agentworkshop 0.7.70 → 0.7.71

package/server/api/workshop/daq/[id]/ingest.post.ts

@@ -1,166 +1,192 @@
-/**
- * POST /api/workshop/daq/:id/ingest —— 外部 API 推送多源异构数采样本。
- *
- * 适用:第三方/边缘系统每次调用返回一张图片或一个数组(如膜厚模头点位数组),
- * 由调用方主动推入本平台,走与网关采样完全相同的队列/入库/打标/告警链路。
- *
- * body:
- *   { at?: ISO, value?: number, points?: number[], metrics?: {k:number},
- *     state?: 'ok'|'warn'|'alarm'|'offline',
- *     image?: { base64|data: string, mime?: string, width?: number, height?: number } | string }
- *
- * 鉴权:
- *   - 配置了 AW_DAQ_INGEST_TOKEN 时,要求 x-aw-daq-token 头匹配(外部系统接入);
- *   - 未配置时退回仪表盘用户会话(resolveUser)。
- * 约束:
- *   - 节点必须存在且启用;载荷形态必须与模板 signalKind 一致(scalar/vector/image);
- *   - 向量 1..4096 个有限数;图像 ≤10MB 且 MIME image/*;
- *   - at 缺省=当前时间,允许范围为 ±7 天。
- */
-import { createHash } from 'node:crypto'
-import { getHeader, getRouterParam, readBody } from 'h3'
-import { resolveUser } from '@/server/api/workshop/caller'
-import { defineApiHandler } from '@/server/utils/response'
-import { getDaqController } from '@/server/services/workshop/daq/daq-controller'
-import { findDaqTemplate } from '@/server/services/workshop/daq/daq-templates'
-import { getDaqQueue } from '@/server/services/workshop/daq/bus'
-import { getObjectStore } from '@/server/services/workshop/daq/objectstore'
-import { daqObjectKey } from '@/server/services/workshop/daq/objectstore/objectstore-port'
-import type { DaqSampleEnvelope } from '@/server/services/workshop/daq/bus/queue-port'
-import { AppError } from '@/server/utils/errors'
-
-const IMAGE_MAX_BYTES = 10 * 1024 * 1024
-const VECTOR_MAX_POINTS = 4096
-const AT_RANGE_MS = 7 * 24 * 3600_000
-
-interface IngestBody {
-  at?: string
-  value?: number | string
-  points?: unknown
-  values?: unknown
-  metrics?: Record<string, unknown>
-  state?: string
-  image?: { base64?: string, data?: string, mime?: string, width?: number, height?: number } | string
-}
-
-function finiteList(raw: unknown): number[] | null {
-  if (!Array.isArray(raw)) return null
-  const out: number[] = []
-  for (const x of raw) {
-    const n = Number(x)
-    if (!Number.isFinite(n)) return null
-    out.push(n)
-  }
-  return out
-}
-
-function metricsOf(raw: unknown): Record<string, number> {
-  if (raw === null || raw === undefined || typeof raw !== 'object' || Array.isArray(raw)) return {}
-  const out: Record<string, number> = {}
-  for (const [k, v] of Object.entries(raw as Record<string, unknown>).slice(0, 64)) {
-    const n = Number(v)
-    if (Number.isFinite(n) && k.trim()) out[k.trim().slice(0, 80)] = n
-  }
-  return out
-}
-
-export default defineApiHandler(async (event) => {
-  const id = getRouterParam(event, 'id') ?? ''
-  const expected = process.env.AW_DAQ_INGEST_TOKEN
-  if (expected) {
-    if (String(getHeader(event, 'x-aw-daq-token') ?? '') !== expected) {
-      throw new AppError(401, 'UNAUTHORIZED', '数采推送鉴权失败:请提供正确的 x-aw-daq-token(AW_DAQ_INGEST_TOKEN)。')
-    }
-  }
-  else {
-    resolveUser(event)
-  }
-
-  const node = getDaqController().byId(id)
-  if (!node) throw new AppError(404, 'NOT_FOUND', `数采节点不存在: ${id}`)
-  if (!node.enabled) throw new AppError(409, 'CONFLICT', `数采节点「${node.name}」已停用,不接受推送。`)
-  const tpl = findDaqTemplate(node.templateKey)
-  const kind = tpl?.signalKind ?? 'scalar'
-  const body = await readBody<IngestBody>(event) ?? {}
-
-  const now = Date.now()
-  const atRaw = String(body.at ?? '').trim()
-  const atMs = atRaw ? Date.parse(atRaw) : now
-  if (!Number.isFinite(atMs)) throw new AppError(400, 'VALIDATION_ERROR', `at 不是合法时间: ${atRaw}(示例 2026-10-19T12:00:00+08:00)`)
-  if (Math.abs(atMs - now) > AT_RANGE_MS) throw new AppError(400, 'VALIDATION_ERROR', 'at 超出允许范围(±7 天),请检查时区/时钟。')
-  const at = new Date(atMs).toISOString()
-  const state = ['ok', 'warn', 'alarm', 'offline'].includes(String(body.state ?? '')) ? String(body.state) : 'ok'
-  const metrics = metricsOf(body.metrics)
-  let env: DaqSampleEnvelope
-
-  if (kind === 'image') {
-    const img = body.image
-    const base64 = typeof img === 'string'
-      ? img
-      : String(img?.base64 ?? img?.data ?? '').trim()
-    if (!base64) throw new AppError(400, 'VALIDATION_ERROR', '图像节点的载荷必须提供 image.base64(或 image.data)。')
-    const mime = typeof img === 'object' && img?.mime ? String(img.mime) : 'image/png'
-    if (!/^image\//i.test(mime)) throw new AppError(400, 'VALIDATION_ERROR', `image.mime 必须是 image/*(收到 ${mime})`)
-    let buf: Buffer
-    try {
-      buf = Buffer.from(base64.replace(/^data:[^,]+,/, ''), 'base64')
-    }
-    catch {
-      throw new AppError(400, 'VALIDATION_ERROR', 'image.base64 解码失败。')
-    }
-    if (buf.length === 0) throw new AppError(400, 'VALIDATION_ERROR', '图像内容为空。')
-    if (buf.length > IMAGE_MAX_BYTES) throw new AppError(413, 'PAYLOAD_TOO_LARGE', `图像超过 ${IMAGE_MAX_BYTES / 1024 / 1024}MB 上限。`)
-    const objectKey = daqObjectKey(node.id, atMs, mime.includes('jpeg') ? '.jpg' : mime.includes('webp') ? '.webp' : '.png')
-    await getObjectStore().put(objectKey, buf, mime)
-    const sha256 = createHash('sha256').update(buf).digest('hex')
-    const width = Number(body.image && typeof body.image === 'object' ? body.image.width : NaN)
-    const height = Number(body.image && typeof body.image === 'object' ? body.image.height : NaN)
-    env = {
-      nodeId: node.id,
-      templateRef: node.templateRef,
-      value: Number((metrics.avg ?? 0).toFixed(node.decimals)),
-      state,
-      at,
-      frame: {
-        kind: 'image',
-        objectKey,
-        mime,
-        width: Number.isFinite(width) ? width : undefined,
-        height: Number.isFinite(height) ? height : undefined,
-        sha256,
-        size: buf.length,
-        metrics,
-      },
-    }
-  }
-  else if (kind === 'vector') {
-    const points = finiteList(body.points ?? body.values)
-    if (!points || points.length === 0) throw new AppError(400, 'VALIDATION_ERROR', '向量节点的载荷必须提供 points 数组。')
-    if (points.length > VECTOR_MAX_POINTS) throw new AppError(413, 'PAYLOAD_TOO_LARGE', `向量点数 ${points.length} 超过 ${VECTOR_MAX_POINTS} 上限。`)
-    const avg = points.reduce((a, b) => a + b, 0) / points.length
-    env = {
-      nodeId: node.id,
-      templateRef: node.templateRef,
-      value: Number((metrics.avg ?? avg).toFixed(node.decimals)),
-      state,
-      at,
-      frame: { kind: 'vector', points, metrics },
-    }
-  }
-  else {
-    const value = Number(body.value)
-    if (!Number.isFinite(value)) throw new AppError(400, 'VALIDATION_ERROR', '标量节点的载荷必须提供数值 value。')
-    env = { nodeId: node.id, templateRef: node.templateRef, value, state, at }
-  }
-
-  await getDaqQueue().then(q => q.publish(env))
-  return {
-    accepted: true,
-    nodeId: node.id,
-    kind,
-    at,
-    lineId: node.lineId ?? null,
-    ...(env.frame?.kind === 'image' ? { objectKey: env.frame.objectKey, bytes: env.frame.size } : {}),
-    ...(env.frame?.kind === 'vector' ? { points: env.frame.points?.length } : {}),
-  }
-})
+/**
+ * POST /api/workshop/daq/:id/ingest —— 外部 API 推送多源异构数采样本。
+ *
+ * 适用:第三方/边缘系统每次调用返回一张图片或一个数组(如膜厚模头点位数组),
+ * 由调用方主动推入本平台,走与网关采样完全相同的队列/入库/打标/告警链路。
+ *
+ * body:
+ *   { at?: ISO, value?: number, points?: number[], metrics?: {k:number},
+ *     state?: 'ok'|'warn'|'alarm'|'offline',
+ *     image?: { base64|data: string, mime?: string, width?: number, height?: number } | string }
+ *
+ * 鉴权:
+ *   - 配置了 AW_DAQ_INGEST_TOKEN 时,要求 x-aw-daq-token 头匹配(外部系统接入);
+ *   - 未配置时退回仪表盘用户会话(resolveUser),且**必须对该节点所属产线有 operate 权限**(WP2)。
+ * 约束:
+ *   - 节点必须存在且启用;载荷形态必须与模板 signalKind 一致(scalar/vector/image);
+ *   - 向量 1..4096 个有限数;图像 ≤10MB 且 MIME image/*;
+ *   - at 缺省=当前时间,回填窗默认 ±1h(env AW_DAQ_INGEST_BACKFILL_MS 可调,上限 7 天)。
+ */
+import { createHash } from 'node:crypto'
+import { getHeader, getRouterParam, readBody } from 'h3'
+import { resolveUser } from '@/server/api/workshop/caller'
+import { defineApiHandler } from '@/server/utils/response'
+import { getDaqController } from '@/server/services/workshop/daq/daq-controller'
+import { findDaqTemplate } from '@/server/services/workshop/daq/daq-templates'
+import { getDaqQueue } from '@/server/services/workshop/daq/bus'
+import { getObjectStore } from '@/server/services/workshop/daq/objectstore'
+import { daqObjectKey } from '@/server/services/workshop/daq/objectstore/objectstore-port'
+import type { DaqSampleEnvelope } from '@/server/services/workshop/daq/bus/queue-port'
+import { ingestAuthMode, ingestBackfillWindowMs, isWideBackfillWindow, withinBackfillWindow } from '@/server/services/workshop/daq/ingest-policy'
+import { recordOps } from '@/server/services/workshop/ops/ops'
+import { AppError } from '@/server/utils/errors'
+
+const IMAGE_MAX_BYTES = 10 * 1024 * 1024
+const VECTOR_MAX_POINTS = 4096
+/** 超宽回填窗告警只发一次(模块级;启动/首请求可见) */
+let wideWindowWarned = false
+
+interface IngestBody {
+  at?: string
+  value?: number | string
+  points?: unknown
+  values?: unknown
+  metrics?: Record<string, unknown>
+  state?: string
+  image?: { base64?: string, data?: string, mime?: string, width?: number, height?: number } | string
+}
+
+function finiteList(raw: unknown): number[] | null {
+  if (!Array.isArray(raw)) return null
+  const out: number[] = []
+  for (const x of raw) {
+    const n = Number(x)
+    if (!Number.isFinite(n)) return null
+    out.push(n)
+  }
+  return out
+}
+
+function metricsOf(raw: unknown): Record<string, number> {
+  if (raw === null || raw === undefined || typeof raw !== 'object' || Array.isArray(raw)) return {}
+  const out: Record<string, number> = {}
+  for (const [k, v] of Object.entries(raw as Record<string, unknown>).slice(0, 64)) {
+    const n = Number(v)
+    if (Number.isFinite(n) && k.trim()) out[k.trim().slice(0, 80)] = n
+  }
+  return out
+}
+
+export default defineApiHandler(async (event) => {
+  const id = getRouterParam(event, 'id') ?? ''
+  const node = getDaqController().byId(id)
+  if (!node) throw new AppError(404, 'NOT_FOUND', `数采节点不存在: ${id}`)
+
+  // ── 鉴权(WP2)────────────────────────────────────────────────────────────
+  // token 路径:边缘系统全局凭据(AW_DAQ_INGEST_TOKEN),语义不变;
+  // 兜底会话路径:必须对该节点所属产线有 operate 权限 —— 此前仅 resolveUser,
+  // 任意注册用户可向任意节点注入(含回填)伪造样本污染训练链。
+  {
+    const mode = ingestAuthMode({
+      configuredToken: process.env.AW_DAQ_INGEST_TOKEN,
+      providedToken: String(getHeader(event, 'x-aw-daq-token') ?? ''),
+    })
+    if (mode === 'token-mismatch') {
+      throw new AppError(401, 'UNAUTHORIZED', '数采推送鉴权失败:请提供正确的 x-aw-daq-token(AW_DAQ_INGEST_TOKEN)。')
+    }
+    if (mode === 'session') {
+      const user = resolveUser(event)
+      const { requireLineMode } = await import('@/server/services/workshop/permissions')
+      requireLineMode(user, node.lineId, 'operate')
+    }
+    if (isWideBackfillWindow() && !wideWindowWarned) {
+      wideWindowWarned = true
+      console.warn(`[daq.ingest] AW_DAQ_INGEST_BACKFILL_MS=${ingestBackfillWindowMs()} 超过默认 1h 安全窗(回填投毒面扩大)`)
+      recordOps({
+        actor: 'system', actorName: 'daq.ingest', actorKind: 'system',
+        action: 'policy.degrade.warn', kind: 'system', level: 'warn',
+        targetKind: 'system', targetId: 'daq.ingest.backfill',
+        summary: `数采推送回填窗被配置为 ${Math.round(ingestBackfillWindowMs() / 3600_000)}h(默认 1h,上限 7d)`,
+      })
+    }
+  }
+
+  if (!node.enabled) throw new AppError(409, 'CONFLICT', `数采节点「${node.name}」已停用,不接受推送。`)
+  const tpl = findDaqTemplate(node.templateKey)
+  const kind = tpl?.signalKind ?? 'scalar'
+  const body = await readBody<IngestBody>(event) ?? {}
+
+  const now = Date.now()
+  const atRaw = String(body.at ?? '').trim()
+  const atMs = atRaw ? Date.parse(atRaw) : now
+  if (!Number.isFinite(atMs)) throw new AppError(400, 'VALIDATION_ERROR', `at 不是合法时间: ${atRaw}(示例 2026-10-19T12:00:00+08:00)`)
+  const windowMs = ingestBackfillWindowMs()
+  if (!withinBackfillWindow(atMs, now, windowMs)) {
+    throw new AppError(400, 'VALIDATION_ERROR', `at 超出允许范围(±${Math.round(windowMs / 60_000)} 分钟),请检查时区/时钟。`)
+  }
+  const at = new Date(atMs).toISOString()
+  const state = ['ok', 'warn', 'alarm', 'offline'].includes(String(body.state ?? '')) ? String(body.state) : 'ok'
+  const metrics = metricsOf(body.metrics)
+  let env: DaqSampleEnvelope
+
+  if (kind === 'image') {
+    const img = body.image
+    const base64 = typeof img === 'string'
+      ? img
+      : String(img?.base64 ?? img?.data ?? '').trim()
+    if (!base64) throw new AppError(400, 'VALIDATION_ERROR', '图像节点的载荷必须提供 image.base64(或 image.data)。')
+    const mime = typeof img === 'object' && img?.mime ? String(img.mime) : 'image/png'
+    if (!/^image\//i.test(mime)) throw new AppError(400, 'VALIDATION_ERROR', `image.mime 必须是 image/*(收到 ${mime})`)
+    let buf: Buffer
+    try {
+      buf = Buffer.from(base64.replace(/^data:[^,]+,/, ''), 'base64')
+    }
+    catch {
+      throw new AppError(400, 'VALIDATION_ERROR', 'image.base64 解码失败。')
+    }
+    if (buf.length === 0) throw new AppError(400, 'VALIDATION_ERROR', '图像内容为空。')
+    if (buf.length > IMAGE_MAX_BYTES) throw new AppError(413, 'PAYLOAD_TOO_LARGE', `图像超过 ${IMAGE_MAX_BYTES / 1024 / 1024}MB 上限。`)
+    const objectKey = daqObjectKey(node.id, atMs, mime.includes('jpeg') ? '.jpg' : mime.includes('webp') ? '.webp' : '.png')
+    await getObjectStore().put(objectKey, buf, mime)
+    const sha256 = createHash('sha256').update(buf).digest('hex')
+    const width = Number(body.image && typeof body.image === 'object' ? body.image.width : NaN)
+    const height = Number(body.image && typeof body.image === 'object' ? body.image.height : NaN)
+    env = {
+      nodeId: node.id,
+      templateRef: node.templateRef,
+      value: Number((metrics.avg ?? 0).toFixed(node.decimals)),
+      state,
+      at,
+      frame: {
+        kind: 'image',
+        objectKey,
+        mime,
+        width: Number.isFinite(width) ? width : undefined,
+        height: Number.isFinite(height) ? height : undefined,
+        sha256,
+        size: buf.length,
+        metrics,
+      },
+    }
+  }
+  else if (kind === 'vector') {
+    const points = finiteList(body.points ?? body.values)
+    if (!points || points.length === 0) throw new AppError(400, 'VALIDATION_ERROR', '向量节点的载荷必须提供 points 数组。')
+    if (points.length > VECTOR_MAX_POINTS) throw new AppError(413, 'PAYLOAD_TOO_LARGE', `向量点数 ${points.length} 超过 ${VECTOR_MAX_POINTS} 上限。`)
+    const avg = points.reduce((a, b) => a + b, 0) / points.length
+    env = {
+      nodeId: node.id,
+      templateRef: node.templateRef,
+      value: Number((metrics.avg ?? avg).toFixed(node.decimals)),
+      state,
+      at,
+      frame: { kind: 'vector', points, metrics },
+    }
+  }
+  else {
+    const value = Number(body.value)
+    if (!Number.isFinite(value)) throw new AppError(400, 'VALIDATION_ERROR', '标量节点的载荷必须提供数值 value。')
+    env = { nodeId: node.id, templateRef: node.templateRef, value, state, at }
+  }
+
+  await getDaqQueue().then(q => q.publish(env))
+  return {
+    accepted: true,
+    nodeId: node.id,
+    kind,
+    at,
+    lineId: node.lineId ?? null,
+    ...(env.frame?.kind === 'image' ? { objectKey: env.frame.objectKey, bytes: env.frame.size } : {}),
+    ...(env.frame?.kind === 'vector' ? { points: env.frame.points?.length } : {}),
+  }
+})

package/server/api/workshop/optimization/bindings/[id].delete.ts

@@ -0,0 +1,12 @@
+/** DELETE /api/workshop/optimization/bindings/:id —— 撤权(立即生效,执行侧旧调用即拒)。 */
+import { getRouterParam } from 'h3'
+import { defineApiHandler } from '@/server/utils/response'
+import { requireRole } from '@/server/api/workshop/caller'
+import { revokeBindingForUser } from '@/server/services/workshop/optimization/rest-auth'
+
+export default defineApiHandler(async (event) => {
+  const user = requireRole(event, ['admin', 'editor'])
+  const id = getRouterParam(event, 'id') ?? ''
+  revokeBindingForUser(user, id)
+  return { revoked: true }
+})

package/server/api/workshop/optimization/bindings/index.ts

@@ -0,0 +1,47 @@
+/**
+ * GET /api/workshop/optimization/bindings?channelId=&agentInstanceId= —— 绑定列表
+ * POST —— 创建绑定(实例身份校验;模板 id 拒绝)
+ */
+import { getQuery, readBody } from 'h3'
+import { defineApiHandler } from '@/server/utils/response'
+import { requireRole } from '@/server/api/workshop/caller'
+import { getBindingRepo } from '@/server/services/workshop/optimization/binding.repo'
+import { createBinding } from '@/server/services/workshop/optimization/binding.service'
+import { assertAgentAccess } from '@/server/services/workshop/optimization/rest-auth'
+import { recordConfigAction } from '@/server/services/workshop/optimization/access'
+import { AppError } from '@/server/utils/errors'
+
+export default defineApiHandler(async (event) => {
+  const user = requireRole(event, ['admin', 'editor'])
+  const method = event.method?.toUpperCase() ?? 'GET'
+  if (method === 'GET') {
+    const q = getQuery(event)
+    if (typeof q.agentInstanceId === 'string') {
+      assertAgentAccess(user, q.agentInstanceId)
+      return { bindings: getBindingRepo().listByAgent(q.agentInstanceId) }
+    }
+    // 全局列表仅 admin(否则会枚举他人 Channel 的绑定)
+    if (user.role !== 'admin') throw new AppError(403, 'SCOPE_VIOLATION', '全局绑定列表仅管理员可读;请按 agentInstanceId 查询')
+    return { bindings: getBindingRepo().listAll(200) }
+  }
+  const body = await readBody<Record<string, unknown>>(event) ?? {}
+  const agentInstanceId = String(body.agentInstanceId ?? '')
+  if (!agentInstanceId) throw new AppError(422, 'AGENT_REQUIRED', 'agentInstanceId 必填')
+  // 创建/更换绑定 = Channel 管理权(manage),普通成员只可调用不可改绑
+  assertAgentAccess(user, agentInstanceId, { manage: true })
+  const binding = createBinding({
+    workspaceId: String(body.workspaceId ?? ''),
+    channelId: String(body.channelId ?? ''),
+    agentInstanceId,
+    profileId: String(body.profileId ?? ''),
+    profileVersion: Number(body.profileVersion ?? 1),
+    capabilities: Array.isArray(body.capabilities) ? body.capabilities.map(String) : undefined,
+    mode: body.mode === 'shadow' ? 'shadow' : 'recommendation',
+    validTo: typeof body.validTo === 'string' ? body.validTo : null,
+    createdBy: user.id,
+  })
+  recordConfigAction(user, 'optimizer.binding.create', { kind: 'optimizer_binding', id: binding.id },
+    `创建优化器绑定 ${binding.id}(agent=${agentInstanceId},profile=${binding.profileId}@${binding.profileVersion})`,
+    { agentInstanceId, profileId: binding.profileId, mode: binding.mode })
+  return { binding }
+})

package/server/api/workshop/optimization/capabilities.get.ts

@@ -0,0 +1,19 @@
+/**
+ * GET /api/workshop/optimization/capabilities?agentInstanceId= —— 环境/求解器/绑定总览(只读)
+ */
+import { getQuery } from 'h3'
+import { defineApiHandler } from '@/server/utils/response'
+import { requireRole } from '@/server/api/workshop/caller'
+import { toolOptimizerCapabilities } from '@/server/services/workshop/agents/industrial/optimizer-tools'
+import { assertAgentAccess } from '@/server/services/workshop/optimization/rest-auth'
+import { AppError } from '@/server/utils/errors'
+
+export default defineApiHandler(async (event) => {
+  const user = requireRole(event, ['admin', 'editor'])
+  const q = getQuery(event)
+  const agentInstanceId = String(q.agentInstanceId ?? '')
+  if (!agentInstanceId) throw new AppError(422, 'AGENT_REQUIRED', 'agentInstanceId 必填')
+  assertAgentAccess(user, agentInstanceId)
+  const result = await toolOptimizerCapabilities(agentInstanceId)
+  return { capabilities: JSON.parse(result.text) as unknown }
+})

package/server/api/workshop/optimization/profiles/[id]/publish.post.ts

@@ -0,0 +1,41 @@
+/**
+ * POST /api/workshop/optimization/profiles/:id/publish?version= —— 发布并冻结 problemIrHash。
+ * 归属:仅 owner 或 admin(D16 配置管理权;B 发布 A 的 draft → 403 + 拒绝审计)。
+ */
+import { getQuery, getRouterParam } from 'h3'
+import { defineApiHandler } from '@/server/utils/response'
+import { requireRole } from '@/server/api/workshop/caller'
+import { getProfileRepo, parseProfileRow } from '@/server/services/workshop/optimization/profile.repo'
+import { assertOptimizationAccess, recordConfigAction } from '@/server/services/workshop/optimization/access'
+import { getAmlRuntime } from '@/server/services/workshop/aml/runtime'
+import { AppError } from '@/server/utils/errors'
+
+export default defineApiHandler(async (event) => {
+  const user = requireRole(event, ['admin', 'editor'])
+  const id = getRouterParam(event, 'id') ?? ''
+  const q = getQuery(event)
+  const row = getProfileRepo().get(id, typeof q.version === 'string' ? Number(q.version) : undefined)
+  if (!row) throw createError({ statusCode: 404, statusMessage: `Profile ${id} 不存在` })
+  assertOptimizationAccess(user, 'publish', { kind: 'profile', id, version: row.version })
+  // D18 谱系门:legacy 数据集训练的模型不能发布进优化 Profile(solve 同门)
+  const parsed = parseProfileRow(row)
+  const legacy = checkModelLineage(parsed.modelRef.modelId)
+  if (legacy) throw new AppError(422, 'LEGACY_MODEL_REQUIRES_RETRAIN', legacy)
+  const published = getProfileRepo().publish(id, row.version, typeof q.problemIrHash === 'string' ? q.problemIrHash : undefined)
+  recordConfigAction(user, 'optimizer.profile.publish', { kind: 'optimizer_profile', id: `${id}@${published.version}` },
+    `发布 Optimizer Profile ${id}@${published.version}(irHash=${published.problemIrHash.slice(0, 12)})`,
+    { problemIrHash: published.problemIrHash })
+  return { profile: published }
+})
+
+function checkModelLineage(modelId: string): string | null {
+  if (!modelId) return null
+  const db = getAmlRuntime().db
+  const model = db.prepare('SELECT dataset_id AS datasetId FROM aml_models WHERE id = ?').get(modelId) as { datasetId?: string | null } | undefined
+  if (!model?.datasetId) return null
+  const ds = db.prepare('SELECT lineage_verified AS v FROM aml_datasets WHERE id = ?').get(model.datasetId) as { v: number } | undefined
+  if (ds && ds.v !== 1) {
+    return `模型 ${modelId} 的训练数据集 ${model.datasetId} 谱系未核验(lineage_verified=0);请基于已确认工况段重建数据集并重训后再发布`
+  }
+  return null
+}

package/server/api/workshop/optimization/profiles/index.ts

@@ -0,0 +1,41 @@
+/**
+ * GET /api/workshop/optimization/profiles —— Profile 列表(用户私有:owner+admin 可见,D16)
+ * POST —— 登记 draft(校验模型/求解器兼容;published 不可变)
+ */
+import { getQuery, readBody } from 'h3'
+import { defineApiHandler } from '@/server/utils/response'
+import { requireRole } from '@/server/api/workshop/caller'
+import { getAmlRuntime } from '@/server/services/workshop/aml/runtime'
+import { getProfileRepo, parseProfileRow } from '@/server/services/workshop/optimization/profile.repo'
+import { assertProfileSolverCompatible, type OptimizationProfile } from '@/server/services/workshop/optimization/contracts'
+import { canSeeProfile, recordConfigAction } from '@/server/services/workshop/optimization/access'
+import { AppError } from '@/server/utils/errors'
+
+export default defineApiHandler(async (event) => {
+  const user = requireRole(event, ['admin', 'editor'])
+  const method = event.method?.toUpperCase() ?? 'GET'
+  if (method === 'GET') {
+    const q = getQuery(event)
+    // 列表静默过滤(不枚举他人 Profile;跨用户访问走 assertOptimizationAccess 显式拒绝+审计)
+    const rows = getProfileRepo().list({ status: typeof q.status === 'string' ? q.status : undefined, limit: 200 })
+      .filter(r => canSeeProfile(user, r))
+    return { profiles: rows.map(r => ({ ...r, profile: parseProfileRow(r) })) }
+  }
+  const body = await readBody<Record<string, unknown>>(event) ?? {}
+  const profile = body as unknown as OptimizationProfile
+  if (!profile?.id || !profile.modelRef?.modelId || !profile.solverRef || !profile.problemTemplateRef) {
+    throw new AppError(422, 'PROFILE_INVALID', 'id / modelRef / solverRef / problemTemplateRef 必填')
+  }
+  const model = getAmlRuntime().repo.model.get(profile.modelRef.modelId)
+  if (!model) throw new AppError(404, 'MODEL_NOT_FOUND', `模型 ${profile.modelRef.modelId} 不存在`)
+  // 模型工件类型/接口以注册表为准(客户端不能自填)
+  profile.modelRef.artifactKind = (model.artifactKind || 'onnx_one_step@1') as OptimizationProfile['modelRef']['artifactKind']
+  profile.modelRef.modelInterface = (model.modelInterface || 'one_step') as OptimizationProfile['modelRef']['modelInterface']
+  profile.modelRef.artifactHash = model.artifactHash || profile.modelRef.artifactHash || ''
+  profile.modelRef.stage = model.stage
+  assertProfileSolverCompatible(profile)
+  const row = getProfileRepo().insert({ ...profile, status: 'draft' }, user.id)
+  recordConfigAction(user, 'optimizer.profile.create', { kind: 'optimizer_profile', id: `${profile.id}@${profile.version}` },
+    `登记 Optimizer Profile ${profile.id}@${profile.version}(solver=${profile.solverRef})`, { solverRef: profile.solverRef, modelId: profile.modelRef.modelId })
+  return { profile: row }
+})

package/server/api/workshop/optimization/recommendations/[id]/crosscheck.post.ts

@@ -0,0 +1,29 @@
+/**
+ * POST /api/workshop/optimization/recommendations/:id/crosscheck —— 候选互校(SW4)。
+ * 归属:建议所属运行的 binding agent 可见性(D16);先决失败给可定位错误码。
+ */
+import { getRouterParam, readBody } from 'h3'
+import { defineApiHandler } from '@/server/utils/response'
+import { requireRole } from '@/server/api/workshop/caller'
+import { assertOptimizationAccess, recordConfigAction } from '@/server/services/workshop/optimization/access'
+import { getRunRepo } from '@/server/services/workshop/optimization/run.repo'
+import { runCrosscheck, getCrosscheckRepo, deriveDualState } from '@/server/services/workshop/optimization/crosscheck.service'
+
+export default defineApiHandler(async (event) => {
+  const user = requireRole(event, ['admin', 'editor'])
+  const id = getRouterParam(event, 'id') ?? ''
+  const rec = getRunRepo().getRecommendation(id)
+  if (!rec) throw createError({ statusCode: 404, statusMessage: `建议 ${id} 不存在` })
+  assertOptimizationAccess(user, 'crosscheck', { kind: 'recommendation', runId: rec.runId })
+  const body = await readBody<Record<string, unknown>>(event).catch(() => ({}) as Record<string, unknown>) ?? {}
+  const row = await runCrosscheck(id)
+  recordConfigAction(user, 'optimizer.crosscheck.run', { kind: 'optimizer_crosscheck', id: row.id },
+    `候选互校 ${id}:${row.verdict}(maxDev=${row.maxDevDimensionless === null ? 'n/a' : row.maxDevDimensionless.toExponential(3)})`,
+    { recommendationId: id, runId: rec.runId, verdict: row.verdict, rowHash: row.rowHash.slice(0, 16) })
+  const dual = deriveDualState(id)
+  return {
+    crosscheck: row,
+    dual,
+    history: getCrosscheckRepo().listForRecommendation(id, Number(body.limit ?? 10)),
+  }
+})

package/server/api/workshop/optimization/recommendations/[id]/dispatch.post.ts

@@ -0,0 +1,33 @@
+/**
+ * POST /api/workshop/optimization/recommendations/:id/dispatch —— 申请下发优化器建议(SW5)。
+ * D11 防伪:body 只接受 { note? };任何证据字段 → 422。卡由服务端落库回查构造,建卡即返回。
+ */
+import { getRouterParam, readBody } from 'h3'
+import { defineApiHandler } from '@/server/utils/response'
+import { requireRole } from '@/server/api/workshop/caller'
+import { createDispatchCard } from '@/server/services/workshop/optimization/dispatch.service'
+import { AppError } from '@/server/utils/errors'
+
+const FORBIDDEN_EVIDENCE_KEYS = ['coverage', 'coverageTest', 'qhat', 'qhatPerCv', 'inputDistance', 'crosscheck', 'rowHash', 'row_hash', 'devPerCv', 'maxDev', 'verdict', 'uq', 'predicted', 'replayed', 'artifactHash']
+
+export default defineApiHandler(async (event) => {
+  const user = requireRole(event, ['admin', 'editor'])
+  const id = getRouterParam(event, 'id') ?? ''
+  const body = await readBody<Record<string, unknown>>(event).catch(() => ({}) as Record<string, unknown>) ?? {}
+  // D11:任何证据字段 → 422(payload 全部服务端落库回查)
+  const smuggled = Object.keys(body).filter(k => FORBIDDEN_EVIDENCE_KEYS.includes(k))
+  if (smuggled.length > 0) {
+    throw new AppError(422, 'DISPATCH_BODY_EVIDENCE_FORBIDDEN',
+      `body 不得携带证据字段(${smuggled.join(',')});payload 全部由服务端按 recommendation_id 落库回查构造`)
+  }
+  const note = typeof body.note === 'string' ? body.note.slice(0, 500) : ''
+  const card = await createDispatchCard(user, id, note)
+  return {
+    dispatch: {
+      cardId: card.cardId,
+      agentInstanceId: card.agentInstanceId,
+      recipeId: card.recipeId,
+      rowHashHint: '见审批卡 payload(服务端构造;卡面展示截断值供人回查)',
+    },
+  }
+})