agentworkshop 0.8.7 → 0.9.0

package/scripts/api-contract-smoke.mjs

@@ -1,126 +1,126 @@
-#!/usr/bin/env node
-/**
- * API 契约 + Channel 作用域冒烟（2026-10-19）
- *
- * 补齐 api-live-e2e 未覆盖的只读面与真实的跨频道 agent-token 负例：
- *  - health / users/me / channels / workspaces / daq / dcw / hitl / plugins / ops-logs 形状
- *  - 两个临时频道：用 A 频道 lead 的实例 token 访问 B 频道的任务详情/列表，必须 403/SCOPE_VIOLATION
- *  - 结束后删除两个临时频道，不触碰既有业务数据
- *
- * 运行：AW_BASE=http://127.0.0.1:3001 AW_TOKEN=<user-token> node scripts/api-contract-smoke.mjs
- */
-const BASE = process.env.AW_BASE ?? 'http://127.0.0.1:3001'
-const TOKEN = process.env.AW_TOKEN
-if (!TOKEN) throw new Error('AW_TOKEN required (user token, admin or owner)')
-process.env.NO_PROXY = '127.0.0.1,localhost'
-
-const results = []
-const ok = (id, name, cond, detail = '') => {
-  results.push({ id, name, pass: Boolean(cond), detail: String(detail).slice(0, 400) })
-  console.log(`${cond ? '✔' : '✖'} [${id}] ${name}${cond ? '' : ` — ${String(detail).slice(0, 400)}`}`)
-}
-const api = async (method, path, { token = TOKEN, body } = {}) => {
-  const r = await fetch(BASE + path, {
-    method,
-    headers: { 'authorization': `Bearer ${token}`, 'content-type': 'application/json' },
-    body: body === undefined ? undefined : JSON.stringify(body),
-    signal: AbortSignal.timeout(30_000),
-  })
-  const text = await r.text()
-  let json
-  try {
-    json = text ? JSON.parse(text) : {}
-  }
-  catch {
-    json = { raw: text }
-  }
-  return { status: r.status, ...json }
-}
-const data = r => r?.data ?? null
-const tag = `scope${Date.now().toString(36).slice(-5)}`
-const created = []
-
-async function createChannel(name) {
-  const r = await api('POST', '/api/workshop/channels', {
-    body: { name, description: 'api-contract-smoke', leadAgent: { name: `${name}-lead`, harness: 'mock', config: { delayMs: 80 } } },
-  })
-  if (r.code !== 0 || !data(r)?.channelId) throw new Error(`channel create failed: ${JSON.stringify(r).slice(0, 300)}`)
-  created.push(data(r).channelId)
-  return data(r)
-}
-
-try {
-  // ── 只读面 ──────────────────────────────────────────────────────────────
-  const health = await api('GET', '/api/health')
-  ok('R1', 'GET /api/health', health.code === 0 && health.data?.status === 'ok', `status=${health.status}`)
-
-  const me = await api('GET', '/api/users/me')
-  ok('R2', 'GET /api/users/me', me.code === 0 && Boolean(data(me)?.id) && Boolean(data(me)?.role), `role=${data(me)?.role}`)
-
-  const noAuth = await api('GET', '/api/users/me', { token: 'deadbeef' })
-  ok('R3', '无效 token /users/me → 401', noAuth.status === 401, `status=${noAuth.status}`)
-
-  const channels = await api('GET', '/api/workshop/channels')
-  ok('R4', 'GET /channels 数组', channels.code === 0 && Array.isArray(data(channels)), `n=${data(channels)?.length}`)
-
-  const workspaces = await api('GET', '/api/workshop/workspaces')
-  ok('R5', 'GET /workspaces 数组', workspaces.code === 0 && Array.isArray(data(workspaces)), `n=${data(workspaces)?.length}`)
-
-  const daq = await api('GET', '/api/workshop/daq')
-  ok('R6', 'GET /daq 节点面', daq.code === 0 && Array.isArray(data(daq)?.nodes), `nodes=${data(daq)?.nodes?.length}`)
-
-  const dcw = await api('GET', '/api/workshop/dcw')
-  ok('R7', 'GET /dcw 产线面', dcw.code === 0 && Array.isArray(data(dcw)?.lines) && Array.isArray(data(dcw)?.nodes), `lines=${data(dcw)?.lines?.length} nodes=${data(dcw)?.nodes?.length}`)
-
-  const hitl = await api('GET', '/api/workshop/hitl/pending')
-  ok('R8', 'GET /hitl/pending 形状', hitl.code === 0 && (Array.isArray(data(hitl)?.items) || Array.isArray(data(hitl))), `type=${Array.isArray(data(hitl)) ? 'array' : 'object'}`)
-
-  const plugins = await api('GET', '/api/workshop/plugins')
-  const pluginList = plugins.plugins ?? data(plugins)?.plugins
-  ok('R9', 'GET /plugins 列表', Array.isArray(pluginList), `n=${pluginList?.length}`)
-
-  const logs = await api('GET', '/api/workshop/ops-logs?limit=5')
-  ok('R10', 'GET /ops-logs 查询', logs.code === 0 && Array.isArray(data(logs)?.logs), `n=${data(logs)?.logs?.length} count=${data(logs)?.count}`)
-
-  // ── Channel 作用域 ─────────────────────────────────────────────────────
-  const a = await createChannel(`api-scope-A-${tag}`)
-  const b = await createChannel(`api-scope-B-${tag}`)
-  const bActivate = await api('POST', `/api/workshop/channels/${b.channelId}/activate`)
-  ok('C1', '创建两个临时频道并激活 B', Boolean(a.channelId && b.channelId && bActivate.code === 0), `A=${a.channelId?.slice(0, 8)} B=${b.channelId?.slice(0, 8)}`)
-
-  const bTask = await api('POST', `/api/workshop/channels/${b.channelId}/tasks`, {
-    body: { title: `scope-task-${tag}`, description: '跨频道作用域负例', mode: 'goal', modeConfig: { goalCriteria: '完成' } },
-  })
-  ok('C2', 'B 频道任务创建', bTask.code === 0 && Boolean(data(bTask)?.id), `task=${data(bTask)?.id?.slice(0, 8)}`)
-
-  const aAgents = await api('GET', `/api/workshop/channels/${a.channelId}/agents`)
-  const aLeadToken = data(aAgents)?.find?.(x => x.id === a.leadAgentId)?.token
-  ok('C3', 'A 频道 lead 实例 token 可读', Boolean(aLeadToken), `token=${aLeadToken ? 'yes' : 'no'}`)
-
-  const crossDetail = await api('GET', `/api/workshop/tasks/${data(bTask)?.id}`, { token: aLeadToken })
-  const deniedDetail = crossDetail.status === 403 || crossDetail.code === 'SCOPE_VIOLATION' || crossDetail.code === 'FORBIDDEN'
-  ok('C4', 'A token 读 B 任务详情 → 403/SCOPE_VIOLATION', deniedDetail, `status=${crossDetail.status} code=${crossDetail.code}`)
-
-  const mgmtList = await api('GET', `/api/workshop/channels/${b.channelId}/tasks`, { token: aLeadToken })
-  const mgmtDenied = [401, 403].includes(mgmtList.status) || mgmtList.code === 'SCOPE_VIOLATION' || mgmtList.code === 'FORBIDDEN'
-  const mgmtLeak = Array.isArray(data(mgmtList)) && data(mgmtList).some(x => x.id === data(bTask)?.id)
-  ok('C5', 'A token 访问 B 频道管理任务面被拒且无泄露', mgmtDenied && !mgmtLeak, `status=${mgmtList.status} code=${mgmtList.code} leaked=${mgmtLeak}`)
-
-  // agent token 真正使用的列表端点:必须 200 且只返回本频道任务
-  const scopedList = await api('GET', '/api/workshop/tasks', { token: aLeadToken })
-  const scopedRows = Array.isArray(data(scopedList)) ? data(scopedList) : (data(scopedList)?.tasks ?? [])
-  const scopedLeak = scopedRows.some(x => x.id === data(bTask)?.id)
-  ok('C6', 'A token 的 /tasks 列表 200 且不含 B 任务', scopedList.code === 0 && Array.isArray(scopedRows) && !scopedLeak, `status=${scopedList.status} code=${scopedList.code} n=${scopedRows.length} leaked=${scopedLeak}`)
-}
-catch (e) {
-  ok('FATAL', '脚本未抛异常', false, e.message)
-}
-finally {
-  for (const id of created) {
-    const r = await api('DELETE', `/api/workshop/channels/${id}`).catch(() => null)
-    console.log(`  cleanup channel ${id.slice(0, 8)} → ${r?.code ?? 'err'}`)
-  }
-  const failed = results.filter(x => !x.pass).length
-  console.log(`\n${failed === 0 ? '★ ALL PASS' : `✗ ${failed} FAILED`} (${results.length - failed} passed)`)
-  process.exit(failed === 0 ? 0 : 1)
-}
+#!/usr/bin/env node
+/**
+ * API 契约 + Channel 作用域冒烟（2026-10-19）
+ *
+ * 补齐 api-live-e2e 未覆盖的只读面与真实的跨频道 agent-token 负例：
+ *  - health / users/me / channels / workspaces / daq / dcw / hitl / plugins / ops-logs 形状
+ *  - 两个临时频道：用 A 频道 lead 的实例 token 访问 B 频道的任务详情/列表，必须 403/SCOPE_VIOLATION
+ *  - 结束后删除两个临时频道，不触碰既有业务数据
+ *
+ * 运行：AW_BASE=http://127.0.0.1:3001 AW_TOKEN=<user-token> node scripts/api-contract-smoke.mjs
+ */
+const BASE = process.env.AW_BASE ?? 'http://127.0.0.1:3001'
+const TOKEN = process.env.AW_TOKEN
+if (!TOKEN) throw new Error('AW_TOKEN required (user token, admin or owner)')
+process.env.NO_PROXY = '127.0.0.1,localhost'
+
+const results = []
+const ok = (id, name, cond, detail = '') => {
+  results.push({ id, name, pass: Boolean(cond), detail: String(detail).slice(0, 400) })
+  console.log(`${cond ? '✔' : '✖'} [${id}] ${name}${cond ? '' : ` — ${String(detail).slice(0, 400)}`}`)
+}
+const api = async (method, path, { token = TOKEN, body } = {}) => {
+  const r = await fetch(BASE + path, {
+    method,
+    headers: { 'authorization': `Bearer ${token}`, 'content-type': 'application/json' },
+    body: body === undefined ? undefined : JSON.stringify(body),
+    signal: AbortSignal.timeout(30_000),
+  })
+  const text = await r.text()
+  let json
+  try {
+    json = text ? JSON.parse(text) : {}
+  }
+  catch {
+    json = { raw: text }
+  }
+  return { status: r.status, ...json }
+}
+const data = r => r?.data ?? null
+const tag = `scope${Date.now().toString(36).slice(-5)}`
+const created = []
+
+async function createChannel(name) {
+  const r = await api('POST', '/api/workshop/channels', {
+    body: { name, description: 'api-contract-smoke', leadAgent: { name: `${name}-lead`, harness: 'mock', config: { delayMs: 80 } } },
+  })
+  if (r.code !== 0 || !data(r)?.channelId) throw new Error(`channel create failed: ${JSON.stringify(r).slice(0, 300)}`)
+  created.push(data(r).channelId)
+  return data(r)
+}
+
+try {
+  // ── 只读面 ──────────────────────────────────────────────────────────────
+  const health = await api('GET', '/api/health')
+  ok('R1', 'GET /api/health', health.code === 0 && health.data?.status === 'ok', `status=${health.status}`)
+
+  const me = await api('GET', '/api/users/me')
+  ok('R2', 'GET /api/users/me', me.code === 0 && Boolean(data(me)?.id) && Boolean(data(me)?.role), `role=${data(me)?.role}`)
+
+  const noAuth = await api('GET', '/api/users/me', { token: 'deadbeef' })
+  ok('R3', '无效 token /users/me → 401', noAuth.status === 401, `status=${noAuth.status}`)
+
+  const channels = await api('GET', '/api/workshop/channels')
+  ok('R4', 'GET /channels 数组', channels.code === 0 && Array.isArray(data(channels)), `n=${data(channels)?.length}`)
+
+  const workspaces = await api('GET', '/api/workshop/workspaces')
+  ok('R5', 'GET /workspaces 数组', workspaces.code === 0 && Array.isArray(data(workspaces)), `n=${data(workspaces)?.length}`)
+
+  const daq = await api('GET', '/api/workshop/daq')
+  ok('R6', 'GET /daq 节点面', daq.code === 0 && Array.isArray(data(daq)?.nodes), `nodes=${data(daq)?.nodes?.length}`)
+
+  const dcw = await api('GET', '/api/workshop/dcw')
+  ok('R7', 'GET /dcw 产线面', dcw.code === 0 && Array.isArray(data(dcw)?.lines) && Array.isArray(data(dcw)?.nodes), `lines=${data(dcw)?.lines?.length} nodes=${data(dcw)?.nodes?.length}`)
+
+  const hitl = await api('GET', '/api/workshop/hitl/pending')
+  ok('R8', 'GET /hitl/pending 形状', hitl.code === 0 && (Array.isArray(data(hitl)?.items) || Array.isArray(data(hitl))), `type=${Array.isArray(data(hitl)) ? 'array' : 'object'}`)
+
+  const plugins = await api('GET', '/api/workshop/plugins')
+  const pluginList = plugins.plugins ?? data(plugins)?.plugins
+  ok('R9', 'GET /plugins 列表', Array.isArray(pluginList), `n=${pluginList?.length}`)
+
+  const logs = await api('GET', '/api/workshop/ops-logs?limit=5')
+  ok('R10', 'GET /ops-logs 查询', logs.code === 0 && Array.isArray(data(logs)?.logs), `n=${data(logs)?.logs?.length} count=${data(logs)?.count}`)
+
+  // ── Channel 作用域 ─────────────────────────────────────────────────────
+  const a = await createChannel(`api-scope-A-${tag}`)
+  const b = await createChannel(`api-scope-B-${tag}`)
+  const bActivate = await api('POST', `/api/workshop/channels/${b.channelId}/activate`)
+  ok('C1', '创建两个临时频道并激活 B', Boolean(a.channelId && b.channelId && bActivate.code === 0), `A=${a.channelId?.slice(0, 8)} B=${b.channelId?.slice(0, 8)}`)
+
+  const bTask = await api('POST', `/api/workshop/channels/${b.channelId}/tasks`, {
+    body: { title: `scope-task-${tag}`, description: '跨频道作用域负例', mode: 'goal', modeConfig: { goalCriteria: '完成' } },
+  })
+  ok('C2', 'B 频道任务创建', bTask.code === 0 && Boolean(data(bTask)?.id), `task=${data(bTask)?.id?.slice(0, 8)}`)
+
+  const aAgents = await api('GET', `/api/workshop/channels/${a.channelId}/agents`)
+  const aLeadToken = data(aAgents)?.find?.(x => x.id === a.leadAgentId)?.token
+  ok('C3', 'A 频道 lead 实例 token 可读', Boolean(aLeadToken), `token=${aLeadToken ? 'yes' : 'no'}`)
+
+  const crossDetail = await api('GET', `/api/workshop/tasks/${data(bTask)?.id}`, { token: aLeadToken })
+  const deniedDetail = crossDetail.status === 403 || crossDetail.code === 'SCOPE_VIOLATION' || crossDetail.code === 'FORBIDDEN'
+  ok('C4', 'A token 读 B 任务详情 → 403/SCOPE_VIOLATION', deniedDetail, `status=${crossDetail.status} code=${crossDetail.code}`)
+
+  const mgmtList = await api('GET', `/api/workshop/channels/${b.channelId}/tasks`, { token: aLeadToken })
+  const mgmtDenied = [401, 403].includes(mgmtList.status) || mgmtList.code === 'SCOPE_VIOLATION' || mgmtList.code === 'FORBIDDEN'
+  const mgmtLeak = Array.isArray(data(mgmtList)) && data(mgmtList).some(x => x.id === data(bTask)?.id)
+  ok('C5', 'A token 访问 B 频道管理任务面被拒且无泄露', mgmtDenied && !mgmtLeak, `status=${mgmtList.status} code=${mgmtList.code} leaked=${mgmtLeak}`)
+
+  // agent token 真正使用的列表端点:必须 200 且只返回本频道任务
+  const scopedList = await api('GET', '/api/workshop/tasks', { token: aLeadToken })
+  const scopedRows = Array.isArray(data(scopedList)) ? data(scopedList) : (data(scopedList)?.tasks ?? [])
+  const scopedLeak = scopedRows.some(x => x.id === data(bTask)?.id)
+  ok('C6', 'A token 的 /tasks 列表 200 且不含 B 任务', scopedList.code === 0 && Array.isArray(scopedRows) && !scopedLeak, `status=${scopedList.status} code=${scopedList.code} n=${scopedRows.length} leaked=${scopedLeak}`)
+}
+catch (e) {
+  ok('FATAL', '脚本未抛异常', false, e.message)
+}
+finally {
+  for (const id of created) {
+    const r = await api('DELETE', `/api/workshop/channels/${id}`).catch(() => null)
+    console.log(`  cleanup channel ${id.slice(0, 8)} → ${r?.code ?? 'err'}`)
+  }
+  const failed = results.filter(x => !x.pass).length
+  console.log(`\n${failed === 0 ? '★ ALL PASS' : `✗ ${failed} FAILED`} (${results.length - failed} passed)`)
+  process.exit(failed === 0 ? 0 : 1)
+}

package/scripts/api-live-e2e.mjs

@@ -7,8 +7,10 @@
  *  - CHANNEL CRUD + activate + 成员管理
  *  - TASK 提交与生命周期:goal / loop(maxIterations 限次)/ pipeline 三模式
  *    SUBMITTED → ASSIGNED → WORKING → 进度上报 → COMPLETED,parent/child 聚合
+ *    (goal 收口按 2026-10-30 证据闸:lead 经 REST complete 显式附真实交付物)
  *  - dispatch / report / complete / cancel 状态机
- *  - Bearer token 作用域:同 channel 可见,跨 channel → 403 SCOPE_VIOLATION
+ *  - Bearer token 作用域:现建一次性 B 频道取其 lead 有效 token —— 同 channel 列表可见,
+ *    异频道列表不含本频道任务、读详情 → 精确 403 SCOPE_VIOLATION
  *  - a2a 点对点 + mailbox 拉取 + channel 消息历史
  *  - agents/subscribe 订阅
  *  - WebSocket Hub 增量广播(agent.status / task.status / task.progress)
@@ -102,7 +104,13 @@ async function waitUntil(name, cond, timeoutMs = 20_000, intervalMs = 250) {
 }
 
 const tag = Date.now().toString(36)
-const ids = { channel: null, template: null, lead: null, worker: null, leadToken: null, workerToken: null }
+const ids = {
+  channel: null, template: null, lead: null, worker: null, leadToken: null, workerToken: null,
+  channelB: null, leadB: null, leadBToken: null,
+}
+
+/** 日志脱敏:token 只露前 4 位,全量 token 严禁出现在输出里 */
+const maskToken = t => (typeof t === 'string' && t.length > 0 ? `${t.slice(0, 4)}***` : '(empty)')
 
 async function main() {
   console.log(`目标: ${BASE} (生产构建 .output + scripts/start.mjs)\n`)
@@ -193,6 +201,39 @@ async function main() {
   ids.channel = ch.data.channelId
   ids.lead = ch.data.leadAgentId
 
+  // lead token 轮换提前到 worker 装配前:下方 goal 用例要以 lead 身份经 REST complete
+  // 显式收口(2026-10-30 证据闸,见下)。轮换端点一次性返回,整个生命周期只轮换这一次。
+  const rotLead = await api('POST', `/api/workshop/channels/${ids.channel}/agents/${ids.lead}/rotate-token`)
+  ids.leadToken = rotLead?.data?.token
+  check('lead token 经轮换端点一次性获取', Boolean(ids.leadToken), `rot=${rotLead.status} token=${maskToken(ids.leadToken)}`)
+
+  // ── goal 模式提交与显式收口(2026-10-30 证据闸:完成必须附真实交付物,平台合成的
+  //    goal-summary 只是记录、不再算证据)──
+  // 刻意安排在 worker 克隆【之前】:频道此时尚无 worker,mock lead 的 goal 剧本找不到
+  // 可派发的空闲 worker,只能原地等待 —— 由此确定性消除「脚本 REST complete vs mock lead
+  // 自动派发+收口」的竞态(自动收口只会附 goal-summary,新契约下不算证据)。任务一旦
+  // COMPLETED 即终态,后续 worker 装配不会再触发对该 goal 的任何派发。
+  const gtask = await api('POST', `/api/workshop/channels/${ids.channel}/tasks`, {
+    body: { title: `goal-${tag}`, description: '验证 goal 模式全链路', mode: 'goal', modeConfig: { goalCriteria: '全部完成' } },
+  })
+  check('POST /channels/:id/tasks 提交(goal)', gtask.code === 0 && gtask.data?.id && gtask.data?.state === 'SUBMITTED', `state=${gtask.data?.state}`)
+  ids.goalTask = gtask.data.id
+  check('任务路由到 lead', gtask.data?.assigneeId === ids.lead)
+
+  // 真实交付物(evidence):name 非 input、非 goal-summary、parts 带非空文本 —— 新证据闸唯一认账的形态
+  const goalDeliverable = {
+    artifactId: 'e2e-evidence-1',
+    name: 'report',
+    parts: [{ text: `跨频道验收实测结论(goal-${tag}):主频道 lead 任务列表可见本 goal;异频道 lead 列表不含本 goal;异频道 lead 读本 goal 详情 → 403 SCOPE_VIOLATION。` }],
+  }
+  const goalComplete = await api('POST', `/api/workshop/tasks/${ids.goalTask}/complete`, {
+    token: ids.leadToken,
+    body: { artifacts: [goalDeliverable] },
+  })
+  check('goal REST complete 附真实交付物 → COMPLETED(新证据闸)', goalComplete.code === 0 && goalComplete.data?.state === 'COMPLETED',
+    `code=${goalComplete.code} state=${goalComplete.data?.state}`)
+  check('goal 提交的真实 artifact 已落库', (goalComplete.data?.artifacts ?? []).some(a => a.artifactId === goalDeliverable.artifactId && a.name === goalDeliverable.name))
+
   const w = await api('POST', `/api/workshop/channels/${ids.channel}/agents`, { body: { agentId: ids.template, role: 'worker' } })
   check('POST /channels/:id/agents 克隆模板为 worker', w.code === 0 && w.data?.id && w.data?.role === 'worker', `id=${w.data?.id?.slice(0, 8)}`)
   ids.worker = w.data.id
@@ -207,12 +248,10 @@ async function main() {
   const leadInfo = members.data.find(a => a.id === ids.lead)
   const workerInfo = members.data.find(a => a.id === ids.worker)
   check('成员列表不回显 token(防冒充)', Boolean(leadInfo) && !('token' in leadInfo) && !('token' in workerInfo))
-  const rotLead = await api('POST', `/api/workshop/channels/${ids.channel}/agents/${ids.lead}/rotate-token`)
   const rotWorker = await api('POST', `/api/workshop/channels/${ids.channel}/agents/${ids.worker}/rotate-token`)
-  ids.leadToken = rotLead?.data?.token
   ids.workerToken = rotWorker?.data?.token
-  check('成员实例 token 经轮换端点一次性获取(auth 基础)', Boolean(ids.leadToken && ids.workerToken),
-    `leadRot=${rotLead.status} workerRot=${rotWorker.status}`)
+  check('worker token 经轮换端点一次性获取(auth 基础)', Boolean(ids.workerToken),
+    `workerRot=${rotWorker.status} token=${maskToken(ids.workerToken)}`)
 
   const dupLead = await api('POST', `/api/workshop/channels/${ids.channel}/agents`, { body: { agentId: tpl2.data.id, role: 'lead' } })
   check('第二个 lead → 409 LEAD_EXISTS', dupLead.status === 409 || dupLead.code === 'LEAD_EXISTS', `code=${dupLead.code}`)
@@ -226,26 +265,17 @@ async function main() {
   const activate = await api('POST', `/api/workshop/channels/${ids.channel}/activate`)
   check('POST /channels/:id/activate 显式激活', activate.code === 0)
 
-  // ═══════════ 4. TASK 生命周期(goal 模式) ═══════════
-  section('TASK 提交与执行 — goal 模式')
-  const gtask = await api('POST', `/api/workshop/channels/${ids.channel}/tasks`, {
-    body: { title: `goal-${tag}`, description: '验证 goal 模式全链路', mode: 'goal', modeConfig: { goalCriteria: '全部完成' } },
-  })
-  check('POST /channels/:id/tasks 提交(goal)', gtask.code === 0 && gtask.data?.id && gtask.data?.state === 'SUBMITTED', `state=${gtask.data?.state}`)
-  ids.goalTask = gtask.data.id
-  check('任务路由到 lead', gtask.data?.assigneeId === ids.lead)
-
-  const goalDone = await waitUntil('goal 任务 COMPLETED', async () => {
-    const t = await api('GET', `/api/workshop/channels/${ids.channel}/tasks`)
-    const mine = (t.data ?? []).find(x => x.id === ids.goalTask)
-    return mine && (mine.state === 'COMPLETED' || mine.state === 'FAILED') ? mine : null
-  }, 20_000)
-  check('goal 任务自动执行至终态', goalDone.state === 'COMPLETED', `state=${goalDone.state} progress=${goalDone.progress}`)
-  check('goal 任务含成果 artifacts', Array.isArray(goalDone.artifacts) && goalDone.artifacts.length > 0, `artifacts=${goalDone.artifacts?.length}`)
-
-  const gDetail = await api('GET', `/api/workshop/tasks/${ids.goalTask}`)
-  check('GET /tasks/:id 详情(管理面,无 token)', gDetail.code === 0 && gDetail.data?.id === ids.goalTask)
-  check('详情含 history 数组', Array.isArray(gDetail.data?.history), `history=${gDetail.data?.history?.length}`)
+  // ═══════════ 4. TASK goal 收口复核(新证据闸) ═══════════
+  section('TASK goal 收口复核 — 真实交付物才算证据')
+  // goal 的提交与显式收口发生在第 3 节(worker 装配前,规避 mock lead 自动收口竞态)。
+  // 2026-10-30 证据闸后不再有「自动执行至终态」可等:mock lead 自动收口只会附平台同构的
+  // goal-summary,新契约下不算证据 —— 断言改为复核显式收口结果与提交的真实 artifact 在场。
+  const goalDone = await api('GET', `/api/workshop/tasks/${ids.goalTask}`)
+  check('GET /tasks/:id 详情(管理面,无 token)', goalDone.code === 0 && goalDone.data?.id === ids.goalTask)
+  check('goal 任务终态 COMPLETED(lead 显式收口)', goalDone.data?.state === 'COMPLETED', `state=${goalDone.data?.state} progress=${goalDone.data?.progress}`)
+  check('goal 任务含成果 artifacts', Array.isArray(goalDone.data?.artifacts) && goalDone.data.artifacts.length > 0, `artifacts=${goalDone.data?.artifacts?.length}`)
+  check('goal 真实交付物在 artifacts(平台 goal-summary 只是记录)', goalDone.data?.artifacts?.some(a => a.artifactId === 'e2e-evidence-1' && a.name === 'report'))
+  check('详情含 history 数组', Array.isArray(goalDone.data?.history), `history=${goalDone.data?.history?.length}`)
 
   // ═══════════ 5. TASK 作用域 + dispatch/report/complete ═══════════
   section('TASK 作用域校验 + dispatch/report/complete 状态机')
@@ -255,12 +285,38 @@ async function main() {
   const badToken = await api('GET', '/api/workshop/tasks', { token: 'deadbeef' })
   check('无效 token → 401', badToken.status === 401, `status=${badToken.status}`)
 
-  // 跨 channel 作用域:用旧 channel(probeId)的 lead token 查新 channel 任务
-  const probeAgents = await api('GET', `/api/workshop/channels/${probeId}/agents`)
-  const otherToken = probeAgents.data?.find(a => a.role === 'lead')?.token
-  const crossScope = await api('GET', `/api/workshop/tasks`, { token: otherToken })
-  const crossed = await api('GET', `/api/workshop/tasks/${ids.goalTask}`, { token: otherToken })
-  check('跨 channel 访问任务 → 403 SCOPE_VIOLATION', crossScope.code !== 0 || crossed.status === 403 || crossed.code === 'SCOPE_VIOLATION', `code=${crossed.code} status=${crossed.status}`)
+  // 跨 channel 作用域(2026-10-28 安全修复后 member 列表不再回显 token —— 旧实现经
+  // probeId 成员列表取 lead token 恒为 undefined,api() 静默回落用户 token → 401 也能
+  // 满足旧 OR 断言,空转假阳性)。正道:现建一次性 B 频道(独立于 probeId/持久化数据,
+  // 不依赖跨重启遗留状态),经轮换端点取 B lead 的有效 Agent token,做三条正/负断言。
+  const chB = await api('POST', '/api/workshop/channels', {
+    body: {
+      name: `api-e2e-b-${tag}`,
+      description: '跨频道作用域负例专用(一次性)',
+      leadAgent: { name: 'api-lead-b', harness: 'mock', config: { delayMs: 80 } },
+    },
+  })
+  check('创建一次性 B 频道(跨频道负例)', chB.code === 0 && chB.data?.leadAgentId, `channel=${chB.data?.channelId?.slice(0, 8)}`)
+  ids.channelB = chB.data.channelId
+  ids.leadB = chB.data.leadAgentId
+  const rotLeadB = await api('POST', `/api/workshop/channels/${ids.channelB}/agents/${ids.leadB}/rotate-token`)
+  ids.leadBToken = rotLeadB?.data?.token
+  check('B lead token 经轮换端点一次性获取', Boolean(ids.leadBToken), `rot=${rotLeadB.status} token=${maskToken(ids.leadBToken)}`)
+
+  // ① A(主频道)lead token 列表 → 200 且包含 A 自己的 goal task id(同 channel 可见)
+  const scopeA = await api('GET', '/api/workshop/tasks', { token: ids.leadToken })
+  check('A lead token 列表 → 200 且含本频道 goal 任务', scopeA.status === 200 && scopeA.code === 0
+  && Array.isArray(scopeA.data) && scopeA.data.some(t => t.id === ids.goalTask),
+  `status=${scopeA.status} tasks=${scopeA.data?.length}`)
+  // ② B lead token 列表 → 200(code=0)但不含 A 的 goal task id(列表按 caller channel 过滤)
+  const scopeB = await api('GET', '/api/workshop/tasks', { token: ids.leadBToken })
+  check('B lead token 列表 → 200 且不含 A 的 goal 任务', scopeB.status === 200 && scopeB.code === 0
+  && Array.isArray(scopeB.data) && !scopeB.data.some(t => t.id === ids.goalTask),
+  `status=${scopeB.status} tasks=${scopeB.data?.length}`)
+  // ③ B lead token 读 A 的 goal task 详情 → 精确 403 + SCOPE_VIOLATION(401/其它码不算过)
+  const crossed = await api('GET', `/api/workshop/tasks/${ids.goalTask}`, { token: ids.leadBToken })
+  check('跨 channel 读任务详情 → 精确 403 SCOPE_VIOLATION', crossed.status === 403 && crossed.code === 'SCOPE_VIOLATION',
+    `status=${crossed.status} code=${crossed.code}`)
 
   // dispatch 状态机:提交新父任务 → 等 lead 自动派发第 1 个子任务(父转 WAITING)
   // → API 手工 dispatch 第 2 个子任务(WAITING 父上允许) → 全部完成后父汇总
@@ -513,11 +569,14 @@ async function main() {
   section('清理与级联删除')
   const delCh = await api('DELETE', `/api/workshop/channels/${ids.channel}`)
   check('DELETE /channels/:id 级联删除', delCh.code === 0 && delCh.data?.ok === true)
+  const delChB = await api('DELETE', `/api/workshop/channels/${ids.channelB}`)
+  check('DELETE B 频道(一次性跨频道负例清理)', delChB.code === 0 && delChB.data?.ok === true, `code=${delChB.code}`)
   const delTpl = await api('DELETE', `/api/workshop/agents/${ids.template}`)
   check('DELETE /agents/:id', delTpl.code === 0)
   await api('DELETE', `/api/workshop/agents/${tpl2.data.id}`)
   const afterCh = await api('GET', '/api/workshop/channels')
   check('删除后 channel 列表回退(旧数据保留)', afterCh.code === 0 && !afterCh.data.some(c => c.id === ids.channel), `count=${afterCh.data?.length}`)
+  check('B 频道已从列表移除', afterCh.code === 0 && !afterCh.data.some(c => c.id === ids.channelB))
 
   // ═══════════ 结果 ═══════════
   console.log(`\n${failures === 0 ? '★ ALL PASS' : `✗ ${failures} FAILED`}  (${passed} passed)`)