agentworkshop 0.7.70 → 0.8.0

package/server/api/workshop/ontology/drafts/[draftId].ts

@@ -0,0 +1,52 @@
+/**
+ * GET    /api/workshop/ontology/drafts/:draftId — 草稿详情(含校验与绑定报告)
+ * PATCH  /api/workshop/ontology/drafts/:draftId — 保存整份文档(乐观锁 rev)
+ * DELETE /api/workshop/ontology/drafts/:draftId — 删除草稿
+ */
+import { getRouterParam, readBody } from 'h3'
+import { defineApiHandler } from '@/server/utils/response'
+import { requireRole, resolveUser } from '@/server/api/workshop/caller'
+import { AppError } from '@/server/utils/errors'
+import {
+  actorFromUser, deleteDraft, getDraftDetail, updateDraft,
+} from '@/server/services/workshop/ontology/ontology.service'
+import { recordConfigAction } from '@/server/services/workshop/optimization/access'
+
+export default defineApiHandler(async (event) => {
+  const draftId = getRouterParam(event, 'draftId') ?? ''
+  if (!draftId) throw new AppError(422, 'DRAFT_ID_REQUIRED', 'draftId 缺失')
+  const method = event.method?.toUpperCase() ?? 'GET'
+
+  if (method === 'GET') {
+    const detail = getDraftDetail(draftId, actorFromUser(resolveUser(event)))
+    return {
+      draft: { id: detail.draft.id, ontologyId: detail.draft.ontologyId, baseVersion: detail.draft.baseVersion, rev: detail.draft.rev, ownerUserId: detail.draft.ownerUserId },
+      doc: detail.doc,
+      validation: detail.validation,
+      bindings: detail.bindings,
+    }
+  }
+
+  const user = requireRole(event, ['admin', 'editor'])
+  if (method === 'DELETE') {
+    deleteDraft(draftId, actorFromUser(user))
+    recordConfigAction(user, 'ontology.draft.delete', { kind: 'ontology_draft', id: draftId }, `删除本体草稿 ${draftId}`)
+    return { deleted: true }
+  }
+
+  const body = await readBody<Record<string, unknown>>(event) ?? {}
+  const expectedRev = Number(body.expectedRev)
+  if (!Number.isInteger(expectedRev)) throw new AppError(422, 'DRAFT_REV_REQUIRED', 'expectedRev 必填(乐观锁;取 GET 返回的 draft.rev)')
+  const detail = updateDraft(draftId, actorFromUser(user), {
+    doc: body.doc,
+    expectedRev,
+    strictBindings: body.strictBindings !== false,
+  })
+  recordConfigAction(user, 'ontology.draft.update', { kind: 'ontology_draft', id: draftId },
+    `保存本体草稿 ${draftId}(rev=${detail.draft.rev})`, { rev: detail.draft.rev, ontologyId: detail.draft.ontologyId })
+  return {
+    draft: { id: detail.draft.id, rev: detail.draft.rev, ontologyId: detail.draft.ontologyId },
+    validation: detail.validation,
+    bindings: detail.bindings,
+  }
+})

package/server/api/workshop/ontology/drafts/index.ts

@@ -0,0 +1,20 @@
+/**
+ * GET /api/workshop/ontology/drafts?ontologyId= — 我的(admin=全部)草稿列表
+ */
+import { getQuery } from 'h3'
+import { defineApiHandler } from '@/server/utils/response'
+import { resolveUser } from '@/server/api/workshop/caller'
+import { actorFromUser, listDrafts } from '@/server/services/workshop/ontology/ontology.service'
+
+export default defineApiHandler(async (event) => {
+  const user = resolveUser(event)
+  const query = getQuery(event)
+  const ontologyId = typeof query.ontologyId === 'string' && query.ontologyId ? query.ontologyId : undefined
+  const drafts = listDrafts(actorFromUser(user), ontologyId ? { ontologyId } : {})
+  return {
+    drafts: drafts.map(d => ({
+      id: d.id, ontologyId: d.ontologyId, baseVersion: d.baseVersion, rev: d.rev,
+      ownerUserId: d.ownerUserId, createdAt: d.createdAt, updatedAt: d.updatedAt,
+    })),
+  }
+})

package/server/api/workshop/ontology/export/[ontologyId].ts

@@ -0,0 +1,50 @@
+/**
+ * GET /api/workshop/ontology/export/:ontologyId?version= — 导出发布快照(JSON bundle)
+ *
+ * 只读导出:供外部评审/互操作与 P1 RDF 导出的输入。
+ */
+import { getQuery, getRouterParam, setResponseHeader } from 'h3'
+import { defineApiHandler } from '@/server/utils/response'
+import { resolveUser } from '@/server/api/workshop/caller'
+import { AppError } from '@/server/utils/errors'
+import { getOntologyRepo } from '@/server/services/workshop/ontology/repo'
+import { getVersion } from '@/server/services/workshop/ontology/ontology.service'
+
+function parseCompiled(raw: string): unknown {
+  try {
+    return JSON.parse(raw || '{}') as unknown
+  }
+  catch {
+    return null
+  }
+}
+
+export default defineApiHandler(async (event) => {
+  resolveUser(event)
+  const ontologyId = getRouterParam(event, 'ontologyId') ?? ''
+  if (!ontologyId) throw new AppError(422, 'ONTOLOGY_ID_REQUIRED', 'ontologyId 缺失')
+  const query = getQuery(event)
+  const requested = query.version !== undefined ? Number(query.version) : undefined
+  const repo = getOntologyRepo()
+  const latest = Number.isInteger(requested) ? requested! : (repo.latestVersion(ontologyId, 'published')?.version ?? 0)
+  if (!latest) throw new AppError(404, 'VERSION_NOT_FOUND', `本体 ${ontologyId} 还没有已发布版本`)
+  const version = getVersion(ontologyId, latest)
+  const bundle = {
+    schemaVersion: 1,
+    ontologyId,
+    version: version.version,
+    status: version.status,
+    lineId: version.lineId,
+    contentHash: version.contentHash,
+    parentVersion: version.parentVersion,
+    createdAt: version.createdAt,
+    entities: repo.listEntities(version.id, version.version),
+    relations: repo.listRelations(version.id, version.version),
+    rules: repo.listRules(version.id, version.version),
+    bindings: repo.listBindings(version.id, version.version),
+    traces: repo.listTraces(version.id, version.version),
+    compiled: parseCompiled(version.compiledJson),
+  }
+  setResponseHeader(event, 'content-disposition', `attachment; filename="${ontologyId}-v${version.version}.json"`)
+  return bundle
+})

package/server/api/workshop/ontology/index.ts

@@ -0,0 +1,38 @@
+/**
+ * GET  /api/workshop/ontology — 本体清单(按产线过滤)+ 我的草稿概览
+ * POST /api/workshop/ontology — 创建草稿(单活跃 409)
+ */
+import { getQuery, readBody } from 'h3'
+import { defineApiHandler } from '@/server/utils/response'
+import { requireRole, resolveUser } from '@/server/api/workshop/caller'
+import { AppError } from '@/server/utils/errors'
+import { actorFromUser, createDraft, listDrafts, listOntologies } from '@/server/services/workshop/ontology/ontology.service'
+import { recordConfigAction } from '@/server/services/workshop/optimization/access'
+
+export default defineApiHandler(async (event) => {
+  const method = event.method?.toUpperCase() ?? 'GET'
+  if (method === 'GET') {
+    const user = resolveUser(event)
+    const query = getQuery(event)
+    const lineId = typeof query.lineId === 'string' && query.lineId ? query.lineId : undefined
+    const ontologies = listOntologies(lineId)
+    const drafts = listDrafts(actorFromUser(user), typeof query.ontologyId === 'string' ? { ontologyId: query.ontologyId } : {})
+    return {
+      ontologies,
+      drafts: drafts.map(d => ({ id: d.id, ontologyId: d.ontologyId, baseVersion: d.baseVersion, rev: d.rev, ownerUserId: d.ownerUserId, updatedAt: d.updatedAt })),
+    }
+  }
+  const user = requireRole(event, ['admin', 'editor'])
+  const body = await readBody<Record<string, unknown>>(event) ?? {}
+  const ontologyId = String(body.ontologyId ?? '').trim()
+  if (!ontologyId) throw new AppError(422, 'ONTOLOGY_ID_REQUIRED', 'ontologyId 必填(形如 ont-pva-line01)')
+  const draft = createDraft(actorFromUser(user), {
+    ontologyId,
+    lineId: typeof body.lineId === 'string' ? body.lineId : '',
+    name: typeof body.name === 'string' ? body.name : undefined,
+    cloneFromVersion: body.cloneFromVersion === true,
+  })
+  recordConfigAction(user, 'ontology.draft.create', { kind: 'ontology_draft', id: draft.id },
+    `创建本体草稿 ${draft.id}(${draft.ontologyId})`, { ontologyId: draft.ontologyId })
+  return { draft: { id: draft.id, ontologyId: draft.ontologyId, rev: draft.rev, baseVersion: draft.baseVersion } }
+})

package/server/api/workshop/ontology/scene.ts

@@ -0,0 +1,21 @@
+/**
+ * GET /api/workshop/ontology/scene?lineId= — 运行时语义子图(绑定面实体 + 关系 + 规则决策 + 守卫)
+ * GET /api/workshop/ontology/scene?lineId=&guards=1&values=... — 附运行时守卫求值
+ *
+ * 这是 Agent 上下文与 MCP 只读工具的共同数据面;只读、只回已发布版本。
+ */
+import { getQuery } from 'h3'
+import { defineApiHandler } from '@/server/utils/response'
+import { resolveUser } from '@/server/api/workshop/caller'
+import { AppError } from '@/server/utils/errors'
+import { sceneSubgraph } from '@/server/services/workshop/ontology/ontology.service'
+
+export default defineApiHandler(async (event) => {
+  resolveUser(event)
+  const query = getQuery(event)
+  const lineId = typeof query.lineId === 'string' ? query.lineId : ''
+  if (!lineId) throw new AppError(422, 'LINE_REQUIRED', 'lineId 必填')
+  const graph = sceneSubgraph(lineId, { limit: query.limit !== undefined ? Math.min(500, Math.max(1, Number(query.limit))) : 200 })
+  if (!graph) return { lineId, active: false, graph: null }
+  return { lineId, active: true, graph }
+})

package/server/api/workshop/ontology/traces/[ontologyId].ts

@@ -0,0 +1,19 @@
+/**
+ * GET /api/workshop/ontology/traces/:ontologyId?version=&ruleId= — 规则溯源(Rule Trace)
+ */
+import { getQuery, getRouterParam } from 'h3'
+import { defineApiHandler } from '@/server/utils/response'
+import { resolveUser } from '@/server/api/workshop/caller'
+import { AppError } from '@/server/utils/errors'
+import { getOntologyRepo } from '@/server/services/workshop/ontology/repo'
+
+export default defineApiHandler(async (event) => {
+  resolveUser(event)
+  const ontologyId = getRouterParam(event, 'ontologyId') ?? ''
+  if (!ontologyId) throw new AppError(422, 'ONTOLOGY_ID_REQUIRED', 'ontologyId 缺失')
+  const query = getQuery(event)
+  const version = query.version !== undefined ? Number(query.version) : undefined
+  const ruleId = typeof query.ruleId === 'string' && query.ruleId ? query.ruleId : undefined
+  const traces = getOntologyRepo().listTraces(ontologyId, Number.isInteger(version) ? version : undefined)
+  return { ontologyId, traces: ruleId ? traces.filter(t => t.ruleId === ruleId) : traces }
+})

package/server/api/workshop/ontology/versions/[ontologyId]/compare.ts

@@ -0,0 +1,21 @@
+/**
+ * GET /api/workshop/ontology/versions/:ontologyId/compare?from=&to= — 版本差异(实体/关系/规则/绑定四段)
+ */
+import { getQuery, getRouterParam } from 'h3'
+import { defineApiHandler } from '@/server/utils/response'
+import { resolveUser } from '@/server/api/workshop/caller'
+import { AppError } from '@/server/utils/errors'
+import { compareVersions } from '@/server/services/workshop/ontology/ontology.service'
+
+export default defineApiHandler(async (event) => {
+  resolveUser(event)
+  const ontologyId = getRouterParam(event, 'ontologyId') ?? ''
+  if (!ontologyId) throw new AppError(422, 'ONTOLOGY_ID_REQUIRED', 'ontologyId 缺失')
+  const query = getQuery(event)
+  const from = Number(query.from)
+  const to = Number(query.to)
+  if (!Number.isInteger(from) || !Number.isInteger(to)) {
+    throw new AppError(422, 'VERSION_REQUIRED', 'from/to 必须是整数版本号')
+  }
+  return compareVersions(ontologyId, from, to)
+})

package/server/api/workshop/ontology/versions/[ontologyId].ts

@@ -0,0 +1,42 @@
+/**
+ * GET  /api/workshop/ontology/versions/:ontologyId — 版本史
+ * POST /api/workshop/ontology/versions/:ontologyId — 退役某版本(body {version})
+ */
+import { getRouterParam, readBody } from 'h3'
+import { defineApiHandler } from '@/server/utils/response'
+import { requireAdmin, resolveUser } from '@/server/api/workshop/caller'
+import { AppError } from '@/server/utils/errors'
+import { actorFromUser, listVersions, retireVersion } from '@/server/services/workshop/ontology/ontology.service'
+
+function parseCompiled(raw: string): { counts?: unknown, packHash?: string } {
+  try {
+    return JSON.parse(raw || '{}') as { counts?: unknown, packHash?: string }
+  }
+  catch {
+    return {}
+  }
+}
+
+export default defineApiHandler(async (event) => {
+  const ontologyId = getRouterParam(event, 'ontologyId') ?? ''
+  if (!ontologyId) throw new AppError(422, 'ONTOLOGY_ID_REQUIRED', 'ontologyId 缺失')
+  const method = event.method?.toUpperCase() ?? 'GET'
+  if (method === 'GET') {
+    resolveUser(event)
+    return {
+      ontologyId,
+      versions: listVersions(ontologyId).map(v => ({
+        version: v.version, status: v.status, name: v.name, lineId: v.lineId,
+        parentVersion: v.parentVersion, contentHash: v.contentHash,
+        publishedBy: v.publishedBy, createdAt: v.createdAt,
+        compiled: parseCompiled(v.compiledJson),
+      })),
+    }
+  }
+  const user = requireAdmin(event)
+  const body = await readBody<Record<string, unknown>>(event) ?? {}
+  const version = Number(body.version)
+  if (!Number.isInteger(version)) throw new AppError(422, 'VERSION_REQUIRED', 'version 必填(整数)')
+  retireVersion(ontologyId, version, actorFromUser(user))
+  return { ontologyId, version, status: 'retired' }
+})

package/server/api/workshop/optimization/bindings/[id].delete.ts

@@ -0,0 +1,12 @@
+/** DELETE /api/workshop/optimization/bindings/:id —— 撤权(立即生效,执行侧旧调用即拒)。 */
+import { getRouterParam } from 'h3'
+import { defineApiHandler } from '@/server/utils/response'
+import { requireRole } from '@/server/api/workshop/caller'
+import { revokeBindingForUser } from '@/server/services/workshop/optimization/rest-auth'
+
+export default defineApiHandler(async (event) => {
+  const user = requireRole(event, ['admin', 'editor'])
+  const id = getRouterParam(event, 'id') ?? ''
+  revokeBindingForUser(user, id)
+  return { revoked: true }
+})

package/server/api/workshop/optimization/bindings/index.ts

@@ -0,0 +1,47 @@
+/**
+ * GET /api/workshop/optimization/bindings?channelId=&agentInstanceId= —— 绑定列表
+ * POST —— 创建绑定(实例身份校验;模板 id 拒绝)
+ */
+import { getQuery, readBody } from 'h3'
+import { defineApiHandler } from '@/server/utils/response'
+import { requireRole } from '@/server/api/workshop/caller'
+import { getBindingRepo } from '@/server/services/workshop/optimization/binding.repo'
+import { createBinding } from '@/server/services/workshop/optimization/binding.service'
+import { assertAgentAccess } from '@/server/services/workshop/optimization/rest-auth'
+import { recordConfigAction } from '@/server/services/workshop/optimization/access'
+import { AppError } from '@/server/utils/errors'
+
+export default defineApiHandler(async (event) => {
+  const user = requireRole(event, ['admin', 'editor'])
+  const method = event.method?.toUpperCase() ?? 'GET'
+  if (method === 'GET') {
+    const q = getQuery(event)
+    if (typeof q.agentInstanceId === 'string') {
+      assertAgentAccess(user, q.agentInstanceId)
+      return { bindings: getBindingRepo().listByAgent(q.agentInstanceId) }
+    }
+    // 全局列表仅 admin(否则会枚举他人 Channel 的绑定)
+    if (user.role !== 'admin') throw new AppError(403, 'SCOPE_VIOLATION', '全局绑定列表仅管理员可读;请按 agentInstanceId 查询')
+    return { bindings: getBindingRepo().listAll(200) }
+  }
+  const body = await readBody<Record<string, unknown>>(event) ?? {}
+  const agentInstanceId = String(body.agentInstanceId ?? '')
+  if (!agentInstanceId) throw new AppError(422, 'AGENT_REQUIRED', 'agentInstanceId 必填')
+  // 创建/更换绑定 = Channel 管理权(manage),普通成员只可调用不可改绑
+  assertAgentAccess(user, agentInstanceId, { manage: true })
+  const binding = createBinding({
+    workspaceId: String(body.workspaceId ?? ''),
+    channelId: String(body.channelId ?? ''),
+    agentInstanceId,
+    profileId: String(body.profileId ?? ''),
+    profileVersion: Number(body.profileVersion ?? 1),
+    capabilities: Array.isArray(body.capabilities) ? body.capabilities.map(String) : undefined,
+    mode: body.mode === 'shadow' ? 'shadow' : 'recommendation',
+    validTo: typeof body.validTo === 'string' ? body.validTo : null,
+    createdBy: user.id,
+  })
+  recordConfigAction(user, 'optimizer.binding.create', { kind: 'optimizer_binding', id: binding.id },
+    `创建优化器绑定 ${binding.id}(agent=${agentInstanceId},profile=${binding.profileId}@${binding.profileVersion})`,
+    { agentInstanceId, profileId: binding.profileId, mode: binding.mode })
+  return { binding }
+})

package/server/api/workshop/optimization/capabilities.get.ts

@@ -0,0 +1,19 @@
+/**
+ * GET /api/workshop/optimization/capabilities?agentInstanceId= —— 环境/求解器/绑定总览(只读)
+ */
+import { getQuery } from 'h3'
+import { defineApiHandler } from '@/server/utils/response'
+import { requireRole } from '@/server/api/workshop/caller'
+import { toolOptimizerCapabilities } from '@/server/services/workshop/agents/industrial/optimizer-tools'
+import { assertAgentAccess } from '@/server/services/workshop/optimization/rest-auth'
+import { AppError } from '@/server/utils/errors'
+
+export default defineApiHandler(async (event) => {
+  const user = requireRole(event, ['admin', 'editor'])
+  const q = getQuery(event)
+  const agentInstanceId = String(q.agentInstanceId ?? '')
+  if (!agentInstanceId) throw new AppError(422, 'AGENT_REQUIRED', 'agentInstanceId 必填')
+  assertAgentAccess(user, agentInstanceId)
+  const result = await toolOptimizerCapabilities(agentInstanceId)
+  return { capabilities: JSON.parse(result.text) as unknown }
+})

package/server/api/workshop/optimization/profiles/[id]/publish.post.ts

@@ -0,0 +1,41 @@
+/**
+ * POST /api/workshop/optimization/profiles/:id/publish?version= —— 发布并冻结 problemIrHash。
+ * 归属:仅 owner 或 admin(D16 配置管理权;B 发布 A 的 draft → 403 + 拒绝审计)。
+ */
+import { getQuery, getRouterParam } from 'h3'
+import { defineApiHandler } from '@/server/utils/response'
+import { requireRole } from '@/server/api/workshop/caller'
+import { getProfileRepo, parseProfileRow } from '@/server/services/workshop/optimization/profile.repo'
+import { assertOptimizationAccess, recordConfigAction } from '@/server/services/workshop/optimization/access'
+import { getAmlRuntime } from '@/server/services/workshop/aml/runtime'
+import { AppError } from '@/server/utils/errors'
+
+export default defineApiHandler(async (event) => {
+  const user = requireRole(event, ['admin', 'editor'])
+  const id = getRouterParam(event, 'id') ?? ''
+  const q = getQuery(event)
+  const row = getProfileRepo().get(id, typeof q.version === 'string' ? Number(q.version) : undefined)
+  if (!row) throw createError({ statusCode: 404, statusMessage: `Profile ${id} 不存在` })
+  assertOptimizationAccess(user, 'publish', { kind: 'profile', id, version: row.version })
+  // D18 谱系门:legacy 数据集训练的模型不能发布进优化 Profile(solve 同门)
+  const parsed = parseProfileRow(row)
+  const legacy = checkModelLineage(parsed.modelRef.modelId)
+  if (legacy) throw new AppError(422, 'LEGACY_MODEL_REQUIRES_RETRAIN', legacy)
+  const published = getProfileRepo().publish(id, row.version, typeof q.problemIrHash === 'string' ? q.problemIrHash : undefined)
+  recordConfigAction(user, 'optimizer.profile.publish', { kind: 'optimizer_profile', id: `${id}@${published.version}` },
+    `发布 Optimizer Profile ${id}@${published.version}(irHash=${published.problemIrHash.slice(0, 12)})`,
+    { problemIrHash: published.problemIrHash })
+  return { profile: published }
+})
+
+function checkModelLineage(modelId: string): string | null {
+  if (!modelId) return null
+  const db = getAmlRuntime().db
+  const model = db.prepare('SELECT dataset_id AS datasetId FROM aml_models WHERE id = ?').get(modelId) as { datasetId?: string | null } | undefined
+  if (!model?.datasetId) return null
+  const ds = db.prepare('SELECT lineage_verified AS v FROM aml_datasets WHERE id = ?').get(model.datasetId) as { v: number } | undefined
+  if (ds && ds.v !== 1) {
+    return `模型 ${modelId} 的训练数据集 ${model.datasetId} 谱系未核验(lineage_verified=0);请基于已确认工况段重建数据集并重训后再发布`
+  }
+  return null
+}

package/server/api/workshop/optimization/profiles/index.ts

@@ -0,0 +1,41 @@
+/**
+ * GET /api/workshop/optimization/profiles —— Profile 列表(用户私有:owner+admin 可见,D16)
+ * POST —— 登记 draft(校验模型/求解器兼容;published 不可变)
+ */
+import { getQuery, readBody } from 'h3'
+import { defineApiHandler } from '@/server/utils/response'
+import { requireRole } from '@/server/api/workshop/caller'
+import { getAmlRuntime } from '@/server/services/workshop/aml/runtime'
+import { getProfileRepo, parseProfileRow } from '@/server/services/workshop/optimization/profile.repo'
+import { assertProfileSolverCompatible, type OptimizationProfile } from '@/server/services/workshop/optimization/contracts'
+import { canSeeProfile, recordConfigAction } from '@/server/services/workshop/optimization/access'
+import { AppError } from '@/server/utils/errors'
+
+export default defineApiHandler(async (event) => {
+  const user = requireRole(event, ['admin', 'editor'])
+  const method = event.method?.toUpperCase() ?? 'GET'
+  if (method === 'GET') {
+    const q = getQuery(event)
+    // 列表静默过滤(不枚举他人 Profile;跨用户访问走 assertOptimizationAccess 显式拒绝+审计)
+    const rows = getProfileRepo().list({ status: typeof q.status === 'string' ? q.status : undefined, limit: 200 })
+      .filter(r => canSeeProfile(user, r))
+    return { profiles: rows.map(r => ({ ...r, profile: parseProfileRow(r) })) }
+  }
+  const body = await readBody<Record<string, unknown>>(event) ?? {}
+  const profile = body as unknown as OptimizationProfile
+  if (!profile?.id || !profile.modelRef?.modelId || !profile.solverRef || !profile.problemTemplateRef) {
+    throw new AppError(422, 'PROFILE_INVALID', 'id / modelRef / solverRef / problemTemplateRef 必填')
+  }
+  const model = getAmlRuntime().repo.model.get(profile.modelRef.modelId)
+  if (!model) throw new AppError(404, 'MODEL_NOT_FOUND', `模型 ${profile.modelRef.modelId} 不存在`)
+  // 模型工件类型/接口以注册表为准(客户端不能自填)
+  profile.modelRef.artifactKind = (model.artifactKind || 'onnx_one_step@1') as OptimizationProfile['modelRef']['artifactKind']
+  profile.modelRef.modelInterface = (model.modelInterface || 'one_step') as OptimizationProfile['modelRef']['modelInterface']
+  profile.modelRef.artifactHash = model.artifactHash || profile.modelRef.artifactHash || ''
+  profile.modelRef.stage = model.stage
+  assertProfileSolverCompatible(profile)
+  const row = getProfileRepo().insert({ ...profile, status: 'draft' }, user.id)
+  recordConfigAction(user, 'optimizer.profile.create', { kind: 'optimizer_profile', id: `${profile.id}@${profile.version}` },
+    `登记 Optimizer Profile ${profile.id}@${profile.version}(solver=${profile.solverRef})`, { solverRef: profile.solverRef, modelId: profile.modelRef.modelId })
+  return { profile: row }
+})

package/server/api/workshop/optimization/recommendations/[id]/crosscheck.post.ts

@@ -0,0 +1,29 @@
+/**
+ * POST /api/workshop/optimization/recommendations/:id/crosscheck —— 候选互校(SW4)。
+ * 归属:建议所属运行的 binding agent 可见性(D16);先决失败给可定位错误码。
+ */
+import { getRouterParam, readBody } from 'h3'
+import { defineApiHandler } from '@/server/utils/response'
+import { requireRole } from '@/server/api/workshop/caller'
+import { assertOptimizationAccess, recordConfigAction } from '@/server/services/workshop/optimization/access'
+import { getRunRepo } from '@/server/services/workshop/optimization/run.repo'
+import { runCrosscheck, getCrosscheckRepo, deriveDualState } from '@/server/services/workshop/optimization/crosscheck.service'
+
+export default defineApiHandler(async (event) => {
+  const user = requireRole(event, ['admin', 'editor'])
+  const id = getRouterParam(event, 'id') ?? ''
+  const rec = getRunRepo().getRecommendation(id)
+  if (!rec) throw createError({ statusCode: 404, statusMessage: `建议 ${id} 不存在` })
+  assertOptimizationAccess(user, 'crosscheck', { kind: 'recommendation', runId: rec.runId })
+  const body = await readBody<Record<string, unknown>>(event).catch(() => ({}) as Record<string, unknown>) ?? {}
+  const row = await runCrosscheck(id)
+  recordConfigAction(user, 'optimizer.crosscheck.run', { kind: 'optimizer_crosscheck', id: row.id },
+    `候选互校 ${id}:${row.verdict}(maxDev=${row.maxDevDimensionless === null ? 'n/a' : row.maxDevDimensionless.toExponential(3)})`,
+    { recommendationId: id, runId: rec.runId, verdict: row.verdict, rowHash: row.rowHash.slice(0, 16) })
+  const dual = deriveDualState(id)
+  return {
+    crosscheck: row,
+    dual,
+    history: getCrosscheckRepo().listForRecommendation(id, Number(body.limit ?? 10)),
+  }
+})

package/server/api/workshop/optimization/recommendations/[id]/dispatch.post.ts

@@ -0,0 +1,33 @@
+/**
+ * POST /api/workshop/optimization/recommendations/:id/dispatch —— 申请下发优化器建议(SW5)。
+ * D11 防伪:body 只接受 { note? };任何证据字段 → 422。卡由服务端落库回查构造,建卡即返回。
+ */
+import { getRouterParam, readBody } from 'h3'
+import { defineApiHandler } from '@/server/utils/response'
+import { requireRole } from '@/server/api/workshop/caller'
+import { createDispatchCard } from '@/server/services/workshop/optimization/dispatch.service'
+import { AppError } from '@/server/utils/errors'
+
+const FORBIDDEN_EVIDENCE_KEYS = ['coverage', 'coverageTest', 'qhat', 'qhatPerCv', 'inputDistance', 'crosscheck', 'rowHash', 'row_hash', 'devPerCv', 'maxDev', 'verdict', 'uq', 'predicted', 'replayed', 'artifactHash']
+
+export default defineApiHandler(async (event) => {
+  const user = requireRole(event, ['admin', 'editor'])
+  const id = getRouterParam(event, 'id') ?? ''
+  const body = await readBody<Record<string, unknown>>(event).catch(() => ({}) as Record<string, unknown>) ?? {}
+  // D11:任何证据字段 → 422(payload 全部服务端落库回查)
+  const smuggled = Object.keys(body).filter(k => FORBIDDEN_EVIDENCE_KEYS.includes(k))
+  if (smuggled.length > 0) {
+    throw new AppError(422, 'DISPATCH_BODY_EVIDENCE_FORBIDDEN',
+      `body 不得携带证据字段(${smuggled.join(',')});payload 全部由服务端按 recommendation_id 落库回查构造`)
+  }
+  const note = typeof body.note === 'string' ? body.note.slice(0, 500) : ''
+  const card = await createDispatchCard(user, id, note)
+  return {
+    dispatch: {
+      cardId: card.cardId,
+      agentInstanceId: card.agentInstanceId,
+      recipeId: card.recipeId,
+      rowHashHint: '见审批卡 payload(服务端构造;卡面展示截断值供人回查)',
+    },
+  }
+})

package/server/api/workshop/optimization/runs/index.get.ts

@@ -0,0 +1,41 @@
+/**
+ * GET /api/workshop/optimization/runs?bindingId=&limit= —— 运行台账(含候选/建议摘要)
+ */
+import { getQuery } from 'h3'
+import { defineApiHandler } from '@/server/utils/response'
+import { requireRole } from '@/server/api/workshop/caller'
+import { getRunRepo } from '@/server/services/workshop/optimization/run.repo'
+import { getBindingRepo } from '@/server/services/workshop/optimization/binding.repo'
+import { assertAgentAccess } from '@/server/services/workshop/optimization/rest-auth'
+import { AppError } from '@/server/utils/errors'
+
+export default defineApiHandler(async (event) => {
+  const user = requireRole(event, ['admin', 'editor'])
+  const q = getQuery(event)
+  const bindingId = typeof q.bindingId === 'string' ? q.bindingId : undefined
+  if (bindingId) {
+    const binding = getBindingRepo().get(bindingId)
+    if (!binding) throw new AppError(404, 'BINDING_NOT_FOUND', `绑定 ${bindingId} 不存在`)
+    assertAgentAccess(user, binding.channelAgentId)
+  }
+  else if (user.role !== 'admin') {
+    throw new AppError(403, 'SCOPE_VIOLATION', '全局运行列表仅管理员可读;请按 bindingId 查询')
+  }
+  const limit = typeof q.limit === 'string' ? Math.max(1, Math.min(Number(q.limit) || 50, 200)) : 50
+  const runs = getRunRepo().listRuns({ bindingId, limit }).map(run => ({
+    ...run,
+    problemIr: safeJson(run.problemIrJson),
+    diagnostics: safeJson(run.diagnosticsJson),
+    recommendation: getRunRepo().latestRecommendationForRun(run.id) ?? null,
+  }))
+  return { runs }
+})
+
+function safeJson(text: string): Record<string, unknown> {
+  try {
+    return JSON.parse(text || '{}') as Record<string, unknown>
+  }
+  catch {
+    return {}
+  }
+}

package/server/api/workshop/optimization/solve.post.ts

@@ -0,0 +1,23 @@
+/**
+ * POST /api/workshop/optimization/solve —— 用户路径求解(权限 = 产线 readonly + 绑定归属)。
+ * body: { agentInstanceId, bindingId?, timeoutMs?, allowIneligible? }
+ */
+import { readBody } from 'h3'
+import { defineApiHandler } from '@/server/utils/response'
+import { requireRole } from '@/server/api/workshop/caller'
+import { solve } from '@/server/services/workshop/optimization/manager'
+import { assertAgentAccess } from '@/server/services/workshop/optimization/rest-auth'
+import { AppError } from '@/server/utils/errors'
+
+export default defineApiHandler(async (event) => {
+  const user = requireRole(event, ['admin', 'editor'])
+  const body = await readBody<Record<string, unknown>>(event) ?? {}
+  const agentInstanceId = String(body.agentInstanceId ?? '')
+  if (!agentInstanceId) throw new AppError(422, 'AGENT_REQUIRED', 'agentInstanceId 必填(channel_agents.id)')
+  assertAgentAccess(user, agentInstanceId)
+  const outcome = await solve(agentInstanceId, {
+    bindingId: typeof body.bindingId === 'string' ? body.bindingId : undefined,
+    timeoutMs: typeof body.timeoutMs === 'number' ? body.timeoutMs : undefined,
+  })
+  return outcome
+})

package/server/api/workshop/process-model/datasets.post.ts

@@ -0,0 +1,26 @@
+/**
+ * POST /api/workshop/process-model/datasets —— 按 ProcessModelSpec 构建 manifest v2 数据集。
+ * body: ProcessModelSpec(完整);权限 = 产线 readonly。
+ */
+import { readBody } from 'h3'
+import { defineApiHandler } from '@/server/utils/response'
+import { resolveUser } from '@/server/api/workshop/caller'
+import { requireLineMode } from '@/server/services/workshop/permissions'
+import { recordOps } from '@/server/services/workshop/ops/ops'
+import { parseProcessModelSpec } from '@/server/services/workshop/process-model/spec'
+import { buildProcessModelDataset } from '@/server/services/workshop/process-model/dataset'
+
+export default defineApiHandler(async (event) => {
+  const user = resolveUser(event)
+  const body = await readBody<Record<string, unknown>>(event) ?? {}
+  const spec = parseProcessModelSpec(body)
+  requireLineMode(user, spec.lineId, 'readonly')
+  const built = await buildProcessModelDataset(body, { id: user.id, kind: 'user' })
+  recordOps({
+    actor: user.id, actorName: user.name, actorKind: 'user',
+    action: 'process_model.dataset.build', kind: 'system',
+    summary: `构建过程模型数据集 ${built.datasetId}(${built.rowCount} 窗 / ${built.runIds.length} 批次;recipe v${built.recipeVersion})`,
+    targetKind: 'aml_dataset', targetId: built.datasetId, lineId: spec.lineId,
+  })
+  return built
+})

package/server/api/workshop/process-model/eligibility.ts

@@ -0,0 +1,40 @@
+/**
+ * GET /api/workshop/process-model/eligibility?specId= —— 最新资格报告
+ * POST —— 从不可变数据集重建序列并评估(body: { specId, specVersion?, datasetId, scope?, actionEvidence? })
+ * 归属:spec 的产线可见性(readonly);评估动作入册(D16/SW1.6)。
+ */
+import { getQuery, readBody } from 'h3'
+import { defineApiHandler } from '@/server/utils/response'
+import { requireRole } from '@/server/api/workshop/caller'
+import { getEligibilityRepo } from '@/server/services/workshop/process-model/eligibility'
+import { evaluateEligibilityFromDataset } from '@/server/services/workshop/process-model/eligibility-service'
+import { assertOptimizationAccess, recordConfigAction } from '@/server/services/workshop/optimization/access'
+
+export default defineApiHandler(async (event) => {
+  const user = requireRole(event, ['admin', 'editor'])
+  const method = event.method?.toUpperCase() ?? 'GET'
+  if (method === 'GET') {
+    const q = getQuery(event)
+    const specId = String(q.specId ?? '')
+    if (!specId) throw createError({ statusCode: 400, statusMessage: 'specId required' })
+    assertOptimizationAccess(user, 'read', { kind: 'eligibility', specId })
+    return { report: getEligibilityRepo().latest(specId), history: getEligibilityRepo().list(specId, 10) }
+  }
+  const body = await readBody<Record<string, unknown>>(event) ?? {}
+  const specId = String(body.specId ?? '')
+  const datasetId = String(body.datasetId ?? '')
+  if (!specId || !datasetId) throw createError({ statusCode: 400, statusMessage: 'specId 与 datasetId 必填' })
+  const ctx = assertOptimizationAccess(user, 'evaluate', { kind: 'eligibility', specId })
+  assertOptimizationAccess(user, 'evaluate', { kind: 'dataset', id: datasetId })
+  const report = evaluateEligibilityFromDataset({
+    specId,
+    specVersion: typeof body.specVersion === 'number' ? body.specVersion : undefined,
+    datasetId,
+    scope: body.scope === 'simulation' ? 'simulation' : 'real',
+    evidenceVersion: typeof body.evidenceVersion === 'string' ? body.evidenceVersion : undefined,
+  })
+  recordConfigAction(user, 'process_model.eligibility.evaluate', { kind: 'process_model_eligibility', id: `${specId}@${body.specVersion ?? '?'}` },
+    `评估优化资格 ${specId}(eligible=${(report as { optimizationEligible?: boolean }).optimizationEligible === true})`,
+    { datasetId, scope: (report as { scope?: string }).scope }, ctx.lineId)
+  return { report }
+})