agentworkshop 0.7.66 → 0.7.71

package/scripts/agent-binding-matrix-e2e.mjs

@@ -0,0 +1,240 @@
+/**
+ * Agent 绑定→工具注入→取数→下发 端到端矩阵(设计验证轮)。
+ *
+ * 用法: node scripts/agent-binding-matrix-e2e.mjs <scenario-context.json>
+ * 产物: docs/audit/evidence/2026-10-22-design-validation/binding-matrix.json
+ *
+ * 覆盖:
+ *  A 工具面装配(全族 host 工具+插件工具在位)
+ *  B 授权面=绑定面:绑 1 节点的 agent 只能查该节点;越权节点拒绝附指引;line 级查询收窄
+ *  C 多产线:第二产线的节点绑定后可查,线 A 未绑节点仍拒
+ *  D 多源异构经 Agent 工具:daq_frames 取 48 点数组断面 + CCD 图像(元数据/引用,像素不入 LLM)
+ *  E 自定义 API:http 驱动轮询节点入镜像 + ingest REST 自定义推送(标量+数组+图像)
+ *  F 参数下发:recipe 绑定 agent 经 HITL 批准下发并设备证实,回读一致
+ *  G 插件工具真调用:kb_agent(rag-bridge)经 invoke 桥返回结构化结果
+ */
+import { readFileSync, writeFileSync, mkdirSync } from 'node:fs'
+import { join, resolve, dirname } from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+const REPO = resolve(dirname(fileURLToPath(import.meta.url)), '..')
+const CTX = process.argv[2]
+if (!CTX) {
+  console.error('用法: node scripts/agent-binding-matrix-e2e.mjs <scenario-context.json>')
+  process.exit(1)
+}
+const c = JSON.parse(readFileSync(CTX, 'utf8'))
+const EVID = join(REPO, 'docs', 'audit', 'evidence', '2026-10-22-design-validation')
+mkdirSync(EVID, { recursive: true })
+const sleep = ms => new Promise(r => setTimeout(r, ms))
+const results = []
+function ok(id, name, cond, detail = '') {
+  results.push({ id, name, pass: Boolean(cond), detail: String(detail).slice(0, 600) })
+  console.log(`${cond ? '✔' : '✖'} [${id}] ${name}${detail ? ` — ${String(detail).slice(0, 240)}` : ''}`)
+}
+async function api(method, path, body) {
+  const r = await fetch(c.base + path, {
+    method,
+    headers: { ...(body !== undefined ? { 'content-type': 'application/json' } : {}), authorization: `Bearer ${c.adminToken}` },
+    body: body === undefined ? undefined : JSON.stringify(body),
+    signal: AbortSignal.timeout(120_000),
+  })
+  return { status: r.status, data: (await r.json().catch(() => null))?.data, message: '' }
+}
+function invokeOf(agent) {
+  return async (tool, args, timeoutMs = 180_000) => {
+    const r = await fetch(c.base + '/api/workshop/agent-tools/invoke', {
+      method: 'POST',
+      headers: { 'content-type': 'application/json', 'x-aw-agent-token': agent.token },
+      body: JSON.stringify({ agentId: agent.id, tool, args }),
+      signal: AbortSignal.timeout(timeoutMs),
+    })
+    const j = await r.json().catch(() => null)
+    return { status: r.status, isError: Boolean(j?.data?.result?.isError), text: String(j?.data?.result?.text ?? '') }
+  }
+}
+async function main() {
+  console.log(`━━━ binding-matrix @ ${c.base} line=${c.lineId} ━━━`)
+  const analyst = c.agents.analyst
+  const optimizer = c.agents.optimizer
+  const analystInvoke = invokeOf(analyst)
+  const optimizerInvoke = invokeOf(optimizer)
+
+  // ── A 工具面装配 ──
+  const listFor = async (agent) => {
+    const r = await fetch(`${c.base}/api/workshop/agent-tools/list?agentId=${agent.id}`, { headers: { 'x-aw-agent-token': agent.token } })
+    return r.status === 200 ? ((await r.json())?.data?.tools ?? []) : []
+  }
+  const aTools = await listFor(analyst)
+  const aNames = aTools.map(t => t.name)
+  ok('A1', '工具面全族装配(worker n≥50,含 daq/frames/recipe/analysis/line)', aNames.length >= 50
+  && ['daq_query', 'daq_frames', 'recipe_catalog', 'analysis_save', 'line_context'].every(t => aNames.includes(t)), `n=${aNames.length}`)
+  ok('A2', '插件工具注入(rag-bridge: kb_agent+sentinel_*)', aNames.includes('kb_agent') && aNames.filter(n => n.startsWith('sentinel_')).length >= 1,
+    `kb=${aNames.includes('kb_agent')} sentinel×${aNames.filter(n => n.startsWith('sentinel_')).length}`)
+  let oTools = await listFor(optimizer)
+  for (let i = 0; i < 3 && !(oTools.length >= 50 && oTools.some(t => t.name === 'daq_query')); i++) {
+    await sleep(2000)
+    oTools = await listFor(optimizer)
+  }
+  ok('A3', 'optimizer 同族工具面(角色差异由授权面体现)', oTools.length >= 50 && oTools.some(t => t.name === 'daq_query'),
+    `n=${oTools.length} hasDaq=${oTools.some(t => t.name === 'daq_query')}`)
+
+  // ── B 单节点绑定授权面 ──
+  const daqNodes = (await api('GET', '/api/workshop/daq')).data?.nodes ?? []
+  const lineNodes = daqNodes.filter(n => n.lineId === c.lineId)
+  const weightNode = c.daq?.['part-weight'] ?? c.weightNode
+  const sibling = lineNodes.find(n => n.id !== weightNode)
+  const tpl = await api('POST', '/api/workshop/agents', { name: `单点绑定工-${Date.now().toString(36).slice(-4)}`, harness: 'mock', config: {} })
+  const tplId = tpl.data?.id
+  const joinB1 = await api('POST', `/api/workshop/channels/${c.channelId}/agents`, { agentId: tplId, role: 'worker' })
+  const members = (await api('GET', `/api/workshop/channels/${c.channelId}/agents`)).data
+  const memberList = Array.isArray(members) ? members : (members?.agents ?? [])
+  const b1 = memberList.find(m => m.id === (joinB1.data?.id ?? joinB1.data?.agentId)) ?? memberList.find(m => /单点绑定工/.test(m.name))
+  ok('B0', '新 agent 入频道(含 token)', Boolean(b1?.token), `id=${b1?.id?.slice(0, 10)}`)
+  const b1Invoke = invokeOf(b1)
+  const bind1 = await api('POST', '/api/workshop/agent-tools/bindings', { agentId: b1.id, nodeId: weightNode, kind: 'daq', mode: 'auto' })
+  ok('B1', '绑定 1 个节点(part-weight)', bind1.status === 200 && Boolean(bind1.data?.binding?.id))
+
+  // ── C0 第二产线供给(手工轻量建:绕开 provisionScenarioLine 的同 tag 复用逻辑——
+  // 复用命中会返回既有线 A,无法造第二条;mock 驱动节点无需模拟器设备) ──
+  const tagL = Date.now().toString(36).slice(-4)
+  const lb = await api('POST', '/api/workshop/dcw/lines', { name: `绑定矩阵-B线-${tagL}`, description: '绑定矩阵验证第二产线' })
+  const lineB = lb.data?.line?.id
+  const mkBNode = async nm => (await api('POST', '/api/workshop/daq', {
+    name: nm, templateRef: 'daq-temp-tc', driver: 'mock', unit: '℃', min: 0, max: 100, decimals: 2,
+    lineId: lineB, intervalMs: 1000, enabled: true,
+  })).data?.node?.id
+  const nodeB = lineB ? await mkBNode(`bm-b-line-t1-${tagL}`) : null
+  const nodeB2 = lineB ? await mkBNode(`bm-b-line-t2-${tagL}`) : null
+  ok('C0', '第二产线供给(line+2 mock 节点)', Boolean(lineB && nodeB && nodeB2), `lineB=${lineB} nodeB=${nodeB} nodeB2=${nodeB2}`)
+
+  await sleep(500)
+  const qBound = await b1Invoke('daq_query', { node_id: weightNode, last_minutes: 10, limit: 60 })
+  const rest = await api('GET', `/api/workshop/daq/${weightNode}/samples?from=${Date.now() - 600_000}&to=${Date.now()}&bucketMs=1000&limit=200`)
+  const restVals = (rest.data?.points ?? []).map(p => Number(p.value ?? p.avg)).filter(Number.isFinite)
+  const restMean = restVals.length ? restVals.reduce((a, b) => a + b, 0) / restVals.length : NaN
+  const toolMean = Number((qBound.text.match(/均值\s+([\d.]+)/) ?? [])[1])
+  ok('B2', '绑定节点 daq_query 取到镜像数据且与 REST 镜像同值',
+    !qBound.isError && Number.isFinite(toolMean) && Number.isFinite(restMean) && Math.abs(toolMean - restMean) <= Math.max(0.05, restMean * 0.02),
+    `tool=${toolMean} rest=${restMean?.toFixed(3)}(n=${restVals.length})`)
+  // v28 语义:频道绑线只读扩权 → 线内互查放行;真隔离边界=跨线未绑节点
+  const qCrossLine = nodeB2 ? await b1Invoke('daq_query', { node_id: nodeB2, last_minutes: 5, limit: 10 }) : { isError: false, text: 'skipped' }
+  ok('B3', '跨线未绑节点拒绝且附授权集指引(v28:隔离边界=线)',
+    qCrossLine.isError && /不在你的授权范围|无权|你有权/.test(qCrossLine.text), qCrossLine.text.slice(0, 140))
+  const qLine = await b1Invoke('daq_query', { line_id: c.lineId, last_minutes: 10, limit: 200 })
+  const nodeSections = (qLine.text.match(/■ /g) ?? []).length
+  ok('B4', '频道绑线只读扩权:线 A 全部节点可读(v28 文档语义)', !qLine.isError && nodeSections === lineNodes.length, `sections=${nodeSections}/${lineNodes.length}`)
+
+  // ── C 多产线绑定扩展 ──
+  // 权限模型 v3:绑线频道成员只能绑同产线节点(LINE_SCOPE_MISMATCH 是设计行为)。
+  // 跨线正道=第二产线配第二频道(产线隔离工作区):建 channelB(绑 lineB)+成员 b2+绑 nodeB。
+  if (lineB && nodeB) {
+    const chB = await api('POST', '/api/workshop/channels', { name: `绑定矩阵-B频道-${Date.now().toString(36).slice(-4)}`, lineId: lineB, leadAgent: { name: `B线主管-${Date.now().toString(36).slice(-3)}`, harness: 'mock' } })
+    const chBId = chB.data?.channelId
+    const tpl2 = await api('POST', '/api/workshop/agents', { name: `B线绑定工-${Date.now().toString(36).slice(-4)}`, harness: 'mock', config: {} })
+    const joinB2 = await api('POST', `/api/workshop/channels/${chBId}/agents`, { agentId: tpl2.data?.id, role: 'worker' })
+    const members2 = (await api('GET', `/api/workshop/channels/${chBId}/agents`)).data
+    const mList2 = Array.isArray(members2) ? members2 : (members2?.agents ?? [])
+    const b2 = mList2.find(m => m.id === (joinB2.data?.id ?? joinB2.data?.agentId)) ?? mList2.find(m => /B线绑定工/.test(m.name))
+    ok('C1', '第二频道(绑线 B)+成员 b2 就绪', Boolean(chBId && b2?.token), `chB=${chBId} b2=${b2?.id?.slice(0, 10)}`)
+    const b2Invoke = b2 ? invokeOf(b2) : null
+    const bindB = b2 ? await api('POST', '/api/workshop/agent-tools/bindings', { agentId: b2.id, nodeId: nodeB, kind: 'daq', mode: 'auto' }) : { status: 0, data: null }
+    ok('C2', 'b2 绑定线 B 节点受理(同线一致)', bindB.status === 200 && Boolean(bindB.data?.binding?.id), String(bindB.data?.binding?.id ?? bindB.message ?? '').slice(0, 90))
+    const qB = b2Invoke ? await b2Invoke('daq_query', { node_id: nodeB, last_minutes: 10, limit: 30 }) : { isError: true, text: 'skipped' }
+    ok('C3', 'b2 查线 B 绑定节点放行(mock 无批,0 点不拒)', !qB.isError, qB.text.slice(0, 100))
+    const qA = b2Invoke ? await b2Invoke('daq_query', { node_id: weightNode, last_minutes: 5, limit: 10 }) : { isError: true, text: 'skipped' }
+    ok('C4', 'b2 查线 A 节点拒绝(跨频道跨线隔离)', qA.isError && /授权范围|无权|你有权/.test(qA.text), qA.text.slice(0, 110))
+    const qLineB = b2Invoke ? await b2Invoke('daq_query', { line_id: lineB, last_minutes: 5, limit: 200 }) : { isError: true, text: 'skipped' }
+    ok('C5', 'b2 lineB 级查询=频道绑线只读扩权(2 节点)', !qLineB.isError && (qLineB.text.match(/■ /g) ?? []).length === 2, `sections=${(qLineB.text.match(/■ /g) ?? []).length}`)
+  }
+
+  // ── D 多源异构经 Agent 工具(数组/图像) ──
+  const tag = Date.now().toString(36).slice(-4)
+  const mkNode = async body => (await api('POST', '/api/workshop/daq', body)).data?.node
+  const vecNode = await mkNode({ name: `绑定矩阵-膜厚断面-${tag}`, templateRef: 'thickness-scan', driver: 'mock', lineId: c.lineId, intervalMs: 60000, enabled: true })
+  const imgNode = await mkNode({ name: `绑定矩阵-CCD图像-${tag}`, templateRef: 'ccd-image', driver: 'mock', lineId: c.lineId, intervalMs: 60000, enabled: true })
+  ok('D0', '异构帧节点在位(vector+image)', Boolean(vecNode?.id && imgNode?.id), `vec=${vecNode?.id} img=${imgNode?.id}`)
+  const ingV = await api('POST', `/api/workshop/daq/${vecNode.id}/ingest`, { points: Array.from({ length: 48 }, (_, i) => Number((30 + Math.sin(i / 6) * 1.5).toFixed(3))), metrics: { source: 'binding-matrix', marker: 'v1' } })
+  const ingI = await api('POST', `/api/workshop/daq/${imgNode.id}/ingest`, { image: { base64: 'iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mP8z8BQDwAEhQGAhKmMIQAAAABJRU5ErkJggg==', mime: 'image/png', width: 1, height: 1 }, metrics: { source: 'binding-matrix', marker: 'i1' } })
+  ok('D1', '自定义 API 推送数组帧(48 点)+图像帧入库', ingV.status === 200 && ingI.status === 200, `vec=${ingV.status} img=${ingI.status}`)
+  await sleep(1500)
+  const bindV = await api('POST', '/api/workshop/agent-tools/bindings', { agentId: b1.id, nodeId: vecNode.id, kind: 'daq', mode: 'auto' })
+  const bindI = await api('POST', '/api/workshop/agent-tools/bindings', { agentId: b1.id, nodeId: imgNode.id, kind: 'daq', mode: 'auto' })
+  ok('D2', '异构节点绑定受理', bindV.status === 200 && bindI.status === 200)
+  const fVec = await b1Invoke('daq_frames', { node_id: vecNode.id, last_minutes: 30, limit: 10, include_points: true, point_limit: 48 })
+  ok('D3', 'daq_frames 取数组断面(48 点/派生指标)', !fVec.isError && /形态|帧数|点/.test(fVec.text) && /30\.\d{2,}|mean|均值|max|min/i.test(fVec.text), fVec.text.slice(0, 160))
+  const fImg = await b1Invoke('daq_frames', { node_id: imgNode.id, kind: 'image', last_minutes: 30, limit: 10 })
+  ok('D4', 'daq_frames 取图像帧(引用/内容 URL,像素不入 LLM)', !fImg.isError && /帧|image|content|http/i.test(fImg.text), fImg.text.slice(0, 160))
+  const fScalar = await b1Invoke('daq_frames', { node_id: sibling.id, last_minutes: 30, limit: 5 })
+  ok('D5', '标量节点 daq_frames 按设计提示无帧(与频道绑线只读面一致)', !fScalar.isError && /单点标量|无帧/.test(fScalar.text), fScalar.text.slice(0, 90))
+
+  // ── E 自定义 API 数据(http 驱动轮询 + ingest 标量) ──
+  const httpNodes = lineNodes.filter(n => (n.protocol ?? n.driver) === 'http')
+  if (httpNodes.length) {
+    const hs = await api('GET', `/api/workshop/daq/${httpNodes[0].id}/samples?from=${Date.now() - 300_000}&to=${Date.now()}&bucketMs=1000&limit=100`)
+    const hn = (hs.data?.points ?? []).length
+    ok('E1', 'http 协议节点镜像采集(API 轮询入库)', hn > 0, `node=${httpNodes[0].name} points=${hn}`)
+  }
+  else ok('E1', 'http 协议节点在位', false, '线内无 http 节点')
+  const mqttNodes = lineNodes.filter(n => (n.protocol ?? n.driver) === 'mqtt')
+  if (mqttNodes.length) {
+    const ms = await api('GET', `/api/workshop/daq/${mqttNodes[0].id}/samples?from=${Date.now() - 300_000}&to=${Date.now()}&bucketMs=1000&limit=100`)
+    ok('E2', 'mqtt 协议节点镜像采集(订阅入库)', (ms.data?.points ?? []).length > 0, `node=${mqttNodes[0].name} points=${(ms.data?.points ?? []).length}`)
+  }
+  else ok('E2', 'mqtt 协议节点在位', false, '线内无 mqtt 节点')
+
+  // ── F 参数下发(HITL) ──
+  // 前置:前序套件/补批次循环可能留下停线;运行门要求「本配方有活动批次」,先确保开线
+  {
+    const stPre = await api('GET', '/api/workshop/dcw')
+    const act = Boolean(stPre.data?.lineStates?.find(l => l.lineId === c.lineId)?.active)
+    if (!act) {
+      await api('POST', `/api/workshop/dcw/lines/${c.lineId}/start`, { recipeId: c.recipeId })
+      await sleep(8000)
+      console.log('  [pre] 产线恢复运行(运行门需要活动批次)')
+    }
+  }
+  const dcwSnap = (await api('GET', '/api/workshop/dcw')).data
+  const pressNode = c.dcw?.['hold-pressure-sp'] ?? (dcwSnap?.nodes ?? []).find(n => /hold-pressure/i.test(n.name ?? ''))?.id
+  const cur = (dcwSnap?.nodes ?? []).find(n => n.id === pressNode)?.value
+  const pendingIds = async () => new Set(((await api('GET', '/api/workshop/hitl/pending')).data?.items ?? []).map(x => x.id))
+  const known = await pendingIds()
+  const trialP = optimizerInvoke('recipe_trial', { recipe_id: c.recipeId, params: [{ node_id: pressNode, value: 46.8 }], hypothesis: '绑定矩阵验证:单变量保压下发', emergency: true })
+  let card = null
+  for (let i = 0; i < 90 && !card; i++) {
+    await sleep(1000)
+    card = ((await api('GET', '/api/workshop/hitl/pending')).data?.items ?? []).find(x => !known.has(x.id) && String(x.nodeId ?? '').startsWith('recipe:')) ?? null
+  }
+  if (card) await api('POST', '/api/workshop/hitl/respond', { kind: 'dcw-approval', id: card.id, confirmed: true, choice: 0, comment: '绑定矩阵 F 轮' })
+  const trial = await trialP
+  const applied = Number(trial.text.match(/hold-pressure-sp→([\d.]+)bar/)?.[1] ?? NaN)
+  ok('F1', 'recipe 绑定 agent 经 HITL 批准下发并设备证实', Boolean(card) && !trial.isError && Math.abs(applied - 46.8) < 1e-6, trial.text.slice(0, 170))
+  await sleep(3000)
+  const snap2 = (await api('GET', '/api/workshop/dcw')).data
+  const nowVal = (snap2?.nodes ?? []).find(n => n.id === pressNode)?.value
+  ok('F2', '下发回读一致', Number(nowVal) === 46.8, `回读=${nowVal}(下发前=${cur})`)
+  const rBack = await optimizerInvoke('daq_query', { node_id: weightNode, last_minutes: 5, limit: 20 })
+  ok('F3', 'optimizer(仅配方绑定)查 DAQ 数据——绑定面按需扩展', !rBack.isError || /绑定|归属/.test(rBack.text), rBack.text.slice(0, 90))
+
+  // ── G 插件工具真调用(rag-bridge kb_agent:async 提交+状态查询,同步回合依赖知识库侧引擎时长) ──
+  const kbSub = await analystInvoke('kb_agent', { prompt: '注塑克重波动常见原因?', mode: 'async' }, 60_000)
+  const taskId = kbSub.text.match(/task[_\s-]?id[:=]?\s*([A-Za-z0-9_-]+)/i)?.[1] ?? ''
+  let kbOk = !kbSub.isError && Boolean(taskId)
+  let kbDetail = kbSub.text.slice(0, 120)
+  if (kbOk) {
+    const st = await analystInvoke('kb_agent_status', { task_id: taskId, wait_seconds: 110 }, 130_000)
+    const done = /完成|done|成功|答案|结论/i.test(st.text) && !st.isError
+    kbOk = !st.isError && (done || /pending|running|执行中/i.test(st.text))
+    kbDetail = `${kbSub.text.slice(0, 60)} | status: ${st.text.slice(0, 100)}`
+  }
+  ok('G1', 'kb_agent 经 invoke 桥走通插件链(异步提交+状态可查)', kbOk, kbDetail)
+
+  const pass = results.filter(r => r.pass).length
+  writeFileSync(join(EVID, 'binding-matrix.json'), JSON.stringify({ at: new Date().toISOString(), base: c.base, lineA: c.lineId, results }, null, 2))
+  console.log(`\n═══ binding-matrix: ${pass}/${results.length} PASS ═══`)
+  process.exit(pass === results.length ? 0 : 1)
+}
+main().catch((e) => {
+  console.error(e)
+  process.exit(1)
+})

package/scripts/agent-daq-isolation-e2e.mjs

@@ -0,0 +1,91 @@
+/**
+ * Agent 专属 DAQ 隔离对照：不绑线的 Channel 内，两个 Agent 各绑不同节点，
+ * 验证 daq_query 只返回自己的绑定节点、调用他人节点被拒。
+ */
+import { readFileSync, writeFileSync, mkdirSync } from 'node:fs'
+import { join, resolve, dirname } from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+const REPO = resolve(dirname(fileURLToPath(import.meta.url)), '..')
+const c = JSON.parse(readFileSync(process.argv[2], 'utf8'))
+const EVID = join(REPO, 'docs', 'audit', '2026-10-21-full-function-evidence')
+mkdirSync(EVID, { recursive: true })
+const results = []
+function ok(id, name, cond, detail = '') {
+  results.push({ id, name, pass: Boolean(cond), detail: String(detail).slice(0, 600) })
+  console.log(`${cond ? '✔' : '✖'} [${id}] ${name}${detail ? ` — ${String(detail).slice(0, 220)}` : ''}`)
+}
+async function api(method, path, body, token = c.adminToken) {
+  const r = await fetch(c.base + path, {
+    method,
+    headers: { ...(body !== undefined ? { 'content-type': 'application/json' } : {}), ...(token ? { authorization: `Bearer ${token}` } : {}) },
+    body: body === undefined ? undefined : JSON.stringify(body),
+    signal: AbortSignal.timeout(60_000),
+  })
+  return { status: r.status, ...(await r.json().catch(() => ({}))) }
+}
+async function invoke(agent, tool, args) {
+  const r = await fetch(c.base + '/api/workshop/agent-tools/invoke', {
+    method: 'POST',
+    headers: { 'content-type': 'application/json', 'x-aw-agent-token': agent.token },
+    body: JSON.stringify({ agentId: agent.id, tool, args }),
+    signal: AbortSignal.timeout(90_000),
+  })
+  const j = await r.json().catch(() => null)
+  return { isError: Boolean(j?.data?.result?.isError), text: String(j?.data?.result?.text ?? '') }
+}
+
+async function main() {
+  console.log(`━━━ Agent DAQ 隔离对照 @ ${c.base} ━━━`)
+  const daq = Object.values(c.daq ?? {})
+  if (daq.length < 2) throw new Error('需要至少 2 个 DAQ 节点')
+  const aNode = daq[0]
+  const bNode = daq[1]
+  // 注意：刻意不传 lineId —— 无频道绑线扩权，只剩 Agent 直接绑定面
+  const ch = await api('POST', '/api/workshop/channels', {
+    name: `agent-daq-isolation-${Date.now().toString(36).slice(-5)}`,
+    leadAgent: { name: 'iso-lead', harness: 'mock' },
+  })
+  const channelId = ch?.data?.channelId
+  ok('D0', '无绑线隔离 Channel 创建', Boolean(channelId), `lineId=${ch?.data?.lineId ?? '(empty)'}`)
+  if (!channelId) return finish({})
+  const a = (await api('POST', `/api/workshop/channels/${channelId}/agents`, { name: 'iso-a', harness: 'mock', role: 'worker' })).data
+  const b = (await api('POST', `/api/workshop/channels/${channelId}/agents`, { name: 'iso-b', harness: 'omp', role: 'worker' })).data
+  const rows = (await api('GET', `/api/workshop/channels/${channelId}/agents`))?.data ?? []
+  const list = Array.isArray(rows) ? rows : (rows.agents ?? [])
+  const agentA = list.find(x => x.id === a?.id) ?? a
+  const agentB = list.find(x => x.id === b?.id) ?? b
+  ok('D1', '两个成员创建且有 token', Boolean(agentA?.token && agentB?.token), `${agentA?.id?.slice(0, 8)}/${agentB?.id?.slice(0, 8)}`)
+  await api('POST', '/api/workshop/agent-tools/bindings', { agentId: agentA.id, nodeId: aNode, kind: 'daq', mode: 'auto' })
+  await api('POST', '/api/workshop/agent-tools/bindings', { agentId: agentB.id, nodeId: bNode, kind: 'daq', mode: 'auto' })
+  const la = await api('GET', `/api/workshop/agent-tools/list?agentId=${agentA.id}`)
+  const lb = await api('GET', `/api/workshop/agent-tools/list?agentId=${agentB.id}`)
+  const da = (la?.data?.tools ?? []).find(t => t.name === 'daq_query')?.description ?? ''
+  const db = (lb?.data?.tools ?? []).find(t => t.name === 'daq_query')?.description ?? ''
+  ok('D2', 'A 描述只含自己的节点', da.includes(aNode) && !da.includes(bNode), `own=${aNode} other=${bNode}`)
+  ok('D3', 'B 描述只含自己的节点', db.includes(bNode) && !db.includes(aNode), `own=${bNode} other=${aNode}`)
+
+  const ra = await invoke(agentA, 'daq_query', { last_minutes: 1, limit: 5 })
+  const rb = await invoke(agentB, 'daq_query', { last_minutes: 1, limit: 5 })
+  const countA = Number((ra.text.match(/数采数据查询结果\((\d+) 个节点/) ?? [])[1])
+  const countB = Number((rb.text.match(/数采数据查询结果\((\d+) 个节点/) ?? [])[1])
+  ok('D4', 'A 查询只覆盖 1 个绑定节点', !ra.isError && countA === 1, ra.text.slice(0, 260))
+  ok('D5', 'B 查询只覆盖 1 个绑定节点', !rb.isError && countB === 1, rb.text.slice(0, 260))
+  const cross = await invoke(agentA, 'daq_query', { node_id: bNode, last_minutes: 1, limit: 5 })
+  ok('D6', 'A 调 B 的节点被拒', cross.isError && /未绑定|不在|可读|越权|拒绝|不可/.test(cross.text), cross.text.slice(0, 260))
+
+  const ev = { at: new Date().toISOString(), channelId, lineBound: Boolean(ch?.data?.lineId), aNode, bNode, agentA: agentA.id, agentB: agentB.id, countA, countB, cross: cross.text.slice(0, 500), results }
+  writeFileSync(join(EVID, 'agent-daq-isolation.json'), JSON.stringify(ev, null, 2))
+  return finish(ev)
+}
+function finish(ev) {
+  const pass = results.filter(r => r.pass).length
+  writeFileSync(join(EVID, 'agent-daq-isolation-summary.json'), JSON.stringify({ at: new Date().toISOString(), pass, fail: results.length - pass, results, ev }, null, 2))
+  console.log(`\n═══ Agent DAQ 隔离: ${pass}/${results.length} PASS ═══`)
+  if (pass !== results.length) process.exitCode = 1
+}
+main().catch((e) => {
+  console.error(e)
+  ok('D-ERR', '脚本未抛异常', false, e.message)
+  finish({})
+})

package/scripts/api-contract-smoke.mjs

@@ -0,0 +1,126 @@
+#!/usr/bin/env node
+/**
+ * API 契约 + Channel 作用域冒烟（2026-10-19）
+ *
+ * 补齐 api-live-e2e 未覆盖的只读面与真实的跨频道 agent-token 负例：
+ *  - health / users/me / channels / workspaces / daq / dcw / hitl / plugins / ops-logs 形状
+ *  - 两个临时频道：用 A 频道 lead 的实例 token 访问 B 频道的任务详情/列表，必须 403/SCOPE_VIOLATION
+ *  - 结束后删除两个临时频道，不触碰既有业务数据
+ *
+ * 运行：AW_BASE=http://127.0.0.1:3001 AW_TOKEN=<user-token> node scripts/api-contract-smoke.mjs
+ */
+const BASE = process.env.AW_BASE ?? 'http://127.0.0.1:3001'
+const TOKEN = process.env.AW_TOKEN
+if (!TOKEN) throw new Error('AW_TOKEN required (user token, admin or owner)')
+process.env.NO_PROXY = '127.0.0.1,localhost'
+
+const results = []
+const ok = (id, name, cond, detail = '') => {
+  results.push({ id, name, pass: Boolean(cond), detail: String(detail).slice(0, 400) })
+  console.log(`${cond ? '✔' : '✖'} [${id}] ${name}${cond ? '' : ` — ${String(detail).slice(0, 400)}`}`)
+}
+const api = async (method, path, { token = TOKEN, body } = {}) => {
+  const r = await fetch(BASE + path, {
+    method,
+    headers: { 'authorization': `Bearer ${token}`, 'content-type': 'application/json' },
+    body: body === undefined ? undefined : JSON.stringify(body),
+    signal: AbortSignal.timeout(30_000),
+  })
+  const text = await r.text()
+  let json
+  try {
+    json = text ? JSON.parse(text) : {}
+  }
+  catch {
+    json = { raw: text }
+  }
+  return { status: r.status, ...json }
+}
+const data = r => r?.data ?? null
+const tag = `scope${Date.now().toString(36).slice(-5)}`
+const created = []
+
+async function createChannel(name) {
+  const r = await api('POST', '/api/workshop/channels', {
+    body: { name, description: 'api-contract-smoke', leadAgent: { name: `${name}-lead`, harness: 'mock', config: { delayMs: 80 } } },
+  })
+  if (r.code !== 0 || !data(r)?.channelId) throw new Error(`channel create failed: ${JSON.stringify(r).slice(0, 300)}`)
+  created.push(data(r).channelId)
+  return data(r)
+}
+
+try {
+  // ── 只读面 ──────────────────────────────────────────────────────────────
+  const health = await api('GET', '/api/health')
+  ok('R1', 'GET /api/health', health.code === 0 && health.data?.status === 'ok', `status=${health.status}`)
+
+  const me = await api('GET', '/api/users/me')
+  ok('R2', 'GET /api/users/me', me.code === 0 && Boolean(data(me)?.id) && Boolean(data(me)?.role), `role=${data(me)?.role}`)
+
+  const noAuth = await api('GET', '/api/users/me', { token: 'deadbeef' })
+  ok('R3', '无效 token /users/me → 401', noAuth.status === 401, `status=${noAuth.status}`)
+
+  const channels = await api('GET', '/api/workshop/channels')
+  ok('R4', 'GET /channels 数组', channels.code === 0 && Array.isArray(data(channels)), `n=${data(channels)?.length}`)
+
+  const workspaces = await api('GET', '/api/workshop/workspaces')
+  ok('R5', 'GET /workspaces 数组', workspaces.code === 0 && Array.isArray(data(workspaces)), `n=${data(workspaces)?.length}`)
+
+  const daq = await api('GET', '/api/workshop/daq')
+  ok('R6', 'GET /daq 节点面', daq.code === 0 && Array.isArray(data(daq)?.nodes), `nodes=${data(daq)?.nodes?.length}`)
+
+  const dcw = await api('GET', '/api/workshop/dcw')
+  ok('R7', 'GET /dcw 产线面', dcw.code === 0 && Array.isArray(data(dcw)?.lines) && Array.isArray(data(dcw)?.nodes), `lines=${data(dcw)?.lines?.length} nodes=${data(dcw)?.nodes?.length}`)
+
+  const hitl = await api('GET', '/api/workshop/hitl/pending')
+  ok('R8', 'GET /hitl/pending 形状', hitl.code === 0 && (Array.isArray(data(hitl)?.items) || Array.isArray(data(hitl))), `type=${Array.isArray(data(hitl)) ? 'array' : 'object'}`)
+
+  const plugins = await api('GET', '/api/workshop/plugins')
+  const pluginList = plugins.plugins ?? data(plugins)?.plugins
+  ok('R9', 'GET /plugins 列表', Array.isArray(pluginList), `n=${pluginList?.length}`)
+
+  const logs = await api('GET', '/api/workshop/ops-logs?limit=5')
+  ok('R10', 'GET /ops-logs 查询', logs.code === 0 && Array.isArray(data(logs)?.logs), `n=${data(logs)?.logs?.length} count=${data(logs)?.count}`)
+
+  // ── Channel 作用域 ─────────────────────────────────────────────────────
+  const a = await createChannel(`api-scope-A-${tag}`)
+  const b = await createChannel(`api-scope-B-${tag}`)
+  const bActivate = await api('POST', `/api/workshop/channels/${b.channelId}/activate`)
+  ok('C1', '创建两个临时频道并激活 B', Boolean(a.channelId && b.channelId && bActivate.code === 0), `A=${a.channelId?.slice(0, 8)} B=${b.channelId?.slice(0, 8)}`)
+
+  const bTask = await api('POST', `/api/workshop/channels/${b.channelId}/tasks`, {
+    body: { title: `scope-task-${tag}`, description: '跨频道作用域负例', mode: 'goal', modeConfig: { goalCriteria: '完成' } },
+  })
+  ok('C2', 'B 频道任务创建', bTask.code === 0 && Boolean(data(bTask)?.id), `task=${data(bTask)?.id?.slice(0, 8)}`)
+
+  const aAgents = await api('GET', `/api/workshop/channels/${a.channelId}/agents`)
+  const aLeadToken = data(aAgents)?.find?.(x => x.id === a.leadAgentId)?.token
+  ok('C3', 'A 频道 lead 实例 token 可读', Boolean(aLeadToken), `token=${aLeadToken ? 'yes' : 'no'}`)
+
+  const crossDetail = await api('GET', `/api/workshop/tasks/${data(bTask)?.id}`, { token: aLeadToken })
+  const deniedDetail = crossDetail.status === 403 || crossDetail.code === 'SCOPE_VIOLATION' || crossDetail.code === 'FORBIDDEN'
+  ok('C4', 'A token 读 B 任务详情 → 403/SCOPE_VIOLATION', deniedDetail, `status=${crossDetail.status} code=${crossDetail.code}`)
+
+  const mgmtList = await api('GET', `/api/workshop/channels/${b.channelId}/tasks`, { token: aLeadToken })
+  const mgmtDenied = [401, 403].includes(mgmtList.status) || mgmtList.code === 'SCOPE_VIOLATION' || mgmtList.code === 'FORBIDDEN'
+  const mgmtLeak = Array.isArray(data(mgmtList)) && data(mgmtList).some(x => x.id === data(bTask)?.id)
+  ok('C5', 'A token 访问 B 频道管理任务面被拒且无泄露', mgmtDenied && !mgmtLeak, `status=${mgmtList.status} code=${mgmtList.code} leaked=${mgmtLeak}`)
+
+  // agent token 真正使用的列表端点:必须 200 且只返回本频道任务
+  const scopedList = await api('GET', '/api/workshop/tasks', { token: aLeadToken })
+  const scopedRows = Array.isArray(data(scopedList)) ? data(scopedList) : (data(scopedList)?.tasks ?? [])
+  const scopedLeak = scopedRows.some(x => x.id === data(bTask)?.id)
+  ok('C6', 'A token 的 /tasks 列表 200 且不含 B 任务', scopedList.code === 0 && Array.isArray(scopedRows) && !scopedLeak, `status=${scopedList.status} code=${scopedList.code} n=${scopedRows.length} leaked=${scopedLeak}`)
+}
+catch (e) {
+  ok('FATAL', '脚本未抛异常', false, e.message)
+}
+finally {
+  for (const id of created) {
+    const r = await api('DELETE', `/api/workshop/channels/${id}`).catch(() => null)
+    console.log(`  cleanup channel ${id.slice(0, 8)} → ${r?.code ?? 'err'}`)
+  }
+  const failed = results.filter(x => !x.pass).length
+  console.log(`\n${failed === 0 ? '★ ALL PASS' : `✗ ${failed} FAILED`} (${results.length - failed} passed)`)
+  process.exit(failed === 0 ? 0 : 1)
+}

package/scripts/ask-hitl-e2e.mjs

@@ -0,0 +1,96 @@
+#!/usr/bin/env node
+/**
+ * ask-hitl-e2e.mjs —— 原生 ask 提问型 HITL 的最短真实链路。
+ *
+ * 与 e2e-hitl-live.mjs 的终端注入路径互补:本脚本直接给 omp lead 一个任务,
+ * 要求它调用原生 ask 工具提问;断言 hitl/pending 出现 question 型待办、
+ * options 含 yes/no、应答后任务完成且交付物含用户答案。
+ *
+ * 用法:AW_E2E_TOKEN=<admin token> node scripts/ask-hitl-e2e.mjs [--base ...]
+ */
+const args = process.argv.slice(2)
+const argOf = (k, d = '') => {
+  const i = args.indexOf(k)
+  return i >= 0 && args[i + 1] && !args[i + 1].startsWith('--') ? args[i + 1] : d
+}
+const BASE = argOf('--base', process.env.AW_BASE ?? 'http://127.0.0.1:3001')
+const TOKEN = process.env.AW_E2E_TOKEN ?? process.env.AW_TOKEN ?? ''
+const TAG = Date.now().toString(36)
+const sleep = ms => new Promise(r => setTimeout(r, ms))
+const checks = []
+const ok = (name, cond, detail = '') => {
+  console.log(`${cond ? 'PASS' : 'FAIL'} | ${name} | ${String(detail).slice(0, 220)}`)
+  checks.push({ name, ok: !!cond, detail: String(detail).slice(0, 500) })
+  return !!cond
+}
+if (!TOKEN) {
+  console.error('缺少 AW_E2E_TOKEN / AW_TOKEN')
+  process.exit(1)
+}
+async function api(method, path, body) {
+  const res = await fetch(BASE + path, {
+    method,
+    headers: { 'content-type': 'application/json', 'authorization': `Bearer ${TOKEN}` },
+    body: body === undefined ? undefined : JSON.stringify(body),
+    signal: AbortSignal.timeout(120_000),
+  })
+  return { status: res.status, ...(await res.json().catch(() => ({}))) }
+}
+async function main() {
+  console.log(`━━━ ask HITL 最短链路 @ ${BASE} (tag=${TAG}) ━━━`)
+  const ch = await api('POST', '/api/workshop/channels', {
+    name: `ask-${TAG}`,
+    description: `ask-hitl-e2e ${TAG}`,
+    leadAgent: { name: 'ask-operator', harness: 'omp' },
+  })
+  const channelId = ch.data?.channelId
+  const leadId = ch.data?.leadAgentId
+  ok('omp lead channel 创建', Boolean(channelId && leadId), channelId ?? ch.message)
+  const task = await api('POST', `/api/workshop/channels/${channelId}/tasks`, {
+    title: `ask-${TAG}`,
+    description: 'Use the ask tool NOW to ask me exactly one question: "Proceed?" with options yes and no. '
+      + 'Do not do anything else. After I answer, call complete_task with summary set to my exact answer.',
+  })
+  const taskId = task.data?.id
+  ok('ask 任务提交', Boolean(taskId), taskId ?? task.message)
+
+  let item = null
+  const end = Date.now() + 180000
+  while (Date.now() < end && !item) {
+    const p = await api('GET', `/api/workshop/hitl/pending?channelId=${channelId}`)
+    item = (p.data?.items ?? []).find((i) => {
+      const opts = JSON.stringify(i.options ?? []).toLowerCase()
+      return opts.includes('yes') && opts.includes('no')
+    }) ?? null
+    if (!item) await sleep(2500)
+  }
+  ok('hitl/pending 出现 ask 提问型待办', Boolean(item), item ? `kind=${item.kind} method=${item.method} options=${JSON.stringify(item.options)}` : '超时')
+  if (!item) {
+    process.exit(1)
+  }
+  ok('待办语义为 question/select', item.method === 'select' && (item.requestType === 'question' || item.kind === 'omp-dialog'), `kind=${item.kind} requestType=${item.requestType} method=${item.method}`)
+
+  const respond = await api('POST', '/api/workshop/hitl/respond', { kind: item.kind, id: item.id, value: 'yes' })
+  ok('应答 ask(选择 yes)', respond.code === 0, respond.message ?? 'ok')
+
+  let done = null
+  const end2 = Date.now() + 120000
+  while (Date.now() < end2) {
+    await sleep(3000)
+    const s = await api('GET', `/api/workshop/tasks/${taskId}`)
+    done = s.data ?? done
+    if (['COMPLETED', 'FAILED', 'CANCELED'].includes(done?.state)) break
+  }
+  const text = (done?.artifacts ?? []).flatMap(a => a.parts ?? []).map(p => String(p.text ?? '')).join('\n')
+  ok('应答后任务完成且交付物含 yes', done?.state === 'COMPLETED' && /\byes\b/i.test(text), `state=${done?.state} deliverable=${text.slice(0, 160)}`)
+
+  const pass = checks.filter(c => c.ok).length
+  console.log(`\n=== ask HITL: ${pass} PASS / ${checks.length - pass} FAIL ===`)
+  const { writeFileSync } = await import('node:fs')
+  writeFileSync('docs/audit/2026-10-20-harness-acceptance-evidence/us005-ask-hitl.json', JSON.stringify({ at: new Date().toISOString(), channelId, taskId, item, checks }, null, 2))
+  process.exit(pass === checks.length ? 0 : 1)
+}
+main().catch((err) => {
+  console.error(err)
+  process.exit(1)
+})

package/scripts/channel-interaction-smoke.mjs

@@ -0,0 +1,80 @@
+#!/usr/bin/env node
+/**
+ * Channel 交互冒烟（2026-10-19）：消息落历史 + 任务生命周期 + 真实 worker 身份。
+ * 运行：AW_BASE=... AW_TOKEN=... CHANNEL_ID=... node scripts/channel-interaction-smoke.mjs
+ */
+const BASE = process.env.AW_BASE ?? 'http://127.0.0.1:3000'
+const TOKEN = process.env.AW_TOKEN
+const CHANNEL_ID = process.env.CHANNEL_ID
+if (!TOKEN || !CHANNEL_ID) throw new Error('AW_TOKEN and CHANNEL_ID required')
+process.env.NO_PROXY = '127.0.0.1,localhost'
+const H = { 'authorization': `Bearer ${TOKEN}`, 'content-type': 'application/json' }
+const sleep = ms => new Promise(r => setTimeout(r, ms))
+const results = []
+const ok = (id, name, cond, detail = '') => {
+  results.push({ id, name, pass: Boolean(cond), detail: String(detail).slice(0, 400) })
+  console.log(`${cond ? '✔' : '✖'} [${id}] ${name}${cond ? '' : ` — ${String(detail).slice(0, 400)}`}`)
+}
+async function api(method, path, body) {
+  const r = await fetch(BASE + path, {
+    method, headers: H, body: body === undefined ? undefined : JSON.stringify(body),
+    signal: AbortSignal.timeout(30_000),
+  })
+  const text = await r.text()
+  try {
+    return { status: r.status, ...JSON.parse(text) }
+  }
+  catch {
+    return { status: r.status, raw: text }
+  }
+}
+const data = r => r?.data ?? null
+const tag = `chsmoke${Date.now().toString(36).slice(-5)}`
+
+try {
+  const ch = await api('GET', `/api/workshop/channels/${CHANNEL_ID}`)
+  const activated = await api('POST', `/api/workshop/channels/${CHANNEL_ID}/activate`)
+  console.log(`  channel activate: code=${activated.code} status=${activated.status}`)
+  ok('H1', '频道详情可读', ch.code === 0 && Boolean(data(ch)?.id), `name=${data(ch)?.name}`)
+
+  const ag = await api('GET', `/api/workshop/channels/${CHANNEL_ID}/agents`)
+  const agents = data(ag) ?? []
+  const opt = agents.find(a => a.role === 'worker' && /工艺优化/.test(a.name))
+  ok('H2', '频道内存在启用的工艺优化 worker', Boolean(opt && opt.enabled), `name=${opt?.name} harness=${opt?.harness}`)
+  ok('H3', 'worker 使用真实 omp + deepseek-flash', opt?.harness === 'omp' && opt?.config?.provider === 'deepseek' && opt?.config?.model === 'deepseek-flash', `harness=${opt?.harness} provider=${opt?.config?.provider} model=${opt?.config?.model}`)
+  ok('H4', '频道 lead 实例 token 可读(任务路由证据)', Boolean(agents.find(a => a.role === 'lead')?.token), 'lead token present')
+
+  const before = await api('GET', `/api/workshop/channels/${CHANNEL_ID}/messages?limit=50`)
+  ok('H5', 'Channel 消息历史可读', before.code === 0 && Array.isArray(data(before)), `msgs=${data(before)?.length}`)
+
+  const lead = agents.find(a => a.role === 'lead')
+  const msg = await api('POST', `/api/workshop/channels/${CHANNEL_ID}/messages`, { toAgentId: lead?.id, text: `channel-interaction-${tag}` })
+  ok('H6', 'POST /channels/:id/messages 发送', msg.code === 0, `code=${msg.code} status=${msg.status}`)
+
+  const after = await api('GET', `/api/workshop/channels/${CHANNEL_ID}/messages?limit=50`)
+  ok('H7', '消息持久化到 Channel 历史', after.code === 0 && (data(after) ?? []).some(m => JSON.stringify(m.parts ?? m).includes(`channel-interaction-${tag}`)), `msgs=${data(after)?.length}`)
+
+  const task = await api('POST', `/api/workshop/channels/${CHANNEL_ID}/tasks`, {
+    title: `channel-task-${tag}`, description: 'Channel 交互验收:确认收到并收口', mode: 'goal', modeConfig: { goalCriteria: '收到并收口' },
+  })
+  const taskId = data(task)?.id
+  ok('H8', 'POST /channels/:id/tasks 提交', task.code === 0 && Boolean(taskId), `id=${taskId?.slice(0, 8)} state=${data(task)?.state}`)
+
+  let state = data(task)?.state
+  for (let i = 0; i < 30 && state !== 'COMPLETED' && state !== 'FAILED'; i++) {
+    await sleep(2000)
+    const list = await api('GET', `/api/workshop/channels/${CHANNEL_ID}/tasks`)
+    const mine = (data(list) ?? []).find(x => x.id === taskId)
+    state = mine?.state ?? state
+  }
+  ok('H9', 'Channel 任务生命周期到终态', state === 'COMPLETED', `state=${state}`)
+
+  const list = await api('GET', `/api/workshop/channels/${CHANNEL_ID}/tasks`)
+  ok('H10', '任务在 Channel 任务列表可追溯', (data(list) ?? []).some(x => x.id === taskId), `tasks=${data(list)?.length}`)
+}
+catch (e) {
+  ok('FATAL', '脚本未抛异常', false, e.message)
+}
+const failed = results.filter(x => !x.pass).length
+console.log(`\n${failed === 0 ? '★ ALL PASS' : `✗ ${failed} FAILED`} (${results.length - failed} passed)`)
+process.exit(failed === 0 ? 0 : 1)