feat: govern workforce optimization with DecisionWorkspace (#98)

## Summary - teach the workforce optimization Skill to use the canonical DecisionWorkspace human/Agent governance flow - declare DecisionWorkspace and OptimizationSolve capabilities while retaining MindOptSolve compatibility - document exact-revision artifact lineage, guarded execution, independent validation, and human approval - preserve the external MindOpt deployment, license, cost, and secret boundaries ## Validation - full i18n validation - translation freshness check - validator unit tests (9/9) - git diff check ## Compatibility Requires DesireCore 10.0.127 or newer. --------- Co-authored-by: yige <yige@yigedeMacBook-Neo.local>
2026-09-05 18:43:51 +08:00 · 2026-08-29 10:48:56 -04:00
parent 3059468526
commit a625b5ec84
3 changed files with 48 additions and 30 deletions
--- a/manifest.json
+++ b/manifest.json
@@ -1,6 +1,6 @@
 {
  "name": "DesireCore Official Market",
-  "version": "1.2.29",
+  "version": "1.2.30",
  "schemaVersion": "1.1.0",
  "supportedLocales": ["zh-CN", "en-US"],
  "defaultLocale": "en-US",
@@ -28,7 +28,7 @@
  "stats": {
    "totalAgents": 1,
    "totalSkills": 62,
-    "lastUpdated": "2026-08-25"
+    "lastUpdated": "2026-08-29"
  },
  "features": [
    "curated-index",
--- a/skills/workforce-optimization/SKILL.md
+++ b/skills/workforce-optimization/SKILL.md
@@ -1,10 +1,10 @@
 ---
 name: workforce-optimization
 description: >-
-  Structure, predict, compile, solve, independently validate, and recover workforce-efficiency optimization through versioned multi-agent artifacts and a governed solver connector. MindOptSolve is only a connector Tool: the MindOpt solver software, applicable license, separate deployment, and related fees are external and not bundled. Use for service-coverage design, hierarchical resource allocation, performance targets, centralized task scheduling, staffing, shifts, or general LP/MILP. 用户提到人效、服务范围、资源划分、绩效目标、任务调度、排班、运筹优化或 LP/MILP 时使用；MindOpt 软件、适用许可证、独立部署及费用不随本技能或客户端提供。
+  Use this Skill when a user naturally asks about workforce efficiency, staffing, shifts, service coverage, hierarchical resource allocation, performance targets, centralized task scheduling, operations research, or general LP/MILP. Govern the request through DecisionWorkspace, versioned multi-agent artifacts, guarded compile/solve, independent validation, and human approval. MindOptSolve is only a compatible connector Tool: the MindOpt solver software, applicable license, separate deployment, and related fees are external and not bundled. 用户自然提到人效、人员配置、排班、服务范围、资源划分、绩效目标、任务调度、运筹优化或 LP/MILP 时使用；通过 DecisionWorkspace、人机确认、版本化制品、受保护求解、独立验收和真人批准完成治理；MindOpt 软件、适用许可证、独立部署及费用不随本技能或客户端提供。
 compatibility: >-
  Requires a separately installed or deployed MindOpt solver, a valid license obtained under the official terms, and configured solver.mindopt connections; commercial licenses and operating costs are purchased separately when applicable. 需要外部安装或部署 MindOpt、按官方条款取得有效许可证并配置 solver.mindopt 连接；适用的商业许可及运行费用需另行采购承担。
-version: 2.3.3
+version: 2.3.4
 type: procedural
 risk_level: medium
 status: enabled
@@ -16,22 +16,16 @@ tags:
  - multi-agent
 provides:
  tools:
+    - DecisionWorkspace
    - TeamArtifact
    - OptimizationPredict
    - OptimizationCompile
+    - OptimizationSolve
    - MindOptSolve
    - OptimizationValidate
-requires:
-  connections:
-    - solver.mindopt.endpoint
-    - solver.mindopt.server-name
-    - solver.mindopt.token
-    - solver.mindopt.ca
-    - solver.mindopt.client-cert
-    - solver.mindopt.client-key
 metadata:
  author: workforce-optimization-team
-  updated_at: '2026-08-08'
+  updated_at: '2026-08-29'
  i18n:
    default_locale: en-US
    source_locale: zh-CN
@@ -40,19 +34,19 @@ metadata:
      - en-US
    zh-CN:
      name: 人效与资源优化
-      short_desc: 梳理、求解并验收人效优化；实际求解需外部授权部署 MindOpt
+      short_desc: 用决策工作区共管人效建模、受保护求解与独立验收；MindOpt 需外部授权部署
      description: >-
-        将服务范围、分层资源分配、绩效目标、集中任务调度、人员配置、排班和通用 LP/MILP 需求转成可恢复的场景、预测、模型、求解与独立验收制品。实际求解依赖使用方另行取得适用许可证、部署并接入 MindOpt；客户端和本技能不包含求解器软件、许可证、算力托管或相关费用。
+        当用户自然提出服务范围、分层资源分配、绩效目标、集中任务调度、人员配置、排班或通用 LP/MILP 需求时，通过 DecisionWorkspace 的人机确认、精确版本制品、入口 Agent 绑定、同伴审阅、执行门禁、独立验收和真人批准形成可恢复治理链。选择 MindOpt 引擎时，实际求解仍依赖使用方另行取得适用许可证、部署并接入 MindOpt；客户端和本技能不包含求解器软件、许可证、算力托管或相关费用。
      body: ./SKILL.zh-CN.md
-      source_hash: sha256:2f741e8223a8c203
+      source_hash: sha256:63c40f1123d9fc31
      translated_by: human
    en-US:
      name: Workforce and Resource Optimization
-      short_desc: Structure and validate workforce optimization; solving requires externally licensed MindOpt
+      short_desc: Co-manage workforce models, guarded solving, and independent validation; MindOpt is externally licensed
      description: >-
-        Turn requests for service coverage, hierarchical resource allocation, performance targets, centralized task scheduling, staffing, shift planning, and general LP/MILP into recoverable scenario, prediction, model, solution, and independent-validation artifacts. Actual solving requires the user to obtain an applicable license, deploy MindOpt, and configure the connector; the client and this Skill do not include the solver, license, hosted compute, or related fees.
+        When users naturally request service coverage, hierarchical resource allocation, performance targets, centralized task scheduling, staffing, shift planning, or general LP/MILP, use DecisionWorkspace human confirmation, exact-version artifacts, entry Agent binding, peer review, execution guards, independent validation, and human approval to create a recoverable governance chain. When MindOpt is selected, actual solving still requires the user to obtain an applicable license, deploy MindOpt, and configure its connector; the client and this Skill do not include the solver, license, hosted compute, or related fees.
      body: ./SKILL.md
-      source_hash: sha256:2f741e8223a8c203
+      source_hash: sha256:63c40f1123d9fc31
      translated_by: human
 market:
  icon: >-
@@ -63,7 +57,7 @@ market:
    verified: true
  compatible_agents: []
  channel: latest
-  required_client_version: 10.0.99
+  required_client_version: 10.0.127
 ---

 # Workforce and Resource Optimization
@@ -77,6 +71,7 @@ Turn natural-language workforce-efficiency requests into reviewable and recovera
 ## L1

 - Treat `MindOptSolve` only as a governed connector/adapter to a MindOpt service supplied by the user or operator. Never describe MindOpt itself as an included or built-in Tool.
+- The platform retains direct personal `MindOptSolve` and compile-option overrides only as a backward-compatible, non-decision-grade expert path outside this Skill's governed team workflow. Never present an unbound personal call as reviewed, human-confirmed, recoverable, or decision-grade; team runs must use the guarded `OptimizationSolve` path and solver limits recorded in the committed specification.
 - Before promising or requesting an actual solve, verify that the external connector is configured and ready, required capabilities are available, and the deployment has a valid applicable license. A registered Tool name alone is not evidence that the solver is installed, licensed, reachable, or paid for.
 - If the external dependency is unavailable, state which prerequisite is missing and stop before the solver call. You may still finish requirement clarification and produce reviewable `SceneSpec`, `DataContract`, and `OptimizationSpec` artifacts for later execution, but must not fabricate a `SolveResult`, feasibility, optimality, or benefit claim.
 - Before routing or modeling, the natural-language entry Agent must read the [requirement-clarification framework](references/requirement-clarification-framework.md) in full and follow its real-decision, mandatory-question, and conditional-question branches.
@@ -87,9 +82,19 @@ Turn natural-language workforce-efficiency requests into reviewable and recovera
 - Treat relative business-time expressions such as today, tomorrow, the next N days, or this quarter as `pending_confirmation` until the current request confirms the business timezone, business calendar, date-time anchor, and applicable day-boundary, cutoff, holiday, and overnight rules. A system clock or host timezone is environment evidence, not a business rule.
 - Isolate every new request from historical contamination. Facts from another conversation, Plan, artifact, memory, or sample remain `pending_confirmation` until the user explicitly carries them into the current request; do not search for or reuse a semantically similar Plan as evidence for the first response.
 - Use one entry Agent for routing, consolidated questions, and final delivery. Assign one owner to each stage.
- For the full path, publish `SceneSpec`, `DataContract`, `PredictionArtifact`, `OptimizationSpec`, `SolveResult`, `ValidationReport`, and `DeliveryBundle` in dependency order through `TeamArtifact`.
+- After the fact-confirmation gate passes, follow this governed sequence without skipping or reordering its control points:
+  1. The entry Agent reads the needed `DecisionWorkspace(action="schema")` sections and each `TeamArtifact(action="schema")` contract before constructing writes.
+  2. The entry Agent creates the team DecisionWorkspace or submits CAS-protected proposals in business language; proposals never manufacture human receipts.
+  3. The user confirms or rejects blocking facts only through the platform's dedicated human controls. A rejection remains an auditable inactive tombstone. All Agents wait for the authoritative result.
+  4. Only the top-level entry Agent calls `DecisionWorkspace(action="bind_workspace")` for the validated current workspace revision and model-input hash. Specialists may not bind, replace, or bypass it.
+  5. The assigned stage owner publishes `SceneSpec`, `DataContract`, optional `PredictionArtifact`, `OptimizationSpec`, `SolveResult`, `ValidationReport`, and `DeliveryBundle` in dependency order through `TeamArtifact`, retaining the returned exact artifact revision and DecisionWorkspace snapshot.
+  6. The entry Agent calls `DecisionWorkspace(action="link_artifact")` with the exact artifact ID, exact revision, and semantic bindings; never resolve governed evidence through `latest`.
+  7. Submit the linked revision for peer review. An independent reviewer checks business-to-model coverage, units, variable families, feasibility logic, provenance, gaps, and stale/rejected exclusions before execution.
+  8. Invoke `OptimizationCompile` and then `OptimizationSolve`; both must pass the platform's DecisionWorkspace execution guard before side effects. `MindOptSolve` remains a compatible connector name and must never be called directly to bypass the guarded solve path.
+  9. A validation owner independent from the solver owner calls `OptimizationValidate` and recomputes domains, hard constraints, objective, baseline delta, and IIS traceability from raw values.
+  10. The user approves only through the platform's dedicated human approval control after the exact linked chain passes review and independent validation. No Agent or specialist may create that approval.
 - When training data exists, call `OptimizationPredict`; use ordered holdout, train-only imputation, tuning, metrics, baseline comparison, and explicit fallback rules.
- Compile general models with `OptimizationCompile`, solve once with `MindOptSolve`, and retain status, variables, objective, request/job IDs, HTTPS transport, solver evidence, and IIS when infeasible.
+- Compile general models with `OptimizationCompile`, solve once through guarded `OptimizationSolve`, and retain status, variables, objective, request/job IDs, HTTPS transport, selected-engine evidence, and IIS when infeasible.
 - Require the validation owner to call `OptimizationValidate` and recompute variable domains, hard constraints, objective, baseline delta, and IIS traceability from raw values.
 - Treat every settled successful Tool call as authoritative. After an interruption, synthesize the persisted result without repeating the Tool.

@@ -98,9 +103,10 @@ Turn natural-language workforce-efficiency requests into reviewable and recovera
 - Until the fact-confirmation gate passes, clarify only: do not publish modeling artifacts, call a solver, delegate a solver-capable Agent, or fill hidden conditions with defaults, simulations, or industry convention.
 - Interaction mode changes terminology, grouping, per-turn batch size, and example depth only. It never changes fact states, mandatory information, triggered conditions, the modeling-confirmation summary, or the stop gate. The user's explicit choice in the current request overrides historical preference; switching mode preserves confirmed facts and continues with every remaining item.
 - If the user cannot confirm an item, deliver the gap, model impact, required owner/data, and optional reduced scope. Never interpret an omitted answer as absent, false, zero, or unlimited.
- Use the fast path only when the user supplied a complete `OptimizationSpec`: one solve delegation, one validation delegation, then an entry-owned `DeliveryBundle`.
+- Use the fast path only when the user supplied a complete `OptimizationSpec`. It may omit unnecessary scene, prediction, or data-authoring work, but it must still create/propose the governed DecisionWorkspace representation, obtain every required dedicated human confirmation, bind the current revision, publish and link exact revisions, pass peer review and execution guards, delegate one solve and one independent validation, and wait for dedicated human approval before an entry-owned `DeliveryBundle` is decision-grade.
 - Use the full path when objectives, constraints, data definitions, or predictive inputs still need modeling. Never advance a stage before its declared dependencies are complete.
 - Do not invent unknown business weights, relax hard constraints silently, treat missing values as zero, or describe an unvalidated solution as executable.
- Non-entry Agents place missing information in the team question queue. Only the entry Agent asks the user.
- Obtain connector secrets only from declared connection references. Never request, reveal, or persist tokens, CA material, client certificates, private keys, endpoints, SSH commands, or tunnels in artifacts.
+- Non-entry Agents place missing information in the team question queue. The queue is only a coordination signal: it cannot carry a human answer or receipt. Only the entry Agent asks the user, and model-changing answers become authoritative only through the dedicated DecisionWorkspace human confirmation controls.
+- Specialists must not ask the user directly, bind a workspace, forge confirm/reject/approval receipts, publish outside their owned stage, link a mutable `latest`, bypass compile/solve guards, validate their own solve, or silently retry side effects. They report gaps and evidence to the entry Agent, which owns all user-facing questions and consolidated delivery.
+- Connector credentials are resolved internally by SolverConnector from configured secret references. This Skill deliberately declares no `requires.connections`, so solver tokens, CA material, client certificates, and private keys are never injected into Bash. Never request, reveal, persist, or pass them through shell commands, artifacts, endpoints, SSH commands, or tunnels.
 - If the solver reports infeasible, preserve and explain its IIS; if validation fails, deliver the failure and violated checks instead of modifying variables or re-solving.
--- a/skills/workforce-optimization/SKILL.zh-CN.md
+++ b/skills/workforce-optimization/SKILL.zh-CN.md
@@ -11,6 +11,7 @@
 ## L1

 - `MindOptSolve` 只能视为连接使用方或运维方所提供 MindOpt 服务的受治理 Connector/Adapter；不得把 MindOpt 求解器本体描述为客户端已包含或内置的 Tool。
+- 平台保留个人会话直接调用 `MindOptSolve` 和 compile 临时覆盖参数，只是本技能团队治理流程之外的向后兼容、非 decision-grade 专家路径。不得把未绑定的个人调用描述成已审阅、已由真人确认、可恢复或 decision-grade；团队运行必须使用受保护的 `OptimizationSolve`，并把求解限制写入 committed specification。
 - 在承诺或发起真实求解前，必须验证外部 Connector 已配置且 ready、所需 capabilities 可用，并确认该部署具备当前用途所需的有效许可证。仅发现 `MindOptSolve` Tool 名称，不能证明求解器已经安装、授权、可达或完成付费。
 - 外部依赖不可用时，必须说明具体缺少的前置条件并在调用求解器前停止。仍可完成需求澄清，并交付供后续执行的 `SceneSpec`、`DataContract` 和 `OptimizationSpec`，但不得伪造 `SolveResult`，也不得宣称可行、最优或收益。
 - 自然语言入口在路由或建模前必须完整读取 `references/requirement-clarification-framework.zh-CN.md`，按业务澄清框架识别真实决策、六场景必问项和条件触发项。
@@ -21,9 +22,19 @@
 - “今天”“明日”“未来 N 天”“本季度”等业务相对时间，在本轮确认业务时区、业务日历、日期/时刻锚点以及适用的日切、截点、节假日和跨日规则前，一律保持 `pending_confirmation`；系统时钟或宿主机时区只是环境证据，不是业务规则。
 - 每个新需求必须隔离历史污染：其他会话、Plan、工件、记忆或样例中的事实一律保持 `pending_confirmation`，只有用户在当前请求中明确沿用后才能转为事实；首轮不得搜索或复用语义相似的旧 Plan 作为证据。
 - 用户只与入口 Agent 交互；入口负责路由、集中追问和最终交付，每个阶段只有一个 Owner。
- 完整路径必须按依赖顺序通过 `TeamArtifact` 发布 `SceneSpec`、`DataContract`、`PredictionArtifact`、`OptimizationSpec`、`SolveResult`、`ValidationReport` 和 `DeliveryBundle`。
+- 事实确认门通过后，必须严格按以下治理顺序执行，不得跳过或调换控制点：
+  1. 入口 Agent 在构造写入前，按需读取 `DecisionWorkspace(action="schema")` 的对应 section，以及每类 `TeamArtifact(action="schema")` 契约。
+  2. 入口 Agent 创建团队 DecisionWorkspace，或用 CAS 提交业务语言提议；提议绝不得伪造真人回执。
+  3. 用户只能通过平台专用真人控件确认或驳回阻断事实；驳回项保留为可审计的非活跃 tombstone。所有 Agent 必须等待权威结果。
+  4. 只有顶层入口 Agent 可以对已验证的当前 workspace revision 与 model-input hash 调用 `DecisionWorkspace(action="bind_workspace")`；Specialist 不得绑定、替换或绕过。
+  5. 指定阶段 Owner 按依赖顺序通过 `TeamArtifact` 发布 `SceneSpec`、`DataContract`、可选 `PredictionArtifact`、`OptimizationSpec`、`SolveResult`、`ValidationReport` 和 `DeliveryBundle`，并保留返回的精确 artifact revision 与 DecisionWorkspace snapshot。
+  6. 入口 Agent 使用精确 artifact ID、精确 revision 和语义绑定调用 `DecisionWorkspace(action="link_artifact")`；受治理证据禁止解析到可变 `latest`。
+  7. 将已链接 revision 提交同伴审阅；独立 reviewer 在执行前检查业务到模型覆盖、单位、变量族、可行性逻辑、来源证据、缺口以及 stale/rejected 排除。
+  8. 依次调用 `OptimizationCompile` 和 `OptimizationSolve`；两者产生副作用前都必须通过平台 DecisionWorkspace execution guard。`MindOptSolve` 只保留兼容 Connector 名称，不得被直接调用来绕过受保护求解路径。
+  9. 与求解 Owner 不同的验证 Owner 调用 `OptimizationValidate`，基于原始变量独立重算变量域、硬约束、目标值、基线差和 IIS 可追溯性。
+  10. 精确链接链通过审阅和独立验收后，用户只能通过平台专用真人批准控件批准；任何 Agent 或 Specialist 都不得生成该批准。
 - 有训练数据时必须调用 `OptimizationPredict`，执行有序留出、仅训练集插补、调参、指标、基线比较和明确降级规则。
- 通用模型先用 `OptimizationCompile` 严格编译，再用 `MindOptSolve` 求解一次；保留真实 status、原始变量、objective、request/job ID、HTTPS transport、solver 证据和不可行时的 IIS。
+- 通用模型先用 `OptimizationCompile` 严格编译，再通过受保护的 `OptimizationSolve` 求解一次；保留真实 status、原始变量、objective、request/job ID、HTTPS transport、所选引擎证据和不可行时的 IIS。
 - 验证 Owner 必须调用 `OptimizationValidate`，基于原始变量独立重算变量域、硬约束、目标值、基线差和 IIS 可追溯性。
 - 已结算且成功的 Tool 调用是权威事实；系统中断后只能综合持久化结果，不得重复执行 Tool。

@@ -32,9 +43,10 @@
 - 事实确认门未通过时只允许反向追问：不得发布建模工件、调用求解器、委派 solver-capable Agent，或用默认值、模拟情况、行业惯例补全隐形条件。
 - 交互模式只改变术语、分组、单轮批量和举例深度；不得改变事实状态、必问信息集合、条件触发项、建模确认摘要或停止门。用户本轮显式选择优先于历史偏好，切换模式时保留已确认事实并继续补齐其余项目。
 - 用户无法确认时交付待确认项、模型影响、所需责任方/数据和可选降级范围；不得把未回答解释为不存在、否、零或不限制。
- 用户已经提供完整 `OptimizationSpec` 时才走快速路径：一次求解委派、一次验证委派，然后由入口发布 `DeliveryBundle`。
+- 只有用户已经提供完整 `OptimizationSpec` 时才走快速路径。快速路径可以省略不必要的场景、预测或数据编写，但仍必须创建/提议受治理的 DecisionWorkspace 表达、取得所有必要的专用真人确认、绑定当前 revision、发布并链接精确 revision、通过同伴审阅和 execution guard、执行一次求解委派和一次独立验证，并等待专用真人批准后，入口发布的 `DeliveryBundle` 才能成为 decision-grade 交付。
 - 目标、约束、数据口径或预测输入仍需建模时走完整路径；依赖阶段未完成不得越级。
 - 不得替业务编造未知权重、静默放松硬约束、把缺失值当零，或把未经独立验算的方案称为可执行策略。
- 非入口 Agent 把数据缺口写入团队问题队列，只有入口能向用户提问。
- Connector 凭证只从声明的 connection refs 获取；不得索取、回显或把 token、CA、客户端证书、私钥、endpoint、SSH 命令或隧道写入制品。
+- 非入口 Agent 把数据缺口写入团队问题队列；该队列只是一种协调信号，不能承载真人答案或回执。只有入口能向用户提问，任何影响模型的答案都只有通过 DecisionWorkspace 专用真人确认控件才成为权威事实。
+- Specialist 不得直接向用户追问、绑定工作区、伪造 confirm/reject/approve 回执、跨出自身阶段发布、链接可变 `latest`、绕过 compile/solve guard、自验自己的求解结果或静默重试副作用。它们只向入口 Agent 报告缺口与证据，由入口统一负责用户问题和汇总交付。
+- SolverConnector 只在内部从已配置的 secret references 解引用连接凭证。本技能刻意不声明 `requires.connections`，因此 solver token、CA、客户端证书和私钥不会被注入 Bash。不得索取、回显、持久化，或通过 shell 命令、制品、endpoint、SSH 命令或隧道传递这些内容。
 - 求解不可行时保留并解释 IIS；独立验收失败时交付失败事实和违规项，不得修改变量或重新求解。