a207-policy 0.2.0__tar.gz

a207_policy-0.2.0/PKG-INFO

@@ -0,0 +1,28 @@
+Metadata-Version: 2.4
+Name: a207-policy
+Version: 0.2.0
+Summary: A207 统一身份注入 / 权限矩阵 / 状态路径策略包（Plan A 单一事实源）
+Requires-Python: >=3.10
+Description-Content-Type: text/markdown
+
+# a207-policy
+
+A207 统一身份注入 / 权限矩阵 / 状态路径策略包（Plan A 单一事实源）。
+
+13 个 MCP 统一依赖本包，取代原先散落在 M1/M2/M4/M11/M13 的多份权限副本。
+
+## 用法
+
+```python
+from a207_policy import get_caller, enforce_read, enforce_write, LIS_READ_FULL
+
+def get_labs(patient_id: str) -> dict:
+    caller = get_caller()                 # 来自 env A207_CALLER，模型碰不到
+    enforce_read("a207-lis-mcp")          # 确定性拒绝越权（fail-closed）
+    ...
+```
+
+- 身份注入：`A207_CALLER` 环境变量由部署配置写入，模型无法自证（修复 P0-1）。
+- 测试：`from a207_policy import set_caller; set_caller("doctor_assistant")`。
+- 状态路径：`from a207_policy import resolve_state_path; resolve_state_path("followup_store.json")`
+  落到 `A207_DATA_DIR` 或系统临时目录，避免只读安装目录崩溃（修复 P1-3）。

a207_policy-0.2.0/README.md

@@ -0,0 +1,21 @@
+# a207-policy
+
+A207 统一身份注入 / 权限矩阵 / 状态路径策略包（Plan A 单一事实源）。
+
+13 个 MCP 统一依赖本包，取代原先散落在 M1/M2/M4/M11/M13 的多份权限副本。
+
+## 用法
+
+```python
+from a207_policy import get_caller, enforce_read, enforce_write, LIS_READ_FULL
+
+def get_labs(patient_id: str) -> dict:
+    caller = get_caller()                 # 来自 env A207_CALLER，模型碰不到
+    enforce_read("a207-lis-mcp")          # 确定性拒绝越权（fail-closed）
+    ...
+```
+
+- 身份注入：`A207_CALLER` 环境变量由部署配置写入，模型无法自证（修复 P0-1）。
+- 测试：`from a207_policy import set_caller; set_caller("doctor_assistant")`。
+- 状态路径：`from a207_policy import resolve_state_path; resolve_state_path("followup_store.json")`
+  落到 `A207_DATA_DIR` 或系统临时目录，避免只读安装目录崩溃（修复 P1-3）。

a207_policy-0.2.0/pyproject.toml

@@ -0,0 +1,16 @@
+[build-system]
+requires = ["setuptools>=61"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "a207-policy"
+version = "0.2.0"
+description = "A207 统一身份注入 / 权限矩阵 / 状态路径策略包（Plan A 单一事实源）"
+requires-python = ">=3.10"
+readme = "README.md"
+
+[tool.setuptools]
+package-dir = {"" = "src"}
+
+[tool.setuptools.packages.find]
+where = ["src"]

a207_policy-0.2.0/setup.cfg

@@ -0,0 +1,4 @@
+[egg_info]
+tag_build = 
+tag_date = 0
+

a207_policy-0.2.0/src/a207_policy/__init__.py

@@ -0,0 +1,89 @@
+"""a207-policy —— A207 统一身份注入 / 权限矩阵 / 状态路径策略包。
+
+Plan A 单一事实源。13 个 MCP 统一依赖本包：
+- caller 注入（env A207_CALLER，fail-closed）→ get_caller / set_caller
+- 权限矩阵 + MX-3 写权 + 各包放行集合 → matrix 模块
+- 确定性执行 → enforce_read / enforce_write / check_permission / knowledge_profile
+- 可写状态路径 → resolve_state_path
+
+调用方（各 MCP 工具）应在函数入口：caller = get_caller(); access = enforce_read("a207-xxx-mcp")
+取代原先「caller 是 LLM 自己填的参数」的旧模式（P0-1 修复）。
+"""
+
+from __future__ import annotations
+
+from .caller import CallerError, CallerUnknown, as_caller, get_caller, set_caller
+from .gate import (
+    PermissionDenied,
+    _MATRIX_EXEMPT_WRITE_TOOLS,
+    check_permission,
+    detect_write_tool,
+    enforce_nutrition_tool,
+    enforce_read,
+    enforce_write,
+    is_write_action,
+    knowledge_profile,
+)
+from .matrix import (
+    ACCESS_LIMITED,
+    ACCESS_NONE,
+    ACCESS_RW,
+    ACCESS_READ,
+    CALLERS,
+    CHILD_FORBIDDEN_MCPS,
+    CLINICAL_CALC_MCP,
+    CLINICIAN_ONLY_FIELDS,
+    CLINICIAN_ONLY_HIDDEN_FROM,
+    GAMIFICATION_MCP,
+    FOLLOWUP_CLINICIAN,
+    FOLLOWUP_WRITE_ALLOWED,
+    GAMIFICATION_ALLOWED,
+    HIS_ALLOWED_FILTER_KEYS,
+    HIS_BLOCKED,
+    HIS_COHORT,
+    HIS_FULL_VIEW,
+    HIS_LIMITED,
+    HIS_READ,
+    KNOWLEDGE_PROFILE,
+    LIS_CRITICAL_CHANNEL,
+    LIS_READ_FULL,
+    LIS_READ_LIMITED,
+    LIS_WRITE_ALLOWED,
+    MCP_ALIASES,
+    MCP_REGISTRY,
+    MX1_BLOCKED_CALLERS,
+    NOTIFY_READ_ROLES,
+    NOTIFY_WRITE_ROLES,
+    NUTRITION_ASSESSMENT_CLINICAL_ROLES,
+    NUTRITION_ASSESSMENT_CLINICAL_TOOLS,
+    NUTRITION_ASSESSMENT_DATA_ROLES,
+    NUTRITION_ASSESSMENT_DATA_TOOLS,
+    NUTRITION_ASSESSMENT_WRITE_ALLOWED,
+    PERMISSION_MATRIX,
+    WRITE_TOOL_ALIASES,
+    WRITE_TOOL_POLICY,
+    normalize_mcp,
+    resolve_access,
+)
+from .state import resolve_state_path
+
+__all__ = [
+    "CallerError", "CallerUnknown", "as_caller", "get_caller", "set_caller",
+    "PermissionDenied", "check_permission", "detect_write_tool",
+    "enforce_nutrition_tool", "enforce_read", "enforce_write", "is_write_action",
+    "knowledge_profile", "_MATRIX_EXEMPT_WRITE_TOOLS",
+    "ACCESS_NONE", "ACCESS_READ", "ACCESS_LIMITED", "ACCESS_RW",
+    "CALLERS", "CHILD_FORBIDDEN_MCPS", "CLINICAL_CALC_MCP", "CLINICIAN_ONLY_FIELDS",
+    "CLINICIAN_ONLY_HIDDEN_FROM",
+    "GAMIFICATION_MCP",
+    "FOLLOWUP_CLINICIAN", "FOLLOWUP_WRITE_ALLOWED", "GAMIFICATION_ALLOWED",
+    "HIS_ALLOWED_FILTER_KEYS", "HIS_BLOCKED", "HIS_COHORT", "HIS_FULL_VIEW",
+    "HIS_LIMITED", "HIS_READ", "KNOWLEDGE_PROFILE",
+    "LIS_CRITICAL_CHANNEL", "LIS_READ_FULL", "LIS_READ_LIMITED", "LIS_WRITE_ALLOWED",
+    "MCP_ALIASES", "MCP_REGISTRY", "MX1_BLOCKED_CALLERS",
+    "NOTIFY_READ_ROLES", "NOTIFY_WRITE_ROLES", "NUTRITION_ASSESSMENT_WRITE_ALLOWED",
+    "NUTRITION_ASSESSMENT_DATA_TOOLS", "NUTRITION_ASSESSMENT_DATA_ROLES",
+    "NUTRITION_ASSESSMENT_CLINICAL_TOOLS", "NUTRITION_ASSESSMENT_CLINICAL_ROLES",
+    "PERMISSION_MATRIX", "WRITE_TOOL_ALIASES", "WRITE_TOOL_POLICY",
+    "normalize_mcp", "resolve_access", "resolve_state_path",
+]

a207_policy-0.2.0/src/a207_policy/caller.py

@@ -0,0 +1,95 @@
+"""身份注入（A1 核心）。
+
+设计要点（对照架构复盘 P0-1）：
+- 旧方案：caller 是 LLM 自己填的工具参数 → 模型可被提示词注入冒充医生。
+- 新方案：caller 来自**部署时注入的环境变量 A207_CALLER**，模型碰不到。
+  每个 Agent 用各自连接配置启动 MCP 服务端时写入该变量（如家长助手配置写死
+  A207_CALLER=parent_assistant），服务端进程内读取，fail-closed：缺失即拒绝。
+
+stdio 部署：启动子进程时由连接配置 setenv。
+HTTP/SSE 部署（将来）：网关在会话建立时把身份写入请求上下文，服务端从上下文读取；
+本模块保留 get_caller() 单一入口，将来只需在 HTTP 分支扩展，调用方代码不变。
+"""
+
+from __future__ import annotations
+
+import os
+from contextlib import contextmanager
+from typing import Iterator, Optional
+
+ENV_KEY = "A207_CALLER"
+
+# 测试覆盖位（仅测试用）。生产代码严禁调用 set_caller。
+_test_override: Optional[str] = None
+
+
+class CallerError(Exception):
+    """权限/身份相关错误的基类。"""
+
+
+class CallerUnknown(CallerError):
+    """caller 未注入（环境变量缺失或为空）→ fail-closed 拒绝。"""
+
+
+def get_caller() -> str:
+    """返回当前进程注入的调用方身份。缺失或空 → 抛 CallerUnknown（fail-closed）。
+
+    生产环境：读取环境变量 A207_CALLER。
+    测试环境：若已调用 set_caller()，返回覆盖值（便于单测，不依赖环境变量）。
+    """
+    if _test_override is not None:
+        return _test_override
+    value = (os.environ.get(ENV_KEY) or "").strip()
+    if not value:
+        raise CallerUnknown(
+            f"caller 未注入：环境变量 {ENV_KEY} 缺失或为空。"
+            f"服务端必须由部署配置注入身份，模型不可自证身份（P0-1 修复）。"
+        )
+    return value
+
+
+def set_caller(value: Optional[str]) -> None:
+    """仅用于测试：覆盖 caller 来源。生产代码不得调用。"""
+    global _test_override
+    _test_override = value
+
+
+@contextmanager
+def as_caller(value: Optional[str]) -> Iterator[None]:
+    """仅用于测试：在代码块内临时切换身份，退出时**一定**还原（异常也还原）。
+
+    为什么需要它
+    ------------
+    真实部署里一个进程只有一个身份（部署配置写死），所以生产代码永远用不到这个。
+    但端到端联调要模拟"医生录检验 → 风险引擎评估 → 通知发家长 → 孩子打卡"
+    这样跨角色的完整链路，必须能逐步换身份，否则测不出真实的权限交接。
+
+    手写 set_caller + try/finally 也能做，但漏写 finally 就会污染后续用例，
+    而且那种污染很隐蔽——后面的用例莫名其妙有了不该有的权限，还看不出为什么。
+    所以固化成上下文管理器，用法上不给人犯错的机会。
+
+        with as_caller("doctor_assistant"):
+            core.upsert_lab_result(...)
+        with as_caller("parent_assistant"):
+            core.get_labs(...)      # 自动换回受限视图
+
+    传 None 表示"模拟身份完全缺失"，用来测 fail-closed。注意这里必须同时清掉
+    环境变量——只把 _test_override 置 None 的话，get_caller 会回退去读 env，
+    结果身份还在，fail-closed 测了个寂寞。这个坑很容易踩，所以封在里面。
+    """
+    global _test_override
+    prev_override = _test_override
+    prev_env = os.environ.get(ENV_KEY)
+    if value is None:
+        _test_override = None
+        os.environ.pop(ENV_KEY, None)
+    else:
+        _test_override = value
+    try:
+        yield
+    finally:
+        _test_override = prev_override
+        if prev_env is None:
+            os.environ.pop(ENV_KEY, None)
+        else:
+            os.environ[ENV_KEY] = prev_env

a207_policy-0.2.0/src/a207_policy/gate.py

@@ -0,0 +1,229 @@
+"""权限执行点（确定性，非 LLM 可选）。
+
+- check_permission：保留 M13 兼容的返回形态（dict），供路由层查表。
+- enforce_read / enforce_write：供各 MCP 工具在入口处调用，放行返回 access 字符串，
+  拒绝抛 PermissionDenied（确定性，模型无法绕过 —— 解决 P0-2 门禁虚设的根因：
+  校验不再依赖 LLM「自觉」调用某个 gate 工具，而是每个工具内强制）。
+- detect_write_tool / is_write_action：MX-3 写工具识别。
+"""
+
+from __future__ import annotations
+
+import re
+
+from .caller import CallerError, get_caller
+from .matrix import (
+    ACCESS_RW,
+    CALLERS,
+    KNOWLEDGE_PROFILE,
+    NUTRITION_ASSESSMENT_CLINICAL_ROLES,
+    NUTRITION_ASSESSMENT_CLINICAL_TOOLS,
+    NUTRITION_ASSESSMENT_DATA_ROLES,
+    NUTRITION_ASSESSMENT_DATA_TOOLS,
+    NUTRITION_ASSESSMENT_WRITE_ALLOWED,
+    PERMISSION_MATRIX,
+    WRITE_TOOL_POLICY,
+    WRITE_TOOL_ALIASES,
+    normalize_mcp,
+    resolve_access,
+)
+
+_ALIASES = WRITE_TOOL_ALIASES  # 别名引用，保持 detect_write_tool 可读
+
+_NOTIFY_RE = re.compile(r"notify_[a-z_]+")
+_UNDERSCORE_PREFIXES = tuple(p for p in (
+    "write", "create", "update", "delete", "insert",
+    "upsert_", "notify_", "log_", "award_", "push_", "trigger_",
+    "close_", "schedule_", "save_",
+) if p.endswith("_"))
+
+# OD-010 选项 A（已落地）：M3 是「计算+数据」混合包，工具级 ACL（enforce_nutrition_tool）
+# 在矩阵（MCP 粒度）之下做细分授权：
+#   - upsert_food_diary（写日记）：仅家长/患儿，比矩阵 M3×家长=RL 更宽 → 豁免矩阵 R/W 校验
+#   - record_pew_risk（落 PEW 历史）：仅临床角色，比矩阵 M3×临床=READ 更宽 → 豁免矩阵 R/W 校验
+# 这两个写工具是「工具级白名单治理」的有意例外，红队 B7b 亦据此跳过（见 tests/red_team_probe.py）。
+_MATRIX_EXEMPT_WRITE_TOOLS: frozenset[str] = frozenset(
+    {"upsert_food_diary", "record_pew_risk"})
+
+
+class PermissionDenied(CallerError):
+    """确定性拒绝。携带足够信息供工具转成各包既有 forbidden 形态。"""
+
+    def __init__(self, caller: str, mcp: str, action: str, reason: str):
+        self.caller = caller
+        self.mcp = mcp
+        self.action = action
+        self.reason = reason
+        super().__init__(f"DENIED {caller} -> {mcp}:{action} : {reason}")
+
+
+def detect_write_tool(text: str) -> str | None:
+    """从 intent/action 文本中识别已登记的写工具，识别不到返回 None。"""
+    lowered = (text or "").strip().lower()
+    if not lowered:
+        return None
+    for tool in sorted(WRITE_TOOL_POLICY, key=len, reverse=True):
+        if tool in lowered:
+            return tool
+    for alias, tool in sorted(_ALIASES.items(), key=lambda kv: len(kv[0]), reverse=True):
+        if alias in lowered:
+            return tool
+    if _NOTIFY_RE.search(lowered):
+        return "notify_physician"
+    return None
+
+
+def is_write_action(action: str) -> bool:
+    lowered = (action or "").strip().lower()
+    if any(lowered.startswith(prefix) for prefix in (
+        "write", "create", "update", "delete", "insert")):
+        return True
+    if any(prefix in lowered for prefix in _UNDERSCORE_PREFIXES):
+        return True
+    return any(hint in lowered for hint in ("写入", "写回", "新增一条", "保存到", "提交写"))
+
+
+def check_permission(caller: str, mcp: str, action: str = "read") -> dict:
+    """M13 兼容查表：返回 {allow, access, resolved_action, reason, ...}。"""
+    caller_id = (caller or "").strip()
+    mcp_id = normalize_mcp(mcp)
+    action_id = (action or "read").strip()
+
+    if caller_id not in CALLERS:
+        return _perm(False, "-", "read", f"caller={caller_id or '(空)'} 未在权限矩阵登记")
+    if mcp_id not in PERMISSION_MATRIX:
+        return _perm(False, "-", "read", f"mcp={mcp_id or '(空)'} 不在 13 个已登记 MCP 内")
+
+    access = PERMISSION_MATRIX[mcp_id][caller_id]
+    tool = detect_write_tool(action_id)
+    if tool:
+        return _check_write_tool(caller_id, mcp_id, access, tool)
+
+    is_write = is_write_action(action_id)
+    allow = resolve_access(access, is_write)
+    kind = "write" if is_write else "read"
+    verdict = "放行" if allow else "拒绝"
+    return _perm(allow, access, kind, f"矩阵 {mcp_id} x {caller_id} = {access}，{kind} 请求{verdict}")
+
+
+def _check_write_tool(caller_id: str, mcp_id: str, access: str, tool: str) -> dict:
+    policy = WRITE_TOOL_POLICY.get(tool)
+    if policy is None:
+        # 未登记的写工具名：回到读写二分
+        allow = resolve_access(access, True)
+        return _perm(allow, access, "write",
+                     f"未登记写工具 {tool}，按矩阵 {mcp_id} x {caller_id} = {access} 判定")
+    owner_mcp = str(policy["mcp"])
+    allowed: frozenset[str] = policy["allowed"]
+    if mcp_id != owner_mcp:
+        return _perm(False, access, "write",
+                     f"写工具 {tool} 属于 {owner_mcp}，与 mcp={mcp_id} 不一致")
+    if caller_id not in allowed:
+        return _perm(False, access, "write",
+                     f"MX-3 写权收口：{tool} 仅允许 {'/'.join(sorted(allowed))}，"
+                     f"当前 caller={caller_id}")
+    return _perm(True, access, "write", f"MX-3 放行：{tool} 由 {caller_id} 执行",
+                 tool=tool, requires_confirmation=bool(policy["requires_confirmation"]))
+
+
+def _perm(allow: bool, access: str, resolved_action: str, reason: str, *,
+          tool: str | None = None, requires_confirmation: bool = False) -> dict:
+    return {
+        "allow": allow,
+        "access": access,
+        "resolved_action": resolved_action,
+        "reason": reason,
+        "write_tool": tool,
+        "requires_confirmation": requires_confirmation,
+        "limited_view": access == "RL",
+    }
+
+
+def enforce_read(mcp_name: str) -> str:
+    """入口守卫：caller 是否可读 mcp_name。放行返回 access（R/RL/RW），拒绝抛 PermissionDenied。"""
+    return _enforce(mcp_name, "read")
+
+
+def enforce_write(mcp_name: str, tool: str | None = None) -> str:
+    """入口守卫：caller 是否可写 mcp_name（tool 为写工具名时走 MX-3）。"""
+    return _enforce(mcp_name, tool or "write")
+
+
+def enforce_nutrition_tool(caller: str, tool: str) -> str:
+    """M3 工具级授权（OD-010 选项 A）：数据面写仅家长/患儿，数据面读 + 计算面仅临床角色。
+
+    M3 是「计算 + 数据」混合包。矩阵对 M3 仅做 MCP 粒度授权（家长/患儿=RL、临床=READ、
+    orchestrator=R/W），无法表达"同包内某些工具家长能写、某些只能临床角色算"。
+    故在此做工具级细分（单一事实源在 matrix 模块）：
+    - 数据面·写 upsert_food_diary：仅家长/患儿（与 MX-3 WRITE_TOOL_POLICY /
+      core._WRITE_ALLOWED_CALLERS 一致，单一事实源）
+    - 数据面·读 get_food_diary_summary：家长/患儿/临床角色（临床需读日记做评估）
+    - 计算面·临床判读/落库（calc_prnt_targets / assess_intake_vs_target / assess_pew_risk /
+      calc_growth_zscore / record_pew_risk / get_pew_history）：仅 doctor/nutritionist/orchestrator
+    未登记工具 fail-closed 拒绝。caller 为已校验身份字符串（由调用方经 get_caller() 取得）。
+    """
+    if caller not in CALLERS:
+        raise PermissionDenied(
+            caller, "a207-nutrition-assessment-mcp", tool, "caller 未登记")
+    # 数据面·写：饮食日记写入仅家长/患儿（与 MX-3 写权收口一致，单一事实源）
+    if tool == "upsert_food_diary":
+        if caller in NUTRITION_ASSESSMENT_WRITE_ALLOWED:
+            return "RL"
+        raise PermissionDenied(
+            caller, "a207-nutrition-assessment-mcp", tool,
+            "饮食日记写入仅限家长/患儿")
+    # 数据面·读：日记摘要家长/患儿/临床角色可读
+    if tool in NUTRITION_ASSESSMENT_DATA_TOOLS:
+        if caller in NUTRITION_ASSESSMENT_DATA_ROLES:
+            return "RL"
+        raise PermissionDenied(
+            caller, "a207-nutrition-assessment-mcp", tool,
+            "日记摘要仅限家长/患儿/临床角色")
+    # 计算面·临床判读/落库：仅临床角色
+    if tool in NUTRITION_ASSESSMENT_CLINICAL_TOOLS:
+        if caller in NUTRITION_ASSESSMENT_CLINICAL_ROLES:
+            return PERMISSION_MATRIX["a207-nutrition-assessment-mcp"][caller]
+        raise PermissionDenied(
+            caller, "a207-nutrition-assessment-mcp", tool,
+            "计算面工具仅限临床角色(doctor/nutritionist/orchestrator)")
+    raise PermissionDenied(
+        caller, "a207-nutrition-assessment-mcp", tool, f"未登记工具: {tool}")
+
+
+def _enforce(mcp_name: str, action: str) -> str:
+    caller = get_caller()
+    if caller not in CALLERS:
+        raise PermissionDenied(caller, mcp_name, action, f"caller 未登记: {caller}")
+    mcp = normalize_mcp(mcp_name)
+    if mcp not in PERMISSION_MATRIX:
+        raise PermissionDenied(caller, mcp_name, action, "mcp 未登记")
+    access = PERMISSION_MATRIX[mcp][caller]
+
+    wt = detect_write_tool(action) if action != "read" else None
+    if wt:
+        policy = WRITE_TOOL_POLICY.get(wt)
+        if policy is None:
+            if not resolve_access(access, True):
+                raise PermissionDenied(caller, mcp, action, f"access={access} 不允许写")
+        elif mcp != policy["mcp"] or caller not in policy["allowed"]:
+            raise PermissionDenied(caller, mcp, action, f"MX-3 写权受限: {wt}")
+        else:
+            # OD-011：登记写工具额外回查矩阵 R/W（OD-010 待决豁免除外），确保矩阵为唯一事实源。
+            # 例：notify_* 仅 risk_warning=R/W 可写；push_to_emr 仅 doctor=R/W（即便 nutritionist 同有 R/W 仍按工具白名单收口）。
+            if wt not in _MATRIX_EXEMPT_WRITE_TOOLS:
+                owner = policy["mcp"]
+                if PERMISSION_MATRIX[owner][caller] != ACCESS_RW:
+                    raise PermissionDenied(
+                        caller, owner, action,
+                        f"矩阵 {owner} x {caller} = {PERMISSION_MATRIX[owner][caller]}，无 R/W，拒绝 {wt}")
+    else:
+        is_write = action != "read"
+        if not resolve_access(access, is_write):
+            raise PermissionDenied(caller, mcp, action,
+                                   f"access={access} 不允许 {action}")
+    return access
+
+
+def knowledge_profile(caller: str) -> str:
+    """M12 按 caller 切语料 profile。"""
+    return KNOWLEDGE_PROFILE.get((caller or "").strip(), "none")

a207_policy-0.2.0/src/a207_policy/matrix.py

@@ -0,0 +1,347 @@
+"""权限矩阵 / 写权策略 / 各包放行集合 —— A207 唯一事实源（Plan A 收口位置）。
+
+本模块取代原先散落在 M1/M2/M4/M11/M13 的多份权限副本（架构复盘 P1-1 指出的漂移源）。
+所有 MCP 从这里 import，不再各自维护一份。
+
+注意：本模块**只固化数据**，不擅自改变「谁能做什么」。各包本地守卫逻辑保留，
+只是把 caller 来源改成 env 注入、把放行集合改成从本模块 import。
+矩阵值 = 需求文档 §7 + MX-3 写权收口；各包本地集合 = 当前实际生效范围（已核对代码）。
+"""
+
+from __future__ import annotations
+
+# ---------------------------------------------------------------- 角色与 MCP
+
+CALLERS: tuple[str, ...] = (
+    "orchestrator",
+    "doctor_assistant",
+    "nutritionist",
+    "parent_assistant",
+    "child_companion",
+    "risk_warning",
+)
+
+MCP_REGISTRY: dict[str, str] = {
+    "a207-his-mcp": "M1",
+    "a207-lis-mcp": "M2",
+    "a207-nutrition-assessment-mcp": "M3",
+    "a207-followup-mcp": "M4",
+    "a207-nutrition-calc-mcp": "M5",
+    "a207-ckd-clinical-calc-mcp": "M6",
+    "a207-meal-plan-mcp": "M7",
+    "a207-risk-rules-mcp": "M8",
+    "a207-report-mcp": "M9",
+    "a207-notify-mcp": "M10",
+    "a207-gamification-mcp": "M11",
+    "a207-knowledge-mcp": "M12",
+    "a207-router-mcp": "M13",
+}
+
+GAMIFICATION_MCP = "a207-gamification-mcp"
+CLINICAL_CALC_MCP = "a207-ckd-clinical-calc-mcp"
+
+# 包名别名归一（OD-002）：登记表沿用早期命名，实际交付目录/PyPI 包名已变更。
+MCP_ALIASES: dict[str, str] = {
+    "a207-clinical-calc-mcp": "a207-ckd-clinical-calc-mcp",
+    "a207-notification-mcp": "a207-notify-mcp",
+    "a207-nutrition-assessment-mcp-nfyy": "a207-nutrition-assessment-mcp",
+}
+
+
+def normalize_mcp(name: str) -> str:
+    """把实际发行/目录包名归一为登记表内的键；未知名原样返回（由上层判未登记）。"""
+    key = (name or "").strip()
+    return MCP_ALIASES.get(key, key)
+
+
+# MX-1：分期类问题不由营养师 / 家长助手判定，改读 M1 已确诊分期
+MX1_BLOCKED_CALLERS: frozenset[str] = frozenset({"nutritionist", "parent_assistant"})
+
+# MX-2：患儿伙伴的医疗数据禁区（构建规格 §2.1 逐条列出的 8 个包）
+CHILD_FORBIDDEN_MCPS: frozenset[str] = frozenset(
+    {
+        "a207-his-mcp",
+        "a207-lis-mcp",
+        "a207-nutrition-calc-mcp",
+        "a207-ckd-clinical-calc-mcp",
+        "a207-meal-plan-mcp",
+        "a207-risk-rules-mcp",
+        "a207-report-mcp",
+        "a207-notify-mcp",
+    }
+)
+
+# ---------------------------------------------------------------- MX-1 字段可见性边界
+CLINICIAN_ONLY_FIELDS: frozenset[str] = frozenset({
+    "note_to_clinician", "clinician_note", "doctor_note", "doctor_notes", "internal_note", "note_to_doctor",
+    "emr_status", "push_to_emr", "physician_confirmed",
+    "scr_umol_L", "egfr_ml_min", "k_mmol_L", "p_mmol_L", "ca_mmol_L", "na_mmol_L",
+    "cl_mmol_L", "bun_mmol_L", "albumin_g_L", "prealbumin_mg_L", "hb_g_L",
+    "ipth_pg_mL", "vitd25oh_nmol_L", "ua_umol_L", "urine_protein_g_24h", "upcr_mg_mmol",
+    "critical_value", "critical_flag",
+    "prior_level", "level_correction",
+    "nutrition_ceiling", "stage_confirmed_by", "z_score_height",
+})
+
+# 与 CLINICIAN_ONLY_FIELDS 配套：上述字段「绝不可见」的角色（家庭角色）。M9 报告层据此对
+# sections / summary_markdown 做受限脱敏（OD-013）。单一事实源放在策略包，避免各 MCP 包
+# 再硬编码角色集合（conformance C3 禁止包内硬编码角色集字面量）。
+CLINICIAN_ONLY_HIDDEN_FROM: frozenset[str] = frozenset({"parent_assistant", "child_companion"})
+
+# ---------------------------------------------------------------- 权限矩阵（§7）
+
+ACCESS_NONE = "-"
+ACCESS_READ = "R"
+ACCESS_LIMITED = "RL"
+ACCESS_RW = "R/W"
+
+_READ_OK: frozenset[str] = frozenset({ACCESS_READ, ACCESS_LIMITED, ACCESS_RW})
+
+PERMISSION_MATRIX: dict[str, dict[str, str]] = {
+    "a207-his-mcp": {
+        "orchestrator": ACCESS_READ, "doctor_assistant": ACCESS_READ,
+        "nutritionist": ACCESS_LIMITED, "parent_assistant": ACCESS_LIMITED,
+        "child_companion": ACCESS_NONE, "risk_warning": ACCESS_READ,
+    },
+    "a207-lis-mcp": {
+        "orchestrator": ACCESS_NONE, "doctor_assistant": ACCESS_RW,
+        "nutritionist": ACCESS_NONE, "parent_assistant": ACCESS_LIMITED,
+        "child_companion": ACCESS_NONE, "risk_warning": ACCESS_READ,
+    },
+    "a207-nutrition-assessment-mcp": {
+        "orchestrator": ACCESS_RW, "doctor_assistant": ACCESS_READ,
+        "nutritionist": ACCESS_READ, "parent_assistant": ACCESS_LIMITED,
+        "child_companion": ACCESS_LIMITED, "risk_warning": ACCESS_READ,
+    },
+    "a207-followup-mcp": {
+        "orchestrator": ACCESS_RW, "doctor_assistant": ACCESS_RW,
+        "nutritionist": ACCESS_RW, "parent_assistant": ACCESS_LIMITED,
+        "child_companion": ACCESS_LIMITED, "risk_warning": ACCESS_READ,
+    },
+    "a207-nutrition-calc-mcp": {
+        "orchestrator": ACCESS_NONE, "doctor_assistant": ACCESS_READ,
+        "nutritionist": ACCESS_READ, "parent_assistant": ACCESS_READ,
+        "child_companion": ACCESS_NONE, "risk_warning": ACCESS_NONE,
+    },
+    "a207-ckd-clinical-calc-mcp": {
+        "orchestrator": ACCESS_NONE, "doctor_assistant": ACCESS_READ,
+        "nutritionist": ACCESS_NONE, "parent_assistant": ACCESS_NONE,
+        "child_companion": ACCESS_NONE, "risk_warning": ACCESS_NONE,
+    },
+    "a207-meal-plan-mcp": {
+        "orchestrator": ACCESS_NONE, "doctor_assistant": ACCESS_READ,
+        "nutritionist": ACCESS_READ, "parent_assistant": ACCESS_NONE,
+        "child_companion": ACCESS_NONE, "risk_warning": ACCESS_NONE,
+    },
+    "a207-risk-rules-mcp": {
+        "orchestrator": ACCESS_NONE, "doctor_assistant": ACCESS_READ,
+        "nutritionist": ACCESS_NONE, "parent_assistant": ACCESS_NONE,
+        "child_companion": ACCESS_NONE, "risk_warning": ACCESS_READ,
+    },
+    "a207-report-mcp": {
+        "orchestrator": ACCESS_NONE, "doctor_assistant": ACCESS_RW,
+        "nutritionist": ACCESS_RW, "parent_assistant": ACCESS_LIMITED,
+        "child_companion": ACCESS_NONE, "risk_warning": ACCESS_READ,
+    },
+    "a207-notify-mcp": {
+        # OD-012 校正（OD-011 派生时误把编排层/家长挡死，导致 notify 单测回归 + 编排层写通知被拒）：
+        # - orchestrator=R/W：ADR-010 明确"编排层在 M4/M8/M9 末端事件后调用 build_event_notification 写入"
+        # - doctor=R/W：临床角色可创建/确认通知
+        # - parent=READ：README 明确"家长读自己孩子的通知"
+        # - risk_warning=R/W：风险预警由 risk_warning 推送（WRITE_TOOL_POLICY notify_* 仍限 risk_warning）
+        # - nutritionist/child=NONE：营养师不在通知回路；患儿受 MX-2 禁区约束
+        "orchestrator": ACCESS_RW, "doctor_assistant": ACCESS_RW,
+        "nutritionist": ACCESS_NONE, "parent_assistant": ACCESS_READ,
+        "child_companion": ACCESS_NONE, "risk_warning": ACCESS_RW,
+    },
+    "a207-gamification-mcp": {
+        "orchestrator": ACCESS_NONE, "doctor_assistant": ACCESS_NONE,
+        "nutritionist": ACCESS_NONE, "parent_assistant": ACCESS_NONE,
+        "child_companion": ACCESS_RW, "risk_warning": ACCESS_NONE,
+    },
+    "a207-knowledge-mcp": {
+        "orchestrator": ACCESS_NONE, "doctor_assistant": ACCESS_READ,
+        "nutritionist": ACCESS_READ, "parent_assistant": ACCESS_LIMITED,
+        "child_companion": ACCESS_LIMITED, "risk_warning": ACCESS_READ,
+    },
+    "a207-router-mcp": {
+        "orchestrator": ACCESS_READ, "doctor_assistant": ACCESS_NONE,
+        "nutritionist": ACCESS_NONE, "parent_assistant": ACCESS_NONE,
+        "child_companion": ACCESS_NONE, "risk_warning": ACCESS_NONE,
+    },
+}
+
+# M12 按角色切语料 profile；注意 M12 旧接口用 role 命名空间(doctor/parent/child)，
+# 已由各包在转换层把 caller 映射到 role，本表保持 caller 维度。
+KNOWLEDGE_PROFILE: dict[str, str] = {
+    "doctor_assistant": "full",
+    "nutritionist": "full",
+    "risk_warning": "full",
+    "parent_assistant": "plain_language",
+    "child_companion": "child_safe",
+}
+
+# ---------------------------------------------------------------- MX-3 写权
+WRITE_TOOL_POLICY: dict[str, dict[str, object]] = {
+    "upsert_lab_result": {
+        "mcp": "a207-lis-mcp",
+        "allowed": frozenset({"doctor_assistant"}),
+        "requires_confirmation": False,
+        "note": "写入后强制触发 M8 重评；命中危急值经 get_critical_values 走 M10",
+    },
+    "upsert_food_diary": {
+        "mcp": "a207-nutrition-assessment-mcp",
+        "allowed": frozenset({"parent_assistant", "child_companion"}),
+        "requires_confirmation": False,
+        "note": "打卡回流的落点，供下次 sum_diet_intake 与食谱参考依从性",
+    },
+    "log_meal_checkin": {
+        "mcp": GAMIFICATION_MCP,
+        "allowed": frozenset({"child_companion"}),
+        "requires_confirmation": False,
+        "note": "只存吃了什么，全程零医疗判定",
+    },
+    "award_badge": {
+        "mcp": GAMIFICATION_MCP,
+        "allowed": frozenset({"child_companion"}),
+        "requires_confirmation": False,
+        "note": "激励侧写入，不得写入任何医疗结论",
+    },
+    "push_to_emr": {
+        "mcp": "a207-report-mcp",
+        "allowed": frozenset({"doctor_assistant"}),
+        "requires_confirmation": True,
+        "note": "需调用方另传 physician_confirmed=true，人在回路",
+    },
+    "notify_physician": {
+        "mcp": "a207-notify-mcp",
+        "allowed": frozenset({"risk_warning"}),
+        "requires_confirmation": False,
+        "note": "推送前须过 24h 同规则去重",
+    },
+    "notify_parent": {
+        "mcp": "a207-notify-mcp",
+        "allowed": frozenset({"risk_warning"}),
+        "requires_confirmation": False,
+        "note": "推送前须过 24h 同规则去重",
+    },
+    "trigger_warning_event": {
+        "mcp": "a207-notify-mcp",
+        "allowed": frozenset({"risk_warning"}),
+        "requires_confirmation": False,
+        "note": "等级须由本轮新数据重评得出，禁止沿用历史等级",
+    },
+    "close_warning": {
+        "mcp": "a207-notify-mcp",
+        "allowed": frozenset({"risk_warning"}),
+        "requires_confirmation": False,
+        "note": "关闭工单需留判定链路",
+    },
+}
+
+WRITE_TOOL_ALIASES: dict[str, str] = {
+    "写回病历": "push_to_emr", "写入病历": "push_to_emr", "推送病历": "push_to_emr",
+    "录入化验": "upsert_lab_result", "写入化验": "upsert_lab_result",
+    "新增生化": "upsert_lab_result", "新增检验": "upsert_lab_result",
+    "记录饮食日记": "upsert_food_diary", "录入饮食": "upsert_food_diary",
+    "写入饮食日记": "upsert_food_diary",
+    "打卡": "log_meal_checkin", "颁发勋章": "award_badge", "发勋章": "award_badge",
+    "推送医生": "notify_physician", "通知医生": "notify_physician",
+    "通知家长": "notify_parent", "发预警": "trigger_warning_event",
+    "触发预警": "trigger_warning_event", "关闭预警": "close_warning",
+}
+
+WRITE_ACTION_PREFIXES: tuple[str, ...] = (
+    "write", "create", "update", "delete", "insert",
+    "upsert_", "notify_", "log_", "award_", "push_", "trigger_",
+    "close_", "schedule_", "save_",
+)
+
+CN_WRITE_HINTS: tuple[str, ...] = ("写入", "写回", "新增一条", "保存到", "提交写")
+
+
+def resolve_access(access: str, is_write: bool) -> bool:
+    """把矩阵格子翻译成布尔放行结果。"""
+    if is_write:
+        return access == ACCESS_RW
+    return access in _READ_OK
+
+
+# ---------------------------------------------------------------- OD-011：从矩阵派生本地集合
+# 本地「放行集合」不再独立声明，改由 PERMISSION_MATRIX 实时派生，杜绝第二副本漂移。
+def _matrix_readers(mcp: str) -> frozenset[str]:
+    """从权限矩阵派生：对该 mcp 有读权限（R/RL/RW）的 caller 集合。"""
+    return frozenset(c for c, a in PERMISSION_MATRIX[mcp].items() if a in _READ_OK)
+
+
+def _matrix_writers(mcp: str) -> frozenset[str]:
+    """从权限矩阵派生：对该 mcp 有写权限（R/W）的 caller 集合。
+
+    OD-011 收口点：各包本地写白名单的唯一事实源就是矩阵，不允许再手写一份更宽的集合。
+    """
+    return frozenset(c for c, a in PERMISSION_MATRIX[mcp].items() if a == ACCESS_RW)
+
+
+# ================================================================
+# 各包本地放行集合（原散落副本，集中到此处作为单一事实源）
+# 命名带包前缀，避免与矩阵概念混淆。值 = 当前代码实际生效范围。
+# ================================================================
+
+# --- M1 HIS（core.py 原 READ_CALLERS / BLOCKED_CALLERS / COHORT_CALLERS 等）---
+HIS_FULL_VIEW: frozenset[str] = frozenset({"orchestrator", "doctor_assistant", "risk_warning"})
+HIS_LIMITED: frozenset[str] = frozenset({"nutritionist", "parent_assistant"})
+HIS_READ: frozenset[str] = HIS_FULL_VIEW | HIS_LIMITED
+HIS_BLOCKED: frozenset[str] = frozenset({"child_companion"})
+HIS_COHORT: frozenset[str] = frozenset(
+    {"orchestrator", "doctor_assistant", "nutritionist", "risk_warning"})
+HIS_ALLOWED_FILTER_KEYS: frozenset[str] = frozenset(
+    {"age_band", "ckd_stage", "dialysis", "sex", "primary_disease",
+     "has_allergies", "min_age_years", "max_age_years"})
+
+# --- M2 LIS（core.py 原 READ_FULL / READ_LIMITED / CRITICAL_CHANNEL / WRITE_ALLOWED）---
+# 读视图分层（full/limited）属视图 tier，与矩阵 RL 一致，保留原声明；写白名单改由矩阵派生（OD-011）。
+LIS_READ_FULL: frozenset[str] = frozenset({"doctor_assistant", "risk_warning"})
+LIS_READ_LIMITED: frozenset[str] = frozenset({"parent_assistant"})
+LIS_CRITICAL_CHANNEL: frozenset[str] = frozenset({"risk_warning", "doctor_assistant"})
+LIS_WRITE_ALLOWED: frozenset[str] = _matrix_writers("a207-lis-mcp")  # OD-011: 派生自矩阵（M2 doctor=R/W）
+
+# --- M4 随访（core.py 原 _WRITE_ALLOWED / _CLINICIAN）---
+FOLLOWUP_WRITE_ALLOWED: frozenset[str] = _matrix_writers("a207-followup-mcp")  # OD-011: doctor/nutritionist/orchestrator = R/W
+FOLLOWUP_CLINICIAN: frozenset[str] = frozenset(
+    {"doctor_assistant", "nutritionist", "orchestrator", "risk_warning"})
+
+# --- M3 营养评估 工具级 ACL（OD-010 选项 A）---
+# M3 是「计算 + 数据」混合包：calc_prnt_targets / assess_pew_risk / calc_growth_zscore 是临床判读（计算面），
+# upsert_food_diary / get_food_diary_summary 是家长/患儿日常记录与聚合（数据面）。
+# 权限矩阵是 MCP 粒度，无法表达"同包内某些工具家长能写、某些只能临床角色算"。
+# 故在此用工具级白名单作为矩阵之下的精细授权层（单一事实源，集中此处；enforce_nutrition_tool 据此执行）：
+#   - 数据面·写 upsert_food_diary：仅家长/患儿（NUTRITION_ASSESSMENT_WRITE_ALLOWED）
+#   - 数据面·读 get_food_diary_summary：家长/患儿/临床角色（NUTRITION_ASSESSMENT_DATA_ROLES）
+#   - 计算面（6 个临床判读/落库工具）：仅 doctor/nutritionist/orchestrator（NUTRITION_ASSESSMENT_CLINICAL_ROLES）
+# 矩阵 M3 各行：家长/患儿=RL、临床=READ、orchestrator=R/W（编排层落 PEW 历史需写权）。
+NUTRITION_ASSESSMENT_WRITE_ALLOWED: frozenset[str] = frozenset(
+    {"parent_assistant", "child_companion"})
+NUTRITION_ASSESSMENT_DATA_TOOLS: frozenset[str] = frozenset({
+    "upsert_food_diary",          # 数据面·写：家长/患儿记饮食日记（写权见 WRITE_ALLOWED）
+    "get_food_diary_summary",     # 数据面·读：脱敏聚合摘要（家长/患儿/临床角色可读）
+})
+NUTRITION_ASSESSMENT_DATA_ROLES: frozenset[str] = frozenset({
+    "parent_assistant", "child_companion",
+    "doctor_assistant", "nutritionist", "orchestrator",
+})
+NUTRITION_ASSESSMENT_CLINICAL_TOOLS: frozenset[str] = frozenset({
+    "calc_prnt_targets", "assess_intake_vs_target", "assess_pew_risk",
+    "calc_growth_zscore", "record_pew_risk", "get_pew_history",
+})
+NUTRITION_ASSESSMENT_CLINICAL_ROLES: frozenset[str] = frozenset({
+    "doctor_assistant", "nutritionist", "orchestrator",
+})
+
+# --- M10 通知（core.py 原 _WRITE_ROLES / _READ_ROLES）---
+# OD-011 收口：原先手写 {全部 6 角色} / {编排+临床 4 角色}，比矩阵宽得多（矩阵 M10 仅 doctor=R、risk_warning=R/W，
+# 其余 NONE）。现全部派生自矩阵，杜绝第二副本。
+NOTIFY_WRITE_ROLES: frozenset[str] = _matrix_writers("a207-notify-mcp")  # → {risk_warning}
+NOTIFY_READ_ROLES: frozenset[str] = _matrix_readers("a207-notify-mcp")   # → {doctor, risk_warning}
+
+# --- M11 游戏化（server.py 原 _guard：仅患儿伙伴）---
+GAMIFICATION_ALLOWED: frozenset[str] = _matrix_writers(GAMIFICATION_MCP)  # OD-011: 派生自矩阵（M11 child=R/W）

a207_policy-0.2.0/src/a207_policy/state.py

@@ -0,0 +1,37 @@
+"""可写状态路径解析（A3 核心）。
+
+旧方案：状态文件写在 os.path.dirname(__file__)（即 site-packages 安装目录），
+容器/云沙箱里通常是只读的 → 写入抛异常（架构复盘 P1-3，与 M2 数据缺失败同源）。
+
+新方案：统一经本函数解析可写路径：
+- 若设环境变量 A207_DATA_DIR，落到该目录；
+- 否则落到系统临时目录下的 a207_state/（总是可写）。
+各包把原先写死的 STORE 常量改成 `resolve_state_path("xxx_store.json")` 即可。
+"""
+
+from __future__ import annotations
+
+import os
+from pathlib import Path
+
+ENV_KEY = "A207_DATA_DIR"
+
+
+def resolve_state_path(filename: str, *, base: str | None = None) -> Path:
+    """返回可写的 filename 绝对路径，并确保父目录存在。
+
+    :param filename: 状态文件名，如 "followup_store.json"
+    :param base: 测试可传入临时基目录覆盖环境变量
+    """
+    if base:
+        root = Path(base)
+    else:
+        override = os.environ.get(ENV_KEY)
+        if override:
+            root = Path(override)
+        else:
+            # 未设环境变量：落到系统临时目录，保证可写（避免只读安装目录崩溃）
+            import tempfile
+            root = Path(tempfile.gettempdir()) / "a207_state"
+    root.mkdir(parents=True, exist_ok=True)
+    return root / filename

a207_policy-0.2.0/src/a207_policy.egg-info/PKG-INFO

@@ -0,0 +1,28 @@
+Metadata-Version: 2.4
+Name: a207-policy
+Version: 0.2.0
+Summary: A207 统一身份注入 / 权限矩阵 / 状态路径策略包（Plan A 单一事实源）
+Requires-Python: >=3.10
+Description-Content-Type: text/markdown
+
+# a207-policy
+
+A207 统一身份注入 / 权限矩阵 / 状态路径策略包（Plan A 单一事实源）。
+
+13 个 MCP 统一依赖本包，取代原先散落在 M1/M2/M4/M11/M13 的多份权限副本。
+
+## 用法
+
+```python
+from a207_policy import get_caller, enforce_read, enforce_write, LIS_READ_FULL
+
+def get_labs(patient_id: str) -> dict:
+    caller = get_caller()                 # 来自 env A207_CALLER，模型碰不到
+    enforce_read("a207-lis-mcp")          # 确定性拒绝越权（fail-closed）
+    ...
+```
+
+- 身份注入：`A207_CALLER` 环境变量由部署配置写入，模型无法自证（修复 P0-1）。
+- 测试：`from a207_policy import set_caller; set_caller("doctor_assistant")`。
+- 状态路径：`from a207_policy import resolve_state_path; resolve_state_path("followup_store.json")`
+  落到 `A207_DATA_DIR` 或系统临时目录，避免只读安装目录崩溃（修复 P1-3）。

a207_policy-0.2.0/src/a207_policy.egg-info/SOURCES.txt

@@ -0,0 +1,12 @@
+README.md
+pyproject.toml
+src/a207_policy/__init__.py
+src/a207_policy/caller.py
+src/a207_policy/gate.py
+src/a207_policy/matrix.py
+src/a207_policy/state.py
+src/a207_policy.egg-info/PKG-INFO
+src/a207_policy.egg-info/SOURCES.txt
+src/a207_policy.egg-info/dependency_links.txt
+src/a207_policy.egg-info/top_level.txt
+tests/test_policy.py

a207_policy-0.2.0/src/a207_policy.egg-info/dependency_links.txt

@@ -0,0 +1 @@
+

a207_policy-0.2.0/src/a207_policy.egg-info/top_level.txt

@@ -0,0 +1 @@
+a207_policy

a207_policy-0.2.0/tests/test_policy.py

@@ -0,0 +1,384 @@
+"""a207-policy 自测：纯 python 可跑，不依赖 pytest / fastmcp。
+
+运行：python tests/test_policy.py
+
+为什么这个包必须单独有测试
+--------------------------
+a207-policy 是 13 个 MCP 包共同的信任根——身份从这里取，权限从这里判，
+状态路径从这里算。它错一行，13 个包一起错，而且**各包自己的测试照样全绿**
+（因为它们都信任 policy 的返回值）。所以这里专打那些"下游测不出来"的盲区：
+矩阵有没有空洞、fail-closed 是否真的关死、写权是否唯一、患儿是否真隔离、
+未知角色会不会悄悄回退到全量专业语料。
+"""
+
+from __future__ import annotations
+
+import os
+import sys
+import tempfile
+import traceback
+from pathlib import Path
+
+sys.stdout.reconfigure(encoding="utf-8")
+sys.path.insert(0, str(Path(__file__).resolve().parents[1] / "src"))
+
+from a207_policy import (  # noqa: E402
+    ACCESS_LIMITED,
+    ACCESS_NONE,
+    ACCESS_READ,
+    ACCESS_RW,
+    CALLERS,
+    CHILD_FORBIDDEN_MCPS,
+    KNOWLEDGE_PROFILE,
+    MCP_ALIASES,
+    PERMISSION_MATRIX,
+    WRITE_TOOL_POLICY,
+    CallerUnknown,
+    PermissionDenied,
+    as_caller,
+    check_permission,
+    enforce_read,
+    enforce_write,
+    get_caller,
+    knowledge_profile,
+    normalize_mcp,
+    resolve_state_path,
+    set_caller,
+)
+
+RESULTS: list[tuple[str, bool, str]] = []
+
+
+def check(name: str):
+    def deco(fn):
+        try:
+            fn()
+            RESULTS.append((name, True, ""))
+        except AssertionError as exc:
+            RESULTS.append((name, False, str(exc) or "断言失败"))
+        except Exception:  # noqa: BLE001
+            RESULTS.append((name, False, traceback.format_exc(limit=3)))
+        return fn
+
+    return deco
+
+
+def _reset(caller: str = "doctor_assistant") -> None:
+    set_caller(None)
+    os.environ["A207_CALLER"] = caller
+
+
+# --------------------------------------------------------- P0-1 身份 fail-closed
+
+@check("get_caller：身份缺失时 fail-closed 抛 CallerUnknown")
+def _caller_missing():
+    with as_caller(None):
+        try:
+            get_caller()
+        except CallerUnknown:
+            return
+        raise AssertionError("身份缺失时未抛 CallerUnknown")
+
+
+@check("get_caller：空串/纯空格视同缺失（不许当成合法身份）")
+def _caller_blank():
+    set_caller(None)
+    try:
+        for blank in ("", "   ", "\t"):
+            os.environ["A207_CALLER"] = blank
+            try:
+                get_caller()
+            except CallerUnknown:
+                continue
+            raise AssertionError(f"空白身份 {blank!r} 被当成合法身份")
+    finally:
+        _reset()
+
+
+@check("as_caller：块内切换、退出还原")
+def _as_caller_restore():
+    _reset()
+    with as_caller("parent_assistant"):
+        assert get_caller() == "parent_assistant"
+    assert get_caller() == "doctor_assistant"
+
+
+@check("as_caller：块内抛异常也必须还原（否则污染后续用例）")
+def _as_caller_exception():
+    _reset()
+    try:
+        with as_caller("child_companion"):
+            raise RuntimeError("boom")
+    except RuntimeError:
+        pass
+    assert get_caller() == "doctor_assistant", "异常路径未还原身份"
+
+
+@check("as_caller(None)：必须同时清 env，否则 fail-closed 测了个寂寞")
+def _as_caller_none_clears_env():
+    _reset()
+    with as_caller(None):
+        try:
+            get_caller()
+        except CallerUnknown:
+            pass
+        else:
+            raise AssertionError("as_caller(None) 内仍取到身份，env 未清")
+    assert get_caller() == "doctor_assistant", "退出后 env 未还原"
+
+
+@check("as_caller：嵌套逐层还原")
+def _as_caller_nested():
+    _reset()
+    with as_caller("nutritionist"):
+        with as_caller("risk_warning"):
+            assert get_caller() == "risk_warning"
+        assert get_caller() == "nutritionist"
+    assert get_caller() == "doctor_assistant"
+
+
+# --------------------------------------------------------- 矩阵完整性（下游测不出）
+
+@check("矩阵无空洞：每个已登记 MCP x 每个角色都有明确取值")
+def _matrix_complete():
+    holes = []
+    for mcp_name, row in PERMISSION_MATRIX.items():
+        for caller in CALLERS:
+            if caller not in row:
+                holes.append(f"{mcp_name} x {caller}")
+    assert not holes, f"矩阵有空洞（缺失即行为未定义）：{holes}"
+
+
+@check("矩阵取值合法：只能是 - / R / RL / R/W 四种")
+def _matrix_values():
+    legal = {ACCESS_NONE, ACCESS_READ, ACCESS_LIMITED, ACCESS_RW}
+    bad = [
+        f"{m} x {c} = {a!r}"
+        for m, row in PERMISSION_MATRIX.items()
+        for c, a in row.items()
+        if a not in legal
+    ]
+    assert not bad, f"非法权限值：{bad}"
+
+
+@check("矩阵覆盖 13 个 MCP（不多不少）")
+def _matrix_size():
+    assert len(PERMISSION_MATRIX) == 13, f"矩阵行数={len(PERMISSION_MATRIX)}，期望 13"
+
+
+@check("别名归一：旧包名解析到真实包名且落在矩阵内（OD-002 回归）")
+def _alias_normalize():
+    for alias, canonical in MCP_ALIASES.items():
+        got = normalize_mcp(alias)
+        assert got == canonical, f"{alias} 归一到 {got}，期望 {canonical}"
+        assert canonical in PERMISSION_MATRIX, f"{canonical} 不在矩阵中"
+
+
+# --------------------------------------------------------- MX 硬规则
+
+@check("MX-2 患儿隔离：CHILD_FORBIDDEN_MCPS 在矩阵里确实为 none")
+def _child_isolation():
+    leaks = [
+        m for m in CHILD_FORBIDDEN_MCPS
+        if PERMISSION_MATRIX.get(normalize_mcp(m), {}).get("child_companion") != ACCESS_NONE
+    ]
+    assert not leaks, f"患儿禁入清单与矩阵不一致，存在泄漏：{leaks}"
+
+
+@check("患儿绝不可触及检验原始数据（M2 LIS 必须为 none）")
+def _child_no_lis():
+    assert PERMISSION_MATRIX["a207-lis-mcp"]["child_companion"] == ACCESS_NONE
+
+
+@check("检验写权唯一：M2 LIS 只有 doctor_assistant 是 R/W")
+def _lis_write_unique():
+    row = PERMISSION_MATRIX["a207-lis-mcp"]
+    writers = sorted(c for c, a in row.items() if a == ACCESS_RW)
+    assert writers == ["doctor_assistant"], f"检验写权不唯一：{writers}"
+
+
+@check("家长看检验只能是受限视图 RL（不得是全量 R）")
+def _parent_lis_limited():
+    assert PERMISSION_MATRIX["a207-lis-mcp"]["parent_assistant"] == ACCESS_LIMITED
+
+
+# --------------------------------------------------------- 闸门确定性执行
+
+@check("enforce_read：无权角色被拒（PermissionDenied）")
+def _enforce_read_denied():
+    with as_caller("child_companion"):
+        try:
+            enforce_read("a207-lis-mcp")
+        except PermissionDenied:
+            return
+        raise AssertionError("child_companion 读 LIS 未被拒")
+
+
+@check("enforce_read：有权角色放行")
+def _enforce_read_allowed():
+    with as_caller("doctor_assistant"):
+        enforce_read("a207-lis-mcp")
+
+
+@check("enforce_read：身份缺失时闸门也必须拒（fail-closed 贯穿）")
+def _enforce_no_caller():
+    with as_caller(None):
+        try:
+            enforce_read("a207-his-mcp")
+        except (CallerUnknown, PermissionDenied):
+            return
+        raise AssertionError("身份缺失时闸门放行了")
+
+
+@check("enforce_write：只读角色不得写")
+def _enforce_write_denied():
+    with as_caller("nutritionist"):
+        try:
+            enforce_write("a207-lis-mcp", tool="upsert_lab_result")
+        except PermissionDenied:
+            return
+        raise AssertionError("nutritionist 竟能写 LIS")
+
+
+@check("enforce_write：RW 角色放行")
+def _enforce_write_allowed():
+    with as_caller("doctor_assistant"):
+        enforce_write("a207-lis-mcp", tool="upsert_lab_result")
+
+
+@check("enforce：未登记的 MCP 一律拒绝（不许悄悄放行未知服务）")
+def _enforce_unknown_mcp():
+    with as_caller("doctor_assistant"):
+        try:
+            enforce_read("a207-totally-unknown-mcp")
+        except (PermissionDenied, KeyError, ValueError):
+            return
+        raise AssertionError("未知 MCP 被放行")
+
+
+@check("check_permission：未登记 caller 一律拒绝")
+def _check_unknown_caller():
+    res = check_permission("hacker_agent", "a207-lis-mcp", "read")
+    assert res["allow"] is False, f"未登记 caller 被放行：{res}"
+
+
+@check("MX-3 写权收口：每条写工具策略字段完整（mcp/allowed/note）")
+def _write_policy_shape():
+    bad = []
+    for tool, policy in WRITE_TOOL_POLICY.items():
+        for field in ("mcp", "allowed"):
+            if field not in policy:
+                bad.append(f"{tool} 缺 {field}")
+    assert not bad, f"写权策略不完整：{bad}"
+
+
+@check("MX-3：写工具的 owner mcp 必须在矩阵里登记")
+def _write_policy_owner_registered():
+    bad = [
+        f"{tool} -> {policy['mcp']}"
+        for tool, policy in WRITE_TOOL_POLICY.items()
+        if normalize_mcp(str(policy["mcp"])) not in PERMISSION_MATRIX
+    ]
+    assert not bad, f"写工具指向未登记 MCP：{bad}"
+
+
+@check("MX-3：写工具的 allowed 角色必须都是已登记 caller")
+def _write_policy_allowed_registered():
+    bad = []
+    for tool, policy in WRITE_TOOL_POLICY.items():
+        for c in policy["allowed"]:
+            if c not in CALLERS:
+                bad.append(f"{tool} 允许了未登记角色 {c}")
+    assert not bad, bad
+
+
+# --------------------------------------------------------- M12 语料分级
+
+@check("语料分级与矩阵一致：能读 M12 的角色必有 profile，够不着的回退 none")
+def _knowledge_matches_matrix():
+    # 不是"6 个角色都要有 profile"——orchestrator 在矩阵里对 M12 是 none（够不着），
+    # 不给它 profile 才是对的。真正的不变量是这两条：
+    row = PERMISSION_MATRIX["a207-knowledge-mcp"]
+    missing, leaked = [], []
+    for caller, access in row.items():
+        readable = access != ACCESS_NONE
+        if readable and caller not in KNOWLEDGE_PROFILE:
+            missing.append(caller)          # 能读却没分级 → 语料给错风险
+        if not readable and knowledge_profile(caller) != "none":
+            leaked.append(caller)           # 够不着却拿到 profile → 越权风险
+    assert not missing, f"能读 M12 却缺语料分级：{missing}"
+    assert not leaked, f"矩阵禁止访问 M12 却拿到语料 profile：{leaked}"
+
+
+@check("患儿必须 child_safe，家长必须 plain_language")
+def _knowledge_safety():
+    assert KNOWLEDGE_PROFILE["child_companion"] == "child_safe"
+    assert KNOWLEDGE_PROFILE["parent_assistant"] == "plain_language"
+    assert knowledge_profile("child_companion") == "child_safe"
+
+
+@check("knowledge_profile：未知角色不得回退到 full（默认必须最保守）")
+def _knowledge_unknown_not_full():
+    got = knowledge_profile("some_unknown_agent")
+    assert got != "full", f"未知角色拿到全量专业语料：{got!r}"
+
+
+# --------------------------------------------------------- P1-3 状态外置
+
+@check("resolve_state_path：base 参数优先")
+def _state_base():
+    with tempfile.TemporaryDirectory() as tmp:
+        p = resolve_state_path("x.json", base=tmp)
+        assert p.parent == Path(tmp), p
+        assert p.name == "x.json"
+
+
+@check("resolve_state_path：读 A207_DATA_DIR 环境变量")
+def _state_env():
+    saved = os.environ.get("A207_DATA_DIR")
+    with tempfile.TemporaryDirectory() as tmp:
+        os.environ["A207_DATA_DIR"] = tmp
+        try:
+            p = resolve_state_path("y.json")
+            assert Path(tmp) == p.parent or Path(tmp) in p.parents, p
+        finally:
+            if saved is None:
+                os.environ.pop("A207_DATA_DIR", None)
+            else:
+                os.environ["A207_DATA_DIR"] = saved
+
+
+@check("resolve_state_path：目录自动创建且可写")
+def _state_writable():
+    with tempfile.TemporaryDirectory() as tmp:
+        p = resolve_state_path("z.json", base=str(Path(tmp) / "nested" / "deep"))
+        assert p.parent.is_dir(), "父目录未自动创建"
+        p.write_text("{}", encoding="utf-8")
+        assert p.read_text(encoding="utf-8") == "{}"
+
+
+@check("resolve_state_path：绝不落在 policy 包安装目录内（P1-3 根本目的）")
+def _state_not_in_pkg():
+    saved = os.environ.pop("A207_DATA_DIR", None)
+    try:
+        p = resolve_state_path("w.json")
+        pkg_root = Path(__file__).resolve().parents[1]
+        assert pkg_root not in p.parents, f"状态落到了安装目录：{p}"
+    finally:
+        if saved is not None:
+            os.environ["A207_DATA_DIR"] = saved
+
+
+def main() -> int:
+    for name, ok, msg in RESULTS:
+        print(f"[{'PASS' if ok else 'FAIL'}] {name}")
+        if not ok:
+            print("       " + msg.strip().replace("\n", "\n       "))
+    passed = sum(1 for _, ok, _ in RESULTS if ok)
+    failed = len(RESULTS) - passed
+    print(f"\n合计 {len(RESULTS)} 项：通过 {passed}，失败 {failed}")
+    return 1 if failed else 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())