agentworkshop 0.8.6 → 0.8.8

package/server/services/workshop/agents/omp-agent/tools-steer.ts

@@ -4,15 +4,83 @@
  */
 import { OmpRpcAgentImplLifecycle } from './lifecycle'
 import type { AgentEvent, AgentRunContext, AgentRunRequest, SupervisionDecision, SupervisionSnapshot, SupervisionOptions } from '../agent-interface'
-import type { HostToolCallRequest } from '../adapters/omp-rpc-client'
+import type { HostToolCallRequest, OmpRpcClient } from '../adapters/omp-rpc-client'
 import { extractJsonArray, parseSteerBanner, peerPrompt, supervisePrompt, systemManual, workerPrompt } from '../prompt-builder'
 import { log } from './helpers'
 import { recordSupervisionToolHistory } from './supervision-history'
+import { ompAgentTeamAuditFailure, recordOmpAgentTeamToolEvent } from './agentteam-audit'
+import { TERMINAL_TASK_STATES } from '../../types/task'
 
 export abstract class OmpRpcAgentImplToolsSteer extends OmpRpcAgentImplLifecycle {
+  protected activeSupervisionToolLease: {
+    client: OmpRpcClient
+    rootId: string | null
+    rootActive: boolean
+    signal?: AbortSignal
+  } | null = null
+
+  protected retireSupervisionClient(client: OmpRpcClient): void {
+    if (this.client === client) this.client = null
+    if (this.activeSupervisionToolLease?.client === client) this.activeSupervisionToolLease = null
+    this.hostToolsRegistered = false
+    client.kill()
+  }
+
+  protected async retireEndedSupervisionClient(nextRootId?: string | null): Promise<void> {
+    const lease = this.activeSupervisionToolLease
+    if (!lease?.rootId || lease.client !== this.client) return
+    if (lease.signal?.aborted) {
+      this.retireSupervisionClient(lease.client)
+      return
+    }
+    if (nextRootId !== undefined && lease.rootId !== nextRootId) {
+      this.retireSupervisionClient(lease.client)
+      return
+    }
+    const rootTask = await this.workspace?.getTask(lease.rootId).catch(() => null)
+    if (!rootTask || TERMINAL_TASK_STATES[rootTask.state]) this.retireSupervisionClient(lease.client)
+  }
+
   /** 引擎无关工具面:REST/MCP 桥直调与 omp 内部 host_tool_call 共用同一实现 */
-  protected async handleHostTool(req: HostToolCallRequest): Promise<{ text: string, isError?: boolean }> {
-    return this.dispatchHostTool(req.toolName, req.arguments ?? {})
+  protected async handleHostTool(req: HostToolCallRequest, sourceClient: OmpRpcClient): Promise<{ text: string, isError?: boolean }> {
+    if (sourceClient !== this.client) {
+      return { text: '监督回合已取消，拒绝过期 Harness 工具调用。', isError: true }
+    }
+    if (!this.turnActive) {
+      return { text: 'Harness 回合已结束，拒绝迟到的工具调用。', isError: true }
+    }
+    const lease = this.activeSupervisionToolLease
+    if (lease?.client === sourceClient && lease.rootId) {
+      if (!lease.rootActive || lease.signal?.aborted) {
+        this.retireSupervisionClient(sourceClient)
+        return { text: '监督根任务已取消或结束，拒绝后续工具调用。', isError: true }
+      }
+      const rootTask = await this.workspace?.getTask(lease.rootId).catch(() => null)
+      if (!rootTask || TERMINAL_TASK_STATES[rootTask.state]
+        || this.activeSupervisionToolLease !== lease
+        || lease.signal?.aborted
+        || sourceClient !== this.client) {
+        if (!rootTask || TERMINAL_TASK_STATES[rootTask.state]) this.retireSupervisionClient(sourceClient)
+        return { text: '监督根任务已取消或结束，拒绝后续工具调用。', isError: true }
+      }
+    }
+    const auditFailure = ompAgentTeamAuditFailure()
+    if (auditFailure) {
+      return { text: `AgentTeam 工具事件采集失败，已阻止后续工具分发: ${auditFailure}`, isError: true }
+    }
+    if (req.toolName === 'dispatch_task' && this.agentRole !== 'lead') {
+      return { text: '拒绝:dispatch_task 仅对 lead 开放。', isError: true }
+    }
+    const activeRootTaskId = this.agentRole === 'lead'
+      && lease?.client === sourceClient
+      && lease.rootActive
+      && !lease.signal?.aborted
+      ? lease.rootId ?? undefined
+      : undefined
+    if (this.agentRole === 'lead' && req.toolName === 'dispatch_task' && !activeRootTaskId) {
+      return { text: '拒绝:dispatch_task 需要已验证的活动根任务；请在监督回合内派发。', isError: true }
+    }
+    return this.dispatchHostTool(req.toolName, req.arguments ?? {}, activeRootTaskId)
   }
 
   // ===== prompt 组合 =====
@@ -76,9 +144,11 @@ export abstract class OmpRpcAgentImplToolsSteer extends OmpRpcAgentImplLifecycle
    */
 
   override async supervise(snapshot: SupervisionSnapshot, ctx: AgentRunContext, opts?: SupervisionOptions): Promise<SupervisionDecision[]> {
+    if (!this.supervising) await this.retireEndedSupervisionClient(snapshot.activeRootId ?? null)
     await this.ensureClient(ctx)
     if (!this.client) return []
     if (this.supervising) return [] // 上一轮 supervise 未收口:跳过本拍(节流即正确)
+    const client = this.client
 
     // 上下文门控(≥70% 先压缩再调度;回合间隙发起,失败放行)
     await this.contextGate('supervise')
@@ -98,11 +168,19 @@ export abstract class OmpRpcAgentImplToolsSteer extends OmpRpcAgentImplLifecycle
     return new Promise<SupervisionDecision[]>((resolve) => {
       let assistantText = ''
       let resolved = false
+      const rootTask = snapshot.tasks.find(task => task.id === snapshot.activeRootId)
       const activeRootTask = snapshot.tasks.find(task =>
         task.id === snapshot.activeRootId
         && task.assigneeId === this.selfAgentId
         && ['SUBMITTED', 'ASSIGNED', 'WORKING', 'WAITING'].includes(task.state),
       )
+      const rootId = snapshot.activeRootId ?? null
+      this.activeSupervisionToolLease = {
+        client,
+        rootId,
+        rootActive: Boolean(rootTask && !TERMINAL_TASK_STATES[rootTask.state]),
+        signal: opts?.signal,
+      }
       let taskHistoryWrites = Promise.resolve()
 
       const finish = (decisions: SupervisionDecision[]) => {
@@ -112,6 +190,7 @@ export abstract class OmpRpcAgentImplToolsSteer extends OmpRpcAgentImplLifecycle
         this.turnActive = false
         this.streaming = false
         unsub()
+        if (this.activeSupervisionToolLease?.client === client) this.activeSupervisionToolLease = null
         if (hardTimer) clearTimeout(hardTimer)
         signalUnsub?.()
         void taskHistoryWrites.then(() => resolve(decisions), () => resolve(decisions))
@@ -120,11 +199,24 @@ export abstract class OmpRpcAgentImplToolsSteer extends OmpRpcAgentImplLifecycle
       const abortTurn = (reason: string): void => {
         // 只有显式取消、Runtime stop 或 hard timeout 才 abort；watchdog 本身不 abort。
         log.warn(`[OmpRpcAgent:${this.selfAgentId}] supervise ${reason} → abort 当前调度回合`)
-        void this.client?.send({ type: 'abort' }).catch(() => {})
+        void client.send({ type: 'abort' }).catch(() => {})
+        if (rootId) {
+          // 旧 stdio 上的迟到 host_tool_call 无法再归属新一轮监督;立即退役客户端,
+          // 后续 ensureClient 会重建,handleHostTool 依据客户端身份拒绝旧帧。
+          this.retireSupervisionClient(client)
+        }
         finish([])
       }
 
-      const unsub = this.client!.onEvent((event) => {
+      const unsub = client.onEvent((event) => {
+        if (event.type === 'tool_execution_start' || event.type === 'tool_execution_end') {
+          recordOmpAgentTeamToolEvent(event, {
+            agentId: this.selfAgentId,
+            role: this.agentRole,
+            channelId: this.channelId,
+            taskId: rootTask && !TERMINAL_TASK_STATES[rootTask.state] ? rootTask.id : undefined,
+          })
+        }
         if (activeRootTask && (event.type === 'tool_execution_start' || event.type === 'tool_execution_end')) {
           // Lead supervision is not a workerTurn, so its host-tool events do not
           // pass through promptAndStream's task event mapper. Persist them on the
@@ -173,7 +265,7 @@ export abstract class OmpRpcAgentImplToolsSteer extends OmpRpcAgentImplLifecycle
       this.supervising = true
       this.turnActive = true
       this.streaming = false
-      this.client!.send({ type: 'prompt', message: prompt }).catch(() => finish([]))
+      client.send({ type: 'prompt', message: prompt }).catch(() => finish([]))
     })
   }
 
@@ -233,6 +325,8 @@ export abstract class OmpRpcAgentImplToolsSteer extends OmpRpcAgentImplLifecycle
    * 回给发送者:执行结果 + 对方所需内容,in_reply_to 关联原消息,并声明是否需再响应。
    */
   protected async* peerTurn(request: AgentRunRequest, ctx: AgentRunContext): AsyncGenerator<AgentEvent, void, unknown> {
+    await this.retireEndedSupervisionClient()
+    if (!this.supervising) this.activeSupervisionToolLease = null
     try {
       await this.ensureClient(ctx)
     }

package/server/services/workshop/agents/tool-approvals.ts

@@ -313,10 +313,10 @@ class ToolApprovalService {
       }
       catch { /* 配方已删除 → 无参数节点可清理 */ }
     }
-    else if (binding.kind === 'dcw') {
-      // 2026-10-28 节点级写授权:收回点位授权后,在飞的配方审批单按当前覆盖集重新判定 ——
-      // 覆盖失效即按拒收敛(收回即失活)。仍被其余节点绑定/配方绑定完整覆盖的审批保留,
-      // 不做过度撤销。
+    else if (binding.kind === 'dcw' || binding.kind === 'line-recipe') {
+      // 2026-10-28 写授权/管理权收回:在飞的配方审批单按当前授权面重新判定 ——
+      // 覆盖失效即按拒收敛(收回即失活)。仍被其余授权完整覆盖的审批保留,不做过度撤销。
+      // dcw=该节点的点位授权(只重判含该节点的配方);line-recipe=该线全部配方的管理授权。
       for (const entry of [...this.pending.values()]) {
         if (entry.approval.agentId !== agentId) continue
         const nodeRef = entry.approval.nodeId
@@ -326,6 +326,8 @@ class ToolApprovalService {
         if (!recipeId) continue
         const recipe = getDcwController().listRecipes().find(r => r.id === recipeId)
         if (!recipe) continue
+        if (binding.kind === 'line-recipe' && recipe.lineId !== binding.nodeId) continue
+        if (binding.kind === 'dcw' && !recipe.params.some(p => p.nodeId === binding.nodeId)) continue
         const payload = entry.approval.payload as { op?: string, params?: Array<{ nodeId?: string }> } | undefined
         const op = payload?.op === 'update' || payload?.op === 'rollback' || payload?.op === 'trial'
           ? payload.op

package/server/services/workshop/agents/tool-classes.ts

@@ -32,6 +32,18 @@ export const HYBRID_TWIN_DIRECT_WRITE_TOOL_NAMES = new Set([
   'recipe_apply',
 ])
 
+/**
+ * 观察模式(executionMode=observe)的拒绝面 = 8 个直写族 ∪ 治理写 ∪ 整包方案 ∪ 启停线。
+ * 由 HYBRID_TWIN_DIRECT_WRITE_TOOL_NAMES 派生,不再各层手抄(历史上有过注入/执行分裂)。
+ */
+export const OBSERVE_BLOCKED_TOOL_NAMES: ReadonlySet<string> = new Set([
+  ...HYBRID_TWIN_DIRECT_WRITE_TOOL_NAMES,
+  'optimization_explore',
+  'recipe_propose',
+  'line_start',
+  'line_stop',
+])
+
 /** MES 数据集工具(只读面:点位目录/历史取数/数据集读取与清单)。
  *  不落 HIGH_RISK、不写 PLC —— fetch 只写 CSV 数据集文件(护栏在 mes-controller 代码级:
  *  绑线授权/窗口≤7天/行数≤5000/频次限流);权限面与目录注入面可同源引用本集合。 */

package/server/services/workshop/aml/dataset-builder.ts

@@ -144,6 +144,9 @@ interface PageQuery {
 /**
  * 单节点取数(C7):优先逐节点分页接口(游标续读、无总量截断);
  * 后端未实现时退化为单节点 queryTagged(旧语义在 nodeIds 单元素时等价)。
+ * 2026-10-29:分页路径**必须携带批次标签**(line/product/recipe/run 等值过滤)——
+ * 此前分页只按时间窗取数,Timescale 部署上会把窗口内全部样本当目标批次,
+ * 产品/配方隔离退化为时间窗推断(串味隐患);两条路径现在语义等价。
  */
 export async function fetchNodeSeries(
   tsdb: Pick<TsdbPort, 'queryTagged' | 'queryTaggedPage'>,
@@ -157,6 +160,7 @@ export async function fetchNodeSeries(
     for (;;) {
       const page = await tsdb.queryTaggedPage(nodeId, {
         afterTs, fromMs: q.fromMs, toMs: q.toMs, limit: pageLimit, withState: true,
+        lineId: q.lineId, productId: q.productId, recipeId: q.recipeId, runId: q.runId,
       })
       out.push(...page.points)
       if (page.done || page.nextCursor == null) break

package/server/services/workshop/aml/env-lease.ts

@@ -1,148 +1,178 @@
-/**
- * AML 共享环境租约(G1.6 / B.9.4)。
- *
- * 规则:
- *  - 训练/评估/Solver 运行期间持**读租约**(可多个并发);
- *  - 安装/重建/`ensureVenv({force:true})` 持**独占锁**:先拒绝新租约,等待所有读者释放;
- *    有读者时返回 ENV_BUSY(首版不强删占用目录,Windows 上 rmSync 会失败)。
- *
- * 进程内租约 + 跨进程文件锁:
- *  - 进程内用计数器(本文件);
- *  - 跨进程用 `<amlRoot>/runtime/env.lock` 文件锁(owner + heartbeat),仅用于阻止
- *    另一个 aw 进程同时重建同一环境。崩溃遗留锁需人工确认旧进程已退出后清理。
- */
-import { existsSync, mkdirSync, readFileSync, rmSync, statSync, writeFileSync } from 'node:fs'
-import { join } from 'node:path'
-import { randomUUID } from 'node:crypto'
-import { AppError } from '../../../utils/errors'
-
-export interface EnvReadLease {
-  holder: string
-  released: boolean
-  release(): void
-}
-
-export interface EnvLeaseStatus {
-  readers: number
-  holders: string[]
-  exclusive: string | null
-  fileLock: { path: string, owner: string, pid: number, heartbeatAt: number } | null
-}
-
-const g = globalThis as typeof globalThis & {
-  __amlEnvLease?: { readers: Map<string, number>, exclusive: string | null, lockPath: string | null }
-}
-
-function state() {
-  g.__amlEnvLease ??= { readers: new Map<string, number>(), exclusive: null, lockPath: null }
-  return g.__amlEnvLease
-}
-
-export function acquireEnvReadLease(holder: string): EnvReadLease {
-  const s = state()
-  if (s.exclusive) {
-    throw new AppError(409, 'ENV_BUSY', `AML 环境正在维护(${s.exclusive}),暂不接受新任务;请等待安装/重建完成`)
-  }
-  s.readers.set(holder, (s.readers.get(holder) ?? 0) + 1)
-  let released = false
-  return {
-    holder,
-    get released() { return released },
-    release() {
-      if (released) return
-      released = true
-      const count = (s.readers.get(holder) ?? 1) - 1
-      if (count <= 0) s.readers.delete(holder)
-      else s.readers.set(holder, count)
-    },
-  }
-}
-
-/** 重建前检查:有读者立即 ENV_BUSY(不阻塞等待,避免请求挂死)。 */
-export function assertEnvIdleForMaintenance(holder: string): void {
-  const s = state()
-  if (s.exclusive && s.exclusive !== holder) {
-    throw new AppError(409, 'ENV_BUSY', `AML 环境已被 ${s.exclusive} 独占,拒绝重复维护`)
-  }
-  if (s.readers.size > 0) {
-    const who = [...s.readers.keys()].join(', ')
-    throw new AppError(409, 'ENV_BUSY', `AML 环境仍有在途任务(${who}),拒绝重建/安装`)
-  }
-}
-
-/** 独占锁:进入时拒绝并发读者;退出时释放。 */
-export async function withEnvExclusiveLock<T>(holder: string, amlRoot: string, fn: () => Promise<T> | T): Promise<T> {
-  const s = state()
-  assertEnvIdleForMaintenance(holder)
-  s.exclusive = holder
-  let lockPath: string | undefined
-  let token: string | undefined
-  try {
-    lockPath = fileLockPath(amlRoot)
-    token = acquireFileLock(lockPath, holder)
-    return await fn()
-  }
-  finally {
-    s.exclusive = null
-    if (lockPath && token) releaseFileLock(lockPath, token)
-  }
-}
-
-export function envLeaseStatus(amlRoot?: string): EnvLeaseStatus {
-  const s = state()
-  const lockPath = amlRoot ? fileLockPath(amlRoot) : null
-  const lock = lockPath ? readFileLock(lockPath) : null
-  return {
-    readers: [...s.readers.values()].reduce((a, b) => a + b, 0),
-    holders: [...s.readers.keys()],
-    exclusive: s.exclusive,
-    fileLock: lock && lockPath ? { path: lockPath, ...lock } : null,
-  }
-}
-
-function fileLockPath(amlRoot: string): string {
-  const dir = join(amlRoot, 'runtime')
-  if (!existsSync(dir)) mkdirSync(dir, { recursive: true })
-  return join(dir, 'env.lock')
-}
-
-interface FileLock { owner: string, pid: number, heartbeatAt: number, token?: string }
-
-function readFileLock(path: string): FileLock | null {
-  try {
-    if (!existsSync(path)) return null
-    return JSON.parse(readFileSync(path, 'utf8')) as FileLock
-  }
-  catch {
-    return null
-  }
-}
-
-function acquireFileLock(path: string, holder: string): string {
-  const token = randomUUID()
-  try {
-    writeFileSync(path, JSON.stringify({ owner: holder, pid: process.pid, heartbeatAt: Date.now(), token }), { flag: 'wx' })
-  }
-  catch (err) {
-    if ((err as NodeJS.ErrnoException).code !== 'EEXIST') throw err
-    const existing = readFileLock(path)
-    // 不做 read-then-delete 过期回收:另一个进程可能已换入新锁。
-    throw new AppError(409, 'ENV_BUSY', `AML 环境被进程 ${existing?.pid ?? '?'}(${existing?.owner ?? '未知'})锁定;如确认其已退出,请清理 ${path}`)
-  }
-  return token
-}
-
-function releaseFileLock(path: string, token: string): void {
-  const existing = readFileLock(path)
-  if (existing?.pid === process.pid && existing.token === token) rmSync(path, { force: true })
-}
-
-/** 观察项:租约文件更新时间(排障用,不参与判定)。 */
-export function envLockMtime(amlRoot: string): number | null {
-  try {
-    return statSync(fileLockPath(amlRoot)).mtimeMs
-  }
-  catch {
-    return null
-  }
-}
+/**
+ * AML 共享环境租约(G1.6 / B.9.4)。
+ *
+ * 规则:
+ *  - 训练/评估/Solver 运行期间持**读租约**(可多个并发);
+ *  - 安装/重建/`ensureVenv({force:true})` 持**独占锁**:先拒绝新租约,等待所有读者释放;
+ *    有读者时返回 ENV_BUSY(首版不强删占用目录,Windows 上 rmSync 会失败)。
+ *
+ * 进程内租约 + 跨进程文件锁:
+ *  - 进程内用计数器(本文件);
+ *  - 跨进程用 `<amlRoot>/runtime/env.lock` 文件锁(owner + heartbeat),仅用于阻止
+ *    另一个 aw 进程同时重建同一环境。崩溃遗留锁需人工确认旧进程已退出后清理。
+ */
+import { existsSync, mkdirSync, readFileSync, rmSync, statSync, writeFileSync } from 'node:fs'
+import { join } from 'node:path'
+import { randomUUID } from 'node:crypto'
+import { AppError } from '../../../utils/errors'
+
+export interface EnvReadLease {
+  holder: string
+  released: boolean
+  release(): void
+}
+
+export interface EnvLeaseStatus {
+  readers: number
+  holders: string[]
+  exclusive: string | null
+  fileLock: { path: string, owner: string, pid: number, heartbeatAt: number } | null
+}
+
+const g = globalThis as typeof globalThis & {
+  __amlEnvLease?: { readers: Map<string, number>, exclusive: string | null, lockPath: string | null }
+}
+
+function state() {
+  g.__amlEnvLease ??= { readers: new Map<string, number>(), exclusive: null, lockPath: null }
+  return g.__amlEnvLease
+}
+
+export function acquireEnvReadLease(holder: string): EnvReadLease {
+  const s = state()
+  if (s.exclusive) {
+    throw new AppError(409, 'ENV_BUSY', `AML 环境正在维护(${s.exclusive}),暂不接受新任务;请等待安装/重建完成`)
+  }
+  s.readers.set(holder, (s.readers.get(holder) ?? 0) + 1)
+  let released = false
+  return {
+    holder,
+    get released() { return released },
+    release() {
+      if (released) return
+      released = true
+      const count = (s.readers.get(holder) ?? 1) - 1
+      if (count <= 0) s.readers.delete(holder)
+      else s.readers.set(holder, count)
+    },
+  }
+}
+
+/** 重建前检查:有读者立即 ENV_BUSY(不阻塞等待,避免请求挂死)。 */
+export function assertEnvIdleForMaintenance(holder: string): void {
+  const s = state()
+  if (s.exclusive && s.exclusive !== holder) {
+    throw new AppError(409, 'ENV_BUSY', `AML 环境已被 ${s.exclusive} 独占,拒绝重复维护`)
+  }
+  if (s.readers.size > 0) {
+    const who = [...s.readers.keys()].join(', ')
+    throw new AppError(409, 'ENV_BUSY', `AML 环境仍有在途任务(${who}),拒绝重建/安装`)
+  }
+}
+
+/** 独占锁:进入时拒绝并发读者;退出时释放。 */
+export async function withEnvExclusiveLock<T>(holder: string, amlRoot: string, fn: () => Promise<T> | T): Promise<T> {
+  const s = state()
+  assertEnvIdleForMaintenance(holder)
+  s.exclusive = holder
+  let lockPath: string | undefined
+  let token: string | undefined
+  try {
+    lockPath = fileLockPath(amlRoot)
+    token = acquireFileLock(lockPath, holder)
+    return await fn()
+  }
+  finally {
+    s.exclusive = null
+    if (lockPath && token) releaseFileLock(lockPath, token)
+  }
+}
+
+export function envLeaseStatus(amlRoot?: string): EnvLeaseStatus {
+  const s = state()
+  const lockPath = amlRoot ? fileLockPath(amlRoot) : null
+  const lock = lockPath ? readFileLock(lockPath) : null
+  return {
+    readers: [...s.readers.values()].reduce((a, b) => a + b, 0),
+    holders: [...s.readers.keys()],
+    exclusive: s.exclusive,
+    fileLock: lock && lockPath ? { path: lockPath, ...lock } : null,
+  }
+}
+
+function fileLockPath(amlRoot: string): string {
+  const dir = join(amlRoot, 'runtime')
+  if (!existsSync(dir)) mkdirSync(dir, { recursive: true })
+  return join(dir, 'env.lock')
+}
+
+interface FileLock { owner: string, pid: number, heartbeatAt: number, token?: string }
+
+function readFileLock(path: string): FileLock | null {
+  try {
+    if (!existsSync(path)) return null
+    return JSON.parse(readFileSync(path, 'utf8')) as FileLock
+  }
+  catch {
+    return null
+  }
+}
+
+function pidAlive(pid: number): boolean {
+  if (!Number.isInteger(pid) || pid <= 0) return false
+  try {
+    process.kill(pid, 0)
+    return true
+  }
+  catch (err) {
+    // EPERM = 进程存在但无权限;仅 ESRCH 才算已死
+    return (err as NodeJS.ErrnoException)?.code === 'EPERM'
+  }
+}
+
+function acquireFileLock(path: string, holder: string): string {
+  const token = randomUUID()
+  const payload = () => JSON.stringify({ owner: holder, pid: process.pid, heartbeatAt: Date.now(), token })
+  for (let attempt = 0; attempt < 3; attempt++) {
+    try {
+      writeFileSync(path, payload(), { flag: 'wx' })
+      return token
+    }
+    catch (err) {
+      if ((err as NodeJS.ErrnoException).code !== 'EEXIST') throw err
+    }
+    // 独占创建失败:区分"活锁"与"崩溃残留"。
+    // 持有者崩溃(尤其 Windows TerminateProcess 不跑信号处理)会留下永久锁,
+    // 使 AML 环境维护(venv 安装)此后每次 409 直到人工删文件 —— 必须能自愈。
+    // 注意:同 PID + 不同 token 视为**另一个持有者**(同进程并发维护也必须互斥),
+    // 只有 PID 已不存在才允许接管。
+    const existing = readFileLock(path)
+    // 存活即拒绝(含本进程的并发维护:同 PID 不同 token 仍是另一个持有者)
+    if (existing?.pid && pidAlive(existing.pid)) {
+      throw new AppError(409, 'ENV_BUSY', `AML 环境被进程 ${existing.pid}(${existing.owner ?? '未知'})锁定;如确认其已退出,请清理 ${path}`)
+    }
+    // 死 PID / 内容损坏 → 清理后重试 wx(仍保持"另一进程可能已换入新锁"的竞态安全:
+    // 只有本轮 wx 成功才算拿到;两进程同时清理时只有一个能 wx 成功)。
+    console.warn(`[aml-env] 接管崩溃残留的环境锁(pid=${existing?.pid ?? '?'} 已不存在):${path}`)
+    try {
+      rmSync(path, { force: true })
+    }
+    catch { /* 竞态留待下一轮 */ }
+  }
+  throw new AppError(409, 'ENV_BUSY', `AML 环境锁竞争失败(持续 EEXIST):${path}`)
+}
+
+function releaseFileLock(path: string, token: string): void {
+  const existing = readFileLock(path)
+  if (existing?.pid === process.pid && existing.token === token) rmSync(path, { force: true })
+}
+
+/** 观察项:租约文件更新时间(排障用,不参与判定)。 */
+export function envLockMtime(amlRoot: string): number | null {
+  try {
+    return statSync(fileLockPath(amlRoot)).mtimeMs
+  }
+  catch {
+    return null
+  }
+}

package/server/services/workshop/aml/model-registry.ts

@@ -373,7 +373,7 @@ export function parseIoSpec(model: AmlModelRow): ReturnType<typeof buildIoSpec>
  *  - candidate→shadow / shadow→production;production 晋升时同组旧 production 自动 retired。
  *  - 返回流转结果;SQL 条件更新兜底并发(他人已流转则失败)。
  */
-export function transitionModel(modelId: string, toStage: Exclude<AmlModelStage, 'candidate'>, by: string, byKind: 'user' | 'agent' = 'user'): { ok: boolean, from?: AmlModelStage, retiredId?: string } {
+export function transitionModel(modelId: string, toStage: Exclude<AmlModelStage, 'candidate'>, by: string, byKind: 'user' | 'agent' = 'user'): { ok: boolean, from?: AmlModelStage, retiredId?: string, warnings?: string[] } {
   const rt = getAmlRuntime()
   const model = rt.repo.model.get(modelId)
   if (!model) throw new AppError(404, 'AML_MODEL_MISSING', `模型 ${modelId} 不存在`)
@@ -422,6 +422,20 @@ export function transitionModel(modelId: string, toStage: Exclude<AmlModelStage,
     }
   }
   const dataset = rt.repo.dataset.get(model.datasetId)
+  // 生产晋升新鲜度提示(2026-10-29,非阻断):训练数据若早于当前配方版本的最后一次变更,
+  // 说明模型是在旧配方语义下训练的 —— 提示用新版本批次重训,不拦晋升(由 lead 判断)。
+  const warnings: string[] = []
+  if (toStage === 'production' && dataset) {
+    try {
+      const versions = getDcwRecipeRepo().versions(model.recipeId)
+      const lastAt = versions.length > 0 ? versions[versions.length - 1]?.at : undefined
+      if (lastAt && Date.parse(lastAt) > Date.parse(dataset.createdAt)) {
+        const curVer = versions[versions.length - 1]?.version
+        warnings.push(`训练数据(${dataset.createdAt.slice(0, 10)})早于配方当前版本 v${curVer ?? '?'} 的变更时间(${lastAt.slice(0, 10)});建议用新版本批次重训后再评估`)
+      }
+    }
+    catch { /* 配方已删等;提示属增强,失败不阻断晋升 */ }
+  }
   recordOps({
     actor: by, actorName: by, actorKind: byKind, action: 'aml.model.promote', kind: 'write',
     summary: `模型 ${modelId}: ${model.stage} → ${toStage}${retiredId ? `(旧生产 ${retiredId} 退役)` : ''}`,
@@ -433,5 +447,5 @@ export function transitionModel(modelId: string, toStage: Exclude<AmlModelStage,
     op: 'promoted', modelId, stage: toStage, from: model.stage,
     productId: model.productId, recipeId: model.recipeId, lineId: dataset?.lineId,
   })
-  return { ok: true, from: model.stage, retiredId }
+  return { ok: true, from: model.stage, retiredId, warnings }
 }

package/server/services/workshop/bench-mode.ts

@@ -0,0 +1,22 @@
+/**
+ * 基准/消融模式保险丝(2026-10-30 安全审计 P2-11)。
+ *
+ * AW_BENCH_MODE=1 曾单 env 解除全部防线:整条限流中间件、在线探索限频(单步上限 /
+ * 60s 间隔 / 写入保持窗)、软联锁(参数/产品/配方窗)、回读容差、写间隔……
+ * 生产实例只要环境里残留这一个变量,整机就变成"无护栏"状态。
+ *
+ * 现在要求**双 env 明确确认**:AW_BENCH_MODE=1 且 AW_BENCH_ACK=1。
+ * 单 env 时启动告警一次并保持防线;既有基准脚本需同时导出两者(README 已更新)。
+ */
+let warned = false
+
+export function benchModeEnabled(): boolean {
+  if (process.env.AW_BENCH_MODE !== '1') return false
+  if (process.env.AW_BENCH_ACK === '1') return true
+  if (!warned) {
+    warned = true
+    console.warn('[bench-mode] 忽略 AW_BENCH_MODE=1:缺少 AW_BENCH_ACK=1 确认令牌,全部安全防线保持生效。'
+      + '基准/消融运行请同时设置 AW_BENCH_MODE=1 AW_BENCH_ACK=1。')
+  }
+  return false
+}