M5：百工与司命——能力注册表、授契行契请命、禁域裁决与观察标证
- 百工域 domains/baigong：capabilities（统一能力契约：执行类型 builtin/qiankun/mcp/http + 四维风险标注 + 来源版本）、mandates（授契 grant / 行契 charter 预算时间窗，撤销立即生效）、tool_calls（净化摘要 + 观察标证）；请命复用 pending_confirmations 加 expires_at/brief_json（超时=拒绝执行 HJ-1302，六要素说明） - 司命裁决器 siming.py：四维取最高档（能力/数据/后果/情境）；禁域为代码常量不可配置（递归删根/格式化/写裸设备/fork 炸弹、file:// 协议、密钥材料外发）——专项测试断言恶意标注与篡改对象仍拒 HJ-1301 - 执行链：禁域→裁决（HJ-1303 未授契拒且双留痕）→请命→执行（乾坤经 SandboxClient HMAC；MCP 经 call_tool；内置无副作用）→净化标证（观察非事实，敏感遮蔽+体量截断）→行动账 - MCP 登记/启停/刷新自动派生与撤下 capabilities（博闻登记接入点）；内置能力种子（echo/datetime/qiankun.shell/web.fetch） - 端点：/capabilities /mandates /petitions /tool-calls + /tools 兼容投影；前端百工页四区（能力目录四维标注/授契行契/请命批准拒绝/行动账观察标证） - 退役：modules/safety|skills|tool_runtime|agent、application/tool_runtime、services/skills|safety、tool_policies/skills/model_endpoint_overrides 表（迁移 006）、前端 SkillManager/ToolsConsole/旧 tools 页 - 验收（test_baigong_siming 四用例）：未授契被拒留痕、请命超时不执行、禁域不可关闭、结果为观察不入忆；后端 454、前端 220、BFF 4、神识 5 包全绿（2 个预存环境失败不变）
This commit is contained in:
chenxin committed
1 parent
144415247e
commit
684261f4b4
97 files changed
+3075
-5554
No files matched your search
+23
-43
@@ -15,7 +15,6 @@ from fastapi.middleware.cors import CORSMiddleware
|
||||
from sqlalchemy.exc import OperationalError
|
||||
|
||||
from app.api.router import api_router
|
||||
from app.application.tool_runtime.runtime import ToolRuntime
|
||||
from app.core.config import settings
|
||||
from app.core.errors import register_exception_handlers, trace_id_var
|
||||
from app.core.ids import new_trace_id
|
||||
@@ -28,12 +27,11 @@ from app.core.logging import (
|
||||
)
|
||||
from app.db.init_data import seed_default_data
|
||||
from app.db.session import AsyncSessionLocal, close_engine
|
||||
from app.domains.baigong.executor import Executor
|
||||
from app.integrations.sandbox.client import SandboxClient
|
||||
from app.modules.safety.confirmation import InMemoryConfirmationStore
|
||||
from app.schemas.common import ErrorResponse
|
||||
from app.services.dispatcher import Dispatcher
|
||||
from app.services.event_store import DbEventStore
|
||||
from app.services.safety import load_governor_from_db
|
||||
|
||||
# 模块级初始化日志系统：import 本模块即完成 loguru 配置并接管标准 logging，
|
||||
# 覆盖 ``python -m app.main`` 与 ``uvicorn app.main:app`` 两种启动入口。
|
||||
@@ -107,47 +105,31 @@ async def lifespan(_app: FastAPI) -> AsyncGenerator[None, None]:
|
||||
# 各枢核心就绪后在 start() 前 register；lifespan 管理 start/stop。
|
||||
_app.state.dispatcher = Dispatcher(_app.state.event_store)
|
||||
await _app.state.dispatcher.start()
|
||||
_app.state.confirmation_store = InMemoryConfirmationStore()
|
||||
if settings.use_db_confirmation_store:
|
||||
from app.modules.safety.confirmation import DbConfirmationStore
|
||||
|
||||
_app.state.confirmation_store = DbConfirmationStore(AsyncSessionLocal)
|
||||
log_with_context("confirmation_store_set_to_db")
|
||||
# 百工执行器：乾坤沙箱客户端（HMAC 授契）+ 长生命周期 HTTP；未配置时乾坤类能力 503
|
||||
sandbox_http: httpx.AsyncClient | None = None
|
||||
tools_http: httpx.AsyncClient | None = None
|
||||
if settings.enable_tool_runtime:
|
||||
try:
|
||||
if settings.sandbox_auth_enabled and not settings.sandbox_auth_secret:
|
||||
raise ValueError("SANDBOX_AUTH_ENABLED=true 但 SANDBOX_AUTH_SECRET 未配置")
|
||||
sandbox_http = httpx.AsyncClient(trust_env=False)
|
||||
# executor 工具（fetch_url）的长生命周期 HTTP 客户端，
|
||||
# 与 sandbox client 同生命周期，由 lifespan 统一 aclose。
|
||||
tools_http = httpx.AsyncClient(trust_env=False)
|
||||
sandbox = SandboxClient(sandbox_http, settings)
|
||||
governor = await load_governor_from_db()
|
||||
_app.state.tool_runtime = ToolRuntime(
|
||||
sandbox,
|
||||
governor,
|
||||
_app.state.event_store,
|
||||
http_client=tools_http,
|
||||
)
|
||||
log_with_context("百工工具运行时就绪")
|
||||
# 启动加载 MCP server 工具（按 transport 类型注册，失败不阻断启动）
|
||||
try:
|
||||
from app.services.mcp import load_registered_mcp_servers
|
||||
try:
|
||||
if settings.sandbox_auth_enabled and not settings.sandbox_auth_secret:
|
||||
raise ValueError("SANDBOX_AUTH_ENABLED=true 但 SANDBOX_AUTH_SECRET 未配置")
|
||||
sandbox_http = httpx.AsyncClient(trust_env=False)
|
||||
sandbox = SandboxClient(sandbox_http, settings)
|
||||
_app.state.baigong_sandbox = sandbox
|
||||
_app.state.baigong_executor = Executor(sandbox, http_client=sandbox_http)
|
||||
log_with_context("百工执行器就绪（乾坤沙箱已接入）")
|
||||
except Exception as exc: # noqa: BLE001 — 配置缺失降级，不阻断启动
|
||||
_app.state.baigong_sandbox = None
|
||||
_app.state.baigong_executor = Executor(None)
|
||||
log_with_context(f"乾坤沙箱未就绪，qiankun 类能力将返回 503：{exc}", level="WARNING")
|
||||
|
||||
await load_registered_mcp_servers(
|
||||
_app.state.tool_runtime,
|
||||
process_manager=_app.state.mcp_process_manager,
|
||||
)
|
||||
except Exception: # noqa: BLE001
|
||||
log_with_context("MCP 启动加载失败，已跳过", level="WARNING")
|
||||
except Exception as exc: # noqa: BLE001 — 任意配置/构造失败均降级，不阻断启动
|
||||
_app.state.tool_runtime = None
|
||||
log_with_context(f"百工工具运行时未就绪，工具 API 将返回 503：{exc}", level="WARNING")
|
||||
else:
|
||||
_app.state.tool_runtime = None
|
||||
log_with_context("ENABLE_TOOL_RUNTIME=false，工具运行时未启用", level="INFO")
|
||||
# 启动登记 MCP 传输实例（stdio 不自动启动；派生能力已在登记/刷新时落库）
|
||||
try:
|
||||
from app.services.mcp import load_registered_mcp_servers
|
||||
|
||||
await load_registered_mcp_servers(
|
||||
process_manager=_app.state.mcp_process_manager,
|
||||
)
|
||||
except Exception: # noqa: BLE001
|
||||
log_with_context("MCP 启动加载失败，已跳过", level="WARNING")
|
||||
|
||||
yield
|
||||
|
||||
@@ -156,8 +138,6 @@ async def lifespan(_app: FastAPI) -> AsyncGenerator[None, None]:
|
||||
await _app.state.dispatcher.stop()
|
||||
if sandbox_http is not None:
|
||||
await sandbox_http.aclose()
|
||||
if tools_http is not None:
|
||||
await tools_http.aclose()
|
||||
# MCP 进程管理器关闭所有 stdio 子进程
|
||||
if getattr(_app.state, "mcp_process_manager", None) is not None:
|
||||
await _app.state.mcp_process_manager.shutdown_all()
|
||||
|
||||
Reference in new issue
Block a user