agentworkshop 0.7.70 → 0.8.0

package/server/services/workshop/agents/plugin-governance.ts

@@ -0,0 +1,148 @@
+/**
+ * plugin-governance —— 插件工具的平台侧治理闸门(WP4b / WP8)。
+ *
+ * 背景:插件工具历史上只过「团队插件开关 + roles」两道,不经 grant-guard/tool-verify/HITL。
+ * 本模块把三类治理补齐到**所有分发路径共用的单点**(dispatchHostToolInner 与
+ * manager.invokeHostTool 都调用,原生/omp/REST/MCP 桥同源):
+ *   1. kb_agent 写知识库(action=ingest)必须挂 HITL 审批(缺省 action 的入库意图启发拦截);
+ *   2. 插件工具声明了 references 才做引用面校验(存量未声明插件行为不变);
+ *   3. 插件工具调用结果统一入 audit(action=plugin.tool.call)。
+ *
+ * 铁律:审批与校验都在服务端执行期发生;注入面(是否展示工具)不是安全边界。
+ */
+import { checkToolAgainstScope } from '../runtime/permission-scope'
+import { getToolApprovals } from './tool-approvals'
+import { verifyToolReferences } from './industrial/tool-verify'
+import { recordOps } from '../ops/ops'
+import type { HostToolResult } from './host-tool-bridge/types'
+
+export interface PluginGovernanceIdentity {
+  agentId: string
+  channelId: string
+  role: 'lead' | 'worker'
+  name: string
+}
+
+/** 知识库入库意图启发词(辅助防线;完备防线 = action=ingest 契约 + riskClass=write 治理) */
+const INGEST_INTENT_PATTERNS = [
+  /入库/,
+  /沉淀/,
+  /写(入|进)?知识库/,
+  /知识库[^。;]{0,12}(写|存|记)/,
+  /\bingest\b/i,
+  /\bindex\s+(this|the)\s+file\b/i,
+  /\badd\s+(to\s+)?(the\s+)?knowledge\s*base\b/i,
+]
+
+const KB_TOOL = 'kb_agent'
+
+/** 入库守卫是否启用(env 逃生门;关闭只影响启发拦截,action=ingest 审批始终生效) */
+function ingestGuardEnabled(): boolean {
+  return process.env.AW_KB_INGEST_GUARD !== '0'
+}
+
+function looksLikeIngest(prompt: string): boolean {
+  return INGEST_INTENT_PATTERNS.some(re => re.test(prompt))
+}
+
+/**
+ * kb_agent 写入治理:action=ingest → HITL 审批(批准才继续);action 缺省且 prompt 命中
+ * 入库意图 → 拒绝并提示改用 action=ingest。
+ * 返回 null = 放行。
+ */
+async function governKbAgent(identity: PluginGovernanceIdentity, toolName: string, args: Record<string, unknown>): Promise<HostToolResult | null> {
+  if (toolName !== KB_TOOL) return null
+  const action = String(args.action ?? '').trim().toLowerCase()
+  const prompt = String(args.prompt ?? '')
+  if (action && action !== 'query' && action !== 'ingest') {
+    return { text: `kb_agent.action 取值非法(${action}):只能是 query(只读)或 ingest(写知识库)。`, isError: true }
+  }
+  if (action !== 'ingest') {
+    if (ingestGuardEnabled() && looksLikeIngest(prompt)) {
+      return {
+        text: '工具调用被拒(kb_agent 入库守卫):检测到入库/沉淀意图但未声明 action=ingest。请改用 action=ingest 重试——入库会进入平台审批(HITL),批准后才会写入知识库。',
+        isError: true,
+      }
+    }
+    return null
+  }
+  // 写入知识库:显式人工审批(与配方/产线写同源审批服务;缺省超时=拒绝)
+  const detail = `知识库入库审批(kb_agent):\n${prompt.slice(0, 1200)}`
+  const decision = await getToolApprovals().request(identity.agentId, '', 'kb', detail, {
+    title: '知识库入库审批',
+    payload: { tool: 'kb_agent', action: 'ingest', prompt: prompt.slice(0, 2000), mode: String(args.mode ?? 'sync') },
+  })
+  if (!decision.approved) {
+    recordOps({
+      actor: identity.agentId, actorName: identity.name, actorKind: 'agent',
+      action: 'plugin.tool.denied', kind: 'system', level: 'warn',
+      targetKind: 'tool', targetId: toolName,
+      summary: `知识库入库被拒绝/超时(审批 ${decision.id})`,
+      detail: { decision: decision.id, comment: decision.comment, prompt: prompt.slice(0, 200) },
+    })
+    return { text: `知识库入库未获批准(审批 ${decision.id}:${decision.comment || '超时或人工拒绝'}),未写入知识库。`, isError: true }
+  }
+  return null
+}
+
+/**
+ * 插件工具治理入口。返回 null = 放行;返回结果 = 拒绝。
+ * 调用点:dispatch.ts 插件分支 / manager.invokeHostTool 插件分支(两处同源)。
+ */
+export async function governPluginToolCall(
+  identity: PluginGovernanceIdentity,
+  toolName: string,
+  args: Record<string, unknown>,
+  declared?: { references?: { atLeastOne?: unknown }, noRefs?: boolean },
+): Promise<HostToolResult | null> {
+  try {
+    const kbDenied = await governKbAgent(identity, toolName, args)
+    if (kbDenied) return kbDenied
+    // WP8②:插件显式声明 references 才做引用面校验(未声明存量零变化)
+    if (declared?.references) {
+      const denied = verifyToolReferences(identity.agentId, toolName, args, declared.references as Parameters<typeof verifyToolReferences>[3])
+      if (denied) return denied
+    }
+    return null
+  }
+  catch (err) {
+    // 治理层自身故障 → fail-closed(与 grant-guard / tool-verify 同纪律)
+    return {
+      text: `插件工具治理校验异常(${toolName}):${err instanceof Error ? err.message : String(err)}。请稍后重试;若持续出现请联系管理员。`,
+      isError: true,
+    }
+  }
+}
+
+/** 插件调用结果审计(WP8③;成功与失败都留痕,便于审计面回答「谁在何时调了插件工具」) */
+export function auditPluginToolCall(
+  identity: PluginGovernanceIdentity,
+  toolName: string,
+  result: { text?: string, isError?: boolean },
+): void {
+  try {
+    recordOps({
+      actor: identity.agentId,
+      actorName: identity.name,
+      actorKind: 'agent',
+      action: 'plugin.tool.call',
+      kind: 'system',
+      level: result.isError ? 'warn' : 'info',
+      targetKind: 'tool',
+      targetId: toolName,
+      summary: `插件工具调用:${toolName}(${result.isError ? '失败' : '成功'})`,
+      detail: { channelId: identity.channelId, role: identity.role, isError: Boolean(result.isError), text: String(result.text ?? '').slice(0, 400) },
+    })
+  }
+  catch { /* 审计失败不阻断工具结果 */ }
+}
+
+/** 供外部(测试/调用方)复用:知识库入库动作判定 */
+export function kbActionOf(args: Record<string, unknown>): 'query' | 'ingest' | 'invalid' {
+  const action = String(args.action ?? '').trim().toLowerCase()
+  if (!action) return 'query'
+  if (action === 'query' || action === 'ingest') return action
+  return 'invalid'
+}
+
+export { checkToolAgainstScope }

package/server/services/workshop/agents/plugin-tools.ts

@@ -11,6 +11,7 @@
  *    (agentId/channelId/role/name)回调插件 handler。
  */
 import { createLogger } from '../logger'
+import type { ToolRiskClass, ToolVerifySpec } from './tool-reference-spec'
 
 const log = createLogger('workshop.plugin-tools')
 
@@ -32,6 +33,16 @@ export interface OmpPluginTool {
   parameters: Record<string, unknown>
   /** 可用角色(缺省 lead+worker 均可) */
   roles?: OmpPluginToolRole[]
+  /**
+   * 引用面声明(WP8①;可选,存量插件零变化)。
+   * 声明后才走执行期引用校验(verifyToolReferences),未声明保持既有行为。
+   * 形状与 host-tools.json 的 `references` 完全一致。
+   */
+  references?: ToolVerifySpec
+  /** 显式无引用声明(与未声明区分;riskClass=write 且未声明会被注册期告警) */
+  noRefs?: boolean
+  /** 风险类别(read/write/admin;插件写操作接同源 HITL 与审计) */
+  riskClass?: ToolRiskClass
   /** 执行体:返回文本结果(isError=true → omp 端按工具错误呈现) */
   handler: (args: Record<string, unknown>, agent: OmpPluginAgentContext) => Promise<{ text: string, isError?: boolean }> | { text: string, isError?: boolean }
 }

package/server/services/workshop/agents/registry.ts

@@ -37,6 +37,13 @@ export interface HarnessCapabilities {
   contextStats: boolean
   /** 平台可主动触发压缩(onTurnSettled 门控) */
   compact: boolean
+  /**
+   * 工具面刷新能力(C14):
+   *  - native      —— 支持服务端直接热更(omp set_host_tools);
+   *  - list_changed —— MCP bridge 轮询 + 客户端重列举(支持者 ≤15s);
+   *  - per_turn    —— 下一回合装配(pi 工具文件)。
+   */
+  toolRefresh?: 'native' | 'list_changed' | 'per_turn'
 }
 
 /**
@@ -270,7 +277,20 @@ export function isKnownHarness(harness: string): boolean {
 
 /** registry 元信息(前端下拉/能力徽标;不含实现) */
 export function harnessMetas(): Array<{ id: string, label: string, description: string, capabilities: HarnessCapabilities, continuityMode: HarnessContinuityMode, homepage: string }> {
-  return Object.values(HARNESS_REGISTRY).map(({ id, label, description, capabilities, continuityMode, homepage }) => ({ id, label, description, capabilities, continuityMode, homepage }))
+  return Object.values(HARNESS_REGISTRY).map(({ id, label, description, capabilities, continuityMode, homepage }) => ({
+    id, label, description, continuityMode, homepage,
+    capabilities: { ...capabilities, toolRefresh: toolRefreshOf(id) },
+  }))
+}
+
+/**
+ * 工具面刷新策略(C14):omp/mock 支持服务端热更;pi 每回合装配;
+ * 其余持久会话走 MCP bridge 的 list_changed(客户端支持时重列举)。
+ */
+export function toolRefreshOf(harness: string): 'native' | 'list_changed' | 'per_turn' {
+  if (harness === 'omp' || harness === 'mock') return 'native'
+  if (harness === 'pi') return 'per_turn'
+  return 'list_changed'
 }
 
 /** 某 harness 的连续性能力(§6.3;未知 harness 按 per_turn 最保守处理,不虚假承诺复用) */

package/server/services/workshop/agents/tool-approvals.ts

@@ -19,7 +19,7 @@ export interface ToolApproval {
   id: string
   agentId: string
   nodeId: string
-  kind: 'dcw' | 'daq'
+  kind: 'dcw' | 'daq' | 'kb'
   /** 人读摘要(节点名/物理量/目标值/窗口) */
   detail: string
   /** 结构化审批载荷(可选;整包方案审批 recipe-propose 存方案集+预检结果,前端渲染结构化审批卡) */
@@ -68,7 +68,7 @@ class ToolApprovalService {
    *  opts.timeoutMs 覆盖本单超时窗(expiresAt 与 timer 两处同源取值;缺省 = 全局 hitl_timeout_ms);
    *  opts.payload 携带结构化审批载荷(随 pending/history 落库,前端渲染结构化审批卡)。
    *  不传 opts 的既有调用(param_control/manual-approval/recipe 门)行为不变。 */
-  request(agentId: string, nodeId: string, kind: 'dcw' | 'daq', detail: string, opts?: { title?: string, timeoutMs?: number, payload?: unknown }): Promise<ToolApprovalDecision> {
+  request(agentId: string, nodeId: string, kind: 'dcw' | 'daq' | 'kb', detail: string, opts?: { title?: string, timeoutMs?: number, payload?: unknown }): Promise<ToolApprovalDecision> {
     // hold 模式(手动生产语义):审批不自动拒、周期催办;显式传 timeoutMs 的调用方
     // (整包方案 30min)同样被 hold 覆盖 —— 真人在环时"等人"优先于"限时"。
     const hold = securityHitlTimeoutMode() === 'hold'
@@ -200,11 +200,11 @@ class ToolApprovalService {
     })
   }
 
-  /** 审批锚点 → 产线 id(节点 id 直查;recipe:/recipe-propose: 前缀查配方产线) */
+  /** 审批锚点 → 产线 id(节点 id 直查;recipe:/recipe-propose:/optimizer-recipe: 前缀查配方产线) */
   private lineIdOf(nodeId: string): string {
     if (nodeId.startsWith('line-start:')) return nodeId.slice('line-start:'.length)
     if (nodeId.startsWith('line-stop:')) return nodeId.slice('line-stop:'.length)
-    const m = nodeId.match(/^(?:recipe|recipe-propose):(.+)$/)
+    const m = nodeId.match(/^(?:recipe|recipe-propose|optimizer-recipe):(.+)$/)
     try {
       if (m) {
         const recipe = getDcwController().listRecipes().find(r => r.id === m[1])
@@ -236,7 +236,7 @@ class ToolApprovalService {
     // recipe_update 只写定义不触产线,排除;失败仅告警不反噬裁决主流程。
     if (approved) {
       try {
-        const m = entry.approval.nodeId.match(/^(?:recipe|recipe-propose):(.+)$/)
+        const m = entry.approval.nodeId.match(/^(?:recipe|recipe-propose|optimizer-recipe):(.+)$/)
         const payload = (entry.approval.payload ?? {}) as { op?: string, kind?: string }
         if (m && payload.op !== 'update') {
           const rawOp = String(payload.op)
@@ -304,6 +304,8 @@ class ToolApprovalService {
     if (binding.kind === 'recipe') {
       n += this.cancelPendingFor(agentId, `recipe:${binding.nodeId}`)
       n += this.cancelPendingFor(agentId, `recipe-propose:${binding.nodeId}`)
+      // SW5/D14:optimizer 下发卡同配方收敛(撤权后在飞卡零写)
+      n += this.cancelPendingFor(agentId, `optimizer-recipe:${binding.nodeId}`)
       try {
         const recipe = getDcwController().listRecipes().find(r => r.id === binding.nodeId)
         for (const p of recipe?.params ?? []) n += this.cancelPendingFor(agentId, p.nodeId)

package/server/services/workshop/agents/tool-reference-kinds.ts

@@ -0,0 +1,2 @@
+/** 引用类别(独立叶子,避免声明模块与校验模块的类型循环) */
+export type ToolRefKind = 'node' | 'line' | 'recipe'

package/server/services/workshop/agents/tool-reference-spec.ts

@@ -0,0 +1,114 @@
+/**
+ * 工具引用面声明 —— 单一声明源(零依赖叶子模块)。
+ *
+ * 设计(2026-10-24 工具面计划 WP5):
+ *  - 工具是否接收引用型参数(node/line/recipe/dataset/job/model/plan/scene/optimizer 对象)、
+ *    该怎么校验,由工具定义自带 `references` 声明;显式无引用声明 `noRefs: true`。
+ *  - **声明在注册期强制、校验在执行期实时**:本模块只承载声明与查表,不缓存任何
+ *    授权判定(绑定面可在调用间隙被改写,归属必须每次重算 —— 见 tool-verify.ts)。
+ *  - 加载器(loader)从 host-tools.json 读出字段,目录装配(catalog)调用
+ *    registerToolReferenceDeclarations() 建立查表;插件工具经 registerPluginTool
+ *    携带同形字段(可选,存量插件零变化)。
+ *  - 命名映射(MCP annotations 预留):refs[].mode='read' ≈ readOnlyHint,
+ *    mode='write' ≈ destructiveHint;riskClass='write' → destructiveHint=true。
+ */
+import type { ToolRefKind as _RefKind } from './tool-reference-kinds'
+
+export type { ToolRefKind } from './tool-reference-kinds'
+
+/** 链式引用类别(经谱系回溯判定归属) */
+export type ToolChainKind = 'dataset' | 'job' | 'model' | 'plan' | 'scene' | 'binding' | 'run' | 'recommendation' | 'ontology_draft' | 'ontology_version'
+
+export interface ToolRefRule {
+  param: string
+  kind: _RefKind
+  /** 语义标注(不改变判定逻辑):read=只声明读取该对象;write=会改写该对象 */
+  mode?: 'read' | 'write'
+}
+
+export interface ToolChainRule {
+  param: string
+  kind: ToolChainKind
+  mode?: 'read' | 'write'
+}
+
+/** 一个工具的引用面声明(与 VERIFY_SPECS 的元素同形,平移到数据面) */
+export interface ToolVerifySpec {
+  /** 必填引用:至少提供一个(缺省形状拒绝;hint 给 Agent 该传什么) */
+  atLeastOne?: Array<{ params: string[], hint: string }>
+  /** 浅层字符串引用参数 → 判定类别 */
+  refs?: ToolRefRule[]
+  /** 浅层节点 id 数组参数 */
+  nodeLists?: string[]
+  /** 深路径节点引用(如 'params[].node_id' / 'packages[].params[].node_id') */
+  deepNodeRefs?: string[]
+  /** 链式引用(dataset_id/job_id/model_id/plan_id/scene_id/binding_id/run_id/recommendation_id) */
+  chained?: ToolChainRule[]
+  /** 只读工具:节点只要归属可读产线即可引用(与频道绑线只读扩权同口径;写工具不得开启) */
+  readableLineNodes?: boolean
+}
+
+/** 工具风险类别(治理面与 MCP annotations 的公共输入) */
+export type ToolRiskClass = 'read' | 'write' | 'admin'
+
+/** 带声明字段的工具定义(host-tools.json / 插件注册共用形状) */
+export interface ToolWithReferenceDeclaration {
+  name: string
+  references?: ToolVerifySpec
+  noRefs?: boolean
+  riskClass?: ToolRiskClass
+}
+
+const specByName = new Map<string, ToolVerifySpec | null>()
+
+/** 装载声明表(目录装配时调用;重复调用幂等覆盖) */
+export function registerToolReferenceDeclarations(tools: ToolWithReferenceDeclaration[]): void {
+  specByName.clear()
+  for (const t of tools) {
+    if (!t || typeof t.name !== 'string') continue
+    if (t.references) specByName.set(t.name, t.references)
+    else if (t.noRefs) specByName.set(t.name, null)
+  }
+}
+
+/**
+ * 查声明:
+ *  - declared=true, spec=ToolVerifySpec → 按声明校验
+ *  - declared=true, spec=null            → 显式无引用(noRefs),不校验
+ *  - declared=false, spec=null           → 未声明(调用方决定告警/回滚到 legacy 表)
+ */
+export function declaredReferenceSpec(name: string): { declared: boolean, spec: ToolVerifySpec | null } {
+  if (specByName.has(name)) return { declared: true, spec: specByName.get(name) ?? null }
+  return { declared: false, spec: null }
+}
+
+/** 已声明工具名集合(测试/审计用) */
+export function declaredToolNames(): string[] {
+  return [...specByName.keys()].sort()
+}
+
+/** 声明是否「有实质校验内容」(空对象等价于 noRefs,但语义不同:空对象=声明过但无规则) */
+export function specHasRules(spec: ToolVerifySpec | null): boolean {
+  if (!spec) return false
+  return Boolean(
+    (spec.atLeastOne?.length)
+    || (spec.refs?.length)
+    || (spec.nodeLists?.length)
+    || (spec.deepNodeRefs?.length)
+    || (spec.chained?.length),
+  )
+}
+
+/**
+ * 登记制判定(纯函数;注册期调用):
+ *  - 'ok'                已声明(有 references 或显式 noRefs)
+ *  - 'undeclared-write'  写族未声明 → 拒绝登记(注入面与执行面双关)
+ *  - 'undeclared-read'   读族未声明 → 登记 + 告警(限期补齐)
+ */
+export function declarationVerdict(
+  tool: { references?: unknown, noRefs?: boolean },
+  isWriteFamily: boolean,
+): 'ok' | 'undeclared-write' | 'undeclared-read' {
+  if (tool.references || tool.noRefs) return 'ok'
+  return isWriteFamily ? 'undeclared-write' : 'undeclared-read'
+}

package/server/services/workshop/aml/aml.repo.ts

@@ -23,12 +23,34 @@ export interface AmlDatasetRow {
   createdByKind: string // 'user' | 'agent'
   note: string
   createdAt: string
+  /** 由 ProcessModelSpec 构建时的规格引用(旧 AML 数据集为空 = 无工艺规格谱系) */
+  specRef?: string
+  specVersion?: number | null
+  /** 数据谱系核验(D18):0=未核验(旧/无 confirmed segment;模型禁优化资格);1=每 run 均有已确认 segment 且版本匹配 */
+  lineageVerified?: number
 }
 
 export type AmlJobStatus
   = | 'queued' | 'provisioning' | 'training' | 'evaluating'
     | 'done' | 'failed' | 'cancelled' | 'timeout' | 'interrupted'
 
+/** AML 作业状态机(C12):终态不可迁出;done 只能从 evaluating 进入。 */
+export const AML_JOB_TRANSITIONS: Record<AmlJobStatus, AmlJobStatus[]> = {
+  queued: ['provisioning', 'training', 'cancelled', 'failed', 'interrupted'],
+  provisioning: ['training', 'evaluating', 'failed', 'cancelled', 'timeout', 'interrupted'],
+  training: ['evaluating', 'failed', 'cancelled', 'timeout', 'interrupted'],
+  evaluating: ['done', 'failed', 'cancelled', 'timeout', 'interrupted'],
+  done: [],
+  failed: [],
+  cancelled: [],
+  timeout: [],
+  interrupted: [],
+}
+
+export function canTransitionJob(from: AmlJobStatus, to: AmlJobStatus): boolean {
+  return AML_JOB_TRANSITIONS[from]?.includes(to) ?? false
+}
+
 export interface AmlJobRow {
   id: string
   datasetId: string
@@ -40,6 +62,8 @@ export interface AmlJobRow {
   metricsJson: string | null
   gatesJson: string | null
   artifactsPath: string | null
+  /** 成功终态登记的模型 id(同一 UPDATE 写入;C11) */
+  modelId?: string | null
   error: string | null
   retryCount: number
   agentId: string
@@ -90,17 +114,26 @@ export interface AmlModelRow {
   lineId: string
   /** 优化目标区分(ObjectiveProfile id;legacy 作业为空串,用 purpose 表达) */
   objectiveId: string
+  /** 工件类型判别(G1.2):'' = 历史行,由 metrics 推断 */
+  artifactKind: string
+  schemaVersion: number
+  /** 模型接口(one_step / linear_state_space / static_response) */
+  modelInterface: string
+  artifactHash: string
+  /** 历史口径标记(如 twin_v1);新链为空串 */
+  legacy: string
   createdAt: string
 }
 
 const DS_COLS = `id, line_id AS lineId, product_id AS productId, recipe_id AS recipeId,
   run_ids_json AS runIdsJson, spec_json AS specJson, sha256, row_count AS rowCount,
   from_ms AS fromMs, to_ms AS toMs, path, created_by AS createdBy,
-  created_by_kind AS createdByKind, note, created_at AS createdAt`
+  created_by_kind AS createdByKind, note, created_at AS createdAt,
+  spec_ref AS specRef, spec_version AS specVersion, lineage_verified AS lineageVerified`
 
 const JOB_COLS = `id, dataset_id AS datasetId, purpose, status, stage, progress,
   budget_json AS budgetJson, metrics_json AS metricsJson, gates_json AS gatesJson,
-  artifacts_path AS artifactsPath, error, retry_count AS retryCount,
+  artifacts_path AS artifactsPath, model_id AS modelId, error, retry_count AS retryCount,
   agent_id AS agentId, channel_id AS channelId, task_id AS taskId,
   created_at AS createdAt, started_at AS startedAt, ended_at AS endedAt`
 
@@ -114,7 +147,9 @@ const MODEL_COLS = `id, experiment_id AS experimentId, dataset_id AS datasetId,
   io_spec_json AS ioSpecJson, metrics_json AS metricsJson, path,
   artifacts_pruned AS artifactsPruned, created_by AS createdBy,
   promoted_by AS promotedBy, promoted_at AS promotedAt, note,
-  label, description, line_id AS lineId, objective_id AS objectiveId, created_at AS createdAt`
+  label, description, line_id AS lineId, objective_id AS objectiveId,
+  artifact_kind AS artifactKind, schema_version AS schemaVersion, model_interface AS modelInterface,
+  artifact_hash AS artifactHash, legacy, created_at AS createdAt`
 
 function rowToDataset(r: Record<string, unknown>): AmlDatasetRow {
   return { ...(r as unknown as Omit<AmlDatasetRow, 'runIds'>), runIds: JSON.parse(String(r.runIdsJson || '[]')) }
@@ -135,8 +170,9 @@ function rowToModel(r: Record<string, unknown>): AmlModelRow {
 export function createAmlRepo(db: DatabaseSync) {
   const dsInsert = db.prepare(
     `INSERT INTO aml_datasets (id, line_id, product_id, recipe_id, run_ids_json, spec_json, sha256,
-       row_count, from_ms, to_ms, path, created_by, created_by_kind, note, created_at)
-     VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+       row_count, from_ms, to_ms, path, created_by, created_by_kind, note, created_at,
+       spec_ref, spec_version, lineage_verified)
+     VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
   )
   const jobInsert = db.prepare(
     `INSERT INTO aml_jobs (id, dataset_id, purpose, status, stage, progress, budget_json,
@@ -144,14 +180,14 @@ export function createAmlRepo(db: DatabaseSync) {
      VALUES (?, ?, ?, 'queued', '', 0, ?, ?, ?, ?, ?)`,
   )
   const jobState = db.prepare(
-    `UPDATE aml_jobs SET status = ?, stage = ?, progress = ? WHERE id = ?`,
+    `UPDATE aml_jobs SET status = ?, stage = ?, progress = ? WHERE id = ? AND status = ?`,
   )
   const jobFinish = db.prepare(
     `UPDATE aml_jobs SET status = ?, stage = 'done', progress = 100, metrics_json = ?, gates_json = ?,
-       artifacts_path = ?, error = ?, ended_at = ? WHERE id = ?`,
+       artifacts_path = ?, error = ?, ended_at = ?, model_id = ? WHERE id = ? AND status IN ('training','evaluating','provisioning')`,
   )
   const jobFail = db.prepare(
-    `UPDATE aml_jobs SET status = ?, error = ?, ended_at = ? WHERE id = ?`,
+    `UPDATE aml_jobs SET status = ?, error = ?, ended_at = ? WHERE id = ? AND status NOT IN ('done','failed','cancelled','timeout','interrupted')`,
   )
   const jobRetryBump = db.prepare(
     `UPDATE aml_jobs SET retry_count = retry_count + 1, status = 'queued', stage = '', progress = 0,
@@ -167,8 +203,9 @@ export function createAmlRepo(db: DatabaseSync) {
   )
   const modelInsert = db.prepare(
     `INSERT INTO aml_models (id, experiment_id, dataset_id, product_id, recipe_id, purpose, stage,
-       io_spec_json, metrics_json, path, created_by, note, label, description, line_id, objective_id, created_at)
-     VALUES (?, ?, ?, ?, ?, ?, 'candidate', ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+       io_spec_json, metrics_json, path, created_by, note, label, description, line_id, objective_id,
+       artifact_kind, schema_version, model_interface, artifact_hash, legacy, created_at)
+     VALUES (?, ?, ?, ?, ?, ?, 'candidate', ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
   )
   /** 晋升/退役:SQL 层条件更新兜底并发竞态( WHERE stage 校验) */
   const modelStage = db.prepare(
@@ -183,6 +220,7 @@ export function createAmlRepo(db: DatabaseSync) {
         dsInsert.run(
           d.id, d.lineId, d.productId, d.recipeId, JSON.stringify(d.runIds), d.specJson, d.sha256,
           d.rowCount, d.fromMs, d.toMs, d.path, d.createdBy, d.createdByKind, d.note, d.createdAt,
+          d.specRef ?? '', d.specVersion ?? null, d.lineageVerified ?? 0,
         )
       },
       get(id: string): AmlDatasetRow | undefined {
@@ -265,18 +303,28 @@ export function createAmlRepo(db: DatabaseSync) {
         ).run(now)
         return Number(r.changes)
       },
-      setState(id: string, status: AmlJobStatus, stage: string, progress: number): void {
-        jobState.run(status, stage, progress, id)
+      /** 状态迁移(CAS):仅当当前状态允许迁移时生效;返回 false = 竞争失败/非法迁移 */
+      setState(id: string, status: AmlJobStatus, stage: string, progress: number): boolean {
+        const current = this.get(id)
+        if (!current) return false
+        if (!canTransitionJob(current.status, status)) return false
+        const r = jobState.run(status, stage, progress, id, current.status)
+        return Number(r.changes) > 0
       },
       markStarted(id: string, status: AmlJobStatus, stage: string, now: string): void {
-        db.prepare(`UPDATE aml_jobs SET status = ?, stage = ?, started_at = COALESCE(started_at, ?) WHERE id = ?`)
+        db.prepare(`UPDATE aml_jobs SET status = ?, stage = ?, started_at = COALESCE(started_at, ?)
+          WHERE id = ? AND status NOT IN ('done','failed','cancelled','timeout','interrupted')`)
           .run(status, stage, now, id)
       },
-      finish(id: string, status: AmlJobStatus, metricsJson: string, gatesJson: string, artifactsPath: string, now: string): void {
-        jobFinish.run(status, metricsJson, gatesJson, artifactsPath, null, now, id)
+      /** 成功终态:只有 evaluating/provisioning(无训练步骤的内置链)可进入 done;
+       *  modelId 与本行同一事务写入,杜绝"训练成功、模型不存在"的假成功(C11)。 */
+      finish(id: string, status: AmlJobStatus, metricsJson: string, gatesJson: string, artifactsPath: string, now: string, modelId?: string | null): boolean {
+        const r = jobFinish.run(status, metricsJson, gatesJson, artifactsPath, null, now, modelId ?? null, id)
+        return Number(r.changes) > 0
       },
-      fail(id: string, status: AmlJobStatus, error: string, now: string): void {
-        jobFail.run(status, error, now, id)
+      fail(id: string, status: AmlJobStatus, error: string, now: string): boolean {
+        const r = jobFail.run(status, error, now, id)
+        return Number(r.changes) > 0
       },
       requeue(id: string): void {
         jobRetryBump.run(id)
@@ -341,11 +389,18 @@ export function createAmlRepo(db: DatabaseSync) {
         description?: string
         lineId?: string
         objectiveId?: string
+        artifactKind?: string
+        schemaVersion?: number
+        modelInterface?: string
+        artifactHash?: string
+        legacy?: string
         createdAt: string
       }): void {
         modelInsert.run(m.id, m.experimentId, m.datasetId, m.productId, m.recipeId, m.purpose,
           m.ioSpecJson, m.metricsJson, m.path, m.createdBy, m.note,
-          m.label ?? '', m.description ?? '', m.lineId ?? '', m.objectiveId ?? '', m.createdAt)
+          m.label ?? '', m.description ?? '', m.lineId ?? '', m.objectiveId ?? '',
+          m.artifactKind ?? '', m.schemaVersion ?? 1, m.modelInterface ?? '', m.artifactHash ?? '', m.legacy ?? '',
+          m.createdAt)
       },
       get(id: string): AmlModelRow | undefined {
         const r = db.prepare(`SELECT ${MODEL_COLS} FROM aml_models WHERE id = ?`).get(id)