agentworkshop 0.8.6 → 0.8.8

package/scripts/e2e-node-binding-3mode-real.mjs

@@ -433,8 +433,8 @@ try {
 
   // ── 三个 Channel(真实 omp) ──
   const obsCh = await makeChannel('验收-三模式-观察', obsLine.id, '观察模式频道:只做数采与工艺分析,物理零写。', 'observe', OBS_TOOLS)
-  const manualCh = await makeChannel('验收-三模式-手动', writeLine.id, '手动模式频道:每次配方试验都必须经人工批准;只操作你绑定的点位。验收场景只执行任务描述,不复测、不等待、不固化。', 'manual', OPS_TOOLS)
-  const autoCh = await makeChannel('验收-三模式-自动', writeLine.id, '自动模式频道:限界内自动执行配方试验;只操作你绑定的点位。验收场景只执行任务描述,不复测、不等待、不固化。', 'auto', OPS_TOOLS)
+  const manualCh = await makeChannel('验收-三模式-手动', writeLine.id, '手动模式频道:每次配方试验都必须经人工批准;只操作你绑定的点位。验收场景只执行任务描述,不复测、不等待、不固化;未收到任务时禁止自主发起任何下发。', 'manual', OPS_TOOLS)
+  const autoCh = await makeChannel('验收-三模式-自动', writeLine.id, '自动模式频道:限界内自动执行配方试验;只操作你绑定的点位。验收场景只执行任务描述,不复测、不等待、不固化;未收到任务时禁止自主发起任何下发。', 'auto', OPS_TOOLS)
   ok('R2', '三频道创建 + 执行模式 + 工具面(omp/selected)', Boolean(obsCh.channelId && manualCh.channelId && autoCh.channelId) && obsCh.toolsSaved === 200 && manualCh.toolsSaved === 200 && autoCh.toolsSaved === 200,
     JSON.stringify({ obs: obsCh.channelId, manual: manualCh.channelId, auto: autoCh.channelId, tools: [obsCh.toolsSaved, manualCh.toolsSaved, autoCh.toolsSaved] }))
 
@@ -486,15 +486,17 @@ try {
   ok('R3d', '观察模式无写审批(只读频道)', obsHistory.length === 0, `approvals=${obsHistory.length}`)
   evidence.tasks.obs = { id: obsTask.id, state: obsRun.task?.state, elapsedSec: Math.round((Date.now() - t0) / 1000), deliverable: obsDeliverable, toolCalls: toolCallsOf(obsRun.task) }
 
-  // ── 手动模式任务(频道钳位 → HITL) ──
-  const manualTask = await submitTask(manualCh.channelId, '验收-手动模式-点位试验', opsPrompt(58, writeLine.id))
+  // ── 手动模式任务(频道钳位 → HITL)。基线取提交时设备现值(值无关断言)。 ──
+  const nodesPreManual = await api('GET', '/api/workshop/dcw')
+  const preManualA = Number((nodesPreManual?.data?.nodes ?? []).find(n => n.id === dcwA.id)?.value)
+  const manualTask = await submitTask(manualCh.channelId, '验收-手动模式-点位试验', opsPrompt(Number.isFinite(preManualA) ? Math.min(preManualA + 2, 70) : 58, writeLine.id))
   const m0 = Date.now()
   const manualRun = await waitTrialAndClose(manualTask.id, manualLead.id, writeLine.id, dcwA.id, {
-    prevValue: 60,
+    prevValue: preManualA,
     approvalComment: '验收:批准手动模式点位试验',
   })
   const writeJournal = await journalCount(writeLine.id)
-  const manualEntries = writeJournal.filter(a => a.nodeId === dcwA.id && a.prevValue === 60 && a.newValue !== 60 && Date.parse(a.at) >= m0 - 5000)
+  const manualEntries = writeJournal.filter(a => a.nodeId === dcwA.id && a.prevValue === preManualA && a.newValue !== preManualA && Date.parse(a.at) >= m0 - 5000)
   const manualTrial = manualEntries[0]
   const manualHistory = await approvalsHistory(manualLead.id)
   const manualCard = manualRun.cards[0]
@@ -504,7 +506,7 @@ try {
   ok('R4', '手动模式控制链完成(HITL → 点位写授权下发)', Boolean(manualTrial), `journal=${JSON.stringify(manualTrial ?? null)} task=${manualRun.task?.state}`)
   ok('R4a', '手动模式触发人工审批(频道 manual 钳位)', manualRun.cards.length >= 1, `cards=${manualRun.cards.map(c => c.id).join(',')}`)
   ok('R4b', '人工审批落定 approved(附言回流)', manualCardRow?.status === 'approved', `card=${manualCard?.id} status=${manualCardRow?.status} comment=${manualCardRow?.comment}`)
-  ok('R4c', `手动模式点位写入落账 60→${manualTrial?.newValue ?? '?'}(点位写授权,无配方绑定)`,
+  ok('R4c', `手动模式点位写入落账 ${preManualA}→${manualTrial?.newValue ?? '?'}(点位写授权,无配方绑定)`,
     Boolean(manualTrial) && Number(manualTrial.newValue) >= 50 && Number(manualTrial.newValue) <= 70,
     JSON.stringify(manualTrial ?? null).slice(0, 400))
   ok('R4d', '手动模式设备侧现值=账本新值(独立回读)', Number(manualNodeRow?.value) === Number(manualTrial?.newValue),
@@ -523,23 +525,26 @@ try {
     journal: manualEntries.slice(-3), approvals: manualCard ? manualCard.id : null,
   }
 
-  // ── 自动模式任务(全链 auto,免批) ──
-  const autoTask = await submitTask(autoCh.channelId, '验收-自动模式-点位试验', opsPrompt(62, writeLine.id))
+  // ── 自动模式任务(全链 auto,免批)。基线取提交时设备现值(值无关断言,
+  //    模型可自选 +2C 内的候选);opsPrompt 里的候选值仅为引导。 ──
+  const nodesPreAuto = await api('GET', '/api/workshop/dcw')
+  const preAutoB = Number((nodesPreAuto?.data?.nodes ?? []).find(n => n.id === dcwB.id)?.value)
+  const autoTask = await submitTask(autoCh.channelId, '验收-自动模式-点位试验', opsPrompt(Number.isFinite(preAutoB) ? Math.min(preAutoB + 2, 70) : 62, writeLine.id))
   const a0 = Date.now()
   const autoRun = await waitTrialAndClose(autoTask.id, autoLead.id, writeLine.id, dcwB.id, {
-    prevValue: 60,
+    prevValue: preAutoB,
     expectNoHitl: true,
   })
   const autoHistory = await approvalsHistory(autoLead.id)
   const autoCardsInWindow = autoHistory.filter(a => Date.parse(a.createdAt ?? 0) >= a0 - 5000)
-  const autoEntries = (await journalCount(writeLine.id)).filter(a => a.nodeId === dcwB.id && a.prevValue === 60 && a.newValue !== 60 && Date.parse(a.at) >= a0 - 5000)
+  const autoEntries = (await journalCount(writeLine.id)).filter(a => a.nodeId === dcwB.id && a.prevValue === preAutoB && a.newValue !== preAutoB && Date.parse(a.at) >= a0 - 5000)
   const autoTrial = autoEntries[0]
   const autoNode = await api('GET', '/api/workshop/dcw')
   const autoNodeRow = (autoNode?.data?.nodes ?? []).find(n => n.id === dcwB.id)
   ok('R5', '自动模式控制链完成(免批 → 点位写授权下发)', Boolean(autoTrial), `journal=${JSON.stringify(autoTrial ?? null)} task=${autoRun.task?.state}`)
   ok('R5a', '自动模式全程无人工审批(全链 auto)', autoRun.cards.length === 0 && autoCardsInWindow.length === 0,
     `cards=${autoRun.cards.length} historyInWindow=${autoCardsInWindow.length}`)
-  ok('R5b', `自动模式点位写入落账 60→${autoTrial?.newValue ?? '?'}(点位写授权,无配方绑定)`,
+  ok('R5b', `自动模式点位写入落账 ${preAutoB}→${autoTrial?.newValue ?? '?'}(点位写授权,无配方绑定)`,
     Boolean(autoTrial) && Number(autoTrial.newValue) >= 50 && Number(autoTrial.newValue) <= 70,
     JSON.stringify(autoTrial ?? null).slice(0, 400))
   ok('R5c', '自动模式设备侧现值=账本新值(独立回读)', Number(autoNodeRow?.value) === Number(autoTrial?.newValue),
@@ -554,9 +559,9 @@ try {
 
   // ── 双轨授权复核:同一活动配方、两个 Agent 各写自己的点位,互不越权 ──
   const writeJournalAll = await journalCount(writeLine.id)
-  const trialA = writeJournalAll.filter(a => a.nodeId === dcwA.id && a.prevValue === 60 && a.newValue !== 60)
-  const trialB = writeJournalAll.filter(a => a.nodeId === dcwB.id && a.prevValue === 60 && a.newValue !== 60)
-  ok('R6', `同一活动配方下两条轨迹各自落账(A 60→${trialA[0]?.newValue ?? '?'}, B 60→${trialB[0]?.newValue ?? '?'})`,
+  const trialA = writeJournalAll.filter(a => a.nodeId === dcwA.id && a.prevValue === preManualA && a.newValue !== preManualA)
+  const trialB = writeJournalAll.filter(a => a.nodeId === dcwB.id && a.prevValue === preAutoB && a.newValue !== preAutoB)
+  ok('R6', `同一活动配方下两条轨迹各自落账(A ${preManualA}→${trialA[0]?.newValue ?? '?'}, B ${preAutoB}→${trialB[0]?.newValue ?? '?'})`,
     trialA.length >= 1 && trialB.length >= 1 && trialA[0].recipeRunId !== trialB[0].recipeRunId,
     `A=${JSON.stringify(trialA.slice(0, 1))} B=${JSON.stringify(trialB.slice(0, 1))}`)
 
@@ -648,6 +653,96 @@ try {
     recipeB: recipeB?.id, runB: startB?.data?.run?.id, trialResponse: switchText, journal: switchJournal.slice(0, 2),
   }
 
+  // ── 产线配方管理权(kind='line-recipe'):真实 Agent 建/改/回退全线配方 + 下发按 dcw 收窄 ──
+  const mgrCh = await makeChannel('验收-配方管理员', writeLine.id,
+    '你是产线配方管理员:可查看/新建/修改/回退本产线全部配方;参数下发只允许你绑定的数控点位。严格按任务步骤执行,不复测、不等待、不固化。', 'auto',
+    ['my_industrial_nodes', 'line_context', 'recipe_create', 'recipe_update', 'recipe_rollback', 'recipe_trial', 'complete_task', 'report_progress'])
+  const mgrLead = mgrCh.lead
+  ok('R10', '配方管理员频道创建(omp/selected/工具面含管理工具)', Boolean(mgrCh.channelId) && mgrCh.toolsSaved === 200, `channel=${mgrCh.channelId} tools=${mgrCh.toolsSaved}`)
+  const mgrLineGrant = await bindAuto(mgrLead.id, writeLine.id, 'line-recipe')
+  const mgrDcwBind = await bindAuto(mgrLead.id, dcwA.id, 'dcw')
+  ok('R10b', '管理权 + 单点位 dcw 绑定落库', mgrLineGrant.status === 200 && mgrDcwBind.status === 200,
+    `grant=${mgrLineGrant?.data?.binding?.kind}:${mgrLineGrant?.data?.binding?.mode} dcw=${mgrDcwBind?.data?.binding?.kind}:${mgrDcwBind?.data?.binding?.mode}`)
+  const tokMgr = agentTokenOf(mgrLead.id)
+
+  // 下发收窄(对当时活动配方 writeRecipe,A/B 都是参数):未绑定节点拒,绑定点位放行
+  const curNodes = await api('GET', '/api/workshop/dcw')
+  const curA = (curNodes?.data?.nodes ?? []).find(n => n.id === dcwA.id)
+  const trialUnbound = await api('POST', '/api/workshop/agent-tools/invoke', {
+    agentId: mgrLead.id, tool: 'recipe_trial',
+    args: { line_id: writeLine.id, params: [{ node_id: dcwB.id, value: 62 }], hypothesis: '验收:管理权 Agent 未绑定该点位,应被收窄拒绝' },
+  }, undefined, { 'x-aw-agent-token': tokMgr })
+  const unboundText = String(trialUnbound?.data?.result?.text ?? trialUnbound?.data?.text ?? '')
+  ok('R10c', '管理权 + dcw 绑定 → 未绑定节点下发被收窄拒', Boolean(trialUnbound?.data?.result?.isError ?? trialUnbound?.data?.isError) && /下发被收窄|只能覆盖这些点位/.test(unboundText), unboundText.slice(0, 300))
+  const trialBound = await api('POST', '/api/workshop/agent-tools/invoke', {
+    agentId: mgrLead.id, tool: 'recipe_trial',
+    args: { line_id: writeLine.id, params: [{ node_id: dcwA.id, value: Number(curA?.value ?? 52) + 2 }], hypothesis: '验收:绑定点位内下发放行' },
+  }, undefined, { 'x-aw-agent-token': tokMgr })
+  const boundText = String(trialBound?.data?.result?.text ?? trialBound?.data?.text ?? '')
+  ok('R10d', '管理权 + dcw 绑定 → 绑定点位内 trial 放行(真实 Agent 身份)', !(trialBound?.data?.result?.isError ?? trialBound?.data?.isError) && /试验已整批下发/.test(boundText), boundText.slice(0, 300))
+
+  // 真实 omp 任务:创建配方(用绑定的节点)。9B 模型可能自选 use_active_run 快照,
+  // 断言按「任务窗口内本线新增的配方」判定(能力级),不绑死命名。
+  const recipesBefore = (await api('GET', `/api/workshop/dcw/recipes`))?.data?.recipes ?? []
+  const knownIds = new Set(recipesBefore.map(r => r.id))
+  const mgrCreateTask = await submitTask(mgrCh.channelId, '验收-管理权-新建配方',
+    '严格按三步执行,不要做别的:\n'
+    + '1) 调用 my_industrial_nodes 查看你的授权(记下绑定的数控节点 id);\n'
+    + `2) 调用 recipe_create:line_id="${writeLine.id}",name="验收-管理权配方",显式传 params=[{node_id:"<你绑定的节点id>",value:58}](不要使用 use_active_run/source_recipe_id/from_run_id),reason 写「验收:产线配方管理权新建配方」;\n`
+    + '3) 立即调用 complete_task 提交 recipe_create 完整回执与新配方 id。\n'
+    + '禁止其他任何工具。')
+  const mgrCreateRun = await waitTask(mgrCreateTask.id, { timeoutMs: 10 * 60_000 })
+  const recipesOnLine = (await api('GET', `/api/workshop/dcw/recipes`))?.data?.recipes ?? []
+  const mgrRecipe = recipesOnLine.find(r => r.lineId === writeLine.id && !knownIds.has(r.id))
+  ok('R10e', '真实 Agent 凭产线管理权新建配方成功(无单配方绑定,窗口内新增)', mgrCreateRun.task?.state === 'COMPLETED' && Boolean(mgrRecipe),
+    `task=${mgrCreateRun.task?.state} recipe=${mgrRecipe?.id ?? '(未找到)'} deliverable=${deliverableOf(mgrCreateRun.task).slice(0, 200)}`)
+
+  if (mgrRecipe) {
+    // 管理权:切换产线到新配方(其参数接管 DCW),再由同一 Agent 修改+回退。
+    // 新配方参数值可能是模型自选的快照值:以 v1 定义里 dcwA 的实际值为基线断言。
+    const mgrV1 = ((await api('GET', `/api/workshop/dcw/recipes/${mgrRecipe.id}/versions`))?.data?.versions ?? [])[0]
+    const baseA = Number((mgrV1?.params ?? []).find(p => p.nodeId === dcwA.id)?.value)
+    const stopPrev = await api('POST', `/api/workshop/dcw/lines/${writeLine.id}/stop`, undefined, admin)
+    const startM = await api('POST', `/api/workshop/dcw/lines/${writeLine.id}/start`, { recipeId: mgrRecipe.id }, admin)
+    const afterStart = await api('GET', '/api/workshop/dcw')
+    const mNodeA = (afterStart?.data?.nodes ?? []).find(n => n.id === dcwA.id)
+    ok('R10f', '新配方开跑:管理权新建的配方接管 DCW(A=v1 定义值)', stopPrev.status === 200 && startM.status === 200 && Number.isFinite(baseA) && Number(mNodeA?.value) === baseA,
+      `stop=${stopPrev.status} start=${startM.status} A=${mNodeA?.value} v1A=${baseA}`)
+    const mgrEditTask = await submitTask(mgrCh.channelId, '验收-管理权-修改并回退',
+      '严格按三步执行,不要做别的:\n'
+      + `1) 调用 recipe_update:recipe_id="${mgrRecipe.id}",params=[{node_id:"${dcwA.id}",value:56}],reason 写「验收:管理权直接修改全线配方」;\n`
+      + `2) 调用 recipe_rollback:recipe_id="${mgrRecipe.id}",version=1,reason 写「验收:管理权回退到 v1(仅定义)」;\n`
+      + '3) 立即调用 complete_task 提交两步回执原文。\n'
+      + '禁止其他任何工具。')
+    const mgrEditRun = await waitTask(mgrEditTask.id, { timeoutMs: 10 * 60_000 })
+    const mgrVersions = (await api('GET', `/api/workshop/dcw/recipes/${mgrRecipe.id}/versions`))?.data?.versions ?? []
+    const v2Row = mgrVersions.find(v => v.version === 2)
+    const lastRow = mgrVersions[mgrVersions.length - 1]
+    ok('R10g', '同一 Agent 修改配方(update v2=56)成功', mgrVersions.some(v => v.version === 2),
+      `task=${mgrEditRun.task?.state} versions=${mgrVersions.map(v => `${v.version}:${(v.params ?? []).map(p => p.value).join('/')}`).join(',')}`)
+    ok('R10h', '同一 Agent 回退配方(生成新版本,参数回到 v1)', Number(lastRow?.version) >= 3
+    && Array.isArray(lastRow?.params) && Number.isFinite(baseA) && lastRow.params.some(p => p.nodeId === dcwA.id && p.value === baseA)
+    && Array.isArray(v2Row?.params) && v2Row.params.some(p => p.nodeId === dcwA.id && p.value !== baseA),
+    `versions=${mgrVersions.map(v => `${v.version}:${(v.params ?? []).map(p => p.value).join('/')}`).join(',')}`)
+    // 收回管理权 → 版本操作立即被拒(dcw 点位绑定不授予版本权)
+    const mgrGrantId = mgrLineGrant?.data?.binding?.id
+    await api('DELETE', `/api/workshop/agent-tools/bindings/${mgrGrantId}`, undefined, admin)
+    const updAfterRevoke = await api('POST', '/api/workshop/agent-tools/invoke', {
+      agentId: mgrLead.id, tool: 'recipe_update',
+      args: { recipe_id: mgrRecipe.id, params: [{ node_id: dcwA.id, value: 55 }], reason: '验收:收回管理权后应拒绝' },
+    }, undefined, { 'x-aw-agent-token': tokMgr })
+    const revokeText = String(updAfterRevoke?.data?.result?.text ?? updAfterRevoke?.data?.text ?? '')
+    ok('R10i', '收回产线管理权后 recipe_update → 拒绝(需配方级授权)',
+      Boolean(updAfterRevoke?.data?.result?.isError ?? updAfterRevoke?.data?.isError) && /配方级授权|版本操作|配方管理权/.test(revokeText), revokeText.slice(0, 300))
+    evidence.lineManager = {
+      channel: mgrCh.channelId, agent: mgrLead.id, lineGrant: mgrGrantId, dcw: dcwA.id,
+      recipe: mgrRecipe.id, versions: mgrVersions.map(v => ({ version: v.version, values: (v.params ?? []).map(p => p.value) })),
+      scopedTrial: { unbound: unboundText.slice(0, 200), bound: boundText.slice(0, 200) },
+      createDeliverable: deliverableOf(mgrCreateRun.task), editDeliverable: deliverableOf(mgrEditRun.task),
+      toolCallsCreate: toolCallsOf(mgrCreateRun.task), toolCallsEdit: toolCallsOf(mgrEditRun.task),
+    }
+  }
+
   // ── IDD 集成(仅检查,不启动分析) ──
   const pluginsR = await api('GET', '/api/workshop/plugins')
   const pluginRows = pluginsR?.data?.plugins ?? pluginsR?.plugins ?? pluginsR?.data ?? []

package/scripts/e2e-node-binding-authz.mjs

@@ -274,7 +274,8 @@ try {
   // ── M4:委派建/撤 dcw 绑定 + 在飞审批收回即失活 ──
   const leadBind = await bind(leadId, n1, 'dcw', 'auto')
   await setBindingMode(String(leadBind?.data?.binding?.id ?? ''), 'auto', true)
-  const grant = await callAs(leadId, tok.lead, 'team_grant_nodes', { agent_id: w3, node_ids: [n1], mode: 'auto' })
+  // 委派 auto = 摘除 worker 的逐次审批闸门,系统要求显式 confirm:true(并行会话新增的安全闸)
+  const grant = await callAs(leadId, tok.lead, 'team_grant_nodes', { agent_id: w3, node_ids: [n1], mode: 'auto', confirm: true })
   ok('T9', 'lead 委派 dcw 节点给 worker(team_grant_nodes)成功', !invErr(grant) && /已把\s*1\s*条节点授权授予/.test(invText(grant)), invText(grant).slice(0, 240))
   const w3b = await api('GET', `/api/workshop/agent-tools/bindings?agentId=${encodeURIComponent(w3)}`, undefined, admin)
   const w3has = (w3b?.data?.bindings ?? []).some(b => b.nodeId === n1 && b.kind === 'dcw')
@@ -302,6 +303,45 @@ try {
   ok('T10', '频道绑 A 线 → 成员绑定 B 线节点被拒(403 产线隔离)', cross.status === 403, `status=${cross.status} code=${String(cross?.code ?? '')}`)
   const direct = await callAs(w1, tok.w1, 'dcw_control', { node_id: n1, value: 50, hypothesis: 'E2E:直写工具必须仍不可达' })
   ok('T10b', '直写工具 dcw_control 仍不可达(未注册/禁写)', invErr(direct) || /未知工具|不可用|停用|拒绝/.test(invText(direct)), invText(direct).slice(0, 200))
+
+  // ── M6 产线配方管理权(kind='line-recipe'):管理全线配方 + 下发按 dcw 收窄 ──
+  const lineGrant = await bind(w3, line, 'line-recipe', 'auto')
+  ok('T11', 'POST kind=line-recipe → 200 且首绑强制 manual(modeForced)',
+    lineGrant.status === 200 && lineGrant?.data?.binding?.kind === 'line-recipe' && lineGrant?.data?.binding?.mode === 'manual' && lineGrant?.data?.modeForced === 'manual',
+    `status=${lineGrant.status} mode=${lineGrant?.data?.binding?.mode}`)
+  const lgId = String(lineGrant?.data?.binding?.id ?? '')
+  const lgAuto = await setBindingMode(lgId, 'auto', true)
+  ok('T11b', '管理权 manual→auto 携 confirm → 200', lgAuto.status === 200 && lgAuto?.data?.binding?.mode === 'auto', `status=${lgAuto.status}`)
+  const plainGrant = await api('POST', '/api/workshop/agent-tools/bindings', { agentId: w3, nodeId: line, kind: 'line-recipe' }, plain)
+  ok('T11c', '只读用户授产线管理权 → 403(需 operate)', plainGrant.status === 403, `status=${plainGrant.status} code=${String(plainGrant?.code ?? '')}`)
+  // 管理权:版本操作(update)全线放行 —— w3 此前没有任何 dcw/recipe 绑定(T9 已全撤)
+  const upd = await callAs(w3, tok.w3, 'recipe_update', { line_id: line, params: [{ node_id: n1, value: 57 }], reason: 'E2E:产线管理权直接修改任意配方' })
+  ok('T12', '管理权 recipe_update(无单配方绑定)→ 成功生成新版本', !invErr(upd) && /已保存|新版本|v\d/.test(invText(upd)), invText(upd).slice(0, 260))
+  // T12 已把配方B 升到 v2(upd)→ 回退到 v1(仅定义,PLC 不动)
+  const rlb = await callAs(w3, tok.w3, 'recipe_rollback', { recipe_id: recipeB, version: 1, reason: 'E2E:管理权回退(仅定义)' })
+  ok('T12b', '管理权 recipe_rollback(仅定义)→ 成功', !invErr(rlb) && /回退完成/.test(invText(rlb)), invText(rlb).slice(0, 260))
+  // 下发(向下兼容):w3 无任何 dcw 绑定 → 管理权默认全参数可发(活动配方B 参数 = n1+n3)
+  const trialFull = await callAs(w3, tok.w3, 'recipe_trial', { line_id: line, params: [{ node_id: n3, value: 58 }], hypothesis: 'E2E:管理权 + 无 dcw 绑定 → 全参数下发' })
+  ok('T12c', '管理权无 dcw 绑定 → trial 全参数放行(向下兼容)', !invErr(trialFull) && /试验已整批下发/.test(invText(trialFull)), invText(trialFull).slice(0, 260))
+  // 绑一个 dcw → 下发立即收窄:未绑节点被拒,绑定点位放行
+  const w3d = await bind(w3, n3, 'dcw', 'auto')
+  await setBindingMode(String(w3d?.data?.binding?.id ?? ''), 'auto', true)
+  ok('T12d', '管理权 Agent 补绑 n3(dcw)', w3d.status === 200, `status=${w3d.status}`)
+  const trialNarrow = await callAs(w3, tok.w3, 'recipe_trial', { line_id: line, params: [{ node_id: n2, value: 59 }], hypothesis: 'E2E:未绑定节点应被收窄拒绝' })
+  ok('T12e', '管理权 + dcw 绑定 → 未绑定节点下发被收窄拒', invErr(trialNarrow) && /下发被收窄|只能覆盖这些点位/.test(invText(trialNarrow)) && invText(trialNarrow).includes(n2), invText(trialNarrow).slice(0, 300))
+  const trialScoped = await callAs(w3, tok.w3, 'recipe_trial', { line_id: line, params: [{ node_id: n3, value: 59 }], hypothesis: 'E2E:绑定点位内应放行' })
+  ok('T12f', '管理权 + dcw 绑定 → 绑定点位内 trial 放行', !invErr(trialScoped) && /试验已整批下发/.test(invText(trialScoped)), invText(trialScoped).slice(0, 260))
+  // 版本操作不受收窄影响(仍凭管理权)
+  const updAfter = await callAs(w3, tok.w3, 'recipe_update', { line_id: line, params: [{ node_id: n2, value: 58 }], reason: 'E2E:收窄后版本操作仍放行' })
+  ok('T12g', 'dcw 收窄不影响版本操作(管理权仍可 update)', !invErr(updAfter), invText(updAfter).slice(0, 220))
+  // 工具注入面声明管理权
+  const listW3 = await api('GET', `/api/workshop/agent-tools/list?agentId=${encodeURIComponent(w3)}`, undefined, undefined, { 'x-aw-agent-token': tok.w3 })
+  const updDesc = String((listW3?.data?.tools ?? []).find(t => t.name === 'recipe_update')?.description ?? '')
+  ok('T12h', '工具注入面带产线配方管理权声明', updDesc.includes(line) && /配方管理权/.test(updDesc), updDesc.slice(-260))
+  // 收回管理权 → 再 update 被拒(收权即失活)
+  const lgRevoke = await api('DELETE', `/api/workshop/agent-tools/bindings/${lgId}`, undefined, admin)
+  const updAfterRevoke = await callAs(w3, tok.w3, 'recipe_update', { line_id: line, params: [{ node_id: n2, value: 56 }], reason: 'E2E:收回管理权后应拒绝' })
+  ok('T13', '收回产线管理权后 recipe_update → 拒绝(需配方级授权)', lgRevoke.status === 200 && invErr(updAfterRevoke) && /配方级授权|版本操作|配方管理权/.test(invText(updAfterRevoke)), `status=${lgRevoke.status} ${invText(updAfterRevoke).slice(0, 260)}`)
 }
 catch (err) {
   ok('FATAL', 'E2E 未捕获异常', false, err instanceof Error ? `${err.message}\n${err.stack ?? ''}` : String(err))

package/scripts/e2e-optimizer-live.mjs

@@ -1217,6 +1217,10 @@ console.log('\n=== 11. live closed-loop value ===')
   check('W6', '审批面精确返回当前下发卡及首步工程值', pending.status === 200 && Boolean(card) && Number.isFinite(cardMove?.to) && Math.abs(cardMove.to - firstMoveEngineering) <= 1e-6 && card.payload?.modelFirstMove?.mv1 === freshOutcome?.result?.firstMove?.mv1, `id=${card?.id ?? 'none'} nodeId=${card?.nodeId ?? 'none'} expected=${firstMoveEngineering} card=${cardMove?.to}`)
 
   if (card) {
+    // 运行门前置(S7 加固):治理下发批准时要求产线在跑目标配方(活动批次)。
+    // 治理 profile 绑定线A(line/recipe)—— 开跑线A(配方A 参数整批下发)。
+    const wStart = await api('POST', `/api/workshop/dcw/lines/${line.id}/start`, { recipeId: recipe.id }, token)
+    check('W6b', '治理下发的运行门前置:线A 开跑(活动批次=配方A)', wStart.status === 200, `status=${wStart.status} msg=${String(wStart?.message ?? '').slice(0, 140)}`)
     const decide = await api('POST', `/api/workshop/agent-tools/approvals/${encodeURIComponent(card.id)}/decide`, { approved: true, choice: 0, comment: '集成验收批准' }, token)
     const decided = data(decide)
     const dispatchResult = decided?.dispatch