M5：百工与司命——能力注册表、授契行契请命、禁域裁决与观察标证

- 百工域 domains/baigong：capabilities（统一能力契约：执行类型 builtin/qiankun/mcp/http + 四维风险标注 + 来源版本）、mandates（授契 grant / 行契 charter 预算时间窗，撤销立即生效）、tool_calls（净化摘要 + 观察标证）；请命复用 pending_confirmations 加 expires_at/brief_json（超时=拒绝执行 HJ-1302，六要素说明）
- 司命裁决器 siming.py：四维取最高档（能力/数据/后果/情境）；禁域为代码常量不可配置（递归删根/格式化/写裸设备/fork 炸弹、file:// 协议、密钥材料外发）——专项测试断言恶意标注与篡改对象仍拒 HJ-1301
- 执行链：禁域→裁决（HJ-1303 未授契拒且双留痕）→请命→执行（乾坤经 SandboxClient HMAC；MCP 经 call_tool；内置无副作用）→净化标证（观察非事实，敏感遮蔽+体量截断）→行动账
- MCP 登记/启停/刷新自动派生与撤下 capabilities（博闻登记接入点）；内置能力种子（echo/datetime/qiankun.shell/web.fetch）
- 端点：/capabilities /mandates /petitions /tool-calls + /tools 兼容投影；前端百工页四区（能力目录四维标注/授契行契/请命批准拒绝/行动账观察标证）
- 退役：modules/safety|skills|tool_runtime|agent、application/tool_runtime、services/skills|safety、tool_policies/skills/model_endpoint_overrides 表（迁移 006）、前端 SkillManager/ToolsConsole/旧 tools 页
- 验收（test_baigong_siming 四用例）：未授契被拒留痕、请命超时不执行、禁域不可关闭、结果为观察不入忆；后端 454、前端 220、BFF 4、神识 5 包全绿（2 个预存环境失败不变）

backend/tests/test_api.py

@@ -114,40 +114,6 @@ async def test_personality_propose_approve_reject_and_rollback(client: AsyncClie
         app.dependency_overrides.pop(require_admin, None)
 
 
-@pytest.mark.asyncio
-async def test_skills_crud(client: AsyncClient) -> None:
-    """Skill 能力包 CRUD——覆盖 services/skills 路径。"""
-    created = await client.post(
-        "/api/v1/tools/skills",
-        json={
-            "name": "测试技能",
-            "description": "用于集成测试",
-            "trigger": "测试触发",
-            "prompt_fragment": "测试提示片段",
-            "tool_bindings": [],
-            "risk_level": "L0",
-        },
-    )
-    assert created.status_code == 201
-    skill_id = created.json()["id"]
-
-    listed = await client.get("/api/v1/tools/skills")
-    assert listed.status_code == 200
-    assert any(item["id"] == skill_id for item in listed.json())
-
-    # Skills 没有 GET single 端点，跳过
-
-    updated = await client.patch(
-        f"/api/v1/tools/skills/{skill_id}",
-        json={"description": "改描述", "trigger": "新触发"},
-    )
-    assert updated.status_code == 200
-    assert updated.json()["trigger"] == "新触发"
-
-    deleted = await client.delete(f"/api/v1/tools/skills/{skill_id}")
-    assert deleted.status_code == 204
-
-
 @pytest.mark.asyncio
 async def test_mcp_server_crud(client: AsyncClient) -> None:
     """MCP 服务器注册 CRUD——覆盖 services/mcp 路径。"""
@@ -213,43 +179,6 @@ async def test_world_entities_crud(client: AsyncClient) -> None:
     assert gone.status_code in (200, 404)
 
 
-@pytest.mark.asyncio
-async def test_safety_policy_crud(client: AsyncClient) -> None:
-    """安全策略 CRUD——覆盖 services/governance 部分路径。"""
-    import uuid
-
-    policy_name = f"test-policy-{uuid.uuid4().hex[:8]}"
-    created = await client.post(
-        "/api/v1/safety/policies",
-        json={
-            "name": policy_name,
-            "description": "集成测试策略",
-            "risk_level": "L3",
-            "permission_policy": "ask",
-            "side_effect": True,
-            "audit_required": True,
-        },
-    )
-    assert created.status_code == 201, created.text
-    data = created.json()
-    assert data["name"] == policy_name
-
-    listed = await client.get("/api/v1/safety/policies")
-    assert listed.status_code == 200
-    # SafetyPolicyItem 使用 tool 字段名（不是 name）
-    assert any(item["tool"] == policy_name for item in listed.json())
-
-    updated = await client.patch(
-        f"/api/v1/safety/policies/{policy_name}",
-        json={"description": "改后描述", "risk_level": "L2"},
-    )
-    assert updated.status_code == 200, updated.text
-    assert updated.json()["risk_level"] == "L2"
-
-    deleted = await client.delete(f"/api/v1/safety/policies/{policy_name}")
-    assert deleted.status_code == 204
-
-
 @pytest.mark.asyncio
 async def test_preferences_flow(client: AsyncClient) -> None:
     """偏好设置读写——覆盖 services/preferences 路径。"""