@zhuoyuezs/ml-platform 0.1.16 → 0.1.17

package/DEVELOPMENT.md

@@ -9,7 +9,7 @@
 - Business CLI 与 Skill 是并列组件；CLI 不属于 Skill。
 - Skill 直接调用正式命令 `ml-platform`，不嵌入 CLI runtime。
 - 正式 npm 包只有 `@zhuoyuezs/ml-platform`，正式 bin 只有 `ml-platform`。
-- `business-client-js/` 是 CLI 唯一源码，`skills/feature-management/` 是 Skill 唯一源码。
+- `business-client-js/` 是 CLI 唯一源码，仓库 `skills/` 下三个受支持 Skill 是各自唯一源码。
 - `npx @zhuoyuezs/ml-platform@<version> install` 是面向用户的统一安装入口；默认目标是 Codex
   用户级 Skill，不要求额外安装参数。
 - 管理命令默认输出简洁结果；Agent 和 CI 显式使用 `--json` 获取稳定结构化输出。
@@ -27,6 +27,8 @@
 ```text
 business-client-js/
 skills/feature-management/
+skills/model-lifecycle-management/
+skills/model-deployment-management/
 npm/ml-platform/
 npm/scripts/build_ml_platform_release.py
 agent_poc/codex-host/
@@ -41,7 +43,7 @@ package/
 │   ├── main.js
 │   └── lib.js
 ├── runtime/business-client/
-├── skills/feature-management/
+├── skills/<skill-name>/
 ├── release-policy.json
 ├── release.json
 ├── checksums.json
@@ -76,7 +78,7 @@ Host 副本、日志、会话数据、attic、凭证和实验文件。
 
 完成标准：正式 CLI 不需要 Python、`uv` 或第三方 npm runtime 依赖，旧 Python client 可删除。
 
-### Step 2：重建纯 feature-management Skill（已完成）
+### Step 2：重建纯 Skills（已完成）
 
 - 保留 `SKILL.md`、`agents/`、`references/` 和 `assets/catalog-template/`；
 - npm staging 时排除 `assets/wheels/`、Skill installer 和 CLI launcher；这些旧 Python
@@ -94,7 +96,7 @@ Host 副本、日志、会话数据、attic、凭证和实验文件。
 只有 Step 1 和 Step 2 都完成后，才开始 npm dispatcher/installer：
 
 - 定义 `release.json` v2 和 `checksums.json` 覆盖范围；
-- 确定 `runtime/business-client` 与 `skills/feature-management` 并列目录；
+- 确定 `runtime/business-client` 与 `skills/<skill-name>` 并列目录；
 - 定义 `ml-platform` 安装管理命令和业务命令的无歧义分发；
 - 定义 `npx ... install` 如何建立持久 CLI，禁止引用一次性 npx cache；
 - 定义 CLI home、shim、PATH 检查和跨平台失败行为；
@@ -106,7 +108,7 @@ Host 副本、日志、会话数据、attic、凭证和实验文件。
 ### Step 4：重构 release builder（已完成）
 
 - 从 `business-client-js` 复制唯一 client tree 到 `runtime/business-client`；
-- 从 canonical Skill 复制纯 Skill 到 `skills/feature-management`；
+- 从仓库 canonical `skills/<skill-name>/` 复制全部纯 Skill；
 - 生成 release v2 和 checksums；
 - 拒绝多份 client、Skill runtime、旧 wheel 和未知文件；
 - 执行 npm package allowlist 和可重现 digest 检查；
@@ -134,7 +136,7 @@ Host 副本、日志、会话数据、attic、凭证和实验文件。
 
 ### Step 7：Skill + CLI 端到端发布验收（已完成）
 
-- `git diff --check -- npm business-client-js skills/feature-management agent_poc/codex-host`；
+- `git diff --check -- npm business-client-js skills agent_poc/codex-host`；
 - JS business-client tests；
 - JavaScript OpenAPI contract 与 Catalog tests；
 - Skill validator 和 forward tests；

package/README.md

@@ -1,6 +1,7 @@
 # ML Platform
 
-ML Platform 的 JavaScript CLI、`feature-management` 与 `model-lifecycle-management` Agent Skill。CLI 与 Skill 由同一个 npm
+ML Platform 的 JavaScript CLI、`feature-management`、`model-lifecycle-management` 与
+`model-deployment-management` Agent Skill。CLI 与 Skill 由同一个 npm
 release 安装和升级，运行时不需要 Python 或 `uv`。
 
 ## 环境要求
@@ -17,7 +18,7 @@ release 安装和升级，运行时不需要 Python 或 `uv`。
 npx @zhuoyuezs/ml-platform@latest install
 ```
 
-这条命令不需要额外参数。默认安装持久化的 `ml-platform` 命令，并将两个 Skill 安装到
+这条命令不需要额外参数。默认安装持久化的 `ml-platform` 命令，并将三个 Skill 安装到
 `~/.codex/skills/`，供当前用户的 Codex 使用。安装后重启终端和 Agent 会话。
 
 只在当前项目使用 Skill 时，在项目根目录运行：
@@ -26,7 +27,7 @@ npx @zhuoyuezs/ml-platform@latest install
 npx @zhuoyuezs/ml-platform@latest install --scope project
 ```
 
-此时 Skill 安装到当前目录的 `.agents/skills/feature-management/`。如果命令不在项目根目录运行，
+此时 Skill 安装到当前目录的 `.agents/skills/<skill-name>/`。如果命令不在项目根目录运行，
 再使用 `--project-dir /absolute/path/to/project` 显式指定项目。
 
 ### 安装参数
@@ -124,7 +125,8 @@ npx --yes --registry=https://registry.npmjs.org/ \
 ## 包内容
 
 - 一份 JavaScript business CLI；
-- 两份纯 Skill：`feature-management` 与 `model-lifecycle-management`；
+- 三份纯 Skill：`feature-management`、`model-lifecycle-management` 与
+  `model-deployment-management`；
 - 显式安装、升级、状态、校验和回滚逻辑。
 
 不包含 Codex CLI、Python business-client wheel、Agent Host、平台服务端、模型训练或 Kubernetes

package/checksums.json

@@ -2,17 +2,17 @@
   "files": [
     {
       "path": "runtime/business-client/README.md",
-      "sha256": "sha256:b823c0cafc47478fa1297c7c2e61e15b537db155586dd012b40d678d788c3ce3",
-      "size_bytes": 5158
+      "sha256": "sha256:168e376d3eec34da4cb7966aac44b5c87239ca432d9921588f499713c6aeb24b",
+      "size_bytes": 6122
     },
     {
       "path": "runtime/business-client/package-lock.json",
-      "sha256": "sha256:a8da8027de475825949a661bc0d5674903e686d72ac945dcd964febfc5cf4667",
+      "sha256": "sha256:b234d20b44cbfd166efef2a9ec6d91e00488952c9a6c7ccb1fdfa50374c4b986",
       "size_bytes": 381
     },
     {
       "path": "runtime/business-client/package.json",
-      "sha256": "sha256:e1f916820a4bb19929a76f2690970068d17bb12bf640b89aae007eef50ef7b95",
+      "sha256": "sha256:95551c271e726f4d69bf81b9f234b11781dc3b9a2e4b9f86db90ba8ca827ce42",
       "size_bytes": 501
     },
     {
@@ -22,8 +22,8 @@
     },
     {
       "path": "runtime/business-client/src/cli.js",
-      "sha256": "sha256:4f135325b57725c614d266285013df799cdd9a2096d8fbe0a9e9608dae2bcdb7",
-      "size_bytes": 44947
+      "sha256": "sha256:3739b93b0bf42bf8c0521005cfe73b080e14ec88e0fe46feb0f375575a98b7ec",
+      "size_bytes": 53174
     },
     {
       "path": "runtime/business-client/src/config.js",
@@ -115,10 +115,35 @@
       "sha256": "sha256:2c7a894330a649248e7f52c944422bcd7a3aba4558f7984d129dfd21c8736cf3",
       "size_bytes": 4540
     },
+    {
+      "path": "skills/model-deployment-management/SKILL.md",
+      "sha256": "sha256:5dfeab163f2c11bd4554da23e898d388a7883a2501e6a9655ee45fcada7659bb",
+      "size_bytes": 2608
+    },
+    {
+      "path": "skills/model-deployment-management/agents/openai.yaml",
+      "sha256": "sha256:55c1a33d59cf08e27e7c806157576a9f8cec079a0fc6775f299794304ae8b6e1",
+      "size_bytes": 238
+    },
+    {
+      "path": "skills/model-deployment-management/references/contracts.md",
+      "sha256": "sha256:3b040a97dcbf3b22b194bef2bb8c1af744d434ee88a6f47deed9ee4b83cf3147",
+      "size_bytes": 1926
+    },
+    {
+      "path": "skills/model-deployment-management/references/operations.md",
+      "sha256": "sha256:410111f01b972832bd48290d280f5364cacf2e63e7d586d3b670fad9b997f695",
+      "size_bytes": 2333
+    },
+    {
+      "path": "skills/model-deployment-management/references/troubleshooting.md",
+      "sha256": "sha256:2354dfad1493c361f534a7d02dbd8ccafa4662a6ebc8e6d1b0bf8dce447dd527",
+      "size_bytes": 1410
+    },
     {
       "path": "skills/model-lifecycle-management/SKILL.md",
-      "sha256": "sha256:faa4f8c0dbae7d1c1e2ca94499ce9b13cc8b52e8229154c05ac6282ea5e47788",
-      "size_bytes": 3610
+      "sha256": "sha256:74ca6bad54ddb1dc30d3307335d045a70d2d383279011657cc49c1e549eda5a6",
+      "size_bytes": 3801
     },
     {
       "path": "skills/model-lifecycle-management/agents/openai.yaml",
@@ -137,8 +162,8 @@
     },
     {
       "path": "skills/model-lifecycle-management/references/packaging.md",
-      "sha256": "sha256:0992f2f9104cb0d65a6325756108211d3f94856e05eca12640e9792c07e1108f",
-      "size_bytes": 3250
+      "sha256": "sha256:f46a5f9c326049a0c2411fdb9d392bea2f4d667062289ee0322a5d9d328c8363",
+      "size_bytes": 4888
     },
     {
       "path": "skills/model-lifecycle-management/references/training-contracts.md",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zhuoyuezs/ml-platform",
-  "version": "0.1.16",
+  "version": "0.1.17",
   "description": "ML 数据平台 business CLI 与 Agent Skills 管理工具",
   "bin": {
     "ml-platform": "scripts/main.js"

package/release.json

@@ -13,8 +13,8 @@
     "entrypoint": "src/cli.js",
     "name": "ml-platform",
     "path": "runtime/business-client",
-    "sha256": "sha256:262508ceeef693cdd580e2952f49161d860cee257fbc87ee46c95979cf1285d1",
-    "version": "0.7.6"
+    "sha256": "sha256:864a3c32efc728bda13b4e2364174e63b9054368be9062ce4f67fe1aac034720",
+    "version": "0.7.7"
   },
   "policy_sha256": "sha256:02fbde0134696b78c0c365d6e0b76c9814227208da5b2b3d4e5dbd82dc4a3606",
   "public_schema_versions": [
@@ -25,7 +25,7 @@
     "ml_data_platform.feature_set/v1",
     "ml_data_platform.dataset_manifest/v1"
   ],
-  "release_version": "0.1.16",
+  "release_version": "0.1.17",
   "runtime_requirements": {
     "node": ">=18",
     "os": [
@@ -37,16 +37,22 @@
   "skills": {
     "feature-management": {
       "path": "skills/feature-management",
-      "requires_cli": ">=0.7.6 <0.8.0",
-      "revision": "0.1.16",
+      "requires_cli": ">=0.7.7 <0.8.0",
+      "revision": "0.1.17",
       "sha256": "sha256:182b6f2df4fe58c946e482dfaf416c7d5b78c6fde9c8c8d7293103246618cb4e"
     },
+    "model-deployment-management": {
+      "path": "skills/model-deployment-management",
+      "requires_cli": ">=0.7.7 <0.8.0",
+      "revision": "0.1.17",
+      "sha256": "sha256:8a4c71ec8bde6c8b37c038f327797286ffa5a3ec10501278bd3d0abbab1b7509"
+    },
     "model-lifecycle-management": {
       "path": "skills/model-lifecycle-management",
-      "requires_cli": ">=0.7.6 <0.8.0",
-      "revision": "0.1.16",
-      "sha256": "sha256:61ba17f955b36d1c2e8329a10454d040ee7eca5afdb90ff0914d3f85b6e2d203"
+      "requires_cli": ">=0.7.7 <0.8.0",
+      "revision": "0.1.17",
+      "sha256": "sha256:a00a50de7b7a5244a08d9865db10c812a1c6291c94ca01a8562f1b2d1ff72f2b"
     }
   },
-  "source_commit": "49bc1482ab3a58874e40e308640db26e13e6ef12"
+  "source_commit": "2f547af208a94ebaf2a4c61ff6ca93f11bdbf43e"
 }

package/runtime/business-client/README.md

@@ -48,7 +48,28 @@ ml-platform get-parameter-lifecycle <name> <version> --project <project>
 ml-platform fetch-inference-context /absolute/path/to/request.json
 ```
 
-已部署模型的标准推理使用 Serving URL，不使用控制面 `--api-url`。Chronos-2 v2 的
+受治理部署通过同一业务 CLI 完成预检、创建、状态等待、晋级、回滚和下线。正常业务操作
+不使用 `kubectl`，也不创建、修改或删除 NetworkPolicy：
+
+```bash
+ml-platform validate-deployment /absolute/path/to/deployment.json \
+  --evaluation-id <pass-evaluation-id>
+ml-platform create-deployment /absolute/path/to/deployment.json \
+  --evaluation-id <pass-evaluation-id>
+ml-platform wait-deployment <deployment-id> --wait-timeout-seconds 1800
+ml-platform get-deployment <deployment-id>
+ml-platform get-deployment-events <deployment-id> --limit 100 --offset 0
+```
+
+`READY` 必须同时包含 `ReplicasReady=true`、`ArtifactsVerified=true` 和
+`SmokePredictionPassed=true`。`get-deployment` 返回控制器实际观察到的 endpoint 元数据；
+本地 CLI 不推测 Kubernetes Service 名称。部署后验证优先使用控制面代理：
+
+```bash
+ml-platform predict-deployment <deployment-id> /absolute/path/to/request.json
+```
+
+直接访问已知外部 Serving URL 时仍可使用 `predict-model`。Chronos-2 v2 的
 `known_future` 协变量放在 inline 请求的 `inputs.future_covariates` 中；每个预测步一行，
 行数必须等于模型的 `prediction_length`。下例为 15 分钟频率、预测 30 分钟；预测明天时
 同样提供整天的所有未来步：

package/runtime/business-client/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@zhuoyuezs/ml-platform-business-client",
-  "version": "0.7.6",
+  "version": "0.7.7",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@zhuoyuezs/ml-platform-business-client",
-      "version": "0.7.6",
+      "version": "0.7.7",
       "license": "UNLICENSED",
       "bin": {
         "ml-platform": "src/cli.js"

package/runtime/business-client/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zhuoyuezs/ml-platform-business-client",
-  "version": "0.7.6",
+  "version": "0.7.7",
   "private": true,
   "description": "JavaScript implementation of the ML Platform business client",
   "bin": {

package/runtime/business-client/src/cli.js

@@ -35,6 +35,10 @@ const BUSINESS_COMMANDS = new Set([
   "validate-evaluation-run", "submit-evaluation", "get-evaluation-run", "get-evaluation-job", "retry-evaluation-job", "cancel-evaluation-job", "list-evaluation-attempts",
   "get-evaluation-result", "get-evaluation-result-metrics", "get-evaluation-result-artifacts", "summarize-evaluation-run", "get-evaluation-summary",
   "create-model-package", "get-model-package", "cancel-model-package", "validate-model-artifact",
+  "list-deployment-targets", "validate-deployment", "create-deployment", "list-deployments",
+  "get-deployment", "wait-deployment", "reconcile-deployment", "approve-deployment",
+  "promote-deployment", "rollback-deployment", "suspend-deployment", "resume-deployment",
+  "undeploy-deployment", "get-deployment-events", "predict-deployment",
 ]);
 
 const COMMAND_USAGE = {
@@ -138,6 +142,21 @@ const COMMAND_USAGE = {
   "get-model-package": "get-model-package PACKAGE_ID [--package-version VERSION]",
   "cancel-model-package": "cancel-model-package PACKAGE_ID [--package-version VERSION]",
   "validate-model-artifact": "validate-model-artifact ARTIFACT_ID",
+  "list-deployment-targets": "list-deployment-targets",
+  "validate-deployment": "validate-deployment SPEC_JSON --evaluation-id ID",
+  "create-deployment": "create-deployment SPEC_JSON --evaluation-id ID",
+  "list-deployments": "list-deployments [--service SERVICE] [--environment ENV] [--state STATE] [-q QUERY] [--limit N] [--offset N]",
+  "get-deployment": "get-deployment DEPLOYMENT_ID",
+  "wait-deployment": "wait-deployment DEPLOYMENT_ID [--poll-interval SECONDS] [--wait-timeout-seconds SECONDS]",
+  "reconcile-deployment": "reconcile-deployment DEPLOYMENT_ID",
+  "approve-deployment": "approve-deployment DEPLOYMENT_ID --revision N --approver NAME --decision approved|rejected [--reason TEXT]",
+  "promote-deployment": "promote-deployment DEPLOYMENT_ID --stage canary|production --actor NAME --reason TEXT [--approval-id ID]",
+  "rollback-deployment": "rollback-deployment DEPLOYMENT_ID --actor NAME --reason TEXT [--to-revision N] [--to-deployment-id ID]",
+  "suspend-deployment": "suspend-deployment DEPLOYMENT_ID --actor NAME --reason TEXT",
+  "resume-deployment": "resume-deployment DEPLOYMENT_ID --actor NAME --reason TEXT",
+  "undeploy-deployment": "undeploy-deployment DEPLOYMENT_ID --actor NAME --reason TEXT",
+  "get-deployment-events": "get-deployment-events DEPLOYMENT_ID [--limit N] [--offset N]",
+  "predict-deployment": "predict-deployment DEPLOYMENT_ID REQUEST_JSON",
   apply: "apply CATALOG_DIRECTORY [--dry-run] [--project PROJECT]",
 };
 
@@ -291,6 +310,28 @@ async function waitForJob(api, jobId, pollInterval, timeoutSeconds) {
   }
 }
 
+function observedDeploymentState(payload) {
+  const state = payload?.observed_state?.observed_state ?? payload?.observed_state;
+  if (typeof state !== "string") throw new Error("deployment status response has no observed state");
+  return state;
+}
+
+async function waitForDeployment(api, deploymentId, pollInterval, timeoutSeconds) {
+  if (!(pollInterval > 0)) throw new Error("deployment poll interval must be positive");
+  if (timeoutSeconds !== undefined && !(timeoutSeconds > 0)) throw new Error("deployment wait timeout must be positive");
+  const deadline = timeoutSeconds === undefined ? Infinity : Date.now() + timeoutSeconds * 1000;
+  let previous;
+  while (true) {
+    const payload = await api.get(`/deployments/${encodeURIComponent(deploymentId)}`);
+    if (!payload || typeof payload !== "object" || Array.isArray(payload)) throw new Error("deployment status response must be a JSON object");
+    const state = observedDeploymentState(payload);
+    if (state !== previous) { process.stderr.write(`deployment ${deploymentId}: ${state}\n`); previous = state; }
+    if (["READY", "FAILED", "DEGRADED", "SUPERSEDED", "SUSPENDED", "UNDEPLOYED", "ROLLED_BACK"].includes(state)) return payload;
+    if (Date.now() >= deadline) throw new Error(`timed out waiting for deployment ${deploymentId}`);
+    await new Promise((resolve) => setTimeout(resolve, pollInterval * 1000));
+  }
+}
+
 async function runBusinessCli(argv) {
   if (argv.length === 0) throw new Error("a business command is required");
   if (argv.includes("--help") || argv.includes("-h")) {
@@ -457,6 +498,91 @@ async function runBusinessCli(argv) {
     const request = readSpec(positional(rest, "request JSON")); const servingUrl = take(rest, "--serving-url");
     if (!servingUrl) throw new Error("--serving-url is required");
     result = await new PlatformApiClient(servingUrl, options.timeout).post("/v1/inference", request);
+  } else if (options.command === "list-deployment-targets") {
+    result = await client(options).get("/deployment-targets");
+  } else if (["validate-deployment", "create-deployment"].includes(options.command)) {
+    const deployment = readSpec(positional(rest, "deployment spec JSON"));
+    const evaluationId = take(rest, "--evaluation-id");
+    if (!evaluationId) throw new Error("--evaluation-id is required");
+    const endpoint = options.command === "validate-deployment" ? "/deployments/validate" : "/deployments";
+    result = await client(options).post(endpoint, { deployment, evaluation_id: evaluationId });
+  } else if (options.command === "list-deployments") {
+    const params = {
+      service: take(rest, "--service"),
+      environment: take(rest, "--environment"),
+      state: take(rest, "--state"),
+      q: take(rest, "--q", take(rest, "-q")),
+    };
+    boolean(rest, "--all");
+    result = await listCollection(client(options), "/deployments", params, rest);
+  } else if (options.command === "get-deployment") {
+    const deploymentId = positional(rest, "deployment id");
+    result = await client(options).get(`/deployments/${encodeURIComponent(deploymentId)}`);
+  } else if (options.command === "wait-deployment") {
+    const deploymentId = positional(rest, "deployment id");
+    const poll = finiteNumber(take(rest, "--poll-interval", 2), "--poll-interval");
+    const rawTimeout = take(rest, "--wait-timeout-seconds");
+    result = await waitForDeployment(
+      client(options),
+      deploymentId,
+      poll,
+      rawTimeout === undefined ? undefined : finiteNumber(rawTimeout, "--wait-timeout-seconds"),
+    );
+    if (observedDeploymentState(result) !== "READY") exitCode = 1;
+  } else if (options.command === "reconcile-deployment") {
+    const deploymentId = positional(rest, "deployment id");
+    result = await client(options).post(`/deployments/${encodeURIComponent(deploymentId)}/reconcile`);
+  } else if (options.command === "approve-deployment") {
+    const deploymentId = positional(rest, "deployment id");
+    const rawRevision = take(rest, "--revision");
+    const approver = take(rest, "--approver");
+    if (rawRevision === undefined) throw new Error("--revision is required");
+    if (!approver) throw new Error("--approver is required");
+    const decision = take(rest, "--decision", "approved");
+    if (!["approved", "rejected"].includes(decision)) throw new Error("--decision must be approved or rejected");
+    result = await client(options).post(`/deployments/${encodeURIComponent(deploymentId)}/approvals`, {
+      revision: integer(rawRevision, "--revision"), stage: "production", decision, approver,
+      reason: take(rest, "--reason", ""),
+    });
+  } else if (options.command === "promote-deployment") {
+    const deploymentId = positional(rest, "deployment id");
+    const stage = take(rest, "--stage"); const actor = take(rest, "--actor"); const reason = take(rest, "--reason");
+    if (!["canary", "production"].includes(stage)) throw new Error("--stage must be canary or production");
+    if (!actor) throw new Error("--actor is required");
+    if (!reason) throw new Error("--reason is required");
+    result = await client(options).post(`/deployments/${encodeURIComponent(deploymentId)}/promote`, {
+      stage, actor, reason, approval_id: take(rest, "--approval-id"),
+    });
+  } else if (options.command === "rollback-deployment") {
+    const deploymentId = positional(rest, "deployment id");
+    const actor = take(rest, "--actor"); const reason = take(rest, "--reason");
+    if (!actor) throw new Error("--actor is required");
+    if (!reason) throw new Error("--reason is required");
+    const rawRevision = take(rest, "--to-revision");
+    result = await client(options).post(`/deployments/${encodeURIComponent(deploymentId)}/rollback`, {
+      actor, reason,
+      to_revision: rawRevision === undefined ? undefined : integer(rawRevision, "--to-revision"),
+      to_deployment_id: take(rest, "--to-deployment-id"),
+    });
+  } else if (["suspend-deployment", "resume-deployment", "undeploy-deployment"].includes(options.command)) {
+    const deploymentId = positional(rest, "deployment id");
+    const actor = take(rest, "--actor"); const reason = take(rest, "--reason");
+    if (!actor) throw new Error("--actor is required");
+    if (!reason) throw new Error("--reason is required");
+    const action = options.command.split("-")[0];
+    result = await client(options).post(`/deployments/${encodeURIComponent(deploymentId)}/${action}`, { actor, reason });
+  } else if (options.command === "get-deployment-events") {
+    const deploymentId = positional(rest, "deployment id");
+    result = await listCollection(
+      client(options),
+      `/deployments/${encodeURIComponent(deploymentId)}/events`,
+      {},
+      rest,
+    );
+  } else if (options.command === "predict-deployment") {
+    const deploymentId = positional(rest, "deployment id");
+    const request = readSpec(positional(rest, "request JSON"));
+    result = await client(options).post(`/deployments/${encodeURIComponent(deploymentId)}/predict`, request);
   } else if (options.command === "get-model-runtime-release") {
     result = await client(options).get("/model-runtime-release");
   } else if (options.command.startsWith("list-") && LIFECYCLE_COLLECTIONS.has(options.command.slice(5))) {
@@ -529,7 +655,7 @@ async function listCollection(api, endpoint, params, rest) {
   return api.get(endpoint, { ...params, limit, offset });
 }
 
-module.exports = { BUSINESS_COMMANDS, fetchAll, listCollection, parse, runBusinessCli, usage, waitForJob };
+module.exports = { BUSINESS_COMMANDS, fetchAll, listCollection, parse, runBusinessCli, usage, waitForDeployment, waitForJob };
 
 if (require.main === module) {
   runBusinessCli(process.argv.slice(2)).then((code) => { process.exitCode = code; }).catch((error) => {

package/skills/model-deployment-management/SKILL.md

@@ -0,0 +1,47 @@
+---
+name: model-deployment-management
+description: Manage governed ITSMP model deployments and post-deployment predictions through the ml-platform business CLI. Use when a user asks to validate or create a DeploymentSpec, inspect targets or rollout state, wait for readiness, record approval, promote, roll back, suspend, resume, undeploy, inspect deployment events, or invoke a deployed model. Do not use for training, evaluation, packaging, image release engineering, or Kubernetes administration.
+---
+
+# Model Deployment Management
+
+Use the `ml-platform` executable installed with the same npm release as this
+Skill. Normal deployment operations go through the ITSMP control plane; do not
+use `kubectl` to create, promote, roll back, suspend, resume, or undeploy a
+business model.
+
+```text
+REGISTERED ModelArtifact + PASS EvaluationResult + READY ModelPackage
+  -> validated DeploymentSpec -> DeploymentRevision -> READY -> prediction
+```
+
+Read [references/contracts.md](references/contracts.md) before authoring or
+validating a DeploymentSpec. Read
+[references/operations.md](references/operations.md) immediately before a
+deployment mutation or prediction. Read
+[references/troubleshooting.md](references/troubleshooting.md) when a
+deployment does not reach `READY` or an operation is rejected.
+
+## Required Gates
+
+- Verify `ml-platform version`, `ml-platform show-config`, and
+  `ml-platform --profile server health` before control-plane work.
+- Use only a `READY` ModelPackage image with an immutable `@sha256:` digest and
+  the package-bound FeatureRetrievalSpec and smoke request.
+- Run `validate-deployment` before `create-deployment`. Validation is read-only
+  and does not authorize creation.
+- Obtain explicit authorization for the exact deployment and operation before
+  create, reconcile, approval, promotion, rollback, suspend, resume, or
+  undeploy. Retry requires renewed authorization when the previous mutation
+  returned an ambiguous result.
+- Treat `READY` as valid only when `ReplicasReady`, `ArtifactsVerified`, and
+  `SmokePredictionPassed` are all true for the current revision.
+- Use `predict-deployment`; it routes through the control plane to the recorded
+  deployment endpoint. Do not infer Kubernetes Service names or require the
+  user to reach a cluster-local URL.
+- Never create, modify, or delete NetworkPolicy. Cluster operators own that
+  boundary.
+
+Report the deployment ID, revision, immutable image digest, desired and
+observed state, failed conditions, endpoint reachability, and event evidence.
+Do not claim a deployment is usable merely because its Pod is running.

package/skills/model-deployment-management/agents/openai.yaml

@@ -0,0 +1,4 @@
+interface:
+  display_name: "模型部署管理"
+  short_description: "管理 ITSMP 模型部署、晋级、回滚与部署后推理"
+  default_prompt: "使用 $model-deployment-management 管理受治理模型部署及部署后推理。"

package/skills/model-deployment-management/references/contracts.md

@@ -0,0 +1,55 @@
+# Deployment Contracts
+
+## DeploymentSpec
+
+Use a JSON object accepted by `ml-platform validate-deployment` with these
+load-bearing fields:
+
+```json
+{
+  "schema_version": "ml_data_platform.deployment/v1",
+  "deployment_id": "deployment_forecast_staging_01",
+  "service": "forecast-service",
+  "environment": "staging",
+  "model_artifact_id": "artifact_01",
+  "package_id": "package_01",
+  "package_version": "1",
+  "image": "registry.example/model-serving@sha256:<64-hex>",
+  "target": {"type": "kubernetes", "namespace": "itsmp-model-serving"},
+  "feature_retrieval": {},
+  "replicas": 1,
+  "resources": {},
+  "rollout": {"strategy": "canary", "traffic_percent": 10},
+  "stage": "staging"
+}
+```
+
+Do not reconstruct `feature_retrieval` or `feature_lookup_test` from memory.
+They must match the registered artifact lineage and the tested ModelPackage.
+The server normalizes an omitted lookup test from the package during
+validation and creation.
+
+The first deployment starts at `staging`. A replacement for an existing
+service/environment declares the active leaf in `previous_deployment_id`.
+Production is reached only by staging to canary to production promotion.
+
+## Revision State
+
+`DeploymentSpec` is immutable. Promotion, rollback, suspension, resumption,
+and undeploy append immutable revisions. Reconcile writes mutable observed
+state separately.
+
+`READY` requires all three current-revision conditions:
+
+- `ReplicasReady=true`
+- `ArtifactsVerified=true`
+- `SmokePredictionPassed=true`
+
+The detail response includes `endpoints`. Cluster-local endpoints have
+`externally_reachable=false`; a Gateway endpoint is externally reachable only
+when rollout hostname metadata exists. `available=true` means the current
+revision passed all READY gates.
+
+Successful smoke verification is cached durably by revision, image digest,
+contract hash, and frozen lookup-test hash. A new revision or changed identity
+must run smoke again.

package/skills/model-deployment-management/references/operations.md

@@ -0,0 +1,78 @@
+# Deployment Operations
+
+## Initialize
+
+```bash
+command -v ml-platform
+ml-platform version
+ml-platform show-config
+ml-platform --profile server health
+ml-platform --profile server list-deployment-targets
+```
+
+## Validate And Create
+
+Validation and creation are separate authorization points:
+
+```bash
+ml-platform --profile server validate-deployment /absolute/path/deployment.json \
+  --evaluation-id <pass-evaluation-id>
+
+ml-platform --profile server create-deployment /absolute/path/deployment.json \
+  --evaluation-id <pass-evaluation-id>
+
+ml-platform --profile server wait-deployment <deployment-id> \
+  --poll-interval 5 --wait-timeout-seconds 1800
+```
+
+Use `get-deployment` to inspect the full revision history and endpoints. Use
+`list-deployments` for discovery and `get-deployment-events` for paginated
+audit evidence.
+
+## Promotion And Approval
+
+```bash
+ml-platform --profile server promote-deployment <deployment-id> \
+  --stage canary --actor <actor> --reason <reason>
+
+ml-platform --profile server approve-deployment <deployment-id> \
+  --revision <canary-revision> --approver <approver> \
+  --decision approved --reason <reason>
+
+ml-platform --profile server promote-deployment <deployment-id> \
+  --stage production --actor <actor> --reason <reason> \
+  --approval-id <approval-id>
+```
+
+Do not approve production before the canary revision is `READY` and the user
+has authorized that exact revision.
+
+## Rollback And Offline Operations
+
+```bash
+ml-platform --profile server rollback-deployment <deployment-id> \
+  --to-revision <revision> --actor <actor> --reason <reason>
+
+ml-platform --profile server suspend-deployment <deployment-id> \
+  --actor <actor> --reason <reason>
+
+ml-platform --profile server resume-deployment <deployment-id> \
+  --actor <actor> --reason <reason>
+
+ml-platform --profile server undeploy-deployment <deployment-id> \
+  --actor <actor> --reason <reason>
+```
+
+Suspend is recoverable. Undeploy removes runtime resources but retains revision
+history; it is not equivalent to resume.
+
+## Prediction
+
+```bash
+ml-platform --profile server predict-deployment <deployment-id> \
+  /absolute/path/request.json
+```
+
+Prediction is allowed only for a current `READY` revision with all readiness
+conditions true. This command uses the control-plane proxy and does not require
+a cluster-local Serving URL.

package/skills/model-deployment-management/references/troubleshooting.md

@@ -0,0 +1,31 @@
+# Deployment Troubleshooting
+
+Start with read-only control-plane evidence:
+
+```bash
+ml-platform --profile server get-deployment <deployment-id>
+ml-platform --profile server get-deployment-events <deployment-id> \
+  --limit 100 --offset 0
+```
+
+Interpret conditions before considering a reconcile:
+
+- `ReplicasReady=false`: inspect scheduler, image pull, resource quota, and Pod
+  readiness through the platform/cluster diagnostic boundary.
+- `ArtifactsVerified=false`: the Serving `/model` identity does not match the
+  revision, or the endpoint is unavailable.
+- `SmokePredictionPassed=false`: preserve the frozen package smoke request and
+  error. Do not replace it with a current-time request to force success.
+- `SUPERSEDED`: operate on the active deployment leaf.
+- `SUSPENDED`: resume only with explicit authorization and a reason.
+- `UNDEPLOYED`: create a governed deployment or rollback as supported; resume
+  is invalid.
+
+`reconcile-deployment` is a mutation because it may update Kubernetes
+resources and execute verification. Obtain authorization for the exact
+deployment before invoking it. Repeated successful reconcile should not rerun
+the same expensive smoke or append identical events.
+
+Use Kubernetes commands only when the user explicitly requests platform
+diagnostics or administration. Do not use them as an alternate deployment
+workflow, and never create, modify, or delete NetworkPolicy.

package/skills/model-lifecycle-management/SKILL.md

@@ -36,3 +36,7 @@ to discover fields. Preserve release/error evidence when deployment differs.
 - Keep credentials, registry secrets, Kubernetes details, and model binaries out of request JSON and reports.
 
 Report immutable input identities, returned run/job/package IDs, status, validation or gate failures, and the next authorized action. Never claim deployment; it is outside this Skill.
+
+Route deployment validation, creation, rollout state, approval, promotion,
+rollback, offline operations, and deployment-bound prediction to the separate
+`model-deployment-management` Skill.

package/skills/model-lifecycle-management/references/packaging.md

@@ -31,6 +31,53 @@ runtime. `feature_lookup` still requires artifact lineage
 signature. Do not infer either capability from training success.
 Omit rather than use an empty list to request default inline behavior.
 
+For `feature_lookup`, the package request must bind both the exact retrieval
+contract and a sanitized real lookup test. They are immutable package identity,
+not namespace Secret/ConfigMap settings:
+
+```json
+{
+  "model_artifact_id": "replace_registered_model_artifact_id",
+  "package_version": "1.0.0",
+  "input_modes": ["inline", "feature_lookup"],
+  "feature_retrieval": {
+    "type": "data_platform",
+    "manifest": {
+      "project": "replace_project",
+      "dataset_id": "replace_inference_manifest",
+      "dataset_version": "v1",
+      "manifest_hash": "sha256:<registered-manifest-hash>"
+    },
+    "feature_set": {
+      "project": "replace_project",
+      "name": "replace_feature_set",
+      "version": "v1"
+    },
+    "contract_signature": "sha256:<artifact-contract-signature>",
+    "request": {
+      "mode": "row",
+      "input_adapter_hash": "sha256:<artifact-input-adapter-hash>",
+      "temporal_binding_hash": "sha256:<training-temporal-binding-hash>",
+      "entity_keys": {}
+    },
+    "freshness_policy": "strict"
+  },
+  "feature_lookup_test": {
+    "input_mode": "feature_lookup",
+    "cutoff_time": "2026-09-11T00:00:00+08:00",
+    "horizon": [{"duration": "PT10M"}],
+    "entity": {}
+  }
+}
+```
+
+The inference DatasetManifest must exist with the supplied hash and use
+`mode=inference`. Its FeatureSet, stable contract signature, adapter/temporal
+hashes, entity keys, and row/context parameters must match the ModelArtifact.
+The test cutoff must include a timezone. A legacy feature-lookup package missing
+either package-bound field remains readable but cannot be rerun or deployed;
+create a new package version.
+
 Always query the exact package ID and version; states are `PACKAGING`, `READY`,
 `FAILED`, `CANCELLED`. A client timeout does not prove packaging failed. Retain the
 known identity and query it before attempting another creation.