oh-my-knowledge 1.0.0-beta.3 → 1.0.0-beta.4

package/README.md

@@ -55,7 +55,7 @@ export OMK_EXECUTOR=codex
 
 Without `OMK_MODEL`, omk reads the model from `~/.codex/config.toml`. You can still pass `--executor codex --model <codex-model>` per command. Pass `--judge-models` or set `OMK_JUDGE_MODELS` only when you want a different judge.
 
-> The default 3-case pack is a low-cost workflow check, so `UNDERPOWERED` is expected. `--samples 20` selects a first-party, difficulty-stratified starter pack that meets omk's registered sample-size floor. Its provenance is `llm-generated`: use it to learn the statistical workflow, then review and replace it with real domain cases before making a release decision.
+> The default 3-case pack is a low-cost workflow check, so `UNDERPOWERED` is expected. `--samples 20` selects a first-party, difficulty-stratified starter pack that meets omk's default heuristic evidence floor; it is not an a priori power calculation. Its provenance is `llm-generated`: use it to learn the statistical workflow, then review and replace it with real domain cases before making a release decision.
 
 > The CLI notifies you when a newer version is available (at most once per 20h); set `OMK_SKIP_UPDATE_CHECK=1` to silence it permanently.
 
@@ -228,7 +228,7 @@ The full docs are published at **[oh-my-knowledge.pages.dev](https://oh-my-knowl
 - **[CLI reference](docs/reference/cli.md)** — all top-level commands with bash examples and flag tables
 - **[Migrate to the 1.0 preview](docs/guides/v1-preview-migration.md)** — install channel, storage reset, sample protocol, CLI automation, and embedded API changes since 0.54
 - **[Evaluation Core cutover](docs/guides/eval-core-cutover.md)** — `BREAKING-SCHEMA` storage, resume, Studio, Gold, managed-evidence, and evolve migration
-- **[Embed OMK in a service](docs/guides/eval-runtime.md)** — one `evaluate()` API for Node.js and FaaS hosts
+- **[Embed OMK in a service](docs/guides/eval-runtime.md)** — canonical `evaluate()` plus repeat-run `evaluateSeries()` for Node.js and FaaS hosts
 - **[Storage layout v2](docs/specs/storage-layout-spec.md)** — project/global domains, compatibility boundary, and Git policy
 - **[Executors](docs/reference/executors.md)** & **[artifact layout](docs/reference/artifact-layout.md)** — built-in / custom executors; how `variant` resolves to an artifact + runtime context
 - **[How-to guides](docs/guides/agent-eval.md)** — [evaluate an agent](docs/guides/agent-eval.md) (project runtime context) and [use non-Claude models](docs/guides/non-claude-models.md) (GLM / Qwen / DeepSeek / Moonshot / Ollama)

package/README.zh.md

@@ -55,7 +55,7 @@ export OMK_EXECUTOR=codex
 
 不设置 `OMK_MODEL` 时，omk 会读取 `~/.codex/config.toml` 的模型。也可以继续逐次显式传 `--executor codex --model <codex-model>`。自定义评委时再传 `--judge-models` 或设置 `OMK_JUDGE_MODELS`。
 
-> 默认 3 条用例是低成本流程检查，出现「数据不足（UNDERPOWERED）」符合预期。`--samples 20` 会选择经过难度分层的官方起步用例集，达到 omk 注册的样本量下限。其来源明确标记为 `llm-generated`：它适合学习统计流程，发布判断前仍应人工复核并替换为真实领域用例。
+> 默认 3 条用例是低成本流程检查，出现「数据不足（UNDERPOWERED）」符合预期。`--samples 20` 会选择经过难度分层的官方起步用例集，达到 omk 默认的启发式证据下限，但这不是先验功效计算。其来源明确标记为 `llm-generated`：它适合学习统计流程，发布判断前仍应人工复核并替换为真实领域用例。
 
 > 命令行有新版本时会自动提示（每 20 小时最多一次）；想永久关闭该提醒，设环境变量 `OMK_SKIP_UPDATE_CHECK=1` 即可。
 
@@ -228,7 +228,7 @@ omk-mcp
 - **[CLI 参考](docs/zh/reference/cli.md)** —— 顶层命令的 bash 示例和 flag 表
 - **[迁移到 1.0 预览版](docs/zh/guides/v1-preview-migration.md)** —— 从 `0.54` 升级时的安装渠道、存储重建、用例协议、CLI 自动化与嵌入式 API 变化
 - **[Evaluation Core 生产切换](docs/zh/guides/eval-core-cutover.md)** —— `BREAKING-SCHEMA` 存储、resume、Studio、Gold、受管证据与 evolve 迁移
-- **[在服务中嵌入 OMK](docs/zh/guides/eval-runtime.md)** —— 面向 Node.js 与 FaaS 宿主的单一 `evaluate()` API
+- **[在服务中嵌入 OMK](docs/zh/guides/eval-runtime.md)** —— 面向 Node.js 与 FaaS 宿主的 canonical `evaluate()` 与重复运行 `evaluateSeries()`
 - **[存储布局 v2](docs/zh/specs/storage-layout-spec.md)** —— 项目／全局领域、迁移兼容与 Git 策略
 - **[执行器](docs/zh/reference/executors.md)** & **[知识载体布局](docs/zh/reference/artifact-layout.md)** —— 内置 / 自定义执行器；variant 如何解析为 artifact + runtime context
 - **[操作指南](docs/zh/guides/agent-eval.md)** —— [评测 agent](docs/zh/guides/agent-eval.md)（项目 runtime context）与[使用非 Claude 模型](docs/zh/guides/non-claude-models.md)（GLM / 通义 / DeepSeek / Moonshot / Ollama）

package/dist/assets/agent-skills/omk/references/commands.md

@@ -104,7 +104,7 @@ omk eval [flags]
 - `--no-serve` `boolean`:不启 report server
 - `--no-strict-baseline` `boolean`:关闭 baseline 隔离
 - `--output-dir` `option`:报告输出目录（默认项目级 .omk/eval）
-- `--repeat` `option`:每个用例重复运行 N 次
+- `--repeat` `option`:预先固定 Evaluation Series 的独立 run 数
 - `--report-only` `boolean`:生成报告并打印判定，但始终 exit 0(不参与 CI gate）。
 - `--resume` `option`:复用经过完整契约校验的 Core runId；拒绝时失败关闭
 - `--retry` `option`:单用例失败重试次数
@@ -169,6 +169,7 @@ omk eval gold compare <runId> [flags]
 - `--gold-dir` `option`:gold dataset 目录，必填
 - `--lang` `option` (默认 `zh`):输出语言 zh|en，优先级 CLI > OMK_LANG env > zh。
 - `--metric` `option`:显式选择 Core metric ID。
+- `--minimum-alpha` `option`:可选的一致性阈值；按 Krippendorff α 置信区间下界评估
 - `--reports-dir` `option`:只读取指定 Core 报告目录（默认当前项目 + 全局）
 - `--seed` `option`:bootstrap seed，可复现
 - `--target` `option`:显式选择 Core target ID。
@@ -274,7 +275,7 @@ omk init [targetDir] [flags]
 
 - `--force` `boolean`:允许覆盖目标目录中已有的 omk 脚手架文件
 - `--lang` `option` (默认 `zh`):输出语言 zh|en，优先级 CLI > OMK_LANG env > zh。
-- `--samples` `3|20` (默认 `3`):官方起步用例数量：3 条用于快速跑通，20 条用于达到注册样本量下限
+- `--samples` `3|20` (默认 `3`):官方起步用例数量：3 条用于快速跑通，20 条用于达到默认启发式证据下限
 
 **示例:**
 
@@ -290,7 +291,7 @@ omk init
 omk init my-project
 ```
 
-> 使用达到注册样本量下限的 20 条官方用例初始化
+> 使用达到默认启发式证据下限的 20 条官方用例初始化
 
 ```bash
 omk init my-project --samples 20

package/dist/cli/commands/eval/gold/compare.d.ts

@@ -10,6 +10,7 @@ export default class EvalGoldCompare extends BaseCommand {
         target: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
         evaluator: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
         metric: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        'minimum-alpha': import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
         'trial-index': import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
         'reports-dir': import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
         'bootstrap-samples': import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;

package/dist/cli/commands/eval/gold/compare.js

@@ -2,7 +2,7 @@ import { resolve } from 'node:path';
 import { Args, Flags } from '@oclif/core';
 import { BaseCommand } from '../../../oclif/base-command.js';
 import { LANG_FLAG, bilingual } from '../../../oclif/i18n.js';
-import { integerStringParser } from '../../../oclif/parsers.js';
+import { integerStringParser, numberStringParser } from '../../../oclif/parsers.js';
 import { CliExit } from '../../../lib/cli-exit.js';
 import { projectReportsDir, globalReportsDir } from '../../../../evidence/storage/directories.js';
 export default class EvalGoldCompare extends BaseCommand {
@@ -33,6 +33,13 @@ export default class EvalGoldCompare extends BaseCommand {
         metric: Flags.string({
             description: bilingual({ zh: '显式选择 Core metric ID。', en: 'Explicit Core metric ID.' }),
         }),
+        'minimum-alpha': Flags.string({
+            description: bilingual({
+                zh: '可选的一致性阈值；按 Krippendorff α 置信区间下界评估',
+                en: 'Optional agreement threshold, assessed against the Krippendorff alpha CI lower bound',
+            }),
+            parse: numberStringParser('--minimum-alpha', { min: -1, max: 1 }),
+        }),
         'trial-index': Flags.string({
             description: bilingual({ zh: '显式选择 trial index。', en: 'Explicit trial index.' }),
             parse: integerStringParser('--trial-index', { min: 0 }),
@@ -61,26 +68,31 @@ export default class EvalGoldCompare extends BaseCommand {
         await this.runWithCliExit(async () => {
             const runId = args.runId;
             if (!runId) {
-                console.error('Usage: omk eval gold compare <runId> --gold-dir <dir> --target <id> --evaluator <id> --metric <id>');
+                console.error(lang === 'zh'
+                    ? '用法：omk eval gold compare <runId> --gold-dir <dir> --target <id> --evaluator <id> --metric <id>'
+                    : 'Usage: omk eval gold compare <runId> --gold-dir <dir> --target <id> --evaluator <id> --metric <id>');
                 throw new CliExit(1);
             }
             const goldDir = flags['gold-dir'];
             if (!goldDir) {
-                console.error('--gold-dir is required');
+                console.error(lang === 'zh' ? '必须提供 --gold-dir。' : '--gold-dir is required.');
                 throw new CliExit(1);
             }
-            const { loadGoldDataset } = await import('../../../../eval-workflows/gold/dataset.js');
+            const { loadGoldDataset, validationIssueMessage } = await import('../../../../eval-workflows/gold/dataset.js');
             const { createNodeCoreContentStore, createNodeCoreRunArtifactStore, createOverlayCoreRunArtifactStore, } = await import('../../../../eval-workflows/artifact-store/index.js');
             const { compareGoldToCoreRun } = await import('../../../../eval-workflows/projections/gold.js');
             const { dataset, issues } = loadGoldDataset(goldDir);
             if (!dataset) {
-                console.error('Cannot load gold dataset:');
+                console.error(lang === 'zh' ? '无法加载 gold dataset：' : 'Cannot load gold dataset:');
                 for (const i of issues)
-                    console.error(`  - ${i.message}`);
+                    console.error(`  - ${validationIssueMessage(i, lang)}`);
                 throw new CliExit(1);
             }
-            for (const i of issues)
-                console.error(`warn: ${i.message}`);
+            for (const i of issues) {
+                console.error(lang === 'zh'
+                    ? `警告：${validationIssueMessage(i, lang)}`
+                    : `Warning: ${validationIssueMessage(i, lang)}`);
+            }
             const storeOf = (directory) => createNodeCoreRunArtifactStore(directory, {
                 contentResolver: createNodeCoreContentStore(resolve(directory, 'content')),
             });
@@ -90,8 +102,8 @@ export default class EvalGoldCompare extends BaseCommand {
             const source = await store.get(runId);
             if (source === undefined) {
                 console.error(lang === 'zh'
-                    ? `找不到 Core run「${runId}」；旧 evaluation report 不再支持 gold compare。`
-                    : `Core run "${runId}" was not found; legacy evaluation reports are no longer supported.`);
+                    ? `找不到 Core run「${runId}」。`
+                    : `Core run "${runId}" was not found.`);
                 throw new CliExit(1);
             }
             if (!flags.target || !flags.evaluator || !flags.metric) {
@@ -114,6 +126,9 @@ export default class EvalGoldCompare extends BaseCommand {
                     }),
                 },
                 bootstrapSamples: samples,
+                ...(flags['minimum-alpha'] === undefined ? {} : {
+                    minimumAlpha: Number(flags['minimum-alpha']),
+                }),
                 ...(Number.isFinite(seedVal) ? { bootstrapSeed: seedVal } : {}),
             });
             console.log(JSON.stringify(result, null, 2));

package/dist/cli/commands/eval/gold/validate.js

@@ -25,18 +25,22 @@ export default class EvalGoldValidate extends BaseCommand {
         await this.runWithCliExit(async () => {
             const dir = args.dir;
             if (!dir) {
-                console.error('Usage: omk eval gold validate <dir>');
+                console.error(lang === 'zh'
+                    ? '用法：omk eval gold validate <dir>'
+                    : 'Usage: omk eval gold validate <dir>');
                 throw new CliExit(1);
             }
             const { validateGoldDataset } = await import('../../../../eval-workflows/gold/cli.js');
-            const result = validateGoldDataset(dir);
+            const result = validateGoldDataset(dir, lang);
             if (result.ok) {
                 console.log(lang === 'zh'
                     ? `✓ gold dataset OK，共 ${result.sampleCount} 条标注`
                     : `✓ gold dataset OK — ${result.sampleCount} annotations`);
                 return;
             }
-            console.error(`✗ gold dataset has ${result.issues.length} issue(s):`);
+            console.error(lang === 'zh'
+                ? `✗ gold dataset 存在 ${result.issues.length} 个问题：`
+                : `✗ gold dataset has ${result.issues.length} issue(s):`);
             for (const msg of result.issues)
                 console.error(`  - ${msg}`);
             throw new CliExit(1);

package/dist/cli/commands/eval/index.js

@@ -333,7 +333,10 @@ export default class Eval extends BaseCommand {
         }),
         // ── eval-runner extra ──
         repeat: Flags.string({
-            description: bilingual({ zh: '每个用例重复运行 N 次', en: 'Repeat each sample N times' }),
+            description: bilingual({
+                zh: '预先固定 Evaluation Series 的独立 run 数',
+                en: 'Predeclare the independent run count for the Evaluation Series',
+            }),
             parse: integerStringParser('--repeat', { min: 1 }),
         }),
         'holdout-ratio': Flags.string({

package/dist/cli/commands/init.js

@@ -77,8 +77,8 @@ export default class Init extends BaseCommand {
         },
         {
             description: bilingual({
-                zh: '使用达到注册样本量下限的 20 条官方用例初始化',
-                en: 'Initialize with the 20 first-party samples that meet the registered sample-size floor',
+                zh: '使用达到默认启发式证据下限的 20 条官方用例初始化',
+                en: 'Initialize with 20 first-party samples that meet the default heuristic evidence floor',
             }),
             command: '<%= config.bin %> init my-project --samples 20',
         },
@@ -108,8 +108,8 @@ export default class Init extends BaseCommand {
         lang: LANG_FLAG,
         samples: Flags.string({
             description: bilingual({
-                zh: '官方起步用例数量：3 条用于快速跑通，20 条用于达到注册样本量下限',
-                en: 'Number of first-party starter samples: 3 for a quick run, 20 to meet the registered sample-size floor',
+                zh: '官方起步用例数量：3 条用于快速跑通，20 条用于达到默认启发式证据下限',
+                en: 'Number of first-party starter samples: 3 for a quick run, 20 to meet the default heuristic evidence floor',
             }),
             options: [String(DEFAULT_INIT_SAMPLE_COUNT), String(FULL_INIT_SAMPLE_COUNT)],
             default: String(DEFAULT_INIT_SAMPLE_COUNT),

package/dist/cli/commands/studio.js

@@ -9,11 +9,11 @@ import { resolveObserveHealthDir, projectObserveHealthDir, globalObserveHealthDi
 import { DEFAULT_GLOBAL_OBSERVATIONS_DIR } from '../../observability/inbox/index.js';
 import { openWorkbench } from '../lib/open-workbench.js';
 // dev / browser-open 测试需要 mock `node:child_process` + `node:os`,通过 in-process
-// import 直接调用。把业务作为 module-level helper export 从 Command file 暴露,
-// 既保留 test 兼容又让产品命令树语义干净(无 legacy commands directory)。
+// import 直接调用。把业务作为 module-level helper export 从 Command file 暴露，
+// 便于测试命令行为，同时保持产品命令树语义干净。
 export async function runStudio(_args, flags, lang) {
-    // reports 读取目录：显式 --reports-dir 固定该目录；--global 钉全局；默认只聚合
-    // 当前项目 + 全局 Core run。旧 eval report index 已删除，不再扫描其它项目。
+    // reports 读取目录：显式 --reports-dir 固定该目录；--global 钉全局；默认聚合
+    // 当前项目与全局 Core run。
     const reportsDirOpt = flags['reports-dir']
         ? resolve(flags['reports-dir'])
         : flags.global

package/dist/cli/lib/i18n-dict/init.js

@@ -27,8 +27,8 @@ export const initDict = {
         en: '  2. Read the report verdict and Next line: 3 samples only prove the workflow, so UNDERPOWERED is expected; use --samples 20 in a new empty directory for the full starter set.',
     },
     'cli.init.next_step_report_full': {
-        zh: '  2. 看报告里的 verdict 和“下一步”：20 条用例达到注册样本量下限，但来源是 llm-generated；用于理解统计流程，发布前应人工复核并替换为真实领域用例。',
-        en: '  2. Read the report verdict and Next line: 20 samples meet the registered sample-size floor but are llm-generated; use them to learn the statistical workflow, then review and replace them with real domain cases before release.',
+        zh: '  2. 看报告里的 verdict 和“下一步”：20 条用例达到默认启发式证据下限，但不等于完成先验功效规划；其来源是 llm-generated，发布前应人工复核并替换为真实领域用例。',
+        en: '  2. Read the report verdict and Next line: 20 samples meet the default heuristic evidence floor, not an a priori power plan; they are llm-generated and must be reviewed or replaced with real domain cases before release.',
     },
     'cli.init.next_step_executor': {
         zh: '     executor / judge 会按运行环境选择；Codex 任务自动使用本机 Codex 配置。也可用 OMK_EXECUTOR / OMK_MODEL 固定环境偏好，详见 https://oh-my-knowledge.pages.dev/zh/reference/executors。',

package/dist/cli/lib/i18n-dict/run.js

@@ -64,8 +64,8 @@ export const runDict = {
         en: '⚠ --bootstrap-samples "{value}" is invalid (expected an integer ≥ 100), falling back to 1000\n',
     },
     'cli.run.bootstrap_samples_too_large': {
-        zh: '⚠ --bootstrap-samples {n} 较大, 可能耗时数秒。1000 是业内标准, 通常已够用。\n',
-        en: '⚠ --bootstrap-samples {n} is large and may take several seconds. 1000 is the industry standard and usually sufficient.\n',
+        zh: '⚠ --bootstrap-samples {n} 较大，可能耗时数秒。有限重采样误差会单独进入显著性证据。\n',
+        en: '⚠ --bootstrap-samples {n} is large and may take several seconds. Finite-resampling error is reported separately in significance evidence.\n',
     },
     'cli.run.dry_run_no_scores': {
         zh: 'eval dry-run：仅预览任务，不检查分数。下一步：确认任务无误后，去掉 --dry-run 运行正式评测。',

package/dist/cli/lib/run-core-evaluation.js

@@ -45,6 +45,9 @@ function requestFor(input, projectRoot) {
             judgeMembers: input.config.judgeModels.map((judge) => ({
                 executorId: judge.executor,
                 model: judge.model,
+                ...(judge.deploymentRevision === undefined
+                    ? {}
+                    : { deploymentRevision: judge.deploymentRevision }),
             })),
             presentation: {
                 projectOutputDirectoryLocator: projectReportsDir(),

package/dist/cli/templates/init-samples.js

@@ -12,14 +12,13 @@ const INIT_CURATED_SAMPLES = [
         sample_id: 's001',
         prompt: '审查以下代码',
         context: "function authenticate(username, password) {\n  const query = `SELECT * FROM users WHERE name='${username}' AND pass='${password}'`;\n  return db.execute(query);\n}",
-        rubric: '满分标准：必须识别 SQL 注入风险、说明攻击影响、给出参数化查询修复，并标注合理的严重程度。',
+        rubric: {
+            security: { criterion: '是否准确识别 SQL 注入漏洞并说明攻击影响', weight: 0.5 },
+            actionability: { criterion: '是否给出可直接采用的参数化查询修复', weight: 0.5 },
+        },
         assertions: [
             { type: 'contains', value: 'SQL', weight: 1 },
         ],
-        dimensions: {
-            security: '是否准确识别 SQL 注入漏洞并说明攻击影响',
-            actionability: '是否给出可直接采用的参数化查询修复',
-        },
         capability: ['security-review'],
         difficulty: 'easy',
         construct: 'quality',
@@ -29,14 +28,13 @@ const INIT_CURATED_SAMPLES = [
         sample_id: 's002',
         prompt: '审查以下代码',
         context: 'async function fetchData(url) {\n  const res = await fetch(url);\n  const data = await res.json();\n  return data;\n}',
-        rubric: '满分标准：必须覆盖网络异常、HTTP 错误状态和非 JSON 响应，并给出结构清晰的错误处理方案。',
+        rubric: {
+            robustness: { criterion: '是否覆盖主要失败路径并区分错误来源', weight: 0.5 },
+            actionability: { criterion: '是否给出完整且不过度复杂的修复方案', weight: 0.5 },
+        },
         assertions: [
             { type: 'regex', pattern: 'try[\\s\\S]*catch|res\\.ok|status', flags: 'i', weight: 1 },
         ],
-        dimensions: {
-            robustness: '是否覆盖主要失败路径并区分错误来源',
-            actionability: '是否给出完整且不过度复杂的修复方案',
-        },
         capability: ['robustness-review'],
         difficulty: 'easy',
         construct: 'quality',
@@ -46,15 +44,14 @@ const INIT_CURATED_SAMPLES = [
         sample_id: 's003',
         prompt: '审查以下代码',
         context: "function renderComment(comment) {\n  document.getElementById('output').innerHTML = '<p>' + comment + '</p>';\n}",
-        rubric: '满分标准：必须识别 XSS 风险、解释不可信输入如何进入 HTML，并建议 textContent 或可靠转义。',
+        rubric: {
+            security: { criterion: '是否准确识别 XSS 漏洞及其数据流', weight: 0.5 },
+            actionability: { criterion: '是否给出安全且适配当前场景的渲染方式', weight: 0.5 },
+        },
         assertions: [
             { type: 'contains', value: 'XSS', weight: 1 },
             { type: 'contains', value: 'innerHTML', weight: 0.5 },
         ],
-        dimensions: {
-            security: '是否准确识别 XSS 漏洞及其数据流',
-            actionability: '是否给出安全且适配当前场景的渲染方式',
-        },
         capability: ['security-review'],
         difficulty: 'easy',
         construct: 'quality',
@@ -64,14 +61,13 @@ const INIT_CURATED_SAMPLES = [
         sample_id: 's004',
         prompt: '审查以下代码',
         context: "import { exec } from 'node:child_process';\n\nexport function archive(name) {\n  exec(`tar -czf ${name}.tgz uploads/${name}`);\n}",
-        rubric: '满分标准：必须识别命令注入和参数边界问题，说明 shell 拼接风险，并给出不经 shell 的参数化调用方案。',
+        rubric: {
+            security: { criterion: '是否识别出模板字符串进入 shell 的命令注入路径', weight: 0.5 },
+            actionability: { criterion: '是否使用参数数组和输入约束消除注入面', weight: 0.5 },
+        },
         assertions: [
             { type: 'regex', pattern: 'execFile|spawn', flags: 'i', weight: 1 },
         ],
-        dimensions: {
-            security: '是否识别出模板字符串进入 shell 的命令注入路径',
-            actionability: '是否使用参数数组和输入约束消除注入面',
-        },
         capability: ['security-review'],
         difficulty: 'medium',
         construct: 'quality',
@@ -81,14 +77,13 @@ const INIT_CURATED_SAMPLES = [
         sample_id: 's005',
         prompt: '审查以下代码',
         context: "import { readFile } from 'node:fs/promises';\nimport { join } from 'node:path';\n\nexport async function download(req) {\n  return readFile(join('/srv/files', req.query.name));\n}",
-        rubric: '满分标准：必须识别目录穿越风险，解释简单 join 不能建立目录边界，并给出规范化后校验根目录的修复。',
+        rubric: {
+            security: { criterion: '是否识别编码、绝对路径和上级目录绕过风险', weight: 0.5 },
+            actionability: { criterion: '是否给出基于解析后路径的边界校验', weight: 0.5 },
+        },
         assertions: [
             { type: 'regex', pattern: 'resolve|normalize|relative', flags: 'i', weight: 1 },
         ],
-        dimensions: {
-            security: '是否识别编码、绝对路径和上级目录绕过风险',
-            actionability: '是否给出基于解析后路径的边界校验',
-        },
         capability: ['security-review'],
         difficulty: 'hard',
         construct: 'quality',
@@ -98,10 +93,9 @@ const INIT_CURATED_SAMPLES = [
         sample_id: 's006',
         prompt: '审查以下代码',
         context: "export async function findUser(db, email) {\n  return db.query('SELECT id, name FROM users WHERE email = ?', [email]);\n}",
-        rubric: '满分标准：应确认参数化查询已经隔离输入；可以提出有依据的次要建议，但不得虚构 SQL 注入漏洞。',
-        dimensions: {
-            precision: '是否避免把安全的参数化查询误报为注入漏洞',
-            reasoning: '是否区分确定缺陷、条件性风险和可选改进',
+        rubric: {
+            precision: { criterion: '是否避免把安全的参数化查询误报为注入漏洞', weight: 0.5 },
+            reasoning: { criterion: '是否区分确定缺陷、条件性风险和可选改进', weight: 0.5 },
         },
         capability: ['security-review'],
         difficulty: 'medium',
@@ -112,10 +106,9 @@ const INIT_CURATED_SAMPLES = [
         sample_id: 's007',
         prompt: '审查以下代码',
         context: 'function displayName(user) {\n  return user.profile.name.trim();\n}',
-        rubric: '满分标准：必须识别空值链路导致的运行时异常，说明哪些对象可能缺失，并给出契合业务语义的防御方案。',
-        dimensions: {
-            robustness: '是否完整定位 user、profile、name 的空值边界',
-            actionability: '是否给出默认值、显式校验或可选链的合理选择',
+        rubric: {
+            robustness: { criterion: '是否完整定位 user、profile、name 的空值边界', weight: 0.5 },
+            actionability: { criterion: '是否给出默认值、显式校验或可选链的合理选择', weight: 0.5 },
         },
         capability: ['robustness-review'],
         difficulty: 'easy',
@@ -126,14 +119,13 @@ const INIT_CURATED_SAMPLES = [
         sample_id: 's008',
         prompt: '审查以下代码',
         context: "export function loadConfig(raw) {\n  const config = JSON.parse(raw);\n  return config.database.host.toLowerCase();\n}",
-        rubric: '满分标准：必须区分 JSON 语法错误与结构不符合预期两类失败，并建议在使用前进行清晰的 schema 校验。',
+        rubric: {
+            robustness: { criterion: '是否覆盖解析失败和解析成功但结构错误两类路径', weight: 0.5 },
+            actionability: { criterion: '是否提供可定位字段问题的校验与错误信息', weight: 0.5 },
+        },
         assertions: [
             { type: 'contains', value: 'JSON.parse', weight: 1 },
         ],
-        dimensions: {
-            robustness: '是否覆盖解析失败和解析成功但结构错误两类路径',
-            actionability: '是否提供可定位字段问题的校验与错误信息',
-        },
         capability: ['robustness-review'],
         difficulty: 'medium',
         construct: 'quality',
@@ -143,14 +135,13 @@ const INIT_CURATED_SAMPLES = [
         sample_id: 's009',
         prompt: '审查以下代码',
         context: 'export async function getProfile(id) {\n  for (;;) {\n    try {\n      return await fetch(`/profiles/${id}`).then(r => r.json());\n    } catch {}\n  }\n}',
-        rubric: '满分标准：必须识别无限重试、吞掉错误、缺少超时与退避等问题，并给出有上限且可取消的重试策略。',
+        rubric: {
+            robustness: { criterion: '是否覆盖无限循环、错误可观测性和服务放大效应', weight: 0.5 },
+            actionability: { criterion: '是否给出上限、退避、超时和取消的完整策略', weight: 0.5 },
+        },
         assertions: [
             { type: 'contains', value: 'AbortController', weight: 1 },
         ],
-        dimensions: {
-            robustness: '是否覆盖无限循环、错误可观测性和服务放大效应',
-            actionability: '是否给出上限、退避、超时和取消的完整策略',
-        },
         capability: ['robustness-review'],
         difficulty: 'hard',
         construct: 'quality',
@@ -160,10 +151,9 @@ const INIT_CURATED_SAMPLES = [
         sample_id: 's010',
         prompt: '审查以下代码',
         context: "export async function loadUser(id, signal) {\n  const res = await fetch(`/users/${encodeURIComponent(id)}`, { signal });\n  if (!res.ok) throw new Error(`HTTP ${res.status}`);\n  return await res.json();\n}",
-        rubric: '满分标准：应认可现有编码、取消和状态检查；可指出 JSON 契约校验是条件性增强，但不得声称完全缺少错误处理。',
-        dimensions: {
-            precision: '是否避免否定代码已经具备的健壮性措施',
-            reasoning: '是否把确定事实与依赖业务上下文的增强建议分开',
+        rubric: {
+            precision: { criterion: '是否避免否定代码已经具备的健壮性措施', weight: 0.5 },
+            reasoning: { criterion: '是否把确定事实与依赖业务上下文的增强建议分开', weight: 0.5 },
         },
         capability: ['robustness-review'],
         difficulty: 'medium',
@@ -174,10 +164,9 @@ const INIT_CURATED_SAMPLES = [
         sample_id: 's011',
         prompt: '审查以下代码',
         context: 'function shippingFee(weight) {\n  if (weight > 30) return 999;\n  return weight * 7.35 + 12;\n}',
-        rubric: '满分标准：必须指出业务魔数和单位不透明造成的维护风险，并建议用有领域含义的常量或配置表达规则。',
-        dimensions: {
-            maintainability: '是否解释 30、999、7.35、12 的语义和变更风险',
-            actionability: '是否给出命名、单位和规则归位的具体方案',
+        rubric: {
+            maintainability: { criterion: '是否解释 30、999、7.35、12 的语义和变更风险', weight: 0.5 },
+            actionability: { criterion: '是否给出命名、单位和规则归位的具体方案', weight: 0.5 },
         },
         capability: ['maintainability-review'],
         difficulty: 'easy',
@@ -188,10 +177,9 @@ const INIT_CURATED_SAMPLES = [
         sample_id: 's012',
         prompt: '审查以下代码',
         context: "function createUser(input) {\n  if (!input.email.includes('@')) throw new Error('bad email');\n  return db.users.insert(input);\n}\nfunction updateUser(input) {\n  if (!input.email.includes('@')) throw new Error('bad email');\n  return db.users.update(input);\n}",
-        rubric: '满分标准：必须识别重复且薄弱的校验逻辑，说明规则漂移风险，并建议抽取单一、可测试的验证边界。',
-        dimensions: {
-            maintainability: '是否识别重复逻辑与未来规则不一致的风险',
-            actionability: '是否提出职责清晰、易测试且不过度抽象的重构',
+        rubric: {
+            maintainability: { criterion: '是否识别重复逻辑与未来规则不一致的风险', weight: 0.5 },
+            actionability: { criterion: '是否提出职责清晰、易测试且不过度抽象的重构', weight: 0.5 },
         },
         capability: ['maintainability-review'],
         difficulty: 'medium',
@@ -202,10 +190,9 @@ const INIT_CURATED_SAMPLES = [
         sample_id: 's013',
         prompt: '审查以下代码',
         context: "export async function completeOrder(order, user) {\n  if (!user.admin && user.id !== order.userId) throw new Error('forbidden');\n  order.status = 'complete';\n  await db.orders.save(order);\n  await mail.send(user.email, renderReceipt(order));\n  metrics.increment('orders.complete');\n  return JSON.stringify(order);\n}",
-        rubric: '满分标准：必须识别授权、状态变更、持久化、通知、指标和序列化混在单函数中的耦合，并提出保留事务语义的拆分。',
-        dimensions: {
-            maintainability: '是否识别职责耦合以及失败时产生的部分完成状态',
-            actionability: '是否在拆分职责的同时保留事务和副作用顺序',
+        rubric: {
+            maintainability: { criterion: '是否识别职责耦合以及失败时产生的部分完成状态', weight: 0.5 },
+            actionability: { criterion: '是否在拆分职责的同时保留事务和副作用顺序', weight: 0.5 },
         },
         capability: ['maintainability-review'],
         difficulty: 'hard',
@@ -216,14 +203,13 @@ const INIT_CURATED_SAMPLES = [
         sample_id: 's014',
         prompt: '审查以下代码',
         context: 'function renderReport(data, compact, includeHeader, sortDescending, useUtc) {\n  // formatting logic\n}',
-        rubric: '满分标准：必须指出多个布尔位置参数难以理解和扩展，并建议使用命名 options 对象及合理默认值。',
+        rubric: {
+            maintainability: { criterion: '是否解释调用点可读性和新增选项时的演进问题', weight: 0.5 },
+            actionability: { criterion: '是否给出类型明确且可兼容默认值的参数设计', weight: 0.5 },
+        },
         assertions: [
             { type: 'contains', value: 'options', weight: 1 },
         ],
-        dimensions: {
-            maintainability: '是否解释调用点可读性和新增选项时的演进问题',
-            actionability: '是否给出类型明确且可兼容默认值的参数设计',
-        },
         capability: ['maintainability-review'],
         difficulty: 'medium',
         construct: 'quality',
@@ -233,10 +219,9 @@ const INIT_CURATED_SAMPLES = [
         sample_id: 's015',
         prompt: '审查以下代码',
         context: 'export function clamp(value, min, max) {\n  return Math.min(max, Math.max(min, value));\n}',
-        rubric: '满分标准：应认可实现对普通数值输入足够简洁；可以询问 min 大于 max 或 NaN 的业务约定，但不得强行引入复杂架构。',
-        dimensions: {
-            precision: '是否避免为了展示审查深度而虚构维护性问题',
-            proportionality: '建议的复杂度是否与这个小型纯函数相称',
+        rubric: {
+            precision: { criterion: '是否避免为了展示审查深度而虚构维护性问题', weight: 0.5 },
+            proportionality: { criterion: '建议的复杂度是否与这个小型纯函数相称', weight: 0.5 },
         },
         capability: ['maintainability-review'],
         difficulty: 'easy',
@@ -247,14 +232,13 @@ const INIT_CURATED_SAMPLES = [
         sample_id: 's016',
         prompt: '审查以下代码',
         context: 'export async function listOrders(users) {\n  const rows = [];\n  for (const user of users) {\n    rows.push(...await db.orders.findByUser(user.id));\n  }\n  return rows;\n}',
-        rubric: '满分标准：必须识别循环内逐用户查询形成的 N+1 和串行等待，并建议批量查询或有边界的并发方案。',
+        rubric: {
+            performance: { criterion: '是否识别查询次数和串行延迟随用户数增长的问题', weight: 0.5 },
+            actionability: { criterion: '是否给出符合数据库边界的批量读取方案', weight: 0.5 },
+        },
         assertions: [
             { type: 'contains', value: 'N+1', weight: 1 },
         ],
-        dimensions: {
-            performance: '是否识别查询次数和串行延迟随用户数增长的问题',
-            actionability: '是否给出符合数据库边界的批量读取方案',
-        },
         capability: ['performance-review'],
         difficulty: 'easy',
         construct: 'quality',
@@ -264,14 +248,13 @@ const INIT_CURATED_SAMPLES = [
         sample_id: 's017',
         prompt: '审查以下代码',
         context: 'export async function hydrate(ids) {\n  const result = [];\n  for (const id of ids) {\n    result.push(await fetch(`/items/${id}`).then(r => r.json()));\n  }\n  return result;\n}',
-        rubric: '满分标准：必须指出无依赖请求被串行化的延迟问题，同时说明无限 Promise.all 的压力，并给出受控并发方案。',
+        rubric: {
+            performance: { criterion: '是否同时看见串行瓶颈和无界并发的反向风险', weight: 0.5 },
+            actionability: { criterion: '是否给出可调并发度、错误策略和顺序语义', weight: 0.5 },
+        },
         assertions: [
             { type: 'contains', value: 'Promise.all', weight: 1 },
         ],
-        dimensions: {
-            performance: '是否同时看见串行瓶颈和无界并发的反向风险',
-            actionability: '是否给出可调并发度、错误策略和顺序语义',
-        },
         capability: ['performance-review'],
         difficulty: 'medium',
         construct: 'quality',
@@ -281,14 +264,13 @@ const INIT_CURATED_SAMPLES = [
         sample_id: 's018',
         prompt: '审查以下代码',
         context: 'function commonIds(left, right) {\n  return left.filter(item => right.some(other => other.id === item.id));\n}',
-        rubric: '满分标准：必须识别双层扫描的时间复杂度，说明数据规模前提，并建议用 Set 或 Map 建立线性查找索引。',
+        rubric: {
+            performance: { criterion: '是否准确分析时间复杂度而不是泛泛声称性能差', weight: 0.5 },
+            actionability: { criterion: '是否根据唯一性和内存取舍选择合适索引结构', weight: 0.5 },
+        },
         assertions: [
             { type: 'regex', pattern: 'Set|Map', weight: 1 },
         ],
-        dimensions: {
-            performance: '是否准确分析时间复杂度而不是泛泛声称性能差',
-            actionability: '是否根据唯一性和内存取舍选择合适索引结构',
-        },
         capability: ['performance-review'],
         difficulty: 'hard',
         construct: 'quality',
@@ -298,10 +280,9 @@ const INIT_CURATED_SAMPLES = [
         sample_id: 's019',
         prompt: '审查以下代码',
         context: 'const cache = new Map();\nexport async function resolveTenant(id) {\n  if (!cache.has(id)) cache.set(id, await loadTenant(id));\n  return cache.get(id);\n}',
-        rubric: '满分标准：必须识别多租户键空间下缓存无限增长和并发重复加载风险，并给出容量、淘汰与请求合并策略。',
-        dimensions: {
-            performance: '是否覆盖内存增长与并发 cache miss 两个独立问题',
-            actionability: '是否给出与数据新鲜度和容量约束匹配的缓存策略',
+        rubric: {
+            performance: { criterion: '是否覆盖内存增长与并发 cache miss 两个独立问题', weight: 0.5 },
+            actionability: { criterion: '是否给出与数据新鲜度和容量约束匹配的缓存策略', weight: 0.5 },
         },
         capability: ['performance-review'],
         difficulty: 'hard',
@@ -312,10 +293,9 @@ const INIT_CURATED_SAMPLES = [
         sample_id: 's020',
         prompt: '审查以下代码',
         context: 'export function indexById(items) {\n  const index = new Map();\n  for (const item of items) index.set(item.id, item);\n  return index;\n}',
-        rubric: '满分标准：应认可这是清晰的线性构建过程；可以说明重复 id 的覆盖语义，但不得虚构嵌套循环或明显性能瓶颈。',
-        dimensions: {
-            precision: '是否避免把正常的 O(n) 工作误报为性能缺陷',
-            reasoning: '是否把重复键语义作为条件性业务问题而非确定 bug',
+        rubric: {
+            precision: { criterion: '是否避免把正常的 O(n) 工作误报为性能缺陷', weight: 0.5 },
+            reasoning: { criterion: '是否把重复键语义作为条件性业务问题而非确定 bug', weight: 0.5 },
         },
         capability: ['performance-review'],
         difficulty: 'medium',