agentworkshop 0.8.8 → 0.9.1

package/server/repositories/user.repository.ts

@@ -1,7 +1,8 @@
 import { existsSync } from 'node:fs'
 import { backupRegistry } from '../services/workshop/db/backup-registry'
 import { join, resolve } from 'node:path'
-import { randomBytes, randomUUID, scryptSync, createHash, timingSafeEqual } from 'node:crypto'
+import { randomBytes, randomUUID, scryptSync, createHash, timingSafeEqual, scrypt as scryptAsync } from 'node:crypto'
+import { promisify } from 'node:util'
 import { DatabaseSync } from 'node:sqlite'
 import { ensureDataDir } from '@/shared/config/home.mjs'
 import type { Paginated, User, UserListQuery, UserToken } from '../types/user'
@@ -181,6 +182,28 @@ export function verifyPassword(password: string, stored: string): boolean {
   return expected.length === actual.length && timingSafeEqual(expected, actual)
 }
 
+// ===== P2-9(2026-11-01):异步 scrypt 变体 =====
+// 热路径(登录/改密校验)走 worker 线程池(scrypt 回调),不再阻塞事件循环 ——
+// 单次 ~50-100ms 的 CPU 阻塞在并发登录时会排队放大为秒级卡顿(验收计划 P2-9)。
+// 管理面低频路径(创建/改密写入)保留同步版:调用点在同步 SQLite 事务链上,
+// 异步化会外溢到仓库 API 形状(18+ 点),收益/风险比不划算 —— 显式记录为设计取舍。
+
+const scryptP = promisify(scryptAsync) as (p: string, s: string, l: number) => Promise<Buffer>
+
+/** 异步校验密码(登录/改密热路径专用;语义与 verifyPassword 完全一致) */
+export async function verifyPasswordAsync(password: string, stored: string): Promise<boolean> {
+  const [salt, hex] = stored.split(':')
+  if (!salt || !hex) return false
+  const expected = Buffer.from(hex, 'hex')
+  try {
+    const actual = await scryptP(password, salt, expected.length)
+    return expected.length === actual.length && timingSafeEqual(expected, actual)
+  }
+  catch {
+    return false
+  }
+}
+
 // ===== Token 哈希 =====
 
 function hashToken(token: string): string {

package/server/services/user.service.ts

@@ -1,4 +1,4 @@
-import { userRepository, findByToken, verifyPassword } from '../repositories/user.repository'
+import { userRepository, findByToken, verifyPasswordAsync } from '../repositories/user.repository'
 import type { UserListInput, UserListQuery, UserToken, AuthResult } from '../types/user'
 import type { UserCreate, UserUpdate, UserLogin, UserRegister } from '../schemas/user.schema'
 import { AppError, ErrorCodes } from '../utils/errors'
@@ -100,14 +100,15 @@ export const userService = {
     return { id, revokedSessions: revoked, mustChangePassword: true }
   },
 
-  /** 本人修改密码(首登强制改密同一入口):当前密码验证 → 更新哈希并清除强制标记 */
-  changePassword(userId: string, currentPassword: string, newPassword: string) {
+  /** 本人修改密码(首登强制改密同一入口):当前密码验证 → 更新哈希并清除强制标记。
+   *  P2-9(2026-11-01):校验走异步 scrypt(worker 线程池),不再阻塞事件循环。 */
+  async changePassword(userId: string, currentPassword: string, newPassword: string) {
     const user = userRepository.findById(userId)
     if (!user) {
       throw new AppError(404, ErrorCodes.NOT_FOUND, '用户不存在')
     }
     const { hash } = userRepository.getPasswordHash(user.email) ?? {}
-    if (!hash || !verifyPassword(currentPassword, hash)) {
+    if (!hash || !(await verifyPasswordAsync(currentPassword, hash))) {
       throw new AppError(401, 'UNAUTHORIZED', '当前密码不正确')
     }
     userRepository.update(userId, { password: newPassword, mustChangePassword: false })
@@ -150,7 +151,7 @@ export const userService = {
    *  - 密码错误时累计,达阈值返回 429 统一文案(不泄露"账号是否存在");
    *  - IP 只入审计(来源可追溯),不参与判定。
    */
-  login(input: UserLogin, opts: { ip?: string } = {}): AuthResult {
+  async login(input: UserLogin, opts: { ip?: string } = {}): Promise<AuthResult> {
     const FAIL_WINDOW_MS = 15 * 60_000
     const LOCK_THRESHOLD = 5
     const accountKey = input.email.trim().toLowerCase()
@@ -163,7 +164,8 @@ export const userService = {
     const locked = Boolean(rec && rec.count >= LOCK_THRESHOLD && Date.now() - rec.firstAt < FAIL_WINDOW_MS)
 
     const { id, hash } = userRepository.getPasswordHash(input.email) ?? {}
-    const passwordOk = Boolean(id && hash && verifyPassword(input.password, hash))
+    // P2-9(2026-11-01):登录校验走异步 scrypt —— 并发登录不再排队阻塞事件循环
+    const passwordOk = Boolean(id && hash && await verifyPasswordAsync(input.password, hash))
     if (!passwordOk) {
       if (!rec || Date.now() - rec.firstAt >= FAIL_WINDOW_MS) fails.set(accountKey, { count: 1, firstAt: Date.now() })
       else rec.count += 1

package/server/services/workshop/agents/host-tool-bridge/catalog.ts

@@ -73,6 +73,8 @@ export const OBSERVER_READ_TOOL_NAMES = new Set([
   'line_context',
   'dcw_journal',
   'daq_query',
+  'daq_identifiability',
+  'intervention_history',
   'exp_collect',
   'analysis_save',
   'analysis_query',

package/server/services/workshop/agents/host-tool-bridge/tools/industrial.ts

@@ -9,7 +9,7 @@
  * 该族**不依赖 workspace**,由 dispatch 在 workspace 门控之前分流(保持原分发顺序)。
  */
 import type { HostToolResult } from '../types'
-import { toolLineStart, toolLineStop, toolLineStatus, toolAmlDatasetBuild, toolAmlDatasetStats, toolAmlJobCancel, toolAmlJobLogs, toolAmlJobStatus, toolAmlJobSubmit, toolAmlLeaderboard, toolAmlModelFind, toolAmlModelPromote, toolAmlModelReference, toolAmlModelAnnotate, toolAmlNodeCatalog, toolAmlTrainingPlanCreate, toolAmlTrainingPlanList, toolAmlTrainingPlanTrain, toolDaqExport, toolDaqFrames, toolDaqQuery, toolDcwControl, toolDcwJudge, toolDcwJournal, toolDcwRollback, toolLineContext, toolMesCatalog, toolMesDatasetRead, toolMesDatasets, toolMesExport, toolMesFetch, toolMyIndustrialNodes, toolOpsLog, toolParamControl, toolRecipeApply, toolRecipeCatalog, toolRecipeCreate, toolRecipeLog, toolRecipeRollback, toolRecipeTrial, toolRecipeUpdate, toolRecipeVersions, toolOptimizationExplore, toolTwinProviderCatalog, toolTwinSceneDiscover, toolTwinSceneCompile, toolTwinSceneFreeze, toolTwinSceneRead, toolTwinPhysicsSpecDraft, toolTwinPhysicsSpecValidate, toolTwinPhysicsSpecCompile, toolTwinSnapshotCreate, toolTwinTrialRun, toolMpcOptimize, toolTwinGateEvaluate, toolTwinBayesOptimize, toolTwinCalibrationRequest, toolAnalysisSave, toolAnalysisQuery } from '../../industrial'
+import { toolLineStart, toolLineStop, toolLineStatus, toolAmlDatasetBuild, toolAmlDatasetStats, toolAmlJobCancel, toolAmlJobLogs, toolAmlJobStatus, toolAmlJobSubmit, toolAmlLeaderboard, toolAmlModelFind, toolAmlModelPromote, toolAmlModelReference, toolAmlModelAnnotate, toolAmlNodeCatalog, toolAmlTrainingPlanCreate, toolAmlTrainingPlanList, toolAmlTrainingPlanTrain, toolDaqExport, toolDaqFrames, toolDaqQuery, toolDcwControl, toolDcwJudge, toolDcwJournal, toolDcwRollback, toolLineContext, toolMesCatalog, toolMesDatasetRead, toolMesDatasets, toolMesExport, toolMesFetch, toolMyIndustrialNodes, toolOpsLog, toolParamControl, toolRecipeApply, toolRecipeCatalog, toolRecipeCreate, toolRecipeLog, toolRecipeRollback, toolRecipeTrial, toolRecipeUpdate, toolRecipeVersions, toolOptimizationExplore, toolDaqIdentifiability, toolInterventionHistory, toolTwinProviderCatalog, toolTwinSceneDiscover, toolTwinSceneCompile, toolTwinSceneFreeze, toolTwinSceneRead, toolTwinPhysicsSpecDraft, toolTwinPhysicsSpecValidate, toolTwinPhysicsSpecCompile, toolTwinSnapshotCreate, toolTwinTrialRun, toolMpcOptimize, toolTwinGateEvaluate, toolTwinBayesOptimize, toolTwinCalibrationRequest, toolAnalysisSave, toolAnalysisQuery } from '../../industrial'
 
 import { toolExpCollect } from '../../industrial/exp-tools'
 import { toolRecipePropose } from '../../industrial/recipe-propose-tools'
@@ -60,6 +60,9 @@ const INDUSTRIAL_HANDLERS = new Map<string, IndustrialToolHandler>([
   ['daq_query', (agentId, args) => toolDaqQuery(agentId, args as Parameters<typeof toolDaqQuery>[1])],
   ['daq_export', (agentId, args) => toolDaqExport(agentId, args as Parameters<typeof toolDaqExport>[1])],
   ['daq_frames', (agentId, args) => toolDaqFrames(agentId, args as Parameters<typeof toolDaqFrames>[1])],
+  // P1/P2(科学探索计划):可辨识性预检与干预台账查询(全只读)
+  ['daq_identifiability', (agentId, args) => toolDaqIdentifiability(agentId, args as Parameters<typeof toolDaqIdentifiability>[1])],
+  ['intervention_history', (agentId, args) => toolInterventionHistory(agentId, args as Parameters<typeof toolInterventionHistory>[1])],
   ['dcw_judge', (agentId, args) => toolDcwJudge(agentId, args as { record_id?: string, verdict?: string, reason?: string })],
   ['dcw_rollback', (agentId, args) => toolDcwRollback(agentId, args as { record_id?: string, node_id?: string, to?: string })],
   ['dcw_journal', (agentId, args) => toolDcwJournal(agentId, args as { node_id?: string, recipe_id?: string, limit?: number | string })],

package/server/services/workshop/agents/host-tool-bridge/tools/messaging.ts

@@ -6,6 +6,7 @@
 import type { AgentWorkspace } from '../../agent-interface'
 import type { HostToolBridgeContext, HostToolResult, HostToolSessionState } from '../types'
 import { partsToText } from '../session'
+import { isHumanChatDelivery } from '../../../types/a2a'
 
 export async function handleSendMessageToAgent(
   args: Record<string, unknown>,
@@ -119,7 +120,10 @@ export async function handlePollMessages(
 ): Promise<HostToolResult> {
   const limit = (args.limit as number | undefined) ?? 10
   const waitSec = Math.min(180, Math.max(0, Number(args.wait_seconds ?? 0) || 0))
-  const msgs = await ws.waitMailbox(limit, waitSec * 1000)
+  // 双保险:运行时 waitPending 已排除人类群聊投递;此处再滤一次,防止旧元数据/回退路径
+  // 把需要 platformReply 回写群聊的消息读走(读即取后用户将收不到答复)。
+  const msgs = (await ws.waitMailbox(limit, waitSec * 1000))
+    .filter(m => !isHumanChatDelivery(m))
   if (msgs.length === 0) {
     return {
       text: waitSec > 0

package/server/services/workshop/agents/industrial/aml-dataset-tools.ts

@@ -302,6 +302,9 @@ export async function toolAmlDatasetStats(_agentId: string, args: { dataset_id?:
       `  三元组: ${dataset.lineId} / ${dataset.productId} / ${dataset.recipeId} | 行数 ${dataset.rowCount} | 批次 ${dataset.runIds.length}(${report.runsUsed.length} 参与构建)| 创建 ${dataset.createdAt.slice(0, 19).replace('T', ' ')}`,
       statLines.length ? `\n逐节点统计(train 切分):\n${statLines.join('\n')}` : null,
       lagLines.length ? `\n控制→目标滞后(互相关峰值,正 = 控制领先):\n${lagLines.join('\n')}` : null,
+      (report.actionCoverage ?? []).length
+        ? `\n动作覆盖(role=control;G6 门依据 —— 水平<3 或与时间共线则模型学不到动作):\n${(report.actionCoverage ?? []).map(c => `- ${amlNodeName(c.controlId)}(${c.controlId}):水平 ${c.distinctLevels} 个,切换 ${c.stepCount} 次,时间共线 |r|=${c.collinearityWithTime.toFixed(3)},贴边 ${(c.saturationRatio * 100).toFixed(0)}%${c.levelPhaseMatrix.length ? `;水平×时间 {${c.levelPhaseMatrix.map(l => `${l.level}@${(l.meanPhase * 100).toFixed(0)}%`).join(', ')}}` : ''}`).join('\n')}`
+        : null,
       profileLines.length ? `\nrun 轮廓(逐批次目标均值,漂移检测):\n${profileLines.join('\n')}` : null,
       `\n窗口计数:train ${report.windowCount.train} / val ${report.windowCount.val} / test ${report.windowCount.test}(byRun 分层切分,防同批泄漏)`,
       report.runsDropped.length > 0 ? `丢弃批次:\n${report.runsDropped.map(d => `- ${d.runId}: ${d.reason}`).join('\n')}` : null,

package/server/services/workshop/agents/industrial/bench-approval-only.ts

@@ -1,12 +1,19 @@
 import { execFileSync } from 'node:child_process'
 import { createHash } from 'node:crypto'
-import { lstatSync, readFileSync, realpathSync } from 'node:fs'
+import { closeSync, fsyncSync, lstatSync, openSync, readFileSync, realpathSync, rmSync, writeFileSync } from 'node:fs'
+import { networkInterfaces } from 'node:os'
 import { basename, dirname, isAbsolute, join, resolve } from 'node:path'
 
 type TrialTarget = { id: string, driver: string, driverConfig: Record<string, unknown> }
+type TrialParam = { node_id: string, value: number }
+type PilotArm = 'ON' | 'OFF'
+type PilotCase = 'legal-approved' | 'legal-rejected' | 'out-of-range-approved'
 type Qualification = {
-  schema_version: number
+  schema_version: 2
   run_id: string
+  episode_id: string
+  arm: 'OFF'
+  case: PilotCase
   aw_home: string
   aw_base: string
   sim_base: string
@@ -14,11 +21,86 @@ type Qualification = {
   simulator_pid: number
   line_id: string
   recipe_id: string
+  actor_id: string
+  hypothesis: string
+  params: TrialParam[]
+  configuration_sha256: string
+  fixture_sha256: string
+  manifest_sha256: string
   expires_at_utc: string
   nodes: Array<{ node_id: string, driver: string, driver_config_sha256: string, host?: string, port?: number }>
 }
 
-export type ApprovalOnlyTrialReceipt = { approval_bypassed: true, run_id: string }
+type Manifest = {
+  schema_version: 'a1-approval-pilot-v1'
+  run_id: string
+  study_type: 'descriptive-pilot'
+  configuration_sha256: string
+  network_isolation: { mode: 'docker-network-none', loopback_only: true }
+  episodes: Array<{
+    episode_id: string
+    case: PilotCase
+    arm_order: PilotArm[]
+    actor_id: string
+    line_id: string
+    recipe_id: string
+    hypothesis: string
+    params: TrialParam[]
+    fixture_sha256: string
+  }>
+}
+
+export type ApprovalOnlyTrialReceipt = {
+  approval_bypassed: true
+  run_id: string
+  episode_id: string
+  arm: 'OFF'
+  case: PilotCase
+  invocation_id: string
+  configuration_sha256: string
+  fixture_sha256: string
+}
+
+type TrialCheckInput = {
+  stage: 'approval' | 'dispatch'
+  invocationId: string
+  actorId: string
+  recipeId: string
+  line: { id: string, simulated?: boolean } | undefined
+  nodes: TrialTarget[]
+  hypothesis: string
+  params: TrialParam[]
+}
+
+function sha256(value: string | Buffer): string {
+  return createHash('sha256').update(value).digest('hex')
+}
+
+function stableJson(value: unknown): string {
+  if (Array.isArray(value)) return `[${value.map(stableJson).join(',')}]`
+  if (value && typeof value === 'object') {
+    return `{${Object.entries(value as Record<string, unknown>).sort(([a], [b]) => a.localeCompare(b)).map(([key, item]) => `${JSON.stringify(key)}:${stableJson(item)}`).join(',')}}`
+  }
+  return JSON.stringify(value) ?? 'null'
+}
+
+/** Digest of the exact actor, recipe, target driver configuration, candidate and rationale. */
+export function approvalOnlyFixtureSha256(input: Omit<TrialCheckInput, 'stage' | 'invocationId'>): string {
+  const projection = {
+    schema_version: 1,
+    actor_id: input.actorId,
+    line_id: input.line?.id ?? '',
+    recipe_id: input.recipeId,
+    hypothesis: input.hypothesis,
+    params: input.params.map(param => ({ node_id: param.node_id, value: Number(param.value) })).sort((a, b) => a.node_id.localeCompare(b.node_id)),
+    nodes: input.nodes.map(node => ({
+      node_id: node.id,
+      driver: node.driver,
+      driver_config_sha256: sha256(stableJson(node.driverConfig)),
+    })).sort((a, b) => a.node_id.localeCompare(b.node_id)),
+  }
+  return sha256(stableJson(projection))
+}
 
 function loopbackUrl(raw: string | undefined, label: string): URL {
   const url = new URL(raw ?? '')
@@ -29,8 +111,7 @@ function loopbackUrl(raw: string | undefined, label: string): URL {
   return url
 }
 
-function targetEndpoint(node: TrialTarget): { host: string, port: number } | null {
-  if (node.driver === 'mock') return null
+function targetEndpoint(node: TrialTarget): { host: string, port: number } {
   let host: string
   let port: number
   if (node.driver === 'opcua') {
@@ -39,7 +120,7 @@ function targetEndpoint(node: TrialTarget): { host: string, port: number } | nul
     host = endpoint.hostname
     port = Number(endpoint.port)
   }
-  else if (node.driver === 'modbus-tcp' || node.driver === 'modbus-rtu') {
+  else if (node.driver === 'modbus-tcp') {
     host = String(node.driverConfig.host ?? '')
     port = Number(node.driverConfig.port)
   }
@@ -51,65 +132,261 @@ function targetEndpoint(node: TrialTarget): { host: string, port: number } | nul
 }
 
 function assertListener(port: number, pid: number): void {
-  const rows = execFileSync('netstat.exe', ['-ano', '-p', 'tcp'], { encoding: 'utf8', timeout: 8000, maxBuffer: 4 * 1024 * 1024 })
-    .split(/\r?\n/).map(line => line.trim().split(/\s+/))
-    .filter(parts => parts[0] === 'TCP' && parts[3]?.toUpperCase() === 'LISTENING' && parts[1]?.endsWith(`:${port}`))
-  if (!rows.length || rows.some(parts => Number(parts[4]) !== pid || !['127.0.0.1', '[::1]'].includes(parts[1]!.slice(0, -(String(port).length + 1))))) {
-    throw new Error(`simulator ownership or loopback binding is unverified for port ${port}`)
+  if (process.platform === 'win32') {
+    const rows = execFileSync('netstat.exe', ['-ano', '-p', 'tcp'], { encoding: 'utf8', timeout: 8000, maxBuffer: 4 * 1024 * 1024 })
+      .split(/\r?\n/).map(line => line.trim().split(/\s+/))
+      .filter(parts => parts[0] === 'TCP' && parts[3]?.toUpperCase() === 'LISTENING' && parts[1]?.endsWith(`:${port}`))
+    if (!rows.length || rows.some(parts => Number(parts[4]) !== pid || !['127.0.0.1', '[::1]'].includes(parts[1]!.slice(0, -(String(port).length + 1))))) {
+      throw new Error(`listener ownership or loopback binding is unverified for port ${port}`)
+    }
+    return
+  }
+  if (process.platform !== 'linux') throw new Error('listener ownership verification is supported only on Windows or Linux')
+  const output = execFileSync('ss', ['-ltnpH'], { encoding: 'utf8', timeout: 8000, maxBuffer: 4 * 1024 * 1024 })
+  const matching = output.split(/\r?\n/).filter(line => line.trim().split(/\s+/)[3]?.endsWith(`:${port}`))
+  if (!matching.length || matching.some((line) => {
+    const parts = line.trim().split(/\s+/)
+    const local = parts[3]?.slice(0, -(String(port).length + 1))
+    const owners = [...line.matchAll(/pid=(\d+)/g)].map(match => Number(match[1]))
+    return !['127.0.0.1', '[::1]'].includes(local ?? '') || owners.length !== 1 || owners[0] !== pid
+  })) {
+    throw new Error(`listener ownership or loopback binding is unverified for port ${port}`)
   }
 }
 
-/** This switch has no tool argument or UI setting. Its qualification file stays in
- * the disposable AW_HOME and must be renewed for each run before bypassing HITL. */
-export function approvalOnlyTrialReceipt(input: {
-  recipeId: string
-  line: { id: string, simulated?: boolean } | undefined
-  nodes: TrialTarget[]
-}): ApprovalOnlyTrialReceipt | null {
+export function assertLoopbackOnlyNetworkNamespace(interfaces: ReturnType<typeof networkInterfaces>): void {
+  if (process.platform !== 'linux') throw new Error('approval-only trials require a Linux network namespace with verified no-egress isolation')
+  const names = Object.keys(interfaces)
+  const loopbackAddresses = interfaces.lo ?? []
+  if (names.length !== 1 || names[0] !== 'lo' || loopbackAddresses.length === 0
+    || loopbackAddresses.some(address => !address?.internal || !['127.0.0.1', '::1'].includes(address.address))) {
+    throw new Error('approval-only trials require a loopback-only network namespace')
+  }
+  const routes = readFileSync('/proc/net/route', 'utf8').trim().split(/\r?\n/).slice(1)
+  if (routes.some((line) => {
+    const parts = line.trim().split(/\s+/)
+    return parts[1] === '00000000' && parts[0] !== 'lo'
+  })) throw new Error('approval-only network namespace has an IPv4 default route via a non-loopback interface')
+  const routes6 = readFileSync('/proc/net/ipv6_route', 'utf8').trim().split(/\r?\n/)
+  if (routes6.some((line) => {
+    const parts = line.trim().split(/\s+/)
+    return /^0{32}$/.test(parts[1] ?? '') && parts[2] === '00' && parts[0] !== 'lo'
+  })) {
+    throw new Error('approval-only network namespace has an IPv6 default route via a non-loopback interface')
+  }
+}
+
+function configurationSha256(configuration: Record<string, unknown>): string {
+  const projection = { ...configuration }
+  delete projection.configuration_sha256
+  return sha256(stableJson(projection))
+}
+
+function readRegularJson(path: string, label: string): { value: Record<string, unknown>, bytes: Buffer } {
+  const stat = lstatSync(path)
+  if (!stat.isFile() || stat.isSymbolicLink()) throw new Error(`${label} must be a regular non-symlink file`)
+  const bytes = readFileSync(path)
+  return { value: JSON.parse(bytes.toString('utf8')) as Record<string, unknown>, bytes }
+}
+
+function readClaim(path: string): Record<string, unknown> {
+  return readRegularJson(path, 'approval-only one-shot claim').value
+}
+
+function withClaimLock<T>(home: string, callback: () => T): T {
+  const lockPath = join(home, 'approval-only-claim.lock')
+  let fd: number
+  try {
+    fd = openSync(lockPath, 'wx', 0o600)
+  }
+  catch (err) {
+    throw new Error(`approval-only qualification is busy or has a stale lock: ${err instanceof Error ? err.message : String(err)}`, { cause: err })
+  }
+  try {
+    writeFileSync(fd, `${process.pid}\n`, 'utf8')
+    fsyncSync(fd)
+    return callback()
+  }
+  finally {
+    closeSync(fd)
+    // A process crash may leave the exclusive lock behind; that intentionally fails closed.
+    rmSync(lockPath, { force: true })
+  }
+}
+
+function receiptOf(q: Qualification, invocationId: string): ApprovalOnlyTrialReceipt {
+  return {
+    approval_bypassed: true,
+    run_id: q.run_id,
+    episode_id: q.episode_id,
+    arm: q.arm,
+    case: q.case,
+    invocation_id: invocationId,
+    configuration_sha256: q.configuration_sha256,
+    fixture_sha256: q.fixture_sha256,
+  }
+}
+
+export function sameApprovalOnlyTrialReceipt(
+  first: ApprovalOnlyTrialReceipt | null | undefined,
+  second: ApprovalOnlyTrialReceipt | null | undefined,
+): boolean {
+  return Boolean(first && second
+    && first.approval_bypassed === true && second.approval_bypassed === true
+    && first.run_id === second.run_id
+    && first.episode_id === second.episode_id
+    && first.arm === 'OFF' && second.arm === 'OFF'
+    && first.case === second.case
+    && first.invocation_id === second.invocation_id
+    && first.configuration_sha256 === second.configuration_sha256
+    && first.fixture_sha256 === second.fixture_sha256)
+}
+
+function validate(input: TrialCheckInput): { q: Qualification, home: string, claimPath: string } {
+  if (!input.invocationId || input.invocationId.length > 160) throw new Error('trusted invocation id is required')
+  const runId = process.env.AW_AGENTTEAM_RUN_ID ?? ''
+  const episodeId = process.env.AW_BENCH_APPROVAL_ONLY_EPISODE_ID ?? ''
+  if (!/^[a-zA-Z0-9_-]{8,80}$/.test(runId) || process.env.AW_BENCH_APPROVAL_ONLY_ACK !== runId) throw new Error('run confirmation mismatch')
+  if (!/^[a-zA-Z0-9_-]{8,80}$/.test(episodeId) || process.env.AW_BENCH_APPROVAL_ONLY_ARM !== 'OFF') throw new Error('episode or manifest arm confirmation mismatch')
+  if (!/^[a-f0-9]{64}$/.test(process.env.AW_BENCH_APPROVAL_ONLY_MANIFEST_SHA256 ?? '')
+    || !/^[a-f0-9]{64}$/.test(process.env.AW_BENCH_APPROVAL_ONLY_CONFIG_SHA256 ?? '')) throw new Error('manifest/configuration digest confirmation is invalid')
+  if (process.env.AW_MODE !== 'home' || (process.env.AW_BENCH_MODE && process.env.AW_BENCH_MODE !== '0')) throw new Error('home mode is required and AW_BENCH_MODE must be disabled')
+
+  const rawHome = process.env.AW_HOME ?? ''
+  if (!isAbsolute(rawHome)) throw new Error('an explicit isolated AW_HOME is required')
+  const home = realpathSync(rawHome)
+  if (basename(home) !== 'aw-home' || basename(dirname(home)) !== 'OFF' || basename(dirname(dirname(home))) !== episodeId
+    || basename(dirname(dirname(dirname(home)))) !== 'episodes'
+    || basename(dirname(dirname(dirname(dirname(home))))) !== 'runtime'
+    || basename(dirname(dirname(dirname(dirname(dirname(home)))))) !== `${runId}-approval-ablation`) {
+    throw new Error('AW_HOME must be this run/episode OFF arm runtime directory')
+  }
+  if (resolve(rawHome) !== home) throw new Error('AW_HOME must not traverse a symlink')
+  const runRoot = dirname(dirname(dirname(dirname(dirname(home)))))
+  const expectedHome = join(runRoot, 'runtime', 'episodes', episodeId, 'OFF', 'aw-home')
+  if (home !== realpathSync(expectedHome)) throw new Error('AW_HOME path does not match the qualified OFF episode')
+
+  const aw = loopbackUrl(process.env.AW_BASE, 'AW_BASE')
+  const sim = loopbackUrl(process.env.SIM_BASE, 'SIM_BASE')
+  if (Number(sim.port) === 4010 || Number(aw.port) === 3001) throw new Error('shared default service ports are forbidden')
+
+  const qualificationPath = join(home, 'approval-only-qualification.json')
+  const { value: parsed } = readRegularJson(qualificationPath, 'approval-only qualification')
+  const q = parsed as unknown as Qualification
+  const expiry = Date.parse(q.expires_at_utc)
+  if (q.schema_version !== 2 || q.run_id !== runId || q.episode_id !== episodeId || q.arm !== 'OFF'
+    || resolve(q.aw_home) !== home || q.aw_base !== aw.origin || q.sim_base !== sim.origin
+    || q.configuration_sha256 !== process.env.AW_BENCH_APPROVAL_ONLY_CONFIG_SHA256
+    || q.manifest_sha256 !== process.env.AW_BENCH_APPROVAL_ONLY_MANIFEST_SHA256
+    || !Number.isFinite(expiry) || expiry <= Date.now() || expiry - Date.now() > 10 * 60_000) {
+    throw new Error('qualification is mismatched, expired, or not bound to this OFF episode')
+  }
+  if (!input.line?.simulated || q.line_id !== input.line.id || q.recipe_id !== input.recipeId || q.actor_id !== input.actorId
+    || q.hypothesis !== input.hypothesis || input.nodes.length !== 1 || input.params.length !== 1 || !Array.isArray(q.nodes)) {
+    throw new Error('the qualified simulated line, actor, recipe, candidate, and single target are required')
+  }
+  const sameParams = q.params.length === input.params.length && q.params.every((param, index) =>
+    param.node_id === input.params[index]?.node_id && Number(param.value) === Number(input.params[index]?.value))
+  if (!sameParams) throw new Error('candidate values differ from the qualified episode')
+
+  const endpoints = input.nodes.map((node) => {
+    const allowed = q.nodes.filter(entry => entry.node_id === node.id)
+    const hash = sha256(stableJson(node.driverConfig))
+    if (allowed.length !== 1 || allowed[0]!.driver !== node.driver || allowed[0]!.driver_config_sha256 !== hash) throw new Error('target or driver configuration differs from qualification')
+    const endpoint = targetEndpoint(node)
+    if (allowed[0]!.host !== endpoint.host || allowed[0]!.port !== endpoint.port) throw new Error('driver endpoint differs from qualification')
+    return endpoint
+  })
+  const fixtureSha = approvalOnlyFixtureSha256(input)
+  if (q.fixture_sha256 !== fixtureSha) throw new Error('actor/recipe/node/value/schema fixture digest mismatch')
+
+  const { value: manifest, bytes: manifestBytes } = readRegularJson(join(runRoot, 'manifest.json'), 'A1 pilot manifest')
+  const { value: configuration } = readRegularJson(join(runRoot, 'configuration.json'), 'A1 pilot configuration')
+  if (sha256(manifestBytes) !== q.manifest_sha256 || configurationSha256(configuration) !== q.configuration_sha256
+    || manifest.schema_version !== 'a1-approval-pilot-v1' || manifest.run_id !== runId
+    || manifest.study_type !== 'descriptive-pilot' || manifest.configuration_sha256 !== q.configuration_sha256
+    || stableJson(manifest.network_isolation) !== stableJson({ mode: 'docker-network-none', loopback_only: true })
+    || configuration.run_id !== runId || configuration.configuration_sha256 !== q.configuration_sha256) {
+    throw new Error('run manifest/configuration changed after episode qualification')
+  }
+  const registered = (manifest.episodes as Manifest['episodes'] | undefined)?.filter(row => row.episode_id === episodeId) ?? []
+  if (registered.length !== 1) throw new Error('episode id is absent or duplicated in the frozen manifest')
+  const row = registered[0]!
+  if (row.case !== q.case || row.arm_order.length !== 2 || [...row.arm_order].sort().join(',') !== 'OFF,ON'
+    || row.actor_id !== q.actor_id || row.line_id !== q.line_id
+    || row.recipe_id !== q.recipe_id || row.hypothesis !== q.hypothesis || row.fixture_sha256 !== q.fixture_sha256
+    || stableJson(row.params) !== stableJson(q.params)) throw new Error('episode qualification differs from its preregistered manifest row')
+
+  assertLoopbackOnlyNetworkNamespace(networkInterfaces())
+  const simRoot = realpathSync(q.simulator_root)
+  if (simRoot !== realpathSync(join(runRoot, 'runtime', 'episodes', episodeId, 'OFF', 'simulator')) || !Number.isInteger(q.simulator_pid) || q.simulator_pid <= 0) {
+    throw new Error('private simulator root/PID mismatch')
+  }
+  const commandLine = readFileSync(`/proc/${q.simulator_pid}/cmdline`, 'utf8').replaceAll('\0', ' ').replaceAll('\\', '/').toLowerCase()
+  if (!process.kill(q.simulator_pid, 0)) throw new Error('simulator PID is not alive')
+  if (!commandLine.includes(`${simRoot.replaceAll('\\', '/').toLowerCase()}/src/server/index.ts`)) throw new Error('simulator PID does not own this run\'s entry point')
+  assertListener(Number(aw.port), process.pid)
+  for (const port of new Set([Number(sim.port), ...endpoints.map(endpoint => endpoint.port)])) assertListener(port, q.simulator_pid)
+  return { q, home, claimPath: join(home, 'approval-only-claim.json') }
+}
+
+/** Validate the fixed OFF episode at approval time, then require atomic one-shot dispatch consumption. */
+export function approvalOnlyTrialReceipt(input: TrialCheckInput): ApprovalOnlyTrialReceipt | null {
   const requested = process.env.AW_BENCH_APPROVAL_ONLY
   if (requested == null || requested === '' || requested === '0') return null
   try {
     if (requested !== '1') throw new Error('AW_BENCH_APPROVAL_ONLY must be 1 or disabled')
-    const runId = process.env.AW_AGENTTEAM_RUN_ID ?? ''
-    if (!/^[a-zA-Z0-9_-]{8,80}$/.test(runId) || process.env.AW_BENCH_APPROVAL_ONLY_ACK !== runId) throw new Error('run confirmation mismatch')
-    if (process.env.AW_MODE !== 'home' || (process.env.AW_BENCH_MODE && process.env.AW_BENCH_MODE !== '0')) throw new Error('home mode is required and AW_BENCH_MODE must be disabled')
-    const rawHome = process.env.AW_HOME ?? ''
-    if (!isAbsolute(rawHome)) throw new Error('an explicit isolated AW_HOME is required')
-    const home = realpathSync(rawHome)
-    if (basename(home) !== 'aw-home' || basename(dirname(home)) !== 'runtime' || !basename(dirname(dirname(home))).startsWith(runId)) {
-      throw new Error('AW_HOME must be this run\'s runtime/aw-home directory')
-    }
-    const aw = loopbackUrl(process.env.AW_BASE, 'AW_BASE')
-    const sim = loopbackUrl(process.env.SIM_BASE, 'SIM_BASE')
-    if (Number(sim.port) === 4010 || Number(aw.port) === 3001) throw new Error('shared default service ports are forbidden')
-    const qualificationPath = join(home, 'approval-only-qualification.json')
-    if (!lstatSync(qualificationPath).isFile() || lstatSync(qualificationPath).isSymbolicLink()) throw new Error('qualification must be a regular run-private file')
-    const q = JSON.parse(readFileSync(qualificationPath, 'utf8')) as Qualification
-    const expiry = Date.parse(q.expires_at_utc)
-    if (q.schema_version !== 1 || q.run_id !== runId || resolve(q.aw_home) !== home || q.aw_base !== aw.origin || q.sim_base !== sim.origin
-      || !Number.isFinite(expiry) || expiry <= Date.now() || expiry - Date.now() > 3_600_000) throw new Error('qualification is mismatched or expired')
-    if (!input.line?.simulated || q.line_id !== input.line.id || q.recipe_id !== input.recipeId || input.nodes.length !== 1 || !Array.isArray(q.nodes)) {
-      throw new Error('the qualified simulated line, recipe and targets are required')
-    }
-    const endpoints = input.nodes.map((node) => {
-      const allowed = q.nodes.filter(entry => entry.node_id === node.id)
-      const hash = createHash('sha256').update(JSON.stringify(node.driverConfig)).digest('hex')
-      if (allowed.length !== 1 || allowed[0]!.driver !== node.driver || allowed[0]!.driver_config_sha256 !== hash) throw new Error('target or driver configuration differs from qualification')
-      const endpoint = targetEndpoint(node)
-      if (endpoint && (allowed[0]!.host !== endpoint.host || allowed[0]!.port !== endpoint.port)) throw new Error('driver endpoint differs from qualification')
-      return endpoint
-    }).filter((endpoint): endpoint is { host: string, port: number } => endpoint !== null)
-    if (endpoints.length) {
-      if (process.platform !== 'win32') throw new Error('simulator PID verification is supported only on Windows')
-      const simRoot = realpathSync(q.simulator_root)
-      if (simRoot !== realpathSync(join(dirname(home), 'simulator')) || !Number.isInteger(q.simulator_pid) || q.simulator_pid <= 0) throw new Error('private simulator root/PID mismatch')
-      const commandLine = execFileSync('powershell.exe', ['-NoProfile', '-NonInteractive', '-Command', `(Get-CimInstance Win32_Process -Filter "ProcessId=${q.simulator_pid}").CommandLine`], { encoding: 'utf8', timeout: 8000, maxBuffer: 64 * 1024 })
-        .replaceAll('\\', '/').toLowerCase()
-      if (!commandLine.includes(`${simRoot.replaceAll('\\', '/').toLowerCase()}/src/server/index.ts`)) throw new Error('simulator PID does not own this run\'s entry point')
-      assertListener(Number(aw.port), process.pid)
-      for (const port of new Set([Number(sim.port), ...endpoints.map(endpoint => endpoint.port)])) assertListener(port, q.simulator_pid)
-    }
-    return { approval_bypassed: true, run_id: runId }
+    const { q, home, claimPath } = validate(input)
+    return withClaimLock(home, () => {
+      if (input.stage === 'approval') {
+        const claim = {
+          schema_version: 1,
+          state: 'claimed',
+          run_id: q.run_id,
+          episode_id: q.episode_id,
+          invocation_id: input.invocationId,
+          arm: q.arm,
+          case: q.case,
+          configuration_sha256: q.configuration_sha256,
+          fixture_sha256: q.fixture_sha256,
+          claimed_at_utc: new Date().toISOString(),
+        }
+        const fd = openSync(claimPath, 'wx', 0o600)
+        try {
+          writeFileSync(fd, `${JSON.stringify(claim, null, 2)}\n`, 'utf8')
+          fsyncSync(fd)
+        }
+        finally { closeSync(fd) }
+      }
+      else {
+        const existing = readClaim(claimPath)
+        if (existing.state !== 'claimed' || existing.run_id !== q.run_id || existing.episode_id !== q.episode_id
+          || existing.arm !== 'OFF' || existing.invocation_id !== input.invocationId
+          || existing.fixture_sha256 !== q.fixture_sha256 || existing.configuration_sha256 !== q.configuration_sha256) {
+          throw new Error('dispatch does not match the claimed one-shot episode/invocation')
+        }
+        const consumedPath = join(home, 'approval-only-consumed.json')
+        const consumed = {
+          schema_version: 1,
+          state: 'consumed-before-dispatch',
+          run_id: q.run_id,
+          episode_id: q.episode_id,
+          invocation_id: input.invocationId,
+          arm: q.arm,
+          case: q.case,
+          configuration_sha256: q.configuration_sha256,
+          fixture_sha256: q.fixture_sha256,
+          consumed_at_utc: new Date().toISOString(),
+        }
+        const fd = openSync(consumedPath, 'wx', 0o600)
+        try {
+          writeFileSync(fd, `${JSON.stringify(consumed, null, 2)}\n`, 'utf8')
+          fsyncSync(fd)
+        }
+        finally { closeSync(fd) }
+      }
+      return receiptOf(q, input.invocationId)
+    })
   }
   catch (err) {
     throw new Error(`Approval-only trial refused: ${err instanceof Error ? err.message : String(err)}`, { cause: err })

package/server/services/workshop/agents/industrial/dcw-tools.ts

@@ -7,6 +7,7 @@ import { agentBadgeLabel } from '../agent-badge'
 import { findDcwTemplate } from '../../dcw/dcw-templates'
 import { getActiveLineRun } from '../../dcw/line-run'
 import { getAgentNodeBindingRepo } from '../node-bindings.repo'
+import { scientificPayloadForWrite } from './identifiability-tools'
 import { getDaqNodeRepo } from '../../daq/daq-node.repo'
 import { getDcwController } from '../../dcw/dcw-controller'
 import { getDcwLineRepo } from '../../dcw/dcw-line.repo'
@@ -204,11 +205,14 @@ async function dcwControlGovernedLegacy(agentId: string, args: { node_id?: strin
     const via = recipeBinding && authorizedRecipe
       ? `经配方授权「${authorizedRecipe.name}」${lineManual ? '(产线手动模式)' : ''}${channelManual ? '(频道手动模式)' : ''}`
       : (channelManual ? '(频道手动模式)' : '')
+    // P5 审批卡科学载荷:上次可辨识性判定 + 可证伪方式(卡片自动填,不再只有散文)
+    const sci = scientificPayloadForWrite(nodeId, node.name, value)
     const ap = await requestManualApproval({
       agentId,
       nodeId,
+      payload: sci.payload,
       // 审批卡可见"为什么":Agent 依据(hypothesis)随卡展示,人工批准时有判断材料
-      detail: `${node.name}(${tpl?.ch ?? node.templateKey})设定 ${value}${node.unit},有效写入区间 ${bd.effective.min}~${bd.effective.max}${node.unit}(${bd.layers.map(l => l.label).join(' ∩ ')})${via ? ` ${via}` : ''}${hypothesisText ? `;Agent 依据:${hypothesisText.slice(0, 200)}` : ''}`,
+      detail: `${node.name}(${tpl?.ch ?? node.templateKey})设定 ${value}${node.unit},有效写入区间 ${bd.effective.min}~${bd.effective.max}${node.unit}(${bd.layers.map(l => l.label).join(' ∩ ')})${via ? ` ${via}` : ''}${hypothesisText ? `;Agent 依据:${hypothesisText.slice(0, 200)}` : ''}\n${sci.lines.join('\n')}`,
       // 批准后复核同一条授权路径:直绑看 dcw 绑定,配方授权看配方绑定与参数仍存在
       verify: recipeBinding
         ? () => {
@@ -245,6 +249,8 @@ async function dcwControlGovernedLegacy(agentId: string, args: { node_id?: strin
       taskId: args.task_id ? String(args.task_id) : undefined,
       hypothesis: args.hypothesis ? String(args.hypothesis) : '',
       approvalId: approvalId || undefined,
+      // v34 干预台账归因:写入发生时所在 Channel(台账 path/channel 维度)
+      channelId: channelId ?? undefined,
       // 台账口径(三模式):该次写入发生时的频道生效执行模式(事后审计"这条写入当时是什么模式")
       executionMode: execMode,
     }