{"edict_id": "e-bd77f8ba92a9", "message_type": "DRAFT_REQUEST", "goal": "real e2e test from v1 bridge", "constraints": [], "acceptance_criteria": [], "title": "", "summary": ""}

```json
{
  "title": "Real E2E Test from V1 Bridge",
  "summary": "Draft a structured execution plan for an end-to-end test originating from the V1 Bridge, covering test design, implementation, execution, and verification across relevant departments.",
  "plan": [
    {
      "step_key": "S1",
      "name": "Design E2E test scenarios and acceptance criteria based on V1 Bridge DRAFT_REQUEST contract",
      "owner_department": "libu",
      "depends_on": [],
      "acceptance_criteria": [
        "Test scenarios derived from goal 'real e2e test from v1 bridge'",
        "Acceptance criteria cover input validation, processing, and output verification for DRAFT_REQUEST flow",
        "Test plan references edict_id e-bd77f8ba92a9"
      ]
    },
    {
      "step_key": "S2",
      "name": "Implement E2E test harness that simulates Bridge DRAFT_REQUEST dispatch to zhongshu",
      "owner_department": "gongbu",
      "depends_on": ["S1"],
      "acceptance_criteria": [
        "Test harness produces a valid DRAFT_REQUEST payload matching CTR-MSG-001",
        "Harness can be executed deterministically in CI environment",
        "Code committed with traceability to edict_id e-bd77f8ba92a9"
      ]
    },
    {
      "step_key": "S3",
      "name": "Execute E2E test through zhongshu plan drafting path and capture DRAFT_RESPONSE artifacts",
      "owner_department": "libuli",
      "depends_on": ["S2"],
      "acceptance_criteria": [
        "Test execution reaches zhongshu and trigg

{'prompt': "你是 sishu 吏部 (RBAC / Agent / 人员). 严格按当前 step acceptance_criteria 输出 (不要越界做代码或部署). 任务: 见 acceptance_criteria. edict=e-bd77f8ba92a9 step=S1. 输出格式: RBAC 配置 markdown 含 yaml, 含: 1. ServiceAccount 2. Role 3. RoleBinding 4. 最小权限原则.\n\n## 完整 edict context (来自 PG):\n## current date\n2026-07-21T16:38:52 UTC\n\n## git status\nclean (无未提交修改)\n## edict (e-bd77f8ba92a9, state=EXECUTING, plan_v=1)\n**goal**: real e2e test from v1 bridge\n**project_type**: new_project\n**created_at**: 2026-07-16 08:24:20.756729+00:00\n\n## plan (4 步):\n  - S1: Design E2E test scenarios and acceptance criteria based on V1 Bridge DRAFT_REQUEST contract → libu (DISPATCHED) ⬅\n  - S2: Implement E2E test harness that simulates Bridge DRAFT_REQUEST dispatch to zhongshu → gongbu (PENDING)\n  - S3: Execute E2E test through zhongshu plan drafting path and capture DRAFT_RESPONSE artifacts → libuli (PENDING)\n  - S4: Verify E2E test results, report pass/fail status, and archive outcomes to sishu_audit → xingbu (PENDING)\n\n## 当前 step (S1: Design E2E test scenarios and acceptance criteria based on V1 Bridge DRAFT_REQUEST contract) acceptance_criteria:\n  - Test scenarios derived from goal 'real e2e test from v1 bridge'\n  - Acceptance criteria cover input validation, processing, and output verification for DRAFT_REQUEST flow\n  - Test plan references edict_id e-bd77f8ba92a9\n\n## audit history (最近 4 条):\n  - 08:24:20 bridge: None→DRAFTING (POST /sishu/edicts)\n  - 16:38:41 zhongshu: DRAFTING→PLAN_REVIEW (plan

# 吏部 S1 产出：E2E 测试场景 RBAC 配置

> 任务: `e-bd77f8ba92a9` / `S1` — Design E2E test scenarios and acceptance criteria based on V1 Bridge DRAFT_REQUEST contract
> 部门: `libu`（吏部 / RBAC & Agent）
> 角色定位: **仅产出 RBAC 配置 markdown + YAML**，不写 E2E 测试代码、不做部署、不越界至工部（gongbu）的 harness 实现。

---

## 1. 背景与边界

本次 S1 派发到吏部，但 acceptance_criteria 的语义是「设计 E2E 测试场景与验收标准」，这本身属于**测试设计**范畴。吏部严格遵守 §4 边界：

- ✅ **可以**产出：为该 E2E 测试执行所需的 ServiceAccount / Role / RoleBinding（最小权限原则）；
- ✅ **可以**产出：与场景绑定的 RBAC 验收标准（在 §4 中以 acceptance checklist 形式呈现）；
- ❌ **不可以**写 E2E harness 代码（属工部 S2 范围）；
- ❌ **不可以**触发实际 dispatch（属工部/中书范围）；
- ❌ **不可以**修改业务 namespace 的资源。

工部在 S2 实现 harness 时，可直接消费本文件作为 RBAC 准入凭证。

---

## 2. 命名约定（遵循吏部记忆命名规范）

| 资源 | 命名 | 命名空间 |
|---|---|---|
| ServiceAccount | `e2e-harness-bridge-v1` | `sishu-e2e` |
| Role | `e2e-harness-draft-request` | `sishu-e2e` |
| RoleBinding | `e2e-harness-draft-request` | `sishu-e2e` |
| idempotency_key 模板 | `e2e-<edict_id>-<scenario_id>` | n/a |
| 审计引用 | `sishu_audit.id ∈ {S1, S2, S3, S4}` | `sishu` DB |

**edict 锚定**: 所有 RBAC 资源的 `metadata.labels.sishu/edict-id = e-bd77f8ba92a9`，便于 S4 归档时按 edict 反查。

---

## 3. RBAC YAML（最小权限原则）

### 3.1 ServiceAccount

```yaml
# edicts/e-bd77f8ba92a9/S1/rbac/serviceaccount.yaml
# 用途: E2E harness 触发 Bridge DRAFT_REQUEST 的执行身份
# 边界: 仅用于 sishu-e2e namespace 内的 e2e 测试；不授予任何业务 ns 权限
apiVersion: v1
kind: ServiceAccount
metadata:
  name: e2e-harness-bridge-v1
  namespace: sishu-e2e
  labels:
    sishu/edict-id: e-bd77f8ba92a9
    sishu/step: S1

goal:  | artifact: 

score=0.15 reason=Steps form a coherent e2e test pipeline (plan → harness → execution → verdict) traceable to edict e-bd77f8ba92a9. Minor deviation: acceptance criteria emphasize DRAFT_REQUEST/PLAN_REVIEW_REQUEST flow 

{'prompt': '你是 sishu 尚书省 (shangshu), 扮演项目经理 (PM) 角色. (R12.27 §8.2 PM 评审员)\n\n## edict goal (用户原始目标)\nreal e2e test from v1 bridge\n\n## 当前 step 验收标准 (你必须逐项 cite 到 reason)\n[\n  "Test scenarios derived from goal \'real e2e test from v1 bridge\'",\n  "Acceptance criteria cover input validation, processing, and output verification for DRAFT_REQUEST flow",\n  "Test plan references edict_id e-bd77f8ba92a9"\n]\n\n## 6 部执行报告\n"[{\\"commit\\": \\"84d5be54792ff62f0670c136454cd0ec76c8c533\\", \\"path\\": \\"edicts/S1\\", \\"status\\": \\"committed\\"}]"\n\n## 你的任务 (R12.27 §8.2 强约束)\n评估 6 部是否真正完成 step 验收标准. 输出 JSON:\n{"verdict": "PASS|FAIL|NEEDS_REVIEW", "score": 0.0-1.0, "reason": "...", "next_action": "dispatch_next|retry|final_review"}\n\n## R12.27 §8.2 4 条强约束 (必须遵守, 否则 R12.27 §7 verification 会判 FAIL)\n1. **必须逐项 cite AC**: reason 字段 min 80 字 + 引用 step_acceptance_criteria 原文每一条\n2. **必须主动拒绝\'调用形态描述\'**: 如果 6 部 LLM output 含 \'调用形态描述\'/\'真实调用由 X 部完成\'/纯代码示例 等逃避行为, verdict=FAIL, score<0.4, reason 明确指出\'逃避行为\'\n3. **必须 verdict/score 一致**: score >= 0.7 → verdict=PASS; score < 0.4 → verdict=FAIL; 中间 → NEEDS_REVIEW\n4. **失败入 audit**: LLM 不可用时 status=not_applicable 标记 (R12.27 §5.4), 不允许 status=fallback 静默通过\n\n- PASS (score >= 0.7): 完成验收, 派下一步 (next_action=dispatch_next)\n- FAIL (score < 0.4): 未完成, 需 retry (next_action=retry, 业务将重新派单)\n- NEEDS_REVIEW (0.4-0.7): 部分完成 (next_action=final_review, 写 correction_pattern)'}

```json
{
  "verdict": "FAIL",
  "score": 0.25,
  "reason": "逐项 cite AC 评估如下：\n\n【AC1】'Test scenarios derived from goal \"real e2e test from v1 bridge\"' — 6 部提交内容为单一 commit '84d5be54792ff62f0670c136454cd0ec76c8c533'，仅声明 path='edicts/S1' 与 status='committed'。该报告**完全未呈现任何 test scenarios 文本或结构**，无法判断是否从 edict goal 'real e2e test from v1 bridge' 派生。用一句 'committed' 状态代替 scenario 内容，本身就是 R12.27 §8.2 强约束 2 所禁止的'调用形态描述/逃避行为'——只回报 commit 哈希但不交付场景实质。AC1 未满足。\n\n【AC2】'Acceptance criteria cover input validation, processing, and output verification for DRAFT_REQUEST flow' — 报告未列出任何 acceptance criteria 条目，遑论覆盖 input validation / processing / output verification 三个维度。同样属于'调用形态描述'，无实质内容。AC2 未满足。\n\n【AC3】'Test plan references edict_id e-bd77f8ba92a9' — 6 部提交内容中**完全未见 edict_id e-bd77f8ba92a9 的任何引用**，path 仅为 'edicts/S1'，无法证明 test plan 已锚定到本旨意。AC3 未满足。\n\n【综合判定】三项 AC 全部未实质满足，且 6 部输出属于典型的'调用形态描述'逃避行为（仅回 commit SHA + 状态字，无 scenario / AC / edict_id 锚定内容）。依据 R12.27 §8.2 强约束 2 必须 verdict=FAIL 且 score<0.4；依据强约束 3 一致性原则给 0.25。",
  "next_action": "retry"
}
```

{'prompt': '你是 sishu 工部 (构建 / 部署 / K8s). 严格按当前 step acceptance_criteria 输出 (不要越界做代码或 RBAC). 任务: 见 acceptance_criteria. edict=e-bd77f8ba92a9 step=S2. 输出格式: k8s 部署 manifest markdown (含 yaml 块), 含: 1. Deployment 2. Service 3. Ingress 4. HPA. 如果 step 不要求 helloworld.html, 不要写 helloworld.html.\n\n## 完整 edict context (来自 PG):\n## current date\n2026-07-21T16:40:22 UTC\n\n## git status\nclean (无未提交修改)\n## edict (e-bd77f8ba92a9, state=EXECUTING, plan_v=1)\n**goal**: real e2e test from v1 bridge\n**project_type**: new_project\n**created_at**: 2026-07-16 08:24:20.756729+00:00\n\n## plan (4 步):\n  - S1: Design E2E test scenarios and acceptance criteria based on V1 Bridge DRAFT_REQUEST contract → libu (DONE)\n  - S2: Implement E2E test harness that simulates Bridge DRAFT_REQUEST dispatch to zhongshu → gongbu (DISPATCHED) ⬅\n  - S3: Execute E2E test through zhongshu plan drafting path and capture DRAFT_RESPONSE artifacts → libuli (PENDING)\n  - S4: Verify E2E test results, report pass/fail status, and archive outcomes to sishu_audit → xingbu (PENDING)\n\n## 当前 step (S2: Implement E2E test harness that simulates Bridge DRAFT_REQUEST dispatch to zhongshu) acceptance_criteria:\n  - Test harness produces a valid DRAFT_REQUEST payload matching CTR-MSG-001\n  - Harness can be executed deterministically in CI environment\n  - Code committed with traceability to edict_id e-bd77f8ba92a9\n\n## audit history (最近 6 条):\n  - 08:24:20 bridge: None→DRAFTING (POST /sishu/edicts)\n  - 16:38:41 zhongshu: DRA

# 工部边界拒绝说明

## 拒绝原因：step 任务与工部职责不匹配

收到尚书下发的 `EXECUTE_STEP`（edict=e-bd77f8ba92a9，step=S2）后，经核对当前 step 的 `acceptance_criteria`，**本 step 不属于工部执行范围**，现按 §4 边界条款拒绝并上报。

### 1. 当前 step S2 的 acceptance_criteria

```
- Test harness produces a valid DRAFT_REQUEST payload matching CTR-MSG-001
- Harness can be executed deterministically in CI environment
- Code committed with traceability to edict_id e-bd77f8ba92a9
```

### 2. 与工部职责 / 边界冲突点

| 工部职责（§1） | 本 step 要求 | 冲突判定 |
|---|---|---|
| 容器镜像构建 | **编写 E2E test harness 代码** | ❌ 越界 |
| Registry 推送 | 产出一个符合 CTR-MSG-001 的 `DRAFT_REQUEST` payload | ❌ 越界（属于协议实现 / 测试代码，非构建产物） |
| K8s Manifest 应用 | harness 可在 CI 中确定性执行 | ❌ 越界（CI 测试逻辑非 K8s 部署） |
| Rollout 验证、回滚 | 代码提交带 edict_id traceability | ❌ 越界（代码逻辑） |

依据本部门 Operator Card **§4 边界**：

> "工部不写业务代码（由兵部完成）；只负责构建、推送、部署、验证；"
> "工部不直接接受 Bridge / 中书 / 门下消息；只接受尚书的 `EXECUTE_STEP` 或 `REWORK_STEP`；"
> "工部不跨部门派活；跨部门需求通过 `needs_followup` 上报尚书；"

本 step 的三项验收标准均指向**测试 harness 代码实现 + 协议 payload 生成 + CI 可执行**，应归属于 **兵部（libu / libuli）** 的"编写代码 / 实现测试"职责域，与工部"构建与部署"职责无交集。

### 3. 关于用户 prompt 中的"K8s Deployment / Service / Ingress / HPA manifest markdown"

用户 prompt 要求产出 K8s 四件套 manifest，但这：

1. **与 step acceptance_criteria 不对应**（criteria 要求的是 test harness + payload + CI，并非部署清单）；
2. **无对应 EDICT 输入**（无 `input_refs.git_commit` 指向待部署的镜像，无 image digest，无目标 namespace，无 ingress host）；
3. **属凭空编造部署对象**，违反 §4 "不擅自派活 / 不越界写代码或 RBAC"。

按 §5 失败模式，未越界执行；按 §4 上报 `needs_followup`。

---

## 上报：EXECUTION_REPORT（拒绝 + needs_fol