chore(release): v3.34.0

Co-authored-by: Codex <noreply@openai.com>

.agents/skills/cpr-dev-guide/SKILL.md

@@ -1,28 +1,32 @@
 ---
 name: cpr-dev-guide
-description: Codex Proxy RS 前后端开发、排障、代码审查和文档修改入口；改页面、弹窗、样式、文案，修接口、调度、数据库、Rust、宿主 SDK 或 Runtime 时均使用；PR、Issue、独立网关插件与发版另配对应技能
+description: Codex Proxy RS 开发、修复、排障、代码审查和文档修改入口；页面、样式、文案、接口、调度、数据库及宿主 SDK、Runtime、插件接入均适用；PR、Issue、独立网关插件与发版叠加对应技能
 ---
 
 # 开发指南
 
-## 先匹配任务与文件
+## 先确定领域与必读规范
 
-按用户要改的行为初判，定位后按实际修改或审查的文件复核，不要求用户说出“前端”“后端”或技能名。**命中多行就同时执行，先读取对应规范再修改或给出审查结论**；任务范围变化时补齐新命中项，已有上下文直接复用
+按用户意图、受影响行为与对象初判，定位后按实际文件复核，不要求用户说出“前端”“后端”或技能名。**所有命中行共同构成本次必读规范，先读完再确定方案、修改或给出审查结论**；跨领域叠加，不能只选最像当前步骤的一行
 
-| 命中条件，操作或文件满足其一即可 | 必须执行 |
+职责边界决定问题由谁修复；即使代码位于账号、调度或 API 模块，只要影响插件接入或为插件增加处理，也命中插件边界。确定方案时说明相关业务事实的归属及已有实现的复用依据，不能以功能恢复或测试通过替代职责判断
+
+| 领域或操作，行为影响与文件路径满足其一即可 | 确定方案前读取与执行 |
 | --- | --- |
 | 调整页面、弹窗、表单、按钮、文案、样式或交互；目标在 `frontend/`、`modules/ui/`、插件前端，或是 `.vue` 文件 | [前端流程](references/frontend.md)，覆盖组件复用、文案、Token、样式、视觉状态和运行证据；局部修改同样执行 |
-| 修改服务端接口、路由、调度、账号与用量规则、持久化、后台任务或协议行为；目标是 `backend/` 中的实现、配置、迁移，或 Rust 源码 | [Workspace 边界](../../../docs/architecture.md#3-workspace-边界)、所属模块、[后端自审](../../../docs/architecture.md#后端自审)；涉及 Rust 时使用 `$rust-best-practices` 和下方后端注释要求，验证时读[命令](../../../docs/architecture.md#验证命令) |
+| 开发、排查或审查插件接入、宿主 SDK、Runtime、扩展接口或独立网关插件；目标在 `backend/crates/gateway-plugin/`、`modules/plugins/` | 完整读取[插件职责边界](references/plugin-boundaries.md)及所用 [SDK](../../../backend/crates/gateway-plugin/sdk/README.md) 类型与能力合同；宿主维护自身合同、资源与稳定性，插件业务错误在插件侧修复，不在宿主、SDK 或 Runtime 中补偿；独立插件开发、排查、审查另用 [cpr-plugin-dev](../cpr-plugin-dev/SKILL.md) |
+| 开发、排查或审查服务端接口、路由、调度、账号与用量规则、持久化、后台任务或协议行为；目标是 `backend/` 中的实现、配置、迁移，或 Rust 源码 | [Workspace 边界](../../../docs/architecture.md#3-workspace-边界)的模块与依赖规则、所属模块及[后端自审](../../../docs/architecture.md#后端自审)；Rust 使用 `$rust-best-practices` 和下方后端注释要求，宿主 Rust 同时读取 [Rust 模块组织约定](../../../docs/architecture.md#32-rust-模块组织约定) |
 | 修改页面接口调用，或开发、排查、审查面向管理端或模型客户端的 HTTP／WS API 合同 | [API](../../../docs/api.md)对应章节；优先复用已有接口，核对调用方 → 服务端解析 → 实际查询或执行，不能只凭前端类型认定参数生效；按实际改动叠加前后端规范 |
 | 模块或调用链变更 | [Workspace 边界](../../../docs/architecture.md#3-workspace-边界)及所属模块章节，不通读整份架构 |
 | 新增、调整、清理或审查测试 | 下方[测试维护](#测试维护)，按当前行为、职责归属与已有覆盖判断保留、合并或删除 |
 | 修改部署行为、`deploy/` 配置或数据库迁移 | 按范围读取[部署](../../../deploy/README.md)、[迁移](../../../backend/migrations/README.md)对应章节 |
-| 开发、排查或审查宿主 SDK、Runtime、扩展接口或独立插件；目标在 `backend/crates/gateway-plugin/` | [插件职责边界](references/plugin-boundaries.md)及所用 [SDK](../../../backend/crates/gateway-plugin/sdk/README.md) 类型与能力合同；宿主守住自身合同、资源与稳定性，不猜测或补偿插件业务错误；仅独立插件创作、排查另用 [cpr-plugin-dev](../cpr-plugin-dev/SKILL.md) |
 | 修改或审查文档 | [文档检查](references/documentation.md)及目标章节，不默认读取代码开发、页面验收或发布流程 |
-| 普通代码审查 | [审查标准](../../../CONTRIBUTING.md#审查标准)；审查默认只读 |
+| 代码审查，包括 PR 审查 | [审查标准](../../../CONTRIBUTING.md#审查标准)，叠加被审查行为所属领域的规范；审查默认只读 |
 | PR / Issue / 发版 | 按当前意图选 [PR](../cpr-github-pr/SKILL.md)、[Issue](../cpr-github-issue/SKILL.md)或[发版](../cpr-release/SKILL.md)，普通提交不创建 PR |
 
-纯文档任务按文档分支执行，不因文档所在目录或提及的路径、语言、功能加载开发流程。每次补读只解决当前未知项；文档链接带 `#章节` 不代表工具自动截取，先用 `rg -n '^#{1,4} ' 文件` 找边界，只读命中章节，不预读整份 CONTRIBUTING、架构、API、主题或全部 references，全文审查除外
+纯文档任务按文档分支执行；核实文中的合同与职责时读对应领域条款，不因提及代码路径或语言加载实现、构建与页面验收流程
+
+命中的流程引用完整读取，并落实其中指定的必读章节；长文档先用 `rg -n '^#{1,4} ' 文件` 定位，读取指定章节的完整内容。`#章节` 不会自动截取，“按需”仅用于未命中的领域和后续操作资料，不能省略必读规范；已有内容只在当前上下文可用且仍适用时复用，不循环重读技能
 
 ## 参考仓库的优先级
 
@@ -31,9 +35,9 @@ description: Codex Proxy RS 前后端开发、排障、代码审查和文档修
 ## 执行与收尾
 
 1. 遵守已提供的 [AGENTS.md](../../../AGENTS.md)，按其 CodeGraph 约定定位代码；确认工作区、任务范围与已有改动，找到事实归属、同类实现和调用链，补齐上表命中规范及[项目约定](../../../CONTRIBUTING.md#项目约定)对应条目后再修改
-2. 自审完整差异，处理本次引入的职责越界、重复规则、冗余状态与无依据分支；删除或替换功能时一并清理失效的配置、类型、调用、测试与文档，已部署数据和公开合同仍遵守所属迁移及兼容规则；仅审查时报告，不自行修复
+2. 以最终差异重新匹配上表，补齐新增领域的规范并检查实际实现，再处理本次引入的职责越界、重复规则、冗余状态与无依据分支；删除或替换功能时一并清理失效的配置、类型、调用、测试与文档，已部署数据和公开合同仍遵守所属迁移及兼容规则；仅审查时报告，不自行修复
 3. 常规文档只写当前状态；有文档差异时执行[文档检查](references/documentation.md)，没有时只确认现有说明是否失真，普通开发不自动修改 `release/notes.md`
-4. 按变更范围执行[验证](../../../CONTRIBUTING.md#验证)及其停止条件，沿用本轮有效证据与用户已确定的验收分工，区分通过、失败、跳过与未执行；提交时补读[提交约定](../../../CONTRIBUTING.md#项目约定)
+4. 按变更范围执行[验证](../../../CONTRIBUTING.md#验证)及其停止条件，后端命令见[验证命令](../../../docs/architecture.md#验证命令)；沿用本轮有效证据与用户已确定的验收分工，区分通过、失败、跳过与未执行；提交时补读[提交约定](../../../CONTRIBUTING.md#项目约定)
 5. 交付实际结果与验证缺口；前端按[前端流程](references/frontend.md)核对最终差异和运行证据，后端按上表检查生命周期，不把构建通过当作行为验收
 
 ## 测试维护

.agents/skills/cpr-dev-guide/agents/openai.yaml

@@ -1,6 +1,6 @@
 interface:
   display_name: "cpr-dev-guide"
-  short_description: "前后端开发、排障与审查入口，按任务和文件匹配规范并验证"
-  default_prompt: "使用 $cpr-dev-guide 按请求和实际文件匹配前后端规范，读取命中项后完成已授权的开发或审查，并自审、验证和报告结果。"
+  short_description: "开发、排障与审查入口，按行为影响匹配领域边界并验证实现"
+  default_prompt: "使用 $cpr-dev-guide 按请求、行为影响和实际文件匹配领域必读规范，读完职责边界再确定方案，完成已授权的开发或审查、自审与验证。"
 policy:
   allow_implicit_invocation: true

.agents/skills/cpr-dev-guide/references/documentation.md

@@ -1,10 +1,10 @@
 # 文档检查
 
-修改或审查文档时读取，职责与行文统一按 [文档职责与更新条件](../../../../CONTRIBUTING.md#文档职责与更新条件)，只读该节
+修改或审查文档时完整读取本流程，并读取 [文档职责与更新条件](../../../../CONTRIBUTING.md#文档职责与更新条件)的完整章节，覆盖内容归属与层次行文
 
 ## 写之前
 
-先确定读者、必须说明的当前事实与所属章节，再决定是否需要修改及详略；文档职责与更新条件按上节核对
+先确定读者、必须说明的当前事实与所属章节，再决定是否需要修改及详略；文档职责与更新条件按上节核对。涉及合同或职责说明时，补读所属架构、API 或 SDK 的对应条款，核实事实；不因文档提及实现而执行无关的开发与构建流程
 
 ## 逐段验收
 

.agents/skills/cpr-dev-guide/references/frontend.md

@@ -2,9 +2,11 @@
 
 适用于页面、组件、弹窗、表单及局部文案和样式修改，不以是否创建 PR 为触发条件；仅审查时核对和报告，不自行修改
 
-## 开始前
+## 领域必读
 
-读取[前端职责](../../../../docs/architecture.md#34-前端模块职责)、[文案与信息层级](../../../../docs/theme.md#界面文案与信息层级)和[界面验证](../../../../CONTRIBUTING.md#界面验证)，明确本次用户操作、原页面、最接近的同类实现及可复用基础组件；按本轮验收分工留存所需截图
+确定页面方案或审查结论前，读取[前端职责](../../../../docs/architecture.md#34-前端模块职责)、[文案与信息层级](../../../../docs/theme.md#界面文案与信息层级)和[界面验证](../../../../CONTRIBUTING.md#界面验证)的完整章节；只改文案或局部样式也执行。明确本次用户操作、原页面、最接近的同类实现及可复用基础组件，沿用既有设计与请求层，按本轮验收分工留存所需截图
+
+## 按改动补齐规范
 
 用户要求看效果或自行验收时，按[源码联调](../../../../docs/development.md#源码联调)提供当前工作区的可访问预览与页面入口，确认热更新和依赖来源；需要模拟数据时用于实际页面并标明，不把静态稿、旧构建或仅有本机文件路径当作可用预览
 
@@ -12,7 +14,7 @@
 
 | 改动 | 规范入口 |
 | --- | --- |
-| Vue 逻辑、请求或状态 | [项目约定](../../../../CONTRIBUTING.md#项目约定)的前端条目及上述前端职责 |
+| Vue 组件、逻辑、请求或状态 | 使用 `$vue-best-practices`，读取[项目约定](../../../../CONTRIBUTING.md#项目约定)的前端条目；请求与接口合同同时执行开发入口的 API 分支 |
 | 颜色、间距、字体、边框、阴影、局部 CSS 或交互样式 | [通用颜色消费](../../../../docs/theme.md#通用颜色消费)、[样式与命名约定](../../../../docs/theme.md#样式与命名约定)，核对无边常态及 Hover、Focus 等视觉状态 |
 | 主题算法、编辑器或共用组件视觉行为 | 所改主题章节及[扩大验证范围](../../../../docs/theme.md#验证) |
 | 明确指定设计技能，或建立、重塑视觉方向 | 使用指定技能或 `$frontend-design`，设计取舍仍以项目主题、用户任务和已有页面为依据 |

.agents/skills/cpr-dev-guide/references/plugin-boundaries.md

@@ -1,7 +1,7 @@
 # 插件职责边界
 
-仅在开发或审查 SDK、Runtime、宿主扩展接口及独立网关插件时读取
-先看[插件扩展](../../../../docs/architecture.md#31-插件扩展)中的职责与执行边界，不通读整份架构
+开发、排查或审查插件接入、SDK、Runtime、宿主扩展接口及独立网关插件时完整读取，不以文件位于插件目录或正在选择能力为条件
+确定方案前读取[职责与源码入口](../../../../docs/architecture.md#职责与源码入口)、[发布与执行边界](../../../../docs/architecture.md#发布与执行边界)及[信任与资源边界](../../../../docs/architecture.md#信任与资源边界)，明确问题归属、必要宿主保护与插件责任
 
 **宿主提供可组合能力，守住自身合同、资源与稳定性；插件业务正确性和兼容修复由插件负责**
 

.agents/skills/cpr-github-issue/SKILL.md

@@ -13,13 +13,15 @@ description: 草拟、创建、补充或回复 GitHub Issue，包括缺陷、功
 
 补充已有 Issue 先读原帖和讨论，按授权更新或追加，不重复新建；无法推断的目标或关键事实才向用户补齐
 
-## 按需取材
+## 按动作读取与核实
 
-- 新建 Issue 时，本仓库只读[提交 Issue](../../../CONTRIBUTING.md#提交-issue)及本次匹配的一张表单：[接口问题](../../../.github/ISSUE_TEMPLATE/api-bug-report.yml)、[常规问题](../../../.github/ISSUE_TEMPLATE/general-bug-report.yml)或[功能建议](../../../.github/ISSUE_TEMPLATE/feature-request.yml)；协作规则提案可用普通 Issue
+目标、授权、事实与脱敏要求适用于草拟、提交和回复；按下列动作读取必需规则与证据，再组织正文。症状反馈可保留未知根因，进入技术排查或方案判断时补齐对应规范
+
+- 新建 Issue 时，读取本仓库的[提交 Issue](../../../CONTRIBUTING.md#提交-issue)及本次匹配的一张表单：[接口问题](../../../.github/ISSUE_TEMPLATE/api-bug-report.yml)、[常规问题](../../../.github/ISSUE_TEMPLATE/general-bug-report.yml)或[功能建议](../../../.github/ISSUE_TEMPLATE/feature-request.yml)；协作规则提案可用普通 Issue
 - 回复时读取原帖、相关讨论与支撑答复的证据，按下方回复口吻组织内容，不套用新建 Issue 的表单
 - 其他仓库读取它自己的相关规则与实际模板，长文档先定位标题再截取，不预读全部模板或 CONTRIBUTING
 - 搜索同场景 open/closed Issues、相关 PR 和发布记录，区分主分支修复与已发布修复，不凭标题判断重复；没有新证据时返回已有链接，用户仍要求新建则按其要求处理
-- 仅当需要额外排查或修改时使用 [cpr-dev-guide](../cpr-dev-guide/SKILL.md)，提交症状反馈不以找到根因为前提
+- 需要技术排查、判断实现方案或修改时执行 [cpr-dev-guide](../cpr-dev-guide/SKILL.md)的领域必读，不能仅凭症状建议跨职责补偿；提交症状反馈不以找到根因为前提
 - 引用上游行为或提出方案时执行[问题与方案依据](../../../CONTRIBUTING.md#问题与方案依据)，注明适用版本、来源与缺口
 
 ## 正文与证据

.agents/skills/cpr-github-pr/SKILL.md

@@ -19,7 +19,7 @@ description: 准备、创建、更新或审查 GitHub PR，含回复讨论与处
 
 ## 按模式读取
 
-只加载当前模式，已有上下文不重读；长文档先定位标题再截取对应章节，不因链接存在而加载全文或所有 references
+先完成上述范围判断，再按当前动作与差异涉及的领域叠加下表。命中的流程引用完整读取，长文档读取指定章节；只复用已实际读取且仍适用的内容，单纯整理正文或回复不扩展为完整实现审查
 
 | 当前动作 | 读取与执行 |
 | --- | --- |
@@ -27,7 +27,7 @@ description: 准备、创建、更新或审查 GitHub PR，含回复讨论与处
 | 创建或更新 PR | [创建流程](references/create.md)、[PR 流程](../../../CONTRIBUTING.md#pr-流程)与[规则文件保护](../../../CONTRIBUTING.md#规则文件保护) |
 | 审查 PR | [审查流程](references/review.md)、[审查标准](../../../CONTRIBUTING.md#审查标准) |
 | 回复讨论或审查意见 | 目标评论、相关上下文与实际处理结果，按下方回复口吻答复；仅回复不加载创建或完整审查流程 |
-| 需要修改代码或文档 | 使用 [cpr-dev-guide](../cpr-dev-guide/SKILL.md)的对应分支，完成自审与验证 |
+| 实现自审、审查或修改代码与文档 | 执行 [cpr-dev-guide](../cpr-dev-guide/SKILL.md)的领域必读与对应检查，包括后端、插件、测试和 API 等命中项；只读审查同样执行，不能仅核对 PR 正文与 CI |
 | 含前端改动 | [前端流程](../cpr-dev-guide/references/frontend.md)，核对适用规范与当前实现的运行证据 |
 | 含文档改动 | [文档检查](../cpr-dev-guide/references/documentation.md) |
 

.agents/skills/cpr-github-pr/agents/openai.yaml

@@ -1,6 +1,6 @@
 interface:
   display_name: "cpr-github-pr"
   short_description: "提交、更新与审查 PR，核对问题、自审、页面截图和 AI 模型披露"
-  default_prompt: "使用 $cpr-github-pr 按当前请求准备、提交、更新或审查 PR，核实问题与方案，检查自审、验证、页面截图和 AI 模型披露。"
+  default_prompt: "使用 $cpr-github-pr 按当前请求准备、提交、更新或审查 PR，实现自审与审查叠加开发指南的领域规范，核实问题、方案、验证、页面截图和 AI 模型披露。"
 policy:
   allow_implicit_invocation: true

.agents/skills/cpr-github-pr/references/review.md

@@ -4,6 +4,7 @@
 
 1. 获取 PR 的 base/head SHA、描述、文件差异、已有讨论及 CI 状态。记录实际审查的 head，使用 merge-base 差异。
    需要源码上下文时先遵守目标仓库的定位规则；需检出时使用隔离工作区，保留用户当前分支和运行环境。
+   按实际行为与文件执行 [cpr-dev-guide](../../cpr-dev-guide/SKILL.md)的领域必读，再判断方案与实现；只读审查也核对职责边界与生命周期。
 2. 按入口公共核对在目标分支基线核实问题，区分原有问题、环境或配置差异与 PR 新引入的问题，说明主分支已覆盖的部分。
 3. 按[问题与方案依据](../../../../CONTRIBUTING.md#问题与方案依据)评估解决方向，涉及上游时说明官方处理方式及本次方案关系；缺少必要性依据的偏离明确指出，不因测试通过就认定方案合理。
 4. 按[审查标准](../../../../CONTRIBUTING.md#审查标准)追踪完整调用链，找到共享业务事实、同类实现及已有验证。

.agents/skills/cpr-plugin-dev/SKILL.md

@@ -1,13 +1,17 @@
 ---
 name: cpr-plugin-dev
-description: 开发、排查或打包 Codex Proxy RS 独立网关插件；仅改宿主 Runtime、安装器或管理端时使用 cpr-dev-guide，不适用于 Codex 插件或 Vue 插件
+description: 开发、修复、排查、审查或打包 Codex Proxy RS 独立网关插件，含处理器、清单与插件页面；仅改宿主能力时使用 cpr-dev-guide 的插件边界，不适用于 Codex 插件或 Vue 插件
 ---
 
 # 网关插件开发
 
-插件在独立项目中通过公开 SDK 实现业务，不向宿主业务模块添加专属流程
+## 先读职责边界
 
-同时使用 [cpr-dev-guide](../cpr-dev-guide/SKILL.md)的对应任务分支，已加载则复用，不递归重读
+插件在独立项目中通过公开 SDK 实现业务，插件业务错误在插件侧修复；宿主维护自身合同、资源与稳定性，不猜测插件意图、不补造业务数据，不在宿主、SDK 或 Runtime 中增加插件专属补偿
+
+开发、排查和审查先完整读取[插件职责边界](../cpr-dev-guide/references/plugin-boundaries.md)，再选择实现步骤；已有处理器修复和页面改动也执行，不以是否新增能力为条件。需要新增宿主能力时，先界定可独立使用的基础接口及其职责；必要的协议保护与资源回收仍由宿主负责
+
+同时执行 [cpr-dev-guide](../cpr-dev-guide/SKILL.md)的领域必读与收尾要求；已实际读取且仍适用的内容复用，不递归重读入口。仅构建、打包或分发已有插件时按对应操作读取，若需诊断或修改行为，再补齐开发分支
 
 ## 范围与合同
 
@@ -18,13 +22,13 @@ description: 开发、排查或打包 Codex Proxy RS 独立网关插件；仅改
 
 ## 按当前步骤读取
 
-只读取命中行与链接的指定章节，长文档先列标题再截取；不预读全部 SDK、示例、前端和打包资料
+完成上述适用边界后，按当前步骤读取下表；同时涉及多项时叠加。命中的实现或页面参考完整读取，长文档读取指定章节，示例、前端和打包资料在对应步骤加载
 
 | 当前工作 | 入口 |
 | --- | --- |
-| 选择能力或确认能力缺口 | [能力与方法](../../../backend/crates/gateway-plugin/sdk/docs/capabilities.md#能力与方法)、所需能力章节、[插件职责边界](../cpr-dev-guide/references/plugin-boundaries.md) |
-| 清单与 Rust 处理器 | [实现参考](references/implementation.md)、所用 SDK 类型；只有修改清单字段时读[清单](../../../backend/crates/gateway-plugin/sdk/docs/manifest.md)对应章节 |
-| 创建或修改页面 | [页面参考](references/frontend.md)，不需要页面的插件不创建前端 |
+| 选择、使用或审查能力 | [能力与方法](../../../backend/crates/gateway-plugin/sdk/docs/capabilities.md#能力与方法)及所用能力章节，不以已有调用能编译代替合同核对 |
+| 开发、排查或审查清单与 Rust 处理器 | [实现参考](references/implementation.md)、所用 SDK 类型；涉及清单字段时读[清单](../../../backend/crates/gateway-plugin/sdk/docs/manifest.md)对应章节 |
+| 创建、修改或审查页面 | [页面参考](references/frontend.md)，不需要页面的插件不创建前端 |
 | 准备工程或联调依赖 | [工程与依赖](references/development.md#工程与依赖)，需要示例时再读[复用示例](references/development.md#复用示例) |
 | 构建或打包 | [构建与打包](references/development.md#构建与打包) |
 | 实际验收 | [验证与交付](references/development.md#验证与交付)，按实现范围验证 |

.agents/skills/cpr-plugin-dev/agents/openai.yaml

@@ -1,6 +1,6 @@
 interface:
   display_name: "cpr-plugin-dev"
-  short_description: "网关插件开发、接入排障、SDK 实现、页面与打包验证"
-  default_prompt: "使用 $cpr-plugin-dev 按当前请求开发、排查或打包 Codex Proxy RS 网关插件，复用公开 SDK 与已有页面并验证实际行为。"
+  short_description: "独立网关插件开发、排障与审查，先核对宿主边界再实现和验证"
+  default_prompt: "使用 $cpr-plugin-dev 按当前请求开发、排查、审查或打包独立网关插件，先读取适用职责边界，插件业务错误在插件侧修复，再按步骤读取实现与验证资料。"
 policy:
   allow_implicit_invocation: true

.agents/skills/cpr-plugin-dev/references/frontend.md

@@ -1,6 +1,6 @@
 # 插件页面
 
-仅在创建或修改插件页面时读取，先执行[前端流程](../../cpr-dev-guide/references/frontend.md)，再核对以下插件特有合同
+创建、修改或审查插件页面时完整读取，先完成[插件入口](../SKILL.md#先读职责边界)的边界判断并执行[前端流程](../../cpr-dev-guide/references/frontend.md)，再核对以下插件特有合同
 
 - 优先参考独立示例仓库的 `examples/workbench/frontend/src/api/`：业务路由放在 `modules/`，`request.ts` 封装公开宿主桥；按需使用 `@codex-proxy/ui` 包出口，不跨仓导入宿主或 UI 的内部源码
 - Vue 页面保留 SFC，逻辑、脚本和配置使用 TypeScript；只实现业务内容，标题和副标题由 `ManagementPage` 交给宿主显示

.agents/skills/cpr-plugin-dev/references/implementation.md

@@ -1,7 +1,7 @@
 # 清单与处理器实现
 
-仅在编写或排查插件清单、Rust 处理器时读取，涉及 Rust 时使用[开发入口](../../cpr-dev-guide/SKILL.md)的 Rust 分支
-选择能力时只读 SDK 的[能力与方法](../../../../backend/crates/gateway-plugin/sdk/docs/capabilities.md#能力与方法)及所需能力章节
+开发、排查或审查插件清单、Rust 处理器时完整读取，先完成[插件入口](../SKILL.md#先读职责边界)的边界判断，涉及 Rust 时执行[开发入口](../../cpr-dev-guide/SKILL.md)的 Rust 分支
+使用能力前读取 SDK 的[能力与方法](../../../../backend/crates/gateway-plugin/sdk/docs/capabilities.md#能力与方法)及所用能力章节，已有实现的修复与审查也核对合同
 
 ## 清单与处理器
 

.agents/skills/cpr-release/SKILL.md

@@ -15,20 +15,6 @@ description: Codex Proxy RS 的版本规划、发布说明、正式或预发行
 
 其他仓库使用其发布入口与规则，不套用本仓库路径；规则已在上下文中时不重复读取
 
-## 按任务读取
-
-只读当前阶段和指定章节，先定位标题再截取，不预读整份 CONTRIBUTING、工作流或所有参考文件；实际发布前仍须核对发布入口的完整副作用
-
-| 任务 | 读取范围 |
-| --- | --- |
-| 推荐版本号 | [基线与版本](references/preparation.md#基线与版本) |
-| 编写或翻译发布说明 | [基线与版本](references/preparation.md#基线与版本)、[发布说明](references/preparation.md#发布说明) |
-| 检查发行条件 | [发行准备检查](references/preparation.md#发行准备检查) |
-| 实际发布 | 完成准备，再读[通道核对](references/operations.md#发行通道核对)和[执行发版](references/operations.md#执行发版) |
-| 失败恢复或验收 | [恢复与验收](references/operations.md#恢复与验收)，先确定已完成步骤，不直接重跑入口 |
-| 实验版 | 在对应阶段补读[实验流程](references/experimental.md)的版本、文案或验收章节 |
-| 修复代码、工作流或常规文档 | 使用 [cpr-dev-guide](../cpr-dev-guide/SKILL.md)，有 PR 任务再使用 [cpr-github-pr](../cpr-github-pr/SKILL.md) |
-
 ## 必须保持的边界
 
 - Codex 兼容性变化按[问题与方案依据](../../../CONTRIBUTING.md#问题与方案依据)核对已有依据与验证范围，缺少依据列为发行风险，不以 CI 通过代替
@@ -37,3 +23,17 @@ description: Codex Proxy RS 的版本规划、发布说明、正式或预发行
 - 预发行不得覆盖 GitHub Latest 或镜像 `latest`，完成后回读核对
 - `release/notes.md` 只承载当前发行的说明；常规文档修改另按开发入口执行[文档检查](../cpr-dev-guide/references/documentation.md)
 - 交付版本、提交、Release／工作流链接与实际结果，未完成构建或缺失产物时不称发布成功
+
+## 按任务读取
+
+先落实上述范围与边界，再读取当前阶段的完整指定章节；实际发布包含准备与验收，不能只读执行命令。阶段变化时补齐读取，准备文案不加载执行流程，实际发布前须核对发布入口的完整副作用
+
+| 任务 | 读取范围 |
+| --- | --- |
+| 推荐版本号 | [基线与版本](references/preparation.md#基线与版本) |
+| 编写或翻译发布说明 | [基线与版本](references/preparation.md#基线与版本)、[发布说明](references/preparation.md#发布说明) |
+| 检查发行条件 | [发行准备检查](references/preparation.md#发行准备检查) |
+| 实际发布 | 先完成[基线与版本](references/preparation.md#基线与版本)、[发布说明](references/preparation.md#发布说明)、[发行准备检查](references/preparation.md#发行准备检查)，再执行[通道核对](references/operations.md#发行通道核对)、[执行发版](references/operations.md#执行发版)与[恢复与验收](references/operations.md#恢复与验收) |
+| 失败恢复或验收 | [恢复与验收](references/operations.md#恢复与验收)，先确定已完成步骤，不直接重跑入口 |
+| 实验版 | 在对应阶段补读[实验流程](references/experimental.md)；实际发布必须覆盖分支与版本、发布能力、文案和执行与验收 |
+| 修复代码、工作流或常规文档 | 使用 [cpr-dev-guide](../cpr-dev-guide/SKILL.md)，有 PR 任务再使用 [cpr-github-pr](../cpr-github-pr/SKILL.md) |

.github/workflows/_container.yml

@@ -14,7 +14,7 @@ permissions:
 
 jobs:
   container:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     timeout-minutes: 45
     env:
       CPR_IMAGE: codex-proxy-rs:ci-${{ inputs.ref }}

.github/workflows/_quality.yml

@@ -24,7 +24,7 @@ permissions:
 jobs:
   backend:
     if: inputs.run_backend
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     timeout-minutes: 30
     env:
       CARGO_TERM_COLOR: always
@@ -34,7 +34,7 @@ jobs:
       CPR_TEST_REDIS_URL: redis://127.0.0.1:6379
     services:
       postgres:
-        image: postgres:18-bookworm@sha256:d9c83446333daec3f0588cc709adb80c26090b7f9f0f7ec8d43c243385d79818
+        image: postgres:18-bookworm@sha256:bbf83594798e144bff365a9c191c5d779f181fb3135902064ab8ff11918020fc
         env:
           POSTGRES_DB: codex_proxy
           POSTGRES_USER: codex_proxy
@@ -48,7 +48,7 @@ jobs:
           --health-timeout 5s
           --health-retries 10
       redis:
-        image: redis:8-alpine@sha256:9d317178eceac8454a2284a9e6df2466b93c745529947f0cd42a0fa9609d7005
+        image: redis:8-alpine@sha256:0bf6577d7774e592b29d093e3ac9390eb91e13d72c21e506afce736de5e0eeb0
         ports:
           - 6379:6379
         options: >-
@@ -108,7 +108,7 @@ jobs:
           components: rustfmt,clippy
 
       - name: Cache Rust
-        uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
+        uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3
         with:
           workspaces: backend -> target
           save-if: ${{ github.event_name == 'push' && github.ref == 'refs/heads/main' }}
@@ -122,7 +122,7 @@ jobs:
         run: cargo clippy --all-targets --all-features --locked -- -D warnings
 
       - name: Setup nextest
-        uses: taiki-e/install-action@8cca0918f8471c33515202b73f56ab27f2bed283 # v2.87.29
+        uses: taiki-e/install-action@1e29709c0ec63babbe8f266397a465f29a825f91 # v2.87.31
         with:
           tool: cargo-nextest@0.9.143
           fallback: none
@@ -199,7 +199,7 @@ jobs:
 
   frontend:
     if: inputs.run_frontend
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     timeout-minutes: 15
     env:
       CI: 'true'
@@ -213,7 +213,7 @@ jobs:
         uses: ./.github/actions/build-frontend
 
   workflow-lint:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     timeout-minutes: 5
     steps:
       - name: Checkout
@@ -223,6 +223,8 @@ jobs:
 
       # GitHub 已支持 queue: max，actionlint 尚未支持该字段
       # https://github.com/rhysd/actionlint/issues/657
+      # GitHub 已提供 ubuntu-26.04，actionlint 尚未收录该标签
+      # https://github.com/actions/runner-images#available-images
       - name: Lint GitHub Actions workflows
         run: >-
           docker run --rm
@@ -231,6 +233,7 @@ jobs:
           rhysd/actionlint:1.7.7@sha256:887a259a5a534f3c4f36cb02dca341673c6089431057242cdc931e9f133147e9
           -color
           -ignore '^unexpected key "queue" for "concurrency" section\. expected one of "cancel-in-progress", "group"$'
+          -ignore '^label "ubuntu-26\.04" is unknown\.'
           .github/workflows/*.yml
 
       - name: Check workflow script syntax

.github/workflows/ci.yml

@@ -20,7 +20,7 @@ concurrency:
 
 jobs:
   changes:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     timeout-minutes: 5
     permissions:
       contents: read
@@ -29,7 +29,6 @@ jobs:
       backend: ${{ steps.filter.outputs.backend }}
       frontend: ${{ steps.filter.outputs.frontend }}
       container: ${{ steps.filter.outputs.container }}
-      source: ${{ steps.filter.outputs.source }}
     steps:
       - name: Checkout
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -41,7 +40,7 @@ jobs:
         id: filter
         uses: dorny/paths-filter@ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d # v4.0.3
         with:
-          # 目录规则取并集，再统一排除说明文档，保留隐藏配置与子模块指针
+          # 目录规则取并集，再统一排除说明文档，保留隐藏配置
           predicate-quantifier: some-with-excludes
           filters: |
             backend:
@@ -61,17 +60,6 @@ jobs:
               - '.github/workflows/ci.yml'
               - '.github/workflows/_quality.yml'
               - '!**/*.md'
-            source:
-              - '.github/scripts/toolchains.rb'
-              - 'backend/rust-toolchain.toml'
-              - 'deploy/Dockerfile'
-              - '.gitmodules'
-              - 'modules/ui'
-              - 'modules/plugins'
-              - 'frontend/**'
-              - 'backend/crates/gateway-plugin/sdk/**'
-              - '.github/workflows/ci.yml'
-              - '!**/*.md'
             container:
               - 'backend/**'
               - 'frontend/**'
@@ -101,66 +89,3 @@ jobs:
     uses: ./.github/workflows/_container.yml
     with:
       ref: ${{ github.event.pull_request.head.sha || github.sha }}
-
-  source-development:
-    needs: changes
-    if: needs.changes.outputs.source == 'true'
-    runs-on: ubuntu-latest
-    timeout-minutes: 20
-    steps:
-      - name: Checkout with development modules
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          ref: ${{ github.event.pull_request.head.sha || github.sha }}
-          submodules: recursive
-      - name: Setup pnpm
-        uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
-        with:
-          package_json_file: frontend/package.json
-      - name: Read build toolchains
-        id: toolchains
-        run: ruby .github/scripts/toolchains.rb >> "$GITHUB_OUTPUT"
-
-      - name: Setup Node
-        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
-        with:
-          node-version: ${{ steps.toolchains.outputs.node }}
-      - name: Setup Rust
-        uses: dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8 # master
-        with:
-          toolchain: ${{ steps.toolchains.outputs.rust }}
-      - name: Check dependency pins
-        run: |
-          ui_revision="$(git -C modules/ui rev-parse HEAD)"
-          for lockfile in frontend/pnpm-lock.yaml modules/plugins/examples/workbench/frontend/pnpm-lock.yaml; do
-            locked_revision="$(sed -nE 's@.*codeload.github.com/zyycn/codex-proxy-ui/tar.gz/([a-f0-9]{40}).*@\1@p' "$lockfile" | sort -u)"
-            if [ "$locked_revision" != "$ui_revision" ]; then
-              echo "::error file=$lockfile::UI dependency must match modules/ui ($ui_revision)"
-              exit 1
-            fi
-          done
-      - name: Install development dependencies
-        run: |
-          pnpm --dir modules/ui install --frozen-lockfile
-          pnpm --dir frontend install --frozen-lockfile
-          pnpm --dir modules/plugins/examples/workbench/frontend install --frozen-lockfile
-      - name: Check UI source integration
-        run: |
-          pnpm --dir frontend build:source
-          pnpm --dir modules/plugins/examples/workbench/frontend build:source
-      - name: Check local SDK integration
-        env:
-          RUST_MIN_STACK: 16777216
-          CARGO_TARGET_DIR: ${{ github.workspace }}/backend/target/plugin-development
-        run: |
-          sdk_check_dir="$RUNNER_TEMP/plugin-source"
-          mkdir -p "$sdk_check_dir/backend"
-          cp modules/plugins/examples/workbench/backend/Cargo.{toml,lock} "$sdk_check_dir/backend/"
-          cp -R modules/plugins/examples/workbench/backend/{src,tests} "$sdk_check_dir/backend/"
-          cp modules/plugins/examples/workbench/plugin.json "$sdk_check_dir/"
-          cargo test --manifest-path "$sdk_check_dir/backend/Cargo.toml" \
-            --config "patch.\"https://github.com/zyycn/codex-proxy-rs.git\".gateway-plugin-sdk.path=\"$GITHUB_WORKSPACE/backend/crates/gateway-plugin/sdk\""
-      - name: Ensure source checks preserve lockfiles
-        run: |
-          git diff --exit-code -- frontend/package.json frontend/pnpm-lock.yaml backend/Cargo.lock
-          git -C modules/plugins diff --exit-code -- examples/workbench/frontend/package.json examples/workbench/frontend/pnpm-lock.yaml examples/workbench/backend/Cargo.lock

.github/workflows/release.yml

@@ -21,7 +21,7 @@ env:
 
 jobs:
   release-info:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     timeout-minutes: 10
     outputs:
       tag: ${{ steps.version.outputs.tag }}
@@ -73,7 +73,7 @@ jobs:
 
   frontend:
     needs: release-info
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     timeout-minutes: 15
     env:
       CI: 'true'
@@ -205,7 +205,7 @@ jobs:
 
   package-assets:
     needs: [release-info, frontend, build-docker-binary, build-binary]
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     timeout-minutes: 20
     permissions:
       contents: read
@@ -312,7 +312,7 @@ jobs:
         uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
 
       - name: Login to GHCR
-        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+        uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}
@@ -375,7 +375,7 @@ jobs:
       queue: max
     # 产物准备可与测试重叠，版本标签和 GitHub Release 必须等全部质量与镜像验证通过
     needs: [release-info, quality, package-assets, build-docker-image]
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     timeout-minutes: 20
     permissions:
       contents: write
@@ -409,7 +409,7 @@ jobs:
         uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
 
       - name: Login to GHCR
-        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+        uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}

.github/workflows/rules.yml

@@ -18,7 +18,7 @@ concurrency:
 
 jobs:
   guard:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     timeout-minutes: 5
     steps:
       # 只查询 PR 元数据，禁止检出或执行贡献分支中的代码。

.github/workflows/security.yml

@@ -19,7 +19,7 @@ concurrency:
 
 jobs:
   backend-security:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     timeout-minutes: 20
     steps:
       - name: Checkout
@@ -28,7 +28,7 @@ jobs:
           ref: ${{ github.event.pull_request.head.sha || github.sha }}
 
       - name: Install cargo-audit
-        uses: taiki-e/install-action@8cca0918f8471c33515202b73f56ab27f2bed283 # v2.87.29
+        uses: taiki-e/install-action@1e29709c0ec63babbe8f266397a465f29a825f91 # v2.87.31
         with:
           tool: cargo-audit@0.22.2
           fallback: none
@@ -38,7 +38,7 @@ jobs:
           cargo-audit audit --file backend/Cargo.lock
 
   frontend-security:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     timeout-minutes: 15
     steps:
       - name: Checkout

AGENTS.md

@@ -5,14 +5,16 @@
 | 任务意图与常见说法 | 必用技能 |
 | --- | --- |
 | 开发、修复、排障、代码审查、改文档；包括“改弹窗／样式／文案”“修接口／调度／数据库”等省略请求 | [cpr-dev-guide](.agents/skills/cpr-dev-guide/SKILL.md)，按实际操作和文件匹配规范，跨前后端同时执行 |
-| 提交／提个 PR、准备或更新 PR、看下 PR、回复 PR 讨论、处理 PR 审查意见 | [cpr-github-pr](.agents/skills/cpr-github-pr/SKILL.md)；需要修改时同时执行 cpr-dev-guide |
+| 提交／提个 PR、准备或更新 PR、看下 PR、回复 PR 讨论、处理 PR 审查意见 | [cpr-github-pr](.agents/skills/cpr-github-pr/SKILL.md)；实现自审、审查或修改同时执行 cpr-dev-guide |
 | 提 Issue、反馈到仓库、把问题或建议整理成 Issue、补充或回复 Issue | [cpr-github-issue](.agents/skills/cpr-github-issue/SKILL.md) |
-| 写网关插件、修改插件能力、排查插件接入、打包插件 | [cpr-plugin-dev](.agents/skills/cpr-plugin-dev/SKILL.md)，同时执行 cpr-dev-guide |
+| 写、修或审查独立网关插件，排查插件接入、打包插件 | [cpr-plugin-dev](.agents/skills/cpr-plugin-dev/SKILL.md)，同时执行 cpr-dev-guide；仅改宿主能力时由 cpr-dev-guide 加载插件边界 |
 | 发版、准备版本、发布 beta／实验版、整理发布说明、打发行 tag | [cpr-release](.agents/skills/cpr-release/SKILL.md) |
 
 结合上下文识别“提交吧”“看看这个问题”等省略说法：普通 Git 提交不自动变成 PR，代码排查不自动变成 Issue；审查与发版准备不代表获准远程写入
 
-只加载当前任务命中的技能、模式和文档章节，复用已有上下文，进入新阶段再补读；链接是按需入口，不是全文或全部参考文件的必读清单
+先完整读取命中技能的 `SKILL.md`，再读取其领域必读规范，之后按当前步骤补充实现、命令和示例。技能名称、描述或入口摘要不能代替正文与必读引用；引用中明确要求“先读”“必须读取”或“执行”的规范也要落实，其他资料按需读取
+
+按用户意图、行为影响和实际文件共同匹配，跨领域叠加；确定方案或给出审查结论前完成对应领域必读，不能因改动小、路径未落在该模块或自认为熟悉而跳过。只复用当前上下文中已实际读取且仍适用的内容；输出截断、上下文压缩后缺失的必要内容须补读，范围或阶段变化时重新匹配
 
 执行所选流程中的问题核实、自审、验证与交付要求，协作流程和审查标准见 [CONTRIBUTING.md](CONTRIBUTING.md)
 

CONTRIBUTING.md

@@ -228,7 +228,7 @@ git diff --check
 
 ## 自动检查与合并条件
 
-[CI](.github/workflows/ci.yml) 按变更范围调用质量检查，Markdown 不触发后端、前端、容器和源码联调任务，工作流语法检查独立执行
+[CI](.github/workflows/ci.yml) 按变更范围调用质量检查，Markdown 不触发后端、前端和容器任务，工作流语法检查独立执行
 
 后端 CI 使用 nextest 执行 `main` 集成测试，默认 Redis 密码模式执行完整测试集，ACL 用户模式复用同一批构建产物执行 Store 的 Redis 测试；本地验证命令见 [架构文档](docs/architecture.md#验证命令)
 

backend/Cargo.lock

@@ -147,9 +147,9 @@ dependencies = [
 
 [[package]]
 name = "async-compression"
-version = "0.4.50"
+version = "0.4.51"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ee19bd99b43e3691acbad4e840420a4881cea6c0b66a208125a824f8fd53f5a1"
+checksum = "9d5755640120b24961f8231e05892e4a4f7e0d04e8aeca161508c9c397946970"
 dependencies = [
  "compression-codecs",
  "compression-core",
@@ -224,9 +224,9 @@ checksum = "f2032f911046de80f0a198e0901378627c33f59ea0ac00e363d481118bd70a53"
 
 [[package]]
 name = "aws-credential-types"
-version = "1.3.0"
+version = "1.3.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e93964ffdaf57857f544be3666a5f57570bb699e934700f11b49708f61bb556e"
+checksum = "576e8da35751dc85409ec1cd15999f692c277a1fbe9336780fe6f15e49dd637d"
 dependencies = [
  "aws-smithy-async",
  "aws-smithy-runtime-api",
@@ -260,9 +260,9 @@ dependencies = [
 
 [[package]]
 name = "aws-runtime"
-version = "1.10.0"
+version = "1.10.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2b8a9911551b4ea6ca13805ef52ed96f7d2bbb43cc3b4a14cb0776a71f33cfaa"
+checksum = "9a0cc2144962cc5e358467b16e3d82981b1d424a7c3d34602be0036103814a1a"
 dependencies = [
  "aws-credential-types",
  "aws-sigv4",
@@ -286,9 +286,9 @@ dependencies = [
 
 [[package]]
 name = "aws-sdk-s3"
-version = "1.152.0"
+version = "1.155.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "004d5acbd6850ab58789a43822e0a2ef23927a46b012c17f8fa51253103db9f8"
+checksum = "5a542f0e9261b9ce56708d591a62062079fa3c58a362ffbf49a2e48a4f6ced16"
 dependencies = [
  "arc-swap",
  "aws-credential-types",
@@ -322,9 +322,9 @@ dependencies = [
 
 [[package]]
 name = "aws-sigv4"
-version = "1.6.0"
+version = "1.6.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2312577f088c9fbf4206dfdb884cf1de9407b43e1a923cbed5237775116fc24b"
+checksum = "9d3d48355cb86b15ccbb38b8bc6b87500c824ee4ed8cbc10a961b435242b5e16"
 dependencies = [
  "aws-credential-types",
  "aws-smithy-eventstream",
@@ -344,9 +344,9 @@ dependencies = [
 
 [[package]]
 name = "aws-smithy-async"
-version = "1.3.0"
+version = "1.3.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f02e407fb3b54891734224b9ffac8a71fdd35f542500fa1af95754a6b2beb316"
+checksum = "de681a9df7ff79823b759ee17061076ec049cd61a8fa28ece4293d89c9f6964e"
 dependencies = [
  "futures-util",
  "pin-project-lite",
@@ -376,9 +376,9 @@ dependencies = [
 
 [[package]]
 name = "aws-smithy-eventstream"
-version = "0.61.4"
+version = "0.61.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "80c2051c2f1016fb8e6548dd07b8bc2ac9c3fe583721444b92f515e856d31609"
+checksum = "14c8a643d0e114cae39e45415e3225793a6396698b7779a0c9e3ede731d8fc71"
 dependencies = [
  "aws-smithy-types",
  "bytes",
@@ -387,9 +387,9 @@ dependencies = [
 
 [[package]]
 name = "aws-smithy-http"
-version = "0.64.1"
+version = "0.64.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "639b4d8f8555f24a9be649811c3eb0b4d4616f4d61daf0c32e28873bc1ea9af1"
+checksum = "ba8960956e0ee0ca3f3161e62913a61bc65a7ef638ca3ef1d4c7159f8443e398"
 dependencies = [
  "aws-smithy-eventstream",
  "aws-smithy-runtime-api",
@@ -403,15 +403,14 @@ dependencies = [
  "http-body-util",
  "percent-encoding",
  "pin-project-lite",
- "pin-utils",
  "tracing",
 ]
 
 [[package]]
 name = "aws-smithy-http-client"
-version = "1.5.0"
+version = "1.5.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "51c89cc3f1f281d659a67a519a1b5c6d445b5ce09fa7e5aee40c2c2707e9509d"
+checksum = "aeca69f65362f7375891008ea525fd440ad6db1836458ac188c87b126804114e"
 dependencies = [
  "aws-smithy-async",
  "aws-smithy-runtime-api",
@@ -433,9 +432,9 @@ dependencies = [
 
 [[package]]
 name = "aws-smithy-json"
-version = "0.63.1"
+version = "0.65.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3385d469edbe8b60cc72002784652b5efca39178192aa9cc4b44c9875c6bdc18"
+checksum = "9f6835fb38bc6fc8c91e584b0366eb4ff595e5c485134dbf4f0bdeaa18856666"
 dependencies = [
  "aws-smithy-runtime-api",
  "aws-smithy-schema",
@@ -453,9 +452,9 @@ dependencies = [
 
 [[package]]
 name = "aws-smithy-runtime"
-version = "1.16.0"
+version = "1.16.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d6e302ac1d88b99652489df31abdec6ac42a2ab2ac3982ad0ac49f64dfaf28ba"
+checksum = "79cef0c41e8ca40f74f68ed8ee4d1ddbde12bb847b95ef9b3c025681ddfae58a"
 dependencies = [
  "aws-smithy-async",
  "aws-smithy-http",
@@ -470,16 +469,15 @@ dependencies = [
  "http-body",
  "http-body-util",
  "pin-project-lite",
- "pin-utils",
  "tokio",
  "tracing",
 ]
 
 [[package]]
 name = "aws-smithy-runtime-api"
-version = "1.19.0"
+version = "1.19.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c0730c16f91124c6a2abb4932c77e299288b3dd9f967ea2e9ec48cc6731e87a4"
+checksum = "06788004dea79018413f381891da6dcca23196acd79c4d51b767fbdacc76eae4"
 dependencies = [
  "aws-smithy-async",
  "aws-smithy-runtime-api-macros",
@@ -505,9 +503,9 @@ dependencies = [
 
 [[package]]
 name = "aws-smithy-schema"
-version = "0.2.1"
+version = "1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e8f395d93304280b64b7632fea798d177e74897fe7f063416ce627cd6fa24829"
+checksum = "bec8dae1015a6d959a5faf86fbdf77486cfe19e4ccb6ee009d8a46efc45028a4"
 dependencies = [
  "aws-smithy-runtime-api",
  "aws-smithy-types",
@@ -516,9 +514,9 @@ dependencies = [
 
 [[package]]
 name = "aws-smithy-types"
-version = "1.8.1"
+version = "1.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "69bb407740a197147da48238ecc94498493c9e85445732360cec180296ca45f1"
+checksum = "55752025c39c0e094962fd73f1c57014b191f678612e517f219468e575af9822"
 dependencies = [
  "base64-simd",
  "bytes",
@@ -530,7 +528,6 @@ dependencies = [
  "itoa",
  "num-integer",
  "pin-project-lite",
- "pin-utils",
  "ryu",
  "serde",
  "time",
@@ -540,9 +537,9 @@ dependencies = [
 
 [[package]]
 name = "aws-smithy-xml"
-version = "0.62.1"
+version = "0.64.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0b932c8d6dc127fc980eecd78f8694ae9b9551b69a93a7def2a199c1c0033daf"
+checksum = "a6581618a2fd006159016d1c36881d94d61b4a017f4a8d631310875e18252413"
 dependencies = [
  "aws-smithy-runtime-api",
  "aws-smithy-schema",
@@ -552,9 +549,9 @@ dependencies = [
 
 [[package]]
 name = "aws-types"
-version = "1.6.0"
+version = "1.7.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "209f3a6d82a6e9e5f94abbed94c7a26e1c052341002bf57a5fb5481f625896fc"
+checksum = "6ba0d970d3947bb064d2ae1d823efa186c1dbde88f88afa8f6549946e5d8deee"
 dependencies = [
  "aws-credential-types",
  "aws-smithy-async",
@@ -945,9 +942,9 @@ dependencies = [
 
 [[package]]
 name = "compression-codecs"
-version = "0.4.45"
+version = "0.4.46"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "98fc98460ba0ad5317075d3632b8dfc45d0be8c4a49347c2a38272019717614a"
+checksum = "cae36683101b2899f48bd31f8db9839437356188e3b1ff23096e73dab09ba8fe"
 dependencies = [
  "compression-core",
  "flate2",
@@ -956,9 +953,9 @@ dependencies = [
 
 [[package]]
 name = "compression-core"
-version = "0.4.33"
+version = "0.4.34"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6e8ccc4ea9f6acc32d102c0f6d471d11d913ad15f20c04de743374861fa1d414"
+checksum = "2ebdda89edc534bf8d5dd2857562633b6495557e5846552ade994b99ed13c36a"
 
 [[package]]
 name = "config"
@@ -1084,9 +1081,9 @@ dependencies = [
 
 [[package]]
 name = "crc32fast"
-version = "1.5.2"
+version = "1.5.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "01a7799fd6b852db0e61728dde9a204c423b44d689dbd432522543614b490e78"
+checksum = "0ba106e844045ddc02c20768ac4b0b7cb45f2cc2ecbd833ac9f5dacb183c2055"
 dependencies = [
  "cfg-if",
 ]
@@ -1129,9 +1126,9 @@ checksum = "61803da095bee82a81bb1a452ecc25d3b2f1416d1897eb86430c6159ef717c17"
 
 [[package]]
 name = "crypto-bigint"
-version = "0.7.5"
+version = "0.7.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1a52aa3fcda4e6302a9f48734f234d35d4721b96f8fe07d073f07ce9df4f0271"
+checksum = "6bb08299a6046833a879ace115697f12fd2bd6c8d3e93c909ffc9e0738e7cae0"
 dependencies = [
  "cpubits",
  "ctutils",
@@ -1166,14 +1163,14 @@ dependencies = [
 
 [[package]]
 name = "cssparser"
-version = "0.37.0"
+version = "0.38.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8c9cdaae01d5ed7882b04d795e7f752f46ff52d2fa3b50a20d28c464510bba98"
+checksum = "11119743ad110e8c1bdccd930d7f5c30c99e5fc76a7b63ec9807e84eef0c5f59"
 dependencies = [
  "cssparser-macros",
  "dtoa-short",
  "itoa",
- "phf 0.13.1",
+ "phf 0.14.0",
  "smallvec",
 ]
 
@@ -2125,12 +2122,13 @@ dependencies = [
 
 [[package]]
 name = "html5ever"
-version = "0.39.0"
+version = "0.40.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "46a1761807faccc9a19e86944bbf40610014066306f96edcdedc2fb714bcb7b8"
+checksum = "456a1a377e608e555d22ddab27ac0114bc7a7b4199078108e34c2aeae6c9b130"
 dependencies = [
  "log",
  "markup5ever",
+ "memchr",
 ]
 
 [[package]]
@@ -2483,9 +2481,9 @@ dependencies = [
 
 [[package]]
 name = "jsonschema"
-version = "0.58.6"
+version = "0.60.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f622c574a29fb3034a0a90645afee194dfedc75fc124228801b6e77041075bd1"
+checksum = "7e7305938cac5ee144352ceb71583ffc6cfeac7d20fcb20ef865a4d5c314e499"
 dependencies = [
  "ahash",
  "bytecount",
@@ -2511,23 +2509,24 @@ dependencies = [
 
 [[package]]
 name = "jsonschema-regex"
-version = "0.58.6"
+version = "0.60.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a968fffd387b2ab005bf00c1851f5d26e90df05b6f7ad609ed0d620033cca5e7"
+checksum = "6f8a848331614144c03e815fb931f238c9e342bd7ab501b29e35d647e7cd5688"
 dependencies = [
  "regex-syntax",
 ]
 
 [[package]]
 name = "jsonschema-value"
-version = "0.58.6"
+version = "0.60.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "39b7670345e5ce87371339d13705dbb9276b7e3e934bbe1efa2c6734a1f65a96"
+checksum = "5a5a947ef798eeacacb43edf29b1d0ab64bdf5e2c9fbcaad10ee8663d922b544"
 dependencies = [
  "ahash",
  "bytecount",
  "fraction",
  "getrandom 0.3.4",
+ "memchr",
  "num-cmp",
  "num-traits",
  "serde_json",
@@ -2642,9 +2641,9 @@ dependencies = [
 
 [[package]]
 name = "markup5ever"
-version = "0.39.0"
+version = "0.40.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7122d987ec5f704ee56f6e5b41a7d93722e9aae27ae07cafa4036c4d3f9757de"
+checksum = "0ab3dc68ac4a0f5719e560136778c1ee716e296030d75dbd4484e37e39e3a842"
 dependencies = [
  "log",
  "tendril",
@@ -3101,23 +3100,23 @@ dependencies = [
 
 [[package]]
 name = "phf"
-version = "0.13.1"
+version = "0.14.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c1562dc717473dbaa4c1f85a36410e03c047b2e7df7f45ee938fbef64ae7fadf"
+checksum = "010378780309880b08997fae13be7834dba947d36393bd372f2b1556deb2a2f6"
 dependencies = [
- "phf_macros 0.13.1",
- "phf_shared 0.13.1",
+ "phf_macros 0.14.0",
+ "phf_shared 0.14.0",
  "serde",
 ]
 
 [[package]]
 name = "phf_codegen"
-version = "0.13.1"
+version = "0.14.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "49aa7f9d80421bca176ca8dbfebe668cc7a2684708594ec9f3c0db0805d5d6e1"
+checksum = "41b585a510fb76fdebead6897982ef2a03a21d8e6cbcca904999742a4afc6ffe"
 dependencies = [
- "phf_generator 0.13.1",
- "phf_shared 0.13.1",
+ "phf_generator 0.14.0",
+ "phf_shared 0.14.0",
 ]
 
 [[package]]
@@ -3132,12 +3131,12 @@ dependencies = [
 
 [[package]]
 name = "phf_generator"
-version = "0.13.1"
+version = "0.14.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "135ace3a761e564ec88c03a77317a7c6b80bb7f7135ef2544dbe054243b89737"
+checksum = "aeb62e0959d5a1bebc965f4d15d9e2b7cea002b6b0f5ba8cde6cc26738467100"
 dependencies = [
  "fastrand",
- "phf_shared 0.13.1",
+ "phf_shared 0.14.0",
 ]
 
 [[package]]
@@ -3155,12 +3154,12 @@ dependencies = [
 
 [[package]]
 name = "phf_macros"
-version = "0.13.1"
+version = "0.14.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "812f032b54b1e759ccd5f8b6677695d5268c588701effba24601f6932f8269ef"
+checksum = "5fa8d0ca26d424d27630da600c6624696e7dec8bf7b3b492b383c5dc49e5e085"
 dependencies = [
- "phf_generator 0.13.1",
- "phf_shared 0.13.1",
+ "phf_generator 0.14.0",
+ "phf_shared 0.14.0",
  "proc-macro2",
  "quote",
  "syn 2.0.119",
@@ -3186,9 +3185,9 @@ dependencies = [
 
 [[package]]
 name = "phf_shared"
-version = "0.13.1"
+version = "0.14.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e57fef6bc5981e38c2ce2d63bfa546861309f875b8a75f092d1d54ae2d64f266"
+checksum = "c6fd9027e2d9319be6349febd1db4e8d02aa544921200c9b777720ac34a3aa89"
 dependencies = [
  "siphasher",
 ]
@@ -3199,12 +3198,6 @@ version = "0.2.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a89322df9ebe1c1578d689c92318e070967d1042b512afbe49518723f4e6d5cd"
 
-[[package]]
-name = "pin-utils"
-version = "0.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8b870d8c151b6f2fb93e84a13146138f05d02ed11c7e7c54f8826aaaf7c9f184"
-
 [[package]]
 name = "pkcs8"
 version = "0.11.0"
@@ -3636,9 +3629,9 @@ dependencies = [
 
 [[package]]
 name = "referencing"
-version = "0.58.6"
+version = "0.60.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "558f3855529c0a7e78a48e409fa653456e55f1b167eab4109c16a255b7727e3f"
+checksum = "922268812b6f9e20b4ab0f1efe8e07036958eed7346ceddb31c777b5531fd11f"
 dependencies = [
  "ahash",
  "fluent-uri",
@@ -3875,9 +3868,9 @@ checksum = "94143f37725109f92c262ed2cf5e59bce7498c01bcc1502d7b9afe439a4e9f49"
 
 [[package]]
 name = "scraper"
-version = "0.27.0"
+version = "0.29.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bdd0be4d296f048bfb06dd01bbc80ef789ddd2e55583e8d2e6b804942abfabc2"
+checksum = "6844b5f49a5579f12ba4f89d9f7eec6d71889e4aa0bc7181821040ce66f08fff"
 dependencies = [
  "cssparser",
  "ego-tree",
@@ -3885,7 +3878,6 @@ dependencies = [
  "html5ever",
  "precomputed-hash",
  "selectors",
- "tendril",
 ]
 
 [[package]]
@@ -3950,17 +3942,15 @@ dependencies = [
 
 [[package]]
 name = "selectors"
-version = "0.38.0"
+version = "0.41.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8adfa1c298912827b8a28b223b3b874357397ae706e6190acd9bf28cee99114d"
+checksum = "8322aebea94a6cc288ff884e8a49bdbceef60206c400c6c46d22e62fc4fd91a6"
 dependencies = [
  "bitflags",
  "cssparser",
  "derive_more",
  "log",
  "new_debug_unreachable",
- "phf 0.13.1",
- "phf_codegen",
  "precomputed-hash",
  "rustc-hash",
  "servo_arc",
@@ -4067,9 +4057,9 @@ dependencies = [
 
 [[package]]
 name = "servo_arc"
-version = "0.4.3"
+version = "0.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "170fb83ab34de17dc69aa7c67482b22218ddb85da56546f9bd6b929e32a05930"
+checksum = "b4eceb519ec34d8290aaf6e46f435102f2bfa63f22b05a144fb16ab266d3b198"
 dependencies = [
  "stable_deref_trait",
 ]
@@ -4401,24 +4391,24 @@ checksum = "6ce2be8dc25455e1f91df71bfa12ad37d7af1092ae736f3a6cd0e37bc7810596"
 
 [[package]]
 name = "string_cache"
-version = "0.9.0"
+version = "0.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a18596f8c785a729f2819c0f6a7eae6ebeebdfffbfe4214ae6b087f690e31901"
+checksum = "ffa8a5dbe8b3f0bbe29d4c3225daafaeead63afdc1b65fc4c01a1384166038e6"
 dependencies = [
  "new_debug_unreachable",
  "parking_lot",
- "phf_shared 0.13.1",
+ "phf_shared 0.14.0",
  "precomputed-hash",
 ]
 
 [[package]]
 name = "string_cache_codegen"
-version = "0.6.1"
+version = "0.11.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "585635e46db231059f76c5849798146164652513eb9e8ab2685939dd90f29b69"
+checksum = "928dcdf75e47626b3617a976ec205d9f057584c371c1f23b782129268d0e6edc"
 dependencies = [
- "phf_generator 0.13.1",
- "phf_shared 0.13.1",
+ "phf_generator 0.14.0",
+ "phf_shared 0.14.0",
  "proc-macro2",
  "quote",
 ]
@@ -4655,9 +4645,9 @@ checksum = "1f3ccbac311fea05f86f61904b462b55fb3df8837a366dfc601a0161d0532f20"
 
 [[package]]
 name = "tokio"
-version = "1.52.3"
+version = "1.53.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8fc7f01b389ac15039e4dc9531aa973a135d7a4135281b12d7c1bc79fd57fffe"
+checksum = "ce3335fa71841cda333a58d7615b03901380ecf09d59b3296d21f8bbac0dde4e"
 dependencies = [
  "bytes",
  "libc",
@@ -5214,11 +5204,11 @@ dependencies = [
 
 [[package]]
 name = "web_atoms"
-version = "0.2.6"
+version = "0.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ba8b815c1b593dc0baf78dd0f4fc8fdb2de53198fb1163738093e9a311c33fb3"
+checksum = "7572660c8890448ba236b7376f27e389c6a7e1c70195622faced601f855c0ada"
 dependencies = [
- "phf 0.13.1",
+ "phf 0.14.0",
  "phf_codegen",
  "string_cache",
  "string_cache_codegen",
@@ -5651,9 +5641,9 @@ dependencies = [
 
 [[package]]
 name = "zip"
-version = "9.0.4"
+version = "9.0.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a954114b47a54df49f83d2722814e86b23d4bb1b54a1b90fb7d92b41619ddc22"
+checksum = "6e04976da629d3b04204ba8105b396a193af8ad2583b2c79bfb3ab8af580a11e"
 dependencies = [
  "crc32fast",
  "flate2",
@@ -5677,27 +5667,27 @@ checksum = "29666d0abbfad1e3dc4dcf6144730dd3a3ab225bbbdac83319345b1b44ccfc1b"
 
 [[package]]
 name = "zstd"
-version = "0.13.3"
+version = "0.14.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e91ee311a569c327171651566e07972200e76fcfe2242a4fa446149a3881c08a"
+checksum = "db3ae9bf90af6e40197bef767eeefc46ad6397420fe873830bd85e5fbbfb3c70"
 dependencies = [
  "zstd-safe",
 ]
 
 [[package]]
 name = "zstd-safe"
-version = "7.2.4"
+version = "8.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8f49c4d5f0abb602a93fb8736af2a4f4dd9512e36f7f570d66e65ff867ed3b9d"
+checksum = "ded520f16b29e1a9b771c722221b2b0a0398c2316d9bb3c42b458a5414d7434b"
 dependencies = [
  "zstd-sys",
 ]
 
 [[package]]
 name = "zstd-sys"
-version = "2.0.16+zstd.1.5.7"
+version = "2.1.2+zstd.1.5.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "91e19ebc2adc8f83e43039e79776e3fda8ca919132d68a1fed6a5faca2683748"
+checksum = "481ada9c543b2323cbb7bbdbb5249177fbf0188ed959ed2c15e4b22421c84ed3"
 dependencies = [
  "cc",
  "pkg-config",

backend/apps/gateway/src/bootstrap/command.rs

@@ -103,6 +103,10 @@ async fn execute(
     let management = ManagementPorts::new(&store, providers.admin.clone(), core.snapshot_control());
     or_shutdown!(plugin_runtime, management.bind(&plugin_runtime));
     let core = or_shutdown!(plugin_runtime, core.activate().await);
+    or_shutdown!(
+        plugin_runtime,
+        plugin_runtime.bind_client_identity_port(&core.client_identity_port())
+    );
     let nested_models = core.nested_model_execution_port();
     let affinity_lookup = core.affinity_lookup_port();
     or_shutdown!(

backend/apps/gateway/src/bootstrap/server.rs

@@ -38,6 +38,10 @@ pub async fn run() -> Result<(), BootstrapError> {
     let management = ManagementPorts::new(&store, providers.admin.clone(), core.snapshot_control());
     or_shutdown!(plugin_runtime, management.bind(&plugin_runtime));
     let mut core = or_shutdown!(plugin_runtime, core.activate().await);
+    or_shutdown!(
+        plugin_runtime,
+        plugin_runtime.bind_client_identity_port(&core.client_identity_port())
+    );
     let nested_models = core.nested_model_execution_port();
     let affinity_lookup = core.affinity_lookup_port();
     or_shutdown!(

backend/apps/gateway/tests/bootstrap/config.rs

@@ -370,10 +370,28 @@ fn config_loader_should_reject_zero_server_port() {
 }
 
 #[test]
-fn config_loader_should_validate_openai_residency() {
+fn config_loader_should_accept_optional_openai_routing_strings() {
+    for value in [
+        serde_json::Value::Null,
+        serde_json::json!("us"),
+        serde_json::json!("custom-value"),
+        serde_json::json!(""),
+    ] {
+        let mut document = valid_config_document();
+        document["openai"]["residency"] = value.clone();
+        document["openai"]["account_routing_override"] = value;
+        parse_config(&document.to_string()).expect("optional routing strings");
+    }
     let mut document = valid_config_document();
-    document["openai"]["residency"] = serde_json::json!("invalid");
-    assert_rejected(document.to_string());
+    document["openai"]
+        .as_object_mut()
+        .unwrap()
+        .remove("residency");
+    document["openai"]
+        .as_object_mut()
+        .unwrap()
+        .remove("account_routing_override");
+    parse_config(&document.to_string()).expect("omitted routing strings");
 }
 
 fn assert_rejected(config: String) {

backend/apps/plugin-cli/tests/main.rs

@@ -250,7 +250,7 @@ fn source_manifest() -> &'static [u8] {
       "main":"bin/plugin",
       "runtime":"trustedProcess",
       "contributes":{
-        "middleware":{"version":5,"stages":["request"],"inputFormats":["openai"],"outputFormats":["openai"]},
+        "middleware":{"version":6,"stages":["request"],"inputFormats":["openai"],"outputFormats":["openai"]},
         "management":{"version":2}
       },
 

backend/crates/gateway-admin/src/model/observability.rs

@@ -740,7 +740,6 @@ pub struct UsageListRecord {
     pub provider_account_authentication_kind: Option<String>,
     pub upstream_model_id: Option<String>,
     pub upstream_transport: Option<String>,
-    pub upstream_response_model: Option<String>,
     pub service_tier: Option<String>,
     pub input_tokens: Option<u64>,
     pub output_tokens: Option<u64>,
@@ -802,7 +801,6 @@ pub struct UsageRecord {
     pub upstream_transport: Option<String>,
     pub http_version: Option<String>,
     pub websocket_pool: Option<String>,
-    pub upstream_response_model: Option<String>,
     pub service_tier: Option<String>,
     /// Provider 已筛选的专有观测 JSON；管理领域保持不透明
     pub provider_metadata_json: Option<String>,

backend/crates/gateway-admin/src/model/plugins/instances.rs

@@ -84,6 +84,7 @@ pub struct PluginInstanceMutation {
 #[derive(Debug, Clone, Copy, PartialEq, Eq)]
 pub enum PluginInstanceRuntimeStatus {
     Disabled,
+    Unknown,
     AwaitingPublication,
     Preparing,
     Running,
@@ -108,6 +109,21 @@ pub struct PluginInstanceRuntime {
     pub actual_artifact_sha256: Option<String>,
     pub failure: Option<PluginInstanceRuntimeFailure>,
     pub draining_revisions: Vec<u64>,
+    pub load: Option<PluginInstanceRuntimeLoad>,
+}
+
+/// 当前发布会话的资源占用采样，计数可以重叠且不构成原子快照
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct PluginInstanceRuntimeLoad {
+    /// 总在途名额，包含排队、取消确认和仍由响应流持有的调用
+    pub active_calls: usize,
+    pub executing_calls: usize,
+    pub queued_calls: usize,
+    pub resuming_calls: usize,
+    /// 包含已返回但尚未由插件消费的回调结果
+    pub pending_callbacks: usize,
+    /// 已交付首结果但尚未收到 End 的流
+    pub active_streams: usize,
 }
 
 /// 可继续运行的旧接口提示，与无法启用的兼容性错误分开
@@ -136,6 +152,8 @@ pub struct PluginInstanceView {
 #[derive(Deserialize)]
 #[serde(rename_all = "camelCase", deny_unknown_fields)]
 pub struct ConfigurePluginInstance {
+    /// 只随本次启动请求传递，不写入实例配置
+    pub compatibility_confirmation: Option<PluginCompatibilityConfirmation>,
     /// 创建草稿固定一个 UUID，重试复用同一配置，不能作为编辑已有配置的入口
     pub creation_id: Option<String>,
     /// 编辑时检查用户看到的配置版本，避免覆盖另一窗口已经保存的内容
@@ -159,6 +177,16 @@ pub struct PluginInstanceReplacement {
     pub expected_revision: u64,
 }
 
+/// 管理员确认的宿主、实例配置与目标包；不构成永久兼容豁免
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct PluginCompatibilityConfirmation {
+    pub host_fingerprint: String,
+    pub instance_id: String,
+    pub instance_revision: u64,
+    pub artifact_sha256: String,
+}
+
 /// 恢复已安装旧版本的配置快照，并重新通过目标版本校验
 #[derive(Debug, Deserialize)]
 #[serde(rename_all = "camelCase", deny_unknown_fields)]
@@ -196,6 +224,9 @@ pub struct PluginVersionConfiguration {
 #[derive(Serialize)]
 #[serde(rename_all = "camelCase")]
 pub struct PluginVersionPlan {
+    pub compatibility_warning: Option<String>,
+    pub compatibility_confirmation: Option<PluginCompatibilityConfirmation>,
+    pub load_error: Option<String>,
     pub instance_revision: u64,
     pub artifact_sha256: String,
     pub configuration: serde_json::Value,

backend/crates/gateway-admin/src/model/plugins/mod.rs

@@ -62,6 +62,48 @@ impl PluginHostCompatibility {
             .iter()
             .any(|entry| entry.capability == capability && entry.versions.contains(&version))
     }
+
+    /// 启动和升级预检共用比较规则，只检查插件声明的能力
+    #[must_use]
+    pub fn incompatibilities(
+        &self,
+        requirements: &PluginCompatibilityRequirements,
+        host: &semver::Version,
+    ) -> Vec<String> {
+        let mut reasons = Vec::new();
+        if !self
+            .manifest_schema_versions
+            .contains(&requirements.manifest_schema_version)
+        {
+            reasons.push(format!(
+                "清单 v{} 不在宿主支持范围内",
+                requirements.manifest_schema_version
+            ));
+        }
+        if !self
+            .protocol_versions
+            .contains(&requirements.protocol_version)
+        {
+            reasons.push(format!(
+                "RPC v{} 不在宿主支持范围内",
+                requirements.protocol_version
+            ));
+        }
+        if !semver::VersionReq::parse(&requirements.host_version)
+            .is_ok_and(|range| range.matches(host))
+        {
+            reasons.push(format!(
+                "插件声明的宿主范围为 {}，当前为 {host}",
+                requirements.host_version
+            ));
+        }
+        for (capability, version) in &requirements.capabilities {
+            if !self.supports_capability(capability, *version) {
+                reasons.push(format!("{capability} v{version} 不在宿主支持范围内"));
+            }
+        }
+        reasons
+    }
 }
 
 fn valid_versions(versions: &[u32]) -> bool {

backend/crates/gateway-admin/src/ports/plugins.rs

@@ -46,6 +46,15 @@ pub trait PluginPreparation: PluginRuntimeDiagnostics + PluginStateLifecycle {
         &self,
         snapshot: PluginInstanceSnapshot,
     ) -> Result<ExtensionSetReference, AdminError>;
+
+    /// 确认由 Admin 校验配置版本，Runtime 复核宿主并仅放行目标实例
+    async fn prepare_confirmed(
+        &self,
+        _snapshot: PluginInstanceSnapshot,
+        _confirmation: crate::model::plugins::instances::PluginCompatibilityConfirmation,
+    ) -> Result<ExtensionSetReference, AdminError> {
+        Err(AdminError::invalid("插件运行时不支持确认启动"))
+    }
 }
 
 /// 运行诊断独立于发布准备；没有进程事实时显式返回 None
@@ -175,6 +184,10 @@ pub trait PluginDistribution: Send + Sync {
 /// Runtime 只解释插件包格式；安装事务与来源选择归 Admin
 #[async_trait]
 pub trait PluginPackageInspector: Send + Sync {
+    /// 当前宿主版本、兼容声明与平台的稳定身份，不含敏感信息
+    fn compatibility_host_fingerprint(&self) -> Result<String, AdminError> {
+        Err(AdminError::internal("宿主兼容声明不可用"))
+    }
     /// 完整校验包并返回版本范围诊断；校验失败与可加载但未经宿主承诺的提醒分开
     async fn compatibility_warning(
         &self,

backend/crates/gateway-admin/src/use_case/plugin_update.rs

@@ -161,53 +161,24 @@ impl PluginSystemUpdatePreflight {
                             .await,
                     ) {
                         (_, Err(error)) if error.kind() == AdminErrorKind::Invalid => {
-                            Some("插件包或协议与目标版本不兼容".to_owned())
+                            Some(error.message().to_owned())
                         }
                         (_, Err(error)) => return Err(map_inspection_error(error)),
                         (None, _) => Some("无法确认插件与目标版本兼容".to_owned()),
                         (Some(host), Ok(requirements)) => {
-                            if !semver::VersionReq::parse(&requirements.host_version)
-                                .is_ok_and(|versions| versions.matches(target))
-                            {
-                                Some(format!("要求网关版本 {}", requirements.host_version))
-                            } else if !host
-                                .manifest_schema_versions
-                                .contains(&requirements.manifest_schema_version)
-                                || !host
-                                    .protocol_versions
-                                    .contains(&requirements.protocol_version)
-                                || requirements
-                                    .capabilities
-                                    .iter()
-                                    .any(|(capability, version)| {
-                                        !host.supports_capability(capability, *version)
-                                    })
-                            {
-                                Some("插件协议或能力与目标版本不兼容".to_owned())
-                            } else {
-                                None
-                            }
+                            let reasons = host.incompatibilities(&requirements, target);
+                            (!reasons.is_empty()).then(|| reasons.join("，"))
                         }
                     }
                 } else {
                     match self
                         .inspector
-                        .inspect(
-                            artifact.archive.clone(),
-                            Some(instance.artifact_sha256.clone()),
-                        )
+                        .compatibility_warning(artifact.archive, instance.artifact_sha256.clone())
                         .await
                     {
-                        Ok(_) => self
-                            .inspector
-                            .compatibility_warning(
-                                artifact.archive,
-                                instance.artifact_sha256.clone(),
-                            )
-                            .await
-                            .map_err(map_inspection_error)?,
+                        Ok(warning) => warning,
                         Err(error) if error.kind() == AdminErrorKind::Invalid => {
-                            Some("插件与当前宿主不兼容".to_owned())
+                            Some(error.message().to_owned())
                         }
                         Err(error) => return Err(map_inspection_error(error)),
                     }

backend/crates/gateway-admin/src/use_case/plugins/artifacts.rs

@@ -186,6 +186,8 @@ impl PluginsService {
             .configuration_ready(probe, &metadata)
             .await?;
 
+        let status = self.package_status(&metadata.sha256).await?;
+        let compatible = status.warning.is_none() && status.load_error.is_none();
         // 其它管理员写入或同插件的并发安装可能推进全局 revision；稳定 creation ID
         // 配合每轮重新读取，既不会复制默认实例，也不会覆盖先完成的另一个版本
         for _ in 0..3 {
@@ -207,12 +209,13 @@ impl PluginsService {
             }
 
             let input = ConfigurePluginInstance {
+                compatibility_confirmation: None,
                 replace_instances: Vec::new(),
                 creation_id: Some(creation_id.clone()),
                 expected_revision: None,
                 name: metadata.display_name.clone(),
                 artifact_sha256: metadata.sha256.clone(),
-                enabled: !configuration_required,
+                enabled: !configuration_required && compatible,
                 configuration: configuration.clone(),
                 secrets: None,
                 bindings: bindings.clone(),

backend/crates/gateway-admin/src/use_case/plugins/instances.rs

@@ -1,773 +0,0 @@
-//! 插件实例的配置、停用、删除与私有状态迁移编排
-
-use std::collections::{BTreeMap, BTreeSet};
-
-use gateway_core::{
-    policy::ClientApiKeyId,
-    routing::{AccountGroupId, extensions::ExtensionSetReference},
-};
-use secrecy::ExposeSecret;
-
-use super::PluginsService;
-use crate::{
-    model::{
-        AdminError, AdminErrorKind, MutationContext, Revision,
-        plugins::instances::{
-            ConfigurePluginInstance, PluginInstance, PluginInstanceMutation,
-            PluginInstanceReplacement, PluginInstanceRuntime, PluginInstanceRuntimeStatus,
-            PluginInstanceSnapshot, PluginInstanceView,
-        },
-        plugins::state::{PluginStateCommit, PluginStateConfiguration},
-    },
-    use_case::{map_store_error, publish_committed},
-};
-
-#[derive(Clone, Default)]
-pub(super) struct PackageStatus {
-    warning: Option<String>,
-    load_error: Option<String>,
-}
-
-impl PluginsService {
-    /// 只校验固定包体，不启动插件；停用实例也需区分兼容性提醒与加载错误
-    async fn package_status(&self, digest: &str) -> Result<PackageStatus, AdminError> {
-        // 运行宿主和摘要固定，缓存纯静态结论，避免管理页轮询反复解包
-        // 只缓存有限数量的确定结果，暂时性错误仍可重试
-        let mut cache = self.compatibility.lock().await;
-        if let Some(warning) = cache.get(digest) {
-            return Ok(warning.clone());
-        }
-        let artifact = self
-            .store
-            .load_artifact(digest)
-            .await
-            .map_err(|error| map_store_error(error, "plugin"))?;
-        let warning = match self
-            .inspector
-            .compatibility_warning(artifact.archive, digest.to_owned())
-            .await
-        {
-            Ok(warning) => PackageStatus {
-                warning,
-                load_error: None,
-            },
-            Err(error) if error.kind() == AdminErrorKind::Invalid => PackageStatus {
-                warning: None,
-                load_error: Some(error.message().to_owned()),
-            },
-            Err(error) => return Err(error),
-        };
-        if cache.len() < 128 {
-            cache.insert(digest.to_owned(), warning.clone());
-        }
-        Ok(warning)
-    }
-
-    pub async fn instances(&self) -> Result<Vec<PluginInstanceView>, AdminError> {
-        let snapshot = self
-            .store
-            .load_instances()
-            .await
-            .map_err(|e| map_store_error(e, "plugin"))?;
-        let published = self.published.snapshot_for_diagnostics();
-        let published_revision = published.as_ref().map(|snapshot| snapshot.revision().get());
-        let published_ready = published
-            .as_ref()
-            .is_some_and(|snapshot| snapshot.extensions().is_none_or(|set| set.can_serve()));
-        let mut diagnostics = self
-            .preparation
-            .runtime_diagnostics(
-                &snapshot,
-                published_revision,
-                published
-                    .as_ref()
-                    .and_then(|snapshot| snapshot.extensions()),
-            )
-            .await
-            .unwrap_or_default();
-        let target_revision = snapshot.config_revision.get();
-        let artifacts = self
-            .list()
-            .await?
-            .into_iter()
-            .map(|artifact| (artifact.metadata.sha256.clone(), artifact.metadata))
-            .collect::<BTreeMap<_, _>>();
-        let mut views = Vec::with_capacity(snapshot.instances.len());
-        for instance in snapshot.instances {
-            let metadata = artifacts
-                .get(&instance.artifact_sha256)
-                .ok_or_else(|| AdminError::not_found("插件制品不存在"))?;
-            let package_status = self.package_status(&instance.artifact_sha256).await?;
-            let configuration_required = package_status.load_error.is_none()
-                && !self
-                    .preparation
-                    .configuration_ready(instance.clone(), metadata)
-                    .await?;
-            let runtime = diagnostics.remove(&instance.id).unwrap_or_else(|| {
-                let running = instance.enabled
-                    && published_ready
-                    && published_revision == Some(target_revision);
-                PluginInstanceRuntime {
-                    status: if !instance.enabled {
-                        PluginInstanceRuntimeStatus::Disabled
-                    } else if running {
-                        PluginInstanceRuntimeStatus::Running
-                    } else {
-                        PluginInstanceRuntimeStatus::AwaitingPublication
-                    },
-                    actual_revision: running.then_some(instance.revision.get()),
-                    actual_artifact_sha256: running.then(|| instance.artifact_sha256.clone()),
-                    failure: None,
-                    draining_revisions: Vec::new(),
-                }
-            });
-            views.push(PluginInstanceView {
-                api_deprecations: if package_status.load_error.is_none() {
-                    self.inspector.api_deprecations(metadata)?
-                } else {
-                    Vec::new()
-                },
-                configuration_required,
-                compatibility_warning: package_status.warning,
-                load_error: package_status.load_error,
-                running: runtime.status == PluginInstanceRuntimeStatus::Running,
-                published_revision,
-                runtime,
-                instance,
-            });
-        }
-        Ok(views)
-    }
-
-    pub async fn configure_instance(
-        &self,
-        id: Option<&str>,
-        input: ConfigurePluginInstance,
-        context: &MutationContext,
-    ) -> Result<PluginInstanceMutation, AdminError> {
-        if id.is_some() && input.creation_id.is_some() {
-            return Err(AdminError::invalid("编辑配置不能使用创建标识"));
-        }
-        if id.is_none() && input.expected_revision.is_some() {
-            return Err(AdminError::invalid("创建配置不能指定已有配置版本"));
-        }
-        if let Some(creation_id) = &input.creation_id {
-            let parsed = uuid::Uuid::parse_str(creation_id)
-                .map_err(|_| AdminError::invalid("配置创建标识必须是 UUID"))?;
-            if parsed.to_string() != *creation_id {
-                return Err(AdminError::invalid("配置创建标识必须使用标准 UUID 格式"));
-            }
-        }
-        let snapshot = self
-            .store
-            .load_instances()
-            .await
-            .map_err(|e| map_store_error(e, "plugin"))?;
-        let existing = match id {
-            Some(id) => Some(
-                snapshot
-                    .instances
-                    .iter()
-                    .find(|instance| instance.id == id)
-                    .cloned()
-                    .ok_or_else(|| AdminError::not_found("插件实例不存在"))?,
-            ),
-            None => input.creation_id.as_ref().and_then(|creation_id| {
-                snapshot
-                    .instances
-                    .iter()
-                    .find(|instance| instance.id == *creation_id)
-                    .cloned()
-            }),
-        };
-        if let Some(existing) = &existing {
-            if id.is_none() && !same_creation_request(existing, &input) {
-                return Err(AdminError::conflict("此配置已创建，请加载最新配置后编辑"));
-            }
-            if input
-                .expected_revision
-                .is_some_and(|revision| revision != existing.revision.get())
-            {
-                return Err(AdminError::conflict("插件配置已变更，请加载最新配置后重试"));
-            }
-        }
-        self.configure_from_snapshot(snapshot, existing, input, context)
-            .await
-    }
-
-    pub(super) async fn configure_from_snapshot(
-        &self,
-        mut snapshot: PluginInstanceSnapshot,
-        existing: Option<PluginInstance>,
-        input: ConfigurePluginInstance,
-        context: &MutationContext,
-    ) -> Result<PluginInstanceMutation, AdminError> {
-        let expected_revision = snapshot.config_revision;
-        let candidate_revision = next_revision(expected_revision)?;
-        let artifacts = self
-            .store
-            .list_artifacts()
-            .await
-            .map_err(|error| map_store_error(error, "plugin"))?;
-        let artifact = artifacts
-            .iter()
-            .find(|artifact| artifact.metadata.sha256 == input.artifact_sha256)
-            .ok_or_else(|| AdminError::not_found("插件制品不存在"))?;
-        if artifact.accepted_at.is_none() {
-            return Err(AdminError::invalid("请先安装并接受该版本声明的权限"));
-        }
-        if input.enabled
-            && let Some(warning) = self
-                .package_status(&input.artifact_sha256)
-                .await?
-                .load_error
-        {
-            return Err(AdminError::invalid(format!(
-                "{warning}，无法启动，请安装兼容版本"
-            )));
-        }
-        let same_plugin = |digest: &str| {
-            artifacts.iter().any(|item| {
-                item.metadata.sha256 == digest
-                    && item.metadata.plugin_id == artifact.metadata.plugin_id
-            })
-        };
-        if existing
-            .as_ref()
-            .is_some_and(|previous| !same_plugin(&previous.artifact_sha256))
-        {
-            return Err(AdminError::invalid("不能将已有配置切换为另一个插件"));
-        }
-        if input.enabled
-            && snapshot.instances.iter().any(|other| {
-                other.enabled
-                    && existing
-                        .as_ref()
-                        .is_none_or(|current| current.id != other.id)
-                    && same_plugin(&other.artifact_sha256)
-                    && !input
-                        .replace_instances
-                        .iter()
-                        .any(|replacement| replacement.id == other.id)
-            })
-        {
-            return Err(AdminError::conflict(
-                "此插件已有启用配置，请先切换或停用旧配置",
-            ));
-        }
-        let saved = if let Some(previous) = &existing
-            && previous.artifact_sha256 != input.artifact_sha256
-            && input.secrets.is_none()
-        {
-            self.store
-                .load_version_configuration(&previous.id, &input.artifact_sha256)
-                .await
-                .map_err(|error| map_store_error(error, "plugin"))?
-        } else {
-            None
-        };
-        let instance = PluginInstance {
-            id: existing.as_ref().map_or_else(
-                || {
-                    input
-                        .creation_id
-                        .clone()
-                        .unwrap_or_else(|| uuid::Uuid::now_v7().to_string())
-                },
-                |instance| instance.id.clone(),
-            ),
-            name: input.name.trim().to_owned(),
-            artifact_sha256: input.artifact_sha256,
-            enabled: input.enabled,
-            trusted_process: true,
-            configuration: input.configuration,
-            secrets: input
-                .secrets
-                .or_else(|| saved.map(|saved| saved.secrets))
-                .unwrap_or_else(|| {
-                    existing
-                        .as_ref()
-                        .map_or_else(Default::default, |instance| instance.secrets.clone())
-                }),
-            bindings: input.bindings,
-            revision: candidate_revision,
-        };
-        validate_input(&instance)?;
-        if existing
-            .as_ref()
-            .is_some_and(|previous| previous.artifact_sha256 != instance.artifact_sha256)
-            && !self
-                .preparation
-                .configuration_ready(instance.clone(), &artifact.metadata)
-                .await?
-        {
-            return Err(AdminError::invalid(
-                "目标版本仍缺少必填设置，请补充后再切换",
-            ));
-        }
-
-        let replacements = input.replace_instances;
-        if !replacements.is_empty() {
-            if !instance.enabled || replacements.len() > 256 {
-                return Err(AdminError::invalid(
-                    "仅启用配置时可以切换其他配置，单次最多 256 项",
-                ));
-            }
-            let mut ids = BTreeSet::new();
-            for replacement in &replacements {
-                if replacement.id == instance.id || !ids.insert(&replacement.id) {
-                    return Err(AdminError::invalid("停用列表不能重复或包含当前配置"));
-                }
-                let previous = snapshot
-                    .instances
-                    .iter()
-                    .find(|item| item.id == replacement.id)
-                    .ok_or_else(|| AdminError::conflict("待停用配置已变更，请重新确认"))?;
-                if !previous.enabled || previous.revision.get() != replacement.expected_revision {
-                    return Err(AdminError::conflict("待停用配置已变更，请重新确认"));
-                }
-                if !artifacts.iter().any(|item| {
-                    item.metadata.sha256 == previous.artifact_sha256
-                        && item.metadata.plugin_id == artifact.metadata.plugin_id
-                }) {
-                    return Err(AdminError::invalid("只能切换同一插件的配置"));
-                }
-            }
-        }
-        let state = self.preparation.validate(instance.clone()).await?;
-        if let Some(existing) = &existing
-            && self.state.transition_required(&existing.id, &state).await?
-        {
-            return self
-                .configure_instance_with_state_transition(
-                    snapshot,
-                    existing.clone(),
-                    instance,
-                    state,
-                    &replacements,
-                    context,
-                )
-                .await;
-        }
-        snapshot.instances.retain(|item| item.id != instance.id);
-        snapshot.instances.push(instance.clone());
-        snapshot.config_revision = candidate_revision;
-        apply_replacements(&mut snapshot, &replacements);
-        let prepared = self.preparation.prepare(snapshot.clone()).await?;
-        let result = self
-            .store
-            .save_instance_replacing(
-                instance,
-                expected_revision,
-                PluginStateCommit {
-                    configuration: state,
-                    transition_id: None,
-                },
-                &replacements,
-                context,
-            )
-            .await
-            .map_err(|e| map_store_error(e, "plugin"))?;
-        self.publish_instance(snapshot, prepared, &result, &replacements)
-            .await?;
-        Ok(result)
-    }
-
-    async fn configure_instance_with_state_transition(
-        &self,
-        mut snapshot: PluginInstanceSnapshot,
-        previous: PluginInstance,
-        mut target: PluginInstance,
-        target_state: PluginStateConfiguration,
-        replacements: &[PluginInstanceReplacement],
-        context: &MutationContext,
-    ) -> Result<PluginInstanceMutation, AdminError> {
-        let previous_state = self.preparation.validate(previous.clone()).await?;
-        let original_revision = snapshot.config_revision;
-        // 即使最终保持停用，迁移也必须由目标制品的受控候选执行
-        let mut migration_instance = target.clone();
-        migration_instance.enabled = true;
-        snapshot.config_revision = migration_instance.revision;
-        snapshot
-            .instances
-            .retain(|instance| instance.id != migration_instance.id);
-        snapshot.instances.push(migration_instance);
-        apply_replacements(&mut snapshot, replacements);
-        let migration_prepared = self.preparation.prepare(snapshot).await?;
-
-        let mut disabled_revision = None;
-        let disabled = if previous.enabled {
-            let mut disabled = previous.clone();
-            disabled.enabled = false;
-            let mutation = self
-                .store
-                .save_instance_with_state(
-                    disabled,
-                    original_revision,
-                    PluginStateCommit {
-                        configuration: previous_state.clone(),
-                        transition_id: None,
-                    },
-                    context,
-                )
-                .await
-                .map_err(|error| map_store_error(error, "plugin"))?;
-            publish_committed(self.snapshots.as_ref(), mutation.config_revision).await?;
-            self.preparation
-                .quiesce_instance(&previous.id, &previous.artifact_sha256, previous.revision)
-                .await;
-            disabled_revision = Some(mutation.config_revision);
-            mutation.instance
-        } else {
-            previous.clone()
-        };
-        let expected_revision = disabled_revision.unwrap_or(original_revision);
-        let transition = match self
-            .state
-            .begin_transition(
-                &disabled.id,
-                disabled.revision,
-                &target.artifact_sha256,
-                target_state.clone(),
-            )
-            .await
-        {
-            Ok(transition) => transition,
-            Err(error) => {
-                return Err(self
-                    .recover_failed_state_transition(
-                        None,
-                        &previous,
-                        &previous_state,
-                        disabled_revision,
-                        context,
-                        error,
-                    )
-                    .await);
-            }
-        };
-        // 迁移开始后的所有提交前失败都走同一恢复出口；提交成功后不再回滚旧配置
-        let committed = async {
-            self.preparation
-                .migrate_state(&migration_prepared, transition.clone())
-                .await?;
-            let mut current = self
-                .store
-                .load_instances()
-                .await
-                .map_err(|error| map_store_error(error, "plugin"))?;
-            if current.config_revision != expected_revision {
-                return Err(AdminError::conflict("迁移期间插件配置已发生变化"));
-            }
-            let candidate_revision = next_revision(expected_revision)?;
-            target.revision = candidate_revision;
-            current.instances.retain(|item| item.id != target.id);
-            current.instances.push(target.clone());
-            current.config_revision = candidate_revision;
-            apply_replacements(&mut current, replacements);
-            let prepared = self.preparation.prepare(current.clone()).await?;
-            let result = self
-                .store
-                .save_instance_replacing(
-                    target,
-                    expected_revision,
-                    PluginStateCommit {
-                        configuration: target_state,
-                        transition_id: Some(transition.id.clone()),
-                    },
-                    replacements,
-                    context,
-                )
-                .await
-                .map_err(|error| map_store_error(error, "plugin"))?;
-            Ok((current, prepared, result))
-        }
-        .await;
-        let (current, prepared, result) = match committed {
-            Ok(committed) => committed,
-            Err(error) => {
-                return Err(self
-                    .recover_failed_state_transition(
-                        Some(&transition.id),
-                        &previous,
-                        &previous_state,
-                        disabled_revision,
-                        context,
-                        error,
-                    )
-                    .await);
-            }
-        };
-        self.publish_instance(current, prepared, &result, replacements)
-            .await?;
-        drop(migration_prepared);
-        Ok(result)
-    }
-
-    async fn recover_failed_state_transition(
-        &self,
-        transition_id: Option<&str>,
-        previous: &PluginInstance,
-        previous_state: &PluginStateConfiguration,
-        disabled_revision: Option<Revision>,
-        context: &MutationContext,
-        original_error: AdminError,
-    ) -> AdminError {
-        if let Some(transition_id) = transition_id {
-            self.state.abort_transition(transition_id).await;
-        }
-        let Some(disabled_revision) = disabled_revision else {
-            return original_error;
-        };
-        let restored = async {
-            let mut snapshot = self
-                .store
-                .load_instances()
-                .await
-                .map_err(|error| map_store_error(error, "plugin"))?;
-            if snapshot.config_revision != disabled_revision {
-                return Err(AdminError::conflict(
-                    "状态迁移失败；实例已保持停用，且配置已被其他操作修改",
-                ));
-            }
-            let candidate_revision = next_revision(disabled_revision)?;
-            let mut restore = previous.clone();
-            restore.enabled = true;
-            restore.revision = candidate_revision;
-            snapshot.instances.retain(|item| item.id != restore.id);
-            snapshot.instances.push(restore.clone());
-            snapshot.config_revision = candidate_revision;
-            let prepared = self.preparation.prepare(snapshot.clone()).await?;
-            let mutation = self
-                .store
-                .save_instance_with_state(
-                    restore,
-                    disabled_revision,
-                    PluginStateCommit {
-                        configuration: previous_state.clone(),
-                        transition_id: None,
-                    },
-                    context,
-                )
-                .await
-                .map_err(|error| map_store_error(error, "plugin"))?;
-            self.publish_instance(snapshot, prepared, &mutation, &[])
-                .await?;
-            Ok::<(), AdminError>(())
-        }
-        .await;
-        match restored {
-            Ok(()) => original_error,
-            Err(error) => {
-                tracing::warn!(
-                    error_kind = ?error.kind(),
-                    "plugin state migration failed and the previous instance could not be restored"
-                );
-                AdminError::conflict("状态迁移失败；为避免覆盖并发配置，插件实例已保持停用")
-            }
-        }
-    }
-
-    /// 以事务返回的版本激活并发布，候选强引用必须覆盖整个提交后阶段
-    async fn publish_instance(
-        &self,
-        mut snapshot: PluginInstanceSnapshot,
-        prepared: ExtensionSetReference,
-        mutation: &PluginInstanceMutation,
-        replacements: &[PluginInstanceReplacement],
-    ) -> Result<(), AdminError> {
-        let prepared = if mutation.config_revision == snapshot.config_revision
-            && mutation.instance.revision == snapshot.config_revision
-        {
-            prepared
-        } else {
-            snapshot.config_revision = mutation.config_revision;
-            snapshot
-                .instances
-                .retain(|item| item.id != mutation.instance.id);
-            snapshot.instances.push(mutation.instance.clone());
-            apply_replacements(&mut snapshot, replacements);
-            self.preparation.prepare(snapshot).await?
-        };
-        self.preparation
-            .activate_state(&prepared, &mutation.instance)
-            .await?;
-        publish_committed(self.snapshots.as_ref(), mutation.config_revision).await?;
-        drop(prepared);
-        Ok(())
-    }
-
-    pub async fn delete_instance(
-        &self,
-        id: &str,
-        context: &MutationContext,
-    ) -> Result<Revision, AdminError> {
-        let snapshot = self
-            .store
-            .load_instances()
-            .await
-            .map_err(|e| map_store_error(e, "plugin"))?;
-        let instance = snapshot
-            .instances
-            .iter()
-            .find(|instance| instance.id == id)
-            .ok_or_else(|| AdminError::not_found("插件实例不存在"))?;
-        if instance.enabled {
-            return Err(AdminError::conflict("请先停用插件实例"));
-        }
-        let revision = self
-            .store
-            .delete_instance(id, snapshot.config_revision, context)
-            .await
-            .map_err(|e| map_store_error(e, "plugin"))?;
-        publish_committed(self.snapshots.as_ref(), revision).await?;
-        Ok(revision)
-    }
-
-    /// 紧急管理修复不要求损坏插件成功准备；提交后沿用现有发布与暂停合同
-    pub async fn disable_instance(
-        &self,
-        id: &str,
-        context: &MutationContext,
-    ) -> Result<PluginInstanceMutation, AdminError> {
-        let PluginInstanceSnapshot {
-            config_revision,
-            instances,
-        } = self
-            .store
-            .load_instances()
-            .await
-            .map_err(|e| map_store_error(e, "plugin"))?;
-        let mut instance = instances
-            .into_iter()
-            .find(|instance| instance.id == id)
-            .ok_or_else(|| AdminError::not_found("插件实例不存在"))?;
-        instance.enabled = false;
-        let result = self
-            .store
-            .save_instance(instance, config_revision, context)
-            .await
-            .map_err(|e| map_store_error(e, "plugin"))?;
-        publish_committed(self.snapshots.as_ref(), result.config_revision).await?;
-        Ok(result)
-    }
-}
-
-fn apply_replacements(
-    snapshot: &mut PluginInstanceSnapshot,
-    replacements: &[PluginInstanceReplacement],
-) {
-    for instance in &mut snapshot.instances {
-        if replacements.iter().any(|item| item.id == instance.id) {
-            instance.enabled = false;
-            instance.revision = snapshot.config_revision;
-        }
-    }
-}
-
-fn same_creation_request(existing: &PluginInstance, input: &ConfigurePluginInstance) -> bool {
-    let same_secrets = input
-        .secrets
-        .as_ref()
-        .map_or(existing.secrets.is_empty(), |secrets| {
-            secrets.len() == existing.secrets.len()
-                && secrets.iter().all(|(key, value)| {
-                    existing
-                        .secrets
-                        .get(key)
-                        .is_some_and(|current| current.expose_secret() == value.expose_secret())
-                })
-        });
-    existing.name == input.name.trim()
-        && existing.artifact_sha256 == input.artifact_sha256
-        && existing.enabled == input.enabled
-        && existing.configuration == input.configuration
-        && existing.bindings == input.bindings
-        && same_secrets
-}
-
-fn validate_input(instance: &PluginInstance) -> Result<(), AdminError> {
-    if instance.name.is_empty()
-        || instance.name.len() > 128
-        || instance.name.chars().any(char::is_control)
-        || instance.artifact_sha256.len() != 64
-        || !instance
-            .artifact_sha256
-            .bytes()
-            .all(|byte| byte.is_ascii_digit() || (b'a'..=b'f').contains(&byte))
-        || !instance.configuration.is_object()
-        || serde_json::to_vec(&instance.configuration).map_or(true, |bytes| bytes.len() > 48 * 1024)
-        || instance.secrets.len() > 64
-        || instance.bindings.len() > 64
-    {
-        return Err(AdminError::invalid("插件实例配置不合法或超过大小限制"));
-    }
-    use secrecy::ExposeSecret as _;
-    if instance
-        .secrets
-        .iter()
-        .any(|(key, value)| key.len() > 64 || value.expose_secret().len() > 8192)
-        || instance
-            .secrets
-            .values()
-            .map(|value| value.expose_secret().len())
-            .sum::<usize>()
-            > 48 * 1024
-    {
-        return Err(AdminError::invalid("插件敏感配置超过大小限制"));
-    }
-    if instance.bindings.iter().any(|binding| {
-        binding.contribution.is_empty()
-            || binding.contribution.len() > 128
-            || !binding
-                .contribution
-                .bytes()
-                .all(|byte| byte.is_ascii_alphanumeric() || matches!(byte, b'.' | b'-'))
-            || binding.client_key_ids.len() > 256
-            || binding.account_group_ids.len() > 256
-            || binding.client_key_ids.iter().collect::<BTreeSet<_>>().len()
-                != binding.client_key_ids.len()
-            || binding
-                .account_group_ids
-                .iter()
-                .collect::<BTreeSet<_>>()
-                .len()
-                != binding.account_group_ids.len()
-            || binding
-                .client_key_ids
-                .iter()
-                .any(|id| ClientApiKeyId::new(id.clone()).is_err())
-            || binding
-                .account_group_ids
-                .iter()
-                .any(|id| AccountGroupId::new(id.clone()).is_err())
-            || binding.identity_bindings.len() > 256
-            || binding
-                .identity_bindings
-                .iter()
-                .map(|identity| &identity.principal)
-                .collect::<BTreeSet<_>>()
-                .len()
-                != binding.identity_bindings.len()
-            || binding.identity_bindings.iter().any(|identity| {
-                identity.principal.trim() != identity.principal
-                    || identity.principal.is_empty()
-                    || identity.principal.len() > 256
-                    || identity.principal.chars().any(char::is_control)
-                    || ClientApiKeyId::new(identity.client_key_id.clone()).is_err()
-            })
-    }) {
-        return Err(AdminError::invalid("插件绑定的范围或入口认证身份不合法"));
-    }
-    Ok(())
-}
-
-fn next_revision(revision: Revision) -> Result<Revision, AdminError> {
-    Revision::new(
-        revision
-            .get()
-            .checked_add(1)
-            .ok_or_else(|| AdminError::internal("配置版本已耗尽"))?,
-    )
-    .map_err(|_| AdminError::internal("配置版本不合法"))
-}

backend/crates/gateway-admin/src/use_case/plugins/instances/configuration.rs

@@ -0,0 +1,135 @@
+//! 插件配置的输入约束、创建幂等比较与候选快照变换
+
+use std::collections::BTreeSet;
+
+use gateway_core::{policy::ClientApiKeyId, routing::AccountGroupId};
+use secrecy::ExposeSecret;
+
+use crate::model::{
+    AdminError, Revision,
+    plugins::instances::{
+        ConfigurePluginInstance, PluginInstance, PluginInstanceReplacement, PluginInstanceSnapshot,
+    },
+};
+
+pub(super) fn apply_replacements(
+    snapshot: &mut PluginInstanceSnapshot,
+    replacements: &[PluginInstanceReplacement],
+) {
+    for instance in &mut snapshot.instances {
+        if replacements.iter().any(|item| item.id == instance.id) {
+            instance.enabled = false;
+            instance.revision = snapshot.config_revision;
+        }
+    }
+}
+
+pub(super) fn same_creation_request(
+    existing: &PluginInstance,
+    input: &ConfigurePluginInstance,
+) -> bool {
+    let same_secrets = input
+        .secrets
+        .as_ref()
+        .map_or(existing.secrets.is_empty(), |secrets| {
+            secrets.len() == existing.secrets.len()
+                && secrets.iter().all(|(key, value)| {
+                    existing
+                        .secrets
+                        .get(key)
+                        .is_some_and(|current| current.expose_secret() == value.expose_secret())
+                })
+        });
+    existing.name == input.name.trim()
+        && existing.artifact_sha256 == input.artifact_sha256
+        && existing.enabled == input.enabled
+        && existing.configuration == input.configuration
+        && existing.bindings == input.bindings
+        && same_secrets
+}
+
+pub(super) fn validate_input(instance: &PluginInstance) -> Result<(), AdminError> {
+    if instance.name.is_empty()
+        || instance.name.len() > 128
+        || instance.name.chars().any(char::is_control)
+        || instance.artifact_sha256.len() != 64
+        || !instance
+            .artifact_sha256
+            .bytes()
+            .all(|byte| byte.is_ascii_digit() || (b'a'..=b'f').contains(&byte))
+        || !instance.configuration.is_object()
+        || serde_json::to_vec(&instance.configuration).map_or(true, |bytes| bytes.len() > 48 * 1024)
+        || instance.secrets.len() > 64
+        || instance.bindings.len() > 64
+    {
+        return Err(AdminError::invalid("插件实例配置不合法或超过大小限制"));
+    }
+    use secrecy::ExposeSecret as _;
+    if instance
+        .secrets
+        .iter()
+        .any(|(key, value)| key.len() > 64 || value.expose_secret().len() > 8192)
+        || instance
+            .secrets
+            .values()
+            .map(|value| value.expose_secret().len())
+            .sum::<usize>()
+            > 48 * 1024
+    {
+        return Err(AdminError::invalid("插件敏感配置超过大小限制"));
+    }
+    if instance.bindings.iter().any(|binding| {
+        binding.contribution.is_empty()
+            || binding.contribution.len() > 128
+            || !binding
+                .contribution
+                .bytes()
+                .all(|byte| byte.is_ascii_alphanumeric() || matches!(byte, b'.' | b'-'))
+            || binding.client_key_ids.len() > 256
+            || binding.account_group_ids.len() > 256
+            || binding.client_key_ids.iter().collect::<BTreeSet<_>>().len()
+                != binding.client_key_ids.len()
+            || binding
+                .account_group_ids
+                .iter()
+                .collect::<BTreeSet<_>>()
+                .len()
+                != binding.account_group_ids.len()
+            || binding
+                .client_key_ids
+                .iter()
+                .any(|id| ClientApiKeyId::new(id.clone()).is_err())
+            || binding
+                .account_group_ids
+                .iter()
+                .any(|id| AccountGroupId::new(id.clone()).is_err())
+            || binding.identity_bindings.len() > 256
+            || binding
+                .identity_bindings
+                .iter()
+                .map(|identity| &identity.principal)
+                .collect::<BTreeSet<_>>()
+                .len()
+                != binding.identity_bindings.len()
+            || binding.identity_bindings.iter().any(|identity| {
+                identity.principal.trim() != identity.principal
+                    || identity.principal.is_empty()
+                    || identity.principal.len() > 256
+                    || identity.principal.chars().any(char::is_control)
+                    || ClientApiKeyId::new(identity.client_key_id.clone()).is_err()
+            })
+    }) {
+        return Err(AdminError::invalid("插件绑定的范围或入口认证身份不合法"));
+    }
+    Ok(())
+}
+
+pub(super) fn next_revision(revision: Revision) -> Result<Revision, AdminError> {
+    Revision::new(
+        revision
+            .get()
+            .checked_add(1)
+            .ok_or_else(|| AdminError::internal("配置版本已耗尽"))?,
+    )
+    .map_err(|_| AdminError::internal("配置版本不合法"))
+}

backend/crates/gateway-admin/src/use_case/plugins/instances/migration.rs

@@ -0,0 +1,226 @@
+//! 插件私有状态迁移的排空、暂存提交与失败恢复编排
+
+use super::{
+    PluginsService,
+    configuration::{apply_replacements, next_revision},
+};
+use crate::{
+    model::{
+        AdminError, MutationContext, Revision,
+        plugins::{
+            instances::{
+                PluginCompatibilityConfirmation, PluginInstance, PluginInstanceMutation,
+                PluginInstanceReplacement, PluginInstanceSnapshot,
+            },
+            state::{PluginStateCommit, PluginStateConfiguration},
+        },
+    },
+    use_case::{map_store_error, publish_committed},
+};
+
+impl PluginsService {
+    pub(super) async fn configure_instance_with_state_transition(
+        &self,
+        mut snapshot: PluginInstanceSnapshot,
+        mut target: PluginInstance,
+        target_state: PluginStateConfiguration,
+        replacements: &[PluginInstanceReplacement],
+        confirmation: Option<&PluginCompatibilityConfirmation>,
+        context: &MutationContext,
+    ) -> Result<PluginInstanceMutation, AdminError> {
+        let previous = snapshot
+            .instances
+            .iter()
+            .find(|instance| instance.id == target.id)
+            .cloned()
+            .ok_or_else(|| AdminError::not_found("插件实例不存在"))?;
+        let previous_state = self.preparation.validate(previous.clone()).await?;
+        let original_revision = snapshot.config_revision;
+        // 即使最终保持停用，迁移也必须由目标制品的受控候选执行
+        let mut migration_instance = target.clone();
+        migration_instance.enabled = true;
+        snapshot.config_revision = migration_instance.revision;
+        snapshot
+            .instances
+            .retain(|instance| instance.id != migration_instance.id);
+        snapshot.instances.push(migration_instance);
+        apply_replacements(&mut snapshot, replacements);
+        let migration_prepared = self
+            .prepare_instance_candidate(snapshot, confirmation)
+            .await?;
+
+        let mut disabled_revision = None;
+        let disabled = if previous.enabled {
+            let mut disabled = previous.clone();
+            disabled.enabled = false;
+            let mutation = self
+                .store
+                .save_instance_with_state(
+                    disabled,
+                    original_revision,
+                    PluginStateCommit {
+                        configuration: previous_state.clone(),
+                        transition_id: None,
+                    },
+                    context,
+                )
+                .await
+                .map_err(|error| map_store_error(error, "plugin"))?;
+            publish_committed(self.snapshots.as_ref(), mutation.config_revision).await?;
+            self.preparation
+                .quiesce_instance(&previous.id, &previous.artifact_sha256, previous.revision)
+                .await;
+            disabled_revision = Some(mutation.config_revision);
+            mutation.instance
+        } else {
+            previous.clone()
+        };
+        let expected_revision = disabled_revision.unwrap_or(original_revision);
+        let transition = match self
+            .state
+            .begin_transition(
+                &disabled.id,
+                disabled.revision,
+                &target.artifact_sha256,
+                target_state.clone(),
+            )
+            .await
+        {
+            Ok(transition) => transition,
+            Err(error) => {
+                return Err(self
+                    .recover_failed_state_transition(
+                        None,
+                        &previous,
+                        &previous_state,
+                        disabled_revision,
+                        context,
+                        error,
+                    )
+                    .await);
+            }
+        };
+        // 迁移开始后的所有提交前失败都走同一恢复出口；提交成功后不再回滚旧配置
+        let committed = async {
+            self.preparation
+                .migrate_state(&migration_prepared, transition.clone())
+                .await?;
+            let mut current = self
+                .store
+                .load_instances()
+                .await
+                .map_err(|error| map_store_error(error, "plugin"))?;
+            if current.config_revision != expected_revision {
+                return Err(AdminError::conflict("迁移期间插件配置已发生变化"));
+            }
+            let candidate_revision = next_revision(expected_revision)?;
+            target.revision = candidate_revision;
+            current.instances.retain(|item| item.id != target.id);
+            current.instances.push(target.clone());
+            current.config_revision = candidate_revision;
+            apply_replacements(&mut current, replacements);
+            let prepared = self
+                .prepare_instance_candidate(current.clone(), confirmation)
+                .await?;
+            let result = self
+                .store
+                .save_instance_replacing(
+                    target,
+                    expected_revision,
+                    PluginStateCommit {
+                        configuration: target_state,
+                        transition_id: Some(transition.id.clone()),
+                    },
+                    replacements,
+                    context,
+                )
+                .await
+                .map_err(|error| map_store_error(error, "plugin"))?;
+            Ok((current, prepared, result))
+        }
+        .await;
+        let (current, prepared, result) = match committed {
+            Ok(committed) => committed,
+            Err(error) => {
+                return Err(self
+                    .recover_failed_state_transition(
+                        Some(&transition.id),
+                        &previous,
+                        &previous_state,
+                        disabled_revision,
+                        context,
+                        error,
+                    )
+                    .await);
+            }
+        };
+        self.publish_instance(current, prepared, &result, replacements, confirmation)
+            .await?;
+        drop(migration_prepared);
+        Ok(result)
+    }
+
+    async fn recover_failed_state_transition(
+        &self,
+        transition_id: Option<&str>,
+        previous: &PluginInstance,
+        previous_state: &PluginStateConfiguration,
+        disabled_revision: Option<Revision>,
+        context: &MutationContext,
+        original_error: AdminError,
+    ) -> AdminError {
+        if let Some(transition_id) = transition_id {
+            self.state.abort_transition(transition_id).await;
+        }
+        let Some(disabled_revision) = disabled_revision else {
+            return original_error;
+        };
+        let restored = async {
+            let mut snapshot = self
+                .store
+                .load_instances()
+                .await
+                .map_err(|error| map_store_error(error, "plugin"))?;
+            if snapshot.config_revision != disabled_revision {
+                return Err(AdminError::conflict(
+                    "状态迁移失败；实例已保持停用，且配置已被其他操作修改",
+                ));
+            }
+            let candidate_revision = next_revision(disabled_revision)?;
+            let mut restore = previous.clone();
+            restore.enabled = true;
+            restore.revision = candidate_revision;
+            snapshot.instances.retain(|item| item.id != restore.id);
+            snapshot.instances.push(restore.clone());
+            snapshot.config_revision = candidate_revision;
+            let prepared = self.preparation.prepare(snapshot.clone()).await?;
+            let mutation = self
+                .store
+                .save_instance_with_state(
+                    restore,
+                    disabled_revision,
+                    PluginStateCommit {
+                        configuration: previous_state.clone(),
+                        transition_id: None,
+                    },
+                    context,
+                )
+                .await
+                .map_err(|error| map_store_error(error, "plugin"))?;
+            self.publish_instance(snapshot, prepared, &mutation, &[], None)
+                .await?;
+            Ok::<(), AdminError>(())
+        }
+        .await;
+        match restored {
+            Ok(()) => original_error,
+            Err(error) => {
+                tracing::warn!(
+                    error_kind = ?error.kind(),
+                    "plugin state migration failed and the previous instance could not be restored"
+                );
+                AdminError::conflict("状态迁移失败；为避免覆盖并发配置，插件实例已保持停用")
+            }
+        }
+    }
+}

backend/crates/gateway-admin/src/use_case/plugins/instances/mod.rs

@@ -0,0 +1,15 @@
+//! 插件实例用例的职责边界与静态检查结果
+
+mod configuration;
+mod migration;
+mod mutations;
+mod publication;
+mod queries;
+
+use super::PluginsService;
+
+#[derive(Clone, Default)]
+pub(super) struct PackageStatus {
+    pub(super) warning: Option<String>,
+    pub(super) load_error: Option<String>,
+}

backend/crates/gateway-admin/src/use_case/plugins/instances/mutations.rs

@@ -0,0 +1,333 @@
+//! 插件实例的配置提交、发布、停用与删除用例
+
+use std::collections::BTreeSet;
+
+use super::{
+    PluginsService,
+    configuration::{apply_replacements, next_revision, same_creation_request, validate_input},
+};
+use crate::{
+    model::{
+        AdminError, MutationContext, Revision,
+        plugins::{
+            instances::{
+                ConfigurePluginInstance, PluginInstance, PluginInstanceMutation,
+                PluginInstanceSnapshot,
+            },
+            state::PluginStateCommit,
+        },
+    },
+    use_case::{map_store_error, publish_committed},
+};
+
+impl PluginsService {
+    pub async fn configure_instance(
+        &self,
+        id: Option<&str>,
+        input: ConfigurePluginInstance,
+        context: &MutationContext,
+    ) -> Result<PluginInstanceMutation, AdminError> {
+        if id.is_some() && input.creation_id.is_some() {
+            return Err(AdminError::invalid("编辑配置不能使用创建标识"));
+        }
+        if id.is_none() && input.expected_revision.is_some() {
+            return Err(AdminError::invalid("创建配置不能指定已有配置版本"));
+        }
+        if let Some(creation_id) = &input.creation_id {
+            let parsed = uuid::Uuid::parse_str(creation_id)
+                .map_err(|_| AdminError::invalid("配置创建标识必须是 UUID"))?;
+            if parsed.to_string() != *creation_id {
+                return Err(AdminError::invalid("配置创建标识必须使用标准 UUID 格式"));
+            }
+        }
+        let snapshot = self
+            .store
+            .load_instances()
+            .await
+            .map_err(|e| map_store_error(e, "plugin"))?;
+        let existing = match id {
+            Some(id) => Some(
+                snapshot
+                    .instances
+                    .iter()
+                    .find(|instance| instance.id == id)
+                    .cloned()
+                    .ok_or_else(|| AdminError::not_found("插件实例不存在"))?,
+            ),
+            None => input.creation_id.as_ref().and_then(|creation_id| {
+                snapshot
+                    .instances
+                    .iter()
+                    .find(|instance| instance.id == *creation_id)
+                    .cloned()
+            }),
+        };
+        if let Some(existing) = &existing {
+            if id.is_none() && !same_creation_request(existing, &input) {
+                return Err(AdminError::conflict("此配置已创建，请加载最新配置后编辑"));
+            }
+            if input
+                .expected_revision
+                .is_some_and(|revision| revision != existing.revision.get())
+            {
+                return Err(AdminError::conflict("插件配置已变更，请加载最新配置后重试"));
+            }
+        }
+        self.configure_from_snapshot(snapshot, existing, input, context)
+            .await
+    }
+
+    pub(in crate::use_case::plugins) async fn configure_from_snapshot(
+        &self,
+        mut snapshot: PluginInstanceSnapshot,
+        existing: Option<PluginInstance>,
+        input: ConfigurePluginInstance,
+        context: &MutationContext,
+    ) -> Result<PluginInstanceMutation, AdminError> {
+        let expected_revision = snapshot.config_revision;
+        let candidate_revision = next_revision(expected_revision)?;
+        let artifacts = self
+            .store
+            .list_artifacts()
+            .await
+            .map_err(|error| map_store_error(error, "plugin"))?;
+        let artifact = artifacts
+            .iter()
+            .find(|artifact| artifact.metadata.sha256 == input.artifact_sha256)
+            .ok_or_else(|| AdminError::not_found("插件制品不存在"))?;
+        if artifact.accepted_at.is_none() {
+            return Err(AdminError::invalid("请先安装并确认完整信任该版本"));
+        }
+        let confirmation = input.compatibility_confirmation.as_ref();
+        if let Some(confirmed) = confirmation
+            && (!input.enabled
+                || existing.as_ref().is_none_or(|instance| {
+                    instance.id != confirmed.instance_id
+                        || instance.revision.get() != confirmed.instance_revision
+                })
+                || input.artifact_sha256 != confirmed.artifact_sha256
+                || self.inspector.compatibility_host_fingerprint()? != confirmed.host_fingerprint)
+        {
+            return Err(AdminError::conflict(
+                "宿主、插件包或配置已变化，请重新确认启动风险",
+            ));
+        }
+        if input.enabled {
+            let status = self.package_status(&input.artifact_sha256).await?;
+            if let Some(reason) = status.load_error {
+                return Err(AdminError::invalid(format!(
+                    "{reason}，无法启动，请安装兼容版本"
+                )));
+            }
+            if let Some(reason) = status.warning
+                && confirmation.is_none()
+            {
+                return Err(AdminError::conflict(format!(
+                    "插件版本不兼容：{reason}；请先确认启动风险"
+                )));
+            }
+        }
+        let same_plugin = |digest: &str| {
+            artifacts.iter().any(|item| {
+                item.metadata.sha256 == digest
+                    && item.metadata.plugin_id == artifact.metadata.plugin_id
+            })
+        };
+        if existing
+            .as_ref()
+            .is_some_and(|previous| !same_plugin(&previous.artifact_sha256))
+        {
+            return Err(AdminError::invalid("不能将已有配置切换为另一个插件"));
+        }
+        if input.enabled
+            && snapshot.instances.iter().any(|other| {
+                other.enabled
+                    && existing
+                        .as_ref()
+                        .is_none_or(|current| current.id != other.id)
+                    && same_plugin(&other.artifact_sha256)
+                    && !input
+                        .replace_instances
+                        .iter()
+                        .any(|replacement| replacement.id == other.id)
+            })
+        {
+            return Err(AdminError::conflict(
+                "此插件已有启用配置，请先切换或停用旧配置",
+            ));
+        }
+        let saved = if let Some(previous) = &existing
+            && previous.artifact_sha256 != input.artifact_sha256
+            && input.secrets.is_none()
+        {
+            self.store
+                .load_version_configuration(&previous.id, &input.artifact_sha256)
+                .await
+                .map_err(|error| map_store_error(error, "plugin"))?
+        } else {
+            None
+        };
+        let instance = PluginInstance {
+            id: existing.as_ref().map_or_else(
+                || {
+                    input
+                        .creation_id
+                        .clone()
+                        .unwrap_or_else(|| uuid::Uuid::now_v7().to_string())
+                },
+                |instance| instance.id.clone(),
+            ),
+            name: input.name.trim().to_owned(),
+            artifact_sha256: input.artifact_sha256,
+            enabled: input.enabled,
+            trusted_process: true,
+            configuration: input.configuration,
+            secrets: input
+                .secrets
+                .or_else(|| saved.map(|saved| saved.secrets))
+                .unwrap_or_else(|| {
+                    existing
+                        .as_ref()
+                        .map_or_else(Default::default, |instance| instance.secrets.clone())
+                }),
+            bindings: input.bindings,
+            revision: candidate_revision,
+        };
+        validate_input(&instance)?;
+        if existing
+            .as_ref()
+            .is_some_and(|previous| previous.artifact_sha256 != instance.artifact_sha256)
+            && !self
+                .preparation
+                .configuration_ready(instance.clone(), &artifact.metadata)
+                .await?
+        {
+            return Err(AdminError::invalid(
+                "目标版本仍缺少必填设置，请补充后再切换",
+            ));
+        }
+
+        let replacements = input.replace_instances;
+        if !replacements.is_empty() {
+            if !instance.enabled || replacements.len() > 256 {
+                return Err(AdminError::invalid(
+                    "仅启用配置时可以切换其他配置，单次最多 256 项",
+                ));
+            }
+            let mut ids = BTreeSet::new();
+            for replacement in &replacements {
+                if replacement.id == instance.id || !ids.insert(&replacement.id) {
+                    return Err(AdminError::invalid("停用列表不能重复或包含当前配置"));
+                }
+                let previous = snapshot
+                    .instances
+                    .iter()
+                    .find(|item| item.id == replacement.id)
+                    .ok_or_else(|| AdminError::conflict("待停用配置已变更，请重新确认"))?;
+                if !previous.enabled || previous.revision.get() != replacement.expected_revision {
+                    return Err(AdminError::conflict("待停用配置已变更，请重新确认"));
+                }
+                if !artifacts.iter().any(|item| {
+                    item.metadata.sha256 == previous.artifact_sha256
+                        && item.metadata.plugin_id == artifact.metadata.plugin_id
+                }) {
+                    return Err(AdminError::invalid("只能切换同一插件的配置"));
+                }
+            }
+        }
+        let state = self.preparation.validate(instance.clone()).await?;
+        if let Some(existing) = &existing
+            && self.state.transition_required(&existing.id, &state).await?
+        {
+            return self
+                .configure_instance_with_state_transition(
+                    snapshot,
+                    instance,
+                    state,
+                    &replacements,
+                    confirmation,
+                    context,
+                )
+                .await;
+        }
+        snapshot.instances.retain(|item| item.id != instance.id);
+        snapshot.instances.push(instance.clone());
+        snapshot.config_revision = candidate_revision;
+        apply_replacements(&mut snapshot, &replacements);
+        let prepared = self
+            .prepare_instance_candidate(snapshot.clone(), confirmation)
+            .await?;
+        let result = self
+            .store
+            .save_instance_replacing(
+                instance,
+                expected_revision,
+                PluginStateCommit {
+                    configuration: state,
+                    transition_id: None,
+                },
+                &replacements,
+                context,
+            )
+            .await
+            .map_err(|e| map_store_error(e, "plugin"))?;
+        self.publish_instance(snapshot, prepared, &result, &replacements, confirmation)
+            .await?;
+        Ok(result)
+    }
+
+    pub async fn delete_instance(
+        &self,
+        id: &str,
+        context: &MutationContext,
+    ) -> Result<Revision, AdminError> {
+        let snapshot = self
+            .store
+            .load_instances()
+            .await
+            .map_err(|e| map_store_error(e, "plugin"))?;
+        let instance = snapshot
+            .instances
+            .iter()
+            .find(|instance| instance.id == id)
+            .ok_or_else(|| AdminError::not_found("插件实例不存在"))?;
+        if instance.enabled {
+            return Err(AdminError::conflict("请先停用插件实例"));
+        }
+        let revision = self
+            .store
+            .delete_instance(id, snapshot.config_revision, context)
+            .await
+            .map_err(|e| map_store_error(e, "plugin"))?;
+        publish_committed(self.snapshots.as_ref(), revision).await?;
+        Ok(revision)
+    }
+
+    /// 紧急管理修复不要求损坏插件成功准备；提交后沿用现有发布与暂停合同
+    pub async fn disable_instance(
+        &self,
+        id: &str,
+        context: &MutationContext,
+    ) -> Result<PluginInstanceMutation, AdminError> {
+        let PluginInstanceSnapshot {
+            config_revision,
+            instances,
+        } = self
+            .store
+            .load_instances()
+            .await
+            .map_err(|e| map_store_error(e, "plugin"))?;
+        let mut instance = instances
+            .into_iter()
+            .find(|instance| instance.id == id)
+            .ok_or_else(|| AdminError::not_found("插件实例不存在"))?;
+        instance.enabled = false;
+        let result = self
+            .store
+            .save_instance(instance, config_revision, context)
+            .await
+            .map_err(|e| map_store_error(e, "plugin"))?;
+        publish_committed(self.snapshots.as_ref(), result.config_revision).await?;
+        Ok(result)
+    }
+}

backend/crates/gateway-admin/src/use_case/plugins/instances/publication.rs

@@ -0,0 +1,63 @@
+//! 配置提交与迁移恢复共用的状态激活和发布收尾
+
+use gateway_core::routing::extensions::ExtensionSetReference;
+
+use super::{PluginsService, configuration::apply_replacements};
+use crate::{
+    model::{
+        AdminError,
+        plugins::instances::{
+            PluginCompatibilityConfirmation, PluginInstanceMutation, PluginInstanceReplacement,
+            PluginInstanceSnapshot,
+        },
+    },
+    use_case::publish_committed,
+};
+
+impl PluginsService {
+    pub(super) async fn prepare_instance_candidate(
+        &self,
+        snapshot: PluginInstanceSnapshot,
+        confirmation: Option<&PluginCompatibilityConfirmation>,
+    ) -> Result<ExtensionSetReference, AdminError> {
+        match confirmation {
+            Some(confirmation) => {
+                self.preparation
+                    .prepare_confirmed(snapshot, confirmation.clone())
+                    .await
+            }
+            None => self.preparation.prepare(snapshot).await,
+        }
+    }
+
+    /// 以事务返回的版本激活并发布，候选强引用必须覆盖整个提交后阶段
+    pub(super) async fn publish_instance(
+        &self,
+        mut snapshot: PluginInstanceSnapshot,
+        prepared: ExtensionSetReference,
+        mutation: &PluginInstanceMutation,
+        replacements: &[PluginInstanceReplacement],
+        confirmation: Option<&PluginCompatibilityConfirmation>,
+    ) -> Result<(), AdminError> {
+        let prepared = if mutation.config_revision == snapshot.config_revision
+            && mutation.instance.revision == snapshot.config_revision
+        {
+            prepared
+        } else {
+            snapshot.config_revision = mutation.config_revision;
+            snapshot
+                .instances
+                .retain(|item| item.id != mutation.instance.id);
+            snapshot.instances.push(mutation.instance.clone());
+            apply_replacements(&mut snapshot, replacements);
+            self.prepare_instance_candidate(snapshot, confirmation)
+                .await?
+        };
+        self.preparation
+            .activate_state(&prepared, &mutation.instance)
+            .await?;
+        publish_committed(self.snapshots.as_ref(), mutation.config_revision).await?;
+        drop(prepared);
+        Ok(())
+    }
+}

backend/crates/gateway-admin/src/use_case/plugins/instances/queries.rs

@@ -0,0 +1,122 @@
+//! 插件实例列表与静态包检查的只读投影，不从发布事实推断进程状态
+
+use std::collections::BTreeMap;
+
+use super::{PackageStatus, PluginsService};
+use crate::{
+    model::{
+        AdminError, AdminErrorKind,
+        plugins::instances::{
+            PluginInstanceRuntime, PluginInstanceRuntimeStatus, PluginInstanceView,
+        },
+    },
+    use_case::map_store_error,
+};
+
+impl PluginsService {
+    /// 只校验固定包体，不启动插件；停用实例也需区分兼容性提醒与加载错误
+    pub(in crate::use_case::plugins) async fn package_status(
+        &self,
+        digest: &str,
+    ) -> Result<PackageStatus, AdminError> {
+        // 运行宿主和摘要固定，缓存纯静态结论，避免管理页轮询反复解包
+        // 只缓存有限数量的确定结果，暂时性错误仍可重试
+        if let Some(status) = self.compatibility.lock().await.get(digest).cloned() {
+            return Ok(status);
+        }
+        let artifact = self
+            .store
+            .load_artifact(digest)
+            .await
+            .map_err(|error| map_store_error(error, "plugin"))?;
+        let status = match self
+            .inspector
+            .compatibility_warning(artifact.archive, digest.to_owned())
+            .await
+        {
+            Ok(warning) => PackageStatus {
+                warning,
+                load_error: None,
+            },
+            Err(error) if error.kind() == AdminErrorKind::Invalid => PackageStatus {
+                warning: None,
+                load_error: Some(error.message().to_owned()),
+            },
+            Err(error) => return Err(error),
+        };
+        let mut cache = self.compatibility.lock().await;
+        if cache.len() < 128 {
+            cache.insert(digest.to_owned(), status.clone());
+        }
+        Ok(status)
+    }
+
+    pub async fn instances(&self) -> Result<Vec<PluginInstanceView>, AdminError> {
+        let snapshot = self
+            .store
+            .load_instances()
+            .await
+            .map_err(|e| map_store_error(e, "plugin"))?;
+        let published = self.published.snapshot_for_diagnostics();
+        let published_revision = published.as_ref().map(|snapshot| snapshot.revision().get());
+        let mut diagnostics = self
+            .preparation
+            .runtime_diagnostics(
+                &snapshot,
+                published_revision,
+                published
+                    .as_ref()
+                    .and_then(|snapshot| snapshot.extensions()),
+            )
+            .await
+            .unwrap_or_default();
+        let artifacts = self
+            .list()
+            .await?
+            .into_iter()
+            .map(|artifact| (artifact.metadata.sha256.clone(), artifact.metadata))
+            .collect::<BTreeMap<_, _>>();
+        let mut views = Vec::with_capacity(snapshot.instances.len());
+        for instance in snapshot.instances {
+            let metadata = artifacts
+                .get(&instance.artifact_sha256)
+                .ok_or_else(|| AdminError::not_found("插件制品不存在"))?;
+            let package_status = self.package_status(&instance.artifact_sha256).await?;
+            let configuration_required = package_status.load_error.is_none()
+                && !self
+                    .preparation
+                    .configuration_ready(instance.clone(), metadata)
+                    .await?;
+            let runtime =
+                diagnostics
+                    .remove(&instance.id)
+                    .unwrap_or_else(|| PluginInstanceRuntime {
+                        status: if !instance.enabled {
+                            PluginInstanceRuntimeStatus::Disabled
+                        } else {
+                            PluginInstanceRuntimeStatus::Unknown
+                        },
+                        actual_revision: None,
+                        actual_artifact_sha256: None,
+                        failure: None,
+                        draining_revisions: Vec::new(),
+                        load: None,
+                    });
+            views.push(PluginInstanceView {
+                api_deprecations: if package_status.load_error.is_none() {
+                    self.inspector.api_deprecations(metadata)?
+                } else {
+                    Vec::new()
+                },
+                configuration_required,
+                compatibility_warning: package_status.warning,
+                load_error: package_status.load_error,
+                running: runtime.status == PluginInstanceRuntimeStatus::Running,
+                published_revision,
+                runtime,
+                instance,
+            });
+        }
+        Ok(views)
+    }
+}

backend/crates/gateway-admin/src/use_case/plugins/versions.rs

@@ -10,9 +10,9 @@ use crate::{
         plugins::{
             PluginArtifactMetadata,
             instances::{
-                ConfigurePluginInstance, PluginInstance, PluginInstanceMutation,
-                PluginRollbackPlan, PluginRollbackTarget, PluginVersionConfiguration,
-                PluginVersionPlan, RollbackPluginInstance,
+                ConfigurePluginInstance, PluginCompatibilityConfirmation, PluginInstance,
+                PluginInstanceMutation, PluginRollbackPlan, PluginRollbackTarget,
+                PluginVersionConfiguration, PluginVersionPlan, RollbackPluginInstance,
             },
         },
     },
@@ -61,6 +61,7 @@ impl PluginsService {
                 AdminError::invalid("该版本没有可恢复的配置，请通过版本切换检查当前设置")
             })?;
         let configuration = ConfigurePluginInstance {
+            compatibility_confirmation: None,
             creation_id: None,
             expected_revision: None,
             replace_instances: Vec::new(),
@@ -142,7 +143,21 @@ impl PluginsService {
             .find(|instance| instance.id == id)
             .ok_or_else(|| AdminError::not_found("插件实例不存在"))?;
         let (configuration, restored) = self.version_configuration(instance, digest).await?;
+        let status = self.package_status(digest).await?;
+        let compatibility_confirmation = if status.warning.is_some() {
+            Some(PluginCompatibilityConfirmation {
+                host_fingerprint: self.inspector.compatibility_host_fingerprint()?,
+                instance_id: instance.id.clone(),
+                instance_revision: instance.revision.get(),
+                artifact_sha256: digest.to_owned(),
+            })
+        } else {
+            None
+        };
         Ok(PluginVersionPlan {
+            compatibility_warning: status.warning,
+            compatibility_confirmation,
+            load_error: status.load_error,
             instance_revision: instance.revision.get(),
             artifact_sha256: digest.to_owned(),
             configuration: configuration.configuration,
@@ -179,6 +194,7 @@ impl PluginsService {
             .version_configuration(&existing, &input.artifact_sha256)
             .await?;
         let request = ConfigurePluginInstance {
+            compatibility_confirmation: None,
             creation_id: None,
             expected_revision: Some(existing.revision.get()),
             replace_instances: Vec::new(),

backend/crates/gateway-admin/tests/use_case/observability/mod.rs

@@ -1361,7 +1361,6 @@ fn total_record(
         provider_account_authentication_kind: None,
         upstream_model_id: Some("gpt-5.5".to_owned()),
         upstream_transport: None,
-        upstream_response_model: None,
         service_tier: None,
         input_tokens: Some(800),
         output_tokens: Some(200),

backend/crates/gateway-admin/tests/use_case/plugins/artifacts.rs

@@ -39,6 +39,7 @@ struct FixtureData {
     artifact: InstalledPluginArtifact,
     snapshot: PluginInstanceSnapshot,
     saves: usize,
+    compatibility_warning: Option<String>,
     publications: Vec<u64>,
 }
 
@@ -61,6 +62,7 @@ impl Fixture {
                     instances: existing.into_iter().collect(),
                 },
                 saves: 0,
+                compatibility_warning: None,
                 publications: Vec::new(),
             }),
         })
@@ -89,6 +91,14 @@ impl SnapshotControl for Fixture {
 
 #[async_trait]
 impl gateway_admin::ports::plugins::PluginPackageInspector for Fixture {
+    async fn compatibility_warning(
+        &self,
+        _: Arc<[u8]>,
+        _: String,
+    ) -> Result<Option<String>, AdminError> {
+        Ok(self.data.lock().unwrap().compatibility_warning.clone())
+    }
+
     async fn inspect(
         &self,
         archive: Arc<[u8]>,
@@ -488,3 +498,20 @@ fn context() -> MutationContext {
 fn store_error(kind: AdminStoreErrorKind) -> AdminStoreError {
     AdminStoreError::new(kind, "plugin", "install fixture")
 }
+
+#[tokio::test]
+async fn installing_an_incompatible_package_keeps_the_default_instance_stopped() {
+    let fixture = Fixture::new(metadata(true), None);
+    fixture.data.lock().unwrap().compatibility_warning = Some("宿主范围不匹配".into());
+    let result = fixture
+        .service()
+        .accept_artifact(DIGEST, &context())
+        .await
+        .unwrap();
+    assert!(!result.configuration_required);
+    let data = fixture.data.lock().unwrap();
+    assert_eq!(data.snapshot.instances.len(), 1);
+    assert!(!data.snapshot.instances[0].enabled);
+    assert!(!data.snapshot.instances[0].bindings.is_empty());
+    assert!(data.artifact.accepted_at.is_some());
+}

backend/crates/gateway-admin/tests/use_case/plugins/instances/mod.rs

@@ -49,6 +49,8 @@ use serde_json::json;
 
 use super::TestPluginPorts;
 
+mod queries;
+
 const OLD_ARTIFACT: &str = "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa";
 const NEW_ARTIFACT: &str = "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb";
 
@@ -61,6 +63,10 @@ enum MigrationBehavior {
 
 #[async_trait]
 impl gateway_admin::ports::plugins::PluginPackageInspector for LifecycleFixture {
+    fn compatibility_host_fingerprint(&self) -> Result<String, AdminError> {
+        Ok("test-host".into())
+    }
+
     fn api_deprecations(
         &self,
         metadata: &PluginArtifactMetadata,
@@ -88,6 +94,11 @@ impl gateway_admin::ports::plugins::PluginPackageInspector for LifecycleFixture
         archive: Arc<[u8]>,
         digest: String,
     ) -> Result<Option<String>, AdminError> {
+        let gate = self.inspection_gate.lock().unwrap().clone();
+        if let Some(gate) = gate.filter(|gate| gate.digest == digest) {
+            gate.started.notify_one();
+            gate.release.notified().await;
+        }
         self.inspect(archive, Some(digest)).await?;
         Ok(self.data.lock().unwrap().compatibility_warning.clone())
     }
@@ -143,11 +154,19 @@ struct LifecycleFixture {
     behavior: MigrationBehavior,
     data: Mutex<FixtureData>,
     next_prepared: AtomicU64,
+    inspection_gate: Mutex<Option<Arc<InspectionGate>>>,
+}
+
+struct InspectionGate {
+    digest: String,
+    started: tokio::sync::Notify,
+    release: tokio::sync::Notify,
 }
 
 impl LifecycleFixture {
     fn new(behavior: MigrationBehavior) -> Arc<Self> {
         Arc::new(Self {
+            inspection_gate: Mutex::new(None),
             behavior,
             data: Mutex::new(FixtureData {
                 snapshot: PluginInstanceSnapshot {
@@ -267,6 +286,22 @@ impl ExtensionSetLease for Lease {
 
 #[async_trait]
 impl PluginPreparation for LifecycleFixture {
+    async fn prepare_confirmed(
+        &self,
+        snapshot: PluginInstanceSnapshot,
+        confirmation: gateway_admin::model::plugins::instances::PluginCompatibilityConfirmation,
+    ) -> Result<ExtensionSetReference, AdminError> {
+        assert_eq!(confirmation.host_fingerprint, "test-host");
+        assert!(
+            snapshot
+                .instances
+                .iter()
+                .any(|instance| instance.id == confirmation.instance_id
+                    && instance.artifact_sha256 == confirmation.artifact_sha256)
+        );
+        self.prepare(snapshot).await
+    }
+
     async fn configuration_ready(
         &self,
         instance: PluginInstance,
@@ -716,6 +751,7 @@ fn rollback_input() -> RollbackPluginInstance {
 
 fn input() -> ConfigurePluginInstance {
     ConfigurePluginInstance {
+        compatibility_confirmation: None,
         replace_instances: Vec::new(),
         creation_id: None,
         expected_revision: None,
@@ -970,49 +1006,6 @@ fn state_unavailable<T>() -> PluginStateStoreResult<T> {
     ))
 }
 
-#[tokio::test]
-async fn instance_list_uses_runtime_diagnostics_and_keeps_running_compatibility_derived() {
-    let fixture = LifecycleFixture::new(MigrationBehavior::Succeed);
-    let expected = PluginInstanceRuntime {
-        status: PluginInstanceRuntimeStatus::PreparationFailed,
-        actual_revision: Some(9),
-        actual_artifact_sha256: Some(OLD_ARTIFACT.into()),
-        failure: Some(PluginInstanceRuntimeFailure {
-            code: "unavailable".into(),
-            message: "插件候选准备失败".into(),
-        }),
-        draining_revisions: vec![8],
-    };
-    fixture.data.lock().unwrap().diagnostics = Some(BTreeMap::from([(
-        "00000000-0000-7000-8000-000000000001".into(),
-        expected.clone(),
-    )]));
-
-    let views = service(fixture, Arc::new(Published::default()))
-        .instances()
-        .await
-        .unwrap();
-    assert_eq!(views.len(), 1);
-    assert!(!views[0].running);
-    assert_eq!(views[0].runtime, expected);
-}
-
-#[tokio::test]
-async fn instance_list_falls_back_without_inventing_runtime_failures() {
-    let fixture = LifecycleFixture::new(MigrationBehavior::Succeed);
-    let views = service(fixture, Arc::new(Published::default()))
-        .instances()
-        .await
-        .unwrap();
-    assert_eq!(views.len(), 1);
-    assert_eq!(
-        views[0].runtime.status,
-        PluginInstanceRuntimeStatus::AwaitingPublication
-    );
-    assert!(!views[0].running);
-    assert!(views[0].runtime.failure.is_none());
-}
-
 #[tokio::test]
 async fn incompatible_state_upgrade_quiesces_migrates_and_promotes_the_target() {
     let fixture = LifecycleFixture::new(MigrationBehavior::Succeed);
@@ -1644,7 +1637,7 @@ async fn transient_compatibility_check_failure_can_be_retried() {
 }
 
 #[tokio::test]
-async fn compatibility_warning_allows_enabling_and_persists_after_success() {
+async fn incompatible_start_requires_confirmation_and_preserves_the_warning() {
     let fixture = LifecycleFixture::new(MigrationBehavior::Succeed);
     {
         let mut data = fixture.data.lock().unwrap();
@@ -1657,6 +1650,21 @@ async fn compatibility_warning_allows_enabling_and_persists_after_success() {
     assert!(view.load_error.is_none());
     let mut request = input();
     request.artifact_sha256 = OLD_ARTIFACT.into();
+    let error = service
+        .configure_instance(Some(&view.instance.id), request, &context())
+        .await
+        .err()
+        .unwrap();
+    assert_eq!(error.kind(), AdminErrorKind::Conflict);
+    assert!(fixture.data.lock().unwrap().saves.is_empty());
+    assert!(fixture.data.lock().unwrap().prepared_snapshots.is_empty());
+    let plan = service
+        .version_plan(&view.instance.id, OLD_ARTIFACT)
+        .await
+        .unwrap();
+    let mut request = input();
+    request.artifact_sha256 = OLD_ARTIFACT.into();
+    request.compatibility_confirmation = plan.compatibility_confirmation;
     let result = service
         .configure_instance(Some(&view.instance.id), request, &context())
         .await
@@ -1667,3 +1675,54 @@ async fn compatibility_warning_allows_enabling_and_persists_after_success() {
     assert!(view.compatibility_warning.is_some());
     assert!(view.load_error.is_none());
 }
+
+#[tokio::test]
+async fn incompatible_start_rejects_stale_confirmations_and_unloadable_packages() {
+    for mismatch in ["host", "instance", "revision", "artifact", "unloadable"] {
+        let fixture = LifecycleFixture::new(MigrationBehavior::Succeed);
+        {
+            let mut data = fixture.data.lock().unwrap();
+            data.snapshot.instances[0].enabled = false;
+            data.compatibility_warning = Some("middleware v2 未声明兼容".into());
+            if mismatch == "unloadable" {
+                data.inspection_error = Some(AdminErrorKind::Invalid);
+            }
+        }
+        let service = service(fixture.clone(), Arc::new(Published::default()));
+        let previous = fixture.data.lock().unwrap().snapshot.instances[0].clone();
+        let mut confirmation =
+            gateway_admin::model::plugins::instances::PluginCompatibilityConfirmation {
+                host_fingerprint: "test-host".into(),
+                instance_id: previous.id.clone(),
+                instance_revision: previous.revision.get(),
+                artifact_sha256: OLD_ARTIFACT.into(),
+            };
+        match mismatch {
+            "host" => confirmation.host_fingerprint = "another-host".into(),
+            "instance" => confirmation.instance_id = "another-instance".into(),
+            "revision" => confirmation.instance_revision += 1,
+            "artifact" => confirmation.artifact_sha256 = NEW_ARTIFACT.into(),
+            _ => {}
+        }
+        let mut request = input();
+        request.artifact_sha256 = OLD_ARTIFACT.into();
+        request.compatibility_confirmation = Some(confirmation);
+        let error = service
+            .configure_instance(Some(&previous.id), request, &context())
+            .await
+            .err()
+            .unwrap();
+        assert_eq!(
+            error.kind(),
+            if mismatch == "unloadable" {
+                AdminErrorKind::Invalid
+            } else {
+                AdminErrorKind::Conflict
+            }
+        );
+        let data = fixture.data.lock().unwrap();
+        assert!(data.saves.is_empty(), "{mismatch}");
+        assert!(data.prepared_snapshots.is_empty(), "{mismatch}");
+        assert!(!data.snapshot.instances[0].enabled);
+    }
+}

backend/crates/gateway-admin/tests/use_case/plugins/instances/queries.rs

@@ -0,0 +1,151 @@
+//! 实例运行诊断与包检查缓存的查询回归测试
+
+use super::*;
+use gateway_admin::model::plugins::instances::PluginInstanceRuntimeLoad;
+
+#[tokio::test]
+async fn instance_list_uses_runtime_diagnostics_and_keeps_running_compatibility_derived() {
+    let fixture = LifecycleFixture::new(MigrationBehavior::Succeed);
+    let expected = PluginInstanceRuntime {
+        status: PluginInstanceRuntimeStatus::PreparationFailed,
+        actual_revision: Some(9),
+        actual_artifact_sha256: Some(OLD_ARTIFACT.into()),
+        failure: Some(PluginInstanceRuntimeFailure {
+            code: "unavailable".into(),
+            message: "插件候选准备失败".into(),
+        }),
+        draining_revisions: vec![8],
+        load: Some(PluginInstanceRuntimeLoad {
+            active_calls: 3,
+            executing_calls: 1,
+            queued_calls: 1,
+            resuming_calls: 1,
+            pending_callbacks: 2,
+            active_streams: 0,
+        }),
+    };
+    fixture.data.lock().unwrap().diagnostics = Some(BTreeMap::from([(
+        "00000000-0000-7000-8000-000000000001".into(),
+        expected.clone(),
+    )]));
+
+    let views = service(fixture, Arc::new(Published::default()))
+        .instances()
+        .await
+        .unwrap();
+    assert_eq!(views.len(), 1);
+    assert!(!views[0].running);
+    assert_eq!(views[0].runtime, expected);
+}
+
+#[tokio::test]
+async fn instance_list_falls_back_without_inventing_runtime_failures() {
+    let fixture = LifecycleFixture::new(MigrationBehavior::Succeed);
+    let views = service(fixture, Arc::new(Published::default()))
+        .instances()
+        .await
+        .unwrap();
+    assert_eq!(views.len(), 1);
+    assert_eq!(
+        views[0].runtime.status,
+        PluginInstanceRuntimeStatus::Unknown
+    );
+    assert!(!views[0].running);
+    assert!(views[0].runtime.failure.is_none());
+    assert!(views[0].runtime.actual_revision.is_none());
+    assert!(views[0].runtime.load.is_none());
+}
+
+#[tokio::test]
+async fn disabled_instance_without_runtime_diagnostics_has_a_known_disabled_status() {
+    let fixture = LifecycleFixture::new(MigrationBehavior::Succeed);
+    fixture.data.lock().unwrap().snapshot.instances[0].enabled = false;
+    let views = service(fixture, Arc::new(Published::default()))
+        .instances()
+        .await
+        .unwrap();
+    assert_eq!(
+        views[0].runtime.status,
+        PluginInstanceRuntimeStatus::Disabled
+    );
+    assert!(!views[0].running);
+    assert!(views[0].runtime.failure.is_none());
+    assert!(views[0].runtime.load.is_none());
+}
+
+#[tokio::test]
+async fn matching_publication_without_process_diagnostics_does_not_imply_running() {
+    for diagnostics in [None, Some(BTreeMap::new())] {
+        let fixture = LifecycleFixture::new(MigrationBehavior::Succeed);
+        fixture.data.lock().unwrap().diagnostics = diagnostics;
+        let revision = fixture.snapshot().config_revision.get();
+        let published = RuntimeSnapshotHandle::new(
+            gateway_core::routing::RuntimeSnapshot::new(
+                ConfigRevision::new(revision).unwrap(),
+                gateway_core::settings::SettingsValues::new(
+                    1,
+                    "round_robin",
+                    BTreeMap::new(),
+                    None,
+                    None,
+                ),
+                Vec::new(),
+                Vec::new(),
+                Vec::new(),
+            )
+            .unwrap(),
+        );
+        let service = PluginsService::new(
+            fixture.clone(),
+            fixture.clone(),
+            PluginDistributionPorts::new(Arc::new(TestPluginPorts), Arc::new(TestPluginPorts)),
+            Arc::new(Published::default()),
+            fixture.clone(),
+            published,
+            fixture,
+        );
+        let view = service.instances().await.unwrap().remove(0);
+        assert_eq!(view.published_revision, Some(revision));
+        assert_eq!(view.runtime.status, PluginInstanceRuntimeStatus::Unknown);
+        assert!(!view.running);
+        assert!(view.runtime.actual_revision.is_none());
+        assert!(view.runtime.actual_artifact_sha256.is_none());
+        assert!(view.runtime.failure.is_none());
+    }
+}
+
+#[tokio::test]
+async fn cached_package_query_is_not_blocked_by_another_package_inspection() {
+    let fixture = LifecycleFixture::new(MigrationBehavior::Succeed);
+    let service = Arc::new(service(fixture.clone(), Arc::new(Published::default())));
+    service.instances().await.unwrap();
+    let gate = Arc::new(InspectionGate {
+        digest: NEW_ARTIFACT.into(),
+        started: tokio::sync::Notify::new(),
+        release: tokio::sync::Notify::new(),
+    });
+    *fixture.inspection_gate.lock().unwrap() = Some(gate.clone());
+    fixture.data.lock().unwrap().snapshot.instances[0].artifact_sha256 = NEW_ARTIFACT.into();
+    let inspecting = {
+        let service = service.clone();
+        tokio::spawn(async move { service.instances().await })
+    };
+    tokio::time::timeout(std::time::Duration::from_secs(1), gate.started.notified())
+        .await
+        .expect("another package inspection started");
+
+    fixture.data.lock().unwrap().snapshot.instances[0].artifact_sha256 = OLD_ARTIFACT.into();
+    let cached =
+        tokio::time::timeout(std::time::Duration::from_millis(100), service.instances()).await;
+    gate.release.notify_one();
+    inspecting.await.unwrap().unwrap();
+    assert_eq!(
+        cached
+            .expect("cached query must not wait for inspection")
+            .unwrap()[0]
+            .instance
+            .artifact_sha256,
+        OLD_ARTIFACT
+    );
+    assert_eq!(fixture.data.lock().unwrap().archive_reads, 2);
+}

backend/crates/gateway-api/Cargo.toml

@@ -37,7 +37,7 @@ tower-http = { version = "0.7.0", features = ["compression-gzip", "cors", "fs",
 tracing = "0.1.44"
 url = "2.5.8"
 uuid = { version = "1.23.3", features = ["v7"] }
-zstd = "=0.13.3"
+zstd = "=0.14.3"
 zip = { version = "9.0.4", default-features = false, features = ["deflate-flate2"] }
 
 [dev-dependencies]

backend/crates/gateway-api/src/admin/observability/export/archive.rs

@@ -28,13 +28,12 @@ pub(super) fn build(document: &Value) -> io::Result<Vec<u8>> {
         let detail = &evidence["detail"]["request"];
         writeln!(
             archive,
-            "\n结果：{}；状态码：{}；尝试数：{}\n模型：请求={}，发送={}，上游报告={}\n传输：{} → {}\n时延：{}",
+            "\n结果：{}；状态码：{}；尝试数：{}\n模型：请求={}，发送={}\n传输：{} → {}\n时延：{}",
             detail["logicalOutcome"],
             detail["statusCode"],
             detail["attemptCount"],
             detail["requestedModel"],
             detail["upstreamModel"],
-            detail["upstreamResponseModel"],
             detail["clientTransport"],
             detail["upstreamTransport"],
             detail["latencyDetails"]

backend/crates/gateway-api/src/admin/observability/presenter.rs

@@ -279,7 +279,6 @@ pub(crate) fn usage_list_record_view(
         model,
         requested_model: record.requested_model_id,
         upstream_model: record.upstream_model_id,
-        upstream_response_model: record.upstream_response_model,
         service_tier: record.service_tier,
         client_transport: record.client_transport,
         upstream_transport: record.upstream_transport,
@@ -377,7 +376,6 @@ pub(crate) fn usage_record_view(
         model,
         requested_model: record.requested_model_id,
         upstream_model: record.upstream_model_id,
-        upstream_response_model: record.upstream_response_model,
         service_tier: record.service_tier,
         status_code,
         client_transport: record.client_transport,

backend/crates/gateway-api/src/admin/observability/wire.rs

@@ -103,7 +103,6 @@ pub struct UsageListRecordView {
     pub model: Option<String>,
     pub requested_model: Option<String>,
     pub upstream_model: Option<String>,
-    pub upstream_response_model: Option<String>,
     pub service_tier: Option<String>,
     pub client_transport: String,
     pub upstream_transport: Option<String>,
@@ -142,7 +141,6 @@ pub struct UsageRecordView {
     pub model: Option<String>,
     pub requested_model: Option<String>,
     pub upstream_model: Option<String>,
-    pub upstream_response_model: Option<String>,
     pub service_tier: Option<String>,
     pub status_code: Option<i64>,
     pub client_transport: String,

backend/crates/gateway-api/src/admin/plugins/instances.rs

@@ -9,8 +9,8 @@ use axum::{
 };
 use gateway_admin::model::plugins::instances::{
     ConfigurePluginInstance, PluginCapabilityBinding, PluginInstance, PluginInstanceRuntime,
-    PluginInstanceRuntimeFailure, PluginInstanceRuntimeStatus, PluginInstanceView,
-    RollbackPluginInstance,
+    PluginInstanceRuntimeFailure, PluginInstanceRuntimeLoad, PluginInstanceRuntimeStatus,
+    PluginInstanceView, RollbackPluginInstance,
 };
 use serde::{Deserialize, Serialize};
 
@@ -70,6 +70,7 @@ struct InstanceView {
 #[serde(rename_all = "snake_case")]
 enum InstanceRuntimeStatus {
     Disabled,
+    Unknown,
     AwaitingPublication,
     Preparing,
     Running,
@@ -83,6 +84,7 @@ impl From<PluginInstanceRuntimeStatus> for InstanceRuntimeStatus {
     fn from(value: PluginInstanceRuntimeStatus) -> Self {
         match value {
             PluginInstanceRuntimeStatus::Disabled => Self::Disabled,
+            PluginInstanceRuntimeStatus::Unknown => Self::Unknown,
             PluginInstanceRuntimeStatus::AwaitingPublication => Self::AwaitingPublication,
             PluginInstanceRuntimeStatus::Preparing => Self::Preparing,
             PluginInstanceRuntimeStatus::Running => Self::Running,
@@ -118,6 +120,31 @@ struct InstanceRuntimeView {
     actual_artifact_sha256: Option<String>,
     failure: Option<InstanceRuntimeFailure>,
     draining_revisions: Vec<u64>,
+    load: Option<InstanceRuntimeLoad>,
+}
+
+#[derive(Serialize)]
+#[serde(rename_all = "camelCase")]
+struct InstanceRuntimeLoad {
+    active_calls: usize,
+    executing_calls: usize,
+    queued_calls: usize,
+    resuming_calls: usize,
+    pending_callbacks: usize,
+    active_streams: usize,
+}
+
+impl From<PluginInstanceRuntimeLoad> for InstanceRuntimeLoad {
+    fn from(value: PluginInstanceRuntimeLoad) -> Self {
+        Self {
+            active_calls: value.active_calls,
+            executing_calls: value.executing_calls,
+            queued_calls: value.queued_calls,
+            resuming_calls: value.resuming_calls,
+            pending_callbacks: value.pending_callbacks,
+            active_streams: value.active_streams,
+        }
+    }
 }
 
 impl From<PluginInstanceRuntime> for InstanceRuntimeView {
@@ -128,6 +155,7 @@ impl From<PluginInstanceRuntime> for InstanceRuntimeView {
             actual_artifact_sha256: value.actual_artifact_sha256,
             failure: value.failure.map(Into::into),
             draining_revisions: value.draining_revisions,
+            load: value.load.map(Into::into),
         }
     }
 }

backend/crates/gateway-api/src/openai/responses/http.rs

@@ -891,7 +891,7 @@ impl StreamingExecutionBody {
                 }
                 continue;
             }
-            // 已提交的流在确认 Core 终结后才交付成功终态，不能先输出 completed 再报结算失败
+            // 已提交的流先确认 Core 终结，避免后续 EOF 验证推翻已交付的成功终态
             if self.awaiting_terminal_eof && self.committed {
                 self.verify_terminal_eof().await?;
                 encoded.push_back(done_frame());

backend/crates/gateway-api/src/openai/responses/websocket/connection/handle.rs

@@ -5,7 +5,7 @@ use super::{
     pump::run_pump,
     state::{ConnectionCommand, ConnectionStats},
 };
-use axum::extract::ws::{CloseFrame, Message, WebSocket, close_code};
+use axum::extract::ws::{CloseFrame, Message, Utf8Bytes, WebSocket, close_code};
 use futures::{Sink, Stream};
 use gateway_core::{
     engine::middleware::{FrozenMiddlewarePlan, MiddlewareHeader},
@@ -142,7 +142,7 @@ impl ResponsesWebSocketConnection {
     /// pump 已关闭、写入超时或 transport 失败时返回稳定错误
     pub async fn send_text(
         &mut self,
-        payload: String,
+        payload: impl Into<Utf8Bytes>,
         context: WriteContext,
     ) -> Result<WriteOutcome, ConnectionWriteError> {
         self.send(Message::Text(payload.into()), context).await

backend/crates/gateway-api/src/openai/responses/websocket/forward.rs

@@ -3,7 +3,7 @@
 use std::collections::VecDeque;
 use std::sync::{Arc, Mutex};
 
-use axum::http::StatusCode;
+use axum::{extract::ws::Utf8Bytes, http::StatusCode};
 use bytes::Bytes;
 use futures::future::BoxFuture;
 use gateway_core::engine::CommitRequirement;
@@ -268,7 +268,7 @@ pub(super) async fn forward_response(
             return fail_body(connection, body, MiddlewareError::InvalidState, &request_id).await;
         }
         let terminal = frame.terminal();
-        let Ok(message) = String::from_utf8(frame.into_bytes().to_vec()) else {
+        let Ok(message) = Utf8Bytes::try_from(frame.into_bytes()) else {
             return fail_body(connection, body, MiddlewareError::InvalidState, &request_id).await;
         };
         let phase = match (first_frame_written, terminal) {

backend/crates/gateway-api/tests/admin/observability/response.rs

@@ -764,7 +764,6 @@ pub(super) fn usage_record_with_account(
         upstream_transport: Some("http_sse".to_owned()),
         http_version: Some("h2".to_owned()),
         websocket_pool: None,
-        upstream_response_model: None,
         service_tier: None,
         provider_metadata_json: None,
         attempt_count: 1,
@@ -909,7 +908,6 @@ async fn usage_route_should_expose_table_facts_without_detail_payload() {
             provider_account_authentication_kind: Some("oauth".to_owned()),
             upstream_model_id: Some("grok-4.5".to_owned()),
             upstream_transport: Some("http_sse".to_owned()),
-            upstream_response_model: Some("grok-4.6-build".to_owned()),
             service_tier: Some("default".to_owned()),
             input_tokens: Some(1),
             output_tokens: Some(1),
@@ -1059,7 +1057,6 @@ async fn usage_route_should_expose_table_facts_without_detail_payload() {
             "imageOutputTokens": value["data"]["items"][0]["tokenDetails"]["imageOutputTokens"],
             "requestedModel": value["data"]["items"][0]["requestedModel"],
             "upstreamModel": value["data"]["items"][0]["upstreamModel"],
-            "upstreamResponseModel": value["data"]["items"][0]["upstreamResponseModel"],
             "reasoningEffort": value["data"]["items"][0]["reasoningEffort"],
             "reasoningPreset": value["data"]["items"][0]["reasoningPreset"],
             "subagentKind": value["data"]["items"][0]["subagentKind"],
@@ -1083,7 +1080,6 @@ async fn usage_route_should_expose_table_facts_without_detail_payload() {
             "imageOutputTokens": 9,
             "requestedModel": "grok-4.5",
             "upstreamModel": "grok-4.5",
-            "upstreamResponseModel": "grok-4.6-build",
             "reasoningEffort": "max",
             "reasoningPreset": "ultra",
             "subagentKind": "worker",

backend/crates/gateway-api/tests/admin/plugins/mod.rs

@@ -322,6 +322,17 @@ async fn instance_list_serializes_safe_runtime_diagnostics() {
     assert_eq!(instance["running"], false);
     assert_eq!(instance["runtime"]["status"], "preparation_failed");
     assert_eq!(instance["runtime"]["actualRevision"], 6);
+    assert_eq!(
+        instance["runtime"]["load"],
+        serde_json::json!({
+            "activeCalls": 3,
+            "executingCalls": 1,
+            "queuedCalls": 1,
+            "resumingCalls": 1,
+            "pendingCallbacks": 2,
+            "activeStreams": 0,
+        })
+    );
     assert_eq!(
         instance["runtime"]["drainingRevisions"],
         serde_json::json!([5])
@@ -665,6 +676,14 @@ impl gateway_admin::ports::plugins::PluginRuntimeDiagnostics for TestPluginPorts
                                 message: "插件候选准备失败".into(),
                             }),
                             draining_revisions: vec![5],
+                            load: Some(gateway_admin::model::plugins::instances::PluginInstanceRuntimeLoad {
+                                active_calls: 3,
+                                executing_calls: 1,
+                                queued_calls: 1,
+                                resuming_calls: 1,
+                                pending_callbacks: 2,
+                                active_streams: 0,
+                            }),
                         },
                     )
                 })

backend/crates/gateway-api/tests/key_usage/fixtures.rs

@@ -110,7 +110,6 @@ fn usage_record() -> UsageListRecord {
         provider_account_authentication_kind: Some("private-sentinel".to_owned()),
         upstream_model_id: Some("private-sentinel".to_owned()),
         upstream_transport: Some("websocket".to_owned()),
-        upstream_response_model: Some("private-sentinel".to_owned()),
         service_tier: Some("private-sentinel".to_owned()),
         input_tokens: Some(1000),
         output_tokens: Some(100),

backend/crates/gateway-api/tests/openai/responses/http.rs

@@ -2164,109 +2164,132 @@ async fn streaming_upstream_wire_failure_should_not_be_rewritten_as_a_gateway_er
 
 #[tokio::test]
 async fn streaming_upstream_error_event_should_be_translated_to_response_failed_for_sse() {
-    let trace = Arc::new(Trace::default());
-    let error_data = json!({
-        "type": "error",
-        "error": {
-            "type": "service_unavailable_error",
-            "code": "server_is_overloaded",
-            "message": "Our servers are currently overloaded. Please try again later.",
-            "param": null,
-            "future_error_field": {"keep": true}
-        },
-        "sequence_number": 2,
-        "future_event_field": {"keep": true}
-    });
-    let projected_error_frame = Bytes::from(encode_sse_event("error", &error_data.to_string()));
-    let error_wire = ProviderEvent::wire(
-        ProtocolWireEvent::json_with_raw_sse_metadata(
-            "openai",
-            Some("error".to_owned()),
-            error_data,
-            projected_error_frame,
-            None,
-            None,
-        )
-        .expect("valid upstream error wire"),
-    );
-    let started_wire = ProviderEvent::canonical_with_wire(
-        vec![started()],
-        ProtocolWireEvent::json(
-            "openai",
-            Some("response.created".to_owned()),
-            json!({
-                "type": "response.created",
-                "response": {
-                    "id": "resp_test",
-                    "model": "public-model",
-                    "status": "in_progress",
-                    "future_response_field": {"keep": true}
-                }
-            }),
-        )
-        .expect("valid upstream started wire"),
-    );
-    let session = FakeSession::streaming(
-        Arc::clone(&trace),
-        vec![
-            NextStep::Event(CoordinatedEvent::single(
-                started_wire,
-                CommitRequirement::CommitBeforeDelivery,
-            )),
-            NextStep::Event(CoordinatedEvent::single(
-                error_wire,
-                CommitRequirement::AlreadyCommitted,
-            )),
-            NextStep::Error(EngineError::Provider(ProviderError::new(
-                ProviderErrorKind::UpstreamCapacityUnavailable,
-                UpstreamSendState::Sent,
-            ))),
-        ],
-    );
-
-    let response = stream_execution_response(Box::new(session), None).await;
-    let body = to_bytes(response.into_body(), usize::MAX)
-        .await
-        .expect("read SSE body");
-    let body = String::from_utf8(body.to_vec()).expect("SSE is UTF-8");
-    let events = parse_sse_events(&body).expect("translated SSE should parse");
-    let failed = events
-        .iter()
-        .find(|event| event.event.as_deref() == Some("response.failed"))
-        .expect("translated response.failed event");
-    let failed: Value = serde_json::from_str(&failed.data).expect("response.failed JSON");
-
-    assert_eq!(
+    for (error_type, code, client_code, kind, client_status) in [
         (
-            failed,
-            body.matches("event: response.failed").count(),
-            body.contains("event: error\n"),
-            body.ends_with("data: [DONE]\n\n"),
+            "service_unavailable_error",
+            "server_is_overloaded",
+            "server_error",
+            ProviderErrorKind::UpstreamCapacityUnavailable,
+            503,
         ),
         (
-            json!({
-                "type": "response.failed",
-                "response": {
-                    "id": "resp_test",
-                    "model": "public-model",
-                    "status": "failed",
-                    "error": {
-                        "type": "service_unavailable_error",
-                        "code": "server_error",
-                        "message": "Our servers are currently overloaded. Please try again later.",
-                        "param": null,
-                        "future_error_field": {"keep": true}
+            "rate_limit_error",
+            "turn_rate_limit_exceeded",
+            "turn_rate_limit_exceeded",
+            ProviderErrorKind::RateLimited,
+            429,
+        ),
+    ] {
+        let trace = Arc::new(Trace::default());
+        let error_data = json!({
+            "type": "error",
+            "status": 429,
+            "headers": {"Retry-After": "24"},
+            "error": {
+                "type": error_type,
+                "code": code,
+                "message": "Our servers are currently overloaded. Please try again later.",
+                "param": null,
+                "future_error_field": {"keep": true}
+            },
+            "sequence_number": 2,
+            "future_event_field": {"keep": true}
+        });
+        let projected_error_frame = Bytes::from(encode_sse_event("error", &error_data.to_string()));
+        let error_wire = ProviderEvent::wire(
+            ProtocolWireEvent::json_with_raw_sse_metadata(
+                "openai",
+                Some("error".to_owned()),
+                error_data,
+                projected_error_frame,
+                None,
+                None,
+            )
+            .expect("valid upstream error wire"),
+        );
+        let started_wire = ProviderEvent::canonical_with_wire(
+            vec![started()],
+            ProtocolWireEvent::json(
+                "openai",
+                Some("response.created".to_owned()),
+                json!({
+                    "type": "response.created",
+                    "response": {
+                        "id": "resp_test",
+                        "model": "public-model",
+                        "status": "in_progress",
+                        "future_response_field": {"keep": true}
+                    }
+                }),
+            )
+            .expect("valid upstream started wire"),
+        );
+        let session = FakeSession::streaming(
+            Arc::clone(&trace),
+            vec![
+                NextStep::Event(CoordinatedEvent::single(
+                    started_wire,
+                    CommitRequirement::CommitBeforeDelivery,
+                )),
+                NextStep::Event(CoordinatedEvent::single(
+                    error_wire,
+                    CommitRequirement::AlreadyCommitted,
+                )),
+                NextStep::Error(EngineError::Provider(ProviderError::new(
+                    kind,
+                    UpstreamSendState::Sent,
+                ))),
+            ],
+        );
+
+        let response = stream_execution_response(Box::new(session), None).await;
+        assert_eq!(response.status(), StatusCode::OK);
+        let body = to_bytes(response.into_body(), usize::MAX)
+            .await
+            .expect("read SSE body");
+        let body = String::from_utf8(body.to_vec()).expect("SSE is UTF-8");
+        let events = parse_sse_events(&body).expect("translated SSE should parse");
+        let failed = events
+            .iter()
+            .find(|event| event.event.as_deref() == Some("response.failed"))
+            .expect("translated response.failed event");
+        let failed: Value = serde_json::from_str(&failed.data).expect("response.failed JSON");
+
+        assert_eq!(
+            (
+                failed,
+                body.matches("event: response.failed").count(),
+                body.contains("event: error\n"),
+                body.ends_with("data: [DONE]\n\n"),
+            ),
+            (
+                json!({
+                    "type": "response.failed",
+                    "status": client_status,
+                    "headers": {"Retry-After": "24"},
+                    "response": {
+                        "id": "resp_test",
+                        "model": "public-model",
+                        "status": "failed",
+                        "error": {
+                            "type": error_type,
+                            "code": client_code,
+                            "message": "Our servers are currently overloaded. Please try again later.",
+                            "param": null,
+                            "future_error_field": {"keep": true},
+                            "headers": {"retry-after": "24"}
+                        },
+                        "future_response_field": {"keep": true}
                     },
-                    "future_response_field": {"keep": true}
-                },
-                "sequence_number": 2,
-                "future_event_field": {"keep": true}
-            }),
-            1,
-            false,
-            true,
-        )
-    );
+                    "sequence_number": 2,
+                    "future_event_field": {"keep": true}
+                }),
+                1,
+                false,
+                true,
+            )
+        );
+    }
 }
 
 #[tokio::test]

backend/crates/gateway-api/tests/openai/responses/mod.rs

@@ -948,8 +948,8 @@ fn transparent_encoder_should_translate_error_wire_to_response_failed_for_websoc
         json!({
             "type": "error",
             "status": 429,
-            "headers": {"x-request-id": "req_raw"},
-            "error": {"type": "custom_type", "code": "custom_code", "message": "raw marker"},
+            "headers": {"x-request-id": "req_raw", "Retry-After": "24"},
+            "error": {"type": "rate_limit_error", "code": "turn_rate_limit_exceeded", "message": "raw marker"},
             "future": {"keep": true}
         }),
     );

backend/crates/gateway-core/src/diagnostics/mod.rs

@@ -9,4 +9,4 @@ mod trace;
 pub use capture::{body_fingerprint, diagnostic_headers, diagnostic_json, json_fingerprint};
 pub use failure::{OperationalDiagnostics, OperationalFailure};
 pub use stream::{StreamCapture, StreamFormat};
-pub use trace::TraceContext;
+pub use trace::{MAX_TRACE_SNAPSHOT_BYTES, TraceContext};

backend/crates/gateway-core/src/diagnostics/trace.rs

@@ -15,13 +15,16 @@ use crate::error::ProviderError;
 use super::capture::{bounded, diagnostic_event_json, diagnostic_event_type};
 use super::{body_fingerprint, diagnostic_headers};
 
+/// 完整诊断快照的编码上限，生产者与持久化适配器共用
+pub const MAX_TRACE_SNAPSHOT_BYTES: usize = 128 * 1024;
+
 const MAX_EVENTS: usize = 128;
 const HEAD_EVENTS: usize = 8;
 const MAX_DATA_BYTES: usize = 4096;
-const MAX_BUFFER_BYTES: usize = 64 * 1024;
+const MAX_BUFFER_BYTES: usize = MAX_TRACE_SNAPSHOT_BYTES / 2;
 const MAX_EVIDENCE_EVENTS: usize = 64;
 const MAX_EVIDENCE_DATA_BYTES: usize = 16 * 1024;
-const MAX_EVIDENCE_BUFFER_BYTES: usize = 64 * 1024;
+const MAX_EVIDENCE_BUFFER_BYTES: usize = MAX_TRACE_SNAPSHOT_BYTES / 2;
 
 /// 显式传给异步任务的关联上下文；默认值禁用捕获，避免全局请求映射
 #[derive(Clone, Default)]
@@ -284,27 +287,22 @@ impl TraceContext {
     /// 与请求终态原子持久化；旧记录没有此字段，不伪造历史时间线
     #[must_use]
     pub fn snapshot(&self) -> Option<Value> {
-        let state = self
+        let mut state = self
             .state
             .as_ref()?
             .lock()
             .unwrap_or_else(std::sync::PoisonError::into_inner);
-        Some(json!({
-            "schemaVersion": 3, "requestId": state.request_id,
-            "startedAtUnixMs": state.started_at_ms, "totalEvents": state.sequence,
-            "droppedEvents": state.dropped_events, "maxEvents": MAX_EVENTS,
-            "captureMode": "sanitized", "events": state.events,
-            "wireDumpEnabled": tracing::enabled!(target: "request_dump", tracing::Level::INFO),
-            "wireFrames": state.wire_frames, "wireBytes": state.wire_bytes,
-            "maxBufferBytes": MAX_BUFFER_BYTES + MAX_EVIDENCE_BUFFER_BYTES, "headEvents": HEAD_EVENTS,
-            "maxEvidenceEvents": MAX_EVIDENCE_EVENTS,
-            "maxEvidenceDataBytes": MAX_EVIDENCE_DATA_BYTES,
-            "maxEvidenceBufferBytes": MAX_EVIDENCE_BUFFER_BYTES,
-            "droppedEvidenceEvents": state.dropped_evidence_events,
-            "stageCounts": state.stage_counts,
-            "stageCountOverflow": state.stage_count_overflow,
-            "snapshotBoundary": "execution_finalization",
-        }))
+        loop {
+            let snapshot = state.snapshot();
+            if snapshot.to_string().len() <= MAX_TRACE_SNAPSHOT_BYTES {
+                return Some(snapshot);
+            }
+            // 完整编码还包含计数与外层字段，超限时先淘汰普通事件并保留丢弃计数
+            // 元数据本身无法容纳时省略诊断，不能让辅助观测阻断请求终态写入
+            let index =
+                regular_eviction_index(&state).or_else(|| evidence_eviction_index(&state))?;
+            remove_event(&mut state, index);
+        }
     }
 
     fn push(&self, stage: &'static str, data: Value, coalesce: bool) {
@@ -439,26 +437,14 @@ impl TraceContext {
             if state.evidence_bytes > MAX_EVIDENCE_BUFFER_BYTES
                 || state.evidence_events > MAX_EVIDENCE_EVENTS
             {
-                if let Some(index) = state
-                    .events
-                    .iter()
-                    .position(|event| event.evidence && event.stage != "request.routed")
-                    .or_else(|| state.events.iter().position(|event| event.evidence))
-                {
+                if let Some(index) = evidence_eviction_index(&state) {
                     remove_event(&mut state, index);
                 }
                 continue;
             }
             // 相比流中间的常规事件，优先保留失败与重试决策
             // 关键事实使用独立预算，只有自身超限才会淘汰
-            let index = (HEAD_EVENTS..state.events.len().saturating_sub(8))
-                .find(|index| !state.events[*index].evidence)
-                .or_else(|| {
-                    (HEAD_EVENTS..state.events.len())
-                        .chain(0..HEAD_EVENTS.min(state.events.len()))
-                        .find(|index| !state.events[*index].evidence)
-                });
-            if let Some(index) = index {
+            if let Some(index) = regular_eviction_index(&state) {
                 remove_event(&mut state, index);
             } else {
                 break;
@@ -467,6 +453,45 @@ impl TraceContext {
     }
 }
 
+impl TraceState {
+    fn snapshot(&self) -> Value {
+        json!({
+            "schemaVersion": 3, "requestId": self.request_id,
+            "startedAtUnixMs": self.started_at_ms, "totalEvents": self.sequence,
+            "droppedEvents": self.dropped_events, "maxEvents": MAX_EVENTS,
+            "captureMode": "sanitized", "events": self.events,
+            "wireDumpEnabled": tracing::enabled!(target: "request_dump", tracing::Level::INFO),
+            "wireFrames": self.wire_frames, "wireBytes": self.wire_bytes,
+            "maxBufferBytes": MAX_BUFFER_BYTES + MAX_EVIDENCE_BUFFER_BYTES, "headEvents": HEAD_EVENTS,
+            "maxEvidenceEvents": MAX_EVIDENCE_EVENTS,
+            "maxEvidenceDataBytes": MAX_EVIDENCE_DATA_BYTES,
+            "maxEvidenceBufferBytes": MAX_EVIDENCE_BUFFER_BYTES,
+            "droppedEvidenceEvents": self.dropped_evidence_events,
+            "stageCounts": self.stage_counts,
+            "stageCountOverflow": self.stage_count_overflow,
+            "snapshotBoundary": "execution_finalization",
+        })
+    }
+}
+
+fn regular_eviction_index(state: &TraceState) -> Option<usize> {
+    (HEAD_EVENTS..state.events.len().saturating_sub(8))
+        .find(|index| !state.events[*index].evidence)
+        .or_else(|| {
+            (HEAD_EVENTS..state.events.len())
+                .chain(0..HEAD_EVENTS.min(state.events.len()))
+                .find(|index| !state.events[*index].evidence)
+        })
+}
+
+fn evidence_eviction_index(state: &TraceState) -> Option<usize> {
+    state
+        .events
+        .iter()
+        .position(|event| event.evidence && event.stage != "request.routed")
+        .or_else(|| state.events.iter().position(|event| event.evidence))
+}
+
 fn remove_event(state: &mut TraceState, index: usize) {
     if let Some(event) = state.events.remove(index) {
         state.bytes = state.bytes.saturating_sub(event.bytes);

backend/crates/gateway-core/src/engine/authentication.rs

@@ -9,15 +9,38 @@ use std::{
 use futures::future::BoxFuture;
 
 use crate::{
+    error::GatewayError,
     policy::{ClientApiKeyId, PlaintextClientApiKey},
-    routing::extensions::{ExtensionSetId, ExtensionSetReference},
+    routing::{
+        extensions::{ExtensionSetId, ExtensionSetReference},
+        request_settings::RequestSettings,
+    },
 };
 
+use super::execution::AuthenticatedClient;
+
+/// 身份解析与认证只返回冻结权限，不提供模型执行入口
+pub trait ClientIdentityPort: Send + Sync {
+    /// 只解析身份与冻结权限，不建立模型执行图或记录使用事实
+    fn resolve_client(
+        &self,
+        client_key_id: ClientApiKeyId,
+        settings: Option<RequestSettings>,
+    ) -> BoxFuture<'_, Result<AuthenticatedClient, GatewayError>>;
+
+    /// 复用入口认证计划及 principal 映射，不进行模型准入
+    fn verify_client(
+        &self,
+        request: ClientAuthenticationRequest,
+    ) -> BoxFuture<'_, Result<AuthenticatedClient, GatewayError>>;
+}
+
 pub const MAXIMUM_AUTHORIZATION_BYTES: usize = 8 * 1024;
 
 /// API 从数据面 Authorization 头构造的有界认证信封
-#[derive(Clone, PartialEq, Eq)]
+#[derive(Clone)]
 pub struct ClientAuthenticationRequest {
+    invocation: Option<Arc<super::extensions::InvocationOrigin>>,
     request_context: Option<Arc<super::extensions::RequestContext>>,
     settings: Option<crate::routing::request_settings::RequestSettings>,
     authorization: Arc<str>,
@@ -25,6 +48,18 @@ pub struct ClientAuthenticationRequest {
 }
 
 impl ClientAuthenticationRequest {
+    /// 子认证继承受信调用的来源、取消和副作用归属，不据此跳过认证器
+    #[must_use]
+    pub fn with_invocation(mut self, origin: super::extensions::InvocationOrigin) -> Self {
+        self.invocation = Some(Arc::new(origin));
+        self
+    }
+
+    #[must_use]
+    pub fn invocation(&self) -> Option<&super::extensions::InvocationOrigin> {
+        self.invocation.as_deref()
+    }
+
     #[must_use]
     pub fn with_request_context(
         mut self,
@@ -35,12 +70,18 @@ impl ClientAuthenticationRequest {
     }
     #[must_use]
     pub fn request_context(&self) -> Option<&super::extensions::RequestContext> {
-        self.request_context.as_deref()
+        self.invocation
+            .as_ref()
+            .and_then(|origin| origin.extensions.request())
+            .or(self.request_context.as_deref())
     }
 
     #[must_use]
     pub fn shared_request_context(&self) -> Option<Arc<super::extensions::RequestContext>> {
-        self.request_context.clone()
+        self.invocation
+            .as_ref()
+            .and_then(|origin| origin.extensions.shared_request())
+            .or_else(|| self.request_context.clone())
     }
 
     #[must_use]
@@ -79,6 +120,7 @@ impl ClientAuthenticationRequest {
             .filter(|value| !value.is_empty())
             .and_then(|value| PlaintextClientApiKey::new(value.to_owned()).ok());
         Ok(Self {
+            invocation: None,
             settings: None,
             request_context: None,
             authorization: authorization.into(),

backend/crates/gateway-core/src/engine/budget.rs

@@ -44,9 +44,9 @@ pub struct ClientBudgetCharge {
 pub struct ClientBudgetError(#[source] pub Option<crate::error::ErrorSource>);
 
 pub trait ClientBudgetPort: Send + Sync {
-    /// 原子检查当前限额与已用金额，不创建预扣费或待结算记录
+    /// 检查当前限额、已用金额与已接管的费用，不预占未来费用
     fn admit(&self, key_id: ClientApiKeyId) -> BoxFuture<'_, Result<(), GatewayError>>;
 
-    /// 按网关请求 ID 幂等累计已取得费用；写入失败由 Store 重试
+    /// 按网关请求 ID 幂等接管已取得费用；运行时入队后返回，由 Store 后台落库和重试
     fn settle(&self, charge: ClientBudgetCharge) -> BoxFuture<'_, Result<(), ClientBudgetError>>;
 }

backend/crates/gateway-core/src/engine/coordinator.rs

@@ -1110,7 +1110,7 @@ where
                 pinned_account.clone(),
                 self.account_state_owner.clone(),
             )
-            .with_account_scope(Arc::clone(self.plan.account_scope())),
+            .with_account_scope(Arc::clone(candidate.account_scope())),
         }
         .with_credential_recovery_attempted(pinned_account.as_ref().is_some_and(|account| {
             self.credential_recovery_attempted_accounts
@@ -2302,12 +2302,6 @@ where
             http_version,
             websocket_pool,
             service_tier,
-            upstream_response_model: self
-                .current
-                .as_ref()
-                .and_then(|current| current.response_observation.as_ref())
-                .and_then(ProviderResponseObservation::upstream_response_model)
-                .map(str::to_owned),
             provider_metadata_json,
             diagnostic_trace_json: self.trace.snapshot().map(|value| value.to_string()),
             error: None,
@@ -2490,12 +2484,6 @@ where
             http_version,
             websocket_pool,
             service_tier,
-            upstream_response_model: self
-                .current
-                .as_ref()
-                .and_then(|current| current.response_observation.as_ref())
-                .and_then(ProviderResponseObservation::upstream_response_model)
-                .map(str::to_owned),
             provider_metadata_json,
             diagnostic_trace_json: self.trace.snapshot().map(|value| value.to_string()),
             error: Some(finalization.error),

backend/crates/gateway-core/src/engine/execution/admission.rs

@@ -32,7 +32,7 @@ pub(super) async fn settle_budget(
             diagnostics,
             &request_id,
             "settle_client_budget",
-            "Client budget settlement failed; storage will retry on the next request",
+            "Client budget settlement could not be accepted",
             error,
         )
         .await;

backend/crates/gateway-core/src/engine/execution/mod.rs

@@ -12,7 +12,6 @@ pub use contract::{
     StartedExecution,
 };
 mod scope;
-pub use scope::BoundModelExecutionContext;
 mod service;
 pub use failure::gateway_error_from_engine;
 pub use service::DefaultExecutionService;

backend/crates/gateway-core/src/engine/execution/scope.rs

@@ -15,13 +15,10 @@ use crate::{
     lifecycle::{CancellationToken, Deadline},
     operation::Operation,
     policy::ClientApiKeyId,
-    routing::{
-        FrozenAccountScope, PublicModelId, UpstreamModelId, request_settings::RequestSettings,
-    },
+    routing::{FrozenAccountScope, PublicModelId, UpstreamModelId},
 };
 use std::{
     collections::BTreeMap,
-    fmt,
     sync::{
         Arc, Mutex, Weak,
         atomic::{AtomicUsize, Ordering},
@@ -188,57 +185,6 @@ pub(super) struct ActiveRequestLease {
     pub(super) authority: Arc<ActiveRequestAuthority>,
 }
 
-/// 管理页或 CLI 一次调用持有的显式模型执行身份
-///
-/// 结构不暴露 Key 明文；Runtime 只能把它原样交回 Core 发起模型请求
-#[derive(Clone)]
-pub struct BoundModelExecutionContext {
-    pub(super) authority: Arc<BoundModelExecutionAuthority>,
-}
-
-impl BoundModelExecutionContext {
-    /// 与实际执行共用绑定时的快照，不能回退到后续发布的配置
-    #[must_use]
-    pub fn request_body_limit(&self) -> usize {
-        self.authority
-            .client
-            .snapshot
-            .responses_max_decompressed_body_bytes()
-    }
-
-    #[must_use]
-    pub fn request_settings(&self) -> Option<&RequestSettings> {
-        self.authority.client.request_settings()
-    }
-}
-
-pub(super) struct BoundModelExecutionAuthority {
-    pub(super) client: AuthenticatedClient,
-    pub(super) account_scope: Arc<FrozenAccountScope>,
-    pub(super) cancellation: CancellationToken,
-    pub(super) extension_scope: ExtensionCallScope,
-    pub(super) initiating_plugin_instance_id: String,
-}
-
-impl fmt::Debug for BoundModelExecutionContext {
-    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
-        formatter
-            .debug_struct("BoundModelExecutionContext")
-            .field("key_id", &self.authority.client.policy.key_id())
-            .field(
-                "initiating_plugin_instance_id",
-                &self.authority.initiating_plugin_instance_id,
-            )
-            .finish_non_exhaustive()
-    }
-}
-
-impl Drop for BoundModelExecutionAuthority {
-    fn drop(&mut self) {
-        self.cancellation.cancel();
-    }
-}
-
 impl ActiveRequestLease {
     pub(super) fn release(self) {
         drop(self);

backend/crates/gateway-core/src/engine/execution/service.rs

@@ -12,9 +12,8 @@ use super::contract::{
 use super::probe_store::{ProbeObservation, TransientExecutionStore};
 use super::scope::{
     ActiveRequestAuthority, ActiveRequestLease, ActiveRequestRegistry, AuthorizedExecution,
-    BoundExecutionFacts, BoundModelExecutionAuthority, BoundModelExecutionContext,
-    ExecutionStartGuard, ExecutionTarget, NestedExecutionFacts, NestedExecutionGraph,
-    PendingStartExecution, PreparedExecutionStart,
+    BoundExecutionFacts, ExecutionStartGuard, ExecutionTarget, NestedExecutionFacts,
+    NestedExecutionGraph, PendingStartExecution, PreparedExecutionStart,
 };
 use super::{COORDINATION_TIMEOUT, DIAGNOSTIC_TIMEOUT};
 use super::{scope::ExecutionAdmission, session::DefaultExecutionSession};
@@ -28,7 +27,7 @@ use crate::{
             ClientAdmissionRequest,
         },
         authentication::{
-            ClientAuthenticationRequest, FrontendAuthenticationDecision,
+            ClientAuthenticationRequest, ClientIdentityPort, FrontendAuthenticationDecision,
             FrontendAuthenticationExtensionIndex,
         },
         budget::{ClientBudgetCharge, ClientBudgetPort},
@@ -41,8 +40,8 @@ use crate::{
         middleware::FrozenMiddlewarePlan,
         nested::{
             AffinityLookupPort, AffinityLookupRequest, AffinityLookupResult,
-            BoundModelExecutionBinding, BoundModelExecutionRequest, ExecutionEffects,
-            NestedModelExecutionPort, NestedModelExecutionRequest,
+            BoundModelExecutionRequest, ExecutionEffects, NestedModelExecutionPort,
+            NestedModelExecutionRequest,
         },
         observation::{
             FrozenRequestObservationContext, RequestObservationDispatch, RequestObservationScope,
@@ -1081,72 +1080,54 @@ impl DefaultExecutionService {
         })
     }
 
-    async fn bind_bound_model_inner(
-        &self,
-        binding: BoundModelExecutionBinding,
-    ) -> Result<BoundModelExecutionContext, GatewayError> {
-        let client = self
-            .client_for_key_id(&binding.client_key_id, binding.settings)
-            .await?;
-        if binding.extension_scope.len() >= ExtensionCallScope::MAXIMUM_DEPTH {
-            return Err(GatewayError::new(
-                GatewayErrorKind::PolicyDenied,
-                "plugin model execution depth exceeded",
-            ));
-        }
-        let extension_scope = binding
-            .extension_scope
-            .extending(binding.initiating_plugin_instance_id.clone())
-            .ok_or_else(|| {
-                GatewayError::new(
-                    GatewayErrorKind::Internal,
-                    "bound plugin execution scope is invalid",
-                )
-            })?;
-        let account_scope = Arc::clone(client.policy.account_scope());
-        Ok(BoundModelExecutionContext {
-            authority: Arc::new(BoundModelExecutionAuthority {
-                client,
-                account_scope,
-                cancellation: binding.cancellation,
-                extension_scope,
-                initiating_plugin_instance_id: binding.initiating_plugin_instance_id,
-            }),
-        })
-    }
-
     async fn start_bound_model_inner(
         &self,
         request: BoundModelExecutionRequest,
     ) -> Result<StartedExecution, GatewayError> {
         let BoundModelExecutionRequest {
-            context,
+            client,
+            initiating_plugin_instance_id,
+            cancellation,
+            extension_scope,
             public_model,
             operation,
             mut metadata,
             provider,
             account,
         } = request;
-        let authority = &context.authority;
-        if authority.cancellation.is_cancelled() {
+        if cancellation.is_cancelled() {
             return Err(GatewayError::new(
                 GatewayErrorKind::Cancelled,
                 "bound plugin invocation was cancelled",
             ));
         }
-        let now = SystemTime::now();
-        let deadline_at = Deadline::from_timeout(now, authority.client.execution_timeout())
+        if extension_scope.len() >= ExtensionCallScope::MAXIMUM_DEPTH {
+            return Err(GatewayError::new(
+                GatewayErrorKind::PolicyDenied,
+                "plugin model execution depth exceeded",
+            ));
+        }
+        let extension_scope = extension_scope
+            .extending(initiating_plugin_instance_id.clone())
             .ok_or_else(|| {
+                GatewayError::new(
+                    GatewayErrorKind::PolicyDenied,
+                    "plugin model execution scope is recursive",
+                )
+            })?;
+        let now = SystemTime::now();
+        let deadline_at =
+            Deadline::from_timeout(now, client.execution_timeout()).ok_or_else(|| {
                 GatewayError::new(GatewayErrorKind::Internal, "system clock is invalid")
             })?;
         let (account_scope, required_provider) = restrict_model_execution_scope(
-            authority.account_scope.as_ref(),
+            client.policy.account_scope().as_ref(),
             provider,
             account.as_ref(),
             None,
         )?;
         // 连接承载多个独立执行；递归预算和副作用只在本次执行的子调用图内共享
-        // 父连接的取消仍通过 authority 传播，不能因新建执行丢失扩展调用链
+        // 父调用的取消继续向子执行传播，不能因新建执行丢失扩展调用链
         let graph = Arc::new(NestedExecutionGraph::new(Arc::new(
             ExecutionEffects::default(),
         )));
@@ -1154,12 +1135,12 @@ impl DefaultExecutionService {
         let execution_effects_baseline = graph.effects.epoch();
         metadata.endpoint = "host.model".to_owned();
         metadata.transport = ClientTransport::InternalPlugin;
-        metadata.inherit_request_origin(&authority.extension_scope);
+        metadata.inherit_request_origin(&extension_scope);
         self.client_api_key_usage
-            .record_used(authority.client.policy.key_id());
+            .record_used(client.policy.key_id());
         self.start_authorized(
             PendingStartExecution {
-                client: authority.client.clone(),
+                client,
                 target: ExecutionTarget::Model(public_model),
                 operation,
                 metadata,
@@ -1168,13 +1149,13 @@ impl DefaultExecutionService {
                 account_scope,
                 response_control: None,
                 deadline_at,
-                cancellation: authority.cancellation.child_token(),
-                extension_scope: authority.extension_scope.clone(),
+                cancellation: cancellation.child_token(),
+                extension_scope,
                 required_provider,
                 required_account: account,
                 nested: None,
                 bound: Some(BoundExecutionFacts {
-                    initiating_plugin_instance_id: authority.initiating_plugin_instance_id.clone(),
+                    initiating_plugin_instance_id,
                 }),
                 graph: Some(graph),
                 execution_effects_baseline,
@@ -1570,14 +1551,7 @@ impl ExecutionService for DefaultExecutionService {
                     .query_client_model_catalog(scope, protocol, client_version)
                     .await?
                 else {
-                    for profile in client.snapshot.public_model_profiles_for_provider(kind) {
-                        if !client.snapshot.catalog_model_allowed_for_scope(
-                            kind,
-                            profile.model(),
-                            scope,
-                        ) {
-                            continue;
-                        }
+                    for profile in client.snapshot.profiles_for_provider_scope(kind, scope) {
                         if seen.insert(profile.model().clone()) {
                             result.push(PublicModelDescriptor::Adapted(profile));
                         }
@@ -1629,6 +1603,12 @@ impl ExecutionService for DefaultExecutionService {
                         result.push(source.content.for_public_model(model));
                     }
                 }
+                // 原生完整对象优先；只补入当前授权账号实际提供的独立适配画像
+                for profile in client.snapshot.contributed_profiles_for_scope(kind, scope) {
+                    if seen.insert(profile.model().clone()) {
+                        result.push(PublicModelDescriptor::Adapted(profile));
+                    }
+                }
             }
             Ok(result)
         })
@@ -1724,23 +1704,57 @@ impl ExecutionService for DefaultExecutionService {
     }
 }
 
+impl ClientIdentityPort for DefaultExecutionService {
+    fn resolve_client(
+        &self,
+        client_key_id: ClientApiKeyId,
+        settings: Option<RequestSettings>,
+    ) -> BoxFuture<'_, Result<AuthenticatedClient, GatewayError>> {
+        Box::pin(async move { self.client_for_key_id(&client_key_id, settings).await })
+    }
+
+    fn verify_client(
+        &self,
+        request: ClientAuthenticationRequest,
+    ) -> BoxFuture<'_, Result<AuthenticatedClient, GatewayError>> {
+        Box::pin(async move {
+            let cancellation = request
+                .invocation()
+                .map(|origin| origin.cancellation.clone());
+            let verification = self.verify_request(request).fuse();
+            pin_mut!(verification);
+            match cancellation {
+                Some(cancellation) => {
+                    let cancelled = cancellation.cancelled().fuse();
+                    pin_mut!(cancelled);
+                    select_biased! {
+                        () = cancelled => Err(GatewayError::new(GatewayErrorKind::Cancelled, "client verification was cancelled")),
+                        result = verification => result.map_err(authentication_gateway_error),
+                    }
+                }
+                None => verification.await.map_err(authentication_gateway_error),
+            }
+        })
+    }
+}
+
 impl NestedModelExecutionPort for DefaultExecutionService {
     fn models(
         &self,
-        context: BoundModelExecutionContext,
+        client: AuthenticatedClient,
+        cancellation: CancellationToken,
         protocol: String,
         client_version: String,
     ) -> BoxFuture<'_, Result<Vec<PublicModelId>, GatewayError>> {
         Box::pin(async move {
-            let authority = &context.authority;
-            let cancellation = authority.cancellation.cancelled().fuse();
+            let cancelled = cancellation.cancelled().fuse();
             let timeout = Delay::new(DIAGNOSTIC_TIMEOUT).fuse();
             let catalog = self
-                .client_model_catalog(&authority.client, &protocol, &client_version)
+                .client_model_catalog(&client, &protocol, &client_version)
                 .fuse();
-            pin_mut!(cancellation, timeout, catalog);
+            pin_mut!(cancelled, timeout, catalog);
             let models = select_biased! {
-                () = cancellation => return Err(GatewayError::new(GatewayErrorKind::Cancelled, "model catalog call was cancelled")),
+                () = cancelled => return Err(GatewayError::new(GatewayErrorKind::Cancelled, "model catalog call was cancelled")),
                 () = timeout => return Err(GatewayError::new(GatewayErrorKind::Timeout, "model catalog deadline elapsed")),
                 result = catalog => result.map_err(|_| GatewayError::new(GatewayErrorKind::Internal, "model catalog is unavailable"))?,
             };
@@ -1754,13 +1768,6 @@ impl NestedModelExecutionPort for DefaultExecutionService {
         })
     }
 
-    fn bind(
-        &self,
-        binding: BoundModelExecutionBinding,
-    ) -> BoxFuture<'_, Result<BoundModelExecutionContext, GatewayError>> {
-        Box::pin(async move { self.bind_bound_model_inner(binding).await })
-    }
-
     fn start(
         &self,
         request: NestedModelExecutionRequest,

backend/crates/gateway-core/src/engine/extensions.rs

@@ -62,6 +62,17 @@ impl ExtensionCallScope {
     }
 }
 
+/// 宿主签发的父调用来源；身份裁决、执行链和实际资源仍由各自 owner 持有
+#[derive(Clone, Debug)]
+pub struct InvocationOrigin {
+    pub request_id: String,
+    pub call_id: String,
+    pub cancellation: crate::lifecycle::CancellationToken,
+    pub extensions: ExtensionCallScope,
+    pub plan: Option<super::middleware::FrozenMiddlewarePlan>,
+    pub effects: Option<Arc<super::nested::ExecutionEffects>>,
+}
+
 /// 同一代次的具体执行计划；不拥有发布状态，运行资源由对应发布集合保活
 #[derive(Debug, Default)]
 pub struct ExecutionExtensionPlans {

backend/crates/gateway-core/src/engine/middleware/contract.rs

@@ -43,6 +43,8 @@ pub enum MiddlewareMount {
     Request,
     /// 受管 Provider attempt 内层；每次真实 retry 都重新建立
     Attempt,
+    /// Provider 完成序列化后、提交实际发送前的请求准备
+    Outbound,
 }
 
 /// 中间件正文块的宿主边界

backend/crates/gateway-core/src/engine/middleware/mod.rs

@@ -2,6 +2,7 @@
 
 mod contract;
 pub mod http;
+pub mod outbound;
 mod plan;
 pub mod service;
 pub mod websocket;

backend/crates/gateway-core/src/engine/middleware/outbound.rs

@@ -0,0 +1,140 @@
+//! Provider 发送前的完整请求准备；续体只组合值，不执行网络操作
+
+use std::fmt;
+
+use bytes::Bytes;
+use futures::FutureExt;
+
+use super::{FrozenMiddlewarePlan, MiddlewareContext, MiddlewareError, MiddlewareHeader};
+use crate::error::{ProviderError, ProviderErrorKind};
+use crate::upstream::UpstreamSendState;
+
+/// 当前发送所用的传输类型与目标；准备过程中不能切换传输类型
+#[derive(Clone, PartialEq, Eq)]
+pub enum Target {
+    Http {
+        method: http::Method,
+        uri: http::Uri,
+    },
+    WebSocket {
+        uri: http::Uri,
+    },
+}
+
+impl fmt::Debug for Target {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        match self {
+            Self::Http { method, .. } => formatter
+                .debug_struct("Http")
+                .field("method", method)
+                .finish_non_exhaustive(),
+            Self::WebSocket { .. } => formatter.debug_struct("WebSocket").finish_non_exhaustive(),
+        }
+    }
+}
+
+/// HTTP 正文已完成序列化与内容编码；WebSocket 正文是一条完整文本消息
+///
+/// WebSocket headers 表示候选 opening，不能改写已经建立的连接握手
+#[derive(Clone, PartialEq, Eq)]
+pub struct Request {
+    pub target: Target,
+    pub headers: Vec<MiddlewareHeader>,
+    pub body: Bytes,
+}
+
+impl Request {
+    /// 转换实际发送的 HTTP 头，保留多值与原始字节，不修复插件输出
+    pub fn header_map(&self) -> Result<http::HeaderMap, ProviderError> {
+        let mut headers = http::HeaderMap::try_with_capacity(self.headers.len())
+            .map_err(|_| preparation_error(ProviderErrorKind::InvalidRequest))?;
+        for header in &self.headers {
+            let name = http::HeaderName::from_bytes(header.name().as_bytes())
+                .map_err(|_| preparation_error(ProviderErrorKind::InvalidRequest))?;
+            let value = http::HeaderValue::from_bytes(header.value())
+                .map_err(|_| preparation_error(ProviderErrorKind::InvalidRequest))?;
+            headers
+                .try_append(name, value)
+                .map_err(|_| preparation_error(ProviderErrorKind::InvalidRequest))?;
+        }
+        Ok(headers)
+    }
+}
+
+impl fmt::Debug for Request {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        formatter
+            .debug_struct("Request")
+            .field("target", &self.target)
+            .field("headers", &self.headers.len())
+            .field("body_bytes", &self.body.len())
+            .finish()
+    }
+}
+
+pub type Next = crate::middleware::Next<Request, Request, MiddlewareError>;
+
+/// 保活本次 attempt 的冻结发布代次、归属和资源上下文
+#[derive(Clone, Debug)]
+pub struct Pipeline {
+    plan: FrozenMiddlewarePlan,
+    context: MiddlewareContext,
+}
+
+impl Pipeline {
+    pub(in crate::engine) const fn new(
+        plan: FrozenMiddlewarePlan,
+        context: MiddlewareContext,
+    ) -> Self {
+        Self { plan, context }
+    }
+
+    /// 完整返回洋葱链最终输出后，Provider 才能提交实际发送
+    pub async fn prepare(&self, request: Request) -> Result<Request, ProviderError> {
+        if self.context.cancellation().is_cancelled() {
+            return Err(preparation_error(ProviderErrorKind::Cancelled));
+        }
+        if self.context.deadline().is_elapsed() {
+            return Err(preparation_error(ProviderErrorKind::Timeout));
+        }
+        let target_kind = std::mem::discriminant(&request.target);
+        let next =
+            crate::middleware::compose(Vec::new(), |request| Box::pin(async { Ok(request) }));
+        let prepare = self
+            .plan
+            .handle_outbound(self.context.clone(), request, next)
+            .fuse();
+        let cancelled = self.context.cancellation().cancelled().fuse();
+        let expired = self.context.deadline().wait().fuse();
+        futures::pin_mut!(prepare, cancelled, expired);
+        let prepared = futures::select_biased! {
+            () = cancelled => return Err(preparation_error(ProviderErrorKind::Cancelled)),
+            () = expired => return Err(preparation_error(ProviderErrorKind::Timeout)),
+            result = prepare => result.map_err(|error| {
+                crate::engine::provider::middleware_error(error, UpstreamSendState::NotSent)
+                    .with_retry_prohibited()
+            })?,
+        };
+        if self.context.cancellation().is_cancelled() {
+            return Err(preparation_error(ProviderErrorKind::Cancelled));
+        }
+        if self.context.deadline().is_elapsed() {
+            return Err(preparation_error(ProviderErrorKind::Timeout));
+        }
+        if std::mem::discriminant(&prepared.target) != target_kind
+            || self
+                .context
+                .request_body_limit()
+                .is_some_and(|limit| prepared.body.len() > limit)
+        {
+            return Err(preparation_error(ProviderErrorKind::InvalidRequest));
+        }
+        Ok(prepared)
+    }
+}
+
+fn preparation_error(kind: ProviderErrorKind) -> ProviderError {
+    ProviderError::new(kind, UpstreamSendState::NotSent)
+        .with_retry_prohibited()
+        .redact_sensitive_context("invalid outbound request preparation")
+}

backend/crates/gateway-core/src/engine/middleware/plan.rs

@@ -9,6 +9,18 @@ use std::{fmt, sync::Arc};
 
 /// 一个发布代次冻结的统一数据面中间件计划
 pub trait MiddlewarePlan: Send + Sync + fmt::Debug {
+    fn has_outbound(&self, _context: &MiddlewareContext) -> bool {
+        false
+    }
+    fn handle_outbound(
+        &self,
+        _context: MiddlewareContext,
+        request: super::outbound::Request,
+        next: super::outbound::Next,
+    ) -> BoxFuture<'static, Result<super::outbound::Request, MiddlewareError>> {
+        next.run(request)
+    }
+
     fn has_service(&self) -> bool {
         false
     }
@@ -73,6 +85,20 @@ pub struct FrozenMiddlewarePlan {
 }
 
 impl FrozenMiddlewarePlan {
+    #[must_use]
+    pub fn has_outbound(&self, context: &MiddlewareContext) -> bool {
+        self.plan.has_outbound(context)
+    }
+    pub fn handle_outbound(
+        &self,
+        mut context: MiddlewareContext,
+        request: super::outbound::Request,
+        next: super::outbound::Next,
+    ) -> BoxFuture<'static, Result<super::outbound::Request, MiddlewareError>> {
+        context.plan = Some(self.clone());
+        self.plan.handle_outbound(context, request, next)
+    }
+
     #[must_use]
     pub fn has_service(&self) -> bool {
         self.plan.has_service()

backend/crates/gateway-core/src/engine/mod.rs

@@ -167,7 +167,7 @@ impl AccountAttemptContext {
         }
     }
 
-    /// 附着普通请求认证时冻结的账号范围
+    /// 附着本次尝试的冻结账号范围，包含路由候选的能力限制
     #[must_use]
     pub fn with_account_scope(
         mut self,
@@ -575,11 +575,48 @@ impl AttemptContext {
         &self,
         provider: &ProviderKind,
         model: &UpstreamModelId,
+    ) -> Result<upstream_adapter::UpstreamAdapterSelection, ProviderError> {
+        let account = self
+            .required_account()
+            .or_else(|| match self.continuation_attempt() {
+                ContinuationAttempt::Native => self
+                    .continuation()
+                    .and_then(continuation::ContinuationBinding::pinned)
+                    .map(|pin| pin.account()),
+                ContinuationAttempt::ReplayOwner => self
+                    .account_state_owner()
+                    .filter(|owner| owner.provider() == provider)
+                    .map(|owner| owner.account()),
+                ContinuationAttempt::None | ContinuationAttempt::ReplayAny => None,
+            });
+        self.request.upstream_adapters.as_ref().map_or(
+            Ok(upstream_adapter::UpstreamAdapterSelection::Native),
+            |plan| plan.select(self, provider, model, account),
+        )
+    }
+
+    /// 账号候选资格检查和最终执行解析使用同一冻结计划，不调用插件进程
+    pub fn upstream_adapter_for_account(
+        &self,
+        provider: &ProviderKind,
+        model: &UpstreamModelId,
+        account: &ProviderAccountId,
     ) -> Result<Option<Arc<dyn upstream_adapter::UpstreamAdapter>>, ProviderError> {
         self.request
             .upstream_adapters
             .as_ref()
-            .map_or(Ok(None), |plan| plan.select(self, provider, model))
+            .map_or(Ok(None), |plan| {
+                match plan.select(self, provider, model, Some(account))? {
+                    upstream_adapter::UpstreamAdapterSelection::Native => Ok(None),
+                    upstream_adapter::UpstreamAdapterSelection::Adapter(adapter) => {
+                        Ok(Some(adapter))
+                    }
+                    // 已知账号的解析必须给出最终执行端，不能绕过资格检查进入原生路径
+                    upstream_adapter::UpstreamAdapterSelection::PendingAccount => Err(
+                        ProviderError::new(ProviderErrorKind::Protocol, UpstreamSendState::NotSent),
+                    ),
+                }
+            })
     }
 
     #[must_use]
@@ -740,12 +777,57 @@ impl AttemptContext {
         } else {
             terminal
         };
-        let context = middleware::MiddlewareContext::new(
+        let context = self.middleware_context(
+            middleware::MiddlewareMount::Attempt,
+            Some(operation.kind()),
+            provider,
+            model,
+            account_id,
+        );
+        provider::execute_attempt_middleware(
+            self.request.middleware.as_ref(),
+            context,
+            operation,
+            self.request.client_transport,
+            terminal,
+        )
+        .await
+    }
+
+    /// 为当前实际账号冻结出站准备链，无此阶段时保留 Provider 原生路径
+    #[must_use]
+    pub fn outbound_middleware(
+        &self,
+        provider: ProviderKind,
+        model: Option<String>,
+        account_id: ProviderAccountId,
+    ) -> Option<middleware::outbound::Pipeline> {
+        let plan = self.request.middleware.as_ref()?;
+        let context = self.middleware_context(
+            middleware::MiddlewareMount::Outbound,
+            None,
+            provider,
+            model,
+            account_id,
+        );
+        plan.has_outbound(&context)
+            .then(|| middleware::outbound::Pipeline::new(plan.clone(), context))
+    }
+
+    fn middleware_context(
+        &self,
+        mount: middleware::MiddlewareMount,
+        operation: Option<crate::operation::OperationKind>,
+        provider: ProviderKind,
+        model: Option<String>,
+        account_id: ProviderAccountId,
+    ) -> middleware::MiddlewareContext {
+        middleware::MiddlewareContext::new(
             middleware::MiddlewareTarget {
                 request_id: self.request.request_id.clone(),
-                mount: middleware::MiddlewareMount::Attempt,
+                mount,
                 attempt_index: Some(self.attempt_index),
-                operation: Some(operation.kind()),
+                operation,
                 endpoint: self.request.endpoint.clone(),
                 transport: self.request.client_transport,
                 provider: Some(provider),
@@ -761,15 +843,7 @@ impl AttemptContext {
                 execution_effects: self.request.execution_effects.as_ref().map(Arc::clone),
             },
         )
-        .with_request_body_limit(self.request.request_body_limit);
-        provider::execute_attempt_middleware(
-            self.request.middleware.as_ref(),
-            context,
-            operation,
-            self.request.client_transport,
-            terminal,
-        )
-        .await
+        .with_request_body_limit(self.request.request_body_limit)
     }
 
     #[must_use]
@@ -821,7 +895,7 @@ impl AttemptContext {
         self.account.is_diagnostic_required_account()
     }
 
-    /// 普通请求认证时冻结的账号范围；管理端诊断为 `None`
+    /// 当前路由候选的冻结账号范围；管理端诊断为 `None`
     #[must_use]
     pub const fn account_scope(&self) -> Option<&Arc<crate::account::scope::FrozenAccountScope>> {
         self.account.account_scope()
@@ -996,7 +1070,6 @@ pub struct ModelRequestFinalization {
     pub http_version: Option<String>,
     pub websocket_pool: Option<String>,
     pub service_tier: Option<String>,
-    pub upstream_response_model: Option<String>,
     /// Provider 已筛选的专有观测 JSON；Core 不解释字段
     pub provider_metadata_json: Option<String>,
     /// 请求全程的有界诊断快照，跨 Provider 与重试保留

backend/crates/gateway-core/src/engine/nested.rs

@@ -13,13 +13,13 @@ use futures::future::BoxFuture;
 
 use crate::{
     account::ProviderAccountId, error::GatewayError, identity::ProviderKind,
-    lifecycle::CancellationToken, operation::Operation, policy::ClientApiKeyId,
-    provider_ports::ProviderSessionAffinityKey, routing::PublicModelId,
+    lifecycle::CancellationToken, operation::Operation, provider_ports::ProviderSessionAffinityKey,
+    routing::PublicModelId,
 };
 
 use super::{
     ModelRequestId,
-    execution::{BoundModelExecutionContext, ExecutionRequestMetadata, StartedExecution},
+    execution::{AuthenticatedClient, ExecutionRequestMetadata, StartedExecution},
 };
 
 /// 同一请求图内不可逆外部副作用的单调水位
@@ -59,37 +59,14 @@ pub struct NestedModelExecutionRequest {
     pub parent_account: Option<ProviderAccountId>,
 }
 
-/// 插件为当前调用或连接显式绑定的模型执行身份
-///
-/// Key ID 由插件选择，发起实例由宿主确定
-/// Core 在绑定时冻结当前
-/// Key 策略；每个实际模型请求仍独立经过准入、预算、账本与计费
-pub struct BoundModelExecutionBinding {
-    pub settings: Option<crate::routing::request_settings::RequestSettings>,
-    pub client_key_id: ClientApiKeyId,
-    pub initiating_plugin_instance_id: String,
-    /// 身份随父调用或连接回收；每个模型请求使用独立的执行期限
-    pub cancellation: CancellationToken,
-    /// 宿主保留的扩展调用链，异步观察不能通过新建模型请求清空防递归事实
-    pub extension_scope: super::extensions::ExtensionCallScope,
-}
-
-impl fmt::Debug for BoundModelExecutionBinding {
-    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
-        formatter
-            .debug_struct("BoundModelExecutionBinding")
-            .field("client_key_id", &self.client_key_id)
-            .field(
-                "initiating_plugin_instance_id",
-                &self.initiating_plugin_instance_id,
-            )
-            .finish_non_exhaustive()
-    }
-}
-
 /// 显式身份作用域内的一次模型请求
+///
+/// 身份与权限可先用于查询；执行链只在真正启动模型请求时建立
 pub struct BoundModelExecutionRequest {
-    pub context: BoundModelExecutionContext,
+    pub client: AuthenticatedClient,
+    pub initiating_plugin_instance_id: String,
+    pub cancellation: CancellationToken,
+    pub extension_scope: super::extensions::ExtensionCallScope,
     pub public_model: PublicModelId,
     pub operation: Operation,
     pub metadata: ExecutionRequestMetadata,
@@ -101,7 +78,11 @@ impl fmt::Debug for BoundModelExecutionRequest {
     fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
         formatter
             .debug_struct("BoundModelExecutionRequest")
-            .field("context", &self.context)
+            .field("client", &self.client)
+            .field(
+                "initiating_plugin_instance_id",
+                &self.initiating_plugin_instance_id,
+            )
             .field("public_model", &self.public_model)
             .field("operation", &self.operation.kind())
             .field("provider", &self.provider)
@@ -132,17 +113,12 @@ impl fmt::Debug for NestedModelExecutionRequest {
 pub trait NestedModelExecutionPort: Send + Sync {
     fn models(
         &self,
-        context: BoundModelExecutionContext,
+        client: AuthenticatedClient,
+        cancellation: CancellationToken,
         protocol: String,
         client_version: String,
     ) -> BoxFuture<'_, Result<Vec<PublicModelId>, GatewayError>>;
 
-    /// 为插件调用冻结显式执行身份；取消父调用会取消其所有模型执行
-    fn bind(
-        &self,
-        binding: BoundModelExecutionBinding,
-    ) -> BoxFuture<'_, Result<BoundModelExecutionContext, GatewayError>>;
-
     fn start(
         &self,
         request: NestedModelExecutionRequest,

backend/crates/gateway-core/src/engine/observation.rs

@@ -249,7 +249,6 @@ pub struct RequestObservation {
     provider: Option<ProviderKind>,
     account_id: Option<ProviderAccountId>,
     upstream_model: Option<crate::routing::UpstreamModelId>,
-    response_model: Option<String>,
     service_tier: Option<String>,
     outcome: RequestObservationOutcome,
     send_state: UpstreamSendState,
@@ -287,7 +286,6 @@ impl RequestObservation {
             provider: None,
             account_id: None,
             upstream_model: None,
-            response_model: None,
             service_tier: None,
             outcome,
             send_state,
@@ -341,11 +339,6 @@ impl RequestObservation {
         self.upstream_model.as_ref()
     }
 
-    #[must_use]
-    pub fn response_model(&self) -> Option<&str> {
-        self.response_model.as_deref()
-    }
-
     #[must_use]
     pub fn service_tier(&self) -> Option<&str> {
         self.service_tier.as_deref()
@@ -626,7 +619,6 @@ impl RequestObservationDispatch {
             outcome: RequestObservationOutcome::Rejected,
             account_id: None,
             upstream_model: None,
-            response_model: None,
             service_tier: None,
             send_state: UpstreamSendState::NotSent,
             attempt_count: 0,
@@ -699,7 +691,6 @@ impl RequestObservationDispatch {
             provider,
             account_id: attempt.map(|attempt| attempt.provider_account_id().clone()),
             upstream_model: attempt.and_then(|attempt| attempt.upstream_model().cloned()),
-            response_model: finalization.upstream_response_model.clone(),
             service_tier: finalization.service_tier.clone(),
             outcome,
             send_state: finalization.send_state,

backend/crates/gateway-core/src/engine/provider.rs

@@ -893,7 +893,10 @@ fn unprepared_middleware_response(
     }
 }
 
-fn middleware_error(error: MiddlewareError, send_state: UpstreamSendState) -> ProviderError {
+pub(super) fn middleware_error(
+    error: MiddlewareError,
+    send_state: UpstreamSendState,
+) -> ProviderError {
     match error {
         MiddlewareError::Provider(error) => error,
         MiddlewareError::Rejected | MiddlewareError::Remote { rejected: true, .. } => {

backend/crates/gateway-core/src/engine/upstream_adapter.rs

@@ -31,7 +31,16 @@ pub trait UpstreamAdapterPlan: fmt::Debug + Send + Sync {
         context: &AttemptContext,
         provider: &ProviderKind,
         model: &UpstreamModelId,
-    ) -> Result<Option<Arc<dyn UpstreamAdapter>>, ProviderError>;
+        account: Option<&ProviderAccountId>,
+    ) -> Result<UpstreamAdapterSelection, ProviderError>;
+}
+
+/// 未确定账号时不能把账号范围声明视为原生执行或继续命中后置兜底
+#[derive(Debug)]
+pub enum UpstreamAdapterSelection {
+    Native,
+    Adapter(Arc<dyn UpstreamAdapter>),
+    PendingAccount,
 }
 
 /// 请求同时持有计划及发布集合，防止旧集合先排空进程而中断在途调用
@@ -58,8 +67,9 @@ impl FrozenUpstreamAdapterPlan {
         context: &AttemptContext,
         provider: &ProviderKind,
         model: &UpstreamModelId,
-    ) -> Result<Option<Arc<dyn UpstreamAdapter>>, ProviderError> {
-        self.plan.select(context, provider, model)
+        account: Option<&ProviderAccountId>,
+    ) -> Result<UpstreamAdapterSelection, ProviderError> {
+        self.plan.select(context, provider, model, account)
     }
 }
 
@@ -71,6 +81,9 @@ pub trait UpstreamAdapter: fmt::Debug + Send + Sync {
 
     /// 注册时声明的上游传输，用于宿主登记 attempt
     fn transport(&self) -> &str;
+
+    /// 选号前复核注册的认证资格，发送前仍由执行端校验当前凭据
+    fn supports_authentication(&self, kind: &str) -> bool;
 }
 
 /// 一次执行的宿主事实；账号及 Provider 归属不可由插件返回值覆盖

backend/crates/gateway-core/src/event.rs

@@ -624,7 +624,6 @@ pub struct ProviderResponseObservation {
     status_code: Option<u16>,
     request_id: Option<OpaqueUpstreamValue>,
     service_tier: Option<String>,
-    upstream_response_model: Option<String>,
     timings: ProviderResponseTimings,
     // 流式事件分别持有快照，共享不可变头集合，避免逐事件复制头名和集合
     client_headers: Arc<[ProviderResponseHeader]>,
@@ -641,7 +640,6 @@ impl ProviderResponseObservation {
             status_code: None,
             request_id: None,
             service_tier: None,
-            upstream_response_model: None,
             timings: ProviderResponseTimings::default(),
             client_headers: Arc::default(),
             provider_metadata: None,
@@ -697,21 +695,6 @@ impl ProviderResponseObservation {
         self
     }
 
-    /// 记录 Provider 从上游响应明确取得的模型，不改写发送模型或计费合同
-    #[must_use]
-    pub fn with_upstream_response_model_if_valid(mut self, model: &str) -> Self {
-        let model = model.trim();
-        if validate_text(model, 256, false, None).is_ok() {
-            self.upstream_response_model = Some(model.to_owned());
-        }
-        self
-    }
-
-    #[must_use]
-    pub fn upstream_response_model(&self) -> Option<&str> {
-        self.upstream_response_model.as_deref()
-    }
-
     #[must_use]
     pub const fn with_timings(mut self, timings: ProviderResponseTimings) -> Self {
         self.timings = timings;

backend/crates/gateway-core/src/lib.rs

@@ -34,6 +34,7 @@ use engine::ExecutionStore;
 use engine::admission::{
     ClientAdmissionPort, ClientAdmissionRecoveryPort, restore_client_admission_startup,
 };
+use engine::authentication::ClientIdentityPort;
 use engine::continuation::NativeContinuationPort;
 use engine::execution::{
     ClientApiKeyUsageSink, ClientKeyVerifier, DefaultExecutionService, ExecutionService,
@@ -127,6 +128,7 @@ pub struct CoreBundle {
     client_key_verifier: Arc<dyn ClientKeyVerifier>,
     snapshot_control: Arc<dyn SnapshotControl>,
     account_probe: Arc<dyn AccountProbe>,
+    client_identity: Arc<dyn ClientIdentityPort>,
     nested_model_execution: Arc<dyn NestedModelExecutionPort>,
     affinity_lookup: Arc<dyn AffinityLookupPort>,
     health_probes: Vec<Arc<dyn HealthProbe>>,
@@ -181,6 +183,7 @@ impl CoreStartup {
         let execution: Arc<dyn ExecutionService> = service.clone();
         let client_key_verifier: Arc<dyn ClientKeyVerifier> = service.clone();
         let account_probe: Arc<dyn AccountProbe> = service.clone();
+        let client_identity: Arc<dyn ClientIdentityPort> = service.clone();
         let nested_model_execution: Arc<dyn NestedModelExecutionPort> = service.clone();
         let affinity_lookup: Arc<dyn AffinityLookupPort> = service;
         let snapshot_control: Arc<dyn SnapshotControl> = publisher;
@@ -191,6 +194,7 @@ impl CoreStartup {
             client_key_verifier,
             snapshot_control,
             account_probe,
+            client_identity,
             nested_model_execution,
             affinity_lookup,
             health_probes,
@@ -266,6 +270,11 @@ impl CoreBundle {
         Arc::clone(&self.account_probe)
     }
 
+    #[must_use]
+    pub fn client_identity_port(&self) -> Arc<dyn ClientIdentityPort> {
+        Arc::clone(&self.client_identity)
+    }
+
     #[must_use]
     pub fn nested_model_execution_port(&self) -> Arc<dyn NestedModelExecutionPort> {
         Arc::clone(&self.nested_model_execution)
@@ -395,6 +404,7 @@ pub struct CoreCommandPlaneStartup {
 pub struct CoreCommandPlaneBundle {
     control: CoreControlPlaneBundle,
     account_probe: Arc<dyn AccountProbe>,
+    client_identity: Arc<dyn ClientIdentityPort>,
     nested_model_execution: Arc<dyn NestedModelExecutionPort>,
     affinity_lookup: Arc<dyn AffinityLookupPort>,
 }
@@ -425,11 +435,13 @@ impl CoreCommandPlaneStartup {
             .with_snapshot_refresh(Arc::clone(&control.publisher)),
         );
         let account_probe: Arc<dyn AccountProbe> = service.clone();
+        let client_identity: Arc<dyn ClientIdentityPort> = service.clone();
         let nested_model_execution: Arc<dyn NestedModelExecutionPort> = service.clone();
         let affinity_lookup: Arc<dyn AffinityLookupPort> = service;
         Ok(CoreCommandPlaneBundle {
             control,
             account_probe,
+            client_identity,
             nested_model_execution,
             affinity_lookup,
         })
@@ -452,6 +464,11 @@ impl CoreCommandPlaneBundle {
         self.control.snapshot_control()
     }
 
+    #[must_use]
+    pub fn client_identity_port(&self) -> Arc<dyn ClientIdentityPort> {
+        Arc::clone(&self.client_identity)
+    }
+
     #[must_use]
     pub fn nested_model_execution_port(&self) -> Arc<dyn NestedModelExecutionPort> {
         Arc::clone(&self.nested_model_execution)

backend/crates/gateway-core/src/routing/catalog.rs

@@ -21,6 +21,17 @@ pub struct ContributedModelAlias {
     pub target: UpstreamModelId,
 }
 
+/// 适配模型的冻结账号支持事实；没有选择账号或改写请求的能力
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct ContributedModel {
+    pub owner: String,
+    pub id: PublicModelId,
+    pub provider: ProviderKind,
+    pub accounts: BTreeSet<ProviderAccountId>,
+    pub capabilities: ModelCapabilities,
+    pub presentation: ModelPresentation,
+}
+
 /// Provider 客户端目录条目；缺少原生协议正文时使用已编译的通用画像
 #[derive(Debug, Clone, PartialEq, Eq)]
 pub struct ProviderModelDescriptor {

backend/crates/gateway-core/src/routing/extensions.rs

@@ -4,7 +4,7 @@ use std::{fmt, sync::Arc};
 
 use futures::future::BoxFuture;
 
-use crate::routing::{ConfigRevision, ContributedModelAlias};
+use crate::routing::{ConfigRevision, ContributedModel, ContributedModelAlias};
 
 #[derive(Debug, Clone, PartialEq, Eq, PartialOrd, Ord, Hash)]
 pub struct ExtensionSetId(String);
@@ -37,6 +37,10 @@ pub trait ExtensionSetLease: Send + Sync {
         &[]
     }
 
+    fn models(&self) -> &[ContributedModel] {
+        &[]
+    }
+
     /// 局部故障已有请求级处理计划时，集合仍可提供服务
     fn can_serve(&self) -> bool {
         self.is_ready()
@@ -71,6 +75,11 @@ impl ExtensionSetReference {
     pub fn model_aliases(&self) -> &[ContributedModelAlias] {
         self.lease.model_aliases()
     }
+
+    #[must_use]
+    pub fn models(&self) -> &[ContributedModel] {
+        self.lease.models()
+    }
 }
 
 impl fmt::Debug for ExtensionSetReference {

backend/crates/gateway-core/src/routing/mod.rs

@@ -11,7 +11,7 @@ pub use crate::account::scope::{
 };
 pub use crate::identity::ProviderKind;
 pub use catalog::{
-    ContributedModelAlias, ProviderCatalogGeneration, ProviderCatalogPort,
+    ContributedModel, ContributedModelAlias, ProviderCatalogGeneration, ProviderCatalogPort,
     ProviderCatalogUnavailable, ProviderModelCapabilities, ProviderModelContent,
     ProviderModelDescriptor, PublicModelDescriptor,
 };

backend/crates/gateway-core/src/routing/snapshot.rs

@@ -652,6 +652,30 @@ impl RuntimeSnapshot {
             .map_or(&[], |set| set.model_aliases())
     }
 
+    fn contributed_models(&self) -> &[super::ContributedModel] {
+        self.extensions.as_ref().map_or(&[], |set| set.models())
+    }
+
+    pub(crate) fn contributed_profiles_for_scope(
+        &self,
+        provider: &ProviderKind,
+        scope: &FrozenAccountScope,
+    ) -> Vec<super::PublicModelProfile> {
+        self.contributed_models()
+            .iter()
+            .filter(|model| {
+                &model.provider == provider
+                    && model.accounts.iter().any(|account| {
+                        scope.account_provider(account) == Some(provider)
+                            && scope.allows_model(account, &self.mapped_model(model.id.as_str()))
+                    })
+            })
+            .map(|model| {
+                super::PublicModelProfile::new(model.id.clone(), model.presentation.clone())
+            })
+            .collect()
+    }
+
     fn model_alias(&self, model: &str) -> Option<&super::ContributedModelAlias> {
         self.model_aliases()
             .iter()
@@ -844,6 +868,12 @@ impl RuntimeSnapshot {
                 .filter(|alias| &alias.provider == provider)
                 .map(|alias| alias.id.clone()),
         );
+        models.extend(
+            self.contributed_models()
+                .iter()
+                .filter(|model| &model.provider == provider)
+                .map(|model| model.id.clone()),
+        );
         models.into_iter().collect()
     }
 
@@ -922,10 +952,7 @@ impl RuntimeSnapshot {
     ) -> Vec<super::PublicModelProfile> {
         let mut profiles = BTreeMap::new();
         for provider in scope.provider_kinds() {
-            for profile in self.public_model_profiles_for_provider(provider) {
-                if !self.catalog_model_allowed_for_scope(provider, profile.model(), scope) {
-                    continue;
-                }
+            for profile in self.profiles_for_provider_scope(provider, scope) {
                 profiles
                     .entry(profile.model().clone())
                     .or_insert_with(|| profile.presentation().clone());
@@ -937,6 +964,20 @@ impl RuntimeSnapshot {
             .collect()
     }
 
+    pub(crate) fn profiles_for_provider_scope(
+        &self,
+        provider: &ProviderKind,
+        scope: &FrozenAccountScope,
+    ) -> Vec<super::PublicModelProfile> {
+        self.public_model_profiles_for_provider(provider)
+            .into_iter()
+            .filter(|profile| {
+                self.native_catalog_model_allowed_for_scope(provider, profile.model(), scope)
+            })
+            .chain(self.contributed_profiles_for_scope(provider, scope))
+            .collect()
+    }
+
     /// 已知模型只属于明确声明它的 Provider；未知模型仍可由非完整目录透传
     #[must_use]
     pub fn contains_public_model_for_provider(
@@ -961,7 +1002,15 @@ impl RuntimeSnapshot {
         self.provider_models
             .get(provider)
             .is_some_and(|models| models.contains_key(&upstream_model))
+            || self
+                .contributed_models()
+                .iter()
+                .any(|model| &model.provider == provider && &model.id == public_model)
             || (!self.exhaustive_provider_catalogs.contains(provider)
+                && !self
+                    .contributed_models()
+                    .iter()
+                    .any(|model| &model.id == public_model)
                 && !self.is_known_upstream_model(&upstream_model))
     }
 
@@ -969,6 +1018,10 @@ impl RuntimeSnapshot {
         self.provider_models
             .values()
             .any(|models| models.contains_key(upstream_model))
+            || self
+                .contributed_models()
+                .iter()
+                .any(|model| model.id.as_str() == upstream_model.as_str())
     }
 
     #[must_use]
@@ -988,6 +1041,24 @@ impl RuntimeSnapshot {
         provider: &ProviderKind,
         public_model: &PublicModelId,
         scope: &FrozenAccountScope,
+    ) -> bool {
+        self.native_catalog_model_allowed_for_scope(provider, public_model, scope)
+            || self.contributed_models().iter().any(|model| {
+                &model.provider == provider
+                    && &model.id == public_model
+                    && model.accounts.iter().any(|account| {
+                        scope.account_provider(account) == Some(provider)
+                            && scope
+                                .allows_model(account, &self.mapped_model(public_model.as_str()))
+                    })
+            })
+    }
+
+    fn native_catalog_model_allowed_for_scope(
+        &self,
+        provider: &ProviderKind,
+        public_model: &PublicModelId,
+        scope: &FrozenAccountScope,
     ) -> bool {
         let upstream_model = self.mapped_model(public_model.as_str());
         match self
@@ -999,7 +1070,17 @@ impl RuntimeSnapshot {
                 scope.account_provider(account) == Some(provider)
                     && scope.allows_model(account, &upstream_model)
             }),
-            None => scope.allows_provider_model(provider, &upstream_model),
+            None => {
+                // 只有插件声明的模型不能借非完整原生目录扩大到其他账号
+                let native = self.provider_models.get(provider).is_some_and(|models| {
+                    models.keys().any(|model| model.as_str() == upstream_model)
+                });
+                let contributed = self
+                    .contributed_models()
+                    .iter()
+                    .any(|model| &model.provider == provider && &model.id == public_model);
+                (native || !contributed) && scope.allows_provider_model(provider, &upstream_model)
+            }
         }
     }
 
@@ -1121,7 +1202,11 @@ impl RuntimeSnapshot {
         }
         .map_err(|_| RoutingError::InvalidIdentifier)?;
         // 归属先于账号范围、能力与路由约束判定，原 Provider 被排除不能变成跨平台透传
-        let known_model = self.is_known_upstream_model(&upstream_model);
+        let known_model = self.is_known_upstream_model(&upstream_model)
+            || self
+                .contributed_models()
+                .iter()
+                .any(|model| &model.id == public_model);
 
         let providers = context.required_provider.as_ref().map_or_else(
             || account_scope.provider_kinds().clone(),
@@ -1155,17 +1240,64 @@ impl RuntimeSnapshot {
                 .provider_models
                 .get(provider)
                 .and_then(|models| models.get(&upstream_model));
-            let emulated_features = match capabilities {
-                Some(capabilities) => {
-                    let Some(emulated) = capabilities.match_requirements(&requirements) else {
+            let contributions: Vec<_> = self
+                .contributed_models()
+                .iter()
+                .filter(|model| &model.provider == provider && &model.id == public_model)
+                .collect();
+            let mut candidate_scope = Arc::clone(&account_scope);
+            let emulated_features = if contributions.is_empty() {
+                match capabilities {
+                    Some(capabilities) => {
+                        let Some(emulated) = capabilities.match_requirements(&requirements) else {
+                            continue;
+                        };
+                        emulated
+                    }
+                    None if known_model || self.exhaustive_provider_catalogs.contains(provider) => {
                         continue;
-                    };
-                    emulated
+                    }
+                    None => BTreeSet::new(),
                 }
-                None if known_model || self.exhaustive_provider_catalogs.contains(provider) => {
+            } else {
+                let native = capabilities.and_then(|value| value.match_requirements(&requirements));
+                let capable_accounts: BTreeSet<_> = contributions
+                    .iter()
+                    .filter(|model| {
+                        model
+                            .capabilities
+                            .match_requirements(&requirements)
+                            .is_some()
+                    })
+                    .flat_map(|model| model.accounts.iter())
+                    .filter(|account| {
+                        account_scope.account_provider(account) == Some(provider)
+                            && account_scope.allows_model(account, upstream_model.as_str())
+                    })
+                    .cloned()
+                    .collect();
+                if native.is_some() {
+                    // 这些账号实际由适配器执行，不能借用同名原生模型的能力
+                    let mut restricted = account_scope.as_ref().clone();
+                    for account in contributions.iter().flat_map(|model| &model.accounts) {
+                        if !capable_accounts.contains(account) {
+                            restricted = restricted.excluding_account(account.clone());
+                        }
+                    }
+                    candidate_scope = Arc::new(restricted);
+                } else {
+                    // restricted_to 的空集合表示不收窄，因此必须先拒绝空候选
+                    if capable_accounts.is_empty() {
+                        continue;
+                    }
+                    candidate_scope = Arc::new(
+                        account_scope.restricted_to(&Default::default(), &capable_accounts),
+                    );
+                }
+                if !candidate_scope.allows_provider_model(provider, upstream_model.as_str()) {
                     continue;
                 }
-                None => BTreeSet::new(),
+                native.unwrap_or_default()
             };
             candidates.push(ProviderCandidate {
                 provider: provider.clone(),
@@ -1173,10 +1305,15 @@ impl RuntimeSnapshot {
                     .provider_model_presentations
                     .get(provider)
                     .and_then(|models| models.get(&upstream_model))
-                    .cloned(),
+                    .cloned()
+                    .or_else(|| {
+                        contributions
+                            .first()
+                            .map(|model| model.presentation.clone())
+                    }),
                 upstream_model: Some(upstream_model.clone()),
                 emulated_features,
-                account_scope: Arc::clone(&account_scope),
+                account_scope: candidate_scope,
             });
         }
 

backend/crates/gateway-core/tests/diagnostics/trace.rs

@@ -5,7 +5,7 @@ use std::{
     sync::{Arc, Mutex},
 };
 
-use gateway_core::diagnostics::{TraceContext, body_fingerprint};
+use gateway_core::diagnostics::{MAX_TRACE_SNAPSHOT_BYTES, TraceContext, body_fingerprint};
 use gateway_core::error::{ProviderDiagnostic, ProviderError, ProviderErrorKind, RawUpstreamError};
 use gateway_core::upstream::UpstreamSendState;
 use serde_json::json;
@@ -47,6 +47,7 @@ fn critical_evidence_survives_stream_pressure_and_preserves_stage_coverage() {
     );
     assert_eq!(snapshot["droppedEvidenceEvents"], 0);
     assert!(snapshot["droppedEvents"].as_u64().unwrap() > 0);
+    assert!(snapshot.to_string().len() <= MAX_TRACE_SNAPSHOT_BYTES);
 }
 
 #[test]
@@ -67,8 +68,42 @@ fn critical_evidence_has_an_independent_bound_and_reports_its_own_loss() {
         events.len() as u64 + snapshot["droppedEvents"].as_u64().unwrap(),
         100
     );
-    assert!(snapshot.to_string().len() < 128 * 1024);
+    assert!(snapshot.to_string().len() <= MAX_TRACE_SNAPSHOT_BYTES);
 }
+
+#[test]
+fn snapshot_budget_includes_stage_coverage_and_event_envelopes() {
+    let trace = TraceContext::new("req_snapshot_budget");
+    trace.record("request.routed", json!({"scope": "all"}));
+    for index in 0..10 {
+        trace.record_evidence(
+            "provider.request.input",
+            json!({"index": index, "hashes": "a".repeat(6000)}),
+        );
+    }
+    for index in 0..64 {
+        let stage = Box::leak(format!("stage.{index}.{}", "x".repeat(512)).into_boxed_str());
+        trace.record(stage, json!({"detail": "x".repeat(2000)}));
+    }
+    trace.record("request.finished", json!({"outcome": "succeeded"}));
+    let snapshot = trace.snapshot().unwrap();
+    let events = snapshot["events"].as_array().unwrap();
+    assert!(snapshot.to_string().len() <= MAX_TRACE_SNAPSHOT_BYTES);
+    assert_eq!(events.first().unwrap()["stage"], "request.routed");
+    assert_eq!(events.last().unwrap()["stage"], "request.finished");
+    assert_eq!(snapshot["droppedEvidenceEvents"], 0);
+    assert!(snapshot["droppedEvents"].as_u64().unwrap() > 0);
+    let retained: u64 = events
+        .iter()
+        .map(|event| event["count"].as_u64().unwrap())
+        .sum();
+    assert_eq!(
+        retained + snapshot["droppedEvents"].as_u64().unwrap(),
+        snapshot["totalEvents"]
+    );
+    assert_eq!(trace.snapshot(), Some(snapshot));
+}
+
 #[test]
 fn bounded_history_preserves_start_failure_and_final_result() {
     let trace = TraceContext::new("req_trace");

backend/crates/gateway-core/tests/engine/coordinator.rs

@@ -491,7 +491,6 @@ struct FinalState {
     http_version: Option<String>,
     websocket_pool: Option<String>,
     service_tier: Option<String>,
-    upstream_response_model: Option<String>,
     upstream_request_id: Option<String>,
     upstream_status_code: Option<u16>,
     transport_decision_wait_ms: Option<u64>,
@@ -682,7 +681,6 @@ impl ExecutionStore for FakeStore {
                 http_version: finalization.http_version,
                 websocket_pool: finalization.websocket_pool,
                 service_tier: finalization.service_tier,
-                upstream_response_model: finalization.upstream_response_model,
                 upstream_request_id: finalization.upstream_request_id,
                 upstream_status_code: finalization.upstream_status_code,
                 transport_decision_wait_ms: finalization.timings.transport_decision_wait_ms,
@@ -1764,7 +1762,6 @@ fn response_observation_is_persisted_but_never_delivered() {
     .with_websocket_pool(WebSocketPoolKind::New)
     .with_status_code(200)
     .with_request_id(OpaqueUpstreamValue::new("upstream-observed"))
-    .with_upstream_response_model_if_valid("gpt-returned")
     .try_with_service_tier("priority")
     .expect("service tier")
     .with_timings(ProviderResponseTimings {
@@ -1804,10 +1801,6 @@ fn response_observation_is_persisted_but_never_delivered() {
     assert_eq!(finalization.http_version.as_deref(), Some("HTTP/2"));
     assert_eq!(finalization.websocket_pool.as_deref(), Some("new"));
     assert_eq!(finalization.service_tier.as_deref(), Some("priority"));
-    assert_eq!(
-        finalization.upstream_response_model.as_deref(),
-        Some("gpt-returned")
-    );
     assert_eq!(
         finalization.upstream_request_id.as_deref(),
         Some("upstream-observed")
@@ -2083,7 +2076,6 @@ fn discarded_attempt_observation_does_not_leak_into_retry_result() {
     .with_http_version(UpstreamHttpVersion::Http11)
     .with_status_code(503)
     .with_request_id(OpaqueUpstreamValue::new("discarded-request"))
-    .with_upstream_response_model_if_valid("discarded-model")
     .with_timings(ProviderResponseTimings {
         transport_decision_wait_ms: Some(7),
         connect_ms: Some(11),
@@ -2146,7 +2138,6 @@ fn discarded_attempt_observation_does_not_leak_into_retry_result() {
 
     let state = store.state.lock().expect("store lock");
     let finalization = &state.finalizations[0];
-    assert_eq!(finalization.upstream_response_model, None);
     let trace: Value =
         serde_json::from_str(finalization.diagnostic_trace_json.as_deref().unwrap()).unwrap();
     let events = trace["events"].as_array().unwrap();

backend/crates/gateway-core/tests/engine/execution/identity.rs

@@ -0,0 +1,270 @@
+//! 身份、冻结权限与查询不建立模型执行图；实际执行才检查调用链并占用执行资源
+
+use super::*;
+use gateway_core::engine::{
+    extensions::{ExtensionCallScope, InvocationOrigin},
+    nested::{BoundModelExecutionRequest, NestedModelExecutionPort},
+};
+use gateway_core::lifecycle::CancellationToken;
+
+#[test]
+fn identity_queries_keep_frozen_permissions_without_using_execution_resources() {
+    block_on(async {
+        let snapshots = RuntimeSnapshotHandle::new(start_snapshot());
+        let store = Arc::new(TrackingExecutionStore::default());
+        let usage = Arc::new(RecordingClientApiKeyUsage::default());
+        let service = DefaultExecutionService::new(
+            snapshots.clone(),
+            store.clone(),
+            ProviderRegistry::new([Arc::new(NativeCatalogProvider {
+                fail: false,
+                empty: false,
+            }) as Arc<dyn Provider>])
+            .unwrap(),
+            Arc::new(UnusedAdmissions),
+            Arc::new(UnusedContinuation),
+            usage.clone(),
+            Arc::new(crate::RecordingDiagnostics::default()),
+        );
+        let settings = service.request_settings().unwrap();
+        let key = ClientApiKeyId::new("key_start_test").unwrap();
+        let client =
+            ClientIdentityPort::resolve_client(&service, key.clone(), Some(settings.clone()))
+                .await
+                .unwrap();
+        snapshots.publish(start_snapshot_with_policy(
+            2,
+            false,
+            RateLimits::unlimited(),
+            FastMode::Disabled,
+        ));
+        assert!(
+            client
+                .policy()
+                .account_scope()
+                .allows(&ProviderAccountId::new("acct_start").unwrap(),)
+        );
+        assert!(
+            !client
+                .policy()
+                .account_scope()
+                .allows(&ProviderAccountId::new("acct_missing").unwrap(),)
+        );
+        let models = NestedModelExecutionPort::models(
+            &service,
+            client.clone(),
+            CancellationToken::default(),
+            "codex".into(),
+            "0.154.0".into(),
+        )
+        .await
+        .unwrap();
+        assert_eq!(models, vec![PublicModelId::new("gpt-start").unwrap()]);
+        let frozen = ClientIdentityPort::resolve_client(&service, key.clone(), Some(settings))
+            .await
+            .unwrap();
+        assert_eq!(frozen.snapshot().revision().get(), 1);
+        let current = ClientIdentityPort::resolve_client(&service, key, None).await;
+        assert!(matches!(current, Err(error) if error.kind() == GatewayErrorKind::Unauthorized));
+
+        let cancellation = CancellationToken::default();
+        cancellation.cancel();
+        let cancelled = NestedModelExecutionPort::models(
+            &service,
+            client,
+            cancellation,
+            "codex".into(),
+            "0.154.0".into(),
+        )
+        .await;
+        assert!(matches!(cancelled, Err(error) if error.kind() == GatewayErrorKind::Cancelled));
+        assert!(usage.recorded().is_empty());
+        assert!(!store.touched.load(Ordering::SeqCst));
+    });
+}
+
+#[test]
+fn execution_scope_limits_apply_only_when_starting_a_model() {
+    block_on(async {
+        let store = Arc::new(TrackingExecutionStore::default());
+        let usage = Arc::new(RecordingClientApiKeyUsage::default());
+        let service = DefaultExecutionService::new(
+            RuntimeSnapshotHandle::new(start_snapshot()),
+            store.clone(),
+            ProviderRegistry::new([Arc::new(NativeCatalogProvider {
+                fail: false,
+                empty: false,
+            }) as Arc<dyn Provider>])
+            .unwrap(),
+            Arc::new(UnusedAdmissions),
+            Arc::new(UnusedContinuation),
+            usage.clone(),
+            Arc::new(crate::RecordingDiagnostics::default()),
+        );
+        let repeated = ExtensionCallScope::default()
+            .extending("entry".into())
+            .unwrap();
+        let exhausted = (0..ExtensionCallScope::MAXIMUM_DEPTH)
+            .fold(ExtensionCallScope::default(), |scope, index| {
+                scope.extending(format!("ancestor-{index}")).unwrap()
+            });
+        for extension_scope in [repeated, exhausted] {
+            let client = ClientIdentityPort::resolve_client(
+                &service,
+                ClientApiKeyId::new("key_start_test").unwrap(),
+                None,
+            )
+            .await
+            .unwrap();
+            let result = NestedModelExecutionPort::start_bound(
+                &service,
+                BoundModelExecutionRequest {
+                    client: client.clone(),
+                    initiating_plugin_instance_id: "entry".into(),
+                    cancellation: CancellationToken::default(),
+                    extension_scope,
+                    public_model: PublicModelId::new("gpt-start").unwrap(),
+                    operation: start_operation(),
+                    metadata: ExecutionRequestMetadata {
+                        protocol: "openai".into(),
+                        endpoint: "host.model".into(),
+                        transport: ClientTransport::InternalPlugin,
+                        stream: false,
+                        client_ip: None,
+                        user_agent: None,
+                        previous_response_id: None,
+                    },
+                    provider: None,
+                    account: None,
+                },
+            )
+            .await;
+            assert!(matches!(result, Err(error) if error.kind() == GatewayErrorKind::PolicyDenied));
+            let models = NestedModelExecutionPort::models(
+                &service,
+                client,
+                CancellationToken::default(),
+                "codex".into(),
+                "0.154.0".into(),
+            )
+            .await
+            .unwrap();
+            assert_eq!(models, vec![PublicModelId::new("gpt-start").unwrap()]);
+        }
+        assert!(usage.recorded().is_empty());
+        assert!(!store.touched.load(Ordering::SeqCst));
+    });
+}
+
+struct ParentAwareAuthentication {
+    calls: AtomicUsize,
+    mapped: bool,
+}
+
+impl FrontendAuthenticationPlan for ParentAwareAuthentication {
+    fn authenticate<'a>(
+        &'a self,
+        request: &'a ClientAuthenticationRequest,
+    ) -> BoxFuture<'a, Result<FrontendAuthenticationDecision, FrontendAuthenticationError>> {
+        Box::pin(async move {
+            self.calls.fetch_add(1, Ordering::SeqCst);
+            let origin = request.invocation().expect("parent invocation");
+            assert_eq!(origin.request_id, "http-request");
+            assert_eq!(origin.call_id, "http-call");
+            assert!(origin.extensions.contains("authentication-plugin"));
+            assert!(origin.effects.is_some());
+            assert!(!origin.cancellation.is_cancelled());
+            assert_eq!(request.request_context().unwrap().uri, "/plugin/proxy");
+            assert!(request.settings().is_some());
+            Ok(FrontendAuthenticationDecision::Authenticated {
+                principal: "external-principal".into(),
+            })
+        })
+    }
+
+    fn client_key_id(&self, principal: &str) -> Option<ClientApiKeyId> {
+        assert_eq!(principal, "external-principal");
+        self.mapped
+            .then(|| ClientApiKeyId::new("key_start_test").unwrap())
+    }
+
+    fn exclusive(&self) -> bool {
+        true
+    }
+}
+
+#[test]
+fn verification_keeps_parent_origin_and_requires_the_frontend_principal_mapping() {
+    block_on(async {
+        for mapped in [true, false] {
+            let authentication = FrontendAuthenticationExtensionIndex::default();
+            let plan = Arc::new(ParentAwareAuthentication {
+                calls: AtomicUsize::new(0),
+                mapped,
+            });
+            let snapshot = start_snapshot().with_extensions(Some(authentication_generation(
+                &authentication,
+                "identity-verification",
+                plan.clone(),
+            )));
+            let store = Arc::new(TrackingExecutionStore::default());
+            let usage = Arc::new(RecordingClientApiKeyUsage::default());
+            let service = DefaultExecutionService::new(
+                RuntimeSnapshotHandle::new(snapshot),
+                store.clone(),
+                ProviderRegistry::default(),
+                Arc::new(UnusedAdmissions),
+                Arc::new(UnusedContinuation),
+                usage.clone(),
+                Arc::new(crate::RecordingDiagnostics::default()),
+            )
+            .with_frontend_authentication(authentication);
+            let settings = service.request_settings().unwrap();
+            let origin = InvocationOrigin {
+                request_id: "http-request".into(),
+                call_id: "http-call".into(),
+                cancellation: CancellationToken::default(),
+                extensions: plugin_origin_scope()
+                    .extending("authentication-plugin".into())
+                    .unwrap(),
+                plan: None,
+                effects: Some(Arc::new(
+                    gateway_core::engine::nested::ExecutionEffects::default(),
+                )),
+            };
+            let mut cancelled_origin = origin.clone();
+            cancelled_origin.cancellation = CancellationToken::default();
+            cancelled_origin.cancellation.cancel();
+            let cancelled = ClientIdentityPort::verify_client(
+                &service,
+                ClientAuthenticationRequest::new("External fixture")
+                    .unwrap()
+                    .with_invocation(cancelled_origin)
+                    .with_settings(settings.clone()),
+            )
+            .await;
+            assert!(matches!(cancelled, Err(error) if error.kind() == GatewayErrorKind::Cancelled));
+            assert_eq!(plan.calls.load(Ordering::SeqCst), 0);
+            let result = ClientIdentityPort::verify_client(
+                &service,
+                ClientAuthenticationRequest::new("External fixture")
+                    .unwrap()
+                    .with_invocation(origin)
+                    .with_settings(settings.clone()),
+            )
+            .await;
+            if mapped {
+                let client = result.unwrap();
+                assert_eq!(client.policy().key_id().as_str(), "key_start_test");
+                assert_eq!(client.request_settings(), Some(&settings));
+            } else {
+                assert!(
+                    matches!(result, Err(error) if error.kind() == GatewayErrorKind::Unauthorized)
+                );
+            }
+            assert_eq!(plan.calls.load(Ordering::SeqCst), 1);
+            assert!(usage.recorded().is_empty());
+            assert!(!store.touched.load(Ordering::SeqCst));
+        }
+    });
+}

backend/crates/gateway-core/tests/engine/execution/mod.rs

@@ -1,4 +1,7 @@
 //! 执行服务的准入、预算、请求记录与终结行为测试
+
+mod identity;
+mod outbound;
 use gateway_core::routing::extensions::{ExtensionSetId, ExtensionSetLease, ExtensionSetReference};
 
 use std::{
@@ -10,6 +13,7 @@ use std::{
     time::{Duration, Instant, SystemTime},
 };
 
+use gateway_core::engine::authentication::ClientIdentityPort;
 use gateway_core::engine::budget::{ClientBudgetCharge, ClientBudgetError, ClientBudgetPort};
 use gateway_core::error::GatewayError;
 
@@ -1213,9 +1217,7 @@ fn plugin_origin_scope() -> gateway_core::engine::extensions::ExtensionCallScope
 
 #[test]
 fn explicit_key_model_execution_preserves_http_origin_and_leaves_background_origin_unknown() {
-    use gateway_core::engine::nested::{
-        BoundModelExecutionBinding, BoundModelExecutionRequest, NestedModelExecutionPort,
-    };
+    use gateway_core::engine::nested::{BoundModelExecutionRequest, NestedModelExecutionPort};
     block_on(async {
         for has_origin in [true, false] {
             let store = Arc::new(TrackingExecutionStore::default());
@@ -1232,11 +1234,17 @@ fn explicit_key_model_execution_preserves_http_origin_and_leaves_background_orig
                 Arc::new(crate::RecordingDiagnostics::default()),
             );
             let input = request(&service, ClientTransport::InternalPlugin);
-            let context = NestedModelExecutionPort::bind(
+            let client = ClientIdentityPort::resolve_client(
                 &service,
-                BoundModelExecutionBinding {
-                    settings: None,
-                    client_key_id: ClientApiKeyId::new("key_start_test").unwrap(),
+                ClientApiKeyId::new("key_start_test").unwrap(),
+                None,
+            )
+            .await
+            .unwrap();
+            let mut started = NestedModelExecutionPort::start_bound(
+                &service,
+                BoundModelExecutionRequest {
+                    client,
                     initiating_plugin_instance_id: "origin-fixture".into(),
                     cancellation: Default::default(),
                     extension_scope: if has_origin {
@@ -1244,14 +1252,6 @@ fn explicit_key_model_execution_preserves_http_origin_and_leaves_background_orig
                     } else {
                         Default::default()
                     },
-                },
-            )
-            .await
-            .unwrap();
-            let mut started = NestedModelExecutionPort::start_bound(
-                &service,
-                BoundModelExecutionRequest {
-                    context: context.clone(),
                     public_model: input.public_model,
                     operation: input.operation,
                     metadata: input.metadata,
@@ -2280,7 +2280,6 @@ impl Provider for ObservationProvider {
                     gateway_core::event::ProviderResponseObservation::new(
                         UpstreamTransport::new("http_sse").unwrap(),
                     )
-                    .with_upstream_response_model_if_valid("gpt-reported")
                     .with_service_tier_if_valid("priority"),
                 );
                 Ok(ProviderStream::new(
@@ -2613,7 +2612,6 @@ fn final_observation_is_emitted_once_for_success_rejection_and_detached_cancella
                     .map(UpstreamModelId::as_str),
                 Some("gpt-start")
             );
-            assert_eq!(observations[0].response_model(), Some("gpt-reported"));
             assert_eq!(observations[0].service_tier(), Some("priority"));
             assert_eq!(
                 observations[0].outcome(),
@@ -3304,6 +3302,7 @@ struct FailingProvider;
 
 struct NativeCatalogProvider {
     fail: bool,
+    empty: bool,
 }
 
 #[async_trait]
@@ -3334,6 +3333,9 @@ impl Provider for NativeCatalogProvider {
         if self.fail {
             return Err(gateway_core::routing::ProviderCatalogUnavailable);
         }
+        if self.empty {
+            return Ok(Some(Vec::new()));
+        }
         Ok(Some(
             ["gpt-new", "gpt-start"]
                 .into_iter()
@@ -3364,7 +3366,10 @@ impl Provider for NativeCatalogProvider {
 #[test]
 fn client_catalog_forwards_scope_maps_whole_objects_and_omits_unroutable_models() {
     #[derive(Debug)]
-    struct Aliases(Vec<gateway_core::routing::ContributedModelAlias>);
+    struct Aliases(
+        Vec<gateway_core::routing::ContributedModelAlias>,
+        Vec<gateway_core::routing::ContributedModel>,
+    );
     impl gateway_core::routing::extensions::ExtensionSetLease for Aliases {
         fn is_ready(&self) -> bool {
             true
@@ -3372,8 +3377,29 @@ fn client_catalog_forwards_scope_maps_whole_objects_and_omits_unroutable_models(
         fn model_aliases(&self) -> &[gateway_core::routing::ContributedModelAlias] {
             &self.0
         }
+        fn models(&self) -> &[gateway_core::routing::ContributedModel] {
+            &self.1
+        }
     }
-    for fail in [false, true] {
+    for (fail, empty) in [(false, false), (false, true), (true, false)] {
+        let contributed = [
+            ("gpt-start", "acct_start"),
+            ("adapted", "acct_start"),
+            ("private-model", "acct_other"),
+        ]
+        .into_iter()
+        .map(|(id, account)| gateway_core::routing::ContributedModel {
+            owner: "catalog-plugin".into(),
+            id: PublicModelId::new(id).unwrap(),
+            provider: ProviderKind::new("openai").unwrap(),
+            accounts: [ProviderAccountId::new(account).unwrap()].into(),
+            capabilities: ModelCapabilities::new([OperationKind::Generate].into(), None),
+            presentation: gateway_core::routing::ModelPresentation::new(
+                Some(format!("Plugin {id}")),
+                None,
+            ),
+        })
+        .collect();
         let snapshot = start_snapshot();
         let settings = snapshot
             .settings()
@@ -3388,20 +3414,23 @@ fn client_catalog_forwards_scope_maps_whole_objects_and_omits_unroutable_models(
             .with_extensions(Some(ExtensionSetReference::new(
                 gateway_core::routing::extensions::ExtensionSetId::new("catalog-aliases".into())
                     .unwrap(),
-                Arc::new(Aliases(vec![
-                    gateway_core::routing::ContributedModelAlias {
+                Arc::new(Aliases(
+                    vec![gateway_core::routing::ContributedModelAlias {
                         owner: "catalog-plugin".into(),
                         id: PublicModelId::new("plugin-alias").unwrap(),
                         provider: ProviderKind::new("openai").unwrap(),
                         target: UpstreamModelId::new("gpt-start").unwrap(),
-                    },
-                ])),
+                    }],
+                    contributed,
+                )),
             )));
         let service = DefaultExecutionService::new(
             RuntimeSnapshotHandle::new(snapshot),
             Arc::new(TrackingExecutionStore::default()),
-            ProviderRegistry::new([Arc::new(NativeCatalogProvider { fail }) as Arc<dyn Provider>])
-                .expect("registry"),
+            ProviderRegistry::new([
+                Arc::new(NativeCatalogProvider { fail, empty }) as Arc<dyn Provider>
+            ])
+            .expect("registry"),
             Arc::new(UnusedAdmissions),
             Arc::new(UnusedContinuation),
             Arc::new(RecordingClientApiKeyUsage::default()),
@@ -3417,8 +3446,35 @@ fn client_catalog_forwards_scope_maps_whole_objects_and_omits_unroutable_models(
             continue;
         }
         let models = result.expect("models");
+        let adapted = models
+            .iter()
+            .filter_map(|entry| match entry {
+                gateway_core::routing::PublicModelDescriptor::Adapted(profile) => {
+                    Some(profile.model().as_str())
+                }
+                _ => None,
+            })
+            .collect::<Vec<_>>();
+        assert_eq!(
+            adapted,
+            if empty {
+                vec!["gpt-start", "adapted"]
+            } else {
+                vec!["adapted"]
+            }
+        );
+        if empty {
+            assert_eq!(models.len(), 2);
+            continue;
+        }
         let pairs = models
             .iter()
+            .filter(|entry| {
+                matches!(
+                    entry,
+                    gateway_core::routing::PublicModelDescriptor::Native { .. }
+                )
+            })
             .map(|entry| {
                 let gateway_core::routing::PublicModelDescriptor::Native { model, payload } = entry
                 else {

backend/crates/gateway-core/tests/engine/execution/outbound.rs

@@ -0,0 +1,223 @@
+//! 出站插件的外部副作用在错误改写后仍约束 Engine 重放
+
+use super::*;
+use gateway_core::engine::extensions::{ExecutionExtensionIndex, ExecutionExtensionPlans};
+use gateway_core::engine::middleware::{
+    MiddlewareContext, MiddlewareError, MiddlewareMount, MiddlewareNext, MiddlewarePlan,
+    MiddlewareRequest, MiddlewareResponse, outbound,
+};
+
+#[derive(Debug)]
+struct EffectfulOutbound {
+    catch_error: bool,
+    caught: Arc<AtomicUsize>,
+}
+
+impl MiddlewarePlan for EffectfulOutbound {
+    fn has_outbound(&self, _context: &MiddlewareContext) -> bool {
+        true
+    }
+
+    fn handle_outbound(
+        &self,
+        context: MiddlewareContext,
+        _: outbound::Request,
+        _: outbound::Next,
+    ) -> BoxFuture<'static, Result<outbound::Request, MiddlewareError>> {
+        Box::pin(async move {
+            // 对应 Runtime 确认受管 HTTP 已发送后的唯一记录入口
+            context.execution_effects().unwrap().observe();
+            Err(MiddlewareError::Fault)
+        })
+    }
+
+    fn handle(
+        &self,
+        context: MiddlewareContext,
+        request: MiddlewareRequest,
+        next: MiddlewareNext,
+    ) -> BoxFuture<'static, Result<MiddlewareResponse, MiddlewareError>> {
+        let catch_error = self.catch_error && context.mount() == MiddlewareMount::Attempt;
+        if !catch_error {
+            return next.run(request);
+        }
+        let caught = Arc::clone(&self.caught);
+        Box::pin(async move {
+            let response = next.run(request).await?;
+            let (_, _, _, mut body, _) = response.into_parts();
+            body.next_frame()
+                .await
+                .expect_err("outbound preparation fails before a frame");
+            body.close().await;
+            caught.fetch_add(1, Ordering::SeqCst);
+            Err(MiddlewareError::Provider(ProviderError::new(
+                ProviderErrorKind::Transport,
+                UpstreamSendState::NotSent,
+            )))
+        })
+    }
+}
+
+struct PreparingProvider {
+    calls: AtomicUsize,
+}
+
+#[async_trait]
+impl Provider for PreparingProvider {
+    fn name(&self) -> &'static str {
+        "openai"
+    }
+    fn catalog_generation(&self) -> ProviderCatalogGeneration {
+        ProviderCatalogGeneration::default()
+    }
+    async fn query_model_capabilities(
+        &self,
+    ) -> Result<Vec<ProviderModelCapabilities>, ProviderError> {
+        Ok(vec![])
+    }
+
+    async fn execute(
+        self: Arc<Self>,
+        request: ProviderRequest,
+        context: AttemptContext,
+    ) -> Result<ProviderStream, ProviderError> {
+        self.calls.fetch_add(1, Ordering::SeqCst);
+        let provider = request.candidate().provider().clone();
+        let model = request
+            .candidate()
+            .upstream_model()
+            .map(|model| model.as_str().to_owned());
+        let account = ProviderAccountId::new("acct_openai").unwrap();
+        let pipeline = context
+            .outbound_middleware(provider.clone(), model.clone(), account.clone())
+            .unwrap();
+        let metadata = ProviderCallMetadata::new(
+            provider.clone(),
+            request.candidate().upstream_model().unwrap().clone(),
+            account.clone(),
+            UpstreamTransport::new("http").unwrap(),
+        );
+        context
+            .execute_middleware(
+                request.operation().clone(),
+                provider,
+                model,
+                account,
+                Box::new(move |_, _| {
+                    Box::pin(async move {
+                        let events = futures::stream::once(async move {
+                            Err::<ProviderEvent, _>(
+                                pipeline
+                                    .prepare(outbound::Request {
+                                        target: outbound::Target::Http {
+                                            method: http::Method::POST,
+                                            uri: "https://example.test/".parse().unwrap(),
+                                        },
+                                        headers: Vec::new(),
+                                        body: bytes::Bytes::from_static(b"request"),
+                                    })
+                                    .await
+                                    .unwrap_err(),
+                            )
+                        });
+                        Ok(ProviderStream::new(metadata, events, ()))
+                    })
+                }),
+            )
+            .await
+    }
+}
+
+struct Fixture {
+    service: DefaultExecutionService,
+    provider: Arc<PreparingProvider>,
+    observer: Arc<RecordingRequestObserver>,
+    caught: Arc<AtomicUsize>,
+    _extensions: Arc<ExecutionExtensionPlans>,
+}
+
+fn fixture(catch_error: bool) -> Fixture {
+    let provider = Arc::new(PreparingProvider {
+        calls: AtomicUsize::new(0),
+    });
+    let generation = super::super::extensions::reference("outbound-effect");
+    let extension_index = ExecutionExtensionIndex::default();
+    let caught = Arc::new(AtomicUsize::new(0));
+    let extension_owner = extension_index
+        .register(
+            generation.id().clone(),
+            Arc::new(ExecutionExtensionPlans {
+                middleware: Some(Arc::new(EffectfulOutbound {
+                    catch_error,
+                    caught: Arc::clone(&caught),
+                })),
+                upstream_adapters: None,
+            }),
+        )
+        .unwrap();
+    let observer_index = RequestObserverExtensionIndex::default();
+    let observer = Arc::new(RecordingRequestObserver::default());
+    let _observer_owner = observer_index
+        .register(generation.id().clone(), observer.clone())
+        .unwrap();
+    let providers = ProviderRegistry::new([provider.clone() as Arc<dyn Provider>]).unwrap();
+    let service = DefaultExecutionService::new(
+        RuntimeSnapshotHandle::new(fallback_observation_snapshot(generation)),
+        Arc::new(TrackingExecutionStore::default()),
+        providers,
+        Arc::new(Admissions::default()),
+        Arc::new(UnusedContinuation),
+        Arc::new(RecordingClientApiKeyUsage::default()),
+        Arc::new(crate::RecordingDiagnostics::default()),
+    )
+    .with_execution_extensions(extension_index)
+    .with_request_observers(observer_index);
+    Fixture {
+        service,
+        provider,
+        observer,
+        caught,
+        _extensions: extension_owner,
+    }
+}
+
+#[test]
+fn outbound_external_effect_is_preserved_when_preparation_fails() {
+    block_on(async {
+        let fixture = fixture(false);
+        let mut started = fixture
+            .service
+            .start(request(&fixture.service, ClientTransport::HttpJson))
+            .await
+            .unwrap();
+        assert!(
+            matches!(started.session.collect_uncommitted().await, Err(EngineError::Provider(error)) if error.kind() == ProviderErrorKind::Protocol)
+        );
+        started.session.detach_finalize().await;
+        assert_eq!(fixture.provider.calls.load(Ordering::SeqCst), 1);
+        let observations = fixture.observer.observations.lock().unwrap();
+        assert_eq!(observations[0].send_state(), UpstreamSendState::Ambiguous);
+        assert_eq!(observations[0].attempt_count(), 1);
+    });
+}
+
+#[test]
+fn attempt_cannot_hide_outbound_external_effect_with_retryable_not_sent_error() {
+    block_on(async {
+        let fixture = fixture(true);
+        let mut started = fixture
+            .service
+            .start(request(&fixture.service, ClientTransport::HttpJson))
+            .await
+            .unwrap();
+        assert!(
+            matches!(started.session.collect_uncommitted().await, Err(EngineError::Provider(error)) if error.kind() == ProviderErrorKind::Transport && !error.retry_is_prohibited())
+        );
+        started.session.detach_finalize().await;
+        assert_eq!(fixture.caught.load(Ordering::SeqCst), 1);
+        assert_eq!(fixture.provider.calls.load(Ordering::SeqCst), 1);
+        let observations = fixture.observer.observations.lock().unwrap();
+        assert_eq!(observations[0].send_state(), UpstreamSendState::Ambiguous);
+        assert_eq!(observations[0].attempt_count(), 1);
+    });
+}

backend/crates/gateway-core/tests/engine/extensions.rs

@@ -3,7 +3,7 @@
 use std::sync::Arc;
 
 use gateway_core::engine::extensions::{ExecutionExtensionIndex, ExecutionExtensionPlans};
-use gateway_core::engine::upstream_adapter::{UpstreamAdapter, UpstreamAdapterPlan};
+use gateway_core::engine::upstream_adapter::{UpstreamAdapterPlan, UpstreamAdapterSelection};
 use gateway_core::routing::extensions::{ExtensionSetId, ExtensionSetLease, ExtensionSetReference};
 use gateway_core::{
     engine::AttemptContext, error::ProviderError, identity::ProviderKind, routing::UpstreamModelId,
@@ -31,8 +31,9 @@ impl UpstreamAdapterPlan for EmptyAdapterPlan {
         _: &AttemptContext,
         _: &ProviderKind,
         _: &UpstreamModelId,
-    ) -> Result<Option<Arc<dyn UpstreamAdapter>>, ProviderError> {
-        Ok(None)
+        _: Option<&gateway_core::account::ProviderAccountId>,
+    ) -> Result<UpstreamAdapterSelection, ProviderError> {
+        Ok(UpstreamAdapterSelection::Native)
     }
 }
 
@@ -89,3 +90,89 @@ fn execution_index_does_not_own_registered_generations() {
     assert!(index.middleware(&reference).is_none());
     assert!(index.upstream_adapters(&reference).is_none());
 }
+
+#[derive(Debug, Default)]
+struct AccountSelectionProbe(std::sync::Mutex<Vec<Option<String>>>);
+
+impl UpstreamAdapterPlan for AccountSelectionProbe {
+    fn select(
+        &self,
+        _: &AttemptContext,
+        _: &ProviderKind,
+        _: &UpstreamModelId,
+        account: Option<&gateway_core::account::ProviderAccountId>,
+    ) -> Result<UpstreamAdapterSelection, ProviderError> {
+        self.0
+            .lock()
+            .unwrap()
+            .push(account.map(|account| account.as_str().into()));
+        Ok(UpstreamAdapterSelection::Native)
+    }
+}
+
+#[test]
+fn adapter_preselection_follows_only_the_current_attempt_account_owner() {
+    use gateway_core::{
+        account::{AccountSelectionPolicy, ProviderAccountId, RotationStrategy},
+        engine::continuation::{ContinuationBinding, NativeContinuationPin, PreviousResponseId},
+        engine::upstream_adapter::FrozenUpstreamAdapterPlan,
+        engine::{
+            AccountAttemptContext, ContinuationAttempt, ModelRequestId, RequestAttemptContext,
+        },
+        lifecycle::CancellationToken,
+        policy::ClientApiKeyId,
+    };
+    use std::{
+        num::NonZeroU32,
+        time::{Duration, SystemTime},
+    };
+
+    let provider = ProviderKind::new("openai").unwrap();
+    let model = UpstreamModelId::new("model").unwrap();
+    let key = ClientApiKeyId::new("key").unwrap();
+    let pin = NativeContinuationPin::new(
+        PreviousResponseId::new("public"),
+        PreviousResponseId::new("upstream"),
+        key.clone(),
+        provider.clone(),
+        ProviderAccountId::new("acct_pinned").unwrap(),
+    );
+    for (attempt, required, expected) in [
+        (ContinuationAttempt::Native, None, Some("acct_pinned")),
+        (ContinuationAttempt::ReplayAny, None, None),
+        (ContinuationAttempt::None, None, None),
+        (
+            ContinuationAttempt::Native,
+            Some("acct_required"),
+            Some("acct_required"),
+        ),
+    ] {
+        let probe = Arc::new(AccountSelectionProbe::default());
+        let context = AttemptContext::new(
+            RequestAttemptContext::new(
+                ModelRequestId::new("req_account_plan").unwrap(),
+                key.clone(),
+            )
+            .with_upstream_adapters(Some(FrozenUpstreamAdapterPlan::new(
+                probe.clone(),
+                reference("account-plan"),
+            ))),
+            NonZeroU32::MIN,
+            SystemTime::now() + Duration::from_secs(5),
+            AccountSelectionPolicy::new(RotationStrategy::RoundRobin, NonZeroU32::MIN),
+            AccountAttemptContext::new(
+                Default::default(),
+                required.map(|id| ProviderAccountId::new(id).unwrap()),
+                None,
+            ),
+            Some(ContinuationBinding::Pinned(pin.clone())),
+            CancellationToken::new(),
+        )
+        .with_continuation_attempt(attempt);
+        assert!(matches!(
+            context.upstream_adapter(&provider, &model).unwrap(),
+            UpstreamAdapterSelection::Native
+        ));
+        assert_eq!(*probe.0.lock().unwrap(), vec![expected.map(str::to_owned)]);
+    }
+}

backend/crates/gateway-core/tests/engine/middleware/mod.rs

@@ -1,6 +1,7 @@
 //! 请求中间件的改写、交付状态与发布代次持有测试
 
 mod cold;
+mod outbound;
 
 use std::num::NonZeroU32;
 use std::sync::Arc;

backend/crates/gateway-core/tests/engine/middleware/outbound.rs

@@ -0,0 +1,303 @@
+//! 出站准备链的返回顺序、预算、生命周期与不可修改归属
+
+use super::*;
+use gateway_core::account::{AccountSelectionPolicy, RotationStrategy};
+use gateway_core::engine::middleware::outbound::{Pipeline, Request, Target};
+use gateway_core::engine::{AccountAttemptContext, AttemptContext, RequestAttemptContext};
+use gateway_core::error::ProviderErrorKind;
+use gateway_core::upstream::UpstreamSendState;
+
+#[derive(Debug, Clone, Copy)]
+enum Action {
+    Forward,
+    Rewrite,
+    Oversize,
+    SwitchTransport,
+    Reject,
+    Pending,
+    Cancel,
+}
+
+#[derive(Debug)]
+struct PreparingPlan {
+    action: Action,
+    calls: Arc<AtomicUsize>,
+}
+
+impl MiddlewarePlan for PreparingPlan {
+    fn has_outbound(&self, context: &MiddlewareContext) -> bool {
+        context.model() == Some("gpt-test")
+    }
+
+    fn handle_outbound(
+        &self,
+        context: MiddlewareContext,
+        request: Request,
+        next: gateway_core::engine::middleware::outbound::Next,
+    ) -> BoxFuture<'static, Result<Request, MiddlewareError>> {
+        assert_eq!(context.mount(), MiddlewareMount::Outbound);
+        assert_eq!(context.provider().unwrap().as_str(), "openai");
+        assert_eq!(context.account_id().unwrap().as_str(), "acct_middleware");
+        assert_eq!(context.model(), Some("gpt-test"));
+        assert_eq!(context.attempt_index(), NonZeroU32::new(2));
+        assert_eq!(context.request_id().as_str(), "req_outbound");
+        assert_eq!(context.client_key_id().as_str(), "key_outbound");
+        assert!(context.plan().is_some());
+        self.calls.fetch_add(1, Ordering::SeqCst);
+        let action = self.action;
+        Box::pin(async move {
+            let mut request = next.run(request).await?;
+            match action {
+                Action::Forward => (),
+                Action::Rewrite => {
+                    let mut body = request.body.to_vec();
+                    body.extend_from_slice(b"-after-next");
+                    request.body = body.into();
+                    request
+                        .headers
+                        .push(MiddlewareHeader::new("x-raw", Bytes::from_static(&[0x80])));
+                }
+                Action::Oversize => request.body = Bytes::from_static(b"too large"),
+                Action::SwitchTransport => {
+                    request.target = Target::WebSocket {
+                        uri: "wss://example.test/".parse().unwrap(),
+                    }
+                }
+                Action::Reject => return Err(MiddlewareError::Rejected),
+                Action::Pending => return futures::future::pending().await,
+                Action::Cancel => {
+                    context.cancellation().cancel();
+                    return futures::future::pending().await;
+                }
+            }
+            Ok(request)
+        })
+    }
+
+    fn handle(
+        &self,
+        _: MiddlewareContext,
+        request: MiddlewareRequest,
+        next: MiddlewareNext,
+    ) -> BoxFuture<'static, Result<MiddlewareResponse, MiddlewareError>> {
+        next.run(request)
+    }
+}
+
+fn pipeline(
+    action: Action,
+    limit: usize,
+    cancellation: CancellationToken,
+    deadline: SystemTime,
+) -> (Pipeline, Arc<AtomicUsize>) {
+    let (attempt, calls) = attempt(action, limit, cancellation, deadline);
+    (
+        attempt
+            .outbound_middleware(
+                ProviderKind::new("openai").unwrap(),
+                Some("gpt-test".into()),
+                ProviderAccountId::new("acct_middleware").unwrap(),
+            )
+            .unwrap(),
+        calls,
+    )
+}
+
+fn attempt(
+    action: Action,
+    limit: usize,
+    cancellation: CancellationToken,
+    deadline: SystemTime,
+) -> (AttemptContext, Arc<AtomicUsize>) {
+    let calls = Arc::new(AtomicUsize::new(0));
+    let plan = FrozenMiddlewarePlan::new(
+        Arc::new(PreparingPlan {
+            action,
+            calls: Arc::clone(&calls),
+        }),
+        ExtensionSetReference::new(
+            ExtensionSetId::new("outbound-test".into()).unwrap(),
+            Arc::new(ReadyGeneration),
+        ),
+    );
+    let request = RequestAttemptContext::new(
+        ModelRequestId::new("req_outbound").unwrap(),
+        ClientApiKeyId::new("key_outbound").unwrap(),
+    )
+    .with_request_body_limit(limit)
+    .with_middleware(
+        Some(plan),
+        Arc::from([]),
+        "/v1/responses".into(),
+        ClientTransport::HttpJson,
+    );
+    let attempt = AttemptContext::new(
+        request,
+        NonZeroU32::new(2).unwrap(),
+        deadline,
+        AccountSelectionPolicy::new(RotationStrategy::Smart, NonZeroU32::new(1).unwrap()),
+        AccountAttemptContext::new(Default::default(), None, None),
+        None,
+        cancellation,
+    );
+    (attempt, calls)
+}
+
+fn request() -> Request {
+    Request {
+        target: Target::Http {
+            method: http::Method::POST,
+            uri: "https://example.test/path?secret=private".parse().unwrap(),
+        },
+        headers: vec![MiddlewareHeader::new("x-raw", Bytes::from_static(b"first"))],
+        body: Bytes::from_static(&[0, 255, 0, 128]),
+    }
+}
+
+#[test]
+fn outbound_returns_outer_rewrite_after_next_without_decoding_body() {
+    let (pipeline, calls) = pipeline(
+        Action::Rewrite,
+        128,
+        CancellationToken::new(),
+        SystemTime::now() + Duration::from_secs(1),
+    );
+    let prepared = futures::executor::block_on(pipeline.prepare(request())).unwrap();
+    assert_eq!(
+        prepared.body.as_ref(),
+        &[
+            0, 255, 0, 128, b'-', b'a', b'f', b't', b'e', b'r', b'-', b'n', b'e', b'x', b't'
+        ]
+    );
+    let headers = prepared.header_map().unwrap();
+    assert_eq!(
+        headers
+            .get_all("x-raw")
+            .iter()
+            .map(http::HeaderValue::as_bytes)
+            .collect::<Vec<_>>(),
+        vec![b"first".as_slice(), &[0x80]]
+    );
+    assert_eq!(calls.load(Ordering::SeqCst), 1);
+}
+
+#[test]
+fn outbound_checks_final_body_limit_without_repair_or_retry() {
+    let (pipeline, _) = pipeline(
+        Action::Oversize,
+        4,
+        CancellationToken::new(),
+        SystemTime::now() + Duration::from_secs(1),
+    );
+    let error = futures::executor::block_on(pipeline.prepare(request())).unwrap_err();
+    assert_eq!(error.kind(), ProviderErrorKind::InvalidRequest);
+    assert_eq!(error.send_state(), UpstreamSendState::NotSent);
+    assert!(error.retry_is_prohibited());
+}
+
+#[test]
+fn outbound_cannot_switch_transport_kind() {
+    let (pipeline, _) = pipeline(
+        Action::SwitchTransport,
+        128,
+        CancellationToken::new(),
+        SystemTime::now() + Duration::from_secs(1),
+    );
+    let error = futures::executor::block_on(pipeline.prepare(request())).unwrap_err();
+    assert_eq!(error.kind(), ProviderErrorKind::InvalidRequest);
+    assert!(error.retry_is_prohibited());
+}
+
+#[test]
+fn outbound_rejection_is_terminal_and_not_sent() {
+    let (pipeline, _) = pipeline(
+        Action::Reject,
+        128,
+        CancellationToken::new(),
+        SystemTime::now() + Duration::from_secs(1),
+    );
+    let error = futures::executor::block_on(pipeline.prepare(request())).unwrap_err();
+    assert_eq!(error.kind(), ProviderErrorKind::RequestPolicyDenied);
+    assert_eq!(error.send_state(), UpstreamSendState::NotSent);
+    assert!(error.retry_is_prohibited());
+}
+
+#[test]
+fn outbound_cancelled_attempt_never_enters_middleware() {
+    let cancelled = CancellationToken::new();
+    cancelled.cancel();
+    let (pipeline, calls) = pipeline(
+        Action::Forward,
+        128,
+        cancelled,
+        SystemTime::now() + Duration::from_secs(1),
+    );
+    let error = futures::executor::block_on(pipeline.prepare(request())).unwrap_err();
+    assert_eq!(error.kind(), ProviderErrorKind::Cancelled);
+    assert_eq!(calls.load(Ordering::SeqCst), 0);
+}
+
+#[test]
+fn outbound_deadline_drops_a_pending_preparation() {
+    let (pipeline, calls) = pipeline(
+        Action::Pending,
+        128,
+        CancellationToken::new(),
+        SystemTime::now() + Duration::from_secs(1),
+    );
+    let error = futures::executor::block_on(pipeline.prepare(request())).unwrap_err();
+    assert_eq!(error.kind(), ProviderErrorKind::Timeout);
+    assert_eq!(calls.load(Ordering::SeqCst), 1);
+    assert!(error.retry_is_prohibited());
+}
+
+#[test]
+fn outbound_header_conversion_rejects_invalid_bytes_without_retry() {
+    let mut request = request();
+    request.headers.push(MiddlewareHeader::new(
+        "x-invalid",
+        Bytes::from_static(b"bad\r\nvalue"),
+    ));
+    let error = request.header_map().unwrap_err();
+    assert_eq!(error.send_state(), UpstreamSendState::NotSent);
+    assert!(error.retry_is_prohibited());
+}
+
+#[test]
+fn outbound_debug_does_not_expose_uri_headers_or_body() {
+    let debug = format!("{:?}", request());
+    assert!(!debug.contains("private"));
+    assert!(!debug.contains("first"));
+    assert!(!debug.contains("255"));
+}
+
+#[test]
+fn outbound_cancellation_stops_an_in_flight_preparation() {
+    let (pipeline, calls) = pipeline(
+        Action::Cancel,
+        128,
+        CancellationToken::new(),
+        SystemTime::now() + Duration::from_secs(1),
+    );
+    let error = futures::executor::block_on(pipeline.prepare(request())).unwrap_err();
+    assert_eq!(error.kind(), ProviderErrorKind::Cancelled);
+    assert_eq!(calls.load(Ordering::SeqCst), 1);
+    assert!(error.retry_is_prohibited());
+}
+
+#[test]
+fn outbound_scope_miss_keeps_the_provider_on_its_native_path() {
+    let (attempt, calls) = attempt(
+        Action::Reject,
+        0,
+        CancellationToken::new(),
+        SystemTime::now() + Duration::from_secs(1),
+    );
+    let pipeline = attempt.outbound_middleware(
+        ProviderKind::new("openai").unwrap(),
+        Some("unmatched".into()),
+        ProviderAccountId::new("acct_middleware").unwrap(),
+    );
+    assert!(pipeline.is_none());
+    assert_eq!(calls.load(Ordering::SeqCst), 0);
+}

backend/crates/gateway-core/tests/routing/snapshot.rs

@@ -99,6 +99,247 @@ struct CountingExtensionPreparation {
 
 struct AliasLease(Vec<ContributedModelAlias>);
 
+struct ModelLease(Vec<gateway_core::routing::ContributedModel>);
+
+#[test]
+fn same_name_native_and_adapted_sources_keep_account_capabilities_separate() {
+    use gateway_core::{
+        account::{AccountModelAccess, AccountModelAccessMode, ProviderAccountId},
+        operation::{Feature, GenerateRequest, Operation, ProtocolPayload},
+        routing::{ContributedModel, SupportLevel},
+    };
+    struct Catalog;
+    impl ProviderCatalogPort for Catalog {
+        fn catalog_generations(&self) -> BTreeMap<ProviderKind, ProviderCatalogGeneration> {
+            [(
+                ProviderKind::new("alpha").unwrap(),
+                ProviderCatalogGeneration::new(1),
+            )]
+            .into()
+        }
+        fn query_model_capabilities(
+            &self,
+            _: &ProviderKind,
+        ) -> BoxFuture<'_, Result<Vec<ProviderModelCapabilities>, ProviderCatalogUnavailable>>
+        {
+            Box::pin(async {
+                Ok(vec![
+                    ProviderModelCapabilities::new(
+                        UpstreamModelId::new("shared-model").unwrap(),
+                        super::capabilities().with_feature(Feature::Tools, SupportLevel::Native),
+                    )
+                    .with_catalog_accounts([ProviderAccountId::new("acct_a").unwrap()].into())
+                    .with_presentation(ModelPresentation::new(Some("Native".into()), None)),
+                ])
+            })
+        }
+    }
+    let id = PublicModelId::new("shared-model").unwrap();
+    let b = ProviderAccountId::new("acct_b").unwrap();
+    let mut contribution = ContributedModel {
+        owner: "fixture".into(),
+        id: id.clone(),
+        provider: ProviderKind::new("alpha").unwrap(),
+        accounts: [b.clone()].into(),
+        capabilities: super::capabilities(),
+        presentation: ModelPresentation::new(Some("Adapted".into()), None),
+    };
+    let facts = SnapshotFacts::new(
+        revision(1),
+        revision(1),
+        super::settings(),
+        vec![],
+        vec![],
+        ["acct_a", "acct_b", "acct_c"]
+            .into_iter()
+            .map(|id| {
+                SnapshotProviderAccountFacts::new(ProviderAccountId::new(id).unwrap(), "alpha")
+                    .with_model_access(
+                        AccountModelAccess::new(
+                            AccountModelAccessMode::Allowlist,
+                            vec![
+                                if id == "acct_c" {
+                                    "other"
+                                } else {
+                                    "shared-model"
+                                }
+                                .into(),
+                            ],
+                        )
+                        .unwrap(),
+                    )
+            })
+            .collect(),
+        vec![],
+    );
+    let native = block_on(
+        RuntimeSnapshotCompiler::new(
+            Arc::new(TestSnapshotStore::new(Ok(facts))),
+            Arc::new(Catalog),
+        )
+        .compile(),
+    )
+    .unwrap();
+    let scope = native.all_account_scope();
+    let b_only = Arc::new(scope.restricted_to(&Default::default(), &[b.clone()].into()));
+    assert!(native.public_models_for_scope(&b_only).is_empty());
+    let snapshot = native.with_extensions(Some(ExtensionSetReference::new(
+        ExtensionSetId::new("adapted".into()).unwrap(),
+        Arc::new(ModelLease(vec![contribution.clone()])),
+    )));
+    assert_eq!(snapshot.public_models_for_scope(&b_only), vec![id.clone()]);
+    assert_eq!(
+        snapshot.public_model_profiles_for_scope(&b_only)[0].presentation(),
+        &contribution.presentation
+    );
+    let plan = snapshot
+        .plan(
+            &id,
+            &super::operation(),
+            b_only.clone(),
+            &Default::default(),
+        )
+        .unwrap();
+    assert!(plan.candidates()[0].account_scope().allows(&b));
+    let tools = Operation::Generate(GenerateRequest::from_protocol_payload(
+        ProtocolPayload::json_object(
+            "openai",
+            serde_json::json!({"model":"shared-model","tools":[{"type":"function","name":"test"}]})
+                .as_object()
+                .unwrap()
+                .clone(),
+        )
+        .unwrap(),
+    ));
+    assert!(
+        snapshot
+            .plan(&id, &tools, b_only, &Default::default())
+            .is_err()
+    );
+    let plan = snapshot
+        .plan(&id, &tools, scope.clone(), &Default::default())
+        .unwrap();
+    assert!(
+        plan.candidates()[0]
+            .account_scope()
+            .allows(&ProviderAccountId::new("acct_a").unwrap())
+    );
+    assert!(!plan.candidates()[0].account_scope().allows(&b));
+    contribution.accounts = [ProviderAccountId::new("acct_c").unwrap()].into();
+    let denied = snapshot.with_extensions(Some(ExtensionSetReference::new(
+        ExtensionSetId::new("denied".into()).unwrap(),
+        Arc::new(ModelLease(vec![contribution])),
+    )));
+    let c_only = Arc::new(scope.restricted_to(
+        &Default::default(),
+        &[ProviderAccountId::new("acct_c").unwrap()].into(),
+    ));
+    assert!(denied.public_models_for_scope(&c_only).is_empty());
+    assert!(
+        denied
+            .plan(&id, &super::operation(), c_only, &Default::default())
+            .is_err()
+    );
+}
+
+impl ExtensionSetLease for ModelLease {
+    fn is_ready(&self) -> bool {
+        true
+    }
+    fn models(&self) -> &[gateway_core::routing::ContributedModel] {
+        &self.0
+    }
+}
+
+#[test]
+fn native_model_without_presentation_cannot_borrow_an_unauthorized_plugin_profile() {
+    let snapshot = super::snapshot().with_extensions(Some(ExtensionSetReference::new(
+        ExtensionSetId::new("private-profile".into()).unwrap(),
+        Arc::new(ModelLease(vec![gateway_core::routing::ContributedModel {
+            owner: "fixture".into(),
+            id: PublicModelId::new("gpt-5.5").unwrap(),
+            provider: ProviderKind::new("openai").unwrap(),
+            accounts: [gateway_core::account::ProviderAccountId::new("acct_private").unwrap()]
+                .into(),
+            capabilities: super::capabilities(),
+            presentation: ModelPresentation::new(Some("Private model".into()), None),
+        }])),
+    )));
+    assert!(
+        snapshot
+            .public_model_profiles_for_scope(&super::account_scope())
+            .is_empty()
+    );
+}
+
+#[test]
+fn adapted_models_limit_visibility_and_routing_to_capable_authorized_accounts() {
+    use gateway_core::{
+        account::ProviderAccountId,
+        operation::{Feature, GenerateRequest, Operation, ProtocolPayload},
+        routing::{ContributedModel, SupportLevel},
+    };
+    let account = ProviderAccountId::new("acct_openai").unwrap();
+    let provider = ProviderKind::new("openai").unwrap();
+    let id = PublicModelId::new("adapted-model").unwrap();
+    let contribution = ContributedModel {
+        owner: "fixture".into(),
+        id: id.clone(),
+        provider,
+        accounts: [account.clone()].into(),
+        capabilities: super::capabilities(),
+        presentation: ModelPresentation::new(Some("Adapted".into()), None),
+    };
+    let snapshot = super::snapshot().with_extensions(Some(ExtensionSetReference::new(
+        ExtensionSetId::new("models".into()).unwrap(),
+        Arc::new(ModelLease(vec![contribution.clone()])),
+    )));
+    let scope = super::account_scope();
+    assert!(snapshot.public_models_for_scope(&scope).contains(&id));
+    assert!(
+        snapshot
+            .public_model_profiles_for_scope(&scope)
+            .iter()
+            .any(|p| p.model() == &id)
+    );
+    let plan = snapshot
+        .plan(&id, &super::operation(), scope.clone(), &Default::default())
+        .unwrap();
+    assert_eq!(plan.candidates().len(), 1);
+    assert!(plan.candidates()[0].account_scope().allows(&account));
+    let other = Arc::new(scope.restricted_to(
+        &Default::default(),
+        &[ProviderAccountId::new("acct_xai").unwrap()].into(),
+    ));
+    assert!(!snapshot.public_models_for_scope(&other).contains(&id));
+    assert!(
+        snapshot
+            .plan(&id, &super::operation(), other, &Default::default())
+            .is_err()
+    );
+    let tools = Operation::Generate(GenerateRequest::from_protocol_payload(
+        ProtocolPayload::json_object("openai", serde_json::json!({"model":"adapted-model","input":[],"tools":[{"type":"function","name":"test","parameters":{}}]}).as_object().unwrap().clone()).unwrap(),
+    ));
+    assert!(
+        snapshot
+            .plan(&id, &tools, scope.clone(), &Default::default())
+            .is_err()
+    );
+    let mut supported = contribution;
+    supported.capabilities = supported
+        .capabilities
+        .with_feature(Feature::Tools, SupportLevel::Native);
+    let capable = snapshot.with_extensions(Some(ExtensionSetReference::new(
+        ExtensionSetId::new("capable".into()).unwrap(),
+        Arc::new(ModelLease(vec![supported])),
+    )));
+    assert!(
+        capable
+            .plan(&id, &tools, scope, &Default::default())
+            .is_ok()
+    );
+}
+
 impl ExtensionSetLease for AliasLease {
     fn is_ready(&self) -> bool {
         true

backend/crates/gateway-host/Cargo.toml

@@ -29,7 +29,7 @@ percent-encoding = "2.3.2"
 reqwest = { version = "=0.12.28", default-features = false, features = ["json", "stream", "rustls-tls-native-roots", "socks"] }
 rustls = { version = "=0.23.46", default-features = false, features = ["aws_lc_rs", "std", "tls12"] }
 rustls-native-certs = "=0.8.3"
-scraper = "0.27.0"
+scraper = "0.29.0"
 semver = "1.0.27"
 secrecy = "0.10.3"
 serde = { version = "1.0.228", features = ["derive"] }

backend/crates/gateway-plugin/runtime/Cargo.toml

@@ -24,7 +24,7 @@ gateway-plugin-sdk = { path = "../sdk", features = ["io"] }
 gateway-protocol = { path = "../../gateway-protocol" }
 hex = "0.4.3"
 image = { version = "0.25.8", default-features = false, features = ["bmp", "gif", "ico", "jpeg", "png", "webp"] }
-jsonschema = { version = "0.58.4", default-features = false }
+jsonschema = { version = "0.60.0", default-features = false }
 roxmltree = "0.21.1"
 semver = "1.0.27"
 secrecy = "0.10.3"

backend/crates/gateway-plugin/runtime/plugin-host-compatibility.json

@@ -1,15 +1,15 @@
 {
   "schema_version": 2,
   "manifest_schema_versions": [2],
-  "protocol_versions": [5],
+  "protocol_versions": [7],
   "capabilities": [
     { "capability": "frontend_authentication", "versions": [2] },
     { "capability": "scheduler", "versions": [3] },
     { "capability": "model_router", "versions": [2] },
-    { "capability": "model_catalog", "versions": [1] },
+    { "capability": "model_catalog", "versions": [1, 2] },
     { "capability": "retry_policy", "versions": [2] },
-    { "capability": "middleware", "versions": [5] },
-    { "capability": "upstream_adapter", "versions": [4] },
+    { "capability": "middleware", "versions": [6] },
+    { "capability": "upstream_adapter", "versions": [5] },
     { "capability": "observer", "versions": [2] },
     { "capability": "command_line", "versions": [1] },
     { "capability": "management", "versions": [2] },

backend/crates/gateway-plugin/runtime/src/adapter/catalog.rs

@@ -1,29 +1,49 @@
 //! 编译插件模型目录贡献并校验能力绑定
 
-use std::time::Duration;
-
 use gateway_admin::model::{
     AdminError,
     plugins::instances::{PluginCapabilityBinding, PluginInstance},
 };
-use gateway_core::routing::{ContributedModelAlias, ProviderKind, PublicModelId, UpstreamModelId};
-use gateway_plugin_sdk::{Capability, Manifest, Stage, call::catalog::ModelCatalogRegistration};
+use gateway_core::{
+    account::ProviderAccountId,
+    operation::{Feature, OperationKind},
+    routing::{
+        ContributedModel, ContributedModelAlias, ModelCapabilities, ModelPresentation,
+        ProviderKind, PublicModelId, SupportLevel, UpstreamModelId,
+    },
+};
+use gateway_plugin_sdk::{
+    Capability, Manifest, Stage,
+    call::{
+        catalog::{ModelCatalogRegistration, ModelCatalogRegistrationV2},
+        middleware::RequestFeature,
+    },
+};
 
 use crate::RpcSession;
 
+pub(crate) struct PreparedCatalog {
+    pub(crate) aliases: Vec<ContributedModelAlias>,
+    pub(crate) models: Vec<ContributedModel>,
+}
+
 pub(crate) async fn prepare(
     manifest: &Manifest,
     instance: &PluginInstance,
     session: &RpcSession,
-) -> Result<Vec<ContributedModelAlias>, AdminError> {
+    adapters: &[super::upstream_adapter::AdapterEntry],
+) -> Result<PreparedCatalog, AdminError> {
     if !manifest.contributes.contains_key(&Capability::ModelCatalog) {
-        return Ok(Vec::new());
+        return Ok(PreparedCatalog {
+            aliases: Vec::new(),
+            models: Vec::new(),
+        });
     }
     validate_bindings(manifest, &instance.bindings)?;
     let reply = session
         .call(
             "model_catalog.register",
-            session.context(Stage::Registration, Duration::from_secs(5)),
+            session.context(Stage::Registration, session.budget(Stage::Registration)),
             serde_json::json!({}),
             Vec::new(),
         )
@@ -32,13 +52,19 @@ pub(crate) async fn prepare(
     if reply.payload.len() > 64 * 1024 {
         return Err(AdminError::invalid("插件模型目录信封无效或过大"));
     }
-    let registration: ModelCatalogRegistration = serde_json::from_slice(&reply.payload)
-        .map_err(|_| AdminError::invalid("插件模型目录声明无效"))?;
-    if registration.models.len() > 256 {
-        return Err(AdminError::invalid("单个插件最多贡献 256 个模型别名"));
+    let (aliases, models) = if manifest.contributes[&Capability::ModelCatalog].version == 2 {
+        let registration: ModelCatalogRegistrationV2 = serde_json::from_slice(&reply.payload)
+            .map_err(|_| AdminError::invalid("插件模型目录声明无效"))?;
+        (registration.aliases, registration.models)
+    } else {
+        let registration: ModelCatalogRegistration = serde_json::from_slice(&reply.payload)
+            .map_err(|_| AdminError::invalid("插件模型目录声明无效"))?;
+        (registration.models, Vec::new())
+    };
+    if aliases.len().saturating_add(models.len()) > 256 {
+        return Err(AdminError::invalid("单个插件最多贡献 256 个模型条目"));
     }
-    registration
-        .models
+    let aliases = aliases
         .into_iter()
         .map(|model| {
             let id = PublicModelId::new(model.id)
@@ -52,7 +78,79 @@ pub(crate) async fn prepare(
                     .map_err(|_| AdminError::invalid("模型别名目标无效"))?,
             })
         })
-        .collect()
+        .collect::<Result<_, AdminError>>()?;
+    let models = models
+        .into_iter()
+        .map(|model| {
+            let mut targets = adapters
+                .iter()
+                .filter_map(|entry| entry.catalog_target(&model.adapter_id, &model.id));
+            let target = targets
+                .next()
+                .filter(|_| targets.next().is_none())
+                .ok_or_else(|| AdminError::invalid("适配模型必须关联同实例的静态账号适配器"))?;
+            let mut capabilities =
+                ModelCapabilities::new([OperationKind::Generate].into(), model.max_output_tokens);
+            for feature in model.features {
+                let feature = match feature {
+                    RequestFeature::Tools => Feature::Tools,
+                    RequestFeature::Vision => Feature::Vision,
+                    RequestFeature::Reasoning => Feature::Reasoning,
+                    RequestFeature::JsonSchema => Feature::JsonSchema,
+                };
+                capabilities = capabilities.with_feature(feature, SupportLevel::Native);
+            }
+            let p = model.presentation;
+            Ok(ContributedModel {
+                owner: instance.id.clone(),
+                id: PublicModelId::new(model.id)
+                    .map_err(|_| AdminError::invalid("适配模型 ID 无效"))?,
+                provider: ProviderKind::new(target.provider.as_str())
+                    .map_err(|_| AdminError::invalid("适配模型 Provider 无效"))?,
+                accounts: target
+                    .account_ids
+                    .iter()
+                    .map(|id| {
+                        ProviderAccountId::new(id.clone())
+                            .map_err(|_| AdminError::invalid("适配模型账号无效"))
+                    })
+                    .collect::<Result<_, _>>()?,
+                capabilities,
+                presentation: ModelPresentation::new(p.display_name, p.description)
+                    .with_reasoning(p.default_reasoning_effort, p.supported_reasoning_efforts)
+                    .with_context_window_tokens(p.context_window_tokens)
+                    .with_max_context_window_tokens(p.max_context_window_tokens)
+                    .with_image_input(p.image_input)
+                    .with_agent_tools(p.agent_tools, p.parallel_tool_calls)
+                    .with_search_tool(p.search_tool)
+                    .with_image_detail_original(p.image_detail_original)
+                    .with_verbosity(p.verbosity)
+                    .with_hidden(p.hidden),
+            })
+        })
+        .collect::<Result<_, AdminError>>()?;
+    Ok(PreparedCatalog { aliases, models })
+}
+
+/// 新目录的同名画像必须一致，不由注册顺序拼接能力或改变别名目标
+pub(crate) fn validate_models(
+    aliases: &[ContributedModelAlias],
+    models: &[ContributedModel],
+) -> Result<(), AdminError> {
+    for (index, model) in models.iter().enumerate() {
+        if aliases.iter().any(|alias| alias.id == model.id)
+            || models[..index].iter().any(|other| {
+                other.id == model.id
+                    && (other.provider != model.provider
+                        || other.presentation != model.presentation
+                        || other.capabilities != model.capabilities
+                        || !other.accounts.is_disjoint(&model.accounts))
+            })
+        {
+            return Err(AdminError::invalid("适配模型目录声明冲突"));
+        }
+    }
+    Ok(())
 }
 
 pub(crate) fn validate_bindings(

backend/crates/gateway-plugin/runtime/src/adapter/command_line/execution.rs

@@ -48,12 +48,13 @@ impl PluginCommandSession {
         let payload = serde_json::to_vec(&invocation)
             .map_err(|_| AdminError::invalid("插件命令参数无法编码"))?;
         let mut saved_accounts = 0;
+        let deadline = tokio::time::Instant::now() + command.session.budget(Stage::CommandLine);
         let result = tokio::select! {
             biased;
             () = cancellation.cancelled() => Ok(Err("调用已取消")),
-            result = tokio::time::timeout(
-                self.limits.maximum_call_timeout,
-                command.execute(payload, self.limits, &mut saved_accounts),
+            result = tokio::time::timeout_at(
+                deadline,
+                command.execute(payload, self.limits, deadline, &mut saved_accounts),
             ) => result,
         };
         match result {
@@ -76,11 +77,14 @@ impl PluginCommand {
         &self,
         payload: Vec<u8>,
         limits: RpcLimits,
+        deadline: tokio::time::Instant,
         saved_accounts: &mut usize,
     ) -> Result<PluginCommandOutput, &'static str> {
-        let mut context = self
-            .session
-            .context(Stage::CommandLine, limits.maximum_call_timeout);
+        let remaining = deadline.saturating_duration_since(tokio::time::Instant::now());
+        if remaining.is_zero() {
+            return Err("超过命令总期限");
+        }
+        let mut context = self.session.context(Stage::CommandLine, remaining);
         context.request_id = Some(uuid::Uuid::new_v4().to_string());
         let scope = self
             .callbacks
@@ -135,6 +139,7 @@ fn rpc_failure(error: RpcError) -> &'static str {
         }
         RpcError::Capacity | RpcError::Overloaded => "插件调用容量不足",
         RpcError::Context(_) => "调用上下文无效",
+        RpcError::Budget(_) => "调用预算冲突",
         RpcError::Remote(_) => "插件拒绝命令",
     }
 }

backend/crates/gateway-plugin/runtime/src/adapter/command_line/registration.rs

@@ -4,7 +4,7 @@ use super::PluginCommand;
 use crate::{RpcSession, callback::PluginCallbacks};
 use gateway_admin::model::{AdminError, plugins::instances::PluginInstance};
 use gateway_plugin_sdk::{Capability, Manifest, Stage, call::management::CommandRegistration};
-use std::{sync::Arc, time::Duration};
+use std::sync::Arc;
 
 const MAXIMUM_REGISTRATION_BYTES: usize = 64 * 1024;
 
@@ -23,7 +23,7 @@ pub(crate) async fn prepare(
     let reply = session
         .call(
             "command_line.register",
-            session.context(Stage::Registration, Duration::from_secs(5)),
+            session.context(Stage::Registration, session.budget(Stage::Registration)),
             serde_json::json!({}),
             Vec::new(),
         )

backend/crates/gateway-plugin/runtime/src/adapter/frontend_authentication.rs

@@ -1,6 +1,6 @@
 //! 编译插件客户端认证绑定，并将认证结果映射为宿主身份
 
-use std::{collections::BTreeMap, sync::Arc, time::Duration};
+use std::{collections::BTreeMap, sync::Arc};
 
 use futures::future::BoxFuture;
 use gateway_admin::model::{
@@ -26,8 +26,6 @@ use gateway_plugin_sdk::{
 
 use crate::{RpcSession, callback::PluginCallbacks};
 
-const IDENTIFIER_TIMEOUT: Duration = Duration::from_secs(5);
-
 #[derive(Clone)]
 pub(crate) struct FrontendAuthenticationEntry {
     identities: BTreeMap<String, ClientApiKeyId>,
@@ -47,7 +45,7 @@ pub(crate) async fn prepare_entry(
     let reply = session
         .call(
             "frontend_auth.identifier",
-            session.context(Stage::Registration, IDENTIFIER_TIMEOUT),
+            session.context(Stage::Registration, session.budget(Stage::Registration)),
             serde_json::json!({}),
             Vec::new(),
         )
@@ -167,19 +165,16 @@ fn valid_identifier(value: &str) -> bool {
 
 pub(crate) struct PluginFrontendAuthenticationPlan {
     entry: FrontendAuthenticationEntry,
-    timeout: Duration,
 }
 
 impl PluginFrontendAuthenticationPlan {
     pub(crate) fn compile(
         mut entries: Vec<FrontendAuthenticationEntry>,
-        maximum_call_timeout: Duration,
     ) -> Result<Option<Arc<Self>>, AdminError> {
         match entries.len() {
             0 => Ok(None),
             1 => Ok(Some(Arc::new(Self {
                 entry: entries.pop().expect("one entry was checked"),
-                timeout: maximum_call_timeout.min(Duration::from_secs(30)),
             }))),
             _ => Err(AdminError::invalid("同一发布集合只能启用一个入口认证插件")),
         }
@@ -197,23 +192,32 @@ impl FrontendAuthenticationPlan for PluginFrontendAuthenticationPlan {
                 .invocation
                 .as_ref()
                 .ok_or(FrontendAuthenticationError)?;
-            let mut context = session.context(Stage::Authentication, self.timeout);
+            let mut context =
+                session.context(Stage::Authentication, session.budget(Stage::Authentication));
             context.request = crate::adapter::request_context(request.request_context());
+            context.request_id = request.invocation().map(|origin| origin.request_id.clone());
             let _scope = callbacks
-                .prepare_frontend_authentication(&context, request.shared_request_context())
+                .prepare_frontend_authentication(&context, request)
                 .map_err(|_| FrontendAuthenticationError)?;
             let input = FrontendAuthenticationRequest {
                 authorization: request.authorization().to_owned(),
             };
-            let reply = session
-                .call(
-                    "frontend_auth.authenticate",
-                    context,
-                    serde_json::json!({}),
-                    serde_json::to_vec(&input).map_err(|_| FrontendAuthenticationError)?,
-                )
-                .await
-                .map_err(|_| FrontendAuthenticationError)?;
+            let invocation = session.call(
+                "frontend_auth.authenticate",
+                context,
+                serde_json::json!({}),
+                serde_json::to_vec(&input).map_err(|_| FrontendAuthenticationError)?,
+            );
+            let reply = if let Some(origin) = request.invocation() {
+                tokio::select! {
+                    biased;
+                    () = origin.cancellation.cancelled() => return Err(FrontendAuthenticationError),
+                    reply = invocation => reply,
+                }
+            } else {
+                invocation.await
+            }
+            .map_err(|_| FrontendAuthenticationError)?;
             let result: FrontendAuthenticationResult =
                 serde_json::from_slice(&reply.payload).map_err(|_| FrontendAuthenticationError)?;
             match result {

backend/crates/gateway-plugin/runtime/src/adapter/management/callback.rs

@@ -165,9 +165,10 @@ impl ManagementEntry {
         {
             return Err(invalid_state());
         }
-        let mut context = self
-            .session
-            .context(Stage::PublicManagement, limits.maximum_call_timeout);
+        let mut context = self.session.context(
+            Stage::PublicManagement,
+            self.session.budget(Stage::PublicManagement),
+        );
         context.request = crate::adapter::request_context(request.request_context.as_deref());
         context.request_id = Some(request.request_id);
         let _scope = self