@zhuoyuezs/ml-platform 0.1.3 → 0.1.5

package/runtime/business-client/src/config.js

@@ -11,11 +11,15 @@ function expandHome(value) {
 }
 
 function configPath() {
-  if (process.env.ML_PLATFORM_CONFIG_PATH?.trim()) return path.resolve(expandHome(process.env.ML_PLATFORM_CONFIG_PATH));
+  for (const variable of ["ML_PLATFORM_CONFIG_PATH", "DATA_PLATFORM_DEMO_CONFIG_PATH"]) {
+    if (process.env[variable]?.trim()) return path.resolve(expandHome(process.env[variable]));
+  }
   const base = process.env.XDG_CONFIG_HOME
     ? path.resolve(process.env.XDG_CONFIG_HOME)
     : path.join(os.homedir(), ".config");
-  return path.join(base, "ml-platform", "config.json");
+  const primary = path.join(base, "ml-platform", "config.json");
+  const legacy = path.join(base, "data-platform-demo", "config.json");
+  return !fs.existsSync(primary) && fs.existsSync(legacy) ? legacy : primary;
 }
 
 function normalizeApiUrl(value) {

package/runtime/business-client/src/http.js

@@ -45,6 +45,7 @@ class PlatformApiClient {
 
   get(endpoint, params) { return this.request("GET", endpoint, { params }); }
   post(endpoint, payload, params) { return this.request("POST", endpoint, { payload, params }); }
+  put(endpoint, payload, params) { return this.request("PUT", endpoint, { payload, params }); }
   delete(endpoint, params) { return this.request("DELETE", endpoint, { params }); }
   uploadOperatorPackage(project, name, version, packagePath) {
     const resolved = path.resolve(expandHome(packagePath));
@@ -63,30 +64,138 @@ class PlatformApiClient {
     fs.mkdirSync(target, { recursive: true });
     const controller = new AbortController();
     const timer = setTimeout(() => controller.abort(), this.timeoutMs);
+    const temporaryDir = fs.mkdtempSync(path.join(os.tmpdir(), "data-platform-artifact-download-"));
+    const temporary = path.join(temporaryDir, "artifact.zip");
     let response;
     try {
       response = await fetch(this.url(`/dataset-artifacts/${encodeURIComponent(project)}/${encodeURIComponent(datasetId)}/${encodeURIComponent(manifestHash)}/download`), { headers: { Accept: "application/zip" }, signal: controller.signal });
+      if (!response.ok) {
+        let detail = response.statusText;
+        try { detail = JSON.parse(await abortable(response.text(), controller.signal))?.detail ?? detail; } catch (_) { /* use status text */ }
+        throw new Error(`artifact download failed: HTTP ${response.status}: ${detail}`);
+      }
+      const total = contentLength(response);
+      let lastReported = -1;
+      const report = (received, complete = false) => {
+        if ((complete && received !== lastReported) || received === 0 || received - lastReported >= 1024 * 1024) {
+          reportDownloadProgress(received, total);
+          lastReported = received;
+        }
+      };
+      report(0);
+      await writeResponseBody(response, temporary, controller.signal, report);
+      const files = await extractArchive(temporary, target);
+      return { dataset_id: datasetId, manifest_hash: manifestHash, output_dir: target, file_count: files.length, files };
     } catch (error) {
+      fs.rmSync(target, { recursive: true, force: true });
+      if (error instanceof Error && error.message.startsWith("artifact download failed:")) throw error;
       throw new Error(`artifact download failed: ${error.message}`);
     } finally {
       clearTimeout(timer);
+      fs.rmSync(temporaryDir, { recursive: true, force: true });
+    }
+  }
+
+  async downloadDatasetArtifactFiles(project, datasetId, manifestHash, relativePaths, outputDir, force = false) {
+    const files = [...new Set((relativePaths || []).map((value) => String(value)))];
+    if (!files.length) throw new Error("at least one artifact file is required");
+    for (const relative of files) {
+      const normalized = relative.replace(/\\/g, "/");
+      const parts = normalized.split("/");
+      if (!normalized || normalized.startsWith("/") || normalized.endsWith("/") || parts.includes("..")) {
+        throw new Error(`artifact path escapes output directory: ${JSON.stringify(relative)}`);
+      }
     }
-    if (!response.ok) {
-      let detail = response.statusText;
-      try { detail = JSON.parse(await response.text())?.detail ?? detail; } catch (_) { /* use status text */ }
-      throw new Error(`artifact download failed: HTTP ${response.status}: ${detail}`);
+    const targetRoot = path.resolve(expandHome(outputDir));
+    if (fs.existsSync(targetRoot) && fs.readdirSync(targetRoot).length) {
+      if (!force) throw new Error(`download output directory is not empty: ${targetRoot}`);
+      fs.rmSync(targetRoot, { recursive: true, force: true });
     }
-    const temporary = path.join(fs.mkdtempSync(path.join(os.tmpdir(), "data-platform-artifact-download-")), "artifact.zip");
+    fs.mkdirSync(targetRoot, { recursive: true });
     try {
-      fs.writeFileSync(temporary, Buffer.from(await response.arrayBuffer()));
-      const files = await extractArchive(temporary, target);
-      return { dataset_id: datasetId, manifest_hash: manifestHash, output_dir: target, file_count: files.length, files };
+      for (const relative of files) {
+        const normalized = relative.replace(/\\/g, "/");
+        const parts = normalized.split("/");
+        const destination = path.resolve(targetRoot, ...parts);
+        if (!normalized || normalized.startsWith("/") || normalized.endsWith("/")
+          || parts.includes("..") || destination !== targetRoot && !destination.startsWith(`${targetRoot}${path.sep}`)) {
+          throw new Error(`artifact path escapes output directory: ${JSON.stringify(relative)}`);
+        }
+        fs.mkdirSync(path.dirname(destination), { recursive: true });
+        const endpoint = `/dataset-artifacts/${encodeURIComponent(project)}/${encodeURIComponent(datasetId)}/${encodeURIComponent(manifestHash)}/files/${parts.map(encodeURIComponent).join("/")}`;
+        const controller = new AbortController();
+        const timer = setTimeout(() => controller.abort(), this.timeoutMs);
+        try {
+          const response = await fetch(this.url(endpoint), { headers: { Accept: "application/octet-stream" }, signal: controller.signal });
+          if (!response.ok) {
+            let detail = response.statusText;
+            try { detail = JSON.parse(await response.text())?.detail ?? detail; } catch (_) { /* status text */ }
+            throw new Error(`artifact file download failed: HTTP ${response.status}: ${detail}`);
+          }
+          fs.writeFileSync(destination, Buffer.from(await response.arrayBuffer()), { flag: "wx" });
+        } finally { clearTimeout(timer); }
+      }
     } catch (error) {
-      fs.rmSync(target, { recursive: true, force: true });
+      fs.rmSync(targetRoot, { recursive: true, force: true });
       throw error;
-    } finally {
-      fs.rmSync(path.dirname(temporary), { recursive: true, force: true });
     }
+    return { project, dataset_id: datasetId, manifest_hash: manifestHash, output_dir: targetRoot, file_count: files.length, files: files.sort() };
+  }
+}
+
+function contentLength(response) {
+  const raw = response.headers?.get?.("content-length") ?? response.headers?.["content-length"];
+  const value = Number(raw);
+  return Number.isFinite(value) && value >= 0 ? value : null;
+}
+
+function reportDownloadProgress(received, total) {
+  const suffix = total == null ? "" : `/${total}`;
+  process.stderr.write(`artifact download: received ${received}${suffix} bytes\n`);
+}
+
+function abortable(value, signal) {
+  if (signal.aborted) return Promise.reject(new Error("This operation was aborted"));
+  return new Promise((resolve, reject) => {
+    const onAbort = () => { cleanup(); reject(new Error("This operation was aborted")); };
+    const cleanup = () => signal.removeEventListener("abort", onAbort);
+    signal.addEventListener("abort", onAbort, { once: true });
+    Promise.resolve(value).then((result) => { cleanup(); resolve(result); }, (error) => { cleanup(); reject(error); });
+  });
+}
+
+async function writeResponseBody(response, outputPath, signal, onProgress) {
+  const handle = fs.openSync(outputPath, "w");
+  let received = 0;
+  try {
+    const write = (value) => {
+      const chunk = Buffer.from(value);
+      fs.writeSync(handle, chunk);
+      received += chunk.length;
+      onProgress(received);
+    };
+    if (response.body?.getReader) {
+      const reader = response.body.getReader();
+      while (true) {
+        const item = await abortable(reader.read(), signal);
+        if (item.done) break;
+        write(item.value);
+      }
+    } else if (response.body?.[Symbol.asyncIterator]) {
+      const iterator = response.body[Symbol.asyncIterator]();
+      while (true) {
+        const item = await abortable(iterator.next(), signal);
+        if (item.done) break;
+        write(item.value);
+      }
+    } else if (typeof response.arrayBuffer === "function") {
+      write(await abortable(response.arrayBuffer(), signal));
+    } else {
+      throw new Error("artifact download response has no readable body");
+    }
+    onProgress(received, true);
+  } finally {
+    fs.closeSync(handle);
   }
 }
 
@@ -111,8 +220,8 @@ async function extractArchive(archivePath, outputDir) {
     if (next > archive.length || compressedSize === 0xffffffff || size === 0xffffffff || localOffset === 0xffffffff) throw new Error("artifact archive entry metadata is invalid");
     if (flags & 1) throw new Error("artifact archive contains an encrypted entry");
     if (![0, 8].includes(method)) throw new Error(`artifact archive compression method is unsupported: ${method}`);
-    if (!(flags & 0x800)) throw new Error("artifact archive contains a non-UTF-8 filename");
-    const rawName = archive.subarray(cursor + 46, cursor + 46 + nameLength).toString("utf8");
+    const rawNameBytes = archive.subarray(cursor + 46, cursor + 46 + nameLength);
+    const rawName = decodeZipFilename(rawNameBytes, flags);
     const name = rawName.replace(/\\/g, "/"); const parts = name.split("/"); const mode = (attributes >>> 16) & 0xffff;
     if (!name || name.startsWith("/") || /^[A-Za-z]:/.test(name) || parts.includes("..")) throw new Error(`artifact archive contains unsafe path: ${JSON.stringify(rawName)}`);
     if ((mode & 0o170000) === 0o120000) throw new Error(`artifact archive contains a symbolic link: ${JSON.stringify(rawName)}`);
@@ -131,6 +240,14 @@ async function extractArchive(archivePath, outputDir) {
   return files.sort();
 }
 
+function decodeZipFilename(bytes, flags) {
+  if (flags & 0x800) return bytes.toString("utf8");
+  // ZIP producers commonly omit the UTF-8 flag for ASCII entry names. Keep
+  // those names interoperable while refusing ambiguous non-ASCII encodings.
+  if (bytes.some((value) => value > 0x7f)) throw new Error("artifact archive contains an unsupported non-UTF-8 filename");
+  return bytes.toString("ascii");
+}
+
 function findEndOfCentralDirectory(archive) { const minimum = Math.max(0, archive.length - 65557); for (let offset = archive.length - 22; offset >= minimum; offset -= 1) if (archive.readUInt32LE(offset) === 0x06054b50 && offset + 22 + archive.readUInt16LE(offset + 20) === archive.length) return offset; throw new Error("artifact download is not a valid zip archive"); }
 function crc32(buffer) { let crc = 0xffffffff; for (const byte of buffer) { crc ^= byte; for (let bit = 0; bit < 8; bit += 1) crc = (crc >>> 1) ^ (0xedb88320 & -(crc & 1)); } return (crc ^ 0xffffffff) >>> 0; }
 

package/skills/feature-management/SKILL.md

@@ -14,13 +14,42 @@ Operator ------> Feature -> FeatureSet -> DatasetManifest -> DatasetArtifact
 
 Treat `Recipe` and public `Feature.compute` as removed. Treat `computation_hash` as internal execution metadata, never as a business-managed asset.
 
+## Platform Role And Evidence Boundaries
+
+The ML Platform is a deterministic data-contract and data-delivery platform. It
+registers versioned source Parameters, runs approved deterministic Operators,
+orders single-column Features into FeatureSets, resolves DatasetManifests, and
+materializes batch DatasetArtifacts or serves one causal realtime inference row.
+It records versions, lineage, quality, missingness, freshness, and execution
+metadata so an algorithm project can consume data without owning source routing
+or cache details.
+
+It does not train, evaluate, or serve models; own complete business feature
+engineering; provision arbitrary source tables; or administer Kubernetes and
+platform services. Read
+[references/platform-capability-guide.md](references/platform-capability-guide.md)
+when the user needs the detailed platform boundary or evidence-level explanation.
+
+Keep these evidence rules active in every workflow:
+
+- Platform defaults and capabilities are not business evidence.
+- Dry-run, publish, resolve, build, metadata inspection, downloaded-file
+  inspection, and realtime fetch are separate evidence checkpoints; success at
+  one checkpoint does not imply success at the next.
+- `validation.ok=true` does not by itself prove source semantics, causal formula
+  correctness, Parquet contents, or numeric parity.
+- Dry-run, publish, and resolve may not detect a missing source relation. Do not
+  report source-backed success until build/fetch returns the required evidence,
+  and never rename a Parameter or remove fields merely to bypass a failed read.
+
 ## Load The Right Context
 
 1. Resolve the Skill root as the directory containing this `SKILL.md`.
 2. Read [references/contracts.md](references/contracts.md) before creating or changing JSON assets.
 3. Read [references/operator-authoring.md](references/operator-authoring.md) whenever creating or changing Operator code or a wheel.
-4. Read [references/commands.md](references/commands.md) before discovering assets, validating, publishing, building, fetching realtime data, or downloading.
+4. Read [references/commands.md](references/commands.md) immediately before a platform CLI action: discovery, validation, publication, build, realtime fetch, or artifact download. A local-only draft that is forbidden to call the CLI does not need this reference.
 5. Use [assets/catalog-template](assets/catalog-template) as a copyable starting point for a new end-to-end catalog. Rename every `example_*` identifier and update every referenced path before validation.
+6. Read [references/platform-capability-guide.md](references/platform-capability-guide.md) only when selecting an asset type or explaining a platform capability. Do not load it merely to write a confirmed local draft; it is never evidence for unresolved business semantics.
 
 ## Initialize The Client
 
@@ -46,6 +75,19 @@ ml-platform show-config
 ml-platform --profile server health
 ```
 
+Use the global `--profile server` form shown above, before the business
+command. Do not append `--profile` after a business command. Before discovery,
+check the installed release with `ml-platform --help` and the relevant
+subcommand's `--help`; CLI releases may differ in supported flags. In the
+deployed 0.6.x CLI, registry `list-*` commands emit JSON by default and do not
+accept a `--json` flag.
+
+If the installed release rejects the global `--profile server` form shown above,
+record the CLI syntax error and inspect `show-config`/subcommand help before
+retrying the same read-only command without that flag when supported. Do not
+switch clients or classify a syntax error as an API outage; keep each command
+separate so CLI compatibility remains distinguishable from network health.
+
 The effective API target is resolved in this order: explicit `--api-url`,
 `ML_PLATFORM_API_URL`, then the saved value written by `ml-platform configure`.
 If no target is configured, ask the user for an approved API URL before making
@@ -61,7 +103,7 @@ Collect only missing information. Do not invent a source table, source field, fo
 
 Confirm:
 
-- the target project (namespace) for the assets; use the built-in `default` only when the user has no dedicated project. On creation the project comes from the optional `project` field in each asset spec (defaults to `default`); reads and filters use the `--project` command option;
+- the target project (namespace) for the assets; use the built-in `default` only when the user has no dedicated project. After the target is confirmed, write its explicit `project` field in every Parameter, Operator, Feature, FeatureSet and DatasetManifest draft; never rely on the schema default. Reads and filters use the `--project` command option;
 - business meaning, stable asset names, owner, and intended consumers;
 - Parameter source adapter and credential-free source mapping;
 - feature formula, exact Parameter dependencies, windows, inclusion rules, rounding, null behavior, and output dtype;
@@ -75,9 +117,64 @@ Confirm:
 
 Separate preparation from mutation. Creating files and running local tests or `apply --dry-run` does not authorize publishing a wheel, changing the Registry, or submitting a build Job.
 
+A label such as "10-minute mean" confirms neither its input Parameter nor a
+complete formula. Before drafting an Operator or Feature, ask for the exact
+versioned input Parameter(s), or for an approved source contract from which
+they will be created. Do not infer an input from the Feature name or a similar
+existing asset.
+
+### Semantic Asset Review Gate
+
+Treat resource correctness as a separate gate from workflow correctness. Before
+creating Catalog JSON, write a local semantic asset review with one row per
+Parameter, Operator, Feature and Dataset field:
+
+```text
+asset_key | business_meaning | source/evidence | confirmed_by | unresolved | proposed_value
+```
+
+The review must distinguish three sources: confirmed business facts, facts
+observed from the selected Project Registry/CLI, and agent proposals. A Skill
+reference, schema default, similarly named old asset, or platform capability is
+not business evidence. Do not convert a proposal into `proposed_value` without
+explicit user confirmation or an exact match in the selected Project.
+
+Stop with `need_business_confirmation` when any required source mapping, field,
+unit, formula, time conversion, missing/quality policy, FeatureSet order,
+dataset read policy, rowset/endpoint policy, owner, or approval boundary is
+unresolved. Do not create placeholder Catalog files to make the workflow look
+complete.
+
+For a requested Feature, `exact Parameter dependencies` is an independent
+required contract item. If the user names a transform or window but not its
+input Parameter(s), include `input_parameter` in the unresolved questions and
+stop. Do this before treating an Operator formula as complete: a time window,
+cutoff rule, or Feature name never identifies the input.
+
+After confirmation, show the proposed dependency closure and obtain approval of
+the semantic asset plan before generating Catalog files. A successful local
+schema check or remote dry-run is not semantic approval.
+
+Before emitting or writing a draft, mechanically check that every asset carries
+the confirmed `project` field, that every Feature input carries that same
+`project`, and that every Operator `input_schema.parameters` reference is
+qualified as `project/parameter:version`. The schema's `default` values are not
+valid substitutes for an explicit non-default target. When a confirmed Feature
+config defines window closure, cutoff inclusion, duplicate handling, or empty
+window behavior, copy all of those fields into the Feature config rather than
+reducing it to the window string.
+
 ## Discover Existing Assets
 
-Check the selected profile and list existing Parameter, Operator, Feature, FeatureSet, and Dataset versions before choosing names. Scope discovery to the target project with `--project`, because the true registry key is `project/name:version` and the same `name:version` may exist independently under another project. Registry list commands are paginated; search by stable identifier or follow every page until `offset + len(items) >= total`. Reuse an exact immutable version only when its full content matches. Never reference an asset in another project; cross-project references are rejected.
+Check the selected profile and list existing Parameter, Operator, Feature, FeatureSet, and Dataset versions before choosing names. Scope discovery to the target project with `--project`, because the true registry key is `project/name:version` and the same `name:version` may exist independently under another project. Run each `list-*` command as a separate command so one failed check cannot hide the status of the others. Do not add `--json` unless the installed subcommand help explicitly advertises it; supported releases emit machine-readable JSON by default. Registry list commands are paginated; search by stable identifier or follow every page until `offset + len(items) >= total`. Reuse an exact immutable version only when its full content matches. Never reference an asset in another project; cross-project references are rejected.
+
+CLI readiness is a hard gate for every Registry conclusion. If `command -v`,
+`version`, `show-config`, or server `health` fails, returns a nonzero status, or
+does not identify the intended target, stop with `platform_not_ready`. Do not
+list assets, select reuse versus authoring, dry-run, publish, build, fetch, or
+report a Registry fact from prompt text, a remembered response, or a similar
+local asset. Report the failed command and its configured target; resume only
+after the user/environment restores the same target.
 
 Create a new version when source semantics, formula code, config meaning, inputs, output dtype, time behavior, quality rules, or column order change. Never overwrite an immutable version or use suffixes such as `new`, `final`, or `test2`.
 
@@ -140,8 +237,29 @@ Keep platform demos and V95 built-ins unchanged. Do not put unrelated business a
 
 ### Define Parameters
 
+Use the platform-capability guide's asset table before choosing the resource
+type. For each Parameter record the business signal, exact source evidence,
+unit, time/availability semantics and missing policy in the semantic review.
+Never infer a source table, column, measurement, tag, unit or timezone from a
+Parameter name.
+
 Create one stable, versioned source contract for each independently readable value. Keep credentials out of JSON. Use only supported direct adapters and explicit source identity. Put source data validity in `quality_rules`; put dataset-specific transformations in preprocess Operators.
 
+When the approved source contract supplies SQL, copy its query text and named
+parameters exactly into `source.sql`/`source.params`. Do not retype, beautify,
+rename an identifier, change a join key, or "simplify" an approved query while
+drafting. SQL whitespace may be formatted only when a reviewed formatter proves
+the token stream is unchanged; every source identifier and `<= %(end)s` boundary
+remains part of the Parameter contract.
+
+For SQL Parameters, the runtime contract is a single statement: use the exact
+`source.sql` field and a mapping under `source.params` for every named
+placeholder other than the reserved `start` and `end` window parameters. Do not
+use `source.parameters` (it is not a supported alias and may be silently
+dropped by older CLI/server releases). Do not leave a trailing semicolon; the
+deployed Worker rejects SQL containing multiple statements. Verify the resolved
+Parameter still contains the named params before authorizing a build.
+
 Use Parameter `rounding` when every consumer must receive the same fixed-point value. The platform applies `mode` (`half_up` or `half_even`) and `decimals` after source normalization and before quality checks, source caching, replay, and Operator execution. Prefer an unrounded source expression, do not repeat the same rounding in an Operator, and publish a new Parameter plus its affected reverse-dependency closure when the rule changes.
 
 Do not represent a rolling mean, lag, ratio, trend, or model input as a Parameter. Those are Features.
@@ -166,7 +284,11 @@ Use a meaningful immutable `function_hash`. Change the Operator version whenever
 
 ### Define Features
 
-Create one JSON file per single output column. Bind exactly one Operator version and physical `output_column`. List only the Parameter versions actually required by that column's formula.
+Create one JSON file per single output column. Set the confirmed `project` on the
+Feature and on every nested Feature input; a FeatureInput without `project`
+silently targets `default`. Bind exactly one Operator version and physical
+`output_column`. List only the Parameter versions actually required by that
+column's formula.
 
 Features may share the same Operator and config. The planner will merge their exact inputs and call the Operator once per computation group. Do not duplicate every Operator input into every Feature merely to make schemas look uniform.
 
@@ -176,8 +298,41 @@ Reference immutable Feature versions in the exact consumer column order. Keep th
 
 ### Define The DatasetManifest
 
+Do not use DatasetManifest as a catch-all for unresolved semantics. Confirm the
+dataset purpose and consumer, then separately confirm the target grid, horizon,
+read policy, explicit Parameter outputs, rowset or rowset splits, abnormal windows and
+endpoint eligibility. Keep the semantic asset review beside the draft Catalog
+so a reviewer can compare business decisions with generated fields.
+
 Reference exactly one FeatureSet. Use `parameters` only for Parameter columns that must also appear explicitly in `parameter_dataset.parquet`; Feature dependencies are resolved automatically.
 
+Map the current Manifest schema exactly rather than carrying descriptive fields
+from Parameter, Feature, or FeatureSet into it. A target Parameter reference is
+**nested**; never flatten its `version` or `project` onto `target`:
+
+```json
+"target": {
+  "parameter": {"parameter": "hot_metal_si", "version": "v1", "project": "<project>"},
+  "si_time_source": "dispatch_time",
+  "offset_minutes": 20,
+  "interpolation": {"method": "linear"}
+}
+```
+
+`target.interpolation` is `{"method": "linear"}`, `{"method": "none"}` or
+`{"method": "forward_fill"}` -- neither it nor `target.parameter` accepts a
+bare string. The current DatasetManifest has no top-level `owner`,
+`description`, `si_null_policy`, or `preserve_all_candidate_rows`. Map a
+business statement only to an existing schema field (for example `mark_only`,
+`endpoint_policy`, a Feature config, or a Parameter missing policy); otherwise
+keep it in the semantic review and ask for a platform/schema change. Validate
+the generated object against the current schema before running `apply --dry-run`.
+
+When a confirmed missing-data policy applies to a Feature-only Parameter, put it
+in `parameter_missing_policies`, using `parameter`, `version`, `project`, and
+`policy`. Do not copy the `ParameterRequest` names `name` and `missing_policy`
+into that list. Omit the section when no such policy is confirmed.
+
 Declare one dataset-wide `prediction` contract when Features use a forecast cutoff. Operators consume `context.cutoff_times`; do not copy the same prediction horizon into every Feature config. Check the selected Operator's `input_schema.prediction` limits and satisfy an explicit-horizon requirement before publishing or building.
 
 Use `snapshot` for reproducible training data, `as_of` for historical visibility replay, and `latest` for current inference-style reads. Use a fresh `dataset_version` when validating a new release or intentionally requesting a new immutable dataset contract.
@@ -202,11 +357,16 @@ freshness, tail-edge, gap-fill, and rowset contracts.
 
 Run, in order:
 
-1. Operator unit tests.
-2. Wheel build and wheel filename verification.
-3. Catalog path, schema, dependency, immutability, and package validation with `apply --dry-run` against the same target profile intended for publication.
-4. Compare the catalog's exact dependency closure with the intended old-to-new version mapping. Reject any affected downstream reference that still points to an old version unless its retention is explicit and justified.
-5. A human-readable summary of planned new, unchanged, retained, and conflicting assets.
+1. Semantic asset review: no required unresolved field and every proposed value has a source or user confirmation.
+2. Operator unit tests. Before building, turn every applicable item in
+   `operator-authoring.md` into a separately named test; do not let one broad
+   happy-path assertion substitute for cutoff-before/at/after, duplicate and
+   missing input, empty history, requested-output, event-time order, or
+   dtype/rounding coverage. The template is only a starting point.
+3. Wheel build and wheel filename verification.
+4. Catalog path, schema, dependency, immutability, and package validation with `apply --dry-run` against the same target profile intended for publication.
+5. Compare the catalog's exact dependency closure with the intended old-to-new version mapping. Reject any affected downstream reference that still points to an old version unless its retention is explicit and justified.
+6. A human-readable summary of planned new, unchanged, retained, and conflicting assets.
 
 Stop on any error. Do not weaken schema validation, fabricate a missing dependency, change an existing version in place, or switch profiles to make validation pass.
 
@@ -214,7 +374,7 @@ Stop on any error. Do not weaken schema validation, fabricate a missing dependen
 
 Publish only after the user explicitly approves Registry and wheel changes. Use catalog `apply` so publication follows Parameter -> Operator -> Feature -> FeatureSet -> Dataset order.
 
-After publication, resolve every new DatasetManifest and compare its exact Parameter, Operator, Feature, and FeatureSet versions with the pre-publication mapping. Stop if an affected old key or any unexpected version remains. Resolve the manifest before building. Submit a build only when requested. For server builds, wait for the terminal Job state and download the exact artifact by `dataset_id + manifest_hash`.
+After publication, resolve every new DatasetManifest and compare its exact Parameter, Operator, Feature, and FeatureSet versions with the pre-publication mapping. Stop if an affected old key or any unexpected version remains. Resolve the manifest before building. Submit a build only when requested. For the current partitioned materialization runtime, use `--max-parallelism 1` unless a separately verified platform capability says otherwise; do not retry or resubmit a failed Job until its error and already-completed partitions are understood. For server builds, wait for the terminal Job state and download the exact artifact by `dataset_id + manifest_hash`.
 
 Do not delete versioned Registry assets, cancel Jobs, rebuild images, modify Kubernetes, or change service configuration as part of this workflow unless the user separately and explicitly requests that action. An empty Project may be soft-deleted only on an explicit request; rely on the server to reject deletion when resources still exist.
 
@@ -232,6 +392,14 @@ gap-filled inputs as degraded freshness, not as a normal read.
 
 ## Verify The Artifact
 
+Treat Registry metadata inspection and downloaded-file inspection as separate
+checkpoints. A successful `get-dataset-artifact` can establish the immutable
+identity, object inventory, row count, validation summary, and lineage metadata;
+it cannot establish Parquet schema, column order, or file-content hashes. If a
+download times out, report whether no response/progress was observed or whether
+some body bytes were received, preserve the metadata-only evidence, and leave
+downloaded-file validation explicitly incomplete.
+
 Require all of the following before reporting success:
 
 - Job status is `succeeded`;

package/skills/feature-management/assets/catalog-template/datasets/example_temperature_training.v1.json

@@ -1,5 +1,6 @@
 {
   "schema_version": "ml_data_platform.dataset_manifest/v1",
+  "project": "replace_with_project",
   "dataset_id": "example_temperature_training",
   "dataset_version": "v1",
   "mode": "training",
@@ -9,7 +10,22 @@
     "end": "2026-07-02T00:00:00+08:00",
     "grid": "10min"
   },
+  "prediction": {
+    "horizon": "0min"
+  },
+  "rowset": {
+    "strategy": "fixed_grid",
+    "grid": "10min"
+  },
   "parameters": [],
+  "parameter_missing_policies": [
+    {
+      "parameter": "example_temperature",
+      "version": "v1",
+      "project": "replace_with_project",
+      "policy": "report_only"
+    }
+  ],
   "feature_set": {
     "name": "example_temperature_core",
     "version": "v1"

package/skills/feature-management/assets/catalog-template/feature_sets/example_temperature_core.v1.json

@@ -1,5 +1,6 @@
 {
   "schema_version": "ml_data_platform.feature_set/v1",
+  "project": "replace_with_project",
   "name": "example_temperature_core",
   "version": "v1",
   "features": [

package/skills/feature-management/assets/catalog-template/features/example_temperature_mean_5m.v1.json

@@ -1,17 +1,24 @@
 {
   "schema_version": "ml_data_platform.feature/v1",
+  "project": "replace_with_project",
   "name": "example_temperature_mean_5m",
   "version": "v1",
   "inputs": [
     {
       "parameter": "example_temperature",
-      "version": "v1"
+      "version": "v1",
+      "project": "replace_with_project"
     }
   ],
   "operator": "example_temperature_features",
   "operator_version": "v1",
   "config": {
-    "window": "5min"
+    "window": "5min",
+    "window_closed": "right",
+    "cutoff_included": true,
+    "post_cutoff_allowed": false,
+    "duplicate_event_time": "last",
+    "empty_window": "null"
   },
   "output_column": "example_temperature_mean_5m",
   "output_dtype": "float64",

package/skills/feature-management/assets/catalog-template/operator_package/tests/test_operator.py

@@ -9,20 +9,21 @@ from business_feature_operator_template import compute_features
 
 
 class ComputeFeaturesTest(unittest.TestCase):
-    def context(self, requested: list[str] | None = None) -> SimpleNamespace:
-        source = pd.DataFrame(
-            {
-                "timestamp": pd.DatetimeIndex(
-                    [
-                        "2026-07-01 09:54:00",
-                        "2026-07-01 09:56:00",
-                        "2026-07-01 10:00:00",
-                        "2026-07-01 10:01:00",
-                    ]
-                ),
-                "value": [10.0, 20.0, 30.0, 40.0],
-            }
-        )
+    def context(
+        self,
+        timestamps: list[str] | None = None,
+        values: list[float | None] | None = None,
+        targets: list[str] | None = None,
+        requested: list[str] | None = None,
+    ) -> SimpleNamespace:
+        timestamps = timestamps or [
+            "2026-07-01 09:54:00",
+            "2026-07-01 09:56:00",
+            "2026-07-01 10:00:00",
+            "2026-07-01 10:01:00",
+        ]
+        values = values or [10.0, 20.0, 30.0, 40.0]
+        source = pd.DataFrame({"timestamp": pd.DatetimeIndex(timestamps), "value": values})
         return SimpleNamespace(
             requested_output_columns=requested or ["example_temperature_mean_5m"],
             inputs=[
@@ -32,24 +33,50 @@ class ComputeFeaturesTest(unittest.TestCase):
                 )
             ],
             metric_frames={"example_temperature:v1": source},
-            target_times=pd.DatetimeIndex(
-                ["2026-07-01 10:00:00", "2026-07-01 10:02:00"]
-            ),
+            target_times=pd.DatetimeIndex(targets or ["2026-07-01 10:00:00", "2026-07-01 10:02:00"]),
             config={"window": "5min"},
         )
 
-    def test_uses_open_left_and_closed_right_window(self) -> None:
+    def test_formula_uses_the_confirmed_mean(self) -> None:
         result = compute_features(self.context())
-
-        self.assertEqual(
-            list(result.columns),
-            ["event_time", "example_temperature_mean_5m"],
-        )
         self.assertEqual(result["example_temperature_mean_5m"].tolist(), [25.0, 35.0])
 
+    def test_excludes_event_at_open_left_window_boundary(self) -> None:
+        result = compute_features(self.context(["2026-07-01 09:55:00", "2026-07-01 09:56:00"], [10.0, 20.0]))
+        self.assertEqual(result["example_temperature_mean_5m"].iloc[0], 20.0)
+
+    def test_includes_event_exactly_at_cutoff(self) -> None:
+        result = compute_features(self.context(["2026-07-01 10:00:00"], [30.0]))
+        self.assertEqual(result["example_temperature_mean_5m"].iloc[0], 30.0)
+
+    def test_excludes_event_after_cutoff(self) -> None:
+        result = compute_features(self.context(["2026-07-01 10:00:01"], [40.0]))
+        self.assertTrue(pd.isna(result["example_temperature_mean_5m"].iloc[0]))
+
+    def test_uses_last_value_for_duplicate_event_time(self) -> None:
+        result = compute_features(self.context(["2026-07-01 10:00:00", "2026-07-01 10:00:00"], [10.0, 30.0]))
+        self.assertEqual(result["example_temperature_mean_5m"].iloc[0], 30.0)
+
+    def test_empty_history_returns_null(self) -> None:
+        result = compute_features(self.context(["2026-07-01 09:00:00"], [10.0]))
+        self.assertTrue(pd.isna(result["example_temperature_mean_5m"].iloc[0]))
+
+    def test_requested_output_is_exactly_the_supported_subset(self) -> None:
+        result = compute_features(self.context(requested=["example_temperature_mean_5m"]))
+        self.assertEqual(list(result.columns), ["event_time", "example_temperature_mean_5m"])
+
+    def test_preserves_requested_event_time_order(self) -> None:
+        targets = ["2026-07-01 10:02:00", "2026-07-01 10:00:00"]
+        result = compute_features(self.context(targets=targets))
+        self.assertEqual(list(result["event_time"]), list(pd.DatetimeIndex(targets)))
+
+    def test_output_dtype_is_float64(self) -> None:
+        result = compute_features(self.context())
+        self.assertEqual(str(result["example_temperature_mean_5m"].dtype), "float64")
+
     def test_rejects_unknown_requested_output(self) -> None:
         with self.assertRaisesRegex(ValueError, "unsupported output columns"):
-            compute_features(self.context(["unknown_feature"]))
+            compute_features(self.context(requested=["unknown_feature"]))
 
 
 if __name__ == "__main__":