@shundoo-ai/dsh-cosmic 1.0.19 → 1.0.21

package/skills/cosmic-build/skills/cosmic-meta-api/scripts/_core/commands.py

@@ -441,12 +441,16 @@ from .cmd_rules import (  # noqa: F401
     do_ensure_conditional_entry_style,
     do_ensure_conditional_control_state,
     do_ensure_conditional_clear_fields,
+    do_ensure_conditional_field_change,
     do_ensure_conditional_copy_field_value,
+    do_ensure_copy_field_mappings,
     do_ensure_conditional_carry_reference_property,
+    do_ensure_carry_reference_mappings,
     do_ensure_conditional_calculation,
     do_ensure_quantity_conversion,
     do_ensure_conditional_field_state,
     do_ensure_field_calculation,
+    do_ensure_time_difference_calculation,
     do_ensure_rule_function_formula,
     do_ensure_rule_set,
     do_update_rule,
@@ -502,7 +506,7 @@ from .cmd_properties import (  # noqa: F401
     do_set_display_prop,
     do_set_permission_control,
     do_set_business_control,
-    do_set_complex_property, do_set_custom_style, do_set_collapse_summary,
+    do_set_complex_property, do_configure_dropdown_menu, do_set_custom_style, do_set_collapse_summary,
     do_set_edit_search_prop,
     do_set_ref_layout,
     do_set_summary_to_field_resolved,
@@ -559,6 +563,7 @@ from .cmd_tabpage import (  # noqa: F401
 
 from .cmd_controls import (  # noqa: F401
     control_catalog,
+    control_input_schema,
     validate_control_batch_input,
     do_add_controls,
 )

package/skills/cosmic-build/skills/cosmic-meta-api/scripts/_core/config.py

@@ -30,6 +30,7 @@ if str(_ROOT_SCRIPTS_P) not in sys.path:
 
 from project_paths import (
     ensure_app_runtime_ignore,
+    get_app_identity,
     get_cosmic_metadata_runtime_dir,
     get_metadata_dir,
     get_modify_dir,
@@ -163,10 +164,16 @@ def _init_paths(temp_dir=None, app_root=None):
     resolved_app_root = (
         _Path(app_root).expanduser().resolve() if app_root is not None else None
     )
-    _BOUND_APP_ROOT = resolved_app_root
     if resolved_app_root is not None:
         if not resolved_app_root.is_dir():
             raise ValueError(f"app root does not exist: {resolved_app_root}")
+        if not get_app_identity(resolved_app_root):
+            raise ValueError(
+                "APP_ROOT_IDENTITY_INVALID: appRoot must be the bound Cosmic application directory, "
+                "not the project root or app container"
+            )
+    _BOUND_APP_ROOT = resolved_app_root
+    if resolved_app_root is not None:
         ensure_app_runtime_ignore(resolved_app_root)
         temp_dir = str(
             resolved_app_root / "_runtime" / "cosmic-metadata"
@@ -211,8 +218,10 @@ def _init_paths(temp_dir=None, app_root=None):
     # Ensure directories exist
     os.makedirs(temp_dir, exist_ok=True)
     os.makedirs(os.path.join(temp_dir, "ops"), exist_ok=True)   # transient ops files
-    os.makedirs(ARTIFACTS_DIR, exist_ok=True)
-    os.makedirs(BATCH_MANIFESTS_DIR, exist_ok=True)
+    # Global discovery/auth may need session state, but has no application artifacts.
+    if resolved_app_root is not None or _read_context_json().get("appRoot"):
+        os.makedirs(ARTIFACTS_DIR, exist_ok=True)
+        os.makedirs(BATCH_MANIFESTS_DIR, exist_ok=True)
 
     # Proactively create workspace.json (write business cloud fixed defaults), ensuring the file always exists
     # isv / standard are not written here; they are dynamically obtained by bootstrapWorkspace → getDevInfo
@@ -361,7 +370,8 @@ _API_PATH = {
     "metalogQuery":            "/kapi/v2/devportal/ai-meta/metalog/query",
     "metalogCompare":          "/kapi/v2/devportal/ai-meta/metalog/compare",
     "metalogRestore":          "/kapi/v2/devportal/ai-meta/metalog/restore",
-    # KSQL 导出/查询（预置数据/基础数据，管理员/子管理员）
+
+    # ─── 本地补丁（LOCAL-PATCHES #13 / #14）：上游 0.0.326 仍无这些端点 ───
     "ksqlListDbRoutes":   "/kapi/v2/devportal/ai-meta/ksql/listDbRoutes",
     "ksqlListDbTypes":    "/kapi/v2/devportal/ai-meta/ksql/listDbTypes",
     "ksqlListTables":     "/kapi/v2/devportal/ai-meta/ksql/listTables",
@@ -369,11 +379,9 @@ _API_PATH = {
     "ksqlTranslate":      "/kapi/v2/devportal/ai-meta/ksql/translate",
     "exportKSQLByTable":  "/kapi/v2/devportal/ai-meta/ksql/exportByTable",
     "exportKSQLByObject": "/kapi/v2/devportal/ai-meta/ksql/exportByObject",
-    # 运行时元数据查询（数据分析 / entity-download 依赖）
     "getEntityOperate":        "/kapi/v2/devportal/ai-meta/getEntityOperate",
     "getIsv":                  "/kapi/v2/devportal/ai-meta/getIsv",
     "getControl":              "/kapi/v2/devportal/ai-meta/getControl",
-    # 自定义数据查询 API（数据分析核心）
     "dataQuery":               "/kapi/v2/open/openapi/data/query",
     "dataQueryWithPagination": "/kapi/v2/open/openapi/data/queryWithPagination",
     "getApiByUrl":             "/kapi/v2/open/openapi_apilist/queryByUrl",
@@ -496,15 +504,16 @@ def config_is_initialized():
             _md._md_has_section(cfg_path, "Business Cloud / App Info"))
 
 
-# ─── dataQuery 参数自动 hex 编码（配合服务端解码，绕过网关 SQL 检测）──────────────
+# ─── 本地补丁（LOCAL-PATCHES #15）：dataQuery 参数 hex 编码 ─────────────────────
+# 服务端 DataServiceController.decodeHex 解码还原；用于绕过网关 SQL 注入检测。
 
 _HEX_ENCODE_FIELDS = ("filters", "selectFields", "orderBys")
 
 
 def _encode_api_params(payload):
-    """dataQuery / dataQueryWithPagination 发送前自动处理：filters / selectFields / orderBys
-    三个字符串参数 hex 编码（网关 SQL 注入检测绕过；服务端 DataServiceController 已加
-    decodeHex 解码还原，agent 无感）。其余参数（entityId/top/pageSize 等）原样。
+    """dataQuery / dataQueryWithPagination 发送前把 filters / selectFields / orderBys
+    三个字符串参数 hex 编码（网关 SQL 检测绕过；服务端解码，agent 无感）。
+    其余参数（entityId/top/pageSize 等）原样。
     """
     if not isinstance(payload, dict):
         return payload
@@ -523,25 +532,29 @@ def _api_call(cfg, token, command, payload, method="GET"):
     (kd_api internally manages token retrieval/encrypted caching/401 forced refresh). Endpoint
     routing is still provided by this module's ``_api_url`` / ``_API_PATH``.
 
-    ``callApiByUrl``：payload['url'] 为相对路径（如 /v2/xxx/query），动态拼接 base_url 调用
-    （数据分析自定义 API 通道，照抄旧版 transport 逻辑）。
+    本地补丁（LOCAL-PATCHES #13 / #15）：
+    - ``callApiByUrl``：payload['url'] 为相对路径（如 /v2/xxx/query），动态拼 base_url 调用；
+    - dataQuery / dataQueryWithPagination 发送前自动 hex 编码。
     """
     import kd_api
 
-    # dataQuery 参数自动 hex 编码（服务端 DataServiceController.decodeHex 解码，WAF 绕过；agent 无感）
+    # dataQuery 参数自动 hex 编码（本地补丁 #15）
     if command in ("dataQuery", "dataQueryWithPagination"):
         _encode_api_params(payload)
 
-    base_url = (cfg.get("base_url") or cfg.get("baseUrl", "")).rstrip("/")
+    # 按 URL 直调（本地补丁 #13）：拆 base（token 缓存 key 用根 URL）与 path，
+    # 避免 get_token 用错 base 而重新登录。
     if command == "callApiByUrl":
+        base_url = (cfg.get("base_url") or cfg.get("baseUrl", "")).rstrip("/")
         rel_url = payload.get("url", "")
         rest = {k: v for k, v in payload.items() if k != "url"}
         if not rel_url.startswith("/kapi/"):
             rel_url = "/kapi" + rel_url
-        # 拆 base（token 缓存 key 用根 URL）+ path（相对路径），避免 get_token 用错 base 重新登录
         if method == "GET":
             return kd_api.get(base_url, rel_url, cfg, params=rest)
         return kd_api.post(base_url, rel_url, cfg, rest)
+
+    base_url = (cfg.get("base_url") or cfg.get("baseUrl", "")).rstrip("/")
     _api_url(cfg, command)  # Validate endpoint is registered (raise ValueError if unknown)
     api_path = _API_PATH[command]
     if method == "GET":

package/skills/cosmic-build/skills/cosmic-meta-api/scripts/_core/execution_errors.py

@@ -0,0 +1,40 @@
+"""Evidence-based error categories shared by machine results and batch receipts."""
+
+
+def classify_execution_error(result):
+    code = str(result.get("errorCode") or "")
+    data = result.get("data") if isinstance(result.get("data"), dict) else {}
+    attempted = result.get("writeAttempted", data.get("writeAttempted"))
+    if code == "RULE_SET_ITEM_FAILED" and data.get("results"):
+        return classify_execution_error(data["results"][-1]["result"])
+    if code == "RULE_SET_ITEM_EXCEPTION":
+        return "unknown_write"
+    if attempted is not False and (result.get("outcome") == "unknown_after_write"
+                                  or result.get("phase") == "writeUnknown"):
+        return "unknown_write"
+    if code == "FULL_METADATA_API_UNAVAILABLE":
+        return "capability_limit"
+    if code.endswith("LOOKUP_UNCONFIRMED"):
+        return "environment"
+    if code.startswith("BATCH_WRITE_"):
+        return "unknown_write"
+    if code == "COMMAND_UNAVAILABLE":
+        return "input"
+    if code == "CONDITIONAL_CARRY_SOURCE_PROPERTY_UNAVAILABLE":
+        return "identity_resolution"
+    if code.endswith(("_UNRESOLVED", "_AMBIGUOUS", "_NOT_FOUND")) or code.startswith(("REF_", "BD-REFERENCE", "TARGET_", "FORM_", "CREATED_IDENTITY", "CALLER_CONTEXT")):
+        return "identity_resolution"
+    if code.startswith(("SKILL_", "AUTH", "TOKEN", "HTTP", "NETWORK", "ENV", "CLI_EXIT")):
+        return "environment"
+    if code.startswith(("CLI_ARGUMENT", "INLINE_JSON", "RULE_SET_ARGS", "RULE_SET_INPUT", "BATCH_INPUT", "ARTIFACT_", "RULE_INPUT_", "RULE_FUNCTION_ARGUMENT", "RULE_SET_COMMAND")):
+        return "input"
+    return "business_validation" if attempted is False else "unknown"
+
+
+def attach_execution_error(result):
+    if not isinstance(result, dict) or result.get("status") is not False:
+        return result
+    result = dict(result)
+    result["errorCategory"] = classify_execution_error(result)
+    result["capabilityLimitConfirmed"] = result["errorCategory"] == "capability_limit"
+    return result

package/skills/cosmic-build/skills/cosmic-meta-api/scripts/_core/formatters.py

@@ -11,6 +11,7 @@ import hashlib
 import json
 import os
 import sys
+import time
 
 from .cache import _iter_biz_tree
 
@@ -639,6 +640,18 @@ def _last_result_legacy_path():
     return os.path.join(output_dir, "last_result.json")
 
 
+def save_run_batch_result(result, app_root, artifact_paths):
+    """Save the original batch receipt for downstream verified Java preparation."""
+    root = os.path.abspath(app_root)
+    destination = os.path.join(root, "_runtime", "output", f"runBatch.{time.time_ns()}.json")
+    receipt = {**result, "appRoot": root, "artifactPaths": [os.path.abspath(p) for p in artifact_paths],
+               "resultPath": destination}
+    os.makedirs(os.path.dirname(destination), exist_ok=True)
+    with open(destination, "w", encoding="utf-8") as handle:
+        json.dump(receipt, handle, ensure_ascii=False, indent=2)
+    return receipt
+
+
 def pjson(obj, force_stdout=False):
     """Output JSON result.
 
@@ -679,11 +692,25 @@ def pjson(obj, force_stdout=False):
                         f.write(text)
                 except OSError:
                     pass
-        print(
-            f"[output] Result written to: {target_file}",
-            file=sys.stdout,
-            flush=True,
-        )
+        if _stdout_mode or force_stdout:
+            print(text, file=sys.stdout, flush=True)
+        else:
+            print(f"[output] Result written to: {target_file}", file=sys.stdout, flush=True)
+            if isinstance(obj, dict) and (obj.get("delivery") or obj.get("results")):
+                # Keep the complete receipt on disk, while exposing the facts
+                # needed to continue. Never infer verification from exit status.
+                summary = {key: obj[key] for key in (
+                    "status", "errorCode", "errorCategory", "message", "total", "completed", "success", "failed",
+                    "forms", "delivery", "executionFinished", "writeAttempted", "metadataRetained",
+                    "doNotRetryBuildMeta", "resume", "reconcile", "reconciliation",
+                ) if key in obj}
+                summary["resultPath"] = os.path.abspath(target_file)
+                if isinstance(obj.get("results"), list):
+                    summary["results"] = [{**{key: row[key] for key in ("artifactPath", "ok", "phase", "error") if key in row},
+                        **({"verification": {key: row["verification"][key] for key in ("performed", "status", "verified")
+                            if key in row["verification"]}} if isinstance(row.get("verification"), dict) else {})}
+                        for row in obj["results"] if isinstance(row, dict)]
+                print("RESULT_SUMMARY=" + json.dumps(summary, ensure_ascii=False, separators=(",", ":")), file=sys.stdout, flush=True)
     else:
         print(text, file=sys.stdout, flush=True)
 

package/skills/cosmic-build/skills/cosmic-meta-api/scripts/_core/property_policy_contract.py

@@ -0,0 +1,6 @@
+"""Language-neutral property policy declarations; copied to locales by the asset synchronizer."""
+
+PUBLISHED_SIMPLE_PROPERTIES = frozenset({
+    "mustinput", "defvalue", "maxlength", "precision", "scale", "invisible",
+    "width", "height",
+})

package/skills/cosmic-build/skills/cosmic-meta-api/scripts/_core/report_ops.py

@@ -235,7 +235,7 @@ def normalize_report_filters_input(value):
     if not isinstance(value, list) or not value:
         _input_error("filters must be a non-empty array")
     allowed = {
-        "fieldPath", "displayName", "compare", "defaultValue", "mustInput", "visible",
+        "fieldPath", "displayName", "compare", "defaultValue", "mustInput", "visible", "source",
     }
     result = []
     seen = set()
@@ -250,6 +250,10 @@ def normalize_report_filters_input(value):
         if item["compare"] not in {"=", "in", "between"}:
             _input_error(
                 f"filters[{index}].compare is not in the verified set (=, in, between)")
+        if "source" in item:
+            source = _object(item["source"], f"filters[{index}].source", {"formNumber", "fieldKey"})
+            item["source"] = {key: _text(source.get(key), f"filters[{index}].source.{key}", identifier=True)
+                              for key in ("formNumber", "fieldKey")}
         for key in ("mustInput", "visible"):
             if key in item:
                 item[key] = _boolean(item[key], f"filters[{index}].{key}")
@@ -617,28 +621,57 @@ def set_report_filters(cfg, token, form_id, filters, dry_run=False, form_number=
             file=sys.stderr, flush=True,
         )
 
-    # `compare` was silently dropped before this notice existed: it is mapped and sent, and the
-    # platform stores every comparison as the same CommonFilterColumnAp, so a `between` date
-    # range renders as a plain filter box. Say it once per write, and let the plugin contract
-    # carry each comparison as something query() has to apply itself.
+    # Comparison semantics remain a query requirement; editor shape depends on the
+    # deployed platform version and must be observed instead of assumed to be plain text.
     print(
-        "[setReportFilters] this deployment does not persist filter compare: "
+        "[setReportFilters] query comparisons: "
         + ", ".join(
             f"{f.get('fieldPath', '')}={f.get('compare', '')}" for f in filters
         )
-        + ". Every comparison must be applied in the data-fetch plugin's query(); "
-        "the filter panel renders one plain control per key regardless of compare.",
+        + ". Verify actual filter editor types from report read-back; compare is not an "
+        "arbitrary control-type selector. Apply the requested query conditions in query().",
         file=sys.stderr, flush=True,
     )
 
     form_number = _ensure_form_number(cfg, token, form_id, form_number)
+    if any(f.get("source") for f in filters):
+        report_filter_source_expectations(cfg, token, filters)
     _assert_report_entity_writable(
         cfg, token, form_id, form_number, requested_filter_keys=filter_ids)
-    result = _set_complex(cfg, token, form_number, "ReportFilters", filter_payload)
+    # A separate route makes an old platform reject before mutation instead of silently
+    # ignoring source and creating TextField. Never fall back after an unsupported write.
+    complex_type = "ReportFilters.typed" if any(f.get("source") for f in filters) else "ReportFilters"
+    result = _set_complex(cfg, token, form_number, complex_type, filter_payload)
     _check_result(result, "setReportFilters", form_mutation_possible=True)
     return filter_ids
 
 
+def report_filter_source_expectations(cfg, token, filters):
+    """Read only the selected source forms once; no inferred reference IDs or enum values."""
+    sources = {}
+    expected = {}
+    for item in filters:
+        source = item.get("source")
+        if not source:
+            continue
+        number = source["formNumber"]
+        if number not in sources:
+            data = (_get_schema(cfg, token, number) or {}).get("data") or {}
+            sources[number] = data.get("fieldSchemas")
+        if not isinstance(sources[number], list):
+            raise RuntimeError("REPORT_TYPED_FILTER_PLATFORM_UNSUPPORTED: source field schema unavailable; install the typed filter platform extension")
+        matches = [row for row in sources[number] if row.get("fieldPath") == source["fieldKey"]]
+        if len(matches) != 1:
+            raise ValueError("REPORT_FILTER_SOURCE_FIELD_AMBIGUOUS_OR_MISSING: " + source["fieldKey"])
+        wanted = {key: value for key, value in matches[0].items() if key not in {"fieldPath", "displayName", "mustInput"}}
+        if item["compare"] == "between" and wanted.get("fieldType") != "DateRangeField":
+            if wanted.get("fieldType") not in {"DateField", "DateTimeField"}:
+                raise ValueError("REPORT_FILTER_RANGE_TYPE_UNSUPPORTED: " + str(wanted.get("fieldType")))
+            wanted["fieldType"] = "DateRangeField"
+        expected[item["fieldPath"]] = wanted
+    return expected
+
+
 def set_report_sorts(cfg, token, form_id, sorts, dry_run=False, form_number=None):
     """Set report sort configuration.
 
@@ -923,9 +956,20 @@ def get_report_schema(cfg, token, form_id):
         "unverifiableSections": [],
     }
 
+    typed = data.get("reportFilterSchema")
+    if isinstance(typed, dict) and typed.get("schemaVersion") == "app-build-typed-report-filters/v1":
+        report_schema["reportFilters"] = typed.get("reportFilters") or []
+        report_schema["typedFiltersReadBack"] = True
+
     if report_schema["readBackAvailable"]:
         return report_schema
 
+    if report_schema.get("typedFiltersReadBack"):
+        report_schema["readBackAvailable"] = True
+        report_schema["readBackSource"] = "typedFilters"
+        report_schema["unverifiableSections"] = ["reportColumns", "reportSorts", "reportPlugins"]
+        report_schema["undecidableFilterProperties"] = ["compare", "visible", "defaultValue"]
+
     # Derived read-back. The tested deployment exposes no data.reportSchema, but
     # data.formLayout is the same ControlAp tree that setReportColumns / setReportFilters
     # write, so the requested structure is provable from it. Returning empty arrays here used
@@ -935,7 +979,9 @@ def get_report_schema(cfg, token, form_id):
     if isinstance(layout, dict):
         report_schema["_raw_formLayout"] = layout
         report_schema["reportColumns"] = _columns_from_layout(layout)
-        report_schema["reportFilters"] = _filters_from_layout(layout)
+        report_schema["reportFilters"] = _filters_from_layout(layout, data.get("schemaText") or "")
+        if report_schema.get("typedFiltersReadBack"):
+            report_schema["reportFilters"] = typed.get("reportFilters") or []
         report_schema["readBackAvailable"] = True
         report_schema["readBackSource"] = "formLayout"
         # formLayout carries the control tree only. Default sort lives in the ReportListAp
@@ -954,6 +1000,8 @@ def get_report_schema(cfg, token, form_id):
         report_schema["undecidableFilterProperties"] = [
             "compare", "mustInput", "visible", "defaultValue",
         ]
+        if report_schema.get("typedFiltersReadBack"):
+            report_schema["undecidableFilterProperties"].remove("mustInput")
 
     schema_text = data.get("schemaText") or ""
     if schema_text:
@@ -1006,17 +1054,22 @@ def _columns_from_layout(layout):
     ]
 
 
-def _filters_from_layout(layout):
+def _filters_from_layout(layout, schema_text=""):
     """Derive report filter controls from the ReportFilterAp subtree of formLayout."""
     panel = _layout_node(layout, "ReportCommFilterPanelAp")
     if not isinstance(panel, dict):
         return []
+    entities = parse_schema_text(schema_text)
+    fields = (entities[0].get("fields") or []) if entities else []
+    field_types = {field["fieldKey"]: field["fieldType"] for field in fields if field.get("fieldType")}
     result = []
     for child in panel.get("children") or []:
         if not isinstance(child, dict):
             continue
         node_type = str(child.get("type") or child.get("$type") or "")
         control = next((name for name in _FILTER_CONTROL_COMPARE if name in node_type), "")
+        if node_type.rsplit(".", 1)[-1] == "FieldAp":
+            control = "FieldAp"
         if not control:
             continue
         item = {
@@ -1024,6 +1077,8 @@ def _filters_from_layout(layout):
             "displayName": child.get("name") or "",
             "controlType": control,
         }
+        if item["fieldPath"] in field_types:
+            item["fieldType"] = field_types[item["fieldPath"]]
         # The layout's own `visible` is a control-phase list ("init,new,edit,...") and is not
         # the filter contract's boolean `visible`. Exposing it under the same key would make a
         # dropped `visible: false` look persisted, so keep the names apart.
@@ -1649,9 +1704,32 @@ def compile_report_plugin_contract(artifact, form_number=""):
             entry["requiredBy"] = bound_by
 
     enforcement = []
+    value_contracts = []
+    field_config = (artifact.get("reportProperties") or {}).get("filterFieldConfig") or []
     for item in filters:
         filter_key = str(item.get("fieldPath") or "")
-        accessor = f'ReportQueryParam.getFilter().getFilterItem("{filter_key}")'
+        binding = next((row for row in field_config if row.get("key") == filter_key), {})
+        candidates = list(dict.fromkeys(key for key in (
+            binding.get("fieldName"), filter_key,
+            binding["fieldName"].split("_", 1)[0] + "_" + filter_key[4:]
+            if filter_key.startswith("flt_") and "_" in binding.get("fieldName", "") else None,
+        ) if key))
+        between = item.get("compare") == "between"
+        accessor = ('ReportQueryParam.getFilter().getFilterItems()' if between
+                    else f'ReportQueryParam.getFilter().getValue("{filter_key}")')
+        value_contracts.append({
+            "filterKey": filter_key,
+            "compare": item.get("compare"),
+            "candidateValueKeys": candidates,
+            "runtimeKeysVerified": False,
+            "valueChannel": "getFilterItems" if between else "getValue",
+            "rangeItemKeys": {"start": filter_key + "_startdate", "end": filter_key + "_enddate"} if between else None,
+            "sourceBinding": item.get("source") or {key: binding[key] for key in ("dataSourceId", "fieldName") if binding.get(key)},
+            "requiredEvidence": ["source field type and editor/reference/enum configuration",
+                                 "actual runtime key mapping and comparison semantics",
+                                 "query entity, field and value type",
+                                 "F7 organization scope and number uniqueness when applicable"],
+        })
         # Every filter carries its comparison here. The platform stores one plain control per
         # key whatever the compare is, so `between` / `in` / `=` exist only as a requirement on
         # query() — without this entry they reached Java delivery as nothing at all.
@@ -1696,6 +1774,8 @@ def compile_report_plugin_contract(artifact, form_number=""):
         "dataSetColumnTypes": column_types,
         "columnPresentation": presentation,
         "filterEnforcement": enforcement,
+        "filterValueContracts": value_contracts,
+        "permissionFilterChannel": "getQFilters",
         "notes": [
             "dataSetColumns are the column names query() must return, case-sensitive, and "
             "dataSetColumnTypes is the Java type each one must carry. Nothing in metadata can "
@@ -1708,10 +1788,13 @@ def compile_report_plugin_contract(artifact, form_number=""):
             "Bind columnPresentation in getColumns() using each java call plus its "
             "javaFollowUp setters; do not guess ReportColumn.TYPE_* names. Recurse into "
             "ReportColumnGroup.getChildren(): a grouped column is not in the top-level list.",
-            "Enforce each filterEnforcement item in query() from its filter key. requirement="
-            "compare is on every filter because the platform renders one plain control per key "
-            "whatever the comparison is: query() has to apply between / in / = itself. The "
-            "others were accepted by the write but are not observable as persisted.",
+            "Enforce filterEnforcement using filterValueContracts. candidateValueKeys are "
+            "unverified candidates, not a universal prefix rule; confirm actual keys and reject "
+            "conflicting values. Date ranges may use separate start/end FilterItemInfo values. "
+            "Use target-SDK accessors, not DynamicObject casts or toString date parsing. "
+            "getQFilters carries permissions and never substitutes for extracting user values. "
+            "F7 number filters are String comparisons on field.number, while field/id comparisons "
+            "require Long; preserve organization and permission scope.",
         ],
     }
     return contract
@@ -1989,7 +2072,18 @@ def report_readback_verification(section, expected, schema):
                 result["unverifiableRequestedProperties"] = sorted(unverifiable_requested)
             result["unverifiedProperties"] = sorted(undecidable)
         else:
-            mismatches = _subset_mismatches(_build_filters_payload(expected), observed, f"/{key}")
+            mismatches = _subset_mismatches(_build_filters_payload([{k: v for k, v in item.items() if k != "source"} for item in expected]), observed, f"/{key}")
+        # Structure-only receipts cannot prove source-derived editor configuration.
+        by_key = {row.get("fieldPath"): row for row in observed or []}
+        for index, item in enumerate(expected):
+            if not item.get("source"):
+                continue
+            actual = by_key.get(item["fieldPath"], {})
+            wanted = (schema.get("filterSourceExpectations") or {}).get(item["fieldPath"])
+            if (not schema.get("typedFiltersReadBack") or not wanted
+                    or any(actual.get(name) != value for name, value in wanted.items())):
+                mismatches.append({"path": f"/{key}/{index}/source", "expected": item["source"],
+                                   "actual": actual.get("fieldType"), "reason": "typed-editor-source-not-proven"})
     else:
         mismatches = _subset_mismatches(expected, observed, f"/{key}")
 
@@ -2151,6 +2245,8 @@ def _build_filters_payload(filters):
             "displayName": f.get("displayName", ""),
             "compare": _map_compare_operator(f.get("compare", "=")),
         }
+        if f.get("source"):
+            item["source"] = f["source"]
         # Only forward keys the normalized contract accepts. The previous version also
         # emitted required / enableFuzzy / basedataFilter, which normalize_report_filters_input
         # already rejects — dead branches that could only reintroduce silent drift.

package/skills/cosmic-build/skills/cosmic-meta-api/scripts/_core/reset.py

@@ -287,16 +287,16 @@ _CONTEXT_TEMPLATE = """# 当前会话上下文
 _CONFIG_MD_TEMPLATE = """# 苍穹 Open API 配置说明
 
 > **数据分工**：
-> - **`scripts/config.json`**（唯一真实来源）：连接参数、密钥等**机器级**配置，代码直接读取
+> - **`~/.kd/config.json`**（唯一真实来源）：连接参数、密钥等**机器级**配置，代码直接读取
 > - **本文件 `config.md`**（人类可读 + AI 可读）：ISV 信息、业务云列表等**项目级**持久配置，由 API 自动写入
-> - 两者存在重复的字段（如 `isv`），以 `config.json` 为准；config.md 仅作展示和 AI 快速查阅
+> - 两者存在重复的字段（如 `isv`），以 `~/.kd/config.json` 为准；config.md 仅作展示和 AI 快速查阅
 
 ---
 
 ## 开发商 ISV 信息
 
 > 由 `getDevInfo` 接口自动写入，供 Skill 生成字段/实体 key 时使用。  
-> **重置环境后此处已清空**，请切换 config.json 后运行 `getDevInfo` 或由建模/改单流程触发刷新。
+> **重置环境后此处已清空**，请在 `~/.kd/config.json` 切换环境后运行 `getDevInfo` 或由建模/改单流程触发刷新。
 
 | 字段 | 值 |
 |------|-----|