feat: record owner decisions in control console (#285)

Co-authored-by: Codex <noreply@openai.com>

Author: Pigbibi

docs/qsl_unified_control_console_architecture_v1.zh-CN.md

@@ -62,7 +62,7 @@ Worker 以**独立于 dispatch token 的同步身份**接收来源快照、按 `
 
 - P1–P3 的异常显示为机器可处理的 `DEFERRED` / `PARKED`，下一有效交易日可重试；一次数据源中断不应作废整年研究。
 - P4/P5 只显示预先写入策略的自动评估状态，不显示“AI 立即改参”按钮。
-- 只有阶段为 P6、状态为 `owner_decision_required` 且建议为 `owner_live_decision` 的候选才进入所有者队列。人可选择确认、保持暂停或退役候选；页面先创建审计化的**决策意图**，不直接调用券商。
+- 只有阶段为 P6、状态为 `owner_decision_required` 且建议为 `owner_live_decision` 的候选才进入所有者队列。人可选择确认受限试运行意图、保持暂停或退役候选；页面创建并校验 `qsl_owner_decision_intent.v1`，绑定当前候选证据指纹，不直接调用券商。证据、候选或阶段变化后，旧意图不会匹配，必须重新决定。
 
 ### 3. P6 决策适配器（最后做）
 

schemas/qsl-owner-decision-intent.v1.schema.json

@@ -0,0 +1,34 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://quantstrategylab.github.io/QuantRuntimeSettings/schemas/qsl-owner-decision-intent.v1.schema.json",
+  "title": "QSL Owner Decision Intent v1",
+  "description": "A signed-by-digest, no-order owner decision intent. It is not execution authority.",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "schema_version",
+    "candidate_id",
+    "candidate_kind",
+    "domain",
+    "decision",
+    "decided_at",
+    "decided_by",
+    "candidate_evidence_sha256",
+    "no_order",
+    "execution_authority_granted",
+    "decision_sha256"
+  ],
+  "properties": {
+    "schema_version": { "const": "qsl_owner_decision_intent.v1" },
+    "candidate_id": { "type": "string", "pattern": "^[A-Za-z0-9._=-]{1,128}$" },
+    "candidate_kind": { "enum": ["individual", "portfolio", "plugin"] },
+    "domain": { "enum": ["us_equity", "hk_equity", "cn_equity", "crypto"] },
+    "decision": { "enum": ["approve_limited_live_canary", "keep_parked", "retire_candidate"] },
+    "decided_at": { "type": "string", "format": "date-time", "maxLength": 64 },
+    "decided_by": { "type": "string", "pattern": "^[a-z0-9](?:[a-z0-9-]{0,37}[a-z0-9])?$" },
+    "candidate_evidence_sha256": { "type": "string", "pattern": "^[0-9a-f]{64}$" },
+    "no_order": { "const": true },
+    "execution_authority_granted": { "const": false },
+    "decision_sha256": { "type": "string", "pattern": "^[0-9a-f]{64}$" }
+  }
+}

tests/strategy_switch_worker_validation.mjs

@@ -2057,6 +2057,118 @@ assert.deepEqual(sourceControlPayload.summary, { candidate_count: 1, deferred: 0
 assert.deepEqual(sourceControlPayload.attention, { status: "research_only", reason_codes: [] });
 assert.equal(sourceControlPayload.candidates[0].candidate_id, "tqqq_core_only_p2_v5");
 
+const ownerDecisionStore = new Map();
+const ownerDecisionKv = {
+  async get(key) { return ownerDecisionStore.get(key) || null; },
+  async put(key, value) { ownerDecisionStore.set(key, value); },
+  async list({ prefix = "", limit = 1000 } = {}) {
+    return {
+      keys: [...ownerDecisionStore.keys()]
+        .filter((key) => key.startsWith(prefix))
+        .slice(0, limit)
+        .map((name) => ({ name })),
+    };
+  },
+};
+const ownerDecisionEnv = {
+  ...controlEnv,
+  STRATEGY_SWITCH_CONFIG: ownerDecisionKv,
+  ALLOWED_GITHUB_LOGINS: "owner-admin,owner-reader",
+  STRATEGY_SWITCH_ADMIN_LOGINS: "owner-admin",
+};
+const ownerAdminCookie = await __test.makeSession("owner-admin", [], ownerDecisionEnv);
+const ownerReaderCookie = await __test.makeSession("owner-reader", [], ownerDecisionEnv);
+const ownerAdminHeaders = { Cookie: `qsl_switch_session=${ownerAdminCookie}` };
+const ownerReaderHeaders = { Cookie: `qsl_switch_session=${ownerReaderCookie}` };
+const ownerDecisionPayload = {
+  ...controlPayload,
+  generated_at: controlNow,
+  computed_at: controlNow,
+  candidates: [{
+    ...controlPayload.candidates[0],
+    candidate_id: "soxl_core_only_p2_v7",
+    lifecycle: { stage: "P6", status: "owner_decision_required" },
+    evidence: {
+      p1_input_digest: "1".repeat(64),
+      p2_config_digest: "2".repeat(64),
+      p3_evidence_id: "3".repeat(64),
+      source_revision: "4".repeat(40),
+    },
+    recommendation: { code: "owner_live_decision", reason: "P4/P5 evidence is current; owner decision required." },
+    freshness: { status: "fresh", age_seconds: 0 },
+  }],
+};
+const ownerDecisionSync = await worker.fetch(
+  new Request("https://switch.example/api/internal/sync-control-plane", {
+    method: "POST",
+    headers: { Authorization: `Bearer ${controlSyncValue}`, "Content-Type": "application/json" },
+    body: JSON.stringify(ownerDecisionPayload),
+  }),
+  ownerDecisionEnv,
+);
+assert.equal(ownerDecisionSync.status, 200);
+
+const ownerDecisionQueue = await worker.fetch(
+  new Request("https://switch.example/api/owner-decisions", { headers: ownerAdminHeaders }),
+  ownerDecisionEnv,
+);
+assert.equal(ownerDecisionQueue.status, 200);
+const ownerDecisionQueuePayload = await ownerDecisionQueue.json();
+assert.equal(ownerDecisionQueuePayload.data_status, "ready");
+assert.equal(ownerDecisionQueuePayload.candidates.length, 1);
+assert.equal(ownerDecisionQueuePayload.candidates[0].intent, null);
+assert.equal(ownerDecisionQueuePayload.policy.execution_authority_granted, false);
+const ownerDecisionRequest = {
+  candidate_id: "soxl_core_only_p2_v7",
+  decision: "keep_parked",
+  candidate_evidence_sha256: ownerDecisionQueuePayload.candidates[0].candidate_evidence_sha256,
+};
+
+const readerDecision = await worker.fetch(
+  new Request("https://switch.example/api/owner-decisions", {
+    method: "POST",
+    headers: { ...ownerReaderHeaders, Origin: "https://switch.example", "Content-Type": "application/json" },
+    body: JSON.stringify(ownerDecisionRequest),
+  }),
+  ownerDecisionEnv,
+);
+assert.equal(readerDecision.status, 403);
+
+const ownerDecisionWrite = await worker.fetch(
+  new Request("https://switch.example/api/owner-decisions", {
+    method: "POST",
+    headers: { ...ownerAdminHeaders, Origin: "https://switch.example", "Content-Type": "application/json" },
+    body: JSON.stringify(ownerDecisionRequest),
+  }),
+  ownerDecisionEnv,
+);
+assert.equal(ownerDecisionWrite.status, 200);
+const ownerDecisionWritePayload = await ownerDecisionWrite.json();
+assert.equal(ownerDecisionWritePayload.intent.decision, "keep_parked");
+assert.equal(ownerDecisionWritePayload.intent.no_order, true);
+assert.equal(ownerDecisionWritePayload.intent.execution_authority_granted, false);
+assert.ok(ownerDecisionStore.has("owner_decision_current:soxl_core_only_p2_v7"));
+assert.ok(ownerDecisionStore.has(
+  `owner_decision_intent:soxl_core_only_p2_v7:${ownerDecisionWritePayload.intent.decision_sha256}`,
+));
+
+const recordedOwnerDecisionQueue = await worker.fetch(
+  new Request("https://switch.example/api/owner-decisions", { headers: ownerAdminHeaders }),
+  ownerDecisionEnv,
+);
+const recordedOwnerDecisionPayload = await recordedOwnerDecisionQueue.json();
+assert.equal(recordedOwnerDecisionPayload.candidates[0].intent.decision, "keep_parked");
+
+const staleDecision = await worker.fetch(
+  new Request("https://switch.example/api/owner-decisions", {
+    method: "POST",
+    headers: { ...ownerAdminHeaders, Origin: "https://switch.example", "Content-Type": "application/json" },
+    body: JSON.stringify({ ...ownerDecisionRequest, candidate_evidence_sha256: "0".repeat(64) }),
+  }),
+  ownerDecisionEnv,
+);
+assert.equal(staleDecision.status, 409);
+
 const conflictingSourceSync = await worker.fetch(
   new Request("https://switch.example/api/internal/sync-control-plane-source", {
     method: "POST",

web/strategy-switch-console/README.md

@@ -68,6 +68,14 @@ audit_log
 
 Without the KV binding, `/admin` is read-only and the Worker falls back to `ALLOWED_GITHUB_LOGINS`, `ALLOWED_GITHUB_ORGS`, `STRATEGY_SWITCH_ADMIN_LOGINS`, `STRATEGY_SWITCH_ADMIN_ORGS`, and `STRATEGY_SWITCH_ACCOUNT_OPTIONS_JSON`.
 
+## Web Owner Decisions (P6 intent)
+
+Only a fresh P6 candidate with `owner_decision_required` and an `owner_live_decision` recommendation appears in the owner-decision area. Console administrators can record one of three choices: approve a limited-canary intent, keep the candidate parked, or retire it.
+
+`POST /api/owner-decisions` stores a `qsl_owner_decision_intent.v1` bound to the current P1/P2/P3/revision evidence fingerprint. It retains an immutable, SHA-256-addressed KV record, a current-record index, and an audit entry. If the candidate, stage, or evidence changes, the old intent no longer matches the queue and the owner must decide again.
+
+This is not an execution API: every intent is fixed as `no_order=true` and `execution_authority_granted=false`. It does not dispatch a workflow, call a platform or broker, change funds, or enable Live. Only a future independent deterministic execution gateway may consume an intent after it verifies all current P4/P5/P6 conditions.
+
 ## Page Asset
 
 `worker.js` serves `web/strategy-switch-console/index.html` through `page_asset.js` and the fallback live-enabled strategy catalog through `strategy_profiles_asset.js`.

web/strategy-switch-console/README.zh-CN.md

@@ -176,6 +176,14 @@ GET  /api/control-plane
 
 这个接口不是订单、paper、shadow 或 live API。`CONTROL_PLANE_SYNC_TOKEN` 必须与 OAuth、workflow dispatch、策略 root 和任何券商凭证完全分离。部署 workflow 会在 `runtime-strategy-switch` environment 提供该 secret 时，把它同步为 Worker secret；每个来源仓库需要保存同一值到其专用 GitHub Environment，URL 使用只读控制台的 `/api/internal/sync-control-plane-source`。
 
+## 网页人工审批（P6 决策意图）
+
+当且仅当候选仍是**新鲜**的 P6 `owner_decision_required`、机器建议仍为 `owner_live_decision` 时，控制台会在“全局概览”显示人工决定区。只有管理员可以选择：批准受限试运行意图、保持暂停或退役候选。
+
+提交到 `POST /api/owner-decisions` 的是 `qsl_owner_decision_intent.v1`：它绑定当前候选的 P1/P2/P3/版本证据指纹，按 SHA-256 留存不可变 KV 记录，并维护当前记录索引和审计日志。证据、候选或阶段变化后，旧记录不会匹配新队列，必须重新决定。
+
+固定边界：该记录始终是 `no_order=true`、`execution_authority_granted=false`。它不会调用 workflow、平台 API、券商、资金或订单，也不会自动启用 Live。未来只有独立的确定性执行网关验证所有当前 P4/P5/P6 条件后，才可能消费这种意图；在那之前它只是网页人工审核记录。
+
 ## 策略 Profile 对齐规范
 
 `strategy_profile` 是切换页、runtime settings 和各平台仓库之间的统一策略 ID。

web/strategy-switch-console/app.css

@@ -382,6 +382,51 @@
       font-size: 27px;
     }
 
+    .owner-decision {
+      display: grid;
+      gap: 7px;
+      margin-top: 14px;
+      padding-top: 13px;
+      border-top: 1px solid var(--line);
+    }
+
+    .owner-decision strong {
+      font-size: 12px;
+    }
+
+    .owner-decision small {
+      color: var(--muted);
+      font-size: 11px;
+      line-height: 1.5;
+    }
+
+    .owner-decision__actions {
+      display: flex;
+      flex-wrap: wrap;
+      gap: 7px;
+    }
+
+    .owner-decision__button {
+      padding: 7px 9px;
+      border: 1px solid var(--line-strong);
+      border-radius: 7px;
+      background: var(--surface);
+      color: var(--ink);
+      font: inherit;
+      font-size: 11px;
+      cursor: pointer;
+    }
+
+    .owner-decision__button:hover:not(:disabled) {
+      border-color: var(--accent);
+      color: var(--accent);
+    }
+
+    .owner-decision__button:disabled {
+      cursor: wait;
+      opacity: 0.62;
+    }
+
     .health-card__empty {
       grid-column: 1 / -1;
       padding: 30px 18px;