agentworkshop 0.7.70 → 0.8.0

package/server/services/workshop/runtime/manager/host-tools.ts

@@ -11,9 +11,24 @@ import { getChannelPluginsRepo } from '../../db/channel-plugins.repo'
 import { HOST_TOOLS, createSessionState, dispatchHostTool, hostToolsForAgent } from '../../agents/host-tool-bridge'
 import { instanceToAgentInfo, rowToChannelMail } from './helpers'
 import { listPluginTools, pluginOfTool } from '../../agents/plugin-tools'
+import { auditPluginToolCall, governPluginToolCall } from '../../agents/plugin-governance'
 import { channelToolGate } from '../../tools/policy'
+import { recordOps } from '../../ops/ops'
 import { rowToMessage } from '../mailbox'
 
+/** WP4:token 路径需要留痕的协作面工具(可作数据二次外传的通道) */
+const COLLAB_AUDIT_TOOLS = new Set([
+  'send_cross_channel_message',
+  'send_message_to_agent',
+  'broadcast_message',
+  'save_memory',
+  'search_memory',
+  'poll_messages',
+  'read_channel_mail',
+  'list_other_teams',
+  'search_other_teams_memory',
+])
+
 export abstract class ManagerHostTools extends ManagerA2A {
   /**
    * 工具桥(协作工具族):按 agentId 定位 channel 并调用其 workspace 方法。
@@ -82,7 +97,8 @@ export abstract class ManagerHostTools extends ManagerA2A {
     const row = this.deps.repos.channelAgents.findById(input.agentId)
     if (!row || row.enabled !== 1) throw new AppError(404, 'NOT_FOUND', `agent 不存在或已停用: ${input.agentId}`)
     // token 鉴权(MCP 桥路径必带;缺省视为服务端内部调用,走 REST 已有用户鉴权)
-    if (input.token !== undefined && input.token !== row.token) {
+    // WP3:走 repo 单点校验(常量时间 + 轮换宽限窗),四路调用点同源
+    if (input.token !== undefined && !this.deps.repos.channelAgents.isTokenValid(row, input.token)) {
       throw new AppError(401, 'UNAUTHORIZED', 'agent token 校验失败')
     }
     // ── 人类权限作用域判定(§13.3)────────────────────────────────────────────
@@ -96,13 +112,18 @@ export abstract class ManagerHostTools extends ManagerA2A {
     }
     // 工具执行错误(业务约束/目标不存在等)一律降级为 isError 文本——
     // 绝不让 AppError 以 unhandledRejection 逃逸拖垮 worker(stability-guard 会因此退出整进程)
+    // WP4:所有返回路径统一过协作审计(插件/原生/dispatch/兜底)
+    const finish = <T extends { text: string, isError?: boolean }>(inp: typeof input, r: T): T => {
+      this.auditCollabInvocation(inp, r)
+      return r
+    }
     try {
       // 活性登记:调度器停滞看门狗以「最近工具调用」为健康信号(见 SchedulerLoopOptions.toolActivityOf)
       this.lastToolInvokeAt.set(input.agentId, Date.now())
       // Channel 逐工具选择:插件分支会提前 return,必须在此先复核(不能只靠 dispatch)。
       {
         const gate = channelToolGate(row.channelId, input.tool)
-        if (gate.blocked) return { text: gate.message ?? `工具 ${input.tool} 不可用`, isError: true }
+        if (gate.blocked) return finish(input, { text: gate.message ?? `工具 ${input.tool} 不可用`, isError: true })
       }
       // 插件工具:团队开关过滤 + handler 直调(ctx.omp 注册的自定义工具全 harness 同源)
       // 内置同名工具优先(与 dispatch 同口径):插件覆盖不得跳过工业门控
@@ -128,19 +149,30 @@ export abstract class ManagerHostTools extends ManagerA2A {
             isError: true,
           }
         }
-        return await pluginTool.handler(input.args ?? {}, identity)
+        // 平台侧插件治理(WP4b/WP8):kb 入库 HITL + 声明式引用校验(与 dispatch 同源)
+        const governed = await governPluginToolCall(identity, input.tool, input.args ?? {}, pluginTool)
+        if (governed) return finish(input, governed)
+        try {
+          const result = await pluginTool.handler(input.args ?? {}, identity)
+          auditPluginToolCall(identity, input.tool, result)
+          return finish(input, result)
+        }
+        catch (err) {
+          auditPluginToolCall(identity, input.tool, { text: err instanceof Error ? err.message : String(err), isError: true })
+          throw err
+        }
       }
       const runtime = this.ensureAgentRuntime(row.channelId, input.agentId)
       if (runtime) {
         const viaImpl = await runtime.dispatchHostTool(input.tool, input.args ?? {})
-        if (viaImpl) return viaImpl
+        if (viaImpl) return finish(input, viaImpl)
       }
       // 回退:impl 未实现 dispatchHostTool(如 mock)→ 仍走**同一份** host-tool-bridge
       // 分发,而不是只支持 3 个协作工具的旧开关。否则同一工具在 omp 上可用、在
       // mock/无工具面引擎经 MCP 桥调用却报“不支持该协作工具”(2026-10-20 实测)。
       const workspace = runtime?.workspace
       if (workspace) {
-        return await dispatchHostTool({
+        return finish(input, await dispatchHostTool({
           identity: {
             agentId: row.id,
             channelId: row.channelId,
@@ -149,15 +181,40 @@ export abstract class ManagerHostTools extends ManagerA2A {
           },
           state: createSessionState(),
           getWorkspace: () => workspace,
-        }, { toolName: input.tool, arguments: input.args ?? {} })
+        }, { toolName: input.tool, arguments: input.args ?? {} }))
       }
       // 最后兜底:仅剩不依赖 Agent 运行时的跨 Channel/团队只读面
-      return await this.invokeAgentWorkspaceTool(input.agentId, input.tool, input.args ?? {})
+      return finish(input, await this.invokeAgentWorkspaceTool(input.agentId, input.tool, input.args ?? {}))
     }
     catch (err) {
       const reason = err instanceof Error ? err.message : String(err)
-      return { text: `工具「${input.tool}」调用失败: ${reason}`, isError: true }
+      return finish(input, { text: `工具「${input.tool}」调用失败: ${reason}`, isError: true })
+    }
+  }
+
+  /**
+   * WP4:token 来源的协作面调用留痕(不改变可达性 —— 桥主循环依赖 poll_messages)。
+   * 目的:token 泄露时可经跨频道消息/记忆二次外传,审计面必须能回溯「谁在何时调了什么」。
+   */
+  private auditCollabInvocation(input: { agentId: string, token?: string, tool: string }, result: { text?: string, isError?: boolean }): void {
+    if (input.token === undefined) return
+    if (process.env.AW_COLLAB_AUDIT === '0') return
+    if (!COLLAB_AUDIT_TOOLS.has(input.tool)) return
+    try {
+      recordOps({
+        actor: input.agentId,
+        actorName: input.agentId,
+        actorKind: 'agent',
+        action: 'tool.call.collaboration',
+        kind: 'system',
+        level: result.isError ? 'warn' : 'info',
+        targetKind: 'tool',
+        targetId: input.tool,
+        summary: `Agent token 路径调用协作面工具:${input.tool}(${result.isError ? '失败' : '成功'})`,
+        detail: { tool: input.tool, isError: Boolean(result.isError), text: String(result.text ?? '').slice(0, 300) },
+      })
     }
+    catch { /* 审计失败不阻断工具结果 */ }
   }
 
   /** 按 token 解析 agent(桥侧只需 token 的自证路径;未命中返回 null) */

package/server/services/workshop/runtime/manager/types.ts

@@ -79,8 +79,8 @@ export interface AgentTemplateDetail {
   isBuiltin: boolean
   /** 归属用户(null = 内置公共) */
   ownerUserId: string | null
-  /** 该模板克隆出的全部实例(跨 channel) */
-  instances: Array<{ id: string, channelId: string, role: 'lead' | 'worker', token: string }>
+  /** 该模板克隆出的全部实例(跨 channel;WP3:只回 token 尾 4 位) */
+  instances: Array<{ id: string, channelId: string, role: 'lead' | 'worker', tokenTail: string }>
   createdAt: string
   updatedAt: string
 }

package/server/services/workshop/settings.ts

@@ -142,10 +142,19 @@ export interface RetentionSettings {
   audit_days: number
   approval_days: number
   analysis_days: number
+  /** Optimizer 运行/候选/建议/收益台账保留天数 */
+  optimizer_days: number
+  /** Process Model 资格/试验台账保留天数 */
+  process_model_days: number
 }
 export interface LogSettings {
   level: 'debug' | 'info' | 'warn' | 'error'
 }
+export interface OptimizerSolverSettings {
+  poolSize: number
+  requestTimeoutMs: number
+  threads: number
+}
 export interface DaqRuntimeSettings {
   mqtt: {
     host: string
@@ -204,6 +213,30 @@ export const harnessContinuityEnabled = (): boolean => workshopFlag('harness_con
 export const channelMemoryDigestEnabled = (): boolean => workshopFlag('channel_memory_digest_enabled', true)
 export const backupSettings = (): BackupSettings => section<BackupSettings>('backup')
 export const retentionSettings = (): RetentionSettings => section<RetentionSettings>('retention')
+export const optimizerSolverSettings = (): OptimizerSolverSettings => {
+  const s = section<Record<string, unknown>>('optimizer')
+  const num = (key: string, dflt: number): number => {
+    const value = Number(s[`solver.${key}`] ?? dflt)
+    return Number.isFinite(value) ? value : dflt
+  }
+  return {
+    poolSize: Math.max(1, Math.min(num('poolSize', 1), 4)),
+    requestTimeoutMs: Math.max(1000, num('requestTimeoutMs', 30_000)),
+    threads: Math.max(1, Math.min(num('threads', 1), 16)),
+  }
+}
+/** 互校逐 CV 无量纲一致性容差(数值精度级;上限 1e-3 防止把门放宽到失效) */
+export const optimizerCrosscheckTol = (): number => {
+  const s = section<Record<string, unknown>>('optimizer')
+  const value = Number(s['crosscheck.tol'] ?? 1e-6)
+  return Number.isFinite(value) ? Math.max(1e-10, Math.min(value, 1e-3)) : 1e-6
+}
+/** 工件 UQ 校准保鲜天数;超期建议降级 unverified */
+export const amlUqFreshDays = (): number => {
+  const s = section<Record<string, unknown>>('aml')
+  const value = Number(s['uq.freshDays'] ?? 7)
+  return Number.isFinite(value) ? Math.max(1, Math.min(value, 365)) : 7
+}
 export const logSettings = (): LogSettings => section<LogSettings>('log')
 export function daqRuntimeSettings(): DaqRuntimeSettings {
   const e = effective()

package/server/services/workshop/tools/catalog-view.ts

@@ -36,7 +36,9 @@ export interface ToolCatalogRow {
 export interface ChannelToolView {
   channelId: string
   mode: 'all' | 'selected'
-  source: 'default' | 'explicit'
+  /** WP7:degraded/cached = 数据库读取失败后的降级来源(前端可提示「策略为最近快照」) */
+  source: 'default' | 'explicit' | 'cached' | 'degraded'
+  stale?: boolean
   updatedBy: string
   updatedAt: string | null
   stats: {
@@ -169,6 +171,7 @@ export function buildChannelToolView(channelId: string): ChannelToolView {
     channelId,
     mode: policy.mode,
     source: policy.source,
+    ...(policy.stale ? { stale: true } : {}),
     updatedBy: policy.updatedBy,
     updatedAt: policy.updatedAt,
     stats: {

package/server/services/workshop/tools/policy.ts

@@ -8,13 +8,40 @@
  * 无策略行(默认)= mode='all' + 全部合格工具启用,保证存量 Channel 行为不变。
  */
 import { getToolRegistryRepo, type ChannelToolPolicySnapshot, type ToolPolicyMode } from '../db/tool-registry.repo'
+import { HYBRID_TWIN_DIRECT_WRITE_TOOL_NAMES } from '../agents/tool-classes'
 import { createLogger } from '../logger'
 
 const log = createLogger('workshop.tool-policy')
 
 let warnedAt = 0
 
-/** 读取策略;DB 故障时降级为默认(全部合格工具启用)并限频告警。 */
+/**
+ * WP7 分级降级:
+ *  - 读取成功 → 更新「最近已知快照」缓存;
+ *  - 读取失败但有缓存(≤5min)→ 用缓存 + stale 标记(读面继续可用,写面由闸门按族拒);
+ *  - 读取失败且无缓存 → selected + 空集(=全拒;比"降级全启用"更安全);
+ *  - env AW_POLICY_DEGRADE=open 回到旧的 fail-open(灰度观察期用,启动期 audit warn)。
+ */
+const lastGood = new Map<string, { snapshot: ChannelToolPolicySnapshot, at: number }>()
+const STALE_MS = 5 * 60_000
+let degradeWarned = false
+
+/** 写族:策略/目录不可判定时这些工具一律拒绝(物理安全优先) */
+const POLICY_WRITE_TOOL_NAMES = new Set<string>([...HYBRID_TWIN_DIRECT_WRITE_TOOL_NAMES, 'line_start', 'line_stop'])
+export function isPolicyWriteTool(name: string): boolean {
+  return POLICY_WRITE_TOOL_NAMES.has(name)
+}
+
+function failOpenMode(): boolean {
+  if (process.env.AW_POLICY_DEGRADE !== 'open') return false
+  if (!degradeWarned) {
+    degradeWarned = true
+    log.warn('AW_POLICY_DEGRADE=open:策略读取失败将降级为全启用(fail-open);安全开关打开态请尽快关闭')
+  }
+  return true
+}
+
+/** 读取策略;DB 故障时按 WP7 分级降级(缓存→stale;无缓存→全拒;fail-open 仅显式开关) */
 export function getPolicySnapshot(channelId: string): ChannelToolPolicySnapshot {
   const fallback: ChannelToolPolicySnapshot = {
     channelId,
@@ -26,14 +53,25 @@ export function getPolicySnapshot(channelId: string): ChannelToolPolicySnapshot
   }
   if (!channelId) return fallback
   try {
-    return getToolRegistryRepo().snapshot(channelId)
+    const snapshot = getToolRegistryRepo().snapshot(channelId)
+    lastGood.set(channelId, { snapshot, at: Date.now() })
+    return snapshot
   }
   catch (err) {
+    const cached = lastGood.get(channelId)
+    if (cached && Date.now() - cached.at <= STALE_MS) {
+      if (Date.now() - warnedAt > 60_000) {
+        warnedAt = Date.now()
+        log.warn(`读取 Channel 工具策略失败,使用最近已知快照(${Math.round((Date.now() - cached.at) / 1000)}s 前): ${err instanceof Error ? err.message : String(err)}`)
+      }
+      return { ...cached.snapshot, source: 'cached', stale: true, ageMs: Date.now() - cached.at }
+    }
+    if (failOpenMode()) return fallback
     if (Date.now() - warnedAt > 60_000) {
       warnedAt = Date.now()
-      log.warn(`读取 Channel 工具策略失败,降级为默认全启用: ${err instanceof Error ? err.message : String(err)}`)
+      log.warn(`读取 Channel 工具策略失败且无可用快照,降级为全拒(selected+空集): ${err instanceof Error ? err.message : String(err)}`)
     }
-    return fallback
+    return { ...fallback, mode: 'selected', source: 'degraded', stale: true }
   }
 }
 
@@ -51,19 +89,22 @@ export function applyChannelToolPolicy<T extends { name: string }>(tools: T[], c
   return tools.filter(t => isChannelToolEnabled(policy, t.name))
 }
 
-export type ToolGateReason = 'CHANNEL_TOOL_DISABLED' | 'UNAVAILABLE'
+export type ToolGateReason = 'CHANNEL_TOOL_DISABLED' | 'UNAVAILABLE' | 'POLICY_UNAVAILABLE'
 
 export interface ToolGateResult {
   blocked: boolean
   reason?: ToolGateReason
   message?: string
+  /** WP7:策略读取降级(读面放行但带降级标记;写面不会带此标记——已被拒) */
+  degraded?: boolean
 }
 
 /**
  * 执行面闸门:
  *  - 未知工具不在这里拦截(保持既有“未知工具”错误语义);
  *  - 目录中存在但当前未注册(unavailable)→ 拒绝;
- *  - 本 Channel 显式停用 → 拒绝。
+ *  - 本 Channel 显式停用 → 拒绝;
+ *  - WP7:目录读取失败时,写族 fail-closed(物理安全优先),读族放行并带 degraded 标记。
  */
 export function channelToolGate(channelId: string, toolName: string): ToolGateResult {
   if (!channelId) return { blocked: false }
@@ -72,8 +113,15 @@ export function channelToolGate(channelId: string, toolName: string): ToolGateRe
     row = getToolRegistryRepo().get(toolName)
   }
   catch {
-    // 目录不可读时不阻断执行(硬安全规则仍在);与策略读取同一 fail-open 口径
-    return { blocked: false }
+    // 目录不可读:写族必须拒(策略不可判定时不得放行物理写);读族降级可用
+    if (isPolicyWriteTool(toolName)) {
+      return {
+        blocked: true,
+        reason: 'POLICY_UNAVAILABLE',
+        message: `工具「${toolName}」属写族,当前工具目录不可读(策略无法判定),已按安全默认拒绝。请稍后重试;若持续出现请联系管理员。`,
+      }
+    }
+    return { blocked: false, degraded: true }
   }
   if (!row) return { blocked: false }
   if (!row.available) {
@@ -88,10 +136,12 @@ export function channelToolGate(channelId: string, toolName: string): ToolGateRe
     return {
       blocked: true,
       reason: 'CHANNEL_TOOL_DISABLED',
-      message: `本 Channel 已在「设置 → 工具」中停用「${toolName}」。请让 Channel 属主在工具管理中启用后重试;硬规则排除的工具不能通过开关绕过。`,
+      message: policy.stale
+        ? `本 Channel 已在「设置 → 工具」中停用「${toolName}」(策略为最近已知快照,数据库暂不可读)。请稍后重试或联系 Channel 属主。`
+        : `本 Channel 已在「设置 → 工具」中停用「${toolName}」。请让 Channel 属主在工具管理中启用后重试;硬规则排除的工具不能通过开关绕过。`,
     }
   }
-  return { blocked: false }
+  return { blocked: false, ...(policy.stale ? { degraded: true } : {}) }
 }
 
 /** API 写入前的模式校验 */

package/server/services/workshop/tools/registry.ts

@@ -10,10 +10,12 @@
  */
 import { createHash } from 'node:crypto'
 import { HOST_TOOLS } from '../agents/host-tool-bridge/catalog'
-import { LEAD_ONLY_TOOL_NAMES } from '../agents/tool-classes'
+import { HYBRID_TWIN_DIRECT_WRITE_TOOL_NAMES, LEAD_ONLY_TOOL_NAMES } from '../agents/tool-classes'
 import { listPluginTools, onPluginToolsChange, pluginOfTool } from '../agents/plugin-tools'
 import { pluginManifest } from '../plugins/host.mjs'
 import { createLogger } from '../logger'
+import { recordOps } from '../ops/ops'
+import { declarationVerdict } from '../agents/tool-reference-spec'
 import {
   getToolRegistryRepo,
   type ToolRegistryUpsert,
@@ -22,6 +24,20 @@ import {
 
 const log = createLogger('workshop.tool-registry')
 
+/**
+ * WP5 登记制:工业工具必须声明引用面(references 或 noRefs)。
+ * 写族未声明 → 拒绝登记(不进目录 = 注入面与执行面双关);读族未声明 → 放行+告警入册。
+ * 声明字段来自 host-tools.json(迁移脚本 scripts/tool-references-migrate.ts)。
+ */
+const EXTRA_WRITE_TOOL_NAMES = new Set(['line_start', 'line_stop'])
+function isWriteFamily(name: string, riskClass?: string): boolean {
+  return riskClass === 'write' || HYBRID_TWIN_DIRECT_WRITE_TOOL_NAMES.has(name) || EXTRA_WRITE_TOOL_NAMES.has(name)
+}
+const warnedUndeclared = new Set<string>()
+function declarationVerdictOf(tool: { name: string, references?: unknown, noRefs?: boolean, riskClass?: string }): 'ok' | 'undeclared-write' | 'undeclared-read' {
+  return declarationVerdict(tool, isWriteFamily(tool.name, tool.riskClass))
+}
+
 export interface ToolRegistrySyncResult {
   builtin: number
   plugin: number
@@ -104,6 +120,7 @@ const GROUP_BY_PREFIX: Record<string, string> = {
   twin: 'twin',
   mpc: 'twin',
   optimization: 'twin',
+  optimizer: 'optimization',
   team: 'team',
   exp: 'experience',
   analysis: 'analysis',
@@ -136,6 +153,28 @@ function hashOf(row: Omit<ToolRegistryUpsert, 'definitionHash'>): string {
 export function buildToolRegistrySnapshot(): ToolRegistryUpsert[] {
   const out = new Map<string, ToolRegistryUpsert>()
   for (const tool of HOST_TOOLS) {
+    // WP5 登记制:写族未声明引用面 → 不登记(unavailable → 注入/执行双关)
+    const verdict = declarationVerdictOf(tool)
+    if (verdict === 'undeclared-write') {
+      log.error(`工具「${tool.name}」属写族但未声明 references/noRefs,拒绝登记(注入面与执行面均不可用)`)
+      recordOps({
+        actor: 'system', actorName: 'tool-registry', actorKind: 'system',
+        action: 'tool.registry.rejected', kind: 'system', level: 'warn',
+        targetKind: 'tool', targetId: tool.name,
+        summary: `写族工具未声明引用面,拒绝登记:${tool.name}`,
+      })
+      continue
+    }
+    if (verdict === 'undeclared-read' && !warnedUndeclared.has(tool.name)) {
+      warnedUndeclared.add(tool.name)
+      log.warn(`工具「${tool.name}」未声明 references/noRefs,按无引用工具登记(限期补齐)`)
+      recordOps({
+        actor: 'system', actorName: 'tool-registry', actorKind: 'system',
+        action: 'tool.registry.undeclared', kind: 'system', level: 'warn',
+        targetKind: 'tool', targetId: tool.name,
+        summary: `工具未声明引用面(references/noRefs):${tool.name}`,
+      })
+    }
     const safe = safeParameters(tool.parameters)
     const base: Omit<ToolRegistryUpsert, 'definitionHash'> = {
       name: tool.name,
@@ -150,6 +189,8 @@ export function buildToolRegistrySnapshot(): ToolRegistryUpsert[] {
       metadata: {
         builtin: true,
         hidden: Boolean(tool.hidden),
+        riskClass: tool.riskClass ?? '',
+        referencesDeclared: Boolean(tool.references || tool.noRefs),
         ...(safe.error ? { schemaError: safe.error } : {}),
       },
     }

package/shared/config/schema.json

@@ -18,6 +18,7 @@
     { "key": "theme.mode", "type": "select", "group": "theme", "label": "显示模式", "labelKey": "settings.runtime.theme.mode", "description": "全局默认深浅色；用户本地切换偏好优先", "applies": "live", "default": "light", "options": ["light", "dark"] },
 
     { "key": "i18n.defaultLocale", "type": "select", "group": "i18n", "label": "默认语言", "labelKey": "settings.runtime.i18n.defaultLocale", "description": "未做本地选择时的界面语言", "applies": "live", "default": "zh-CN", "options": ["zh-CN", "en"] },
+
     { "key": "time.timeZone", "type": "timezone", "group": "time", "label": "系统时区", "labelKey": "settings.runtime.time.timeZone", "description": "日志、聊天、审计、Agent 记录与定时任务使用的 IANA 时区；DAQ 原始时间轴仍保存绝对时间", "applies": "live", "default": "Asia/Shanghai" },
 
     { "key": "security.approvalGate", "type": "boolean", "group": "security", "label": "高危操作双人复核", "labelKey": "settings.runtime.security.approvalGate", "description": "R3：开启后写控/删除等高风险操作需另一位管理员批核", "applies": "live", "default": false },
@@ -38,7 +39,6 @@
     { "key": "daq.objectstore.accessKey", "type": "string", "group": "daq", "label": "对象存储 AccessKey", "labelKey": "settings.runtime.daq.osAccess", "description": "MinIO 访问账号", "applies": "restart", "default": "awshop" },
     { "key": "daq.objectstore.secretKey", "type": "string", "group": "daq", "label": "对象存储 SecretKey", "labelKey": "settings.runtime.daq.osSecret", "description": "MinIO 访问密钥", "applies": "restart", "default": "awshop-secret" },
     { "key": "daq.objectstore.bucket", "type": "string", "group": "daq", "label": "对象存储桶", "labelKey": "settings.runtime.daq.osBucket", "description": "图像帧存储桶(不存在时自动创建)", "applies": "restart", "default": "daq" },
-
     { "key": "daq.mqtt.qos", "type": "number", "group": "daq", "label": "MQTT QoS", "labelKey": "settings.runtime.daq.mqttQos", "description": "数采事件总线发布 QoS(0/1/2)", "applies": "restart", "default": 0, "min": 0, "max": 2, "aliases": ["DAQ_MQTT_QOS"] },
     { "key": "daq.mqtt.username", "type": "string", "group": "daq", "label": "MQTT 用户名", "labelKey": "settings.runtime.daq.mqttUsername", "description": "数采事件总线 MQTT 鉴权用户名(空=匿名)", "applies": "restart", "default": "", "aliases": ["DAQ_MQTT_USERNAME"] },
     { "key": "daq.mqtt.password", "type": "string", "group": "daq", "label": "MQTT 密码", "labelKey": "settings.runtime.daq.mqttPassword", "description": "数采事件总线 MQTT 鉴权密码", "applies": "restart", "default": "", "aliases": ["DAQ_MQTT_PASSWORD"] },
@@ -76,15 +76,15 @@
     { "key": "harness.opencode_command", "type": "string", "group": "harness", "label": "opencode 命令", "labelKey": "settings.runtime.harness.opencodeCommand", "description": "OpenCode 引擎可执行文件(PATH 解析)", "applies": "restart", "default": "opencode" },
     { "key": "harness.codex_command", "type": "string", "group": "harness", "label": "codex 命令", "labelKey": "settings.runtime.harness.codexCommand", "description": "OpenAI Codex CLI 可执行文件(app-server 模式)", "applies": "restart", "default": "codex" },
     { "key": "harness.dsh_command", "type": "string", "group": "harness", "label": "dsh 命令", "labelKey": "settings.runtime.harness.dshCommand", "description": "DeepSeek Harness 可执行文件(ACP 模式)", "applies": "restart", "default": "dsh" },
-{ "key": "harness.gemini_command", "type": "string", "group": "harness", "label": "gemini 命令", "labelKey": "settings.runtime.harness.geminiCommand", "description": "Google Gemini CLI 可执行文件(stream-json 无头)", "applies": "restart", "default": "gemini" },
+    { "key": "harness.gemini_command", "type": "string", "group": "harness", "label": "gemini 命令", "labelKey": "settings.runtime.harness.geminiCommand", "description": "Google Gemini CLI 可执行文件(stream-json 无头)", "applies": "restart", "default": "gemini" },
     { "key": "harness.qwen_command", "type": "string", "group": "harness", "label": "qwen 命令", "labelKey": "settings.runtime.harness.qwenCommand", "description": "Qwen Code 可执行文件(experimental-acp 模式)", "applies": "restart", "default": "qwen" },
     { "key": "harness.copilot_command", "type": "string", "group": "harness", "label": "copilot 命令", "labelKey": "settings.runtime.harness.copilotCommand", "description": "GitHub Copilot CLI 可执行文件(JSONL 无头)", "applies": "restart", "default": "copilot" },
     { "key": "harness.cursor_command", "type": "string", "group": "harness", "label": "cursor 命令", "labelKey": "settings.runtime.harness.cursorCommand", "description": "Cursor CLI 可执行文件(stream-json 无头)", "applies": "restart", "default": "cursor-agent" },
     { "key": "harness.crush_command", "type": "string", "group": "harness", "label": "crush 命令", "labelKey": "settings.runtime.harness.crushCommand", "description": "Charm Crush 可执行文件(run 非交互模式)", "applies": "restart", "default": "crush" },
-{ "key": "harness.goose_command", "type": "string", "group": "harness", "label": "goose 命令", "labelKey": "settings.runtime.harness.gooseCommand", "description": "Block Goose 可执行文件(run stream-json 无头)", "applies": "restart", "default": "goose" },
+    { "key": "harness.goose_command", "type": "string", "group": "harness", "label": "goose 命令", "labelKey": "settings.runtime.harness.gooseCommand", "description": "Block Goose 可执行文件(run stream-json 无头)", "applies": "restart", "default": "goose" },
     { "key": "harness.pi_command", "type": "string", "group": "harness", "label": "pi 命令", "labelKey": "settings.runtime.harness.piCommand", "description": "pi coding agent 可执行文件(-p --mode json 无头)", "applies": "restart", "default": "pi" },
     { "key": "harness.hermes_command", "type": "string", "group": "harness", "label": "hermes 命令", "labelKey": "settings.runtime.harness.hermesCommand", "description": "Hermes Agent 可执行文件(acp 模式)", "applies": "restart", "default": "hermes" },
-            { "key": "harness.hitl_timeout_ms", "type": "number", "group": "harness", "label": "引擎审批超时(ms)", "labelKey": "settings.runtime.harness.hitlTimeoutMs", "description": "codex/opencode/dsh 权限审批无人应答的自动拒绝时限(0=无限等待)", "applies": "restart", "default": 300000, "min": 0, "max": 3600000 },
+    { "key": "harness.hitl_timeout_ms", "type": "number", "group": "harness", "label": "引擎审批超时(ms)", "labelKey": "settings.runtime.harness.hitlTimeoutMs", "description": "codex/opencode/dsh 权限审批无人应答的自动拒绝时限(0=无限等待)", "applies": "restart", "default": 300000, "min": 0, "max": 3600000 },
 
     { "key": "dcw.rollback_cooldown_ms", "type": "number", "group": "dcw", "label": "回退冷却(ms)", "labelKey": "settings.runtime.dcw.rollbackCooldownMs", "description": "回退执行后的同向冷却窗", "applies": "restart", "default": 300000, "min": 0, "max": 3600000 },
     { "key": "dcw.rollback_min_window_ms", "type": "number", "group": "dcw", "label": "回退最小观察窗(ms)", "labelKey": "settings.runtime.dcw.rollbackMinWindowMs", "description": "开记录后允许判定的最小观察窗", "applies": "restart", "default": 120000, "min": 0, "max": 3600000 },
@@ -117,6 +117,8 @@
     { "key": "retention.audit_days", "type": "number", "group": "retention", "label": "审计日志保留(天)", "labelKey": "settings.runtime.retention.auditDays", "description": "审计日志保留天数(合规观察期,从严保留)", "applies": "restart", "default": 90, "min": 1, "max": 3650 },
     { "key": "retention.approval_days", "type": "number", "group": "retention", "label": "审批历史保留(天)", "labelKey": "settings.runtime.retention.approvalDays", "description": "审批历史保留天数(历史裁决主张不可变,放宽)", "applies": "restart", "default": 180, "min": 1, "max": 3650 },
     { "key": "retention.analysis_days", "type": "number", "group": "retention", "label": "分析报告保留(天)", "labelKey": "settings.runtime.retention.analysisDays", "description": "数据分析报告台账保留天数(数据留痕,宽松保留)", "applies": "restart", "default": 365, "min": 1, "max": 3650 },
+    { "key": "retention.optimizer_days", "type": "number", "group": "retention", "label": "优化运行保留(天)", "labelKey": "settings.runtime.retention.optimizerDays", "description": "Optimizer 运行/候选/建议/收益台账保留天数", "applies": "restart", "default": 365, "min": 1, "max": 3650 },
+    { "key": "retention.process_model_days", "type": "number", "group": "retention", "label": "过程模型台账保留(天)", "labelKey": "settings.runtime.retention.processModelDays", "description": "过程模型资格报告与模拟试验台账保留天数", "applies": "restart", "default": 365, "min": 1, "max": 3650 },
 
     { "key": "log.level", "type": "string", "group": "log", "label": "日志级别", "labelKey": "settings.runtime.log.level", "description": "服务端日志级别(debug/info/warn/error)", "applies": "restart", "default": "info", "aliases": ["AWSHOP_LOG_LEVEL"] },
 
@@ -136,6 +138,13 @@
     { "key": "aml.gates.valTestGap", "type": "number", "group": "aml", "label": "门禁:泛化差", "labelKey": "settings.runtime.aml.gateValTestGap", "description": "门禁 G3:|test-val|/val 相对差上限(防过拟合验证集)", "applies": "live", "default": 0.2, "min": 0.01, "max": 2 },
     { "key": "aml.gates.minRows", "type": "number", "group": "aml", "label": "门禁:最少样本行", "labelKey": "settings.runtime.aml.gateMinRows", "description": "门禁 G4a:数据集滑窗样本行数下限", "applies": "live", "default": 500, "min": 50, "max": 1000000 },
     { "key": "aml.gates.minRuns", "type": "number", "group": "aml", "label": "门禁:最少批次数", "labelKey": "settings.runtime.aml.gateMinRuns", "description": "门禁 G4b:数据集覆盖的批次(run)数下限", "applies": "live", "default": 3, "min": 1, "max": 1000 },
-    { "key": "mcp.enabled", "type": "boolean", "group": "mcp", "label": "启动 MCP 集成", "labelKey": "settings.runtime.mcp.enabled", "description": "允许 aw 工业 MCP(mcp/aw-mcp-server.mjs)连接并操作本实例;停用后 MCP 工具调用将被拒绝(平台 REST 与频道内 agent 不受影响)。也可用环境变量 AW_MCP_ENABLED 覆盖。", "applies": "live", "default": false, "aliases": ["AW_MCP_ENABLED"] }
+    { "key": "aml.uq.freshDays", "type": "number", "group": "aml", "label": "UQ 证据保鲜天数", "labelKey": "settings.runtime.aml.uqFreshDays", "description": "工件 UQ 校准时间(calibratedAt)超过该天数后建议降级 unverified(需重训刷新证据)", "applies": "live", "default": 7, "min": 1, "max": 365 },
+
+    { "key": "mcp.enabled", "type": "boolean", "group": "mcp", "label": "启动 MCP 集成", "labelKey": "settings.runtime.mcp.enabled", "description": "允许 aw 工业 MCP(mcp/aw-mcp-server.mjs)连接并操作本实例;停用后 MCP 工具调用将被拒绝(平台 REST 与频道内 agent 不受影响)。也可用环境变量 AW_MCP_ENABLED 覆盖。", "applies": "live", "default": false, "aliases": ["AW_MCP_ENABLED"] },
+
+    { "key": "optimizer.solver.poolSize", "type": "number", "group": "optimizer", "label": "Solver 进程池上限", "labelKey": "settings.runtime.optimizer.poolSize", "description": "本地 Python Solver 进程池大小(每进程同时 1 个 solve)", "applies": "restart", "default": 1, "min": 1, "max": 4 },
+    { "key": "optimizer.solver.requestTimeoutMs", "type": "number", "group": "optimizer", "label": "Solver 请求超时(ms)", "labelKey": "settings.runtime.optimizer.requestTimeoutMs", "description": "单次求解硬超时;超时终止独占 Worker 进程", "applies": "restart", "default": 30000, "min": 1000, "max": 600000 },
+    { "key": "optimizer.solver.threads", "type": "number", "group": "optimizer", "label": "Solver 线程预算", "labelKey": "settings.runtime.optimizer.threads", "description": "求解进程 OMP/OPENBLAS/MKL/NUMEXPR 线程数(避免与训练抢占)", "applies": "restart", "default": 1, "min": 1, "max": 16 },
+    { "key": "optimizer.crosscheck.tol", "type": "number", "group": "optimizer", "label": "互校一致性容差", "labelKey": "settings.runtime.optimizer.crosscheckTol", "description": "候选互校逐 CV 无量纲数值一致性门限(默认数值精度级;调大仅用于诊断,放宽不改变证据要求)", "applies": "live", "default": 0.000001, "min": 0.0000000001, "max": 0.001 }
   ]
 }

package/shared/dcw-protocol/line.ts

@@ -31,12 +31,21 @@ export interface LineView {
    * 存量数据无此字段时按 'manual' 生效(读侧归一,见 DcwLineRepo.controlModeOf)。
    */
   controlMode?: 'auto' | 'manual'
+  /**
+   * 是否为模拟器产线(C9/A9):只有 simulated=true 的线允许发起"模拟参数试验";
+   * 真实线缺失该字段 = false(默认拒绝)。建线时由 seed/bench 脚本显式置位。
+   */
+  simulated?: boolean
+  /** 模拟器场景 id(plant-runtime 引擎 key;仅诊断展示用) */
+  simSceneId?: string
 }
 
 export interface LineInput {
   name: string
   color?: string
   description?: string
+  simulated?: boolean
+  simSceneId?: string
   /** 线级控制模式总闸;缺省 'manual';manual→auto 须 confirm:true(服务端强制) */
   controlMode?: 'auto' | 'manual'
   /** manual→auto 的显式风险确认(严格 === true;仅 patch 入参用,不落盘) */

package/shared/dcw-protocol/recipe.ts

@@ -265,6 +265,8 @@ export interface RecipeRunView {
   productId: string
   /** 所属产线(自配方继承) */
   lineId: string
+  /** 建批时冻结的配方版本(0/缺省 = 历史未知;C8 版本谱系证据) */
+  recipeVersion?: number
   startedAt: string
   endedAt: string | null
   /** apply 时逐参数写结果快照(节点级寻址);ack/verify 为 2026-10-08 ACK 鉴定增量 */