M5：百工与司命——能力注册表、授契行契请命、禁域裁决与观察标证

- 百工域 domains/baigong：capabilities（统一能力契约：执行类型 builtin/qiankun/mcp/http + 四维风险标注 + 来源版本）、mandates（授契 grant / 行契 charter 预算时间窗，撤销立即生效）、tool_calls（净化摘要 + 观察标证）；请命复用 pending_confirmations 加 expires_at/brief_json（超时=拒绝执行 HJ-1302，六要素说明）
- 司命裁决器 siming.py：四维取最高档（能力/数据/后果/情境）；禁域为代码常量不可配置（递归删根/格式化/写裸设备/fork 炸弹、file:// 协议、密钥材料外发）——专项测试断言恶意标注与篡改对象仍拒 HJ-1301
- 执行链：禁域→裁决（HJ-1303 未授契拒且双留痕）→请命→执行（乾坤经 SandboxClient HMAC；MCP 经 call_tool；内置无副作用）→净化标证（观察非事实，敏感遮蔽+体量截断）→行动账
- MCP 登记/启停/刷新自动派生与撤下 capabilities（博闻登记接入点）；内置能力种子（echo/datetime/qiankun.shell/web.fetch）
- 端点：/capabilities /mandates /petitions /tool-calls + /tools 兼容投影；前端百工页四区（能力目录四维标注/授契行契/请命批准拒绝/行动账观察标证）
- 退役：modules/safety|skills|tool_runtime|agent、application/tool_runtime、services/skills|safety、tool_policies/skills/model_endpoint_overrides 表（迁移 006）、前端 SkillManager/ToolsConsole/旧 tools 页
- 验收（test_baigong_siming 四用例）：未授契被拒留痕、请命超时不执行、禁域不可关闭、结果为观察不入忆；后端 454、前端 220、BFF 4、神识 5 包全绿（2 个预存环境失败不变）

backend/app/db/governance_seed.py

@@ -8,12 +8,12 @@ from datetime import UTC, datetime
 
 from sqlalchemy.ext.asyncio import AsyncSession
 
+from app.domains.baigong.models import Capability
 from app.models.governance import (
     AgentRosterEntry,
     Goal,
     PerceptionChannel,
     Plan,
-    ToolPolicy,
     WorldEntity,
 )
 from app.repositories.json_utils import dumps
@@ -251,28 +251,83 @@ _AGENTS = [
 ]
 
 
-async def _seed_tool_policies(session: AsyncSession) -> None:
-    """把 builtin 工具元数据按主键插入 tool_policies（source=builtin）。
+_BUILTIN_CAPABILITIES = [
+    # name, 描述, 执行类型, 执行器, 四维风险, 数据范围, 目的地, consent
+    (
+        "builtin.echo",
+        "回显输入（无副作用演示能力）",
+        "builtin",
+        "echo",
+        {"capability": "L0", "data": "L0", "consequence": "L0", "context": "L0"},
+        "",
+        "",
+        "allow",
+    ),
+    (
+        "builtin.datetime",
+        "读取当前时间",
+        "builtin",
+        "datetime.now",
+        {"capability": "L0", "data": "L0", "consequence": "L0", "context": "L0"},
+        "",
+        "",
+        "allow",
+    ),
+    (
+        "qiankun.shell",
+        "在乾坤沙箱中执行命令（隔离执行，HMAC 授契）",
+        "qiankun",
+        "",
+        {"capability": "L2", "data": "L1", "consequence": "L3", "context": "L1"},
+        "沙箱工作目录",
+        "本机沙箱进程",
+        "ask",
+    ),
+    (
+        "web.fetch",
+        "抓取指定 URL 内容（受限出站）",
+        "http",
+        "",
+        {"capability": "L1", "data": "L1", "consequence": "L2", "context": "L1"},
+        "目标 URL 响应体",
+        "目标站点",
+        "allow",
+    ),
+]
 
-    存在则跳过——保留用户经 API 对 builtin 工具策略的 PATCH 覆盖；新增的 builtin 工具
-    （builtins.py 里新加的）会被插入。不记审计（系统初始化）。
-    """
-    from app.application.tool_runtime.builtins import builtin_specs
 
-    for name, spec in builtin_specs().items():
-        if await session.get(ToolPolicy, name) is None:
-            session.add(
-                ToolPolicy(
-                    name=name,
-                    description=spec.description,
-                    risk_level=spec.risk_level,
-                    permission_policy=str(spec.permission_policy),
-                    side_effect=spec.side_effect,
-                    audit_required=spec.audit_required,
-                    source="builtin",
-                    enabled=True,
-                )
+async def _seed_capabilities(session: AsyncSession) -> None:
+    """内置能力按 (owner, name) 幂等登记（source=builtin，四维风险标注随代码演进）。"""
+    import json as _json
+
+    from sqlalchemy import select
+
+    existing = set(
+        (
+            await session.execute(
+                select(Capability.name).where(Capability.source == "builtin")
             )
+        )
+        .scalars()
+        .all()
+    )
+    for name, desc, executor_type, ref, dims, scope, dests, consent in _BUILTIN_CAPABILITIES:
+        if name in existing:
+            continue
+        session.add(
+            Capability(
+                name=name,
+                owner_scope="local-user",
+                description=desc,
+                executor_type=executor_type,
+                executor_ref=ref,
+                risk_dims_json=_json.dumps(dims),
+                data_scope=scope,
+                destinations=dests,
+                consent_mode=consent,
+                source="builtin",
+            )
+        )
 
 
 async def ensure_governance_seed(session: AsyncSession) -> None:
@@ -368,5 +423,5 @@ async def ensure_governance_seed(session: AsyncSession) -> None:
                 )
             )
 
-    await _seed_tool_policies(session)
+    await _seed_capabilities(session)
     await session.commit()