@webskill/sdk 0.6.0 → 0.7.0

package/dist/governance.d.ts

@@ -1,6 +1,6 @@
-import { B as PageQuery, P as FileSystemProvider, Q as SkillCatalogEntry, b as UiBridge, et as SkillDocument, f as LlmMessage, it as SkillManagerPort, l as LlmClient, z as Page } from "./types-4pg-qp_I-Gq63X8Oa.js";
-import { It as SkillStateGuard, Mt as SkillOutcomeReporter, V as IntegrityVerdict, jt as SkillIntegrityGuard, on as WebSkillRuntime, vt as RuntimeRun } from "./index-C-KFAZoF.js";
-import { _ as SkillVersion, a as AuditLog, c as CandidateFile, d as CandidateSource, f as CandidateStatus, g as SkillState, h as SKILL_VERSION_PAGE_SIZE, i as AuditEvent, l as CandidateRisk, m as CompositeApprovalPolicy, n as ApprovalDecision, o as AuditQueryFilter, p as CandidateStore, r as ApprovalPolicy, s as CANDIDATE_PAGE_SIZE, t as AlwaysHumanApprovalPolicy, u as CandidateSkill, v as SkillVersionStore, y as candidateToCatalogEntry } from "./skillVersionStore-BzLbzFOL-CxdAFWO2.js";
+import { H as PageQuery, I as FileSystemProvider, V as Page, et as SkillCatalogEntry, f as LlmMessage, l as LlmClient, nt as SkillDocument, ot as SkillManagerPort, x as UiBridge } from "./types-CcxRLdJG-DCXyw1US.js";
+import { H as IntegrityVerdict, Nt as SkillIntegrityGuard, Pt as SkillOutcomeReporter, Rt as SkillStateGuard, bt as RuntimeRun, ln as WebSkillRuntime } from "./index-DkbABR43.js";
+import { _ as SkillVersion, a as AuditLog, c as CandidateFile, d as CandidateSource, f as CandidateStatus, g as SkillState, h as SKILL_VERSION_PAGE_SIZE, i as AuditEvent, l as CandidateRisk, m as CompositeApprovalPolicy, n as ApprovalDecision, o as AuditQueryFilter, p as CandidateStore, r as ApprovalPolicy, s as CANDIDATE_PAGE_SIZE, t as AlwaysHumanApprovalPolicy, u as CandidateSkill, v as SkillVersionStore, y as candidateToCatalogEntry } from "./skillVersionStore-Bl-ElD45-CWPvGvoq.js";
 //#region ../governance/dist/index.d.ts
 //#region src/candidate/candidateNormalizer.d.ts
 /** 剥 markdown fence 与 <think> 块、截取首尾 {}；非对象 → CANDIDATE_INVALID */
@@ -99,12 +99,29 @@ interface AuditChainVerification {
   /** 首个断链位置（行号，0 起；ok 时 undefined） */
   brokenAt?: number;
   reason?: string;
+  /** 已扫描的记录总数（无论成败都给，便于判断断点在全链中的位置） */
+  total?: number;
+  /** 断点前一条的 ts（断点在首行时缺失） */
+  brokenBeforeTs?: string;
+  /** 断点所在记录的 ts（该行不可解析时缺失） */
+  brokenAfterTs?: string;
+}
+/** 带断链报告的分页结果（`tolerateBrokenChain` 打开时才可能带上后两个字段） */
+interface AuditPage extends Page<AuditEvent> {
+  chainBrokenAt?: number;
+  chainReason?: string;
 }
 /**
  * JSONL 追加式审计日志（<managedRoot>/.webskill/audit.jsonl）：
- * 真追加（fs.appendText，不整读改写）+ lastHash 内存缓存（同实例不重读）。
+ * 真追加（fs.appendText，不整读改写）+ lastHash 缓存（仅当文件字节数未变时可用）。
  * 语义：**tamper-evident, not tamper-proof**——verifyChain 能检出篡改/删除/换序，
  * 但不阻止有写权限者直接改写文件；更强保证需要签名信任体系（未排期）。
+ *
+ * **并发边界**：追加的串行化只在**同一进程内**成立（模块级 mutex）。
+ * 跨进程 / 跨标签页靠的是「写前用 `stat().size` 重新确认链尾」：
+ * 外部写入会改变字节数，后写者因此会重读链尾而不会分叉——
+ * 除非两个进程落在同一个 stat/append 窗口内。真正的跨进程互斥需要文件锁，
+ * `FileSystemProvider` 不提供，不在本版承诺范围。
  */
 declare class FsAuditLog implements AuditLog {
   #private;
@@ -126,11 +143,42 @@ declare class FsAuditLog implements AuditLog {
    * 任一处对不上以 `GOVERNANCE_FAILED` 报错。范围之外的断链不在本方法职责内——
    * 那是 `verifyChain()` 的事（全量 O(N) 校验不该压在每次翻页上）。
    */
-  query(filter?: AuditQueryFilter & PageQuery): Promise<Page<AuditEvent>>;
-  /** hash 链完整性校验：逐行重算 hash 并核对 prevHash 链接 */
+  query(filter?: AuditQueryFilter & PageQuery): Promise<AuditPage>;
+  /** hash 链完整性校验：逐行重算 hash 并核对 prevHash 链接。**只读**，绝不改写历史 */
   verifyChain(): Promise<AuditChainVerification>;
 }
 //#endregion
+//#region src/audit/eventTypes.d.ts
+/**
+ * 审计事件类型常量（FR-13.4）。
+ *
+ * 存在的理由是**消灭调用点的字面量**：写入点分散在 governance 与 console 的十来个文件里，
+ * 字面量拼错不会有任何编译期反馈，只会在审计里留下一条永远查不到的记录。
+ *
+ * `AuditEvent.type` 刻意**保持 `string`**、不收窄为 `AuditEventType`——
+ * 收窄会让外部写入方（插件、其它宿主）无法追加自定义类型，且会立刻产生快照差异。
+ */
+declare const AUDIT_EVENT_TYPES: {
+  readonly skillEdited: "skill.edited";
+  readonly skillRolledBack: "skill.rolled_back";
+  readonly skillPublished: "skill.published";
+  readonly skillRepairApplied: "skill.repair_applied";
+  readonly skillQuarantined: "skill.quarantined";
+  readonly skillPolicyDenied: "skill.policy_denied";
+  readonly skillUninstalled: "skill.uninstalled";
+  readonly skillInstalled: "skill.installed";
+  readonly trustKeyAdded: "trust.key_added";
+  readonly trustKeyRemoved: "trust.key_removed";
+  readonly policyNetworkChanged: "policy.network_changed";
+  readonly policyPrivacyChanged: "policy.privacy_changed";
+  readonly mcpEndpointChanged: "mcp.endpoint_changed";
+  readonly mcpPolicyRelaxed: "mcp.policy_relaxed";
+  readonly providerChanged: "provider.changed";
+};
+type AuditEventType = (typeof AUDIT_EVENT_TYPES)[keyof typeof AUDIT_EVENT_TYPES];
+/** 稳定展示序：筛选下拉与文档表格都从这里取，不各自维护一份顺序 */
+declare const AUDIT_EVENT_TYPE_LIST: readonly AuditEventType[];
+//#endregion
 //#region src/repair/failureAnalyzer.d.ts
 interface FailureDiagnosis {
   cause: string;
@@ -173,6 +221,17 @@ declare class RepairPlanner {
 }
 //#endregion
 //#region src/state/skillStatePolicy.d.ts
+/**
+ * 用户策略主动拒绝的错误码（FR-12.4）：这是配置生效的证据，不是技能有问题，不计入隔离阈值。
+ *
+ * 集中在这一份常量里而不散在条件判断里，是为了让「哪些码不计数」只有一个事实源。
+ */
+declare const POLICY_DENIAL_CODES: ReadonlySet<string>;
+/** 自动隔离的原因判别式（FR-12.6）；人工隔离仍写自由文本 */
+declare const QUARANTINE_REASONS: {
+  readonly integrity: "integrity";
+  readonly failures: "failures";
+};
 /**
  * 降级治理：states.json 持久化；失败达阈值 → quarantined；
  * canRoute 仅 active；canExecute active|deprecated；disabled 执行抛 SKILL_DISABLED；
@@ -191,15 +250,22 @@ declare class SkillStatePolicy {
   setState(skillName: string, state: SkillState, input: {
     actor?: string;
     reason?: string;
+    detail?: string;
   }): Promise<void>;
   /**
    * 失败计数；达阈值（默认 3）→ quarantined + 审计。
    *
-   * 计数是**累计**而非「连续」：成功不清零，只有 `setState(name, 'active')` 会清。
+   * 计数是**连续**而非累计（0.7.0 FR-12.5）：一次成功执行经 `clearFailures` 归零，
+   * `setState(name, 'active')` 同样清零。
    */
   recordFailure(skillName: string, input?: {
     actor?: string;
   }): Promise<SkillState>;
+  /**
+   * 成功清零（FR-12.5）。不写审计（成功是常态，写了会把审计流淹掉），
+   * 也**不改变 state**——已隔离的技能不会因一次成功自动解除。
+   */
+  clearFailures(skillName: string): Promise<void>;
   canRoute(state: SkillState): boolean;
   canExecute(state: SkillState): boolean;
   /**
@@ -221,17 +287,18 @@ declare class SkillStatePolicy {
   toSkillIntegrityGuard(verify: (skillName: string) => Promise<IntegrityVerdict>): SkillIntegrityGuard;
   /**
    * runtime `SkillOutcomeReporter` 适配（F1）：一次真实的技能脚本执行失败 → `recordFailure`，
-   * 达阈值即自动 `quarantined` + 写审计。
+   * 达阈值即自动 `quarantined` + 写审计；一次成功 → `clearFailures`。
    *
    * 0.4.0 之前 `recordFailure` 没有任何生产调用方——`states.json` 的失败计数只在单测里增长，
    * 于是「失败达阈值自动隔离」在真实部署里从不触发，Console 上那个计数恒为 0。
    * 这个适配器就是把那一段接上：runtime 不能反向依赖治理，装配点只能在宿主。
    *
-   * 只上报失败、不上报成功，与 `recordFailure` 的既有语义保持一致（累计计数，
-   * 成功不清零，只有 `setState(name, 'active')` 清零）。
+   * 策略拒绝的分流放在这里而不是 `recordFailure`：后者是**治理动作**（管理员也可手工调用），
+   * 它不该知道运行时错误码；判定“这次失败算不算技能的错”是**上报侧**的语义。
    */
   toSkillOutcomeReporter(input?: {
     actor?: string;
+    policyDenialCodes?: ReadonlySet<string>;
   }): SkillOutcomeReporter;
   /** disabled → SKILL_DISABLED；quarantined → SKILL_QUARANTINED */
   assertExecutable(skillName: string): Promise<void>;
@@ -405,4 +472,4 @@ declare function createMissHook(deps: {
  */
 declare function completeText(llm: LlmClient, messages: LlmMessage[]): Promise<string>;
 //#endregion
-export { AUDIT_PAGE_SIZE, AlwaysHumanApprovalPolicy, type ApprovalDecision, type ApprovalPolicy, type AuditEvent, type AuditLog, type AuditQueryFilter, CANDIDATE_PAGE_SIZE, type CandidateFile, type CandidateRisk, type CandidateSink, type CandidateSinkOptions, type CandidateSkill, type CandidateSource, type CandidateStatus, CandidateStore, CompositeApprovalPolicy, DependencyGraph, DocumentSkillExtractor, type EvaluationReport, type EvaluationResult, EvaluationRunner, type EvaluationTask, FailureAnalyzer, type FailureDiagnosis, FsAuditLog, type GeneratedSkillSubmission, LlmCandidateGenerator, type RepairOption, RepairPlanner, SCORING_WEIGHTS, SKILL_VERSION_PAGE_SIZE, type ScoreInput, SimilarityDetector, SkillScorer, type SkillState, SkillStatePolicy, type SkillVersion, SkillVersionStore, type SourceDocument, candidateToCatalogEntry, completeText, createCandidateSink, createMissHook, jaccardSimilarity, normalizeCandidate, normalizeCandidateFiles, normalizeRisk, parseJsonObject, readDocument, sanitizeCandidateName, suggestFromFailedRun, validateCandidate };
+export { AUDIT_EVENT_TYPES, AUDIT_EVENT_TYPE_LIST, AUDIT_PAGE_SIZE, AlwaysHumanApprovalPolicy, type ApprovalDecision, type ApprovalPolicy, type AuditChainVerification, type AuditEvent, type AuditEventType, type AuditLog, type AuditPage, type AuditQueryFilter, CANDIDATE_PAGE_SIZE, type CandidateFile, type CandidateRisk, type CandidateSink, type CandidateSinkOptions, type CandidateSkill, type CandidateSource, type CandidateStatus, CandidateStore, CompositeApprovalPolicy, DependencyGraph, DocumentSkillExtractor, type EvaluationReport, type EvaluationResult, EvaluationRunner, type EvaluationTask, FailureAnalyzer, type FailureDiagnosis, FsAuditLog, type GeneratedSkillSubmission, LlmCandidateGenerator, POLICY_DENIAL_CODES, QUARANTINE_REASONS, type RepairOption, RepairPlanner, SCORING_WEIGHTS, SKILL_VERSION_PAGE_SIZE, type ScoreInput, SimilarityDetector, SkillScorer, type SkillState, SkillStatePolicy, type SkillVersion, SkillVersionStore, type SourceDocument, candidateToCatalogEntry, completeText, createCandidateSink, createMissHook, jaccardSimilarity, normalizeCandidate, normalizeCandidateFiles, normalizeRisk, parseJsonObject, readDocument, sanitizeCandidateName, suggestFromFailedRun, validateCandidate };

package/dist/governance.js

@@ -1,5 +1,6 @@
 import { O as messageOf, T as isValidSkillName, g as assertSafePathSegment, m as WebSkillError } from "./dist-8oQRa8Xz.js";
 import { a as textParts, n as partsToText } from "./memoryArtifactStore-52Zn9npI-BMPYwvoy.js";
+import { n as AUDIT_EVENT_TYPE_LIST, t as AUDIT_EVENT_TYPES } from "./eventTypes-DjIQpt8Y-Bj3vghj4.js";
 
 //#region ../governance/dist/index.js
 const invalid = (message, details) => {
@@ -331,19 +332,32 @@ function canonical(event) {
 	});
 }
 /**
+* 同一进程内按审计文件路径共享的链式 mutex。
+* 跟着实例走不行：本类允许多实例指向同一个 root，而交错追加正是分叉的来源。
+*/
+const APPEND_LOCKS = /* @__PURE__ */ new Map();
+/**
 * JSONL 追加式审计日志（<managedRoot>/.webskill/audit.jsonl）：
-* 真追加（fs.appendText，不整读改写）+ lastHash 内存缓存（同实例不重读）。
+* 真追加（fs.appendText，不整读改写）+ lastHash 缓存（仅当文件字节数未变时可用）。
 * 语义：**tamper-evident, not tamper-proof**——verifyChain 能检出篡改/删除/换序，
 * 但不阻止有写权限者直接改写文件；更强保证需要签名信任体系（未排期）。
+*
+* **并发边界**：追加的串行化只在**同一进程内**成立（模块级 mutex）。
+* 跨进程 / 跨标签页靠的是「写前用 `stat().size` 重新确认链尾」：
+* 外部写入会改变字节数，后写者因此会重读链尾而不会分叉——
+* 除非两个进程落在同一个 stat/append 窗口内。真正的跨进程互斥需要文件锁，
+* `FileSystemProvider` 不提供，不在本版承诺范围。
 */
 var FsAuditLog = class {
 	#root;
 	#fs;
 	#now;
 	#createId;
-	/** lastHash 内存缓存（同实例内追加不重读文件） */
+	/** lastHash 内存缓存（仅当 #lastKnownSize 与当前文件字节数相等时才作数） */
 	#lastHash;
 	#lastHashSeeded = false;
+	/** 本实例最后一次写入后观察到的文件字节数 */
+	#lastKnownSize;
 	constructor(deps) {
 		this.#root = deps.root.replace(/\/+$/, "");
 		this.#fs = deps.fs;
@@ -354,8 +368,13 @@ var FsAuditLog = class {
 	async #seedLastHash() {
 		this.#lastHashSeeded = true;
 		const path = fileOf$1(this.#root);
-		if (!await this.#fs.exists(path)) return "GENESIS";
-		const lines = (await this.#fs.readText(path)).split("\n").filter((l) => l.trim() !== "");
+		if (!await this.#fs.exists(path)) {
+			this.#lastKnownSize = void 0;
+			return "GENESIS";
+		}
+		const text = await this.#fs.readText(path);
+		this.#lastKnownSize = await this.#fileSize();
+		const lines = text.split("\n").filter((l) => l.trim() !== "");
 		if (lines.length === 0) return "GENESIS";
 		try {
 			const last = JSON.parse(lines.at(-1));
@@ -364,21 +383,50 @@ var FsAuditLog = class {
 			throw new WebSkillError("GOVERNANCE_FAILED", `Audit log tail line at ${path} is corrupted; refusing to append (the chain must not silently restart)`, e);
 		}
 	}
+	/** 当前字节数；文件不存在、提供方不报 size 或 stat 抛错时统一返回 undefined */
+	async #fileSize() {
+		try {
+			return (await this.#fs.stat(fileOf$1(this.#root))).size;
+		} catch {
+			return;
+		}
+	}
+	/**
+	* 追加前解析链尾（FR-13.1）。
+	* 缓存只在「文件字节数与本实例上次写后一致」时才作数；
+	* 拿不到 size 就无条件重读——不把「大概没变」当正确性依据。
+	*/
+	async #resolvePrevHash() {
+		if (!this.#lastHashSeeded) return this.#seedLastHash();
+		const size = await this.#fileSize();
+		if (size === void 0 || size !== this.#lastKnownSize) return this.#seedLastHash();
+		return this.#lastHash;
+	}
+	/** 同一审计文件上的追加串行化（前一个失败也要继续排队） */
+	async #withAppendLock(work) {
+		const path = fileOf$1(this.#root);
+		const next = (APPEND_LOCKS.get(path) ?? Promise.resolve()).then(work, work);
+		APPEND_LOCKS.set(path, next.catch(() => void 0));
+		return next;
+	}
 	async append(event) {
-		const prevHash = this.#lastHashSeeded ? this.#lastHash : await this.#seedLastHash();
-		const full = {
-			id: event.id ?? this.#createId?.() ?? `audit-${Math.random().toString(36).slice(2, 10)}`,
-			ts: event.ts ?? this.#now?.() ?? (/* @__PURE__ */ new Date()).toISOString(),
-			type: event.type,
-			target: event.target,
-			...event.actor !== void 0 ? { actor: event.actor } : {},
-			...event.data !== void 0 ? { data: event.data } : {},
-			prevHash
-		};
-		full.hash = await sha256Hex$1(canonical(full));
-		await this.#fs.appendText(fileOf$1(this.#root), `${JSON.stringify(full)}\n`);
-		this.#lastHash = full.hash;
-		return full;
+		return this.#withAppendLock(async () => {
+			const prevHash = await this.#resolvePrevHash();
+			const full = {
+				id: event.id ?? this.#createId?.() ?? `audit-${Math.random().toString(36).slice(2, 10)}`,
+				ts: event.ts ?? this.#now?.() ?? (/* @__PURE__ */ new Date()).toISOString(),
+				type: event.type,
+				target: event.target,
+				...event.actor !== void 0 ? { actor: event.actor } : {},
+				...event.data !== void 0 ? { data: event.data } : {},
+				prevHash
+			};
+			full.hash = await sha256Hex$1(canonical(full));
+			await this.#fs.appendText(fileOf$1(this.#root), `${JSON.stringify(full)}\n`);
+			this.#lastHash = full.hash;
+			this.#lastKnownSize = await this.#fileSize();
+			return full;
+		});
 	}
 	/**
 	* 分页 + 筛选下推。整文件读仍在（JSONL 布局未改，备案 D25），
@@ -425,29 +473,47 @@ var FsAuditLog = class {
 		}
 		const start = Math.max(0, end - limit);
 		const items = [];
+		let broken;
 		for (const line of matched.slice(start, end)) {
 			const event = records[line];
-			await this.#assertChainAt(records, line, path);
+			const failure = await this.#chainFailureAt(records, line);
+			if (failure !== void 0) {
+				if (filter.tolerateBrokenChain !== true) throw new WebSkillError("GOVERNANCE_FAILED", `Audit chain is broken at line ${line} of ${path}: ${failure}`);
+				broken ??= {
+					at: line,
+					reason: failure
+				};
+				break;
+			}
 			items.push(event);
 		}
 		return {
 			items,
-			...start > 0 ? { nextCursor: String(start) } : {}
+			...start > 0 ? { nextCursor: String(start) } : {},
+			...broken !== void 0 ? {
+				chainBrokenAt: broken.at,
+				chainReason: broken.reason
+			} : {}
 		};
 	}
-	/** 单行的链自洽：本行 hash 重算相符，且 prevHash 指向前一行的 hash */
-	async #assertChainAt(records, index, path) {
+	/** 单行的链自洽：本行 hash 重算相符，且 prevHash 指向前一行的 hash。自洽时返回 undefined */
+	async #chainFailureAt(records, index) {
 		const event = records[index];
 		const expectedPrev = index === 0 ? "GENESIS" : records[index - 1]?.hash;
-		if (expectedPrev === void 0 || event.prevHash !== expectedPrev) throw new WebSkillError("GOVERNANCE_FAILED", `Audit chain is broken at line ${index} of ${path}: prevHash link mismatch (events may have been removed, reordered or corrupted)`);
-		if (event.hash !== await sha256Hex$1(canonical(event))) throw new WebSkillError("GOVERNANCE_FAILED", `Audit chain is broken at line ${index} of ${path}: event hash mismatch (event content was tampered)`);
+		if (expectedPrev === void 0 || event.prevHash !== expectedPrev) return "prevHash link mismatch (events may have been removed, reordered or corrupted)";
+		if (event.hash !== await sha256Hex$1(canonical(event))) return "event hash mismatch (event content was tampered)";
 	}
-	/** hash 链完整性校验：逐行重算 hash 并核对 prevHash 链接 */
+	/** hash 链完整性校验：逐行重算 hash 并核对 prevHash 链接。**只读**，绝不改写历史 */
 	async verifyChain() {
 		const path = fileOf$1(this.#root);
-		if (!await this.#fs.exists(path)) return { ok: true };
+		if (!await this.#fs.exists(path)) return {
+			ok: true,
+			total: 0
+		};
 		const lines = (await this.#fs.readText(path)).split("\n").filter((l) => l.trim() !== "");
+		const total = lines.length;
 		let expectedPrev = "GENESIS";
+		let prevTs;
 		for (let i = 0; i < lines.length; i++) {
 			let event;
 			try {
@@ -456,23 +522,29 @@ var FsAuditLog = class {
 				return {
 					ok: false,
 					brokenAt: i,
-					reason: "line is not valid JSON"
+					reason: "line is not valid JSON",
+					total,
+					...prevTs !== void 0 ? { brokenBeforeTs: prevTs } : {}
 				};
 			}
-			if (event.prevHash !== expectedPrev) return {
+			const broken = (reason) => ({
 				ok: false,
 				brokenAt: i,
-				reason: "prevHash link mismatch (events may have been removed or reordered)"
-			};
+				reason,
+				total,
+				...prevTs !== void 0 ? { brokenBeforeTs: prevTs } : {},
+				...typeof event.ts === "string" ? { brokenAfterTs: event.ts } : {}
+			});
+			if (event.prevHash !== expectedPrev) return broken("prevHash link mismatch (events may have been removed or reordered)");
 			const expectedHash = await sha256Hex$1(canonical(event));
-			if (event.hash !== expectedHash) return {
-				ok: false,
-				brokenAt: i,
-				reason: "event hash mismatch (event content was tampered)"
-			};
+			if (event.hash !== expectedHash) return broken("event hash mismatch (event content was tampered)");
 			expectedPrev = event.hash;
+			prevTs = event.ts;
 		}
-		return { ok: true };
+		return {
+			ok: true,
+			total
+		};
 	}
 };
 const dirOf = (root, skillName) => {
@@ -560,7 +632,7 @@ var SkillVersionStore = class {
 	async rollback(skillName, targetVersionId, input) {
 		const target = await this.get(skillName, targetVersionId);
 		const auditEvent = await this.#audit?.append({
-			type: "skill.rolled_back",
+			type: AUDIT_EVENT_TYPES.skillRolledBack,
 			target: skillName,
 			...input.actor !== void 0 ? { actor: input.actor } : {},
 			data: { targetVersionId }
@@ -653,6 +725,21 @@ var RepairPlanner = class {
 };
 const fileOf = (root) => `${root}/.webskill/states.json`;
 /**
+* 用户策略主动拒绝的错误码（FR-12.4）：这是配置生效的证据，不是技能有问题，不计入隔离阈值。
+*
+* 集中在这一份常量里而不散在条件判断里，是为了让「哪些码不计数」只有一个事实源。
+*/
+const POLICY_DENIAL_CODES = /* @__PURE__ */ new Set([
+	"NETWORK_BLOCKED",
+	"TOOL_NOT_ALLOWED",
+	"FS_PERMISSION_DENIED"
+]);
+/** 自动隔离的原因判别式（FR-12.6）；人工隔离仍写自由文本 */
+const QUARANTINE_REASONS = {
+	integrity: "integrity",
+	failures: "failures"
+};
+/**
 * 降级治理：states.json 持久化；失败达阈值 → quarantined；
 * canRoute 仅 active；canExecute active|deprecated；disabled 执行抛 SKILL_DISABLED；
 * 卸载/状态变更经 UiBridge confirm 审批。
@@ -713,17 +800,22 @@ var SkillStatePolicy = class {
 		data.states[skillName] = state;
 		if (state === "active") delete data.failures[skillName];
 		await this.#persist();
+		const auditData = {
+			...input.reason !== void 0 ? { reason: input.reason } : {},
+			...input.detail !== void 0 ? { detail: input.detail } : {}
+		};
 		await this.#audit?.append({
 			type: `skill.${state === "active" ? "reactivated" : state === "quarantined" ? "quarantined" : state === "deprecated" ? "deprecated" : "disabled"}`,
 			target: skillName,
 			...input.actor !== void 0 ? { actor: input.actor } : {},
-			...input.reason !== void 0 ? { data: { reason: input.reason } } : {}
+			...Object.keys(auditData).length > 0 ? { data: auditData } : {}
 		});
 	}
 	/**
 	* 失败计数；达阈值（默认 3）→ quarantined + 审计。
 	*
-	* 计数是**累计**而非「连续」：成功不清零，只有 `setState(name, 'active')` 会清。
+	* 计数是**连续**而非累计（0.7.0 FR-12.5）：一次成功执行经 `clearFailures` 归零，
+	* `setState(name, 'active')` 同样清零。
 	*/
 	async recordFailure(skillName, input = {}) {
 		assertSafePathSegment(skillName, "skill name");
@@ -735,10 +827,11 @@ var SkillStatePolicy = class {
 			state = "quarantined";
 			data.states[skillName] = "quarantined";
 			await this.#audit?.append({
-				type: "skill.quarantined",
+				type: AUDIT_EVENT_TYPES.skillQuarantined,
 				target: skillName,
 				...input.actor !== void 0 ? { actor: input.actor } : {},
 				data: {
+					reason: QUARANTINE_REASONS.failures,
 					failures: count,
 					threshold: this.#failureThreshold
 				}
@@ -747,6 +840,17 @@ var SkillStatePolicy = class {
 		await this.#persist();
 		return state;
 	}
+	/**
+	* 成功清零（FR-12.5）。不写审计（成功是常态，写了会把审计流淹掉），
+	* 也**不改变 state**——已隔离的技能不会因一次成功自动解除。
+	*/
+	async clearFailures(skillName) {
+		assertSafePathSegment(skillName, "skill name");
+		const data = await this.#load();
+		if (data.failures[skillName] === void 0) return;
+		delete data.failures[skillName];
+		await this.#persist();
+	}
 	canRoute(state) {
 		return state === "active";
 	}
@@ -790,25 +894,44 @@ var SkillStatePolicy = class {
 					reason: `integrity check failed: ${e instanceof Error ? e.message : String(e)}`
 				};
 			}
-			if (!verdict.ok) await this.setState(skillName, "quarantined", { reason: verdict.reason ?? "integrity verification failed on activation" });
+			if (!verdict.ok) await this.setState(skillName, "quarantined", {
+				reason: QUARANTINE_REASONS.integrity,
+				detail: verdict.reason ?? "integrity verification failed on activation"
+			});
 			return verdict;
 		} };
 	}
 	/**
 	* runtime `SkillOutcomeReporter` 适配（F1）：一次真实的技能脚本执行失败 → `recordFailure`，
-	* 达阈值即自动 `quarantined` + 写审计。
+	* 达阈值即自动 `quarantined` + 写审计；一次成功 → `clearFailures`。
 	*
 	* 0.4.0 之前 `recordFailure` 没有任何生产调用方——`states.json` 的失败计数只在单测里增长，
 	* 于是「失败达阈值自动隔离」在真实部署里从不触发，Console 上那个计数恒为 0。
 	* 这个适配器就是把那一段接上：runtime 不能反向依赖治理，装配点只能在宿主。
 	*
-	* 只上报失败、不上报成功，与 `recordFailure` 的既有语义保持一致（累计计数，
-	* 成功不清零，只有 `setState(name, 'active')` 清零）。
+	* 策略拒绝的分流放在这里而不是 `recordFailure`：后者是**治理动作**（管理员也可手工调用），
+	* 它不该知道运行时错误码；判定“这次失败算不算技能的错”是**上报侧**的语义。
 	*/
 	toSkillOutcomeReporter(input = {}) {
-		return { onSkillFailed: async (report) => {
-			await this.recordFailure(report.skillName, input);
-		} };
+		const denied = input.policyDenialCodes ?? POLICY_DENIAL_CODES;
+		const actor = input.actor !== void 0 ? { actor: input.actor } : {};
+		return {
+			onSkillFailed: async (report) => {
+				if (denied.has(report.code)) {
+					await this.#audit?.append({
+						type: AUDIT_EVENT_TYPES.skillPolicyDenied,
+						target: report.skillName,
+						...actor,
+						data: { code: report.code }
+					});
+					return;
+				}
+				await this.recordFailure(report.skillName, actor);
+			},
+			onSkillSucceeded: async (report) => {
+				await this.clearFailures(report.skillName);
+			}
+		};
 	}
 	/** disabled → SKILL_DISABLED；quarantined → SKILL_QUARANTINED */
 	async assertExecutable(skillName) {
@@ -839,7 +962,7 @@ var SkillStatePolicy = class {
 		delete data.failures[skillName];
 		await this.#persist();
 		await this.#audit?.append({
-			type: "skill.uninstalled",
+			type: AUDIT_EVENT_TYPES.skillUninstalled,
 			target: skillName,
 			actor: input.actor
 		});
@@ -1089,4 +1212,4 @@ function createMissHook(deps) {
 }
 
 //#endregion
-export { AUDIT_PAGE_SIZE, AlwaysHumanApprovalPolicy, CANDIDATE_PAGE_SIZE, CandidateStore, CompositeApprovalPolicy, DependencyGraph, DocumentSkillExtractor, EvaluationRunner, FailureAnalyzer, FsAuditLog, LlmCandidateGenerator, RepairPlanner, SCORING_WEIGHTS, SKILL_VERSION_PAGE_SIZE, SimilarityDetector, SkillScorer, SkillStatePolicy, SkillVersionStore, candidateToCatalogEntry, completeText, createCandidateSink, createMissHook, jaccardSimilarity, normalizeCandidate, normalizeCandidateFiles, normalizeRisk, parseJsonObject, readDocument, sanitizeCandidateName, suggestFromFailedRun, validateCandidate };
+export { AUDIT_EVENT_TYPES, AUDIT_EVENT_TYPE_LIST, AUDIT_PAGE_SIZE, AlwaysHumanApprovalPolicy, CANDIDATE_PAGE_SIZE, CandidateStore, CompositeApprovalPolicy, DependencyGraph, DocumentSkillExtractor, EvaluationRunner, FailureAnalyzer, FsAuditLog, LlmCandidateGenerator, POLICY_DENIAL_CODES, QUARANTINE_REASONS, RepairPlanner, SCORING_WEIGHTS, SKILL_VERSION_PAGE_SIZE, SimilarityDetector, SkillScorer, SkillStatePolicy, SkillVersionStore, candidateToCatalogEntry, completeText, createCandidateSink, createMissHook, jaccardSimilarity, normalizeCandidate, normalizeCandidateFiles, normalizeRisk, parseJsonObject, readDocument, sanitizeCandidateName, suggestFromFailedRun, validateCandidate };