abelien-harness 0.3.0 → 0.5.0

package/skills/abelien-harness/scripts/generate3d.mjs

@@ -126,6 +126,10 @@ export function validateProfile(p) {
 // （mock baseUrl 等），CLI 不暴露；校验先于合并（override 可放松 https 钉子指向 http mock），
 // 指向未知名显式 PROVIDER_NOT_FOUND（拒绝静默吞掉测试笔误）。
 export function loadProfiles(deps) {
+  // Trusted host-only port: the exact verified configuration snapshot is used for
+  // preflight, upload, paid submit and subsequent reads within this operation.
+  // No CLI flag or environment setting exposes this port.
+  if (deps?.profileSnapshot) return deps.profileSnapshot;
   const domain = discoverDomains({ workdir: deps.workdir }).find(d => d.name === DOMAIN_NAME);
   if (!domain) throw fail("PROVIDER_NOT_FOUND", `domain pack ${DOMAIN_NAME} not discovered`, { domain: DOMAIN_NAME });
   const dir = path.join(domain.dir, "providers");
@@ -514,27 +518,62 @@ export function unzipPick(zipBuf, pickRe, destPath, options = {}) {
 }
 
 // downloadArtifact——产物下载落盘（Task 8）：GET 签名 URL（fetchImpl 可注入，测试零网络），
-// 60s 超时（AbortController）；非 2xx / 网络失败 / 超时一律 DOWNLOAD_FAILED（非 2xx 附
-// status）。落盘恒 destDir/model.glb：binary 直接原子写；zip/auto 先嗅探（Content-Type 含
+// 60s 超时（AbortController）；非 2xx / 网络失败 / 超时 / 3xx 一律 DOWNLOAD_FAILED（非 2xx 附
+// status）。**签名 URL 一律不跟随重定向**（`redirect:'error'`，与 restJson/uploadImages 同款）：
+// 产物地址是 provider 给的带签名链接，跟随 302 就等于把凭据送到未受信主机；这条对 CLI 的
+// `ab generate 3d fetch` 与宿主 API 一并生效（宿主面本就在 hostDeps 强制，此处补齐内核面）。
+// 落盘恒 destDir/model.glb：binary 直接原子写；zip/auto 先嗅探（Content-Type 含
 // zip 或字节头 PK\x03\x04）走 unzipPick 挑 glb 条目。返回 {file, path, sha256, bytes}——
 // spec 红线：签名 URL 永不进入返回值或落盘内容，只存在于调用栈；错误消息同样 redact
 // （T8 遗留收口：URL 不进 message/details，诊断靠 details.status / details.reason）。
+// Keep the host cancellation signal attached until the entire response body is read.
+function requestAbort(deps, timeoutMs) {
+  const ac = new AbortController();
+  const abort = () => ac.abort();
+  if (deps.signal?.aborted) ac.abort();
+  deps.signal?.addEventListener('abort', abort, { once: true });
+  const timer = setTimeout(abort, timeoutMs);
+  return {
+    signal: ac.signal,
+    close() { clearTimeout(timer); deps.signal?.removeEventListener('abort', abort); },
+  };
+}
+
+async function artifactBytes(deps, res) {
+  if (deps.credentialPolicy !== 'env-only') return Buffer.from(await res.arrayBuffer());
+  const limit = deps.maxArtifactBytes;
+  const advertised = Number(res.headers?.get?.('content-length'));
+  if (Number.isFinite(advertised) && advertised > limit) throw fail('DOWNLOAD_FAILED', 'Artifact exceeds host budget');
+  const reader = res.body?.getReader();
+  if (!reader) throw fail('DOWNLOAD_FAILED', 'Hosted artifact response must be bounded');
+  const chunks = []; let size = 0;
+  try {
+    for (;;) {
+      const { done, value } = await reader.read();
+      if (done) break;
+      size += value.length;
+      if (size > limit) throw fail('DOWNLOAD_FAILED', 'Artifact exceeds host budget');
+      chunks.push(value);
+    }
+  } finally { await reader.cancel().catch(() => {}); reader.releaseLock(); }
+  return Buffer.concat(chunks);
+}
+
 export async function downloadArtifact(deps, profile, url, destDir, localId) {
   const fetchImpl = deps.fetchImpl ?? globalThis.fetch;
-  const ac = new AbortController();
-  const timer = setTimeout(() => ac.abort(), 60000);
+  const request = requestAbort(deps, 60000);
   let res;
   let body;
   try {
-    res = await fetchImpl(url, { method: "GET", signal: ac.signal });
+    res = await fetchImpl(url, { method: "GET", signal: request.signal, redirect: 'error' });
     if (!res.ok) throw fail("DOWNLOAD_FAILED", `下载失败: HTTP ${res.status}`, { status: res.status });
-    body = Buffer.from(await res.arrayBuffer());
+    body = await artifactBytes(deps, res);
     if (deps.maxArtifactBytes !== undefined && body.length > deps.maxArtifactBytes) throw fail('DOWNLOAD_FAILED', 'Artifact exceeds host budget');
   } catch (e) {
     if (e?.code === "DOWNLOAD_FAILED") throw e;   // 非 2xx 已带 status，不二次包裹
     throw fail("DOWNLOAD_FAILED", "下载失败（签名 URL 已隐去）", { reason: String(e?.cause?.message ?? e?.message ?? e).slice(0, 200) });
   } finally {
-    clearTimeout(timer);
+    request.close();
   }
   // mkdir -p 语义自裁（Task 12 离线段 A）：目录不可创建（父路径被文件占据等）也是
   // 下载失败的一部分——收口 DOWNLOAD_FAILED 家族，消息只含本地落点、绝无签名 URL。
@@ -661,11 +700,10 @@ export async function restJson(deps, profile, { method = "GET", url, body, key,
   const headers = { "content-type": "application/json", authorization: `Bearer ${key}` };
   let lastErr;
   for (let attempt = 0; attempt <= retries; attempt++) {
-    const ac = new AbortController();
-    const timer = setTimeout(() => ac.abort(), timeoutMs);
+    const request = requestAbort(deps, timeoutMs);
     try {
       const res = await fetchImpl(url, {
-        method, headers, signal: ac.signal, redirect: 'error',
+        method, headers, signal: request.signal, redirect: 'error',
         ...(body !== undefined ? { body } : {}),   // GET 零 body（undici 拒绝 GET/HEAD body）
       });
       if (!res.ok) {
@@ -683,8 +721,9 @@ export async function restJson(deps, profile, { method = "GET", url, body, key,
       if (e?.code === "HTTP_STATUS") throw e;
       lastErr = e;   // 网络错/超时/响应体非 JSON → 重试
     } finally {
-      clearTimeout(timer);
+      request.close();
     }
+    if (deps.signal?.aborted) break;
   }
   if (lastErr?.code === "HTTP_STATUS") {   // 5xx 耗尽：保 HTTP_FAILED 码，status 仍可诊断
     throw fail("HTTP_FAILED", `rest 请求失败: ${lastErr.message}`, { status: lastErr.details.status });
@@ -718,19 +757,18 @@ async function uploadImages(deps, profile, key, files) {
     }
     const form = new FormData();
     form.append("file", new Blob([raw], { type: mime }), path.basename(file));
-    const ac = new AbortController();
-    const timer = setTimeout(() => ac.abort(), 30000);
+    const request = requestAbort(deps, 30000);
     let res,text;
     try {
       res = await fetchImpl(profile.transport.baseUrl + upath, {
-        method, headers: { authorization: `Bearer ${key}` }, body: form, signal: ac.signal, redirect: 'error',
+        method, headers: { authorization: `Bearer ${key}` }, body: form, signal: request.signal, redirect: 'error',
       });
       text=await providerText(deps,res);
     } catch (e) {
       throw fail("UPLOAD_FAILED", `图片上传失败（网络错）: ${file}`,
         { index: i, reason: String(e?.cause?.message ?? e?.message ?? e).slice(0, 200) });
     } finally {
-      clearTimeout(timer);
+      request.close();
     }
     if (!res.ok) {
       throw fail("UPLOAD_FAILED", `图片上传失败: HTTP ${res.status}`,
@@ -856,6 +894,7 @@ export async function submitFlow(deps, { provider, model: modelId, flags = {} })
   // upload 节（T12 在线段 1c）：双闸通过后、submit 请求前逐图上传换 token——
   // Authorization 同源（上方同一凭证解析的 key）；失败即 UPLOAD_FAILED 中断（零花费）。
   if (profile.upload) tokenByFile = await uploadImages(deps, profile, key, imgCtx.views.map(([, f]) => f));
+  await deps.beforeSubmit?.(); // Trusted host persists the one-send claim before the paid request.
   const raw = await restJson(deps, profile, {
     method: plan.request.method, url: plan.request.url, key,
     body: canonicalJson(buildBody(bodyTemplate, realCtx)),

package/skills/abelien-harness/scripts/receipt.mjs

@@ -16,7 +16,9 @@ const SAFE_RUN_RE = /^[0-9A-Za-z][0-9A-Za-z._-]{0,255}$/;
 const SYMBOL_RE = /^[A-Za-z0-9][A-Za-z0-9_.:-]{0,127}$/;
 const TERMINAL_WORKFLOW_STATES = new Set(["done", "failed", "cancelled"]);
 const ALLOWED_CHANGES = new Set(["geometry", "transform", "interfaces", "appearance_mapping", "material"]);
-const STEP_KEYS = new Set(["appearance.generate", "cad.initial", "cad.revision", "cad.repair", "cad.final", "visual.review"]);
+const STEP_KEYS = new Set(["appearance.generate", "appearance.revision", "mesh.generate", "structure.adapt",
+  "cad.initial", "cad.revision", "cad.repair", "cad.final", "visual.review"]);
+const APPEARANCE_PARENT_STEPS = new Set(["appearance.revision", "mesh.generate", "structure.adapt"]);
 
 function invalid(message, details) {
   throw fail("RECEIPT_INVALID", message, details);
@@ -237,6 +239,9 @@ export function parseStudioReceiptEnvelope(value) {
   exactKeys(step, ["stepKey", "parentCandidateId", "repairOrdinal", "repairBasis"], "receipt.step");
   if (typeof step.stepKey !== "string" || !STEP_KEYS.has(step.stepKey)) invalid("receipt.step.stepKey is invalid");
   if (step.parentCandidateId !== null) uuid(step.parentCandidateId, "receipt.step.parentCandidateId");
+  if (APPEARANCE_PARENT_STEPS.has(step.stepKey) && step.parentCandidateId === null) {
+    invalid("appearance and engineering receipts require their immutable parent candidate");
+  }
   if (step.stepKey === "cad.final" && (!creationLineage || step.parentCandidateId === null)) {
     invalid("cad.final requires creation lineage and the reviewed preview parent");
   }
@@ -499,7 +504,8 @@ function inspectWorkflow(workdir, envelope) {
     instanceDigest: crypto.createHash("sha256").update(bytes).digest("hex"),
     validatedFields: [...validated].sort(),
     waitIdentityVerified: ["waitId", "workflowInstanceId", operationField, "localRunId", "remoteRunId", "invocationId",
-      ...(envelope.step.stepKey === "cad.final" ? ["definitionDigest", "stepKey", "parentCandidateId"] : [])]
+      ...(envelope.step.stepKey === "cad.final" || APPEARANCE_PARENT_STEPS.has(envelope.step.stepKey)
+        ? ["definitionDigest", "stepKey", "parentCandidateId"] : [])]
       .every(field => validated.has(field)),
     resumeDisposition,
   };

package/skills/abelien-harness/scripts/studio.mjs

@@ -3,7 +3,7 @@
 // model input can never select either value.
 import fs from "node:fs";
 
-export const STUDIO_CONTEXT_FILE = "/tmp/abelien-runtime-delegation/current.json";
+export const STUDIO_CONTEXT_FILE = "/home/agent/workspace/abelien-runtime-delegation/current.json";
 
 const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
 const DIGEST = /^[0-9a-f]{64}$/;
@@ -188,6 +188,16 @@ function validateModificationRequest(value) {
   jsonSize(input, "modification input");
   return input;
 }
+// Transport identities only; immutable definitions and full tool schemas remain
+// broker-owned. Do not grant v2 to every tool when adding CAD adaptation.
+function validateToolIdentity(value) {
+  const tool = record(value, "tool input");
+  const v1 = ["model.complete", "hardware.edit", "image.generate", "cad.build", "visual.review", "mesh.generate"];
+  if (!(tool.version === 1 && v1.includes(tool.tool))
+    && !(tool.version === 2 && tool.tool === "cad.build" && tool.purpose === "appearance_adaptation")) {
+    throw fail("STUDIO_INVALID", "tool input identity is invalid");
+  }
+}
 function validateToolOperationRequest(value) {
   const input = exact(value, ["schemaVersion", "commandId", "stepKey", "parentCandidateId",
     "repairBasis", "effectIdentity", "effectRequestDigest", "waits", "input"],
@@ -214,10 +224,7 @@ function validateToolOperationRequest(value) {
     text(repair.reportDigest, "reportDigest", DIGEST, 64);
     sortedUniqueStrings(repair.issueCodes, "issueCodes", 64);
   }
-  const tool = record(input.input, "tool input");
-  if (!["model.complete", "hardware.edit", "image.generate", "cad.build", "visual.review"].includes(tool.tool) || tool.version !== 1) {
-    throw fail("STUDIO_INVALID", "tool input identity is invalid");
-  }
+  validateToolIdentity(input.input);
   noForbiddenKeys(input);
   jsonSize(input, "tool operation input");
   return input;
@@ -244,10 +251,7 @@ function validateInvocationRequest(value) {
   if (input.schemaVersion !== 1) throw fail("STUDIO_INVALID", "invocation schemaVersion must be 1");
   text(input.operationId, "operationId", UUID, 36);
   text(input.callSlot, "callSlot", IDENTIFIER, 128);
-  const tool = record(input.input, "tool input");
-  if (!["model.complete", "hardware.edit", "image.generate", "cad.build", "visual.review"].includes(tool.tool) || tool.version !== 1) {
-    throw fail("STUDIO_INVALID", "tool input identity is invalid");
-  }
+  validateToolIdentity(input.input);
   noForbiddenKeys(input);
   jsonSize(input, "invocation input");
   return input;
@@ -352,10 +356,14 @@ function safeSuccess(kind, value) {
     const row = exact(wrapper.creation, ["creationOperationId", "requestId", "inputRevision", "manifestDigest",
       "requirementsHash", "hardwareRef", "visualSpecRef", "algorithmRef", "frozenInputs", "plannedOccurrenceBindings",
       "executionDefinitionVersion", "executionDefinitionDigest", "executionPath", "repairCount", "status"],
-    ["executionSources", "stage", "latestInvocationId", "latestInvocationStatus", "accountingStatus", "candidateId", "reviewOutcome"], "creation");
+    ["executionSources", "stage", "latestInvocationId", "latestInvocationStatus", "accountingStatus", "candidateId", "reviewOutcome",
+      "latestTool", "cadBuildAttempts", "previewCandidateId"], "creation");
     text(row.creationOperationId, "creationOperationId", UUID, 36);
     text(row.requestId, "requestId", UUID, 36);
     text(row.manifestDigest, "manifestDigest", DIGEST, 64);
+    if (row.latestTool != null) text(row.latestTool, "latestTool", IDENTIFIER, 128);
+    if (row.cadBuildAttempts !== undefined) integer(row.cadBuildAttempts, "cadBuildAttempts");
+    if (row.previewCandidateId != null) text(row.previewCandidateId, "previewCandidateId", UUID, 36);
     noForbiddenKeys(row, "creation response");
     return {creation: row};
   }

package/skills/abelien-structure/SKILL.md

@@ -35,13 +35,15 @@ compatibility:
 
 产品目标是尽快展示可信真实 CAD；根据可用资产组合复用、布局和参数化补建，不强制所有部件从零 Build123d。已有可信模型可先只读预览并标注未审查，实际是否支持由宿主决定；采用／交付仍须适用检查。几何执行分 preview 与 final，预览可迭代，不是只能调用两次。需求、组件、几何、相关证据或工具链变化才失效对应缓存；纯报告措辞变化不要求重新导出 CAD。
 
+局部自由造型修改的独立 structure.adapt（cad.build@2）步骤及 analytic_carrier_faceted_decoration 范围按[外观件交接](../abelien-appearance/references/local-component-edit.md)执行：保持原接口精确几何及未改实例，不要求 Build123d 重建整个装饰网格；缺可信保护区域／接口检查时只预览，不能升级为 CAD 通过。
+
 ## 本包可执行的辅助工具
 
 - `python3 scripts/check_bundle.py --project <候选目录> --manifest bundle.json --baseline <宿主当前基线>`：现代候选包的同版文件、来源／候选 BOM、逐实例数量、原生比例、几何检查覆盖与视觉报告完整性门，格式见[候选包质量](references/bundle-quality.md)。明确只证明契约完整性，不能以 viewed=true 宣称真实审查；不依赖旧 workflow-state。
 - `python3 scripts/run_stage.py --project <工程目录> --plan <任务计划.json>`：显式输入／输出清单、输入与输出哈希复用、互斥执行、可配置超时、POSIX 进程组终止及独立执行回执。计划格式见建模参考。
 - `python3 scripts/check_visual_review.py --project <工程目录> --report <审查.json> --subject <本版模型文件> --require-pass`：为 appearance 保留的兼容完整性校验实现，只检查报告结构、文件及哈希、视图和目标覆盖；不执行图像比较或几何验收。视觉语义见同级 `abelien-appearance/references/visual-review.md`。
 
-进程组清理保持 TERM → wait(2s) → KILL → wait。仅 Darwin 的 PermissionError 且原子进程已退出时，固定 `/bin/ps` 完整校验全表，证明原组无成员或全为同有效 UID 的 zombie 后才按已终止处理；活后代、未知探针与其他错误仍失败。边界见[执行参考](references/build123d-execution.md)。
+进程组清理保持 TERM → wait(2s) → KILL → wait。仅 Darwin 的 PermissionError 且原子进程已退出时，固定 `/bin/ps` 完整校验全表，证明原组无成员或全为同有效 UID 的 zombie 后才按已终止处理（该表接受 Darwin 的 `?` 未定运行态，它不使整表判废；原组自身成员为 `?` 仍不是 zombie，照旧失败）；活后代、未知探针与其他错误仍失败。边界见[执行参考](references/build123d-execution.md)。
 
 本包不注册空 `domain.json`、虚假的 `structure.*` capability 或占位 CAD 生成服务。需要有本地执行／渲染／看图能力的宿主，或另行接通对应后端。执行辅助工具是有界前台进程，不是跨请求的后台 Worker；中断后可核验并复用已完成产物，不能恢复一个已经消失的进程。
 

package/skills/abelien-structure/references/build123d-execution.md

@@ -52,7 +52,7 @@ python3 <本skill>/scripts/run_stage.py --project <工程目录> --plan <任务J
 
 同 task_id 的 lock 防止并发覆盖；相互影响的不同 task_id 仍需宿主串行安排或使用独立候选目录。超时或可捕获的终止信号会终止子进程组并记录失败；强制杀死宿主／断电可能留下 running 与 lock。恢复时先核对 PID 和相关进程，只有证明原任务不再运行才清理该任务自己的锁；不要删除工程或重写产品状态。脚本不自动接管旧进程。
 
-POSIX 清理保持 TERM → wait(2s) → KILL → wait，不提高任务预算。Darwin 对只剩 zombie 的进程组可能返回 PermissionError；只有原 leader 的 poll 已证明退出，且固定 `/bin/ps` 的有界完整 pid/pgid/uid/stat 全表成功、非空、逐行合法时，才接受原 PGID 无成员或全为同有效 UID 的 Z 状态。活成员、不同 UID、未知／非法／不完整输出、探针失败、原 leader 仍活着或非 Darwin 的 PermissionError 都保留原错误；ProcessLookupError 的已有处理不变。探针不接受调用者路径或 shell。
+POSIX 清理保持 TERM → wait(2s) → KILL → wait，不提高任务预算。Darwin 对只剩 zombie 的进程组可能返回 PermissionError；只有原 leader 的 poll 已证明退出，且固定 `/bin/ps` 的有界完整 pid/pgid/uid/stat 全表成功、非空、逐行合法时，才接受原 PGID 无成员或全为同有效 UID 的 Z 状态。`?` 运行态（个别进程状态未定，man page 未列、负载下实测存在）是合法行，不使整表判废；但原 PGID 自身成员为 `?` 时它不是 Z，仍保留原错误。活成员、不同 UID、无法读取／非法／不完整输出、探针失败、原 leader 仍活着或非 Darwin 的 PermissionError 都保留原错误；ProcessLookupError 的已有处理不变。探针不接受调用者路径或 shell。
 
 不要覆盖已确认候选，使用新的候选目录并保留旧资产。失败任务的输出可能不完整，不得因文件存在就采用。日志为本地工程诊断，不直接展示给终端用户；任务命令和日志不得输出凭据。
 

package/skills/abelien-structure/scripts/run_stage.py

@@ -109,10 +109,17 @@ def _signal_group(process: subprocess.Popen, signum: int) -> None:
                                        env={"LC_ALL": "C"}, timeout=2)
                 if probe.returncode == 0 and not probe.stderr and probe.stdout.endswith("\n"):
                     rows = [line.split() for line in probe.stdout.splitlines()]
+                    # Darwin reports the run state as "?" when it cannot determine it
+                    # (undocumented in the man page; observed under load as "?", "?N",
+                    # "?E", "?NE"...). Such a row is structurally complete and must not
+                    # invalidate the table: otherwise one unrelated process turns a
+                    # benign exited-group cleanup into an error. An unknown-state row
+                    # of the original group is still not a zombie, so the member check
+                    # below keeps rejecting that case.
                     valid = bool(rows) and all(
                         len(row) == 4 and re.fullmatch(r"[1-9][0-9]*", row[0])
                         and all(re.fullmatch(r"-?[0-9]+", value) for value in row[1:3])
-                        and re.fullmatch(r"[IRSTUZ][+<>AELNSsVWX]*", row[3])
+                        and re.fullmatch(r"[IRSTUZ?][+<>AELNSsVWX]*", row[3])
                         for row in rows)
                     if valid and len({row[0] for row in rows}) == len(rows):
                         members = [row for row in rows if int(row[1]) == process.pid]

package/skills/abelien-workspace/SKILL.md

@@ -22,6 +22,8 @@ compatibility:
 
 已读规则在同一会话中沿用；重新取得的是作品事实与事件。不要通过反复加载 guide／workspace 启动递归调度。
 
+局部自由造型外观件使用[现有候选与采用交接](../abelien-appearance/references/local-component-edit.md)：ready 候选与 adopted current 保持原谱系，网格预览不得借 CAD 接口完成确认／导出。冻结 target occurrence 和 baseline，提交前与采用前均核对同版；unknown fit 保持预览状态。
+
 ## 产品入口
 
 [user-journey.json](workflows/user-journey.json) 中的 `journey` 对应本包完整旅程，供 Agent 阅读。其单个 `drive-product-journey` 步骤由使用 guide 的宿主 Agent 跨轮驱动。

package/skills/abelien-workspace/domain.json

@@ -1,6 +1,6 @@
 {
   "name": "abelien-workspace",
-  "version": "1.2.0",
+  "version": "1.4.0",
   "description": "作品旅程、PRD 与业务契约；user-journey 由 Agent 驱动，draft 供真实硬件阶段使用；不声明假 PRD、确认、报价或支付能力",
   "resources": [
     "draft"

package/skills/abelien-workspace/references/hardware-journey-orchestration.md

@@ -26,4 +26,4 @@ All three new hardware definitions now share `review-hardware-candidates` -> `ha
 
 Prismer Parse pending holds the original search-hardware-web cursor as awaiting_external; no extract/merge/select runs. The controlled {runId} host resumes the same frozen args/resource with `workflow resume`; task progress uses fixed original-task GET, received synchronous POST results are reused and only undispatched original-plan operations may first POST. Unknown paid effects/failed terminal runs cannot restart. Running SIGKILL snapshots require same-ID latest-checkpoint/source/plan/fence-owner verification; see the hardware evidence architecture for exact fields.
 
-The fixed trusted Prismer-first chain permits one Volc search only after saved definitive primary denial/successful empty query/unsent missing Key. Source denial permits safe direct HTML/plaintext, not a Parse substitute. Saved denial/fallback receipt SIGKILL windows recover in the same run/resource; only original unstarted fallback/source work may first dispatch, and unknown effects remain closed. The v2 host uses the declared pure recovery guard against the trusted original step snapshot; see the architecture.
+Prismer is temporarily off by default (P2-05.02): the chain saves unsent prismer_disabled markers, searches Volc directly with an English query and Count ≤ 5, and reads sources over public HTTPS (PDF/image sources stay unavailable). When the trusted host enables it, the Prismer-first chain permits one Volc search only after saved definitive primary denial/successful empty query/unsent missing Key. Source denial permits safe direct HTML/plaintext, not a Parse substitute. Saved denial/fallback receipt SIGKILL windows recover in the same run/resource; only original unstarted fallback/source work may first dispatch, and unknown effects remain closed. The v2 host uses the declared pure recovery guard against the trusted original step snapshot; see the architecture.

package/skills/abelien-workspace/workflows/definitions/0852e4949f5a6246880c1a26bf5ccaa42f8cda06b960e7c7ce234a0a176878f9.json

@@ -0,0 +1,229 @@
+{
+  "name": "user-journey-hardware-algorithm",
+  "domain": "abelien-workspace",
+  "executionProtocol": "pinned-result-v1",
+  "description": "Library recall, suitability review, fixed Prismer-first/Volc evidence for unresolved slots, source-bound merge, then the same formal hardware.select and gate",
+  "input": {
+    "required": [
+      "requirements",
+      "reactions"
+    ]
+  },
+  "steps": [
+    {
+      "id": "record-requirements",
+      "executor": "cli",
+      "action": "resource.put",
+      "args": {
+        "kind": "draft",
+        "id": "hardware-algorithm-d-{{hash}}",
+        "body": {
+          "requirements": "{{input.requirements}}",
+          "reactions": "{{input.reactions}}"
+        }
+      }
+    },
+    {
+      "id": "classify-hardware",
+      "executor": "agent",
+      "instruction": "需求已澄清；requirements 是 clarify 的 Requirements：context 为落点与场景，reaction[] 为全部触发→反应，limits[] 每项带 strength。按全部 reaction 推导功能槽位与数量，strength=hard 的 limits 进 hard_constraints，preference 只作排序提示；缺 reaction 或只有品类标签时停止并说明。读取同级 abelien-hardware-selection/SKILL.md，并用其 scripts/load-guide.mjs 依次按需加载 entry、命中的 level1、命中的 level2、contract；仅提交功能槽位、数量、受控三级路径和需求硬约束，不提交型号或猜测数据库事实。回复 {\"slots\":[...]}；若需求不足或路径不确定，停止并说明，不能伪造槽位。",
+      "replySchema": {
+        "slots": "array"
+      }
+    },
+    {
+      "id": "search-hardware-wikis",
+      "executor": "cli",
+      "action": "capability.run",
+      "args": {
+        "capability": "hardware.search",
+        "input": {
+          "operation": "search",
+          "query": "{{input.requirements}}",
+          "requirements": "{{input.requirements}}",
+          "slots": "{{steps.classify-hardware.result.slots}}",
+          "policy": {
+            "prefer_system_candidates": true,
+            "top_k_per_slot": 8,
+            "include_content": true
+          }
+        }
+      }
+    },
+    {
+      "id": "hardware-knowledge-recalled",
+      "executor": "cli",
+      "action": "machine.send",
+      "args": {
+        "machine": "hardware-recall",
+        "event": "confirmRecall",
+        "instance": "{{steps.search-hardware-wikis.resource.id}}"
+      }
+    },
+    {
+      "id": "review-hardware-candidates",
+      "executor": "agent",
+      "instruction": "Read the complete library candidates and original requirements/slots. Review suitability against function and every hard constraint. Reply {\"unresolved_slots\":[{\"slot_id\":\"original slot\",\"reason\":\"no candidates or specific reasons all candidates are unsuitable\",\"query\":\"official model search targeting function/category/key hard constraints\",\"count\":10}]}. Every zero-candidate slot requires supplemental search. All unsuitable candidates also require search. Preserve rechargeable built-in battery, wireless charging, and all other original requirements; do not ask the user to drop a requirement because the catalog is empty. unresolved_slots contains only slots that need search. Omit suitable library slots entirely; never add placeholder rows with an empty query or count=0. Return [] when all slots are suitable. Before committing this review, the trusted host validates the full original requirements, slots and recall with validate-web-search-plan.mjs; a VALIDATION reply preserves this pause so the same run can be corrected. Count is optional and a positive integer; Prismer search.topK and return.topK are explicit. Do not apply undocumented Prismer query/result limits or truncate requirements. The trusted fixed Prismer-first policy permits Volc only after a saved definitive denial, successful empty query or unsent missing Key; Volc alone checks its official 1-100 character Query and Count 1-50 at dispatch. Unknown dispatched effects never authorize fallback or a new invocation. Do not supply URLs, credentials, commands or providers. System reuse is optional: poor matches must not force complex whole systems. Concept visuals and the original requirements come first.",
+      "replySchema": {
+        "unresolved_slots": "array"
+      }
+    },
+    {
+      "id": "search-hardware-web",
+      "executor": "cli",
+      "action": "capability.run",
+      "args": {
+        "capability": "hardware.web-search",
+        "input": {
+          "requirements": "{{input.requirements}}",
+          "slots": "{{steps.classify-hardware.result.slots}}",
+          "recall_id": "{{steps.search-hardware-wikis.resource.id}}",
+          "unresolved_slots": "{{steps.review-hardware-candidates.result.unresolved_slots}}"
+        }
+      }
+    },
+    {
+      "id": "extract-web-hardware",
+      "executor": "agent",
+      "instruction": "When pages contain blob_ref, use resource get <evidenceResourceId> --page <pageId> to read each required full original page; never copy page bodies into replies. Read the persisted hardware-web-evidence pages from search-hardware-web in full. Search Content/snippets/provider official labels are not complete official pages or proof of authority. Extract only manufacturer pages; uncertain source authority remains unknown and third-party mirrors are not official merely because their URL contains a manufacturer domain. Reply {\"candidates\":[{\"slot_id\":\"original slot\",\"page_id\":\"persisted page ID\",\"manufacturer\":\"exact manufacturer\",\"manufacturer_quote\":\"at least 8 source characters\",\"model\":\"exact model\",\"model_quote\":\"at least 8 source characters\",\"parts\":[{\"name\":\"physical part name\",\"name_quote\":\"exact source quote\",\"shape\":\"box|cylinder|sphere|unknown\",\"shape_quote\":\"exact source quote\",\"dimensions_mm\":{\"length\":20,\"width\":12,\"height\":3},\"dimension_quotes\":{\"length\":\"exact quote identifying this part, axis, numeric value and unit\",\"width\":\"exact quote\",\"height\":\"exact quote\"}}]}]}. Quotes must include the exact part/name/shape they support. Each physical part has separate dimensions; cylinders use diameter/height, spheres use diameter. Unknown dimensions are omitted, never invented or defaulted. Conflicting versions and unknown multi-part overall dimensions remain unknown; do not combine contradictory versions. Do not submit page bodies, official/verified/CAD_available/source/geometry claims. Missing reliable pages or no network means candidates empty. This is envelope_only, not true component CAD or engineering verification. For an attributed tuple such as Back Panel: 48mm x 32mm x 0.5mm, add dimensions_quote with the entire exact source string and dimension_axes:[\"length\",\"width\",\"height\"] in original order; dimensions_mm must map each original value/unit to that explicitly declared axis. Preserve alternate imperial tuples in the quote; never use their values as mm or borrow another part's measurements. A 2-value tuple leaves height unknown. A box inferred from dimensions is only an envelope expression: actual part shape and orientation remain unknown. dimension_quotes may be empty for this tuple mode. Never invent coil thickness or total assembly dimensions.",
+      "replySchema": {
+        "candidates": "array"
+      }
+    },
+    {
+      "id": "merge-hardware-web",
+      "executor": "cli",
+      "action": "capability.run",
+      "args": {
+        "capability": "hardware.web-merge",
+        "input": {
+          "requirements": "{{input.requirements}}",
+          "slots": "{{steps.classify-hardware.result.slots}}",
+          "recall_id": "{{steps.search-hardware-wikis.resource.id}}",
+          "evidence_id": "{{steps.search-hardware-web.resource.id}}",
+          "candidates": "{{steps.extract-web-hardware.result.candidates}}"
+        }
+      }
+    },
+    {
+      "id": "select-hardware-from-wikis",
+      "executor": "agent",
+      "instruction": "先读 abelien-hardware-selection/references/selection-service-contract.md 与真实候选的完整 Wiki。每槽位选择一个真实 component_id，显式 quantity 等于槽位 quantity；manufacturer/model 取候选，selection_reason 非空，wiki_evidence 为至少 8 字符的 Wiki 原文引用数组。selected_models 每项需 constraint_checks，覆盖 function、slot:<hard_constraints 的键>、limit:<每项 hard limit.id>；每项包含 constraint_id、status=verified|unknown|incompatible、reason、evidence:[{component_id,quote}]。多型号另给 compatibility_checks：power、interfaces 两维须包含 status、reason、每个型号的原文 evidence，可信电气数据确定性通过时以 compatibility_report 为准；mechanical、thermal、software 只作提示，可选填写，但填 incompatible 仍阻塞。证据不足填 unknown，不可编造。status=verified|needs_confirmation，plan_mode=assemble_new|adapt_system，其余数组 selected_models/coverage_ledger/remaining_slots/unknowns/replacement_plan 必填。先比较整机，但整机继承缺 manifest 必须待确认，不凭文案抵扣数量。verified 只表示 Wiki 证据判断通过，不是独立工程兼容求解或实测，不代表采用。 Read only merge-hardware-web candidates for the final choice. Preserve structured limits.envelope and source strength; dimension metadata/name/selection-line identity are supplied by the trusted finalizer, never invented. Incompatible dimension candidates require replacement; only decision_required (user hard limit, measured/datasheet size, no axis-aligned fit) returns needs_confirmation, other risk/unknown stays advisory and risk candidates rank last. Electrically incompatible candidates (trusted data: missing bus type or count) require replacing one side; ELECTRICAL_SUPPLY_GAP means add a power or regulator part. all_indexed_candidates_rejected is scoped to this indexed category; occupancy is advisory and clear is only coarse single-part screening. Whole-system reuse is optional; a poor match never forces a complex baseline. External IDs are external:<hash>, with source authority and engineering unknowns; envelopes are not component CAD and cannot grant adoption or delivery.",
+      "replySchema": {
+        "status": "verified|needs_confirmation",
+        "plan_mode": "adapt_system|assemble_new",
+        "selected_models": "array",
+        "coverage_ledger": "array",
+        "remaining_slots": "array",
+        "unknowns": "array",
+        "replacement_plan": "array",
+        "compatibility_checks": "array"
+      }
+    },
+    {
+      "id": "select-hardware",
+      "executor": "cli",
+      "action": "capability.run",
+      "args": {
+        "capability": "hardware.select",
+        "input": {
+          "requirements": "{{input.requirements}}",
+          "slots": "{{steps.classify-hardware.result.slots}}",
+          "recall_id": "{{steps.merge-hardware-web.resource.id}}",
+          "selection_proposal": "{{steps.select-hardware-from-wikis.result}}"
+        }
+      }
+    },
+    {
+      "id": "record-hardware-selection",
+      "executor": "cli",
+      "action": "resource.update",
+      "args": {
+        "id": "{{steps.record-requirements.resource.id}}",
+        "bodyPatch": {
+          "hardwareSelectionId": "{{steps.select-hardware.resource.id}}",
+          "hardwareSelectionStatus": "{{steps.select-hardware.result.status}}",
+          "hardwareSelectionRevision": "{{steps.select-hardware.result.revision}}",
+          "hardwarePlanMode": "{{steps.select-hardware.result.plan_mode}}"
+        }
+      }
+    },
+    {
+      "id": "hardware-selected",
+      "executor": "cli",
+      "action": "machine.send",
+      "args": {
+        "machine": "hardware-selection",
+        "event": "confirmSelection",
+        "instance": "{{steps.record-requirements.resource.id}}"
+      },
+      "completeWhen": {
+        "path": "steps.hardware-selected.result.to",
+        "equals": "selected_pending_confirmation"
+      },
+      "completionResult": {
+        "selectionId": "{{steps.select-hardware.resource.id}}",
+        "selectionStatus": "{{steps.select-hardware.result.status}}",
+        "selectionRevision": "{{steps.select-hardware.result.revision}}"
+      }
+    },
+    {
+      "id": "research-algorithms",
+      "executor": "agent",
+      "instruction": "硬件选型已完成。读取同级 abelien-algorithm/SKILL.md 和 references/research-policy.md，并从 context-json 的 select-hardware.resource 读取准确厂商、型号、能力和 Wiki 证据。针对 input.reactions 先检索硬件厂商官方资料，再检索算法或模型官方资料与 Hugging Face；端侧不满足且用户允许联网时才比较成熟云服务。选择每个 reaction 的最合适实现并回复 {\"bindings\":[...],\"candidates\":[...],\"sources\":[...],\"unavailable_sources\":[...],\"unknowns\":[...],\"blocking_unknowns\":[...]}；来源必须回读，binding 必须明确 edge、cloud 或 hybrid。",
+      "replySchema": {
+        "bindings": "array",
+        "candidates": "array",
+        "sources": "array",
+        "unavailable_sources": "array",
+        "unknowns": "array",
+        "blocking_unknowns": "array"
+      }
+    },
+    {
+      "id": "select-algorithms",
+      "executor": "cli",
+      "action": "capability.run",
+      "args": {
+        "capability": "algorithm.finalize",
+        "input": {
+          "operation": "select",
+          "hardware_selection_id": "{{steps.select-hardware.resource.id}}",
+          "hardware_selection_revision": "{{steps.select-hardware.result.revision}}",
+          "requirements": "{{input.requirements}}",
+          "reactions": "{{input.reactions}}",
+          "research": "{{steps.research-algorithms.result}}"
+        }
+      }
+    },
+    {
+      "id": "algorithm-selected",
+      "executor": "cli",
+      "action": "machine.send",
+      "args": {
+        "machine": "algorithm-selection",
+        "event": "confirmSelection",
+        "instance": "{{steps.select-algorithms.resource.id}}"
+      }
+    },
+    {
+      "id": "record-algorithm-selection",
+      "executor": "cli",
+      "action": "resource.update",
+      "args": {
+        "id": "{{steps.record-requirements.resource.id}}",
+        "bodyPatch": {
+          "algorithmSelectionId": "{{steps.select-algorithms.resource.id}}",
+          "algorithmSelectionStatus": "{{steps.select-algorithms.result.status}}",
+          "algorithmSelectionRevision": "{{steps.select-algorithms.result.revision}}"
+        }
+      }
+    }
+  ],
+  "result": {
+    "selectionId": "{{steps.select-hardware.resource.id}}",
+    "selectionStatus": "{{steps.select-hardware.result.status}}",
+    "selectionRevision": "{{steps.select-hardware.result.revision}}"
+  },
+  "legacyResume": "read_only"
+}