@zhuoyuezs/ml-platform 0.2.3 → 0.2.5

package/checksums.json

@@ -7,12 +7,12 @@
     },
     {
       "path": "runtime/business-client/package-lock.json",
-      "sha256": "sha256:fcc57e214724294f6208ec192dbe42b9cabbb6324945b0e93471bf991f76f0bc",
+      "sha256": "sha256:744e49f72a879478a18899c6eb64cf3bbdc22700e9d8a4b61d45ad3a5927deb9",
       "size_bytes": 1628
     },
     {
       "path": "runtime/business-client/package.json",
-      "sha256": "sha256:61b2a01e7611af07ad49a1789cbaddb5f8ec36d70b78ef72d54227039990e8dc",
+      "sha256": "sha256:97145119a4080392bbd2242b6a5a67046aa45e720c38977686fa0f4346c41bf0",
       "size_bytes": 671
     },
     {
@@ -22,8 +22,8 @@
     },
     {
       "path": "runtime/business-client/src/cli.js",
-      "sha256": "sha256:3913154693561ea4cea1538f560bf5e4f4b4488398abf69332f23f302481ee04",
-      "size_bytes": 66966
+      "sha256": "sha256:6ad8fb06e410cb5a197a696f3cb9819e9e3b06919d443d303a3e9d285cf4c0e2",
+      "size_bytes": 68793
     },
     {
       "path": "runtime/business-client/src/config.js",
@@ -32,13 +32,13 @@
     },
     {
       "path": "runtime/business-client/src/http.js",
-      "sha256": "sha256:517ad46944f3a4068a00a570dc09975c5b59de61b730e0acf8e009ee1f18c89d",
-      "size_bytes": 18865
+      "sha256": "sha256:088ef5fa067cc830a95db7d8ad3887ae58276179b524533f338daa781e243979",
+      "size_bytes": 19452
     },
     {
       "path": "skills/data-source-exploration/SKILL.md",
-      "sha256": "sha256:11b20671ad81b42cd2ddb1cb146196b9f5ab15e962249e7e07cfa148c601e881",
-      "size_bytes": 4172
+      "sha256": "sha256:1f1f89d4ca41c3f7b206287e983027f50f65e462897584511259067fe94f2707",
+      "size_bytes": 5631
     },
     {
       "path": "skills/data-source-exploration/agents/openai.yaml",
@@ -127,8 +127,8 @@
     },
     {
       "path": "skills/model-deployment-management/SKILL.md",
-      "sha256": "sha256:e8419e4d83031248b40783674813bf3f5a98544f05ea3fbe056547ae47632016",
-      "size_bytes": 4397
+      "sha256": "sha256:e4ec21765e23a02ad86bd6b0c92414eee182d74a9f7032e738711c823478ecfe",
+      "size_bytes": 4960
     },
     {
       "path": "skills/model-deployment-management/agents/openai.yaml",
@@ -137,13 +137,13 @@
     },
     {
       "path": "skills/model-deployment-management/references/contracts.md",
-      "sha256": "sha256:de9fd3de8d88179b09108ee0778fb83fbffa304353706a3bbc14ae3d9276ac01",
-      "size_bytes": 5417
+      "sha256": "sha256:967d70e1d162ce0f8736683fd82009c7aa4227a309f38de14199469bb3bfe52c",
+      "size_bytes": 6722
     },
     {
       "path": "skills/model-deployment-management/references/operations.md",
-      "sha256": "sha256:b6d8ac126033a1e3b463b53474f0b27d8687e1a7b05eb973d3aad79259838ac6",
-      "size_bytes": 4968
+      "sha256": "sha256:2eb0fb62d971e21bfbdc1f398a5dcb91916dfccec35e7cbfa4a6404799bfdfb3",
+      "size_bytes": 6165
     },
     {
       "path": "skills/model-deployment-management/references/troubleshooting.md",
@@ -152,8 +152,8 @@
     },
     {
       "path": "skills/model-lifecycle-management/SKILL.md",
-      "sha256": "sha256:9ad2428621b52a15a83dce34a2a95606d7d979017a227c0aeb8fe5c8acd5faa3",
-      "size_bytes": 5442
+      "sha256": "sha256:785219483f917d83d9a371772ea107dc03ddf024a0c4bd098711c4689c5c2ce4",
+      "size_bytes": 5718
     },
     {
       "path": "skills/model-lifecycle-management/agents/openai.yaml",
@@ -172,8 +172,8 @@
     },
     {
       "path": "skills/model-lifecycle-management/references/packaging.md",
-      "sha256": "sha256:1e3c5080fa085255b29223890c333333ee6011326b56f1b2e0b859b0d73d2ec0",
-      "size_bytes": 6146
+      "sha256": "sha256:d090fa9df9db106eae98b0e961038a234768a124e4804cef2f86cb85550b2108",
+      "size_bytes": 7718
     },
     {
       "path": "skills/model-lifecycle-management/references/training-contracts.md",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zhuoyuezs/ml-platform",
-  "version": "0.2.3",
+  "version": "0.2.5",
   "description": "ML 数据平台 business CLI 与 Agent Skills 管理工具",
   "bin": {
     "ml-platform": "scripts/main.js"

package/release.json

@@ -13,8 +13,8 @@
     "entrypoint": "src/cli.js",
     "name": "ml-platform",
     "path": "runtime/business-client",
-    "sha256": "sha256:a002eb1fb35605ad13ad071b2131233fd4b798e3438984ae1c4c6f4ddf262902",
-    "version": "0.8.4"
+    "sha256": "sha256:3cf1b6b441fc99bfc8e1615f7c0949a3234da0e4ccaa70fca2ddb4ed7b96cae4",
+    "version": "0.8.5"
   },
   "policy_sha256": "sha256:02fbde0134696b78c0c365d6e0b76c9814227208da5b2b3d4e5dbd82dc4a3606",
   "public_schema_versions": [
@@ -25,7 +25,7 @@
     "ml_data_platform.feature_set/v1",
     "ml_data_platform.dataset_manifest/v1"
   ],
-  "release_version": "0.2.3",
+  "release_version": "0.2.5",
   "runtime_requirements": {
     "node": ">=18",
     "os": [
@@ -37,34 +37,34 @@
   "skills": {
     "data-source-exploration": {
       "path": "skills/data-source-exploration",
-      "requires_cli": ">=0.8.4 <0.9.0",
-      "revision": "0.2.3",
-      "sha256": "sha256:2fa1e1802d799ee0c47b10263f2fde57b604e505fea5c98bfa23f51f382bbf69"
+      "requires_cli": ">=0.8.5 <0.9.0",
+      "revision": "0.2.5",
+      "sha256": "sha256:6cb1cad3e9531e5098582c532288edd9838c2acab2b324794ec99d2550418f32"
     },
     "feature-management": {
       "path": "skills/feature-management",
-      "requires_cli": ">=0.8.4 <0.9.0",
-      "revision": "0.2.3",
+      "requires_cli": ">=0.8.5 <0.9.0",
+      "revision": "0.2.5",
       "sha256": "sha256:6dfa708172c3b5b23af75997c82a6d43bc2eb8ca67cc2275c8b95022455b0c42"
     },
     "model-deployment-management": {
       "path": "skills/model-deployment-management",
-      "requires_cli": ">=0.8.4 <0.9.0",
-      "revision": "0.2.3",
-      "sha256": "sha256:d3f3fe0e4a11b93d8f6f57758164aa236b84a49c1b9f0d0b700fd9d6d615a8d7"
+      "requires_cli": ">=0.8.5 <0.9.0",
+      "revision": "0.2.5",
+      "sha256": "sha256:5be65bc4c7b4d81297cc27dfd298c5970efd4230c144ca5289a09344ca2a66ee"
     },
     "model-lifecycle-management": {
       "path": "skills/model-lifecycle-management",
-      "requires_cli": ">=0.8.4 <0.9.0",
-      "revision": "0.2.3",
-      "sha256": "sha256:8822fbec7037c2312d18b1d18648b60757fc569e6bf5f2856ea41592f3ba987d"
+      "requires_cli": ">=0.8.5 <0.9.0",
+      "revision": "0.2.5",
+      "sha256": "sha256:c268653c6520426f84ceaf7e1cf190708bdee5a2ad72018e4201da6f2d2a1a08"
     },
     "prediction-report-management": {
       "path": "skills/prediction-report-management",
-      "requires_cli": ">=0.8.4 <0.9.0",
-      "revision": "0.2.3",
+      "requires_cli": ">=0.8.5 <0.9.0",
+      "revision": "0.2.5",
       "sha256": "sha256:3a6991eec5cfa6bf30eaf43295f0c7d5c1e70e4f638904dfde1be2a39965d64f"
     }
   },
-  "source_commit": "fc09e3233f9ba919b3c8ce7ff5044527ed0f7415"
+  "source_commit": "710dd6d1a923ad8fdec4144a928947c8bcda2fa9"
 }

package/runtime/business-client/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@zhuoyuezs/ml-platform-business-client",
-  "version": "0.8.4",
+  "version": "0.8.5",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@zhuoyuezs/ml-platform-business-client",
-      "version": "0.8.4",
+      "version": "0.8.5",
       "license": "UNLICENSED",
       "bin": {
         "ml-platform": "src/cli.js"

package/runtime/business-client/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zhuoyuezs/ml-platform-business-client",
-  "version": "0.8.4",
+  "version": "0.8.5",
   "private": true,
   "description": "JavaScript implementation of the ML Platform business client",
   "bin": {

package/runtime/business-client/src/cli.js

@@ -15,7 +15,9 @@ const BUSINESS_COMMANDS = new Set([
     "version", "create-project", "list-projects", "get-project", "delete-project",
     "configure", "show-config", "health",
     "list-datasource-connections", "list-datasource-namespaces", "list-datasource-objects",
-    "list-datasource-fields", "query-datasource-object",
+    "list-datasource-fields", "query-datasource-object", "create-datasource-connection",
+    "get-datasource-connection", "update-datasource-connection", "delete-datasource-connection",
+    "test-datasource-connection",
     "list-parameters", "list-operators", "list-features",
     "list-feature-sets", "list-datasets", "get-dataset", "list-jobs", "resolve-manifest",
     "resolve-dataset", "build-dataset", "build-registered-dataset",
@@ -62,6 +64,11 @@ const COMMAND_USAGE = {
     "list-datasource-objects": "list-datasource-objects CONNECTION_ID NAMESPACE_ID [--limit N] [--cursor CURSOR]",
     "list-datasource-fields": "list-datasource-fields CONNECTION_ID OBJECT_ID [--limit N] [--cursor CURSOR]",
     "query-datasource-object": "query-datasource-object CONNECTION_ID OBJECT_ID SPEC_JSON [--cursor CURSOR]",
+    "create-datasource-connection": "create-datasource-connection SPEC_JSON",
+    "get-datasource-connection": "get-datasource-connection CONNECTION_ID",
+    "update-datasource-connection": "update-datasource-connection CONNECTION_ID SPEC_JSON",
+    "delete-datasource-connection": "delete-datasource-connection CONNECTION_ID",
+    "test-datasource-connection": "test-datasource-connection CONNECTION_ID",
     "create-project": "create-project NAME [--display-name TEXT] [--description TEXT] [--owner OWNER]",
     "list-projects": "list-projects",
     "get-project": "get-project NAME",
@@ -445,6 +452,25 @@ async function runBusinessCli(argv) {
             spec.cursor = cursor;
         result = await client(options).post(`/datasource-connections/${encodeURIComponent(connectionId)}/objects/${encodeURIComponent(objectId)}/query`, spec);
     }
+    else if (options.command === "create-datasource-connection") {
+        result = await client(options).post("/datasource-connections", readSpec(positional(rest, "connection spec JSON")));
+    }
+    else if (options.command === "get-datasource-connection") {
+        const connectionId = positional(rest, "connection id");
+        result = await client(options).get(`/datasource-connections/${encodeURIComponent(connectionId)}`);
+    }
+    else if (options.command === "update-datasource-connection") {
+        const connectionId = positional(rest, "connection id");
+        result = await client(options).put(`/datasource-connections/${encodeURIComponent(connectionId)}`, readSpec(positional(rest, "connection spec JSON")));
+    }
+    else if (options.command === "delete-datasource-connection") {
+        const connectionId = positional(rest, "connection id");
+        result = await client(options).delete(`/datasource-connections/${encodeURIComponent(connectionId)}`);
+    }
+    else if (options.command === "test-datasource-connection") {
+        const connectionId = positional(rest, "connection id");
+        result = await client(options).post(`/datasource-connections/${encodeURIComponent(connectionId)}/test`, {});
+    }
     else if (options.command === "create-project") {
         const name = positional(rest, "project name");
         result = await client(options).post("/projects", { schema_version: "ml_data_platform.project/v1", name, display_name: take(rest, "--display-name", name), description: take(rest, "--description", ""), owner: take(rest, "--owner", "demo") });
@@ -727,7 +753,7 @@ async function runBusinessCli(argv) {
             realtime.validate_freshness = false;
         if (boolean(rest, "--allow-missing"))
             realtime.allow_missing = true;
-        const request = { manifest: readDataset(manifest), cutoff_time: cutoffTime };
+        const request = { manifest: normalizeRegistryDataset(readObject(manifest)), cutoff_time: cutoffTime };
         if (Object.keys(realtime).length)
             request.realtime_fetch = realtime;
         result = await client(options).post("/inference-data/fetch", request);

package/runtime/business-client/src/http.js

@@ -5,6 +5,17 @@ const os = require("os");
 const path = require("path");
 const zlib = require("zlib");
 const { expandHome } = require("./config");
+function apiErrorDetail(result, fallback) {
+    if (result === null || result === undefined)
+        return fallback;
+    if (typeof result === "string")
+        return result || fallback;
+    // Keep the familiar string detail, but serialize structured error responses
+    // in full so nested field errors and sibling diagnostics remain visible.
+    if (typeof result.detail === "string" && Object.keys(result).length === 1)
+        return result.detail;
+    return JSON.stringify(result, null, 2);
+}
 class PlatformApiClient {
     constructor(baseUrl, timeoutSeconds = 30) {
         this.baseUrl = String(baseUrl).trim().replace(/\/+$/, "");
@@ -50,10 +61,11 @@ class PlatformApiClient {
             result = JSON.parse(text);
         }
         catch (_) {
-            throw new Error("platform API returned invalid JSON");
+            if (response.ok)
+                throw new Error("platform API returned invalid JSON");
         }
         if (!response.ok)
-            throw new Error(`platform API request failed: ${method} ${response.url}: HTTP ${response.status}: ${result?.detail ?? response.statusText}`);
+            throw new Error(`platform API request failed: ${method} ${response.url || this.url(endpoint, params)}: HTTP ${response.status}: ${apiErrorDetail(result, text.trim() || response.statusText)}`);
         if (!result || typeof result !== "object")
             throw new Error("platform API returned an unsupported JSON response");
         return result;

package/skills/data-source-exploration/SKILL.md

@@ -6,7 +6,41 @@ description: Discover platform-configured PostgreSQL, MySQL, SQL Server, or Infl
 # Data Source Exploration
 
 Use the platform API through `ml-platform`; never connect to a business database directly and
-never request credentials. The platform exposes configured connections and their discoverable objects.
+never request credentials in chat. The platform exposes managed connections and their discoverable
+objects. Connection credentials are write-only control-plane input and are never returned by the
+platform.
+
+## Manage Connections
+
+Datasource connections are business-owned platform resources, not ConfigMap entries. An operator
+with the required platform permission can create or change one from a JSON file; the API encrypts
+the connection configuration at rest and returns only metadata:
+
+```json
+{
+  "connection_id": "postgresql_bf_monitoring",
+  "name": "BF monitoring",
+  "adapter": "postgresql_direct",
+  "connection_config": {
+    "dsn": "postgresql://readonly:password@db.example:5432/bf_monitoring_dev_db",
+    "timeout_seconds": 30
+  }
+}
+```
+
+```bash
+ml-platform create-datasource-connection connection.json
+ml-platform test-datasource-connection postgresql_bf_monitoring
+ml-platform list-datasource-connections
+ml-platform update-datasource-connection postgresql_bf_monitoring connection.json
+ml-platform delete-datasource-connection postgresql_bf_monitoring
+```
+
+Do not put the JSON file in the repository or paste real credentials into logs or issue comments.
+Updating a connection creates a new internal revision. Dataset Workers and realtime reads resolve
+the latest enabled revision from platform storage when they start or when the API handles a request;
+the business connection does not require a Pod restart. A platform-level encryption key remains
+system security configuration, but the connection itself is managed through this resource API.
 
 ## Establish The Target
 

package/skills/model-deployment-management/SKILL.md

@@ -52,11 +52,19 @@ deployment does not reach `READY` or an operation is rejected.
   `NodePort` value creates one deployment-level direct Serving Service that
   follows the current revision; it does not replace validation, approval,
   rollout, READY gates, or audit history.
+- Set `service_exposure.type=Ingress` to reuse the environment's existing
+  ingress-nginx controller while keeping the model Service as ClusterIP. The
+  observed `ingress` endpoint contains the stable path and URL template. This
+  option does not install a Gateway controller or configure authentication.
 - Every model Serving process publishes that model's Swagger UI at `/docs`,
   OpenAPI JSON at `/openapi.json`, and ReDoc at `/redoc`. The document embeds
   the deployed artifact identity and its actual input modes, ordered columns,
   horizon semantics, known-future contract, and output schema. These are model
   data-plane documents, not the control-plane API documentation.
+- For context packages with an explicit `availability_boundary`, verify
+  `lineage.visibility` as described in [references/operations.md](references/operations.md).
+  Configure the boundary when packaging; prediction callers still send only
+  `cutoff_time`.
 - Never create, modify, or delete NetworkPolicy. Cluster operators own that
   boundary.
 

package/skills/model-deployment-management/references/contracts.md

@@ -81,13 +81,32 @@ reports the assigned value. An explicit value must be in `30000..32767`.
 known to be reachable by callers. Without it, the endpoint returns a URL
 template rather than claiming external reachability.
 
+Set `type=Ingress` to reuse an existing ingress-nginx controller while keeping
+the stable model Service as ClusterIP. The default external path is
+`/models/{service}`. `host` adds an HTTP Host rule,
+`advertised_host` supplies the host used in the observed URL, `path_prefix`
+overrides the default path, and `ingress_class_name` defaults to `nginx`.
+Without `host` or `advertised_host`, the endpoint returns a path URL template
+and the caller must supply the environment's ingress address. `advertised_host`
+may include the ingress entry port. `host` must be a DNS hostname, while IP
+access uses `advertised_host` with no Host rule. `path_prefix` is a non-root
+literal path; regex expressions and traversal segments are rejected. Ingress routing
+strips the external prefix and preserves the Serving `/v1/*` and `/docs` paths; this contract does
+not configure authentication. Because `environment` is not part of the default public path,
+same-service deployments in multiple environments must use different Hosts or explicit
+`path_prefix` values when they share an ingress entry.
+
+The Serving entrypoint receives an ASGI root path for Swagger and OpenAPI server
+URLs. Older Serving images still support rewritten inference requests; prefix-aware
+documentation requires an updated Serving runtime. Training images do not need
+to change for this exposure option.
+
 The controller keeps preview, stable, and canary Services as ClusterIP for
-verification and Gateway traffic. NodePort exposure uses one fixed-name Service
-per DeploymentSpec and creates or updates it only after the revision passes all
-READY gates. Retained revisions of that deployment share the Service, while a
-replacement deployment receives a different Service so staging cannot rewrite
-the existing production route. When replacement deployments request explicit
-ports, their values must not collide while both deployments exist.
+verification and Gateway or Ingress traffic. NodePort exposure uses one fixed-name Service
+per service/environment and creates or updates it only after the revision passes all
+READY gates. Retained revisions and replacement deployments share the Service;
+staging verification uses a separate preview Service before switching the shared
+selector, so an explicit NodePort is not allocated twice.
 
 ## Revision State
 
@@ -109,7 +128,7 @@ revision passed all READY gates.
 
 Each endpoint advertises `inference_path=/v1/inference`, `docs_url`,
 `openapi_url`, and `redoc_url`. When no reviewed host is available, the
-NodePort endpoint returns corresponding URL templates instead. The Serving
+NodePort or Ingress endpoint returns corresponding URL templates instead. The Serving
 OpenAPI document is generated for the deployed ModelArtifact and embeds the
 effective model contract; it is not a generic platform API schema.
 

package/skills/model-deployment-management/references/operations.md

@@ -60,6 +60,18 @@ deployed model. NodePort network reachability remains an environment concern;
 do not report it as reachable unless `advertised_host` was reviewed and the
 client can connect.
 
+For an ingress-backed ClusterIP deployment, read the observed `ingress`
+endpoint after `READY` and use its base URL:
+
+```bash
+curl http://<ingress-host>/models/<service>/v1/model
+curl http://<ingress-host>/models/<service>/openapi.json
+```
+
+When `host` is configured separately from `advertised_host`, send the declared
+HTTP `Host` header. The platform does not configure authentication for this
+exposure mode.
+
 ## Promotion And Approval
 
 ```bash
@@ -145,6 +157,18 @@ ml-platform --profile server predict-deployment <deployment-id> \
   /absolute/path/request.json
 ```
 
+For a package with an explicit `availability_boundary`, inspect
+`lineage.visibility` in the prediction response. It records the package's
+boundary, `cutoff_time`, `attempt_started_at`, `knowledge_time`,
+`read_started_at`, and `read_completed_at`. In `request_time` mode,
+`knowledge_time` equals `attempt_started_at`; in `cutoff_time` mode it equals
+the request cutoff. Check that the source's `available_at` evidence is no later
+than `knowledge_time`, that the event-time context ends at the requested
+cutoff, and that there are no missing or non-finite model inputs. The caller
+does not supply `request_time`: each retrieval attempt receives a new time at
+the API. A historical cutoff in `request_time` mode is therefore a current
+read of historical events, not a historical replay.
+
 Prediction is allowed only for a current `READY` revision with all readiness
 conditions true. This command uses the control-plane proxy and does not require
 a cluster-local Serving URL.

package/skills/model-lifecycle-management/SKILL.md

@@ -14,6 +14,11 @@ DatasetArtifact -> TrainingRun -> TrainingJob -> ModelArtifact
 
 Read [references/training.md](references/training.md) for training work, [references/evaluation.md](references/evaluation.md) for governed evaluation, and [references/packaging.md](references/packaging.md) for ModelArtifact validation and packaging. Read only the references required by the request.
 
+For late-arriving context observations, read the package-bound
+`availability_boundary` guidance in [references/packaging.md](references/packaging.md).
+The caller supplies one cutoff; the package chooses strict cutoff visibility or
+visibility at the actual retrieval attempt.
+
 Read [references/discovery.md](references/discovery.md) before locating existing
 resources or selecting runtime bindings. It also defines Job/package preflight
 and version-skew handling.

package/skills/model-lifecycle-management/references/packaging.md

@@ -90,6 +90,35 @@ not namespace Secret/ConfigMap settings:
 }
 ```
 
+This option applies to `feature_retrieval.request.mode=context`; row retrieval
+and known-future covariate reads retain their cutoff visibility rules.
+For a context model whose event-time cutoff can precede the arrival of its
+last observation, set `feature_retrieval.availability_boundary` explicitly in
+the new package request:
+
+```json
+"availability_boundary": "request_time"
+```
+
+The caller still sends only `cutoff_time`. This remains the end of the model's
+event-time context; the API records the start of each actual retrieval attempt
+as `request_time` and admits only source records with trustworthy
+`available_at <= request_time`. Use this mode when a D 00:00 observation may
+arrive at 08:10 and prediction runs after its arrival. Use
+`"availability_boundary": "cutoff_time"` when a replay or decision must
+exclude every record that arrived after the supplied cutoff. Omit the field
+only for an existing package that intentionally retains its legacy contract.
+The platform rejects explicit visibility policies when the source cannot
+provide trustworthy availability timestamps; never replace ingestion times
+with event times or fabricate missing observations.
+
+This choice is immutable package identity. Validate and create a new package
+version, then deploy its new Serving image; changing the API image alone does
+not update existing packages. A historical `feature_lookup_test.cutoff_time`
+with `request_time` tests present-day retrieval of old events, not what was
+visible at that historical instant. Use `cutoff_time` mode for historical
+availability replay.
+
 The inference DatasetManifest must exist with the supplied hash and use
 `mode=inference`. Its FeatureSet, stable contract signature, adapter/temporal
 hashes, entity keys, and row/context parameters must match the ModelArtifact.