dsh-punky-swarm 0.4.1 → 0.4.3

package/CHANGELOG.md

@@ -1,3 +1,40 @@
+## 0.4.3（2026-09-07）
+
+### 调用级护栏拒绝可见性
+
+- 护栏拦截明示：工具调用送入人工审批后被拒绝（含审批服务不可达、无可用 agent 等降级情形）时，Agent 收到的拒绝不再只是「用户拒绝了该工具」的泛化提示，而会携带护栏标注、命中规则、违规说明与查阅路径——Agent 与用户均可识别该拒绝源于护栏对疑似敏感数据调用的拦截，并可按违规说明修正参数后重发合规调用；非拦截场景行为保持不变。
+- 拒绝文本携带命中规则：拒绝原因末尾追加命中规则及其预设归属（如 L1-A10 · preset l1-sensitive），人工审批请求与直接拒绝路径均携带，用户在批准/拒绝前即可核对所触发的具体规则。
+- 行为说明同步：拒绝可见性语义（拦截明示与规则引用，含边界说明）随双语主题文档 guardrails-hook 同步更新。
+
+### 护栏预设逐条审阅清单
+
+- presets/hook-rules/README.md 新增逐条规则审阅清单：敏感数据防护 12 条与资源边界 6 条，按规则编号 / 预设归属 / 类别 / 生效原语 / 触发工具 / 匹配摘要 / 违规说明逐条成表，供用户与 Agent 主动审阅护栏规则全集；配套一致性断言守护清单与规则文件同步。
+
+### 发布整理
+
+- 版本 0.4.2 → 0.4.3；变更记录整理与发布前内部口径清查。
+
+## 0.4.2（2026-09-06）
+
+### 治理配置面板：Lane 过期检测与重派探针
+
+- 治理配置页新增 **Lane 过期检测** 与 **长跑超时重派探针** 两级开关：前者控制 running lane 的心跳过期扫描，后者控制长时间无 checkpoint / 活动进展 lane 的重派候选探测。开关随护栏共用同一保存通道写入运行配置，保存即热更生效，进程重启后按 runtime.json 自动对账，无需重复设置；出厂默认开（缺省即开、显式关闭才停），关闭仅停止扫描与候选探测，不改动已落盘批次 / 成员状态，重新开启后自基线恢复扫描。
+- 长跑时间窗口面板化：**超时窗口**（默认 20 分钟）与**无进展窗口**（默认 5 分钟）可在表单以分钟输入，保存时自动换算毫秒生效，无需手工编辑配置文件。
+- 「违规自动升级」说明文案优化：直接说明触发次数 / 窗口阈值的判定与升级暂停行为，去除括号提示与实现细节，降低配置理解成本。
+- 配套新增回归测试：覆盖开关保存热更、进程重启对账与长跑无进展候选场景。
+
+### 无 Manager 批次的长跑候选消费
+
+- 未拉起编排 Manager 的批次运行期间，由任务负责人（Leader）兜底承担长跑候选消费：读取候选广播、核对 lane 探针状态与 checkpoint / 活动进展，按半自动规则裁决继续观察或重新派发；已拉起 Manager 的批次仍由 Manager 完成调度。
+
+### 注释与文档口径统一
+
+- 「出厂默认开、显式关闭才停」口径统一：Lane 过期检测与长跑探针的默认开启说明跨代码注释、预设说明与双语文档对齐（纯注释与文档改动，零逻辑变更）。
+
+### 发布整理
+
+- 版本 0.4.1 → 0.4.2；变更记录整理。
+
 ## 0.4.1（2026-09-05）
 
 ### 治理预设规则包
@@ -8,7 +45,7 @@
 ### Web UI 治理配置页 + runtime.json 写通道
 
 - 治理配置设置页（Web UI 设置区）：护栏开关、规则预设、违规自动升级（触发次数 / 窗口）可视化配置；页面保存即时生效、无需重启。
-- runtime.json 热写通道：保存请求经 config-trust 校验（顶层白名单 / 值域 / preset 与内联规则冲突守卫）后落盘 runtime.json，400 校验拒绝不回写；窗口秒输入后端毫秒归一化（windowSeconds → windowMs，线协议键不落盘）。
+- runtime.json 热写通道：保存请求经 config-trust 校验（顶层白名单 / 值域 / preset 与内联规则冲突守卫）后落盘 runtime.json，400 校验拒绝不落盘；窗口秒输入后端毫秒归一化（windowSeconds → windowMs，线协议键不落盘）。
 - 随包双语主题文档：docs/webui-governance-config(.en).md。
 
 ### lane_longrun 超时无进展探针
@@ -78,17 +115,17 @@
 
 ## 0.3.3（2026-08-22）
 
-### 国标 AIP 兼容契约对齐（aip-gb-fix → aip-align-publish 合入主仓库）
+### 国标 AIP 兼容契约对齐
 
-- **aip.enabled 默认开启**（readCapability 合并 `{enabled:true}`）；智能体描述改为 ACS 字段集（P4，根对象 20 键 必填 14/可选 6、AgentSkill 8 键，协议 02.01，旧 14+8 属性降级为 toLegacyDescriptor 兼容映射层）；消息映射对齐 ACPs AIP（P6，aip-format.js Message/TaskCommand/Session 三函数，mailbox/batch 附 ACPs 投影）；身份体系（P2/P3，默认关）：AIC 身份码（前缀 1.2.156.3088 + CRC-16/CCITT-FALSE + Base36）+ CAI 身份证书 + 可插拔签名（默认 ECDSA-P256/RSA-2048）；发现服务（P5/ADP，默认开）：`lib/discovery/` 新域 + `POST /api/dsh-punky-swarm/discover`（type 四类/filter 34 运算符/错误码 40000~40005/50001）+ `GET /.well-known/aip`；P7 工具 6 属性保持现状（待正式文本校准）。
+- **aip.enabled 默认开启**（readCapability 合并 `{enabled:true}`）；智能体描述改为 ACS 字段集（根对象 20 键 必填 14/可选 6、AgentSkill 8 键，协议 02.01，旧 14+8 属性降级为 toLegacyDescriptor 兼容映射层）；消息映射对齐 ACPs AIP（aip-format.js Message/TaskCommand/Session 三函数，mailbox/batch 附 ACPs 投影）；身份体系（默认关）：AIC 身份码（前缀 1.2.156.3088 + CRC-16/CCITT-FALSE + Base36）+ CAI 身份证书 + 可插拔签名（默认 ECDSA-P256/RSA-2048）；发现服务（ADP，默认开）：`lib/discovery/` 新域 + `POST /api/dsh-punky-swarm/discover`（type 四类/filter 34 运算符/错误码 40000~40005/50001）+ `GET /.well-known/aip`；工具描述 6 属性保持现状（待正式协议文本校准）。
 
-### ACPs 通讯方式（P1-P3，默认关）
+### ACPs 通讯方式（默认关）
 
-- **能力总开关默认关（U-D2）**：`acps.enabled` 与 `acps.endpoint.enabled` 均默认 `false`，关闭时零运行时路径；对外 mTLS 服务端点（P1）：独立 HTTPS 监听器（node:https/tls 原生、零新依赖），默认端口 9443/host 127.0.0.1、TLSv1.3 + 双向证书（CERT_REQUIRED）、端点 `POST /acps/rpc`（AIP JSON-RPC）+ `GET /.well-known/acs.json`（ACS 14 必填键 + mutualTLS + JSONRPC）+ `GET /health`，证书 CA 自签（CN=AIC/SAN=acps://AIC，默认 `<root>/acps/certs`）；内部桥接（P2，默认关）：`acps.bridge`（同进程双向，inbound 默认关 D14 需显式 `acps.bridge.inbound=true`；outbound = mailbox→ACPs 投影/投递；`/rpc→bridge 接线` DEF-V6-1，inbound=false 时协议级 rejected INBOUND_DISABLED）；registry 对接（P3/R1 半自动注册，默认关）：login→upsertAgent→submitAgent（人工工批不自动跳过）→requestEab→queryAcs，EAB macKey **AES-256-GCM 加密存证**（D13，与参考实现 SM4-CBC 标注差异）；discovery 对接（P3/DS1 ADP 客户端，默认关）：`POST {baseUrl}/discover` 查询外部 Agent（type 四类/34 运算符与本地共享协议常量），scope=local/external/both（默认 local）；能力注册表扩至 9 键（aip/identity/discovery/verify/watch/worktree/budget/trajectory/**acps**，acps 与 identity 为默认关能力）；未实现项如实标注（P4 工具调用待正式文本；SM2 签名无参考证据可插拔；DS3 mini-ADSP 仅预留签名；V2/V4 与参考实现真实互通待 demo 验证）。
+- **能力总开关默认关**：`acps.enabled` 与 `acps.endpoint.enabled` 均默认 `false`，关闭时零运行时路径；对外 mTLS 服务端点：独立 HTTPS 监听器（node:https/tls 原生、零新依赖），默认端口 9443/host 127.0.0.1、TLSv1.3 + 双向证书（CERT_REQUIRED）、端点 `POST /acps/rpc`（AIP JSON-RPC）+ `GET /.well-known/acs.json`（ACS 14 必填键 + mutualTLS + JSONRPC）+ `GET /health`，证书 CA 自签（CN=AIC/SAN=acps://AIC，默认 `<root>/acps/certs`）；内部桥接（默认关）：`acps.bridge`（同进程双向，inbound 默认关需显式 `acps.bridge.inbound=true`；outbound = mailbox→ACPs 投影/投递；`/rpc→bridge 接线` 已通，inbound=false 时协议级 rejected INBOUND_DISABLED）；registry 对接（半自动注册，默认关）：login→upsertAgent→submitAgent（人工工批不自动跳过）→requestEab→queryAcs，EAB macKey **AES-256-GCM 加密存证**（与参考实现 SM4-CBC 标注差异）；discovery 对接（ADP 客户端，默认关）：`POST {baseUrl}/discover` 查询外部 Agent（type 四类/34 运算符与本地共享协议常量），scope=local/external/both（默认 local）；能力注册表扩至 9 键（aip/identity/discovery/verify/watch/worktree/budget/trajectory/**acps**，acps 与 identity 为默认关能力）；未实现项如实标注（工具调用待正式协议文本校准；SM2 签名无参考证据可插拔；mini-ADSP 仅预留签名；与参考实现真实互通待 demo 验证）。
 
-### 护栏根治 + 文档补建（aip-acps-cleanup）
+### 护栏根治 + 文档补建
 
-- T2.6 护栏 `\r?\n` 修复（merge-agent 护栏）；`README.en.md` 英文文档补建（22 KB，含中文互链）。
+- 护栏 `\r?\n` 处理修复（merge-agent 护栏）；`README.en.md` 英文文档补建（22 KB，含中文互链）。
 
 ## 0.3.2（2026-08-22）
 
@@ -100,15 +137,15 @@
 
 ### 许可合规修正 + npm 发布
 - 许可唯一化：全仓表述统一为 AGPL-3.0 唯一许可（AGPL-3.0-only），移除商业授权字段；其他授权一律「联系作者获得许可」（README.md / README.en.md / CHANGELOG 0.3.0 记载 / docs/OPENSOURCE.md）
-- 品牌残留清零：Swarm 集群品牌词全包改写为 dsh 语义历史沿革（README 中英 L22、SKILL.md L152/L195、CHANGELOG 历史记载）
+- 品牌残留清零：Swarm 集群品牌词全包改写为 dsh 语义历史沿革（README / SKILL.md / CHANGELOG 历史记载）
 - npm 发布：dsh-punky-swarm@0.3.1 发布至 npm registry（`npm install -g dsh-punky-swarm`），README / docs/OPENSOURCE 安装章节同步更新
-- 本地库同步：D:\dsh\Punky-plugin 与发布包文本/版本号对齐（排除 backup/node_modules/backups）
+- 发布包与主仓库文本/版本号对齐（排除备份与依赖目录）
 - 审计清理：docs/OPENSOURCE.md checklist LICENSE 项修正为 AGPL-3.0；本地库 package-lock.json root license 修正为 AGPL-3.0-only
 
 ## 0.3.0（2026-08-21）
 
-### 0.3.0 发布：8 批次升级 + AGPL-3.0 唯一许可 + 治理能力默认全开
-- 8 批次能力升级：引擎修复（目录 consume 判定 / 产物根指引 / 难度门禁豁免）+ lib 四域解耦（43 文件，删 3 单体）+ 国标 AIP 兼容 + 7 能力域（资产/装配/桥接/通信/面板/状态/验证/监控）+ 生命周期 + 恢复机制
+### 0.3.0 发布：AGPL-3.0 唯一许可 + 治理能力默认全开
+- 能力升级：引擎修复（目录 consume 判定 / 产物根指引 / 难度门禁豁免）+ lib 四域解耦（43 文件，删 3 单体）+ 国标 AIP 兼容 + 7 能力域（资产/装配/桥接/通信/面板/状态/验证/监控）+ 生命周期 + 恢复机制
 - 测试 93 → 276 全绿（27 测试文件）
 - 许可切换：Apache-2.0 → AGPL-3.0 唯一许可（AGPL-3.0-only；其他授权一律联系作者获得许可，自 0.3.0 起）
 - 治理能力默认全开：wavePlan 三层 DAG + 引擎级门禁 + 状态机 + 锁/mailbox + 会话隔离
@@ -127,7 +164,7 @@
 - 新增 SKILL.md「Manager 角色派发模板」：Manager=代劳指挥（只指挥不执行、不派发子代理），指挥循环 5 步（batch_status 读黑板 → mailbox_send 建议派发 → mailbox_read 收通知 → member_status/settle 结算 → report 批次完成）；任务包模板补 worker 双通道回执约定（report→Leader 简短 + mailbox_send outbox→Manager 详细）
 - 新增 persona 纪律 0g Leader 唤醒协议：worker 由 Leader 派发（depth-1 直系）、Manager mailbox 建议、report→send_message 一行唤醒、Leader 不做调度决策（调度循环在 Manager 上下文）
 - manager.md 协作方式 5 要素更新：不派发子代理 / mailbox 建议派发 / 收 worker 通知 / member_settle 结算裁决 / worker 双通道回执
-- references/ 残留清零：constitution/workflow/call-chain-matrix-template/leader-decision-pack 4 文件 Swarm 集群运行时术语（HITL/HATL/Converge/任务包）改写为 dsh 语义（人审门禁/gap-list 对账/lane 任务）；role 8 文件重写（4 段骨架 dsh 工具面对齐）
+- references/ 残留术语改写：Swarm 集群运行时术语（HITL/HATL/Converge/任务包）统一为 dsh 治理语义（人审门禁/gap-list 对账/lane 任务）。
 - 测试 93/93 全绿；安装链路验证（模块加载 + syncAssets 幂等）通过
 
 ## 0.2.0（2026-08-19）

package/README.en.md

@@ -15,8 +15,8 @@
 - **In-process messaging with loop protection** — the mailbox's three boxes (inbox / outbox / broadcast) use atomic writes and acknowledgements; loop protection suppresses message storms, and communication paths stay traceable.
 - **Crash-recoverable** — heartbeat expiry detection plus progress checkpoint preservation: after a crash the scene and artifacts remain inspectable and a new worker can take over; no automatic resume — a failed task is redone by opening a new batch.
 - **Read-only monitoring panel** — the Web UI shows batches, lane states, and the event timeline directly; read-only, non-intrusive, so nothing can be altered by accident.
-- **Call-level guardrails (6 primitives)** — the call-level line of defense in two-layer governance (local-first, evidence-auditable): besides the pre-dispatch difficulty gate, every tool call is adjudicated per call against the six primitives ALLOW / DENY / REQUIRE_APPROVAL / NARROW / DEFER / PAUSE to decide whether it is out of bounds; a hit produces a **tamper-evident refusal receipt** (sha256 hash-chain anchored; re-checking can locate where tampering happened). Adjudication is deterministic, predictable, and easy to test — suited to local multi-agent orchestration needing **auditable out-of-bounds prevention with deterministic, testable governance**. Guardrail events are observable at the event level through receipts and event-stream files (verifiable), with no dedicated UI panel; out of the box `rules` is empty (zero interception) and takes effect once rules are configured on demand.
-- **Hot-updatable configuration, no restart** — guardrail rules and switches written to `runtime.json` take effect immediately, with no process restart.
+- **Call-level guardrails (6 primitives)** — the call-level line of defense in two-layer governance (local-first, evidence-auditable): besides the pre-dispatch difficulty gate, every tool call is adjudicated per call against the six primitives ALLOW / DENY / REQUIRE_APPROVAL / NARROW / DEFER / PAUSE to decide whether it is out of bounds; a hit produces a **tamper-evident refusal receipt** (sha256 hash-chain anchored; re-checking can locate where tampering happened). Adjudication is deterministic, predictable, and easy to test — suited to local multi-agent orchestration needing **auditable out-of-bounds prevention with deterministic, testable governance**. Guardrail events are observable at the event level through receipts and event-stream files (verifiable); the switches and rules are configured on the "Punky Swarm Governance" page in the Settings sidebar (out of the box `rules` is empty (zero interception) and takes effect once rules are configured on demand).
+- **Hot-updatable configuration, no restart** — guardrail rules and switches, plus the watch capability switches (lane heartbeat / longrun probe), written to `runtime.json` take effect immediately, with no process restart; on restart they are also reconciled against `runtime.json`.
 - **National-standard AIP compatible** — follows the descriptor structures of GB/Z 185-2026 (Artificial Intelligence — Agent Interconnection): tool 6 attributes / agent ACS / message-task-session mapping; additive only, pluggable.
 - **Optional ACPs communication** — external mTLS service endpoint, registry registration, and external discovery, all off by default (secure default).
 - **Runs locally, works out of the box** — zero cloud dependency, zero network exposure by default; a single npm package contains the plugin engine, the Punky Swarm preset, and the jiufeng-team role guide, with bilingual (Chinese / English) documentation.
@@ -68,6 +68,8 @@ The plugin ships a **read-only** monitoring panel — the third tab, "Conversati
 - **Batch detail**: lane status cards (state, task summary, gate missing items, layer and dependencies), event timeline, inbox counts;
 - **Read-only by design**: 3-second auto-refresh, follows the light/dark theme; batch and gate states are view-only, and governance operations are carried out by the Leader through governance tools.
 
+The Settings sidebar also provides a "**Punky Swarm Governance**" page (writable, saveable): configure the guardrails (`governance.hook` switch/preset/escalation/narrowing) and the lane capability switches (`watch.enabled` / `watch.longrun.enabled`) here; saving writes `runtime.json` and takes effect immediately with no dsh restart. See [docs/webui-governance-config.en.md](docs/webui-governance-config.en.md).
+
 ## Configuration at a Glance
 
 Plugin configuration is centralized in `cordis.patch.yml`; the key assembly keys and their defaults:
@@ -81,6 +83,8 @@ Plugin configuration is centralized in `cordis.patch.yml`; the key assembly keys
 | Identity system (AIC / CAI / signing) | `aip.identity.enabled` | Off |
 | ACPs communication (mTLS endpoint / bridge / registry / discovery) | `acps.*` | Off (when off: no listeners, no timers, no network) |
 
+> Note: `capabilities.watch` includes a `longrun` sub-switch (longrun timeout re-dispatch probe, on by factory default, off only when explicitly set to `false`); both `watch.enabled` and `watch.longrun.enabled` can be hot-toggled on the "Punky Swarm Governance" page, written to `runtime.json` and taking effect immediately (see "Hot-updatable configuration, no restart" above and [docs/webui-governance-config.en.md](docs/webui-governance-config.en.md)).
+
 Key semantics, configuration examples, and rule authoring: see [docs/governance-technical.en.md](docs/governance-technical.en.md) and [docs/guardrails-hook.en.md](docs/guardrails-hook.en.md).
 
 ### Secure defaults
@@ -117,7 +121,8 @@ Technical details live under `docs/` (each document ships with an English versio
 
 | Document | Contents |
 |---|---|
-| [docs/governance-technical.en.md](docs/governance-technical.en.md) | Batch-level governance technical manual: three-layer gates, state machine, wavePlan contract, 20 governance tools reference, assembly key table, lifecycle |
+| [docs/governance-technical.en.md](docs/governance-technical.en.md) | Batch-level governance technical manual: three-layer gates, state machine, wavePlan contract, 21 governance tools reference, assembly key table, lifecycle |
+| [docs/webui-governance-config.en.md](docs/webui-governance-config.en.md) | Web UI "Governance Configuration" page guide: save/activation semantics and behavior boundaries for guardrail switch/presets and the lane capability switch (watch) |
 | [docs/guardrails-hook.en.md](docs/guardrails-hook.en.md) | Call-level guardrail technical manual: runtime semantics of the 6 primitives, rule configuration and examples, refusal receipts and verification, hot update, boundaries and non-provisions, capability boundaries & trade-offs |
 | [docs/aip-compliance.en.md](docs/aip-compliance.en.md) | National-standard AIP compliance details: tool 6 attributes, ACS field set, message / task / session mapping, identity system |
 | [docs/acps-communication.en.md](docs/acps-communication.en.md) | ACPs communication details: mTLS endpoints, internal bridge, registry / discovery, configuration examples, capability boundaries |

package/README.md

@@ -15,8 +15,8 @@ English: [README.en.md](README.en.md)
 - **进程内消息与环防护**——mailbox 三箱（inbox / outbox / broadcast）原子写与确认，环防护抑制消息风暴，通信路径可追踪。
 - **崩溃可恢复**——心跳过期检测 + 进度 checkpoint 保全：崩溃后现场与产物可查、新 worker 可接续；不自动续跑，失败任务重做即开新批次。
 - **只读监控面板**——Web UI 直接查看批次、lane 状态与事件时间线，只读不干预，人工不可误改。
-- **工具调用级护栏（6 原语）**——双层治理中的调用级防线（本地优先、证据可审计）：除派发前难度门禁外，每次工具调用再按 ALLOW / DENY / REQUIRE_APPROVAL / NARROW / DEFER / PAUSE 六原语逐调用裁决是否越界，命中即产出**可验篡改的拒绝收据**（sha256 哈希链锚定，复核可定位篡改位置）。裁决确定、可预期、便于测试，适合需要**可审计防越界、确定性可测试治理**的本地多 Agent 编排。护栏事件以收据与事件流文件留痕、可复核（事件级可观测），暂无独立 UI 面板；出厂 `rules` 为空即零拦截，按需配置规则后生效。
-- **热更新配置，免重启**——护栏规则与开关写入 `runtime.json` 即时生效，进程无需重启。
+- **工具调用级护栏（6 原语）**——双层治理中的调用级防线（本地优先、证据可审计）：除派发前难度门禁外，每次工具调用再按 ALLOW / DENY / REQUIRE_APPROVAL / NARROW / DEFER / PAUSE 六原语逐调用裁决是否越界，命中即产出**可验篡改的拒绝收据**（sha256 哈希链锚定，复核可定位篡改位置）。裁决确定、可预期、便于测试，适合需要**可审计防越界、确定性可测试治理**的本地多 Agent 编排。护栏事件以收据与事件流文件留痕、可复核（事件级可观测）；开关与规则在设置侧边栏「蟛蜞治理配置」页配置（出厂 `rules` 为空即零拦截，按需配置规则后生效）。
+- **热更新配置，免重启**——护栏规则与开关、watch 能力开关（lane 心跳/长跑探针）写入 `runtime.json` 即时生效，进程无需重启；重启时亦按 `runtime.json` 对账生效。
 - **国标 AIP 兼容**——遵循《人工智能 智能体互联》GB/Z 185-2026 描述结构（工具 6 属性 / 智能体 ACS / 消息任务会话映射），仅增不改、可插拔。
 - **可选的 ACPs 通讯**——对外 mTLS 服务端点、registry 注册与外部发现，默认全部关闭（安全默认）。
 - **本地运行，开箱即用**——零云依赖、默认零网络暴露；单一 npm 包内含插件引擎、Punky Swarm 预设与 jiufeng-team 角色指引，附中英双语文档。
@@ -68,6 +68,8 @@ dsh web restart
 - **批次详情**：lane 状态卡（状态、任务简述、门禁缺件、层与依赖）、事件时间线、收件箱计数；
 - **只读设计**：3 秒自动刷新，跟随深浅主题；批次与门禁状态只能查看，治理操作由 Leader 通过治理工具完成。
 
+设置侧边栏另提供「**蟛蜞治理配置**」页（非只读，可保存）：在此配置护栏（`governance.hook` 开关/预设/升级/窄化）与 lane 能力开关（`watch.enabled` / `watch.longrun.enabled`），保存即写入 `runtime.json` 并即时生效、无需重启 dsh；详见 [docs/webui-governance-config.md](docs/webui-governance-config.md)。
+
 ## 配置速览
 
 插件配置集中在 `cordis.patch.yml`，关键装配键与默认值：
@@ -81,6 +83,8 @@ dsh web restart
 | 身份体系（AIC / CAI / 签名） | `aip.identity.enabled` | 关 |
 | ACPs 通讯（mTLS 端点 / 桥接 / registry / discovery） | `acps.*` | 关（关闭时无监听、无定时器、无网络） |
 
+> 注：`capabilities.watch` 含 `longrun` 子开关（长跑超时重派探针，出厂默认开，显式 `false` 才关）；`watch.enabled` 与 `watch.longrun.enabled` 均可在「蟛蜞治理配置」页热更开关，写入 `runtime.json` 即时生效（见「热更新配置，免重启」与 [docs/webui-governance-config.md](docs/webui-governance-config.md)）。
+
 各键语义、配置示例与规则写法见 [docs/governance-technical.md](docs/governance-technical.md) 与 [docs/guardrails-hook.md](docs/guardrails-hook.md)。
 
 ### 安全默认
@@ -117,7 +121,8 @@ flowchart LR
 
 | 文档 | 内容 |
 |---|---|
-| [docs/governance-technical.md](docs/governance-technical.md) | 批级治理技术手册：三层门禁、状态机、wavePlan 契约、20 治理工具参考、装配键表、生命周期 |
+| [docs/governance-technical.md](docs/governance-technical.md) | 批级治理技术手册：三层门禁、状态机、wavePlan 契约、21 治理工具参考、装配键表、生命周期 |
+| [docs/webui-governance-config.md](docs/webui-governance-config.md) | Web UI「治理配置」页说明：护栏开关/预设与 lane 能力开关（watch）的保存生效口径与行为边界 |
 | [docs/guardrails-hook.md](docs/guardrails-hook.md) | 调用级护栏技术手册：6 原语运行期语义、规则配置与示例、拒绝收据与验签、热更新、边界与不提供项、能力边界与取舍 |
 | [docs/aip-compliance.md](docs/aip-compliance.md) | 国标 AIP 兼容明细：工具 6 属性、ACS 字段集、消息/任务/会话映射、身份体系 |
 | [docs/acps-communication.md](docs/acps-communication.md) | ACPs 通讯明细：mTLS 端点、内部桥接、registry / discovery、配置示例、能力边界 |

package/cordis.patch.yml

@@ -31,7 +31,7 @@
           #   intervalsMinutes 退避档位（分钟，默认 [10,20,30]，冷场越久追问间隔越长）；maxMissed 硬停拍数
           #   （默认 3，连续 N 拍无活动 → appendEvent('lane.stalled') 停止追问，只标记不自动处置）；
           #   scanIntervalMinutes watchdog 扫描间隔（默认 1）；probeTemplate 可选覆写追问模板（{lane}/{batchId}/{missed} 占位）。
-          #   longrun 子键（长跑档探针，出厂默认开——用户定案修订，非设计默认关）：running lane 持续超
+          #   longrun 子键（长跑档探针，出厂默认开）：running lane 持续超
           #   maxDurationMs（默认 1200000=20min）且近 noProgressWindowMs（默认 300000=5min）无新 checkpoint
           #   且无活动（严格 AND）→ 同 tick 产 lane.longrun.candidate 事件 + mailbox broadcast 候选通知
           #   Manager 裁决（探针只标记不改 lane 状态；lane_longrun 工具并列注册，enabled=false 不注册、
@@ -39,12 +39,12 @@
           watch:
             enabled: true
             longrun:
-              enabled: true           # 出厂默认开（定案修订：显式 false 才关）
+              enabled: true           # 出厂默认开（显式 false 才关）
               maxDurationMs: 1200000  # 长跑超时阈值（默认 20min；正整数 ms，非法回退默认）
               noProgressWindowMs: 300000  # 无进展窗（默认 5min；正整数 ms，非法回退默认）
           # worktree 物理隔离（lane-tools）：enabled=true 时注册 lane_worktree_create / lane_worktree_merge / lane_checkpoint
           # （git worktree 隔离 + checkpoint 提交；与 lane_claim 逻辑锁互补——lane_claim 管状态层「写谁的」，
-          #  本组工具管工作区层「写到哪」；全能力默认开 → 工具总数 18（14+heartbeat+worktree 三件+log_export），回归已覆盖）。
+          #  本组工具管工作区层「写到哪」；工具总数：裸配置 20 / patch 全开 21（含 lane_longrun 与 lane_checkpoint_status）/ 显式关（worktree+watch 关）14）。
           worktree:
             enabled: true
             # merge agent 装配键：enabled=true 且宿主注入 mergeAgentSpawner 时，
@@ -66,28 +66,28 @@
           #   落盘到引擎产物根（可审计）；显式 enabled:false 可关闭（关闭时工具不注册）。
           logs:
             enabled: true
-        # 工具调用级护栏（governance hook，M2 阶段 2.2）：订阅宿主 tools/pre-execute + tools/post-execute，
+        # 工具调用级护栏（governance hook）：订阅宿主 tools/pre-execute + tools/post-execute，
         # 6 原语纯函数内核（ALLOW/DENY/REQUIRE_APPROVAL/DEFER/NARROW/PAUSE）；拒绝收据落盘
         # <root>/governance/refusals/<sessionId>/。rules 空表=零拦截（decide 恒 ALLOW，行为不变）。
-        # 分层：任务级=ctx.tools.guard 难度门禁（core.js:65，派发前治理）；调用级=本 hook（执行时治理）。
-        # 【已敲定 2026-08-31】默认开启（hook.enabled: true），可显式关闭（governance.hook.enabled=false）。
-        # 热更新（P3 已热切，harden-plan §5.4 A）：governance 键已纳入 runtime.json 白名单
-        # （lib/hot/config-watch.js ALLOWED_TOP_KEYS）——governance.hook 任一子键生效变化（enabled 翻转 /
-        # rules / flags / defaults）经 applyConfigChange ⑤ dispose+重挂即时生效，免重启；
+        # 分层：任务级=ctx.tools.guard 难度门禁（派发前治理）；调用级=本 hook（执行时治理）。
+        # 默认开启（hook.enabled: true），可显式关闭（governance.hook.enabled=false）。
+        # 热更新：governance 键已纳入 runtime.json 热更白名单
+        # ——governance.hook 任一子键生效变化（enabled 翻转 /
+        # rules / flags / defaults）经热更 dispose+重挂即时生效，免重启；
         # <root>/config/runtime.json 覆盖示例见 README（如 {"governance":{"hook":{"enabled":false}}}）。
         governance:
           hook:
             enabled: true      # 默认开启；空规则表 → decide 恒 ALLOW → 零行为变化
             rules: []          # 规则表（空=零拦截）；Rule 结构见 lib/governance/types.ts
-            # M5-b preset 装载键（preset-build）：引用随包预设（presets/hook-rules/ 三 JSON，注册 id 枚举：
+            # preset 装载键：引用随包预设（presets/hook-rules/ 三 JSON，注册 id 枚举：
             #   l1-sensitive / l2-resource / compose——不接受任意路径），保序展开拼接至 rules（inline rules 在后）。
             #   preset: 'l1-sensitive' 或 preset: ['l1-sensitive', 'l2-resource']（= compose 逐条等价，二选一互斥引用——
             #   同批引用 compose + l1-sensitive 会产生重复 id → 装载失败回退空表 + warn，宁空勿半）。
-            #   runtime.json 热更示例：{"governance":{"hook":{"preset":["l1-sensitive","l2-resource"]}}}（⑤ 通道即时生效）。
+            #   runtime.json 热更示例：{"governance":{"hook":{"preset":["l1-sensitive","l2-resource"]}}}（热更即时生效）。
             #   出厂不默认启用任何 preset（本键缺省 = 空表零拦截不变，与 rules:[] 出厂安全默认严格一致）——
             #   需启用时经 runtime.json 下发或装配 config 注入；preset 文件内容随包版本发布生效（boot 装载一次）。
             # preset: []        # ← 示例注释（默认不启用，勿取消注释即默认值）
-            # M5-a：护栏违规计数升级（默认关——出厂零行为变化；开启后：归属批次的规则拒绝
+            # 护栏违规计数升级（默认关——出厂零行为变化；开启后：归属批次的规则拒绝
             # （DENY/NARROW）在 windowMs 内达 threshold → 经棘轮校验批 paused（reason=governance-escalate）；
             # 与 hook enabled:true 内核就位零拦截正交——出厂 rules:[] 本就零收据，关保持「改规则不意外武装暂停」保守面）
             escalation:
@@ -96,9 +96,9 @@
               windowMs: 600000 # 滚动计数窗口（毫秒，≥1000；10 分钟）
               primitives: [DENY, NARROW]  # 计入原语子集（可扩入 DEFER/PAUSE；REQUIRE_APPROVAL 与状态门收据不可配）
             defaults:
-              deny: DENY       # fail-closed 兜底（未分类违规 → 兜底原语，hf.md:87）；可配置为其他拒绝类原语
-                               # （如 REQUIRE_APPROVAL）；不可为 ALLOW——resolve 校验回退 DENY（P0 死配置修复，配置真实生效）
+              deny: DENY       # fail-closed 兜底（未分类违规 → 兜底原语）；可配置为其他拒绝类原语
+                               # （如 REQUIRE_APPROVAL）；不可为 ALLOW——resolve 校验回退 DENY（保证配置真实生效）
             flags:
-              pause: false     # 原语开关（CAGE feature-flag 借鉴 hf.md:83-85；默认关 → P3 回退 DENY）
+              pause: false     # 原语开关（feature-flag 式；默认关 → 该原语回退 DENY）
               narrow: false
               defer: false

package/docs/governance-technical.en.md

@@ -137,7 +137,10 @@ Tools are grouped by function; registration is controlled by assembly keys (see
 
 | Tool | Description |
 |---|---|
-| `lane_heartbeat` | Lane heartbeat query/trigger (watchdog scan, stalled marking) |
+| `lane_heartbeat` | Lane heartbeat query/trigger (watchdog scan, stalled marking; lane omitted → returns all running lanes of the batch) |
+| `lane_longrun` | Lane longrun probe query/trigger (longrun tier: runningSince/duration/no-progress window/candidate state; lane omitted → returns all running lanes of the batch; registered when both the watch and longrun sub-switches are on) |
+
+Watch consumption for batches without a Manager (or while the Manager is absent) falls to the Leader: on each worker settlement or confirmed idle, the Leader checks `mailbox_read(broadcast)` for longrun.candidate broadcasts and cross-checks probe state (candidate/emitted/reason) with `lane_longrun` (whole-batch default); a hit candidate is handled as a semi-automatic redispatch — keep observing while the lane has recent checkpoints/activity, stop-and-redispatch or reopen the batch when there is genuinely no progress, and escalate doubtful cases to the user; once a Manager is raised, scheduling returns to the Manager.
 
 ### worktree physical isolation
 
@@ -163,7 +166,7 @@ Assembly is centralized in `cordis.patch.yml`; runtime overrides are covered in
 | Discovery service (ADP) | `capabilities.discovery` | on | Mounts `POST /api/dsh-punky-swarm/discover` + `GET /.well-known/aip`; nodes can hide per-node with active=false |
 | Diagnostics bridging | `capabilities.trajectory` | on (autoFail=false) | anomaly diagnosis → sessionId→lane mapping → notify; auto-failed only when autoFail=true (failConfidence threshold) |
 | Mailbox loop protection | `capabilities.budget` | on (hops=4 / roundTrips=2) | checkBudget before outbox/broadcast sends; inbox (Leader downlink dispatch) never limited |
-| Heartbeat/expiry detection | `capabilities.watch` | on | watchdog timer + lane_heartbeat; backoff-tier follow-ups + N consecutive no-activity beats → lane.stalled mark (mark only, no automatic disposition) |
+| Heartbeat/expiry detection | `capabilities.watch` | on | watchdog timer + lane_heartbeat; backoff-tier follow-ups + N consecutive no-activity beats → lane.stalled mark (mark only, no automatic disposition); hot-apply/restart-reconcile surface = 5 keys {`enabled`, `longrun.enabled`, `scanIntervalMinutes`, `longrun.maxDurationMs`, `longrun.noProgressWindowMs`} — longrun thresholds can be set via the governance-config page form (minutes→ms) or runtime.json and take effect on hot-apply/restart |
 | worktree physical isolation | `capabilities.worktree` | on | lane_worktree_create/merge/checkpoint; complements the lane_claim logical lock |
 | Acceptance evidence | `capabilities.verify` | on (mode=advisory) | post-execute evidence capture (content-addressed blob + ledger); three-state adjudication (done/failed/blocked); intercepts when mode=enforce |
 | Log export | `capabilities.logs` | off | log_export tool registration (explicitly enabled by the patch) |

package/docs/governance-technical.md

@@ -137,7 +137,10 @@
 
 | 工具 | 说明 |
 |---|---|
-| `lane_heartbeat` | lane 心跳查询/触发（watchdog 扫描，stalled 标记） |
+| `lane_heartbeat` | lane 心跳查询/触发（watchdog 扫描，stalled 标记；lane 缺省 → 返回该批全部 running lane） |
+| `lane_longrun` | lane 长跑超时重派探针查询/触发（longrun 档：runningSince/时长/无进展窗/候选状态；lane 缺省 → 返回该批全部 running lane；watch 与 longrun 子开关均开启时注册） |
+
+无 Manager（或 Manager 缺席）批次的 watch 消费由 Leader 兜底承担：每次 worker 结算或确认空闲时，Leader 以 `mailbox_read(broadcast)` 查 longrun.candidate 广播，再以 `lane_longrun` 缺省全批查询核对探针态（candidate/emitted/reason）；命中候选按半自动重派处置——近窗有 checkpoint/活动则等待继续观察，确无进展则停轮重派或重开批次，处置存疑则上报用户裁决；批次拉起 Manager 后调度交还 Manager。
 
 ### worktree 物理隔离
 
@@ -163,7 +166,7 @@
 | 发现服务（ADP） | `capabilities.discovery` | 开 | 挂载 `POST /api/dsh-punky-swarm/discover` + `GET /.well-known/aip`；nodes 可逐节点 active=false 隐藏 |
 | 诊断桥接 | `capabilities.trajectory` | 开（autoFail=false） | 异常诊断 → sessionId→lane 映射 → notify；autoFail=true 时才自动 failed（failConfidence 阈值） |
 | mailbox 环防护 | `capabilities.budget` | 开（hops=4 / roundTrips=2） | outbox/broadcast 发送前 checkBudget；inbox（Leader 下行派发）永不受限 |
-| 心跳/过期检测 | `capabilities.watch` | 开 | watchdog 定时器 + lane_heartbeat；退避档位追问 + 连续 N 拍无活动 → lane.stalled 标记（只标记不自动处置） |
+| 心跳/过期检测 | `capabilities.watch` | 开 | watchdog 定时器 + lane_heartbeat；退避档位追问 + 连续 N 拍无活动 → lane.stalled 标记（只标记不自动处置）；热更/重启对账生效面 5 键 = {`enabled`, `longrun.enabled`, `scanIntervalMinutes`, `longrun.maxDurationMs`, `longrun.noProgressWindowMs`}——长跑阈值可经治理配置页表单（分钟换算 ms）或 runtime.json 写入并生效 |
 | worktree 物理隔离 | `capabilities.worktree` | 开 | lane_worktree_create/merge/checkpoint；与 lane_claim 逻辑锁互补 |
 | 验收证据 | `capabilities.verify` | 开（mode=advisory） | post-execute 证据捕获（内容寻址 blob + ledger）；三态裁决（done/failed/blocked）；mode=enforce 时拦截 |
 | 日志导出 | `capabilities.logs` | 关 | log_export 工具注册（patch 显式开启） |

package/docs/guardrails-hook.en.md

@@ -15,7 +15,7 @@ Execution order: pre-execute event chain (kernel) → ask resolution → difficu
 ## 1. Two-Phase Wiring
 
 - **pre-execute**: session-state pre-check (session deferred/paused → reject directly, see §2 DEFER/PAUSE) → kernel adjudication → ALLOW passes through (`next()`); non-ALLOW synchronously writes the refusal receipt (failure only warns, observer discipline, does not block adjudication) → returns `{kind:'deny'|'ask'}`;
-- **post-execute**: pass-through observer — always `next()`, never alters the result; only best-effort backfills the ask outcome (lookup + inference, write failure only warns);
+- **post-execute**: pass-through observer — always `next()`, never alters the result; only best-effort backfills the ask outcome (lookup + inference, write failure only warns). **Controlled exception (denial visibility, controlled correction)**: once the host's serviceAsk generic branches (rejected/cancelled/unavailable/no-agent) overwrite ask.reason, post short-circuits with a corrected agent-visible text for matched asks of this plugin — returns `{kind:'accept', content:[corrected text]}` (the host's accept+content replacement swaps only the display content, preserving isError:true and error.message); the short-circuit condition is strictly narrowed (only those 4 branches plus a matched pending ask of this plugin), backfill/correction failures degrade to `next()` (zero behavior regression); every other scenario stays `next()` (see §2);
 - **event order**: pre → execute → post → result; this hook never calls `ctx.emit` to tamper with the event stream; on the pre-rejection short path execute does not run, but the post observer is still invoked (the degraded-deny path of ask is backfilled the same way);
 - **teardown**: `dispose()` unsubscribes pre + post listeners in order (idempotent).
 
@@ -41,8 +41,8 @@ Adjudication order (category priority, first match wins):
 7. `soft` with confidence ≥ 0.70 → REQUIRE_APPROVAL;
 8. unclassified violations → fallback primitive (defaults.deny, default DENY; never ALLOW — fail-closed).
 
-- **Unified refusal message format**: `[governance:<primitive>] <reason>` (primitive ∈ ALLOW/DENY/REQUIRE_APPROVAL/DEFER/NARROW/PAUSE; aligned with the difficulty gate's `[task-difficulty-gate]` prefix style) — the model side can distinguish "task level unassessed" from "call level out of bounds". DENY/DEFER/NARROW/PAUSE all land as `{kind:'deny'}`; REQUIRE_APPROVAL → `{kind:'ask'}`.
-- **REQUIRE_APPROVAL ask behavior (explicit)**: pre synchronously writes `ask: {channel:'host-serviceAsk', initiated, requestId(=callId)}`; post best-effort backfills `outcome` (denied-no-approval / denied-no-agent / denied-rejected / denied-cancelled / unavailable / allowed-once). **Depends on the host approval channel (serviceAsk); no approval service / no agent → degraded deny** (behavior unchanged, record made explicit); allowed-once → allow.
+- **Unified refusal message format**: `[governance:<primitive>] <reason>` (primitive ∈ ALLOW/DENY/REQUIRE_APPROVAL/DEFER/NARROW/PAUSE; aligned with the difficulty gate's `[task-difficulty-gate]` prefix style) — the model side can distinguish "task level unassessed" from "call level out of bounds". DENY/DEFER/NARROW/PAUSE all land as `{kind:'deny'}`; REQUIRE_APPROVAL → `{kind:'ask'}`. **Matched-rule reference**: when ruleRefs is non-empty the reason appends「; rule reference: `<ruleId>` (preset `<presetId>`)」— carried by both the DENY short path and ask.reason (if the approval UI renders reason, the matched rules are visible before the user rejects; custom rules without preset attribution list only the rule id).
+- **REQUIRE_APPROVAL ask behavior (explicit)**: pre synchronously writes `ask: {channel:'host-serviceAsk', initiated, requestId(=callId)}` (and caches a decision snapshot — primitive/reason/ruleRefs — for zero-disk-read post correction); post best-effort backfills `outcome` (denied-no-approval / denied-no-agent / denied-rejected / denied-cancelled / unavailable / allowed-once). **Depends on the host approval channel (serviceAsk); no approval service / no agent → degraded deny** (behavior unchanged, record made explicit); allowed-once → allow. **Denial visibility (controlled exception)**: the host's serviceAsk overwrites ask.reason with tool-name-level generic text on 4 generic branches — rejected (`user rejected`) / cancelled (`was cancelled`) / unavailable (`no approval channel is available`) / no-agent (`no agent to route it through`) — e.g. `the user rejected tool "pwsh"` (no guardrail marker, no matched rules); the wiring post observer **short-circuits a controlled correction** for matched asks of this plugin: returns `{kind:'accept', content:[corrected text]}` whose text carries the `[governance:REQUIRE_APPROVAL approval-gate rejection (guardrail interception…)]` marker + matched rules (rule id + preset attribution) + violation message + receipt/checklist lookup paths (<root>/governance/refusals/… and presets/hook-rules/README.md), preserving isError and degrading to `next()` on failure (zero behavior regression); **denied-no-approval (no-approval-service degrade — the host keeps ask.reason, i.e. the guardrail-prefixed text) is not corrected** (no duplicate annotation). The short-circuit condition is strictly narrowed; the boundary of touching the "post always next()" discipline lives in §1/§7.
 - **DEFER/PAUSE file-state state machine (truly effective once flags are on)**: `flags.defer: true` (soft violation) → session suspended and deferred (state file `<root>/governance/state/<sessionId>.json`, window 30s, receipt carries `deferMeta`); `flags.pause: true` (pausable violation) → session paused (window 60s, receipt carries `pauseMeta`). While suspended/paused, same-session calls are uniformly denied with `[governance:DEFER|PAUSE]` (reason includes retry-after / pauseToken / until); **lazy expiry auto-recovers** (cleaned on read; no timer / no resume endpoint); flag-off collapses to DENY with no state side effect (distinguishable from "session deferred/paused").
 
 ## 3. Configuration Guide and Example Rules
@@ -142,6 +142,21 @@ The current guardrails provide in-process, single-machine, rule-table-driven cal
 - full RFC8785 (numeric normalization / per-character escaping) and true-signature evidence envelope (the sha256-chain simplified version is provided, see §4);
 - immutable storage (write-once class).
 
+### Engine boundaries and denial-visibility lookup paths
+
+**Engine boundaries (host dependency layer — not modifiable by the plugin)**:
+
+- The host's `serviceAsk` retention/concatenation of the denial reason — its rejected/cancelled/unavailable/no-agent branches overwrite `ask.reason` with tool-name-level generic text; the true root fix requires the host upstream to retain/concatenate reason (an npm overlay would be lost — not provided); the plugin compensates via the post controlled correction (see §2);
+- The host approval UI's rendering of reason (whether the approval card shows multi-line guardrail details) — host web implementation; the plugin only guarantees that the reason text (with the rule reference) reaches the UI via `approval.request`;
+- Per-rule view/edit on the WebUI「Governance Configuration」page — the page itself lives in the host's dsh-web; the plugin only exposes presetCatalog metadata; the current review surface is this repo's rule checklist (see ④ below).
+
+**Denial-visibility lookup paths** (traceable chain "visible text → audit detail → full rule list"):
+
+- ① Agent-reported text after a refusal (controlled-correction text): session-immediately-visible `[governance:REQUIRE_APPROVAL approval-gate rejection…]` + matched rules (rule id + preset attribution) + violation message + receipt path; the Agent can retry a compliant call following the violation message;
+- ② Approval-request reason (rule-reference delivery): reason tail「; rule reference: …」, delivered to the host UI with `approval.request`;
+- ③ Receipt details (manual/audit): `<root>/governance/refusals/<sessionId>/<receiptId>.json` (decision.reason + ruleRefs + attemptedParams + ask.outcome, hash-anchored) + `ledger-<sessionId>.jsonl` + the batch-level event stream (see §4/§5);
+- ④ Full rule list (proactive review): the「Per-rule review checklist」in `presets/hook-rules/README.md` (l1-sensitive 12 + l2-resource 6; rule id/preset/category/primitive/tools/match/message) + the preset JSON files.
+
 ## 8. Capability Boundaries & Trade-offs
 
 The call-level guardrails extend governance beyond the task level with a call-level line of defense while keeping determinism, auditability, zero added dependencies, and zero host modification. The summary below is grouped into **enhancement surface / capability boundaries / technical trade-offs** (implementation details in §1–§7).

package/docs/guardrails-hook.md

@@ -15,7 +15,7 @@
 ## 1. 双阶段接线
 
 - **pre-execute**：状态前置检查（会话延后/暂停中 → 直接拒绝，见 §2 DEFER/PAUSE）→ 内核裁决 → ALLOW 则透传（`next()`）；非 ALLOW 同步落盘拒绝收据（失败仅 warn，观察者纪律，不阻断裁决）→ 返回 `{kind:'deny'|'ask'}`；
-- **post-execute**：pass-through 观察者——恒 `next()`，不篡改结果；仅尽力补记 ask outcome（查表推断，写失败仅 warn）；
+- **post-execute**：pass-through 观察者——恒 `next()`，不篡改结果；仅尽力补记 ask outcome（查表推断，写失败仅 warn）。**受控例外（拒绝可见性，受控补正）**：宿主 serviceAsk 泛化分支（rejected/cancelled/unavailable/no-agent）覆盖 ask.reason 后，post 对本插件 ask 命中分支**短路补正** Agent 可见文本——返回 `{kind:'accept', content:[补正文本]}`（宿主 accept+content 替换仅改展示 content、保 isError:true 与 error.message）；短路条件严格收窄（仅该 4 分支 + 本插件 pendingAsk 命中），补记/补正失败降级恒 `next()`（零行为回归）；其余一切场景恒 `next()`（详见 §2）；
 - **事件序**：pre → execute → post → result；本 hook 不调用 `ctx.emit` 篡改事件流；pre 拒绝短路径下 execute 不执行，post 观察者仍被调用（ask 降级 deny 路径同样补记）；
 - **卸载**：`dispose()` 依次卸载 pre + post listener（幂等）。
 
@@ -41,8 +41,8 @@
 7. `soft` 置信 ≥ 0.70 → REQUIRE_APPROVAL；
 8. 未分类违规 → 兜底原语（defaults.deny，缺省 DENY；绝不 ALLOW——fail-closed）。
 
-- **统一拒绝消息格式**：`[governance:<primitive>] <reason>`（primitive ∈ ALLOW/DENY/REQUIRE_APPROVAL/DEFER/NARROW/PAUSE；对齐难度门禁 `[task-difficulty-gate]` 前缀风格）——模型侧可区分「任务级未评估」vs「调用级越界」。DENY/DEFER/NARROW/PAUSE 统一以 `{kind:'deny'}` 落地；REQUIRE_APPROVAL → `{kind:'ask'}`。
-- **REQUIRE_APPROVAL ask 行为（显式化）**：pre 同步落盘 `ask: {channel:'host-serviceAsk', initiated, requestId(=callId)}`；post 尽力补记 `outcome`（denied-no-approval / denied-no-agent / denied-rejected / denied-cancelled / unavailable / allowed-once）。**依赖宿主 approval 通道（serviceAsk），无审批服务 / 无 agent = 降级 deny**（行为不变，记录显式化）；allowed-once → allow。
+- **统一拒绝消息格式**：`[governance:<primitive>] <reason>`（primitive ∈ ALLOW/DENY/REQUIRE_APPROVAL/DEFER/NARROW/PAUSE；对齐难度门禁 `[task-difficulty-gate]` 前缀风格）——模型侧可区分「任务级未评估」vs「调用级越界」。DENY/DEFER/NARROW/PAUSE 统一以 `{kind:'deny'}` 落地；REQUIRE_APPROVAL → `{kind:'ask'}`。**命中规则引用**：ruleRefs 非空时 reason 尾部追加「；规则引用：`<ruleId>`（preset `<presetId>`）」——DENY 短路径与 ask.reason 均携带（审批 UI 若渲染 reason，用户拒绝前即可见命中规则；无 preset 归属的自定义规则仅列 rule id）。
+- **REQUIRE_APPROVAL ask 行为（显式化）**：pre 同步落盘 `ask: {channel:'host-serviceAsk', initiated, requestId(=callId)}`（登记时顺带缓存 decision 快照：primitive/reason/ruleRefs——post 补正零盘读）；post 尽力补记 `outcome`（denied-no-approval / denied-no-agent / denied-rejected / denied-cancelled / unavailable / allowed-once）。**依赖宿主 approval 通道（serviceAsk），无审批服务 / 无 agent = 降级 deny**（行为不变，记录显式化）；allowed-once → allow。**拒绝可见性（受控例外）**：宿主 serviceAsk 在 4 个泛化分支——rejected（`user rejected`）/ cancelled（`was cancelled`）/ unavailable（`no approval channel is available`）/ no-agent（`no agent to route it through`）——会把 ask.reason 覆盖为「工具名级」泛化文本（如 `the user rejected tool "pwsh"`，无护栏标识、无命中规则）；wiring post 观察者对本插件 ask 命中分支做**受控补正**：短路返回 `{kind:'accept', content:[补正文本]}`——补正文本含 `[governance:REQUIRE_APPROVAL 人工闸拒绝（护栏拦截…）]` 护栏标注 + 命中规则（rule id + preset 归属）+ 违规 message + 收据/清单查阅路径（<root>/governance/refusals/… 与 presets/hook-rules/README.md），保 isError、失败降级恒 `next()`（零行为回归）；**denied-no-approval（无审批服务降级，宿主保留 ask.reason 即护栏前缀正文）不补正**（不重复标注）。短路条件严格收窄，触碰「post 恒 next」纪律的边界见 §1/§7。
 - **DEFER/PAUSE 文件态状态机（flag 开启后真实生效）**：`flags.defer: true`（soft 违规）→ 会话挂起延后（状态文件 `<root>/governance/state/<sessionId>.json`，窗口 30s，收据含 `deferMeta`）；`flags.pause: true`（pausable 违规）→ 会话暂停（窗口 60s，收据含 `pauseMeta`）。挂起/暂停期间同会话调用统一 `[governance:DEFER|PAUSE]` deny（reason 含 retry-after / pauseToken / until），**惰性过期自动恢复**（读时清理，无定时器 / 无 resume 端点）；flag-off 折叠 DENY 无状态副作用（与「会话延后/暂停中」可区分）。
 
 ## 3. 配置指南与示例规则
@@ -142,6 +142,21 @@ governance:
 - 完整 RFC8785（数字规范化 / 逐字符转义）与真签名证据信封（sha256 链简版已提供，见 §4）；
 - 不可变存储（write-once 类）。
 
+### 引擎边界与拒绝可见性查阅路径
+
+**引擎边界（宿主依赖层，插件不可改）**：
+
+- 宿主 `serviceAsk` 对拒绝 reason 的保留/拼接——rejected/cancelled/unavailable/no-agent 四分支把 `ask.reason` 覆盖为「工具名级」泛化文本；真根修需宿主上游保留/拼接 reason（npm 覆盖即丢，不提供），插件侧以 post 受控补正兜底（见 §2）；
+- 宿主审批 UI 对 reason 的渲染形态（审批卡片是否展示多行护栏明细）——宿主 Web 实现；插件只保证 reason 文本（含规则引用）随 `approval.request` 送达；
+- WebUI「治理配置」页逐条规则查看/编辑——页面本体在宿主 dsh-web；插件只提供 presetCatalog 元数据，当前审阅面 = 本仓库规则清单（见下 ④）。
+
+**拒绝可见性查阅路径**（「可见文本 → 审计明细 → 全量清单」可追溯链）：
+
+- ① 被拒后 Agent 汇报文本（受控补正文本）：会话内即时可见 `[governance:REQUIRE_APPROVAL 人工闸拒绝…]` + 命中规则（rule id + preset 归属）+ 违规 message + 收据路径，Agent 可按违规 message 修正参数后重发合规调用；
+- ② 审批请求 reason（规则引用送达）：reason 尾部「；规则引用：…」，随 approval.request 送达宿主 UI；
+- ③ 收据明细（人工/审计）：`<root>/governance/refusals/<sessionId>/<receiptId>.json`（decision.reason + ruleRefs + attemptedParams + ask.outcome，哈希锚定）+ `ledger-<sessionId>.jsonl` + 批级事件流（见 §4/§5）；
+- ④ 全量规则清单（主动审阅）：`presets/hook-rules/README.md`「逐条规则审阅清单」（l1-sensitive 12 + l2-resource 6，rule id/preset/category/原语/tools/match/message）+ 各 preset JSON。
+
 ## 8. 能力边界与取舍
 
 调用级护栏把治理能力从任务级扩展出调用级一道防线，同时保持确定性、可审计、零新增依赖与零宿主改造。以下按**增强面 / 能力边界 / 技术取舍**三组小结（实现细节见 §1–§7）。

package/docs/webui-governance-config.en.md

@@ -7,6 +7,8 @@
 
 Governance is a dedicated page in the Settings area of the dsh Web UI. It manages a set of guardrail options for dsh running on this machine: the guardrails inspect the tool calls an Agent makes, detect out-of-bounds calls, and then allow, deny, or escalate them according to the rules you have chosen. Changes made on this page take effect **immediately after saving — no dsh restart needed**.
 
+Besides the guardrails, this page also provides lane capability switches and time windows: enabling and disabling lane expiry detection (watch, including the longrun timeout re-dispatch probe), and setting the two longrun time windows (timeout / no-progress).
+
 At the top of the page you can see the current state: whether the guardrails are live, and how many rules are currently in effect.
 
 ## Configurable options
@@ -32,19 +34,31 @@ Once you select a preset, the page shows the **count and a purpose summary** for
 
 ### Auto-escalation
 
-Off by default. When enabled, once the rules are refused a set number of times within a time window for the same batch of tasks, the affected batch is escalated automatically (the related work is paused and a record is kept, waiting for you to review and continue).
+Off by default. When on, once guardrail refusals for the same batch reach the threshold within the counting window, the batch is automatically paused with a record, waiting for you to review and resume it manually.
 
-- **Refusals within window**: how many rule refusals within one time window trigger escalation (minimum 1).
-- **Window (ms)**: the length of the counting window (minimum 1000).
+- **Refusals within window**: how many rule refusals accumulate within one time window before the automatic pause triggers (minimum 1).
+- **Window (s)**: the length of the counting window (default 600 s — 10 minutes; minimum 1). Entered in seconds on the form and stored in milliseconds internally (×1000).
 - **Counted verdicts**: "Deny" and "Narrowed allowance" are counted by default; "Defer" and "Pause" can be added as needed; verdicts that require human approval are not on this list.
 
 ### Narrowed allowance
 
 Off by default. When enabled, calls that go beyond the allowed bounds are no longer denied outright; instead the guardrails give narrowing guidance so the caller can retry with narrowed parameters. When disabled, such calls are denied outright.
 
+### Lane capability switches (watch)
+
+Control lane expiry detection (heartbeat / longrun):
+
+- **Lane expiry watch**: the parent switch, controls the watchdog expiry scan over running lanes (heartbeat backoff follow-ups + stalled marking). When off, expiry detection does not run at all.
+- **Long-run timeout probe**: the child switch, controls the longrun candidate probe for lanes making no progress for too long. **On by factory default**; it takes effect only while the parent switch is on (when the parent is off, the child is disabled).
+  - **Timeout window (min)**: a lane running longer than this enters longrun judging (default 20, minimum 1, whole minutes).
+  - **No-progress window (min)**: a lane under longrun judging with no checkpoint/activity within this window produces a redispatch candidate (default 5, minimum 1, whole minutes).
+
+Both switches are on by factory default (`enabled` defaults to on — off only when explicitly `false`). While off, running lanes producing no stalled / longrun candidate events is expected; after re-enabling, scanning resumes from the baseline. The two time windows are entered in minutes on the form and converted to milliseconds when saved (internal keys `maxDurationMs`/`noProgressWindowMs`, defaults 1200000/300000); sub-minute tuning is done by editing the configuration file directly.
+
 ## Saving and activation
 
 - **Save**: after clicking Save, the settings are written to the local configuration file and then applied to the running dsh immediately — no restart at any point. The page first shows "Saved, confirming…" and turns to "Live" once confirmed.
+- **Activation of the lane capability switches (watch)**: the watch group is saved together with the guardrails (same Save button, merged into `runtime.json`); **any change — either switch or a time window — hot-applies immediately on save** (the watch effective surface is 5 keys: `enabled`/`longrun.enabled`/`scanIntervalMinutes`/`longrun.maxDurationMs`/`longrun.noProgressWindowMs`); after a process restart they are also reconciled against `runtime.json`, so there is no need to set them again.
 - **Reset**: discards your unsaved changes and returns to the state most recently loaded into the page.
 - **Save rejected**: the page shows why the save was rejected; the common reasons are listed in "Behavior boundaries" below.
 
@@ -54,6 +68,8 @@ Off by default. When enabled, calls that go beyond the allowed bounds are no lon
 - **Factory default zero interception is unchanged**: a fresh install ships with the factory default — guardrails on but no rules loaded, so no call is intercepted and existing behavior is unaffected; interception only begins after you select a preset or configure rules manually.
 - **Manual rules must be handled first when they conflict with presets**: if a hand-maintained rule list already exists in the configuration, switching presets is rejected (to avoid overwriting manual rules); remove those rules manually first, or keep the preset unchanged, then save.
 - **Saving is accepted only from this machine (or trusted sources)**: this page only accepts save requests from a browser on this machine (a local address); if dsh is served through a remote address, the deployment must add the visiting source to the trust list (the dsh host and this plugin must stay consistent), otherwise saves are rejected.
+- **Boundaries of the watch switches**: on by factory default — off only when explicitly disabled; turning them off only stops scanning and probe events and never changes already-landed batch/member states. The tool registration surface (whether the heartbeat/longrun query tools appear in the available list) is fixed at startup; while watch is turned off at runtime, the query tools remain available and return a "disabled" state (no error).
+- **watch longrun thresholds are now configurable on this page**: the longrun timeout window and no-progress window can be configured on this page's form (entered in minutes, stored in milliseconds) and hot-apply immediately on save (see "Lane capability switches (watch)" and "Saving and activation" above); the remaining watch-level keys — `scanIntervalMinutes`/`intervalsMinutes`/`maxMissed`/`probeTemplate` — are still maintained manually in `runtime.json`.
 
 ## Further reading
 

package/docs/webui-governance-config.md

@@ -7,6 +7,8 @@
 
 「治理配置」是 dsh Web UI 设置区的一个独立页面。它管理 dsh 在本机运行时的一组护栏选项：护栏会检查 Agent 的工具调用是否越界，再按你所选规则决定放行、拒绝或升级处理。页面上的改动保存后**立即生效，无需重启 dsh**。
 
+除护栏外，本页面还提供 lane 能力开关与时间窗口：lane 过期检测（watch，含长跑超时重派探针）的启用与关闭，以及超时/无进展两个长跑时间窗口的设置。
+
 页面顶部显示当前状态：护栏是否已生效，以及当前生效的规则数量。
 
 ## 可配置项
@@ -32,19 +34,31 @@
 
 ### 违规自动升级
 
-出厂关闭。开启后，当同一批任务在设定时间窗口内的规则拒绝达到指定次数时，自动升级处置相关批次（相关工作会被自动暂停并留下记录，等待你检查后继续）。
+出厂关闭。开启后：同一批任务在设定时间窗口内被护栏拒绝达到阈值次数时，自动将该批次暂停并留痕，等待你检查后手动恢复运行。
 
-- **窗口内触发次数**：一个时间窗口内触发多少次规则拒绝即升级（最小为 1）。
-- **窗口（毫秒）**：计数的窗口长度（最小为 1000）。
+- **窗口内触发次数**：一个时间窗口内累计多少次规则拒绝即触发自动暂停（最小为 1）。
+- **窗口（秒）**：计数的窗口长度（默认 600 秒，即 10 分钟；最小为 1）。表单以秒输入，内部按毫秒存储（×1000）。
 - **计入的处理结果**：默认计入「拒绝」与「收窄放行」，可按需增选「延后」「暂停」；需要人工审批的处理结果不在此列。
 
 ### 窄化放行
 
 出厂关闭。打开后，对超出允许范围的调用不再直接拒绝，而是给出收窄指引，让调用方按收窄后的参数重试放行；关闭时此类调用直接拒绝。
 
+### Lane 能力开关（watch）
+
+控制 lane 过期检测（心跳/长跑）的运行：
+
+- **Lane 过期检测**：父开关，控制 watchdog 对 running lane 的过期扫描（心跳退避追问 + stalled 标记）。关闭后过期检测整体不运行。
+- **长跑超时重派探针**：子开关，控制对长时间无进展 lane 的长跑候选探测。**出厂默认开**；仅当父开关开启时才生效（父关时子项禁用）。
+  - **超时窗口（分钟）**：lane 运行超过该时长即进入长跑判定（默认 20，最小 1，整数分钟）。
+  - **无进展窗口（分钟）**：进入长跑判定的 lane 若在该窗口内无 checkpoint/活动，即产出重派候选（默认 5，最小 1，整数分钟）。
+
+两个开关出厂默认均为开（`enabled` 缺省即开，显式 `false` 才关）。关闭期间，running lane 不再产生 stalled / 长跑候选事件属预期；重新开启后自基线恢复扫描。两个时间窗口在表单以分钟输入，保存时换算为毫秒写入配置（内部键 `maxDurationMs`/`noProgressWindowMs`，默认值 1200000/300000）；亚分钟级微调请直接编辑配置文件。
+
 ## 保存与生效
 
 - **保存**：点击后，设置先写入本机配置文件，再即时应用到运行中的 dsh，全程无需重启。页面先显示「已保存，生效确认中」，确认后转为「已生效」。
+- **Lane 能力开关（watch）的生效**：watch 组随护栏一起保存（同一保存按钮，合并写入 `runtime.json`）；两个开关与时间窗口**任一变化都保存即热更生效**（watch 生效面共 5 键：`enabled`/`longrun.enabled`/`scanIntervalMinutes`/`longrun.maxDurationMs`/`longrun.noProgressWindowMs`），进程重启后亦按 `runtime.json` 对账生效，无需重复设置。
 - **重置**：放弃本次未保存的修改，回到最近一次载入页面的状态。
 - **保存被拒**：页面会显示被拒原因；常见原因见下节「行为边界」。
 
@@ -54,6 +68,8 @@
 - **出厂默认零拦截不变**：全新安装即出厂空表——护栏开启但不加载任何规则、不拦截任何调用，既有行为不受影响；只有选择预设或手工配置规则后才会开始拦截。
 - **预设与手工规则冲突时先手工处置**：若配置中已存在手工维护的规则清单，切换预设会被拒绝（避免覆盖手工规则）；请先手工移除这些规则，或保持预设不变，再保存。
 - **仅本机（或受信任来源）可保存**：本页面只接受来自本机浏览器（本地地址）的保存请求；若 dsh 通过远程地址对外提供服务，部署方须把访问来源加入信任名单（dsh 宿主与本插件保持一致），否则保存会被拒绝。
+- **watch 开关的边界**：出厂默认开，显式关闭才停；关闭只停扫描与探针事件，不改动已落盘的批次/成员状态。工具注册面（心跳/长跑查询工具是否出现在可用列表）在启动时固定；运行期关闭 watch 时查询工具仍可用并返回「已禁用」状态（不报错）。
+- **watch 长跑阈值现可经本页表单配置**：长跑超时窗口与无进展窗口可经本页表单配置（分钟输入，换算毫秒落盘）并随保存即时热更生效（见上文「Lane 能力开关（watch）」「保存与生效」）；`scanIntervalMinutes`/`intervalsMinutes`/`maxMissed`/`probeTemplate` 等其余 watch 级键仍走手工 `runtime.json` 维护。
 
 ## 延伸阅读
 

package/lib/acps/certs.js

@@ -15,7 +15,7 @@ You should have received a copy of the GNU Affero General Public License
 along with this program. If not, see <https://www.gnu.org/licenses/>.
 */
 
-// 文件 certs：ACPs mTLS 证书材料（lib/acps 域，P1 lane exec-acps-server）
+// 文件 certs：ACPs mTLS 证书材料（lib/acps 域）
 // 契约：CAI 自签（node:crypto 自签 X.509，零新依赖）；文件三路径（cert/key/ca 三路径
 //       config 可配，默认 acps 数据目录）；TLS 语义对齐参考实现
 //       registry-server/app/main_mtls.py:14-30（cert/key/ca 三件套 + CERT_REQUIRED + TLSv1_3）。

package/lib/acps/server.js

@@ -15,7 +15,7 @@ You should have received a copy of the GNU Affero General Public License
 along with this program. If not, see <https://www.gnu.org/licenses/>.
 */
 
-// 文件 server：ACPs 对外 mTLS 服务端点（lib/acps 域，P1 lane exec-acps-server）
+// 文件 server：ACPs 对外 mTLS 服务端点（lib/acps 域）
 // 契约：
 //   - 独立 HTTPS 监听器（node:https + node:tls，零新依赖），默认端口 9443、绑定 127.0.0.1（config 可配）；
 //   - TLS：minVersion TLSv1.3 + requestCert + rejectUnauthorized（=CERT_REQUIRED + TLSv1_3 语义，

package/lib/aip/agent-descriptor.js

@@ -21,7 +21,7 @@ along with this program. If not, see <https://www.gnu.org/licenses/>.
 // ⚠ 2026-08 校准（覆盖旧 14+8 口径）：字段集以 ACS（Agent Capability Specification）原文为准——
 //   registry-server/app/agent/acsSchema.json（JSON Schema 全文）为逐字字段来源；
 //   旧「14+8 兼容映射层」（toLegacyDescriptor / toLegacySkill + ALL_TOOLS / LAYER_CAPABILITIES）
-//   已移除（P2-06）：ACPs 兼容路径中无调用——ACPs 描述直接消费 buildAgentDescriptor 的 ACS 格式
+//   已移除：ACPs 兼容路径中无调用——ACPs 描述直接消费 buildAgentDescriptor 的 ACS 格式
 //   （server.js:37,136 装配），描述以 ACS 格式为准。
 // 派生值标记：固定值 = 本文件推导；预留 = 后续填充。
 // 仅用内建能力，零新增依赖（红线：不改 node_modules）。

package/lib/aip/identity.js

@@ -17,7 +17,7 @@ along with this program. If not, see <https://www.gnu.org/licenses/>.
 
 // 文件 identity：国标 P2/P3 身份体系（AIC 身份码 + CAI 身份证书）
 // -----------------------------------------------------------------------------
-// 校准基准（plan/spec.md §3.4/§3.5，[参考] = ACPs-community v2.1.0 原文）：
+// 校准基准（§3.4/§3.5；[参考] = ACPs-community v2.1.0 原文）：
 //   P2 身份码 AIC：10 级编码（前缀 1.2.156.3088 + 版本/ARSP/供应商/本体/实体 + 校验码），
 //     CRC-16/CCITT-FALSE（poly=0x1021, init=0xFFFF, refin/refout=false, xorout=0x0000）+
 //     ARSP 盐值（>=2 字节）+ Base36 固定 4 位校验码（ACPs-spec-AIC-v02.01 §4）。