@tea-agent/loop-agent 0.38.0 → 0.39.0-next.10

package/dist/task/frontend-project-capability.js

@@ -5,7 +5,73 @@
  */
 import { readFile, readdir, stat } from "node:fs/promises";
 import path from "node:path";
-import { OPENSPEC_SPEC_DIRS, OPENSPEC_SPEC_EXT_RE } from "../shared/openspec-spec.js";
+import { z } from "zod";
+import { DEFAULT_OPENSPEC_GOVERNANCE_ROOT, MAX_OPENSPEC_CANDIDATE_PATHS, OPENSPEC_SPEC_DIRS, OPENSPEC_SPEC_EXT_RE, isGovernanceSubtreePath, isOpenspecSpecFilePath, } from "../shared/openspec-spec.js";
+const classifiedPathSchema = z
+    .string()
+    .refine((candidate) => isOpenspecSpecFilePath(candidate), "classified path must be a repo-relative supported spec file under openspec/schemas/, openspec/project-specs/, or ai_workspace/");
+/**
+ * Stable semantic partition of `designEvidence.normativePaths`. Keys are a
+ * generic directory convention (not project-specific file names); the same
+ * repository therefore yields the same classification on repeated probes.
+ */
+export const frontendDesignClassifiedSchema = z
+    .object({
+    schemas: z.array(classifiedPathSchema),
+    codeTemplate: z.array(classifiedPathSchema),
+    rule: z
+        .object({
+        api: z.array(classifiedPathSchema),
+        mock: z.array(classifiedPathSchema),
+        router: z.array(classifiedPathSchema),
+        hooks: z.array(classifiedPathSchema),
+        utils: z.array(classifiedPathSchema),
+        components: z.array(classifiedPathSchema),
+        other: z.array(classifiedPathSchema),
+    })
+        .strict(),
+    theme: z.array(classifiedPathSchema),
+    component: z.array(classifiedPathSchema),
+    uiOther: z.array(classifiedPathSchema),
+    advisoryOther: z.array(classifiedPathSchema),
+})
+    .strict();
+export const frontendDesignEvidenceSchema = z
+    .object({
+    normativePaths: z.array(z.string()),
+    advisoryPaths: z.array(z.string()),
+    conflicts: z.array(z.string()),
+    classified: frontendDesignClassifiedSchema,
+})
+    .strict()
+    .superRefine((evidence, ctx) => {
+    const classified = [
+        ...evidence.classified.schemas,
+        ...evidence.classified.codeTemplate,
+        ...evidence.classified.rule.api,
+        ...evidence.classified.rule.mock,
+        ...evidence.classified.rule.router,
+        ...evidence.classified.rule.hooks,
+        ...evidence.classified.rule.utils,
+        ...evidence.classified.rule.components,
+        ...evidence.classified.rule.other,
+        ...evidence.classified.theme,
+        ...evidence.classified.component,
+        ...evidence.classified.uiOther,
+        ...evidence.classified.advisoryOther,
+    ];
+    const classifiedSet = new Set(classified);
+    const normativeSet = new Set(evidence.normativePaths);
+    const onlyClassified = [...classifiedSet].filter((candidate) => !normativeSet.has(candidate));
+    const onlyNormative = [...normativeSet].filter((candidate) => !classifiedSet.has(candidate));
+    if (onlyClassified.length > 0 || onlyNormative.length > 0) {
+        ctx.addIssue({
+            code: z.ZodIssueCode.custom,
+            message: `classified must partition normativePaths exactly; extra in classified: ${onlyClassified.join(", ") || "(none)"}; missing from classified: ${onlyNormative.join(", ") || "(none)"}`,
+            path: ["classified"],
+        });
+    }
+});
 async function exists(filePath) {
     try {
         await stat(filePath);
@@ -15,39 +81,68 @@ async function exists(filePath) {
         return false;
     }
 }
-async function readJson(filePath) {
-    try {
-        return JSON.parse(await readFile(filePath, "utf8"));
-    }
-    catch {
-        return null;
+/**
+ * Resolve the governance subtree root from harness.json.governanceRoot.
+ * Falls back to DEFAULT_OPENSPEC_GOVERNANCE_ROOT when the manifest is missing,
+ * unreadable, malformed, or lacks a string governanceRoot. This intentionally
+ * does NOT apply init.ts's "docs" -> default migration (init-only behavior).
+ */
+export async function resolveOpenspecGovernanceRoot(repoRoot) {
+    const manifest = await readJson(path.join(repoRoot, "harness.json"));
+    if (manifest && typeof manifest === "object") {
+        const candidate = manifest.governanceRoot;
+        if (typeof candidate === "string" && candidate.trim()) {
+            return candidate.trim().replace(/\\/g, "/").replace(/\/+$/, "");
+        }
     }
+    return DEFAULT_OPENSPEC_GOVERNANCE_ROOT;
 }
-function allDeps(pkg) {
-    return {
-        ...(pkg.dependencies ?? {}),
-        ...(pkg.devDependencies ?? {}),
-        ...(pkg.peerDependencies ?? {}),
+export async function listOpenspecDiscovery(repoRoot, options = {}) {
+    const governanceRoot = options.governanceRootOverride ??
+        (await resolveOpenspecGovernanceRoot(repoRoot));
+    const extraExcludedPrefixes = (options.extraExcludedPrefixes ?? [])
+        .map((prefix) => prefix.replace(/\\/g, "/").replace(/\/+$/, ""))
+        .filter(Boolean);
+    const collected = [];
+    let excludedGovernanceCount = 0;
+    const isExcluded = (rel) => {
+        if (isGovernanceSubtreePath(rel, governanceRoot))
+            return true;
+        return extraExcludedPrefixes.some((prefix) => rel === prefix || rel.startsWith(prefix + "/"));
     };
-}
-function hasDep(deps, name) {
-    return Object.hasOwn(deps, name);
-}
-async function listOpenspec(repoRoot) {
-    const out = [];
     for (const specDir of OPENSPEC_SPEC_DIRS) {
         const root = path.join(repoRoot, specDir);
         if (!(await exists(root)))
             continue;
         await walk(root, 0);
     }
-    return out.slice(0, 40);
+    // openspec/schemas/** and openspec/project-specs/** sort first; remaining
+    // ai_workspace/** business files follow. Dedupe preserves discovery order.
+    const unique = [...new Set(collected)];
+    const openspecPaths = unique
+        .filter((candidate) => candidate.startsWith("openspec/"))
+        .sort();
+    const aiWorkspacePaths = unique
+        .filter((candidate) => candidate.startsWith("ai_workspace/"))
+        .sort();
+    const deduped = [...openspecPaths, ...aiWorkspacePaths];
+    const truncated = deduped.length > MAX_OPENSPEC_CANDIDATE_PATHS;
+    const paths = truncated
+        ? deduped.slice(0, MAX_OPENSPEC_CANDIDATE_PATHS)
+        : deduped;
+    return {
+        paths,
+        governanceRoot,
+        excludedGovernanceCount,
+        truncated,
+        maxCandidates: MAX_OPENSPEC_CANDIDATE_PATHS,
+    };
     async function walk(dir, depth) {
         if (depth > 4)
             return;
         let entries = [];
         try {
-            entries = await readdir(dir);
+            entries = (await readdir(dir)).sort();
         }
         catch {
             return;
@@ -59,7 +154,13 @@ async function listOpenspec(repoRoot) {
                 if (info.isDirectory())
                     await walk(full, depth + 1);
                 else if (OPENSPEC_SPEC_EXT_RE.test(name)) {
-                    out.push(path.relative(repoRoot, full).replace(/\\/g, "/"));
+                    const rel = path.relative(repoRoot, full).replace(/\\/g, "/");
+                    if (isExcluded(rel)) {
+                        excludedGovernanceCount++;
+                    }
+                    else {
+                        collected.push(rel);
+                    }
                 }
             }
             catch {
@@ -68,6 +169,164 @@ async function listOpenspec(repoRoot) {
         }
     }
 }
+/**
+ * Count spec-extension files under a governance subtree that candidate
+ * discovery would exclude. Bounded, read-only diagnostic helper used by the
+ * prewrite gate to reproduce exclusion stats at runtime.
+ */
+export async function countExcludedGovernanceSpecFiles(repoRoot, governanceRoot) {
+    const root = path.join(repoRoot, governanceRoot);
+    if (!(await exists(root)))
+        return 0;
+    let count = 0;
+    await walkGovernance(root, 0);
+    return count;
+    async function walkGovernance(dir, depth) {
+        if (depth > 4)
+            return;
+        let entries = [];
+        try {
+            entries = (await readdir(dir)).sort();
+        }
+        catch {
+            return;
+        }
+        for (const name of entries) {
+            const full = path.join(dir, name);
+            try {
+                const info = await stat(full);
+                if (info.isDirectory())
+                    await walkGovernance(full, depth + 1);
+                else if (OPENSPEC_SPEC_EXT_RE.test(name))
+                    count++;
+            }
+            catch {
+                // skip
+            }
+        }
+    }
+}
+async function readJson(filePath) {
+    try {
+        return JSON.parse(await readFile(filePath, "utf8"));
+    }
+    catch {
+        return null;
+    }
+}
+function allDeps(pkg) {
+    return {
+        ...(pkg.dependencies ?? {}),
+        ...(pkg.devDependencies ?? {}),
+        ...(pkg.peerDependencies ?? {}),
+    };
+}
+function hasDep(deps, name) {
+    return Object.hasOwn(deps, name);
+}
+function emptyClassified() {
+    return {
+        schemas: [],
+        codeTemplate: [],
+        rule: { api: [], mock: [], router: [], hooks: [], utils: [], components: [], other: [] },
+        theme: [],
+        component: [],
+        uiOther: [],
+        advisoryOther: [],
+    };
+}
+/**
+ * Classify discovered openspec paths by generic directory convention. Only
+ * `isOpenspecSpecFilePath` paths enter a bucket; the classifier never invents
+ * project-specific file names. Basename stems use word-boundary matching so
+ * e.g. `*api*` (case-insensitive) maps to `rule.api` without hardcoding names.
+ */
+function classifyOpenspecPaths(paths) {
+    const classified = emptyClassified();
+    const ruleStem = (basename) => {
+        const lower = basename.toLowerCase();
+        const stems = [
+            ["api", /\bapi\b/],
+            ["mock", /\bmock\b/],
+            ["router", /\brouter\b/],
+            ["hooks", /\bhooks?\b/],
+            ["utils", /\butils?\b/],
+            ["components", /\bcomponents?\b/],
+        ];
+        for (const [key, re] of stems) {
+            if (re.test(lower))
+                return key;
+        }
+        return "other";
+    };
+    for (const candidate of paths) {
+        if (!isOpenspecSpecFilePath(candidate))
+            continue;
+        const segments = candidate.split("/");
+        const basename = segments[segments.length - 1] ?? "";
+        if (candidate.startsWith("openspec/schemas/")) {
+            classified.schemas.push(candidate);
+        }
+        else if (candidate.startsWith("openspec/project-specs/templates/")) {
+            classified.codeTemplate.push(candidate);
+        }
+        else if (candidate.startsWith("openspec/project-specs/rules/")) {
+            classified.rule[ruleStem(basename)].push(candidate);
+        }
+        else if (candidate.startsWith("openspec/project-specs/ui/")) {
+            const lower = basename.toLowerCase();
+            if (/\btheme\b/.test(lower))
+                classified.theme.push(candidate);
+            else if (/\bcomponents?\b/.test(lower))
+                classified.component.push(candidate);
+            else
+                classified.uiOther.push(candidate);
+        }
+        else {
+            classified.advisoryOther.push(candidate);
+        }
+    }
+    const sortBucket = (bucket) => bucket.sort();
+    classified.schemas = sortBucket(classified.schemas);
+    classified.codeTemplate = sortBucket(classified.codeTemplate);
+    for (const key of [
+        "api",
+        "mock",
+        "router",
+        "hooks",
+        "utils",
+        "components",
+        "other",
+    ]) {
+        classified.rule[key] = sortBucket(classified.rule[key]);
+    }
+    classified.theme = sortBucket(classified.theme);
+    classified.component = sortBucket(classified.component);
+    classified.uiOther = sortBucket(classified.uiOther);
+    classified.advisoryOther = sortBucket(classified.advisoryOther);
+    return classified;
+}
+function buildDesignEvidence(openspec) {
+    // Preserve discovery priority order (openspec first, then ai_workspace)
+    // instead of re-sorting; the exact-partition schema identity is set-based.
+    const normativePaths = [...new Set(openspec)];
+    return frontendDesignEvidenceSchema.parse({
+        normativePaths,
+        advisoryPaths: [],
+        conflicts: [],
+        classified: classifyOpenspecPaths(normativePaths),
+    });
+}
+function toOpenspecDiscovery(discovery, designEvidence) {
+    return {
+        source: "auto-discovered",
+        governanceRoot: discovery.governanceRoot,
+        candidateCount: designEvidence.normativePaths.length,
+        excludedGovernanceCount: discovery.excludedGovernanceCount,
+        truncated: discovery.truncated,
+        maxCandidates: discovery.maxCandidates,
+    };
+}
 export function buildAdapterGuidance(capability) {
     const lines = [
         "## Frontend project capability (generation-time)",
@@ -108,7 +367,8 @@ export async function discoverFrontendProjectCapability(repoRoot) {
     const pkgPath = path.join(repoRoot, "package.json");
     const pkgRaw = await readJson(pkgPath);
     if (!pkgRaw || typeof pkgRaw !== "object") {
-        const openspec = await listOpenspec(repoRoot);
+        const discovery = await listOpenspecDiscovery(repoRoot);
+        const designEvidence = buildDesignEvidence(discovery.paths);
         const base = {
             schemaVersion: 1,
             framework: "unknown",
@@ -119,16 +379,13 @@ export async function discoverFrontendProjectCapability(repoRoot) {
             testRunner: [],
             mock: [],
             a11y: { status: "unknown", tools: [], evidencePaths: [] },
-            evidencePaths: openspec.slice(0, 5),
+            evidencePaths: discovery.paths.slice(0, 5),
             reasons: ["package.json missing or unreadable"],
-            designEvidence: {
-                normativePaths: openspec,
-                advisoryPaths: [],
-                conflicts: [],
-            },
+            designEvidence,
+            openspecDiscovery: toOpenspecDiscovery(discovery, designEvidence),
         };
-        if (openspec.length) {
-            base.reasons.push(`openspec spec files discovered: ${openspec.slice(0, 5).join(", ")}`);
+        if (discovery.paths.length) {
+            base.reasons.push(`openspec spec files discovered: ${discovery.paths.slice(0, 5).join(", ")}`);
         }
         return { ...base, adapterGuidance: buildAdapterGuidance(base) };
     }
@@ -283,14 +540,10 @@ export async function discoverFrontendProjectCapability(repoRoot) {
         router = router ?? "next-router";
     if (hasDep(deps, "vue-router"))
         router = "vue-router";
-    const openspec = await listOpenspec(repoRoot);
-    const designEvidence = {
-        normativePaths: openspec,
-        advisoryPaths: [],
-        conflicts: [],
-    };
-    if (openspec.length)
-        evidencePaths.push(...openspec.slice(0, 5));
+    const discovery = await listOpenspecDiscovery(repoRoot);
+    const designEvidence = buildDesignEvidence(discovery.paths);
+    if (discovery.paths.length)
+        evidencePaths.push(...discovery.paths.slice(0, 5));
     const base = {
         schemaVersion: 1,
         framework,
@@ -311,6 +564,7 @@ export async function discoverFrontendProjectCapability(repoRoot) {
         evidencePaths: [...new Set(evidencePaths)],
         reasons,
         designEvidence,
+        openspecDiscovery: toOpenspecDiscovery(discovery, designEvidence),
     };
     return { ...base, adapterGuidance: buildAdapterGuidance(base) };
 }

package/dist/worker/console/chat/turn-process.js

@@ -92,36 +92,25 @@ function sortToolsStable(tools) {
     });
 }
 /**
- * Flush buffered consecutive tools into process items. Semantic operator
- * tools stay as individual activity events; plain tools group into a
- * `tool-group` ("并行调用 · N 项") when two or more land back to back.
+ * Flush buffered consecutive tools into process items (pi-web aligned:
+ * strict sequential flow, no synthetic grouping). Semantic operator tools
+ * stay as individual activity events; plain tools each render as their own
+ * card in stable server order (eventSeq first, createdAt fallback).
  * Thinking/text/activity boundaries break the buffer upstream.
  */
 function flushToolBuffer(processItems, buffer) {
     if (buffer.length === 0)
         return;
     const sorted = sortToolsStable(buffer);
-    let plainGroup = [];
-    const flushPlain = () => {
-        if (plainGroup.length === 1) {
-            processItems.push({ kind: "tool", tool: plainGroup[0] });
-        }
-        else if (plainGroup.length > 1) {
-            processItems.push({ kind: "tool-group", tools: plainGroup });
-        }
-        plainGroup = [];
-    };
     for (const tool of sorted) {
         const activity = semanticActivityForTool(tool);
         if (activity) {
-            flushPlain();
             processItems.push({ kind: "activity", activity });
         }
         else {
-            plainGroup.push(tool);
+            processItems.push({ kind: "tool", tool });
         }
     }
-    flushPlain();
 }
 function emitProcessBlocks(blocks, group, processItems, usedToolIds) {
     let buffer = [];
@@ -324,7 +313,7 @@ export function processGroupSummary(tools, options) {
         parts.push("运行中");
     return { count, errorCount, runningCount, stepCount, label: parts.join(" · ") };
 }
-/** Summary over rendered process items (tool-group tools count individually). */
+/** Summary over rendered process items. */
 export function summarizeProcessItems(items) {
     const tools = [];
     let thinkingCount = 0;
@@ -344,10 +333,8 @@ export function summarizeProcessItems(items) {
             else if (item.activity.kind === "progress")
                 activityRunningCount += 1;
         }
-        else if (item.kind === "tool")
-            tools.push(item.tool);
         else
-            tools.push(...item.tools);
+            tools.push(item.tool);
     }
     return processGroupSummary(tools, {
         thinkingCount,

package/dist/worker/console/harness-pi-model-matrix.js

@@ -0,0 +1,146 @@
+/**
+ * harness.json executors.pi LOW/MED/HIGH 模型矩阵的读写与校验。
+ *
+ * 该模块只服务于 Console「模型与认证」页的模型矩阵编辑器：
+ *  - `validatePiModelMatrixTiers`：写入前拒绝空串 / default 哨兵 / 非字符串 /
+ *    畸形 provider/model（如 provider/、/model、a//b）。
+ *  - `readPiModelMatrixProjection`：读全文档并投影三档的 provider/model 或裸
+ *    model id（供 readiness 结构化投影 piModelMatrix 使用）。
+ *  - `writePiModelMatrix`：读全文档 → 校验 → 原子写 tmp + fsync + rename，
+ *    保留 $schema 与其余所有字段。
+ *
+ * 本模块在 worker/console（Node 侧），不得被浏览器静态资源直接 import
+ * （依赖 node:fs / node:crypto / node:path）。
+ */
+import { randomBytes } from "node:crypto";
+import { open, readFile, rename, writeFile } from "node:fs/promises";
+import path from "node:path";
+import { normalizeExecutorTierValue } from "../../governance/manifest-types.js";
+export const PI_MODEL_TIERS = ["LOW", "MED", "HIGH"];
+/** 校验单档字符串值，返回错误文案；合法返回 undefined。 */
+export function piModelTierValueError(value) {
+    if (typeof value !== "string")
+        return "模型值必须是字符串";
+    if (value.length === 0)
+        return "模型值不能为空";
+    if (value.trim() !== value)
+        return "模型值不能包含首尾空白";
+    if (value === "default")
+        return "default 是保留哨兵，不能作为模型值";
+    // 比 normalizeExecutorTierValue 更严格：拒绝 provider/、/model、a//b。
+    if (value.startsWith("/") || value.endsWith("/") || value.includes("//")) {
+        return "provider/model 格式非法：不允许 /model、provider/ 或 a//b";
+    }
+    return undefined;
+}
+/**
+ * 写入前校验三档字符串值。任何一档非法即整体拒绝，保证不落盘。
+ */
+export function validatePiModelMatrixTiers(input) {
+    if (!input || typeof input !== "object" || Array.isArray(input)) {
+        return {
+            ok: false,
+            code: "INVALID_INPUT",
+            message: "模型矩阵必须是 { LOW, MED, HIGH } 对象",
+        };
+    }
+    const record = input;
+    const tiers = {};
+    for (const tier of PI_MODEL_TIERS) {
+        const raw = record[tier];
+        const error = piModelTierValueError(raw);
+        if (error) {
+            return {
+                ok: false,
+                code: "INVALID_INPUT",
+                message: `${tier}: ${error}`,
+                tier,
+            };
+        }
+        tiers[tier] = raw;
+    }
+    return { ok: true, tiers };
+}
+async function readHarnessJson(repoRoot) {
+    try {
+        const raw = await readFile(path.join(repoRoot, "harness.json"), "utf8");
+        const parsed = JSON.parse(raw);
+        if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+            return undefined;
+        }
+        return parsed;
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * 投影 harness.json executors.pi 三档（provider/model 或裸 model id）。
+ * 缺文件 / 非法 JSON / 未配置档位均优雅降级为缺省，绝不抛错。
+ */
+export async function readPiModelMatrixProjection(repoRoot) {
+    const manifest = await readHarnessJson(repoRoot);
+    const pi = manifest?.executors?.pi;
+    const projection = {};
+    const options = new Set();
+    if (!pi || typeof pi !== "object")
+        return { ...projection, options: [] };
+    const configuredOptions = Array.isArray(pi.modelOptions)
+        ? pi.modelOptions.filter((item) => typeof item === "string" &&
+            item.trim().length > 0 &&
+            item.trim() === item)
+        : [];
+    for (const option of configuredOptions)
+        options.add(option);
+    for (const tier of PI_MODEL_TIERS) {
+        const selection = normalizeExecutorTierValue(pi[tier]);
+        if (!selection)
+            continue;
+        projection[tier] = {
+            model: selection.model,
+            ...(selection.provider ? { provider: selection.provider } : {}),
+            value: selection.provider
+                ? `${selection.provider}/${selection.model}`
+                : selection.model,
+        };
+        options.add(projection[tier].value);
+    }
+    return { ...projection, options: [...options] };
+}
+/**
+ * 原子更新 harness.json executors.pi.LOW/MED/HIGH：
+ * 读全文档 → 校验 → 保留其余字段 → 写 tmp + fsync + rename。
+ */
+export async function writePiModelMatrix(repoRoot, tiers) {
+    const validation = validatePiModelMatrixTiers(tiers);
+    if (!validation.ok) {
+        throw Object.assign(new Error(validation.message), {
+            code: validation.code,
+        });
+    }
+    const file = path.join(repoRoot, "harness.json");
+    const manifest = await readHarnessJson(repoRoot);
+    if (!manifest) {
+        throw Object.assign(new Error("harness.json 不存在或不是合法 JSON"), {
+            code: "HARNESS_NOT_FOUND",
+        });
+    }
+    const executors = (manifest.executors ?? {});
+    const pi = (executors.pi ?? {});
+    const nextPi = { ...pi };
+    for (const tier of PI_MODEL_TIERS) {
+        nextPi[tier] = validation.tiers[tier];
+    }
+    const nextManifest = { ...manifest, executors: { ...executors, pi: nextPi } };
+    const body = `${JSON.stringify(nextManifest, null, 2)}\n`;
+    const tmp = path.join(repoRoot, `.harness.${process.pid}.${randomBytes(4).toString("hex")}.tmp`);
+    await writeFile(tmp, body, { encoding: "utf8" });
+    const handle = await open(tmp, "r+");
+    try {
+        await handle.sync();
+    }
+    finally {
+        await handle.close();
+    }
+    await rename(tmp, file);
+}

package/dist/worker/console/operator-actions.js

@@ -11,6 +11,7 @@ import { resolveLatestDagRunIdForTask } from "./resolve-dag-run-for-task.js";
 import { repoFingerprintV1 } from "./repo-fingerprint.js";
 import { scheduleOperation, } from "./operation-runner.js";
 import { readinessGateFailure, } from "./pi-readiness.js";
+import { validatePiModelMatrixTiers, writePiModelMatrix, } from "./harness-pi-model-matrix.js";
 import { isAssessmentFreshForDraft } from "./interview/assessment.js";
 import { applyGrillMeAnswer, draftSummary, emptyDraft, isDraftStructurallyComplete, nextGrillMeQuestion, } from "./interview/grill-me.js";
 import { toCanonicalDraftForCli, } from "./draft-store.js";
@@ -2483,6 +2484,54 @@ export async function dispatchOperatorAction(ctx, req) {
                 }),
             };
         }
+        case "savePiModelMatrix": {
+            // 「模型与认证」页模型矩阵编辑器：三档字符串值经校验后原子写入
+            // harness.json executors.pi，并自动重测 readiness。写路径本身由 HTTP
+            // 层 evaluateMutationGate 拦截（cookie + confirmation 头 + origin）。
+            const matrixInput = p.matrix ?? p;
+            const validation = validatePiModelMatrixTiers(matrixInput);
+            if (!validation.ok) {
+                return {
+                    kind: "error",
+                    status: 400,
+                    body: operatorFailed({
+                        command: action,
+                        outcome: "invalid",
+                        code: validation.code,
+                        message: validation.message,
+                        ...(validation.tier ? { details: { tier: validation.tier } } : {}),
+                    }),
+                };
+            }
+            try {
+                await writePiModelMatrix(ctx.repoRoot, validation.tiers);
+            }
+            catch (error) {
+                return {
+                    kind: "error",
+                    status: 500,
+                    body: operatorFailed({
+                        command: action,
+                        outcome: "blocked",
+                        code: "PI_MODEL_MATRIX_WRITE_FAILED",
+                        message: error instanceof Error ? error.message : String(error),
+                    }),
+                };
+            }
+            // 保存成功自动重测 readiness（复用 probePiReadiness），让页面立即
+            // 展示新的 modelsAvailable / modelsMessage / piModelMatrix（AC-4）。
+            const report = ctx.refreshReadiness
+                ? await ctx.refreshReadiness()
+                : ctx.getReadiness?.() ?? ctx.readiness;
+            return {
+                kind: "sync",
+                status: 200,
+                body: operatorSucceeded("savePiModelMatrix", {
+                    tiers: validation.tiers,
+                    readiness: report,
+                }),
+            };
+        }
         default: {
             // M5 official-command coverage uses one generic tail for newly registered
             // CLI actions. It remains inside dispatchOperatorAction (the sole dispatch