pr

.dockerignore

@@ -0,0 +1,28 @@
+.git
+.github
+.env
+.env.*
+!.env.example
+.venv
+**/__pycache__
+*.py[cod]
+.pytest_cache
+.ruff_cache
+.mypy_cache
+node_modules
+frontend/node_modules
+frontend/.next
+frontend/out
+data
+.codegraph
+.understand-anything
+.playwright-cli
+.claude
+.idea
+.vscode
+docs/internal
+docs/generated
+deploy/secrets
+*.log
+*.tmp
+.tmp-go-cache

.env.example

@@ -13,6 +13,24 @@
 # AGENTHUB_MEMORY_EVENTS_ENABLED=true
 # DATABASE_DSN=postgres://agenthub:agenthub@localhost:5432/agenthub?sslmode=disable
 
+# 本地 Decision 到期监督（默认不启动）
+# 启用：docker compose -f deploy/docker-compose.platform.yml --profile mission-supervision up -d --build
+# DSN 写入此文件，文件内容示例：postgresql://agenthub:agenthub@postgres:5432/agenthub
+# AGENTHUB_DECISION_EXPIRY_DATABASE_URL_FILE=./secrets/decision-expiry-database-url
+# AGENTHUB_DECISION_EXPIRY_IDLE_DELAY_SECONDS=0.5
+# AGENTHUB_DECISION_EXPIRY_MAX_DELAY_SECONDS=10.0
+
+# Artifact byte verification (Mission Control reads; Runner/Artifact Store writes)
+# AGENTHUB_ARTIFACT_STORE_BACKEND=local
+# AGENTHUB_ARTIFACT_LOCAL_ROOT=data/artifacts
+# AGENTHUB_ARTIFACT_PUBLISH_MAX_BYTES=1073741824
+# AGENTHUB_ARTIFACT_VERIFY_MAX_BYTES=1073741824
+# MINIO_ENDPOINT=127.0.0.1:9000
+# MINIO_ACCESS_KEY=minio
+# MINIO_SECRET_KEY=minio123
+# MINIO_BUCKET=agenthub
+# MINIO_SECURE=false
+
 # ── 安全 (Security) ──────────────────────────────────────────────────
 # JWT 密钥 — 留空则开发模式（不验签），生产环境必须设置 64 字符 hex
 # JWT_SECRET=
@@ -29,6 +47,14 @@
 
 # Anthropic Claude
 # ANTHROPIC_API_KEY=sk-ant-...
+#
+# ── 统一 LLM 网关（可选，new-api 风格）───────────────────────────────
+# 默认留空：走自研按供应商适配器。设为 "newapi" 后，远程供应商的模型
+# 统一经 new-api 的 OpenAI 兼容入口转发（渠道选择、重试、计费由网关负责）。
+# 部署参考：deploy/docker-compose.newapi.yml；迁移：python deploy/newapi/migrate_models.py --apply
+# AGENTHUB_LLM_GATEWAY=newapi
+# AGENTHUB_NEWAPI_BASE_URL=http://127.0.0.1:3000/v1
+# AGENTHUB_NEWAPI_API_KEY=sk-agenthub-xxxx
 
 # BGE Embedding (TEI-compatible server)
 # BGE_API_URL=http://127.0.0.1:8080
@@ -51,9 +77,23 @@
 # VLLM_BASE_URL=http://vllm:8000/v1
 # VLLM_API_KEY=not-needed
 # VLLM_EMBED_MODEL=text-embedding-3-small
+
+# Go Gateway -> Python Mission control plane (A2A task persistence)
+# MISSION_CONTROL_PLANE_URL=http://127.0.0.1:8000
 # VLLM_MODEL=Qwen/Qwen2.5-7B-Instruct       # docker-compose 启动 vLLM 时加载的模型
 # HF_TOKEN=                                  # 拉取 gated 模型时的 HuggingFace token
 
+# ── A2A 分发模式 (ADR-0053 cutover) ───────────────────────────────────
+# gateway（默认）：Gateway 在请求路径同步转发远程任务（兼容）。
+# runner：Gateway 仅提交到 Mission Control，远端分发交给 Runner outbound worker，
+#         两条路径不会同时派发同一 attempt。
+# A2A_DISPATCH_MODE=gateway
+
+# ── Legacy LangGraph 编排 (R2 下线) ───────────────────────────────────
+# 默认 false：聊天路由直接走 agent_service 工具循环，不再经 LangGraph 编排。
+# 仅在受控迁移窗口显式开启。
+# AGENTHUB_ENABLE_LEGACY_LANGGRAPH=false
+
 # ── 沙盒执行 (Sandbox Execution) ─────────────────────────────────────
 # SANDBOX_MODE=auto                          # auto / subprocess / remote
 # SANDBOX_SERVICE_URL=http://sandbox-service:8097

.github/workflows/ci.yml

@@ -11,6 +11,61 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
+  # ═══════════════════════════════════════════════════════════════════
+  # Docs & benchmark gates (R1/R4) — doc-link integrity + claim discipline
+  # + measured perf gates
+  # ═══════════════════════════════════════════════════════════════════
+  docs-gates:
+    name: 'Docs & Benchmark Gates'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: '3.11'
+      - run: pip install -r requirements.txt
+        continue-on-error: true
+      - name: Check doc links resolve
+        run: python benchmarks/gates.py check-links
+      - name: Check claim discipline (no oversold performance claims)
+        run: python benchmarks/gates.py check-docs
+      - name: Real token-compaction gate (measured against production helpers)
+        run: python benchmarks/gates.py run --name token_compaction_ratio
+      - name: Code file-size gate (<=800 lines, legacy ratchet may only shrink)
+        run: python benchmarks/gates.py run --name code_file_size
+      - name: Code complexity gate (McCabe <=20, class-qualified exemptions)
+        run: python benchmarks/gates.py run --name code_complexity
+      - name: Streaming first-token (TTFT) gate (pooled local mock, < 2s per docs claim)
+        run: python benchmarks/gates.py run --name streaming_ttft
+      - name: Restore native tokenizer assets
+        id: tokcache
+        uses: actions/cache@v4
+        with:
+          path: assets/tokenizers
+          # Key pins the Qwen tokenizer.json sha256[:16]; bump when
+          # benchmarks/fetch_tokenizers.py REPOS changes.
+          key: cn-tokenizers-qwen-c0382117ea329cdf
+      - name: Provision CN tokenizer assets (HF primary + mirror fallback)
+        if: steps.tokcache.outputs.cache-hit != 'true'
+        run: |
+          pip install "tokenizers>=0.20,<1"
+          python benchmarks/fetch_tokenizers.py --provider qwen
+        # Network flake must not hard-block CI: the gate degrades to an
+        # honest SKIP when no asset exists (never a synthetic pass).
+        continue-on-error: true
+      - name: CN tokenizer billing-parity gate
+        env:
+          AGENTHUB_TOKENIZER_QWEN_PATH: ${{ github.workspace }}/assets/tokenizers/qwen
+          AGENTHUB_CN_TOKENIZER_PROVIDER: qwen
+        run: python benchmarks/gates.py run --name cn_tokenizer_precision
+      # MM-5 opt-in vision probe: honest SKIP unless a real channel is wired
+      # via repo secrets (NEWAPI_BASE_URL / AGENTHUB_TEST_CHANNEL_KEY).
+      - name: Multimodal vision e2e probe (skips without channel secrets)
+        env:
+          NEWAPI_BASE_URL: ${{ secrets.NEWAPI_BASE_URL }}
+          AGENTHUB_TEST_CHANNEL_KEY: ${{ secrets.AGENTHUB_TEST_CHANNEL_KEY }}
+        run: python benchmarks/gates.py run --name multimodal_e2e_probe
+
   # ═══════════════════════════════════════════════════════════════════
   # Frontend
   # ═══════════════════════════════════════════════════════════════════
@@ -60,7 +115,14 @@ jobs:
             echo "::endgroup::"
           done
       # test all modules (skip integration tests that need infra)
-      - run: go test -short -race -count=1 ./...
+      - name: go test (all modules)
+        run: |
+          set -e
+          for mod in $(find . -name go.mod -not -path '*/testdata/*' | sed 's|/go.mod||'); do
+            echo "::group::go test $mod"
+            (cd "$mod" && go test -short -race -count=1 ./...)
+            echo "::endgroup::"
+          done
 
   # ═══════════════════════════════════════════════════════════════════
   # Rust — all crates
@@ -100,12 +162,97 @@ jobs:
         with:
           python-version: '3.11'
           cache: pip
-      - run: pip install ruff mypy pytest
+      - run: pip install ruff mypy pytest pytest-cov
       - run: ruff check .
         continue-on-error: true
       - run: mypy --ignore-missing-imports --check-untyped-defs .
         continue-on-error: true
-      - run: pytest --tb=short -q
+      # services/python currently ships no test files; bare pytest would exit 5
+      # (no tests collected) and fail the job. Skip honestly until tests land —
+      # the coverage gate already SKIPs without a coverage.xml artifact.
+      - name: Run pytest (honest SKIP while services/python has no tests)
+        run: |
+          if find . -name 'test_*.py' -not -path '*/node_modules/*' | grep -q .; then
+            pytest --cov=services --cov-report=xml --tb=short -q
+          else
+            echo "[SKIP] services/python has no test files yet; add tests to enforce coverage."
+          fi
+      - name: Coverage gate (line-rate >= 60%)
+        run: python ../../benchmarks/gates.py run --name test_coverage
+
+  workspace-runner-integration:
+    name: 'Python - Workspace Runner integration'
+    runs-on: ubuntu-latest
+    services:
+      postgres:
+        image: postgres:16
+        env:
+          POSTGRES_USER: agenthub_test
+          POSTGRES_PASSWORD: agenthub_test
+          POSTGRES_DB: agenthub_test
+        ports:
+          - 5432:5432
+        options: >-
+          --health-cmd "pg_isready -U agenthub_test -d agenthub_test"
+          --health-interval 5s
+          --health-timeout 5s
+          --health-retries 10
+    env:
+      AGENTHUB_TEST_POSTGRES_DSN: >-
+        postgresql://agenthub_test:agenthub_test@127.0.0.1:5432/agenthub_test
+      # tests/integration imports the `app` package by its repo-root path;
+      # without this pytest cannot resolve it on the runner.
+      PYTHONPATH: ${{ github.workspace }}
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: '3.11'
+          cache: pip
+          cache-dependency-path: requirements.txt
+      - run: pip install -r requirements-dev.txt
+      - run: ruff check tests/integration
+      - run: pytest tests/integration --tb=short -q
+
+  # ═══════════════════════════════════════════════════════════════════
+  # Developer CLI — unit tests + headless exec --json smoke (north-star M1)
+  # The exec smoke proves the exit-code contract on CI: the mock provider
+  # cannot create files, so the VERIFY: gate must veto the mission and
+  # `agenthub exec --json` must exit 1 (never a fake success).
+  # ═══════════════════════════════════════════════════════════════════
+  cli:
+    name: 'Developer CLI'
+    runs-on: ubuntu-latest
+    env:
+      PYTHONPATH: ${{ github.workspace }}
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: '3.11'
+          cache: pip
+          cache-dependency-path: requirements.txt
+      - run: pip install -r requirements.txt pytest
+      - name: CLI unit tests
+        run: pytest tests/cli/test_cli_main.py tests/cli/test_cli_chat.py tests/cli/test_cli_chat_compact.py tests/cli/test_cli_tui.py tests/cli/test_cli_frozen.py tests/cli/test_cli_review.py tests/cli/test_stack_installer.py tests/scripts/test_make_stack_manifest.py tests/core/test_project_root.py tests/services/test_web_search_tool.py tests/services/test_web_fetch_tool.py tests/services/test_tool_permissions.py tests/services/test_desktop_skill_tools.py tests/desktop/test_bootstrap_wizard_ui.py tests/desktop/test_release_signing.py tests/npm/test_npm_cli_package.py --tb=short -q
+      - name: CLI e2e (mock provider, honest-failure contract)
+        env:
+          AGENTHUB_CLI_E2E: '1'
+        run: pytest tests/cli/test_cli_e2e.py --tb=short -q
+      - name: Headless exec smoke (exit code must be 1, verifier veto)
+        working-directory: ${{ runner.temp }}
+        run: |
+          mkdir -p agenthub-cli-smoke && cd agenthub-cli-smoke
+          OBJ="创建 hello.py 并打印 hello world。"$'\n'"VERIFY: python hello.py"
+          set +e
+          python -m app.cli exec "$OBJ" --json --mission-timeout 240 > result.json
+          code=$?
+          set -e
+          echo "exit code: $code"
+          cat result.json
+          test "$code" -eq 1
+          grep -q '"status": "FAILED"' result.json
+
 
   # ═══════════════════════════════════════════════════════════════════
   # Docker — build verification (key images only, parallel)

.github/workflows/cli-jsonl-smoke.yml

@@ -0,0 +1,21 @@
+name: CLI JSONL smoke
+
+on:
+  workflow_dispatch:
+  pull_request:
+    paths:
+      - "app/cli/**"
+      - "app/services/model_port.py"
+      - "tests/cli/**"
+
+jobs:
+  cli-jsonl:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+      - run: python -m pip install -r requirements-dev.txt
+      - run: python -m pytest tests/cli -q
+      - run: python scripts/cli_provider_smoke.py

.github/workflows/cli-package-install.yml

@@ -0,0 +1,42 @@
+name: CLI GitHub Release install and rollback
+
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        description: Target cli-v* GitHub Release version
+        required: true
+        type: string
+      previous_version:
+        description: Previous cli-v* version used for rollback
+        required: true
+        type: string
+
+jobs:
+  windows-install-upgrade-rollback:
+    runs-on: windows-latest
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: '3.12'
+      - name: Verify checksummed GitHub Release lifecycle
+        shell: pwsh
+        env:
+          AGENTHUB_RELEASE_ID: github-${{ github.run_id }}
+          AGENTHUB_PRODUCTION_EVIDENCE_DIR: ${{ github.workspace }}\artifacts\production\github-${{ github.run_id }}
+        run: >-
+          python scripts/verify_github_release.py
+          --target "${{ inputs.version }}"
+          --previous "${{ inputs.previous_version }}"
+          --output "${{ runner.temp }}\github-release.json"
+      - uses: actions/upload-artifact@v4
+        if: always()
+        with:
+          name: cli-github-release-${{ inputs.version }}
+          path: |
+            artifacts/production/**/*.json
+            ${{ runner.temp }}/github-release.json
+          if-no-files-found: ignore

.github/workflows/cli-production-evidence.yml

@@ -0,0 +1,57 @@
+name: CLI production evidence gates
+
+on:
+  workflow_dispatch:
+  schedule:
+    - cron: "41 3 * * 1"
+
+jobs:
+  benchmark:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+      - run: python -m pip install -r requirements.txt
+      - name: Benchmark evidence
+        env:
+          AGENTHUB_RELEASE_ID: evidence-${{ github.run_id }}
+          AGENTHUB_PRODUCTION_EVIDENCE_DIR: ${{ github.workspace }}/artifacts/production/evidence-${{ github.run_id }}
+          AGENTHUB_BENCHMARK_EVIDENCE_OUTPUT: ${{ runner.temp }}/benchmark.json
+        run: python scripts/cli_benchmark.py --task-file benchmarks/cli_tasks.json --task-id conversation-basic --check-thresholds
+      - uses: actions/upload-artifact@v4
+        if: always()
+        with:
+          name: cli-benchmark-evidence
+          path: |
+            artifacts/production/**/*.json
+            ${{ runner.temp }}/benchmark.json
+          if-no-files-found: ignore
+
+  sse-recovery:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+      - run: python -m pip install -r requirements.txt
+      - name: SSE disconnect and cursor recovery evidence
+        env:
+          AGENTHUB_CLI_BASE_URL: ${{ vars.AGENTHUB_SSE_BASE_URL }}
+          AGENTHUB_CLI_AUTH_TOKEN: ${{ secrets.AGENTHUB_CLI_AUTH_TOKEN }}
+          AGENTHUB_CLI_SSE_MISSION_ID: ${{ vars.AGENTHUB_SSE_MISSION_ID }}
+          AGENTHUB_CLI_SSE_FAULT_INJECTED: "1"
+          AGENTHUB_RELEASE_ID: evidence-${{ github.run_id }}
+          AGENTHUB_PRODUCTION_EVIDENCE_DIR: ${{ github.workspace }}/artifacts/production/evidence-${{ github.run_id }}
+          AGENTHUB_SSE_EVIDENCE_OUTPUT: ${{ runner.temp }}/sse-recovery.json
+        run: python scripts/cli_sse_recovery_evidence.py
+      - uses: actions/upload-artifact@v4
+        if: always()
+        with:
+          name: cli-sse-recovery-evidence
+          path: |
+            artifacts/production/**/*.json
+            ${{ runner.temp }}/sse-recovery.json
+          if-no-files-found: ignore