oasis_test 0.1.81 → 0.1.83

package/dist/index.js

@@ -1794,9 +1794,9 @@ function resolveNodeRef(ref2, candidates) {
     const hit = candidates.find((n) => n.id === r);
     return hit ? { ok: true, id: hit.id } : { ok: false, reason: "not_found" };
   }
-  const sep3 = r.indexOf(":");
-  const type = (sep3 >= 0 ? r.slice(0, sep3) : r).trim().toLowerCase();
-  const title = sep3 >= 0 ? r.slice(sep3 + 1).trim().toLowerCase() : null;
+  const sep4 = r.indexOf(":");
+  const type = (sep4 >= 0 ? r.slice(0, sep4) : r).trim().toLowerCase();
+  const title = sep4 >= 0 ? r.slice(sep4 + 1).trim().toLowerCase() : null;
   const matches = candidates.filter((n) => n.type.toLowerCase() === type && (title === null || (n.title ?? "").toLowerCase() === title));
   if (matches.length === 0) return { ok: false, reason: "not_found" };
   if (matches.length === 1) return { ok: true, id: matches[0].id };
@@ -2243,61 +2243,181 @@ var init_collab_view = __esm({
 });
 
 // ../contract/src/evaluation.ts
-function calculateSpecialtyScore(dimensions) {
-  if (dimensions.length !== 5 || dimensions.some((dimension) => dimension.score === null)) {
-    return null;
-  }
-  const scores = dimensions.map((dimension) => dimension.score);
-  if (scores.some((score2) => score2 < 1 || score2 > 5)) {
-    throw new Error("S \u4E13\u9879\u7EF4\u5EA6\u5206\u5FC5\u987B\u5728 1-5 \u4E4B\u95F4");
-  }
-  const score = scores.reduce((sum, value2) => sum + value2, 0) / scores.length;
-  return { score, score100: score * 20 };
-}
 function assertScore(value2, min2, max, label, nullable2 = false) {
   if (nullable2 && value2 === null) return;
   if (typeof value2 !== "number" || !Number.isFinite(value2) || value2 < min2 || value2 > max) {
     throw new Error(`${label} \u5FC5\u987B\u5728 ${min2}-${max} \u4E4B\u95F4${nullable2 ? "\u6216\u4E3A null" : ""}`);
   }
 }
-function validateEvaluationResult(value2) {
-  if (!value2 || typeof value2 !== "object") throw new Error("\u8BC4\u5206\u7ED3\u679C\u5FC5\u987B\u662F\u5BF9\u8C61");
-  const result = value2;
-  if (!Array.isArray(result.common?.dimensions) || result.common.dimensions.length !== 7) {
-    throw new Error("\u901A\u7528\u80FD\u529B\u5FC5\u987B\u5305\u542B G1-G7 \u4E03\u4E2A\u7EF4\u5EA6");
-  }
-  const commonIds = result.common.dimensions.map((dimension) => dimension.id);
-  for (const id of ["G1", "G2", "G3", "G4", "G5", "G6", "G7"]) {
-    if (!commonIds.includes(id)) throw new Error(`\u901A\u7528\u80FD\u529B\u7F3A\u5C11 ${id}`);
+function validateSection(result, spec) {
+  const section = sectionOf(result, spec.sectionKey);
+  if (!section) throw new Error(`\u7F3A\u5C11\u8BC4\u5206\u6BB5 ${spec.sectionKey}`);
+  if (!spec.dimensions.length) {
+    if (!Array.isArray(section["items"])) throw new Error(`\u8BC4\u5206\u6BB5 ${spec.sectionKey} \u7F3A\u5C11\u8BC4\u5206\u9879`);
+    return;
   }
-  for (const dimension of result.common.dimensions) {
-    assertScore(dimension.score, 1, 5, dimension.id, dimension.id === "G6");
+  const dimensions = section["dimensions"];
+  if (!Array.isArray(dimensions) || dimensions.length !== spec.dimensions.length) {
+    throw new Error(`\u8BC4\u5206\u6BB5 ${spec.sectionKey} \u5FC5\u987B\u5305\u542B ${spec.dimensions.length} \u4E2A\u7EF4\u5EA6`);
   }
-  if (!Array.isArray(result.specialty?.dimensions)) throw new Error("\u7F3A\u5C11 S \u4E13\u9879\u7EF4\u5EA6");
-  if (result.specialty.dimensions.length !== 5) throw new Error("S \u4E13\u9879\u5FC5\u987B\u5305\u542B\u4E94\u4E2A\u7EF4\u5EA6");
-  const calculated = calculateSpecialtyScore(result.specialty.dimensions);
-  if (calculated) {
-    if (Math.abs((result.specialty.score ?? Number.NaN) - calculated.score) > 1e-9) {
-      throw new Error("S \u4E13\u9879\u5E73\u5747\u5206\u4E0E\u4E94\u4E2A\u7EF4\u5EA6\u4E0D\u4E00\u81F4");
+  const byId = new Map(
+    dimensions.map((dimension) => [dimension?.id, dimension])
+  );
+  spec.dimensions.forEach((expected, index) => {
+    const dimension = spec.strictIds === false ? dimensions[index] : byId.get(expected.id);
+    if (!dimension) throw new Error(`\u8BC4\u5206\u6BB5 ${spec.sectionKey} \u7F3A\u5C11 ${expected.id}`);
+    assertScore(dimension.score, expected.min, expected.max, expected.id, expected.nullable === true);
+  });
+  if (spec.aggregation !== "mean") return;
+  const scores = dimensions.map((dimension) => dimension.score);
+  const complete = scores.every((value2) => typeof value2 === "number");
+  const score = section["score"];
+  const score100 = section["score100"];
+  if (complete) {
+    const mean = scores.reduce((sum, value2) => sum + value2, 0) / scores.length;
+    const max = spec.dimensions[0]?.max ?? 5;
+    if (Math.abs((typeof score === "number" ? score : Number.NaN) - mean) > 1e-9) {
+      throw new Error(`\u8BC4\u5206\u6BB5 ${spec.sectionKey} \u7684\u5E73\u5747\u5206\u4E0E\u7EF4\u5EA6\u4E0D\u4E00\u81F4`);
     }
-    if (Math.abs((result.specialty.score100 ?? Number.NaN) - calculated.score100) > 1e-9) {
-      throw new Error("S \u4E13\u9879\u767E\u5206\u5236\u5206\u6570\u4E0E\u4E94\u4E2A\u7EF4\u5EA6\u4E0D\u4E00\u81F4");
+    if (Math.abs((typeof score100 === "number" ? score100 : Number.NaN) - mean * (100 / max)) > 1e-9) {
+      throw new Error(`\u8BC4\u5206\u6BB5 ${spec.sectionKey} \u7684\u767E\u5206\u5236\u5206\u6570\u4E0E\u7EF4\u5EA6\u4E0D\u4E00\u81F4`);
     }
-  } else if (result.specialty.score !== null || result.specialty.score100 !== null) {
-    throw new Error("S \u4E13\u9879\u7EF4\u5EA6\u4E0D\u5B8C\u6574\u65F6\u4E0D\u80FD\u751F\u6210\u4E13\u9879\u5206");
+  } else if (score !== null || score100 !== null) {
+    throw new Error(`\u8BC4\u5206\u6BB5 ${spec.sectionKey} \u7EF4\u5EA6\u4E0D\u5B8C\u6574\u65F6\u4E0D\u80FD\u751F\u6210\u6BB5\u5206`);
   }
-  if (!Array.isArray(result.caseSpecial?.items)) throw new Error("\u7F3A\u5C11 Case Special \u8BC4\u5206\u9879");
-  assertScore(result.caseSpecial.score100, 0, 100, "Case Special", true);
-  if (!result.runtimeMetrics || typeof result.runtimeMetrics !== "object") {
+}
+function validateEvaluationResult(value2, specs = BUILTIN_OUTPUT_SPECS) {
+  if (!value2 || typeof value2 !== "object") throw new Error("\u8BC4\u5206\u7ED3\u679C\u5FC5\u987B\u662F\u5BF9\u8C61");
+  const result = value2;
+  for (const spec of specs.length ? specs : BUILTIN_OUTPUT_SPECS) validateSection(result, spec);
+  const caseSpecial = sectionOf(result, "caseSpecial");
+  if (caseSpecial) assertScore(caseSpecial["score100"], 0, 100, "Case Special", true);
+  if (!result["runtimeMetrics"] || typeof result["runtimeMetrics"] !== "object") {
     throw new Error("\u7F3A\u5C11\u8FD0\u884C\u6307\u6807");
   }
   return structuredClone(result);
 }
-var isEvaluationEligibleWorkorder;
+var isEvaluationEligibleWorkorder, BUILTIN_COMMON_OUTPUT_SPEC, BUILTIN_SPECIALTY_OUTPUT_SPEC, BUILTIN_CASE_SPECIAL_OUTPUT_SPEC, BUILTIN_OUTPUT_SPECS, sectionOf;
 var init_evaluation = __esm({
   "../contract/src/evaluation.ts"() {
     "use strict";
     isEvaluationEligibleWorkorder = (workorder) => workorder.stage === "concluded";
+    BUILTIN_COMMON_OUTPUT_SPEC = {
+      sectionKey: "common",
+      aggregation: "none",
+      dimensions: [
+        { id: "G1", label: "G1", min: 1, max: 5 },
+        { id: "G2", label: "G2", min: 1, max: 5 },
+        { id: "G3", label: "G3", min: 1, max: 5 },
+        { id: "G4", label: "G4", min: 1, max: 5 },
+        { id: "G5", label: "G5", min: 1, max: 5 },
+        { id: "G6", label: "G6", min: 1, max: 5, nullable: true },
+        { id: "G7", label: "G7", min: 1, max: 5 }
+      ]
+    };
+    BUILTIN_SPECIALTY_OUTPUT_SPEC = {
+      sectionKey: "specialty",
+      aggregation: "mean",
+      // strictIds=false：五项的 id 由各 S 类标准自己定，历史校验也只数个数不认 id。
+      strictIds: false,
+      // nullable：S 专项允许整段不评分（没有可读专业产物时五项全 null，段分随之为 null）——
+      // 这是既有语义，见 enforceSpecialtyArtifactBoundary。段分一致性由 aggregation 那条兜住。
+      dimensions: Array.from({ length: 5 }, (_unused, index) => ({
+        id: `S${index + 1}`,
+        label: `S${index + 1}`,
+        min: 1,
+        max: 5,
+        nullable: true
+      }))
+    };
+    BUILTIN_CASE_SPECIAL_OUTPUT_SPEC = {
+      sectionKey: "caseSpecial",
+      aggregation: "none",
+      dimensions: []
+    };
+    BUILTIN_OUTPUT_SPECS = [
+      BUILTIN_COMMON_OUTPUT_SPEC,
+      BUILTIN_SPECIALTY_OUTPUT_SPEC,
+      BUILTIN_CASE_SPECIAL_OUTPUT_SPEC
+    ];
+    sectionOf = (result, key) => {
+      const section = result[key];
+      return section && typeof section === "object" && !Array.isArray(section) ? section : void 0;
+    };
+  }
+});
+
+// ../contract/src/evaluation-rubric.ts
+function validateEvaluationRubricOutputSpec(value2) {
+  if (!value2 || typeof value2 !== "object") throw new Error("\u8F93\u51FA\u5951\u7EA6\u5FC5\u987B\u662F\u5BF9\u8C61");
+  const spec = value2;
+  if (typeof spec.sectionKey !== "string" || !spec.sectionKey.trim()) {
+    throw new Error("\u8F93\u51FA\u5951\u7EA6\u7F3A\u5C11 sectionKey");
+  }
+  if (spec.aggregation !== "none" && spec.aggregation !== "mean") {
+    throw new Error("aggregation \u53EA\u80FD\u662F none \u6216 mean");
+  }
+  if (!Array.isArray(spec.dimensions)) throw new Error("dimensions \u5FC5\u987B\u662F\u6570\u7EC4");
+  const seen = /* @__PURE__ */ new Set();
+  for (const dimension of spec.dimensions) {
+    if (!dimension || typeof dimension !== "object") throw new Error("\u7EF4\u5EA6\u5FC5\u987B\u662F\u5BF9\u8C61");
+    if (typeof dimension.id !== "string" || !DIMENSION_ID.test(dimension.id)) {
+      throw new Error(`\u7EF4\u5EA6 id \u975E\u6CD5\uFF1A${String(dimension.id)}`);
+    }
+    if (seen.has(dimension.id)) throw new Error(`\u7EF4\u5EA6 id \u91CD\u590D\uFF1A${dimension.id}`);
+    seen.add(dimension.id);
+    if (typeof dimension.label !== "string" || !dimension.label.trim()) {
+      throw new Error(`\u7EF4\u5EA6 ${dimension.id} \u7F3A\u5C11 label`);
+    }
+    if (typeof dimension.min !== "number" || typeof dimension.max !== "number" || !Number.isFinite(dimension.min) || !Number.isFinite(dimension.max) || dimension.min >= dimension.max) {
+      throw new Error(`\u7EF4\u5EA6 ${dimension.id} \u7684\u5206\u503C\u533A\u95F4\u975E\u6CD5`);
+    }
+  }
+  return {
+    sectionKey: spec.sectionKey.trim(),
+    aggregation: spec.aggregation,
+    ...spec.strictIds === false ? { strictIds: false } : {},
+    dimensions: spec.dimensions.map((dimension) => ({
+      id: dimension.id,
+      label: dimension.label,
+      min: dimension.min,
+      max: dimension.max,
+      ...dimension.nullable ? { nullable: true } : {}
+    }))
+  };
+}
+function validateUpsertEvaluationRubricInput(value2) {
+  if (!value2 || typeof value2 !== "object") throw new Error("\u8BC4\u5206\u6807\u51C6\u5FC5\u987B\u662F\u5BF9\u8C61");
+  const input = value2;
+  if (typeof input.name !== "string" || !input.name.trim()) throw new Error("\u8BC4\u5206\u6807\u51C6\u7F3A\u5C11\u540D\u79F0");
+  if (input.kind !== "common" && input.kind !== "specialty" && input.kind !== "case_special") {
+    throw new Error("kind \u53EA\u80FD\u662F common / specialty / case_special");
+  }
+  if (typeof input.promptSection !== "string" || !input.promptSection.trim()) {
+    throw new Error("\u8BC4\u5206\u6807\u51C6\u6B63\u6587\u4E0D\u80FD\u4E3A\u7A7A");
+  }
+  if (input.status !== void 0 && input.status !== "active" && input.status !== "archived") {
+    throw new Error("status \u53EA\u80FD\u662F active \u6216 archived");
+  }
+  return {
+    ...typeof input.rubricId === "string" && input.rubricId ? { rubricId: input.rubricId } : {},
+    name: input.name.trim(),
+    kind: input.kind,
+    ...typeof input.description === "string" && input.description.trim() ? { description: input.description.trim() } : {},
+    promptSection: input.promptSection,
+    outputSpec: validateEvaluationRubricOutputSpec(input.outputSpec),
+    ...input.status ? { status: input.status } : {}
+  };
+}
+function rubricVersionOf(rubrics, fallback) {
+  if (!rubrics.length) return fallback;
+  return rubrics.map((rubric) => `${rubric.rubricId}@${rubric.version}`).join("+");
+}
+var DIMENSION_ID;
+var init_evaluation_rubric = __esm({
+  "../contract/src/evaluation-rubric.ts"() {
+    "use strict";
+    DIMENSION_ID = /^[A-Za-z][A-Za-z0-9_.-]{0,31}$/;
   }
 });
 
@@ -2615,6 +2735,7 @@ var init_src = __esm({
     init_annotation();
     init_collab_view();
     init_evaluation();
+    init_evaluation_rubric();
     init_inbox_read();
     init_workorder_quality();
     init_workorder_attachments();
@@ -6441,8 +6562,8 @@ var init_dispatcher = __esm({
       /** 从 produce jobKey 解析 artifactId：`produce::<artifactId>` 或 `produce::<artifactId>::<part>`。 */
       artifactIdFromJobKey(jobKey) {
         const rest = jobKey.slice(jobKey.indexOf("::") + 2);
-        const sep3 = rest.indexOf("::");
-        return sep3 >= 0 ? rest.slice(0, sep3) : rest;
+        const sep4 = rest.indexOf("::");
+        return sep4 >= 0 ? rest.slice(0, sep4) : rest;
       }
       /**
        * 某节点的派发器运行时信号（stuckDiagnosis 的非 oplog 那半；proposal 协调者阻塞诊断 D1）。
@@ -7541,11 +7662,88 @@ var init_store = __esm({
   }
 });
 
+// ../core/src/evaluation/rubric-store.ts
+var import_node_crypto4, bindingKey, MemoryEvaluationRubricStore;
+var init_rubric_store = __esm({
+  "../core/src/evaluation/rubric-store.ts"() {
+    "use strict";
+    import_node_crypto4 = require("node:crypto");
+    bindingKey = (companyId, caseId) => JSON.stringify([companyId, caseId]);
+    MemoryEvaluationRubricStore = class {
+      rubrics = /* @__PURE__ */ new Map();
+      bindings = /* @__PURE__ */ new Map();
+      async listRubrics(companyId) {
+        return [...this.rubrics.values()].filter((rubric) => rubric.companyId === companyId).sort((left, right) => left.name.localeCompare(right.name)).map((rubric) => structuredClone(rubric));
+      }
+      async getRubric(rubricId) {
+        const rubric = this.rubrics.get(rubricId);
+        return rubric ? structuredClone(rubric) : null;
+      }
+      async upsertRubric(input, at) {
+        const existing = input.rubricId ? this.rubrics.get(input.rubricId) : void 0;
+        if (existing && existing.companyId !== input.companyId) {
+          throw new Error(`\u8BC4\u5206\u6807\u51C6 ${input.rubricId} \u4E0D\u5C5E\u4E8E\u5F53\u524D\u516C\u53F8`);
+        }
+        const rubric = {
+          rubricId: existing?.rubricId ?? input.rubricId ?? (0, import_node_crypto4.randomUUID)(),
+          companyId: input.companyId,
+          name: input.name,
+          kind: input.kind,
+          ...input.description ? { description: input.description } : {},
+          promptSection: input.promptSection,
+          outputSpec: structuredClone(input.outputSpec),
+          // 版本随每次保存自增：判分记录靠 rubricId@version 复现「当时用的是哪一版标准」。
+          version: (existing?.version ?? 0) + 1,
+          status: input.status ?? existing?.status ?? "active",
+          createdBy: existing?.createdBy ?? input.actor,
+          createdAt: existing?.createdAt ?? at,
+          updatedBy: input.actor,
+          updatedAt: at
+        };
+        this.rubrics.set(rubric.rubricId, rubric);
+        return structuredClone(rubric);
+      }
+      async deleteRubric(rubricId, companyId) {
+        const rubric = this.rubrics.get(rubricId);
+        if (!rubric || rubric.companyId !== companyId) return;
+        this.rubrics.delete(rubricId);
+        for (const [key, binding] of this.bindings) {
+          if (binding.companyId !== companyId || !binding.rubricIds.includes(rubricId)) continue;
+          this.bindings.set(key, {
+            ...binding,
+            rubricIds: binding.rubricIds.filter((id) => id !== rubricId)
+          });
+        }
+      }
+      async listBindings(companyId) {
+        return [...this.bindings.values()].filter((binding) => binding.companyId === companyId).map((binding) => structuredClone(binding));
+      }
+      async getBinding(companyId, caseId) {
+        const binding = this.bindings.get(bindingKey(companyId, caseId));
+        return binding ? structuredClone(binding) : null;
+      }
+      async putBinding(input, at) {
+        const binding = {
+          companyId: input.companyId,
+          caseId: input.caseId,
+          rubricIds: [...input.rubricIds],
+          judgeActorId: input.judgeActorId,
+          updatedBy: input.actor,
+          updatedAt: at
+        };
+        this.bindings.set(bindingKey(input.companyId, input.caseId), binding);
+        return structuredClone(binding);
+      }
+    };
+  }
+});
+
 // ../core/src/evaluation/index.ts
 var init_evaluation2 = __esm({
   "../core/src/evaluation/index.ts"() {
     "use strict";
     init_store();
+    init_rubric_store();
   }
 });
 
@@ -7845,11 +8043,11 @@ var init_parse = __esm({
 
 // ../channels/src/feishu/crypto.ts
 function decryptFeishu(encrypt, encryptKey) {
-  const key = (0, import_node_crypto4.createHash)("sha256").update(encryptKey).digest();
+  const key = (0, import_node_crypto5.createHash)("sha256").update(encryptKey).digest();
   const data = Buffer.from(encrypt, "base64");
   const iv = data.subarray(0, 16);
   const ciphertext = data.subarray(16);
-  const decipher = (0, import_node_crypto4.createDecipheriv)("aes-256-cbc", key, iv);
+  const decipher = (0, import_node_crypto5.createDecipheriv)("aes-256-cbc", key, iv);
   decipher.setAutoPadding(true);
   return Buffer.concat([decipher.update(ciphertext), decipher.final()]).toString("utf8");
 }
@@ -7883,11 +8081,11 @@ function verifyToken(decoded, expected) {
   const token = headerToken ?? decoded["token"];
   return token === expected;
 }
-var import_node_crypto4;
+var import_node_crypto5;
 var init_crypto = __esm({
   "../channels/src/feishu/crypto.ts"() {
     "use strict";
-    import_node_crypto4 = require("node:crypto");
+    import_node_crypto5 = require("node:crypto");
   }
 });
 
@@ -8023,11 +8221,11 @@ var init_src3 = __esm({
 function errMsg(e) {
   return e instanceof Error ? e.message : String(e);
 }
-var import_node_crypto5, FEISHU, ChannelService, CardStreamer;
+var import_node_crypto6, FEISHU, ChannelService, CardStreamer;
 var init_service = __esm({
   "../server/src/channels/service.ts"() {
     "use strict";
-    import_node_crypto5 = require("node:crypto");
+    import_node_crypto6 = require("node:crypto");
     init_src3();
     FEISHU = "feishu";
     ChannelService = class {
@@ -8107,7 +8305,7 @@ var init_service = __esm({
             return existing.chatSessionId;
           }
         }
-        const id = (0, import_node_crypto5.randomUUID)();
+        const id = (0, import_node_crypto6.randomUUID)();
         const now = this.now();
         if (cs) {
           const rt = await this.deps.resolveRuntime?.(a.aiActorId).catch(() => null);
@@ -8143,7 +8341,7 @@ var init_service = __esm({
         if (cs) {
           const sess = await cs.getSession(intent.chatSessionId).catch(() => null);
           resumeRt = sess?.runtimeSessionId ?? void 0;
-          await cs.appendMessage({ id: (0, import_node_crypto5.randomUUID)(), sessionId: intent.chatSessionId, role: "user", content: intent.message, createdAt: this.now() }).catch(() => void 0);
+          await cs.appendMessage({ id: (0, import_node_crypto6.randomUUID)(), sessionId: intent.chatSessionId, role: "user", content: intent.message, createdAt: this.now() }).catch(() => void 0);
         }
         let session;
         try {
@@ -8165,7 +8363,7 @@ var init_service = __esm({
             const reply = streamer.text();
             if (reply || session.runId) {
               await cs.appendMessage({
-                id: (0, import_node_crypto5.randomUUID)(),
+                id: (0, import_node_crypto6.randomUUID)(),
                 sessionId: intent.chatSessionId,
                 role: "assistant",
                 content: reply,
@@ -137636,7 +137834,7 @@ var init_live_chat = __esm({
         }
         if (!res.accepted) return say(res, { from: "runtime" });
         if (this.turns.get(chatSessionId) !== turn || turn.status !== "running") {
-          return say({ accepted: true, reason: "turn-finished" }, { turnStatus: turn.status, replaced: this.turns.get(chatSessionId) !== turn });
+          return say({ accepted: false, reason: "turn-finished" }, { turnStatus: turn.status, replaced: this.turns.get(chatSessionId) !== turn });
         }
         const withSeq = { type: "user", text: text2, seq: ++turn.seq };
         turn.buffer.push(withSeq);
@@ -138196,7 +138394,7 @@ function slug4(name) {
   return s2 || "user";
 }
 function short6() {
-  return (0, import_node_crypto6.randomBytes)(4).toString("hex").slice(0, 6);
+  return (0, import_node_crypto7.randomBytes)(4).toString("hex").slice(0, 6);
 }
 async function assertBindingWritePermission(caller, targetHumanId, deps) {
   if (caller === targetHumanId) return true;
@@ -138261,11 +138459,11 @@ async function resolveWorkorderPrincipals(caller, cliOverrides, deps) {
   }
   return { error: "UNBOUND_AGENT_NO_OWNER", message: `owner \u65E0\u6CD5\u89E3\u6790\uFF1A\u8C03\u7528\u65B9 ${caller} \u65E2\u975E\u5728\u5C97\u771F\u4EBA\u4E5F\u975E\u5DF2\u7ED1\u52A9\u7406` };
 }
-var import_node_crypto6, DEFAULT_ASSISTANT_PROMPT, DEFAULT_ASSISTANT_SKILLS, DEFAULT_ASSISTANT_RUNTIME_KIND, ASSISTANT_ARCHIVED_CODE, AssistantLazyCreateError, AssistantsService;
+var import_node_crypto7, DEFAULT_ASSISTANT_PROMPT, DEFAULT_ASSISTANT_SKILLS, DEFAULT_ASSISTANT_RUNTIME_KIND, ASSISTANT_ARCHIVED_CODE, AssistantLazyCreateError, AssistantsService;
 var init_assistants = __esm({
   "../server/src/domains/actors/assistants.ts"() {
     "use strict";
-    import_node_crypto6 = require("node:crypto");
+    import_node_crypto7 = require("node:crypto");
     init_src();
     DEFAULT_ASSISTANT_PROMPT = "\u4F60\u662F\u8FD9\u540D\u771F\u4EBA\u5458\u5DE5\u7684\u4E13\u5C5E\u4E2A\u4EBA\u52A9\u7406\u3002\u4F60\u4EE5\u5176\u300C\u5DE5\u5355\u7BA1\u7406\u8005\u300D\u8EAB\u4EFD\u4EE3\u8DD1\uFF0C\u9075\u5FAA\u4E09\u6863\u6743\u9650\u6A21\u578B\uFF1A\u6863 A\uFF08\u52A0\u8FB9\u3001\u65B0\u5EFA\u8282\u70B9\u3001\u6539\u6807\u9898\u4E0E brief\u3001\u5E38\u89C4\u8BC4\u8BBA\u7B54\u7591\u3001\u63A8\u8FDB\u81EA\u5DF1\u63A5\u7684\u6D3B\uFF09\u53EF\u9006\u6539\u52A8\u76F4\u63A5\u751F\u6548\uFF1B\u6863 B\uFF08\u65AD\u8FB9\u3001\u5E9F\u8282\u70B9\u3001\u6539\u6D3E\u3001\u64A4\u90E8\u4EF6\uFF09\u9500\u6BC1\u6027\u6539\u52A8\u81EA\u52A8\u6253\u5305\u6210\u5F85\u786E\u8BA4\u63D0\u6848\uFF0C\u4EA4\u7531\u672C\u4EBA\u786E\u8BA4\u540E\u751F\u6548\uFF1B\u6863 C\uFF08force-conclude\u3001promote \u7B49\u6CBB\u7406\u547D\u4EE4\uFF09\u8D70\u4EBA\u5DE5\u6388\u6743\u5361\u3002\u4F60\u4E0D\u627F\u62C5\u4E1A\u52A1\u4E13\u4E1A\u5C97\u4F4D\u804C\u8D23\uFF0C\u53EA\u5728\u5176\u6388\u6743\u8303\u56F4\u5185\u534F\u52A9\u5EFA\u5355\u3001\u8DDF\u8FDB\u4E0E\u6C9F\u901A\u3002";
     DEFAULT_ASSISTANT_SKILLS = [];
@@ -139226,9 +139424,9 @@ function agentEdgesFor(dependsOn, nodes, briefId, issues) {
       edges.add(briefId);
       continue;
     }
-    const sep3 = d.indexOf(":");
-    const depType = (sep3 >= 0 ? d.slice(0, sep3) : d).trim().toLowerCase();
-    const depTitle = sep3 >= 0 ? d.slice(sep3 + 1).trim().toLowerCase() : null;
+    const sep4 = d.indexOf(":");
+    const depType = (sep4 >= 0 ? d.slice(0, sep4) : d).trim().toLowerCase();
+    const depTitle = sep4 >= 0 ? d.slice(sep4 + 1).trim().toLowerCase() : null;
     const match = nodes.find((n) => n.type === depType && (depTitle === null || (n.title ?? "").toLowerCase() === depTitle));
     if (match) edges.add(match.id);
     else issues.push({ code: "planner_invalid", severity: "warning", message: `\u8282\u70B9\u4F9D\u8D56\u300C${dep}\u300D\u627E\u4E0D\u5230\u5BF9\u5E94\u4E0A\u6E38\uFF08\u6309 type:title \u5339\u914D\uFF09\uFF0C\u5DF2\u5FFD\u7565\u8FD9\u6761\u8FB9\u3002` });
@@ -140566,6 +140764,13 @@ function resolveWrapperScript(wrapperDir, slug6) {
   }
   return null;
 }
+function isOasisWrapperPath(p2) {
+  try {
+    return (0, import_node_fs2.realpathSync)(p2).endsWith(`${import_node_path.sep}wrapper.sh`);
+  } catch {
+    return false;
+  }
+}
 function wrapperCandidates(wrapperDir, slug6) {
   const override = process.env[ASSETS_DIR_ENV];
   if (override) return [(0, import_node_path.resolve)(override, slug6, "wrapper.sh")];
@@ -140863,13 +141068,27 @@ var init_cli_connector = __esm({
         }
       }
       /**
-       * 用 `which` 解析真实二进制的绝对路径；找不到就原样返回命令名。
-       * 必须在**跑 agent 的那台机器**上解析——server 侧算出的路径在远程节点上并不存在。
+       * 用 `which -a` 解析真实二进制的绝对路径，**跳过 oasis 自己 stage 出来的 wrapper**；
+       * 一个都没有就原样返回命令名。必须在**跑 agent 的那台机器**上解析——server 侧算出的
+       * 路径在远程节点上并不存在。
+       *
+       * 为什么要跳过 wrapper（2026-08-03 实测踩到）：`which` 吃的是**本进程的 PATH**，而
+       * daemon 的 PATH 可能被 agent 会话的 wrapper 目录污染（`oasis daemon start` 把当时
+       * shell 的 PATH 固化进 systemd unit——在 agent 会话里触发更新就会带进 /tmp/oasis-conn-*）。
+       * 裸 `which gh` 于是解析到 wrapper 自己，注入的 GH_BIN 指回 wrapper，wrapper 再 exec
+       * 它 → 无限递归。节点侧已在 daemon 启动时清洗 PATH，这里是第二道闸：
+       * **解析结果一旦是我们自己的 wrapper 就继续往后找。**
        */
       async resolveRealBin(name) {
         try {
-          const { stdout } = await execFile3("which", [name]);
-          return stdout.trim();
+          const { stdout } = await execFile3("which", ["-a", name]);
+          for (const line of stdout.split("\n")) {
+            const candidate = line.trim();
+            if (!candidate) continue;
+            if (isOasisWrapperPath(candidate)) continue;
+            return candidate;
+          }
+          return name;
         } catch {
           return name;
         }
@@ -141420,7 +141639,10 @@ var init_github = __esm({
         "GIT_AUTHOR_EMAIL",
         "GIT_COMMITTER_NAME",
         "GIT_COMMITTER_EMAIL",
-        "EMAIL"
+        "EMAIL",
+        "GIT_CONFIG_COUNT",
+        "GIT_CONFIG_KEY_0",
+        "GIT_CONFIG_VALUE_0"
       ];
       /** 自检：问 GitHub「我是谁」——这是唯一能戳穿「静默用成宿主机身份」的检查。 */
       verifyArgs = ["api", "user", "--jq", ".login"];
@@ -141460,6 +141682,9 @@ var init_github = __esm({
         sessionEnv.set("GIT_COMMITTER_NAME", name);
         sessionEnv.set("GIT_COMMITTER_EMAIL", "");
         sessionEnv.set("EMAIL", "");
+        sessionEnv.set("GIT_CONFIG_COUNT", "1");
+        sessionEnv.set("GIT_CONFIG_KEY_0", "credential.https://github.com.helper");
+        sessionEnv.set("GIT_CONFIG_VALUE_0", "!gh auth git-credential");
       }
     };
   }
@@ -141643,7 +141868,7 @@ var init_prepare_job = __esm({
 function deriveBoardKey(artifactId) {
   const tail = artifactId.split(":").pop() ?? artifactId;
   const ascii = tail.replace(/[^a-zA-Z0-9-]+/g, "-").replace(/-+/g, "-").replace(/^-|-$/g, "").slice(0, 24);
-  const sha8 = (0, import_node_crypto7.createHash)("sha256").update(artifactId).digest("hex").slice(0, 8);
+  const sha8 = (0, import_node_crypto8.createHash)("sha256").update(artifactId).digest("hex").slice(0, 8);
   return ascii ? `od-${ascii}-${sha8}` : `od-${sha8}`;
 }
 async function odApi(base, fetchImpl, method, p2, body) {
@@ -141686,7 +141911,7 @@ function materializeContext(resolvedDir, files) {
   }
 }
 async function putVisibleUserTurn(base, fetchImpl, args) {
-  const messageId = (0, import_node_crypto7.randomUUID)();
+  const messageId = (0, import_node_crypto8.randomUUID)();
   await odApi(
     base,
     fetchImpl,
@@ -141701,8 +141926,8 @@ async function startDesignRun(base, fetchImpl, args) {
     agentId: args.agentId,
     projectId: args.boardKey,
     conversationId: args.conversationId,
-    assistantMessageId: (0, import_node_crypto7.randomUUID)(),
-    clientRequestId: (0, import_node_crypto7.randomUUID)(),
+    assistantMessageId: (0, import_node_crypto8.randomUUID)(),
+    clientRequestId: (0, import_node_crypto8.randomUUID)(),
     message: args.message,
     // 提案 design-conversational-driving 坑②：systemPrompt 从写死改为可选——缺省用引擎侧默认，
     // 让设计意图由驱动方每轮的话（message）表达，而非焊死一句。
@@ -141883,11 +142108,11 @@ async function runDesignChatTurn(opts) {
   const { artifacts, fileCount } = await fetchResultPackage(opts.base, fetchImpl, runId);
   return { boardKey, conversationId, runId, userMessageId, artifacts, fileCount };
 }
-var import_node_crypto7, fs5, os, path4;
+var import_node_crypto8, fs5, os, path4;
 var init_driver = __esm({
   "../adapters/src/open-design/driver.ts"() {
     "use strict";
-    import_node_crypto7 = require("node:crypto");
+    import_node_crypto8 = require("node:crypto");
     fs5 = __toESM(require("node:fs"), 1);
     os = __toESM(require("node:os"), 1);
     path4 = __toESM(require("node:path"), 1);
@@ -141998,7 +142223,7 @@ function resolveWorkRoots(workRoot) {
 }
 function slug5(workdirKey) {
   const safe = workdirKey.replace(/[^a-zA-Z0-9_-]+/g, "_").slice(0, 48);
-  const h = (0, import_node_crypto8.createHash)("sha256").update(workdirKey).digest("hex").slice(0, 8);
+  const h = (0, import_node_crypto9.createHash)("sha256").update(workdirKey).digest("hex").slice(0, 8);
   return `${safe}-${h}`;
 }
 function sessionDirFor(workRoot, runtimeKind, workdirKey) {
@@ -142130,11 +142355,11 @@ function prepareWorkdir(args) {
 function legacyChatSessionDir(workRoot, rtId) {
   return import_node_path8.default.join(resolveLegacyWorkRoot(workRoot), "oasis-chat-sessions", rtId.replace(/[^a-zA-Z0-9_-]+/g, "_"));
 }
-var import_node_crypto8, import_node_fs6, import_node_os4, import_node_path8, META_FILE, LOCK_FILE, NEW_WORK_ROOT, LEGACY_ROOTS, LEGACY_ONESHOT_PREFIX;
+var import_node_crypto9, import_node_fs6, import_node_os4, import_node_path8, META_FILE, LOCK_FILE, NEW_WORK_ROOT, LEGACY_ROOTS, LEGACY_ONESHOT_PREFIX;
 var init_session_paths = __esm({
   "../adapters/src/_core/session-paths.ts"() {
     "use strict";
-    import_node_crypto8 = require("node:crypto");
+    import_node_crypto9 = require("node:crypto");
     import_node_fs6 = __toESM(require("node:fs"), 1);
     import_node_os4 = __toESM(require("node:os"), 1);
     import_node_path8 = __toESM(require("node:path"), 1);
@@ -142337,12 +142562,12 @@ function classifyExit(result) {
   if (status === 429 || status === 529) return "rate-limit";
   return "error";
 }
-var import_node_child_process8, import_node_crypto9, fs9, path7, readline, ONE_SHOT_UNSAFE_TOOLS, ClaudeCodeAdapter;
+var import_node_child_process8, import_node_crypto10, fs9, path7, readline, ONE_SHOT_UNSAFE_TOOLS, ClaudeCodeAdapter;
 var init_claude_code = __esm({
   "../adapters/src/claude-code/index.ts"() {
     "use strict";
     import_node_child_process8 = require("node:child_process");
-    import_node_crypto9 = require("node:crypto");
+    import_node_crypto10 = require("node:crypto");
     fs9 = __toESM(require("node:fs"), 1);
     path7 = __toESM(require("node:path"), 1);
     readline = __toESM(require("node:readline"), 1);
@@ -142383,7 +142608,7 @@ var init_claude_code = __esm({
       }
       async spawn(job) {
         const slug6 = job.artifactId.replace(/[^a-zA-Z0-9_-]+/g, "_").slice(0, 32);
-        const id = `claude-${slug6}-${(0, import_node_crypto9.randomUUID)().slice(0, 8)}`;
+        const id = `claude-${slug6}-${(0, import_node_crypto10.randomUUID)().slice(0, 8)}`;
         const dir = job.workdirKey ? prepareWorkdir({
           workRoot: this.opts.workRoot,
           runtimeKind: "claude",
@@ -143749,12 +143974,12 @@ function normalizeCodexConsoleLine(line, state = createCodexNormalizeState()) {
   tool.output.push(line);
   return [];
 }
-var import_node_child_process10, import_node_crypto10, fs10, os4, path9, readline2, CODEX_ARGV_PROMPT_MAX_BYTES, CodexAdapter;
+var import_node_child_process10, import_node_crypto11, fs10, os4, path9, readline2, CODEX_ARGV_PROMPT_MAX_BYTES, CodexAdapter;
 var init_codex = __esm({
   "../adapters/src/codex/index.ts"() {
     "use strict";
     import_node_child_process10 = require("node:child_process");
-    import_node_crypto10 = require("node:crypto");
+    import_node_crypto11 = require("node:crypto");
     fs10 = __toESM(require("node:fs"), 1);
     os4 = __toESM(require("node:os"), 1);
     path9 = __toESM(require("node:path"), 1);
@@ -143781,7 +144006,7 @@ var init_codex = __esm({
       capabilities = { appendInput: false };
       async spawn(job) {
         const slug6 = job.artifactId.replace(/[^a-zA-Z0-9_-]+/g, "_").slice(0, 32);
-        const id = `codex-${slug6}-${(0, import_node_crypto10.randomUUID)().slice(0, 8)}`;
+        const id = `codex-${slug6}-${(0, import_node_crypto11.randomUUID)().slice(0, 8)}`;
         const startedAtMs = Date.now();
         const dir = job.workdirKey ? prepareWorkdir({
           workRoot: this.opts.workRoot,
@@ -144528,7 +144753,7 @@ function buildReportedUsage(acc, model, inputTokensIncludeCacheRead) {
 async function runACPSession(job, cfg) {
   const slug6 = job.artifactId.replace(/[^a-zA-Z0-9_-]+/g, "_").slice(0, 32);
   const binTag = path10.basename(cfg.bin).replace(/[^a-zA-Z0-9]/g, "").slice(0, 12) || "acp";
-  const id = `${binTag}-${slug6}-${(0, import_node_crypto11.randomUUID)().slice(0, 8)}`;
+  const id = `${binTag}-${slug6}-${(0, import_node_crypto12.randomUUID)().slice(0, 8)}`;
   const dir = job.workdirKey ? prepareWorkdir({
     workRoot: cfg.workRoot,
     runtimeKind: cfg.runtimeKind ?? "subprocess",
@@ -144832,12 +145057,12 @@ ${task2}` : task2;
     }
   };
 }
-var import_node_child_process11, import_node_crypto11, fs11, path10, readline3, ACPClient;
+var import_node_child_process11, import_node_crypto12, fs11, path10, readline3, ACPClient;
 var init_acp = __esm({
   "../adapters/src/_core/acp.ts"() {
     "use strict";
     import_node_child_process11 = require("node:child_process");
-    import_node_crypto11 = require("node:crypto");
+    import_node_crypto12 = require("node:crypto");
     fs11 = __toESM(require("node:fs"), 1);
     path10 = __toESM(require("node:path"), 1);
     readline3 = __toESM(require("node:readline"), 1);
@@ -145189,7 +145414,7 @@ var init_kiro = __esm({
 // ../adapters/src/_core/subprocess.ts
 async function materialize(job, cfg) {
   const slug6 = job.artifactId.replace(/[^a-zA-Z0-9_-]+/g, "_").slice(0, 32);
-  const id = `${slug6}-${(0, import_node_crypto12.randomUUID)().slice(0, 8)}`;
+  const id = `${slug6}-${(0, import_node_crypto13.randomUUID)().slice(0, 8)}`;
   const dir = job.workdirKey ? prepareWorkdir({
     workRoot: cfg.workRoot,
     runtimeKind: cfg.runtimeKind ?? "subprocess",
@@ -145411,12 +145636,12 @@ async function runOneShotText(job, cfg) {
     }
   });
 }
-var import_node_child_process12, import_node_crypto12, fs12, path11, readline4;
+var import_node_child_process12, import_node_crypto13, fs12, path11, readline4;
 var init_subprocess = __esm({
   "../adapters/src/_core/subprocess.ts"() {
     "use strict";
     import_node_child_process12 = require("node:child_process");
-    import_node_crypto12 = require("node:crypto");
+    import_node_crypto13 = require("node:crypto");
     fs12 = __toESM(require("node:fs"), 1);
     path11 = __toESM(require("node:path"), 1);
     readline4 = __toESM(require("node:readline"), 1);
@@ -145830,11 +146055,11 @@ function normalizeOpenClaw(line) {
   }
   return [];
 }
-var import_node_crypto13, OpenClawAdapter;
+var import_node_crypto14, OpenClawAdapter;
 var init_openclaw = __esm({
   "../adapters/src/openclaw/index.ts"() {
     "use strict";
-    import_node_crypto13 = require("node:crypto");
+    import_node_crypto14 = require("node:crypto");
     init_subprocess();
     OpenClawAdapter = class {
       constructor(opts = {}) {
@@ -145852,7 +146077,7 @@ var init_openclaw = __esm({
 ---
 
 ${task2}` : task2;
-            const sessionId = job2.runtimeSessionId ?? `oasis-${(0, import_node_crypto13.randomUUID)().slice(0, 8)}`;
+            const sessionId = job2.runtimeSessionId ?? `oasis-${(0, import_node_crypto14.randomUUID)().slice(0, 8)}`;
             return [
               "agent",
               ...opts.mode !== "gateway" ? ["--local"] : [],
@@ -147591,12 +147816,12 @@ async function startOasisServer(opts) {
     if (!store || !dispatch) return;
     const session = await store.getSession(origin).catch(() => null);
     if (!session) return;
-    const { randomUUID: randomUUID29 } = await import("node:crypto");
+    const { randomUUID: randomUUID31 } = await import("node:crypto");
     const approved = resolution.status === "approved";
     const by = ctx.authorizedBy ?? "\u7BA1\u7406\u8005";
     const label = ctx.effectLabel || ctx.command || "";
     const statusText = approved ? `\u547D\u4EE4\u5DF2\u7531 ${by} \u6279\u51C6\u5E76\u4EE5\u5176\u540D\u4E49\u6267\u884C${label ? `\uFF1A${label}` : ""}\u3002` : `\u547D\u4EE4\u5DF2\u88AB ${by} \u9A73\u56DE${ctx.reason ? `\uFF1A${ctx.reason}` : ""}\u3002`;
-    await store.appendMessage({ id: randomUUID29(), sessionId: origin, role: "system", content: statusText, createdAt: (/* @__PURE__ */ new Date()).toISOString() }).catch(() => void 0);
+    await store.appendMessage({ id: randomUUID31(), sessionId: origin, role: "system", content: statusText, createdAt: (/* @__PURE__ */ new Date()).toISOString() }).catch(() => void 0);
     if (liveChat.isRunning(origin)) return;
     const prompt = approved ? `\u4E0A\u4E00\u6761\u5F85\u6388\u6743\u547D\u4EE4\u5DF2\u88AB ${by} \u6279\u51C6\u5E76\u4EE5\u5176\u540D\u4E49\u6267\u884C\uFF08\u547D\u4EE4\uFF1A${label}\uFF09\u3002\u8BF7\u7EE7\u7EED\u539F\u4EFB\u52A1\u3002` : `\u4E0A\u4E00\u6761\u5F85\u6388\u6743\u547D\u4EE4\u5DF2\u88AB ${by} \u9A73\u56DE${ctx.reason ? `\uFF08\u7406\u7531\uFF1A${ctx.reason}\uFF09` : ""}\u3002\u522B\u91CD\u8BD5\u540C\u4E00\u6761\u2014\u2014\u8BF7\u6539\u65B9\u6848\u6216\u5148\u5411\u53D1\u8D77\u4EBA\u95EE\u6E05\u695A\u3002`;
     let dispatched;
@@ -147617,7 +147842,7 @@ async function startOasisServer(opts) {
     void dispatched.done.then(async () => {
       if (text2 || dispatched.runId) {
         await store.appendMessage({
-          id: randomUUID29(),
+          id: randomUUID31(),
           sessionId: origin,
           role: "assistant",
           content: text2,
@@ -148268,11 +148493,11 @@ async function startOasisServer(opts) {
             const itemKey = `${baseItemKey}:${ctx.ownerId}`;
             let chatSessionId;
             if (chatStore) {
-              const { randomUUID: randomUUID29 } = await import("node:crypto");
+              const { randomUUID: randomUUID31 } = await import("node:crypto");
               const known = discussSessions.get(itemKey);
               if (known && await chatStore.getSession(known).catch(() => null)) chatSessionId = known;
               if (!chatSessionId) {
-                chatSessionId = randomUUID29();
+                chatSessionId = randomUUID31();
                 const now = (/* @__PURE__ */ new Date()).toISOString();
                 const title = `\u89E3\u51B3\uFF1A${ctx.seed.slice(ctx.seed.indexOf("\uFF1A") + 1, ctx.seed.indexOf("\uFF1A") + 25) || "\u5DE5\u5355\u5361\u70B9"}`;
                 const reg0 = (await resolveEngine(currentCompanyId).catch(() => null))?.registry ?? opts.registry;
@@ -148722,14 +148947,14 @@ async function startOasisServer(opts) {
                     runtimeSessionId: session.nativeSessionId ?? session.id
                   }).catch(() => void 0);
                 }
-                const { randomUUID: randomUUID30 } = await import("node:crypto");
+                const { randomUUID: randomUUID32 } = await import("node:crypto");
                 const persistAttachments = attachments.map((a) => ({
                   name: a.name,
                   ...a.blobRef !== void 0 ? { blobRef: a.blobRef } : {},
                   ...a.contentType !== void 0 ? { contentType: a.contentType } : {}
                 }));
                 await chatStore.appendMessage({
-                  id: randomUUID30(),
+                  id: randomUUID32(),
                   sessionId: persistTarget.id,
                   role: "user",
                   content: persistedUserMessage,
@@ -148739,8 +148964,8 @@ async function startOasisServer(opts) {
               }
               let assistantMsgId;
               if (chatStore && persistTarget) {
-                const { randomUUID: randomUUID30 } = await import("node:crypto");
-                const id = randomUUID30();
+                const { randomUUID: randomUUID32 } = await import("node:crypto");
+                const id = randomUUID32();
                 await chatStore.appendMessage({
                   id,
                   sessionId: persistTarget.id,
@@ -148776,9 +149001,9 @@ async function startOasisServer(opts) {
                   }).catch(() => void 0);
                 } else {
                   if (!assistantText && !session.runId && parts.length === 0) return;
-                  const { randomUUID: randomUUID30 } = await import("node:crypto");
+                  const { randomUUID: randomUUID32 } = await import("node:crypto");
                   await chatStore.appendMessage({
-                    id: randomUUID30(),
+                    id: randomUUID32(),
                     sessionId: persistTarget.id,
                     role: "assistant",
                     content: assistantText,
@@ -149011,8 +149236,8 @@ async function startOasisServer(opts) {
               }
             }
             const { spawn: spawn7 } = await import("node:child_process");
-            const { randomUUID: randomUUID29 } = await import("node:crypto");
-            const sessionId = body.sessionId ?? randomUUID29();
+            const { randomUUID: randomUUID31 } = await import("node:crypto");
+            const sessionId = body.sessionId ?? randomUUID31();
             const args = [
               "-p",
               body.message,
@@ -149513,10 +149738,10 @@ function createTokenIssuer(opts = {}) {
     if (revoked.has(token)) return null;
     if (!token.startsWith(SESSION_TOKEN_PREFIX)) return null;
     const encoded = token.slice(SESSION_TOKEN_PREFIX.length);
-    const sep3 = encoded.indexOf(".");
-    if (sep3 <= 0) return null;
-    const payload = encoded.slice(0, sep3);
-    const actualSig = encoded.slice(sep3 + 1);
+    const sep4 = encoded.indexOf(".");
+    if (sep4 <= 0) return null;
+    const payload = encoded.slice(0, sep4);
+    const actualSig = encoded.slice(sep4 + 1);
     const expectedSig = sign(secret, payload);
     if (!signatureMatches(actualSig, expectedSig)) return null;
     let claims;
@@ -149574,7 +149799,7 @@ function createNodeTokenStore(file) {
   return {
     issue(nodeId) {
       const table = read();
-      const token = `ont_${(0, import_node_crypto14.randomBytes)(24).toString("base64url")}`;
+      const token = `ont_${(0, import_node_crypto15.randomBytes)(24).toString("base64url")}`;
       table[token] = nodeId;
       write(table);
       return token;
@@ -149616,7 +149841,7 @@ function createEnrollTokenStore(defaultTtlMs = 30 * 60 * 1e3, file) {
   return {
     issue(name, ttlMs = defaultTtlMs) {
       const m2 = prune();
-      const token = `ent_${(0, import_node_crypto14.randomBytes)(24).toString("base64url")}`;
+      const token = `ent_${(0, import_node_crypto15.randomBytes)(24).toString("base64url")}`;
       const expiresAt = Date.now() + ttlMs;
       m2.set(token, { name, expiresAt });
       write(m2);
@@ -149646,33 +149871,33 @@ function createEnrollTokenStore(defaultTtlMs = 30 * 60 * 1e3, file) {
     }
   };
 }
-var import_node_crypto14, fs14, path13, SESSION_TOKEN_PREFIX, b64url, fromB64url, readOrCreateSecret, sign, signatureMatches, isTokenClaims;
+var import_node_crypto15, fs14, path13, SESSION_TOKEN_PREFIX, b64url, fromB64url, readOrCreateSecret, sign, signatureMatches, isTokenClaims;
 var init_tokens = __esm({
   "../server/src/tokens.ts"() {
     "use strict";
-    import_node_crypto14 = require("node:crypto");
+    import_node_crypto15 = require("node:crypto");
     fs14 = __toESM(require("node:fs"), 1);
     path13 = __toESM(require("node:path"), 1);
     SESSION_TOKEN_PREFIX = "oat_v2_";
     b64url = (value2) => Buffer.from(value2).toString("base64url");
     fromB64url = (value2) => Buffer.from(value2, "base64url").toString("utf8");
     readOrCreateSecret = (file) => {
-      if (!file) return (0, import_node_crypto14.randomBytes)(32);
+      if (!file) return (0, import_node_crypto15.randomBytes)(32);
       try {
         const raw = fs14.readFileSync(file, "utf8").trim();
         if (raw) return Buffer.from(raw, "base64url");
       } catch {
       }
-      const secret = (0, import_node_crypto14.randomBytes)(32);
+      const secret = (0, import_node_crypto15.randomBytes)(32);
       fs14.mkdirSync(path13.dirname(file), { recursive: true });
       fs14.writeFileSync(file, secret.toString("base64url"), { mode: 384 });
       return secret;
     };
-    sign = (secret, payload) => (0, import_node_crypto14.createHmac)("sha256", secret).update(payload).digest("base64url");
+    sign = (secret, payload) => (0, import_node_crypto15.createHmac)("sha256", secret).update(payload).digest("base64url");
     signatureMatches = (actual, expected) => {
       const a = Buffer.from(actual);
       const b2 = Buffer.from(expected);
-      return a.length === b2.length && (0, import_node_crypto14.timingSafeEqual)(a, b2);
+      return a.length === b2.length && (0, import_node_crypto15.timingSafeEqual)(a, b2);
     };
     isTokenClaims = (value2) => {
       if (value2 === null || typeof value2 !== "object") return false;
@@ -150889,11 +151114,11 @@ function onlyHits(pool, q) {
   if (!q.requireMatch || q.keywords.length === 0) return [...pool];
   return pool.filter((r) => memoryMatchScore(r, q.keywords) > 0);
 }
-var import_node_crypto15, MemoryActorMemoryStore, toIndexEntry;
+var import_node_crypto16, MemoryActorMemoryStore, toIndexEntry;
 var init_memory_actor_memory_store = __esm({
   "../testkit/src/memory-actor-memory-store.ts"() {
     "use strict";
-    import_node_crypto15 = require("node:crypto");
+    import_node_crypto16 = require("node:crypto");
     init_src();
     MemoryActorMemoryStore = class {
       rows = /* @__PURE__ */ new Map();
@@ -150947,7 +151172,7 @@ var init_memory_actor_memory_store = __esm({
       async write(input, now) {
         if (input.memId === void 0) {
           const rec = {
-            memId: `mem:${(0, import_node_crypto15.randomUUID)()}`,
+            memId: `mem:${(0, import_node_crypto16.randomUUID)()}`,
             actorId: input.actorId,
             projectId: input.projectId,
             keywords: [...input.keywords],
@@ -152662,11 +152887,11 @@ var init_service2 = __esm({
 });
 
 // ../server/src/dev-store.ts
-var import_node_crypto16, fs15, path14, NdjsonOplogStore, DirBlobStore, MUTATORS, FileTypeRegistryStore, FileRoleRegistryStore, FileRegistryStore, FileAssistantBindStore, FileHumanPrefsStore, FileProjectStateStore, FileProjectDocumentStore, FileArtifactStateStore, FileTraceStore, MemoryChatSessionStore, FileChatSessionStore, MemoryReadMarkerStore, FileReadMarkerStore;
+var import_node_crypto17, fs15, path14, NdjsonOplogStore, DirBlobStore, MUTATORS, FileTypeRegistryStore, FileRoleRegistryStore, FileRegistryStore, FileAssistantBindStore, FileHumanPrefsStore, FileProjectStateStore, FileProjectDocumentStore, FileArtifactStateStore, FileTraceStore, MemoryChatSessionStore, FileChatSessionStore, MemoryReadMarkerStore, FileReadMarkerStore;
 var init_dev_store = __esm({
   "../server/src/dev-store.ts"() {
     "use strict";
-    import_node_crypto16 = require("node:crypto");
+    import_node_crypto17 = require("node:crypto");
     fs15 = __toESM(require("node:fs"), 1);
     path14 = __toESM(require("node:path"), 1);
     init_src();
@@ -152720,7 +152945,7 @@ var init_dev_store = __esm({
         return path14.join(this.dir, hash);
       }
       async put(bytes) {
-        const hash = (0, import_node_crypto16.createHash)("sha256").update(bytes).digest("hex");
+        const hash = (0, import_node_crypto17.createHash)("sha256").update(bytes).digest("hex");
         const file = this.fileOf(hash);
         if (!fs15.existsSync(file)) fs15.writeFileSync(file, bytes);
         return hash;
@@ -153457,11 +153682,11 @@ function typeDefError(def, mode) {
   }
   return null;
 }
-var import_node_crypto17, RESERVED_FIELD_NAMES, ARTIFACT_TYPE_ACCENTS, TYPE_DEF_SCHEMA, TypesAdminService;
+var import_node_crypto18, RESERVED_FIELD_NAMES, ARTIFACT_TYPE_ACCENTS, TYPE_DEF_SCHEMA, TypesAdminService;
 var init_types_admin = __esm({
   "../server/src/types-admin.ts"() {
     "use strict";
-    import_node_crypto17 = require("node:crypto");
+    import_node_crypto18 = require("node:crypto");
     init_zod();
     init_src2();
     init_config_audit();
@@ -153578,7 +153803,7 @@ var init_types_admin = __esm({
       async trace(change, target, by, detail) {
         try {
           await this.audit?.({
-            id: `reg_${(0, import_node_crypto17.randomUUID)()}`,
+            id: `reg_${(0, import_node_crypto18.randomUUID)()}`,
             actor: by ?? SYSTEM_CONFIG_ACTOR,
             kind: "registry_change",
             target,
@@ -153726,11 +153951,11 @@ function roleDefError(def, mode) {
   }
   return null;
 }
-var import_node_crypto18, ACCENTS, ROLE_DEF_SCHEMA, RolesAdminService;
+var import_node_crypto19, ACCENTS, ROLE_DEF_SCHEMA, RolesAdminService;
 var init_roles_admin = __esm({
   "../server/src/roles-admin.ts"() {
     "use strict";
-    import_node_crypto18 = require("node:crypto");
+    import_node_crypto19 = require("node:crypto");
     init_zod();
     init_src2();
     init_config_audit();
@@ -153755,7 +153980,7 @@ var init_roles_admin = __esm({
       async trace(change, target, by, detail) {
         try {
           await this.deps.audit?.({
-            id: `reg_${(0, import_node_crypto18.randomUUID)()}`,
+            id: `reg_${(0, import_node_crypto19.randomUUID)()}`,
             actor: by ?? SYSTEM_CONFIG_ACTOR,
             kind: "registry_change",
             target,
@@ -155113,6 +155338,7 @@ async function planChatTurnRecovery(deps) {
       assistantMsgId: row.id,
       runId: run.id,
       artifactId: run.artifactId,
+      actor: run.actorId,
       ...run.runtimeKind ? { runtimeKind: run.runtimeKind } : {},
       ...runtimeSessionId ? { runtimeSessionId } : {},
       startedAt: run.startedAt,
@@ -155210,7 +155436,7 @@ function wireRecoveredChatTurn(deps) {
       const segText = assistantText;
       const segParts = collectedParts();
       const closingId = currentMsgId;
-      const nextId = (0, import_node_crypto19.randomUUID)();
+      const nextId = (0, import_node_crypto20.randomUUID)();
       assistantText = "";
       currentMsgId = nextId;
       segmentBaseSeq = live.bufferedParts().reduce((max, p2) => p2.seq > max ? p2.seq : max, 0);
@@ -155223,7 +155449,7 @@ function wireRecoveredChatTurn(deps) {
           ...segParts.length ? { parts: segParts } : {}
         }).catch(() => void 0);
         await store.appendMessage({
-          id: (0, import_node_crypto19.randomUUID)(),
+          id: (0, import_node_crypto20.randomUUID)(),
           sessionId: plan.chatSessionId,
           role: "user",
           content: text2,
@@ -155403,11 +155629,11 @@ async function reconcileChatExitFrame(deps) {
   }
   return false;
 }
-var import_node_crypto19, asObj3, partsOf, maxPartSeq, exitFailed, exitErrorText, runTerminalPatch;
+var import_node_crypto20, asObj3, partsOf, maxPartSeq, exitFailed, exitErrorText, runTerminalPatch;
 var init_chat_recovery = __esm({
   "../server/src/chat-recovery.ts"() {
     "use strict";
-    import_node_crypto19 = require("node:crypto");
+    import_node_crypto20 = require("node:crypto");
     init_chat_parts();
     init_sink();
     asObj3 = (v2) => v2 && typeof v2 === "object" && !Array.isArray(v2) ? v2 : void 0;
@@ -155432,8 +155658,8 @@ var init_chat_recovery = __esm({
 
 // ../server/src/auth/crypto.ts
 function hashPassword(password) {
-  const salt = (0, import_node_crypto20.randomBytes)(16);
-  const dk = (0, import_node_crypto20.scryptSync)(password, salt, SCRYPT_KEYLEN, { N: SCRYPT_N, maxmem: 64 * 1024 * 1024 });
+  const salt = (0, import_node_crypto21.randomBytes)(16);
+  const dk = (0, import_node_crypto21.scryptSync)(password, salt, SCRYPT_KEYLEN, { N: SCRYPT_N, maxmem: 64 * 1024 * 1024 });
   return `scrypt$${SCRYPT_N}$${salt.toString("base64url")}$${dk.toString("base64url")}`;
 }
 function verifyPassword(password, stored) {
@@ -155450,8 +155676,8 @@ function verifyPassword(password, stored) {
     return false;
   }
   if (expected.length === 0) return false;
-  const dk = (0, import_node_crypto20.scryptSync)(password, salt, expected.length, { N, maxmem: 64 * 1024 * 1024 });
-  return dk.length === expected.length && (0, import_node_crypto20.timingSafeEqual)(dk, expected);
+  const dk = (0, import_node_crypto21.scryptSync)(password, salt, expected.length, { N, maxmem: 64 * 1024 * 1024 });
+  return dk.length === expected.length && (0, import_node_crypto21.timingSafeEqual)(dk, expected);
 }
 function b64urlJson(value2) {
   return Buffer.from(JSON.stringify(value2)).toString("base64url");
@@ -155459,17 +155685,17 @@ function b64urlJson(value2) {
 function signSession(claims, secret) {
   const head = b64urlJson({ alg: "HS256", typ: "JWT" });
   const body = b64urlJson(claims);
-  const sig = (0, import_node_crypto20.createHmac)("sha256", secret).update(`${head}.${body}`).digest("base64url");
+  const sig = (0, import_node_crypto21.createHmac)("sha256", secret).update(`${head}.${body}`).digest("base64url");
   return `${head}.${body}.${sig}`;
 }
 function verifySession(token, secret, nowMs) {
   const parts = token.split(".");
   if (parts.length !== 3) return null;
   const [head, body, sig] = parts;
-  const expected = (0, import_node_crypto20.createHmac)("sha256", secret).update(`${head}.${body}`).digest("base64url");
+  const expected = (0, import_node_crypto21.createHmac)("sha256", secret).update(`${head}.${body}`).digest("base64url");
   const got = Buffer.from(sig);
   const exp = Buffer.from(expected);
-  if (got.length !== exp.length || !(0, import_node_crypto20.timingSafeEqual)(got, exp)) return null;
+  if (got.length !== exp.length || !(0, import_node_crypto21.timingSafeEqual)(got, exp)) return null;
   let claims;
   try {
     claims = JSON.parse(Buffer.from(body, "base64url").toString("utf8"));
@@ -155481,21 +155707,21 @@ function verifySession(token, secret, nowMs) {
   return claims;
 }
 function generateCode() {
-  return String((0, import_node_crypto20.randomInt)(0, 1e6)).padStart(6, "0");
+  return String((0, import_node_crypto21.randomInt)(0, 1e6)).padStart(6, "0");
 }
 function hashCode(code, secret) {
-  return (0, import_node_crypto20.createHmac)("sha256", secret).update(`code:${code}`).digest("base64url");
+  return (0, import_node_crypto21.createHmac)("sha256", secret).update(`code:${code}`).digest("base64url");
 }
 function safeEqualHash(a, b2) {
   const ba = Buffer.from(a);
   const bb = Buffer.from(b2);
-  return ba.length === bb.length && (0, import_node_crypto20.timingSafeEqual)(ba, bb);
+  return ba.length === bb.length && (0, import_node_crypto21.timingSafeEqual)(ba, bb);
 }
-var import_node_crypto20, SCRYPT_N, SCRYPT_KEYLEN;
+var import_node_crypto21, SCRYPT_N, SCRYPT_KEYLEN;
 var init_crypto2 = __esm({
   "../server/src/auth/crypto.ts"() {
     "use strict";
-    import_node_crypto20 = require("node:crypto");
+    import_node_crypto21 = require("node:crypto");
     SCRYPT_N = 16384;
     SCRYPT_KEYLEN = 32;
   }
@@ -156024,13 +156250,13 @@ function variableKeyFromEnv(env = process.env) {
     return buf;
   }
   if (env.NODE_ENV === "production") throw new Error("OASIS_VAR_KEY is required in production");
-  return (0, import_node_crypto21.createHash)("sha256").update("oasis-dev-only-variable-key").digest();
+  return (0, import_node_crypto22.createHash)("sha256").update("oasis-dev-only-variable-key").digest();
 }
-var import_node_crypto21, REDACTED_MARKER, ActorsService, mask, changedKeys;
+var import_node_crypto22, REDACTED_MARKER, ActorsService, mask, changedKeys;
 var init_service3 = __esm({
   "../server/src/domains/actors/service.ts"() {
     "use strict";
-    import_node_crypto21 = require("node:crypto");
+    import_node_crypto22 = require("node:crypto");
     init_skill_fetcher();
     init_identity();
     init_src5();
@@ -156424,7 +156650,7 @@ ${input.description}
        */
       buildSkillFile(skillId, path30, content, now) {
         const bytes = new TextEncoder().encode(content);
-        const blobHash = (0, import_node_crypto21.createHash)("sha256").update(bytes).digest("hex");
+        const blobHash = (0, import_node_crypto22.createHash)("sha256").update(bytes).digest("hex");
         return { skillId, path: path30, content, blobHash, size: bytes.length, updatedAt: now };
       }
       /**
@@ -156779,15 +157005,15 @@ ${input.description}
         return env;
       }
       encrypt(plain) {
-        const iv = (0, import_node_crypto21.randomBytes)(12);
-        const cipher = (0, import_node_crypto21.createCipheriv)("aes-256-gcm", this.opts.variableKey, iv);
+        const iv = (0, import_node_crypto22.randomBytes)(12);
+        const cipher = (0, import_node_crypto22.createCipheriv)("aes-256-gcm", this.opts.variableKey, iv);
         const enc4 = Buffer.concat([cipher.update(plain, "utf8"), cipher.final()]);
         return [iv.toString("base64"), cipher.getAuthTag().toString("base64"), enc4.toString("base64")].join(".");
       }
       decrypt(packed) {
         const [iv, tag, data] = packed.split(".");
         if (!iv || !tag || typeof data !== "string") throw new Error("malformed ciphertext");
-        const decipher = (0, import_node_crypto21.createDecipheriv)("aes-256-gcm", this.opts.variableKey, Buffer.from(iv, "base64"));
+        const decipher = (0, import_node_crypto22.createDecipheriv)("aes-256-gcm", this.opts.variableKey, Buffer.from(iv, "base64"));
         decipher.setAuthTag(Buffer.from(tag, "base64"));
         return Buffer.concat([decipher.update(Buffer.from(data, "base64")), decipher.final()]).toString("utf8");
       }
@@ -157628,7 +157854,7 @@ async function listSkillMetadataForActor(args) {
     usedDirs.add(dir);
     const sorted = [...metas].sort((a, b2) => a.path.localeCompare(b2.path));
     let latest = "1970-01-01T00:00:00.000Z";
-    const hasher = (0, import_node_crypto22.createHash)("sha256");
+    const hasher = (0, import_node_crypto23.createHash)("sha256");
     for (const m2 of sorted) {
       if (m2.updatedAt > latest) latest = m2.updatedAt;
       hasher.update(m2.path);
@@ -157653,11 +157879,11 @@ async function listSkillMetadataForActor(args) {
     const dir = sanitizeSkillDir(c.name, c.slug);
     if (usedDirs.has(dir)) continue;
     usedDirs.add(dir);
-    const hasher = (0, import_node_crypto22.createHash)("sha256");
+    const hasher = (0, import_node_crypto23.createHash)("sha256");
     for (const p2 of paths) {
       hasher.update(p2);
       hasher.update("\0");
-      hasher.update((0, import_node_crypto22.createHash)("sha256").update(c.files[p2]).digest("hex"));
+      hasher.update((0, import_node_crypto23.createHash)("sha256").update(c.files[p2]).digest("hex"));
       hasher.update("\0");
     }
     out.push({
@@ -157678,11 +157904,11 @@ async function listSkillMetadataForActor(args) {
     const dir = sanitizeSkillDir(b2.name, b2.id);
     if (usedDirs.has(dir)) continue;
     usedDirs.add(dir);
-    const hasher = (0, import_node_crypto22.createHash)("sha256");
+    const hasher = (0, import_node_crypto23.createHash)("sha256");
     for (const p2 of paths) {
       hasher.update(p2);
       hasher.update("\0");
-      hasher.update((0, import_node_crypto22.createHash)("sha256").update(b2.files[p2]).digest("hex"));
+      hasher.update((0, import_node_crypto23.createHash)("sha256").update(b2.files[p2]).digest("hex"));
       hasher.update("\0");
     }
     out.push({
@@ -157702,7 +157928,7 @@ function builtinSkillToFiles(b2) {
     skillId: `builtin:${b2.id}`,
     path: path30,
     content,
-    blobHash: (0, import_node_crypto22.createHash)("sha256").update(content).digest("hex"),
+    blobHash: (0, import_node_crypto23.createHash)("sha256").update(content).digest("hex"),
     size: Buffer.byteLength(content, "utf8"),
     updatedAt: "1970-01-01T00:00:00.000Z"
   }));
@@ -157726,7 +157952,7 @@ function sanitizeSkillDir(name, fallbackId) {
   if (byName) return byName;
   const byId = fallbackId ? fold2(fallbackId) : "";
   if (byId) return byId;
-  return `skill-${(0, import_node_crypto22.createHash)("sha256").update(name).digest("hex").slice(0, 8)}`;
+  return `skill-${(0, import_node_crypto23.createHash)("sha256").update(name).digest("hex").slice(0, 8)}`;
 }
 async function materializeSkillFiles(args) {
   const skills = await args.service.listInstalledSkillsForActor(args.actorId);
@@ -157759,7 +157985,7 @@ function connectorSkillToFiles(c) {
     skillId: c.id,
     path: path30,
     content,
-    blobHash: (0, import_node_crypto22.createHash)("sha256").update(content).digest("hex"),
+    blobHash: (0, import_node_crypto23.createHash)("sha256").update(content).digest("hex"),
     size: Buffer.byteLength(content, "utf8"),
     updatedAt: "1970-01-01T00:00:00.000Z"
   }));
@@ -157776,11 +158002,11 @@ function connectorSkillDisplayRows(connectorSkills, enabledConnectors) {
     ...s2.version !== void 0 ? { version: s2.version } : {}
   }));
 }
-var import_node_crypto22;
+var import_node_crypto23;
 var init_skill_materializer = __esm({
   "../server/src/domains/actors/skill-materializer.ts"() {
     "use strict";
-    import_node_crypto22 = require("node:crypto");
+    import_node_crypto23 = require("node:crypto");
   }
 });
 
@@ -158719,7 +158945,7 @@ function createActorsDomain(opts) {
     ...kernel !== void 0 ? { onRolesChanged: (a, r) => kernel.setActorRoles(a, r) } : {},
     audit: async (entry) => {
       await opts.audit?.({
-        id: `reg_${(0, import_node_crypto23.randomUUID)()}`,
+        id: `reg_${(0, import_node_crypto24.randomUUID)()}`,
         actor: entry.by,
         kind: "registry_change",
         target: entry.actorId,
@@ -158754,11 +158980,11 @@ function createActorsDomain(opts) {
     register: actorsDomain({ resolveCtx, ...opts.trace ? { trace: opts.trace } : {}, ...opts.listBuiltinSkills ? { listBuiltinSkills: opts.listBuiltinSkills } : {}, ...opts.getBuiltinSkills ? { getBuiltinSkills: opts.getBuiltinSkills } : {}, ...opts.getConnectorSkills ? { getConnectorSkills: opts.getConnectorSkills } : {}, ...opts.refreshConnectorSkills ? { refreshConnectorSkills: opts.refreshConnectorSkills } : {}, ...opts.memory ? { memory: opts.memory } : {} })
   };
 }
-var import_node_crypto23;
+var import_node_crypto24;
 var init_actors = __esm({
   "../server/src/domains/actors/index.ts"() {
     "use strict";
-    import_node_crypto23 = require("node:crypto");
+    import_node_crypto24 = require("node:crypto");
     init_service3();
     init_routes();
     init_service3();
@@ -159814,11 +160040,11 @@ var init_projects = __esm({
 });
 
 // ../server/src/domains/companies/service.ts
-var import_node_crypto24, ROLES, INVITABLE_ROLES, INVITATION_TTL_MS, SLUG_RE, CompanyError, CompaniesService;
+var import_node_crypto25, ROLES, INVITABLE_ROLES, INVITATION_TTL_MS, SLUG_RE, CompanyError, CompaniesService;
 var init_service4 = __esm({
   "../server/src/domains/companies/service.ts"() {
     "use strict";
-    import_node_crypto24 = require("node:crypto");
+    import_node_crypto25 = require("node:crypto");
     ROLES = ["owner", "admin", "member"];
     INVITABLE_ROLES = ["admin", "member"];
     INVITATION_TTL_MS = 7 * 24 * 60 * 60 * 1e3;
@@ -159866,7 +160092,7 @@ var init_service4 = __esm({
         const existing = await this.store.getAccountByEmail(normalized);
         if (existing) return existing;
         const account = {
-          id: `actor:human:${(0, import_node_crypto24.randomUUID)()}`,
+          id: `actor:human:${(0, import_node_crypto25.randomUUID)()}`,
           email: normalized,
           name: name ?? normalized,
           status: "active"
@@ -160026,7 +160252,7 @@ var init_service4 = __esm({
         }
         const nowMs = Date.parse(this.now());
         const invitation = {
-          id: `invitation:${(0, import_node_crypto24.randomUUID)()}`,
+          id: `invitation:${(0, import_node_crypto25.randomUUID)()}`,
           companyId,
           email: mail,
           role,
@@ -161062,6 +161288,23 @@ function daemonVersionLess(a, b2) {
 function nodesDomain(deps) {
   const UPDATE_TIMEOUT_MS = 15e4;
   const nodeUpdates = /* @__PURE__ */ new Map();
+  function runtimeInfoOf(r) {
+    const activeRunCount = deps.activeRunCountOf?.(r.nodeId, r.kind) ?? 0;
+    const activeRuns = deps.activeRunsOf?.(r.nodeId, r.kind);
+    return {
+      id: r.id,
+      nodeId: r.nodeId,
+      hostname: r.hostname,
+      kind: r.kind,
+      ...r.binary ? { binary: r.binary } : {},
+      ...r.version ? { version: r.version } : {},
+      status: r.status,
+      busy: activeRunCount > 0,
+      activeRunCount,
+      ...activeRuns ? { activeRuns } : {},
+      lastReportAt: r.lastSeenAt
+    };
+  }
   const publicUpdateStatus = (entry, activeRunCount) => ({
     state: entry.state,
     requestedAt: new Date(entry.requestedAtMs).toISOString(),
@@ -161211,21 +161454,7 @@ function nodesDomain(deps) {
           id: n.id,
           hostname: n.hostname,
           adapters: rts.map((r) => r.kind),
-          runtimes: rts.map((r) => {
-            const runtimeActiveRunCount = deps.activeRunCountOf?.(r.nodeId, r.kind) ?? 0;
-            return {
-              id: r.id,
-              nodeId: r.nodeId,
-              hostname: r.hostname,
-              kind: r.kind,
-              ...r.binary ? { binary: r.binary } : {},
-              ...r.version ? { version: r.version } : {},
-              status: r.status,
-              busy: runtimeActiveRunCount > 0,
-              activeRunCount: runtimeActiveRunCount,
-              lastReportAt: r.lastSeenAt
-            };
-          }),
+          runtimes: rts.map(runtimeInfoOf),
           nodeVersion: n.nodeVersion,
           ...daemonVersion ? { daemonVersion } : {},
           ...n.name ? { name: n.name } : {},
@@ -161258,38 +161487,10 @@ function nodesDomain(deps) {
         const stale = [...new Set(rts.filter((r) => onlineIds.has(r.nodeId) && r.status !== "online").map((r) => r.nodeId))];
         if (stale.length > 0) {
           await Promise.all(stale.map((id) => syncConnectedDaemon(id, hub)));
-          return { status: 200, body: { items: (await deps.nodeStore.listRuntimes()).map((r) => {
-            const activeRunCount = deps.activeRunCountOf?.(r.nodeId, r.kind) ?? 0;
-            return {
-              id: r.id,
-              nodeId: r.nodeId,
-              hostname: r.hostname,
-              kind: r.kind,
-              ...r.binary ? { binary: r.binary } : {},
-              ...r.version ? { version: r.version } : {},
-              status: r.status,
-              busy: activeRunCount > 0,
-              activeRunCount,
-              lastReportAt: r.lastSeenAt
-            };
-          }) } };
+          return { status: 200, body: { items: (await deps.nodeStore.listRuntimes()).map(runtimeInfoOf) } };
         }
       }
-      const items = rts.map((r) => {
-        const activeRunCount = deps.activeRunCountOf?.(r.nodeId, r.kind) ?? 0;
-        return {
-          id: r.id,
-          nodeId: r.nodeId,
-          hostname: r.hostname,
-          kind: r.kind,
-          ...r.binary ? { binary: r.binary } : {},
-          ...r.version ? { version: r.version } : {},
-          status: r.status,
-          busy: activeRunCount > 0,
-          activeRunCount,
-          lastReportAt: r.lastSeenAt
-        };
-      });
+      const items = rts.map(runtimeInfoOf);
       return { status: 200, body: { items } };
     });
     router.post("/api/nodes/enroll", async (req) => {
@@ -161315,7 +161516,7 @@ function nodesDomain(deps) {
         nodeId = incomingNodeId;
         deps.enrollTokens.setIssuedNodeId(enrollToken, nodeId);
       } else {
-        nodeId = `node-${(0, import_node_crypto25.randomUUID)().slice(0, 8)}`;
+        nodeId = `node-${(0, import_node_crypto26.randomUUID)().slice(0, 8)}`;
         deps.enrollTokens.setIssuedNodeId(enrollToken, nodeId);
       }
       const existingNode = await deps.nodeStore.getNode(nodeId);
@@ -161453,11 +161654,11 @@ function nodesDomain(deps) {
     });
   };
 }
-var import_node_crypto25, import_node_fs11, import_node_url4, import_node_path13;
+var import_node_crypto26, import_node_fs11, import_node_url4, import_node_path13;
 var init_routes5 = __esm({
   "../server/src/domains/nodes/routes.ts"() {
     "use strict";
-    import_node_crypto25 = require("node:crypto");
+    import_node_crypto26 = require("node:crypto");
     import_node_fs11 = require("node:fs");
     import_node_url4 = require("node:url");
     import_node_path13 = require("node:path");
@@ -162655,13 +162856,13 @@ function nameKey(name) {
 function cleanName(name) {
   return name.trim().replace(/\s+/g, " ");
 }
-var import_node_fs12, import_node_path14, import_node_crypto26, SEP, keyOf, prefixOf, MemoryWorkorderTagStore, FileWorkorderTagStore;
+var import_node_fs12, import_node_path14, import_node_crypto27, SEP, keyOf, prefixOf, MemoryWorkorderTagStore, FileWorkorderTagStore;
 var init_tags = __esm({
   "../server/src/domains/collab/tags.ts"() {
     "use strict";
     import_node_fs12 = __toESM(require("node:fs"), 1);
     import_node_path14 = __toESM(require("node:path"), 1);
-    import_node_crypto26 = __toESM(require("node:crypto"), 1);
+    import_node_crypto27 = __toESM(require("node:crypto"), 1);
     SEP = "::";
     keyOf = (companyId, id) => `${companyId}${SEP}${id}`;
     prefixOf = (companyId) => `${companyId}${SEP}`;
@@ -162679,7 +162880,7 @@ var init_tags = __esm({
         if (!name) return null;
         if (this.entries(companyId).some((t) => nameKey(t.name) === nameKey(name))) return null;
         const tag = {
-          id: `tag-${import_node_crypto26.default.randomBytes(6).toString("hex")}`,
+          id: `tag-${import_node_crypto27.default.randomBytes(6).toString("hex")}`,
           name,
           ...input.color?.trim() ? { color: input.color.trim() } : {},
           ...input.description?.trim() ? { description: input.description.trim() } : {}
@@ -163274,7 +163475,7 @@ var init_collab = __esm({
 
 // ../server/src/domains/collab/create-seeded-workorder.ts
 function makeSeededWorkorderCreator(deps) {
-  const genWorkspace = deps.genWorkspace ?? (() => `ws:wo-${(0, import_node_crypto27.randomUUID)().slice(0, 8)}`);
+  const genWorkspace = deps.genWorkspace ?? (() => `ws:wo-${(0, import_node_crypto28.randomUUID)().slice(0, 8)}`);
   return async (input) => {
     const workspace = genWorkspace();
     if (deps.artifactState && (input.projectId || deps.createProject)) {
@@ -163354,11 +163555,11 @@ function makeSeededWorkorderCreator(deps) {
     return { workspace, rootArtifactId: briefId, spawned: planned.spawned };
   };
 }
-var import_node_crypto27, enc2;
+var import_node_crypto28, enc2;
 var init_create_seeded_workorder = __esm({
   "../server/src/domains/collab/create-seeded-workorder.ts"() {
     "use strict";
-    import_node_crypto27 = require("node:crypto");
+    import_node_crypto28 = require("node:crypto");
     init_ephemeral_project();
     init_planner();
     enc2 = (s2) => new TextEncoder().encode(s2);
@@ -164212,7 +164413,7 @@ function createChatSessionsDomain(opts) {
       const runtimeId = await currentRuntimeId(body.aiActorId) ?? "unknown";
       const now = (/* @__PURE__ */ new Date()).toISOString();
       const session = {
-        id: (0, import_node_crypto28.randomUUID)(),
+        id: (0, import_node_crypto29.randomUUID)(),
         humanActorId: req.auth.actor,
         aiActorId: body.aiActorId,
         runtimeId,
@@ -164285,7 +164486,7 @@ function createChatSessionsDomain(opts) {
       if (body.role !== "user" && body.role !== "assistant") throw new ApiError(400, "BAD_REQUEST", "role must be user or assistant");
       const role = body.role;
       const msg = await store.appendMessage({
-        id: (0, import_node_crypto28.randomUUID)(),
+        id: (0, import_node_crypto29.randomUUID)(),
         sessionId: req.params.id,
         role,
         content: role === "user" ? stripInjectedChatContext(body.content) : body.content,
@@ -164377,11 +164578,11 @@ function createChatSessionsDomain(opts) {
     });
   };
 }
-var import_node_crypto28, WORKDIR_READ_MAX_BYTES;
+var import_node_crypto29, WORKDIR_READ_MAX_BYTES;
 var init_chat_sessions = __esm({
   "../server/src/domains/chat-sessions/index.ts"() {
     "use strict";
-    import_node_crypto28 = require("node:crypto");
+    import_node_crypto29 = require("node:crypto");
     init_chat_session();
     init_router();
     init_workorders();
@@ -165592,14 +165793,294 @@ var init_project_binding = __esm({
   }
 });
 
+// ../server/src/domains/evaluation/judge-prompt.ts
+function builtinRubricsForCase(evaluationCase) {
+  const at = "1970-01-01T00:00:00.000Z";
+  const base = {
+    companyId: "",
+    version: 0,
+    status: "active",
+    createdBy: "system",
+    createdAt: at,
+    updatedBy: "system",
+    updatedAt: at
+  };
+  return [
+    {
+      ...base,
+      rubricId: "builtin:common",
+      name: "\u901A\u7528\u80FD\u529B\u6807\u51C6\uFF08Case \u81EA\u5E26\uFF09",
+      kind: "common",
+      promptSection: evaluationCase.commonRubric,
+      outputSpec: BUILTIN_COMMON_OUTPUT_SPEC
+    },
+    {
+      ...base,
+      rubricId: "builtin:specialty",
+      name: `S \u4E13\u9879\u6807\u51C6\uFF08${evaluationCase.scopeType}\uFF0CCase \u81EA\u5E26\uFF09`,
+      kind: "specialty",
+      // 「只看可读专业产物」这条约束原先写在硬编码提示词里、不在 bench 的专项标准正文里。
+      // 搬到这里而不是丢掉——它同时还有代码侧的事后守卫（enforceSpecialtyArtifactBoundary），
+      // 两边必须说同一件事，否则模型评了分又被守卫抹掉，白跑一轮还看不懂为什么。
+      promptSection: [
+        "S \u4E13\u9879\u53EA\u80FD\u4F9D\u636E artifacts \u4E2D\u53EF\u8BFB\u7684\u4E13\u4E1A\u4EA7\u7269\u6B63\u6587\u5224\u65AD\u3002Trace\u3001\u8282\u70B9\u6458\u8981\u548C Brief \u4E0D\u80FD\u66FF\u4EE3\u4E13\u4E1A\u4EA7\u7269\u3002",
+        "\u6CA1\u6709\u53EF\u8BFB\u4E13\u4E1A\u4EA7\u7269\u65F6\uFF0C\u4E94\u9879 score\u3001specialty.score \u548C specialty.score100 \u5FC5\u987B\u5168\u90E8\u4E3A null\u3002",
+        "",
+        evaluationCase.specialtyRubric
+      ].join("\n"),
+      outputSpec: BUILTIN_SPECIALTY_OUTPUT_SPEC
+    },
+    {
+      ...base,
+      rubricId: "builtin:case_special",
+      name: "Case \u4E13\u9879\u6807\u51C6\uFF08Case \u81EA\u5E26\uFF09",
+      kind: "case_special",
+      promptSection: [
+        "\u53EA\u4F9D\u636E\u6700\u7EC8\u4EA7\u7269\u53CA evaluator \u7ED3\u679C\u7ED9\u5206\u3002",
+        "evaluator.type=native \u7684\u9879\u76EE\u53EA\u80FD\u8BFB\u53D6\u771F\u5B9E native evaluator \u8F93\u51FA\uFF1B\u5F53\u524D\u8BC1\u636E\u6CA1\u6709\u8BE5\u8F93\u51FA\u65F6\u5FC5\u987B\u8FD4\u56DE",
+        "status=evaluator_failed\uFF0C\u7981\u6B62\u7531 LLM \u4EE3\u6253\u5B98\u65B9\u5206\u6570\u3002"
+      ].join("\n"),
+      outputSpec: BUILTIN_CASE_SPECIAL_OUTPUT_SPEC
+    }
+  ];
+}
+function caseSpecialItemDefinitions(evaluationCase) {
+  const items = Array.isArray(evaluationCase.caseSpecial["items"]) ? evaluationCase.caseSpecial["items"] : [];
+  return items.flatMap((raw) => {
+    const item = asRecord2(raw);
+    if (!item || typeof item["id"] !== "string") return [];
+    const evaluator = asRecord2(item["evaluator"]);
+    return [{
+      id: item["id"],
+      label: typeof item["label"] === "string" ? item["label"] : typeof item["description"] === "string" ? item["description"] : item["id"],
+      maxScore: typeof item["max_score"] === "number" ? item["max_score"] : null,
+      evaluatorType: typeof evaluator?.["type"] === "string" ? evaluator["type"] : null
+    }];
+  });
+}
+function sectionSkeleton(spec, caseSpecialItems) {
+  if (spec.dimensions.length) {
+    const rows2 = spec.dimensions.map((dimension) => `    - ${dimension.id}\uFF08${dimension.label}\uFF09\uFF1A${dimension.min}-${dimension.max} \u5206${dimension.nullable ? "\uFF0C\u786E\u5B9E\u4E0D\u9002\u7528\u65F6\u53EF\u4E3A null" : "\uFF0C\u4E0D\u5F97\u4E3A null"}`);
+    const aggregation = spec.aggregation === "mean" ? `
+    \u6BB5\u5185\u8FD8\u9700\u7ED9\u51FA score\uFF08\u5404\u7EF4\u5EA6\u5747\u503C\uFF09\u4E0E score100\uFF08\u5747\u503C\u6362\u7B97\u767E\u5206\u5236\uFF09\uFF0C\u7EF4\u5EA6\u4E0D\u5168\u65F6\u4E24\u8005\u90FD\u4E3A null\u3002` : "";
+    return `  "${spec.sectionKey}".dimensions \u5FC5\u987B\u6070\u597D ${spec.dimensions.length} \u9879\uFF1A
+${rows2.join("\n")}${aggregation}`;
+  }
+  if (!caseSpecialItems.length) {
+    return `  "${spec.sectionKey}".items \u4E3A\u6570\u7EC4\uFF1B\u672C Case \u6CA1\u6709\u5B9A\u4E49\u8BC4\u5206\u9879\u65F6\u7ED9\u7A7A\u6570\u7EC4 []\uFF0C\u4E0D\u8981\u7701\u7565\u8BE5\u5B57\u6BB5\u3002`;
+  }
+  const rows = caseSpecialItems.map((item) => `    - id="${item.id}"\uFF08${item.label}\uFF09${item.maxScore === null ? "" : `\uFF0C\u6EE1\u5206 ${item.maxScore}`}${item.evaluatorType ? `\uFF0Cevaluator=${item.evaluatorType}` : ""}`);
+  return [
+    `  "${spec.sectionKey}".items \u5FC5\u987B\u9010\u9879\u8986\u76D6\u4E0B\u9762 ${caseSpecialItems.length} \u4E2A id\uFF0C\u4E00\u4E2A\u90FD\u4E0D\u80FD\u5C11\uFF1A`,
+    ...rows,
+    `    \u6BCF\u9879\u542B id / label / score / maxScore / status / reasoning\uFF1B`,
+    `    status \u2208 scored | not_applicable | evaluator_failed\uFF1B\u62FF\u4E0D\u5230 evaluator \u8F93\u51FA\u5C31\u586B evaluator_failed \u4E14 score=null\u3002`
+  ].join("\n");
+}
+function caseContextForPrompt(evaluationCase) {
+  const {
+    commonRubric: _commonRubric,
+    specialtyRubric: _specialtyRubric,
+    caseSpecial: _caseSpecial,
+    ...rest
+  } = evaluationCase;
+  return rest;
+}
+function buildJudgePrompt(input) {
+  const items = caseSpecialItemDefinitions(input.evaluationCase);
+  const specs = input.rubrics.map((rubric) => rubric.outputSpec);
+  const sections = input.rubrics.map((rubric, index) => [
+    `### \u6807\u51C6 ${index + 1}\uFF0F${input.rubrics.length}\uFF1A${rubric.name}`,
+    `- \u7C7B\u578B\uFF1A${rubric.kind}\uFF1B\u8F93\u51FA\u5230\u7ED3\u679C JSON \u7684 "${rubric.outputSpec.sectionKey}" \u6BB5` + (rubric.version ? `\uFF1B\u7248\u672C ${rubric.rubricId}@${rubric.version}` : ""),
+    ...rubric.description ? [`- \u8BF4\u660E\uFF1A${rubric.description}`] : [],
+    "",
+    rubric.promptSection.trim()
+  ].join("\n"));
+  return [
+    "\u4F60\u662F Oasis Benchmark \u7684\u8BC4\u5206\u5458\u5DE5\u3002\u672C\u6B21\u4EFB\u52A1\u53EA\u505A\u8BC4\u6D4B\uFF0C\u4E0D\u4FEE\u6539\u88AB\u6D4B\u5DE5\u5355\u3002",
+    `evaluation_id: ${input.evaluationId}`,
+    "",
+    "## \u8BC4\u5206\u6807\u51C6\uFF08\u9010\u6761\u9002\u7528\uFF0C\u7F3A\u4E00\u4E0D\u53EF\uFF09",
+    "",
+    sections.join("\n\n"),
+    "",
+    "## \u8F93\u51FA\u8981\u6C42",
+    "",
+    "\u53EA\u8FD4\u56DE\u4E00\u4E2A JSON \u5BF9\u8C61\uFF0C\u4E0D\u8981\u8FD4\u56DE Markdown \u89E3\u91CA\u3001\u4E0D\u8981\u52A0\u4EE3\u7801\u5757\u4EE5\u5916\u7684\u6B63\u6587\u3002\u5BF9\u8C61\u5FC5\u987B\u540C\u65F6\u5305\u542B\u4E0B\u5217\u5404\u6BB5\uFF1A",
+    specs.map((spec) => sectionSkeleton(spec, items)).join("\n"),
+    '  "runtimeMetrics"\uFF1A\u539F\u6837\u4FDD\u7559\u8BC1\u636E\u4E2D\u7684\u8FD0\u884C\u6307\u6807\uFF0C\u4E0D\u8FDB\u5165\u8D28\u91CF\u5206\u3002',
+    "",
+    "\u7981\u6B62\u751F\u6210\u8DE8\u6BB5\u7684\u603B\u4F53\u603B\u5206\u3002\u6BCF\u4E2A\u7EF4\u5EA6\u90FD\u8981\u7ED9 reasoning\uFF0C\u5E76\u5C3D\u91CF\u5E26 evidenceRefs\u3002",
+    "",
+    "## CASE",
+    JSON.stringify(caseContextForPrompt(input.evaluationCase)),
+    "",
+    "## EVIDENCE SNAPSHOT",
+    input.evidenceJson
+  ].join("\n");
+}
+var asRecord2;
+var init_judge_prompt = __esm({
+  "../server/src/domains/evaluation/judge-prompt.ts"() {
+    "use strict";
+    init_src();
+    asRecord2 = (value2) => value2 && typeof value2 === "object" && !Array.isArray(value2) ? value2 : null;
+  }
+});
+
+// ../server/src/domains/evaluation/scoring.ts
+var ScoringConfigError, EvaluationScoringService;
+var init_scoring = __esm({
+  "../server/src/domains/evaluation/scoring.ts"() {
+    "use strict";
+    init_src();
+    init_judge_prompt();
+    ScoringConfigError = class extends Error {
+      constructor(statusCode, code, message) {
+        super(message);
+        this.statusCode = statusCode;
+        this.code = code;
+        this.name = "ScoringConfigError";
+      }
+    };
+    EvaluationScoringService = class {
+      constructor(options) {
+        this.options = options;
+      }
+      at() {
+        return (this.options.now ?? (() => /* @__PURE__ */ new Date()))().toISOString();
+      }
+      listRubrics(companyId) {
+        return this.options.store.listRubrics(companyId);
+      }
+      async upsertRubric(body, companyId, actor) {
+        const raw = body ?? {};
+        const rubricId = typeof raw["rubricId"] === "string" && raw["rubricId"] ? raw["rubricId"] : void 0;
+        let existing = null;
+        if (rubricId) {
+          existing = await this.options.store.getRubric(rubricId);
+          if (existing && existing.companyId !== companyId) {
+            throw new ScoringConfigError(404, "RUBRIC_NOT_FOUND", `\u8BC4\u5206\u6807\u51C6 ${rubricId} \u4E0D\u5B58\u5728`);
+          }
+        }
+        const merged = existing ? {
+          rubricId,
+          name: raw["name"] ?? existing.name,
+          kind: raw["kind"] ?? existing.kind,
+          description: raw["description"] ?? existing.description,
+          promptSection: raw["promptSection"] ?? existing.promptSection,
+          outputSpec: raw["outputSpec"] ?? existing.outputSpec,
+          status: raw["status"] ?? existing.status
+        } : raw;
+        let input;
+        try {
+          input = validateUpsertEvaluationRubricInput(merged);
+        } catch (error2) {
+          throw new ScoringConfigError(400, "BAD_REQUEST", error2 instanceof Error ? error2.message : String(error2));
+        }
+        return this.options.store.upsertRubric({ ...input, companyId, actor }, this.at());
+      }
+      async deleteRubric(rubricId, companyId) {
+        const existing = await this.options.store.getRubric(rubricId);
+        if (!existing || existing.companyId !== companyId) {
+          throw new ScoringConfigError(404, "RUBRIC_NOT_FOUND", `\u8BC4\u5206\u6807\u51C6 ${rubricId} \u4E0D\u5B58\u5728`);
+        }
+        await this.options.store.deleteRubric(rubricId, companyId);
+      }
+      listBindings(companyId) {
+        return this.options.store.listBindings(companyId);
+      }
+      async putBinding(caseId, body, companyId, actor) {
+        const input = body ?? {};
+        const rubricIds = Array.isArray(input.rubricIds) ? input.rubricIds.filter((id) => typeof id === "string" && id.length > 0) : [];
+        if (new Set(rubricIds).size !== rubricIds.length) {
+          throw new ScoringConfigError(400, "BAD_REQUEST", "\u540C\u4E00\u6761\u8BC4\u5206\u6807\u51C6\u4E0D\u80FD\u91CD\u590D\u6302\u8F7D");
+        }
+        const rubrics = [];
+        for (const rubricId of rubricIds) {
+          const rubric = await this.options.store.getRubric(rubricId);
+          if (!rubric || rubric.companyId !== companyId) {
+            throw new ScoringConfigError(400, "RUBRIC_NOT_FOUND", `\u8BC4\u5206\u6807\u51C6 ${rubricId} \u4E0D\u5B58\u5728`);
+          }
+          if (rubric.status !== "active") {
+            throw new ScoringConfigError(400, "RUBRIC_ARCHIVED", `\u8BC4\u5206\u6807\u51C6\u300C${rubric.name}\u300D\u5DF2\u5F52\u6863\uFF0C\u4E0D\u80FD\u6302\u8F7D`);
+          }
+          rubrics.push(rubric);
+        }
+        const sections = rubrics.map((rubric) => rubric.outputSpec.sectionKey);
+        if (new Set(sections).size !== sections.length) {
+          throw new ScoringConfigError(
+            400,
+            "RUBRIC_SECTION_CONFLICT",
+            `\u6302\u8F7D\u7684\u6807\u51C6\u8F93\u51FA\u5230\u4E86\u540C\u4E00\u4E2A\u7ED3\u679C\u6BB5\uFF08${sections.join("\u3001")}\uFF09\uFF0C\u8BF7\u6539\u5176\u4E2D\u4E00\u6761\u7684 sectionKey`
+          );
+        }
+        const judgeActorId = typeof input.judgeActorId === "string" && input.judgeActorId.trim() ? input.judgeActorId.trim() : null;
+        if (judgeActorId && this.options.verifyJudgeActor && !await this.options.verifyJudgeActor(judgeActorId, companyId)) {
+          throw new ScoringConfigError(400, "JUDGE_ACTOR_INVALID", `${judgeActorId} \u4E0D\u662F\u53EF\u7528\u7684\u5224\u5206\u5458\u5DE5`);
+        }
+        const binding = await this.options.store.putBinding(
+          { companyId, caseId, rubricIds, judgeActorId, actor },
+          this.at()
+        );
+        return {
+          caseId,
+          rubrics,
+          judgeActorId: binding.judgeActorId,
+          usesBuiltinFallback: rubrics.length === 0
+        };
+      }
+      /** Case 当前装配的对外投影（挂载展开 + 是否还在吃回落）。 */
+      async getCaseScoring(caseId, companyId) {
+        const binding = await this.options.store.getBinding(companyId, caseId);
+        const rubrics = await this.mountedRubrics(binding, companyId);
+        return {
+          caseId,
+          rubrics,
+          judgeActorId: binding?.judgeActorId ?? null,
+          usesBuiltinFallback: rubrics.length === 0
+        };
+      }
+      /** 判分前的最终解析：拿到本次真正要用的标准与判分员工。 */
+      async resolveForRun(evaluationCase, companyId, requestedJudgeActorId) {
+        const binding = await this.options.store.getBinding(companyId, evaluationCase.id);
+        const mounted = await this.mountedRubrics(binding, companyId);
+        const judgeActorId = requestedJudgeActorId?.trim() || binding?.judgeActorId || this.options.defaultJudgeActorId;
+        if (!judgeActorId) {
+          throw new ScoringConfigError(
+            409,
+            "JUDGE_ACTOR_NOT_CONFIGURED",
+            "\u6CA1\u6709\u53EF\u7528\u7684\u5224\u5206\u5458\u5DE5\uFF1A\u8BF7\u5728 Case \u8BC4\u5206\u88C5\u914D\u91CC\u6307\u5B9A\uFF0C\u6216\u914D\u7F6E OASIS_EVALUATION_SCORING_ACTOR_ID"
+          );
+        }
+        return {
+          rubrics: mounted.length ? mounted : builtinRubricsForCase(evaluationCase),
+          judgeActorId,
+          usesBuiltinFallback: mounted.length === 0
+        };
+      }
+      async mountedRubrics(binding, companyId) {
+        if (!binding?.rubricIds.length) return [];
+        const rubrics = [];
+        for (const rubricId of binding.rubricIds) {
+          const rubric = await this.options.store.getRubric(rubricId);
+          if (rubric && rubric.companyId === companyId && rubric.status === "active") rubrics.push(rubric);
+        }
+        return rubrics;
+      }
+    };
+  }
+});
+
 // ../server/src/domains/evaluation/service.ts
-var import_node_crypto29, EvaluationError, EvaluationService;
+var import_node_crypto30, EvaluationError, EvaluationService;
 var init_service7 = __esm({
   "../server/src/domains/evaluation/service.ts"() {
     "use strict";
-    import_node_crypto29 = require("node:crypto");
+    import_node_crypto30 = require("node:crypto");
     init_src();
     init_project_binding();
+    init_scoring();
     EvaluationError = class extends Error {
       constructor(statusCode, code, message) {
         super(message);
@@ -165612,7 +166093,7 @@ var init_service7 = __esm({
       constructor(options) {
         this.options = options;
         this.now = options.now ?? (() => /* @__PURE__ */ new Date());
-        this.id = options.id ?? import_node_crypto29.randomUUID;
+        this.id = options.id ?? import_node_crypto30.randomUUID;
       }
       now;
       id;
@@ -165715,10 +166196,17 @@ var init_service7 = __esm({
           createdBy: actor,
           createdAt: now
         });
-        const evaluation = await this.createEvaluation(run.runId, evaluationCase, actor, true);
+        const evaluation = await this.createEvaluation(
+          run.runId,
+          evaluationCase,
+          actor,
+          companyId,
+          input.judgeActorId,
+          true
+        );
         return { run, evaluation };
       }
-      async createRescore(runId, actor, companyId = "default") {
+      async createRescore(runId, actor, companyId = "default", judgeActorId) {
         const run = await this.options.store.getRun(runId);
         if (!run || run.companyId !== companyId) {
           throw new EvaluationError(404, "RUN_NOT_FOUND", `Run ${runId} \u4E0D\u5B58\u5728`);
@@ -165728,7 +166216,7 @@ var init_service7 = __esm({
         if (!evaluationCase) {
           throw new EvaluationError(409, "CASE_VERSION_MISSING", `Case ${run.caseId}@${run.caseVersion} \u4E0D\u5B58\u5728`);
         }
-        return this.createEvaluation(runId, evaluationCase, actor);
+        return this.createEvaluation(runId, evaluationCase, actor, companyId, judgeActorId);
       }
       async runEvaluation(evaluationId, companyId) {
         const current = await this.options.store.getEvaluation(evaluationId);
@@ -165752,11 +166240,18 @@ var init_service7 = __esm({
         };
         await this.options.store.updateEvaluation(started);
         try {
+          const resolved = await this.options.scoring.resolveForRun(
+            evaluationCase,
+            run.companyId,
+            current.judgeActorId
+          );
           const judged = await this.options.judge.evaluate({
             ...companyId ? { companyId } : {},
             evaluationId,
             evaluationCase,
-            evidenceSnapshot: run.evidenceSnapshot
+            evidenceSnapshot: run.evidenceSnapshot,
+            rubrics: resolved.rubrics,
+            judgeActorId: resolved.judgeActorId
           });
           const snapshotMetrics = run.evidenceSnapshot["runtimeMetrics"];
           const result = {
@@ -165828,15 +166323,20 @@ var init_service7 = __esm({
           benchmarkProjects
         };
       }
-      createEvaluation(runId, evaluationCase, actor, ifRunHasNone = false) {
+      /**
+       * 判分员工与 rubricVersion 在**建 Evaluation 时**定下并落库，不在跑的时候再算：
+       * 队列里排到再解析的话，中途改了装配就说不清「这条分是按哪套标准、谁打的」。
+       */
+      async createEvaluation(runId, evaluationCase, actor, companyId, judgeActorId, ifRunHasNone = false) {
         const now = this.now().toISOString();
+        const resolved = await this.options.scoring.resolveForRun(evaluationCase, companyId, judgeActorId);
         return this.options.store.createEvaluation({
           evaluationId: this.id(),
           runId,
           status: "queued",
-          judgeActorId: this.options.judgeActorId,
+          judgeActorId: resolved.judgeActorId,
           judgeVersion: this.options.judgeVersion,
-          rubricVersion: evaluationCase.rubricVersion,
+          rubricVersion: rubricVersionOf(resolved.rubrics, evaluationCase.rubricVersion),
           evaluatorVersion: evaluationCase.evaluatorVersion,
           createdBy: actor,
           createdAt: now
@@ -165850,6 +166350,7 @@ var init_service7 = __esm({
 function evaluationDomain(options) {
   const schedule = options.schedule ?? ((task2) => queueMicrotask(task2));
   const service = options.service;
+  const scoring = options.scoring;
   return (router) => {
     router.get("/api/evaluations/workorders", async (req) => ({
       status: 200,
@@ -165877,7 +166378,8 @@ function evaluationDomain(options) {
         const created = await service.createRun({
           workOrderId: body.workOrderId,
           caseId: body.caseId,
-          ...body.caseVersion ? { caseVersion: body.caseVersion } : {}
+          ...body.caseVersion ? { caseVersion: body.caseVersion } : {},
+          judgeActorId: optionalActorId(body.judgeActorId)
         }, req.auth.actor, req.auth.companyId ?? "default");
         schedule(() => {
           void service.runEvaluation(created.evaluation.evaluationId, req.auth.companyId);
@@ -165892,7 +166394,8 @@ function evaluationDomain(options) {
         const evaluation = await service.createRescore(
           req.params.runId,
           req.auth.actor,
-          req.auth.companyId ?? "default"
+          req.auth.companyId ?? "default",
+          optionalActorId(req.body?.judgeActorId)
         );
         schedule(() => {
           void service.runEvaluation(evaluation.evaluationId, req.auth.companyId);
@@ -165902,20 +166405,87 @@ function evaluationDomain(options) {
         return mapError(error2);
       }
     });
+    router.get("/api/evaluations/rubrics", async (req) => ({
+      status: 200,
+      body: { items: await scoring.listRubrics(req.auth.companyId ?? "default") }
+    }));
+    router.post("/api/evaluations/rubrics", async (req) => {
+      try {
+        return {
+          status: 201,
+          body: await scoring.upsertRubric(req.body, req.auth.companyId ?? "default", req.auth.actor)
+        };
+      } catch (error2) {
+        return mapError(error2);
+      }
+    });
+    router.put("/api/evaluations/rubrics/:rubricId", async (req) => {
+      try {
+        return {
+          status: 200,
+          body: await scoring.upsertRubric(
+            { ...req.body, rubricId: req.params.rubricId },
+            req.auth.companyId ?? "default",
+            req.auth.actor
+          )
+        };
+      } catch (error2) {
+        return mapError(error2);
+      }
+    });
+    router.delete("/api/evaluations/rubrics/:rubricId", async (req) => {
+      try {
+        await scoring.deleteRubric(req.params.rubricId, req.auth.companyId ?? "default");
+        return { status: 200, body: { ok: true } };
+      } catch (error2) {
+        return mapError(error2);
+      }
+    });
+    router.get("/api/evaluations/case-scoring", async (req) => ({
+      status: 200,
+      body: { items: await scoring.listBindings(req.auth.companyId ?? "default") }
+    }));
+    router.get("/api/evaluations/cases/:caseId/scoring", async (req) => ({
+      status: 200,
+      body: await scoring.getCaseScoring(req.params.caseId, req.auth.companyId ?? "default")
+    }));
+    router.put("/api/evaluations/cases/:caseId/scoring", async (req) => {
+      try {
+        return {
+          status: 200,
+          body: await scoring.putBinding(
+            req.params.caseId,
+            req.body,
+            req.auth.companyId ?? "default",
+            req.auth.actor
+          )
+        };
+      } catch (error2) {
+        return mapError(error2);
+      }
+    });
+    router.get("/api/evaluations/judge-candidates", async (req) => ({
+      status: 200,
+      body: {
+        items: options.listJudgeCandidates ? await options.listJudgeCandidates(req.auth.companyId ?? "default") : []
+      }
+    }));
   };
 }
-var mapError;
+var mapError, optionalActorId;
 var init_routes8 = __esm({
   "../server/src/domains/evaluation/routes.ts"() {
     "use strict";
     init_router();
     init_service7();
+    init_scoring();
     mapError = (error2) => {
-      if (error2 instanceof EvaluationError) {
+      if (error2 instanceof EvaluationError || error2 instanceof ScoringConfigError) {
         throw new ApiError(error2.statusCode, error2.code, error2.message);
       }
       throw error2;
     };
+    optionalActorId = (value2) => typeof value2 === "string" && value2.trim() ? value2.trim() : null;
   }
 });
 
@@ -169974,10 +170544,10 @@ var require_resolve_block_map = __commonJS({
       let offset = bm.offset;
       let commentEnd = null;
       for (const collItem of bm.items) {
-        const { start, key, sep: sep3, value: value2 } = collItem;
+        const { start, key, sep: sep4, value: value2 } = collItem;
         const keyProps = resolveProps.resolveProps(start, {
           indicator: "explicit-key-ind",
-          next: key ?? sep3?.[0],
+          next: key ?? sep4?.[0],
           offset,
           onError,
           parentIndent: bm.indent,
@@ -169991,7 +170561,7 @@ var require_resolve_block_map = __commonJS({
             else if ("indent" in key && key.indent !== bm.indent)
               onError(offset, "BAD_INDENT", startColMsg);
           }
-          if (!keyProps.anchor && !keyProps.tag && !sep3) {
+          if (!keyProps.anchor && !keyProps.tag && !sep4) {
             commentEnd = keyProps.end;
             if (keyProps.comment) {
               if (map.comment)
@@ -170015,7 +170585,7 @@ var require_resolve_block_map = __commonJS({
         ctx.atKey = false;
         if (utilMapIncludes.mapIncludes(ctx, map.items, keyNode))
           onError(keyStart, "DUPLICATE_KEY", "Map keys must be unique");
-        const valueProps = resolveProps.resolveProps(sep3 ?? [], {
+        const valueProps = resolveProps.resolveProps(sep4 ?? [], {
           indicator: "map-value-ind",
           next: value2,
           offset: keyNode.range[2],
@@ -170031,7 +170601,7 @@ var require_resolve_block_map = __commonJS({
             if (ctx.options.strict && keyProps.start < valueProps.found.offset - 1024)
               onError(keyNode.range, "KEY_OVER_1024_CHARS", "The : indicator must be at most 1024 chars after the start of an implicit block mapping key");
           }
-          const valueNode = value2 ? composeNode(ctx, value2, valueProps, onError) : composeEmptyNode(ctx, offset, sep3, null, valueProps, onError);
+          const valueNode = value2 ? composeNode(ctx, value2, valueProps, onError) : composeEmptyNode(ctx, offset, sep4, null, valueProps, onError);
           if (ctx.schema.compat)
             utilFlowIndentCheck.flowIndentCheck(bm.indent, value2, onError);
           offset = valueNode.range[2];
@@ -170122,7 +170692,7 @@ var require_resolve_end = __commonJS({
       let comment = "";
       if (end) {
         let hasSpace = false;
-        let sep3 = "";
+        let sep4 = "";
         for (const token of end) {
           const { source, type } = token;
           switch (type) {
@@ -170136,13 +170706,13 @@ var require_resolve_end = __commonJS({
               if (!comment)
                 comment = cb;
               else
-                comment += sep3 + cb;
-              sep3 = "";
+                comment += sep4 + cb;
+              sep4 = "";
               break;
             }
             case "newline":
               if (comment)
-                sep3 += source;
+                sep4 += source;
               hasSpace = true;
               break;
             default:
@@ -170185,18 +170755,18 @@ var require_resolve_flow_collection = __commonJS({
       let offset = fc.offset + fc.start.source.length;
       for (let i = 0; i < fc.items.length; ++i) {
         const collItem = fc.items[i];
-        const { start, key, sep: sep3, value: value2 } = collItem;
+        const { start, key, sep: sep4, value: value2 } = collItem;
         const props = resolveProps.resolveProps(start, {
           flow: fcName,
           indicator: "explicit-key-ind",
-          next: key ?? sep3?.[0],
+          next: key ?? sep4?.[0],
           offset,
           onError,
           parentIndent: fc.indent,
           startOnNewline: false
         });
         if (!props.found) {
-          if (!props.anchor && !props.tag && !sep3 && !value2) {
+          if (!props.anchor && !props.tag && !sep4 && !value2) {
             if (i === 0 && props.comma)
               onError(props.comma, "UNEXPECTED_TOKEN", `Unexpected , in ${fcName}`);
             else if (i < fc.items.length - 1)
@@ -170250,8 +170820,8 @@ var require_resolve_flow_collection = __commonJS({
             }
           }
         }
-        if (!isMap && !sep3 && !props.found) {
-          const valueNode = value2 ? composeNode(ctx, value2, props, onError) : composeEmptyNode(ctx, props.end, sep3, null, props, onError);
+        if (!isMap && !sep4 && !props.found) {
+          const valueNode = value2 ? composeNode(ctx, value2, props, onError) : composeEmptyNode(ctx, props.end, sep4, null, props, onError);
           coll.items.push(valueNode);
           offset = valueNode.range[2];
           if (isBlock(value2))
@@ -170263,7 +170833,7 @@ var require_resolve_flow_collection = __commonJS({
           if (isBlock(key))
             onError(keyNode.range, "BLOCK_IN_FLOW", blockMsg);
           ctx.atKey = false;
-          const valueProps = resolveProps.resolveProps(sep3 ?? [], {
+          const valueProps = resolveProps.resolveProps(sep4 ?? [], {
             flow: fcName,
             indicator: "map-value-ind",
             next: value2,
@@ -170274,8 +170844,8 @@ var require_resolve_flow_collection = __commonJS({
           });
           if (valueProps.found) {
             if (!isMap && !props.found && ctx.options.strict) {
-              if (sep3)
-                for (const st of sep3) {
+              if (sep4)
+                for (const st of sep4) {
                   if (st === valueProps.found)
                     break;
                   if (st.type === "newline") {
@@ -170292,7 +170862,7 @@ var require_resolve_flow_collection = __commonJS({
             else
               onError(valueProps.start, "MISSING_CHAR", `Missing , or : between ${fcName} items`);
           }
-          const valueNode = value2 ? composeNode(ctx, value2, valueProps, onError) : valueProps.found ? composeEmptyNode(ctx, valueProps.end, sep3, null, valueProps, onError) : null;
+          const valueNode = value2 ? composeNode(ctx, value2, valueProps, onError) : valueProps.found ? composeEmptyNode(ctx, valueProps.end, sep4, null, valueProps, onError) : null;
           if (valueNode) {
             if (isBlock(value2))
               onError(valueNode.range, "BLOCK_IN_FLOW", blockMsg);
@@ -170472,7 +171042,7 @@ var require_resolve_block_scalar = __commonJS({
           chompStart = i + 1;
       }
       let value2 = "";
-      let sep3 = "";
+      let sep4 = "";
       let prevMoreIndented = false;
       for (let i = 0; i < contentStart; ++i)
         value2 += lines[i][0].slice(trimIndent) + "\n";
@@ -170489,24 +171059,24 @@ var require_resolve_block_scalar = __commonJS({
           indent = "";
         }
         if (type === Scalar.Scalar.BLOCK_LITERAL) {
-          value2 += sep3 + indent.slice(trimIndent) + content;
-          sep3 = "\n";
+          value2 += sep4 + indent.slice(trimIndent) + content;
+          sep4 = "\n";
         } else if (indent.length > trimIndent || content[0] === "	") {
-          if (sep3 === " ")
-            sep3 = "\n";
-          else if (!prevMoreIndented && sep3 === "\n")
-            sep3 = "\n\n";
-          value2 += sep3 + indent.slice(trimIndent) + content;
-          sep3 = "\n";
+          if (sep4 === " ")
+            sep4 = "\n";
+          else if (!prevMoreIndented && sep4 === "\n")
+            sep4 = "\n\n";
+          value2 += sep4 + indent.slice(trimIndent) + content;
+          sep4 = "\n";
           prevMoreIndented = true;
         } else if (content === "") {
-          if (sep3 === "\n")
+          if (sep4 === "\n")
             value2 += "\n";
           else
-            sep3 = "\n";
+            sep4 = "\n";
         } else {
-          value2 += sep3 + content;
-          sep3 = " ";
+          value2 += sep4 + content;
+          sep4 = " ";
           prevMoreIndented = false;
         }
       }
@@ -170688,25 +171258,25 @@ var require_resolve_flow_scalar = __commonJS({
       if (!match)
         return source;
       let res = match[1];
-      let sep3 = " ";
+      let sep4 = " ";
       let pos = first.lastIndex;
       line.lastIndex = pos;
       while (match = line.exec(source)) {
         if (match[1] === "") {
-          if (sep3 === "\n")
-            res += sep3;
+          if (sep4 === "\n")
+            res += sep4;
           else
-            sep3 = "\n";
+            sep4 = "\n";
         } else {
-          res += sep3 + match[1];
-          sep3 = " ";
+          res += sep4 + match[1];
+          sep4 = " ";
         }
         pos = line.lastIndex;
       }
       const last = /[ \t]*(.*)/sy;
       last.lastIndex = pos;
       match = last.exec(source);
-      return res + sep3 + (match?.[1] ?? "");
+      return res + sep4 + (match?.[1] ?? "");
     }
     function doubleQuotedValue(source, onError) {
       let res = "";
@@ -171516,14 +172086,14 @@ var require_cst_stringify = __commonJS({
         }
       }
     }
-    function stringifyItem({ start, key, sep: sep3, value: value2 }) {
+    function stringifyItem({ start, key, sep: sep4, value: value2 }) {
       let res = "";
       for (const st of start)
         res += st.source;
       if (key)
         res += stringifyToken(key);
-      if (sep3)
-        for (const st of sep3)
+      if (sep4)
+        for (const st of sep4)
           res += st.source;
       if (value2)
         res += stringifyToken(value2);
@@ -172690,18 +173260,18 @@ var require_parser = __commonJS({
         if (this.type === "map-value-ind") {
           const prev = getPrevProps(this.peek(2));
           const start = getFirstKeyStartProps(prev);
-          let sep3;
+          let sep4;
           if (scalar.end) {
-            sep3 = scalar.end;
-            sep3.push(this.sourceToken);
+            sep4 = scalar.end;
+            sep4.push(this.sourceToken);
             delete scalar.end;
           } else
-            sep3 = [this.sourceToken];
+            sep4 = [this.sourceToken];
           const map = {
             type: "block-map",
             offset: scalar.offset,
             indent: scalar.indent,
-            items: [{ start, key: scalar, sep: sep3 }]
+            items: [{ start, key: scalar, sep: sep4 }]
           };
           this.onKeyLine = true;
           this.stack[this.stack.length - 1] = map;
@@ -172854,15 +173424,15 @@ var require_parser = __commonJS({
                 } else if (isFlowToken(it.key) && !includesToken(it.sep, "newline")) {
                   const start2 = getFirstKeyStartProps(it.start);
                   const key = it.key;
-                  const sep3 = it.sep;
-                  sep3.push(this.sourceToken);
+                  const sep4 = it.sep;
+                  sep4.push(this.sourceToken);
                   delete it.key;
                   delete it.sep;
                   this.stack.push({
                     type: "block-map",
                     offset: this.offset,
                     indent: this.indent,
-                    items: [{ start: start2, key, sep: sep3 }]
+                    items: [{ start: start2, key, sep: sep4 }]
                   });
                 } else if (start.length > 0) {
                   it.sep = it.sep.concat(start, this.sourceToken);
@@ -173056,13 +173626,13 @@ var require_parser = __commonJS({
             const prev = getPrevProps(parent);
             const start = getFirstKeyStartProps(prev);
             fixFlowSeqItems(fc);
-            const sep3 = fc.end.splice(1, fc.end.length);
-            sep3.push(this.sourceToken);
+            const sep4 = fc.end.splice(1, fc.end.length);
+            sep4.push(this.sourceToken);
             const map = {
               type: "block-map",
               offset: fc.offset,
               indent: fc.indent,
-              items: [{ start, key: fc, sep: sep3 }]
+              items: [{ start, key: fc, sep: sep4 }]
             };
             this.onKeyLine = true;
             this.stack[this.stack.length - 1] = map;
@@ -173614,27 +174184,12 @@ function evidenceForJudge(snapshot) {
   };
 }
 function judgePrompt(input) {
-  return [
-    "\u4F60\u662F Oasis Benchmark \u7684\u8BC4\u5206\u5458\u5DE5\u3002\u672C\u6B21\u4EFB\u52A1\u53EA\u505A\u8BC4\u6D4B\uFF0C\u4E0D\u4FEE\u6539\u88AB\u6D4B\u5DE5\u5355\u3002",
-    `evaluation_id: ${input.evaluationId}`,
-    "",
-    "\u5FC5\u987B\u5206\u522B\u8F93\u51FA\u56DB\u7EC4\u7ED3\u679C\uFF0C\u7981\u6B62\u751F\u6210\u603B\u4F53\u603B\u5206\uFF1A",
-    "1. common.dimensions\uFF1AG1-G7 \u4E03\u9879\uFF0C1-5 \u5206\uFF1B\u53EA\u6709 G6 \u53EF\u5728\u786E\u5B9E\u4E0D\u9002\u7528\u65F6\u4E3A null\u3002",
-    "2. specialty.dimensions\uFF1A\u4E25\u683C\u4E94\u9879\u3001\u6BCF\u9879 1-5 \u5206\uFF1Bscore \u4E3A\u4E94\u9879\u5E73\u5747\uFF0Cscore100=score*20\u3002",
-    "   S \u4E13\u9879\u53EA\u80FD\u4F9D\u636E artifacts \u4E2D\u53EF\u8BFB\u7684\u4E13\u4E1A\u4EA7\u7269\u6B63\u6587\u5224\u65AD\u3002Trace\u3001\u8282\u70B9\u6458\u8981\u548C Brief \u4E0D\u80FD\u66FF\u4EE3\u4E13\u4E1A\u4EA7\u7269\u3002",
-    "   \u6CA1\u6709\u53EF\u8BFB\u4E13\u4E1A\u4EA7\u7269\u65F6\uFF0C\u4E94\u9879 score\u3001specialty.score \u548C specialty.score100 \u5FC5\u987B\u5168\u90E8\u4E3A null\u3002",
-    "3. caseSpecial\uFF1A\u53EA\u4F9D\u636E\u6700\u7EC8\u4EA7\u7269\u53CA evaluator \u7ED3\u679C\u3002",
-    "   evaluator.type=native \u7684\u9879\u76EE\u53EA\u80FD\u8BFB\u53D6\u771F\u5B9E native evaluator \u8F93\u51FA\uFF1B\u5F53\u524D\u8BC1\u636E\u6CA1\u6709\u8BE5\u8F93\u51FA\u65F6\u5FC5\u987B\u8FD4\u56DE evaluator_failed\uFF0C\u7981\u6B62\u7531 LLM \u4EE3\u6253\u5B98\u65B9\u5206\u6570\u3002",
-    "4. runtimeMetrics\uFF1A\u539F\u6837\u4FDD\u7559\u8BC1\u636E\u4E2D\u7684\u8FD0\u884C\u6307\u6807\uFF0C\u4E0D\u8FDB\u5165\u8D28\u91CF\u5206\u3002",
-    "",
-    "\u53EA\u8FD4\u56DE\u4E00\u4E2A JSON \u5BF9\u8C61\uFF0C\u4E0D\u8981\u8FD4\u56DE Markdown \u89E3\u91CA\u3002",
-    "",
-    "CASE:",
-    JSON.stringify(input.evaluationCase),
-    "",
-    "EVIDENCE SNAPSHOT:",
-    JSON.stringify(evidenceForJudge(input.evidenceSnapshot))
-  ].join("\n");
+  return buildJudgePrompt({
+    evaluationId: input.evaluationId,
+    evaluationCase: input.evaluationCase,
+    rubrics: input.rubrics,
+    evidenceJson: JSON.stringify(evidenceForJudge(input.evidenceSnapshot))
+  });
 }
 function record7(value2) {
   return value2 && typeof value2 === "object" && !Array.isArray(value2) ? value2 : null;
@@ -173673,19 +174228,20 @@ function normalizeDimensions(value2, expectedIds) {
   if (!dimensions) return value2;
   return Object.entries(dimensions).map(([id, raw]) => normalizeDimensionItem(raw, id, expectedIds));
 }
-function normalizeJudgeOutput(value2, evaluationCase) {
+function normalizeJudgeOutput(value2, evaluationCase, rubrics) {
   const source = record7(value2);
   if (!source) return value2;
   const result = structuredClone(source);
-  const common = record7(result["common"]);
-  if (common) {
-    common["dimensions"] = normalizeDimensions(
-      common["dimensions"],
-      ["G1", "G2", "G3", "G4", "G5", "G6", "G7"]
+  for (const rubric of rubrics) {
+    const spec = rubric.outputSpec;
+    if (!spec.dimensions.length) continue;
+    const section = record7(result[spec.sectionKey]);
+    if (!section) continue;
+    section["dimensions"] = normalizeDimensions(
+      section["dimensions"],
+      spec.dimensions.map((dimension) => dimension.id)
     );
   }
-  const specialty = record7(result["specialty"]);
-  if (specialty) specialty["dimensions"] = normalizeDimensions(specialty["dimensions"]);
   const caseSpecial = record7(result["caseSpecial"]);
   if (caseSpecial && Array.isArray(caseSpecial["items"])) {
     const definitions = Array.isArray(evaluationCase.caseSpecial["items"]) ? evaluationCase.caseSpecial["items"] : [];
@@ -173711,6 +174267,30 @@ function normalizeJudgeOutput(value2, evaluationCase) {
   }
   return result;
 }
+function fillMissingItemSections(value2, evaluationCase, rubrics) {
+  const result = record7(value2);
+  if (!result) return value2;
+  const filled = structuredClone(result);
+  const definitions = caseSpecialItemDefinitions(evaluationCase);
+  for (const rubric of rubrics) {
+    const spec = rubric.outputSpec;
+    if (spec.dimensions.length) continue;
+    const section = record7(filled[spec.sectionKey]);
+    if (section && Array.isArray(section["items"])) continue;
+    filled[spec.sectionKey] = {
+      score100: null,
+      items: definitions.map((definition) => ({
+        id: definition.id,
+        label: definition.label,
+        score: null,
+        maxScore: definition.maxScore,
+        status: "evaluator_failed",
+        reasoning: `\u8BC4\u5206\u5458\u5DE5\u672A\u8FD4\u56DE ${spec.sectionKey} \u6BB5\uFF0C\u672C\u9879\u6309\u672A\u8BC4\u5206\u8BB0\u5F55\uFF08\u6807\u51C6\uFF1A${rubric.name}\uFF09\u3002`
+      }))
+    };
+  }
+  return filled;
+}
 function enforceEvaluatorBoundaries(value2, evaluationCase) {
   if (!value2 || typeof value2 !== "object") return value2;
   const result = structuredClone(value2);
@@ -173776,17 +174356,22 @@ var init_judge = __esm({
   "../server/src/domains/evaluation/judge.ts"() {
     "use strict";
     init_src();
+    init_judge_prompt();
     TRACE_STRING_LIMIT = 200;
     TRACE_ARRAY_LIMIT = 20;
     ChatEvaluationJudge = class {
       constructor(options) {
         this.options = options;
+        this.attempts = Math.max(1, options.attempts ?? 2);
       }
+      attempts;
       async evaluate(input) {
-        const message = judgePrompt(input);
-        for (let attempt = 0; attempt < 2; attempt += 1) {
+        if (!input.judgeActorId) throw new Error("\u672A\u6307\u5B9A\u5224\u5206\u5458\u5DE5");
+        const rubrics = input.rubrics?.length ? input.rubrics : builtinRubricsForCase(input.evaluationCase);
+        const message = judgePrompt({ ...input, rubrics });
+        for (let attempt = 0; attempt < this.attempts; attempt += 1) {
           const session = await this.options.dispatchChat({
-            actorId: this.options.actorId,
+            actorId: input.judgeActorId,
             message,
             ...input.companyId ? { companyId: input.companyId } : {}
           });
@@ -173797,7 +174382,7 @@ var init_judge = __esm({
           try {
             await session.done;
           } catch (error2) {
-            if (attempt === 0 && isRetryableRuntimeExit(error2, output)) continue;
+            if (attempt + 1 < this.attempts && isRetryableRuntimeExit(error2, output)) continue;
             if (error2 instanceof Error && session.runId) {
               Object.assign(error2, { judgeRunId: session.runId });
             }
@@ -173806,13 +174391,20 @@ var init_judge = __esm({
           return {
             judgeRunId: session.runId ?? null,
             judgeVersion: this.options.judgeVersion,
-            result: validateEvaluationResult(enforceEvaluatorBoundaries(
-              enforceSpecialtyArtifactBoundary(
-                normalizeJudgeOutput(extractJson2(output), input.evaluationCase),
-                input.evidenceSnapshot
+            result: validateEvaluationResult(
+              enforceEvaluatorBoundaries(
+                enforceSpecialtyArtifactBoundary(
+                  fillMissingItemSections(
+                    normalizeJudgeOutput(extractJson2(output), input.evaluationCase, rubrics),
+                    input.evaluationCase,
+                    rubrics
+                  ),
+                  input.evidenceSnapshot
+                ),
+                input.evaluationCase
               ),
-              input.evaluationCase
-            ))
+              rubrics.map((rubric) => rubric.outputSpec)
+            )
           };
         }
         throw new Error("\u8BC4\u5206\u5458\u5DE5\u91CD\u8BD5\u6D41\u7A0B\u5F02\u5E38\u7ED3\u675F");
@@ -173880,6 +174472,8 @@ var init_evaluation3 = __esm({
     init_evidence();
     init_filesystem_catalog();
     init_judge();
+    init_judge_prompt();
+    init_scoring();
     init_project_binding();
     init_runtime_metrics();
     init_routes8();
@@ -174479,7 +175073,7 @@ function playbooksDomain(opts) {
       opts.overrides.set(companyOf(req), ref2, nodeKey, nextOverride);
       try {
         await opts.audit?.({
-          id: `reg_${(0, import_node_crypto30.randomUUID)()}`,
+          id: `reg_${(0, import_node_crypto31.randomUUID)()}`,
           actor: req.auth.actor,
           kind: "registry_change",
           target: `playbook:${ref2}#${nodeKey}`,
@@ -174496,11 +175090,11 @@ function playbooksDomain(opts) {
     });
   };
 }
-var import_node_crypto30;
+var import_node_crypto31;
 var init_routes9 = __esm({
   "../server/src/domains/playbooks/routes.ts"() {
     "use strict";
-    import_node_crypto30 = require("node:crypto");
+    import_node_crypto31 = require("node:crypto");
     init_router();
     init_registry3();
     init_planner();
@@ -174633,11 +175227,11 @@ function remoteAppendInput(hub, nodeId, dispatchId, entry, input, timeoutMs) {
     entry.appendWaiters.push({ resolve: resolve9, timer });
   });
 }
-var import_node_crypto31, STASH_TTL_MS, STASH_MAX_FRAMES_PER_ID, STASH_MAX_IDS, DaemonHubAdapter, BindingRouterAdapter, WorkdirBridge;
+var import_node_crypto32, STASH_TTL_MS, STASH_MAX_FRAMES_PER_ID, STASH_MAX_IDS, DaemonHubAdapter, BindingRouterAdapter, WorkdirBridge;
 var init_daemon_adapter = __esm({
   "../server/src/daemon-adapter.ts"() {
     "use strict";
-    import_node_crypto31 = require("node:crypto");
+    import_node_crypto32 = require("node:crypto");
     STASH_TTL_MS = 5 * 6e4;
     STASH_MAX_FRAMES_PER_ID = 500;
     STASH_MAX_IDS = 50;
@@ -174723,6 +175317,21 @@ var init_daemon_adapter = __esm({
         }
         return n;
       }
+      /**
+       * 当前在途会话的**按员工分布**：`activeRunCount` 的同源摊开（同一张 pending 表、同一组过滤条件），
+       * 故 `sum(count) === activeRunCount(nodeId, runtimeKind)` 恒成立。
+       * 重挂路没带 actor 的会话归到 `actorId: ""`——不丢计数、也不猜身份。
+       */
+      activeRunsByActor(nodeId, runtimeKind) {
+        const byActor = /* @__PURE__ */ new Map();
+        for (const e of this.pending.values()) {
+          if (e.nodeId !== nodeId || e.exited) continue;
+          if (runtimeKind !== void 0 && e.runtimeKind !== runtimeKind) continue;
+          const key = e.actorId ?? "";
+          byActor.set(key, (byActor.get(key) ?? 0) + 1);
+        }
+        return byActor;
+      }
       /** 收到任何回帧（started/event/output/exited）即视为派发已达，取消 ack 超时。 */
       cancelAck(dispatchId) {
         const entry = this.pending.get(dispatchId);
@@ -174793,10 +175402,11 @@ var init_daemon_adapter = __esm({
       async spawn(job) {
         const nodeId = job.binding?.nodeId;
         if (!nodeId) throw new Error("DaemonHubAdapter \u9700\u8981 job.binding.nodeId\uFF08\u8DEF\u7531\u9519\u8BEF\uFF09");
-        const dispatchId = job.dispatchId ?? `dispatch:${(0, import_node_crypto31.randomUUID)()}`;
+        const dispatchId = job.dispatchId ?? `dispatch:${(0, import_node_crypto32.randomUUID)()}`;
         const entry = {
           nodeId,
           ...job.binding?.runtimeKind ? { runtimeKind: job.binding.runtimeKind } : {},
+          ...job.actor ? { actorId: job.actor } : {},
           exitCbs: [],
           telemetryCbs: [],
           outputCbs: [],
@@ -174840,13 +175450,14 @@ var init_daemon_adapter = __esm({
           appendInput: (input) => remoteAppendInput(hub, nodeId, dispatchId, entry, input, appendTimeoutMs)
         };
       }
-      recover(dispatchId, nodeId, runtimeKind) {
+      recover(dispatchId, nodeId, runtimeKind, actorId) {
         const stashed = this.drainStash(dispatchId);
         let entry = this.pending.get(dispatchId);
         if (!entry) {
           entry = {
             nodeId,
             ...runtimeKind ? { runtimeKind } : {},
+            ...actorId ? { actorId } : {},
             exitCbs: [],
             telemetryCbs: [],
             outputCbs: [],
@@ -174954,7 +175565,7 @@ var init_daemon_adapter = __esm({
         }));
       }
       request(nodeId, buildFrame) {
-        const requestId = (0, import_node_crypto31.randomUUID)();
+        const requestId = (0, import_node_crypto32.randomUUID)();
         const sent = this.hub.dispatch(nodeId, buildFrame(requestId));
         if (!sent) return Promise.resolve({ ok: false, code: "NODE_OFFLINE" });
         return new Promise((resolve9) => {
@@ -175037,13 +175648,13 @@ function classifyPage(page, lastPushedHash, serviceAccount) {
   if (sha(body) === lastPushedHash) return { kind: "echo" };
   return { kind: "human-edit", content: body, updatedBy: page.updatedBy };
 }
-var import_node_crypto32, sha, enc3, dec, MirrorEngine, MapMirrorIdentities;
+var import_node_crypto33, sha, enc3, dec, MirrorEngine, MapMirrorIdentities;
 var init_engine = __esm({
   "../server/src/mirror/engine.ts"() {
     "use strict";
-    import_node_crypto32 = require("node:crypto");
+    import_node_crypto33 = require("node:crypto");
     init_src();
-    sha = (s2) => (0, import_node_crypto32.createHash)("sha256").update(s2, "utf8").digest("hex");
+    sha = (s2) => (0, import_node_crypto33.createHash)("sha256").update(s2, "utf8").digest("hex");
     enc3 = (s2) => new TextEncoder().encode(s2);
     dec = (b2) => new TextDecoder().decode(b2);
     MirrorEngine = class {
@@ -175795,11 +176406,11 @@ function humanExitCause(exit) {
   const base = (exit.reason ? label[exit.reason] : void 0) ?? `\u4F1A\u8BDD\u5F02\u5E38\u7ED3\u675F\uFF08${exit.reason ?? "\u65E0\u9000\u51FA\u4FE1\u606F"}\uFF09`;
   return exit.errorMessage ? `${base}\uFF1A${exit.errorMessage.slice(0, 200)}` : base;
 }
-var import_node_crypto33, AUTONOMOUS_ETHOS, CONVERSATIONAL_ETHOS, SHARED_GRAPH_BODY, AUTONOMOUS_RECOVERY_TOOLS, HIGH_RISK_COMMANDS, COORDINATOR_SYSTEM_PROMPT, CONVERSATIONAL_RECOVERY_TOOLS, CONVERSATIONAL_MANAGER_BODY, MACHINE_EXIT_CODES, CoordinatorWorker;
+var import_node_crypto34, AUTONOMOUS_ETHOS, CONVERSATIONAL_ETHOS, SHARED_GRAPH_BODY, AUTONOMOUS_RECOVERY_TOOLS, HIGH_RISK_COMMANDS, COORDINATOR_SYSTEM_PROMPT, CONVERSATIONAL_RECOVERY_TOOLS, CONVERSATIONAL_MANAGER_BODY, MACHINE_EXIT_CODES, CoordinatorWorker;
 var init_worker = __esm({
   "../server/src/coordinator/worker.ts"() {
     "use strict";
-    import_node_crypto33 = require("node:crypto");
+    import_node_crypto34 = require("node:crypto");
     init_src2();
     init_identity();
     AUTONOMOUS_ETHOS = `\u4F60\u662F\u8FD9\u4E2A\u5DE5\u5355\u7684**\u7BA1\u7406\u8005**\u2014\u2014\u804C\u8D23\u662F\u8BA9\u5B83\u987A\u7545\u8DD1\u5B8C\u3002\u7CFB\u7EDF\u5728\u67D0\u4E2A\u8282\u70B9\u5361\u4F4F\u3001\u673A\u68B0\u5206\u8BCA\u786E\u8BA4"\u9700\u8981\u4F60"\u65F6\u5524\u8D77\u4F60\uFF08\u65E0\u4EBA\u5728\u573A\uFF0C\u4F60\u8FD9\u4E00\u8F6E\u628A\u80FD\u505A\u7684\u505A\u6389\uFF09\u3002\u4F60\u7684\u624B\u6BB5\u5F88\u5BBD\uFF1A
@@ -176038,7 +176649,7 @@ ${HIGH_RISK_COMMANDS}`;
         return this.deps.kernel.model.lastSeq.get(artifactId) ?? 0;
       }
       evaluationKey(kind, artifactId, evidence) {
-        const fingerprint = (0, import_node_crypto33.createHash)("sha256").update(JSON.stringify(evidence)).digest("hex");
+        const fingerprint = (0, import_node_crypto34.createHash)("sha256").update(JSON.stringify(evidence)).digest("hex");
         return `${kind}:${artifactId}:${fingerprint}`;
       }
       artifactEvidence(id) {
@@ -176403,7 +177014,7 @@ ${ctx.nodeFault}
         const token = this.deps.tokenFor(actorId, ctx);
         const serverUrl = this.deps.serverUrlFor ? await this.deps.serverUrlFor(ctx) : this.deps.serverUrl;
         const workspace = this.deps.kernel.model.artifacts.get(artifactId)?.workspace;
-        const runtimeSessionId = opts?.resumeSessionId ?? (0, import_node_crypto33.randomUUID)();
+        const runtimeSessionId = opts?.resumeSessionId ?? (0, import_node_crypto34.randomUUID)();
         const job = {
           actor: actorId,
           actorToken: token,
@@ -181812,11 +182423,11 @@ var init_esm2 = __esm({
 });
 
 // ../storage/src/postgres.ts
-var import_node_crypto34, ident3, isUniqueViolation, PostgresOplogStore, PostgresBlobStore;
+var import_node_crypto35, ident3, isUniqueViolation, PostgresOplogStore, PostgresBlobStore;
 var init_postgres = __esm({
   "../storage/src/postgres.ts"() {
     "use strict";
-    import_node_crypto34 = require("node:crypto");
+    import_node_crypto35 = require("node:crypto");
     init_esm2();
     init_src();
     ident3 = (s2) => {
@@ -181969,7 +182580,7 @@ var init_postgres = __esm({
         return new _PostgresBlobStore(pool, schema);
       }
       async put(bytes) {
-        const hash = (0, import_node_crypto34.createHash)("sha256").update(bytes).digest("hex");
+        const hash = (0, import_node_crypto35.createHash)("sha256").update(bytes).digest("hex");
         await this.pool.query(
           `INSERT INTO ${this.t} (hash, bytes, size, content_type) VALUES ($1, $2, $3, $4) ON CONFLICT (hash) DO NOTHING`,
           [hash, Buffer.from(bytes), bytes.byteLength, sniffContentType(bytes) ?? null]
@@ -185849,11 +186460,11 @@ var init_postgres_chat_sessions = __esm({
 });
 
 // ../storage/src/postgres-nodes.ts
-var import_node_crypto35, ident12, PostgresNodeStore, PostgresNodeTokenStore, rowToNode, rowToRuntime;
+var import_node_crypto36, ident12, PostgresNodeStore, PostgresNodeTokenStore, rowToNode, rowToRuntime;
 var init_postgres_nodes = __esm({
   "../storage/src/postgres-nodes.ts"() {
     "use strict";
-    import_node_crypto35 = require("node:crypto");
+    import_node_crypto36 = require("node:crypto");
     init_esm2();
     ident12 = (s2) => {
       if (!/^[a-z_][a-z0-9_]*$/.test(s2)) throw new Error(`invalid schema name: ${s2}`);
@@ -185992,7 +186603,7 @@ var init_postgres_nodes = __esm({
         return store;
       }
       issue(nodeId) {
-        const token = `ont_${(0, import_node_crypto35.randomBytes)(24).toString("base64url")}`;
+        const token = `ont_${(0, import_node_crypto36.randomBytes)(24).toString("base64url")}`;
         this.cache.set(token, nodeId);
         void this.pool.query(`INSERT INTO ${this.s}.node_tokens (token,node_id) VALUES ($1,$2)`, [token, nodeId]);
         return token;
@@ -186203,11 +186814,11 @@ var init_postgres_type_registry = __esm({
 });
 
 // ../storage/src/postgres-actor-memory.ts
-var import_node_crypto36, matchClause, ident15, PostgresActorMemoryStore, rowToIndexEntry, rowToRecord;
+var import_node_crypto37, matchClause, ident15, PostgresActorMemoryStore, rowToIndexEntry, rowToRecord;
 var init_postgres_actor_memory = __esm({
   "../storage/src/postgres-actor-memory.ts"() {
     "use strict";
-    import_node_crypto36 = require("node:crypto");
+    import_node_crypto37 = require("node:crypto");
     init_src();
     matchClause = (q) => q.requireMatch && q.keywords.length > 0 ? " WHERE m > 0" : "";
     ident15 = (s2) => {
@@ -186412,7 +187023,7 @@ var init_postgres_actor_memory = __esm({
       }
       async write(input, now) {
         if (input.memId === void 0) {
-          const memId = `mem:${(0, import_node_crypto36.randomUUID)()}`;
+          const memId = `mem:${(0, import_node_crypto37.randomUUID)()}`;
           const r2 = await this.pool.query(
             `INSERT INTO ${this.s}.actor_memories
            (mem_id, actor_id, project_id, keywords, content, version, created_at, updated_at, accessed_at, source_artifact_id, source_session_id)
@@ -186605,6 +187216,20 @@ function benchmarkSchemaSql(schema) {
       ON ${s2}.benchmark_runs (case_id, attempt_no DESC);
     CREATE INDEX IF NOT EXISTS benchmark_evaluations_run_idx
       ON ${s2}.benchmark_evaluations (run_id, evaluation_no DESC);
+    CREATE TABLE IF NOT EXISTS ${s2}.benchmark_rubrics (
+      rubric_id text PRIMARY KEY, company_id text NOT NULL, name text NOT NULL, kind text NOT NULL,
+      description text, prompt_section text NOT NULL, output_spec jsonb NOT NULL,
+      version integer NOT NULL, status text NOT NULL,
+      created_by text NOT NULL, created_at timestamptz NOT NULL,
+      updated_by text NOT NULL, updated_at timestamptz NOT NULL
+    );
+    CREATE TABLE IF NOT EXISTS ${s2}.benchmark_case_scoring (
+      company_id text NOT NULL, case_id text NOT NULL, rubric_ids jsonb NOT NULL,
+      judge_actor_id text, updated_by text NOT NULL, updated_at timestamptz NOT NULL,
+      PRIMARY KEY (company_id, case_id)
+    );
+    CREATE INDEX IF NOT EXISTS benchmark_rubrics_company_idx
+      ON ${s2}.benchmark_rubrics (company_id, name);
   `;
 }
 function benchmarkAttemptLockKey(companyId, caseId) {
@@ -186648,10 +187273,38 @@ function toEvaluation(row) {
     completedAt: nullableIso(row.completed_at)
   };
 }
-var ident17, iso2, nullableIso, nullableText, PostgresEvaluationStore;
+function toRubric(row) {
+  return {
+    rubricId: String(row.rubric_id),
+    companyId: String(row.company_id),
+    name: String(row.name),
+    kind: String(row.kind),
+    ...row.description == null ? {} : { description: String(row.description) },
+    promptSection: String(row.prompt_section),
+    outputSpec: structuredClone(row.output_spec),
+    version: Number(row.version),
+    status: String(row.status),
+    createdBy: String(row.created_by),
+    createdAt: iso2(row.created_at),
+    updatedBy: String(row.updated_by),
+    updatedAt: iso2(row.updated_at)
+  };
+}
+function toBinding(row) {
+  return {
+    companyId: String(row.company_id),
+    caseId: String(row.case_id),
+    rubricIds: Array.isArray(row.rubric_ids) ? row.rubric_ids.map(String) : [],
+    judgeActorId: nullableText(row.judge_actor_id),
+    updatedBy: String(row.updated_by),
+    updatedAt: iso2(row.updated_at)
+  };
+}
+var import_node_crypto38, ident17, iso2, nullableIso, nullableText, PostgresEvaluationStore, PostgresEvaluationRubricStore;
 var init_postgres_evaluation = __esm({
   "../storage/src/postgres-evaluation.ts"() {
     "use strict";
+    import_node_crypto38 = require("node:crypto");
     init_esm2();
     ident17 = (value2) => {
       if (!/^[a-z_][a-z0-9_]*$/.test(value2)) throw new Error(`invalid schema name: ${value2}`);
@@ -186838,6 +187491,147 @@ var init_postgres_evaluation = __esm({
         if (result.rowCount !== 1) throw new Error(`Evaluation ${evaluation.evaluationId} \u4E0D\u5B58\u5728`);
       }
     };
+    PostgresEvaluationRubricStore = class _PostgresEvaluationRubricStore {
+      constructor(pool, schema) {
+        this.pool = pool;
+        this.s = `"${ident17(schema)}"`;
+      }
+      s;
+      static async open(pool, schema = "public") {
+        const safe = ident17(schema);
+        await pool.query(`CREATE SCHEMA IF NOT EXISTS "${safe}"`);
+        await pool.query(benchmarkSchemaSql(safe));
+        return new _PostgresEvaluationRubricStore(pool, safe);
+      }
+      async listRubrics(companyId) {
+        const result = await this.pool.query(
+          `SELECT * FROM ${this.s}.benchmark_rubrics WHERE company_id=$1 ORDER BY name ASC`,
+          [companyId]
+        );
+        return result.rows.map((row) => toRubric(row));
+      }
+      async getRubric(rubricId) {
+        const result = await this.pool.query(
+          `SELECT * FROM ${this.s}.benchmark_rubrics WHERE rubric_id=$1`,
+          [rubricId]
+        );
+        return result.rows[0] ? toRubric(result.rows[0]) : null;
+      }
+      async upsertRubric(input, at) {
+        const client = await this.pool.connect();
+        try {
+          await client.query("BEGIN");
+          const existing = input.rubricId ? (await client.query(
+            `SELECT * FROM ${this.s}.benchmark_rubrics WHERE rubric_id=$1 FOR UPDATE`,
+            [input.rubricId]
+          )).rows[0] : void 0;
+          if (existing && String(existing.company_id) !== input.companyId) {
+            throw new Error(`\u8BC4\u5206\u6807\u51C6 ${input.rubricId} \u4E0D\u5C5E\u4E8E\u5F53\u524D\u516C\u53F8`);
+          }
+          const rubricId = existing ? String(existing.rubric_id) : input.rubricId ?? (0, import_node_crypto38.randomUUID)();
+          const version2 = existing ? Number(existing.version) + 1 : 1;
+          const status = input.status ?? (existing ? String(existing.status) : "active");
+          const createdBy = existing ? String(existing.created_by) : input.actor;
+          const createdAt = existing ? iso2(existing.created_at) : at;
+          await client.query(
+            `INSERT INTO ${this.s}.benchmark_rubrics
+         (rubric_id,company_id,name,kind,description,prompt_section,output_spec,version,status,
+          created_by,created_at,updated_by,updated_at)
+         VALUES ($1,$2,$3,$4,$5,$6,$7::jsonb,$8,$9,$10,$11,$12,$13)
+         ON CONFLICT (rubric_id) DO UPDATE SET name=EXCLUDED.name,kind=EXCLUDED.kind,
+           description=EXCLUDED.description,prompt_section=EXCLUDED.prompt_section,
+           output_spec=EXCLUDED.output_spec,version=EXCLUDED.version,status=EXCLUDED.status,
+           updated_by=EXCLUDED.updated_by,updated_at=EXCLUDED.updated_at`,
+            [
+              rubricId,
+              input.companyId,
+              input.name,
+              input.kind,
+              input.description ?? null,
+              input.promptSection,
+              JSON.stringify(input.outputSpec),
+              version2,
+              status,
+              createdBy,
+              createdAt,
+              input.actor,
+              at
+            ]
+          );
+          await client.query("COMMIT");
+          const saved = await this.getRubric(rubricId);
+          if (!saved) throw new Error(`\u8BC4\u5206\u6807\u51C6 ${rubricId} \u4FDD\u5B58\u540E\u8BFB\u4E0D\u56DE`);
+          return saved;
+        } catch (error2) {
+          await client.query("ROLLBACK").catch(() => {
+          });
+          throw error2;
+        } finally {
+          client.release();
+        }
+      }
+      async deleteRubric(rubricId, companyId) {
+        const client = await this.pool.connect();
+        try {
+          await client.query("BEGIN");
+          await client.query(
+            `DELETE FROM ${this.s}.benchmark_rubrics WHERE rubric_id=$1 AND company_id=$2`,
+            [rubricId, companyId]
+          );
+          await client.query(
+            `UPDATE ${this.s}.benchmark_case_scoring
+         SET rubric_ids = COALESCE((
+           SELECT jsonb_agg(value) FROM jsonb_array_elements_text(rubric_ids) AS value
+           WHERE value <> $2
+         ), '[]'::jsonb)
+         WHERE company_id=$1 AND rubric_ids @> to_jsonb($2::text)`,
+            [companyId, rubricId]
+          );
+          await client.query("COMMIT");
+        } catch (error2) {
+          await client.query("ROLLBACK").catch(() => {
+          });
+          throw error2;
+        } finally {
+          client.release();
+        }
+      }
+      async listBindings(companyId) {
+        const result = await this.pool.query(
+          `SELECT * FROM ${this.s}.benchmark_case_scoring WHERE company_id=$1 ORDER BY case_id ASC`,
+          [companyId]
+        );
+        return result.rows.map((row) => toBinding(row));
+      }
+      async getBinding(companyId, caseId) {
+        const result = await this.pool.query(
+          `SELECT * FROM ${this.s}.benchmark_case_scoring WHERE company_id=$1 AND case_id=$2`,
+          [companyId, caseId]
+        );
+        return result.rows[0] ? toBinding(result.rows[0]) : null;
+      }
+      async putBinding(input, at) {
+        await this.pool.query(
+          `INSERT INTO ${this.s}.benchmark_case_scoring
+       (company_id,case_id,rubric_ids,judge_actor_id,updated_by,updated_at)
+       VALUES ($1,$2,$3::jsonb,$4,$5,$6)
+       ON CONFLICT (company_id,case_id) DO UPDATE SET rubric_ids=EXCLUDED.rubric_ids,
+         judge_actor_id=EXCLUDED.judge_actor_id,updated_by=EXCLUDED.updated_by,
+         updated_at=EXCLUDED.updated_at`,
+          [
+            input.companyId,
+            input.caseId,
+            JSON.stringify(input.rubricIds),
+            input.judgeActorId,
+            input.actor,
+            at
+          ]
+        );
+        const saved = await this.getBinding(input.companyId, input.caseId);
+        if (!saved) throw new Error(`Case ${input.caseId} \u88C5\u914D\u4FDD\u5B58\u540E\u8BFB\u4E0D\u56DE`);
+        return saved;
+      }
+    };
   }
 });
 
@@ -186852,6 +187646,7 @@ __export(src_exports, {
   PostgresChannelStore: () => PostgresChannelStore,
   PostgresChatSessionStore: () => PostgresChatSessionStore,
   PostgresControlPlaneStore: () => PostgresControlPlaneStore,
+  PostgresEvaluationRubricStore: () => PostgresEvaluationRubricStore,
   PostgresEvaluationStore: () => PostgresEvaluationStore,
   PostgresHumanPrefsStore: () => PostgresHumanPrefsStore,
   PostgresModelPriceStore: () => PostgresModelPriceStore,
@@ -187027,13 +187822,13 @@ var import_node_child_process17 = require("node:child_process");
 var fs33 = __toESM(require("node:fs"), 1);
 var os8 = __toESM(require("node:os"), 1);
 var path27 = __toESM(require("node:path"), 1);
-var import_node_crypto40 = require("node:crypto");
+var import_node_crypto42 = require("node:crypto");
 
 // ../cli/src/serve.ts
 var fs29 = __toESM(require("node:fs"), 1);
 var os5 = __toESM(require("node:os"), 1);
 var path23 = __toESM(require("node:path"), 1);
-var import_node_crypto37 = require("node:crypto");
+var import_node_crypto39 = require("node:crypto");
 var import_node_url5 = require("node:url");
 init_src2();
 init_src7();
@@ -187268,8 +188063,8 @@ exec ${JSON.stringify(tsx)} ${JSON.stringify(main)} "$@"
   return wrapper;
 }
 function splitIdentityFiles3(prompt) {
-  const sep3 = /<!-- FILE: (.+?) -->\n?/g;
-  const parts = prompt.split(sep3);
+  const sep4 = /<!-- FILE: (.+?) -->\n?/g;
+  const parts = prompt.split(sep4);
   if (parts.length === 1) return { "identity/AGENTS.md": prompt };
   const out = {};
   for (let i = 1; i < parts.length; i += 2) {
@@ -187923,6 +188718,16 @@ async function startServe(opts) {
   let workdirBridge = null;
   const nodeHealth = new NodeHealthTracker();
   const activeRunCountOf = (nodeId, runtimeKind) => (chatRemoteAdapter?.activeRunCount(nodeId, runtimeKind) ?? 0) + (dispatchRemoteAdapter?.activeRunCount(nodeId, runtimeKind) ?? 0);
+  const activeRunsOf = (nodeId, runtimeKind) => {
+    const byActor = /* @__PURE__ */ new Map();
+    for (const adapter of [chatRemoteAdapter, dispatchRemoteAdapter]) {
+      if (!adapter) continue;
+      for (const [actorId, count2] of adapter.activeRunsByActor(nodeId, runtimeKind)) {
+        byActor.set(actorId, (byActor.get(actorId) ?? 0) + count2);
+      }
+    }
+    return [...byActor].map(([actorId, count2]) => ({ actorId, count: count2 })).sort((a, b2) => b2.count - a.count || a.actorId.localeCompare(b2.actorId));
+  };
   let localUrl = "";
   const chatLiveSessions = /* @__PURE__ */ new Map();
   const remoteApiUrl = opts.publicUrl ? normalizeHttpBaseUrl(opts.publicUrl) : apiUrlFromGatewayUrl(opts.gatewayUrl);
@@ -187980,6 +188785,7 @@ async function startServe(opts) {
   const structuralBaselines = /* @__PURE__ */ new Map();
   const deployTargets = DeployTargetStore.open(path23.join(opts.dir, "deploy-targets.json"));
   const evaluationStore = pgPool ? await PostgresEvaluationStore.open(pgPool, pgSchema) : new MemoryEvaluationStore();
+  const evaluationRubricStore = pgPool ? await PostgresEvaluationRubricStore.open(pgPool, pgSchema) : new MemoryEvaluationRubricStore();
   const evaluationBenchRoot = process.env["OASIS_EVALUATION_BENCH_ROOT"]?.trim() ?? "";
   const evaluationCatalog = evaluationBenchRoot ? await FilesystemEvaluationCaseCatalog.open(evaluationBenchRoot) : new StaticEvaluationCaseCatalog([]);
   console.log(`[serve] evaluation benchmark catalog=${evaluationBenchRoot || "empty (OASIS_EVALUATION_BENCH_ROOT unset)"}`);
@@ -188029,19 +188835,34 @@ async function startServe(opts) {
     return collector.freeze(workOrderId);
   };
   const evaluationJudge = new ChatEvaluationJudge({
-    actorId: evaluationScoringActorId,
     judgeVersion: evaluationJudgeVersion,
     dispatchChat: async (request) => {
-      if (!evaluationScoringActorId) {
-        throw new Error("OASIS_EVALUATION_SCORING_ACTOR_ID \u672A\u914D\u7F6E\uFF0C\u65E0\u6CD5\u8C03\u7528\u8BC4\u5206\u5458\u5DE5");
-      }
       if (!evaluationDispatchChat) {
         throw new Error("\u8BC4\u5206\u5458\u5DE5\u6D3E\u53D1\u94FE\u8DEF\u5C1A\u672A\u521D\u59CB\u5316");
       }
       return evaluationDispatchChat(request);
     }
   });
+  const listJudgeCandidates = async (companyId) => {
+    const actorCtx = await actors.resolveCtx(companyId);
+    const [agents, resolveBinding] = await Promise.all([
+      actorCtx.service.listActors({ kind: "agent", status: "active" }),
+      actorCtx.service.resolveBinding()
+    ]);
+    const candidates = await Promise.all(agents.map(async (agent) => {
+      const binding = await resolveBinding(agent.id).catch(() => null);
+      return binding ? { actorId: agent.id, name: agent.name } : null;
+    }));
+    return candidates.filter((candidate) => candidate !== null);
+  };
+  const evaluationScoring = new EvaluationScoringService({
+    store: evaluationRubricStore,
+    defaultJudgeActorId: evaluationScoringActorId,
+    verifyJudgeActor: async (actorId, companyId) => (await listJudgeCandidates(companyId)).some((candidate) => candidate.actorId === actorId)
+  });
   const evaluations = createEvaluationDomain({
+    scoring: evaluationScoring,
+    listJudgeCandidates,
     service: new EvaluationService({
       store: evaluationStore,
       catalog: evaluationCatalog,
@@ -188051,7 +188872,7 @@ async function startServe(opts) {
       },
       freezeEvidence: async (runId, companyId) => structuredClone(await collectEvaluationEvidence(runId, companyId)),
       judge: evaluationJudge,
-      judgeActorId: evaluationScoringActorId,
+      scoring: evaluationScoring,
       judgeVersion: evaluationJudgeVersion,
       resolveBenchmarkProjects: (evaluationCase) => resolveEvaluationBenchmarkProjects(evaluationCase, projectStateStore)
     })
@@ -188117,7 +188938,7 @@ async function startServe(opts) {
         }));
       }
       const limits = { wallClockMs: SESSION_WALL_CLOCK_MS.planner };
-      const artifactId = `artifact:planner:${(0, import_node_crypto37.randomUUID)()}`;
+      const artifactId = `artifact:planner:${(0, import_node_crypto39.randomUUID)()}`;
       const handle = await chatRemoteAdapter.spawn({
         actor: planner.id,
         actorToken: issueSessionToken(planner.id, { artifactId, action: "plan-workorder", limits, binding }),
@@ -188164,6 +188985,7 @@ async function startServe(opts) {
         repoRemote: opts.nodeRepoRemote ?? "git@github.com:open-friday/oasis-core.git",
         nodeHealth,
         activeRunCountOf,
+        activeRunsOf,
         fetchLatestNpmDaemonVersion
       }),
       evaluations.register,
@@ -188308,10 +189130,10 @@ async function startServe(opts) {
           { nodeId: priorChatSession?.runtimeId, runtimeKind: priorChatSession?.runtimeKind },
           { nodeId: binding.nodeId, runtimeKind: binding.runtimeKind }
         ) : false;
-        const runtimeSessionId = sessionId ?? (0, import_node_crypto37.randomUUID)();
+        const runtimeSessionId = sessionId ?? (0, import_node_crypto39.randomUUID)();
         const resumeRuntimeSession = Boolean(sessionId);
-        const traceRunId = `chat-run:${(0, import_node_crypto37.randomUUID)()}`;
-        const artifactId = `artifact:chat:${(0, import_node_crypto37.randomUUID)()}`;
+        const traceRunId = `chat-run:${(0, import_node_crypto39.randomUUID)()}`;
+        const artifactId = `artifact:chat:${(0, import_node_crypto39.randomUUID)()}`;
         const traceStartedAt = (/* @__PURE__ */ new Date()).toISOString();
         let traceSeq = 0;
         let lastProgressTouchMs = 0;
@@ -188645,7 +189467,7 @@ async function startServe(opts) {
           isWired: (artifactId) => chatLiveSessions.has(`chat::${artifactId}`)
         });
         for (const plan of plans) {
-          const handle = chatRemoteAdapter.recover(plan.dispatchId, daemonId, plan.runtimeKind);
+          const handle = chatRemoteAdapter.recover(plan.dispatchId, daemonId, plan.runtimeKind, plan.actor);
           const jobKey = `chat::${plan.artifactId}`;
           wireRecoveredChatTurn({
             plan,
@@ -189078,7 +189900,7 @@ async function startServe(opts) {
         ensureDispatcherForEngine?.(companyId, engine2);
         const slot = dispatchers.get(companyId);
         if (!slot) continue;
-        const session = dispatchRemoteAdapter.recover(plan.dispatchId, daemonId, plan.runtimeKind);
+        const session = dispatchRemoteAdapter.recover(plan.dispatchId, daemonId, plan.runtimeKind, plan.actor);
         const recoveredAt = (/* @__PURE__ */ new Date()).toISOString();
         const interruptedAt = previousServerHeartbeatAt ?? serverStartedAt;
         const restored = slot.dispatcher.recoverInFlightSession({
@@ -189708,7 +190530,7 @@ var SessionManager = class {
 // ../cli/src/daemon/ws-client.ts
 init_wrapper();
 var import_node_os7 = require("node:os");
-var import_node_crypto38 = require("node:crypto");
+var import_node_crypto40 = require("node:crypto");
 init_src5();
 
 // ../cli/src/daemon/detect-adapters.ts
@@ -190264,7 +191086,7 @@ var DaemonWsClient = class {
    */
   async queryArtifactStates(artifactIds, timeoutMs = 15e3) {
     if (artifactIds.length === 0) return {};
-    const requestId = (0, import_node_crypto38.randomUUID)();
+    const requestId = (0, import_node_crypto40.randomUUID)();
     return new Promise((resolve9, reject) => {
       const timer = setTimeout(() => {
         this.gcPending.delete(requestId);
@@ -190483,7 +191305,7 @@ async function startNode(opts) {
 // ../cli/src/daemon/machine-id.ts
 var import_node_child_process16 = require("node:child_process");
 var import_node_fs18 = require("node:fs");
-var import_node_crypto39 = require("node:crypto");
+var import_node_crypto41 = require("node:crypto");
 var import_node_os10 = require("node:os");
 function linuxMachineId() {
   for (const p2 of ["/etc/machine-id", "/var/lib/dbus/machine-id"]) {
@@ -190549,7 +191371,7 @@ var defaultSources = {
 function resolveNodeId(sources = {}) {
   const s2 = { ...defaultSources, ...sources };
   const material = `${s2.machineFingerprint()}:${s2.osUser()}`;
-  const digest = (0, import_node_crypto39.createHash)("sha256").update(material).digest("hex").slice(0, 12);
+  const digest = (0, import_node_crypto41.createHash)("sha256").update(material).digest("hex").slice(0, 12);
   return `node-${digest}`;
 }
 
@@ -190720,6 +191542,24 @@ var USAGE = `oasis \u2014\u2014 artifact-centric \u534F\u4F5C\u5185\u6838 CLI\uF
   legacy-assistants list                              # \u5217\u5B58\u91CF\u53EF\u8BA4\u9886\u7684\u79C1\u4EBA agent\uFF08\u5019\u9009\u9762\uFF0C\u9644\u731C\u6D4B\u5F52\u5C5E\u4EBA\uFF0C\u4E0D\u9884\u586B\uFF09
   legacy-assistants claim <agentId> --human <humanId> [--keep-position] [--name <\u65B0\u540D>]  # \u8BA4\u9886\u5E76\u6C38\u4E45\u9501\u5B9A\u7ED9\u8BE5\u771F\u4EBA
 
+  \u6D4B\u8BC4\u4E0E\u8BC4\u5206\u88C5\u914D\uFF08\u4EBA\u548C agent \u540C\u4E00\u5957\u547D\u4EE4\uFF1B\u524D\u7AEF\u300C\u8BC4\u6D4B \u2192 \u8BC4\u5206\u88C5\u914D\u300D\u9875\u8D70\u540C\u4E00\u6279\u63A5\u53E3\uFF09
+  cases                                              # Benchmark Case \u6E05\u5355
+  evaluations [--case <caseId>]                      # Run \u4E00\u89C8\uFF1A\u6700\u65B0\u8BC4\u5206\u72B6\u6001 / \u5224\u5206\u5458\u5DE5 / \u6807\u51C6\u7248\u672C
+  evaluate <workOrderId> --case <caseId> [--judge <actorId>] [--case-version <v>]   # \u5EFA Run \u5E76\u6392\u961F\u9996\u6B21\u8BC4\u5206
+  rescore  <runId> [--judge <actorId>]               # \u53EA\u65B0\u589E\u4E00\u6B21\u8BC4\u5206\uFF0C\u4E0D\u52A8 Run \u5E8F\u53F7
+  judges                                             # \u53EF\u5F53\u5224\u5206\u5458\u5DE5\u7684 agent\uFF08\u53EA\u5217\u6709 active runtime \u7ED1\u5B9A\u7684\uFF09
+  rubrics [--kind common|specialty|case_special]     # \u8BC4\u5206\u6807\u51C6\u6E05\u5355\uFF08\u4E09\u79CD\u6807\u51C6\u662F\u540C\u4E00\u79CD\u5B9E\u4F53\uFF09
+  rubric  <rubricId>                                 # \u770B\u4E00\u6761\u6807\u51C6\uFF1A\u8BF4\u660E + \u8F93\u51FA\u5951\u7EA6 + \u6CE8\u5165 prompt \u7684\u6B63\u6587\u5168\u6587
+  rubric-save [--rubric-id <id>] --name <\u540D> --kind <k> (--prompt <\u6587\u672C>|--prompt-file <\u8DEF\u5F84>) [--spec-file <json>|--spec <json>] [--description \u2026] [--status active|archived]
+      # \u4E0D\u5E26 --rubric-id \u662F\u65B0\u5EFA\uFF0C\u5E26\u4E0A\u662F\u6539\uFF08\u7248\u672C\u53F7\u81EA\u589E\uFF09\u3002--spec \u662F\u8F93\u51FA\u5951\u7EA6\uFF1A
+      # { "sectionKey": "common", "aggregation": "none"|"mean", "strictIds": true, "dimensions": [{"id":"G1","label":"\u2026","min":1,"max":5,"nullable":false}] }
+      # \u5B83\u540C\u65F6\u51B3\u5B9A\u300C\u5224\u5206\u5458\u5DE5\u8981\u8F93\u51FA\u4EC0\u4E48\u5F62\u72B6\u300D\u548C\u300C\u7ED3\u679C\u600E\u4E48\u6821\u9A8C\u300D\u2014\u2014\u4E0D\u518D\u5199\u6B7B G1-G7/\u4E94\u9879\u3002
+  rubric-delete <rubricId>                           # \u5220\u6807\u51C6\uFF08\u6302\u8F7D\u4E86\u5B83\u7684 Case \u540C\u6B65\u6458\u5F15\u7528\uFF09
+  case-scoring <caseId>                              # \u770B\u67D0 Case \u6302\u4E86\u54EA\u51E0\u5957\u6807\u51C6\u3001\u7531\u8C01\u6253\u5206\u3001\u662F\u5426\u8FD8\u5728\u5403\u56DE\u843D
+  case-scoring-set <caseId> [--rubrics id1,id2] [--judge <actorId>|none]
+      # \u53EA\u7ED9\u5176\u4E2D\u4E00\u4E2A flag \u5C31\u53EA\u6539\u90A3\u4E00\u9879\uFF08\u53E6\u4E00\u9879\u6CBF\u7528\u73B0\u503C\uFF0C\u4E0D\u4F1A\u88AB\u6E05\u7A7A\uFF09\u3002--judge none = \u56DE\u5230\u90E8\u7F72\u9ED8\u8BA4\u3002
+      # \u4E00\u6761\u6807\u51C6\u90FD\u4E0D\u6302 = \u56DE\u843D\u5230 oasis-bench \u81EA\u5E26\u7684\u901A\u7528/\u4E13\u9879/Case \u4E13\u9879\u4E09\u4EFD\u6750\u6599\uFF0C\u884C\u4E3A\u4E0E\u914D\u7F6E\u5316\u4E4B\u524D\u4E00\u81F4\u3002
+
   \u6CBB\u7406\uFF08\xA711\uFF09
   reopen        <artifactId> [--note t]            # \u89E3\u5C01\uFF08lifecycle \u2192 active\uFF09
   force-conclude <artifactId> --reason <t>          # \u8C41\u514D gate\uFF1B\u673A\u68B0\u68C0\u67E5\u7167\u8DD1\u3001\u91CC\u7A0B\u7891\u5E26 forced \u6807\u8BB0
@@ -191069,7 +191909,7 @@ async function runCli(argv, println = console.log) {
     const store = createNodeTokenStore(path27.join(dir, "node-tokens.json"));
     const sub = positional[0];
     if (sub === "issue") {
-      const id = flags.get("id") ?? `node-${(0, import_node_crypto40.randomUUID)()}`;
+      const id = flags.get("id") ?? `node-${(0, import_node_crypto42.randomUUID)()}`;
       const token2 = store.issue(id);
       println(token2);
       process.stderr.write(
@@ -192687,6 +193527,151 @@ ${res.warning}`);
       else if (!wsFilter && rows.length > 30) println(`\u2014\u2014 \u5171 ${rows.length} \u4E2A\u4EA7\u7269\uFF08\u5168\u5E93\u62C9\u5E73\uFF09\u3002\u6309\u5DE5\u5355\u770B\u7528 \`oasis ls --workspace <ws:id>\`\uFF0C\u5DE5\u5355\u6E05\u5355\u7528 \`oasis workorders\`\u3002`);
       break;
     }
+    /**
+     * 评测评分装配（人和 agent 同一套命令）。
+     *
+     * 三种评分标准（通用 / S 专项 / Case 专项）在系统里是**同一种实体**，统一经 prompt 注入判分员工；
+     * 一条标准可挂到多个 Case，一个 Case 可挂多条；判分员工按「本次指定 → Case 装配 → 部署默认」解析。
+     * 前端「评测 → 评分装配」页走的是同一批接口，两边不会各算各的。
+     */
+    case "rubrics": {
+      const kind = flags.get("kind");
+      const res = await api.request("GET", "/api/evaluations/rubrics");
+      const items = kind ? res.items.filter((r) => r.kind === kind) : res.items;
+      println(`\u8BC4\u5206\u6807\u51C6(${items.length}${kind ? ` / kind=${kind}` : ""})\u2014\u2014\u6302\u5230 Case \u7528 \`oasis case-scoring-set\`:`);
+      for (const r of items) {
+        println(`- ${r.rubricId}  ${r.name}  [${r.kind}] v${r.version}${r.status === "archived" ? "  [\u5DF2\u5F52\u6863]" : ""}`);
+        println(`    \u8F93\u51FA\u6BB5=${r.outputSpec.sectionKey}  \u7EF4\u5EA6=${r.outputSpec.dimensions.length || "\u7531 Case \u5B9A\u4E49"}${r.description ? `  ${r.description}` : ""}`);
+      }
+      if (items.length === 0) println("\uFF08\u65E0\u3002\u4E00\u6761\u90FD\u6CA1\u6709\u65F6 Case \u4F1A\u56DE\u843D\u5230 oasis-bench \u81EA\u5E26\u7684\u4E09\u4EFD\u6750\u6599\uFF09");
+      break;
+    }
+    case "rubric": {
+      const rubricId = needPos(positional, 0, "oasis rubric <rubricId>");
+      const res = await api.request("GET", "/api/evaluations/rubrics");
+      const rubric = res.items.find((r) => r.rubricId === rubricId);
+      if (!rubric) throw new Error(`\u8BC4\u5206\u6807\u51C6 ${rubricId} \u4E0D\u5B58\u5728`);
+      println(`${rubric.name}  [${rubric.kind}] v${rubric.version}  ${rubric.status}`);
+      if (rubric.description) println(`\u8BF4\u660E: ${rubric.description}`);
+      println(`\u8F93\u51FA\u5951\u7EA6: ${JSON.stringify(rubric.outputSpec, null, 2)}`);
+      println("--- \u6CE8\u5165\u5224\u5206 prompt \u7684\u6B63\u6587 ---");
+      println(rubric.promptSection);
+      break;
+    }
+    case "rubric-save": {
+      const rubricId = flags.get("rubric-id");
+      const promptSection = flags.get("prompt-file") !== void 0 ? readFileArg(flags.get("prompt-file")) : flags.get("prompt");
+      if (!promptSection) {
+        throw new Error("\u7F3A\u5C11\u6807\u51C6\u6B63\u6587\uFF1A\u7ED9 --prompt <\u6587\u672C> \u6216 --prompt-file <\u8DEF\u5F84>");
+      }
+      const outputSpec = flags.get("spec-file") !== void 0 ? JSON.parse(readFileArg(flags.get("spec-file"))) : flags.get("spec") !== void 0 ? JSON.parse(flags.get("spec")) : void 0;
+      const body = { promptSection };
+      if (flags.get("name") !== void 0) body["name"] = flags.get("name");
+      if (flags.get("kind") !== void 0) body["kind"] = flags.get("kind");
+      if (flags.get("description") !== void 0) body["description"] = flags.get("description");
+      if (flags.get("status") !== void 0) body["status"] = flags.get("status");
+      if (outputSpec !== void 0) body["outputSpec"] = outputSpec;
+      const saved = rubricId ? await api.request("PUT", `/api/evaluations/rubrics/${encodeURIComponent(rubricId)}`, body) : await api.request("POST", "/api/evaluations/rubrics", body);
+      println(`\u5DF2\u4FDD\u5B58 ${saved.rubricId}  ${saved.name}  [${saved.kind}] v${saved.version}`);
+      println(`\u6302\u5230 Case: oasis case-scoring-set <caseId> --rubrics ${saved.rubricId}`);
+      break;
+    }
+    case "rubric-delete": {
+      const rubricId = needPos(positional, 0, "oasis rubric-delete <rubricId>");
+      await api.request("DELETE", `/api/evaluations/rubrics/${encodeURIComponent(rubricId)}`);
+      println(`\u5DF2\u5220\u9664 ${rubricId}\uFF08\u6302\u8F7D\u4E86\u5B83\u7684 Case \u4F1A\u540C\u6B65\u6458\u6389\u5F15\u7528\uFF09`);
+      break;
+    }
+    case "case-scoring": {
+      const caseId = needPos(positional, 0, "oasis case-scoring <caseId>");
+      const res = await api.request(
+        "GET",
+        `/api/evaluations/cases/${encodeURIComponent(caseId)}/scoring`
+      );
+      println(`Case ${res.caseId} \u8BC4\u5206\u88C5\u914D:`);
+      println(`  \u5224\u5206\u5458\u5DE5: ${res.judgeActorId ?? "\uFF08\u7528\u90E8\u7F72\u9ED8\u8BA4\uFF09"}`);
+      if (res.usesBuiltinFallback) {
+        println("  \u8BC4\u5206\u6807\u51C6: \uFF08\u672A\u6302\u8F7D\uFF0C\u56DE\u843D\u5230 oasis-bench \u81EA\u5E26\u7684\u901A\u7528 / \u4E13\u9879 / Case \u4E13\u9879\u4E09\u4EFD\u6750\u6599\uFF09");
+      } else {
+        for (const r of res.rubrics) {
+          println(`  - ${r.rubricId}  ${r.name}  [${r.kind}] v${r.version} \u2192 \u8F93\u51FA\u6BB5 ${r.outputSpec.sectionKey}`);
+        }
+      }
+      break;
+    }
+    case "case-scoring-set": {
+      const caseId = needPos(positional, 0, "oasis case-scoring-set <caseId> [--rubrics id1,id2] [--judge <actorId>|none]");
+      const current = await api.request(
+        "GET",
+        `/api/evaluations/cases/${encodeURIComponent(caseId)}/scoring`
+      );
+      const rubricIds = flags.get("rubrics") !== void 0 ? flags.get("rubrics").split(",").map((v2) => v2.trim()).filter(Boolean) : current.rubrics.map((r) => r.rubricId);
+      const judgeFlag = flags.get("judge");
+      const judgeActorId = judgeFlag === void 0 ? current.judgeActorId : judgeFlag === "none" || judgeFlag === "" ? null : judgeFlag;
+      const saved = await api.request(
+        "PUT",
+        `/api/evaluations/cases/${encodeURIComponent(caseId)}/scoring`,
+        { rubricIds, judgeActorId }
+      );
+      println(`\u5DF2\u66F4\u65B0 Case ${saved.caseId} \u7684\u8BC4\u5206\u88C5\u914D\uFF1A\u6807\u51C6 ${saved.rubrics.length} \u5957\uFF0C\u5224\u5206\u5458\u5DE5 ${saved.judgeActorId ?? "\u90E8\u7F72\u9ED8\u8BA4"}`);
+      if (saved.usesBuiltinFallback) println("\uFF08\u4E00\u6761\u90FD\u6CA1\u6302 = \u4ECD\u8D70 oasis-bench \u56DE\u843D\uFF09");
+      break;
+    }
+    case "judges": {
+      const res = await api.request(
+        "GET",
+        "/api/evaluations/judge-candidates"
+      );
+      println(`\u53EF\u9009\u5224\u5206\u5458\u5DE5(${res.items.length}):`);
+      for (const j of res.items) println(`- ${j.actorId}  ${j.name}`);
+      if (res.items.length === 0) println("\uFF08\u65E0\uFF1A\u6CA1\u6709 agent \u914D\u4E86 active runtime \u7ED1\u5B9A\uFF09");
+      break;
+    }
+    case "evaluations": {
+      const res = await api.request("GET", "/api/evaluations/runs");
+      const caseId = flags.get("case");
+      const items = caseId ? res.items.filter((i) => i.run.caseId === caseId) : res.items;
+      println(`Benchmark Runs(${items.length}):`);
+      for (const item of items) {
+        const e = item.latestEvaluation;
+        println(`- ${item.run.runId}  ${item.run.workOrderName}  case=${item.run.caseId}#${item.run.attemptNo}`);
+        println(`    \u8BC4\u5206=${e ? `${e.status}${e.errorMessage ? ` (${e.errorMessage})` : ""}` : "\u5C1A\u672A\u8BC4\u5206"}  \u5224\u5206\u5458\u5DE5=${e?.judgeActorId ?? "-"}  \u6807\u51C6\u7248\u672C=${e?.rubricVersion ?? "-"}`);
+      }
+      break;
+    }
+    case "evaluate": {
+      const workOrderId = needPos(positional, 0, "oasis evaluate <workOrderId> --case <caseId> [--judge <actorId>]");
+      const caseId = flags.get("case");
+      if (!caseId) throw new Error("\u7F3A\u5C11 --case <caseId>\uFF08\u53EF\u7528 oasis cases \u770B\u6E05\u5355\uFF09");
+      const r = await api.request(
+        "POST",
+        "/api/evaluations/runs",
+        { workOrderId, caseId, ...flags.get("case-version") ? { caseVersion: flags.get("case-version") } : {}, ...flags.get("judge") ? { judgeActorId: flags.get("judge") } : {} }
+      );
+      println(`\u5DF2\u5EFA Run ${r.run.runId}\uFF0C\u8BC4\u5206 ${r.evaluation.evaluationId} \u5DF2\u6392\u961F\uFF08\u5224\u5206\u5458\u5DE5 ${r.evaluation.judgeActorId}\uFF09`);
+      break;
+    }
+    case "rescore": {
+      const runId = needPos(positional, 0, "oasis rescore <runId> [--judge <actorId>]");
+      const r = await api.request(
+        "POST",
+        `/api/evaluations/runs/${encodeURIComponent(runId)}/rescore`,
+        flags.get("judge") ? { judgeActorId: flags.get("judge") } : {}
+      );
+      println(`\u5DF2\u6392\u961F\u7B2C ${r.evaluationNo} \u6B21\u8BC4\u5206 ${r.evaluationId}\uFF08\u5224\u5206\u5458\u5DE5 ${r.judgeActorId}\uFF09`);
+      break;
+    }
+    case "cases": {
+      const res = await api.request(
+        "GET",
+        "/api/evaluations/cases"
+      );
+      println(`Benchmark Cases(${res.items.length}):`);
+      for (const c of res.items) {
+        println(`- ${c.id}  ${c.title}  [${c.scopeType}/${c.difficultyLevel}] ${c.status}`);
+      }
+      break;
+    }
     case "artifact-types": {
       const sub = positional[0] ?? "list";
       const typeBodyFromFlags = () => {
@@ -192849,6 +193834,14 @@ init_src5();
 var fs34 = __toESM(require("node:fs"));
 var path28 = __toESM(require("node:path"));
 var ASSET_EXT = ".sh";
+var SESSION_SCOPED_PREFIXES = ["oasis-conn-", "oasis-wrappers-", "oasis-cli-"];
+function sanitizeDaemonPath(rawPath) {
+  return (rawPath ?? "").split(":").filter((dir) => {
+    if (!dir) return false;
+    const base = path28.basename(dir);
+    return !SESSION_SCOPED_PREFIXES.some((p2) => base.startsWith(p2));
+  }).join(":");
+}
 function installRuntimeAssets(srcRoot, binDir) {
   if (path28.resolve(srcRoot) === path28.resolve(binDir)) return 0;
   let copied = 0;
@@ -192889,7 +193882,7 @@ function syncRuntimeAssets(candidateRoots, binDir) {
 }
 
 // src/index.ts
-var PKG_VERSION = true ? "0.1.81" : "dev";
+var PKG_VERSION = true ? "0.1.83" : "dev";
 var OASIS_DIR = path29.join(os9.homedir(), ".oasis");
 var CONFIG_FILE = path29.join(OASIS_DIR, "node-config.json");
 var PID_FILE = path29.join(OASIS_DIR, "node.pid");
@@ -192967,7 +193960,7 @@ function setupAutostart() {
     path29.join(home, ".local", "bin"),
     "/usr/local/bin"
   ];
-  const daemonPath = [process.env["PATH"] ?? "", ...extraBins].filter(Boolean).join(":");
+  const daemonPath = sanitizeDaemonPath([process.env["PATH"] ?? "", ...extraBins].filter(Boolean).join(":"));
   if (process.platform === "linux") {
     const unitDir = path29.join(os9.homedir(), ".config", "systemd", "user");
     fs35.mkdirSync(unitDir, { recursive: true });
@@ -193113,6 +194106,11 @@ void (async () => {
       cleanup();
       process.exit(0);
     });
+    const cleanPath = sanitizeDaemonPath(process.env["PATH"]);
+    if (cleanPath !== process.env["PATH"]) {
+      console.error(`[oasis] daemon PATH \u5DF2\u6E05\u6D17\uFF1A\u5254\u9664 agent \u4F1A\u8BDD\u4E34\u65F6 wrapper \u76EE\u5F55 ${(process.env["PATH"] ?? "").split(":").length - cleanPath.split(":").length} \u6761`);
+      process.env["PATH"] = cleanPath;
+    }
     try {
       ensureRuntimeAssets();
     } catch (e) {