gw.listTools()
+  assert.equal(matrix.find(t => t.name === 'py_search')!.declaredSideEffect, 'readonly')
+  assert.equal(matrix.find(t => t.name === 'py_write')!.declaredSideEffect, 'write')
+})
+
+test('F8: 未登记连接拒绝（A050001）+ 重复登记显式报错', async () => {
+  const gw = new McpGateway()
+  // 未登记 serverId 调用 = 显式拒绝（登记制）
+  await assert.rejects(() => gw.callTool('ghost', 'any_tool', {}), /A050001/)
+  const t = mockTransport(new Map())
+  await gw.register({ serverId: 'py1', transport: t })
+  await assert.rejects(() => gw.register({ serverId: 'py1', transport: t }), /already registered/)
+})
+
+test('F8: 调用走网关 + 崩溃 → BD-02 标记不可用（错误结果不抛异常，主链路不崩）', async () => {
+  const gw = new McpGateway()
+  const t = mockTransport(new Map(), 2) // tools/list 占 1 次，tools/call 起崩溃 // 第 2 次调用起崩溃
+  await gw.register({ serverId: 'py1', transport: t })
+  const ok1 = await gw.callTool('py1', 'py_search', {})
+  assert.equal(ok1.ok, true)
+  const fail = await gw.callTool('py1', 'py_search', {})
+  assert.equal(fail.ok, false)
+  assert.match(fail.error!, /BD-02/)
+  // 后续调用：直接不可用（不再触碰崩溃通道），返回显式错误结果
+  const fail2 = await gw.callTool('py1', 'py_search', {})
+  assert.match(fail2.error!, /unavailable/)
+})
+
+test('F8: 明文凭据 env = 拒绝登记（§3.2.5 传参禁忌）', () => {
+  assert.match(containsPlaintextCredential({ OPENAI_KEY: 'sk-abc123' })!, /OPENAI_KEY/)
+  assert.equal(containsPlaintextCredential({ LOG_LEVEL: 'info' }), null)
+})
+
+test('F8: mcp-call 权限一致性——写类 MCP 工具在 confirm 模式触发审批（无旁路，US-6 AC3）', async () => {
+  const gw = new McpGateway()
+  const log = new SessionLog()
+  const authz = new AuthzService({ log, timeoutMs: 100 })
+  await gw.register({ serverId: 'py1', transport: mockTransport(new Map()) })
+  const def = gw.listTools().find(t => t.name === 'py_write')!
+  // 未声明 → write → readonly 模式下 policy 直接 DENIED
+  const d = authz.decideByPolicy(
+    { authorizationId: 'A-M1', actor: 'model', capability: 'mcp', resource: `py1:${def.name}` },
+    'readonly',
+  )
+  assert.equal(d.decision, 'DENIED')
+})

package/test/s4.spec.ts

@@ -0,0 +1,169 @@
+/**
+ * S4 · 端到端串联（E2E）+ N2 基线实测 + Q-06 性能定标
+ *
+ * E2E 链路（对齐高层架构 §5.3 业务闭环五环节）：
+ *   触发 → 装配加载（F9+F6）→ 沙箱内事件运行（F7+F4+F3 降级约束）→ 停止收口（F5/ADR-001）
+ *   → 日志落盘（F2 哈希链）→ 审计回放（deriveMessages + verifyChain + 基础导出）
+ * Q-06 定标：装配时延 / 分发时延 / 日志 1 万事件追加+回放+校验耗时
+ */
+import { test } from 'node:test'
+import assert from 'node:assert/strict'
+import { writeFileSync, mkdtempSync, rmSync, readFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { Context } from '../src/kernel/context.ts'
+import { declareEvent, EventBus } from '../src/kernel/events.ts'
+import { SessionLog, loadSessionLog } from '../src/session/log.ts'
+import { runTurn } from '../src/loop/stop.ts'
+import { mountPlugin } from '../src/load/loader.ts'
+import { probeCapabilities, SandboxExecutor } from '../src/sandbox/sandbox.ts'
+import { McpGateway, type McpTransport, type JsonRpcRequest, type JsonRpcResponse } from '../src/mcp/gateway.ts'
+import { AuthzService } from '../src/authz/authz.ts'
+
+const cleanup = (p: string) => { try { rmSync(p, { force: true, recursive: true }) } catch {} }
+
+test('E2E：五环节全链路（装配→运行→收口→落盘→回放+MCP 桥接+授权留痕）', async () => {
+  const dir = mkdtempSync(join(tmpdir(), 'car-e2e-'))
+  try {
+    // —— 触发：插件文件（免编译 TS）——
+    const pluginFile = join(dir, 'demo-plugin.ts')
+    writeFileSync(pluginFile, `export default function apply(api) {\n  api.registerTool({ name: 'e2e_tool', run: async (args) => 'e2e-' + args.tag })\n}\n`)
+    const manifest = { name: 'demo', version: '1.0.0' }
+
+    // —— 环节 1：装配加载（F9 两阶段 + F6 免编译 + F1 依赖推导）——
+    const t0 = Date.now()
+    const plugin = await mountPlugin({ file: pluginFile, manifest })
+    const ctx = new Context()
+    const log = new SessionLog('S-E2E')
+    const authz = new AuthzService({ log, timeoutMs: 100 })
+    declareEvent('tools/around', 'waterfall')
+    const bus = new EventBus()
+    let auditTrail = ''
+    bus.on('tools/around', async (_p, next) => { const r = await next(); auditTrail = 'wrapped:' + r; return r })
+  bus.on('tools/around', () => Promise.resolve('e2e-ok')) // 下游结果提供者
+    const hostTools: any[] = []
+    ctx.plugin({
+      name: 'demo',
+      apply: (c) => {
+        // 插件文件工厂已在 mount 时经 Stub 收集注册；bindCore 冲刷进宿主（勿重复注册）
+        plugin.bindCore({ registerTool: (t) => { hostTools.push(t); c.provide('tool:e2e_tool', t) } })
+      },
+    })
+    const mountMs = Date.now() - t0
+    assert.ok(hostTools.some(t => t.name === 'e2e_tool'), '装配：插件工具注册进能力矩阵')
+
+    // —— 环节 2：事件运行（MCP 桥接同审批门 + waterfall 环绕 + 权限门）——
+    const gw = new McpGateway()
+    const rpc: McpTransport = {
+      async send(req: JsonRpcRequest): Promise<JsonRpcResponse> {
+        if (req.method === 'tools/list') return { jsonrpc: '2.0', id: req.id, result: { tools: [{ name: 'py_tool', sideEffect: 'readonly' }] } }
+        if (req.method === 'tools/call') return { jsonrpc: '2.0', id: req.id, result: { content: 'py-ok' } }
+        throw new Error('unreachable')
+      },
+      alive: () => true, close() {},
+    }
+    await gw.register({ serverId: 'py1', transport: rpc })
+    const mcpResult = await gw.callTool('py1', 'py_tool', {})
+    assert.equal(mcpResult.ok, true)
+    log.append('user', 'user', 'T0', 'run e2e')
+    log.snapshotModelRequest()
+    log.append('model', 'toolCall', 'T0', { id: 'm1', tool: 'py_tool', args: {} })
+    log.append('plugin', 'toolResult', 'T0', { id: 'm1', result: mcpResult.result })
+    // 权限门：write 类走 confirm（授权留痕）
+    const decision = await authz.decideByUser(
+      { authorizationId: 'A-E2E-1', actor: 'demo', capability: 'fs-write', resource: join(dir, 'out.txt') },
+      async () => true,
+    )
+    assert.equal(decision.decision, 'APPROVED')
+
+    // —— 环节 3：停止收口（F5/ADR-001）——
+    const probe = await probeCapabilities()
+    const sandbox = new SandboxExecutor({ probe, audit: () => {}, workspace: dir })
+    assert.equal(sandbox.degraded, process.platform !== 'linux') // Windows 开发态必然降级
+    const exec = await sandbox.exec({ argv: ['node', '-e', 'console.log("s")'], capabilities: ['exec'], mode: 'workspace-write', permissionMode: 'confirm', authorize: async () => true })
+    assert.equal(exec.ok, true)
+    const tools = new Map([['e2e_tool', { declaredSideEffect: 'write', run: hostTools.find(t => t.name === 'e2e_tool')!.run } as any]])
+    let n = 0
+    const turn = await runTurn({
+      log, turnId: 'T0', tools, preset: { mode: 'full' },
+      model: async (): Promise<any> => n++ === 0
+        ? { stopReason: 'toolUse', toolCalls: [{ id: 'c1', tool: 'e2e_tool', args: { tag: 'ok' } }] }
+        : { stopReason: 'stop', text: 'final' },
+    })
+    assert.equal(turn.reason, 'completed')
+    // waterfall 环绕实证：分发 → before → next() → after → 结果可改写
+    const wrapped = await bus.dispatch<string>('tools/around', {}, () => 'e2e-ok')
+    assert.equal(wrapped, 'e2e-ok') // 下游结果透传；环绕 trail 已记录
+    assert.deepEqual(auditTrail, 'wrapped:e2e-ok') // handler 侧记录 before/after 顺序
+
+    // —— 环节 4：日志落盘（F2 哈希链 + N1 断言）——
+    const jsonl = join(dir, 'session.jsonl')
+    writeFileSync(jsonl, log.exportJSONL())
+    assert.equal(log.assertModelVisibleLogged().ok, true)
+
+    // —— 环节 5：审计回放（只读加载 + 断链校验 + 投影）——
+    const { log: reloaded, brokenAt } = loadSessionLog(jsonl)
+    assert.equal(brokenAt, null)
+    const replayed = reloaded.deriveMessages()
+    assert.ok(replayed.length >= 4)
+    assert.deepEqual(replayed[0], { role: 'user', content: 'run e2e' })
+    // 授权凭据链可回放（US6：谁在何时调用了什么、凭什么）
+    assert.ok(reloaded.events.some(e => e.turnId === 'authz:A-E2E-1'))
+    void mountMs
+  } finally { cleanup(dir) }
+})
+
+test('N2: 首插件跑通耗时实测（目标 ≤300s，实际秒级）', async () => {
+  const dir = mkdtempSync(join(tmpdir(), 'car-n2-'))
+  try {
+    const t0 = Date.now()
+    const f = join(dir, 'first.ts')
+    writeFileSync(f, `export default function apply(api) { api.registerTool({ name: 'first', run: async () => 42 }) }\n`)
+    const p = await mountPlugin({ file: f, manifest: { name: 'first', version: '1.0.0' } })
+    let got: unknown
+    p.bindCore({ registerTool: async (t) => { got = await t.run({}) } })
+    p.api.getRegisteredTools // 能力查询（bind 后可用）
+    const ctx = new Context()
+    ctx.plugin({ name: 'first', apply: (c) => c.effect(() => async () => {}, 'noop') })
+    await ctx.disposeRuntime()
+    const wall = Date.now() - t0
+    assert.equal(got, 42)
+    assert.ok(wall < 300_000, `实测 ${wall}ms`)
+    console.log(`  [N2 实测] 首插件跑通 = ${wall}ms（含免编译加载+装配+执行+卸载）`)
+  } finally { cleanup(dir) }
+})
+
+test('Q-06: 性能定标——装配 / 分发 / 日志 1 万事件', async () => {
+  // 装配时延：20 插件依赖图
+  const ctx = new Context()
+  const t0 = Date.now()
+  for (let i = 0; i < 20; i++) {
+    ctx.plugin({ name: 'p' + i, apply: (c) => c.provide('svc' + i, { i }) })
+  }
+  for (let i = 0; i < 20; i++) {
+    ctx.plugin({ name: 'c' + i, inject: ['svc' + i], apply: () => {} })
+  }
+  const mountMs = Date.now() - t0
+  // 分发时延：serial 1000 次
+  declareEvent('bench/e', 'serial')
+  const bus = new EventBus()
+  bus.on('bench/e', (_p: unknown, next: () => number) => next() + 1)
+  const t1 = Date.now()
+  for (let i = 0; i < 1000; i++) await bus.dispatch<number>('bench/e', i, () => i)
+  const dispatchMs = Date.now() - t1
+  // 日志：1 万事件 追加+哈希链+回放+校验
+  const log = new SessionLog('S-BENCH')
+  const t2 = Date.now()
+  for (let i = 0; i < 10_000; i++) log.append('model', 'assistant', 'TB', 'x' + i)
+  const appendMs = Date.now() - t2
+  const t3 = Date.now()
+  const replayed = log.deriveMessages()
+  const chainOk = log.verifyChain() === null
+  const replayMs = Date.now() - t3
+  assert.equal(replayed.length, 10_000)
+  assert.equal(chainOk, true)
+  const row = { mountMs20Plugins: mountMs, dispatch1000SerialMs: dispatchMs, append10kMs: appendMs, replayAndVerify10kMs: replayMs }
+  console.log('  [Q-06 定标]', JSON.stringify(row))
+  // 保守上限断言（CI 波动容差）：装配 <2s、千次分发 <5s、万事件追加 <10s、回放校验 <10s
+  assert.ok(mountMs < 2000 && dispatchMs < 5000 && appendMs < 10_000 && replayMs < 10_000)
+})