feat(hub): usage fact ledger for run-scoped cost attribution (ADR-0026)

Replace the single-scalar cost model on AgentRun with an append-only
UsageFact ledger. One AgentRun owns zero or more UsageFact rows; each
records one billable consumption event (model completion, external
capability, or tool proxy) with its own provider/model/tokens/quantity/
cost. AgentRun.costUsd/inputTokens/outputTokens become a derived rollup
cache.

This unblocks external capabilities (PDF->MD bundle, audio/video->text)
that bill in non-token units (pages, seconds) through a different
provider than the main agent loop, without per-capability schema changes
or nested AgentRuns (which would pollute lock/admission/session
semantics).

Contract:
- spec/Spec/System/Agent/Usage.lean pins UsageFact, UsageFactKind,
  CostSource and three invariants: append-only; belongs to one run,
  never holds a lock; missing cost != zero (ADR-0022).
- ADR-0026 records the decision, the rejected nested-Run alternative,
  the rollup cache strategy, and the deferred capability registry /
  pricebook / post-hoc correction flows.

Schema:
- UsageFact model with indexes on (runId, occurredAt), (runId, kind),
  (provider, model, occurredAt), (capabilityId, occurredAt).
- Migration backfills one synthetic model_completion fact per existing
  run with recorded cost/tokens (correlationId = runId marks backfill);
  truly unrecorded runs stay runsWithoutCost per ADR-0022.

Write path (trigger finish):
- Write the UsageFact first, then mirror it onto AgentRun as two
  separate statements (not one transaction). The fact is the truth so it
  goes first; the cache is derived so it goes second. A crash between
  them leaves the cache stale but the usage service re-reads facts
  directly, so this is recoverable; the reverse order would lose the
  truth. Separate statements also avoid an AgentRun row lock held across
  the insert's FK ShareLock, which deadlocked concurrent workspace
  teardown under the Organization->Project->AgentRun->UsageFact cascade.

Read paths:
- org/usage.ts aggregates from UsageFact, ignoring the AgentRun cache.
- slash /usage buckets by (fact.provider, fact.model); a run with a
  main loop + an external call lands in two buckets.
- session detail exposes usageFacts[] + costSource for future per-run
  cost-breakdown UI.

Tests:
- usage.test.ts: 6 integration tests pin fact aggregation, missing-cost-
  !=-zero, multi-fact-per-run, empty-run, project-level, empty-org.
- trigger.test.ts: existing /usage assertion ($0.0023,
  openrouter / mock-model) passes on the fact path.
- feishu-reactions mock prisma gains usageFact.create.

.gitea/workflows/deploy-admin.yml

@@ -0,0 +1,126 @@
+name: deploy admin (hub fleet)
+
+# Rolls Hub releases that include the org-admin SPA (`admin-web` → registerStaticSpa)
+# onto the managed Alpha host. Two fleets share one machine and are separated by
+# the middle DNS label of each Silo's public URL:
+#
+#   dev  → https://<slug>.educraft-dev.paradigm-edu.net   (every push + PR)
+#   prod → https://<slug>.educraft.paradigm-edu.net       (main + tags)
+#
+# Example prod tenant:
+#   https://para-26071100.educraft.paradigm-edu.net/auth/feishu/para-26071100
+#
+# Required Gitea secret:
+#   DEPLOY_SSH_KEY  — private key for root@39.107.254.4
+#
+# Optional secrets / vars (defaults match NEW_SILO_RUNBOOK):
+#   DEPLOY_HOST, DEPLOY_USER, DEPLOY_SSH_PORT, DEPLOY_BASE
+#   vars.ALLOW_EMPTY_FLEET=1  — green when the fleet has no silos yet
+
+on:
+  push:
+    paths:
+      - "hub/**"
+      - ".gitea/workflows/deploy-admin.yml"
+  pull_request:
+    paths:
+      - "hub/**"
+      - ".gitea/workflows/deploy-admin.yml"
+  workflow_dispatch:
+    inputs:
+      fleet:
+        description: "Which fleet to deploy (dev | prod | both)"
+        required: true
+        default: both
+      allow_empty_fleet:
+        description: "Succeed if no silo matches (1/0)"
+        required: false
+        default: "0"
+
+concurrency:
+  group: deploy-admin-host
+  cancel-in-progress: false
+
+jobs:
+  deploy-dev:
+    name: deploy fleet dev (educraft-dev)
+    runs-on: ubuntu-latest
+    if: >
+      github.event_name == 'pull_request' ||
+      (github.event_name == 'push' && !startsWith(github.ref, 'refs/tags/')) ||
+      (github.event_name == 'workflow_dispatch' &&
+        (github.event.inputs.fleet == 'dev' || github.event.inputs.fleet == 'both'))
+    steps:
+      - uses: actions/checkout@v5
+
+      - name: Install rsync + ssh
+        run: sudo apt-get update && sudo apt-get install -y rsync openssh-client
+
+      - name: Deploy Hub + admin SPA to educraft-dev fleet
+        env:
+          CPH_FLEET: dev
+          PLATFORM_DEPLOY_HOST: ${{ secrets.DEPLOY_HOST }}
+          PLATFORM_DEPLOY_USER: ${{ secrets.DEPLOY_USER }}
+          PLATFORM_DEPLOY_PORT: ${{ secrets.DEPLOY_SSH_PORT }}
+          PLATFORM_DEPLOY_BASE: ${{ secrets.DEPLOY_BASE }}
+          PLATFORM_DEPLOY_RELEASE: ${{ github.sha }}
+          ALLOW_EMPTY_FLEET: ${{ github.event.inputs.allow_empty_fleet || vars.ALLOW_EMPTY_FLEET || '0' }}
+          DEPLOY_SSH_KEY_BODY: ${{ secrets.DEPLOY_SSH_KEY }}
+        run: |
+          set -euo pipefail
+          if [ -z "${DEPLOY_SSH_KEY_BODY:-}" ]; then
+            echo "missing secret DEPLOY_SSH_KEY" >&2
+            exit 1
+          fi
+          key="$(mktemp)"
+          trap 'rm -f "$key"' EXIT
+          printf '%s\n' "$DEPLOY_SSH_KEY_BODY" >"$key"
+          chmod 600 "$key"
+          export PLATFORM_DEPLOY_SSH_KEY="$key"
+          # Apply managed-host defaults when secrets are unset.
+          export PLATFORM_DEPLOY_HOST="${PLATFORM_DEPLOY_HOST:-39.107.254.4}"
+          export PLATFORM_DEPLOY_USER="${PLATFORM_DEPLOY_USER:-root}"
+          export PLATFORM_DEPLOY_PORT="${PLATFORM_DEPLOY_PORT:-22}"
+          export PLATFORM_DEPLOY_BASE="${PLATFORM_DEPLOY_BASE:-/srv/curriculum-project-hub}"
+          bash hub/deploy/deploy_fleet_release.sh
+
+  deploy-prod:
+    name: deploy fleet prod (educraft)
+    runs-on: ubuntu-latest
+    if: >
+      (github.event_name == 'push' && github.ref == 'refs/heads/main') ||
+      (github.event_name == 'push' && startsWith(github.ref, 'refs/tags/')) ||
+      (github.event_name == 'workflow_dispatch' &&
+        (github.event.inputs.fleet == 'prod' || github.event.inputs.fleet == 'both'))
+    steps:
+      - uses: actions/checkout@v5
+
+      - name: Install rsync + ssh
+        run: sudo apt-get update && sudo apt-get install -y rsync openssh-client
+
+      - name: Deploy Hub + admin SPA to educraft fleet
+        env:
+          CPH_FLEET: prod
+          PLATFORM_DEPLOY_HOST: ${{ secrets.DEPLOY_HOST }}
+          PLATFORM_DEPLOY_USER: ${{ secrets.DEPLOY_USER }}
+          PLATFORM_DEPLOY_PORT: ${{ secrets.DEPLOY_SSH_PORT }}
+          PLATFORM_DEPLOY_BASE: ${{ secrets.DEPLOY_BASE }}
+          PLATFORM_DEPLOY_RELEASE: ${{ github.sha }}
+          ALLOW_EMPTY_FLEET: ${{ github.event.inputs.allow_empty_fleet || vars.ALLOW_EMPTY_FLEET || '0' }}
+          DEPLOY_SSH_KEY_BODY: ${{ secrets.DEPLOY_SSH_KEY }}
+        run: |
+          set -euo pipefail
+          if [ -z "${DEPLOY_SSH_KEY_BODY:-}" ]; then
+            echo "missing secret DEPLOY_SSH_KEY" >&2
+            exit 1
+          fi
+          key="$(mktemp)"
+          trap 'rm -f "$key"' EXIT
+          printf '%s\n' "$DEPLOY_SSH_KEY_BODY" >"$key"
+          chmod 600 "$key"
+          export PLATFORM_DEPLOY_SSH_KEY="$key"
+          export PLATFORM_DEPLOY_HOST="${PLATFORM_DEPLOY_HOST:-39.107.254.4}"
+          export PLATFORM_DEPLOY_USER="${PLATFORM_DEPLOY_USER:-root}"
+          export PLATFORM_DEPLOY_PORT="${PLATFORM_DEPLOY_PORT:-22}"
+          export PLATFORM_DEPLOY_BASE="${PLATFORM_DEPLOY_BASE:-/srv/curriculum-project-hub}"
+          bash hub/deploy/deploy_fleet_release.sh

.gitignore

@@ -11,6 +11,9 @@
 # regenerable, not for VCS. The embedded engine mounts cph-render directly.
 render/vendor/local-packages/
 
+# Environment
+.env
+
 # Node (hub/ TS workspace and any future JS package)
 node_modules/
 

AGENTS.md

@@ -30,8 +30,17 @@
   控制面与 Docker adapter 后置(见 ADR-0025)。
 - Agent role 与 skill 是 Organization-scoped 动态运行配置：role 组合 model、system prompt、
   tools 与已安装 skill；skill 版本进入 content-addressed 持久存储，run 只读加载所选快照。
+  每个 Organization 必须且只能有一个启用中的默认 role；新建群绑定从该默认值初始化，之后
+  `ProjectGroupBinding` 持久化群内当前 role，run 在接纳时冻结该 role。飞书公开 slash 协议只含
+  `/project`、`/usage`、`/help`；role、会话、目录操作走 `/project` 卡片，Claude 原生
+  `/compact` 只能由卡片动作以未经包装的精确 prompt 转发。
   `settingSources: []` 继续禁用项目/用户配置加载，不得把任意 workspace `.claude` 配置变成
   运行时能力(见 ADR-0018)。
+- 项目发现由 `ProjectDiscovery` 模块统一承载：PostgreSQL `pg_trgm` 搜索派生文档、项目编号
+  归一化、完整 Folder breadcrumb、MANAGE 授权过滤与分页都在该模块内；飞书卡片只是 adapter。
+  `Project`/`Folder` 仍是事实来源，搜索文档必须可重建且由数据库触发器同步，禁止调用方双写。
+  系统 `Inbox` 只作为未分类项目的内部落点，不作为业务 folder 暴露；已绑定群通过
+  `@bot /project` 随时打开项目管理卡片，重命名仍走 org-scoped MANAGE 授权与审计。
 
 ## 纪律
 

docs/adr/0017-agent-session-is-provider-bound.md

@@ -34,8 +34,12 @@ provider runtime cursor needed to continue a conversation. For Claude Code SDK,
 that cursor is the `result.session_id`; store it in `AgentSession.metadata` as
 `claudeSessionId` and pass it back to the next `query()` call as
 `options.resume`. Role is part of the session binding because role prompts and
-tool surfaces can differ even when the underlying model is the same; `/draft`
-and `/review` must not resume the same Claude runtime cursor by accident.
+tool surfaces can differ even when the underlying model is the same. A Feishu
+project group's active binding selects one Organization role for ordinary
+messages. Switching that selection routes future messages to the selected
+role's own session; it never mutates or merges provider cursors across roles.
+Work freezes the selected role when accepted so queued requests cannot drift
+after a later switch.
 
 Role definitions are Organization-scoped runtime data. A role bundle selects
 its default model, system prompt, tool allowlist and installed Agent skill
@@ -47,6 +51,20 @@ a Hub release or process restart. A change to the role's execution surface
 the next run cannot resume a provider context created under stale instructions;
 label and ordering-only changes preserve conversational continuity.
 
+Exactly one active role per Organization is the default used when a project
+group is first bound. The default is configuration data, not a hard-coded role
+name. Roles are selected through the Hub project console; role ids are not
+public slash commands. A project participant may change the group's shared
+selection only when both `agent.trigger` for the project and `role.trigger` for
+the target role authorize that actor. The selection affects every participant's
+future messages, while already accepted work keeps its frozen role.
+
+Hub slash commands are a closed control-plane protocol. Unknown commands fail
+explicitly and are never downgraded to Agent text. Claude SDK session commands
+are invoked only through typed Hub actions. In particular, compaction resumes
+the selected role session and sends the exact `/compact` prompt without
+prepending Feishu context.
+
 Environment variables:
 ```
 ANTHROPIC_BASE_URL=https://openrouter.ai/api

docs/adr/0018-agent-execution-surface-bounded-by-workspace.md

@@ -123,15 +123,23 @@ The boundary is enforced by the Claude Code SDK's built-in sandbox
   workspace or service-user config from widening tools, hooks, MCP servers, or
   sandbox paths.
 - Agent skills are Organization-scoped runtime configuration, not Hub release
-  assets. A controlled host-console installer imports each version into a
-  content-addressed persistent store and records its digest in PostgreSQL. A
-  role selects enabled Organization skills alongside its model, system prompt
-  and tool allowlist. Each run copies only those selected immutable versions
-  into a run-scoped plugin outside the project workspace; the sandbox exposes
-  that snapshot read-only and deletes it after the run. SDK-bundled skills and
-  filesystem setting sources remain disabled, so project `.claude` content
-  cannot register skills or widen tools. Requested skill versions are recorded
-  on `run.created`; SDK initialization remains authoritative loading evidence.
+  assets. Skill content is imported into a content-addressed persistent store
+  through a shared ingestion pipeline (`importSkillDirectory` for host-console
+  CLI, `importSkillFromFiles` for org-admin web surface) that enforces the same
+  safety checks: `SKILL.md` manifest required, 512-file / 16-byte limits,
+  symlink rejection, SHA-256 content addressing. The web surface
+  (`OrganizationAgentConfiguration.installSkillFromFiles`) writes to the same
+  store as the host-console CLI (`installSkill`); both flow through
+  `commitSkillContent` for deduplication and atomic rename into
+  `versions/<digest>/`. Org-admin authentication gates the web surface; the
+  content-addressed store remains platform-controlled. A role selects enabled
+  Organization skills alongside its model, system prompt and tool allowlist.
+  Each run copies only those selected immutable versions into a run-scoped
+  plugin outside the project workspace; the sandbox exposes that snapshot
+  read-only and deletes it after the run. SDK-bundled skills and filesystem
+  setting sources remain disabled, so project `.claude` content cannot register
+  skills or widen tools. Requested skill versions are recorded on
+  `run.created`; SDK initialization remains authoritative loading evidence.
 - Network: open (see Open Questions).
 
 `bypassPermissions` is kept (headless server — no interactive prompts); the

docs/adr/0026-usage-fact-ledger.md

@@ -0,0 +1,146 @@
+# ADR 0026: Usage Fact Ledger
+
+## Status
+
+Accepted.
+
+## Context
+
+ADR-0022 pins the cost-attribution contract for the platform: token,
+provider-reported cost, run count, and duration are attributed by Organization,
+Project, Run, model, and Provider Connection; "missing provider cost remains
+unknown rather than zero." ADR-0021 scopes usage accounting as operational
+reporting, not payment collection (commercial billing stays deferred).
+
+The implementation today stores this as **one scalar per `AgentRun`**:
+`inputTokens`, `outputTokens`, `costUsd?`, `costSource?`, written once from the
+Claude Agent SDK's `result.total_cost_usd` when the run finishes. This is
+adequate for a single provider-reported model loop, but it cannot represent:
+
+- **External capability consumption** inside a run. PDF→Markdown bundle
+  conversion, audio/video transcription, OCR and similar media transforms are
+  not the main agent loop. They run as side effects of a run, may use a
+  different provider/model, may bill in non-token units (pages, seconds,
+  invocations), and may report cost through a different channel than the
+  OpenRouter gateway. Today there is no row to write that cost to — it would
+  either disappear or silently corrupt the run's single scalar.
+- **Multiple model calls within one run** (e.g. a sub-model invoked by a
+  tool, a gateway-side reroute). The scalar collapses them into one number.
+- **Pricebook derivation** after the fact. With only a final USD figure and no
+  `(provider, model, occurredAt, tokens)` fact, an operator cannot re-derive
+  cost from a price table when the provider did not report it.
+
+Treating each external call as a nested `AgentRun` was considered and
+rejected: `AgentRun` carries lock ownership (ADR-0002), session/provider/role
+binding (ADR-0017), admission/capacity semantics (ADR-0022), and the
+user-visible task boundary. External calls hold none of those. Making them
+`AgentRun`s would pollute run counts, admission, lock semantics, and session
+continuity, and would still not solve non-token metering.
+
+## Decision
+
+Introduce **`UsageFact`** as the single source of truth for billable
+consumption inside an `AgentRun`. An `AgentRun` owns zero or more
+append-only `UsageFact` rows; each row records one billable consumption event:
+
+- `kind` — `model_completion` (the main agent loop) | `external_capability`
+  | `tool_proxy`. The kind set is `OPEN`; new kinds must be surfaced, not
+  silently folded into an existing one.
+- `provider` — e.g. `openrouter`, `mineru`, `openai_whisper`.
+- `model?`, `inputTokens?`, `outputTokens?` — token metering, optional
+  because non-token capabilities have none.
+- `quantity?` + `unit?` — non-token metering (pages, audio_seconds,
+  invocations), coexisting with tokens rather than replacing them.
+- `costUsd?` + `costSource` — `provider_reported` | `pricebook_derived` |
+  `unknown`. `costUsd = null` means **unknown, not zero** (ADR-0022). When the
+  provider reported a cost, `costSource = provider_reported` and that value
+  wins. When only tokens are known, a later pricebook pass may derive
+  `costUsd` with `costSource = pricebook_derived`. When neither is possible,
+  `costSource = unknown` and `costUsd` stays null.
+- `occurredAt` — when the consumption happened; the pricebook derivation
+  depends on this, not on `AgentRun.finishedAt`, because an external
+  capability may complete before the run finishes.
+- `capabilityId?` — for `external_capability` facts, the registered capability
+  id (e.g. `pdf_to_md_bundle`, `audio_video_to_text`).
+- `correlationId?` — external request id for reconciliation / idempotency;
+  not part of the aggregation key.
+
+### Invariants
+
+1. **Append-only.** A `UsageFact` row is never updated or deleted. A cost
+   correction is a new row; the old row stays. `onDelete: Cascade` exists only
+   so a hard run delete (itself not a normal path) cleans up its facts.
+2. **Belongs to exactly one Run; never holds a lock.** A fact is a side-effect
+   ledger of one run, not a sub-run. External capability calls obey the same
+   boundary: their identity is `capabilityId + correlationId`, not `RunId`.
+3. **Missing cost ≠ zero.** Aggregation MUST NOT sum `null` `costUsd` as 0.
+   A run whose facts all have `costUsd = null` is "cost unknown" — reported as
+   `runsWithoutCost`, exactly as the pre-migration `costUsd = null` runs are
+   today. A run with at least one `costUsd`-bearing fact contributes its sum.
+
+### Rollup cache
+
+`AgentRun.costUsd / inputTokens / outputTokens / costSource` columns are kept
+as a **derived rollup cache**, not dropped:
+
+- Existing non-`/usage` readers (slash `/usage`, session detail, integration
+  tests asserting `run.costUsd`) continue to work without code changes for
+  historical runs.
+- On run finish, the writer writes the `UsageFact` row first and then mirrors
+  it onto `AgentRun` as two separate statements, not one transaction. The
+  fact is the truth, so it is written first; the cache is derived, so it is
+  written second. A crash between the two leaves the cache stale, but the
+  usage service re-reads `UsageFact` directly, so staleness is recoverable
+  (and the reverse order would lose the truth, which is not). Keeping the
+  fact insert and the run update in separate statements also avoids holding
+  the `AgentRun` row lock across the FK ShareLock taken by the insert, which
+  deadlocks against concurrent workspace teardown under the cascade path
+  `Organization → Project → AgentRun → UsageFact`.
+- The org/project usage service and the slash `/usage` command read from
+  `UsageFact` directly — they are the canonical aggregation path.
+
+### Migration
+
+A new `UsageFact` table is added. For every existing `AgentRun` with a
+non-null `costUsd` or non-null `inputTokens`/`outputTokens`, the migration
+inserts **one synthetic `model_completion` fact** carrying the run's
+provider, model, tokens, cost, and `costSource`. Its `correlationId` is the
+run id, so the row is identifiable as a backfill artefact. This keeps
+historical reporting correct under the new aggregation path. Pre-migration
+runs with no recorded cost remain `runsWithoutCost` by design, matching
+ADR-0022's "missing cost ≠ zero" rule and the existing migration
+`20260709143000_agent_run_cost_tracking`'s "no backfill" stance for the
+truly unrecorded.
+
+## Consequences
+
+- The billing model now supports external capabilities (PDF→MD, ASR, OCR, …)
+  without per-capability schema changes: a new capability is one new
+  `capabilityId` value and one or more `external_capability` facts.
+- `AgentRun.costUsd` is no longer the truth; it is a convenience cache.
+  Readers that need the truth (cost breakdown, per-capability attribution)
+  must read `UsageFact`. The cache MUST be kept consistent on the write path.
+- The capability registry, pricebook, and any commercial settlement remain
+  `OPEN` and out of pilot scope (ADR-0021). This ADR only pins the ledger
+  shape and invariants.
+- `usage.ts` and `/usage` now perform a join against `UsageFact` rather than a
+  single-table scan of `AgentRun`; the index on `(runId, occurredAt)` and
+  `(provider, model, occurredAt)` keeps the existing org/project/report
+  queries bounded.
+- Cost corrections (e.g. a provider rebills a run) produce a new fact row; the
+  rollup cache must be recomputed. The initial release writes facts once at
+  run finish and does not support post-hoc correction flows — that remains
+  `OPEN`.
+
+## Deferred
+
+- **Capability registry** as a first-class spec entity (`Spec.System.Capability`)
+  with org-scoped enable/disable, input/output contracts, metering schemas,
+  and org-exclusive credentials (ADR-0024 alignment). This ADR only reserves
+  the `capabilityId` field and the `external_capability` fact kind.
+- **Pricebook** — a versioned price table keyed by `(provider, model, unit)`
+  with time validity. Required to actually produce `pricebook_derived` costs;
+  until then, facts without provider-reported cost stay `unknown`.
+- **Post-hoc cost correction flow** — append-only today; correction UI and
+  rollup recompute are `OPEN`.
+- **Commercial billing, invoicing, settlement** — still deferred per ADR-0021.

docs/para-26071100-feishu-setup.md

@@ -72,8 +72,10 @@ Educraft 机器人以应用身份调用上述 API，因此这些 scope 全部放
 
 1. 在“事件配置”中将订阅方式设为“使用长连接接收事件”。
 2. 添加事件“接收消息” `im.message.receive_v1`。
-3. 在“回调配置”中同样选择长连接。
-4. 添加回调“卡片回传交互” `card.action.trigger`，用于审批、运行中断和项目创建/绑定按钮。
+3. 添加事件“解散群” `im.chat.disbanded_v1`，用于立即归档该群的项目绑定。
+4. 添加事件“机器人被移出群” `im.chat.member.bot.deleted_v1`，用于立即归档该群的项目绑定。
+5. 在“回调配置”中同样选择长连接。
+6. 添加回调“卡片回传交互” `card.action.trigger`，用于审批、运行中断和项目创建/绑定按钮。
 
 ![长连接与消息事件配置](assets/feishu-setup/03-events.png)
 
@@ -174,7 +176,7 @@ App ID：cli_...
 App Secret：（通过安全渠道单独发送）
 应用已发布：是 / 否
 机器人能力已启用：是 / 否
-消息事件和卡片回调已配置：是 / 否
+消息事件（含解散群、机器人被移出群）和卡片回调已配置：是 / 否
 OAuth 重定向 URL 已配置：是 / 否
 
 【首位 OWNER】

hub/.env.example

@@ -34,6 +34,10 @@ HUB_FEISHU_EVENTS_PER_MINUTE="120"
 # to this path and rejects any overlap before installing the unit.
 HUB_PROJECT_WORKSPACE_ROOT="/var/lib/cph-hub/workspaces"
 
+# Persistent root for the content-addressed agent skill store. Required at hub
+# startup unless XDG_STATE_HOME is set (then defaults to $XDG_STATE_HOME/skills).
+HUB_SKILL_STORE_ROOT="/var/lib/cph-hub/state/skills"
+
 # This process is pinned to exactly one Organization. Feishu credentials are
 # resolved from that Organization's encrypted ACTIVE connection.
 HUB_SILO_ORGANIZATION_ID=""

hub/.gitignore

@@ -4,3 +4,7 @@ dist/
 .env
 .env.*
 !.env.example
+.secrets/
+admin-web/node_modules/
+admin-web/build/
+admin-web/.svelte-kit/

hub/admin-web/.gitignore

@@ -0,0 +1,23 @@
+node_modules
+
+# Output
+.output
+.vercel
+.netlify
+.wrangler
+/.svelte-kit
+/build
+
+# OS
+.DS_Store
+Thumbs.db
+
+# Env
+.env
+.env.*
+!.env.example
+!.env.test
+
+# Vite
+vite.config.js.timestamp-*
+vite.config.ts.timestamp-*

hub/admin-web/.npmrc

@@ -0,0 +1 @@
+engine-strict=true

hub/admin-web/.prettierignore

@@ -0,0 +1,4 @@
+build
+.svelte-kit
+node_modules
+package-lock.json

hub/admin-web/.prettierrc.json

@@ -0,0 +1,9 @@
+{
+	"useTabs": true,
+	"singleQuote": true,
+	"semi": true,
+	"trailingComma": "all",
+	"printWidth": 120,
+	"plugins": ["prettier-plugin-svelte"],
+	"overrides": [{ "files": "*.svelte", "options": { "parser": "svelte" } }]
+}

hub/admin-web/.vscode/extensions.json

@@ -0,0 +1,3 @@
+{
+	"recommendations": ["svelte.svelte-vscode"]
+}

hub/admin-web/README.md

@@ -0,0 +1,42 @@
+# sv
+
+Everything you need to build a Svelte project, powered by [`sv`](https://github.com/sveltejs/cli).
+
+## Creating a project
+
+If you're seeing this, you've probably already done this step. Congrats!
+
+```sh
+# create a new project
+npx sv create my-app
+```
+
+To recreate this project with the same configuration:
+
+```sh
+# recreate this project
+npx sv@0.16.2 create --template minimal --types ts --install npm D:/Projects/curriculum-project-hub/hub/admin-web
+```
+
+## Developing
+
+Once you've created a project and installed dependencies with `npm install` (or `pnpm install` or `yarn`), start a development server:
+
+```sh
+npm run dev
+
+# or start the server and open the app in a new browser tab
+npm run dev -- --open
+```
+
+## Building
+
+To create a production version of your app:
+
+```sh
+npm run build
+```
+
+You can preview the production build with `npm run preview`.
+
+> To deploy your app, you may need to install an [adapter](https://svelte.dev/docs/kit/adapters) for your target environment.

hub/admin-web/package.json

@@ -0,0 +1,33 @@
+{
+	"name": "admin-web",
+	"private": true,
+	"version": "0.0.1",
+	"type": "module",
+	"scripts": {
+		"dev": "vite dev",
+		"build": "vite build",
+		"preview": "vite preview",
+		"prepare": "svelte-kit sync || echo ''",
+		"check": "svelte-kit sync && svelte-check --tsconfig ./tsconfig.json",
+		"check:watch": "svelte-kit sync && svelte-check --tsconfig ./tsconfig.json --watch",
+		"format": "prettier --write .",
+		"format:check": "prettier --check ."
+	},
+	"devDependencies": {
+		"@skeletonlabs/skeleton": "^4.15.2",
+		"@skeletonlabs/skeleton-svelte": "^4.15.2",
+		"@sveltejs/adapter-auto": "^7.0.1",
+		"@sveltejs/adapter-static": "^3.0.10",
+		"@sveltejs/kit": "^2.63.0",
+		"@sveltejs/vite-plugin-svelte": "^7.1.2",
+		"@tailwindcss/vite": "^4.3.2",
+		"bits-ui": "^2.18.1",
+		"prettier": "^3.9.5",
+		"prettier-plugin-svelte": "^4.1.1",
+		"svelte": "^5.56.1",
+		"svelte-check": "^4.6.0",
+		"tailwindcss": "^4.3.2",
+		"typescript": "^6.0.3",
+		"vite": "^8.0.16"
+	}
+}

hub/admin-web/src/app.d.ts

@@ -0,0 +1,13 @@
+// See https://svelte.dev/docs/kit/types#app.d.ts
+// for information about these interfaces
+declare global {
+	namespace App {
+		// interface Error {}
+		// interface Locals {}
+		// interface PageData {}
+		// interface PageState {}
+		// interface Platform {}
+	}
+}
+
+export {};

hub/admin-web/src/app.html

@@ -0,0 +1,27 @@
+<!doctype html>
+<html lang="zh-CN" data-theme="hamlindigo">
+	<head>
+		<meta charset="utf-8" />
+		<meta name="viewport" content="width=device-width, initial-scale=1" />
+		<meta name="text-scale" content="scale" />
+		<meta name="description" content="Curriculum Project Hub — 组织管理后台" />
+		<link rel="icon" href="%sveltekit.assets%/favicon.svg" type="image/svg+xml" />
+		<link rel="preconnect" href="https://fonts.googleapis.com" />
+		<link rel="preconnect" href="https://fonts.gstatic.com" crossorigin />
+		<link
+			href="https://fonts.googleapis.com/css2?family=Inter:wght@400;500;600;700&family=JetBrains+Mono:wght@400;500&family=Noto+Sans+SC:wght@400;500;600;700&display=swap"
+			rel="stylesheet"
+		/>
+		<style>
+			/* Fallback before CSS bundle: CJK-first industrial base */
+			html {
+				font-family: 'Noto Sans SC', 'PingFang SC', 'Microsoft YaHei', 'Inter', sans-serif;
+			}
+		</style>
+		<title>CPH Admin</title>
+		%sveltekit.head%
+	</head>
+	<body data-sveltekit-preload-data="hover">
+		<div style="display: contents">%sveltekit.body%</div>
+	</body>
+</html>

hub/admin-web/src/lib/api.ts

@@ -0,0 +1,413 @@
+/**
+ * Thin API client for the org admin backend. Same-origin cookie auth.
+ */
+
+export class ApiError extends Error {
+	code: string;
+	status: number;
+	constructor(code: string, message: string, status: number) {
+		super(message);
+		this.name = 'ApiError';
+		this.code = code;
+		this.status = status;
+	}
+}
+
+async function request(method: string, url: string, body?: unknown): Promise<unknown> {
+	const init: RequestInit = {
+		method,
+		credentials: 'same-origin',
+		headers: body !== undefined ? { 'content-type': 'application/json' } : undefined,
+		body: body !== undefined ? JSON.stringify(body) : undefined,
+	};
+	const res = await fetch(url, init);
+	const text = await res.text();
+	let data: unknown = null;
+	if (text !== '') {
+		try {
+			data = JSON.parse(text);
+		} catch {
+			data = text;
+		}
+	}
+	if (!res.ok) {
+		const err = (data as { error?: { code?: string; message?: string } } | null)?.error;
+		throw new ApiError(err?.code ?? 'http_error', err?.message ?? `HTTP ${res.status}`, res.status);
+	}
+	return data;
+}
+
+const get = (u: string) => request('GET', u);
+const post = (u: string, b?: unknown) => request('POST', u, b);
+const put = (u: string, b?: unknown) => request('PUT', u, b);
+const patch = (u: string, b?: unknown) => request('PATCH', u, b);
+const del = (u: string) => request('DELETE', u);
+
+const orgBase = (slug: string) => `/api/org/${encodeURIComponent(slug)}`;
+
+// --- Types ---
+
+export interface OrgMembership {
+	id: string;
+	slug: string;
+	name: string;
+	status: string;
+	role: 'OWNER' | 'ADMIN' | 'MEMBER';
+}
+
+export interface MeResponse {
+	user: {
+		id: string;
+		feishuOpenId: string;
+		displayName: string;
+		avatarUrl: string | null;
+	};
+	organizations: OrgMembership[];
+}
+
+export interface OrgMember {
+	userId: string;
+	feishuOpenId: string;
+	displayName: string;
+	avatarUrl: string | null;
+	role: 'OWNER' | 'ADMIN' | 'MEMBER';
+	createdAt: string;
+}
+
+export interface TeamRow {
+	id: string;
+	slug: string;
+	name: string;
+	description: string | null;
+	memberCount: number;
+	createdAt: string;
+}
+
+export interface TeamMemberRow {
+	userId: string;
+	feishuOpenId: string;
+	displayName: string;
+	createdAt: string;
+}
+
+export interface ExplorerFolder {
+	id: string;
+	name: string;
+	parentId: string | null;
+	sortKey: string;
+	projectCount: number;
+	childFolderCount: number;
+}
+
+export interface ExplorerProject {
+	id: string;
+	name: string;
+	folderId: string | null;
+	createdAt: string;
+	binding: { chatId: string; createdAt: string } | null;
+}
+
+export interface ExplorerData {
+	folders: ExplorerFolder[];
+	projects: ExplorerProject[];
+}
+
+export interface ProjectDetail {
+	id: string;
+	name: string;
+	folderId: string | null;
+	folder: { id: string; name: string } | null;
+	workspaceDir: string;
+	createdAt: string;
+	archivedAt: string | null;
+	createdBy: { id: string; displayName: string; feishuOpenId: string } | null;
+	binding: { chatId: string; createdAt: string } | null;
+	actorIsOrgAdmin?: boolean;
+	actorCanManageProject?: boolean;
+}
+
+export interface TeamAccessEntry {
+	grantId: string;
+	projectId: string;
+	organizationId: string;
+	teamId: string;
+	teamSlug: string;
+	teamName: string;
+	role: 'READ' | 'EDIT' | 'MANAGE';
+}
+
+export interface SessionSummary {
+	id: string;
+	provider: string;
+	roleId: string;
+	model: string;
+	title: string | null;
+	runCount: number;
+	createdAt: string;
+	updatedAt: string;
+}
+
+export interface ProviderConnectionRow {
+	id: string;
+	providerId: string;
+	mode: 'BYOK' | 'PLATFORM_MANAGED';
+	status: 'DRAFT' | 'ACTIVE' | 'DISABLED';
+	activeVersion: number | null;
+	keyId: string | null;
+	createdAt: string;
+	updatedAt: string;
+}
+
+export interface FeishuApplicationConnection {
+	id: string;
+	appFingerprint: string;
+	status: 'DRAFT' | 'ACTIVE' | 'DISABLED';
+	activeVersion: number | null;
+	keyId: string | null;
+	createdAt: string;
+	updatedAt: string;
+}
+
+export interface UsageTotals {
+	runCount: number;
+	runsWithCost: number;
+	runsWithoutCost: number;
+	inputTokens: number;
+	outputTokens: number;
+	costUsd: number | null;
+}
+
+export interface ProjectUsageRow extends UsageTotals {
+	projectId: string;
+	projectName: string;
+	folderId: string | null;
+}
+
+export interface UsageReport {
+	from: string | null;
+	to: string | null;
+	projects: ProjectUsageRow[];
+	totals: UsageTotals;
+}
+
+export type CapacityDimension =
+	| 'requestRate'
+	| 'requestBodySize'
+	| 'agentConcurrency'
+	| 'admissionQueueLength'
+	| 'admissionQueueWait'
+	| 'fileSize'
+	| 'attachmentCount'
+	| 'archiveExpansion'
+	| 'projectStorage'
+	| 'organizationStorage'
+	| 'memberCount'
+	| 'projectCount'
+	| 'teamCount'
+	| 'folderCount'
+	| 'sessionCount'
+	| 'runWallTime'
+	| 'runTurns'
+	| 'runToolCalls'
+	| 'toolWallTime'
+	| 'runOutputSize'
+	| 'processMemory'
+	| 'processCpu'
+	| 'processCount';
+
+export interface CapacityDimensionRow {
+	dimension: CapacityDimension;
+	platformCeiling: number | null;
+	organizationLimit: number | null;
+	effective: number | null;
+}
+
+export interface CapacityPolicyView {
+	dimensions: CapacityDimensionRow[];
+}
+
+export interface AgentRoleRow {
+	id: string;
+	roleId: string;
+	label: string;
+	defaultModel: string | null;
+	systemPrompt: string | null;
+	tools: readonly string[] | null;
+	sortOrder: number;
+	isDefault: boolean;
+	disabledAt: string | null;
+	createdAt: string;
+	updatedAt: string;
+	skillNames: readonly string[];
+}
+
+export interface AgentSkillRow {
+	id: string;
+	name: string;
+	version: string;
+	description: string | null;
+	contentDigest: string;
+	disabledAt: string | null;
+	createdAt: string;
+	updatedAt: string;
+	boundRoleIds: readonly string[];
+}
+
+export interface SkillFileEntry {
+	path: string;
+	content: string;
+}
+
+export interface InstalledSkillResult {
+	id: string;
+	name: string;
+	contentDigest: string;
+}
+
+export interface AgentModelRow {
+	id: string;
+	label: string;
+	toolCapable: boolean;
+}
+
+// --- API ---
+
+export const api = {
+	me: () => get('/api/me') as Promise<MeResponse>,
+	logout: () => post('/auth/logout'),
+
+	org: (slug: string) =>
+		get(orgBase(slug)) as Promise<{
+			organization: { id: string; slug: string; name: string; status: string };
+			actorRole: string;
+		}>,
+	settings: (slug: string) => get(`${orgBase(slug)}/settings`) as Promise<{ membersCanCreateProjects: boolean }>,
+	setSettings: (slug: string, body: { membersCanCreateProjects: boolean }) =>
+		patch(`${orgBase(slug)}/settings`, body) as Promise<{ membersCanCreateProjects: boolean }>,
+
+	members: (slug: string) => get(`${orgBase(slug)}/members`) as Promise<{ members: OrgMember[] }>,
+	addMember: (slug: string, body: { feishuOpenId: string; displayName?: string; role: string }) =>
+		post(`${orgBase(slug)}/members`, body) as Promise<OrgMember>,
+	setMemberRole: (slug: string, userId: string, role: string) => patch(`${orgBase(slug)}/members/${userId}`, { role }),
+	revokeMember: (slug: string, userId: string) => post(`${orgBase(slug)}/members/${userId}/revoke`),
+
+	teams: (slug: string) => get(`${orgBase(slug)}/teams`) as Promise<{ teams: TeamRow[] }>,
+	createTeam: (slug: string, body: { slug: string; name: string; description?: string }) =>
+		post(`${orgBase(slug)}/teams`, body) as Promise<TeamRow>,
+	updateTeam: (slug: string, teamId: string, body: { name?: string; description?: string | null }) =>
+		patch(`${orgBase(slug)}/teams/${teamId}`, body) as Promise<TeamRow>,
+	archiveTeam: (slug: string, teamId: string) => post(`${orgBase(slug)}/teams/${teamId}/archive`),
+	teamMembers: (slug: string, teamId: string) =>
+		get(`${orgBase(slug)}/teams/${teamId}/members`) as Promise<{ members: TeamMemberRow[] }>,
+	addTeamMember: (slug: string, teamId: string, body: { userId?: string; feishuOpenId?: string }) =>
+		post(`${orgBase(slug)}/teams/${teamId}/members`, body) as Promise<TeamMemberRow>,
+	revokeTeamMember: (slug: string, teamId: string, userId: string) =>
+		post(`${orgBase(slug)}/teams/${teamId}/members/${userId}/revoke`),
+
+	explorer: (slug: string) => get(`${orgBase(slug)}/explorer`) as Promise<ExplorerData>,
+	myProjects: (slug: string) => get(`${orgBase(slug)}/my-projects`) as Promise<{ projects: ExplorerProject[] }>,
+	createFolder: (slug: string, body: { name: string; parentId?: string; sortKey?: string }) =>
+		post(`${orgBase(slug)}/folders`, body) as Promise<{
+			id: string;
+			name: string;
+			parentId: string | null;
+			sortKey: string;
+		}>,
+	renameFolder: (slug: string, folderId: string, body: { name?: string; sortKey?: string; parentId?: string | null }) =>
+		patch(`${orgBase(slug)}/folders/${folderId}`, body) as Promise<{
+			id: string;
+			name: string;
+			parentId: string | null;
+			sortKey: string;
+		}>,
+	archiveFolder: (slug: string, folderId: string) =>
+		post(`${orgBase(slug)}/folders/${folderId}/archive`) as Promise<{ archived: true; folderId: string }>,
+	createProject: (slug: string, body: { name: string; folderId?: string }) =>
+		post(`${orgBase(slug)}/projects`, body) as Promise<{ id: string; name: string }>,
+	project: (slug: string, projectId: string) => get(`${orgBase(slug)}/projects/${projectId}`) as Promise<ProjectDetail>,
+	renameProject: (slug: string, projectId: string, name: string) =>
+		patch(`${orgBase(slug)}/projects/${projectId}`, { name }),
+	moveProject: (slug: string, projectId: string, folderId: string | null) =>
+		patch(`${orgBase(slug)}/projects/${projectId}/folder`, { folderId }),
+	archiveProject: (slug: string, projectId: string) => post(`${orgBase(slug)}/projects/${projectId}/archive`),
+	archiveBinding: (slug: string, projectId: string) => post(`${orgBase(slug)}/projects/${projectId}/binding/archive`),
+
+	teamAccess: (slug: string, projectId: string) =>
+		get(`${orgBase(slug)}/projects/${projectId}/team-access`) as Promise<{ access: TeamAccessEntry[] }>,
+	grantTeamAccess: (slug: string, projectId: string, body: { teamId?: string; teamSlug?: string; role: string }) =>
+		put(`${orgBase(slug)}/projects/${projectId}/team-access`, body) as Promise<TeamAccessEntry>,
+	revokeTeamAccess: (slug: string, projectId: string, teamId: string) =>
+		del(`${orgBase(slug)}/projects/${projectId}/team-access/${teamId}`),
+
+	sessions: (slug: string, projectId: string, limit?: number) =>
+		get(`${orgBase(slug)}/projects/${projectId}/sessions${limit !== undefined ? `?limit=${limit}` : ''}`) as Promise<{
+			sessions: SessionSummary[];
+		}>,
+	usage: (slug: string, params?: { from?: string; to?: string; folderId?: string }) => {
+		const q = new URLSearchParams();
+		if (params?.from) q.set('from', params.from);
+		if (params?.to) q.set('to', params.to);
+		if (params?.folderId) q.set('folderId', params.folderId);
+		const qs = q.toString();
+		return get(`${orgBase(slug)}/usage${qs ? `?${qs}` : ''}`) as Promise<UsageReport>;
+	},
+
+	providerConnections: (slug: string) =>
+		get(`${orgBase(slug)}/provider-connections`) as Promise<{ connections: ProviderConnectionRow[] }>,
+	rotateProviderConnection: (
+		slug: string,
+		providerId: string,
+		body: { baseUrl: string; authToken: string; anthropicApiKey?: string },
+	) =>
+		put(
+			`${orgBase(slug)}/provider-connections/${encodeURIComponent(providerId)}`,
+			body,
+		) as Promise<ProviderConnectionRow>,
+
+	feishuApplication: (slug: string) =>
+		get(`${orgBase(slug)}/feishu-application-connection`) as Promise<{
+			connection: FeishuApplicationConnection | null;
+		}>,
+	rotateFeishuApplication: (
+		slug: string,
+		body: {
+			appId: string;
+			appSecret: string;
+			botOpenId: string;
+			verificationToken?: string;
+			encryptKey?: string;
+		},
+	) => put(`${orgBase(slug)}/feishu-application-connection`, body) as Promise<FeishuApplicationConnection>,
+	disableFeishuApplication: (slug: string) =>
+		del(`${orgBase(slug)}/feishu-application-connection`) as Promise<FeishuApplicationConnection>,
+
+	capacityPolicy: (slug: string) => get(`${orgBase(slug)}/capacity-policy`) as Promise<CapacityPolicyView>,
+	setCapacityPolicy: (slug: string, body: { limits: Partial<Record<CapacityDimension, number | null>> }) =>
+		put(`${orgBase(slug)}/capacity-policy`, body) as Promise<CapacityPolicyView>,
+
+	agentRoles: (slug: string) => get(`${orgBase(slug)}/agent-roles`) as Promise<{ roles: AgentRoleRow[] }>,
+	upsertAgentRole: (
+		slug: string,
+		roleId: string,
+		body: {
+			label: string;
+			defaultModel?: string | null;
+			systemPrompt?: string | null;
+			tools?: readonly string[] | null;
+			sortOrder?: number;
+			isDefault?: boolean;
+		},
+	) => put(`${orgBase(slug)}/agent-roles/${encodeURIComponent(roleId)}`, body) as Promise<AgentRoleRow>,
+	setAgentRoleSkills: (slug: string, roleId: string, skillNames: readonly string[]) =>
+		put(`${orgBase(slug)}/agent-roles/${encodeURIComponent(roleId)}/skills`, { skillNames }) as Promise<{
+			skillNames: string[];
+		}>,
+	agentSkills: (slug: string) => get(`${orgBase(slug)}/agent-skills`) as Promise<{ skills: AgentSkillRow[] }>,
+	agentSkillFiles: (slug: string, name: string) =>
+		get(`${orgBase(slug)}/agent-skills/${encodeURIComponent(name)}/files`) as Promise<{ files: SkillFileEntry[] }>,
+	installAgentSkill: (slug: string, name: string, body: { version: string; files: readonly SkillFileEntry[] }) =>
+		put(`${orgBase(slug)}/agent-skills/${encodeURIComponent(name)}`, body) as Promise<InstalledSkillResult>,
+	patchAgentSkill: (slug: string, name: string, body: { description?: string; disabled?: boolean }) =>
+		patch(`${orgBase(slug)}/agent-skills/${encodeURIComponent(name)}`, body) as Promise<{ disabled?: boolean; updated?: boolean }>,
+	agentModels: (slug: string) => get(`${orgBase(slug)}/agent-models`) as Promise<{ models: AgentModelRow[] }>,
+};

hub/admin-web/src/lib/assets/favicon.svg

@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="107" height="128" viewBox="0 0 107 128"><title>svelte-logo</title><path d="M94.157 22.819c-10.4-14.885-30.94-19.297-45.792-9.835L22.282 29.608A29.92 29.92 0 0 0 8.764 49.65a31.5 31.5 0 0 0 3.108 20.231 30 30 0 0 0-4.477 11.183 31.9 31.9 0 0 0 5.448 24.116c10.402 14.887 30.942 19.297 45.791 9.835l26.083-16.624A29.92 29.92 0 0 0 98.235 78.35a31.53 31.53 0 0 0-3.105-20.232 30 30 0 0 0 4.474-11.182 31.88 31.88 0 0 0-5.447-24.116" style="fill:#ff3e00"/><path d="M45.817 106.582a20.72 20.72 0 0 1-22.237-8.243 19.17 19.17 0 0 1-3.277-14.503 18 18 0 0 1 .624-2.435l.49-1.498 1.337.981a33.6 33.6 0 0 0 10.203 5.098l.97.294-.09.968a5.85 5.85 0 0 0 1.052 3.878 6.24 6.24 0 0 0 6.695 2.485 5.8 5.8 0 0 0 1.603-.704L69.27 76.28a5.43 5.43 0 0 0 2.45-3.631 5.8 5.8 0 0 0-.987-4.371 6.24 6.24 0 0 0-6.698-2.487 5.7 5.7 0 0 0-1.6.704l-9.953 6.345a19 19 0 0 1-5.296 2.326 20.72 20.72 0 0 1-22.237-8.243 19.17 19.17 0 0 1-3.277-14.502 17.99 17.99 0 0 1 8.13-12.052l26.081-16.623a19 19 0 0 1 5.3-2.329 20.72 20.72 0 0 1 22.237 8.243 19.17 19.17 0 0 1 3.277 14.503 18 18 0 0 1-.624 2.435l-.49 1.498-1.337-.98a33.6 33.6 0 0 0-10.203-5.1l-.97-.294.09-.968a5.86 5.86 0 0 0-1.052-3.878 6.24 6.24 0 0 0-6.696-2.485 5.8 5.8 0 0 0-1.602.704L37.73 51.72a5.42 5.42 0 0 0-2.449 3.63 5.79 5.79 0 0 0 .986 4.372 6.24 6.24 0 0 0 6.698 2.486 5.8 5.8 0 0 0 1.602-.704l9.952-6.342a19 19 0 0 1 5.295-2.328 20.72 20.72 0 0 1 22.237 8.242 19.17 19.17 0 0 1 3.277 14.503 18 18 0 0 1-8.13 12.053l-26.081 16.622a19 19 0 0 1-5.3 2.328" style="fill:#fff"/></svg>

hub/admin-web/src/lib/components/CheckboxControl.svelte

@@ -0,0 +1,32 @@
+<script lang="ts">
+	import { Checkbox } from 'bits-ui';
+	import Icon from './Icon.svelte';
+
+	let {
+		checked = $bindable(false),
+		disabled = false,
+		class: className = '',
+		onchange,
+	}: {
+		checked?: boolean;
+		disabled?: boolean;
+		class?: string;
+		onchange?: (checked: boolean) => void;
+	} = $props();
+</script>
+
+<Checkbox.Root
+	class="saas-checkbox {className}"
+	{disabled}
+	{checked}
+	onCheckedChange={(next) => {
+		checked = next;
+		onchange?.(next);
+	}}
+>
+	{#snippet children({ checked: isChecked })}
+		{#if isChecked}
+			<Icon name="check" class="h-3.5 w-3.5" />
+		{/if}
+	{/snippet}
+</Checkbox.Root>

hub/admin-web/src/lib/components/EmptyState.svelte

@@ -0,0 +1,32 @@
+<script lang="ts">
+	import type { Snippet } from 'svelte';
+
+	let {
+		title = '暂无数据',
+		description,
+		action,
+	}: {
+		title?: string;
+		description?: string;
+		action?: Snippet;
+	} = $props();
+</script>
+
+<div class="saas-empty">
+	<div
+		class="mb-1 flex h-12 w-12 items-center justify-center border border-surface-300 bg-surface-100 text-surface-600"
+	>
+		<svg class="h-6 w-6" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.75">
+			<path stroke-linecap="round" stroke-linejoin="round" d="M3.75 6.75h16.5M3.75 12h16.5m-16.5 5.25H12" />
+		</svg>
+	</div>
+	<p class="text-sm font-medium text-surface-900">{title}</p>
+	{#if description}
+		<p class="max-w-sm text-sm text-surface-600">{description}</p>
+	{/if}
+	{#if action}
+		<div class="mt-2">
+			{@render action()}
+		</div>
+	{/if}
+</div>

hub/admin-web/src/lib/components/ErrorBanner.svelte

@@ -0,0 +1,26 @@
+<script lang="ts">
+	let {
+		message,
+		onretry,
+	}: {
+		message: string;
+		onretry?: () => void;
+	} = $props();
+</script>
+
+<div class="saas-card flex flex-wrap items-start gap-3 border-error-200 bg-error-50 p-4 text-error-700">
+	<svg class="mt-0.5 h-5 w-5 shrink-0" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.75">
+		<path
+			stroke-linecap="round"
+			stroke-linejoin="round"
+			d="M12 9v3.75m9-.75a9 9 0 11-18 0 9 9 0 0118 0zm-9 3.75h.008v.008H12v-.008z"
+		/>
+	</svg>
+	<div class="min-w-0 flex-1">
+		<p class="text-sm font-medium">请求失败</p>
+		<p class="mt-0.5 text-sm opacity-90">{message}</p>
+	</div>
+	{#if onretry}
+		<button type="button" class="saas-btn-ghost text-sm" onclick={onretry}>重试</button>
+	{/if}
+</div>

hub/admin-web/src/lib/components/FolderNode.svelte

@@ -0,0 +1,78 @@
+<script lang="ts">
+	import type { ExplorerFolder } from '$lib/api';
+	import Icon from './Icon.svelte';
+	import FolderTree from './FolderTree.svelte';
+
+	let {
+		folder,
+		folders,
+		projects,
+		slug,
+		onCreateFolder,
+		onCreateProject,
+	}: {
+		folder: ExplorerFolder;
+		folders: ExplorerFolder[];
+		projects: {
+			id: string;
+			name: string;
+			folderId: string | null;
+			createdAt: string;
+			binding: { chatId: string } | null;
+		}[];
+		slug: string;
+		onCreateFolder?: (parentId: string) => void;
+		onCreateProject?: (folderId: string) => void;
+	} = $props();
+
+	let open = $state(true);
+</script>
+
+<div>
+	<div class="group flex w-full items-center gap-2.5 px-3 py-2.5 text-sm transition hover:bg-surface-100">
+		<button type="button" class="flex min-w-0 flex-1 items-center gap-2.5 text-left" onclick={() => (open = !open)}>
+			<span class="w-3.5 text-center text-xs text-surface-600">{open ? '▾' : '▸'}</span>
+			<span class="flex h-7 w-7 items-center justify-center border border-warning-300 bg-warning-50 text-warning-800">
+				<Icon name="folder" class="h-4 w-4" />
+			</span>
+			<span class="min-w-0 flex-1 truncate font-medium text-surface-900">{folder.name}</span>
+			<span class="saas-badge-neutral">{folder.projectCount} 项目</span>
+			{#if folder.childFolderCount > 0}
+				<span class="saas-badge-neutral">{folder.childFolderCount} 子夹</span>
+			{/if}
+		</button>
+		{#if onCreateFolder || onCreateProject}
+			<span
+				class="flex shrink-0 items-center gap-1 opacity-0 transition group-hover:opacity-100 focus-within:opacity-100"
+			>
+				{#if onCreateFolder}
+					<button
+						type="button"
+						class="flex h-6 w-6 items-center justify-center border border-surface-300 bg-surface-50 text-surface-600 transition hover:border-primary-400 hover:text-primary-700"
+						title="在此新建子文件夹"
+						aria-label="在 {folder.name} 内新建子文件夹"
+						onclick={() => onCreateFolder(folder.id)}
+					>
+						<Icon name="folder-plus" class="h-4 w-4" />
+					</button>
+				{/if}
+				{#if onCreateProject}
+					<button
+						type="button"
+						class="flex h-6 w-6 items-center justify-center border border-surface-300 bg-surface-50 text-surface-600 transition hover:border-primary-400 hover:text-primary-700"
+						title="在此新建项目"
+						aria-label="在 {folder.name} 内新建项目"
+						onclick={() => onCreateProject(folder.id)}
+					>
+						<Icon name="file-plus" class="h-4 w-4" />
+					</button>
+				{/if}
+			</span>
+		{/if}
+	</div>
+	{#if open}
+		<div class="ml-4 border-l border-surface-300 pl-2">
+			<FolderTree {folders} {projects} parentId={folder.id} {slug} {onCreateFolder} {onCreateProject} />
+		</div>
+	{/if}
+</div>

hub/admin-web/src/lib/components/FolderTree.svelte

@@ -0,0 +1,53 @@
+<script lang="ts">
+	import type { ExplorerFolder } from '$lib/api';
+	import { fmtDate } from '$lib/format';
+	import Icon from './Icon.svelte';
+	import FolderNode from './FolderNode.svelte';
+
+	let {
+		folders,
+		projects,
+		parentId,
+		slug,
+		onCreateFolder,
+		onCreateProject,
+	}: {
+		folders: ExplorerFolder[];
+		projects: {
+			id: string;
+			name: string;
+			folderId: string | null;
+			createdAt: string;
+			binding: { chatId: string } | null;
+		}[];
+		parentId: string | null;
+		slug: string;
+		onCreateFolder?: (parentId: string) => void;
+		onCreateProject?: (folderId: string) => void;
+	} = $props();
+
+	let childFolders = $derived(folders.filter((f) => f.parentId === parentId));
+	let childProjects = $derived(projects.filter((p) => p.folderId === parentId));
+</script>
+
+<div class="space-y-0.5">
+	{#each childProjects as p (p.id)}
+		<a
+			href={`/admin/org/${slug}/projects/${p.id}`}
+			class="flex items-center gap-2.5 px-3 py-2.5 text-sm transition hover:bg-surface-100"
+		>
+			<span class="flex h-7 w-7 items-center justify-center border border-primary-200 bg-primary-50 text-primary-700">
+				<Icon name="file" class="h-4 w-4" />
+			</span>
+			<span class="min-w-0 flex-1 truncate font-medium text-surface-900">{p.name}</span>
+			{#if p.binding}
+				<span class="saas-badge-success">已绑定</span>
+			{/if}
+			<span class="hidden text-xs text-surface-600 sm:inline">{fmtDate(p.createdAt)}</span>
+		</a>
+	{/each}
+
+	{#each childFolders as f (f.id)}
+		<FolderNode folder={f} {folders} {projects} {slug} {onCreateFolder} {onCreateProject} />
+	{/each}
+</div>

hub/admin-web/src/lib/components/Icon.svelte

@@ -0,0 +1,155 @@
+<script lang="ts">
+	/** Inline nav icons for the admin shell. */
+	let {
+		name,
+		class: className = 'h-4 w-4',
+	}: {
+		name:
+			| 'overview'
+			| 'members'
+			| 'teams'
+			| 'projects'
+			| 'provider'
+			| 'feishu'
+			| 'menu'
+			| 'logout'
+			| 'org'
+			| 'chevron'
+			| 'arrow-left'
+			| 'folder'
+			| 'file'
+			| 'folder-plus'
+			| 'file-plus'
+			| 'check'
+			| 'roles';
+		class?: string;
+	} = $props();
+</script>
+
+{#if name === 'overview'}
+	<svg class={className} viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.75">
+		<path
+			stroke-linecap="round"
+			stroke-linejoin="round"
+			d="M3 12l9-9 9 9M5 10v9a1 1 0 001 1h3v-5h6v5h3a1 1 0 001-1v-9"
+		/>
+	</svg>
+{:else if name === 'members'}
+	<svg class={className} viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.75">
+		<path
+			stroke-linecap="round"
+			stroke-linejoin="round"
+			d="M15.75 7.5a3.75 3.75 0 11-7.5 0 3.75 3.75 0 017.5 0zM4.5 19.5a7.5 7.5 0 0115 0"
+		/>
+	</svg>
+{:else if name === 'teams'}
+	<svg class={className} viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.75">
+		<path
+			stroke-linecap="round"
+			stroke-linejoin="round"
+			d="M18 18.72a9.09 9.09 0 003.74-.72 9 9 0 00-5.07-5.95M15 11a4 4 0 10-8 0 4 4 0 008 0zM4.26 18a9 9 0 0115.48 0"
+		/>
+	</svg>
+{:else if name === 'projects'}
+	<svg class={className} viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.75">
+		<path
+			stroke-linecap="round"
+			stroke-linejoin="round"
+			d="M3.75 6.75A2.25 2.25 0 016 4.5h3.379c.6 0 1.175.238 1.6.66l.842.84c.424.423 1 .66 1.6.66H18A2.25 2.25 0 0120.25 9v8.25A2.25 2.25 0 0118 19.5H6a2.25 2.25 0 01-2.25-2.25V6.75z"
+		/>
+	</svg>
+{:else if name === 'provider'}
+	<svg class={className} viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.75">
+		<path
+			stroke-linecap="round"
+			stroke-linejoin="round"
+			d="M13.19 8.688a4.5 4.5 0 016.364 6.364l-3.182 3.182a4.5 4.5 0 01-6.364-6.364"
+		/>
+		<path
+			stroke-linecap="round"
+			stroke-linejoin="round"
+			d="M10.81 15.312a4.5 4.5 0 01-6.364-6.364l3.182-3.182a4.5 4.5 0 016.364 6.364"
+		/>
+	</svg>
+{:else if name === 'feishu'}
+	<svg class={className} viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.75">
+		<path
+			stroke-linecap="round"
+			stroke-linejoin="round"
+			d="M4.5 8.25h15a8.25 8.25 0 01-8.25 8.25A8.25 8.25 0 014.5 8.25z"
+		/>
+		<path stroke-linecap="round" stroke-linejoin="round" d="M8.25 11.25h.01M12 11.25h.01M15.75 11.25h.01" />
+	</svg>
+{:else if name === 'menu'}
+	<svg class={className} viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.75">
+		<path stroke-linecap="round" stroke-linejoin="round" d="M3.75 6.75h16.5M3.75 12h16.5m-16.5 5.25h16.5" />
+	</svg>
+{:else if name === 'logout'}
+	<svg class={className} viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.75">
+		<path
+			stroke-linecap="round"
+			stroke-linejoin="round"
+			d="M15.75 9V5.25A2.25 2.25 0 0013.5 3h-6A2.25 2.25 0 005.25 5.25v13.5A2.25 2.25 0 007.5 21h6a2.25 2.25 0 002.25-2.25V15M12 9l3 3m0 0l-3 3m3-3H6"
+		/>
+	</svg>
+{:else if name === 'org'}
+	<svg class={className} viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.75">
+		<path
+			stroke-linecap="round"
+			stroke-linejoin="round"
+			d="M3.75 21h16.5M4.5 3h15M5.25 3v18m13.5-18v18M9 6.75h1.5m-1.5 3h1.5m-1.5 3h1.5m3-6H15m-1.5 3H15m-1.5 3H15M9 21v-3.375c0-.621.504-1.125 1.125-1.125h3.75c.621 0 1.125.504 1.125 1.125V21"
+		/>
+	</svg>
+{:else if name === 'chevron'}
+	<svg class={className} viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.75">
+		<path stroke-linecap="round" stroke-linejoin="round" d="M8.25 4.5l7.5 7.5-7.5 7.5" />
+	</svg>
+{:else if name === 'arrow-left'}
+	<svg class={className} viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.75">
+		<path stroke-linecap="round" stroke-linejoin="round" d="M10.5 19.5L3 12m0 0l7.5-7.5M3 12h18" />
+	</svg>
+{:else if name === 'folder'}
+	<svg class={className} viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.75">
+		<path
+			stroke-linecap="round"
+			stroke-linejoin="round"
+			d="M3.75 6.75A2.25 2.25 0 016 4.5h3.379c.6 0 1.175.238 1.6.66l.842.84c.424.423 1 .66 1.6.66H18A2.25 2.25 0 0120.25 9v8.25A2.25 2.25 0 0118 19.5H6a2.25 2.25 0 01-2.25-2.25V6.75z"
+		/>
+	</svg>
+{:else if name === 'file'}
+	<svg class={className} viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.75">
+		<path
+			stroke-linecap="round"
+			stroke-linejoin="round"
+			d="M19.5 14.25v-2.625a3.375 3.375 0 00-3.375-3.375h-1.5A1.125 1.125 0 0113.5 7.125v-1.5a3.375 3.375 0 00-3.375-3.375H8.25m0 12.75h7.5m-7.5 3H12M10.5 2.25H5.625c-.621 0-1.125.504-1.125 1.125v17.25c0 .621.504 1.125 1.125 1.125h12.75c.621 0 1.125-.504 1.125-1.125V11.25a9 9 0 00-9-9z"
+		/>
+	</svg>
+{:else if name === 'folder-plus'}
+	<svg class={className} viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.75">
+		<path
+			stroke-linecap="round"
+			stroke-linejoin="round"
+			d="M12 10.5v6m3-3H9m4.06-7.19l-2.12-2.12a1.5 1.5 0 00-1.061-.44H4.5A2.25 2.25 0 002.25 6v12a2.25 2.25 0 002.25 2.25h15A2.25 2.25 0 0021.75 18V9a2.25 2.25 0 00-2.25-2.25h-5.379a1.5 1.5 0 01-1.06-.44z"
+		/>
+	</svg>
+{:else if name === 'file-plus'}
+	<svg class={className} viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.75">
+		<path
+			stroke-linecap="round"
+			stroke-linejoin="round"
+			d="M19.5 14.25v-2.625a3.375 3.375 0 00-3.375-3.375h-1.5A1.125 1.125 0 0113.5 7.125v-1.5a3.375 3.375 0 00-3.375-3.375H8.25m3.75 9v6m3-3H9m1.5-12H5.625c-.621 0-1.125.504-1.125 1.125v17.25c0 .621.504 1.125 1.125 1.125h12.75c.621 0 1.125-.504 1.125-1.125V11.25a9 9 0 00-9-9z"
+		/>
+	</svg>
+{:else if name === 'check'}
+	<svg class={className} viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.75">
+		<path stroke-linecap="round" stroke-linejoin="round" d="M4.5 12.75l6 6 9-13.5" />
+	</svg>
+{:else if name === 'roles'}
+	<svg class={className} viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.75">
+		<path
+			stroke-linecap="round"
+			stroke-linejoin="round"
+			d="M9.813 15.904L9 18.75l-.813-2.846a4.5 4.5 0 00-3.09-3.09L2.25 12l2.847-.813a4.5 4.5 0 003.09-3.09L9 5.25l.813 2.846a4.5 4.5 0 003.09 3.09L15.75 12l-2.847.813a4.5 4.5 0 00-3.09 3.09zM18.259 8.715L18 9.75l-.259-1.035a3.375 3.375 0 00-2.456-2.456L14.25 6l1.035-.259a3.375 3.375 0 002.456-2.456L18 2.25l.259 1.035a3.375 3.375 0 002.456 2.456L21.75 6l-1.035.259a3.375 3.375 0 00-2.456 2.456zM16.894 20.567L16.5 21.75l-.394-1.183a2.25 2.25 0 00-1.423-1.423L13.5 18.75l1.183-.394a2.25 2.25 0 001.423-1.423l.394-1.183.394 1.183a2.25 2.25 0 001.423 1.423l1.183.394-1.183.394a2.25 2.25 0 00-1.423 1.423z"
+		/>
+	</svg>
+{/if}

hub/admin-web/src/lib/components/LoadingState.svelte

@@ -0,0 +1,15 @@
+<script lang="ts">
+	let { label = '加载中…' }: { label?: string } = $props();
+</script>
+
+<div class="flex flex-col items-center justify-center gap-3 py-16 text-surface-600">
+	<svg class="h-7 w-7 animate-spin text-primary-500" viewBox="0 0 24 24" fill="none">
+		<circle class="opacity-25" cx="12" cy="12" r="10" stroke="currentColor" stroke-width="4"></circle>
+		<path
+			class="opacity-90"
+			fill="currentColor"
+			d="M4 12a8 8 0 018-8V0C5.373 0 0 5.373 0 12h4zm2 5.291A7.962 7.962 0 014 12H0c0 3.042 1.135 5.824 3 7.938l3-2.647z"
+		></path>
+	</svg>
+	<p class="text-sm">{label}</p>
+</div>

hub/admin-web/src/lib/components/Modal.svelte

@@ -0,0 +1,38 @@
+<script lang="ts">
+	import type { Snippet } from 'svelte';
+	import { Dialog } from 'bits-ui';
+
+	let {
+		open = $bindable(false),
+		title,
+		children,
+		onclose,
+	}: {
+		open?: boolean;
+		title: string;
+		children: Snippet;
+		onclose?: () => void;
+	} = $props();
+</script>
+
+<Dialog.Root
+	bind:open
+	onOpenChange={(next) => {
+		if (!next) onclose?.();
+	}}
+>
+	<Dialog.Portal>
+		<Dialog.Overlay class="saas-modal-backdrop" />
+		<Dialog.Content class="saas-modal">
+			<div class="mb-4 flex items-start justify-between gap-3">
+				<Dialog.Title class="text-lg font-semibold text-surface-900">{title}</Dialog.Title>
+				<Dialog.Close class="saas-btn-ghost px-2! py-1! text-surface-600" aria-label="关闭">
+					<svg class="h-5 w-5" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.75">
+						<path stroke-linecap="round" stroke-linejoin="round" d="M6 18L18 6M6 6l12 12" />
+					</svg>
+				</Dialog.Close>
+			</div>
+			{@render children()}
+		</Dialog.Content>
+	</Dialog.Portal>
+</Dialog.Root>

hub/admin-web/src/lib/components/PageHeader.svelte

@@ -0,0 +1,27 @@
+<script lang="ts">
+	import type { Snippet } from 'svelte';
+
+	let {
+		title,
+		description,
+		actions,
+	}: {
+		title: string;
+		description?: string;
+		actions?: Snippet;
+	} = $props();
+</script>
+
+<div class="saas-toolbar">
+	<div class="min-w-0">
+		<h1 class="saas-page-title">{title}</h1>
+		{#if description}
+			<p class="saas-muted mt-1">{description}</p>
+		{/if}
+	</div>
+	{#if actions}
+		<div class="ml-auto flex flex-wrap items-center gap-2">
+			{@render actions()}
+		</div>
+	{/if}
+</div>

hub/admin-web/src/lib/components/RoleCard.svelte

@@ -0,0 +1,208 @@
+<script lang="ts">
+	import { Checkbox, Label } from 'bits-ui';
+	import type { AgentRoleRow, AgentModelRow, AgentSkillRow } from '$lib/api';
+	import { api } from '$lib/api';
+	import { fmtDate } from '$lib/format';
+	import { TOOL_OPTIONS } from '$lib/constants';
+	import SelectField from '$lib/components/SelectField.svelte';
+	import CheckboxControl from '$lib/components/CheckboxControl.svelte';
+	import Icon from '$lib/components/Icon.svelte';
+	import { toastError, toastSuccess } from '$lib/toast';
+
+	let {
+		r,
+		models,
+		skills,
+		slug,
+		onupdated,
+		onskillschanged,
+	}: {
+		r: AgentRoleRow;
+		models: AgentModelRow[];
+		skills: AgentSkillRow[];
+		slug: string;
+		onupdated: (updated: AgentRoleRow) => void;
+		onskillschanged: (roleId: string, skillNames: string[]) => void;
+	} = $props();
+
+	const initial = {
+		label: r.label,
+		defaultModel: r.defaultModel ?? '',
+		systemPrompt: r.systemPrompt ?? '',
+		unrestricted: r.tools === null,
+		tools: r.tools ?? [],
+		sortOrder: String(r.sortOrder),
+		isDefault: r.isDefault,
+		skillNames: r.skillNames,
+	};
+	let label = $state(initial.label);
+	let defaultModel = $state(initial.defaultModel);
+	let systemPrompt = $state(initial.systemPrompt);
+	let unrestricted = $state(initial.unrestricted);
+	let selectedTools = $state<string[]>([...initial.tools]);
+	let sortOrder = $state(initial.sortOrder);
+	let isDefault = $state(initial.isDefault);
+	let selectedSkills = $state<string[]>([...initial.skillNames]);
+	let saving = $state(false);
+
+	const groupedTools = TOOL_OPTIONS.reduce(
+		(acc, t) => {
+			(acc[t.group] ??= []).push(t);
+			return acc;
+		},
+		{} as Record<string, typeof TOOL_OPTIONS>,
+	);
+
+	const modelItems = $derived([
+		{ value: '', label: '（使用平台默认模型）' },
+		...models.map((m) => ({ value: m.id, label: `${m.label}（${m.id}）` })),
+	]);
+
+	const skillItems = $derived(skills.map((s) => ({ value: s.name, label: s.name })));
+
+	function skillsDirty(): boolean {
+		const a = [...selectedSkills].sort();
+		const b = [...r.skillNames].sort();
+		return a.length !== b.length || a.some((v, i) => v !== b[i]);
+	}
+
+	async function save() {
+		const trimmedLabel = label.trim();
+		if (trimmedLabel === '') {
+			toastError('显示名不能为空');
+			return;
+		}
+		const order = Number(sortOrder);
+		if (sortKeyDirty() && (!Number.isSafeInteger(order) || order < 0)) {
+			toastError('排序必须为非负整数');
+			return;
+		}
+		saving = true;
+		const tools = unrestricted ? null : selectedTools;
+		try {
+			const updated = await api.upsertAgentRole(slug, r.roleId, {
+				label: trimmedLabel,
+				defaultModel: defaultModel === '' ? null : defaultModel,
+				systemPrompt: systemPrompt === '' ? null : systemPrompt,
+				tools,
+				...(sortKeyDirty() ? { sortOrder: order } : {}),
+				isDefault,
+			});
+			onupdated(updated);
+			if (skillsDirty()) {
+				const res = await api.setAgentRoleSkills(slug, r.roleId, selectedSkills);
+				selectedSkills = [...res.skillNames];
+				onskillschanged(r.roleId, res.skillNames);
+			}
+			toastSuccess('角色已保存');
+		} catch (err) {
+			toastError(err instanceof Error ? err.message : String(err));
+		} finally {
+			saving = false;
+		}
+	}
+
+	function sortKeyDirty(): boolean {
+		return Number(sortOrder) !== r.sortOrder;
+	}
+</script>
+
+<div class="saas-card-pad">
+	<div class="mb-4 flex flex-wrap items-center gap-2">
+		<span class="saas-badge-primary font-mono">/{r.roleId}</span>
+		<span class="text-sm text-surface-700">{label || r.label}</span>
+		{#if r.isDefault}
+			<span class="saas-badge-success">默认</span>
+		{/if}
+	</div>
+
+	<div class="grid grid-cols-1 gap-4 md:grid-cols-2">
+		<div>
+			<Label.Root for="role-label-{r.id}" class="saas-label">显示名</Label.Root>
+			<input id="role-label-{r.id}" class="saas-input" bind:value={label} />
+		</div>
+		<div>
+			<Label.Root for="role-sort-{r.id}" class="saas-label">排序</Label.Root>
+			<input id="role-sort-{r.id}" class="saas-input" type="number" min="0" bind:value={sortOrder} />
+		</div>
+	</div>
+
+	<div class="mt-4">
+		<p class="saas-label">默认模型</p>
+		<SelectField items={modelItems} bind:value={defaultModel} />
+	</div>
+
+	<div class="mt-4">
+		<span class="saas-label">工具白名单</span>
+		<label class="mb-3 flex cursor-pointer items-center gap-2 border border-surface-300 bg-surface-100 px-3 py-2">
+			<CheckboxControl bind:checked={unrestricted} />
+			<span class="text-sm">不限（使用全部注册工具）</span>
+		</label>
+		<div class="space-y-3 {unrestricted ? 'pointer-events-none opacity-40' : ''}">
+			<Checkbox.Group bind:value={selectedTools} disabled={unrestricted}>
+				{#each Object.entries(groupedTools) as [group, tools]}
+					<div>
+						<p class="mb-1.5 text-xs font-semibold uppercase tracking-wide text-surface-600">{group}</p>
+						<div class="grid grid-cols-1 gap-1.5 sm:grid-cols-2">
+							{#each tools as t}
+								<label class="flex cursor-pointer items-center gap-2 px-2 py-1.5 text-sm hover:bg-surface-100">
+									<Checkbox.Root class="saas-checkbox" value={t.id} id={`tool-${r.id}-${t.id}`}>
+										{#snippet children({ checked })}
+											{#if checked}
+												<Icon name="check" class="h-3.5 w-3.5" />
+											{/if}
+										{/snippet}
+									</Checkbox.Root>
+									<span>{t.label}</span>
+								</label>
+							{/each}
+						</div>
+					</div>
+				{/each}
+			</Checkbox.Group>
+		</div>
+	</div>
+
+	<div class="mt-4">
+		<span class="saas-label">技能绑定</span>
+		{#if skills.length === 0}
+			<p class="text-sm text-surface-600">组织内暂无已安装技能。技能通过 CLI / seed 安装（ADR-0018）。</p>
+		{:else}
+			<div class="grid grid-cols-1 gap-1.5 sm:grid-cols-2">
+				{#each skillItems as s}
+					<label class="flex cursor-pointer items-center gap-2 px-2 py-1.5 text-sm hover:bg-surface-100">
+						<CheckboxControl
+							checked={selectedSkills.includes(s.value)}
+							onchange={(checked) => {
+								selectedSkills = checked ? [...selectedSkills, s.value] : selectedSkills.filter((x) => x !== s.value);
+							}}
+						/>
+						<span class="font-mono text-xs">{s.label}</span>
+					</label>
+				{/each}
+			</div>
+		{/if}
+	</div>
+
+	<div class="mt-4">
+		<Label.Root for="role-prompt-{r.id}" class="saas-label">系统提示词</Label.Root>
+		<textarea
+			id="role-prompt-{r.id}"
+			class="saas-textarea"
+			rows="4"
+			placeholder="系统提示词（可选）。会话开始时注入，定义智能体人格/指令。"
+			bind:value={systemPrompt}></textarea>
+	</div>
+
+	<div class="mt-4 flex flex-wrap items-center gap-3 border-t border-surface-100 pt-4">
+		<label class="flex cursor-pointer items-center gap-2">
+			<CheckboxControl bind:checked={isDefault} />
+			<span class="text-sm">设为组织默认角色</span>
+		</label>
+		<span class="text-xs text-surface-600">更新于 {fmtDate(r.updatedAt)}</span>
+		<div class="flex-1"></div>
+		<button class="saas-btn-primary" onclick={save} disabled={saving}>
+			{saving ? '保存中…' : '保存'}
+		</button>
+	</div>
+</div>

hub/admin-web/src/lib/components/SelectField.svelte

@@ -0,0 +1,66 @@
+<script lang="ts">
+	import { Select } from 'bits-ui';
+	import Icon from './Icon.svelte';
+
+	export type SelectItem = { label: string; value: string; disabled?: boolean };
+
+	let {
+		items,
+		value = $bindable(''),
+		class: className = '',
+		disabled = false,
+		placeholder = '请选择…',
+		onchange,
+	}: {
+		items: SelectItem[];
+		value?: string;
+		class?: string;
+		disabled?: boolean;
+		placeholder?: string;
+		onchange?: (value: string) => void;
+	} = $props();
+</script>
+
+<Select.Root
+	type="single"
+	{items}
+	{disabled}
+	{value}
+	onValueChange={(next) => {
+		value = next;
+		onchange?.(next);
+	}}
+>
+	<Select.Trigger class="saas-select-trigger {className}" {disabled}>
+		<span class="min-w-0 flex-1 truncate text-left">
+			<Select.Value {placeholder} />
+		</span>
+		<svg
+			class="ml-2 h-4 w-4 shrink-0 text-surface-600"
+			viewBox="0 0 24 24"
+			fill="none"
+			stroke="currentColor"
+			stroke-width="1.75"
+			aria-hidden="true"
+		>
+			<path stroke-linecap="round" stroke-linejoin="round" d="M8.25 15l3.75 3.75L15.75 15" />
+			<path stroke-linecap="round" stroke-linejoin="round" d="M8.25 9l3.75-3.75L15.75 9" />
+		</svg>
+	</Select.Trigger>
+	<Select.Portal>
+		<Select.Content class="saas-select-content" sideOffset={6} collisionPadding={8}>
+			<Select.Viewport class="p-1">
+				{#each items as item (item.value)}
+					<Select.Item class="saas-select-item" value={item.value} label={item.label} disabled={item.disabled}>
+						{#snippet children({ selected })}
+							<span class="min-w-0 flex-1 truncate">{item.label}</span>
+							{#if selected}
+								<Icon name="check" class="ml-2 h-4 w-4 shrink-0 text-primary-600" />
+							{/if}
+						{/snippet}
+					</Select.Item>
+				{/each}
+			</Select.Viewport>
+		</Select.Content>
+	</Select.Portal>
+</Select.Root>

hub/admin-web/src/lib/components/SkillEditor.svelte

@@ -0,0 +1,305 @@
+<script lang="ts">
+	import type { AgentSkillRow, SkillFileEntry } from '$lib/api';
+	import { api } from '$lib/api';
+	import { fmtDate } from '$lib/format';
+	import Icon from '$lib/components/Icon.svelte';
+	import { toastError, toastSuccess } from '$lib/toast';
+
+	let {
+		slug,
+		skill,
+		oninstalled,
+		ondisabled,
+	}: {
+		slug: string;
+		skill: AgentSkillRow;
+		oninstalled: (result: { id: string; name: string; contentDigest: string }) => void;
+		ondisabled: (name: string) => void;
+	} = $props();
+
+	type FileNode = { path: string; content: string };
+
+	let files = $state<FileNode[]>([]);
+	let selectedPath = $state<string | null>(null);
+	let version = $state(skill.version);
+	let description = $state(skill.description ?? '');
+	let loading = $state(false);
+	let saving = $state(false);
+	let dirty = $state(false);
+	let newFilePath = $state('');
+	let showNewFile = $state(false);
+
+	const selectedFile = $derived(files.find((f) => f.path === selectedPath) ?? null);
+	const hasManifest = $derived(files.some((f) => f.path === 'SKILL.md'));
+	const sortedFiles = $derived([...files].sort((a, b) => a.path.localeCompare(b.path)));
+
+	async function loadFiles() {
+		loading = true;
+		try {
+			const res = await api.agentSkillFiles(slug, skill.name);
+			files = res.files.map((f) => ({ path: f.path, content: f.content }));
+			if (files.length > 0 && selectedPath === null) {
+				selectedPath = files[0]!.path;
+			}
+			dirty = false;
+		} catch (err) {
+			toastError(err instanceof Error ? err.message : String(err));
+		} finally {
+			loading = false;
+		}
+	}
+
+	function selectFile(path: string) {
+		selectedPath = path;
+	}
+
+	function updateContent(path: string, content: string) {
+		const file = files.find((f) => f.path === path);
+		if (file) {
+			file.content = content;
+			dirty = true;
+			if (path === 'SKILL.md') {
+				const desc = parseDescription(content);
+				if (desc !== null) description = desc;
+			}
+		}
+	}
+
+	function addFile() {
+		const path = newFilePath.trim();
+		if (path === '') {
+			toastError('文件路径不能为空');
+			return;
+		}
+		if (files.some((f) => f.path === path)) {
+			toastError(`文件已存在：${path}`);
+			return;
+		}
+		if (path.startsWith('/') || path.includes('..')) {
+			toastError('文件路径必须为相对路径');
+			return;
+		}
+		files.push({ path, content: '' });
+		selectedPath = path;
+		newFilePath = '';
+		showNewFile = false;
+		dirty = true;
+	}
+
+	function deleteFile(path: string) {
+		if (path === 'SKILL.md') {
+			toastError('SKILL.md 是必需的 manifest，不能删除');
+			return;
+		}
+		files = files.filter((f) => f.path !== path);
+		if (selectedPath === path) {
+			selectedPath = files.length > 0 ? files[0]!.path : null;
+		}
+		dirty = true;
+	}
+
+	function parseDescription(manifest: string): string | null {
+		const match = /^description:\s*['"]?([^'"\r\n]+)['"]?\s*$/m.exec(manifest);
+		return match ? match[1]!.trim() : null;
+	}
+
+	async function save() {
+		if (!hasManifest) {
+			toastError('缺少 SKILL.md manifest 文件');
+			return;
+		}
+		const trimmedVersion = version.trim();
+		if (trimmedVersion === '') {
+			toastError('版本号不能为空');
+			return;
+		}
+		saving = true;
+		try {
+			const fileEntries: SkillFileEntry[] = files.map((f) => ({ path: f.path, content: f.content }));
+			const result = await api.installAgentSkill(slug, skill.name, {
+				version: trimmedVersion,
+				files: fileEntries,
+			});
+			dirty = false;
+			toastSuccess('技能已保存');
+			oninstalled(result);
+			await loadFiles();
+		} catch (err) {
+			toastError(err instanceof Error ? err.message : String(err));
+		} finally {
+			saving = false;
+		}
+	}
+
+	async function disable() {
+		saving = true;
+		try {
+			await api.patchAgentSkill(slug, skill.name, { disabled: true });
+			toastSuccess('技能已禁用');
+			ondisabled(skill.name);
+		} catch (err) {
+			toastError(err instanceof Error ? err.message : String(err));
+		} finally {
+			saving = false;
+		}
+	}
+
+	function saveDescription() {
+		const manifest = files.find((f) => f.path === 'SKILL.md');
+		if (!manifest) return;
+		const updated = updateFrontmatter(manifest.content, 'description', description.trim());
+		manifest.content = updated;
+		dirty = true;
+	}
+
+	function updateFrontmatter(content: string, key: string, value: string): string {
+		const regex = new RegExp(`^(${key}:\\s*)(.*?)(\\s*)$`, 'm');
+		if (regex.test(content)) {
+			return content.replace(regex, `${key}: ${value}`);
+		}
+		const lines = content.split('\n');
+		if (lines[0] === '---') {
+			lines.splice(1, 0, `${key}: ${value}`);
+		} else {
+			lines.unshift('---', `${key}: ${value}`, '---');
+		}
+		return lines.join('\n');
+	}
+
+	$effect(() => {
+		if (skill.name) loadFiles();
+	});
+</script>
+
+<div class="saas-card-pad">
+	<div class="mb-4 flex flex-wrap items-center gap-2">
+		<span class="saas-badge-primary font-mono">{skill.name}</span>
+		<span class="text-sm text-surface-700">v{skill.version}</span>
+		{#if skill.disabledAt}
+			<span class="saas-badge-error">已禁用</span>
+		{/if}
+	</div>
+
+	<div class="mb-4 grid grid-cols-1 gap-4 md:grid-cols-2">
+		<div>
+			<label for="skill-version-{skill.id}" class="saas-label">版本号</label>
+			<input id="skill-version-{skill.id}" class="saas-input" bind:value={version} placeholder="如 0.1.0" />
+		</div>
+		<div>
+			<label for="skill-desc-{skill.id}" class="saas-label">描述（同步到 SKILL.md frontmatter）</label>
+			<div class="flex gap-2">
+				<input id="skill-desc-{skill.id}" class="saas-input" bind:value={description} onchange={saveDescription} />
+			</div>
+		</div>
+	</div>
+
+	<div class="mb-4 flex flex-wrap items-center gap-2 text-xs text-surface-600">
+		<span>digest: <code class="font-mono">{skill.contentDigest.slice(0, 12)}</code></span>
+		<span>·</span>
+		<span>更新于 {fmtDate(skill.updatedAt)}</span>
+		{#if skill.boundRoleIds.length > 0}
+			<span>·</span>
+			<span>绑定角色: {skill.boundRoleIds.join(', ')}</span>
+		{/if}
+		{#if dirty}
+			<span>·</span>
+			<span class="font-medium text-warning-700">未保存</span>
+		{/if}
+	</div>
+
+	{#if loading}
+		<div class="py-8 text-center text-sm text-surface-600">加载文件中…</div>
+	{:else}
+		<div class="grid grid-cols-1 gap-4 md:grid-cols-[16rem_1fr]">
+			<div class="border border-surface-300 bg-surface-100">
+				<div class="flex items-center justify-between border-b border-surface-300 px-3 py-2">
+					<span class="text-xs font-medium text-surface-700">文件</span>
+					<button
+						type="button"
+						class="text-xs text-primary-700 hover:text-primary-900"
+						onclick={() => (showNewFile = !showNewFile)}
+					>
+						{showNewFile ? '取消' : '+ 新增'}
+					</button>
+				</div>
+				{#if showNewFile}
+					<div class="border-b border-surface-300 px-3 py-2">
+						<input
+							class="saas-input text-xs"
+							placeholder="如 reference.md"
+							bind:value={newFilePath}
+							onkeydown={(e) => {
+								if (e.key === 'Enter') addFile();
+							}}
+						/>
+					</div>
+				{/if}
+				<div class="max-h-80 overflow-y-auto">
+					{#each sortedFiles as f (f.path)}
+						<button
+							type="button"
+							class="flex w-full items-center gap-2 px-3 py-1.5 text-left text-sm transition hover:bg-surface-200
+								{selectedPath === f.path ? 'bg-primary-100 text-primary-900' : 'text-surface-800'}"
+							onclick={() => selectFile(f.path)}
+						>
+							<Icon name="file" class="h-3.5 w-3.5 shrink-0 opacity-60" />
+							<span class="truncate font-mono text-xs">{f.path}</span>
+							{#if f.path === 'SKILL.md'}
+								<span class="ml-auto text-[10px] text-primary-700">manifest</span>
+							{:else}
+								<span
+									class="ml-auto text-xs text-surface-500 hover:text-error-700"
+									role="button"
+									tabindex="0"
+									onclick={(e) => {
+										e.stopPropagation();
+										deleteFile(f.path);
+									}}
+									onkeydown={(e) => {
+										if (e.key === 'Enter' || e.key === ' ') {
+											e.stopPropagation();
+											deleteFile(f.path);
+										}
+									}}
+								>
+									×
+								</span>
+							{/if}
+						</button>
+					{/each}
+					{#if files.length === 0}
+						<div class="px-3 py-4 text-center text-xs text-surface-600">暂无文件</div>
+					{/if}
+				</div>
+			</div>
+
+			<div>
+				{#if selectedFile}
+					<div class="mb-2 flex items-center gap-2">
+						<span class="font-mono text-xs text-surface-600">{selectedFile.path}</span>
+					</div>
+					<textarea
+						class="h-80 w-full resize-y border border-surface-300 bg-white p-3 font-mono text-xs text-surface-900 focus:border-primary-500 focus:outline-none"
+						bind:value={selectedFile.content}
+						oninput={() => (dirty = true)}
+					></textarea>
+				{:else}
+					<div class="flex h-80 items-center justify-center border border-surface-300 bg-surface-100 text-sm text-surface-600">
+						选择一个文件或新建文件
+					</div>
+				{/if}
+			</div>
+		</div>
+
+		<div class="mt-4 flex flex-wrap items-center gap-3 border-t border-surface-100 pt-4">
+			<button class="saas-btn-primary" onclick={save} disabled={saving || !dirty}>
+				{saving ? '保存中…' : '保存'}
+			</button>
+			{#if !skill.disabledAt}
+				<button class="saas-btn-danger" onclick={disable} disabled={saving}>
+					禁用
+				</button>
+			{/if}
+		</div>
+	{/if}
+</div>

hub/admin-web/src/lib/components/StatCard.svelte

@@ -0,0 +1,19 @@
+<script lang="ts">
+	let {
+		label,
+		value,
+		hint,
+	}: {
+		label: string;
+		value: string;
+		hint?: string;
+	} = $props();
+</script>
+
+<div class="saas-stat">
+	<div class="saas-stat-label">{label}</div>
+	<div class="saas-stat-value">{value}</div>
+	{#if hint}
+		<div class="saas-help">{hint}</div>
+	{/if}
+</div>

hub/admin-web/src/lib/components/SwitchControl.svelte

@@ -0,0 +1,27 @@
+<script lang="ts">
+	import { Switch } from 'bits-ui';
+
+	let {
+		checked = $bindable(false),
+		disabled = false,
+		class: className = '',
+		onchange,
+	}: {
+		checked?: boolean;
+		disabled?: boolean;
+		class?: string;
+		onchange?: (checked: boolean) => void;
+	} = $props();
+</script>
+
+<Switch.Root
+	class="saas-switch {className}"
+	{disabled}
+	{checked}
+	onCheckedChange={(next) => {
+		checked = next;
+		onchange?.(next);
+	}}
+>
+	<Switch.Thumb class="saas-switch-thumb" />
+</Switch.Root>

hub/admin-web/src/lib/components/ToastHost.svelte

@@ -0,0 +1,25 @@
+<script lang="ts">
+	import { dismissToast, toasts } from '$lib/toast';
+
+	const kindClass: Record<string, string> = {
+		info: 'border-surface-200 bg-surface-50 text-surface-800',
+		success: 'border-success-200 bg-success-50 text-success-800',
+		error: 'border-error-200 bg-error-50 text-error-800',
+	};
+</script>
+
+<div class="pointer-events-none fixed inset-x-0 top-0 z-100 flex flex-col items-end gap-2 p-4">
+	{#each $toasts as t (t.id)}
+		<div
+			class="pointer-events-auto flex max-w-sm items-start gap-3 border px-4 py-3 text-sm shadow-[4px_4px_0_rgb(15_23_42/0.12)] {kindClass[
+				t.kind
+			] ?? kindClass.info}"
+			role="status"
+		>
+			<p class="min-w-0 flex-1">{t.message}</p>
+			<button type="button" class="opacity-60 hover:opacity-100" onclick={() => dismissToast(t.id)} aria-label="关闭">
+				×
+			</button>
+		</div>
+	{/each}
+</div>

hub/admin-web/src/lib/constants.ts

@@ -0,0 +1,41 @@
+export interface ToolOption {
+	id: string;
+	label: string;
+	group: string;
+}
+
+export const TOOL_OPTIONS: ToolOption[] = [
+	{ id: 'read_file', label: '读取文件', group: '文件' },
+	{ id: 'write_file', label: '写入文件', group: '文件' },
+	{ id: 'list_files', label: '列目录', group: '文件' },
+	{ id: 'search_files', label: '搜索', group: '文件' },
+	{ id: 'bash', label: 'Bash 命令', group: 'Shell' },
+	{ id: 'web_fetch', label: 'WebFetch', group: '网络' },
+	{ id: 'web_search', label: 'WebSearch', group: '网络' },
+	{ id: 'cph_check', label: 'cph check', group: 'CPH' },
+	{ id: 'cph_build', label: 'cph build', group: 'CPH' },
+	{ id: 'send_file', label: '发送文件（飞书）', group: '飞书' },
+	{ id: 'feishu_read_context', label: '读飞书上下文', group: '飞书' },
+	{ id: 'feishu_download_resource', label: '下载飞书资源', group: '飞书' },
+	{ id: 'request_approval', label: '请求审批', group: '飞书' },
+];
+
+/** 组织成员角色（接口枚举保持英文，界面用 orgRoleLabel） */
+export const ORG_ROLES = ['OWNER', 'ADMIN', 'MEMBER'] as const;
+export type OrgRole = (typeof ORG_ROLES)[number];
+
+export const ORG_ROLE_LABELS: Record<OrgRole, string> = {
+	OWNER: '所有者',
+	ADMIN: '管理员',
+	MEMBER: '成员',
+};
+
+/** 项目团队授权角色（接口枚举保持英文，界面用 permissionRoleLabel） */
+export const PERMISSION_ROLES = ['READ', 'EDIT', 'MANAGE'] as const;
+export type PermissionRole = (typeof PERMISSION_ROLES)[number];
+
+export const PERMISSION_ROLE_LABELS: Record<PermissionRole, string> = {
+	READ: '只读',
+	EDIT: '编辑',
+	MANAGE: '管理',
+};

hub/admin-web/src/lib/format.ts

@@ -0,0 +1,46 @@
+import { ORG_ROLE_LABELS, PERMISSION_ROLE_LABELS, type OrgRole, type PermissionRole } from './constants';
+
+export function fmtDate(iso: string): string {
+	if (!iso) return '—';
+	const d = new Date(iso);
+	if (Number.isNaN(d.getTime())) return iso;
+	return d.toLocaleString(undefined, {
+		year: 'numeric',
+		month: 'short',
+		day: '2-digit',
+		hour: '2-digit',
+		minute: '2-digit',
+	});
+}
+
+export function fmtDateOnly(iso: string): string {
+	if (!iso) return '—';
+	const d = new Date(iso);
+	if (Number.isNaN(d.getTime())) return iso;
+	return d.toLocaleDateString(undefined, { year: 'numeric', month: 'short', day: '2-digit' });
+}
+
+export function fmtCost(usd: number | null): string {
+	if (usd === null) return '—';
+	return `$${Number(usd).toFixed(4)}`;
+}
+
+export function fmtNum(n: number): string {
+	return n.toLocaleString();
+}
+
+export function orgRoleLabel(role: string): string {
+	const key = role.toUpperCase() as OrgRole;
+	return ORG_ROLE_LABELS[key] ?? role;
+}
+
+export function permissionRoleLabel(role: string): string {
+	const key = role.toUpperCase() as PermissionRole;
+	return PERMISSION_ROLE_LABELS[key] ?? role;
+}
+
+export function providerModeLabel(mode: string): string {
+	if (mode === 'BYOK') return '自带密钥';
+	if (mode === 'PLATFORM_MANAGED') return '平台托管';
+	return mode;
+}

hub/admin-web/src/lib/index.ts

@@ -0,0 +1 @@
+// place files you want to import through the `$lib` alias in this folder.

hub/admin-web/src/lib/session.ts

@@ -0,0 +1,71 @@
+import { writable } from 'svelte/store';
+import { api, type MeResponse } from './api';
+
+interface SessionState {
+	loading: boolean;
+	me: MeResponse | null;
+	error: string | null;
+}
+
+export const session = writable<SessionState>({
+	loading: true,
+	me: null,
+	error: null,
+});
+
+export async function loadSession(): Promise<void> {
+	session.update((s) => ({ ...s, loading: true, error: null }));
+	try {
+		const me = await api.me();
+		session.set({ loading: false, me, error: null });
+	} catch (err) {
+		const status = (err as { status?: number }).status;
+		if (status === 401) {
+			redirectToLogin();
+			return;
+		}
+		session.set({
+			loading: false,
+			me: null,
+			error: err instanceof Error ? err.message : String(err),
+		});
+	}
+}
+
+/**
+ * Resolve org slug for org-scoped Feishu OAuth (`GET /auth/feishu/:orgSlug`).
+ * Unscoped `/auth/feishu` is disabled unless allowLegacyFeishuOAuth is on.
+ */
+export function resolveLoginOrgSlug(): string | null {
+	const path = window.location.pathname.split('/').filter(Boolean);
+	if (path[0] === 'admin' && path[1] === 'org' && path[2]) {
+		return decodeURIComponent(path[2]);
+	}
+	const q = new URLSearchParams(window.location.search).get('org');
+	if (q && q.trim() !== '') return q.trim();
+
+	// Alpha Silo public host: <slug>.educraft.paradigm-edu.net (or educraft-dev)
+	const host = window.location.hostname.toLowerCase();
+	const m = host.match(/^([a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)\.educraft(?:-dev)?\./);
+	if (m?.[1]) return m[1];
+	return null;
+}
+
+export function redirectToLogin(): void {
+	if (window.location.pathname === '/admin/login') return;
+	const ret = encodeURIComponent(
+		window.location.pathname + window.location.search + window.location.hash,
+	);
+	const slug = resolveLoginOrgSlug();
+	if (slug === null) {
+		// Need an org slug for scoped OAuth — backend login helper can prompt.
+		window.location.href = `/admin/login?returnTo=${ret}`;
+		return;
+	}
+	window.location.href = `/auth/feishu/${encodeURIComponent(slug)}?returnTo=${ret}`;
+}
+
+export async function logout(): Promise<void> {
+	await api.logout();
+	redirectToLogin();
+}

hub/admin-web/src/lib/toast.ts

@@ -0,0 +1,34 @@
+import { writable } from 'svelte/store';
+
+export type ToastKind = 'info' | 'success' | 'error';
+
+export interface ToastItem {
+	id: number;
+	message: string;
+	kind: ToastKind;
+}
+
+let seq = 0;
+export const toasts = writable<ToastItem[]>([]);
+
+export function pushToast(message: string, kind: ToastKind = 'info', ms = 3200): void {
+	const id = ++seq;
+	toasts.update((list) => [...list, { id, message, kind }]);
+	if (ms > 0) {
+		setTimeout(() => {
+			toasts.update((list) => list.filter((t) => t.id !== id));
+		}, ms);
+	}
+}
+
+export function dismissToast(id: number): void {
+	toasts.update((list) => list.filter((t) => t.id !== id));
+}
+
+export function toastSuccess(message: string): void {
+	pushToast(message, 'success');
+}
+
+export function toastError(message: string): void {
+	pushToast(message, 'error', 5000);
+}

hub/admin-web/src/routes/+layout.svelte

@@ -0,0 +1,387 @@
+<script lang="ts">
+	import '../routes/app.css';
+	import { onMount } from 'svelte';
+	import { goto } from '$app/navigation';
+	import { page } from '$app/state';
+	import { session, loadSession, logout, redirectToLogin } from '$lib/session';
+	import type { OrgMembership } from '$lib/api';
+	import { orgRoleLabel } from '$lib/format';
+	import Icon from '$lib/components/Icon.svelte';
+	import ToastHost from '$lib/components/ToastHost.svelte';
+	import SelectField from '$lib/components/SelectField.svelte';
+
+	let { children } = $props();
+	let mobileNavOpen = $state(false);
+	let redirecting = $state(false);
+
+	onMount(() => {
+		loadSession();
+	});
+
+	const navItems = [
+		{ key: 'overview', label: '概览', icon: 'overview' as const },
+		{ key: 'members', label: '成员', icon: 'members' as const },
+		{ key: 'teams', label: '团队', icon: 'teams' as const },
+		{ key: 'projects', label: '项目', icon: 'projects' as const },
+		{ key: 'capacity', label: '容量', icon: 'overview' as const },
+		{ key: 'provider', label: '供应方', icon: 'provider' as const },
+		{ key: 'skills', label: '技能', icon: 'roles' as const },
+		{ key: 'roles', label: '角色', icon: 'roles' as const },
+		{ key: 'feishu', label: '飞书', icon: 'feishu' as const },
+	];
+
+	function isAdmin(org: OrgMembership): boolean {
+		const role = String(org.role ?? '').toUpperCase();
+		return role === 'OWNER' || role === 'ADMIN';
+	}
+
+	function orgSlugFromPath(): string | null {
+		const parts = page.url.pathname.split('/').filter(Boolean);
+		if (parts[0] === 'admin' && parts[1] === 'org' && parts[2]) {
+			return decodeURIComponent(parts[2]);
+		}
+		return null;
+	}
+
+	function isOnProjectRoute(): boolean {
+		const parts = page.url.pathname.split('/').filter(Boolean);
+		return parts[0] === 'admin' && parts[1] === 'org' && parts[3] === 'projects';
+	}
+
+	function memberships(): OrgMembership[] {
+		return $session.me?.organizations ?? [];
+	}
+
+	function adminOrgs(): OrgMembership[] {
+		return memberships().filter(isAdmin);
+	}
+
+	function currentOrg(): OrgMembership | null {
+		const slug = orgSlugFromPath();
+		if (!slug) return null;
+		return memberships().find((o) => o.slug === slug) ?? null;
+	}
+
+	function pickHomeOrg(): OrgMembership | null {
+		const admin = adminOrgs()[0];
+		if (admin) return admin;
+		return memberships()[0] ?? null;
+	}
+
+	function activeKey(): string {
+		const parts = page.url.pathname.split('/').filter(Boolean);
+		if (parts[0] !== 'admin' || parts[1] !== 'org' || !parts[2]) return '';
+		return parts[3] ?? 'overview';
+	}
+
+	function navHref(key: string): string {
+		const slug = currentOrg()?.slug ?? pickHomeOrg()?.slug;
+		if (!slug) return '/';
+		if (key === 'overview') return `/admin/org/${slug}`;
+		return `/admin/org/${slug}/${key}`;
+	}
+
+	function pageTitle(): string {
+		const key = activeKey();
+		if (key === 'overview' || key === '') return '概览';
+		return navItems.find((i) => i.key === key)?.label ?? '管理后台';
+	}
+
+	function switchOrg(nextSlug: string) {
+		if (!nextSlug || nextSlug === currentOrg()?.slug) return;
+		void goto(`/admin/org/${nextSlug}`);
+	}
+
+	function handleLogout(e: Event) {
+		e.preventDefault();
+		logout();
+	}
+
+	function orgSelectItems(list: OrgMembership[]) {
+		return list.map((o) => ({
+			value: o.slug,
+			label: `${o.name} · ${orgRoleLabel(o.role)}`,
+		}));
+	}
+
+	$effect(() => {
+		page.url.pathname;
+		mobileNavOpen = false;
+	});
+
+	$effect(() => {
+		if ($session.loading || !$session.me) return;
+
+		const slug = orgSlugFromPath();
+		const matched = slug ? memberships().find((o) => o.slug === slug) : null;
+
+		// Org admins: route to their first admin org if none matched as admin.
+		const admins = adminOrgs();
+		if (matched && isAdmin(matched)) {
+			redirecting = false;
+			return;
+		}
+		if (!matched && admins.length > 0) {
+			const target = `/admin/org/${admins[0].slug}`;
+			if (page.url.pathname !== target && !page.url.pathname.startsWith(`${target}/`)) {
+				redirecting = true;
+				void goto(target, { replaceState: true });
+			}
+			return;
+		}
+
+		// Members (non-admin): project pages are open to project MANAGE holders;
+		// the org overview and other admin-only surfaces are not for them.
+		if (matched && !isAdmin(matched)) {
+			redirecting = false;
+			const parts = page.url.pathname.split('/').filter(Boolean);
+			const onOverview = parts.length === 3; // /admin/org/:slug
+			if (onOverview) {
+				const target = `/admin/org/${matched.slug}/projects`;
+				if (page.url.pathname !== target) {
+					redirecting = true;
+					void goto(target, { replaceState: true });
+				}
+			}
+			return;
+		}
+
+		// No matched org and no admin orgs: route a member to their first org's
+		// projects page so they can reach project MANAGE surfaces.
+		if (!matched && memberships().length > 0) {
+			const home = memberships()[0];
+			const target = `/admin/org/${home.slug}/projects`;
+			if (page.url.pathname !== target && !page.url.pathname.startsWith(`${target}/`)) {
+				redirecting = true;
+				void goto(target, { replaceState: true });
+			}
+		}
+	});
+</script>
+
+<ToastHost />
+
+{#if $session.loading || redirecting}
+	<div class="saas-status-panel">
+		<div class="flex flex-col items-center gap-3 text-surface-600">
+			<svg class="h-8 w-8 animate-spin text-primary-500" viewBox="0 0 24 24" fill="none">
+				<circle class="opacity-25" cx="12" cy="12" r="10" stroke="currentColor" stroke-width="4"></circle>
+				<path
+					class="opacity-90"
+					fill="currentColor"
+					d="M4 12a8 8 0 018-8V0C5.373 0 0 5.373 0 12h4zm2 5.291A7.962 7.962 0 014 12H0c0 3.042 1.135 5.824 3 7.938l3-2.647z"
+				></path>
+			</svg>
+			<p class="text-sm">{redirecting ? '正在进入组织…' : '正在加载会话…'}</p>
+		</div>
+	</div>
+{:else if $session.error}
+	<div class="saas-status-panel">
+		<div class="saas-status-card">
+			<div
+				class="mx-auto mb-4 flex h-12 w-12 items-center justify-center border border-error-300 bg-error-100 text-error-700 font-bold"
+			>
+				!
+			</div>
+			<h2 class="mb-1 text-lg font-semibold">无法连接到后端</h2>
+			<p class="mb-5 text-sm text-surface-700">{$session.error}</p>
+			<button class="saas-btn-primary" onclick={() => loadSession()}>重试</button>
+		</div>
+	</div>
+{:else if !$session.me}
+	<div class="saas-status-panel">
+		<div class="saas-status-card">
+			<div
+				class="mx-auto mb-5 flex h-12 w-12 items-center justify-center border border-primary-700 bg-primary-600 text-white font-bold"
+			>
+				CPH
+			</div>
+			<h1 class="text-xl font-semibold">Curriculum Project Hub</h1>
+			<p class="mt-2 mb-6 text-sm text-surface-700">登录以管理组织、项目、团队与模型供应。</p>
+			<button class="saas-btn-primary w-full" onclick={() => redirectToLogin()}>使用飞书登录</button>
+		</div>
+	</div>
+{:else if currentOrg() && isAdmin(currentOrg()!)}
+	{@const org = currentOrg()!}
+	{@const me = $session.me!}
+	<div class="saas-shell">
+		{#if mobileNavOpen}
+			<button
+				type="button"
+				class="fixed inset-0 z-40 bg-surface-950/40 md:hidden"
+				aria-label="关闭导航"
+				onclick={() => (mobileNavOpen = false)}
+			></button>
+		{/if}
+
+		<aside
+			class="saas-sidebar fixed inset-y-0 left-0 z-50 transition-transform md:static md:translate-x-0
+				{mobileNavOpen ? 'translate-x-0' : '-translate-x-full md:translate-x-0'}"
+		>
+			<div class="flex items-center gap-2.5 px-4 py-4">
+				<div
+					class="flex h-9 w-9 items-center justify-center border border-primary-700 bg-primary-600 text-xs font-bold tracking-wide text-white"
+				>
+					CPH
+				</div>
+				<div class="min-w-0">
+					<div class="truncate text-sm font-semibold text-surface-900">组织后台</div>
+					<div class="truncate text-xs text-surface-600">Curriculum Hub</div>
+				</div>
+			</div>
+
+			<div class="px-3 pb-3">
+				<div class="mb-1.5 flex items-center gap-1.5 text-xs font-medium text-surface-700">
+					<Icon name="org" class="h-3.5 w-3.5" />
+					组织
+				</div>
+				<SelectField items={orgSelectItems(me.organizations)} value={org.slug} onchange={switchOrg} />
+			</div>
+
+			<nav class="flex-1 space-y-0.5 overflow-y-auto px-2 pb-3">
+				<p class="px-3 pb-1 pt-2 text-[11px] font-semibold uppercase tracking-wider text-surface-600">工作台</p>
+				{#each navItems as item}
+					{@const active =
+						activeKey() === item.key || (item.key === 'overview' && (activeKey() === '' || activeKey() === 'overview'))}
+					<a href={navHref(item.key)} class="saas-nav-item" data-active={active ? 'true' : 'false'}>
+						<Icon name={item.icon} class="h-4 w-4 shrink-0 opacity-80" />
+						<span>{item.label}</span>
+					</a>
+				{/each}
+			</nav>
+
+			<div class="border-t border-surface-300 p-3">
+				<div class="flex items-center gap-2.5 border border-surface-300 bg-surface-100 px-2.5 py-2">
+					{#if me.user.avatarUrl}
+						<img src={me.user.avatarUrl} alt="" class="h-8 w-8 object-cover" />
+					{:else}
+						<div
+							class="flex h-8 w-8 items-center justify-center border border-primary-300 bg-primary-100 text-xs font-semibold text-primary-800"
+						>
+							{me.user.displayName.slice(0, 1)}
+						</div>
+					{/if}
+					<div class="min-w-0 flex-1">
+						<div class="truncate text-sm font-medium text-surface-900">{me.user.displayName}</div>
+						<div class="truncate text-[11px] text-surface-600">{orgRoleLabel(org.role)}</div>
+					</div>
+					<button
+						type="button"
+						class="p-1.5 text-surface-600 transition hover:bg-surface-200 hover:text-error-700"
+						title="退出登录"
+						onclick={handleLogout}
+					>
+						<Icon name="logout" class="h-4 w-4" />
+					</button>
+				</div>
+			</div>
+		</aside>
+
+		<div class="saas-main">
+			<header class="saas-topbar">
+				<button
+					type="button"
+					class="saas-btn-ghost px-2! md:hidden"
+					onclick={() => (mobileNavOpen = !mobileNavOpen)}
+					aria-label="打开导航"
+				>
+					<Icon name="menu" class="h-5 w-5" />
+				</button>
+				<div class="min-w-0">
+					<div class="flex items-center gap-1.5 text-xs text-surface-600">
+						<span class="truncate">{org.name}</span>
+						<span>/</span>
+						<span class="truncate font-medium text-surface-900">{pageTitle()}</span>
+					</div>
+				</div>
+				<div class="ml-auto hidden items-center gap-2 sm:flex">
+					<span class="saas-badge-primary">{org.status}</span>
+					<span class="saas-badge-neutral font-mono">/{org.slug}</span>
+				</div>
+			</header>
+			<main class="saas-content">
+				<div class="saas-content-inner">
+					{@render children()}
+				</div>
+			</main>
+		</div>
+	</div>
+{:else if currentOrg() && !isAdmin(currentOrg()!) && isOnProjectRoute()}
+	{@const org = currentOrg()!}
+	{@const me = $session.me!}
+	<div class="saas-shell">
+		<div class="saas-main">
+			<header class="saas-topbar">
+				<a href={`/admin/org/${org.slug}/projects`} class="saas-btn-ghost px-2!" aria-label="返回项目列表">
+					<Icon name="menu" class="h-5 w-5" />
+				</a>
+				<div class="min-w-0">
+					<div class="flex items-center gap-1.5 text-xs text-surface-600">
+						<span class="truncate">{org.name}</span>
+						<span>/</span>
+						<span class="truncate font-medium text-surface-900">项目</span>
+					</div>
+				</div>
+				<div class="ml-auto flex items-center gap-2">
+					<span class="saas-badge-neutral font-mono">/{org.slug}</span>
+					<button
+						type="button"
+						class="p-1.5 text-surface-600 transition hover:bg-surface-200 hover:text-error-700"
+						title="退出登录"
+						onclick={handleLogout}
+					>
+						<Icon name="logout" class="h-4 w-4" />
+					</button>
+				</div>
+			</header>
+			<main class="saas-content">
+				<div class="saas-content-inner">
+					{@render children()}
+				</div>
+			</main>
+		</div>
+	</div>
+{:else if currentOrg() && !isAdmin(currentOrg()!)}
+	{@const denied = currentOrg()!}
+	<div class="saas-status-panel">
+		<div class="saas-status-card">
+			<h2 class="mb-2 text-lg font-semibold">无权访问管理后台</h2>
+			<p class="mb-3 text-sm text-surface-700">
+				组织 <strong>{denied.name}</strong>（/{denied.slug}）中你的角色是
+				<span class="saas-badge-neutral mx-1">{orgRoleLabel(denied.role)}</span>。普通成员仅可访问自己有授权的项目。
+			</p>
+			<a class="saas-btn-primary" href={`/admin/org/${denied.slug}/projects`}>查看我的项目</a>
+			{#if memberships().length > 1}
+				<p class="saas-label text-left mb-1.5 mt-3">切换到其他组织</p>
+				<div class="mb-4">
+					<SelectField items={orgSelectItems(memberships())} value={denied.slug} onchange={switchOrg} />
+				</div>
+			{/if}
+			<button class="saas-btn-ghost mt-3" onclick={handleLogout}>退出登录</button>
+		</div>
+	</div>
+{:else if memberships().length > 0}
+	{@const denied = pickHomeOrg()!}
+	<div class="saas-status-panel">
+		<div class="saas-status-card">
+			<h2 class="mb-2 text-lg font-semibold">正在跳转…</h2>
+			<p class="mb-5 text-sm text-surface-700">
+				即将进入 <strong>{denied.name}</strong>（/{denied.slug}）的项目。
+			</p>
+			<a class="saas-btn-primary" href={`/admin/org/${denied.slug}/projects`}>立即进入</a>
+			<button class="saas-btn-ghost mt-3" onclick={handleLogout}>退出登录</button>
+		</div>
+	</div>
+{:else}
+	<div class="saas-status-panel">
+		<div class="saas-status-card">
+			<h2 class="mb-2 text-lg font-semibold">未加入组织</h2>
+			<p class="mb-3 text-sm text-surface-700">飞书账号已登录，但当前账号尚未加入任何组织。</p>
+			<p class="mb-5 text-left text-xs text-surface-600">
+				open_id：
+				<code class="break-all font-mono text-surface-600">{$session.me!.user.feishuOpenId}</code>
+			</p>
+			<button class="saas-btn-primary" onclick={handleLogout}>退出登录</button>
+		</div>
+	</div>
+{/if}

hub/admin-web/src/routes/+page.svelte

@@ -0,0 +1,43 @@
+<script lang="ts">
+	import { onMount } from 'svelte';
+	import { goto } from '$app/navigation';
+	import { session, redirectToLogin } from '$lib/session';
+
+	function homeForSession(): string | null {
+		const me = $session.me;
+		if (!me) return null;
+		const admin = me.organizations.find((o) => {
+			const r = String(o.role ?? '').toUpperCase();
+			return r === 'OWNER' || r === 'ADMIN';
+		});
+		const target = admin ?? me.organizations[0];
+		return target ? `/admin/org/${target.slug}` : null;
+	}
+
+	onMount(() => {
+		const unsub = session.subscribe((s) => {
+			if (s.loading) return;
+			if (!s.me) {
+				redirectToLogin();
+				return;
+			}
+			const dest = homeForSession();
+			if (dest) void goto(dest, { replaceState: true });
+		});
+		return unsub;
+	});
+</script>
+
+<div class="saas-status-panel">
+	<div class="flex flex-col items-center gap-3 text-surface-600">
+		<svg class="h-7 w-7 animate-spin text-primary-500" viewBox="0 0 24 24" fill="none">
+			<circle class="opacity-25" cx="12" cy="12" r="10" stroke="currentColor" stroke-width="4"></circle>
+			<path
+				class="opacity-90"
+				fill="currentColor"
+				d="M4 12a8 8 0 018-8V0C5.373 0 0 5.373 0 12h4zm2 5.291A7.962 7.962 0 014 12H0c0 3.042 1.135 5.824 3 7.938l3-2.647z"
+			></path>
+		</svg>
+		<p class="text-sm">正在进入工作台…</p>
+	</div>
+</div>

hub/admin-web/src/routes/admin/org/[slug]/+page.svelte

@@ -0,0 +1,147 @@
+<script lang="ts">
+	import { page } from '$app/state';
+	import { api, type OrgMembership } from '$lib/api';
+	import { session } from '$lib/session';
+	import { fmtCost, fmtNum, orgRoleLabel } from '$lib/format';
+	import PageHeader from '$lib/components/PageHeader.svelte';
+	import StatCard from '$lib/components/StatCard.svelte';
+	import LoadingState from '$lib/components/LoadingState.svelte';
+	import ErrorBanner from '$lib/components/ErrorBanner.svelte';
+	import SwitchControl from '$lib/components/SwitchControl.svelte';
+	import { toastError, toastSuccess } from '$lib/toast';
+
+	let orgSlug = $derived(page.params.slug ?? '');
+	let org = $derived($session.me?.organizations.find((o) => o.slug === orgSlug) as OrgMembership | undefined);
+
+	let settings = $state<{ membersCanCreateProjects: boolean } | null>(null);
+	let usage = $state<Awaited<ReturnType<typeof api.usage>> | null>(null);
+	let loading = $state(true);
+	let error = $state<string | null>(null);
+	let saving = $state(false);
+
+	async function load() {
+		loading = true;
+		error = null;
+		try {
+			[settings, usage] = await Promise.all([api.settings(orgSlug), api.usage(orgSlug)]);
+		} catch (err) {
+			error = err instanceof Error ? err.message : String(err);
+		} finally {
+			loading = false;
+		}
+	}
+
+	async function setMembersCanCreate(next: boolean) {
+		if (!settings || settings.membersCanCreateProjects === next) return;
+		saving = true;
+		const prev = settings.membersCanCreateProjects;
+		settings.membersCanCreateProjects = next;
+		try {
+			await api.setSettings(orgSlug, { membersCanCreateProjects: next });
+			toastSuccess(next ? '已允许成员自助建项' : '已关闭成员自助建项');
+		} catch (err) {
+			settings.membersCanCreateProjects = prev;
+			toastError(err instanceof Error ? err.message : String(err));
+		} finally {
+			saving = false;
+		}
+	}
+
+	$effect(() => {
+		if (orgSlug) load();
+	});
+</script>
+
+{#if loading}
+	<LoadingState />
+{:else if error}
+	<ErrorBanner message={error} onretry={load} />
+{:else if org && settings && usage}
+	<PageHeader title={org.name} description="组织健康度、用量与生产策略一览。" />
+
+	<div class="mb-6 grid gap-4 sm:grid-cols-2 lg:grid-cols-3">
+		<div class="saas-card-pad sm:col-span-2 lg:col-span-1">
+			<p class="saas-section-title mb-3">组织信息</p>
+			<dl class="space-y-2.5 text-sm">
+				<div class="flex items-center justify-between gap-3">
+					<dt class="text-surface-700">Slug</dt>
+					<dd class="font-mono text-xs text-surface-800">/{org.slug}</dd>
+				</div>
+				<div class="flex items-center justify-between gap-3">
+					<dt class="text-surface-700">状态</dt>
+					<dd><span class="saas-badge-success">{org.status}</span></dd>
+				</div>
+				<div class="flex items-center justify-between gap-3">
+					<dt class="text-surface-700">你的角色</dt>
+					<dd><span class="saas-badge-primary">{orgRoleLabel(org.role)}</span></dd>
+				</div>
+			</dl>
+		</div>
+
+		<div class="saas-card-pad sm:col-span-2">
+			<p class="saas-section-title mb-1">项目自助创建策略</p>
+			<p class="saas-muted mb-4">开启后，普通老师可在飞书群自助创建项目；关闭后仅所有者与管理员可建。</p>
+			<div class="flex items-center gap-3 border border-surface-300 bg-surface-100 px-4 py-3">
+				<SwitchControl checked={settings.membersCanCreateProjects} disabled={saving} onchange={setMembersCanCreate} />
+				<div>
+					<div class="text-sm font-medium text-surface-900">允许成员自助创建项目</div>
+					<div class="text-xs text-surface-600">普通成员在飞书群中自助建项</div>
+				</div>
+			</div>
+		</div>
+	</div>
+
+	<div class="mb-4 flex items-end justify-between gap-3">
+		<div>
+			<h2 class="saas-section-title">用量概览</h2>
+			<p class="saas-muted">全组织智能体运行汇总</p>
+		</div>
+	</div>
+
+	<div class="mb-6 grid gap-3 sm:grid-cols-2 lg:grid-cols-3">
+		<StatCard label="运行总数" value={fmtNum(usage.totals.runCount)} />
+		<StatCard label="有成本运行" value={fmtNum(usage.totals.runsWithCost)} />
+		<StatCard label="无成本运行" value={fmtNum(usage.totals.runsWithoutCost)} />
+		<StatCard label="输入 tokens" value={fmtNum(usage.totals.inputTokens)} />
+		<StatCard label="输出 tokens" value={fmtNum(usage.totals.outputTokens)} />
+		<StatCard label="成本 (USD)" value={fmtCost(usage.totals.costUsd)} />
+	</div>
+
+	<div class="saas-card overflow-hidden">
+		<div class="border-b border-surface-200 px-5 py-3">
+			<h3 class="text-sm font-semibold text-surface-800">按项目用量</h3>
+		</div>
+		{#if usage.projects.length === 0}
+			<div class="saas-empty">
+				<p class="text-sm text-surface-600">暂无项目用量数据</p>
+			</div>
+		{:else}
+			<div class="overflow-x-auto">
+				<table class="data-table">
+					<thead>
+						<tr>
+							<th>项目</th>
+							<th>运行</th>
+							<th>in / out tokens</th>
+							<th>成本</th>
+						</tr>
+					</thead>
+					<tbody>
+						{#each usage.projects as p}
+							<tr>
+								<td class="font-medium">{p.projectName}</td>
+								<td class="tabular-nums">{fmtNum(p.runCount)}</td>
+								<td class="tabular-nums text-surface-600">{fmtNum(p.inputTokens)} / {fmtNum(p.outputTokens)}</td>
+								<td class="tabular-nums">{fmtCost(p.costUsd)}</td>
+							</tr>
+						{/each}
+					</tbody>
+				</table>
+			</div>
+		{/if}
+	</div>
+{:else}
+	<div class="saas-empty">
+		<p class="text-sm text-surface-600">组织数据不可用</p>
+	</div>
+{/if}

hub/admin-web/src/routes/admin/org/[slug]/capacity/+page.svelte

@@ -0,0 +1,310 @@
+<script lang="ts">
+	import { page } from '$app/state';
+	import { api, type CapacityDimension, type CapacityDimensionRow, type CapacityPolicyView } from '$lib/api';
+	import PageHeader from '$lib/components/PageHeader.svelte';
+	import LoadingState from '$lib/components/LoadingState.svelte';
+	import ErrorBanner from '$lib/components/ErrorBanner.svelte';
+	import EmptyState from '$lib/components/EmptyState.svelte';
+	import { toastError, toastSuccess } from '$lib/toast';
+
+	const slug = $derived(page.params.slug ?? '');
+
+	// Friendlier, user-facing labels. No spec jargon (墙钟 → 运行时长, etc.).
+	const DIMENSION_LABELS: Record<CapacityDimension, string> = {
+		requestRate: '请求速率',
+		requestBodySize: '请求体大小',
+		agentConcurrency: '并发数',
+		admissionQueueLength: '队列长度',
+		admissionQueueWait: '队列等待',
+		fileSize: '单文件大小',
+		attachmentCount: '附件数',
+		archiveExpansion: '归档展开',
+		projectStorage: '项目存储',
+		organizationStorage: '组织存储',
+		memberCount: '成员数',
+		projectCount: '项目数',
+		teamCount: '团队数',
+		folderCount: '文件夹数',
+		sessionCount: '会话数',
+		runWallTime: '运行时长',
+		runTurns: '对话轮次',
+		runToolCalls: '工具调用数',
+		toolWallTime: '工具执行时长',
+		runOutputSize: '输出大小',
+		processMemory: '内存',
+		processCpu: 'CPU',
+		processCount: '进程数',
+	};
+
+	// Logical groupings for higher information density.
+	const GROUPS: { title: string; dims: CapacityDimension[] }[] = [
+		{ title: 'HTTP 接入', dims: ['requestRate', 'requestBodySize'] },
+		{ title: '智能体运行', dims: ['agentConcurrency', 'runWallTime', 'runTurns', 'runToolCalls', 'toolWallTime', 'runOutputSize'] },
+		{ title: '接纳队列', dims: ['admissionQueueLength', 'admissionQueueWait'] },
+		{ title: '附件与存储', dims: ['fileSize', 'attachmentCount', 'archiveExpansion', 'projectStorage', 'organizationStorage'] },
+		{ title: '组织配额', dims: ['memberCount', 'projectCount', 'teamCount', 'folderCount', 'sessionCount'] },
+		{ title: '进程资源', dims: ['processMemory', 'processCpu', 'processCount'] },
+	];
+
+	let view = $state<CapacityPolicyView | null>(null);
+	let drafts = $state<Partial<Record<CapacityDimension, string | number>>>({});
+	let loading = $state(true);
+	let saving = $state(false);
+	let error = $state<string | null>(null);
+
+	async function load() {
+		loading = true;
+		error = null;
+		try {
+			view = await api.capacityPolicy(slug);
+			drafts = {};
+			for (const row of view.dimensions) {
+				drafts[row.dimension] = row.organizationLimit === null ? '' : String(row.organizationLimit);
+			}
+		} catch (err) {
+			error = err instanceof Error ? err.message : String(err);
+		} finally {
+			loading = false;
+		}
+	}
+
+	function draftText(dim: CapacityDimension): string {
+		const raw = drafts[dim];
+		if (raw === undefined || raw === null) return '';
+		return String(raw).trim();
+	}
+
+	// Inline validation: surfaced as the user edits, not on submit. Returns null
+	// when the draft is empty (means "use platform ceiling") or valid.
+	function draftError(row: CapacityDimensionRow): string | null {
+		const text = draftText(row.dimension);
+		if (text === '') return null;
+		const n = Number.parseInt(text, 10);
+		if (!Number.isFinite(n) || n < 1) return '需为正整数';
+		if (row.platformCeiling !== null && n > row.platformCeiling) return `不得超过 ${row.platformCeiling}`;
+		return null;
+	}
+
+	// Live effective value: min(platform ceiling, draft). Reflects the draft
+	// before save so the user sees the outcome as they type.
+	function liveEffective(row: CapacityDimensionRow): number | null {
+		if (row.platformCeiling === null) return null;
+		const text = draftText(row.dimension);
+		if (text === '') return row.platformCeiling;
+		const n = Number.parseInt(text, 10);
+		if (!Number.isFinite(n) || n < 1) return row.platformCeiling;
+		return Math.min(row.platformCeiling, n);
+	}
+
+	function isLowered(row: CapacityDimensionRow): boolean {
+		const eff = liveEffective(row);
+		return eff !== null && eff < row.platformCeiling!;
+	}
+
+	const hasErrors = $derived(
+		view?.dimensions.some((row) => draftError(row) !== null) ?? false,
+	);
+
+	async function save() {
+		if (!view || hasErrors) return;
+		saving = true;
+		const limits: Partial<Record<CapacityDimension, number | null>> = {};
+		for (const row of view.dimensions) {
+			const text = draftText(row.dimension);
+			limits[row.dimension] = text === '' ? null : Number.parseInt(text, 10);
+		}
+		try {
+			view = await api.setCapacityPolicy(slug, { limits });
+			drafts = {};
+			for (const row of view.dimensions) {
+				drafts[row.dimension] = row.organizationLimit === null ? '' : String(row.organizationLimit);
+			}
+			toastSuccess('容量策略已保存');
+		} catch (err) {
+			toastError(err instanceof Error ? err.message : String(err));
+		} finally {
+			saving = false;
+		}
+	}
+
+	$effect(() => {
+		if (slug) load();
+	});
+</script>
+
+<PageHeader
+	title="容量策略"
+	description="平台上限不可突破。组织可在此设更低限制，未设置时按平台上限执行。"
+>
+	{#snippet actions()}
+		<button class="saas-btn-primary" disabled={saving || !view || hasErrors} onclick={save}>
+			{saving ? '保存中…' : '保存'}
+		</button>
+	{/snippet}
+</PageHeader>
+
+<p class="saas-muted mb-6">
+	未配置平台上限的维度暂不可设置组织限制。输入框留空即沿用平台上限。
+</p>
+
+{#if loading}
+	<LoadingState />
+{:else if error}
+	<ErrorBanner message={error} onretry={load} />
+{:else if view}
+	{#if view.dimensions.length === 0}
+		<EmptyState title="暂无容量维度" description="容量维度由平台定义。" />
+	{:else}
+		{@const policy = view}
+		<div class="grid gap-4 md:grid-cols-2">
+			{#each GROUPS as group}
+				{@const rows = group.dims
+					.map((d) => policy.dimensions.find((r) => r.dimension === d))
+					.filter((r): r is CapacityDimensionRow => r !== undefined)}
+				{#if rows.length > 0}
+					<section class="saas-card">
+						<header class="group-header">
+							<h3 class="group-title">{group.title}</h3>
+							<span class="group-count">{rows.length} 项</span>
+						</header>
+						<div class="dim-list">
+							{#each rows as row (row.dimension)}
+								{@const err = draftError(row)}
+								{@const eff = liveEffective(row)}
+								{@const lowered = isLowered(row)}
+								{@const disabled = row.platformCeiling === null}
+								<div class="dim-row" class:dim-row-error={err !== null}>
+									<div class="dim-label">{DIMENSION_LABELS[row.dimension] ?? row.dimension}</div>
+									<div class="dim-ceiling">
+										{#if disabled}
+											<span class="text-surface-400">未配置</span>
+										{:else}
+											<span class="tabular-nums">平台 ≤ {row.platformCeiling}</span>
+										{/if}
+									</div>
+									<input
+										class="saas-input dim-input"
+										type="number"
+										placeholder="用平台值"
+										disabled={disabled}
+										bind:value={drafts[row.dimension]}
+									/>
+									<div class="dim-effective">
+										{#if eff === null}
+											<span class="text-surface-400">—</span>
+										{:else if lowered}
+											<span class="saas-badge saas-badge-primary tabular-nums">有效 {eff}</span>
+										{:else}
+											<span class="saas-badge saas-badge-neutral tabular-nums">有效 {eff}</span>
+										{/if}
+									</div>
+									{#if err !== null}
+										<div class="dim-error">{err}</div>
+									{/if}
+								</div>
+							{/each}
+						</div>
+					</section>
+				{/if}
+			{/each}
+		</div>
+	{/if}
+{:else}
+	<EmptyState title="容量数据不可用" description="无法加载容量策略。" />
+{/if}
+
+<style>
+	.group-header {
+		display: flex;
+		align-items: baseline;
+		justify-content: space-between;
+		padding: 0.5rem 0.75rem;
+		border-bottom: 1px solid var(--color-surface-200);
+		background: var(--color-surface-100);
+	}
+	.group-title {
+		font-size: 0.8125rem;
+		font-weight: 600;
+		color: var(--color-surface-800);
+		letter-spacing: 0.02em;
+	}
+	.group-count {
+		font-size: 0.6875rem;
+		color: var(--color-surface-500);
+	}
+	.dim-list {
+		display: flex;
+		flex-direction: column;
+	}
+	.dim-row {
+		display: grid;
+		grid-template-columns: minmax(5rem, 1fr) auto minmax(7rem, 8.5rem) 6.5rem;
+		align-items: center;
+		gap: 0.5rem;
+		padding: 0.4rem 0.75rem;
+		border-bottom: 1px solid var(--color-surface-100);
+	}
+	.dim-row:last-child {
+		border-bottom: none;
+	}
+	.dim-row-error {
+		background: color-mix(in oklab, var(--color-error-100) 40%, transparent);
+	}
+	.dim-label {
+		font-size: 0.8125rem;
+		font-weight: 500;
+		color: var(--color-surface-900);
+		white-space: nowrap;
+		overflow: hidden;
+		text-overflow: ellipsis;
+	}
+	.dim-ceiling {
+		font-size: 0.6875rem;
+		color: var(--color-surface-500);
+		white-space: nowrap;
+	}
+	.dim-input {
+		padding: 0.25rem 0.5rem;
+		font-size: 0.8125rem;
+		text-align: right;
+	}
+	.dim-effective {
+		display: flex;
+		justify-content: flex-end;
+	}
+	.dim-effective > .saas-badge {
+		width: 100%;
+		justify-content: center;
+	}
+	.dim-error {
+		grid-column: 1 / -1;
+		font-size: 0.6875rem;
+		color: var(--color-error-700);
+		padding-bottom: 0.2rem;
+	}
+	@media (max-width: 480px) {
+		.dim-row {
+			grid-template-columns: 1fr 5rem;
+			grid-template-rows: auto auto auto;
+			row-gap: 0.25rem;
+		}
+		.dim-label {
+			grid-column: 1;
+		}
+		.dim-ceiling {
+			grid-column: 2;
+			text-align: right;
+		}
+		.dim-input {
+			grid-column: 1 / -1;
+		}
+		.dim-effective {
+			grid-column: 1 / -1;
+			justify-content: flex-start;
+		}
+		.dim-effective > .saas-badge {
+			width: auto;
+			justify-content: flex-start;
+		}
+	}
+</style>

hub/admin-web/src/routes/admin/org/[slug]/feishu/+page.svelte

@@ -0,0 +1,176 @@
+<script lang="ts">
+	import { page } from '$app/state';
+	import { api, type FeishuApplicationConnection } from '$lib/api';
+	import { fmtDate } from '$lib/format';
+	import { Label } from 'bits-ui';
+	import PageHeader from '$lib/components/PageHeader.svelte';
+	import LoadingState from '$lib/components/LoadingState.svelte';
+	import ErrorBanner from '$lib/components/ErrorBanner.svelte';
+	import { toastError, toastSuccess } from '$lib/toast';
+
+	const slug = $derived(page.params.slug ?? '');
+
+	let connection = $state<FeishuApplicationConnection | null>(null);
+	let loading = $state(true);
+	let error = $state<string | null>(null);
+
+	let appId = $state('');
+	let appSecret = $state('');
+	let botOpenId = $state('');
+	let verificationToken = $state('');
+	let encryptKey = $state('');
+	let saving = $state(false);
+	let disabling = $state(false);
+
+	async function load() {
+		loading = true;
+		error = null;
+		try {
+			const res = await api.feishuApplication(slug);
+			connection = res.connection;
+		} catch (err) {
+			error = err instanceof Error ? err.message : String(err);
+		} finally {
+			loading = false;
+		}
+	}
+
+	function resetForm() {
+		appId = '';
+		appSecret = '';
+		botOpenId = '';
+		verificationToken = '';
+		encryptKey = '';
+	}
+
+	async function save() {
+		const id = appId.trim();
+		const secret = appSecret.trim();
+		const bot = botOpenId.trim();
+		if (id === '' || secret === '' || bot === '') {
+			toastError('App ID、App Secret、Bot Open ID 均为必填');
+			return;
+		}
+		saving = true;
+		const body: {
+			appId: string;
+			appSecret: string;
+			botOpenId: string;
+			verificationToken?: string;
+			encryptKey?: string;
+		} = { appId: id, appSecret: secret, botOpenId: bot };
+		const vt = verificationToken.trim();
+		if (vt !== '') body.verificationToken = vt;
+		const ek = encryptKey.trim();
+		if (ek !== '') body.encryptKey = ek;
+		try {
+			connection = await api.rotateFeishuApplication(slug, body);
+			resetForm();
+			toastSuccess('飞书应用凭据已保存');
+		} catch (err) {
+			toastError(err instanceof Error ? err.message : String(err));
+		} finally {
+			saving = false;
+		}
+	}
+
+	async function disable() {
+		if (!connection) return;
+		if (!confirm('停用后该组织将无法收发飞书消息，确定停用？')) return;
+		disabling = true;
+		try {
+			connection = await api.disableFeishuApplication(slug);
+			toastSuccess('已停用飞书应用连接');
+		} catch (err) {
+			toastError(err instanceof Error ? err.message : String(err));
+		} finally {
+			disabling = false;
+		}
+	}
+
+	$effect(() => {
+		if (slug) load();
+	});
+</script>
+
+<PageHeader
+	title="飞书应用"
+	description="本组织绑定的飞书应用凭据（ADR-0021：组织与应用 1:1）。凭据按组织隔离、版本化信封存储，缺失或校验失败即 fail-closed。"
+/>
+
+{#if loading}
+	<LoadingState />
+{:else if error}
+	<ErrorBanner message={error} onretry={load} />
+{:else}
+	{#if connection}
+		<div class="saas-card-pad mb-6">
+			<p class="saas-section-title mb-3">当前连接</p>
+			<dl class="space-y-2.5 text-sm">
+				<div class="flex items-center justify-between gap-3">
+					<dt class="text-surface-700">状态</dt>
+					<dd><span class="saas-badge-success">{connection.status}</span></dd>
+				</div>
+				<div class="flex items-center justify-between gap-3">
+					<dt class="text-surface-700">App 指纹</dt>
+					<dd class="font-mono text-xs text-surface-800">{connection.appFingerprint}</dd>
+				</div>
+				<div class="flex items-center justify-between gap-3">
+					<dt class="text-surface-700">版本</dt>
+					<dd class="tabular-nums">{connection.activeVersion ?? '—'}</dd>
+				</div>
+				<div class="flex items-center justify-between gap-3">
+					<dt class="text-surface-700">更新于</dt>
+					<dd class="text-surface-600">{fmtDate(connection.updatedAt)}</dd>
+				</div>
+			</dl>
+			{#if connection.status !== 'DISABLED'}
+				<div class="mt-5 flex items-center justify-end gap-3 border-t border-surface-100 pt-4">
+					<button class="saas-btn-ghost" onclick={disable} disabled={disabling}>
+						{disabling ? '停用中…' : '停用连接'}
+					</button>
+				</div>
+			{/if}
+		</div>
+	{:else}
+		<div class="saas-card-pad mb-6">
+			<p class="text-sm text-surface-700">本组织尚未绑定飞书应用。填写下方凭据以创建连接。</p>
+		</div>
+	{/if}
+
+	<div class="saas-card-pad">
+		<h3 class="saas-section-title mb-1">{connection ? '轮换凭据' : '创建连接'}</h3>
+		<p class="saas-muted mb-4">
+			密钥仅写入新版本，旧版本归档。{#if connection}App ID 不可变更，须与现有应用一致。{/if}
+		</p>
+		<div class="grid gap-5">
+			<div>
+				<Label.Root class="saas-label" for="app-id">App ID</Label.Root>
+				<input id="app-id" class="saas-input font-mono text-sm" bind:value={appId} />
+			</div>
+			<div>
+				<Label.Root class="saas-label" for="app-secret">App Secret</Label.Root>
+				<input id="app-secret" class="saas-input" type="password" bind:value={appSecret} />
+			</div>
+			<div>
+				<Label.Root class="saas-label" for="bot-open-id">Bot Open ID</Label.Root>
+				<input id="bot-open-id" class="saas-input font-mono text-sm" bind:value={botOpenId} />
+			</div>
+			<div>
+				<Label.Root class="saas-label" for="verification-token">Verification Token（可选）</Label.Root>
+				<input id="verification-token" class="saas-input" type="password" bind:value={verificationToken} />
+			</div>
+			<div>
+				<Label.Root class="saas-label" for="encrypt-key">Encrypt Key（可选）</Label.Root>
+				<input id="encrypt-key" class="saas-input" type="password" bind:value={encryptKey} />
+			</div>
+		</div>
+		<div class="mt-6 flex items-center gap-3 border-t border-surface-100 pt-4">
+			<div class="flex-1"></div>
+			<button class="saas-btn-ghost" onclick={resetForm} disabled={saving}>清空</button>
+			<button class="saas-btn-primary" onclick={save} disabled={saving}>
+				{saving ? '保存中…' : '保存'}
+			</button>
+		</div>
+	</div>
+{/if}

hub/admin-web/src/routes/admin/org/[slug]/members/+page.svelte

@@ -0,0 +1,164 @@
+<script lang="ts">
+	import { page } from '$app/state';
+	import { api, type OrgMember } from '$lib/api';
+	import { fmtDate } from '$lib/format';
+	import { ORG_ROLES, ORG_ROLE_LABELS, PERMISSION_ROLE_LABELS } from '$lib/constants';
+	import PageHeader from '$lib/components/PageHeader.svelte';
+	import LoadingState from '$lib/components/LoadingState.svelte';
+	import ErrorBanner from '$lib/components/ErrorBanner.svelte';
+	import EmptyState from '$lib/components/EmptyState.svelte';
+	import SelectField from '$lib/components/SelectField.svelte';
+	import { toastError, toastSuccess } from '$lib/toast';
+
+	const slug = $derived(page.params.slug ?? '');
+	const roleItems = ORG_ROLES.map((r) => ({ value: r, label: ORG_ROLE_LABELS[r] }));
+	const permHint = Object.values(PERMISSION_ROLE_LABELS).join(' / ');
+
+	let members = $state<OrgMember[]>([]);
+	let loading = $state(true);
+	let error = $state<string | null>(null);
+
+	let newOpenId = $state('');
+	let newName = $state('');
+	let newRole = $state<string>('MEMBER');
+	let adding = $state(false);
+
+	async function load() {
+		loading = true;
+		error = null;
+		try {
+			const res = await api.members(slug);
+			members = res.members;
+		} catch (err) {
+			error = err instanceof Error ? err.message : String(err);
+		} finally {
+			loading = false;
+		}
+	}
+
+	async function addMember() {
+		if (!newOpenId.trim()) return;
+		adding = true;
+		try {
+			const m = await api.addMember(slug, {
+				feishuOpenId: newOpenId.trim(),
+				role: newRole,
+				...(newName.trim() ? { displayName: newName.trim() } : {}),
+			});
+			members = [...members, m].sort((a, b) => a.role.localeCompare(b.role) || a.createdAt.localeCompare(b.createdAt));
+			newOpenId = '';
+			newName = '';
+			toastSuccess('成员已添加');
+		} catch (err) {
+			toastError(err instanceof Error ? err.message : String(err));
+		} finally {
+			adding = false;
+		}
+	}
+
+	async function changeRole(m: OrgMember, role: string) {
+		try {
+			await api.setMemberRole(slug, m.userId, role);
+			await load();
+			toastSuccess('角色已更新');
+		} catch (err) {
+			toastError(err instanceof Error ? err.message : String(err));
+		}
+	}
+
+	async function revoke(m: OrgMember) {
+		if (!confirm(`移除成员 ${m.displayName} 出本组织?`)) return;
+		try {
+			await api.revokeMember(slug, m.userId);
+			await load();
+			toastSuccess('成员已移除');
+		} catch (err) {
+			toastError(err instanceof Error ? err.message : String(err));
+		}
+	}
+
+	$effect(() => {
+		if (slug) load();
+	});
+</script>
+
+<PageHeader title="成员与权限" description="管理组织角色：所有者与管理员可访问本后台，成员不可。" />
+
+{#if loading}
+	<LoadingState />
+{:else if error}
+	<ErrorBanner message={error} onretry={load} />
+{:else}
+	<div class="saas-card-pad mb-6">
+		<h2 class="saas-section-title mb-4">添加成员</h2>
+		<div class="grid gap-3 md:grid-cols-[1.2fr_1fr_12rem_auto]">
+			<input class="saas-input" placeholder="飞书 open_id" bind:value={newOpenId} />
+			<input class="saas-input" placeholder="显示名（可选）" bind:value={newName} />
+			<SelectField items={roleItems} bind:value={newRole} />
+			<button class="saas-btn-primary" onclick={addMember} disabled={adding}>
+				{adding ? '添加中…' : '添加成员'}
+			</button>
+		</div>
+	</div>
+
+	<div class="saas-card overflow-hidden">
+		<div class="flex items-center justify-between border-b border-surface-200 px-5 py-3">
+			<h2 class="text-sm font-semibold">成员列表</h2>
+			<span class="saas-badge-neutral">{members.length}</span>
+		</div>
+		{#if members.length === 0}
+			<EmptyState title="暂无成员" description="使用上方表单按飞书 open_id 添加成员。" />
+		{:else}
+			<div class="overflow-x-auto">
+				<table class="data-table">
+					<thead>
+						<tr>
+							<th>用户</th>
+							<th>open_id</th>
+							<th>组织角色</th>
+							<th>加入时间</th>
+							<th></th>
+						</tr>
+					</thead>
+					<tbody>
+						{#each members as m}
+							<tr>
+								<td>
+									<div class="flex items-center gap-2.5">
+										{#if m.avatarUrl}
+											<img src={m.avatarUrl} alt="" class="h-7 w-7 border border-surface-300 object-cover" />
+										{:else}
+											<div
+												class="flex h-7 w-7 items-center justify-center border border-primary-300 bg-primary-100 text-xs font-semibold text-primary-800"
+											>
+												{m.displayName.slice(0, 1)}
+											</div>
+										{/if}
+										<span class="font-medium">{m.displayName}</span>
+									</div>
+								</td>
+								<td class="font-mono text-xs text-surface-700">{m.feishuOpenId}</td>
+								<td class="min-w-36">
+									<SelectField
+										items={roleItems}
+										value={m.role}
+										onchange={(role) => {
+											if (role !== m.role) changeRole(m, role);
+										}}
+									/>
+								</td>
+								<td class="text-surface-700">{fmtDate(m.createdAt)}</td>
+								<td class="text-right">
+									<button class="saas-btn-danger py-1! text-sm" onclick={() => revoke(m)}>移除</button>
+								</td>
+							</tr>
+						{/each}
+					</tbody>
+				</table>
+			</div>
+		{/if}
+		<p class="border-t border-surface-300 px-5 py-3 text-xs text-surface-600">
+			组织角色控制后台访问；项目级权限由「项目」页团队授权（{permHint}）决定。
+		</p>
+	</div>
+{/if}

hub/admin-web/src/routes/admin/org/[slug]/projects/+page.svelte

@@ -0,0 +1,222 @@
+<script lang="ts">
+	import { page } from '$app/state';
+	import { api, type ExplorerData, type ExplorerFolder, type ExplorerProject, type OrgMembership } from '$lib/api';
+	import { session } from '$lib/session';
+	import FolderTree from '$lib/components/FolderTree.svelte';
+	import PageHeader from '$lib/components/PageHeader.svelte';
+	import LoadingState from '$lib/components/LoadingState.svelte';
+	import ErrorBanner from '$lib/components/ErrorBanner.svelte';
+	import EmptyState from '$lib/components/EmptyState.svelte';
+	import { Label } from 'bits-ui';
+	import Modal from '$lib/components/Modal.svelte';
+	import SelectField from '$lib/components/SelectField.svelte';
+	import { fmtDate } from '$lib/format';
+	import { toastError, toastSuccess } from '$lib/toast';
+
+	const slug = $derived(page.params.slug ?? '');
+	const org = $derived(($session.me?.organizations.find((o) => o.slug === slug) as OrgMembership | undefined) ?? null);
+	const isAdmin = $derived(!!org && (org.role === 'OWNER' || org.role === 'ADMIN'));
+
+	let data = $state<ExplorerData | null>(null);
+	let myProjects = $state<ExplorerProject[] | null>(null);
+	let loading = $state(true);
+	let error = $state<string | null>(null);
+
+	let showFolderModal = $state(false);
+	let folderName = $state('');
+	let folderParent = $state('');
+
+	let showProjectModal = $state(false);
+	let projectName = $state('');
+	let projectFolder = $state('');
+
+	function openFolderModal(parentId: string) {
+		folderName = '';
+		folderParent = parentId;
+		showFolderModal = true;
+	}
+
+	function openProjectModal(folderId: string) {
+		projectName = '';
+		projectFolder = folderId;
+		showProjectModal = true;
+	}
+
+	async function load() {
+		loading = true;
+		error = null;
+		try {
+			if (isAdmin) {
+				data = await api.explorer(slug);
+				myProjects = null;
+			} else {
+				myProjects = (await api.myProjects(slug)).projects;
+				data = null;
+			}
+		} catch (err) {
+			error = err instanceof Error ? err.message : String(err);
+		} finally {
+			loading = false;
+		}
+	}
+
+	async function createFolder() {
+		if (!folderName.trim()) return;
+		try {
+			await api.createFolder(slug, {
+				name: folderName.trim(),
+				...(folderParent ? { parentId: folderParent } : {}),
+			});
+			folderName = '';
+			folderParent = '';
+			showFolderModal = false;
+			await load();
+			toastSuccess('文件夹已创建');
+		} catch (err) {
+			toastError(err instanceof Error ? err.message : String(err));
+		}
+	}
+
+	async function createProject() {
+		if (!projectName.trim()) return;
+		try {
+			const res = await api.createProject(slug, {
+				name: projectName.trim(),
+				...(projectFolder ? { folderId: projectFolder } : {}),
+			});
+			projectName = '';
+			projectFolder = '';
+			showProjectModal = false;
+			window.location.href = `/admin/org/${slug}/projects/${res.id}`;
+		} catch (err) {
+			toastError(err instanceof Error ? err.message : String(err));
+		}
+	}
+
+	function folderPath(f: ExplorerFolder): string {
+		if (!data) return f.name;
+		const parts: string[] = [f.name];
+		let cur: ExplorerFolder | undefined = f;
+		while (cur?.parentId) {
+			const parent = data.folders.find((x) => x.id === cur!.parentId);
+			if (!parent) break;
+			parts.unshift(parent.name);
+			cur = parent;
+		}
+		return parts.join(' / ');
+	}
+
+	function folderItems() {
+		if (!data) return [{ value: '', label: '（根）' }];
+		return [{ value: '', label: '（根）' }, ...data.folders.map((f) => ({ value: f.id, label: folderPath(f) }))];
+	}
+
+	$effect(() => {
+		if (slug && org) load();
+	});
+</script>
+
+{#if loading}
+	<LoadingState />
+{:else if error}
+	<ErrorBanner message={error} onretry={load} />
+{:else if isAdmin && data}
+	<PageHeader title="项目" description="文件夹是透明组织节点；项目是权限边界。">
+		{#snippet actions()}
+			<button class="saas-btn-secondary" onclick={() => openFolderModal('')}>新建文件夹</button>
+			<button class="saas-btn-primary" onclick={() => openProjectModal('')}>新建项目</button>
+		{/snippet}
+	</PageHeader>
+
+	<div class="saas-card p-2 sm:p-3">
+		{#if data.projects.filter((p) => !p.folderId).length === 0 && data.folders.filter((f) => !f.parentId).length === 0}
+			<EmptyState title="暂无项目" description="新建文件夹或项目，开始组织你的教研资产。" />
+		{:else}
+			<FolderTree
+				folders={data.folders}
+				projects={data.projects}
+				parentId={null}
+				{slug}
+				onCreateFolder={openFolderModal}
+				onCreateProject={openProjectModal}
+			/>
+		{/if}
+	</div>
+
+	<Modal bind:open={showFolderModal} title="新建文件夹">
+		<Label.Root class="saas-label" for="folder-name">名称</Label.Root>
+		<input
+			id="folder-name"
+			class="saas-input mb-4"
+			bind:value={folderName}
+			onkeydown={(e) => {
+				if (e.key === 'Enter') createFolder();
+			}}
+		/>
+		{#if data && data.folders.length > 0}
+			<p class="saas-label">父文件夹（可选）</p>
+			<div class="mb-4">
+				<SelectField items={folderItems()} bind:value={folderParent} />
+			</div>
+		{/if}
+		<div class="flex justify-end gap-2">
+			<button class="saas-btn-ghost" onclick={() => (showFolderModal = false)}>取消</button>
+			<button class="saas-btn-primary" onclick={createFolder}>创建</button>
+		</div>
+	</Modal>
+
+	<Modal bind:open={showProjectModal} title="新建项目">
+		<Label.Root class="saas-label" for="project-name">项目名</Label.Root>
+		<input
+			id="project-name"
+			class="saas-input mb-4"
+			bind:value={projectName}
+			onkeydown={(e) => {
+				if (e.key === 'Enter') createProject();
+			}}
+		/>
+		{#if data && data.folders.length > 0}
+			<p class="saas-label">文件夹（可选）</p>
+			<div class="mb-4">
+				<SelectField items={folderItems()} bind:value={projectFolder} />
+			</div>
+		{/if}
+		<div class="flex justify-end gap-2">
+			<button class="saas-btn-ghost" onclick={() => (showProjectModal = false)}>取消</button>
+			<button class="saas-btn-primary" onclick={createProject}>创建</button>
+		</div>
+	</Modal>
+{:else if myProjects !== null}
+	<PageHeader title="我的项目" description="你拥有访问授权的项目。">
+		{#snippet actions()}
+			<span class="saas-badge-neutral">仅显示已授权项目</span>
+		{/snippet}
+	</PageHeader>
+
+	<div class="saas-card overflow-hidden">
+		{#if myProjects.length === 0}
+			<EmptyState title="暂无可访问项目" description="当团队被授予项目访问权限时，项目会出现在这里。" />
+		{:else}
+			<table class="data-table">
+				<thead>
+					<tr>
+						<th>项目</th>
+						<th>飞书群</th>
+						<th>创建时间</th>
+					</tr>
+				</thead>
+				<tbody>
+					{#each myProjects as p}
+						<tr class="cursor-pointer" onclick={() => (window.location.href = `/admin/org/${slug}/projects/${p.id}`)}>
+							<td class="font-medium">{p.name}</td>
+							<td class="font-mono text-xs">{p.binding ? `群 ${p.binding.chatId}` : '—'}</td>
+							<td class="text-surface-700">{fmtDate(p.createdAt)}</td>
+						</tr>
+					{/each}
+				</tbody>
+			</table>
+		{/if}
+	</div>
+{:else}
+	<EmptyState title="项目数据不可用" description="无法加载项目列表。" />
+{/if}

hub/admin-web/src/routes/admin/org/[slug]/projects/[projectId]/+page.svelte

@@ -0,0 +1,306 @@
+<script lang="ts">
+	import { page } from '$app/state';
+	import {
+		api,
+		type ProjectDetail,
+		type TeamAccessEntry,
+		type TeamRow,
+		type SessionSummary,
+		type ExplorerData,
+	} from '$lib/api';
+	import { fmtDate, permissionRoleLabel } from '$lib/format';
+	import { PERMISSION_ROLES, PERMISSION_ROLE_LABELS } from '$lib/constants';
+	import PageHeader from '$lib/components/PageHeader.svelte';
+	import LoadingState from '$lib/components/LoadingState.svelte';
+	import ErrorBanner from '$lib/components/ErrorBanner.svelte';
+	import EmptyState from '$lib/components/EmptyState.svelte';
+	import SelectField from '$lib/components/SelectField.svelte';
+	import Icon from '$lib/components/Icon.svelte';
+	import { toastError, toastSuccess } from '$lib/toast';
+
+	const slug = $derived(page.params.slug ?? '');
+	const projectId = $derived(page.params.projectId ?? '');
+	const roleItems = PERMISSION_ROLES.map((r) => ({ value: r, label: PERMISSION_ROLE_LABELS[r] }));
+	const roleChain = `${PERMISSION_ROLE_LABELS.READ} ⊂ ${PERMISSION_ROLE_LABELS.EDIT} ⊂ ${PERMISSION_ROLE_LABELS.MANAGE}`;
+
+	let proj = $state<ProjectDetail | null>(null);
+	let access = $state<TeamAccessEntry[]>([]);
+	let sessions = $state<SessionSummary[]>([]);
+	let teams = $state<TeamRow[]>([]);
+	let explorer = $state<ExplorerData | null>(null);
+	let loading = $state(true);
+	let error = $state<string | null>(null);
+
+	let grantTeam = $state('');
+	let grantRole = $state<string>('EDIT');
+	let moveFolder = $state('');
+
+	const actorIsOrgAdmin = $derived(proj?.actorIsOrgAdmin ?? false);
+	const actorCanManage = $derived(proj?.actorCanManageProject ?? false);
+
+	async function load() {
+		loading = true;
+		error = null;
+		try {
+			// Project detail + team-access list are gated to project read/oversight.
+			const [p, a] = await Promise.all([api.project(slug, projectId), api.teamAccess(slug, projectId)]);
+			proj = p;
+			access = a.access;
+			// Team list is needed for grant UI whenever the actor has project MANAGE
+			// (org admin or member). Sessions/explorer stay org-admin oversight only.
+			const needTeams = p.actorIsOrgAdmin === true || p.actorCanManageProject === true;
+			const [s, t, e] = await Promise.all([
+				p.actorIsOrgAdmin ? api.sessions(slug, projectId) : Promise.resolve({ sessions: [] as SessionSummary[] }),
+				needTeams ? api.teams(slug) : Promise.resolve({ teams: [] as TeamRow[] }),
+				p.actorIsOrgAdmin ? api.explorer(slug) : Promise.resolve(null as ExplorerData | null),
+			]);
+			sessions = s.sessions;
+			teams = t.teams;
+			explorer = e;
+			if (p.actorIsOrgAdmin) {
+				moveFolder = p.folderId ?? '';
+			}
+		} catch (err) {
+			error = err instanceof Error ? err.message : String(err);
+		} finally {
+			loading = false;
+		}
+	}
+
+	async function rename() {
+		if (!proj) return;
+		const name = prompt('新名称', proj.name);
+		if (!name) return;
+		try {
+			await api.renameProject(slug, projectId, name);
+			await load();
+			toastSuccess('已重命名');
+		} catch (err) {
+			toastError(err instanceof Error ? err.message : String(err));
+		}
+	}
+
+	async function archiveBinding() {
+		if (!confirm('解绑当前飞书群? 用户将无法通过该群触发智能体。')) return;
+		try {
+			await api.archiveBinding(slug, projectId);
+			await load();
+			toastSuccess('已解绑飞书群');
+		} catch (err) {
+			toastError(err instanceof Error ? err.message : String(err));
+		}
+	}
+
+	async function archiveProject() {
+		if (!confirm(`归档项目 ${proj?.name}?`)) return;
+		try {
+			await api.archiveProject(slug, projectId);
+			window.location.href = `/admin/org/${slug}/projects`;
+		} catch (err) {
+			toastError(err instanceof Error ? err.message : String(err));
+		}
+	}
+
+	async function move() {
+		try {
+			await api.moveProject(slug, projectId, moveFolder || null);
+			await load();
+			toastSuccess('已移动');
+		} catch (err) {
+			toastError(err instanceof Error ? err.message : String(err));
+		}
+	}
+
+	async function grant() {
+		if (!grantTeam) return;
+		try {
+			await api.grantTeamAccess(slug, projectId, { teamId: grantTeam, role: grantRole });
+			grantTeam = '';
+			await load();
+			toastSuccess('已授权');
+		} catch (err) {
+			toastError(err instanceof Error ? err.message : String(err));
+		}
+	}
+
+	async function revoke(t: TeamAccessEntry) {
+		if (!confirm(`撤销 ${t.teamName} 对此项目的授权?`)) return;
+		try {
+			await api.revokeTeamAccess(slug, projectId, t.teamId);
+			await load();
+			toastSuccess('已撤销授权');
+		} catch (err) {
+			toastError(err instanceof Error ? err.message : String(err));
+		}
+	}
+
+	function folderItems() {
+		const items = [{ value: '', label: '（根）' }];
+		if (!explorer) return items;
+		return [...items, ...explorer.folders.map((f) => ({ value: f.id, label: f.name }))];
+	}
+
+	function teamItems() {
+		return [{ value: '', label: '选择团队…' }, ...teams.map((t) => ({ value: t.id, label: `${t.name}（${t.slug}）` }))];
+	}
+
+	$effect(() => {
+		if (slug && projectId) load();
+	});
+</script>
+
+{#if loading}
+	<LoadingState />
+{:else if error}
+	<ErrorBanner message={error} onretry={load} />
+{:else if proj}
+	<div class="mb-2">
+		<a
+			href={`/admin/org/${slug}/projects`}
+			class="inline-flex items-center gap-1 text-sm text-surface-700 hover:text-primary-600"
+		>
+			<Icon name="arrow-left" class="h-4 w-4" />
+			返回项目列表
+		</a>
+	</div>
+
+	{@const detail = proj}
+	<PageHeader title={detail.name} description={`项目是权限边界；通过团队授予 ${roleChain}。`}>
+		{#snippet actions()}
+			{#if actorIsOrgAdmin}
+				<button class="saas-btn-secondary py-1.5! text-sm" onclick={rename}>重命名</button>
+				{#if detail.binding}
+					<button class="saas-btn-secondary py-1.5! text-sm" onclick={archiveBinding}>解绑飞书群</button>
+				{/if}
+				<button class="saas-btn-danger py-1.5! text-sm" onclick={archiveProject}>归档</button>
+			{/if}
+		{/snippet}
+	</PageHeader>
+
+	<div class="saas-card-pad mb-6">
+		<dl class="grid gap-x-8 gap-y-3 text-sm sm:grid-cols-2">
+			<div>
+				<dt class="text-xs font-medium uppercase tracking-wide text-surface-600">工作区路径</dt>
+				<dd class="mt-0.5 break-all font-mono text-xs text-surface-700">{proj.workspaceDir}</dd>
+			</div>
+			<div>
+				<dt class="text-xs font-medium uppercase tracking-wide text-surface-600">创建者</dt>
+				<dd class="mt-0.5 text-surface-800">
+					{proj.createdBy ? `${proj.createdBy.displayName} (${proj.createdBy.feishuOpenId})` : '—'}
+				</dd>
+			</div>
+			<div>
+				<dt class="text-xs font-medium uppercase tracking-wide text-surface-600">文件夹</dt>
+				<dd class="mt-0.5 text-surface-800">{proj.folder ? proj.folder.name : '（根）'}</dd>
+			</div>
+			<div>
+				<dt class="text-xs font-medium uppercase tracking-wide text-surface-600">飞书群</dt>
+				<dd class="mt-0.5 text-surface-800">
+					{#if proj.binding}
+						<span class="saas-badge-success mr-1">已绑定</span>
+						<span class="font-mono text-xs">群 {proj.binding.chatId}</span>
+						<span class="text-surface-600"> · {fmtDate(proj.binding.createdAt)}</span>
+					{:else}
+						<span class="saas-badge-neutral">未绑定</span>
+					{/if}
+				</dd>
+			</div>
+			<div>
+				<dt class="text-xs font-medium uppercase tracking-wide text-surface-600">创建时间</dt>
+				<dd class="mt-0.5 text-surface-800">{fmtDate(proj.createdAt)}</dd>
+			</div>
+		</dl>
+
+		{#if explorer}
+			<div class="mt-5 flex flex-wrap items-end gap-2 border-t border-surface-100 pt-4">
+				<div class="min-w-48 flex-1">
+					<p class="saas-label">移动到文件夹</p>
+					<SelectField items={folderItems()} bind:value={moveFolder} />
+				</div>
+				<button class="saas-btn-secondary" onclick={move}>移动</button>
+			</div>
+		{/if}
+	</div>
+
+	<div class="saas-card-pad mb-6">
+		<h3 class="saas-section-title mb-1">团队授权</h3>
+		<p class="saas-muted mb-4">通过团队授权项目访问。一项目可授多团队，一团队可访问多项目。</p>
+
+		{#if actorCanManage}
+			<div class="mb-4 grid gap-2 sm:grid-cols-[1fr_10rem_auto]">
+				<SelectField items={teamItems()} bind:value={grantTeam} />
+				<SelectField items={roleItems} bind:value={grantRole} />
+				<button class="saas-btn-primary" onclick={grant}>授权</button>
+			</div>
+		{:else}
+			<p class="mb-4 text-xs text-surface-600">需要项目 MANAGE 授权才能增删团队访问。</p>
+		{/if}
+
+		{#if access.length === 0}
+			<EmptyState title="暂无团队授权" description="选择团队并授予角色以开放项目访问。" />
+		{:else}
+			<table class="data-table">
+				<thead>
+					<tr>
+						<th>团队</th>
+						<th>标识</th>
+						<th>角色</th>
+						<th></th>
+					</tr>
+				</thead>
+				<tbody>
+					{#each access as g}
+						<tr>
+							<td class="font-medium">{g.teamName}</td>
+							<td class="font-mono text-xs">/{g.teamSlug}</td>
+							<td><span class="saas-badge-primary">{permissionRoleLabel(g.role)}</span></td>
+							<td class="text-right">
+								{#if actorCanManage}
+									<button class="saas-btn-danger py-1! text-xs" onclick={() => revoke(g)}>撤销</button>
+								{:else}
+									<span class="text-xs text-surface-500">—</span>
+								{/if}
+							</td>
+						</tr>
+					{/each}
+				</tbody>
+			</table>
+		{/if}
+	</div>
+
+	{#if actorIsOrgAdmin}
+		<div class="saas-card overflow-hidden">
+			<div class="border-b border-surface-200 px-5 py-3">
+				<h3 class="text-sm font-semibold">智能体会话</h3>
+			</div>
+			{#if sessions.length === 0}
+				<EmptyState title="暂无会话" description="飞书侧触发智能体后会显示在此。" />
+			{:else}
+				<table class="data-table">
+					<thead>
+						<tr>
+							<th>供应方 / 角色</th>
+							<th>模型</th>
+							<th>运行次数</th>
+							<th>更新</th>
+						</tr>
+					</thead>
+					<tbody>
+						{#each sessions as s}
+							<tr>
+								<td class="font-mono text-xs">{s.provider} / {s.roleId}</td>
+								<td class="font-mono text-xs">{s.model}</td>
+								<td class="tabular-nums">{s.runCount}</td>
+								<td class="text-surface-700">{fmtDate(s.updatedAt)}</td>
+							</tr>
+						{/each}
+					</tbody>
+				</table>
+			{/if}
+		</div>
+	{/if}
+{:else}
+	<div class="saas-empty">
+		<p class="text-sm text-surface-600">项目数据不可用</p>
+	</div>
+{/if}

hub/admin-web/src/routes/admin/org/[slug]/provider/+page.svelte

@@ -0,0 +1,169 @@
+<script lang="ts">
+	import { page } from '$app/state';
+	import { api, type ProviderConnectionRow } from '$lib/api';
+	import { fmtDate, providerModeLabel } from '$lib/format';
+	import { Label } from 'bits-ui';
+	import PageHeader from '$lib/components/PageHeader.svelte';
+	import LoadingState from '$lib/components/LoadingState.svelte';
+	import ErrorBanner from '$lib/components/ErrorBanner.svelte';
+	import { toastError, toastSuccess } from '$lib/toast';
+
+	const slug = $derived(page.params.slug ?? '');
+
+	let connections = $state<ProviderConnectionRow[]>([]);
+	let loading = $state(true);
+	let error = $state<string | null>(null);
+
+	let providerId = $state('');
+	let baseUrl = $state('');
+	let authToken = $state('');
+	let anthropicApiKey = $state('');
+	let saving = $state(false);
+
+	async function load() {
+		loading = true;
+		error = null;
+		try {
+			const res = await api.providerConnections(slug);
+			connections = res.connections;
+		} catch (err) {
+			error = err instanceof Error ? err.message : String(err);
+		} finally {
+			loading = false;
+		}
+	}
+
+	function startRotate(row: ProviderConnectionRow) {
+		providerId = row.providerId;
+		baseUrl = '';
+		authToken = '';
+		anthropicApiKey = '';
+	}
+
+	function resetForm() {
+		providerId = '';
+		baseUrl = '';
+		authToken = '';
+		anthropicApiKey = '';
+	}
+
+	async function save() {
+		const id = providerId.trim();
+		if (id === '') {
+			toastError('请填写供应方 ID');
+			return;
+		}
+		const url = baseUrl.trim();
+		const token = authToken.trim();
+		if (url === '' || token === '') {
+			toastError('接口地址与访问令牌均为必填');
+			return;
+		}
+		saving = true;
+		const body: { baseUrl: string; authToken: string; anthropicApiKey?: string } = {
+			baseUrl: url,
+			authToken: token,
+		};
+		const key = anthropicApiKey.trim();
+		if (key !== '') body.anthropicApiKey = key;
+		try {
+			await api.rotateProviderConnection(slug, id, body);
+			toastSuccess('凭据已轮换');
+			resetForm();
+			await load();
+		} catch (err) {
+			toastError(err instanceof Error ? err.message : String(err));
+		} finally {
+			saving = false;
+		}
+	}
+
+	$effect(() => {
+		if (slug) load();
+	});
+</script>
+
+<PageHeader
+	title="模型供应方"
+	description="本组织的模型供应方连接。BYOK 由组织所有者/管理员轮换；平台托管连接由平台管理员配置。凭据按组织隔离，缺失或校验失败即拒绝运行（fail-closed）。"
+/>
+
+{#if loading}
+	<LoadingState />
+{:else if error}
+	<ErrorBanner message={error} onretry={load} />
+{:else}
+	<div class="saas-card overflow-hidden mb-6">
+		<div class="border-b border-surface-200 px-5 py-3">
+			<h3 class="text-sm font-semibold text-surface-800">连接</h3>
+		</div>
+		{#if connections.length === 0}
+			<div class="saas-empty"><p class="text-sm text-surface-600">尚无供应方连接</p></div>
+		{:else}
+			<div class="overflow-x-auto">
+				<table class="data-table">
+					<thead>
+						<tr>
+							<th>供应方</th>
+							<th>凭据模式</th>
+							<th>状态</th>
+							<th>版本</th>
+							<th>更新于</th>
+							<th></th>
+						</tr>
+					</thead>
+					<tbody>
+						{#each connections as row}
+							<tr>
+								<td class="font-mono text-sm">{row.providerId}</td>
+								<td>{providerModeLabel(row.mode)}</td>
+								<td>{row.status}</td>
+								<td class="tabular-nums">{row.activeVersion ?? '—'}</td>
+								<td class="text-surface-600">{fmtDate(row.updatedAt)}</td>
+								<td>
+									{#if row.mode === 'BYOK'}
+										<button class="saas-btn-ghost px-2! py-1! text-xs" onclick={() => startRotate(row)}>轮换</button>
+									{:else}
+										<span class="text-xs text-surface-500">平台管理</span>
+									{/if}
+								</td>
+							</tr>
+						{/each}
+					</tbody>
+				</table>
+			</div>
+		{/if}
+	</div>
+
+	<div class="saas-card-pad">
+		<h3 class="saas-section-title mb-1">轮换 BYOK 凭据</h3>
+		<p class="saas-muted mb-4">
+			密钥仅写入新版本，旧版本归档；保存时需重新填写接口地址与访问令牌。平台托管连接不在此处管理。
+		</p>
+		<div class="grid gap-5">
+			<div>
+				<Label.Root class="saas-label" for="provider-id">供应方 ID</Label.Root>
+				<input id="provider-id" class="saas-input font-mono text-sm" bind:value={providerId} placeholder="openrouter" />
+			</div>
+			<div>
+				<Label.Root class="saas-label" for="base-url">接口地址</Label.Root>
+				<input id="base-url" class="saas-input" placeholder="https://openrouter.ai/api" bind:value={baseUrl} />
+			</div>
+			<div>
+				<Label.Root class="saas-label" for="auth-token">访问令牌</Label.Root>
+				<input id="auth-token" class="saas-input" type="password" bind:value={authToken} />
+			</div>
+			<div>
+				<Label.Root class="saas-label" for="anthropic-key">Anthropic API Key（可选）</Label.Root>
+				<input id="anthropic-key" class="saas-input" type="password" bind:value={anthropicApiKey} />
+			</div>
+		</div>
+		<div class="mt-6 flex items-center gap-3 border-t border-surface-100 pt-4">
+			<div class="flex-1"></div>
+			<button class="saas-btn-ghost" onclick={resetForm} disabled={saving}>清空</button>
+			<button class="saas-btn-primary" onclick={save} disabled={saving}>
+				{saving ? '保存中…' : '保存'}
+			</button>
+		</div>
+	</div>
+{/if}

hub/admin-web/src/routes/admin/org/[slug]/roles/+page.svelte

@@ -0,0 +1,129 @@
+<script lang="ts">
+	import { page } from '$app/state';
+	import { api, type AgentRoleRow, type AgentModelRow, type AgentSkillRow } from '$lib/api';
+	import PageHeader from '$lib/components/PageHeader.svelte';
+	import LoadingState from '$lib/components/LoadingState.svelte';
+	import ErrorBanner from '$lib/components/ErrorBanner.svelte';
+	import EmptyState from '$lib/components/EmptyState.svelte';
+	import RoleCard from '$lib/components/RoleCard.svelte';
+	import { toastError, toastSuccess } from '$lib/toast';
+
+	const slug = $derived(page.params.slug ?? '');
+
+	let roles = $state<AgentRoleRow[]>([]);
+	let models = $state<AgentModelRow[]>([]);
+	let skills = $state<AgentSkillRow[]>([]);
+	let loading = $state(true);
+	let error = $state<string | null>(null);
+
+	let newRoleId = $state('');
+	let newLabel = $state('');
+	let adding = $state(false);
+
+	async function load() {
+		loading = true;
+		error = null;
+		try {
+			const [r, s] = await Promise.all([api.agentRoles(slug), api.agentSkills(slug)]);
+			roles = r.roles;
+			skills = s.skills;
+			// Model fetch hits the provider API and may fail or be slow; load it
+			// independently so roles remain editable even without a model list.
+			models = [];
+			api.agentModels(slug)
+				.then((m) => { models = m.models; })
+				.catch((err) => { toastError(`模型列表加载失败：${err instanceof Error ? err.message : String(err)}`); });
+		} catch (err) {
+			error = err instanceof Error ? err.message : String(err);
+		} finally {
+			loading = false;
+		}
+	}
+
+	async function add() {
+		const roleId = newRoleId.trim();
+		const label = newLabel.trim();
+		if (roleId === '' || label === '') {
+			toastError('角色 ID 与显示名均为必填');
+			return;
+		}
+		if (roles.some((r) => r.roleId === roleId)) {
+			toastError(`角色 ID 已存在：${roleId}`);
+			return;
+		}
+		adding = true;
+		try {
+			const created = await api.upsertAgentRole(slug, roleId, { label });
+			roles = [...roles, created];
+			newRoleId = '';
+			newLabel = '';
+			toastSuccess('角色已创建');
+		} catch (err) {
+			toastError(err instanceof Error ? err.message : String(err));
+		} finally {
+			adding = false;
+		}
+	}
+
+	function onRoleUpdated(updated: AgentRoleRow) {
+		roles = roles.map((x) => (x.roleId === updated.roleId ? { ...updated, skillNames: x.skillNames } : x));
+		if (updated.isDefault) {
+			roles = roles.map((x) => (x.roleId === updated.roleId ? x : { ...x, isDefault: false }));
+		}
+	}
+
+	function onRoleSkillsChanged(roleId: string, skillNames: string[]) {
+		roles = roles.map((x) => (x.roleId === roleId ? { ...x, skillNames } : x));
+	}
+
+	$effect(() => {
+		if (slug) load();
+	});
+</script>
+
+<PageHeader
+	title="角色"
+	description="角色是组织级数据：组合默认模型、系统提示词、工具白名单与已绑定技能。角色 ID 即飞书斜杠命令（如 /draft）。"
+/>
+
+{#if loading}
+	<LoadingState />
+{:else if error}
+	<ErrorBanner message={error} onretry={load} />
+{:else}
+	<div class="saas-card-pad mb-6">
+		<h2 class="saas-section-title mb-4">新建角色</h2>
+		<div class="grid gap-3 sm:grid-cols-[10rem_1fr_auto]">
+			<input
+				class="saas-input font-mono text-sm"
+				placeholder="角色 ID（如 draft）"
+				bind:value={newRoleId}
+				onkeydown={(e) => {
+					if (e.key === 'Enter') add();
+				}}
+			/>
+			<input
+				class="saas-input"
+				placeholder="显示名（如 草稿）"
+				bind:value={newLabel}
+				onkeydown={(e) => {
+					if (e.key === 'Enter') add();
+				}}
+			/>
+			<button class="saas-btn-primary" onclick={add} disabled={adding}>新建</button>
+		</div>
+		<p class="mt-2 text-xs text-surface-600">角色 ID 仅允许小写字母、数字、下划线与连字符，且以字母或数字开头。</p>
+	</div>
+
+	{#if roles.length === 0}
+		<div class="saas-card">
+			<EmptyState title="暂无角色" description="组织必须且只能有一个启用中的默认角色；新建第一个角色将自动成为默认。" />
+		</div>
+	{:else}
+		<div class="space-y-4">
+			{#each roles as r (r.roleId)}
+				<RoleCard {r} {models} {skills} {slug} onupdated={onRoleUpdated} onskillschanged={onRoleSkillsChanged} />
+			{/each}
+		</div>
+	{/if}
+{/if}

hub/admin-web/src/routes/admin/org/[slug]/skills/+page.svelte

@@ -0,0 +1,141 @@
+<script lang="ts">
+	import { page } from '$app/state';
+	import { api, type AgentSkillRow, type SkillFileEntry } from '$lib/api';
+	import PageHeader from '$lib/components/PageHeader.svelte';
+	import LoadingState from '$lib/components/LoadingState.svelte';
+	import ErrorBanner from '$lib/components/ErrorBanner.svelte';
+	import EmptyState from '$lib/components/EmptyState.svelte';
+	import SkillEditor from '$lib/components/SkillEditor.svelte';
+	import { toastError, toastSuccess } from '$lib/toast';
+
+	const slug = $derived(page.params.slug ?? '');
+
+	let skills = $state<AgentSkillRow[]>([]);
+	let loading = $state(true);
+	let error = $state<string | null>(null);
+
+	let showNewSkill = $state(false);
+	let newSkillName = $state('');
+	let newSkillVersion = $state('0.1.0');
+	let newSkillDescription = $state('');
+	let creating = $state(false);
+
+	async function load() {
+		loading = true;
+		error = null;
+		try {
+			const res = await api.agentSkills(slug);
+			skills = res.skills;
+		} catch (err) {
+			error = err instanceof Error ? err.message : String(err);
+		} finally {
+			loading = false;
+		}
+	}
+
+	async function createSkill() {
+		const name = newSkillName.trim();
+		if (name === '') {
+			toastError('技能名称不能为空');
+			return;
+		}
+		if (!/^[a-z0-9][a-z0-9-]{0,63}$/.test(name)) {
+			toastError('技能名称仅允许小写字母、数字和连字符，且以字母或数字开头');
+			return;
+		}
+		const version = newSkillVersion.trim();
+		if (version === '') {
+			toastError('版本号不能为空');
+			return;
+		}
+		creating = true;
+		try {
+			const manifest = buildManifest(name, newSkillDescription.trim());
+			const files: SkillFileEntry[] = [{ path: 'SKILL.md', content: manifest }];
+			const result = await api.installAgentSkill(slug, name, { version, files });
+			toastSuccess(`技能 ${result.name} 已创建`);
+			newSkillName = '';
+			newSkillDescription = '';
+			showNewSkill = false;
+			await load();
+		} catch (err) {
+			toastError(err instanceof Error ? err.message : String(err));
+		} finally {
+			creating = false;
+		}
+	}
+
+	function buildManifest(name: string, description: string): string {
+		const desc = description === '' ? name : description;
+		return `---\nname: ${name}\ndescription: ${desc}\n---\n# ${name}\n\n`;
+	}
+
+	function onInstalled(_result: { id: string; name: string; contentDigest: string }) {
+		load();
+	}
+
+	function onDisabled(_name: string) {
+		load();
+	}
+
+	$effect(() => {
+		if (slug) load();
+	});
+</script>
+
+<PageHeader
+	title="技能"
+	description="技能是组织级 Agent 能力包：一个包含 SKILL.md manifest 的目录。技能内容按 SHA-256 content-addressed 存储，变更后绑定角色的活跃会话自动归档。"
+/>
+
+{#if loading}
+	<LoadingState />
+{:else if error}
+	<ErrorBanner message={error} onretry={load} />
+{:else}
+	<div class="saas-card-pad mb-6">
+		<div class="flex items-center justify-between">
+			<h2 class="saas-section-title">新建技能</h2>
+			<button class="text-sm text-primary-700 hover:text-primary-900" onclick={() => (showNewSkill = !showNewSkill)}>
+				{showNewSkill ? '取消' : '+ 新建'}
+			</button>
+		</div>
+		{#if showNewSkill}
+			<div class="mt-4 grid gap-3 sm:grid-cols-[12rem_8rem_1fr_auto]">
+				<input
+					class="saas-input font-mono text-sm"
+					placeholder="技能名（如 typst-help）"
+					bind:value={newSkillName}
+				/>
+				<input
+					class="saas-input text-sm"
+					placeholder="版本号"
+					bind:value={newSkillVersion}
+				/>
+				<input
+					class="saas-input text-sm"
+					placeholder="描述"
+					bind:value={newSkillDescription}
+				/>
+				<button class="saas-btn-primary" onclick={createSkill} disabled={creating}>
+					{creating ? '创建中…' : '创建'}
+				</button>
+			</div>
+			<p class="mt-2 text-xs text-surface-600">
+				技能名称仅允许小写字母、数字和连字符，且以字母或数字开头。创建后会生成 SKILL.md 模板。
+			</p>
+		{/if}
+	</div>
+
+	{#if skills.length === 0}
+		<div class="saas-card">
+			<EmptyState title="暂无技能" description="新建一个技能，然后在角色管理中绑定到角色。" />
+		</div>
+	{:else}
+		<div class="space-y-4">
+			{#each skills as skill (skill.id)}
+				<SkillEditor {slug} {skill} oninstalled={onInstalled} ondisabled={onDisabled} />
+			{/each}
+		</div>
+	{/if}
+{/if}

hub/admin-web/src/routes/admin/org/[slug]/teams/+page.svelte

@@ -0,0 +1,233 @@
+<script lang="ts">
+	import { Collapsible } from 'bits-ui';
+	import { page } from '$app/state';
+	import { api, type TeamRow, type TeamMemberRow } from '$lib/api';
+	import { fmtDate } from '$lib/format';
+	import PageHeader from '$lib/components/PageHeader.svelte';
+	import LoadingState from '$lib/components/LoadingState.svelte';
+	import ErrorBanner from '$lib/components/ErrorBanner.svelte';
+	import EmptyState from '$lib/components/EmptyState.svelte';
+	import { toastError, toastSuccess } from '$lib/toast';
+
+	const slug = $derived(page.params.slug ?? '');
+
+	let teams = $state<TeamRow[]>([]);
+	let loading = $state(true);
+	let error = $state<string | null>(null);
+
+	let newSlug = $state('');
+	let newName = $state('');
+	let newDesc = $state('');
+	let adding = $state(false);
+
+	let expandedId = $state<string | null>(null);
+	let teamMembers = $state<TeamMemberRow[]>([]);
+	let memberInput = $state('');
+	let loadingMembers = $state(false);
+
+	async function load() {
+		loading = true;
+		error = null;
+		try {
+			const res = await api.teams(slug);
+			teams = res.teams;
+		} catch (err) {
+			error = err instanceof Error ? err.message : String(err);
+		} finally {
+			loading = false;
+		}
+	}
+
+	const SLUG_RE = /^[a-z0-9]([a-z0-9-]*[a-z0-9])?$/;
+
+	async function createTeam() {
+		if (!newSlug.trim() || !newName.trim()) return;
+		const teamSlug = newSlug.trim().toLowerCase();
+		if (!SLUG_RE.test(teamSlug)) {
+			toastError('标识须为小写字母数字，可用连字符连接');
+			return;
+		}
+		adding = true;
+		try {
+			await api.createTeam(slug, {
+				slug: teamSlug,
+				name: newName.trim(),
+				...(newDesc.trim() ? { description: newDesc.trim() } : {}),
+			});
+			newSlug = '';
+			newName = '';
+			newDesc = '';
+			await load();
+			toastSuccess('团队已创建');
+		} catch (err) {
+			toastError(err instanceof Error ? err.message : String(err));
+		} finally {
+			adding = false;
+		}
+	}
+
+	async function archiveTeam(t: TeamRow) {
+		if (!confirm(`归档团队 ${t.name}? 归档后该团队不再解析为项目授权主体。`)) return;
+		try {
+			await api.archiveTeam(slug, t.id);
+			if (expandedId === t.id) expandedId = null;
+			await load();
+			toastSuccess('团队已归档');
+		} catch (err) {
+			toastError(err instanceof Error ? err.message : String(err));
+		}
+	}
+
+	async function openMembers(t: TeamRow) {
+		if (expandedId === t.id) return;
+		expandedId = t.id;
+		loadingMembers = true;
+		memberInput = '';
+		try {
+			const res = await api.teamMembers(slug, t.id);
+			teamMembers = res.members;
+		} catch (err) {
+			toastError(err instanceof Error ? err.message : String(err));
+		} finally {
+			loadingMembers = false;
+		}
+	}
+
+	function onExpandChange(t: TeamRow, open: boolean) {
+		if (open) void openMembers(t);
+		else if (expandedId === t.id) expandedId = null;
+	}
+
+	async function addMember(t: TeamRow) {
+		if (!memberInput.trim()) return;
+		const v = memberInput.trim();
+		try {
+			await api.addTeamMember(slug, t.id, v.startsWith('ou') ? { feishuOpenId: v } : { userId: v });
+			memberInput = '';
+			const res = await api.teamMembers(slug, t.id);
+			teamMembers = res.members;
+			await load();
+			toastSuccess('已加入团队');
+		} catch (err) {
+			toastError(err instanceof Error ? err.message : String(err));
+		}
+	}
+
+	async function revokeMember(t: TeamRow, m: TeamMemberRow) {
+		if (!confirm(`将 ${m.displayName} 移出团队 ${t.name}?`)) return;
+		try {
+			await api.revokeTeamMember(slug, t.id, m.userId);
+			const res = await api.teamMembers(slug, t.id);
+			teamMembers = res.members;
+			await load();
+			toastSuccess('已移出团队');
+		} catch (err) {
+			toastError(err instanceof Error ? err.message : String(err));
+		}
+	}
+
+	$effect(() => {
+		if (slug) load();
+	});
+</script>
+
+<PageHeader title="团队" description="团队是项目授权主体，可被授予只读、编辑或管理权限。" />
+
+{#if loading}
+	<LoadingState />
+{:else if error}
+	<ErrorBanner message={error} onretry={load} />
+{:else}
+	<div class="saas-card-pad mb-6">
+		<h2 class="saas-section-title mb-4">新建团队</h2>
+		<div class="grid gap-3 md:grid-cols-[1fr_1fr_1.2fr_auto]">
+			<input class="saas-input" placeholder="标识（如 math-g7）" bind:value={newSlug} />
+			<input class="saas-input" placeholder="名称" bind:value={newName} />
+			<input class="saas-input" placeholder="描述（可选）" bind:value={newDesc} />
+			<button class="saas-btn-primary" onclick={createTeam} disabled={adding}>新建</button>
+		</div>
+	</div>
+
+	{#if teams.length === 0}
+		<div class="saas-card">
+			<EmptyState title="暂无团队" description="创建团队后，可在项目页授权项目访问。" />
+		</div>
+	{:else}
+		<div class="space-y-3">
+			{#each teams as t (t.id)}
+				<Collapsible.Root
+					class="saas-card p-5"
+					open={expandedId === t.id}
+					onOpenChange={(open) => onExpandChange(t, open)}
+				>
+					<div class="flex flex-wrap items-center gap-2.5">
+						<span class="text-base font-semibold text-surface-900">{t.name}</span>
+						<span class="font-mono text-xs text-surface-600">/{t.slug}</span>
+						<span class="saas-badge-neutral">{t.memberCount} 成员</span>
+						<div class="ml-auto flex flex-wrap gap-2">
+							<Collapsible.Trigger class="saas-btn-secondary py-1.5! text-sm">
+								{expandedId === t.id ? '收起' : '管理成员'}
+							</Collapsible.Trigger>
+							<button type="button" class="saas-btn-danger py-1.5! text-sm" onclick={() => archiveTeam(t)}>
+								归档
+							</button>
+						</div>
+					</div>
+					{#if t.description}
+						<p class="mt-1.5 text-sm text-surface-700">{t.description}</p>
+					{/if}
+					<p class="mt-1 text-xs text-surface-600">创建于 {fmtDate(t.createdAt)}</p>
+
+					<Collapsible.Content>
+						<div class="mt-4 border-t border-surface-200 pt-4">
+							{#if loadingMembers && expandedId === t.id}
+								<p class="text-sm text-surface-600">加载中…</p>
+							{:else if expandedId === t.id}
+								<div class="mb-4 flex gap-2">
+									<input
+										class="saas-input"
+										placeholder="飞书 open_id 或用户 id"
+										bind:value={memberInput}
+										onkeydown={(e) => {
+											if (e.key === 'Enter') addMember(t);
+										}}
+									/>
+									<button class="saas-btn-secondary shrink-0" onclick={() => addMember(t)}>加入</button>
+								</div>
+								{#if teamMembers.length === 0}
+									<p class="py-3 text-center text-sm text-surface-600">团队暂无成员</p>
+								{:else}
+									<table class="data-table">
+										<thead>
+											<tr>
+												<th>成员</th>
+												<th>open_id</th>
+												<th>加入时间</th>
+												<th></th>
+											</tr>
+										</thead>
+										<tbody>
+											{#each teamMembers as m}
+												<tr>
+													<td class="font-medium">{m.displayName}</td>
+													<td class="font-mono text-xs">{m.feishuOpenId}</td>
+													<td class="text-surface-700">{fmtDate(m.createdAt)}</td>
+													<td class="text-right">
+														<button class="saas-btn-danger py-1! text-xs" onclick={() => revokeMember(t, m)}>
+															移除
+														</button>
+													</td>
+												</tr>
+											{/each}
+										</tbody>
+									</table>
+								{/if}
+							{/if}
+						</div>
+					</Collapsible.Content>
+				</Collapsible.Root>
+			{/each}
+		</div>
+	{/if}
+	<p class="mt-4 text-xs text-surface-600">归档团队会同步撤销其活跃的项目授权。</p>
+{/if}

hub/admin-web/src/routes/app.css

@@ -0,0 +1,692 @@
+@import 'tailwindcss';
+
+@import '@skeletonlabs/skeleton';
+@import '@skeletonlabs/skeleton/themes/hamlindigo';
+
+@source './**/*.{html,js,svelte,ts}';
+@source '../lib/**/*.{html,js,svelte,ts}';
+
+/* Flat industrial: zero radius, higher-contrast surfaces, CJK-first type */
+@theme {
+	--font-sans:
+		'Noto Sans SC', 'PingFang SC', 'Hiragino Sans GB', 'Microsoft YaHei', 'Inter', ui-sans-serif, system-ui,
+		-apple-system, 'Segoe UI', sans-serif;
+	--font-mono: 'JetBrains Mono', ui-monospace, 'SF Mono', Menlo, Consolas, monospace;
+
+	--radius-none: 0;
+	--radius-sm: 0;
+	--radius-md: 0;
+	--radius-lg: 0;
+	--radius-xl: 0;
+	--radius-2xl: 0;
+	--radius-3xl: 0;
+	--radius-full: 0;
+	--radius: 0;
+}
+
+@layer base {
+	html {
+		height: 100%;
+		-webkit-font-smoothing: antialiased;
+		-moz-osx-font-smoothing: grayscale;
+		text-rendering: optimizeLegibility;
+		font-feature-settings:
+			'kern' 1,
+			'liga' 1;
+		/* Prefer readable CJK metrics over Latin optical sizing */
+		text-size-adjust: 100%;
+	}
+
+	body {
+		min-height: 100%;
+		font-family: var(--font-sans);
+		font-size: 15px;
+		line-height: 1.7;
+		letter-spacing: 0.01em;
+		/* Slightly cooler industrial surface */
+		background: var(--color-surface-100);
+		color: var(--color-surface-950, var(--color-surface-900));
+		font-variant-east-asian: proportional-width;
+	}
+
+	/* CJK headings: no negative tracking, breathing line-height */
+	h1,
+	h2,
+	h3,
+	h4,
+	h5,
+	h6 {
+		font-weight: 600;
+		line-height: 1.45;
+		letter-spacing: 0;
+		color: var(--color-surface-950, var(--color-surface-900));
+	}
+
+	p {
+		line-height: 1.75;
+	}
+
+	/* Harder focus ring for industrial UI */
+	:focus-visible {
+		outline: 2px solid var(--color-primary-600);
+		outline-offset: 2px;
+	}
+
+	::selection {
+		background: color-mix(in oklab, var(--color-primary-600) 35%, transparent);
+		color: var(--color-surface-950, var(--color-surface-900));
+	}
+
+	/* Tables: high-contrast grid, flat */
+	table.data-table {
+		width: 100%;
+		border-collapse: collapse;
+		font-size: 0.875rem;
+		line-height: 1.6;
+	}
+
+	table.data-table thead th {
+		padding: 0.625rem 0.75rem;
+		text-align: left;
+		font-weight: 600;
+		color: var(--color-surface-700);
+		background: var(--color-surface-100);
+		border-bottom: 1px solid var(--color-surface-300);
+		white-space: nowrap;
+		letter-spacing: 0.02em;
+	}
+
+	table.data-table tbody td {
+		padding: 0.75rem;
+		border-bottom: 1px solid var(--color-surface-200);
+		vertical-align: middle;
+		color: var(--color-surface-900);
+	}
+
+	table.data-table tbody tr:hover td {
+		background: var(--color-surface-100);
+	}
+
+	table.data-table tbody tr:last-child td {
+		border-bottom: none;
+	}
+}
+
+@layer components {
+	.saas-card {
+		border-radius: 0;
+		border: 1px solid var(--color-surface-300);
+		background: var(--color-surface-50);
+		box-shadow: none;
+	}
+
+	.saas-card-pad {
+		border-radius: 0;
+		border: 1px solid var(--color-surface-300);
+		background: var(--color-surface-50);
+		box-shadow: none;
+		padding: 1.25rem;
+	}
+
+	.saas-page-title {
+		font-size: 1.375rem;
+		line-height: 1.4;
+		font-weight: 700;
+		letter-spacing: 0;
+		color: var(--color-surface-950, var(--color-surface-900));
+	}
+
+	.saas-section-title {
+		font-size: 1rem;
+		line-height: 1.5;
+		font-weight: 600;
+		letter-spacing: 0;
+		color: var(--color-surface-950, var(--color-surface-900));
+	}
+
+	.saas-muted {
+		font-size: 0.875rem;
+		line-height: 1.65;
+		color: var(--color-surface-700);
+	}
+
+	.saas-label {
+		display: block;
+		margin-bottom: 0.375rem;
+		font-size: 0.875rem;
+		line-height: 1.5;
+		font-weight: 600;
+		color: var(--color-surface-800);
+	}
+
+	.saas-help {
+		margin-top: 0.375rem;
+		font-size: 0.8125rem;
+		line-height: 1.6;
+		color: var(--color-surface-600);
+	}
+
+	.saas-toolbar {
+		display: flex;
+		flex-wrap: wrap;
+		align-items: center;
+		gap: 0.75rem;
+		margin-bottom: 1.5rem;
+	}
+
+	.saas-stat {
+		border-radius: 0;
+		border: 1px solid var(--color-surface-300);
+		background: var(--color-surface-50);
+		padding: 1rem;
+		box-shadow: none;
+	}
+
+	.saas-stat-label {
+		font-size: 0.75rem;
+		font-weight: 600;
+		letter-spacing: 0.04em;
+		text-transform: uppercase;
+		color: var(--color-surface-600);
+	}
+
+	.saas-stat-value {
+		margin-top: 0.25rem;
+		font-size: 1.5rem;
+		line-height: 1.3;
+		font-weight: 700;
+		font-variant-numeric: tabular-nums;
+		letter-spacing: 0;
+		color: var(--color-surface-950, var(--color-surface-900));
+	}
+
+	.saas-empty {
+		display: flex;
+		flex-direction: column;
+		align-items: center;
+		justify-content: center;
+		gap: 0.5rem;
+		padding: 3rem 1rem;
+		text-align: center;
+		line-height: 1.7;
+	}
+
+	.saas-shell {
+		display: flex;
+		height: 100vh;
+		overflow: hidden;
+		background: var(--color-surface-100);
+	}
+
+	.saas-sidebar {
+		display: flex;
+		width: 16rem;
+		flex-shrink: 0;
+		flex-direction: column;
+		border-right: 1px solid var(--color-surface-300);
+		background: var(--color-surface-50);
+	}
+
+	.saas-main {
+		display: flex;
+		min-width: 0;
+		flex: 1;
+		flex-direction: column;
+		overflow: hidden;
+	}
+
+	.saas-topbar {
+		display: flex;
+		height: 3.5rem;
+		flex-shrink: 0;
+		align-items: center;
+		gap: 0.75rem;
+		border-bottom: 1px solid var(--color-surface-300);
+		background: var(--color-surface-50);
+		padding: 0 1.5rem;
+		/* flat: no glass */
+		backdrop-filter: none;
+	}
+
+	.saas-content {
+		flex: 1;
+		overflow-y: auto;
+	}
+
+	.saas-content-inner {
+		margin-inline: auto;
+		width: 100%;
+		max-width: 72rem;
+		padding: 1.5rem;
+	}
+
+	@media (min-width: 768px) {
+		.saas-content-inner {
+			padding: 2rem;
+		}
+	}
+
+	.saas-nav-item {
+		display: flex;
+		align-items: center;
+		gap: 0.75rem;
+		border-radius: 0;
+		padding: 0.5rem 0.75rem;
+		font-size: 0.875rem;
+		line-height: 1.5;
+		font-weight: 500;
+		color: var(--color-surface-700);
+		border-left: 2px solid transparent;
+		transition:
+			color 0.1s,
+			background-color 0.1s,
+			border-color 0.1s;
+	}
+
+	.saas-nav-item:hover {
+		background: var(--color-surface-100);
+		color: var(--color-surface-950, var(--color-surface-900));
+	}
+
+	.saas-nav-item[data-active='true'] {
+		background: var(--color-primary-50, var(--color-primary-100));
+		color: var(--color-primary-800);
+		border-left-color: var(--color-primary-600);
+		font-weight: 600;
+	}
+
+	.saas-badge {
+		display: inline-flex;
+		align-items: center;
+		border-radius: 0;
+		padding: 0.125rem 0.5rem;
+		font-size: 0.75rem;
+		line-height: 1.4;
+		font-weight: 600;
+		letter-spacing: 0.02em;
+	}
+
+	.saas-badge-neutral {
+		display: inline-flex;
+		align-items: center;
+		border-radius: 0;
+		padding: 0.125rem 0.5rem;
+		font-size: 0.75rem;
+		line-height: 1.4;
+		font-weight: 600;
+		border: 1px solid var(--color-surface-300);
+		background: var(--color-surface-100);
+		color: var(--color-surface-800);
+	}
+
+	.saas-badge-primary {
+		display: inline-flex;
+		align-items: center;
+		border-radius: 0;
+		padding: 0.125rem 0.5rem;
+		font-size: 0.75rem;
+		line-height: 1.4;
+		font-weight: 600;
+		border: 1px solid var(--color-primary-300);
+		background: var(--color-primary-100);
+		color: var(--color-primary-800);
+	}
+
+	.saas-badge-success {
+		display: inline-flex;
+		align-items: center;
+		border-radius: 0;
+		padding: 0.125rem 0.5rem;
+		font-size: 0.75rem;
+		line-height: 1.4;
+		font-weight: 600;
+		border: 1px solid var(--color-success-300);
+		background: var(--color-success-100);
+		color: var(--color-success-800);
+	}
+
+	.saas-badge-warning {
+		display: inline-flex;
+		align-items: center;
+		border-radius: 0;
+		padding: 0.125rem 0.5rem;
+		font-size: 0.75rem;
+		line-height: 1.4;
+		font-weight: 600;
+		border: 1px solid var(--color-warning-300);
+		background: var(--color-warning-100);
+		color: var(--color-warning-900);
+	}
+
+	.saas-badge-error {
+		display: inline-flex;
+		align-items: center;
+		border-radius: 0;
+		padding: 0.125rem 0.5rem;
+		font-size: 0.75rem;
+		line-height: 1.4;
+		font-weight: 600;
+		border: 1px solid var(--color-error-300);
+		background: var(--color-error-100);
+		color: var(--color-error-800);
+	}
+
+	.saas-input,
+	.saas-select,
+	.saas-textarea {
+		width: 100%;
+		border-radius: 0;
+		border: 1px solid var(--color-surface-400);
+		background: var(--color-surface-50);
+		color: var(--color-surface-950, var(--color-surface-900));
+		padding: 0.5rem 0.75rem;
+		font-size: 0.875rem;
+		line-height: 1.5;
+		outline: none;
+		transition:
+			border-color 0.1s,
+			box-shadow 0.1s;
+	}
+
+	.saas-input::placeholder,
+	.saas-textarea::placeholder {
+		color: var(--color-surface-500);
+	}
+
+	.saas-input:focus,
+	.saas-select:focus,
+	.saas-textarea:focus {
+		border-color: var(--color-primary-600);
+		box-shadow: inset 0 0 0 1px var(--color-primary-600);
+	}
+
+	.saas-textarea {
+		font-family: var(--font-mono);
+		line-height: 1.55;
+		resize: vertical;
+	}
+
+	.saas-select-trigger {
+		display: inline-flex;
+		width: 100%;
+		align-items: center;
+		border-radius: 0;
+		border: 1px solid var(--color-surface-400);
+		background: var(--color-surface-50);
+		color: var(--color-surface-950, var(--color-surface-900));
+		padding: 0.5rem 0.75rem;
+		font-size: 0.875rem;
+		line-height: 1.5;
+		outline: none;
+		transition:
+			border-color 0.1s,
+			box-shadow 0.1s;
+		cursor: pointer;
+		text-align: left;
+	}
+
+	.saas-select-trigger:focus-visible,
+	.saas-select-trigger[data-state='open'] {
+		border-color: var(--color-primary-600);
+		box-shadow: inset 0 0 0 1px var(--color-primary-600);
+	}
+
+	.saas-select-trigger:disabled,
+	.saas-select-trigger[data-disabled] {
+		cursor: not-allowed;
+		opacity: 0.55;
+	}
+
+	.saas-select-trigger [data-placeholder] {
+		color: var(--color-surface-500);
+	}
+
+	.saas-select-content {
+		z-index: 70;
+		max-height: min(18rem, var(--bits-select-content-available-height, 18rem));
+		width: var(--bits-select-anchor-width);
+		min-width: var(--bits-select-anchor-width);
+		overflow: hidden;
+		border-radius: 0;
+		border: 1px solid var(--color-surface-400);
+		background: var(--color-surface-50);
+		box-shadow: 4px 4px 0 rgb(15 23 42 / 0.12);
+		outline: none;
+	}
+
+	.saas-select-item {
+		display: flex;
+		align-items: center;
+		border-radius: 0;
+		padding: 0.45rem 0.65rem;
+		font-size: 0.875rem;
+		line-height: 1.5;
+		color: var(--color-surface-900);
+		cursor: pointer;
+		outline: none;
+		user-select: none;
+	}
+
+	.saas-select-item[data-highlighted] {
+		background: var(--color-primary-100);
+		color: var(--color-primary-900);
+	}
+
+	.saas-select-item[data-selected] {
+		color: var(--color-primary-900);
+		font-weight: 600;
+	}
+
+	.saas-select-item[data-disabled] {
+		cursor: not-allowed;
+		opacity: 0.45;
+	}
+
+	.saas-btn-primary,
+	.saas-btn-secondary,
+	.saas-btn-ghost,
+	.saas-btn-danger {
+		display: inline-flex;
+		align-items: center;
+		justify-content: center;
+		gap: 0.375rem;
+		border-radius: 0;
+		padding: 0.5rem 0.875rem;
+		font-size: 0.875rem;
+		font-weight: 600;
+		line-height: 1.4;
+		letter-spacing: 0.01em;
+		border: 1px solid transparent;
+		cursor: pointer;
+		transition:
+			background-color 0.1s,
+			color 0.1s,
+			border-color 0.1s,
+			opacity 0.1s;
+	}
+
+	.saas-btn-primary:disabled,
+	.saas-btn-secondary:disabled,
+	.saas-btn-ghost:disabled,
+	.saas-btn-danger:disabled {
+		opacity: 0.55;
+		cursor: not-allowed;
+	}
+
+	.saas-btn-primary {
+		background: var(--color-primary-600);
+		border-color: var(--color-primary-700);
+		color: var(--color-primary-contrast-500, white);
+	}
+
+	.saas-btn-primary:hover:not(:disabled) {
+		background: var(--color-primary-700);
+		border-color: var(--color-primary-800);
+	}
+
+	.saas-btn-secondary {
+		background: var(--color-surface-100);
+		border-color: var(--color-surface-400);
+		color: var(--color-surface-900);
+	}
+
+	.saas-btn-secondary:hover:not(:disabled) {
+		background: var(--color-surface-200);
+		border-color: var(--color-surface-500);
+	}
+
+	.saas-btn-ghost {
+		background: transparent;
+		border-color: transparent;
+		color: var(--color-surface-800);
+	}
+
+	.saas-btn-ghost:hover:not(:disabled) {
+		background: var(--color-surface-200);
+		color: var(--color-surface-950, var(--color-surface-900));
+	}
+
+	.saas-btn-danger {
+		background: var(--color-error-100);
+		border-color: var(--color-error-400);
+		color: var(--color-error-800);
+	}
+
+	.saas-btn-danger:hover:not(:disabled) {
+		background: var(--color-error-200);
+		border-color: var(--color-error-500);
+	}
+
+	.saas-checkbox {
+		display: inline-flex;
+		align-items: center;
+		justify-content: center;
+		width: 1.1rem;
+		height: 1.1rem;
+		flex-shrink: 0;
+		border-radius: 0;
+		border: 1px solid var(--color-surface-500);
+		background: var(--color-surface-50);
+		color: white;
+		cursor: pointer;
+		transition:
+			background 0.1s,
+			border-color 0.1s;
+	}
+
+	.saas-checkbox[data-state='checked'] {
+		background: var(--color-primary-700);
+		border-color: var(--color-primary-700);
+	}
+
+	.saas-checkbox:focus-visible {
+		outline: none;
+		box-shadow:
+			0 0 0 2px var(--color-surface-50),
+			0 0 0 4px var(--color-primary-600);
+	}
+
+	.saas-checkbox[data-disabled] {
+		cursor: not-allowed;
+		opacity: 0.5;
+	}
+
+	/* Square industrial switch (no pill) */
+	.saas-switch {
+		position: relative;
+		display: inline-flex;
+		width: 2.5rem;
+		height: 1.35rem;
+		flex-shrink: 0;
+		align-items: center;
+		border-radius: 0;
+		border: 1px solid var(--color-surface-500);
+		background: var(--color-surface-300);
+		padding: 0.125rem;
+		cursor: pointer;
+		transition:
+			background 0.1s,
+			border-color 0.1s;
+	}
+
+	.saas-switch[data-state='checked'] {
+		background: var(--color-primary-600);
+		border-color: var(--color-primary-700);
+	}
+
+	.saas-switch:focus-visible {
+		outline: none;
+		box-shadow:
+			0 0 0 2px var(--color-surface-50),
+			0 0 0 4px var(--color-primary-600);
+	}
+
+	.saas-switch[data-disabled] {
+		cursor: not-allowed;
+		opacity: 0.5;
+	}
+
+	.saas-switch-thumb {
+		display: block;
+		width: 1rem;
+		height: 1rem;
+		border-radius: 0;
+		background: white;
+		border: 1px solid var(--color-surface-400);
+		box-shadow: none;
+		transition: transform 0.1s;
+		transform: translateX(0);
+	}
+
+	.saas-switch[data-state='checked'] .saas-switch-thumb,
+	.saas-switch-thumb[data-state='checked'] {
+		transform: translateX(1.1rem);
+		border-color: var(--color-primary-800);
+	}
+
+	.saas-modal-backdrop {
+		position: fixed;
+		inset: 0;
+		z-index: 50;
+		background: rgb(2 6 23 / 0.55);
+		backdrop-filter: none;
+	}
+
+	.saas-modal {
+		position: fixed;
+		left: 50%;
+		top: 50%;
+		z-index: 51;
+		width: calc(100% - 2rem);
+		max-width: 28rem;
+		transform: translate(-50%, -50%);
+		border-radius: 0;
+		border: 1px solid var(--color-surface-400);
+		background: var(--color-surface-50);
+		padding: 1.5rem;
+		box-shadow: 6px 6px 0 rgb(15 23 42 / 0.15);
+		outline: none;
+	}
+
+	.saas-status-panel {
+		display: flex;
+		min-height: 100vh;
+		flex-direction: column;
+		align-items: center;
+		justify-content: center;
+		background: var(--color-surface-100);
+		padding: 1rem;
+	}
+
+	.saas-status-card {
+		width: 100%;
+		max-width: 28rem;
+		border-radius: 0;
+		border: 1px solid var(--color-surface-400);
+		background: var(--color-surface-50);
+		padding: 2rem;
+		text-align: center;
+		box-shadow: 4px 4px 0 rgb(15 23 42 / 0.1);
+		line-height: 1.7;
+	}
+}

hub/admin-web/static/favicon.svg

@@ -0,0 +1,5 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 32 32" fill="none">
+	<rect width="32" height="32" rx="8" fill="#4F46E5"/>
+	<path d="M8 10.5h7.5a3.5 3.5 0 0 1 0 7H11v4H8v-11Zm3 4.5h4.5a1.5 1.5 0 0 0 0-3H11v3Z" fill="white"/>
+	<path d="M20.5 21.5c1.93 0 3.5-1.34 3.5-3s-1.57-3-3.5-3S17 16.84 17 18.5s1.57 3 3.5 3Z" fill="white" opacity=".9"/>
+</svg>

hub/admin-web/static/robots.txt

@@ -0,0 +1,3 @@
+# allow crawling everything by default
+User-agent: *
+Disallow:

hub/admin-web/svelte.config.js

@@ -0,0 +1,18 @@
+import adapter from '@sveltejs/adapter-static';
+import { vitePreprocess } from '@sveltejs/vite-plugin-svelte';
+
+/** @type {import('@sveltejs/kit').Config} */
+const config = {
+	preprocess: vitePreprocess(),
+	kit: {
+		adapter: adapter({
+			pages: 'build',
+			assets: 'build',
+			fallback: 'index.html',
+			precompress: false,
+			strict: false,
+		}),
+	},
+};
+
+export default config;

hub/admin-web/tsconfig.json

@@ -0,0 +1,20 @@
+{
+	"extends": "./.svelte-kit/tsconfig.json",
+	"compilerOptions": {
+		"rewriteRelativeImportExtensions": true,
+		"allowJs": true,
+		"checkJs": true,
+		"esModuleInterop": true,
+		"forceConsistentCasingInFileNames": true,
+		"resolveJsonModule": true,
+		"skipLibCheck": true,
+		"sourceMap": true,
+		"strict": true,
+		"moduleResolution": "bundler"
+	}
+	// Path aliases are handled by https://svelte.dev/docs/kit/configuration#alias
+	// except $lib which is handled by https://svelte.dev/docs/kit/configuration#files
+	//
+	// To make changes to top-level options such as include and exclude, we recommend extending
+	// the generated config; see https://svelte.dev/docs/kit/configuration#typescript
+}

hub/admin-web/vite.config.ts

@@ -0,0 +1,17 @@
+import { sveltekit } from '@sveltejs/kit/vite';
+import tailwindcss from '@tailwindcss/vite';
+import { defineConfig } from 'vite';
+
+export default defineConfig({
+	plugins: [tailwindcss(), sveltekit()],
+	server: {
+		proxy: {
+			'/api': 'http://127.0.0.1:8788',
+			'/auth': 'http://127.0.0.1:8788',
+			// Backend owns /admin/login (registered before the SPA fallback in
+			// src/admin/static.ts). Proxy it in dev so the SPA doesn't re-render
+			// its layout on that path and 401-redirect into a returnTo loop.
+			'/admin/login': 'http://127.0.0.1:8788',
+		},
+	},
+});

hub/deploy/README.md

@@ -11,6 +11,32 @@ See [NEW_SILO_RUNBOOK.md](NEW_SILO_RUNBOOK.md). The remainder of this document
 describes the individual installer and maintenance primitives used by the
 generated bundle.
 
+## CI: roll Hub + admin SPA by fleet (`educraft` / `educraft-dev`)
+
+`.gitea/workflows/deploy-admin.yml` deploys Hub releases (including the org-admin
+SPA) to the managed Alpha host via `deploy_fleet_release.sh`. Fleets share the
+host and are selected by the middle DNS label of `HUB_PUBLIC_BASE_URL`:
+
+| Fleet | Domain | CI trigger |
+|-------|--------|------------|
+| **dev** | `https://<slug>.educraft-dev.paradigm-edu.net` | every push + PR (paths under `hub/`) |
+| **prod** | `https://<slug>.educraft.paradigm-edu.net` | push to `main` + tags |
+
+Example prod tenant:
+`https://para-26071100.educraft.paradigm-edu.net/auth/feishu/para-26071100`.
+
+Required Gitea secret: `DEPLOY_SSH_KEY` (private key for `root@39.107.254.4`).
+Optional: `DEPLOY_HOST` / `DEPLOY_USER` / `DEPLOY_SSH_PORT` / `DEPLOY_BASE`.
+Set repository var `ALLOW_EMPTY_FLEET=1` until the first silo exists for a fleet.
+
+Local dry-run against the host:
+
+```sh
+CPH_FLEET=dev \
+  PLATFORM_DEPLOY_SSH_KEY=$HOME/.ssh/id_ed25519 \
+  bash hub/deploy/deploy_fleet_release.sh
+```
+
 The supervised alpha runs one Organization per named Silo. The supported host
 has systemd, PostgreSQL, Node.js 24+, `pg_isready`, `runuser`, `setpriv`,
 bubblewrap, `socat`, `pg_dump`, `tar`, `sha256sum`, and a compatible `cph`.

hub/deploy/build_legacy_project_manifest.mjs

@@ -0,0 +1,59 @@
+#!/usr/bin/env node
+
+import { readdir, readFile, realpath } from "node:fs/promises";
+import { dirname, relative, resolve, sep } from "node:path";
+
+const rootArgument = process.argv[2];
+if (!rootArgument) throw new Error("usage: build_legacy_project_manifest.mjs <legacy-workspaces-root>");
+const root = await realpath(rootArgument);
+const projectFiles = await findProjectFiles(root);
+const seenIds = new Set();
+const manifest = [];
+for (const projectFile of projectFiles) {
+  const metadata = JSON.parse(await readFile(projectFile, "utf8"));
+  if (typeof metadata.id !== "string" || metadata.id.trim() === "") {
+    throw new Error(`project metadata has no id: ${projectFile}`);
+  }
+  if (seenIds.has(metadata.id)) throw new Error(`duplicate project id: ${metadata.id}`);
+  seenIds.add(metadata.id);
+  if (typeof metadata.name !== "string" || metadata.name.trim() === "") {
+    throw new Error(`project metadata has no name: ${projectFile}`);
+  }
+  const projectRoot = dirname(projectFile);
+  const sourceRelativePath = relative(root, projectRoot).split(sep).join("/");
+  const physicalFolderPath = dirname(sourceRelativePath) === "."
+    ? []
+    : dirname(sourceRelativePath).split("/");
+  if (metadata.folderPath !== undefined && (
+    !Array.isArray(metadata.folderPath)
+    || metadata.folderPath.some((part) => typeof part !== "string")
+    || JSON.stringify(metadata.folderPath) !== JSON.stringify(physicalFolderPath)
+  )) {
+    process.stderr.write(`[legacy-manifest] stale metadata folderPath; using physical path: ${projectFile}\n`);
+  }
+  manifest.push({
+    legacyId: metadata.id,
+    name: metadata.name,
+    folderPath: physicalFolderPath,
+    sourceRelativePath,
+  });
+}
+manifest.sort((left, right) => left.sourceRelativePath.localeCompare(right.sourceRelativePath, "zh-CN"));
+process.stdout.write(`${JSON.stringify(manifest, null, 2)}\n`);
+
+async function findProjectFiles(directory) {
+  const entries = await readdir(directory, { withFileTypes: true });
+  const projectMetadata = entries.find((entry) => entry.isFile() && entry.name === "project.json");
+  if (projectMetadata !== undefined) return [resolve(directory, projectMetadata.name)];
+  const found = [];
+  for (const entry of entries) {
+    if (entry.name === ".trash") continue;
+    const path = resolve(directory, entry.name);
+    if (entry.isSymbolicLink()) {
+      process.stderr.write(`[legacy-manifest] skip untracked symbolic link: ${path}\n`);
+      continue;
+    }
+    if (entry.isDirectory()) found.push(...await findProjectFiles(path));
+  }
+  return found;
+}

hub/deploy/deploy_fleet_release.sh

@@ -0,0 +1,222 @@
+#!/usr/bin/env bash
+# Publish one immutable Hub release (tsc + admin-web SPA) to the managed host,
+# then repoint every Silo in the chosen fleet to that release and restart it.
+#
+# Fleet is selected by the middle DNS label of each Silo's HUB_PUBLIC_BASE_URL:
+#
+#   prod → https://<slug>.educraft.paradigm-edu.net
+#   dev  → https://<slug>.educraft-dev.paradigm-edu.net
+#
+# Example tenant (prod):
+#   https://para-26071100.educraft.paradigm-edu.net/auth/feishu/para-26071100
+#
+# Configure (CI secrets / env):
+#   CPH_FLEET                 required: dev | prod
+#   PLATFORM_DEPLOY_HOST      default 39.107.254.4
+#   PLATFORM_DEPLOY_USER      default root
+#   PLATFORM_DEPLOY_SSH_KEY   required (path to private key)
+#   PLATFORM_DEPLOY_PORT      default 22
+#   PLATFORM_DEPLOY_BASE      default /srv/curriculum-project-hub
+#   PLATFORM_DEPLOY_RELEASE   default git HEAD (must be safe for paths)
+#   ALLOW_EMPTY_FLEET         optional: if 1, succeed when no silo matches
+#
+# This is a code-roll for existing silos. It does not create databases, domains,
+# or Feishu apps — use new_silo.sh / apply_new_silo.sh for that.
+set -euo pipefail
+
+FLEET="${CPH_FLEET:?CPH_FLEET required (dev|prod)}"
+case "$FLEET" in
+  dev) FLEET_DOMAIN_SUFFIX="educraft-dev.paradigm-edu.net" ;;
+  prod) FLEET_DOMAIN_SUFFIX="educraft.paradigm-edu.net" ;;
+  *)
+    echo "CPH_FLEET must be dev or prod, got: $FLEET" >&2
+    exit 1
+    ;;
+esac
+
+HOST="${PLATFORM_DEPLOY_HOST:-39.107.254.4}"
+DEPLOY_USER="${PLATFORM_DEPLOY_USER:-root}"
+PORT="${PLATFORM_DEPLOY_PORT:-22}"
+SSH_KEY="${PLATFORM_DEPLOY_SSH_KEY:?PLATFORM_DEPLOY_SSH_KEY required}"
+BASE="${PLATFORM_DEPLOY_BASE:-/srv/curriculum-project-hub}"
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+REPO_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
+RELEASE_ID="${PLATFORM_DEPLOY_RELEASE:-$(git -C "$REPO_ROOT" rev-parse --verify HEAD)}"
+[[ "$RELEASE_ID" =~ ^[A-Za-z0-9._-]+$ ]] || {
+  echo "invalid PLATFORM_DEPLOY_RELEASE: $RELEASE_ID" >&2
+  exit 1
+}
+ALLOW_EMPTY_FLEET="${ALLOW_EMPTY_FLEET:-0}"
+
+HUB_DIR="$BASE/releases/$RELEASE_ID/hub"
+RELEASE_DIR="$BASE/releases/$RELEASE_ID"
+SSH_OPTS=(-i "$SSH_KEY" -p "$PORT" -o BatchMode=yes -o StrictHostKeyChecking=accept-new)
+
+echo "[fleet] fleet=$FLEET domain=*.$FLEET_DOMAIN_SUFFIX host=$DEPLOY_USER@$HOST release=$RELEASE_ID"
+
+# --- 1. Publish immutable release (shared; flock so parallel fleet jobs do not race) ---
+release_ready=false
+if ssh "${SSH_OPTS[@]}" "$DEPLOY_USER@$HOST" "test -f '$RELEASE_DIR/.complete'"; then
+  release_ready=true
+  echo "[fleet] release already complete: $RELEASE_DIR"
+fi
+
+if [ "$release_ready" = false ]; then
+  # Drop a prior incomplete tree for this release id (failed CI leave leftovers).
+  ssh "${SSH_OPTS[@]}" "$DEPLOY_USER@$HOST" bash -s <<REMOTE
+set -euo pipefail
+flock /var/lock/cph-hub-release-publish bash -c '
+  set -euo pipefail
+  if [ -f "$RELEASE_DIR/.complete" ]; then
+    exit 0
+  fi
+  if [ -e "$RELEASE_DIR" ]; then
+    echo "[fleet] removing incomplete release: $RELEASE_DIR"
+    rm -rf "$RELEASE_DIR"
+  fi
+  mkdir -p "$HUB_DIR"
+'
+REMOTE
+
+  echo "[fleet] rsync hub → $HUB_DIR"
+  rsync -az --delete \
+    --exclude node_modules --exclude dist --exclude .env \
+    --exclude admin-web/node_modules --exclude admin-web/build --exclude admin-web/.svelte-kit \
+    -e "ssh ${SSH_OPTS[*]}" \
+    "$REPO_ROOT/hub/" "$DEPLOY_USER@$HOST:$HUB_DIR/"
+
+  echo "[fleet] npm ci + build (tsc + admin-web SPA)"
+  ssh "${SSH_OPTS[@]}" "$DEPLOY_USER@$HOST" bash -s <<REMOTE
+set -euo pipefail
+flock /var/lock/cph-hub-release-publish bash -c '
+  set -euo pipefail
+  if [ -f "$RELEASE_DIR/.complete" ]; then
+    echo "[fleet] release completed by another job"
+    exit 0
+  fi
+  cd "$HUB_DIR"
+  PUPPETEER_SKIP_DOWNLOAD=1 npm ci
+  npm ci --prefix admin-web
+  npm run audit:production
+  npm run build
+  test -f admin-web/build/index.html
+  touch "$RELEASE_DIR/.complete"
+'
+REMOTE
+fi
+
+# --- 2. Discover silos in this fleet and roll them onto the release ---
+ssh "${SSH_OPTS[@]}" "$DEPLOY_USER@$HOST" \
+  env BASE="$BASE" HUB_DIR="$HUB_DIR" FLEET="$FLEET" \
+  FLEET_DOMAIN_SUFFIX="$FLEET_DOMAIN_SUFFIX" ALLOW_EMPTY_FLEET="$ALLOW_EMPTY_FLEET" \
+  bash -s <<'REMOTE'
+set -euo pipefail
+
+fleet_match() {
+  local public_url="$1"
+  local host="${public_url#https://}"
+  host="${host#http://}"
+  host="${host%%/*}"
+  host="${host%%:*}"
+  case "$FLEET" in
+    prod)
+      [[ "$host" == *."$FLEET_DOMAIN_SUFFIX" || "$host" == "$FLEET_DOMAIN_SUFFIX" ]] || return 1
+      # Avoid matching educraft-dev when suffix is educraft.…
+      [[ "$host" != *.educraft-dev.paradigm-edu.net && "$host" != educraft-dev.paradigm-edu.net ]] || return 1
+      return 0
+      ;;
+    dev)
+      [[ "$host" == *."$FLEET_DOMAIN_SUFFIX" || "$host" == "$FLEET_DOMAIN_SUFFIX" ]]
+      return
+      ;;
+    *)
+      return 1
+      ;;
+  esac
+}
+
+env_value() {
+  local file="$1"
+  local key="$2"
+  # Do not source secrets — only read the KEY=value line.
+  local line
+  line="$(grep -E "^${key}=" "$file" | tail -n1 || true)"
+  printf '%s' "${line#"${key}="}"
+}
+
+matched=0
+shopt -s nullglob
+for env_file in "$BASE"/.secrets/*/platform.env; do
+  instance_id="$(basename "$(dirname "$env_file")")"
+  public_url="$(env_value "$env_file" HUB_PUBLIC_BASE_URL)"
+  if [ -z "$public_url" ]; then
+    echo "[fleet] skip $instance_id: HUB_PUBLIC_BASE_URL empty"
+    continue
+  fi
+  if ! fleet_match "$public_url"; then
+    echo "[fleet] skip $instance_id: $public_url (not $FLEET)"
+    continue
+  fi
+
+  port="$(env_value "$env_file" PORT)"
+  workspace="$(env_value "$env_file" HUB_PROJECT_WORKSPACE_ROOT)"
+  unit="cph-hub-${instance_id}.service"
+  if [ ! -f "/etc/systemd/system/$unit" ]; then
+    echo "[fleet] skip $instance_id: unit missing ($unit)" >&2
+    continue
+  fi
+
+  # Prefer unit file ceilings (MemoryMax=16G) over systemctl's byte form.
+  memory_max="$(sed -n 's/^MemoryMax=//p' "/etc/systemd/system/$unit" | tail -n1)"
+  cpu_quota="$(sed -n 's/^CPUQuota=//p' "/etc/systemd/system/$unit" | tail -n1)"
+  tasks_max="$(sed -n 's/^TasksMax=//p' "/etc/systemd/system/$unit" | tail -n1)"
+
+  if [ -z "$port" ] || [ -z "$workspace" ] || [ -z "$memory_max" ] || [ -z "$cpu_quota" ] || [ -z "$tasks_max" ]; then
+    echo "[fleet] error: $instance_id missing PORT/workspace/ceilings (port=$port workspace=$workspace memory=$memory_max cpu=$cpu_quota tasks=$tasks_max)" >&2
+    exit 1
+  fi
+
+  echo "[fleet] roll $instance_id → $HUB_DIR ($public_url port=$port)"
+  BASE="$BASE" \
+    HUB_DIR="$HUB_DIR" \
+    INSTANCE_ID="$instance_id" \
+    WORKSPACE_ROOT="$workspace" \
+    PORT="$port" \
+    MEMORY_MAX="$memory_max" \
+    CPU_QUOTA="$cpu_quota" \
+    TASKS_MAX="$tasks_max" \
+    bash "$HUB_DIR/deploy/install_service.sh"
+
+  systemctl restart "$unit"
+  systemctl is-active --quiet "$unit"
+
+  health="http://127.0.0.1:${port}/api/healthz"
+  ok=false
+  for _ in $(seq 1 45); do
+    if curl --fail --silent "$health" >/dev/null 2>&1; then
+      ok=true
+      break
+    fi
+    sleep 1
+  done
+  if [ "$ok" != true ]; then
+    curl --fail --silent --show-error "$health" >/dev/null
+  fi
+  echo "[fleet] healthy $instance_id ($health)"
+  matched=$((matched + 1))
+done
+
+if [ "$matched" -eq 0 ]; then
+  msg="[fleet] no silos matched *.$FLEET_DOMAIN_SUFFIX under $BASE/.secrets"
+  if [ "$ALLOW_EMPTY_FLEET" = "1" ]; then
+    echo "$msg (ALLOW_EMPTY_FLEET=1)"
+    exit 0
+  fi
+  echo "$msg" >&2
+  exit 1
+fi
+
+echo "[fleet] rolled $matched silo(s) on $FLEET"
+REMOTE
+
+echo "[fleet] done fleet=$FLEET release=$RELEASE_ID hub=$HUB_DIR"

hub/deploy/deploy_platform.sh

@@ -60,9 +60,10 @@ if [ "$release_ready" = false ]; then
     -e "ssh ${SSH_OPTS[*]}" \
     "$REPO_ROOT/hub/" "$DEPLOY_USER@$HOST:$HUB_DIR/"
 
-  # 2. Install deps, audit and build, then atomically mark the release complete.
+  # 2. Install deps (hub + admin-web), audit hub prod, build tsc + SPA, mark complete.
+  # `npm run build` → tsc then admin:build → admin-web/build for registerStaticSpa.
   ssh "${SSH_OPTS[@]}" "$DEPLOY_USER@$HOST" \
-    "cd '$HUB_DIR' && npm ci && npm run audit:production && npm run build && touch '$RELEASE_DIR/.complete'"
+    "cd '$HUB_DIR' && PUPPETEER_SKIP_DOWNLOAD=1 npm ci && npm ci --prefix admin-web && npm run audit:production && npm run build && touch '$RELEASE_DIR/.complete'"
 fi
 
 # 3. Ensure the service is installed (idempotent), then restart.

hub/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@paradigm/hub",
-  "version": "0.0.20",
+  "version": "0.0.31",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@paradigm/hub",
-      "version": "0.0.20",
+      "version": "0.0.31",
       "dependencies": {
         "@anthropic-ai/claude-agent-sdk": "^0.3.202",
         "@fastify/cookie": "^11.0.2",
@@ -131,9 +131,6 @@
       "cpu": [
         "arm64"
       ],
-      "libc": [
-        "glibc"
-      ],
       "license": "SEE LICENSE IN LICENSE.md",
       "optional": true,
       "os": [
@@ -147,9 +144,6 @@
       "cpu": [
         "arm64"
       ],
-      "libc": [
-        "musl"
-      ],
       "license": "SEE LICENSE IN LICENSE.md",
       "optional": true,
       "os": [
@@ -163,9 +157,6 @@
       "cpu": [
         "x64"
       ],
-      "libc": [
-        "glibc"
-      ],
       "license": "SEE LICENSE IN LICENSE.md",
       "optional": true,
       "os": [
@@ -179,9 +170,6 @@
       "cpu": [
         "x64"
       ],
-      "libc": [
-        "musl"
-      ],
       "license": "SEE LICENSE IN LICENSE.md",
       "optional": true,
       "os": [
@@ -247,24 +235,26 @@
       }
     },
     "node_modules/@emnapi/core": {
-      "version": "1.11.1",
-      "resolved": "https://registry.npmjs.org/@emnapi/core/-/core-1.11.1.tgz",
-      "integrity": "sha512-RSvbQmHzdKzNsLYa/wHrbc3KN4sYLKAdPZxqiM2HATqv/SBk2/ENSHpvXGaLOMcsAyz0poEGqkmmKYG3OWiJEQ==",
+      "version": "1.11.2",
+      "resolved": "https://registry.npmjs.org/@emnapi/core/-/core-1.11.2.tgz",
+      "integrity": "sha512-TC8MkTuZUtcTSiFeuC0ksCh9QIJ5+F21MvZ4Wn4ORfYaFJ/0dsiudv5tVkejgwZlwQ39jL9WWDe2lz8x0WglOA==",
       "dev": true,
       "license": "MIT",
       "optional": true,
+      "peer": true,
       "dependencies": {
         "@emnapi/wasi-threads": "1.2.2",
         "tslib": "^2.4.0"
       }
     },
     "node_modules/@emnapi/runtime": {
-      "version": "1.11.1",
-      "resolved": "https://registry.npmjs.org/@emnapi/runtime/-/runtime-1.11.1.tgz",
-      "integrity": "sha512-vgj7R3y3Wgx24IQaGPA/R6YFXLHVMOZ0uVEyIQPaWs+rd1AzfEMXlAC22FYwO1XkKR6NPsq7mUandH8oIRdZFw==",
+      "version": "1.11.2",
+      "resolved": "https://registry.npmjs.org/@emnapi/runtime/-/runtime-1.11.2.tgz",
+      "integrity": "sha512-kyOl3X0DuTiT1h2ft8r2fYO8JYtU9a9Xis/zBSiGArNaagCOWx90N1k2wxp18czFDH+OgcWGb5ZP/XMt3dcyPA==",
       "dev": true,
       "license": "MIT",
       "optional": true,
+      "peer": true,
       "dependencies": {
         "tslib": "^2.4.0"
       }
@@ -1199,9 +1189,6 @@
         "arm64"
       ],
       "dev": true,
-      "libc": [
-        "glibc"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1219,9 +1206,6 @@
         "arm64"
       ],
       "dev": true,
-      "libc": [
-        "musl"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1239,9 +1223,6 @@
         "ppc64"
       ],
       "dev": true,
-      "libc": [
-        "glibc"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1259,9 +1240,6 @@
         "s390x"
       ],
       "dev": true,
-      "libc": [
-        "glibc"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1279,9 +1257,6 @@
         "x64"
       ],
       "dev": true,
-      "libc": [
-        "glibc"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1299,9 +1274,6 @@
         "x64"
       ],
       "dev": true,
-      "libc": [
-        "musl"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1347,6 +1319,29 @@
         "node": "^20.19.0 || >=22.12.0"
       }
     },
+    "node_modules/@rolldown/binding-wasm32-wasi/node_modules/@emnapi/core": {
+      "version": "1.11.1",
+      "resolved": "https://registry.npmmirror.com/@emnapi/core/-/core-1.11.1.tgz",
+      "integrity": "sha512-RSvbQmHzdKzNsLYa/wHrbc3KN4sYLKAdPZxqiM2HATqv/SBk2/ENSHpvXGaLOMcsAyz0poEGqkmmKYG3OWiJEQ==",
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "@emnapi/wasi-threads": "1.2.2",
+        "tslib": "^2.4.0"
+      }
+    },
+    "node_modules/@rolldown/binding-wasm32-wasi/node_modules/@emnapi/runtime": {
+      "version": "1.11.1",
+      "resolved": "https://registry.npmmirror.com/@emnapi/runtime/-/runtime-1.11.1.tgz",
+      "integrity": "sha512-vgj7R3y3Wgx24IQaGPA/R6YFXLHVMOZ0uVEyIQPaWs+rd1AzfEMXlAC22FYwO1XkKR6NPsq7mUandH8oIRdZFw==",
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "tslib": "^2.4.0"
+      }
+    },
     "node_modules/@rolldown/binding-win32-arm64-msvc": {
       "version": "1.1.4",
       "resolved": "https://registry.npmjs.org/@rolldown/binding-win32-arm64-msvc/-/binding-win32-arm64-msvc-1.1.4.tgz",
@@ -3157,9 +3152,6 @@
         "arm64"
       ],
       "dev": true,
-      "libc": [
-        "glibc"
-      ],
       "license": "MPL-2.0",
       "optional": true,
       "os": [
@@ -3181,9 +3173,6 @@
         "arm64"
       ],
       "dev": true,
-      "libc": [
-        "musl"
-      ],
       "license": "MPL-2.0",
       "optional": true,
       "os": [
@@ -3205,9 +3194,6 @@
         "x64"
       ],
       "dev": true,
-      "libc": [
-        "glibc"
-      ],
       "license": "MPL-2.0",
       "optional": true,
       "os": [
@@ -3229,9 +3215,6 @@
         "x64"
       ],
       "dev": true,
-      "libc": [
-        "musl"
-      ],
       "license": "MPL-2.0",
       "optional": true,
       "os": [

hub/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@paradigm/hub",
-  "version": "0.0.20",
+  "version": "0.0.31",
   "private": true,
   "type": "module",
   "engines": {
@@ -30,19 +30,21 @@
   "description": "Curriculum Project Hub — org-scoped Feishu collaboration and confined Agent runtime. Aligns to spec/System through ADR-0024.",
   "scripts": {
     "dev": "npm run prisma:migrate && tsx watch src/server.ts",
-    "build": "tsc -p tsconfig.json",
+    "build": "tsc -p tsconfig.json && npm run admin:build",
     "start": "npm run prisma:migrate && node dist/server.js",
     "check": "tsc -p tsconfig.json --noEmit",
     "audit:production": "npm audit --omit=dev --audit-level=high",
     "prisma:generate": "prisma generate --schema prisma/schema.prisma",
-    "prisma:validate": "DATABASE_URL=${DATABASE_URL:-postgresql://stub:stub@127.0.0.1:5432/stub} prisma validate --schema prisma/schema.prisma",
-    "prisma:migrate": "DATABASE_URL=${DATABASE_URL:-postgresql://paradigm:paradigm@127.0.0.1:5432/paradigm} prisma migrate deploy --schema prisma/schema.prisma",
+    "prisma:validate": "prisma validate --schema prisma/schema.prisma",
+    "prisma:migrate": "prisma migrate deploy --schema prisma/schema.prisma",
     "secrets:rotate-kek": "node dist/deployment/rotate-secret-kek.js",
     "agent-config": "node dist/deployment/agent-config-cli.js",
     "silo:bootstrap": "node dist/deployment/bootstrap-silo-cli.js",
     "silo:restore-preflight": "node dist/deployment/restore-preflight.js",
     "deploy": "bash deploy/deploy_platform.sh",
     "test": "vitest run",
-    "test:watch": "vitest"
+    "test:watch": "vitest",
+    "admin:dev": "npm run dev --prefix admin-web",
+    "admin:build": "npm run build --prefix admin-web"
   }
 }

hub/prisma/migrations/20260712010000_project_discovery_search/migration.sql

@@ -0,0 +1,191 @@
+-- Derived project discovery projection. Project/Folder remain authoritative;
+-- triggers prevent index drift through ordinary database mutations.
+CREATE EXTENSION IF NOT EXISTS pg_trgm;
+
+CREATE TYPE "FolderKind" AS ENUM ('REGULAR', 'SYSTEM_INBOX');
+ALTER TABLE "Folder" ADD COLUMN "kind" "FolderKind" NOT NULL DEFAULT 'REGULAR';
+
+DO $$
+BEGIN
+  IF EXISTS (
+    SELECT 1 FROM "Folder"
+    WHERE "parentId" IS NULL AND "name" = 'Inbox' AND "archivedAt" IS NULL
+    GROUP BY "organizationId" HAVING count(*) > 1
+  ) THEN
+    RAISE EXCEPTION 'cannot identify system Inbox: organization has multiple active root Inbox folders';
+  END IF;
+END $$;
+
+UPDATE "Folder" f SET "kind" = 'SYSTEM_INBOX'
+WHERE f."parentId" IS NULL AND f."name" = 'Inbox' AND f."archivedAt" IS NULL;
+
+INSERT INTO "Folder" ("id", "organizationId", "parentId", "name", "kind", "sortKey", "createdAt", "updatedAt")
+SELECT o."id" || ':system-inbox', o."id", NULL, 'Inbox', 'SYSTEM_INBOX', '000000', CURRENT_TIMESTAMP, CURRENT_TIMESTAMP
+FROM "Organization" o
+WHERE NOT EXISTS (
+  SELECT 1 FROM "Folder" f
+  WHERE f."organizationId" = o."id" AND f."kind" = 'SYSTEM_INBOX' AND f."archivedAt" IS NULL
+);
+
+CREATE UNIQUE INDEX "Folder_one_active_system_inbox_per_org"
+  ON "Folder"("organizationId") WHERE "kind" = 'SYSTEM_INBOX' AND "archivedAt" IS NULL;
+
+CREATE OR REPLACE FUNCTION cph_protect_system_inbox() RETURNS trigger
+LANGUAGE plpgsql AS $$
+BEGIN
+  IF TG_OP = 'UPDATE' AND OLD."kind" = 'SYSTEM_INBOX' AND (
+    NEW."id" IS DISTINCT FROM OLD."id" OR
+    NEW."organizationId" IS DISTINCT FROM OLD."organizationId" OR
+    NEW."kind" IS DISTINCT FROM OLD."kind" OR
+    NEW."name" IS DISTINCT FROM OLD."name" OR
+    NEW."parentId" IS DISTINCT FROM OLD."parentId" OR
+    NEW."archivedAt" IS DISTINCT FROM OLD."archivedAt"
+  ) THEN
+    RAISE EXCEPTION 'system Inbox identity cannot be changed';
+  END IF;
+  IF TG_OP IN ('INSERT', 'UPDATE') AND NEW."kind" = 'SYSTEM_INBOX' AND (
+    NEW."name" <> 'Inbox' OR NEW."parentId" IS NOT NULL OR NEW."archivedAt" IS NOT NULL
+  ) THEN
+    RAISE EXCEPTION 'system Inbox must be an active root folder named Inbox';
+  END IF;
+  IF TG_OP = 'DELETE' AND OLD."kind" = 'SYSTEM_INBOX' AND EXISTS (
+    SELECT 1 FROM "Organization" WHERE "id" = OLD."organizationId"
+  ) THEN
+    RAISE EXCEPTION 'system Inbox cannot be deleted while its organization exists';
+  END IF;
+  RETURN CASE WHEN TG_OP = 'DELETE' THEN OLD ELSE NEW END;
+END;
+$$;
+
+CREATE TRIGGER cph_protect_system_inbox
+BEFORE INSERT OR UPDATE OR DELETE ON "Folder"
+FOR EACH ROW EXECUTE FUNCTION cph_protect_system_inbox();
+
+ALTER TABLE "Project" ADD COLUMN "code" TEXT;
+
+CREATE TABLE "ProjectSearchDocument" (
+    "projectId" TEXT NOT NULL,
+    "organizationId" TEXT NOT NULL,
+    "name" TEXT NOT NULL,
+    "code" TEXT,
+    "normalizedCode" TEXT NOT NULL,
+    "normalizedName" TEXT NOT NULL,
+    "breadcrumb" TEXT NOT NULL,
+    "normalizedBreadcrumb" TEXT NOT NULL,
+    "normalizedSearchText" TEXT NOT NULL,
+    "updatedAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    CONSTRAINT "ProjectSearchDocument_pkey" PRIMARY KEY ("projectId")
+);
+
+CREATE INDEX "ProjectSearchDocument_organizationId_idx" ON "ProjectSearchDocument"("organizationId");
+CREATE INDEX "ProjectSearchDocument_normalizedName_trgm_idx"
+  ON "ProjectSearchDocument" USING GIN ("normalizedName" gin_trgm_ops);
+CREATE INDEX "ProjectSearchDocument_normalizedCode_trgm_idx"
+  ON "ProjectSearchDocument" USING GIN ("normalizedCode" gin_trgm_ops);
+CREATE INDEX "ProjectSearchDocument_normalizedBreadcrumb_trgm_idx"
+  ON "ProjectSearchDocument" USING GIN ("normalizedBreadcrumb" gin_trgm_ops);
+CREATE INDEX "ProjectSearchDocument_normalizedSearchText_trgm_idx"
+  ON "ProjectSearchDocument" USING GIN ("normalizedSearchText" gin_trgm_ops);
+
+ALTER TABLE "ProjectSearchDocument" ADD CONSTRAINT "ProjectSearchDocument_projectId_fkey"
+  FOREIGN KEY ("projectId") REFERENCES "Project"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+ALTER TABLE "ProjectSearchDocument" ADD CONSTRAINT "ProjectSearchDocument_organizationId_fkey"
+  FOREIGN KEY ("organizationId") REFERENCES "Organization"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+CREATE OR REPLACE FUNCTION cph_project_search_normalize(value TEXT) RETURNS TEXT
+LANGUAGE sql IMMUTABLE STRICT PARALLEL SAFE AS $$
+  SELECT lower(regexp_replace(normalize(value, NFKC), '[[:space:]_.:/\\-]+', '', 'g'))
+$$;
+
+CREATE OR REPLACE FUNCTION cph_folder_breadcrumb(folder_id TEXT) RETURNS TEXT
+LANGUAGE sql STABLE PARALLEL SAFE AS $$
+  WITH RECURSIVE ancestors AS (
+    SELECT f."id", f."parentId", f."name", f."kind", 0 AS depth
+    FROM "Folder" f
+    WHERE f."id" = folder_id
+    UNION ALL
+    SELECT parent."id", parent."parentId", parent."name", parent."kind", child.depth + 1
+    FROM "Folder" parent
+    JOIN ancestors child ON parent."id" = child."parentId"
+  )
+  SELECT CASE
+    WHEN count(*) = 1 AND bool_and("kind" = 'SYSTEM_INBOX') THEN '未分类'
+    ELSE coalesce(string_agg("name", ' / ' ORDER BY depth DESC), '')
+  END
+  FROM ancestors
+$$;
+
+CREATE OR REPLACE FUNCTION cph_project_search_code(explicit_code TEXT, project_name TEXT) RETURNS TEXT
+LANGUAGE sql IMMUTABLE PARALLEL SAFE AS $$
+  SELECT CASE
+    WHEN explicit_code IS NOT NULL AND btrim(explicit_code) <> ''
+      THEN cph_project_search_normalize(explicit_code)
+    ELSE coalesce(substring(cph_project_search_normalize(project_name) FROM '^[a-z]+[0-9]+'), '')
+  END
+$$;
+
+CREATE OR REPLACE FUNCTION cph_refresh_project_search_document(target_project_id TEXT) RETURNS void
+LANGUAGE plpgsql AS $$
+BEGIN
+  INSERT INTO "ProjectSearchDocument" (
+    "projectId", "organizationId", "name", "code", "normalizedCode", "normalizedName",
+    "breadcrumb", "normalizedBreadcrumb", "normalizedSearchText", "updatedAt"
+  )
+  SELECT p."id", p."organizationId", p."name", p."code",
+    cph_project_search_code(p."code", p."name"),
+    cph_project_search_normalize(p."name"),
+    cph_folder_breadcrumb(p."folderId"),
+    cph_project_search_normalize(cph_folder_breadcrumb(p."folderId")),
+    cph_project_search_normalize(cph_folder_breadcrumb(p."folderId") || ' ' || p."name"),
+    CURRENT_TIMESTAMP
+  FROM "Project" p WHERE p."id" = target_project_id
+  ON CONFLICT ("projectId") DO UPDATE SET
+    "organizationId" = EXCLUDED."organizationId",
+    "name" = EXCLUDED."name",
+    "code" = EXCLUDED."code",
+    "normalizedCode" = EXCLUDED."normalizedCode",
+    "normalizedName" = EXCLUDED."normalizedName",
+    "breadcrumb" = EXCLUDED."breadcrumb",
+    "normalizedBreadcrumb" = EXCLUDED."normalizedBreadcrumb",
+    "normalizedSearchText" = EXCLUDED."normalizedSearchText",
+    "updatedAt" = CURRENT_TIMESTAMP;
+END;
+$$;
+
+CREATE OR REPLACE FUNCTION cph_project_search_project_trigger() RETURNS trigger
+LANGUAGE plpgsql AS $$
+BEGIN
+  PERFORM cph_refresh_project_search_document(NEW."id");
+  RETURN NEW;
+END;
+$$;
+
+CREATE TRIGGER cph_project_search_project_changed
+AFTER INSERT OR UPDATE OF "name", "code", "folderId", "organizationId", "archivedAt" ON "Project"
+FOR EACH ROW EXECUTE FUNCTION cph_project_search_project_trigger();
+
+CREATE OR REPLACE FUNCTION cph_project_search_folder_trigger() RETURNS trigger
+LANGUAGE plpgsql AS $$
+DECLARE project_id TEXT;
+BEGIN
+  FOR project_id IN
+    WITH RECURSIVE descendants AS (
+      SELECT NEW."id"
+      UNION ALL
+      SELECT child."id" FROM "Folder" child
+      JOIN descendants parent ON child."parentId" = parent."id"
+    )
+    SELECT p."id" FROM "Project" p
+    WHERE p."folderId" IN (SELECT "id" FROM descendants)
+  LOOP
+    PERFORM cph_refresh_project_search_document(project_id);
+  END LOOP;
+  RETURN NEW;
+END;
+$$;
+
+CREATE TRIGGER cph_project_search_folder_changed
+AFTER UPDATE OF "name", "kind", "parentId", "archivedAt" ON "Folder"
+FOR EACH ROW EXECUTE FUNCTION cph_project_search_folder_trigger();
+
+SELECT cph_refresh_project_search_document("id") FROM "Project";

hub/prisma/migrations/20260713170000_project_group_selected_role/migration.sql

@@ -0,0 +1,65 @@
+-- ADR-0017: roles are selected through the project-group control plane, not
+-- through slash-command names. Existing alpha Organizations keep draft as
+-- their configured default during migration; runtime code no longer hard-codes it.
+ALTER TABLE "OrganizationAgentRole"
+  ADD COLUMN "isDefault" BOOLEAN NOT NULL DEFAULT false;
+
+-- An Organization without any role was valid in the previous schema (the
+-- runtime failed closed later). Preserve the old alpha baseline so every
+-- existing binding can acquire a selected role during this migration.
+INSERT INTO "OrganizationAgentRole" (
+  "id", "organizationId", "roleId", "label", "sortOrder", "isDefault", "updatedAt"
+)
+SELECT organization."id" || ':agent-role:draft', organization."id", 'draft', '草稿', 10, true, CURRENT_TIMESTAMP
+FROM "Organization" organization
+WHERE NOT EXISTS (
+  SELECT 1 FROM "OrganizationAgentRole" role
+  WHERE role."organizationId" = organization."id" AND role."disabledAt" IS NULL
+);
+
+WITH ranked AS (
+  SELECT "id", row_number() OVER (
+    PARTITION BY "organizationId"
+    ORDER BY CASE WHEN "roleId" = 'draft' THEN 0 ELSE 1 END, "sortOrder", "roleId", "id"
+  ) AS position
+  FROM "OrganizationAgentRole"
+  WHERE "disabledAt" IS NULL
+)
+UPDATE "OrganizationAgentRole" role
+SET "isDefault" = (ranked.position = 1)
+FROM ranked
+WHERE role."id" = ranked."id";
+
+CREATE UNIQUE INDEX "OrganizationAgentRole_one_active_default_per_org"
+  ON "OrganizationAgentRole"("organizationId")
+  WHERE "isDefault" = true AND "disabledAt" IS NULL;
+
+ALTER TABLE "ProjectGroupBinding"
+  ADD COLUMN "selectedAgentRoleId" TEXT;
+
+UPDATE "ProjectGroupBinding" binding
+SET "selectedAgentRoleId" = role."id"
+FROM "Project" project
+JOIN "OrganizationAgentRole" role
+  ON role."organizationId" = project."organizationId"
+ AND role."isDefault" = true
+ AND role."disabledAt" IS NULL
+WHERE binding."projectId" = project."id";
+
+DO $$
+BEGIN
+  IF EXISTS (SELECT 1 FROM "ProjectGroupBinding" WHERE "selectedAgentRoleId" IS NULL) THEN
+    RAISE EXCEPTION 'cannot migrate project-group bindings without an active default Agent role';
+  END IF;
+END $$;
+
+ALTER TABLE "ProjectGroupBinding"
+  ALTER COLUMN "selectedAgentRoleId" SET NOT NULL;
+
+CREATE INDEX "ProjectGroupBinding_selectedAgentRoleId_idx"
+  ON "ProjectGroupBinding"("selectedAgentRoleId");
+
+ALTER TABLE "ProjectGroupBinding"
+  ADD CONSTRAINT "ProjectGroupBinding_selectedAgentRoleId_fkey"
+  FOREIGN KEY ("selectedAgentRoleId") REFERENCES "OrganizationAgentRole"("id")
+  ON DELETE RESTRICT ON UPDATE CASCADE;

hub/prisma/migrations/20260713173000_project_group_role_tenant_scope/migration.sql

@@ -0,0 +1,41 @@
+-- ADR-0017 / ADR-0020: enforce the selected role's Organization at the
+-- database boundary. A role primary key alone cannot prove tenant scope.
+ALTER TABLE "ProjectGroupBinding"
+  ADD COLUMN "organizationId" TEXT;
+
+UPDATE "ProjectGroupBinding" binding
+SET "organizationId" = project."organizationId"
+FROM "Project" project
+WHERE project."id" = binding."projectId";
+
+DO $$
+BEGIN
+  IF EXISTS (SELECT 1 FROM "ProjectGroupBinding" WHERE "organizationId" IS NULL) THEN
+    RAISE EXCEPTION 'cannot tenant-scope project-group binding without a project Organization';
+  END IF;
+END $$;
+
+ALTER TABLE "ProjectGroupBinding"
+  ALTER COLUMN "organizationId" SET NOT NULL;
+
+CREATE UNIQUE INDEX "Project_organizationId_id_key"
+  ON "Project"("organizationId", "id");
+
+ALTER TABLE "ProjectGroupBinding"
+  DROP CONSTRAINT "ProjectGroupBinding_projectId_fkey",
+  DROP CONSTRAINT "ProjectGroupBinding_selectedAgentRoleId_fkey";
+
+ALTER TABLE "ProjectGroupBinding"
+  ADD CONSTRAINT "ProjectGroupBinding_organizationId_fkey"
+    FOREIGN KEY ("organizationId") REFERENCES "Organization"("id")
+    ON DELETE CASCADE ON UPDATE CASCADE,
+  ADD CONSTRAINT "ProjectGroupBinding_organizationId_projectId_fkey"
+    FOREIGN KEY ("organizationId", "projectId") REFERENCES "Project"("organizationId", "id")
+    ON DELETE CASCADE ON UPDATE CASCADE,
+  ADD CONSTRAINT "ProjectGroupBinding_organizationId_selectedAgentRoleId_fkey"
+    FOREIGN KEY ("organizationId", "selectedAgentRoleId")
+    REFERENCES "OrganizationAgentRole"("organizationId", "id")
+    ON DELETE RESTRICT ON UPDATE CASCADE;
+
+CREATE INDEX "ProjectGroupBinding_organizationId_idx"
+  ON "ProjectGroupBinding"("organizationId");

hub/prisma/migrations/20260713174500_agent_role_default_invariant/migration.sql

@@ -0,0 +1,31 @@
+-- ADR-0017: once an Organization starts configuring roles, every committed
+-- state must contain exactly one active default. The deferred trigger permits
+-- an atomic default switch while rejecting zero-default transitions.
+CREATE FUNCTION cph_enforce_agent_role_default() RETURNS trigger
+LANGUAGE plpgsql AS $$
+DECLARE
+  target_organization_id TEXT := COALESCE(NEW."organizationId", OLD."organizationId");
+  active_default_count INTEGER;
+BEGIN
+  IF NOT EXISTS (SELECT 1 FROM "Organization" WHERE "id" = target_organization_id) THEN
+    RETURN NULL;
+  END IF;
+
+  SELECT count(*) INTO active_default_count
+  FROM "OrganizationAgentRole"
+  WHERE "organizationId" = target_organization_id
+    AND "isDefault" = true
+    AND "disabledAt" IS NULL;
+
+  IF active_default_count <> 1 THEN
+    RAISE EXCEPTION 'Organization % must have exactly one active default Agent role; found %',
+      target_organization_id, active_default_count;
+  END IF;
+  RETURN NULL;
+END;
+$$;
+
+CREATE CONSTRAINT TRIGGER "OrganizationAgentRole_exactly_one_active_default"
+AFTER INSERT OR UPDATE OR DELETE ON "OrganizationAgentRole"
+DEFERRABLE INITIALLY DEFERRED
+FOR EACH ROW EXECUTE FUNCTION cph_enforce_agent_role_default();

hub/prisma/migrations/20260713175000_agent_role_tenant_immutable/migration.sql

@@ -0,0 +1,30 @@
+-- Organization-owned role configuration cannot be re-parented. Besides being
+-- a tenant boundary, immutability ensures the deferred default-role invariant
+-- checks the same Organization before and after an update.
+CREATE OR REPLACE FUNCTION cph_enforce_agent_role_default() RETURNS trigger
+LANGUAGE plpgsql AS $$
+DECLARE
+  target_organization_id TEXT := COALESCE(NEW."organizationId", OLD."organizationId");
+  active_default_count INTEGER;
+BEGIN
+  IF TG_OP = 'UPDATE' AND NEW."organizationId" <> OLD."organizationId" THEN
+    RAISE EXCEPTION 'OrganizationAgentRole.organizationId is immutable';
+  END IF;
+
+  IF NOT EXISTS (SELECT 1 FROM "Organization" WHERE "id" = target_organization_id) THEN
+    RETURN NULL;
+  END IF;
+
+  SELECT count(*) INTO active_default_count
+  FROM "OrganizationAgentRole"
+  WHERE "organizationId" = target_organization_id
+    AND "isDefault" = true
+    AND "disabledAt" IS NULL;
+
+  IF active_default_count <> 1 THEN
+    RAISE EXCEPTION 'Organization % must have exactly one active default Agent role; found %',
+      target_organization_id, active_default_count;
+  END IF;
+  RETURN NULL;
+END;
+$$;

hub/prisma/migrations/20260713175500_organization_requires_default_role/migration.sql

@@ -0,0 +1,25 @@
+-- ADR-0017's default-role function is total over Organizations. Enforce the
+-- other side of the invariant when an Organization itself is created.
+CREATE FUNCTION cph_enforce_organization_default_role() RETURNS trigger
+LANGUAGE plpgsql AS $$
+DECLARE
+  active_default_count INTEGER;
+BEGIN
+  SELECT count(*) INTO active_default_count
+  FROM "OrganizationAgentRole"
+  WHERE "organizationId" = NEW."id"
+    AND "isDefault" = true
+    AND "disabledAt" IS NULL;
+
+  IF active_default_count <> 1 THEN
+    RAISE EXCEPTION 'Organization % must have exactly one active default Agent role; found %',
+      NEW."id", active_default_count;
+  END IF;
+  RETURN NULL;
+END;
+$$;
+
+CREATE CONSTRAINT TRIGGER "Organization_requires_active_default_role"
+AFTER INSERT ON "Organization"
+DEFERRABLE INITIALLY DEFERRED
+FOR EACH ROW EXECUTE FUNCTION cph_enforce_organization_default_role();

hub/prisma/migrations/20260714120000_drop_legacy_platform_role_assignment/migration.sql

@@ -0,0 +1,20 @@
+-- ADR-0023 rejected the legacy `PlatformRoleAssignment` / `PlatformRole`{ADMIN,TEACHER}
+-- model: the platform administration control plane is a separate identity/session/
+-- audit surface (see `Spec.System.PlatformAdministration`), intentionally not built
+-- in alpha (ADR-0025, `hub/deploy/README.md`). The legacy table has no runtime
+-- reader — no guard, route, or service queries it for an authorization decision —
+-- and ADR-0023 requires it to be migrated/replaced before the platform panel ships.
+-- Drop the table, the `User.platformRoles` relation, and the enum.
+
+-- DropForeignKey
+ALTER TABLE "PlatformRoleAssignment" DROP CONSTRAINT "PlatformRoleAssignment_userId_fkey";
+
+-- DropIndex
+DROP INDEX IF EXISTS "PlatformRoleAssignment_userId_revokedAt_idx";
+DROP INDEX IF EXISTS "PlatformRoleAssignment_role_revokedAt_idx";
+
+-- DropTable
+DROP TABLE IF EXISTS "PlatformRoleAssignment";
+
+-- DropEnum
+DROP TYPE IF EXISTS "PlatformRole";

hub/prisma/migrations/20260714130000_organization_capacity_policy/migration.sql

@@ -0,0 +1,18 @@
+-- ADR-0022 layered capacity policy. Org admins may set per-dimension lower
+-- `organizationLimit` overrides; platform ceilings come from deployment config
+-- (see `src/capacity/ceilings.ts`). `limits` is a JSON map of
+-- CapacityDimension → number (only the set dimensions); service enforces
+-- `LayeredLimit.Valid` (org limit ≤ platform ceiling).
+
+-- CreateTable
+CREATE TABLE "OrganizationCapacityPolicy" (
+    "organizationId" TEXT NOT NULL,
+    "limits" JSONB NOT NULL,
+    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updatedAt" TIMESTAMP(3) NOT NULL,
+
+    CONSTRAINT "OrganizationCapacityPolicy_pkey" PRIMARY KEY ("organizationId")
+);
+
+-- AddForeignKey
+ALTER TABLE "OrganizationCapacityPolicy" ADD CONSTRAINT "OrganizationCapacityPolicy_organizationId_fkey" FOREIGN KEY ("organizationId") REFERENCES "Organization"("id") ON DELETE CASCADE ON UPDATE CASCADE;

hub/prisma/migrations/20260718120000_usage_fact_ledger/migration.sql

@@ -0,0 +1,64 @@
+-- ADR-0026: append-only UsageFact ledger. AgentRun.costUsd/inputTokens/
+-- outputTokens become a derived rollup cache; the truth is in UsageFact.
+
+CREATE TABLE "UsageFact" (
+    "id"            TEXT                   NOT NULL,
+    "runId"         TEXT                   NOT NULL,
+    "occurredAt"    TIMESTAMP(3)           NOT NULL,
+    "kind"          TEXT                   NOT NULL,
+    "provider"      TEXT                   NOT NULL,
+    "model"         TEXT,
+    "inputTokens"   INTEGER,
+    "outputTokens"  INTEGER,
+    "quantity"      DECIMAL(18, 6),
+    "unit"          TEXT,
+    "costUsd"       DECIMAL(18, 8),
+    "costSource"    TEXT                   NOT NULL,
+    "capabilityId"  TEXT,
+    "correlationId" TEXT,
+    "metadata"      JSONB                  NOT NULL,
+    "createdAt"     TIMESTAMP(3)           NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    CONSTRAINT "UsageFact_pkey" PRIMARY KEY ("id")
+);
+
+CREATE INDEX "UsageFact_runId_occurredAt_idx" ON "UsageFact"("runId", "occurredAt");
+CREATE INDEX "UsageFact_runId_kind_idx"       ON "UsageFact"("runId", "kind");
+CREATE INDEX "UsageFact_provider_model_occurredAt_idx"
+  ON "UsageFact"("provider", "model", "occurredAt");
+CREATE INDEX "UsageFact_capabilityId_occurredAt_idx"
+  ON "UsageFact"("capabilityId", "occurredAt");
+
+ALTER TABLE "UsageFact"
+  ADD CONSTRAINT "UsageFact_runId_fkey"
+  FOREIGN KEY ("runId") REFERENCES "AgentRun"("id")
+  ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- Backfill: one synthetic model_completion fact per AgentRun that has any
+-- recorded usage (cost or tokens). correlationId = run id marks these as
+-- backfill artefacts (real facts use an external correlation id or null).
+-- Runs with no recorded usage stay fact-less and remain runsWithoutCost,
+-- matching ADR-0022's "missing cost ≠ zero" rule and the pre-existing
+-- migration 20260709143000_agent_run_cost_tracking's "no backfill for the
+-- truly unrecorded" stance.
+INSERT INTO "UsageFact" (
+  "id", "runId", "occurredAt", "kind", "provider", "model",
+  "inputTokens", "outputTokens", "costUsd", "costSource",
+  "correlationId", "metadata"
+)
+SELECT
+  'usagefact_backfill_' || "AgentRun"."id",
+  "AgentRun"."id",
+  COALESCE("AgentRun"."finishedAt", "AgentRun"."startedAt", CURRENT_TIMESTAMP),
+  'model_completion',
+  "AgentRun"."provider",
+  "AgentRun"."model",
+  "AgentRun"."inputTokens",
+  "AgentRun"."outputTokens",
+  "AgentRun"."costUsd",
+  COALESCE("AgentRun"."costSource", 'unknown'),
+  "AgentRun"."id",
+  '{}'::jsonb
+FROM "AgentRun"
+WHERE "AgentRun"."costUsd" IS NOT NULL
+   OR "AgentRun"."inputTokens" IS NOT NULL
+   OR "AgentRun"."outputTokens" IS NOT NULL;

hub/prisma/schema.prisma

@@ -37,6 +37,7 @@ model Organization {
 
   memberships                  OrganizationMembership[]
   projectSettings              OrganizationProjectSettings?
+  capacityPolicy               OrganizationCapacityPolicy?
   folders                      Folder[]
   projects                     Project[]
   teams                        Team[]
@@ -45,7 +46,9 @@ model Organization {
   feishuApplicationConnection  OrganizationFeishuApplicationConnection?
   agentSkills                  OrganizationAgentSkill[]
   agentRoles                   OrganizationAgentRole[]
-  auditEntries                 AuditEntry[]                    @relation("organizationAudit")
+  projectGroupBindings         ProjectGroupBinding[]
+  auditEntries                 AuditEntry[]                             @relation("organizationAudit")
+  projectSearchDocuments       ProjectSearchDocument[]
 
   @@index([status])
 }
@@ -56,8 +59,9 @@ enum OrganizationStatus {
   ARCHIVED
 }
 
-/// Org-scoped platform role. Distinct from project PermissionRole and from
-/// global PlatformRoleAssignment, which is reserved for SaaS/platform control.
+/// Org-scoped membership role. Distinct from project PermissionRole and from
+/// the platform administrator surface (ADR-0023 / Spec.System.PlatformAdministration),
+/// which is a separate control plane not modeled in alpha (ADR-0025).
 model OrganizationMembership {
   id             String                 @id @default(cuid())
   organizationId String
@@ -115,12 +119,14 @@ model OrganizationAgentRole {
   systemPrompt   String?
   tools          Json?
   sortOrder      Int       @default(0)
+  isDefault      Boolean   @default(false)
   createdAt      DateTime  @default(now())
   updatedAt      DateTime  @updatedAt
   disabledAt     DateTime?
 
-  organization Organization                 @relation(fields: [organizationId], references: [id], onDelete: Cascade)
-  skillBindings OrganizationAgentRoleSkill[]
+  organization       Organization                 @relation(fields: [organizationId], references: [id], onDelete: Cascade)
+  skillBindings      OrganizationAgentRoleSkill[]
+  selectedByBindings ProjectGroupBinding[]        @relation("selectedAgentRole")
 
   @@unique([organizationId, roleId])
   @@unique([organizationId, id])
@@ -131,10 +137,10 @@ model OrganizationAgentRole {
 /// gives stable skill listing and prompt discovery order for a role bundle.
 model OrganizationAgentRoleSkill {
   organizationId String
-  agentRoleId     String
-  agentSkillId    String
-  sortOrder       Int      @default(0)
-  createdAt       DateTime @default(now())
+  agentRoleId    String
+  agentSkillId   String
+  sortOrder      Int      @default(0)
+  createdAt      DateTime @default(now())
 
   role  OrganizationAgentRole  @relation(fields: [organizationId, agentRoleId], references: [organizationId, id], onDelete: Cascade)
   skill OrganizationAgentSkill @relation(fields: [organizationId, agentSkillId], references: [organizationId, id], onDelete: Cascade)
@@ -155,6 +161,20 @@ model OrganizationProjectSettings {
   organization Organization @relation(fields: [organizationId], references: [id], onDelete: Cascade)
 }
 
+/// ADR-0022 layered capacity policy. Org admins may set per-dimension lower
+/// limits; `limits` is a JSON map of CapacityDimension → number (only the set
+/// ones). Each set value must be ≤ the platform ceiling for that dimension
+/// (validated in service; spec `LayeredLimit.Valid`). Dimensions with no entry
+/// fall back to the platform ceiling (`LayeredLimit.effective`).
+model OrganizationCapacityPolicy {
+  organizationId String   @id
+  limits         Json
+  createdAt      DateTime @default(now())
+  updatedAt      DateTime @updatedAt
+
+  organization Organization @relation(fields: [organizationId], references: [id], onDelete: Cascade)
+}
+
 /// A person known to the Hub. `feishuOpenId` remains a legacy compatibility
 /// key; new customer-app identities live in FeishuUserIdentity and store a
 /// connection-scoped opaque USER principal here instead of a raw open_id.
@@ -166,18 +186,17 @@ model User {
   createdAt    DateTime @default(now())
   updatedAt    DateTime @updatedAt
 
-  platformRoles                PlatformRoleAssignment[]
   organizationMemberships      OrganizationMembership[]
-  createdProjects              Project[]                     @relation("projectCreator")
-  requestedRuns                AgentRun[]                    @relation("runRequester")
-  heldLocks                    ProjectAgentLock[]            @relation("lockHolder")
-  feishuBindings               ProjectGroupBinding[]         @relation("bindingCreator")
+  createdProjects              Project[]                            @relation("projectCreator")
+  requestedRuns                AgentRun[]                           @relation("runRequester")
+  heldLocks                    ProjectAgentLock[]                   @relation("lockHolder")
+  feishuBindings               ProjectGroupBinding[]                @relation("bindingCreator")
   teamMemberships              TeamMembership[]
   externalPrincipalMemberships ExternalPrincipalMembership[]
-  permissionGrants             PermissionGrant[]             @relation("grantCreator")
-  roleTriggerGrants            RoleTriggerGrant[]            @relation("roleGrantCreator")
-  auditEntries                 AuditEntry[]                  @relation("auditActor")
-  providerCredentialVersions   ProviderCredentialVersion[]   @relation("providerCredentialVersionCreator")
+  permissionGrants             PermissionGrant[]                    @relation("grantCreator")
+  roleTriggerGrants            RoleTriggerGrant[]                   @relation("roleGrantCreator")
+  auditEntries                 AuditEntry[]                         @relation("auditActor")
+  providerCredentialVersions   ProviderCredentialVersion[]          @relation("providerCredentialVersionCreator")
   feishuCredentialVersions     FeishuApplicationCredentialVersion[] @relation("feishuCredentialVersionCreator")
   feishuIdentities             FeishuUserIdentity[]
 }
@@ -196,7 +215,7 @@ model OrganizationFeishuApplicationConnection {
   createdAt              DateTime                     @default(now())
   updatedAt              DateTime                     @updatedAt
 
-  organization        Organization                       @relation(fields: [organizationId], references: [id], onDelete: Cascade)
+  organization        Organization                         @relation(fields: [organizationId], references: [id], onDelete: Cascade)
   secretVersions      FeishuApplicationCredentialVersion[] @relation("feishuCredentialVersions")
   activeSecretVersion FeishuApplicationCredentialVersion?  @relation("activeFeishuCredentialVersion", fields: [activeSecretVersionId], references: [id], onDelete: Restrict)
   userIdentities      FeishuUserIdentity[]
@@ -228,19 +247,19 @@ model FeishuUserIdentity {
 /// ADR-0024: all Feishu app material, including provider-local app/bot ids, is
 /// inside one immutable authenticated envelope version.
 model FeishuApplicationCredentialVersion {
-  id              String   @id @default(cuid())
+  id              String    @id @default(cuid())
   connectionId    String
   version         Int
-  envelopeVersion Int      @default(1)
+  envelopeVersion Int       @default(1)
   keyId           String
   envelope        Json
   createdByUserId String?
-  createdAt       DateTime @default(now())
+  createdAt       DateTime  @default(now())
   retiredAt       DateTime?
 
   connection OrganizationFeishuApplicationConnection  @relation("feishuCredentialVersions", fields: [connectionId], references: [id], onDelete: Cascade)
   activeFor  OrganizationFeishuApplicationConnection? @relation("activeFeishuCredentialVersion")
-  createdBy  User?                                   @relation("feishuCredentialVersionCreator", fields: [createdByUserId], references: [id], onDelete: SetNull)
+  createdBy  User?                                    @relation("feishuCredentialVersionCreator", fields: [createdByUserId], references: [id], onDelete: SetNull)
 
   @@unique([connectionId, version])
   @@index([connectionId, retiredAt])
@@ -287,14 +306,14 @@ enum OrganizationConnectionStatus {
 /// per immutable version. keyId/envelopeVersion are redacted rotation metadata;
 /// all provider URL/token/API-key fields remain inside envelope ciphertext.
 model ProviderCredentialVersion {
-  id              String   @id @default(cuid())
+  id              String    @id @default(cuid())
   connectionId    String
   version         Int
-  envelopeVersion Int      @default(1)
+  envelopeVersion Int       @default(1)
   keyId           String
   envelope        Json
   createdByUserId String?
-  createdAt       DateTime @default(now())
+  createdAt       DateTime  @default(now())
   retiredAt       DateTime?
 
   connection OrganizationProviderConnection  @relation("providerCredentialVersions", fields: [connectionId], references: [id], onDelete: Cascade)
@@ -307,26 +326,6 @@ model ProviderCredentialVersion {
   @@index([createdByUserId])
 }
 
-/// Platform-level role (admin/teacher). Distinct from ADR-0004 PermissionRole.
-/// `admin` is the only override path for force-release (spec RequiresAdmin).
-model PlatformRoleAssignment {
-  id        String       @id @default(cuid())
-  userId    String
-  role      PlatformRole
-  createdAt DateTime     @default(now())
-  revokedAt DateTime?
-
-  user User @relation(fields: [userId], references: [id], onDelete: Cascade)
-
-  @@index([userId, revokedAt])
-  @@index([role, revokedAt])
-}
-
-enum PlatformRole {
-  ADMIN
-  TEACHER
-}
-
 /// ADR-0019: typed principals for permission grants and actor resolution.
 /// USER and Feishu external principals use connection-scoped opaque ids, never
 /// raw provider-local ids; TEAM uses Hub Team.id.
@@ -437,14 +436,20 @@ model ExternalPrincipalMembership {
 /// ADR-0021: transparent project explorer folder. Folders are org-scoped
 /// navigation/aggregation nodes, not permission resources; project grants stay
 /// attached to PROJECT resources.
+enum FolderKind {
+  REGULAR
+  SYSTEM_INBOX
+}
+
 model Folder {
-  id             String    @id @default(cuid())
+  id             String     @id @default(cuid())
   organizationId String
   parentId       String?
   name           String
-  sortKey        String    @default("")
-  createdAt      DateTime  @default(now())
-  updatedAt      DateTime  @updatedAt
+  kind           FolderKind @default(REGULAR)
+  sortKey        String     @default("")
+  createdAt      DateTime   @default(now())
+  updatedAt      DateTime   @updatedAt
   archivedAt     DateTime?
 
   organization Organization @relation(fields: [organizationId], references: [id], onDelete: Cascade)
@@ -460,6 +465,7 @@ model Project {
   id              String    @id @default(cuid())
   organizationId  String
   folderId        String?
+  code            String?
   name            String
   workspaceDir    String
   createdByUserId String?
@@ -467,39 +473,68 @@ model Project {
   updatedAt       DateTime  @updatedAt
   archivedAt      DateTime?
 
-  organization      Organization          @relation(fields: [organizationId], references: [id], onDelete: Cascade)
-  folder            Folder?               @relation(fields: [folderId], references: [id], onDelete: SetNull)
-  createdBy         User?                 @relation("projectCreator", fields: [createdByUserId], references: [id], onDelete: SetNull)
+  organization      Organization           @relation(fields: [organizationId], references: [id], onDelete: Cascade)
+  folder            Folder?                @relation(fields: [folderId], references: [id], onDelete: SetNull)
+  createdBy         User?                  @relation("projectCreator", fields: [createdByUserId], references: [id], onDelete: SetNull)
   groupBindings     ProjectGroupBinding[]
   agentSessions     AgentSession[]
   agentRuns         AgentRun[]
   agentLock         ProjectAgentLock?
-  roleTriggerGrants RoleTriggerGrant[]    @relation("projectRoleGrants")
-  auditEntries      AuditEntry[]          @relation("projectAudit")
-  fileChanges       AgentFileChange[]     @relation("projectFileChanges")
+  roleTriggerGrants RoleTriggerGrant[]     @relation("projectRoleGrants")
+  auditEntries      AuditEntry[]           @relation("projectAudit")
+  fileChanges       AgentFileChange[]      @relation("projectFileChanges")
+  searchDocument    ProjectSearchDocument?
 
+  @@unique([organizationId, id])
   @@index([organizationId, archivedAt])
   @@index([folderId, archivedAt])
   @@index([archivedAt])
 }
 
+/// Derived, rebuildable search projection for project discovery. PostgreSQL
+/// triggers keep it synchronized with Project and Folder mutations; Project
+/// remains the source of truth and authorization remains outside this table.
+model ProjectSearchDocument {
+  projectId            String   @id
+  organizationId       String
+  name                 String
+  code                 String?
+  normalizedCode       String
+  normalizedName       String
+  breadcrumb           String
+  normalizedBreadcrumb String
+  normalizedSearchText String
+  updatedAt            DateTime @updatedAt
+
+  project      Project      @relation(fields: [projectId], references: [id], onDelete: Cascade)
+  organization Organization @relation(fields: [organizationId], references: [id], onDelete: Cascade)
+
+  @@index([organizationId])
+}
+
 /// ADR-0001 + ADR-0021: active bindings are one project ↔ one Feishu chat
 /// (1:1). Historical archived bindings are retained for audit; partial unique
 /// indexes in migrations enforce one active binding per project and per chat.
 model ProjectGroupBinding {
-  id              String    @id @default(cuid())
-  projectId       String
-  chatId          String
-  createdByUserId String?
-  createdAt       DateTime  @default(now())
-  updatedAt       DateTime  @updatedAt
-  archivedAt      DateTime?
+  id                  String    @id @default(cuid())
+  organizationId      String
+  projectId           String
+  chatId              String
+  createdByUserId     String?
+  createdAt           DateTime  @default(now())
+  updatedAt           DateTime  @updatedAt
+  archivedAt          DateTime?
+  selectedAgentRoleId String
 
-  project   Project @relation(fields: [projectId], references: [id], onDelete: Cascade)
-  createdBy User?   @relation("bindingCreator", fields: [createdByUserId], references: [id], onDelete: SetNull)
+  organization Organization          @relation(fields: [organizationId], references: [id], onDelete: Cascade)
+  project      Project               @relation(fields: [organizationId, projectId], references: [organizationId, id], onDelete: Cascade)
+  createdBy    User?                 @relation("bindingCreator", fields: [createdByUserId], references: [id], onDelete: SetNull)
+  selectedRole OrganizationAgentRole @relation("selectedAgentRole", fields: [organizationId, selectedAgentRoleId], references: [organizationId, id], onDelete: Restrict)
 
+  @@index([organizationId])
   @@index([projectId, archivedAt])
   @@index([chatId, archivedAt])
+  @@index([selectedAgentRoleId])
 }
 
 // --- AgentRun, session, lock (ADR-0002, 0017) -----------------------------
@@ -561,9 +596,13 @@ model AgentRun {
   summary           String?
   inputTokens       Int?
   outputTokens      Int?
-  /// Provider/gateway-reported cost in USD. Null means this run has no trusted cost fact.
+  /// ADR-0026: derived rollup cache of UsageFact rows for this run. The truth
+  /// is in UsageFact; this column is convenience for existing readers. Null
+  /// means this run has no trusted cost fact (ADR-0022: missing cost ≠ zero).
   costUsd           Decimal?        @db.Decimal(18, 8)
-  /// Semantic source of costUsd, e.g. provider_reported. Not a pricing-estimate fallback.
+  /// ADR-0026: semantic source of the rolled-up costUsd (provider_reported |
+  /// pricebook_derived | unknown). Mirrors the dominant CostSource of the
+  /// run's facts; not a pricing-estimate fallback.
   costSource        String?
   metadata          Json
   error             String?
@@ -577,6 +616,7 @@ model AgentRun {
   projectLock ProjectAgentLock?
   messages    AgentMessage[]    @relation("runMessages")
   fileChanges AgentFileChange[] @relation("runFileChanges")
+  usageFacts  UsageFact[]       @relation("runUsageFacts")
 
   @@index([projectId, status])
   @@index([projectId, finishedAt])
@@ -607,8 +647,9 @@ model ProjectAgentLock {
 // --- Permission grants & settings (ADR-0004) ----------------------------
 
 /// ADR-0004 PermissionRole: read ⊂ edit ⊂ manage (capability lattice).
-/// Distinct from PlatformRole. Force-release is admin-only, outside this
-/// lattice (spec RequiresAdmin).
+/// Force-release is platform-admin-only, outside this lattice (spec
+/// RequiresAdmin); platform admin is a separate control plane (ADR-0023),
+/// not modeled in alpha (ADR-0025).
 enum PermissionRole {
   READ
   EDIT
@@ -697,17 +738,17 @@ model RoleTriggerGrant {
 /// spec AuditEntry: minimal skeleton — one entry relates to a run. Event type,
 /// actor, timestamp, details are OPEN. This table mirrors that: `runId` is the
 model AuditEntry {
-  id          String   @id @default(cuid())
-  runId       String?
-  projectId   String?
+  id             String   @id @default(cuid())
+  runId          String?
+  projectId      String?
   organizationId String?
-  actorUserId String?
-  action      String
-  metadata    Json
-  createdAt   DateTime @default(now())
+  actorUserId    String?
+  action         String
+  metadata       Json
+  createdAt      DateTime @default(now())
 
-  actor   User?    @relation("auditActor", fields: [actorUserId], references: [id], onDelete: SetNull)
-  project Project? @relation("projectAudit", fields: [projectId], references: [id], onDelete: SetNull)
+  actor        User?         @relation("auditActor", fields: [actorUserId], references: [id], onDelete: SetNull)
+  project      Project?      @relation("projectAudit", fields: [projectId], references: [id], onDelete: SetNull)
   organization Organization? @relation("organizationAudit", fields: [organizationId], references: [id], onDelete: SetNull)
 
   @@index([runId])
@@ -781,3 +822,50 @@ model AgentFileChange {
   @@index([projectId])
   @@index([path])
 }
+
+// --- Usage fact ledger (ADR-0026) ----------------------------------------
+
+/// ADR-0026: one billable consumption event inside an AgentRun. Append-only;
+/// the run's AgentRun.costUsd/inputTokens/outputTokens are a derived rollup
+/// of these rows, not the truth. kind=external_capability carries capabilityId
+/// for media transforms (PDF→MD, audio/video→text, …). costUsd=null means
+/// unknown, not zero (ADR-0022). The kind set is OPEN: new kinds must be
+/// surfaced, not silently folded in.
+model UsageFact {
+  id            String   @id @default(cuid())
+  runId         String
+  /// When the consumption happened. Pricebook derivation uses this, not
+  /// AgentRun.finishedAt, because an external capability may finish before
+  /// the run ends.
+  occurredAt    DateTime
+  /// model_completion | external_capability | tool_proxy. OPEN set.
+  kind          String
+  /// e.g. openrouter, mineru, openai_whisper.
+  provider      String
+  model         String?
+  inputTokens   Int?
+  outputTokens  Int?
+  /// Non-token meter (pages, audio_seconds, invocations). Coexists with tokens.
+  quantity      Decimal? @db.Decimal(18, 6)
+  unit          String?
+  /// USD. Null = unknown, NOT zero (ADR-0022). When null, costSource=unknown.
+  costUsd       Decimal? @db.Decimal(18, 8)
+  /// provider_reported | pricebook_derived | unknown. Required even when
+  /// costUsd is null, so a reader can distinguish "reported zero" from
+  /// "no report at all".
+  costSource    String
+  /// For kind=external_capability, the registered capability id
+  /// (e.g. pdf_to_md_bundle, audio_video_to_text). Null for model_completion.
+  capabilityId  String?
+  /// External request id for reconciliation / idempotency. Not an aggregation key.
+  correlationId String?
+  metadata      Json
+  createdAt     DateTime @default(now())
+
+  run AgentRun @relation("runUsageFacts", fields: [runId], references: [id], onDelete: Cascade)
+
+  @@index([runId, occurredAt])
+  @@index([runId, kind])
+  @@index([provider, model, occurredAt])
+  @@index([capabilityId, occurredAt])
+}

hub/scripts/dev-bootstrap-silo.ts

@@ -0,0 +1,76 @@
+/**
+ * Local dev bootstrap for an Alpha Silo on Windows / non-systemd hosts.
+ *
+ * The production bootstrap-silo CLI is Linux-only (requires root uid 0,
+ * systemctl, root-owned files). This script calls the same
+ * `bootstrapAlphaSilo` invariants directly, sourcing credentials from the
+ * local `.env` and the dev keyring. Idempotent: re-running is a no-op once
+ * the Silo Organization exists.
+ *
+ * Usage: npx tsx scripts/dev-bootstrap-silo.ts
+ */
+import "dotenv/config";
+import { PrismaClient } from "@prisma/client";
+import { bootstrapAlphaSilo } from "../src/deployment/bootstrap-silo.js";
+import { loadLocalSecretKeyring, LocalSecretEnvelope } from "../src/security/secretEnvelope.js";
+
+function requiredEnv(name: string): string {
+  const v = process.env[name]?.trim();
+  if (v === undefined || v === "") throw new Error(`missing required env: ${name}`);
+  return v;
+}
+
+async function main(): Promise<void> {
+  const databaseUrl = requiredEnv("DATABASE_URL");
+  const keyring = await loadLocalSecretKeyring();
+  const secrets = new LocalSecretEnvelope(keyring);
+  const prisma = new PrismaClient({ datasources: { db: { url: databaseUrl } }, log: [] });
+
+  const organizationId = requiredEnv("HUB_SILO_ORGANIZATION_ID");
+  const feishuAppId = requiredEnv("FEISHU_APP_ID");
+  const feishuAppSecret = requiredEnv("FEISHU_APP_SECRET");
+  const feishuBotOpenId = requiredEnv("FEISHU_BOT_OPEN_ID");
+  const providerAuthToken = requiredEnv("ANTHROPIC_AUTH_TOKEN");
+  const providerBaseUrl = process.env["ANTHROPIC_BASE_URL"]?.trim() || "https://openrouter.ai/api";
+  const anthropicApiKey = process.env["ANTHROPIC_API_KEY"]?.trim() || "";
+
+  try {
+    const result = await bootstrapAlphaSilo(
+      prisma,
+      secrets,
+      {
+        organization: {
+          id: organizationId,
+          slug: "local-dev",
+          name: "Local Dev Silo",
+        },
+        owner: {
+          openId: feishuBotOpenId,
+          displayName: "Local Dev Owner",
+        },
+        feishu: {
+          appId: feishuAppId,
+          appSecret: feishuAppSecret,
+          botOpenId: feishuBotOpenId,
+        },
+        provider: {
+          providerId: "openrouter",
+          baseUrl: providerBaseUrl,
+          authToken: providerAuthToken,
+          ...(anthropicApiKey !== "" ? { anthropicApiKey } : {}),
+        },
+      },
+      // Skip live network probes in local dev — Feishu/OpenRouter reachability
+      // is not required to seed the encrypted envelope rows.
+      { feishu: async () => {}, provider: async () => {} },
+    );
+    console.log("bootstrap result:", JSON.stringify(result, null, 2));
+  } finally {
+    await prisma.$disconnect();
+  }
+}
+
+main().catch((error: unknown) => {
+  console.error("[dev-bootstrap-silo] failed:", error instanceof Error ? error.message : String(error));
+  process.exitCode = 1;
+});

hub/scripts/dev-bootstrap.ts

@@ -0,0 +1,52 @@
+import { config } from "dotenv";
+config();
+
+import { PrismaClient } from "@prisma/client";
+import { bootstrapAlphaSilo } from "../src/deployment/bootstrap-silo.js";
+import { loadLocalSecretKeyring, LocalSecretEnvelope } from "../src/security/secretEnvelope.js";
+
+async function main(): Promise<void> {
+  const keyringFile = process.env["HUB_SECRET_KEYRING_FILE"];
+  if (!keyringFile) throw new Error("HUB_SECRET_KEYRING_FILE is required");
+  const secrets = new LocalSecretEnvelope(await loadLocalSecretKeyring());
+  const prisma = new PrismaClient();
+  try {
+    const result = await bootstrapAlphaSilo(
+      prisma,
+      secrets,
+      {
+        organization: {
+          id: "org_default",
+          slug: "default",
+          name: "Default Organization",
+        },
+        owner: {
+          openId: process.env["FEISHU_BOT_OPEN_ID"] ?? "dev-owner",
+          displayName: "Dev Owner",
+        },
+        feishu: {
+          appId: process.env["FEISHU_APP_ID"] ?? "dev-app",
+          appSecret: process.env["FEISHU_APP_SECRET"] ?? "dev-secret",
+          botOpenId: process.env["FEISHU_BOT_OPEN_ID"] ?? "dev-bot",
+        },
+        provider: {
+          providerId: "openrouter",
+          baseUrl: process.env["ANTHROPIC_BASE_URL"] ?? "https://openrouter.ai/api",
+          authToken: process.env["ANTHROPIC_AUTH_TOKEN"] ?? "dev-token",
+        },
+      },
+      {
+        feishu: async () => undefined,
+        provider: async () => undefined,
+      },
+    );
+    console.log("bootstrap ok:", JSON.stringify(result, null, 2));
+  } finally {
+    await prisma.$disconnect();
+  }
+}
+
+main().catch((error: unknown) => {
+  console.error("[dev-bootstrap] failed:", error instanceof Error ? error.message : String(error));
+  process.exitCode = 1;
+});

hub/scripts/dev-seed-connections.ts

@@ -0,0 +1,84 @@
+/**
+ * Local dev seed for an existing Organization that predates the ADR-0024
+ * secret-envelope plane (e.g. the legacy `org_default` from the tenant-root
+ * migration). Creates ACTIVE Feishu Application + Provider (BYOK openrouter)
+ * connections with encrypted envelopes, using the local dev keyring.
+ *
+ * Idempotent: re-running rotates a new secret version if the connection
+ * already exists.
+ *
+ * Usage: npx tsx scripts/dev-seed-connections.ts
+ */
+import "dotenv/config";
+import { PrismaClient } from "@prisma/client";
+import { FeishuApplicationConnectionService } from "../src/connections/feishuApplicationConnections.js";
+import { ProviderConnectionService } from "../src/connections/providerConnections.js";
+import { loadLocalSecretKeyring, LocalSecretEnvelope } from "../src/security/secretEnvelope.js";
+
+function requiredEnv(name: string): string {
+  const v = process.env[name]?.trim();
+  if (v === undefined || v === "") throw new Error(`missing required env: ${name}`);
+  return v;
+}
+
+async function main(): Promise<void> {
+  const databaseUrl = requiredEnv("DATABASE_URL");
+  const organizationId = requiredEnv("HUB_SILO_ORGANIZATION_ID");
+  const keyring = await loadLocalSecretKeyring();
+  const secrets = new LocalSecretEnvelope(keyring);
+  const prisma = new PrismaClient({ datasources: { db: { url: databaseUrl } }, log: [] });
+
+  const feishuAppId = requiredEnv("FEISHU_APP_ID");
+  const feishuAppSecret = requiredEnv("FEISHU_APP_SECRET");
+  const feishuBotOpenId = requiredEnv("FEISHU_BOT_OPEN_ID");
+  const providerAuthToken = requiredEnv("ANTHROPIC_AUTH_TOKEN");
+  const providerBaseUrl = process.env["ANTHROPIC_BASE_URL"]?.trim() || "https://openrouter.ai/api";
+  const anthropicApiKey = process.env["ANTHROPIC_API_KEY"]?.trim() || "";
+
+  // Pick an existing active OWNER/ADMIN as the actor for the audit rows.
+  const actor = await prisma.organizationMembership.findFirst({
+    where: { organizationId, role: { in: ["OWNER", "ADMIN"] }, revokedAt: null },
+    select: { userId: true },
+  });
+  if (actor === null) throw new Error(`no active OWNER/ADMIN membership on ${organizationId}; seed a member first`);
+  const actorUserId = actor.userId;
+  console.log("actor:", actorUserId);
+
+  try {
+    const feishuService = new FeishuApplicationConnectionService(
+      prisma,
+      secrets,
+      async () => {}, // skip live Feishu probe in local dev
+    );
+    const feishuResult = await feishuService.rotateCustomerApplication({
+      organizationId,
+      actorUserId,
+      appId: feishuAppId,
+      appSecret: feishuAppSecret,
+      botOpenId: feishuBotOpenId,
+    });
+    console.log("feishu connection:", JSON.stringify(feishuResult, null, 2));
+
+    const providerService = new ProviderConnectionService(
+      prisma,
+      secrets,
+      async () => {}, // skip live OpenRouter probe in local dev
+    );
+    const providerResult = await providerService.rotateByok({
+      organizationId,
+      actorUserId,
+      providerId: "openrouter",
+      baseUrl: providerBaseUrl,
+      authToken: providerAuthToken,
+      ...(anthropicApiKey !== "" ? { anthropicApiKey } : {}),
+    });
+    console.log("provider connection:", JSON.stringify(providerResult, null, 2));
+  } finally {
+    await prisma.$disconnect();
+  }
+}
+
+main().catch((error: unknown) => {
+  console.error("[dev-seed-connections] failed:", error instanceof Error ? error.message : String(error));
+  process.exitCode = 1;
+});

hub/src/admin/auth/guards.ts

@@ -10,8 +10,10 @@ import {
   verifySession,
   type SessionPayload,
 } from "./session.js";
+import { createPermissionAuthorizer, type AuthorizationAction } from "../../permissions/authorizer.js";
 
 export const ORG_ADMIN_ROLES: readonly OrganizationMemberRole[] = ["OWNER", "ADMIN"];
+const ANY_ORG_ROLE: readonly OrganizationMemberRole[] = ["OWNER", "ADMIN", "MEMBER"];
 
 export interface AuthContext {
   readonly session: SessionPayload;
@@ -175,3 +177,55 @@ export async function sendError(
 ): Promise<void> {
   await reply.status(statusCode).send({ error: { code, message } });
 }
+
+export interface ProjectAuthContext extends OrgAuthContext {
+  readonly projectId: string;
+}
+
+/**
+ * Resolve an org member (any role) viewing/mutating a project in their org, then
+ * enforce project-level permission via the PermissionGrant authorizer.
+ *
+ * `allowOrgAdminOversight=true` lets org OWNER/ADMIN through without a project
+ * grant — reserved for *read* oversight (listing/viewing). Mutations that the
+ * spec pins to project `manage` (e.g. `collaborator.manage`) must pass
+ * `allowOrgAdminOversight=false`: org role alone is not a project authorization
+ * root (spec `Permission.lean` / ADR-0004; the only out-of-role override is
+ * platform-admin force-release `RequiresAdmin`, not org admin).
+ */
+export async function requireProjectPermission(
+  request: FastifyRequest,
+  reply: FastifyReply,
+  deps: GuardDeps,
+  options: {
+    readonly orgSlug: string;
+    readonly projectId: string;
+    readonly action: AuthorizationAction;
+    readonly allowOrgAdminOversight: boolean;
+  },
+): Promise<ProjectAuthContext | null> {
+  const auth = await requireOrgRole(request, reply, deps, {
+    orgSlug: options.orgSlug,
+    roles: ANY_ORG_ROLE,
+  });
+  if (auth === null) return null;
+  await requireOrgProject(deps, auth.organization.id, options.projectId);
+  if (options.allowOrgAdminOversight && ORG_ADMIN_ROLES.includes(auth.membershipRole)) {
+    return { ...auth, projectId: options.projectId };
+  }
+  const decision = await createPermissionAuthorizer(deps.prisma).can({
+    actor: { feishuOpenId: auth.feishuOpenId },
+    action: options.action,
+    resource: { type: "PROJECT", id: options.projectId },
+  });
+  if (!decision.allowed) {
+    await sendError(
+      reply,
+      403,
+      "forbidden",
+      `project ${options.projectId} requires ${decision.requiredRole} (${options.action}): ${decision.reason}`,
+    );
+    return null;
+  }
+  return { ...auth, projectId: options.projectId };
+}

hub/src/admin/errors.ts

@@ -35,9 +35,11 @@ export async function handleRouteError(reply: FastifyReply, err: unknown): Promi
       await sendError(reply, mapped.statusCode, mapped.code, mapped.message);
       return;
     }
+    reply.log.error({ err }, "unmapped route error");
     await sendError(reply, 500, "internal_error", "internal error");
     return;
   }
+  reply.log.error({ err }, "unmapped route error");
   await sendError(reply, 500, "internal_error", "internal error");
 }
 
@@ -71,7 +73,8 @@ function mapDomainError(message: string): { statusCode: number; code: string; me
     lower.includes("is required") ||
     lower.includes("already") ||
     lower.includes("invalid") ||
-    lower.includes("accepts only")
+    lower.includes("accepts only") ||
+    lower.includes("must be")
   ) {
     return { statusCode: 400, code: "bad_request", message };
   }

hub/src/admin/plugin.ts

@@ -1,11 +1,12 @@
 /**
- * Registers org-admin HTTP surface: auth, org APIs, (later) static SPA.
+ * Registers org-admin HTTP surface: auth, org APIs, and the static SPA shell.
  */
 import cookie from "@fastify/cookie";
 import type { PrismaClient } from "@prisma/client";
 import type { FastifyInstance } from "fastify";
 import { registerAuthRoutes } from "./routes/authRoutes.js";
 import { registerOrgRoutes } from "./routes/orgRoutes.js";
+import { registerStaticSpa } from "./static.js";
 import type { LocalSecretEnvelope } from "../security/secretEnvelope.js";
 import type { ProviderReadinessProbe } from "../connections/providerReadiness.js";
 import type { FeishuReadinessProbe } from "../connections/feishuReadiness.js";
@@ -62,4 +63,7 @@ export async function registerAdminPlugin(
       ? { feishuConnectionReadinessProbe: config.feishuConnectionReadinessProbe }
       : {}),
   });
+
+  // After API + /admin/login so SPA fallback does not shadow auth routes.
+  await registerStaticSpa(app);
 }

hub/src/admin/routes/accessRoutes.ts

@@ -5,7 +5,7 @@ import {
   listProjectTeamAccess,
   revokeTeamProjectAccess,
 } from "../../permissions/projectTeamAccess.js";
-import { requireOrgProject, requireOrgRole, type GuardDeps } from "../auth/guards.js";
+import { requireProjectPermission, type GuardDeps } from "../auth/guards.js";
 import { handleRouteError } from "../errors.js";
 
 const ROLES: readonly PermissionRole[] = ["READ", "EDIT", "MANAGE"];
@@ -19,9 +19,13 @@ export async function registerAccessRoutes(
   app.get("/api/org/:orgSlug/projects/:projectId/team-access", async (request, reply) => {
     try {
       const { orgSlug, projectId } = request.params as { orgSlug: string; projectId: string };
-      const auth = await requireOrgRole(request, reply, guardDeps, { orgSlug });
+      const auth = await requireProjectPermission(request, reply, guardDeps, {
+        orgSlug,
+        projectId,
+        action: "project.read",
+        allowOrgAdminOversight: true,
+      });
       if (auth === null) return;
-      await requireOrgProject(guardDeps, auth.organization.id, projectId);
       return { access: await listProjectTeamAccess(config.prisma, projectId) };
     } catch (err) {
       return handleRouteError(reply, err);
@@ -31,9 +35,13 @@ export async function registerAccessRoutes(
   app.put("/api/org/:orgSlug/projects/:projectId/team-access", async (request, reply) => {
     try {
       const { orgSlug, projectId } = request.params as { orgSlug: string; projectId: string };
-      const auth = await requireOrgRole(request, reply, guardDeps, { orgSlug });
+      const auth = await requireProjectPermission(request, reply, guardDeps, {
+        orgSlug,
+        projectId,
+        action: "collaborator.manage",
+        allowOrgAdminOversight: false,
+      });
       if (auth === null) return;
-      await requireOrgProject(guardDeps, auth.organization.id, projectId);
       const body = request.body as {
         teamId?: unknown;
         teamSlug?: unknown;
@@ -67,9 +75,13 @@ export async function registerAccessRoutes(
           projectId: string;
           teamId: string;
         };
-        const auth = await requireOrgRole(request, reply, guardDeps, { orgSlug });
+        const auth = await requireProjectPermission(request, reply, guardDeps, {
+          orgSlug,
+          projectId,
+          action: "collaborator.manage",
+          allowOrgAdminOversight: false,
+        });
         if (auth === null) return;
-        await requireOrgProject(guardDeps, auth.organization.id, projectId);
         const count = await revokeTeamProjectAccess(config.prisma, { projectId, teamId });
         return { revoked: count };
       } catch (err) {

hub/src/admin/routes/agentConfigRoutes.ts

@@ -0,0 +1,246 @@
+/**
+ * Org-admin Agent configuration routes (ADR-0017 / ADR-0018).
+ *
+ * Surface for browsing and editing Organization-scoped Agent roles, the skills
+ * bound to them, and the model picker. The model list is **derived** from the
+ * org's ACTIVE provider connection via OpenRouter's /v1/models API — there is
+ * no separate model table to maintain. When no ACTIVE provider exists, the
+ * route falls back to the env-default model registry so the admin surface
+ * remains usable.
+ *
+ * Skill management (create, read, edit, disable) is performed in-band through
+ * the deep module `OrganizationAgentConfiguration`, which writes to the same
+ * content-addressed persistent store used by the host-console CLI. All skill
+ * content flows through `importSkillFromFiles` → `inspectSkillDirectory` →
+ * `commitSkillContent`, so the web path and CLI path share one ingestion
+ * pipeline and one set of safety checks (SKILL.md manifest required, 512-file
+ * / 16-byte limits, symlink rejection).
+ */
+import type { PrismaClient } from "@prisma/client";
+import type { FastifyInstance } from "fastify";
+import { OrganizationAgentConfiguration } from "../../agent/configuration.js";
+import { ProviderModelCatalog } from "../../connections/providerModelCatalog.js";
+import { createDefaultModelRegistry } from "../../settings/runtime.js";
+import type { LocalSecretEnvelope } from "../../security/secretEnvelope.js";
+import { requireOrgRole, type GuardDeps } from "../auth/guards.js";
+import { handleRouteError } from "../errors.js";
+
+export interface AgentConfigRouteConfig {
+  readonly prisma: PrismaClient;
+  readonly sessionSecret: string;
+  readonly skillStoreRoot: string;
+  readonly secretEnvelope: LocalSecretEnvelope;
+}
+
+export async function registerAgentConfigRoutes(
+  app: FastifyInstance,
+  config: AgentConfigRouteConfig,
+): Promise<void> {
+  const guardDeps: GuardDeps = { prisma: config.prisma, sessionSecret: config.sessionSecret };
+  const agentConfig = new OrganizationAgentConfiguration(config.prisma, config.skillStoreRoot);
+  const modelCatalog = new ProviderModelCatalog(config.prisma, config.secretEnvelope);
+
+  app.get("/api/org/:orgSlug/agent-roles", async (request, reply) => {
+    try {
+      const { orgSlug } = request.params as { orgSlug: string };
+      const auth = await requireOrgRole(request, reply, guardDeps, { orgSlug });
+      if (auth === null) return;
+      const roles = await agentConfig.listRoles({ organizationId: auth.organization.id });
+      return { roles };
+    } catch (err) {
+      return handleRouteError(reply, err);
+    }
+  });
+
+  app.put("/api/org/:orgSlug/agent-roles/:roleId", async (request, reply) => {
+    try {
+      const { orgSlug, roleId } = request.params as { orgSlug: string; roleId: string };
+      const auth = await requireOrgRole(request, reply, guardDeps, { orgSlug });
+      if (auth === null) return;
+      const body = request.body as {
+        label?: unknown;
+        defaultModel?: unknown;
+        systemPrompt?: unknown;
+        tools?: unknown;
+        sortOrder?: unknown;
+        isDefault?: unknown;
+      };
+      if (typeof body.label !== "string" || body.label.trim() === "") {
+        return reply.status(400).send({
+          error: { code: "bad_request", message: "label is required" },
+        });
+      }
+      const role = await agentConfig.upsertRole({
+        organizationId: auth.organization.id,
+        roleId,
+        label: body.label,
+        ...(body.defaultModel === null || typeof body.defaultModel === "string"
+          ? { defaultModel: body.defaultModel as string | null }
+          : {}),
+        ...(body.systemPrompt === null || typeof body.systemPrompt === "string"
+          ? { systemPrompt: body.systemPrompt as string | null }
+          : {}),
+        ...(body.tools === null || Array.isArray(body.tools)
+          ? { tools: body.tools as readonly string[] | null }
+          : {}),
+        ...(typeof body.sortOrder === "number" ? { sortOrder: body.sortOrder } : {}),
+        ...(typeof body.isDefault === "boolean" ? { isDefault: body.isDefault } : {}),
+      });
+      return role;
+    } catch (err) {
+      return handleRouteError(reply, err);
+    }
+  });
+
+  app.put("/api/org/:orgSlug/agent-roles/:roleId/skills", async (request, reply) => {
+    try {
+      const { orgSlug, roleId } = request.params as { orgSlug: string; roleId: string };
+      const auth = await requireOrgRole(request, reply, guardDeps, { orgSlug });
+      if (auth === null) return;
+      const body = request.body as { skillNames?: unknown };
+      if (!Array.isArray(body.skillNames) || body.skillNames.some((n) => typeof n !== "string")) {
+        return reply.status(400).send({
+          error: { code: "bad_request", message: "skillNames must be a string array" },
+        });
+      }
+      await agentConfig.setRoleSkills({
+        organizationId: auth.organization.id,
+        roleId,
+        skillNames: body.skillNames as readonly string[],
+      });
+      return { skillNames: body.skillNames as string[] };
+    } catch (err) {
+      return handleRouteError(reply, err);
+    }
+  });
+
+  app.get("/api/org/:orgSlug/agent-skills", async (request, reply) => {
+    try {
+      const { orgSlug } = request.params as { orgSlug: string };
+      const auth = await requireOrgRole(request, reply, guardDeps, { orgSlug });
+      if (auth === null) return;
+      const skills = await agentConfig.listSkills({ organizationId: auth.organization.id });
+      return { skills };
+    } catch (err) {
+      return handleRouteError(reply, err);
+    }
+  });
+
+  app.get("/api/org/:orgSlug/agent-skills/:name/files", async (request, reply) => {
+    try {
+      const { orgSlug, name } = request.params as { orgSlug: string; name: string };
+      const auth = await requireOrgRole(request, reply, guardDeps, { orgSlug });
+      if (auth === null) return;
+      const skills = await agentConfig.listSkills({ organizationId: auth.organization.id });
+      const skill = skills.find((s) => s.name === name && s.disabledAt === null);
+      if (skill === undefined) {
+        return reply.status(404).send({
+          error: { code: "not_found", message: `skill not found: ${name}` },
+        });
+      }
+      const files = await agentConfig.readSkillFiles({
+        organizationId: auth.organization.id,
+        contentDigest: skill.contentDigest,
+      });
+      return { files };
+    } catch (err) {
+      return handleRouteError(reply, err);
+    }
+  });
+
+  app.put("/api/org/:orgSlug/agent-skills/:name", async (request, reply) => {
+    try {
+      const { orgSlug, name } = request.params as { orgSlug: string; name: string };
+      const auth = await requireOrgRole(request, reply, guardDeps, { orgSlug });
+      if (auth === null) return;
+      const body = request.body as { version?: unknown; files?: unknown };
+      if (typeof body.version !== "string" || body.version.trim() === "") {
+        return reply.status(400).send({
+          error: { code: "bad_request", message: "version is required" },
+        });
+      }
+      if (!Array.isArray(body.files) || body.files.length === 0) {
+        return reply.status(400).send({
+          error: { code: "bad_request", message: "files must be a non-empty array" },
+        });
+      }
+      const skillFiles: Array<{ readonly path: string; readonly bytes: Buffer }> = [];
+      for (const entry of body.files) {
+        if (typeof entry !== "object" || entry === null || Array.isArray(entry)) {
+          return reply.status(400).send({
+            error: { code: "bad_request", message: "each file must be an object" },
+          });
+        }
+        const e = entry as { path?: unknown; content?: unknown };
+        if (typeof e.path !== "string" || typeof e.content !== "string") {
+          return reply.status(400).send({
+            error: { code: "bad_request", message: "each file needs string path and content" },
+          });
+        }
+        skillFiles.push({ path: e.path, bytes: Buffer.from(e.content, "utf8") });
+      }
+      const result = await agentConfig.installSkillFromFiles({
+        organizationId: auth.organization.id,
+        files: skillFiles,
+        version: body.version,
+      });
+      // The manifest name is authoritative — reject if it doesn't match the
+      // URL param, so clients can't silently rename a skill under a different
+      // route key.
+      if (result.name !== name) {
+        return reply.status(400).send({
+          error: {
+            code: "bad_request",
+            message: `skill manifest name "${result.name}" does not match route "${name}"`,
+          },
+        });
+      }
+      return { id: result.id, name: result.name, contentDigest: result.contentDigest };
+    } catch (err) {
+      return handleRouteError(reply, err);
+    }
+  });
+
+  app.patch("/api/org/:orgSlug/agent-skills/:name", async (request, reply) => {
+    try {
+      const { orgSlug, name } = request.params as { orgSlug: string; name: string };
+      const auth = await requireOrgRole(request, reply, guardDeps, { orgSlug });
+      if (auth === null) return;
+      const body = request.body as { description?: unknown; disabled?: unknown };
+      if (body.disabled === true) {
+        await agentConfig.disableSkill({ organizationId: auth.organization.id, name });
+        return { disabled: true };
+      }
+      if (typeof body.description === "string") {
+        await agentConfig.updateSkillDescription({
+          organizationId: auth.organization.id,
+          name,
+          description: body.description,
+        });
+        return { updated: true };
+      }
+      return reply.status(400).send({
+        error: { code: "bad_request", message: "provide description or disabled: true" },
+      });
+    } catch (err) {
+      return handleRouteError(reply, err);
+    }
+  });
+
+  app.get("/api/org/:orgSlug/agent-models", async (request, reply) => {
+    try {
+      const { orgSlug } = request.params as { orgSlug: string };
+      const auth = await requireOrgRole(request, reply, guardDeps, { orgSlug });
+      if (auth === null) return;
+      const providerModels = await modelCatalog.listModels(auth.organization.id);
+      // Fall back to env-default registry when the org has no ACTIVE provider
+      // (or the provider API is unreachable on first load).
+      const models = providerModels.length > 0
+        ? providerModels
+        : createDefaultModelRegistry(process.env).listModels();
+      return { models };
+    } catch (err) {
+      return handleRouteError(reply, err);
+    }
+  });
+}

hub/src/admin/routes/authRoutes.ts

@@ -433,8 +433,10 @@ async function resolvePostLoginRedirect(
     });
     if (intended === null) return "/admin?error=not_an_active_org_member";
     const orgRoot = `/admin/org/${intended.organization.slug}`;
+    // Default / missing returnTo sanitizes to "/admin". Always land in the org
+    // admin SPA (not the legacy static "close this tab" complete page).
     if (returnTo === "/admin") {
-      return `/auth/feishu/complete?org=${encodeURIComponent(intended.organization.name)}`;
+      return orgRoot;
     }
     return returnTo === orgRoot || returnTo.startsWith(`${orgRoot}/`) ? returnTo : orgRoot;
   }

hub/src/admin/routes/capacityRoutes.ts

@@ -0,0 +1,64 @@
+/**
+ * Org-admin capacity policy routes (ADR-0022).
+ */
+import type { PrismaClient } from "@prisma/client";
+import type { FastifyInstance } from "fastify";
+import { getCapacityPolicy, setCapacityPolicy } from "../../org/capacityPolicy.js";
+import { isCapacityDimension } from "../../capacity/dimensions.js";
+import { requireOrgRole, type GuardDeps } from "../auth/guards.js";
+import { handleRouteError } from "../errors.js";
+
+export async function registerCapacityRoutes(
+  app: FastifyInstance,
+  config: { readonly prisma: PrismaClient; readonly sessionSecret: string },
+): Promise<void> {
+  const guardDeps: GuardDeps = { prisma: config.prisma, sessionSecret: config.sessionSecret };
+
+  app.get("/api/org/:orgSlug/capacity-policy", async (request, reply) => {
+    try {
+      const { orgSlug } = request.params as { orgSlug: string };
+      const auth = await requireOrgRole(request, reply, guardDeps, { orgSlug });
+      if (auth === null) return;
+      return await getCapacityPolicy(config.prisma, auth.organization.id);
+    } catch (err) {
+      return handleRouteError(reply, err);
+    }
+  });
+
+  app.put("/api/org/:orgSlug/capacity-policy", async (request, reply) => {
+    try {
+      const { orgSlug } = request.params as { orgSlug: string };
+      const auth = await requireOrgRole(request, reply, guardDeps, { orgSlug });
+      if (auth === null) return;
+      const body = request.body as { limits?: unknown };
+      if (body?.limits === null || typeof body.limits !== "object") {
+        return reply.status(400).send({
+          error: { code: "bad_request", message: "limits object is required" },
+        });
+      }
+      const limits: Record<string, number | null> = {};
+      for (const [key, value] of Object.entries(body.limits as Record<string, unknown>)) {
+        if (!isCapacityDimension(key)) {
+          return reply.status(400).send({
+            error: { code: "bad_request", message: `unknown capacity dimension: ${key}` },
+          });
+        }
+        if (value === null) {
+          limits[key] = null;
+        } else if (typeof value === "number" && Number.isFinite(value)) {
+          limits[key] = value;
+        } else {
+          return reply.status(400).send({
+            error: { code: "bad_request", message: `limit for ${key} must be a number or null` },
+          });
+        }
+      }
+      return await setCapacityPolicy(config.prisma, {
+        organizationId: auth.organization.id,
+        limits,
+      });
+    } catch (err) {
+      return handleRouteError(reply, err);
+    }
+  });
+}

hub/src/admin/routes/explorerRoutes.ts

@@ -10,13 +10,15 @@ import {
   createOrgFolder,
   createOrgProject,
   getOrgProjectDetail,
+  listMyProjects,
   listOrgExplorer,
   moveOrgProjectToFolder,
   renameFolder,
   renameProject,
 } from "../../org/explorer.js";
-import { requireOrgRole, type GuardDeps } from "../auth/guards.js";
+import { requireOrgRole, requireProjectPermission, ORG_ADMIN_ROLES, type GuardDeps } from "../auth/guards.js";
 import { handleRouteError } from "../errors.js";
+import { createPermissionAuthorizer } from "../../permissions/authorizer.js";
 
 export interface ExplorerRouteConfig {
   readonly prisma: PrismaClient;
@@ -41,6 +43,24 @@ export async function registerExplorerRoutes(
     }
   });
 
+  app.get("/api/org/:orgSlug/my-projects", async (request, reply) => {
+    try {
+      const { orgSlug } = request.params as { orgSlug: string };
+      const auth = await requireOrgRole(request, reply, guardDeps, {
+        orgSlug,
+        roles: ["OWNER", "ADMIN", "MEMBER"],
+      });
+      if (auth === null) return;
+      const projects = await listMyProjects(config.prisma, {
+        organizationId: auth.organization.id,
+        actorFeishuOpenId: auth.feishuOpenId,
+      });
+      return { projects };
+    } catch (err) {
+      return handleRouteError(reply, err);
+    }
+  });
+
   app.post("/api/org/:orgSlug/folders", async (request, reply) => {
     try {
       const { orgSlug } = request.params as { orgSlug: string };
@@ -135,7 +155,7 @@ export async function registerExplorerRoutes(
         workspaceRoot: config.projectWorkspaceRoot,
         ...(typeof body.folderId === "string" ? { folderId: body.folderId } : {}),
       });
-      return reply.status(201).send(result);
+      return reply.status(201).send({ id: result.projectId, name: body.name });
     } catch (err) {
       return handleRouteError(reply, err);
     }
@@ -144,12 +164,27 @@ export async function registerExplorerRoutes(
   app.get("/api/org/:orgSlug/projects/:projectId", async (request, reply) => {
     try {
       const { orgSlug, projectId } = request.params as { orgSlug: string; projectId: string };
-      const auth = await requireOrgRole(request, reply, guardDeps, { orgSlug });
+      const auth = await requireProjectPermission(request, reply, guardDeps, {
+        orgSlug,
+        projectId,
+        action: "project.read",
+        allowOrgAdminOversight: true,
+      });
       if (auth === null) return;
-      return await getOrgProjectDetail(config.prisma, {
+      const detail = await getOrgProjectDetail(config.prisma, {
         organizationId: auth.organization.id,
         projectId,
       });
+      const manageDecision = await createPermissionAuthorizer(config.prisma).can({
+        actor: { feishuOpenId: auth.feishuOpenId },
+        action: "collaborator.manage",
+        resource: { type: "PROJECT", id: projectId },
+      });
+      return {
+        ...detail,
+        actorIsOrgAdmin: ORG_ADMIN_ROLES.includes(auth.membershipRole),
+        actorCanManageProject: manageDecision.allowed,
+      };
     } catch (err) {
       return handleRouteError(reply, err);
     }

hub/src/admin/routes/orgRoutes.ts

@@ -15,6 +15,9 @@ import { registerMembersRoutes } from "./membersRoutes.js";
 import { registerSessionsAndUsageRoutes } from "./sessionsRoutes.js";
 import { registerTeamsRoutes } from "./teamsRoutes.js";
 import { registerProviderConnectionRoutes } from "./providerConnectionRoutes.js";
+import { registerCapacityRoutes } from "./capacityRoutes.js";
+import { readSkillStoreRoot } from "../../agent/skillStore.js";
+import { registerAgentConfigRoutes } from "./agentConfigRoutes.js";
 import type { LocalSecretEnvelope } from "../../security/secretEnvelope.js";
 import type { ProviderReadinessProbe } from "../../connections/providerReadiness.js";
 import type { FeishuReadinessProbe } from "../../connections/feishuReadiness.js";
@@ -105,6 +108,16 @@ export async function registerOrgRoutes(app: FastifyInstance, config: OrgRouteCo
     prisma: config.prisma,
     sessionSecret: config.sessionSecret,
   });
+  await registerCapacityRoutes(app, {
+    prisma: config.prisma,
+    sessionSecret: config.sessionSecret,
+  });
+  await registerAgentConfigRoutes(app, {
+    prisma: config.prisma,
+    sessionSecret: config.sessionSecret,
+    skillStoreRoot: readSkillStoreRoot(),
+    secretEnvelope: config.secretEnvelope,
+  });
   await registerSessionsAndUsageRoutes(app, {
     prisma: config.prisma,
     sessionSecret: config.sessionSecret,

hub/src/admin/routes/teamsRoutes.ts

@@ -18,10 +18,16 @@ export async function registerTeamsRoutes(
 ): Promise<void> {
   const guardDeps: GuardDeps = { prisma: config.prisma, sessionSecret: config.sessionSecret };
 
+  // Read-only listing is open to any active org member so project MANAGE
+  // holders can pick a team when granting TEAM→PROJECT access (ADR-0004).
+  // Mutations below stay org-admin only.
   app.get("/api/org/:orgSlug/teams", async (request, reply) => {
     try {
       const { orgSlug } = request.params as { orgSlug: string };
-      const auth = await requireOrgRole(request, reply, guardDeps, { orgSlug });
+      const auth = await requireOrgRole(request, reply, guardDeps, {
+        orgSlug,
+        roles: ["OWNER", "ADMIN", "MEMBER"],
+      });
       if (auth === null) return;
       return { teams: await listOrgTeams(config.prisma, auth.organization.id) };
     } catch (err) {
@@ -34,7 +40,7 @@ export async function registerTeamsRoutes(
       const { orgSlug } = request.params as { orgSlug: string };
       const auth = await requireOrgRole(request, reply, guardDeps, { orgSlug });
       if (auth === null) return;
-      const body = request.body as { slug?: unknown; name?: unknown; description?: unknown };
+      const body = (request.body ?? {}) as { slug?: unknown; name?: unknown; description?: unknown };
       if (typeof body.slug !== "string" || typeof body.name !== "string") {
         return reply.status(400).send({
           error: { code: "bad_request", message: "slug and name are required" },

hub/src/admin/static.ts

@@ -0,0 +1,82 @@
+/**
+ * Serves the org-admin SPA (built by SvelteKit via `admin-web/build/`) and
+ * the SPA index fallback for client-side routes under `/admin/*`.
+ *
+ * The SvelteKit project lives in `hub/admin-web/`. Run `npm run build` there
+ * to produce the static output in `admin-web/build/`. In development, use
+ * `npm run dev` in `admin-web/` which proxies `/api` and `/auth` to the Hub.
+ *
+ * Override the UI directory with `CPH_ADMIN_UI_DIR` env if needed.
+ */
+import { readFile } from "node:fs/promises";
+import { existsSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+import { dirname, extname, join, resolve as resolvePath } from "node:path";
+import type { FastifyInstance } from "fastify";
+
+const MIME: Record<string, string> = {
+  ".html": "text/html; charset=utf-8",
+  ".js": "text/javascript; charset=utf-8",
+  ".mjs": "text/javascript; charset=utf-8",
+  ".css": "text/css; charset=utf-8",
+  ".svg": "image/svg+xml",
+  ".ico": "image/x-icon",
+  ".png": "image/png",
+  ".jpg": "image/jpeg",
+  ".woff": "font/woff",
+  ".woff2": "font/woff2",
+  ".json": "application/json; charset=utf-8",
+  ".txt": "text/plain; charset=utf-8",
+};
+
+function resolveUiDir(): string {
+  const override = process.env["CPH_ADMIN_UI_DIR"];
+  if (override && override.trim() !== "") return resolvePath(override);
+  const here = dirname(fileURLToPath(import.meta.url));
+  return resolvePath(join(here, "..", "..", "admin-web", "build"));
+}
+
+export async function registerStaticSpa(app: FastifyInstance): Promise<void> {
+  const uiDir = resolveUiDir();
+  if (!existsSync(join(uiDir, "index.html"))) {
+    app.log.warn(
+      { uiDir },
+      "admin-web/build not found; SPA shell disabled. Run `npm run build` in admin-web/ to enable. Org admin APIs remain fully functional.",
+    );
+    return;
+  }
+  const indexHtml = await readFile(join(uiDir, "index.html"), "utf8");
+
+  // SvelteKit static assets (_app/*, favicon, etc.)
+  app.get("/_app/*", async (request, reply) => {
+    const rel = (request.params as { "*": string })["*"];
+    const safe = rel.split("/").filter((p) => p !== ".." && p !== "").join("/");
+    try {
+      const buf = await readFile(join(uiDir, "_app", safe));
+      const mime = MIME[extname(safe)] ?? "application/octet-stream";
+      return reply.type(mime).send(buf);
+    } catch {
+      return reply.status(404).send({ error: { code: "not_found", message: "asset not found" } });
+    }
+  });
+
+  // Other top-level static assets (favicon.svg, robots.txt, etc.)
+  app.get("/favicon.svg", async (_request, reply) => {
+    try {
+      const buf = await readFile(join(uiDir, "favicon.svg"));
+      return reply.type("image/svg+xml").send(buf);
+    } catch {
+      return reply.status(404).send();
+    }
+  });
+
+  // SPA client-side route fallback. Auth registers `/admin/login` first so it
+  // takes precedence; everything else under /admin/* serves the index so
+  // SvelteKit's client-side router can resolve the view.
+  app.get("/admin", async (_request, reply) => {
+    return reply.type("text/html; charset=utf-8").send(indexHtml);
+  });
+  app.get("/admin/*", async (_request, reply) => {
+    return reply.type("text/html; charset=utf-8").send(indexHtml);
+  });
+}

hub/src/agent/configuration.ts

@@ -1,10 +1,37 @@
 import type { PrismaClient } from "@prisma/client";
 import { Prisma } from "@prisma/client";
 import { assertSupportedRoleTools } from "./roleTools.js";
-import { importSkillDirectory } from "./skillStore.js";
+import { importSkillDirectory, importSkillFromFiles, readSkillFiles, type SkillFileInput, type SkillFileOutput } from "./skillStore.js";
 
 const ROLE_ID_PATTERN = /^[a-z0-9][a-z0-9_-]{0,63}$/;
 
+export interface AgentRoleRow {
+  readonly id: string;
+  readonly roleId: string;
+  readonly label: string;
+  readonly defaultModel: string | null;
+  readonly systemPrompt: string | null;
+  readonly tools: readonly string[] | null;
+  readonly sortOrder: number;
+  readonly isDefault: boolean;
+  readonly disabledAt: string | null;
+  readonly createdAt: string;
+  readonly updatedAt: string;
+  readonly skillNames: readonly string[];
+}
+
+export interface AgentSkillRow {
+  readonly id: string;
+  readonly name: string;
+  readonly version: string;
+  readonly description: string | null;
+  readonly contentDigest: string;
+  readonly disabledAt: string | null;
+  readonly createdAt: string;
+  readonly updatedAt: string;
+  readonly boundRoleIds: readonly string[];
+}
+
 /**
  * Deep module for controlled host-console Agent configuration. It owns the
  * filesystem/DB ordering, Organization checks and role-skill composition so
@@ -13,43 +40,227 @@ const ROLE_ID_PATTERN = /^[a-z0-9][a-z0-9_-]{0,63}$/;
 export class OrganizationAgentConfiguration {
   constructor(
     private readonly prisma: PrismaClient,
-    private readonly skillStoreRoot: string,
+    private readonly skillStoreRoot: string | null,
   ) {}
 
+  async listRoles(input: { readonly organizationId: string }): Promise<readonly AgentRoleRow[]> {
+    await this.requireActiveOrganization(input.organizationId);
+    const roles = await this.prisma.organizationAgentRole.findMany({
+      where: { organizationId: input.organizationId, disabledAt: null },
+      orderBy: [{ sortOrder: "asc" }, { roleId: "asc" }],
+      include: {
+        skillBindings: {
+          orderBy: [{ sortOrder: "asc" }, { agentSkillId: "asc" }],
+          select: { skill: { select: { name: true, disabledAt: true } } },
+        },
+      },
+    });
+    return roles.map((role) => toRoleRow(role));
+  }
+
+  async listSkills(input: { readonly organizationId: string }): Promise<readonly AgentSkillRow[]> {
+    await this.requireActiveOrganization(input.organizationId);
+    const skills = await this.prisma.organizationAgentSkill.findMany({
+      where: { organizationId: input.organizationId, disabledAt: null },
+      orderBy: [{ name: "asc" }],
+      include: {
+        roleBindings: {
+          where: { role: { disabledAt: null } },
+          select: { role: { select: { roleId: true } } },
+        },
+      },
+    });
+    return skills.map((skill) => ({
+      id: skill.id,
+      name: skill.name,
+      version: skill.version,
+      description: skill.description,
+      contentDigest: skill.contentDigest,
+      disabledAt: skill.disabledAt === null ? null : skill.disabledAt.toISOString(),
+      createdAt: skill.createdAt.toISOString(),
+      updatedAt: skill.updatedAt.toISOString(),
+      boundRoleIds: skill.roleBindings.map((binding) => binding.role.roleId),
+    }));
+  }
+
   async installSkill(input: {
     readonly organizationId: string;
     readonly sourceDir: string;
     readonly version: string;
   }): Promise<{ readonly id: string; readonly name: string; readonly contentDigest: string }> {
+    const storeRoot = this.requireSkillStoreRoot();
     await this.requireActiveOrganization(input.organizationId);
     const version = nonEmpty(input.version, "skill version");
     const imported = await importSkillDirectory({
       sourceDir: input.sourceDir,
-      storeRoot: this.skillStoreRoot,
+      storeRoot,
     });
+    return this.commitInstalledSkill({
+      organizationId: input.organizationId,
+      imported,
+      version,
+      action: "agent_skill.installed",
+    });
+  }
+
+  /**
+   * Install or replace a skill from an in-memory file list (web upload path).
+   * Same content-addressed storage, same session archival semantics as
+   * `installSkill`; only the ingestion source differs.
+   */
+  async installSkillFromFiles(input: {
+    readonly organizationId: string;
+    readonly files: readonly SkillFileInput[];
+    readonly version: string;
+  }): Promise<{ readonly id: string; readonly name: string; readonly contentDigest: string }> {
+    const storeRoot = this.requireSkillStoreRoot();
+    await this.requireActiveOrganization(input.organizationId);
+    const version = nonEmpty(input.version, "skill version");
+    const imported = await importSkillFromFiles({
+      files: input.files,
+      storeRoot,
+    });
+    return this.commitInstalledSkill({
+      organizationId: input.organizationId,
+      imported,
+      version,
+      action: "agent_skill.installed",
+    });
+  }
+
+  /**
+   * Read all files from the stored skill version identified by content digest.
+   * Returns UTF-8 content for each file; the web editor uses this to populate
+   * its file tree.
+   */
+  async readSkillFiles(input: {
+    readonly organizationId: string;
+    readonly contentDigest: string;
+  }): Promise<readonly SkillFileOutput[]> {
+    const storeRoot = this.requireSkillStoreRoot();
+    await this.requireActiveOrganization(input.organizationId);
+    const skill = await this.prisma.organizationAgentSkill.findFirst({
+      where: {
+        organizationId: input.organizationId,
+        contentDigest: input.contentDigest,
+      },
+      select: { id: true, disabledAt: true },
+    });
+    if (skill === null) {
+      throw new Error(`skill not found in organization for digest: ${input.contentDigest}`);
+    }
+    return readSkillFiles({
+      storeRoot,
+      contentDigest: input.contentDigest,
+    });
+  }
+
+  /**
+   * Disable a skill (soft-delete). Sets `disabledAt` and archives active
+   * sessions of every role bound to this skill, since the execution surface
+   * changes when a bound skill disappears.
+   */
+  async disableSkill(input: { readonly organizationId: string; readonly name: string }): Promise<void> {
+    await this.requireActiveOrganization(input.organizationId);
+    await this.prisma.$transaction(async (tx) => {
+      const skill = await tx.organizationAgentSkill.findUnique({
+        where: { organizationId_name: { organizationId: input.organizationId, name: input.name } },
+        select: { id: true, disabledAt: true, roleBindings: { select: { role: { select: { roleId: true } } } } },
+      });
+      if (skill === null) throw new Error(`active skill not found in organization: ${input.name}`);
+      if (skill.disabledAt !== null) return;
+      await tx.organizationAgentSkill.update({
+        where: { id: skill.id },
+        data: { disabledAt: new Date() },
+      });
+      await archiveRoleSessions(
+        tx,
+        input.organizationId,
+        skill.roleBindings.map((binding) => binding.role.roleId),
+      );
+      await tx.auditEntry.create({
+        data: {
+          organizationId: input.organizationId,
+          action: "agent_skill.disabled",
+          metadata: { name: input.name },
+        },
+      });
+    });
+  }
+
+  /**
+   * Update only the `description` label of a skill. This is a label change,
+   * not an execution-surface change — no session archival (ADR-0017).
+   */
+  async updateSkillDescription(input: {
+    readonly organizationId: string;
+    readonly name: string;
+    readonly description: string;
+  }): Promise<void> {
+    await this.requireActiveOrganization(input.organizationId);
+    const description = input.description.trim();
+    await this.prisma.$transaction(async (tx) => {
+      const skill = await tx.organizationAgentSkill.findUnique({
+        where: { organizationId_name: { organizationId: input.organizationId, name: input.name } },
+        select: { id: true, disabledAt: true },
+      });
+      if (skill === null || skill.disabledAt !== null) {
+        throw new Error(`active skill not found in organization: ${input.name}`);
+      }
+      await tx.organizationAgentSkill.update({
+        where: { id: skill.id },
+        data: { description: description === "" ? null : description },
+      });
+      await tx.auditEntry.create({
+        data: {
+          organizationId: input.organizationId,
+          action: "agent_skill.description_updated",
+          metadata: { name: input.name, description: description === "" ? null : description },
+        },
+      });
+    });
+  }
+
+  private requireSkillStoreRoot(): string {
+    if (this.skillStoreRoot === null) {
+      throw new Error("skill store root is not configured for this OrganizationAgentConfiguration");
+    }
+    return this.skillStoreRoot;
+  }
+
+  /**
+   * Shared DB commit for an imported skill: upsert the skill record, archive
+   * affected sessions if the content digest changed, and write an audit entry.
+   */
+  private async commitInstalledSkill(input: {
+    readonly organizationId: string;
+    readonly imported: { readonly name: string; readonly description: string | undefined; readonly contentDigest: string };
+    readonly version: string;
+    readonly action: string;
+  }): Promise<{ readonly id: string; readonly name: string; readonly contentDigest: string }> {
     return this.prisma.$transaction(async (tx) => {
       const previous = await tx.organizationAgentSkill.findUnique({
-        where: { organizationId_name: { organizationId: input.organizationId, name: imported.name } },
+        where: { organizationId_name: { organizationId: input.organizationId, name: input.imported.name } },
         select: { contentDigest: true },
       });
       const skill = await tx.organizationAgentSkill.upsert({
         where: {
           organizationId_name: {
             organizationId: input.organizationId,
-            name: imported.name,
+            name: input.imported.name,
           },
         },
         create: {
           organizationId: input.organizationId,
-          name: imported.name,
-          version,
-          description: imported.description ?? null,
-          contentDigest: imported.contentDigest,
+          name: input.imported.name,
+          version: input.version,
+          description: input.imported.description ?? null,
+          contentDigest: input.imported.contentDigest,
         },
         update: {
-          version,
-          description: imported.description ?? null,
-          contentDigest: imported.contentDigest,
+          version: input.version,
+          description: input.imported.description ?? null,
+          contentDigest: input.imported.contentDigest,
           disabledAt: null,
         },
         select: {
@@ -69,10 +280,10 @@ export class OrganizationAgentConfiguration {
       await tx.auditEntry.create({
         data: {
           organizationId: input.organizationId,
-          action: "agent_skill.installed",
+          action: input.action,
           metadata: {
             name: skill.name,
-            version,
+            version: input.version,
             contentDigest: skill.contentDigest,
           },
         },
@@ -89,7 +300,8 @@ export class OrganizationAgentConfiguration {
     readonly systemPrompt?: string | null | undefined;
     readonly tools?: readonly string[] | null | undefined;
     readonly sortOrder?: number | undefined;
-  }): Promise<{ readonly id: string; readonly roleId: string }> {
+    readonly isDefault?: boolean | undefined;
+  }): Promise<AgentRoleRow> {
     await this.requireActiveOrganization(input.organizationId);
     if (!ROLE_ID_PATTERN.test(input.roleId)) throw new Error(`invalid role id: ${input.roleId}`);
     const label = nonEmpty(input.label, "role label");
@@ -107,8 +319,22 @@ export class OrganizationAgentConfiguration {
     return this.prisma.$transaction(async (tx) => {
       const previous = await tx.organizationAgentRole.findUnique({
         where: { organizationId_roleId: { organizationId: input.organizationId, roleId: input.roleId } },
-        select: { defaultModel: true, systemPrompt: true, tools: true },
+        select: { defaultModel: true, systemPrompt: true, tools: true, isDefault: true },
       });
+      const currentDefault = await tx.organizationAgentRole.findFirst({
+        where: { organizationId: input.organizationId, isDefault: true, disabledAt: null },
+        select: { id: true },
+      });
+      const effectiveIsDefault = input.isDefault ?? previous?.isDefault ?? (currentDefault === null);
+      if (input.isDefault === false && previous?.isDefault === true) {
+        throw new Error("cannot unset the active default role without selecting a replacement");
+      }
+      if (effectiveIsDefault) {
+        await tx.organizationAgentRole.updateMany({
+          where: { organizationId: input.organizationId, isDefault: true },
+          data: { isDefault: false },
+        });
+      }
       const role = await tx.organizationAgentRole.upsert({
         where: {
           organizationId_roleId: {
@@ -124,6 +350,7 @@ export class OrganizationAgentConfiguration {
           systemPrompt: normalizeOptionalText(input.systemPrompt),
           tools: createTools,
           sortOrder,
+          isDefault: effectiveIsDefault,
         },
         update: {
           label,
@@ -131,15 +358,27 @@ export class OrganizationAgentConfiguration {
           ...(input.systemPrompt !== undefined ? { systemPrompt: normalizeOptionalText(input.systemPrompt) } : {}),
           ...(updateTools !== undefined ? { tools: updateTools } : {}),
           sortOrder,
+          isDefault: effectiveIsDefault,
           disabledAt: null,
         },
-        select: { id: true, roleId: true },
+        include: {
+          skillBindings: {
+            orderBy: [{ sortOrder: "asc" }, { agentSkillId: "asc" }],
+            select: { skill: { select: { name: true, disabledAt: true } } },
+          },
+        },
       });
       const executionSurfaceChanged = previous !== null && (
         (input.defaultModel !== undefined && normalizeOptionalText(input.defaultModel) !== previous.defaultModel) ||
         (input.systemPrompt !== undefined && normalizeOptionalText(input.systemPrompt) !== previous.systemPrompt) ||
         (input.tools !== undefined && JSON.stringify(input.tools) !== JSON.stringify(previous.tools))
       );
+      const activeDefaultCount = await tx.organizationAgentRole.count({
+        where: { organizationId: input.organizationId, isDefault: true, disabledAt: null },
+      });
+      if (activeDefaultCount !== 1) {
+        throw new Error(`organization ${input.organizationId} must have exactly one active default role`);
+      }
       if (executionSurfaceChanged) await archiveRoleSessions(tx, input.organizationId, [input.roleId]);
       await tx.auditEntry.create({
         data: {
@@ -154,10 +393,12 @@ export class OrganizationAgentConfiguration {
               : normalizeOptionalText(input.systemPrompt) !== null,
             tools: input.tools === undefined ? "unchanged" : input.tools === null ? "all" : [...input.tools],
             sortOrder,
+            isDefault: effectiveIsDefault,
+            defaultExplicit: input.isDefault !== undefined,
           },
         },
       });
-      return role;
+      return toRoleRow(role);
     });
   }
 
@@ -237,14 +478,26 @@ async function archiveRoleSessions(
   roleIds: readonly string[],
 ): Promise<void> {
   if (roleIds.length === 0) return;
-  await tx.agentSession.updateMany({
+  const sessions = await tx.agentSession.findMany({
     where: {
       roleId: { in: [...new Set(roleIds)] },
-      archivedAt: null,
       project: { organizationId },
     },
-    data: { archivedAt: new Date() },
+    select: { id: true, archivedAt: true, metadata: true },
   });
+  const archivedAt = new Date();
+  for (const session of sessions) {
+    const metadata = typeof session.metadata === "object" && session.metadata !== null && !Array.isArray(session.metadata)
+      ? session.metadata as Prisma.JsonObject
+      : {};
+    await tx.agentSession.update({
+      where: { id: session.id },
+      data: {
+        ...(session.archivedAt === null ? { archivedAt } : {}),
+        metadata: { ...metadata, userResumable: false },
+      },
+    });
+  }
 }
 
 function nonEmpty(value: string, label: string): string {
@@ -258,3 +511,43 @@ function normalizeOptionalText(value: string | null | undefined): string | null
   const normalized = value.trim();
   return normalized === "" ? null : normalized;
 }
+
+function parseTools(value: Prisma.JsonValue): readonly string[] | null {
+  if (value === null) return null;
+  if (!Array.isArray(value)) return null;
+  return value.filter((t): t is string => typeof t === "string");
+}
+
+function toRoleRow(role: {
+  readonly id: string;
+  readonly roleId: string;
+  readonly label: string;
+  readonly defaultModel: string | null;
+  readonly systemPrompt: string | null;
+  readonly tools: Prisma.JsonValue;
+  readonly sortOrder: number;
+  readonly isDefault: boolean;
+  readonly disabledAt: Date | null;
+  readonly createdAt: Date;
+  readonly updatedAt: Date;
+  readonly skillBindings: ReadonlyArray<{
+    readonly skill: { readonly name: string; readonly disabledAt: Date | null };
+  }>;
+}): AgentRoleRow {
+  return {
+    id: role.id,
+    roleId: role.roleId,
+    label: role.label,
+    defaultModel: role.defaultModel,
+    systemPrompt: role.systemPrompt,
+    tools: parseTools(role.tools),
+    sortOrder: role.sortOrder,
+    isDefault: role.isDefault,
+    disabledAt: role.disabledAt === null ? null : role.disabledAt.toISOString(),
+    createdAt: role.createdAt.toISOString(),
+    updatedAt: role.updatedAt.toISOString(),
+    skillNames: role.skillBindings
+      .filter((binding) => binding.skill.disabledAt === null)
+      .map((binding) => binding.skill.name),
+  };
+}

hub/src/agent/models.ts

@@ -12,8 +12,8 @@
  * A named role preset — the full per-run agent bundle. Roles are **data**, not
  * a code enum: admin/teachers define them (ADR-0017: role-based routing is
  * product config, not a spec invariant). `roleId` is an opaque string and
- * doubles as the slash-command name (`/draft ...`) — the registry holds the
- * role set, so new roles are added by configuration, not by editing code.
+ * is selected through the project console — the registry holds the role set,
+ * so new roles are added by configuration, not by editing code.
  *
  * A role bundles everything that distinguishes one agent persona from another:
  * model, system prompt, and the tool surface (files / cph / feishu / skills /

hub/src/agent/roleTools.ts

@@ -1,4 +1,12 @@
-export const DEFAULT_CLAUDE_BUILT_IN_TOOLS = ["Read", "Write", "Bash", "Glob", "Grep"] as const;
+export const DEFAULT_CLAUDE_BUILT_IN_TOOLS = [
+  "Read",
+  "Write",
+  "Bash",
+  "Glob",
+  "Grep",
+  "WebFetch",
+  "WebSearch",
+] as const;
 
 export const CPH_HUB_MCP_SERVER_NAME = "cph_hub";
 export const CPH_HUB_MCP_TOOL_IDS = [
@@ -26,11 +34,15 @@ const ROLE_TOOL_TO_CLAUDE_BUILT_INS = new Map<string, readonly string[]>([
   // would need a separate command-policy layer.
   ["cph_check", ["Bash"]],
   ["cph_build", ["Bash"]],
+  ["web_fetch", ["WebFetch"]],
+  ["web_search", ["WebSearch"]],
   ["Read", ["Read"]],
   ["Write", ["Write"]],
   ["Bash", ["Bash"]],
   ["Glob", ["Glob"]],
   ["Grep", ["Grep"]],
+  ["WebFetch", ["WebFetch"]],
+  ["WebSearch", ["WebSearch"]],
 ]);
 
 const ROLE_TOOL_TO_CPH_HUB_MCP_TOOL = new Map<string, CphHubMcpToolId>([

hub/src/agent/runner.ts

@@ -293,6 +293,9 @@ export async function runAgent(req: RunRequest): Promise<RunResult> {
         case "result": {
           const result = message as SDKResultMessage;
           sdkSessionId = result.session_id;
+          if (result.subtype === "success" && fullText === "" && typeof result.result === "string") {
+            fullText = result.result;
+          }
           costUsd = Number.isFinite(result.total_cost_usd) ? result.total_cost_usd : undefined;
           if (result.subtype !== "success") {
             error = `result_${result.subtype}`;

hub/src/agent/skillStore.ts

@@ -34,40 +34,134 @@ export async function importSkillDirectory(input: {
   readonly sourceDir: string;
   readonly storeRoot: string;
 }): Promise<ImportedSkillContent> {
-  const source = await inspectSkillDirectory(input.sourceDir);
+  return commitSkillContent({
+    storeRoot: input.storeRoot,
+    prepare: async (dir) => {
+      await cp(input.sourceDir, dir, { recursive: true, force: false, errorOnExist: true });
+      return inspectSkillDirectory(dir);
+    },
+  });
+}
+
+/**
+ * Import a skill from an in-memory file list (web upload path). Each file
+ * path is relative to the skill root and must be a simple relative path
+ * (no absolute, no `..`). A `SKILL.md` manifest is required.
+ */
+export async function importSkillFromFiles(input: {
+  readonly files: readonly SkillFileInput[];
+  readonly storeRoot: string;
+}): Promise<ImportedSkillContent> {
+  const seen = new Set<string>();
+  for (const file of input.files) {
+    validateSkillFilePath(file.path);
+    if (seen.has(file.path)) throw new Error(`duplicate skill file path: ${file.path}`);
+    seen.add(file.path);
+  }
+  return commitSkillContent({
+    storeRoot: input.storeRoot,
+    prepare: async (dir) => {
+      for (const file of input.files) {
+        const dest = join(dir, file.path);
+        const parent = join(dest, "..");
+        await mkdir(parent, { recursive: true, mode: 0o750 });
+        await writeFile(dest, file.bytes, { mode: 0o640 });
+      }
+      return inspectSkillDirectory(dir);
+    },
+  });
+}
+
+/**
+ * Read all files from a stored skill version (by content digest). Returns
+ * relative paths and UTF-8 decoded content for the web editor.
+ */
+export async function readSkillFiles(input: {
+  readonly storeRoot: string;
+  readonly contentDigest: string;
+}): Promise<readonly SkillFileOutput[]> {
+  if (!DIGEST_PATTERN.test(input.contentDigest)) {
+    throw new Error(`invalid content digest: ${input.contentDigest}`);
+  }
+  const dir = join(input.storeRoot, "versions", input.contentDigest);
+  const files: Array<{ readonly path: string; readonly bytes: Buffer }> = [];
+  await walk(resolve(dir), resolve(dir), files);
+  return files.sort((a, b) => a.path.localeCompare(b.path)).map((f) => ({
+    path: f.path,
+    content: f.bytes.toString("utf8"),
+  }));
+}
+
+export interface SkillFileInput {
+  readonly path: string;
+  readonly bytes: Buffer;
+}
+
+export interface SkillFileOutput {
+  readonly path: string;
+  readonly content: string;
+}
+
+/**
+ * Shared commit logic: populate a temp dir, inspect it, deduplicate against
+ * an existing `versions/<digest>/` destination, and atomically rename.
+ *
+ * `prepare(dir)` writes the skill content into `dir` and returns the inspected
+ * result (name, description, contentDigest). The caller owns the write;
+ * commitSkillContent owns the move.
+ */
+async function commitSkillContent(input: {
+  readonly storeRoot: string;
+  readonly prepare: (dir: string) => Promise<ImportedSkillContent>;
+}): Promise<ImportedSkillContent> {
   const versionsRoot = join(input.storeRoot, "versions");
   await mkdir(versionsRoot, { recursive: true, mode: 0o750 });
+  const temporary = join(versionsRoot, `.tmp-${randomUUID()}`);
+
+  let source: ImportedSkillContent;
+  try {
+    source = await input.prepare(temporary);
+  } catch (error) {
+    await rm(temporary, { recursive: true, force: true });
+    throw error;
+  }
+
   const destination = join(versionsRoot, source.contentDigest);
 
+  // If the destination already exists with identical content, reuse it.
   try {
     const existing = await inspectSkillDirectory(destination);
     if (existing.contentDigest !== source.contentDigest || existing.name !== source.name) {
       throw new Error(`stored skill content digest mismatch: ${source.name}`);
     }
+    await rm(temporary, { recursive: true, force: true });
     return source;
   } catch (error) {
     if (!isMissingPath(error)) throw error;
   }
 
-  const temporary = join(versionsRoot, `.tmp-${randomUUID()}`);
   try {
-    await cp(input.sourceDir, temporary, { recursive: true, force: false, errorOnExist: true });
-    const copied = await inspectSkillDirectory(temporary);
-    if (copied.contentDigest !== source.contentDigest || copied.name !== source.name) {
-      throw new Error(`skill changed while importing: ${source.name}`);
-    }
     await rename(temporary, destination);
   } catch (error) {
     await rm(temporary, { recursive: true, force: true });
     if (isDestinationExists(error)) {
       const existing = await inspectSkillDirectory(destination);
-      if (existing.contentDigest === source.contentDigest && existing.name === source.name) return source;
+      if (existing.contentDigest === source.contentDigest && existing.name === source.name) {
+        return source;
+      }
     }
     throw error;
   }
   return source;
 }
 
+function validateSkillFilePath(path: string): void {
+  if (path === "") throw new Error("skill file path is empty");
+  if (path.startsWith("/")) throw new Error(`skill file path must be relative: ${path}`);
+  if (path.includes("..")) throw new Error(`skill file path must not escape: ${path}`);
+  if (path.startsWith("\\")) throw new Error(`skill file path must be relative: ${path}`);
+}
+
 export async function prepareRunSkillPlugin(input: {
   readonly storeRoot: string;
   readonly runId: string;

hub/src/capacity/ceilings.ts

@@ -0,0 +1,78 @@
+/**
+ * ADR-0022 platform ceilings (spec `LayeredLimit.platformCeiling`).
+ *
+ * Platform ceilings are the unbreakable upper bounds; org policy may only
+ * configure lower limits (see `LayeredLimit.Valid`). Exact numeric values are
+ * `OPEN` per spec and calibrated by capacity testing — this module is the
+ * single place to wire them.
+ *
+ * Seven dimensions are sourced from existing runtime env vars
+ * (`HUB_HTTP_BODY_LIMIT_BYTES`, `HUB_MAX_FILES_PER_MESSAGE`, `HUB_MAX_FILE_BYTES`,
+ * `HUB_HTTP_REQUESTS_PER_MINUTE`, `HUB_AGENT_MAX_CONCURRENT_RUNS`,
+ * `HUB_AGENT_MAX_RUN_SECONDS`, `HUB_AGENT_MAX_TURNS`). The remaining dimensions
+ * are sourced from `HUB_CEILING_<DIMENSION>` env vars; until those are set the
+ * dimension has no configured ceiling and the policy UI surfaces it as
+ * "未配置" (cannot enforce a limit without a ceiling).
+ */
+import type { CapacityDimension } from "./dimensions.js";
+
+function positiveIntEnv(name: string): number | undefined {
+  const raw = process.env[name];
+  if (raw === undefined || raw === "") return undefined;
+  const n = Number.parseInt(raw, 10);
+  return Number.isFinite(n) && n > 0 ? n : undefined;
+}
+
+const ENV_BACKED_CEILINGS: Partial<Record<CapacityDimension, string>> = {
+  requestBodySize: "HUB_HTTP_BODY_LIMIT_BYTES",
+  attachmentCount: "HUB_MAX_FILES_PER_MESSAGE",
+  fileSize: "HUB_MAX_FILE_BYTES",
+  requestRate: "HUB_HTTP_REQUESTS_PER_MINUTE",
+  agentConcurrency: "HUB_AGENT_MAX_CONCURRENT_RUNS",
+  runWallTime: "HUB_AGENT_MAX_RUN_SECONDS",
+  runTurns: "HUB_AGENT_MAX_TURNS",
+};
+
+const CEILING_DIMENSIONS: readonly CapacityDimension[] = [
+  "requestRate",
+  "requestBodySize",
+  "agentConcurrency",
+  "admissionQueueLength",
+  "admissionQueueWait",
+  "fileSize",
+  "attachmentCount",
+  "archiveExpansion",
+  "projectStorage",
+  "organizationStorage",
+  "memberCount",
+  "projectCount",
+  "teamCount",
+  "folderCount",
+  "sessionCount",
+  "runWallTime",
+  "runTurns",
+  "runToolCalls",
+  "toolWallTime",
+  "runOutputSize",
+  "processMemory",
+  "processCpu",
+  "processCount",
+];
+
+function envNameFor(dimension: CapacityDimension): string {
+  return ENV_BACKED_CEILINGS[dimension] ?? `HUB_CEILING_${dimension.toUpperCase()}`;
+}
+
+/**
+ * Returns the configured platform ceilings (only the dimensions currently
+ * wired via env). Unconfigured dimensions are absent — callers must surface
+ * them, not assume unlimited (spec `LayeredLimit` forbids unlimited ceilings).
+ */
+export function readPlatformCeilings(): Partial<Record<CapacityDimension, number>> {
+  const ceilings: Partial<Record<CapacityDimension, number>> = {};
+  for (const dimension of CEILING_DIMENSIONS) {
+    const value = positiveIntEnv(envNameFor(dimension));
+    if (value !== undefined) ceilings[dimension] = value;
+  }
+  return ceilings;
+}

hub/src/capacity/dimensions.ts

@@ -0,0 +1,63 @@
+/**
+ * ADR-0022 capacity dimensions (spec `Spec.System.Capacity.CapacityDimension`).
+ * The 23 PINNED dimensions; exact numeric ceilings are `OPEN` and calibrated by
+ * capacity testing. This module is the single source of the dimension set shared
+ * by the platform-ceiling config and the org capacity-policy service.
+ */
+export const CAPACITY_DIMENSIONS = [
+  "requestRate",
+  "requestBodySize",
+  "agentConcurrency",
+  "admissionQueueLength",
+  "admissionQueueWait",
+  "fileSize",
+  "attachmentCount",
+  "archiveExpansion",
+  "projectStorage",
+  "organizationStorage",
+  "memberCount",
+  "projectCount",
+  "teamCount",
+  "folderCount",
+  "sessionCount",
+  "runWallTime",
+  "runTurns",
+  "runToolCalls",
+  "toolWallTime",
+  "runOutputSize",
+  "processMemory",
+  "processCpu",
+  "processCount",
+] as const;
+
+export type CapacityDimension = (typeof CAPACITY_DIMENSIONS)[number];
+
+export const CAPACITY_DIMENSION_LABELS: Record<CapacityDimension, string> = {
+  requestRate: "HTTP 请求速率",
+  requestBodySize: "请求体大小",
+  agentConcurrency: "智能体并发",
+  admissionQueueLength: "接纳队列长度",
+  admissionQueueWait: "接纳队列等待",
+  fileSize: "单文件大小",
+  attachmentCount: "每消息附件数",
+  archiveExpansion: "归档展开",
+  projectStorage: "项目存储",
+  organizationStorage: "组织存储",
+  memberCount: "成员数",
+  projectCount: "项目数",
+  teamCount: "团队数",
+  folderCount: "文件夹数",
+  sessionCount: "会话数",
+  runWallTime: "单次运行墙钟",
+  runTurns: "单次运行轮次",
+  runToolCalls: "单次运行工具调用",
+  toolWallTime: "工具墙钟",
+  runOutputSize: "运行输出大小",
+  processMemory: "进程内存",
+  processCpu: "进程 CPU",
+  processCount: "进程数",
+};
+
+export function isCapacityDimension(value: string): value is CapacityDimension {
+  return (CAPACITY_DIMENSIONS as readonly string[]).includes(value);
+}

hub/src/connections/providerModelCatalog.ts

@@ -0,0 +1,144 @@
+/**
+ * Provider model catalog: fetches the list of models available to an
+ * Organization from its ACTIVE provider connection (OpenRouter), with an
+ * in-memory TTL cache so the admin model picker stays responsive without
+ * hammering the upstream API on every page load.
+ *
+ * The model list is **derived** from the provider connection — there is no
+ * separate model table to maintain. When an org activates a provider, its
+ * models become selectable; when the provider is disabled, the list empties.
+ */
+import type { PrismaClient } from "@prisma/client";
+import type { LocalSecretEnvelope } from "../security/secretEnvelope.js";
+import { decryptStoredProviderCredential } from "./providerConnections.js";
+
+/** A model entry surfaced to the admin model picker. */
+export interface ProviderModelEntry {
+  readonly id: string;
+  readonly label: string;
+  readonly toolCapable: boolean;
+}
+
+/** A model entry as returned by OpenRouter's /v1/models endpoint. */
+interface OpenRouterModel {
+  readonly id: string;
+  readonly name: string;
+  readonly supported_parameters: readonly string[];
+}
+
+interface OpenRouterModelsResponse {
+  readonly data: readonly OpenRouterModel[];
+}
+
+/** Cache entry: models + expiry timestamp. */
+interface CacheEntry {
+  readonly models: readonly ProviderModelEntry[];
+  readonly expiresAt: number;
+}
+
+const DEFAULT_TTL_MS = 5 * 60 * 1000; // 5 minutes
+
+/**
+ * Per-organization model catalog cache. Keyed by organizationId so that
+ * multiple orgs in the same Silo don't cross-pollute. The cache is intentionally
+ * process-local: it survives for the lifetime of the Hub process and is
+ * invalidated by TTL, not by DB events. A cache miss re-fetches from the
+ * provider API.
+ */
+export class ProviderModelCatalog {
+  private readonly cache = new Map<string, CacheEntry>();
+  private readonly fetchImpl: typeof fetch;
+
+  constructor(
+    private readonly prisma: PrismaClient,
+    private readonly secrets: LocalSecretEnvelope,
+    private readonly ttlMs: number = DEFAULT_TTL_MS,
+    fetchImpl: typeof fetch = fetch,
+  ) {
+    this.fetchImpl = fetchImpl;
+  }
+
+  /**
+   * List tool-capable models available to the organization's ACTIVE provider
+   * connection. Returns cached results when fresh; otherwise fetches from the
+   * provider API. Falls back to an empty list (not an error) when the org has
+   * no ACTIVE provider — the admin sees the env-default model from the
+   * separate env fallback in the route.
+   */
+  async listModels(organizationId: string): Promise<readonly ProviderModelEntry[]> {
+    const cached = this.cache.get(organizationId);
+    if (cached !== undefined && cached.expiresAt > Date.now()) {
+      return cached.models;
+    }
+
+    const credential = await this.resolveActiveProviderCredential(organizationId);
+    if (credential === null) return [];
+
+    const models = await this.fetchModelsFromProvider(credential);
+    this.cache.set(organizationId, {
+      models,
+      expiresAt: Date.now() + this.ttlMs,
+    });
+    return models;
+  }
+
+  /** Force a cache invalidation (e.g. after provider connection changes). */
+  invalidate(organizationId: string): void {
+    this.cache.delete(organizationId);
+  }
+
+  private async resolveActiveProviderCredential(
+    organizationId: string,
+  ): Promise<{ readonly baseUrl: string; readonly authToken: string; readonly anthropicApiKey: string } | null> {
+    const connection = await this.prisma.organizationProviderConnection.findFirst({
+      where: { organizationId, status: "ACTIVE" },
+      include: { activeSecretVersion: true },
+    });
+    const version = connection?.activeSecretVersion;
+    if (connection === null || version === null || version === undefined || version.retiredAt !== null) {
+      return null;
+    }
+    const payload = decryptStoredProviderCredential(this.secrets, {
+      organizationId,
+      connectionId: connection.id,
+      providerId: connection.providerId,
+      secretVersionId: version.id,
+      envelopeVersion: version.envelopeVersion,
+      keyId: version.keyId,
+      envelope: version.envelope,
+    });
+    return {
+      baseUrl: payload.baseUrl,
+      authToken: payload.authToken,
+      anthropicApiKey: payload.anthropicApiKey,
+    };
+  }
+
+  private async fetchModelsFromProvider(
+    credential: { readonly baseUrl: string; readonly authToken: string; readonly anthropicApiKey: string },
+  ): Promise<readonly ProviderModelEntry[]> {
+    const base = credential.baseUrl.endsWith("/") ? credential.baseUrl : `${credential.baseUrl}/`;
+    // Filter to models that support tool calling — the agent runner requires it.
+    const url = new URL("v1/models?supported_parameters=tools", base);
+    const headers: Record<string, string> = {
+      authorization: `Bearer ${credential.authToken}`,
+      accept: "application/json",
+    };
+    if (credential.anthropicApiKey !== "") headers["x-api-key"] = credential.anthropicApiKey;
+
+    const response = await this.fetchImpl(url, {
+      method: "GET",
+      headers,
+      signal: AbortSignal.timeout(15_000),
+    });
+    if (!response.ok) {
+      throw new Error(`provider models request failed: status ${response.status}`);
+    }
+    const body = (await response.json()) as OpenRouterModelsResponse;
+    return body.data.map((m) => ({
+      id: m.id,
+      label: m.name,
+      toolCapable: m.supported_parameters.includes("tools"),
+    }));
+  }
+}

hub/src/deployment/agent-config-cli.ts

@@ -47,6 +47,7 @@ async function main(argv: readonly string[]): Promise<void> {
           : {}),
         ...(tools !== undefined ? { tools } : {}),
         ...(sortOrderRaw !== undefined ? { sortOrder: integer(sortOrderRaw, "sort-order") } : {}),
+        ...(options.has("default") ? { isDefault: boolean(options.get("default")!, "default") } : {}),
       });
       console.log(JSON.stringify(role));
       return;
@@ -79,6 +80,7 @@ async function main(argv: readonly string[]): Promise<void> {
         systemPromptConfigured: role.systemPrompt !== null,
         tools: role.tools,
         disabled: role.disabledAt !== null,
+        default: role.isDefault,
         skills: role.skillBindings.map((binding) => ({
           name: binding.skill.name,
           version: binding.skill.version,
@@ -138,10 +140,16 @@ function integer(raw: string, name: string): number {
   return value;
 }
 
+function boolean(raw: string, name: string): boolean {
+  if (raw === "true") return true;
+  if (raw === "false") return false;
+  throw new Error(`--${name} must be true or false`);
+}
+
 function printHelp(): void {
   console.log(`Usage:
   agent-config install-skill --organization ORG --source DIR --version VERSION
-  agent-config upsert-role --organization ORG --role ID --label LABEL [--model MODEL] [--system-prompt-file FILE] [--tools-json JSON] [--sort-order N]
+  agent-config upsert-role --organization ORG --role ID --label LABEL [--model MODEL] [--system-prompt-file FILE] [--tools-json JSON] [--sort-order N] [--default true|false]
   agent-config set-role-skills --organization ORG --role ID --skills name,name
   agent-config list --organization ORG
   agent-config verify-store --organization ORG`);

hub/src/deployment/bootstrap-silo.ts

@@ -233,6 +233,7 @@ async function initializeSilo(
           roleId: "draft",
           label: "草稿",
           sortOrder: 10,
+          isDefault: true,
         },
         {
           organizationId: input.organization.id,

hub/src/deployment/legacy-project-import-cli.ts

@@ -0,0 +1,48 @@
+import { readFile } from "node:fs/promises";
+import { prisma } from "../db.js";
+import { importLegacyProjects, type LegacyProjectManifestEntry } from "./legacyProjectImport.js";
+import { readSiloOrganizationId } from "./silo.js";
+
+async function main(argv: readonly string[]): Promise<void> {
+  const options = parseOptions(argv);
+  const organizationId = readSiloOrganizationId();
+  const manifest = JSON.parse(await readFile(required(options, "manifest"), "utf8")) as unknown;
+  if (!Array.isArray(manifest)) throw new Error("legacy import manifest must be a JSON array");
+  const state = await importLegacyProjects({
+    prisma,
+    organizationId,
+    actorFeishuOpenId: required(options, "actor-open-id"),
+    workspaceRoot: required(options, "workspace-root"),
+    sourceRoot: required(options, "source-root"),
+    stateFile: required(options, "state-file"),
+    projects: manifest as LegacyProjectManifestEntry[],
+    onProgress: (message) => console.error(`[legacy-import] ${message}`),
+  });
+  console.log(JSON.stringify({ imported: Object.keys(state.projects).length }));
+}
+
+function parseOptions(args: readonly string[]): Map<string, string> {
+  const options = new Map<string, string>();
+  for (let index = 0; index < args.length; index += 2) {
+    const flag = args[index];
+    const value = args[index + 1];
+    if (flag === undefined || !flag.startsWith("--") || value === undefined) {
+      throw new Error(`expected --name value, got: ${args.slice(index).join(" ")}`);
+    }
+    options.set(flag.slice(2), value);
+  }
+  return options;
+}
+
+function required(options: ReadonlyMap<string, string>, name: string): string {
+  const value = options.get(name)?.trim();
+  if (!value) throw new Error(`--${name} is required`);
+  return value;
+}
+
+main(process.argv.slice(2))
+  .catch((error) => {
+    console.error(error instanceof Error ? error.message : String(error));
+    process.exitCode = 1;
+  })
+  .finally(async () => prisma.$disconnect());