fix(ci): sync npm lockfiles so fleet deploy npm ci succeeds

Hub and admin-web package-lock.json were missing @emnapi/* entries that
npm 11 on the Alpha host requires, so deploy_fleet_release failed at
npm ci. Regenerate both lockfiles and retry incomplete release trees.

.gitea/workflows/deploy-admin.yml

@@ -0,0 +1,126 @@
+name: deploy admin (hub fleet)
+
+# Rolls Hub releases that include the org-admin SPA (`admin-web` → registerStaticSpa)
+# onto the managed Alpha host. Two fleets share one machine and are separated by
+# the middle DNS label of each Silo's public URL:
+#
+#   dev  → https://<slug>.educraft-dev.paradigm-edu.net   (every push + PR)
+#   prod → https://<slug>.educraft.paradigm-edu.net       (main + tags)
+#
+# Example prod tenant:
+#   https://para-26071100.educraft.paradigm-edu.net/auth/feishu/para-26071100
+#
+# Required Gitea secret:
+#   DEPLOY_SSH_KEY  — private key for root@39.107.254.4
+#
+# Optional secrets / vars (defaults match NEW_SILO_RUNBOOK):
+#   DEPLOY_HOST, DEPLOY_USER, DEPLOY_SSH_PORT, DEPLOY_BASE
+#   vars.ALLOW_EMPTY_FLEET=1  — green when the fleet has no silos yet
+
+on:
+  push:
+    paths:
+      - "hub/**"
+      - ".gitea/workflows/deploy-admin.yml"
+  pull_request:
+    paths:
+      - "hub/**"
+      - ".gitea/workflows/deploy-admin.yml"
+  workflow_dispatch:
+    inputs:
+      fleet:
+        description: "Which fleet to deploy (dev | prod | both)"
+        required: true
+        default: both
+      allow_empty_fleet:
+        description: "Succeed if no silo matches (1/0)"
+        required: false
+        default: "0"
+
+concurrency:
+  group: deploy-admin-host
+  cancel-in-progress: false
+
+jobs:
+  deploy-dev:
+    name: deploy fleet dev (educraft-dev)
+    runs-on: ubuntu-latest
+    if: >
+      github.event_name == 'pull_request' ||
+      (github.event_name == 'push' && !startsWith(github.ref, 'refs/tags/')) ||
+      (github.event_name == 'workflow_dispatch' &&
+        (github.event.inputs.fleet == 'dev' || github.event.inputs.fleet == 'both'))
+    steps:
+      - uses: actions/checkout@v5
+
+      - name: Install rsync + ssh
+        run: sudo apt-get update && sudo apt-get install -y rsync openssh-client
+
+      - name: Deploy Hub + admin SPA to educraft-dev fleet
+        env:
+          CPH_FLEET: dev
+          PLATFORM_DEPLOY_HOST: ${{ secrets.DEPLOY_HOST }}
+          PLATFORM_DEPLOY_USER: ${{ secrets.DEPLOY_USER }}
+          PLATFORM_DEPLOY_PORT: ${{ secrets.DEPLOY_SSH_PORT }}
+          PLATFORM_DEPLOY_BASE: ${{ secrets.DEPLOY_BASE }}
+          PLATFORM_DEPLOY_RELEASE: ${{ github.sha }}
+          ALLOW_EMPTY_FLEET: ${{ github.event.inputs.allow_empty_fleet || vars.ALLOW_EMPTY_FLEET || '0' }}
+          DEPLOY_SSH_KEY_BODY: ${{ secrets.DEPLOY_SSH_KEY }}
+        run: |
+          set -euo pipefail
+          if [ -z "${DEPLOY_SSH_KEY_BODY:-}" ]; then
+            echo "missing secret DEPLOY_SSH_KEY" >&2
+            exit 1
+          fi
+          key="$(mktemp)"
+          trap 'rm -f "$key"' EXIT
+          printf '%s\n' "$DEPLOY_SSH_KEY_BODY" >"$key"
+          chmod 600 "$key"
+          export PLATFORM_DEPLOY_SSH_KEY="$key"
+          # Apply managed-host defaults when secrets are unset.
+          export PLATFORM_DEPLOY_HOST="${PLATFORM_DEPLOY_HOST:-39.107.254.4}"
+          export PLATFORM_DEPLOY_USER="${PLATFORM_DEPLOY_USER:-root}"
+          export PLATFORM_DEPLOY_PORT="${PLATFORM_DEPLOY_PORT:-22}"
+          export PLATFORM_DEPLOY_BASE="${PLATFORM_DEPLOY_BASE:-/srv/curriculum-project-hub}"
+          bash hub/deploy/deploy_fleet_release.sh
+
+  deploy-prod:
+    name: deploy fleet prod (educraft)
+    runs-on: ubuntu-latest
+    if: >
+      (github.event_name == 'push' && github.ref == 'refs/heads/main') ||
+      (github.event_name == 'push' && startsWith(github.ref, 'refs/tags/')) ||
+      (github.event_name == 'workflow_dispatch' &&
+        (github.event.inputs.fleet == 'prod' || github.event.inputs.fleet == 'both'))
+    steps:
+      - uses: actions/checkout@v5
+
+      - name: Install rsync + ssh
+        run: sudo apt-get update && sudo apt-get install -y rsync openssh-client
+
+      - name: Deploy Hub + admin SPA to educraft fleet
+        env:
+          CPH_FLEET: prod
+          PLATFORM_DEPLOY_HOST: ${{ secrets.DEPLOY_HOST }}
+          PLATFORM_DEPLOY_USER: ${{ secrets.DEPLOY_USER }}
+          PLATFORM_DEPLOY_PORT: ${{ secrets.DEPLOY_SSH_PORT }}
+          PLATFORM_DEPLOY_BASE: ${{ secrets.DEPLOY_BASE }}
+          PLATFORM_DEPLOY_RELEASE: ${{ github.sha }}
+          ALLOW_EMPTY_FLEET: ${{ github.event.inputs.allow_empty_fleet || vars.ALLOW_EMPTY_FLEET || '0' }}
+          DEPLOY_SSH_KEY_BODY: ${{ secrets.DEPLOY_SSH_KEY }}
+        run: |
+          set -euo pipefail
+          if [ -z "${DEPLOY_SSH_KEY_BODY:-}" ]; then
+            echo "missing secret DEPLOY_SSH_KEY" >&2
+            exit 1
+          fi
+          key="$(mktemp)"
+          trap 'rm -f "$key"' EXIT
+          printf '%s\n' "$DEPLOY_SSH_KEY_BODY" >"$key"
+          chmod 600 "$key"
+          export PLATFORM_DEPLOY_SSH_KEY="$key"
+          export PLATFORM_DEPLOY_HOST="${PLATFORM_DEPLOY_HOST:-39.107.254.4}"
+          export PLATFORM_DEPLOY_USER="${PLATFORM_DEPLOY_USER:-root}"
+          export PLATFORM_DEPLOY_PORT="${PLATFORM_DEPLOY_PORT:-22}"
+          export PLATFORM_DEPLOY_BASE="${PLATFORM_DEPLOY_BASE:-/srv/curriculum-project-hub}"
+          bash hub/deploy/deploy_fleet_release.sh

.gitignore

@@ -11,6 +11,9 @@
 # regenerable, not for VCS. The embedded engine mounts cph-render directly.
 render/vendor/local-packages/
 
+# Environment
+.env
+
 # Node (hub/ TS workspace and any future JS package)
 node_modules/
 

hub/.gitignore

@@ -4,3 +4,7 @@ dist/
 .env
 .env.*
 !.env.example
+.secrets/
+admin-web/node_modules/
+admin-web/build/
+admin-web/.svelte-kit/

hub/admin-web/.gitignore

@@ -0,0 +1,23 @@
+node_modules
+
+# Output
+.output
+.vercel
+.netlify
+.wrangler
+/.svelte-kit
+/build
+
+# OS
+.DS_Store
+Thumbs.db
+
+# Env
+.env
+.env.*
+!.env.example
+!.env.test
+
+# Vite
+vite.config.js.timestamp-*
+vite.config.ts.timestamp-*

hub/admin-web/.npmrc

@@ -0,0 +1 @@
+engine-strict=true

hub/admin-web/.prettierignore

@@ -0,0 +1,4 @@
+build
+.svelte-kit
+node_modules
+package-lock.json

hub/admin-web/.prettierrc.json

@@ -0,0 +1,9 @@
+{
+	"useTabs": true,
+	"singleQuote": true,
+	"semi": true,
+	"trailingComma": "all",
+	"printWidth": 120,
+	"plugins": ["prettier-plugin-svelte"],
+	"overrides": [{ "files": "*.svelte", "options": { "parser": "svelte" } }]
+}

hub/admin-web/.vscode/extensions.json

@@ -0,0 +1,3 @@
+{
+	"recommendations": ["svelte.svelte-vscode"]
+}

hub/admin-web/README.md

@@ -0,0 +1,42 @@
+# sv
+
+Everything you need to build a Svelte project, powered by [`sv`](https://github.com/sveltejs/cli).
+
+## Creating a project
+
+If you're seeing this, you've probably already done this step. Congrats!
+
+```sh
+# create a new project
+npx sv create my-app
+```
+
+To recreate this project with the same configuration:
+
+```sh
+# recreate this project
+npx sv@0.16.2 create --template minimal --types ts --install npm D:/Projects/curriculum-project-hub/hub/admin-web
+```
+
+## Developing
+
+Once you've created a project and installed dependencies with `npm install` (or `pnpm install` or `yarn`), start a development server:
+
+```sh
+npm run dev
+
+# or start the server and open the app in a new browser tab
+npm run dev -- --open
+```
+
+## Building
+
+To create a production version of your app:
+
+```sh
+npm run build
+```
+
+You can preview the production build with `npm run preview`.
+
+> To deploy your app, you may need to install an [adapter](https://svelte.dev/docs/kit/adapters) for your target environment.

hub/admin-web/package.json

@@ -0,0 +1,33 @@
+{
+	"name": "admin-web",
+	"private": true,
+	"version": "0.0.1",
+	"type": "module",
+	"scripts": {
+		"dev": "vite dev",
+		"build": "vite build",
+		"preview": "vite preview",
+		"prepare": "svelte-kit sync || echo ''",
+		"check": "svelte-kit sync && svelte-check --tsconfig ./tsconfig.json",
+		"check:watch": "svelte-kit sync && svelte-check --tsconfig ./tsconfig.json --watch",
+		"format": "prettier --write .",
+		"format:check": "prettier --check ."
+	},
+	"devDependencies": {
+		"@skeletonlabs/skeleton": "^4.15.2",
+		"@skeletonlabs/skeleton-svelte": "^4.15.2",
+		"@sveltejs/adapter-auto": "^7.0.1",
+		"@sveltejs/adapter-static": "^3.0.10",
+		"@sveltejs/kit": "^2.63.0",
+		"@sveltejs/vite-plugin-svelte": "^7.1.2",
+		"@tailwindcss/vite": "^4.3.2",
+		"bits-ui": "^2.18.1",
+		"prettier": "^3.9.5",
+		"prettier-plugin-svelte": "^4.1.1",
+		"svelte": "^5.56.1",
+		"svelte-check": "^4.6.0",
+		"tailwindcss": "^4.3.2",
+		"typescript": "^6.0.3",
+		"vite": "^8.0.16"
+	}
+}

hub/admin-web/src/app.d.ts

@@ -0,0 +1,13 @@
+// See https://svelte.dev/docs/kit/types#app.d.ts
+// for information about these interfaces
+declare global {
+	namespace App {
+		// interface Error {}
+		// interface Locals {}
+		// interface PageData {}
+		// interface PageState {}
+		// interface Platform {}
+	}
+}
+
+export {};

hub/admin-web/src/app.html

@@ -0,0 +1,27 @@
+<!doctype html>
+<html lang="zh-CN" data-theme="hamlindigo">
+	<head>
+		<meta charset="utf-8" />
+		<meta name="viewport" content="width=device-width, initial-scale=1" />
+		<meta name="text-scale" content="scale" />
+		<meta name="description" content="Curriculum Project Hub — 组织管理后台" />
+		<link rel="icon" href="%sveltekit.assets%/favicon.svg" type="image/svg+xml" />
+		<link rel="preconnect" href="https://fonts.googleapis.com" />
+		<link rel="preconnect" href="https://fonts.gstatic.com" crossorigin />
+		<link
+			href="https://fonts.googleapis.com/css2?family=Inter:wght@400;500;600;700&family=JetBrains+Mono:wght@400;500&family=Noto+Sans+SC:wght@400;500;600;700&display=swap"
+			rel="stylesheet"
+		/>
+		<style>
+			/* Fallback before CSS bundle: CJK-first industrial base */
+			html {
+				font-family: 'Noto Sans SC', 'PingFang SC', 'Microsoft YaHei', 'Inter', sans-serif;
+			}
+		</style>
+		<title>CPH Admin</title>
+		%sveltekit.head%
+	</head>
+	<body data-sveltekit-preload-data="hover">
+		<div style="display: contents">%sveltekit.body%</div>
+	</body>
+</html>

hub/admin-web/src/lib/api.ts

@@ -0,0 +1,345 @@
+/**
+ * Thin API client for the org admin backend. Same-origin cookie auth.
+ */
+
+export class ApiError extends Error {
+	code: string;
+	status: number;
+	constructor(code: string, message: string, status: number) {
+		super(message);
+		this.name = 'ApiError';
+		this.code = code;
+		this.status = status;
+	}
+}
+
+async function request(method: string, url: string, body?: unknown): Promise<unknown> {
+	const init: RequestInit = {
+		method,
+		credentials: 'same-origin',
+		headers: body !== undefined ? { 'content-type': 'application/json' } : undefined,
+		body: body !== undefined ? JSON.stringify(body) : undefined,
+	};
+	const res = await fetch(url, init);
+	const text = await res.text();
+	let data: unknown = null;
+	if (text !== '') {
+		try {
+			data = JSON.parse(text);
+		} catch {
+			data = text;
+		}
+	}
+	if (!res.ok) {
+		const err = (data as { error?: { code?: string; message?: string } } | null)?.error;
+		throw new ApiError(err?.code ?? 'http_error', err?.message ?? `HTTP ${res.status}`, res.status);
+	}
+	return data;
+}
+
+const get = (u: string) => request('GET', u);
+const post = (u: string, b?: unknown) => request('POST', u, b);
+const put = (u: string, b?: unknown) => request('PUT', u, b);
+const patch = (u: string, b?: unknown) => request('PATCH', u, b);
+const del = (u: string) => request('DELETE', u);
+
+const orgBase = (slug: string) => `/api/org/${encodeURIComponent(slug)}`;
+
+// --- Types ---
+
+export interface OrgMembership {
+	id: string;
+	slug: string;
+	name: string;
+	status: string;
+	role: 'OWNER' | 'ADMIN' | 'MEMBER';
+}
+
+export interface MeResponse {
+	user: {
+		id: string;
+		feishuOpenId: string;
+		displayName: string;
+		avatarUrl: string | null;
+	};
+	organizations: OrgMembership[];
+}
+
+export interface OrgMember {
+	userId: string;
+	feishuOpenId: string;
+	displayName: string;
+	avatarUrl: string | null;
+	role: 'OWNER' | 'ADMIN' | 'MEMBER';
+	createdAt: string;
+}
+
+export interface TeamRow {
+	id: string;
+	slug: string;
+	name: string;
+	description: string | null;
+	memberCount: number;
+	createdAt: string;
+}
+
+export interface TeamMemberRow {
+	userId: string;
+	feishuOpenId: string;
+	displayName: string;
+	createdAt: string;
+}
+
+export interface ExplorerFolder {
+	id: string;
+	name: string;
+	parentId: string | null;
+	sortKey: string;
+	projectCount: number;
+	childFolderCount: number;
+}
+
+export interface ExplorerProject {
+	id: string;
+	name: string;
+	folderId: string | null;
+	createdAt: string;
+	binding: { chatId: string; createdAt: string } | null;
+}
+
+export interface ExplorerData {
+	folders: ExplorerFolder[];
+	projects: ExplorerProject[];
+}
+
+export interface ProjectDetail {
+	id: string;
+	name: string;
+	folderId: string | null;
+	folder: { id: string; name: string } | null;
+	workspaceDir: string;
+	createdAt: string;
+	archivedAt: string | null;
+	createdBy: { id: string; displayName: string; feishuOpenId: string } | null;
+	binding: { chatId: string; createdAt: string } | null;
+	actorIsOrgAdmin?: boolean;
+	actorCanManageProject?: boolean;
+}
+
+export interface TeamAccessEntry {
+	grantId: string;
+	projectId: string;
+	organizationId: string;
+	teamId: string;
+	teamSlug: string;
+	teamName: string;
+	role: 'READ' | 'EDIT' | 'MANAGE';
+}
+
+export interface SessionSummary {
+	id: string;
+	provider: string;
+	roleId: string;
+	model: string;
+	title: string | null;
+	runCount: number;
+	createdAt: string;
+	updatedAt: string;
+}
+
+export interface ProviderConnectionRow {
+	id: string;
+	providerId: string;
+	mode: 'BYOK' | 'PLATFORM_MANAGED';
+	status: 'DRAFT' | 'ACTIVE' | 'DISABLED';
+	activeVersion: number | null;
+	keyId: string | null;
+	createdAt: string;
+	updatedAt: string;
+}
+
+export interface FeishuApplicationConnection {
+	id: string;
+	appFingerprint: string;
+	status: 'DRAFT' | 'ACTIVE' | 'DISABLED';
+	activeVersion: number | null;
+	keyId: string | null;
+	createdAt: string;
+	updatedAt: string;
+}
+
+export interface UsageTotals {
+	runCount: number;
+	runsWithCost: number;
+	runsWithoutCost: number;
+	inputTokens: number;
+	outputTokens: number;
+	costUsd: number | null;
+}
+
+export interface ProjectUsageRow extends UsageTotals {
+	projectId: string;
+	projectName: string;
+	folderId: string | null;
+}
+
+export interface UsageReport {
+	from: string | null;
+	to: string | null;
+	projects: ProjectUsageRow[];
+	totals: UsageTotals;
+}
+
+export type CapacityDimension =
+	| 'requestRate'
+	| 'requestBodySize'
+	| 'agentConcurrency'
+	| 'admissionQueueLength'
+	| 'admissionQueueWait'
+	| 'fileSize'
+	| 'attachmentCount'
+	| 'archiveExpansion'
+	| 'projectStorage'
+	| 'organizationStorage'
+	| 'memberCount'
+	| 'projectCount'
+	| 'teamCount'
+	| 'folderCount'
+	| 'sessionCount'
+	| 'runWallTime'
+	| 'runTurns'
+	| 'runToolCalls'
+	| 'toolWallTime'
+	| 'runOutputSize'
+	| 'processMemory'
+	| 'processCpu'
+	| 'processCount';
+
+export interface CapacityDimensionRow {
+	dimension: CapacityDimension;
+	platformCeiling: number | null;
+	organizationLimit: number | null;
+	effective: number | null;
+}
+
+export interface CapacityPolicyView {
+	dimensions: CapacityDimensionRow[];
+}
+
+// --- API ---
+
+export const api = {
+	me: () => get('/api/me') as Promise<MeResponse>,
+	logout: () => post('/auth/logout'),
+
+	org: (slug: string) =>
+		get(orgBase(slug)) as Promise<{
+			organization: { id: string; slug: string; name: string; status: string };
+			actorRole: string;
+		}>,
+	settings: (slug: string) => get(`${orgBase(slug)}/settings`) as Promise<{ membersCanCreateProjects: boolean }>,
+	setSettings: (slug: string, body: { membersCanCreateProjects: boolean }) =>
+		patch(`${orgBase(slug)}/settings`, body) as Promise<{ membersCanCreateProjects: boolean }>,
+
+	members: (slug: string) => get(`${orgBase(slug)}/members`) as Promise<{ members: OrgMember[] }>,
+	addMember: (slug: string, body: { feishuOpenId: string; displayName?: string; role: string }) =>
+		post(`${orgBase(slug)}/members`, body) as Promise<OrgMember>,
+	setMemberRole: (slug: string, userId: string, role: string) => patch(`${orgBase(slug)}/members/${userId}`, { role }),
+	revokeMember: (slug: string, userId: string) => post(`${orgBase(slug)}/members/${userId}/revoke`),
+
+	teams: (slug: string) => get(`${orgBase(slug)}/teams`) as Promise<{ teams: TeamRow[] }>,
+	createTeam: (slug: string, body: { slug: string; name: string; description?: string }) =>
+		post(`${orgBase(slug)}/teams`, body) as Promise<TeamRow>,
+	updateTeam: (slug: string, teamId: string, body: { name?: string; description?: string | null }) =>
+		patch(`${orgBase(slug)}/teams/${teamId}`, body) as Promise<TeamRow>,
+	archiveTeam: (slug: string, teamId: string) => post(`${orgBase(slug)}/teams/${teamId}/archive`),
+	teamMembers: (slug: string, teamId: string) =>
+		get(`${orgBase(slug)}/teams/${teamId}/members`) as Promise<{ members: TeamMemberRow[] }>,
+	addTeamMember: (slug: string, teamId: string, body: { userId?: string; feishuOpenId?: string }) =>
+		post(`${orgBase(slug)}/teams/${teamId}/members`, body) as Promise<TeamMemberRow>,
+	revokeTeamMember: (slug: string, teamId: string, userId: string) =>
+		post(`${orgBase(slug)}/teams/${teamId}/members/${userId}/revoke`),
+
+	explorer: (slug: string) => get(`${orgBase(slug)}/explorer`) as Promise<ExplorerData>,
+	myProjects: (slug: string) =>
+		get(`${orgBase(slug)}/my-projects`) as Promise<{ projects: ExplorerProject[] }>,
+	createFolder: (slug: string, body: { name: string; parentId?: string; sortKey?: string }) =>
+		post(`${orgBase(slug)}/folders`, body) as Promise<{
+			id: string;
+			name: string;
+			parentId: string | null;
+			sortKey: string;
+		}>,
+	renameFolder: (slug: string, folderId: string, body: { name?: string; sortKey?: string; parentId?: string | null }) =>
+		patch(`${orgBase(slug)}/folders/${folderId}`, body) as Promise<{
+			id: string;
+			name: string;
+			parentId: string | null;
+			sortKey: string;
+		}>,
+	archiveFolder: (slug: string, folderId: string) =>
+		post(`${orgBase(slug)}/folders/${folderId}/archive`) as Promise<{ archived: true; folderId: string }>,
+	createProject: (slug: string, body: { name: string; folderId?: string }) =>
+		post(`${orgBase(slug)}/projects`, body) as Promise<{ id: string; name: string }>,
+	project: (slug: string, projectId: string) => get(`${orgBase(slug)}/projects/${projectId}`) as Promise<ProjectDetail>,
+	renameProject: (slug: string, projectId: string, name: string) =>
+		patch(`${orgBase(slug)}/projects/${projectId}`, { name }),
+	moveProject: (slug: string, projectId: string, folderId: string | null) =>
+		patch(`${orgBase(slug)}/projects/${projectId}/folder`, { folderId }),
+	archiveProject: (slug: string, projectId: string) => post(`${orgBase(slug)}/projects/${projectId}/archive`),
+	archiveBinding: (slug: string, projectId: string) => post(`${orgBase(slug)}/projects/${projectId}/binding/archive`),
+
+	teamAccess: (slug: string, projectId: string) =>
+		get(`${orgBase(slug)}/projects/${projectId}/team-access`) as Promise<{ access: TeamAccessEntry[] }>,
+	grantTeamAccess: (slug: string, projectId: string, body: { teamId?: string; teamSlug?: string; role: string }) =>
+		put(`${orgBase(slug)}/projects/${projectId}/team-access`, body) as Promise<TeamAccessEntry>,
+	revokeTeamAccess: (slug: string, projectId: string, teamId: string) =>
+		del(`${orgBase(slug)}/projects/${projectId}/team-access/${teamId}`),
+
+	sessions: (slug: string, projectId: string, limit?: number) =>
+		get(`${orgBase(slug)}/projects/${projectId}/sessions${limit !== undefined ? `?limit=${limit}` : ''}`) as Promise<{
+			sessions: SessionSummary[];
+		}>,
+	usage: (slug: string, params?: { from?: string; to?: string; folderId?: string }) => {
+		const q = new URLSearchParams();
+		if (params?.from) q.set('from', params.from);
+		if (params?.to) q.set('to', params.to);
+		if (params?.folderId) q.set('folderId', params.folderId);
+		const qs = q.toString();
+		return get(`${orgBase(slug)}/usage${qs ? `?${qs}` : ''}`) as Promise<UsageReport>;
+	},
+
+	providerConnections: (slug: string) =>
+		get(`${orgBase(slug)}/provider-connections`) as Promise<{ connections: ProviderConnectionRow[] }>,
+	rotateProviderConnection: (
+		slug: string,
+		providerId: string,
+		body: { baseUrl: string; authToken: string; anthropicApiKey?: string },
+	) =>
+		put(
+			`${orgBase(slug)}/provider-connections/${encodeURIComponent(providerId)}`,
+			body,
+		) as Promise<ProviderConnectionRow>,
+
+	feishuApplication: (slug: string) =>
+		get(`${orgBase(slug)}/feishu-application-connection`) as Promise<{
+			connection: FeishuApplicationConnection | null;
+		}>,
+	rotateFeishuApplication: (
+		slug: string,
+		body: {
+			appId: string;
+			appSecret: string;
+			botOpenId: string;
+			verificationToken?: string;
+			encryptKey?: string;
+		},
+	) => put(`${orgBase(slug)}/feishu-application-connection`, body) as Promise<FeishuApplicationConnection>,
+	disableFeishuApplication: (slug: string) =>
+		del(`${orgBase(slug)}/feishu-application-connection`) as Promise<FeishuApplicationConnection>,
+
+	capacityPolicy: (slug: string) =>
+		get(`${orgBase(slug)}/capacity-policy`) as Promise<CapacityPolicyView>,
+	setCapacityPolicy: (slug: string, body: { limits: Partial<Record<CapacityDimension, number | null>> }) =>
+		put(`${orgBase(slug)}/capacity-policy`, body) as Promise<CapacityPolicyView>,
+};

hub/admin-web/src/lib/assets/favicon.svg

@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="107" height="128" viewBox="0 0 107 128"><title>svelte-logo</title><path d="M94.157 22.819c-10.4-14.885-30.94-19.297-45.792-9.835L22.282 29.608A29.92 29.92 0 0 0 8.764 49.65a31.5 31.5 0 0 0 3.108 20.231 30 30 0 0 0-4.477 11.183 31.9 31.9 0 0 0 5.448 24.116c10.402 14.887 30.942 19.297 45.791 9.835l26.083-16.624A29.92 29.92 0 0 0 98.235 78.35a31.53 31.53 0 0 0-3.105-20.232 30 30 0 0 0 4.474-11.182 31.88 31.88 0 0 0-5.447-24.116" style="fill:#ff3e00"/><path d="M45.817 106.582a20.72 20.72 0 0 1-22.237-8.243 19.17 19.17 0 0 1-3.277-14.503 18 18 0 0 1 .624-2.435l.49-1.498 1.337.981a33.6 33.6 0 0 0 10.203 5.098l.97.294-.09.968a5.85 5.85 0 0 0 1.052 3.878 6.24 6.24 0 0 0 6.695 2.485 5.8 5.8 0 0 0 1.603-.704L69.27 76.28a5.43 5.43 0 0 0 2.45-3.631 5.8 5.8 0 0 0-.987-4.371 6.24 6.24 0 0 0-6.698-2.487 5.7 5.7 0 0 0-1.6.704l-9.953 6.345a19 19 0 0 1-5.296 2.326 20.72 20.72 0 0 1-22.237-8.243 19.17 19.17 0 0 1-3.277-14.502 17.99 17.99 0 0 1 8.13-12.052l26.081-16.623a19 19 0 0 1 5.3-2.329 20.72 20.72 0 0 1 22.237 8.243 19.17 19.17 0 0 1 3.277 14.503 18 18 0 0 1-.624 2.435l-.49 1.498-1.337-.98a33.6 33.6 0 0 0-10.203-5.1l-.97-.294.09-.968a5.86 5.86 0 0 0-1.052-3.878 6.24 6.24 0 0 0-6.696-2.485 5.8 5.8 0 0 0-1.602.704L37.73 51.72a5.42 5.42 0 0 0-2.449 3.63 5.79 5.79 0 0 0 .986 4.372 6.24 6.24 0 0 0 6.698 2.486 5.8 5.8 0 0 0 1.602-.704l9.952-6.342a19 19 0 0 1 5.295-2.328 20.72 20.72 0 0 1 22.237 8.242 19.17 19.17 0 0 1 3.277 14.503 18 18 0 0 1-8.13 12.053l-26.081 16.622a19 19 0 0 1-5.3 2.328" style="fill:#fff"/></svg>

hub/admin-web/src/lib/components/CheckboxControl.svelte

@@ -0,0 +1,32 @@
+<script lang="ts">
+	import { Checkbox } from 'bits-ui';
+	import Icon from './Icon.svelte';
+
+	let {
+		checked = $bindable(false),
+		disabled = false,
+		class: className = '',
+		onchange,
+	}: {
+		checked?: boolean;
+		disabled?: boolean;
+		class?: string;
+		onchange?: (checked: boolean) => void;
+	} = $props();
+</script>
+
+<Checkbox.Root
+	class="saas-checkbox {className}"
+	{disabled}
+	{checked}
+	onCheckedChange={(next) => {
+		checked = next;
+		onchange?.(next);
+	}}
+>
+	{#snippet children({ checked: isChecked })}
+		{#if isChecked}
+			<Icon name="check" class="h-3.5 w-3.5" />
+		{/if}
+	{/snippet}
+</Checkbox.Root>

hub/admin-web/src/lib/components/EmptyState.svelte

@@ -0,0 +1,32 @@
+<script lang="ts">
+	import type { Snippet } from 'svelte';
+
+	let {
+		title = '暂无数据',
+		description,
+		action,
+	}: {
+		title?: string;
+		description?: string;
+		action?: Snippet;
+	} = $props();
+</script>
+
+<div class="saas-empty">
+	<div
+		class="mb-1 flex h-12 w-12 items-center justify-center border border-surface-300 bg-surface-100 text-surface-600"
+	>
+		<svg class="h-6 w-6" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.75">
+			<path stroke-linecap="round" stroke-linejoin="round" d="M3.75 6.75h16.5M3.75 12h16.5m-16.5 5.25H12" />
+		</svg>
+	</div>
+	<p class="text-sm font-medium text-surface-900">{title}</p>
+	{#if description}
+		<p class="max-w-sm text-sm text-surface-600">{description}</p>
+	{/if}
+	{#if action}
+		<div class="mt-2">
+			{@render action()}
+		</div>
+	{/if}
+</div>

hub/admin-web/src/lib/components/ErrorBanner.svelte

@@ -0,0 +1,26 @@
+<script lang="ts">
+	let {
+		message,
+		onretry,
+	}: {
+		message: string;
+		onretry?: () => void;
+	} = $props();
+</script>
+
+<div class="saas-card flex flex-wrap items-start gap-3 border-error-200 bg-error-50 p-4 text-error-700">
+	<svg class="mt-0.5 h-5 w-5 shrink-0" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.75">
+		<path
+			stroke-linecap="round"
+			stroke-linejoin="round"
+			d="M12 9v3.75m9-.75a9 9 0 11-18 0 9 9 0 0118 0zm-9 3.75h.008v.008H12v-.008z"
+		/>
+	</svg>
+	<div class="min-w-0 flex-1">
+		<p class="text-sm font-medium">请求失败</p>
+		<p class="mt-0.5 text-sm opacity-90">{message}</p>
+	</div>
+	{#if onretry}
+		<button type="button" class="saas-btn-ghost text-sm" onclick={onretry}>重试</button>
+	{/if}
+</div>

hub/admin-web/src/lib/components/FolderNode.svelte

@@ -0,0 +1,48 @@
+<script lang="ts">
+	import type { ExplorerFolder } from '$lib/api';
+	import Icon from './Icon.svelte';
+	import FolderTree from './FolderTree.svelte';
+
+	let {
+		folder,
+		folders,
+		projects,
+		slug,
+	}: {
+		folder: ExplorerFolder;
+		folders: ExplorerFolder[];
+		projects: {
+			id: string;
+			name: string;
+			folderId: string | null;
+			createdAt: string;
+			binding: { chatId: string } | null;
+		}[];
+		slug: string;
+	} = $props();
+
+	let open = $state(true);
+</script>
+
+<div>
+	<button
+		type="button"
+		class="flex w-full items-center gap-2.5 px-3 py-2.5 text-left text-sm transition hover:bg-surface-100"
+		onclick={() => (open = !open)}
+	>
+		<span class="w-3.5 text-center text-xs text-surface-600">{open ? '▾' : '▸'}</span>
+		<span class="flex h-7 w-7 items-center justify-center border border-warning-300 bg-warning-50 text-warning-800">
+			<Icon name="folder" class="h-4 w-4" />
+		</span>
+		<span class="min-w-0 flex-1 truncate font-medium text-surface-900">{folder.name}</span>
+		<span class="saas-badge-neutral">{folder.projectCount} 项目</span>
+		{#if folder.childFolderCount > 0}
+			<span class="saas-badge-neutral">{folder.childFolderCount} 子夹</span>
+		{/if}
+	</button>
+	{#if open}
+		<div class="ml-4 border-l border-surface-300 pl-2">
+			<FolderTree {folders} {projects} parentId={folder.id} {slug} />
+		</div>
+	{/if}
+</div>

hub/admin-web/src/lib/components/FolderTree.svelte

@@ -0,0 +1,49 @@
+<script lang="ts">
+	import type { ExplorerFolder } from '$lib/api';
+	import { fmtDate } from '$lib/format';
+	import Icon from './Icon.svelte';
+	import FolderNode from './FolderNode.svelte';
+
+	let {
+		folders,
+		projects,
+		parentId,
+		slug,
+	}: {
+		folders: ExplorerFolder[];
+		projects: {
+			id: string;
+			name: string;
+			folderId: string | null;
+			createdAt: string;
+			binding: { chatId: string } | null;
+		}[];
+		parentId: string | null;
+		slug: string;
+	} = $props();
+
+	let childFolders = $derived(folders.filter((f) => f.parentId === parentId));
+	let childProjects = $derived(projects.filter((p) => p.folderId === parentId));
+</script>
+
+<div class="space-y-0.5">
+	{#each childProjects as p (p.id)}
+		<a
+			href={`/admin/org/${slug}/projects/${p.id}`}
+			class="flex items-center gap-2.5 px-3 py-2.5 text-sm transition hover:bg-surface-100"
+		>
+			<span class="flex h-7 w-7 items-center justify-center border border-primary-200 bg-primary-50 text-primary-700">
+				<Icon name="file" class="h-4 w-4" />
+			</span>
+			<span class="min-w-0 flex-1 truncate font-medium text-surface-900">{p.name}</span>
+			{#if p.binding}
+				<span class="saas-badge-success">已绑定</span>
+			{/if}
+			<span class="hidden text-xs text-surface-600 sm:inline">{fmtDate(p.createdAt)}</span>
+		</a>
+	{/each}
+
+	{#each childFolders as f (f.id)}
+		<FolderNode folder={f} {folders} {projects} {slug} />
+	{/each}
+</div>

hub/admin-web/src/lib/components/Icon.svelte

@@ -0,0 +1,123 @@
+<script lang="ts">
+	/** Inline nav icons for the admin shell. */
+	let {
+		name,
+		class: className = 'h-4 w-4',
+	}: {
+		name:
+			| 'overview'
+			| 'members'
+			| 'teams'
+			| 'projects'
+			| 'provider'
+			| 'feishu'
+			| 'menu'
+			| 'logout'
+			| 'org'
+			| 'chevron'
+			| 'folder'
+			| 'file'
+			| 'check';
+		class?: string;
+	} = $props();
+</script>
+
+{#if name === 'overview'}
+	<svg class={className} viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.75">
+		<path
+			stroke-linecap="round"
+			stroke-linejoin="round"
+			d="M3 12l9-9 9 9M5 10v9a1 1 0 001 1h3v-5h6v5h3a1 1 0 001-1v-9"
+		/>
+	</svg>
+{:else if name === 'members'}
+	<svg class={className} viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.75">
+		<path
+			stroke-linecap="round"
+			stroke-linejoin="round"
+			d="M15.75 7.5a3.75 3.75 0 11-7.5 0 3.75 3.75 0 017.5 0zM4.5 19.5a7.5 7.5 0 0115 0"
+		/>
+	</svg>
+{:else if name === 'teams'}
+	<svg class={className} viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.75">
+		<path
+			stroke-linecap="round"
+			stroke-linejoin="round"
+			d="M18 18.72a9.09 9.09 0 003.74-.72 9 9 0 00-5.07-5.95M15 11a4 4 0 10-8 0 4 4 0 008 0zM4.26 18a9 9 0 0115.48 0"
+		/>
+	</svg>
+{:else if name === 'projects'}
+	<svg class={className} viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.75">
+		<path
+			stroke-linecap="round"
+			stroke-linejoin="round"
+			d="M3.75 6.75A2.25 2.25 0 016 4.5h3.379c.6 0 1.175.238 1.6.66l.842.84c.424.423 1 .66 1.6.66H18A2.25 2.25 0 0120.25 9v8.25A2.25 2.25 0 0118 19.5H6a2.25 2.25 0 01-2.25-2.25V6.75z"
+		/>
+	</svg>
+{:else if name === 'provider'}
+	<svg class={className} viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.75">
+		<path
+			stroke-linecap="round"
+			stroke-linejoin="round"
+			d="M13.19 8.688a4.5 4.5 0 016.364 6.364l-3.182 3.182a4.5 4.5 0 01-6.364-6.364"
+		/>
+		<path
+			stroke-linecap="round"
+			stroke-linejoin="round"
+			d="M10.81 15.312a4.5 4.5 0 01-6.364-6.364l3.182-3.182a4.5 4.5 0 016.364 6.364"
+		/>
+	</svg>
+{:else if name === 'feishu'}
+	<svg class={className} viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.75">
+		<path
+			stroke-linecap="round"
+			stroke-linejoin="round"
+			d="M4.5 8.25h15a8.25 8.25 0 01-8.25 8.25A8.25 8.25 0 014.5 8.25z"
+		/>
+		<path stroke-linecap="round" stroke-linejoin="round" d="M8.25 11.25h.01M12 11.25h.01M15.75 11.25h.01" />
+	</svg>
+{:else if name === 'menu'}
+	<svg class={className} viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.75">
+		<path stroke-linecap="round" stroke-linejoin="round" d="M3.75 6.75h16.5M3.75 12h16.5m-16.5 5.25h16.5" />
+	</svg>
+{:else if name === 'logout'}
+	<svg class={className} viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.75">
+		<path
+			stroke-linecap="round"
+			stroke-linejoin="round"
+			d="M15.75 9V5.25A2.25 2.25 0 0013.5 3h-6A2.25 2.25 0 005.25 5.25v13.5A2.25 2.25 0 007.5 21h6a2.25 2.25 0 002.25-2.25V15M12 9l3 3m0 0l-3 3m3-3H6"
+		/>
+	</svg>
+{:else if name === 'org'}
+	<svg class={className} viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.75">
+		<path
+			stroke-linecap="round"
+			stroke-linejoin="round"
+			d="M3.75 21h16.5M4.5 3h15M5.25 3v18m13.5-18v18M9 6.75h1.5m-1.5 3h1.5m-1.5 3h1.5m3-6H15m-1.5 3H15m-1.5 3H15M9 21v-3.375c0-.621.504-1.125 1.125-1.125h3.75c.621 0 1.125.504 1.125 1.125V21"
+		/>
+	</svg>
+{:else if name === 'chevron'}
+	<svg class={className} viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.75">
+		<path stroke-linecap="round" stroke-linejoin="round" d="M8.25 4.5l7.5 7.5-7.5 7.5" />
+	</svg>
+{:else if name === 'folder'}
+	<svg class={className} viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.75">
+		<path
+			stroke-linecap="round"
+			stroke-linejoin="round"
+			d="M3.75 6.75A2.25 2.25 0 016 4.5h3.379c.6 0 1.175.238 1.6.66l.842.84c.424.423 1 .66 1.6.66H18A2.25 2.25 0 0120.25 9v8.25A2.25 2.25 0 0118 19.5H6a2.25 2.25 0 01-2.25-2.25V6.75z"
+		/>
+	</svg>
+{:else if name === 'file'}
+	<svg class={className} viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.75">
+		<path
+			stroke-linecap="round"
+			stroke-linejoin="round"
+			d="M19.5 14.25v-2.625a3.375 3.375 0 00-3.375-3.375h-1.5A1.125 1.125 0 0113.5 7.125v-1.5a3.375 3.375 0 00-3.375-3.375H8.25m0 12.75h7.5m-7.5 3H12M10.5 2.25H5.625c-.621 0-1.125.504-1.125 1.125v17.25c0 .621.504 1.125 1.125 1.125h12.75c.621 0 1.125-.504 1.125-1.125V11.25a9 9 0 00-9-9z"
+		/>
+	</svg>
+{:else if name === 'check'}
+	<svg class={className} viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.75">
+		<path stroke-linecap="round" stroke-linejoin="round" d="M4.5 12.75l6 6 9-13.5" />
+	</svg>
+{/if}

hub/admin-web/src/lib/components/LoadingState.svelte

@@ -0,0 +1,15 @@
+<script lang="ts">
+	let { label = '加载中…' }: { label?: string } = $props();
+</script>
+
+<div class="flex flex-col items-center justify-center gap-3 py-16 text-surface-600">
+	<svg class="h-7 w-7 animate-spin text-primary-500" viewBox="0 0 24 24" fill="none">
+		<circle class="opacity-25" cx="12" cy="12" r="10" stroke="currentColor" stroke-width="4"></circle>
+		<path
+			class="opacity-90"
+			fill="currentColor"
+			d="M4 12a8 8 0 018-8V0C5.373 0 0 5.373 0 12h4zm2 5.291A7.962 7.962 0 014 12H0c0 3.042 1.135 5.824 3 7.938l3-2.647z"
+		></path>
+	</svg>
+	<p class="text-sm">{label}</p>
+</div>

hub/admin-web/src/lib/components/Modal.svelte

@@ -0,0 +1,38 @@
+<script lang="ts">
+	import type { Snippet } from 'svelte';
+	import { Dialog } from 'bits-ui';
+
+	let {
+		open = $bindable(false),
+		title,
+		children,
+		onclose,
+	}: {
+		open?: boolean;
+		title: string;
+		children: Snippet;
+		onclose?: () => void;
+	} = $props();
+</script>
+
+<Dialog.Root
+	bind:open
+	onOpenChange={(next) => {
+		if (!next) onclose?.();
+	}}
+>
+	<Dialog.Portal>
+		<Dialog.Overlay class="saas-modal-backdrop" />
+		<Dialog.Content class="saas-modal">
+			<div class="mb-4 flex items-start justify-between gap-3">
+				<Dialog.Title class="text-lg font-semibold text-surface-900">{title}</Dialog.Title>
+				<Dialog.Close class="saas-btn-ghost px-2! py-1! text-surface-600" aria-label="关闭">
+					<svg class="h-5 w-5" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.75">
+						<path stroke-linecap="round" stroke-linejoin="round" d="M6 18L18 6M6 6l12 12" />
+					</svg>
+				</Dialog.Close>
+			</div>
+			{@render children()}
+		</Dialog.Content>
+	</Dialog.Portal>
+</Dialog.Root>

hub/admin-web/src/lib/components/PageHeader.svelte

@@ -0,0 +1,27 @@
+<script lang="ts">
+	import type { Snippet } from 'svelte';
+
+	let {
+		title,
+		description,
+		actions,
+	}: {
+		title: string;
+		description?: string;
+		actions?: Snippet;
+	} = $props();
+</script>
+
+<div class="saas-toolbar">
+	<div class="min-w-0">
+		<h1 class="saas-page-title">{title}</h1>
+		{#if description}
+			<p class="saas-muted mt-1">{description}</p>
+		{/if}
+	</div>
+	{#if actions}
+		<div class="ml-auto flex flex-wrap items-center gap-2">
+			{@render actions()}
+		</div>
+	{/if}
+</div>

hub/admin-web/src/lib/components/SelectField.svelte

@@ -0,0 +1,66 @@
+<script lang="ts">
+	import { Select } from 'bits-ui';
+	import Icon from './Icon.svelte';
+
+	export type SelectItem = { label: string; value: string; disabled?: boolean };
+
+	let {
+		items,
+		value = $bindable(''),
+		class: className = '',
+		disabled = false,
+		placeholder = '请选择…',
+		onchange,
+	}: {
+		items: SelectItem[];
+		value?: string;
+		class?: string;
+		disabled?: boolean;
+		placeholder?: string;
+		onchange?: (value: string) => void;
+	} = $props();
+</script>
+
+<Select.Root
+	type="single"
+	{items}
+	{disabled}
+	{value}
+	onValueChange={(next) => {
+		value = next;
+		onchange?.(next);
+	}}
+>
+	<Select.Trigger class="saas-select-trigger {className}" {disabled}>
+		<span class="min-w-0 flex-1 truncate text-left">
+			<Select.Value {placeholder} />
+		</span>
+		<svg
+			class="ml-2 h-4 w-4 shrink-0 text-surface-600"
+			viewBox="0 0 24 24"
+			fill="none"
+			stroke="currentColor"
+			stroke-width="1.75"
+			aria-hidden="true"
+		>
+			<path stroke-linecap="round" stroke-linejoin="round" d="M8.25 15l3.75 3.75L15.75 15" />
+			<path stroke-linecap="round" stroke-linejoin="round" d="M8.25 9l3.75-3.75L15.75 9" />
+		</svg>
+	</Select.Trigger>
+	<Select.Portal>
+		<Select.Content class="saas-select-content" sideOffset={6} collisionPadding={8}>
+			<Select.Viewport class="p-1">
+				{#each items as item (item.value)}
+					<Select.Item class="saas-select-item" value={item.value} label={item.label} disabled={item.disabled}>
+						{#snippet children({ selected })}
+							<span class="min-w-0 flex-1 truncate">{item.label}</span>
+							{#if selected}
+								<Icon name="check" class="ml-2 h-4 w-4 shrink-0 text-primary-600" />
+							{/if}
+						{/snippet}
+					</Select.Item>
+				{/each}
+			</Select.Viewport>
+		</Select.Content>
+	</Select.Portal>
+</Select.Root>

hub/admin-web/src/lib/components/StatCard.svelte

@@ -0,0 +1,19 @@
+<script lang="ts">
+	let {
+		label,
+		value,
+		hint,
+	}: {
+		label: string;
+		value: string;
+		hint?: string;
+	} = $props();
+</script>
+
+<div class="saas-stat">
+	<div class="saas-stat-label">{label}</div>
+	<div class="saas-stat-value">{value}</div>
+	{#if hint}
+		<div class="saas-help">{hint}</div>
+	{/if}
+</div>

hub/admin-web/src/lib/components/SwitchControl.svelte

@@ -0,0 +1,27 @@
+<script lang="ts">
+	import { Switch } from 'bits-ui';
+
+	let {
+		checked = $bindable(false),
+		disabled = false,
+		class: className = '',
+		onchange,
+	}: {
+		checked?: boolean;
+		disabled?: boolean;
+		class?: string;
+		onchange?: (checked: boolean) => void;
+	} = $props();
+</script>
+
+<Switch.Root
+	class="saas-switch {className}"
+	{disabled}
+	{checked}
+	onCheckedChange={(next) => {
+		checked = next;
+		onchange?.(next);
+	}}
+>
+	<Switch.Thumb class="saas-switch-thumb" />
+</Switch.Root>

hub/admin-web/src/lib/components/ToastHost.svelte

@@ -0,0 +1,25 @@
+<script lang="ts">
+	import { dismissToast, toasts } from '$lib/toast';
+
+	const kindClass: Record<string, string> = {
+		info: 'border-surface-200 bg-surface-50 text-surface-800',
+		success: 'border-success-200 bg-success-50 text-success-800',
+		error: 'border-error-200 bg-error-50 text-error-800',
+	};
+</script>
+
+<div class="pointer-events-none fixed inset-x-0 top-0 z-100 flex flex-col items-end gap-2 p-4">
+	{#each $toasts as t (t.id)}
+		<div
+			class="pointer-events-auto flex max-w-sm items-start gap-3 border px-4 py-3 text-sm shadow-[4px_4px_0_rgb(15_23_42/0.12)] {kindClass[
+				t.kind
+			] ?? kindClass.info}"
+			role="status"
+		>
+			<p class="min-w-0 flex-1">{t.message}</p>
+			<button type="button" class="opacity-60 hover:opacity-100" onclick={() => dismissToast(t.id)} aria-label="关闭">
+				×
+			</button>
+		</div>
+	{/each}
+</div>

hub/admin-web/src/lib/constants.ts

@@ -0,0 +1,39 @@
+export interface ToolOption {
+	id: string;
+	label: string;
+	group: string;
+}
+
+export const TOOL_OPTIONS: ToolOption[] = [
+	{ id: 'read_file', label: '读取文件', group: '文件' },
+	{ id: 'write_file', label: '写入文件', group: '文件' },
+	{ id: 'list_files', label: '列目录', group: '文件' },
+	{ id: 'search_files', label: '搜索', group: '文件' },
+	{ id: 'bash', label: 'Bash 命令', group: 'Shell' },
+	{ id: 'cph_check', label: 'cph check', group: 'CPH' },
+	{ id: 'cph_build', label: 'cph build', group: 'CPH' },
+	{ id: 'send_file', label: '发送文件（飞书）', group: '飞书' },
+	{ id: 'feishu_read_context', label: '读飞书上下文', group: '飞书' },
+	{ id: 'feishu_download_resource', label: '下载飞书资源', group: '飞书' },
+	{ id: 'request_approval', label: '请求审批', group: '飞书' },
+];
+
+/** 组织成员角色（接口枚举保持英文，界面用 orgRoleLabel） */
+export const ORG_ROLES = ['OWNER', 'ADMIN', 'MEMBER'] as const;
+export type OrgRole = (typeof ORG_ROLES)[number];
+
+export const ORG_ROLE_LABELS: Record<OrgRole, string> = {
+	OWNER: '所有者',
+	ADMIN: '管理员',
+	MEMBER: '成员',
+};
+
+/** 项目团队授权角色（接口枚举保持英文，界面用 permissionRoleLabel） */
+export const PERMISSION_ROLES = ['READ', 'EDIT', 'MANAGE'] as const;
+export type PermissionRole = (typeof PERMISSION_ROLES)[number];
+
+export const PERMISSION_ROLE_LABELS: Record<PermissionRole, string> = {
+	READ: '只读',
+	EDIT: '编辑',
+	MANAGE: '管理',
+};

hub/admin-web/src/lib/format.ts

@@ -0,0 +1,46 @@
+import { ORG_ROLE_LABELS, PERMISSION_ROLE_LABELS, type OrgRole, type PermissionRole } from './constants';
+
+export function fmtDate(iso: string): string {
+	if (!iso) return '—';
+	const d = new Date(iso);
+	if (Number.isNaN(d.getTime())) return iso;
+	return d.toLocaleString(undefined, {
+		year: 'numeric',
+		month: 'short',
+		day: '2-digit',
+		hour: '2-digit',
+		minute: '2-digit',
+	});
+}
+
+export function fmtDateOnly(iso: string): string {
+	if (!iso) return '—';
+	const d = new Date(iso);
+	if (Number.isNaN(d.getTime())) return iso;
+	return d.toLocaleDateString(undefined, { year: 'numeric', month: 'short', day: '2-digit' });
+}
+
+export function fmtCost(usd: number | null): string {
+	if (usd === null) return '—';
+	return `$${Number(usd).toFixed(4)}`;
+}
+
+export function fmtNum(n: number): string {
+	return n.toLocaleString();
+}
+
+export function orgRoleLabel(role: string): string {
+	const key = role.toUpperCase() as OrgRole;
+	return ORG_ROLE_LABELS[key] ?? role;
+}
+
+export function permissionRoleLabel(role: string): string {
+	const key = role.toUpperCase() as PermissionRole;
+	return PERMISSION_ROLE_LABELS[key] ?? role;
+}
+
+export function providerModeLabel(mode: string): string {
+	if (mode === 'BYOK') return '自带密钥';
+	if (mode === 'PLATFORM_MANAGED') return '平台托管';
+	return mode;
+}

hub/admin-web/src/lib/index.ts

@@ -0,0 +1 @@
+// place files you want to import through the `$lib` alias in this folder.

hub/admin-web/src/lib/session.ts

@@ -0,0 +1,43 @@
+import { writable } from 'svelte/store';
+import { api, type MeResponse } from './api';
+
+interface SessionState {
+	loading: boolean;
+	me: MeResponse | null;
+	error: string | null;
+}
+
+export const session = writable<SessionState>({
+	loading: true,
+	me: null,
+	error: null,
+});
+
+export async function loadSession(): Promise<void> {
+	session.update((s) => ({ ...s, loading: true, error: null }));
+	try {
+		const me = await api.me();
+		session.set({ loading: false, me, error: null });
+	} catch (err) {
+		const status = (err as { status?: number }).status;
+		if (status === 401) {
+			redirectToLogin();
+			return;
+		}
+		session.set({
+			loading: false,
+			me: null,
+			error: err instanceof Error ? err.message : String(err),
+		});
+	}
+}
+
+export function redirectToLogin(): void {
+	const ret = encodeURIComponent(window.location.pathname + window.location.hash);
+	window.location.href = `/auth/feishu?returnTo=${ret}`;
+}
+
+export async function logout(): Promise<void> {
+	await api.logout();
+	redirectToLogin();
+}

hub/admin-web/src/lib/toast.ts

@@ -0,0 +1,34 @@
+import { writable } from 'svelte/store';
+
+export type ToastKind = 'info' | 'success' | 'error';
+
+export interface ToastItem {
+	id: number;
+	message: string;
+	kind: ToastKind;
+}
+
+let seq = 0;
+export const toasts = writable<ToastItem[]>([]);
+
+export function pushToast(message: string, kind: ToastKind = 'info', ms = 3200): void {
+	const id = ++seq;
+	toasts.update((list) => [...list, { id, message, kind }]);
+	if (ms > 0) {
+		setTimeout(() => {
+			toasts.update((list) => list.filter((t) => t.id !== id));
+		}, ms);
+	}
+}
+
+export function dismissToast(id: number): void {
+	toasts.update((list) => list.filter((t) => t.id !== id));
+}
+
+export function toastSuccess(message: string): void {
+	pushToast(message, 'success');
+}
+
+export function toastError(message: string): void {
+	pushToast(message, 'error', 5000);
+}

hub/admin-web/src/routes/+layout.svelte

@@ -0,0 +1,389 @@
+<script lang="ts">
+	import '../routes/app.css';
+	import { onMount } from 'svelte';
+	import { goto } from '$app/navigation';
+	import { page } from '$app/state';
+	import { session, loadSession, logout, redirectToLogin } from '$lib/session';
+	import type { OrgMembership } from '$lib/api';
+	import { orgRoleLabel } from '$lib/format';
+	import Icon from '$lib/components/Icon.svelte';
+	import ToastHost from '$lib/components/ToastHost.svelte';
+	import SelectField from '$lib/components/SelectField.svelte';
+
+	let { children } = $props();
+	let mobileNavOpen = $state(false);
+	let redirecting = $state(false);
+
+	onMount(() => {
+		loadSession();
+	});
+
+	const navItems = [
+		{ key: 'overview', label: '概览', icon: 'overview' as const },
+		{ key: 'members', label: '成员', icon: 'members' as const },
+		{ key: 'teams', label: '团队', icon: 'teams' as const },
+		{ key: 'projects', label: '项目', icon: 'projects' as const },
+		{ key: 'capacity', label: '容量', icon: 'overview' as const },
+		{ key: 'provider', label: '供应方', icon: 'provider' as const },
+		{ key: 'feishu', label: '飞书', icon: 'feishu' as const },
+	];
+
+	function isAdmin(org: OrgMembership): boolean {
+		const role = String(org.role ?? '').toUpperCase();
+		return role === 'OWNER' || role === 'ADMIN';
+	}
+
+	function orgSlugFromPath(): string | null {
+		const parts = page.url.pathname.split('/').filter(Boolean);
+		if (parts[0] === 'admin' && parts[1] === 'org' && parts[2]) {
+			return decodeURIComponent(parts[2]);
+		}
+		return null;
+	}
+
+	function isOnProjectRoute(): boolean {
+		const parts = page.url.pathname.split('/').filter(Boolean);
+		return parts[0] === 'admin' && parts[1] === 'org' && parts[3] === 'projects';
+	}
+
+	function memberships(): OrgMembership[] {
+		return $session.me?.organizations ?? [];
+	}
+
+	function adminOrgs(): OrgMembership[] {
+		return memberships().filter(isAdmin);
+	}
+
+	function currentOrg(): OrgMembership | null {
+		const slug = orgSlugFromPath();
+		if (!slug) return null;
+		return memberships().find((o) => o.slug === slug) ?? null;
+	}
+
+	function pickHomeOrg(): OrgMembership | null {
+		const admin = adminOrgs()[0];
+		if (admin) return admin;
+		return memberships()[0] ?? null;
+	}
+
+	function activeKey(): string {
+		const parts = page.url.pathname.split('/').filter(Boolean);
+		if (parts[0] !== 'admin' || parts[1] !== 'org' || !parts[2]) return '';
+		return parts[3] ?? 'overview';
+	}
+
+	function navHref(key: string): string {
+		const slug = currentOrg()?.slug ?? pickHomeOrg()?.slug;
+		if (!slug) return '/';
+		if (key === 'overview') return `/admin/org/${slug}`;
+		return `/admin/org/${slug}/${key}`;
+	}
+
+	function pageTitle(): string {
+		const key = activeKey();
+		if (key === 'overview' || key === '') return '概览';
+		return navItems.find((i) => i.key === key)?.label ?? '管理后台';
+	}
+
+	function switchOrg(nextSlug: string) {
+		if (!nextSlug || nextSlug === currentOrg()?.slug) return;
+		void goto(`/admin/org/${nextSlug}`);
+	}
+
+	function handleLogout(e: Event) {
+		e.preventDefault();
+		logout();
+	}
+
+	function orgSelectItems(list: OrgMembership[]) {
+		return list.map((o) => ({
+			value: o.slug,
+			label: `${o.name} · ${orgRoleLabel(o.role)}`,
+		}));
+	}
+
+	$effect(() => {
+		page.url.pathname;
+		mobileNavOpen = false;
+	});
+
+	$effect(() => {
+		if ($session.loading || !$session.me) return;
+
+		const slug = orgSlugFromPath();
+		const matched = slug ? memberships().find((o) => o.slug === slug) : null;
+
+		// Org admins: route to their first admin org if none matched as admin.
+		const admins = adminOrgs();
+		if (matched && isAdmin(matched)) {
+			redirecting = false;
+			return;
+		}
+		if (!matched && admins.length > 0) {
+			const target = `/admin/org/${admins[0].slug}`;
+			if (page.url.pathname !== target && !page.url.pathname.startsWith(`${target}/`)) {
+				redirecting = true;
+				void goto(target, { replaceState: true });
+			}
+			return;
+		}
+
+		// Members (non-admin): project pages are open to project MANAGE holders;
+		// the org overview and other admin-only surfaces are not for them.
+		if (matched && !isAdmin(matched)) {
+			redirecting = false;
+			const parts = page.url.pathname.split('/').filter(Boolean);
+			const onOverview = parts.length === 3; // /admin/org/:slug
+			if (onOverview) {
+				const target = `/admin/org/${matched.slug}/projects`;
+				if (page.url.pathname !== target) {
+					redirecting = true;
+					void goto(target, { replaceState: true });
+				}
+			}
+			return;
+		}
+
+		// No matched org and no admin orgs: route a member to their first org's
+		// projects page so they can reach project MANAGE surfaces.
+		if (!matched && memberships().length > 0) {
+			const home = memberships()[0];
+			const target = `/admin/org/${home.slug}/projects`;
+			if (page.url.pathname !== target && !page.url.pathname.startsWith(`${target}/`)) {
+				redirecting = true;
+				void goto(target, { replaceState: true });
+			}
+		}
+	});
+</script>
+
+<ToastHost />
+
+{#if $session.loading || redirecting}
+	<div class="saas-status-panel">
+		<div class="flex flex-col items-center gap-3 text-surface-600">
+			<svg class="h-8 w-8 animate-spin text-primary-500" viewBox="0 0 24 24" fill="none">
+				<circle class="opacity-25" cx="12" cy="12" r="10" stroke="currentColor" stroke-width="4"></circle>
+				<path
+					class="opacity-90"
+					fill="currentColor"
+					d="M4 12a8 8 0 018-8V0C5.373 0 0 5.373 0 12h4zm2 5.291A7.962 7.962 0 014 12H0c0 3.042 1.135 5.824 3 7.938l3-2.647z"
+				></path>
+			</svg>
+			<p class="text-sm">{redirecting ? '正在进入组织…' : '正在加载会话…'}</p>
+		</div>
+	</div>
+{:else if $session.error}
+	<div class="saas-status-panel">
+		<div class="saas-status-card">
+			<div
+				class="mx-auto mb-4 flex h-12 w-12 items-center justify-center border border-error-300 bg-error-100 text-error-700 font-bold"
+			>
+				!
+			</div>
+			<h2 class="mb-1 text-lg font-semibold">无法连接到后端</h2>
+			<p class="mb-5 text-sm text-surface-700">{$session.error}</p>
+			<button class="saas-btn-primary" onclick={() => loadSession()}>重试</button>
+		</div>
+	</div>
+{:else if !$session.me}
+	<div class="saas-status-panel">
+		<div class="saas-status-card">
+			<div
+				class="mx-auto mb-5 flex h-12 w-12 items-center justify-center border border-primary-700 bg-primary-600 text-white font-bold"
+			>
+				CPH
+			</div>
+			<h1 class="text-xl font-semibold">Curriculum Project Hub</h1>
+			<p class="mt-2 mb-6 text-sm text-surface-700">登录以管理组织、项目、团队与模型供应。</p>
+			<button class="saas-btn-primary w-full" onclick={() => redirectToLogin()}>使用飞书登录</button>
+		</div>
+	</div>
+{:else if currentOrg() && isAdmin(currentOrg()!)}
+	{@const org = currentOrg()!}
+	{@const me = $session.me!}
+	<div class="saas-shell">
+		{#if mobileNavOpen}
+			<button
+				type="button"
+				class="fixed inset-0 z-40 bg-surface-950/40 md:hidden"
+				aria-label="关闭导航"
+				onclick={() => (mobileNavOpen = false)}
+			></button>
+		{/if}
+
+		<aside
+			class="saas-sidebar fixed inset-y-0 left-0 z-50 transition-transform md:static md:translate-x-0
+				{mobileNavOpen ? 'translate-x-0' : '-translate-x-full md:translate-x-0'}"
+		>
+			<div class="flex items-center gap-2.5 px-4 py-4">
+				<div
+					class="flex h-9 w-9 items-center justify-center border border-primary-700 bg-primary-600 text-xs font-bold tracking-wide text-white"
+				>
+					CPH
+				</div>
+				<div class="min-w-0">
+					<div class="truncate text-sm font-semibold text-surface-900">组织后台</div>
+					<div class="truncate text-xs text-surface-600">Curriculum Hub</div>
+				</div>
+			</div>
+
+			<div class="px-3 pb-3">
+				<div class="mb-1.5 flex items-center gap-1.5 text-xs font-medium text-surface-700">
+					<Icon name="org" class="h-3.5 w-3.5" />
+					组织
+				</div>
+				<SelectField items={orgSelectItems(me.organizations)} value={org.slug} onchange={switchOrg} />
+			</div>
+
+			<nav class="flex-1 space-y-0.5 overflow-y-auto px-2 pb-3">
+				<p class="px-3 pb-1 pt-2 text-[11px] font-semibold uppercase tracking-wider text-surface-600">工作台</p>
+				{#each navItems as item}
+					{@const active =
+						activeKey() === item.key || (item.key === 'overview' && (activeKey() === '' || activeKey() === 'overview'))}
+					<a href={navHref(item.key)} class="saas-nav-item" data-active={active ? 'true' : 'false'}>
+						<Icon name={item.icon} class="h-4 w-4 shrink-0 opacity-80" />
+						<span>{item.label}</span>
+					</a>
+				{/each}
+			</nav>
+
+			<div class="border-t border-surface-300 p-3">
+				<div class="flex items-center gap-2.5 border border-surface-300 bg-surface-100 px-2.5 py-2">
+					{#if me.user.avatarUrl}
+						<img src={me.user.avatarUrl} alt="" class="h-8 w-8 object-cover" />
+					{:else}
+						<div
+							class="flex h-8 w-8 items-center justify-center border border-primary-300 bg-primary-100 text-xs font-semibold text-primary-800"
+						>
+							{me.user.displayName.slice(0, 1)}
+						</div>
+					{/if}
+					<div class="min-w-0 flex-1">
+						<div class="truncate text-sm font-medium text-surface-900">{me.user.displayName}</div>
+						<div class="truncate text-[11px] text-surface-600">{orgRoleLabel(org.role)}</div>
+					</div>
+					<button
+						type="button"
+						class="p-1.5 text-surface-600 transition hover:bg-surface-200 hover:text-error-700"
+						title="退出登录"
+						onclick={handleLogout}
+					>
+						<Icon name="logout" class="h-4 w-4" />
+					</button>
+				</div>
+			</div>
+		</aside>
+
+		<div class="saas-main">
+			<header class="saas-topbar">
+				<button
+					type="button"
+					class="saas-btn-ghost px-2! md:hidden"
+					onclick={() => (mobileNavOpen = !mobileNavOpen)}
+					aria-label="打开导航"
+				>
+					<Icon name="menu" class="h-5 w-5" />
+				</button>
+				<div class="min-w-0">
+					<div class="flex items-center gap-1.5 text-xs text-surface-600">
+						<span class="truncate">{org.name}</span>
+						<span>/</span>
+						<span class="truncate font-medium text-surface-900">{pageTitle()}</span>
+					</div>
+				</div>
+				<div class="ml-auto hidden items-center gap-2 sm:flex">
+					<span class="saas-badge-primary">{org.status}</span>
+					<span class="saas-badge-neutral font-mono">/{org.slug}</span>
+				</div>
+			</header>
+			<main class="saas-content">
+				<div class="saas-content-inner">
+					{@render children()}
+				</div>
+			</main>
+		</div>
+	</div>
+{:else if currentOrg() && !isAdmin(currentOrg()!) && isOnProjectRoute()}
+	{@const org = currentOrg()!}
+	{@const me = $session.me!}
+	<div class="saas-shell">
+		<div class="saas-main">
+			<header class="saas-topbar">
+				<a
+					href={`/admin/org/${org.slug}/projects`}
+					class="saas-btn-ghost px-2!"
+					aria-label="返回项目列表"
+				>
+					<Icon name="menu" class="h-5 w-5" />
+				</a>
+				<div class="min-w-0">
+					<div class="flex items-center gap-1.5 text-xs text-surface-600">
+						<span class="truncate">{org.name}</span>
+						<span>/</span>
+						<span class="truncate font-medium text-surface-900">项目</span>
+					</div>
+				</div>
+				<div class="ml-auto flex items-center gap-2">
+					<span class="saas-badge-neutral font-mono">/{org.slug}</span>
+					<button
+						type="button"
+						class="p-1.5 text-surface-600 transition hover:bg-surface-200 hover:text-error-700"
+						title="退出登录"
+						onclick={handleLogout}
+					>
+						<Icon name="logout" class="h-4 w-4" />
+					</button>
+				</div>
+			</header>
+			<main class="saas-content">
+				<div class="saas-content-inner">
+					{@render children()}
+				</div>
+			</main>
+		</div>
+	</div>
+{:else if currentOrg() && !isAdmin(currentOrg()!)}
+	{@const denied = currentOrg()!}
+	<div class="saas-status-panel">
+		<div class="saas-status-card">
+			<h2 class="mb-2 text-lg font-semibold">无权访问管理后台</h2>
+			<p class="mb-3 text-sm text-surface-700">
+				组织 <strong>{denied.name}</strong>（/{denied.slug}）中你的角色是
+				<span class="saas-badge-neutral mx-1">{orgRoleLabel(denied.role)}</span>。普通成员仅可访问自己有授权的项目。
+			</p>
+			<a class="saas-btn-primary" href={`/admin/org/${denied.slug}/projects`}>查看我的项目</a>
+			{#if memberships().length > 1}
+				<p class="saas-label text-left mb-1.5 mt-3">切换到其他组织</p>
+				<div class="mb-4">
+					<SelectField items={orgSelectItems(memberships())} value={denied.slug} onchange={switchOrg} />
+				</div>
+			{/if}
+			<button class="saas-btn-ghost mt-3" onclick={handleLogout}>退出登录</button>
+		</div>
+	</div>
+{:else if memberships().length > 0}
+	{@const denied = pickHomeOrg()!}
+	<div class="saas-status-panel">
+		<div class="saas-status-card">
+			<h2 class="mb-2 text-lg font-semibold">正在跳转…</h2>
+			<p class="mb-5 text-sm text-surface-700">
+				即将进入 <strong>{denied.name}</strong>（/{denied.slug}）的项目。
+			</p>
+			<a class="saas-btn-primary" href={`/admin/org/${denied.slug}/projects`}>立即进入</a>
+			<button class="saas-btn-ghost mt-3" onclick={handleLogout}>退出登录</button>
+		</div>
+	</div>
+{:else}
+	<div class="saas-status-panel">
+		<div class="saas-status-card">
+			<h2 class="mb-2 text-lg font-semibold">未加入组织</h2>
+			<p class="mb-3 text-sm text-surface-700">飞书账号已登录，但当前账号尚未加入任何组织。</p>
+			<p class="mb-5 text-left text-xs text-surface-600">
+				open_id：
+				<code class="break-all font-mono text-surface-600">{$session.me!.user.feishuOpenId}</code>
+			</p>
+			<button class="saas-btn-primary" onclick={handleLogout}>退出登录</button>
+		</div>
+	</div>
+{/if}

hub/admin-web/src/routes/+page.svelte

@@ -0,0 +1,43 @@
+<script lang="ts">
+	import { onMount } from 'svelte';
+	import { goto } from '$app/navigation';
+	import { session, redirectToLogin } from '$lib/session';
+
+	function homeForSession(): string | null {
+		const me = $session.me;
+		if (!me) return null;
+		const admin = me.organizations.find((o) => {
+			const r = String(o.role ?? '').toUpperCase();
+			return r === 'OWNER' || r === 'ADMIN';
+		});
+		const target = admin ?? me.organizations[0];
+		return target ? `/admin/org/${target.slug}` : null;
+	}
+
+	onMount(() => {
+		const unsub = session.subscribe((s) => {
+			if (s.loading) return;
+			if (!s.me) {
+				redirectToLogin();
+				return;
+			}
+			const dest = homeForSession();
+			if (dest) void goto(dest, { replaceState: true });
+		});
+		return unsub;
+	});
+</script>
+
+<div class="saas-status-panel">
+	<div class="flex flex-col items-center gap-3 text-surface-600">
+		<svg class="h-7 w-7 animate-spin text-primary-500" viewBox="0 0 24 24" fill="none">
+			<circle class="opacity-25" cx="12" cy="12" r="10" stroke="currentColor" stroke-width="4"></circle>
+			<path
+				class="opacity-90"
+				fill="currentColor"
+				d="M4 12a8 8 0 018-8V0C5.373 0 0 5.373 0 12h4zm2 5.291A7.962 7.962 0 014 12H0c0 3.042 1.135 5.824 3 7.938l3-2.647z"
+			></path>
+		</svg>
+		<p class="text-sm">正在进入工作台…</p>
+	</div>
+</div>

hub/admin-web/src/routes/admin/org/[slug]/+page.svelte

@@ -0,0 +1,147 @@
+<script lang="ts">
+	import { page } from '$app/state';
+	import { api, type OrgMembership } from '$lib/api';
+	import { session } from '$lib/session';
+	import { fmtCost, fmtNum, orgRoleLabel } from '$lib/format';
+	import PageHeader from '$lib/components/PageHeader.svelte';
+	import StatCard from '$lib/components/StatCard.svelte';
+	import LoadingState from '$lib/components/LoadingState.svelte';
+	import ErrorBanner from '$lib/components/ErrorBanner.svelte';
+	import SwitchControl from '$lib/components/SwitchControl.svelte';
+	import { toastError, toastSuccess } from '$lib/toast';
+
+	let orgSlug = $derived(page.params.slug ?? '');
+	let org = $derived($session.me?.organizations.find((o) => o.slug === orgSlug) as OrgMembership | undefined);
+
+	let settings = $state<{ membersCanCreateProjects: boolean } | null>(null);
+	let usage = $state<Awaited<ReturnType<typeof api.usage>> | null>(null);
+	let loading = $state(true);
+	let error = $state<string | null>(null);
+	let saving = $state(false);
+
+	async function load() {
+		loading = true;
+		error = null;
+		try {
+			[settings, usage] = await Promise.all([api.settings(orgSlug), api.usage(orgSlug)]);
+		} catch (err) {
+			error = err instanceof Error ? err.message : String(err);
+		} finally {
+			loading = false;
+		}
+	}
+
+	async function setMembersCanCreate(next: boolean) {
+		if (!settings || settings.membersCanCreateProjects === next) return;
+		saving = true;
+		const prev = settings.membersCanCreateProjects;
+		settings.membersCanCreateProjects = next;
+		try {
+			await api.setSettings(orgSlug, { membersCanCreateProjects: next });
+			toastSuccess(next ? '已允许成员自助建项' : '已关闭成员自助建项');
+		} catch (err) {
+			settings.membersCanCreateProjects = prev;
+			toastError(err instanceof Error ? err.message : String(err));
+		} finally {
+			saving = false;
+		}
+	}
+
+	$effect(() => {
+		if (orgSlug) load();
+	});
+</script>
+
+{#if loading}
+	<LoadingState />
+{:else if error}
+	<ErrorBanner message={error} onretry={load} />
+{:else if org && settings && usage}
+	<PageHeader title={org.name} description="组织健康度、用量与生产策略一览。" />
+
+	<div class="mb-6 grid gap-4 sm:grid-cols-2 lg:grid-cols-3">
+		<div class="saas-card-pad sm:col-span-2 lg:col-span-1">
+			<p class="saas-section-title mb-3">组织信息</p>
+			<dl class="space-y-2.5 text-sm">
+				<div class="flex items-center justify-between gap-3">
+					<dt class="text-surface-700">Slug</dt>
+					<dd class="font-mono text-xs text-surface-800">/{org.slug}</dd>
+				</div>
+				<div class="flex items-center justify-between gap-3">
+					<dt class="text-surface-700">状态</dt>
+					<dd><span class="saas-badge-success">{org.status}</span></dd>
+				</div>
+				<div class="flex items-center justify-between gap-3">
+					<dt class="text-surface-700">你的角色</dt>
+					<dd><span class="saas-badge-primary">{orgRoleLabel(org.role)}</span></dd>
+				</div>
+			</dl>
+		</div>
+
+		<div class="saas-card-pad sm:col-span-2">
+			<p class="saas-section-title mb-1">项目自助创建策略</p>
+			<p class="saas-muted mb-4">开启后，普通老师可在飞书群自助创建项目；关闭后仅所有者与管理员可建。</p>
+			<div class="flex items-center gap-3 border border-surface-300 bg-surface-100 px-4 py-3">
+				<SwitchControl checked={settings.membersCanCreateProjects} disabled={saving} onchange={setMembersCanCreate} />
+				<div>
+					<div class="text-sm font-medium text-surface-900">允许成员自助创建项目</div>
+					<div class="text-xs text-surface-600">普通成员在飞书群中自助建项</div>
+				</div>
+			</div>
+		</div>
+	</div>
+
+	<div class="mb-4 flex items-end justify-between gap-3">
+		<div>
+			<h2 class="saas-section-title">用量概览</h2>
+			<p class="saas-muted">全组织智能体运行汇总</p>
+		</div>
+	</div>
+
+	<div class="mb-6 grid gap-3 sm:grid-cols-2 lg:grid-cols-3">
+		<StatCard label="运行总数" value={fmtNum(usage.totals.runCount)} />
+		<StatCard label="有成本运行" value={fmtNum(usage.totals.runsWithCost)} />
+		<StatCard label="无成本运行" value={fmtNum(usage.totals.runsWithoutCost)} />
+		<StatCard label="输入 tokens" value={fmtNum(usage.totals.inputTokens)} />
+		<StatCard label="输出 tokens" value={fmtNum(usage.totals.outputTokens)} />
+		<StatCard label="成本 (USD)" value={fmtCost(usage.totals.costUsd)} />
+	</div>
+
+	<div class="saas-card overflow-hidden">
+		<div class="border-b border-surface-200 px-5 py-3">
+			<h3 class="text-sm font-semibold text-surface-800">按项目用量</h3>
+		</div>
+		{#if usage.projects.length === 0}
+			<div class="saas-empty">
+				<p class="text-sm text-surface-600">暂无项目用量数据</p>
+			</div>
+		{:else}
+			<div class="overflow-x-auto">
+				<table class="data-table">
+					<thead>
+						<tr>
+							<th>项目</th>
+							<th>运行</th>
+							<th>in / out tokens</th>
+							<th>成本</th>
+						</tr>
+					</thead>
+					<tbody>
+						{#each usage.projects as p}
+							<tr>
+								<td class="font-medium">{p.projectName}</td>
+								<td class="tabular-nums">{fmtNum(p.runCount)}</td>
+								<td class="tabular-nums text-surface-600">{fmtNum(p.inputTokens)} / {fmtNum(p.outputTokens)}</td>
+								<td class="tabular-nums">{fmtCost(p.costUsd)}</td>
+							</tr>
+						{/each}
+					</tbody>
+				</table>
+			</div>
+		{/if}
+	</div>
+{:else}
+	<div class="saas-empty">
+		<p class="text-sm text-surface-600">组织数据不可用</p>
+	</div>
+{/if}

hub/admin-web/src/routes/admin/org/[slug]/capacity/+page.svelte

@@ -0,0 +1,310 @@
+<script lang="ts">
+	import { page } from '$app/state';
+	import { api, type CapacityDimension, type CapacityDimensionRow, type CapacityPolicyView } from '$lib/api';
+	import PageHeader from '$lib/components/PageHeader.svelte';
+	import LoadingState from '$lib/components/LoadingState.svelte';
+	import ErrorBanner from '$lib/components/ErrorBanner.svelte';
+	import EmptyState from '$lib/components/EmptyState.svelte';
+	import { toastError, toastSuccess } from '$lib/toast';
+
+	const slug = $derived(page.params.slug ?? '');
+
+	// Friendlier, user-facing labels. No spec jargon (墙钟 → 运行时长, etc.).
+	const DIMENSION_LABELS: Record<CapacityDimension, string> = {
+		requestRate: '请求速率',
+		requestBodySize: '请求体大小',
+		agentConcurrency: '并发数',
+		admissionQueueLength: '队列长度',
+		admissionQueueWait: '队列等待',
+		fileSize: '单文件大小',
+		attachmentCount: '附件数',
+		archiveExpansion: '归档展开',
+		projectStorage: '项目存储',
+		organizationStorage: '组织存储',
+		memberCount: '成员数',
+		projectCount: '项目数',
+		teamCount: '团队数',
+		folderCount: '文件夹数',
+		sessionCount: '会话数',
+		runWallTime: '运行时长',
+		runTurns: '对话轮次',
+		runToolCalls: '工具调用数',
+		toolWallTime: '工具执行时长',
+		runOutputSize: '输出大小',
+		processMemory: '内存',
+		processCpu: 'CPU',
+		processCount: '进程数',
+	};
+
+	// Logical groupings for higher information density.
+	const GROUPS: { title: string; dims: CapacityDimension[] }[] = [
+		{ title: 'HTTP 接入', dims: ['requestRate', 'requestBodySize'] },
+		{ title: '智能体运行', dims: ['agentConcurrency', 'runWallTime', 'runTurns', 'runToolCalls', 'toolWallTime', 'runOutputSize'] },
+		{ title: '接纳队列', dims: ['admissionQueueLength', 'admissionQueueWait'] },
+		{ title: '附件与存储', dims: ['fileSize', 'attachmentCount', 'archiveExpansion', 'projectStorage', 'organizationStorage'] },
+		{ title: '组织配额', dims: ['memberCount', 'projectCount', 'teamCount', 'folderCount', 'sessionCount'] },
+		{ title: '进程资源', dims: ['processMemory', 'processCpu', 'processCount'] },
+	];
+
+	let view = $state<CapacityPolicyView | null>(null);
+	let drafts = $state<Partial<Record<CapacityDimension, string | number>>>({});
+	let loading = $state(true);
+	let saving = $state(false);
+	let error = $state<string | null>(null);
+
+	async function load() {
+		loading = true;
+		error = null;
+		try {
+			view = await api.capacityPolicy(slug);
+			drafts = {};
+			for (const row of view.dimensions) {
+				drafts[row.dimension] = row.organizationLimit === null ? '' : String(row.organizationLimit);
+			}
+		} catch (err) {
+			error = err instanceof Error ? err.message : String(err);
+		} finally {
+			loading = false;
+		}
+	}
+
+	function draftText(dim: CapacityDimension): string {
+		const raw = drafts[dim];
+		if (raw === undefined || raw === null) return '';
+		return String(raw).trim();
+	}
+
+	// Inline validation: surfaced as the user edits, not on submit. Returns null
+	// when the draft is empty (means "use platform ceiling") or valid.
+	function draftError(row: CapacityDimensionRow): string | null {
+		const text = draftText(row.dimension);
+		if (text === '') return null;
+		const n = Number.parseInt(text, 10);
+		if (!Number.isFinite(n) || n < 1) return '需为正整数';
+		if (row.platformCeiling !== null && n > row.platformCeiling) return `不得超过 ${row.platformCeiling}`;
+		return null;
+	}
+
+	// Live effective value: min(platform ceiling, draft). Reflects the draft
+	// before save so the user sees the outcome as they type.
+	function liveEffective(row: CapacityDimensionRow): number | null {
+		if (row.platformCeiling === null) return null;
+		const text = draftText(row.dimension);
+		if (text === '') return row.platformCeiling;
+		const n = Number.parseInt(text, 10);
+		if (!Number.isFinite(n) || n < 1) return row.platformCeiling;
+		return Math.min(row.platformCeiling, n);
+	}
+
+	function isLowered(row: CapacityDimensionRow): boolean {
+		const eff = liveEffective(row);
+		return eff !== null && eff < row.platformCeiling!;
+	}
+
+	const hasErrors = $derived(
+		view?.dimensions.some((row) => draftError(row) !== null) ?? false,
+	);
+
+	async function save() {
+		if (!view || hasErrors) return;
+		saving = true;
+		const limits: Partial<Record<CapacityDimension, number | null>> = {};
+		for (const row of view.dimensions) {
+			const text = draftText(row.dimension);
+			limits[row.dimension] = text === '' ? null : Number.parseInt(text, 10);
+		}
+		try {
+			view = await api.setCapacityPolicy(slug, { limits });
+			drafts = {};
+			for (const row of view.dimensions) {
+				drafts[row.dimension] = row.organizationLimit === null ? '' : String(row.organizationLimit);
+			}
+			toastSuccess('容量策略已保存');
+		} catch (err) {
+			toastError(err instanceof Error ? err.message : String(err));
+		} finally {
+			saving = false;
+		}
+	}
+
+	$effect(() => {
+		if (slug) load();
+	});
+</script>
+
+<PageHeader
+	title="容量策略"
+	description="平台上限不可突破。组织可在此设更低限制，未设置时按平台上限执行。"
+>
+	{#snippet actions()}
+		<button class="saas-btn-primary" disabled={saving || !view || hasErrors} onclick={save}>
+			{saving ? '保存中…' : '保存'}
+		</button>
+	{/snippet}
+</PageHeader>
+
+<p class="saas-muted mb-6">
+	未配置平台上限的维度暂不可设置组织限制。输入框留空即沿用平台上限。
+</p>
+
+{#if loading}
+	<LoadingState />
+{:else if error}
+	<ErrorBanner message={error} onretry={load} />
+{:else if view}
+	{#if view.dimensions.length === 0}
+		<EmptyState title="暂无容量维度" description="容量维度由平台定义。" />
+	{:else}
+		{@const policy = view}
+		<div class="grid gap-4 md:grid-cols-2">
+			{#each GROUPS as group}
+				{@const rows = group.dims
+					.map((d) => policy.dimensions.find((r) => r.dimension === d))
+					.filter((r): r is CapacityDimensionRow => r !== undefined)}
+				{#if rows.length > 0}
+					<section class="saas-card">
+						<header class="group-header">
+							<h3 class="group-title">{group.title}</h3>
+							<span class="group-count">{rows.length} 项</span>
+						</header>
+						<div class="dim-list">
+							{#each rows as row (row.dimension)}
+								{@const err = draftError(row)}
+								{@const eff = liveEffective(row)}
+								{@const lowered = isLowered(row)}
+								{@const disabled = row.platformCeiling === null}
+								<div class="dim-row" class:dim-row-error={err !== null}>
+									<div class="dim-label">{DIMENSION_LABELS[row.dimension] ?? row.dimension}</div>
+									<div class="dim-ceiling">
+										{#if disabled}
+											<span class="text-surface-400">未配置</span>
+										{:else}
+											<span class="tabular-nums">平台 ≤ {row.platformCeiling}</span>
+										{/if}
+									</div>
+									<input
+										class="saas-input dim-input"
+										type="number"
+										placeholder="用平台值"
+										disabled={disabled}
+										bind:value={drafts[row.dimension]}
+									/>
+									<div class="dim-effective">
+										{#if eff === null}
+											<span class="text-surface-400">—</span>
+										{:else if lowered}
+											<span class="saas-badge saas-badge-primary tabular-nums">有效 {eff}</span>
+										{:else}
+											<span class="saas-badge saas-badge-neutral tabular-nums">有效 {eff}</span>
+										{/if}
+									</div>
+									{#if err !== null}
+										<div class="dim-error">{err}</div>
+									{/if}
+								</div>
+							{/each}
+						</div>
+					</section>
+				{/if}
+			{/each}
+		</div>
+	{/if}
+{:else}
+	<EmptyState title="容量数据不可用" description="无法加载容量策略。" />
+{/if}
+
+<style>
+	.group-header {
+		display: flex;
+		align-items: baseline;
+		justify-content: space-between;
+		padding: 0.5rem 0.75rem;
+		border-bottom: 1px solid var(--color-surface-200);
+		background: var(--color-surface-100);
+	}
+	.group-title {
+		font-size: 0.8125rem;
+		font-weight: 600;
+		color: var(--color-surface-800);
+		letter-spacing: 0.02em;
+	}
+	.group-count {
+		font-size: 0.6875rem;
+		color: var(--color-surface-500);
+	}
+	.dim-list {
+		display: flex;
+		flex-direction: column;
+	}
+	.dim-row {
+		display: grid;
+		grid-template-columns: minmax(5rem, 1fr) auto minmax(7rem, 8.5rem) 6.5rem;
+		align-items: center;
+		gap: 0.5rem;
+		padding: 0.4rem 0.75rem;
+		border-bottom: 1px solid var(--color-surface-100);
+	}
+	.dim-row:last-child {
+		border-bottom: none;
+	}
+	.dim-row-error {
+		background: color-mix(in oklab, var(--color-error-100) 40%, transparent);
+	}
+	.dim-label {
+		font-size: 0.8125rem;
+		font-weight: 500;
+		color: var(--color-surface-900);
+		white-space: nowrap;
+		overflow: hidden;
+		text-overflow: ellipsis;
+	}
+	.dim-ceiling {
+		font-size: 0.6875rem;
+		color: var(--color-surface-500);
+		white-space: nowrap;
+	}
+	.dim-input {
+		padding: 0.25rem 0.5rem;
+		font-size: 0.8125rem;
+		text-align: right;
+	}
+	.dim-effective {
+		display: flex;
+		justify-content: flex-end;
+	}
+	.dim-effective > .saas-badge {
+		width: 100%;
+		justify-content: center;
+	}
+	.dim-error {
+		grid-column: 1 / -1;
+		font-size: 0.6875rem;
+		color: var(--color-error-700);
+		padding-bottom: 0.2rem;
+	}
+	@media (max-width: 480px) {
+		.dim-row {
+			grid-template-columns: 1fr 5rem;
+			grid-template-rows: auto auto auto;
+			row-gap: 0.25rem;
+		}
+		.dim-label {
+			grid-column: 1;
+		}
+		.dim-ceiling {
+			grid-column: 2;
+			text-align: right;
+		}
+		.dim-input {
+			grid-column: 1 / -1;
+		}
+		.dim-effective {
+			grid-column: 1 / -1;
+			justify-content: flex-start;
+		}
+		.dim-effective > .saas-badge {
+			width: auto;
+			justify-content: flex-start;
+		}
+	}
+</style>

hub/admin-web/src/routes/admin/org/[slug]/feishu/+page.svelte

@@ -0,0 +1,176 @@
+<script lang="ts">
+	import { page } from '$app/state';
+	import { api, type FeishuApplicationConnection } from '$lib/api';
+	import { fmtDate } from '$lib/format';
+	import { Label } from 'bits-ui';
+	import PageHeader from '$lib/components/PageHeader.svelte';
+	import LoadingState from '$lib/components/LoadingState.svelte';
+	import ErrorBanner from '$lib/components/ErrorBanner.svelte';
+	import { toastError, toastSuccess } from '$lib/toast';
+
+	const slug = $derived(page.params.slug ?? '');
+
+	let connection = $state<FeishuApplicationConnection | null>(null);
+	let loading = $state(true);
+	let error = $state<string | null>(null);
+
+	let appId = $state('');
+	let appSecret = $state('');
+	let botOpenId = $state('');
+	let verificationToken = $state('');
+	let encryptKey = $state('');
+	let saving = $state(false);
+	let disabling = $state(false);
+
+	async function load() {
+		loading = true;
+		error = null;
+		try {
+			const res = await api.feishuApplication(slug);
+			connection = res.connection;
+		} catch (err) {
+			error = err instanceof Error ? err.message : String(err);
+		} finally {
+			loading = false;
+		}
+	}
+
+	function resetForm() {
+		appId = '';
+		appSecret = '';
+		botOpenId = '';
+		verificationToken = '';
+		encryptKey = '';
+	}
+
+	async function save() {
+		const id = appId.trim();
+		const secret = appSecret.trim();
+		const bot = botOpenId.trim();
+		if (id === '' || secret === '' || bot === '') {
+			toastError('App ID、App Secret、Bot Open ID 均为必填');
+			return;
+		}
+		saving = true;
+		const body: {
+			appId: string;
+			appSecret: string;
+			botOpenId: string;
+			verificationToken?: string;
+			encryptKey?: string;
+		} = { appId: id, appSecret: secret, botOpenId: bot };
+		const vt = verificationToken.trim();
+		if (vt !== '') body.verificationToken = vt;
+		const ek = encryptKey.trim();
+		if (ek !== '') body.encryptKey = ek;
+		try {
+			connection = await api.rotateFeishuApplication(slug, body);
+			resetForm();
+			toastSuccess('飞书应用凭据已保存');
+		} catch (err) {
+			toastError(err instanceof Error ? err.message : String(err));
+		} finally {
+			saving = false;
+		}
+	}
+
+	async function disable() {
+		if (!connection) return;
+		if (!confirm('停用后该组织将无法收发飞书消息，确定停用？')) return;
+		disabling = true;
+		try {
+			connection = await api.disableFeishuApplication(slug);
+			toastSuccess('已停用飞书应用连接');
+		} catch (err) {
+			toastError(err instanceof Error ? err.message : String(err));
+		} finally {
+			disabling = false;
+		}
+	}
+
+	$effect(() => {
+		if (slug) load();
+	});
+</script>
+
+<PageHeader
+	title="飞书应用"
+	description="本组织绑定的飞书应用凭据（ADR-0021：组织与应用 1:1）。凭据按组织隔离、版本化信封存储，缺失或校验失败即 fail-closed。"
+/>
+
+{#if loading}
+	<LoadingState />
+{:else if error}
+	<ErrorBanner message={error} onretry={load} />
+{:else}
+	{#if connection}
+		<div class="saas-card-pad mb-6">
+			<p class="saas-section-title mb-3">当前连接</p>
+			<dl class="space-y-2.5 text-sm">
+				<div class="flex items-center justify-between gap-3">
+					<dt class="text-surface-700">状态</dt>
+					<dd><span class="saas-badge-success">{connection.status}</span></dd>
+				</div>
+				<div class="flex items-center justify-between gap-3">
+					<dt class="text-surface-700">App 指纹</dt>
+					<dd class="font-mono text-xs text-surface-800">{connection.appFingerprint}</dd>
+				</div>
+				<div class="flex items-center justify-between gap-3">
+					<dt class="text-surface-700">版本</dt>
+					<dd class="tabular-nums">{connection.activeVersion ?? '—'}</dd>
+				</div>
+				<div class="flex items-center justify-between gap-3">
+					<dt class="text-surface-700">更新于</dt>
+					<dd class="text-surface-600">{fmtDate(connection.updatedAt)}</dd>
+				</div>
+			</dl>
+			{#if connection.status !== 'DISABLED'}
+				<div class="mt-5 flex items-center justify-end gap-3 border-t border-surface-100 pt-4">
+					<button class="saas-btn-ghost" onclick={disable} disabled={disabling}>
+						{disabling ? '停用中…' : '停用连接'}
+					</button>
+				</div>
+			{/if}
+		</div>
+	{:else}
+		<div class="saas-card-pad mb-6">
+			<p class="text-sm text-surface-700">本组织尚未绑定飞书应用。填写下方凭据以创建连接。</p>
+		</div>
+	{/if}
+
+	<div class="saas-card-pad">
+		<h3 class="saas-section-title mb-1">{connection ? '轮换凭据' : '创建连接'}</h3>
+		<p class="saas-muted mb-4">
+			密钥仅写入新版本，旧版本归档。{#if connection}App ID 不可变更，须与现有应用一致。{/if}
+		</p>
+		<div class="grid gap-5">
+			<div>
+				<Label.Root class="saas-label" for="app-id">App ID</Label.Root>
+				<input id="app-id" class="saas-input font-mono text-sm" bind:value={appId} />
+			</div>
+			<div>
+				<Label.Root class="saas-label" for="app-secret">App Secret</Label.Root>
+				<input id="app-secret" class="saas-input" type="password" bind:value={appSecret} />
+			</div>
+			<div>
+				<Label.Root class="saas-label" for="bot-open-id">Bot Open ID</Label.Root>
+				<input id="bot-open-id" class="saas-input font-mono text-sm" bind:value={botOpenId} />
+			</div>
+			<div>
+				<Label.Root class="saas-label" for="verification-token">Verification Token（可选）</Label.Root>
+				<input id="verification-token" class="saas-input" type="password" bind:value={verificationToken} />
+			</div>
+			<div>
+				<Label.Root class="saas-label" for="encrypt-key">Encrypt Key（可选）</Label.Root>
+				<input id="encrypt-key" class="saas-input" type="password" bind:value={encryptKey} />
+			</div>
+		</div>
+		<div class="mt-6 flex items-center gap-3 border-t border-surface-100 pt-4">
+			<div class="flex-1"></div>
+			<button class="saas-btn-ghost" onclick={resetForm} disabled={saving}>清空</button>
+			<button class="saas-btn-primary" onclick={save} disabled={saving}>
+				{saving ? '保存中…' : '保存'}
+			</button>
+		</div>
+	</div>
+{/if}

hub/admin-web/src/routes/admin/org/[slug]/members/+page.svelte

@@ -0,0 +1,164 @@
+<script lang="ts">
+	import { page } from '$app/state';
+	import { api, type OrgMember } from '$lib/api';
+	import { fmtDate } from '$lib/format';
+	import { ORG_ROLES, ORG_ROLE_LABELS, PERMISSION_ROLE_LABELS } from '$lib/constants';
+	import PageHeader from '$lib/components/PageHeader.svelte';
+	import LoadingState from '$lib/components/LoadingState.svelte';
+	import ErrorBanner from '$lib/components/ErrorBanner.svelte';
+	import EmptyState from '$lib/components/EmptyState.svelte';
+	import SelectField from '$lib/components/SelectField.svelte';
+	import { toastError, toastSuccess } from '$lib/toast';
+
+	const slug = $derived(page.params.slug ?? '');
+	const roleItems = ORG_ROLES.map((r) => ({ value: r, label: ORG_ROLE_LABELS[r] }));
+	const permHint = Object.values(PERMISSION_ROLE_LABELS).join(' / ');
+
+	let members = $state<OrgMember[]>([]);
+	let loading = $state(true);
+	let error = $state<string | null>(null);
+
+	let newOpenId = $state('');
+	let newName = $state('');
+	let newRole = $state<string>('MEMBER');
+	let adding = $state(false);
+
+	async function load() {
+		loading = true;
+		error = null;
+		try {
+			const res = await api.members(slug);
+			members = res.members;
+		} catch (err) {
+			error = err instanceof Error ? err.message : String(err);
+		} finally {
+			loading = false;
+		}
+	}
+
+	async function addMember() {
+		if (!newOpenId.trim()) return;
+		adding = true;
+		try {
+			const m = await api.addMember(slug, {
+				feishuOpenId: newOpenId.trim(),
+				role: newRole,
+				...(newName.trim() ? { displayName: newName.trim() } : {}),
+			});
+			members = [...members, m].sort((a, b) => a.role.localeCompare(b.role) || a.createdAt.localeCompare(b.createdAt));
+			newOpenId = '';
+			newName = '';
+			toastSuccess('成员已添加');
+		} catch (err) {
+			toastError(err instanceof Error ? err.message : String(err));
+		} finally {
+			adding = false;
+		}
+	}
+
+	async function changeRole(m: OrgMember, role: string) {
+		try {
+			await api.setMemberRole(slug, m.userId, role);
+			await load();
+			toastSuccess('角色已更新');
+		} catch (err) {
+			toastError(err instanceof Error ? err.message : String(err));
+		}
+	}
+
+	async function revoke(m: OrgMember) {
+		if (!confirm(`移除成员 ${m.displayName} 出本组织?`)) return;
+		try {
+			await api.revokeMember(slug, m.userId);
+			await load();
+			toastSuccess('成员已移除');
+		} catch (err) {
+			toastError(err instanceof Error ? err.message : String(err));
+		}
+	}
+
+	$effect(() => {
+		if (slug) load();
+	});
+</script>
+
+<PageHeader title="成员与权限" description="管理组织角色：所有者与管理员可访问本后台，成员不可。" />
+
+{#if loading}
+	<LoadingState />
+{:else if error}
+	<ErrorBanner message={error} onretry={load} />
+{:else}
+	<div class="saas-card-pad mb-6">
+		<h2 class="saas-section-title mb-4">添加成员</h2>
+		<div class="grid gap-3 md:grid-cols-[1.2fr_1fr_12rem_auto]">
+			<input class="saas-input" placeholder="飞书 open_id" bind:value={newOpenId} />
+			<input class="saas-input" placeholder="显示名（可选）" bind:value={newName} />
+			<SelectField items={roleItems} bind:value={newRole} />
+			<button class="saas-btn-primary" onclick={addMember} disabled={adding}>
+				{adding ? '添加中…' : '添加成员'}
+			</button>
+		</div>
+	</div>
+
+	<div class="saas-card overflow-hidden">
+		<div class="flex items-center justify-between border-b border-surface-200 px-5 py-3">
+			<h2 class="text-sm font-semibold">成员列表</h2>
+			<span class="saas-badge-neutral">{members.length}</span>
+		</div>
+		{#if members.length === 0}
+			<EmptyState title="暂无成员" description="使用上方表单按飞书 open_id 添加成员。" />
+		{:else}
+			<div class="overflow-x-auto">
+				<table class="data-table">
+					<thead>
+						<tr>
+							<th>用户</th>
+							<th>open_id</th>
+							<th>组织角色</th>
+							<th>加入时间</th>
+							<th></th>
+						</tr>
+					</thead>
+					<tbody>
+						{#each members as m}
+							<tr>
+								<td>
+									<div class="flex items-center gap-2.5">
+										{#if m.avatarUrl}
+											<img src={m.avatarUrl} alt="" class="h-7 w-7 border border-surface-300 object-cover" />
+										{:else}
+											<div
+												class="flex h-7 w-7 items-center justify-center border border-primary-300 bg-primary-100 text-xs font-semibold text-primary-800"
+											>
+												{m.displayName.slice(0, 1)}
+											</div>
+										{/if}
+										<span class="font-medium">{m.displayName}</span>
+									</div>
+								</td>
+								<td class="font-mono text-xs text-surface-700">{m.feishuOpenId}</td>
+								<td class="min-w-36">
+									<SelectField
+										items={roleItems}
+										value={m.role}
+										onchange={(role) => {
+											if (role !== m.role) changeRole(m, role);
+										}}
+									/>
+								</td>
+								<td class="text-surface-700">{fmtDate(m.createdAt)}</td>
+								<td class="text-right">
+									<button class="saas-btn-danger py-1! text-sm" onclick={() => revoke(m)}>移除</button>
+								</td>
+							</tr>
+						{/each}
+					</tbody>
+				</table>
+			</div>
+		{/if}
+		<p class="border-t border-surface-300 px-5 py-3 text-xs text-surface-600">
+			组织角色控制后台访问；项目级权限由「项目」页团队授权（{permHint}）决定。
+		</p>
+	</div>
+{/if}

hub/admin-web/src/routes/admin/org/[slug]/projects/+page.svelte

@@ -0,0 +1,205 @@
+<script lang="ts">
+	import { page } from '$app/state';
+	import { api, type ExplorerData, type ExplorerFolder, type ExplorerProject, type OrgMembership } from '$lib/api';
+	import { session } from '$lib/session';
+	import FolderTree from '$lib/components/FolderTree.svelte';
+	import PageHeader from '$lib/components/PageHeader.svelte';
+	import LoadingState from '$lib/components/LoadingState.svelte';
+	import ErrorBanner from '$lib/components/ErrorBanner.svelte';
+	import EmptyState from '$lib/components/EmptyState.svelte';
+	import { Label } from 'bits-ui';
+	import Modal from '$lib/components/Modal.svelte';
+	import SelectField from '$lib/components/SelectField.svelte';
+	import { fmtDate } from '$lib/format';
+	import { toastError, toastSuccess } from '$lib/toast';
+
+	const slug = $derived(page.params.slug ?? '');
+	const org = $derived(
+		($session.me?.organizations.find((o) => o.slug === slug) as OrgMembership | undefined) ?? null,
+	);
+	const isAdmin = $derived(!!org && (org.role === 'OWNER' || org.role === 'ADMIN'));
+
+	let data = $state<ExplorerData | null>(null);
+	let myProjects = $state<ExplorerProject[] | null>(null);
+	let loading = $state(true);
+	let error = $state<string | null>(null);
+
+	let showFolderModal = $state(false);
+	let folderName = $state('');
+	let folderParent = $state('');
+
+	let showProjectModal = $state(false);
+	let projectName = $state('');
+	let projectFolder = $state('');
+
+	async function load() {
+		loading = true;
+		error = null;
+		try {
+			if (isAdmin) {
+				data = await api.explorer(slug);
+				myProjects = null;
+			} else {
+				myProjects = (await api.myProjects(slug)).projects;
+				data = null;
+			}
+		} catch (err) {
+			error = err instanceof Error ? err.message : String(err);
+		} finally {
+			loading = false;
+		}
+	}
+
+	async function createFolder() {
+		if (!folderName.trim()) return;
+		try {
+			await api.createFolder(slug, {
+				name: folderName.trim(),
+				...(folderParent ? { parentId: folderParent } : {}),
+			});
+			folderName = '';
+			folderParent = '';
+			showFolderModal = false;
+			await load();
+			toastSuccess('文件夹已创建');
+		} catch (err) {
+			toastError(err instanceof Error ? err.message : String(err));
+		}
+	}
+
+	async function createProject() {
+		if (!projectName.trim()) return;
+		try {
+			const res = await api.createProject(slug, {
+				name: projectName.trim(),
+				...(projectFolder ? { folderId: projectFolder } : {}),
+			});
+			projectName = '';
+			projectFolder = '';
+			showProjectModal = false;
+			window.location.href = `/admin/org/${slug}/projects/${res.id}`;
+		} catch (err) {
+			toastError(err instanceof Error ? err.message : String(err));
+		}
+	}
+
+	function folderPath(f: ExplorerFolder): string {
+		if (!data) return f.name;
+		const parts: string[] = [f.name];
+		let cur: ExplorerFolder | undefined = f;
+		while (cur?.parentId) {
+			const parent = data.folders.find((x) => x.id === cur!.parentId);
+			if (!parent) break;
+			parts.unshift(parent.name);
+			cur = parent;
+		}
+		return parts.join(' / ');
+	}
+
+	function folderItems() {
+		if (!data) return [{ value: '', label: '（根）' }];
+		return [{ value: '', label: '（根）' }, ...data.folders.map((f) => ({ value: f.id, label: folderPath(f) }))];
+	}
+
+	$effect(() => {
+		if (slug && org) load();
+	});
+</script>
+
+{#if loading}
+	<LoadingState />
+{:else if error}
+	<ErrorBanner message={error} onretry={load} />
+{:else if isAdmin && data}
+	<PageHeader title="项目" description="文件夹是透明组织节点；项目是权限边界。">
+		{#snippet actions()}
+			<button class="saas-btn-secondary" onclick={() => (showFolderModal = true)}>新建文件夹</button>
+			<button class="saas-btn-primary" onclick={() => (showProjectModal = true)}>新建项目</button>
+		{/snippet}
+	</PageHeader>
+
+	<div class="saas-card p-2 sm:p-3">
+		{#if data.projects.filter((p) => !p.folderId).length === 0 && data.folders.filter((f) => !f.parentId).length === 0}
+			<EmptyState title="暂无项目" description="新建文件夹或项目，开始组织你的教研资产。" />
+		{:else}
+			<FolderTree folders={data.folders} projects={data.projects} parentId={null} {slug} />
+		{/if}
+	</div>
+
+	<Modal bind:open={showFolderModal} title="新建文件夹">
+		<Label.Root class="saas-label" for="folder-name">名称</Label.Root>
+		<input
+			id="folder-name"
+			class="saas-input mb-4"
+			bind:value={folderName}
+			onkeydown={(e) => {
+				if (e.key === 'Enter') createFolder();
+			}}
+		/>
+		{#if data && data.folders.length > 0}
+			<p class="saas-label">父文件夹（可选）</p>
+			<div class="mb-4">
+				<SelectField items={folderItems()} bind:value={folderParent} />
+			</div>
+		{/if}
+		<div class="flex justify-end gap-2">
+			<button class="saas-btn-ghost" onclick={() => (showFolderModal = false)}>取消</button>
+			<button class="saas-btn-primary" onclick={createFolder}>创建</button>
+		</div>
+	</Modal>
+
+	<Modal bind:open={showProjectModal} title="新建项目">
+		<Label.Root class="saas-label" for="project-name">项目名</Label.Root>
+		<input
+			id="project-name"
+			class="saas-input mb-4"
+			bind:value={projectName}
+			onkeydown={(e) => {
+				if (e.key === 'Enter') createProject();
+			}}
+		/>
+		{#if data && data.folders.length > 0}
+			<p class="saas-label">文件夹（可选）</p>
+			<div class="mb-4">
+				<SelectField items={folderItems()} bind:value={projectFolder} />
+			</div>
+		{/if}
+		<div class="flex justify-end gap-2">
+			<button class="saas-btn-ghost" onclick={() => (showProjectModal = false)}>取消</button>
+			<button class="saas-btn-primary" onclick={createProject}>创建</button>
+		</div>
+	</Modal>
+{:else if myProjects !== null}
+	<PageHeader title="我的项目" description="你拥有访问授权的项目。">
+		{#snippet actions()}
+			<span class="saas-badge-neutral">仅显示已授权项目</span>
+		{/snippet}
+	</PageHeader>
+
+	<div class="saas-card overflow-hidden">
+		{#if myProjects.length === 0}
+			<EmptyState title="暂无可访问项目" description="当团队被授予项目访问权限时，项目会出现在这里。" />
+		{:else}
+			<table class="data-table">
+				<thead>
+					<tr>
+						<th>项目</th>
+						<th>飞书群</th>
+						<th>创建时间</th>
+					</tr>
+				</thead>
+				<tbody>
+					{#each myProjects as p}
+						<tr class="cursor-pointer" onclick={() => (window.location.href = `/admin/org/${slug}/projects/${p.id}`)}>
+							<td class="font-medium">{p.name}</td>
+							<td class="font-mono text-xs">{p.binding ? `群 ${p.binding.chatId}` : '—'}</td>
+							<td class="text-surface-700">{fmtDate(p.createdAt)}</td>
+						</tr>
+					{/each}
+				</tbody>
+			</table>
+		{/if}
+	</div>
+{:else}
+	<EmptyState title="项目数据不可用" description="无法加载项目列表。" />
+{/if}

hub/admin-web/src/routes/admin/org/[slug]/projects/[projectId]/+page.svelte

@@ -0,0 +1,304 @@
+<script lang="ts">
+	import { page } from '$app/state';
+	import {
+		api,
+		type ProjectDetail,
+		type TeamAccessEntry,
+		type TeamRow,
+		type SessionSummary,
+		type ExplorerData,
+	} from '$lib/api';
+	import { fmtDate, permissionRoleLabel } from '$lib/format';
+	import { PERMISSION_ROLES, PERMISSION_ROLE_LABELS } from '$lib/constants';
+	import PageHeader from '$lib/components/PageHeader.svelte';
+	import LoadingState from '$lib/components/LoadingState.svelte';
+	import ErrorBanner from '$lib/components/ErrorBanner.svelte';
+	import EmptyState from '$lib/components/EmptyState.svelte';
+	import SelectField from '$lib/components/SelectField.svelte';
+	import { toastError, toastSuccess } from '$lib/toast';
+
+	const slug = $derived(page.params.slug ?? '');
+	const projectId = $derived(page.params.projectId ?? '');
+	const roleItems = PERMISSION_ROLES.map((r) => ({ value: r, label: PERMISSION_ROLE_LABELS[r] }));
+	const roleChain = `${PERMISSION_ROLE_LABELS.READ} ⊂ ${PERMISSION_ROLE_LABELS.EDIT} ⊂ ${PERMISSION_ROLE_LABELS.MANAGE}`;
+
+	let proj = $state<ProjectDetail | null>(null);
+	let access = $state<TeamAccessEntry[]>([]);
+	let sessions = $state<SessionSummary[]>([]);
+	let teams = $state<TeamRow[]>([]);
+	let explorer = $state<ExplorerData | null>(null);
+	let loading = $state(true);
+	let error = $state<string | null>(null);
+
+	let grantTeam = $state('');
+	let grantRole = $state<string>('EDIT');
+	let moveFolder = $state('');
+
+	const actorIsOrgAdmin = $derived(proj?.actorIsOrgAdmin ?? false);
+	const actorCanManage = $derived(proj?.actorCanManageProject ?? false);
+
+	async function load() {
+		loading = true;
+		error = null;
+		try {
+			// Project detail + team-access list are gated to project read/oversight.
+			const [p, a] = await Promise.all([api.project(slug, projectId), api.teamAccess(slug, projectId)]);
+			proj = p;
+			access = a.access;
+			// Team list is needed for grant UI whenever the actor has project MANAGE
+			// (org admin or member). Sessions/explorer stay org-admin oversight only.
+			const needTeams = p.actorIsOrgAdmin === true || p.actorCanManageProject === true;
+			const [s, t, e] = await Promise.all([
+				p.actorIsOrgAdmin ? api.sessions(slug, projectId) : Promise.resolve({ sessions: [] as SessionSummary[] }),
+				needTeams ? api.teams(slug) : Promise.resolve({ teams: [] as TeamRow[] }),
+				p.actorIsOrgAdmin ? api.explorer(slug) : Promise.resolve(null as ExplorerData | null),
+			]);
+			sessions = s.sessions;
+			teams = t.teams;
+			explorer = e;
+			if (p.actorIsOrgAdmin) {
+				moveFolder = p.folderId ?? '';
+			}
+		} catch (err) {
+			error = err instanceof Error ? err.message : String(err);
+		} finally {
+			loading = false;
+		}
+	}
+
+	async function rename() {
+		if (!proj) return;
+		const name = prompt('新名称', proj.name);
+		if (!name) return;
+		try {
+			await api.renameProject(slug, projectId, name);
+			await load();
+			toastSuccess('已重命名');
+		} catch (err) {
+			toastError(err instanceof Error ? err.message : String(err));
+		}
+	}
+
+	async function archiveBinding() {
+		if (!confirm('解绑当前飞书群? 用户将无法通过该群触发智能体。')) return;
+		try {
+			await api.archiveBinding(slug, projectId);
+			await load();
+			toastSuccess('已解绑飞书群');
+		} catch (err) {
+			toastError(err instanceof Error ? err.message : String(err));
+		}
+	}
+
+	async function archiveProject() {
+		if (!confirm(`归档项目 ${proj?.name}?`)) return;
+		try {
+			await api.archiveProject(slug, projectId);
+			window.location.href = `/admin/org/${slug}/projects`;
+		} catch (err) {
+			toastError(err instanceof Error ? err.message : String(err));
+		}
+	}
+
+	async function move() {
+		try {
+			await api.moveProject(slug, projectId, moveFolder || null);
+			await load();
+			toastSuccess('已移动');
+		} catch (err) {
+			toastError(err instanceof Error ? err.message : String(err));
+		}
+	}
+
+	async function grant() {
+		if (!grantTeam) return;
+		try {
+			await api.grantTeamAccess(slug, projectId, { teamId: grantTeam, role: grantRole });
+			grantTeam = '';
+			await load();
+			toastSuccess('已授权');
+		} catch (err) {
+			toastError(err instanceof Error ? err.message : String(err));
+		}
+	}
+
+	async function revoke(t: TeamAccessEntry) {
+		if (!confirm(`撤销 ${t.teamName} 对此项目的授权?`)) return;
+		try {
+			await api.revokeTeamAccess(slug, projectId, t.teamId);
+			await load();
+			toastSuccess('已撤销授权');
+		} catch (err) {
+			toastError(err instanceof Error ? err.message : String(err));
+		}
+	}
+
+	function folderItems() {
+		const items = [{ value: '', label: '（根）' }];
+		if (!explorer) return items;
+		return [...items, ...explorer.folders.map((f) => ({ value: f.id, label: f.name }))];
+	}
+
+	function teamItems() {
+		return [{ value: '', label: '选择团队…' }, ...teams.map((t) => ({ value: t.id, label: `${t.name}（${t.slug}）` }))];
+	}
+
+	$effect(() => {
+		if (slug && projectId) load();
+	});
+</script>
+
+{#if loading}
+	<LoadingState />
+{:else if error}
+	<ErrorBanner message={error} onretry={load} />
+{:else if proj}
+	<div class="mb-2">
+		<a
+			href={`/admin/org/${slug}/projects`}
+			class="inline-flex items-center gap-1 text-sm text-surface-700 hover:text-primary-600"
+		>
+			← 返回项目列表
+		</a>
+	</div>
+
+	{@const detail = proj}
+	<PageHeader title={detail.name} description={`项目是权限边界；通过团队授予 ${roleChain}。`}>
+		{#snippet actions()}
+			{#if actorIsOrgAdmin}
+				<button class="saas-btn-secondary py-1.5! text-sm" onclick={rename}>重命名</button>
+				{#if detail.binding}
+					<button class="saas-btn-secondary py-1.5! text-sm" onclick={archiveBinding}>解绑飞书群</button>
+				{/if}
+				<button class="saas-btn-danger py-1.5! text-sm" onclick={archiveProject}>归档</button>
+			{/if}
+		{/snippet}
+	</PageHeader>
+
+	<div class="saas-card-pad mb-6">
+		<dl class="grid gap-x-8 gap-y-3 text-sm sm:grid-cols-2">
+			<div>
+				<dt class="text-xs font-medium uppercase tracking-wide text-surface-600">工作区路径</dt>
+				<dd class="mt-0.5 break-all font-mono text-xs text-surface-700">{proj.workspaceDir}</dd>
+			</div>
+			<div>
+				<dt class="text-xs font-medium uppercase tracking-wide text-surface-600">创建者</dt>
+				<dd class="mt-0.5 text-surface-800">
+					{proj.createdBy ? `${proj.createdBy.displayName} (${proj.createdBy.feishuOpenId})` : '—'}
+				</dd>
+			</div>
+			<div>
+				<dt class="text-xs font-medium uppercase tracking-wide text-surface-600">文件夹</dt>
+				<dd class="mt-0.5 text-surface-800">{proj.folder ? proj.folder.name : '（根）'}</dd>
+			</div>
+			<div>
+				<dt class="text-xs font-medium uppercase tracking-wide text-surface-600">飞书群</dt>
+				<dd class="mt-0.5 text-surface-800">
+					{#if proj.binding}
+						<span class="saas-badge-success mr-1">已绑定</span>
+						<span class="font-mono text-xs">群 {proj.binding.chatId}</span>
+						<span class="text-surface-600"> · {fmtDate(proj.binding.createdAt)}</span>
+					{:else}
+						<span class="saas-badge-neutral">未绑定</span>
+					{/if}
+				</dd>
+			</div>
+			<div>
+				<dt class="text-xs font-medium uppercase tracking-wide text-surface-600">创建时间</dt>
+				<dd class="mt-0.5 text-surface-800">{fmtDate(proj.createdAt)}</dd>
+			</div>
+		</dl>
+
+		{#if explorer}
+			<div class="mt-5 flex flex-wrap items-end gap-2 border-t border-surface-100 pt-4">
+				<div class="min-w-48 flex-1">
+					<p class="saas-label">移动到文件夹</p>
+					<SelectField items={folderItems()} bind:value={moveFolder} />
+				</div>
+				<button class="saas-btn-secondary" onclick={move}>移动</button>
+			</div>
+		{/if}
+	</div>
+
+	<div class="saas-card-pad mb-6">
+		<h3 class="saas-section-title mb-1">团队授权</h3>
+		<p class="saas-muted mb-4">通过团队授权项目访问。一项目可授多团队，一团队可访问多项目。</p>
+
+		{#if actorCanManage}
+			<div class="mb-4 grid gap-2 sm:grid-cols-[1fr_10rem_auto]">
+				<SelectField items={teamItems()} bind:value={grantTeam} />
+				<SelectField items={roleItems} bind:value={grantRole} />
+				<button class="saas-btn-primary" onclick={grant}>授权</button>
+			</div>
+		{:else}
+			<p class="mb-4 text-xs text-surface-600">需要项目 MANAGE 授权才能增删团队访问。</p>
+		{/if}
+
+		{#if access.length === 0}
+			<EmptyState title="暂无团队授权" description="选择团队并授予角色以开放项目访问。" />
+		{:else}
+			<table class="data-table">
+				<thead>
+					<tr>
+						<th>团队</th>
+						<th>标识</th>
+						<th>角色</th>
+						<th></th>
+					</tr>
+				</thead>
+				<tbody>
+					{#each access as g}
+						<tr>
+							<td class="font-medium">{g.teamName}</td>
+							<td class="font-mono text-xs">/{g.teamSlug}</td>
+							<td><span class="saas-badge-primary">{permissionRoleLabel(g.role)}</span></td>
+							<td class="text-right">
+								{#if actorCanManage}
+									<button class="saas-btn-danger py-1! text-xs" onclick={() => revoke(g)}>撤销</button>
+								{:else}
+									<span class="text-xs text-surface-500">—</span>
+								{/if}
+							</td>
+						</tr>
+					{/each}
+				</tbody>
+			</table>
+		{/if}
+	</div>
+
+	{#if actorIsOrgAdmin}
+		<div class="saas-card overflow-hidden">
+			<div class="border-b border-surface-200 px-5 py-3">
+				<h3 class="text-sm font-semibold">智能体会话</h3>
+			</div>
+			{#if sessions.length === 0}
+				<EmptyState title="暂无会话" description="飞书侧触发智能体后会显示在此。" />
+			{:else}
+				<table class="data-table">
+					<thead>
+						<tr>
+							<th>供应方 / 角色</th>
+							<th>模型</th>
+							<th>运行次数</th>
+							<th>更新</th>
+						</tr>
+					</thead>
+					<tbody>
+						{#each sessions as s}
+							<tr>
+								<td class="font-mono text-xs">{s.provider} / {s.roleId}</td>
+								<td class="font-mono text-xs">{s.model}</td>
+								<td class="tabular-nums">{s.runCount}</td>
+								<td class="text-surface-700">{fmtDate(s.updatedAt)}</td>
+							</tr>
+						{/each}
+					</tbody>
+				</table>
+			{/if}
+		</div>
+	{/if}
+{:else}
+	<div class="saas-empty">
+		<p class="text-sm text-surface-600">项目数据不可用</p>
+	</div>
+{/if}

hub/admin-web/src/routes/admin/org/[slug]/provider/+page.svelte

@@ -0,0 +1,169 @@
+<script lang="ts">
+	import { page } from '$app/state';
+	import { api, type ProviderConnectionRow } from '$lib/api';
+	import { fmtDate, providerModeLabel } from '$lib/format';
+	import { Label } from 'bits-ui';
+	import PageHeader from '$lib/components/PageHeader.svelte';
+	import LoadingState from '$lib/components/LoadingState.svelte';
+	import ErrorBanner from '$lib/components/ErrorBanner.svelte';
+	import { toastError, toastSuccess } from '$lib/toast';
+
+	const slug = $derived(page.params.slug ?? '');
+
+	let connections = $state<ProviderConnectionRow[]>([]);
+	let loading = $state(true);
+	let error = $state<string | null>(null);
+
+	let providerId = $state('');
+	let baseUrl = $state('');
+	let authToken = $state('');
+	let anthropicApiKey = $state('');
+	let saving = $state(false);
+
+	async function load() {
+		loading = true;
+		error = null;
+		try {
+			const res = await api.providerConnections(slug);
+			connections = res.connections;
+		} catch (err) {
+			error = err instanceof Error ? err.message : String(err);
+		} finally {
+			loading = false;
+		}
+	}
+
+	function startRotate(row: ProviderConnectionRow) {
+		providerId = row.providerId;
+		baseUrl = '';
+		authToken = '';
+		anthropicApiKey = '';
+	}
+
+	function resetForm() {
+		providerId = '';
+		baseUrl = '';
+		authToken = '';
+		anthropicApiKey = '';
+	}
+
+	async function save() {
+		const id = providerId.trim();
+		if (id === '') {
+			toastError('请填写供应方 ID');
+			return;
+		}
+		const url = baseUrl.trim();
+		const token = authToken.trim();
+		if (url === '' || token === '') {
+			toastError('接口地址与访问令牌均为必填');
+			return;
+		}
+		saving = true;
+		const body: { baseUrl: string; authToken: string; anthropicApiKey?: string } = {
+			baseUrl: url,
+			authToken: token,
+		};
+		const key = anthropicApiKey.trim();
+		if (key !== '') body.anthropicApiKey = key;
+		try {
+			await api.rotateProviderConnection(slug, id, body);
+			toastSuccess('凭据已轮换');
+			resetForm();
+			await load();
+		} catch (err) {
+			toastError(err instanceof Error ? err.message : String(err));
+		} finally {
+			saving = false;
+		}
+	}
+
+	$effect(() => {
+		if (slug) load();
+	});
+</script>
+
+<PageHeader
+	title="模型供应方"
+	description="本组织的模型供应方连接。BYOK 由组织所有者/管理员轮换；平台托管连接由平台管理员配置。凭据按组织隔离，缺失或校验失败即拒绝运行（fail-closed）。"
+/>
+
+{#if loading}
+	<LoadingState />
+{:else if error}
+	<ErrorBanner message={error} onretry={load} />
+{:else}
+	<div class="saas-card overflow-hidden mb-6">
+		<div class="border-b border-surface-200 px-5 py-3">
+			<h3 class="text-sm font-semibold text-surface-800">连接</h3>
+		</div>
+		{#if connections.length === 0}
+			<div class="saas-empty"><p class="text-sm text-surface-600">尚无供应方连接</p></div>
+		{:else}
+			<div class="overflow-x-auto">
+				<table class="data-table">
+					<thead>
+						<tr>
+							<th>供应方</th>
+							<th>凭据模式</th>
+							<th>状态</th>
+							<th>版本</th>
+							<th>更新于</th>
+							<th></th>
+						</tr>
+					</thead>
+					<tbody>
+						{#each connections as row}
+							<tr>
+								<td class="font-mono text-sm">{row.providerId}</td>
+								<td>{providerModeLabel(row.mode)}</td>
+								<td>{row.status}</td>
+								<td class="tabular-nums">{row.activeVersion ?? '—'}</td>
+								<td class="text-surface-600">{fmtDate(row.updatedAt)}</td>
+								<td>
+									{#if row.mode === 'BYOK'}
+										<button class="saas-btn-ghost px-2! py-1! text-xs" onclick={() => startRotate(row)}>轮换</button>
+									{:else}
+										<span class="text-xs text-surface-500">平台管理</span>
+									{/if}
+								</td>
+							</tr>
+						{/each}
+					</tbody>
+				</table>
+			</div>
+		{/if}
+	</div>
+
+	<div class="saas-card-pad">
+		<h3 class="saas-section-title mb-1">轮换 BYOK 凭据</h3>
+		<p class="saas-muted mb-4">
+			密钥仅写入新版本，旧版本归档；保存时需重新填写接口地址与访问令牌。平台托管连接不在此处管理。
+		</p>
+		<div class="grid gap-5">
+			<div>
+				<Label.Root class="saas-label" for="provider-id">供应方 ID</Label.Root>
+				<input id="provider-id" class="saas-input font-mono text-sm" bind:value={providerId} placeholder="openrouter" />
+			</div>
+			<div>
+				<Label.Root class="saas-label" for="base-url">接口地址</Label.Root>
+				<input id="base-url" class="saas-input" placeholder="https://openrouter.ai/api" bind:value={baseUrl} />
+			</div>
+			<div>
+				<Label.Root class="saas-label" for="auth-token">访问令牌</Label.Root>
+				<input id="auth-token" class="saas-input" type="password" bind:value={authToken} />
+			</div>
+			<div>
+				<Label.Root class="saas-label" for="anthropic-key">Anthropic API Key（可选）</Label.Root>
+				<input id="anthropic-key" class="saas-input" type="password" bind:value={anthropicApiKey} />
+			</div>
+		</div>
+		<div class="mt-6 flex items-center gap-3 border-t border-surface-100 pt-4">
+			<div class="flex-1"></div>
+			<button class="saas-btn-ghost" onclick={resetForm} disabled={saving}>清空</button>
+			<button class="saas-btn-primary" onclick={save} disabled={saving}>
+				{saving ? '保存中…' : '保存'}
+			</button>
+		</div>
+	</div>
+{/if}

hub/admin-web/src/routes/admin/org/[slug]/teams/+page.svelte

@@ -0,0 +1,233 @@
+<script lang="ts">
+	import { Collapsible } from 'bits-ui';
+	import { page } from '$app/state';
+	import { api, type TeamRow, type TeamMemberRow } from '$lib/api';
+	import { fmtDate } from '$lib/format';
+	import PageHeader from '$lib/components/PageHeader.svelte';
+	import LoadingState from '$lib/components/LoadingState.svelte';
+	import ErrorBanner from '$lib/components/ErrorBanner.svelte';
+	import EmptyState from '$lib/components/EmptyState.svelte';
+	import { toastError, toastSuccess } from '$lib/toast';
+
+	const slug = $derived(page.params.slug ?? '');
+
+	let teams = $state<TeamRow[]>([]);
+	let loading = $state(true);
+	let error = $state<string | null>(null);
+
+	let newSlug = $state('');
+	let newName = $state('');
+	let newDesc = $state('');
+	let adding = $state(false);
+
+	let expandedId = $state<string | null>(null);
+	let teamMembers = $state<TeamMemberRow[]>([]);
+	let memberInput = $state('');
+	let loadingMembers = $state(false);
+
+	async function load() {
+		loading = true;
+		error = null;
+		try {
+			const res = await api.teams(slug);
+			teams = res.teams;
+		} catch (err) {
+			error = err instanceof Error ? err.message : String(err);
+		} finally {
+			loading = false;
+		}
+	}
+
+	const SLUG_RE = /^[a-z0-9]([a-z0-9-]*[a-z0-9])?$/;
+
+	async function createTeam() {
+		if (!newSlug.trim() || !newName.trim()) return;
+		const teamSlug = newSlug.trim().toLowerCase();
+		if (!SLUG_RE.test(teamSlug)) {
+			toastError('标识须为小写字母数字，可用连字符连接');
+			return;
+		}
+		adding = true;
+		try {
+			await api.createTeam(slug, {
+				slug: teamSlug,
+				name: newName.trim(),
+				...(newDesc.trim() ? { description: newDesc.trim() } : {}),
+			});
+			newSlug = '';
+			newName = '';
+			newDesc = '';
+			await load();
+			toastSuccess('团队已创建');
+		} catch (err) {
+			toastError(err instanceof Error ? err.message : String(err));
+		} finally {
+			adding = false;
+		}
+	}
+
+	async function archiveTeam(t: TeamRow) {
+		if (!confirm(`归档团队 ${t.name}? 归档后该团队不再解析为项目授权主体。`)) return;
+		try {
+			await api.archiveTeam(slug, t.id);
+			if (expandedId === t.id) expandedId = null;
+			await load();
+			toastSuccess('团队已归档');
+		} catch (err) {
+			toastError(err instanceof Error ? err.message : String(err));
+		}
+	}
+
+	async function openMembers(t: TeamRow) {
+		if (expandedId === t.id) return;
+		expandedId = t.id;
+		loadingMembers = true;
+		memberInput = '';
+		try {
+			const res = await api.teamMembers(slug, t.id);
+			teamMembers = res.members;
+		} catch (err) {
+			toastError(err instanceof Error ? err.message : String(err));
+		} finally {
+			loadingMembers = false;
+		}
+	}
+
+	function onExpandChange(t: TeamRow, open: boolean) {
+		if (open) void openMembers(t);
+		else if (expandedId === t.id) expandedId = null;
+	}
+
+	async function addMember(t: TeamRow) {
+		if (!memberInput.trim()) return;
+		const v = memberInput.trim();
+		try {
+			await api.addTeamMember(slug, t.id, v.startsWith('ou') ? { feishuOpenId: v } : { userId: v });
+			memberInput = '';
+			const res = await api.teamMembers(slug, t.id);
+			teamMembers = res.members;
+			await load();
+			toastSuccess('已加入团队');
+		} catch (err) {
+			toastError(err instanceof Error ? err.message : String(err));
+		}
+	}
+
+	async function revokeMember(t: TeamRow, m: TeamMemberRow) {
+		if (!confirm(`将 ${m.displayName} 移出团队 ${t.name}?`)) return;
+		try {
+			await api.revokeTeamMember(slug, t.id, m.userId);
+			const res = await api.teamMembers(slug, t.id);
+			teamMembers = res.members;
+			await load();
+			toastSuccess('已移出团队');
+		} catch (err) {
+			toastError(err instanceof Error ? err.message : String(err));
+		}
+	}
+
+	$effect(() => {
+		if (slug) load();
+	});
+</script>
+
+<PageHeader title="团队" description="团队是项目授权主体，可被授予只读、编辑或管理权限。" />
+
+{#if loading}
+	<LoadingState />
+{:else if error}
+	<ErrorBanner message={error} onretry={load} />
+{:else}
+	<div class="saas-card-pad mb-6">
+		<h2 class="saas-section-title mb-4">新建团队</h2>
+		<div class="grid gap-3 md:grid-cols-[1fr_1fr_1.2fr_auto]">
+			<input class="saas-input" placeholder="标识（如 math-g7）" bind:value={newSlug} />
+			<input class="saas-input" placeholder="名称" bind:value={newName} />
+			<input class="saas-input" placeholder="描述（可选）" bind:value={newDesc} />
+			<button class="saas-btn-primary" onclick={createTeam} disabled={adding}>新建</button>
+		</div>
+	</div>
+
+	{#if teams.length === 0}
+		<div class="saas-card">
+			<EmptyState title="暂无团队" description="创建团队后，可在项目页授权项目访问。" />
+		</div>
+	{:else}
+		<div class="space-y-3">
+			{#each teams as t (t.id)}
+				<Collapsible.Root
+					class="saas-card p-5"
+					open={expandedId === t.id}
+					onOpenChange={(open) => onExpandChange(t, open)}
+				>
+					<div class="flex flex-wrap items-center gap-2.5">
+						<span class="text-base font-semibold text-surface-900">{t.name}</span>
+						<span class="font-mono text-xs text-surface-600">/{t.slug}</span>
+						<span class="saas-badge-neutral">{t.memberCount} 成员</span>
+						<div class="ml-auto flex flex-wrap gap-2">
+							<Collapsible.Trigger class="saas-btn-secondary py-1.5! text-sm">
+								{expandedId === t.id ? '收起' : '管理成员'}
+							</Collapsible.Trigger>
+							<button type="button" class="saas-btn-danger py-1.5! text-sm" onclick={() => archiveTeam(t)}>
+								归档
+							</button>
+						</div>
+					</div>
+					{#if t.description}
+						<p class="mt-1.5 text-sm text-surface-700">{t.description}</p>
+					{/if}
+					<p class="mt-1 text-xs text-surface-600">创建于 {fmtDate(t.createdAt)}</p>
+
+					<Collapsible.Content>
+						<div class="mt-4 border-t border-surface-200 pt-4">
+							{#if loadingMembers && expandedId === t.id}
+								<p class="text-sm text-surface-600">加载中…</p>
+							{:else if expandedId === t.id}
+								<div class="mb-4 flex gap-2">
+									<input
+										class="saas-input"
+										placeholder="飞书 open_id 或用户 id"
+										bind:value={memberInput}
+										onkeydown={(e) => {
+											if (e.key === 'Enter') addMember(t);
+										}}
+									/>
+									<button class="saas-btn-secondary shrink-0" onclick={() => addMember(t)}>加入</button>
+								</div>
+								{#if teamMembers.length === 0}
+									<p class="py-3 text-center text-sm text-surface-600">团队暂无成员</p>
+								{:else}
+									<table class="data-table">
+										<thead>
+											<tr>
+												<th>成员</th>
+												<th>open_id</th>
+												<th>加入时间</th>
+												<th></th>
+											</tr>
+										</thead>
+										<tbody>
+											{#each teamMembers as m}
+												<tr>
+													<td class="font-medium">{m.displayName}</td>
+													<td class="font-mono text-xs">{m.feishuOpenId}</td>
+													<td class="text-surface-700">{fmtDate(m.createdAt)}</td>
+													<td class="text-right">
+														<button class="saas-btn-danger py-1! text-xs" onclick={() => revokeMember(t, m)}>
+															移除
+														</button>
+													</td>
+												</tr>
+											{/each}
+										</tbody>
+									</table>
+								{/if}
+							{/if}
+						</div>
+					</Collapsible.Content>
+				</Collapsible.Root>
+			{/each}
+		</div>
+	{/if}
+	<p class="mt-4 text-xs text-surface-600">归档团队会同步撤销其活跃的项目授权。</p>
+{/if}

hub/admin-web/src/routes/app.css

@@ -0,0 +1,692 @@
+@import 'tailwindcss';
+
+@import '@skeletonlabs/skeleton';
+@import '@skeletonlabs/skeleton/themes/hamlindigo';
+
+@source './**/*.{html,js,svelte,ts}';
+@source '../lib/**/*.{html,js,svelte,ts}';
+
+/* Flat industrial: zero radius, higher-contrast surfaces, CJK-first type */
+@theme {
+	--font-sans:
+		'Noto Sans SC', 'PingFang SC', 'Hiragino Sans GB', 'Microsoft YaHei', 'Inter', ui-sans-serif, system-ui,
+		-apple-system, 'Segoe UI', sans-serif;
+	--font-mono: 'JetBrains Mono', ui-monospace, 'SF Mono', Menlo, Consolas, monospace;
+
+	--radius-none: 0;
+	--radius-sm: 0;
+	--radius-md: 0;
+	--radius-lg: 0;
+	--radius-xl: 0;
+	--radius-2xl: 0;
+	--radius-3xl: 0;
+	--radius-full: 0;
+	--radius: 0;
+}
+
+@layer base {
+	html {
+		height: 100%;
+		-webkit-font-smoothing: antialiased;
+		-moz-osx-font-smoothing: grayscale;
+		text-rendering: optimizeLegibility;
+		font-feature-settings:
+			'kern' 1,
+			'liga' 1;
+		/* Prefer readable CJK metrics over Latin optical sizing */
+		text-size-adjust: 100%;
+	}
+
+	body {
+		min-height: 100%;
+		font-family: var(--font-sans);
+		font-size: 15px;
+		line-height: 1.7;
+		letter-spacing: 0.01em;
+		/* Slightly cooler industrial surface */
+		background: var(--color-surface-100);
+		color: var(--color-surface-950, var(--color-surface-900));
+		font-variant-east-asian: proportional-width;
+	}
+
+	/* CJK headings: no negative tracking, breathing line-height */
+	h1,
+	h2,
+	h3,
+	h4,
+	h5,
+	h6 {
+		font-weight: 600;
+		line-height: 1.45;
+		letter-spacing: 0;
+		color: var(--color-surface-950, var(--color-surface-900));
+	}
+
+	p {
+		line-height: 1.75;
+	}
+
+	/* Harder focus ring for industrial UI */
+	:focus-visible {
+		outline: 2px solid var(--color-primary-600);
+		outline-offset: 2px;
+	}
+
+	::selection {
+		background: color-mix(in oklab, var(--color-primary-600) 35%, transparent);
+		color: var(--color-surface-950, var(--color-surface-900));
+	}
+
+	/* Tables: high-contrast grid, flat */
+	table.data-table {
+		width: 100%;
+		border-collapse: collapse;
+		font-size: 0.875rem;
+		line-height: 1.6;
+	}
+
+	table.data-table thead th {
+		padding: 0.625rem 0.75rem;
+		text-align: left;
+		font-weight: 600;
+		color: var(--color-surface-700);
+		background: var(--color-surface-100);
+		border-bottom: 1px solid var(--color-surface-300);
+		white-space: nowrap;
+		letter-spacing: 0.02em;
+	}
+
+	table.data-table tbody td {
+		padding: 0.75rem;
+		border-bottom: 1px solid var(--color-surface-200);
+		vertical-align: middle;
+		color: var(--color-surface-900);
+	}
+
+	table.data-table tbody tr:hover td {
+		background: var(--color-surface-100);
+	}
+
+	table.data-table tbody tr:last-child td {
+		border-bottom: none;
+	}
+}
+
+@layer components {
+	.saas-card {
+		border-radius: 0;
+		border: 1px solid var(--color-surface-300);
+		background: var(--color-surface-50);
+		box-shadow: none;
+	}
+
+	.saas-card-pad {
+		border-radius: 0;
+		border: 1px solid var(--color-surface-300);
+		background: var(--color-surface-50);
+		box-shadow: none;
+		padding: 1.25rem;
+	}
+
+	.saas-page-title {
+		font-size: 1.375rem;
+		line-height: 1.4;
+		font-weight: 700;
+		letter-spacing: 0;
+		color: var(--color-surface-950, var(--color-surface-900));
+	}
+
+	.saas-section-title {
+		font-size: 1rem;
+		line-height: 1.5;
+		font-weight: 600;
+		letter-spacing: 0;
+		color: var(--color-surface-950, var(--color-surface-900));
+	}
+
+	.saas-muted {
+		font-size: 0.875rem;
+		line-height: 1.65;
+		color: var(--color-surface-700);
+	}
+
+	.saas-label {
+		display: block;
+		margin-bottom: 0.375rem;
+		font-size: 0.875rem;
+		line-height: 1.5;
+		font-weight: 600;
+		color: var(--color-surface-800);
+	}
+
+	.saas-help {
+		margin-top: 0.375rem;
+		font-size: 0.8125rem;
+		line-height: 1.6;
+		color: var(--color-surface-600);
+	}
+
+	.saas-toolbar {
+		display: flex;
+		flex-wrap: wrap;
+		align-items: center;
+		gap: 0.75rem;
+		margin-bottom: 1.5rem;
+	}
+
+	.saas-stat {
+		border-radius: 0;
+		border: 1px solid var(--color-surface-300);
+		background: var(--color-surface-50);
+		padding: 1rem;
+		box-shadow: none;
+	}
+
+	.saas-stat-label {
+		font-size: 0.75rem;
+		font-weight: 600;
+		letter-spacing: 0.04em;
+		text-transform: uppercase;
+		color: var(--color-surface-600);
+	}
+
+	.saas-stat-value {
+		margin-top: 0.25rem;
+		font-size: 1.5rem;
+		line-height: 1.3;
+		font-weight: 700;
+		font-variant-numeric: tabular-nums;
+		letter-spacing: 0;
+		color: var(--color-surface-950, var(--color-surface-900));
+	}
+
+	.saas-empty {
+		display: flex;
+		flex-direction: column;
+		align-items: center;
+		justify-content: center;
+		gap: 0.5rem;
+		padding: 3rem 1rem;
+		text-align: center;
+		line-height: 1.7;
+	}
+
+	.saas-shell {
+		display: flex;
+		height: 100vh;
+		overflow: hidden;
+		background: var(--color-surface-100);
+	}
+
+	.saas-sidebar {
+		display: flex;
+		width: 16rem;
+		flex-shrink: 0;
+		flex-direction: column;
+		border-right: 1px solid var(--color-surface-300);
+		background: var(--color-surface-50);
+	}
+
+	.saas-main {
+		display: flex;
+		min-width: 0;
+		flex: 1;
+		flex-direction: column;
+		overflow: hidden;
+	}
+
+	.saas-topbar {
+		display: flex;
+		height: 3.5rem;
+		flex-shrink: 0;
+		align-items: center;
+		gap: 0.75rem;
+		border-bottom: 1px solid var(--color-surface-300);
+		background: var(--color-surface-50);
+		padding: 0 1.5rem;
+		/* flat: no glass */
+		backdrop-filter: none;
+	}
+
+	.saas-content {
+		flex: 1;
+		overflow-y: auto;
+	}
+
+	.saas-content-inner {
+		margin-inline: auto;
+		width: 100%;
+		max-width: 72rem;
+		padding: 1.5rem;
+	}
+
+	@media (min-width: 768px) {
+		.saas-content-inner {
+			padding: 2rem;
+		}
+	}
+
+	.saas-nav-item {
+		display: flex;
+		align-items: center;
+		gap: 0.75rem;
+		border-radius: 0;
+		padding: 0.5rem 0.75rem;
+		font-size: 0.875rem;
+		line-height: 1.5;
+		font-weight: 500;
+		color: var(--color-surface-700);
+		border-left: 2px solid transparent;
+		transition:
+			color 0.1s,
+			background-color 0.1s,
+			border-color 0.1s;
+	}
+
+	.saas-nav-item:hover {
+		background: var(--color-surface-100);
+		color: var(--color-surface-950, var(--color-surface-900));
+	}
+
+	.saas-nav-item[data-active='true'] {
+		background: var(--color-primary-50, var(--color-primary-100));
+		color: var(--color-primary-800);
+		border-left-color: var(--color-primary-600);
+		font-weight: 600;
+	}
+
+	.saas-badge {
+		display: inline-flex;
+		align-items: center;
+		border-radius: 0;
+		padding: 0.125rem 0.5rem;
+		font-size: 0.75rem;
+		line-height: 1.4;
+		font-weight: 600;
+		letter-spacing: 0.02em;
+	}
+
+	.saas-badge-neutral {
+		display: inline-flex;
+		align-items: center;
+		border-radius: 0;
+		padding: 0.125rem 0.5rem;
+		font-size: 0.75rem;
+		line-height: 1.4;
+		font-weight: 600;
+		border: 1px solid var(--color-surface-300);
+		background: var(--color-surface-100);
+		color: var(--color-surface-800);
+	}
+
+	.saas-badge-primary {
+		display: inline-flex;
+		align-items: center;
+		border-radius: 0;
+		padding: 0.125rem 0.5rem;
+		font-size: 0.75rem;
+		line-height: 1.4;
+		font-weight: 600;
+		border: 1px solid var(--color-primary-300);
+		background: var(--color-primary-100);
+		color: var(--color-primary-800);
+	}
+
+	.saas-badge-success {
+		display: inline-flex;
+		align-items: center;
+		border-radius: 0;
+		padding: 0.125rem 0.5rem;
+		font-size: 0.75rem;
+		line-height: 1.4;
+		font-weight: 600;
+		border: 1px solid var(--color-success-300);
+		background: var(--color-success-100);
+		color: var(--color-success-800);
+	}
+
+	.saas-badge-warning {
+		display: inline-flex;
+		align-items: center;
+		border-radius: 0;
+		padding: 0.125rem 0.5rem;
+		font-size: 0.75rem;
+		line-height: 1.4;
+		font-weight: 600;
+		border: 1px solid var(--color-warning-300);
+		background: var(--color-warning-100);
+		color: var(--color-warning-900);
+	}
+
+	.saas-badge-error {
+		display: inline-flex;
+		align-items: center;
+		border-radius: 0;
+		padding: 0.125rem 0.5rem;
+		font-size: 0.75rem;
+		line-height: 1.4;
+		font-weight: 600;
+		border: 1px solid var(--color-error-300);
+		background: var(--color-error-100);
+		color: var(--color-error-800);
+	}
+
+	.saas-input,
+	.saas-select,
+	.saas-textarea {
+		width: 100%;
+		border-radius: 0;
+		border: 1px solid var(--color-surface-400);
+		background: var(--color-surface-50);
+		color: var(--color-surface-950, var(--color-surface-900));
+		padding: 0.5rem 0.75rem;
+		font-size: 0.875rem;
+		line-height: 1.5;
+		outline: none;
+		transition:
+			border-color 0.1s,
+			box-shadow 0.1s;
+	}
+
+	.saas-input::placeholder,
+	.saas-textarea::placeholder {
+		color: var(--color-surface-500);
+	}
+
+	.saas-input:focus,
+	.saas-select:focus,
+	.saas-textarea:focus {
+		border-color: var(--color-primary-600);
+		box-shadow: inset 0 0 0 1px var(--color-primary-600);
+	}
+
+	.saas-textarea {
+		font-family: var(--font-mono);
+		line-height: 1.55;
+		resize: vertical;
+	}
+
+	.saas-select-trigger {
+		display: inline-flex;
+		width: 100%;
+		align-items: center;
+		border-radius: 0;
+		border: 1px solid var(--color-surface-400);
+		background: var(--color-surface-50);
+		color: var(--color-surface-950, var(--color-surface-900));
+		padding: 0.5rem 0.75rem;
+		font-size: 0.875rem;
+		line-height: 1.5;
+		outline: none;
+		transition:
+			border-color 0.1s,
+			box-shadow 0.1s;
+		cursor: pointer;
+		text-align: left;
+	}
+
+	.saas-select-trigger:focus-visible,
+	.saas-select-trigger[data-state='open'] {
+		border-color: var(--color-primary-600);
+		box-shadow: inset 0 0 0 1px var(--color-primary-600);
+	}
+
+	.saas-select-trigger:disabled,
+	.saas-select-trigger[data-disabled] {
+		cursor: not-allowed;
+		opacity: 0.55;
+	}
+
+	.saas-select-trigger [data-placeholder] {
+		color: var(--color-surface-500);
+	}
+
+	.saas-select-content {
+		z-index: 70;
+		max-height: min(18rem, var(--bits-select-content-available-height, 18rem));
+		width: var(--bits-select-anchor-width);
+		min-width: var(--bits-select-anchor-width);
+		overflow: hidden;
+		border-radius: 0;
+		border: 1px solid var(--color-surface-400);
+		background: var(--color-surface-50);
+		box-shadow: 4px 4px 0 rgb(15 23 42 / 0.12);
+		outline: none;
+	}
+
+	.saas-select-item {
+		display: flex;
+		align-items: center;
+		border-radius: 0;
+		padding: 0.45rem 0.65rem;
+		font-size: 0.875rem;
+		line-height: 1.5;
+		color: var(--color-surface-900);
+		cursor: pointer;
+		outline: none;
+		user-select: none;
+	}
+
+	.saas-select-item[data-highlighted] {
+		background: var(--color-primary-100);
+		color: var(--color-primary-900);
+	}
+
+	.saas-select-item[data-selected] {
+		color: var(--color-primary-900);
+		font-weight: 600;
+	}
+
+	.saas-select-item[data-disabled] {
+		cursor: not-allowed;
+		opacity: 0.45;
+	}
+
+	.saas-btn-primary,
+	.saas-btn-secondary,
+	.saas-btn-ghost,
+	.saas-btn-danger {
+		display: inline-flex;
+		align-items: center;
+		justify-content: center;
+		gap: 0.375rem;
+		border-radius: 0;
+		padding: 0.5rem 0.875rem;
+		font-size: 0.875rem;
+		font-weight: 600;
+		line-height: 1.4;
+		letter-spacing: 0.01em;
+		border: 1px solid transparent;
+		cursor: pointer;
+		transition:
+			background-color 0.1s,
+			color 0.1s,
+			border-color 0.1s,
+			opacity 0.1s;
+	}
+
+	.saas-btn-primary:disabled,
+	.saas-btn-secondary:disabled,
+	.saas-btn-ghost:disabled,
+	.saas-btn-danger:disabled {
+		opacity: 0.55;
+		cursor: not-allowed;
+	}
+
+	.saas-btn-primary {
+		background: var(--color-primary-600);
+		border-color: var(--color-primary-700);
+		color: var(--color-primary-contrast-500, white);
+	}
+
+	.saas-btn-primary:hover:not(:disabled) {
+		background: var(--color-primary-700);
+		border-color: var(--color-primary-800);
+	}
+
+	.saas-btn-secondary {
+		background: var(--color-surface-100);
+		border-color: var(--color-surface-400);
+		color: var(--color-surface-900);
+	}
+
+	.saas-btn-secondary:hover:not(:disabled) {
+		background: var(--color-surface-200);
+		border-color: var(--color-surface-500);
+	}
+
+	.saas-btn-ghost {
+		background: transparent;
+		border-color: transparent;
+		color: var(--color-surface-800);
+	}
+
+	.saas-btn-ghost:hover:not(:disabled) {
+		background: var(--color-surface-200);
+		color: var(--color-surface-950, var(--color-surface-900));
+	}
+
+	.saas-btn-danger {
+		background: var(--color-error-100);
+		border-color: var(--color-error-400);
+		color: var(--color-error-800);
+	}
+
+	.saas-btn-danger:hover:not(:disabled) {
+		background: var(--color-error-200);
+		border-color: var(--color-error-500);
+	}
+
+	.saas-checkbox {
+		display: inline-flex;
+		align-items: center;
+		justify-content: center;
+		width: 1.1rem;
+		height: 1.1rem;
+		flex-shrink: 0;
+		border-radius: 0;
+		border: 1px solid var(--color-surface-500);
+		background: var(--color-surface-50);
+		color: white;
+		cursor: pointer;
+		transition:
+			background 0.1s,
+			border-color 0.1s;
+	}
+
+	.saas-checkbox[data-state='checked'] {
+		background: var(--color-primary-700);
+		border-color: var(--color-primary-700);
+	}
+
+	.saas-checkbox:focus-visible {
+		outline: none;
+		box-shadow:
+			0 0 0 2px var(--color-surface-50),
+			0 0 0 4px var(--color-primary-600);
+	}
+
+	.saas-checkbox[data-disabled] {
+		cursor: not-allowed;
+		opacity: 0.5;
+	}
+
+	/* Square industrial switch (no pill) */
+	.saas-switch {
+		position: relative;
+		display: inline-flex;
+		width: 2.5rem;
+		height: 1.35rem;
+		flex-shrink: 0;
+		align-items: center;
+		border-radius: 0;
+		border: 1px solid var(--color-surface-500);
+		background: var(--color-surface-300);
+		padding: 0.125rem;
+		cursor: pointer;
+		transition:
+			background 0.1s,
+			border-color 0.1s;
+	}
+
+	.saas-switch[data-state='checked'] {
+		background: var(--color-primary-600);
+		border-color: var(--color-primary-700);
+	}
+
+	.saas-switch:focus-visible {
+		outline: none;
+		box-shadow:
+			0 0 0 2px var(--color-surface-50),
+			0 0 0 4px var(--color-primary-600);
+	}
+
+	.saas-switch[data-disabled] {
+		cursor: not-allowed;
+		opacity: 0.5;
+	}
+
+	.saas-switch-thumb {
+		display: block;
+		width: 1rem;
+		height: 1rem;
+		border-radius: 0;
+		background: white;
+		border: 1px solid var(--color-surface-400);
+		box-shadow: none;
+		transition: transform 0.1s;
+		transform: translateX(0);
+	}
+
+	.saas-switch[data-state='checked'] .saas-switch-thumb,
+	.saas-switch-thumb[data-state='checked'] {
+		transform: translateX(1.1rem);
+		border-color: var(--color-primary-800);
+	}
+
+	.saas-modal-backdrop {
+		position: fixed;
+		inset: 0;
+		z-index: 50;
+		background: rgb(2 6 23 / 0.55);
+		backdrop-filter: none;
+	}
+
+	.saas-modal {
+		position: fixed;
+		left: 50%;
+		top: 50%;
+		z-index: 51;
+		width: calc(100% - 2rem);
+		max-width: 28rem;
+		transform: translate(-50%, -50%);
+		border-radius: 0;
+		border: 1px solid var(--color-surface-400);
+		background: var(--color-surface-50);
+		padding: 1.5rem;
+		box-shadow: 6px 6px 0 rgb(15 23 42 / 0.15);
+		outline: none;
+	}
+
+	.saas-status-panel {
+		display: flex;
+		min-height: 100vh;
+		flex-direction: column;
+		align-items: center;
+		justify-content: center;
+		background: var(--color-surface-100);
+		padding: 1rem;
+	}
+
+	.saas-status-card {
+		width: 100%;
+		max-width: 28rem;
+		border-radius: 0;
+		border: 1px solid var(--color-surface-400);
+		background: var(--color-surface-50);
+		padding: 2rem;
+		text-align: center;
+		box-shadow: 4px 4px 0 rgb(15 23 42 / 0.1);
+		line-height: 1.7;
+	}
+}

hub/admin-web/static/favicon.svg

@@ -0,0 +1,5 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 32 32" fill="none">
+	<rect width="32" height="32" rx="8" fill="#4F46E5"/>
+	<path d="M8 10.5h7.5a3.5 3.5 0 0 1 0 7H11v4H8v-11Zm3 4.5h4.5a1.5 1.5 0 0 0 0-3H11v3Z" fill="white"/>
+	<path d="M20.5 21.5c1.93 0 3.5-1.34 3.5-3s-1.57-3-3.5-3S17 16.84 17 18.5s1.57 3 3.5 3Z" fill="white" opacity=".9"/>
+</svg>

hub/admin-web/static/robots.txt

@@ -0,0 +1,3 @@
+# allow crawling everything by default
+User-agent: *
+Disallow:

hub/admin-web/svelte.config.js

@@ -0,0 +1,18 @@
+import adapter from '@sveltejs/adapter-static';
+import { vitePreprocess } from '@sveltejs/vite-plugin-svelte';
+
+/** @type {import('@sveltejs/kit').Config} */
+const config = {
+	preprocess: vitePreprocess(),
+	kit: {
+		adapter: adapter({
+			pages: 'build',
+			assets: 'build',
+			fallback: 'index.html',
+			precompress: false,
+			strict: false,
+		}),
+	},
+};
+
+export default config;

hub/admin-web/tsconfig.json

@@ -0,0 +1,20 @@
+{
+	"extends": "./.svelte-kit/tsconfig.json",
+	"compilerOptions": {
+		"rewriteRelativeImportExtensions": true,
+		"allowJs": true,
+		"checkJs": true,
+		"esModuleInterop": true,
+		"forceConsistentCasingInFileNames": true,
+		"resolveJsonModule": true,
+		"skipLibCheck": true,
+		"sourceMap": true,
+		"strict": true,
+		"moduleResolution": "bundler"
+	}
+	// Path aliases are handled by https://svelte.dev/docs/kit/configuration#alias
+	// except $lib which is handled by https://svelte.dev/docs/kit/configuration#files
+	//
+	// To make changes to top-level options such as include and exclude, we recommend extending
+	// the generated config; see https://svelte.dev/docs/kit/configuration#typescript
+}

hub/admin-web/vite.config.ts

@@ -0,0 +1,13 @@
+import { sveltekit } from '@sveltejs/kit/vite';
+import tailwindcss from '@tailwindcss/vite';
+import { defineConfig } from 'vite';
+
+export default defineConfig({
+	plugins: [tailwindcss(), sveltekit()],
+	server: {
+		proxy: {
+			'/api': 'http://127.0.0.1:8788',
+			'/auth': 'http://127.0.0.1:8788',
+		},
+	},
+});

hub/deploy/README.md

@@ -11,6 +11,32 @@ See [NEW_SILO_RUNBOOK.md](NEW_SILO_RUNBOOK.md). The remainder of this document
 describes the individual installer and maintenance primitives used by the
 generated bundle.
 
+## CI: roll Hub + admin SPA by fleet (`educraft` / `educraft-dev`)
+
+`.gitea/workflows/deploy-admin.yml` deploys Hub releases (including the org-admin
+SPA) to the managed Alpha host via `deploy_fleet_release.sh`. Fleets share the
+host and are selected by the middle DNS label of `HUB_PUBLIC_BASE_URL`:
+
+| Fleet | Domain | CI trigger |
+|-------|--------|------------|
+| **dev** | `https://<slug>.educraft-dev.paradigm-edu.net` | every push + PR (paths under `hub/`) |
+| **prod** | `https://<slug>.educraft.paradigm-edu.net` | push to `main` + tags |
+
+Example prod tenant:
+`https://para-26071100.educraft.paradigm-edu.net/auth/feishu/para-26071100`.
+
+Required Gitea secret: `DEPLOY_SSH_KEY` (private key for `root@39.107.254.4`).
+Optional: `DEPLOY_HOST` / `DEPLOY_USER` / `DEPLOY_SSH_PORT` / `DEPLOY_BASE`.
+Set repository var `ALLOW_EMPTY_FLEET=1` until the first silo exists for a fleet.
+
+Local dry-run against the host:
+
+```sh
+CPH_FLEET=dev \
+  PLATFORM_DEPLOY_SSH_KEY=$HOME/.ssh/id_ed25519 \
+  bash hub/deploy/deploy_fleet_release.sh
+```
+
 The supervised alpha runs one Organization per named Silo. The supported host
 has systemd, PostgreSQL, Node.js 24+, `pg_isready`, `runuser`, `setpriv`,
 bubblewrap, `socat`, `pg_dump`, `tar`, `sha256sum`, and a compatible `cph`.

hub/deploy/deploy_fleet_release.sh

@@ -0,0 +1,222 @@
+#!/usr/bin/env bash
+# Publish one immutable Hub release (tsc + admin-web SPA) to the managed host,
+# then repoint every Silo in the chosen fleet to that release and restart it.
+#
+# Fleet is selected by the middle DNS label of each Silo's HUB_PUBLIC_BASE_URL:
+#
+#   prod → https://<slug>.educraft.paradigm-edu.net
+#   dev  → https://<slug>.educraft-dev.paradigm-edu.net
+#
+# Example tenant (prod):
+#   https://para-26071100.educraft.paradigm-edu.net/auth/feishu/para-26071100
+#
+# Configure (CI secrets / env):
+#   CPH_FLEET                 required: dev | prod
+#   PLATFORM_DEPLOY_HOST      default 39.107.254.4
+#   PLATFORM_DEPLOY_USER      default root
+#   PLATFORM_DEPLOY_SSH_KEY   required (path to private key)
+#   PLATFORM_DEPLOY_PORT      default 22
+#   PLATFORM_DEPLOY_BASE      default /srv/curriculum-project-hub
+#   PLATFORM_DEPLOY_RELEASE   default git HEAD (must be safe for paths)
+#   ALLOW_EMPTY_FLEET         optional: if 1, succeed when no silo matches
+#
+# This is a code-roll for existing silos. It does not create databases, domains,
+# or Feishu apps — use new_silo.sh / apply_new_silo.sh for that.
+set -euo pipefail
+
+FLEET="${CPH_FLEET:?CPH_FLEET required (dev|prod)}"
+case "$FLEET" in
+  dev) FLEET_DOMAIN_SUFFIX="educraft-dev.paradigm-edu.net" ;;
+  prod) FLEET_DOMAIN_SUFFIX="educraft.paradigm-edu.net" ;;
+  *)
+    echo "CPH_FLEET must be dev or prod, got: $FLEET" >&2
+    exit 1
+    ;;
+esac
+
+HOST="${PLATFORM_DEPLOY_HOST:-39.107.254.4}"
+DEPLOY_USER="${PLATFORM_DEPLOY_USER:-root}"
+PORT="${PLATFORM_DEPLOY_PORT:-22}"
+SSH_KEY="${PLATFORM_DEPLOY_SSH_KEY:?PLATFORM_DEPLOY_SSH_KEY required}"
+BASE="${PLATFORM_DEPLOY_BASE:-/srv/curriculum-project-hub}"
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+REPO_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
+RELEASE_ID="${PLATFORM_DEPLOY_RELEASE:-$(git -C "$REPO_ROOT" rev-parse --verify HEAD)}"
+[[ "$RELEASE_ID" =~ ^[A-Za-z0-9._-]+$ ]] || {
+  echo "invalid PLATFORM_DEPLOY_RELEASE: $RELEASE_ID" >&2
+  exit 1
+}
+ALLOW_EMPTY_FLEET="${ALLOW_EMPTY_FLEET:-0}"
+
+HUB_DIR="$BASE/releases/$RELEASE_ID/hub"
+RELEASE_DIR="$BASE/releases/$RELEASE_ID"
+SSH_OPTS=(-i "$SSH_KEY" -p "$PORT" -o BatchMode=yes -o StrictHostKeyChecking=accept-new)
+
+echo "[fleet] fleet=$FLEET domain=*.$FLEET_DOMAIN_SUFFIX host=$DEPLOY_USER@$HOST release=$RELEASE_ID"
+
+# --- 1. Publish immutable release (shared; flock so parallel fleet jobs do not race) ---
+release_ready=false
+if ssh "${SSH_OPTS[@]}" "$DEPLOY_USER@$HOST" "test -f '$RELEASE_DIR/.complete'"; then
+  release_ready=true
+  echo "[fleet] release already complete: $RELEASE_DIR"
+fi
+
+if [ "$release_ready" = false ]; then
+  # Drop a prior incomplete tree for this release id (failed CI leave leftovers).
+  ssh "${SSH_OPTS[@]}" "$DEPLOY_USER@$HOST" bash -s <<REMOTE
+set -euo pipefail
+flock /var/lock/cph-hub-release-publish bash -c '
+  set -euo pipefail
+  if [ -f "$RELEASE_DIR/.complete" ]; then
+    exit 0
+  fi
+  if [ -e "$RELEASE_DIR" ]; then
+    echo "[fleet] removing incomplete release: $RELEASE_DIR"
+    rm -rf "$RELEASE_DIR"
+  fi
+  mkdir -p "$HUB_DIR"
+'
+REMOTE
+
+  echo "[fleet] rsync hub → $HUB_DIR"
+  rsync -az --delete \
+    --exclude node_modules --exclude dist --exclude .env \
+    --exclude admin-web/node_modules --exclude admin-web/build --exclude admin-web/.svelte-kit \
+    -e "ssh ${SSH_OPTS[*]}" \
+    "$REPO_ROOT/hub/" "$DEPLOY_USER@$HOST:$HUB_DIR/"
+
+  echo "[fleet] npm ci + build (tsc + admin-web SPA)"
+  ssh "${SSH_OPTS[@]}" "$DEPLOY_USER@$HOST" bash -s <<REMOTE
+set -euo pipefail
+flock /var/lock/cph-hub-release-publish bash -c '
+  set -euo pipefail
+  if [ -f "$RELEASE_DIR/.complete" ]; then
+    echo "[fleet] release completed by another job"
+    exit 0
+  fi
+  cd "$HUB_DIR"
+  npm ci
+  npm ci --prefix admin-web
+  npm run audit:production
+  npm run build
+  test -f admin-web/build/index.html
+  touch "$RELEASE_DIR/.complete"
+'
+REMOTE
+fi
+
+# --- 2. Discover silos in this fleet and roll them onto the release ---
+ssh "${SSH_OPTS[@]}" "$DEPLOY_USER@$HOST" \
+  env BASE="$BASE" HUB_DIR="$HUB_DIR" FLEET="$FLEET" \
+  FLEET_DOMAIN_SUFFIX="$FLEET_DOMAIN_SUFFIX" ALLOW_EMPTY_FLEET="$ALLOW_EMPTY_FLEET" \
+  bash -s <<'REMOTE'
+set -euo pipefail
+
+fleet_match() {
+  local public_url="$1"
+  local host="${public_url#https://}"
+  host="${host#http://}"
+  host="${host%%/*}"
+  host="${host%%:*}"
+  case "$FLEET" in
+    prod)
+      [[ "$host" == *."$FLEET_DOMAIN_SUFFIX" || "$host" == "$FLEET_DOMAIN_SUFFIX" ]] || return 1
+      # Avoid matching educraft-dev when suffix is educraft.…
+      [[ "$host" != *.educraft-dev.paradigm-edu.net && "$host" != educraft-dev.paradigm-edu.net ]] || return 1
+      return 0
+      ;;
+    dev)
+      [[ "$host" == *."$FLEET_DOMAIN_SUFFIX" || "$host" == "$FLEET_DOMAIN_SUFFIX" ]]
+      return
+      ;;
+    *)
+      return 1
+      ;;
+  esac
+}
+
+env_value() {
+  local file="$1"
+  local key="$2"
+  # Do not source secrets — only read the KEY=value line.
+  local line
+  line="$(grep -E "^${key}=" "$file" | tail -n1 || true)"
+  printf '%s' "${line#"${key}="}"
+}
+
+matched=0
+shopt -s nullglob
+for env_file in "$BASE"/.secrets/*/platform.env; do
+  instance_id="$(basename "$(dirname "$env_file")")"
+  public_url="$(env_value "$env_file" HUB_PUBLIC_BASE_URL)"
+  if [ -z "$public_url" ]; then
+    echo "[fleet] skip $instance_id: HUB_PUBLIC_BASE_URL empty"
+    continue
+  fi
+  if ! fleet_match "$public_url"; then
+    echo "[fleet] skip $instance_id: $public_url (not $FLEET)"
+    continue
+  fi
+
+  port="$(env_value "$env_file" PORT)"
+  workspace="$(env_value "$env_file" HUB_PROJECT_WORKSPACE_ROOT)"
+  unit="cph-hub-${instance_id}.service"
+  if [ ! -f "/etc/systemd/system/$unit" ]; then
+    echo "[fleet] skip $instance_id: unit missing ($unit)" >&2
+    continue
+  fi
+
+  # Prefer unit file ceilings (MemoryMax=16G) over systemctl's byte form.
+  memory_max="$(sed -n 's/^MemoryMax=//p' "/etc/systemd/system/$unit" | tail -n1)"
+  cpu_quota="$(sed -n 's/^CPUQuota=//p' "/etc/systemd/system/$unit" | tail -n1)"
+  tasks_max="$(sed -n 's/^TasksMax=//p' "/etc/systemd/system/$unit" | tail -n1)"
+
+  if [ -z "$port" ] || [ -z "$workspace" ] || [ -z "$memory_max" ] || [ -z "$cpu_quota" ] || [ -z "$tasks_max" ]; then
+    echo "[fleet] error: $instance_id missing PORT/workspace/ceilings (port=$port workspace=$workspace memory=$memory_max cpu=$cpu_quota tasks=$tasks_max)" >&2
+    exit 1
+  fi
+
+  echo "[fleet] roll $instance_id → $HUB_DIR ($public_url port=$port)"
+  BASE="$BASE" \
+    HUB_DIR="$HUB_DIR" \
+    INSTANCE_ID="$instance_id" \
+    WORKSPACE_ROOT="$workspace" \
+    PORT="$port" \
+    MEMORY_MAX="$memory_max" \
+    CPU_QUOTA="$cpu_quota" \
+    TASKS_MAX="$tasks_max" \
+    bash "$HUB_DIR/deploy/install_service.sh"
+
+  systemctl restart "$unit"
+  systemctl is-active --quiet "$unit"
+
+  health="http://127.0.0.1:${port}/api/healthz"
+  ok=false
+  for _ in $(seq 1 45); do
+    if curl --fail --silent "$health" >/dev/null 2>&1; then
+      ok=true
+      break
+    fi
+    sleep 1
+  done
+  if [ "$ok" != true ]; then
+    curl --fail --silent --show-error "$health" >/dev/null
+  fi
+  echo "[fleet] healthy $instance_id ($health)"
+  matched=$((matched + 1))
+done
+
+if [ "$matched" -eq 0 ]; then
+  msg="[fleet] no silos matched *.$FLEET_DOMAIN_SUFFIX under $BASE/.secrets"
+  if [ "$ALLOW_EMPTY_FLEET" = "1" ]; then
+    echo "$msg (ALLOW_EMPTY_FLEET=1)"
+    exit 0
+  fi
+  echo "$msg" >&2
+  exit 1
+fi
+
+echo "[fleet] rolled $matched silo(s) on $FLEET"
+REMOTE
+
+echo "[fleet] done fleet=$FLEET release=$RELEASE_ID hub=$HUB_DIR"

hub/deploy/deploy_platform.sh

@@ -60,9 +60,10 @@ if [ "$release_ready" = false ]; then
     -e "ssh ${SSH_OPTS[*]}" \
     "$REPO_ROOT/hub/" "$DEPLOY_USER@$HOST:$HUB_DIR/"
 
-  # 2. Install deps, audit and build, then atomically mark the release complete.
+  # 2. Install deps (hub + admin-web), audit hub prod, build tsc + SPA, mark complete.
+  # `npm run build` → tsc then admin:build → admin-web/build for registerStaticSpa.
   ssh "${SSH_OPTS[@]}" "$DEPLOY_USER@$HOST" \
-    "cd '$HUB_DIR' && npm ci && npm run audit:production && npm run build && touch '$RELEASE_DIR/.complete'"
+    "cd '$HUB_DIR' && npm ci && npm ci --prefix admin-web && npm run audit:production && npm run build && touch '$RELEASE_DIR/.complete'"
 fi
 
 # 3. Ensure the service is installed (idempotent), then restart.

hub/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@paradigm/hub",
-  "version": "0.0.24",
+  "version": "0.0.25",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@paradigm/hub",
-      "version": "0.0.24",
+      "version": "0.0.25",
       "dependencies": {
         "@anthropic-ai/claude-agent-sdk": "^0.3.202",
         "@fastify/cookie": "^11.0.2",
@@ -131,9 +131,6 @@
       "cpu": [
         "arm64"
       ],
-      "libc": [
-        "glibc"
-      ],
       "license": "SEE LICENSE IN LICENSE.md",
       "optional": true,
       "os": [
@@ -147,9 +144,6 @@
       "cpu": [
         "arm64"
       ],
-      "libc": [
-        "musl"
-      ],
       "license": "SEE LICENSE IN LICENSE.md",
       "optional": true,
       "os": [
@@ -163,9 +157,6 @@
       "cpu": [
         "x64"
       ],
-      "libc": [
-        "glibc"
-      ],
       "license": "SEE LICENSE IN LICENSE.md",
       "optional": true,
       "os": [
@@ -179,9 +170,6 @@
       "cpu": [
         "x64"
       ],
-      "libc": [
-        "musl"
-      ],
       "license": "SEE LICENSE IN LICENSE.md",
       "optional": true,
       "os": [
@@ -247,24 +235,26 @@
       }
     },
     "node_modules/@emnapi/core": {
-      "version": "1.11.1",
-      "resolved": "https://registry.npmjs.org/@emnapi/core/-/core-1.11.1.tgz",
-      "integrity": "sha512-RSvbQmHzdKzNsLYa/wHrbc3KN4sYLKAdPZxqiM2HATqv/SBk2/ENSHpvXGaLOMcsAyz0poEGqkmmKYG3OWiJEQ==",
+      "version": "1.11.2",
+      "resolved": "https://registry.npmjs.org/@emnapi/core/-/core-1.11.2.tgz",
+      "integrity": "sha512-TC8MkTuZUtcTSiFeuC0ksCh9QIJ5+F21MvZ4Wn4ORfYaFJ/0dsiudv5tVkejgwZlwQ39jL9WWDe2lz8x0WglOA==",
       "dev": true,
       "license": "MIT",
       "optional": true,
+      "peer": true,
       "dependencies": {
         "@emnapi/wasi-threads": "1.2.2",
         "tslib": "^2.4.0"
       }
     },
     "node_modules/@emnapi/runtime": {
-      "version": "1.11.1",
-      "resolved": "https://registry.npmjs.org/@emnapi/runtime/-/runtime-1.11.1.tgz",
-      "integrity": "sha512-vgj7R3y3Wgx24IQaGPA/R6YFXLHVMOZ0uVEyIQPaWs+rd1AzfEMXlAC22FYwO1XkKR6NPsq7mUandH8oIRdZFw==",
+      "version": "1.11.2",
+      "resolved": "https://registry.npmjs.org/@emnapi/runtime/-/runtime-1.11.2.tgz",
+      "integrity": "sha512-kyOl3X0DuTiT1h2ft8r2fYO8JYtU9a9Xis/zBSiGArNaagCOWx90N1k2wxp18czFDH+OgcWGb5ZP/XMt3dcyPA==",
       "dev": true,
       "license": "MIT",
       "optional": true,
+      "peer": true,
       "dependencies": {
         "tslib": "^2.4.0"
       }
@@ -1199,9 +1189,6 @@
         "arm64"
       ],
       "dev": true,
-      "libc": [
-        "glibc"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1219,9 +1206,6 @@
         "arm64"
       ],
       "dev": true,
-      "libc": [
-        "musl"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1239,9 +1223,6 @@
         "ppc64"
       ],
       "dev": true,
-      "libc": [
-        "glibc"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1259,9 +1240,6 @@
         "s390x"
       ],
       "dev": true,
-      "libc": [
-        "glibc"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1279,9 +1257,6 @@
         "x64"
       ],
       "dev": true,
-      "libc": [
-        "glibc"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1299,9 +1274,6 @@
         "x64"
       ],
       "dev": true,
-      "libc": [
-        "musl"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1347,6 +1319,29 @@
         "node": "^20.19.0 || >=22.12.0"
       }
     },
+    "node_modules/@rolldown/binding-wasm32-wasi/node_modules/@emnapi/core": {
+      "version": "1.11.1",
+      "resolved": "https://registry.npmmirror.com/@emnapi/core/-/core-1.11.1.tgz",
+      "integrity": "sha512-RSvbQmHzdKzNsLYa/wHrbc3KN4sYLKAdPZxqiM2HATqv/SBk2/ENSHpvXGaLOMcsAyz0poEGqkmmKYG3OWiJEQ==",
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "@emnapi/wasi-threads": "1.2.2",
+        "tslib": "^2.4.0"
+      }
+    },
+    "node_modules/@rolldown/binding-wasm32-wasi/node_modules/@emnapi/runtime": {
+      "version": "1.11.1",
+      "resolved": "https://registry.npmmirror.com/@emnapi/runtime/-/runtime-1.11.1.tgz",
+      "integrity": "sha512-vgj7R3y3Wgx24IQaGPA/R6YFXLHVMOZ0uVEyIQPaWs+rd1AzfEMXlAC22FYwO1XkKR6NPsq7mUandH8oIRdZFw==",
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "tslib": "^2.4.0"
+      }
+    },
     "node_modules/@rolldown/binding-win32-arm64-msvc": {
       "version": "1.1.4",
       "resolved": "https://registry.npmjs.org/@rolldown/binding-win32-arm64-msvc/-/binding-win32-arm64-msvc-1.1.4.tgz",
@@ -3157,9 +3152,6 @@
         "arm64"
       ],
       "dev": true,
-      "libc": [
-        "glibc"
-      ],
       "license": "MPL-2.0",
       "optional": true,
       "os": [
@@ -3181,9 +3173,6 @@
         "arm64"
       ],
       "dev": true,
-      "libc": [
-        "musl"
-      ],
       "license": "MPL-2.0",
       "optional": true,
       "os": [
@@ -3205,9 +3194,6 @@
         "x64"
       ],
       "dev": true,
-      "libc": [
-        "glibc"
-      ],
       "license": "MPL-2.0",
       "optional": true,
       "os": [
@@ -3229,9 +3215,6 @@
         "x64"
       ],
       "dev": true,
-      "libc": [
-        "musl"
-      ],
       "license": "MPL-2.0",
       "optional": true,
       "os": [

hub/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@paradigm/hub",
-  "version": "0.0.24",
+  "version": "0.0.25",
   "private": true,
   "type": "module",
   "engines": {
@@ -30,19 +30,21 @@
   "description": "Curriculum Project Hub — org-scoped Feishu collaboration and confined Agent runtime. Aligns to spec/System through ADR-0024.",
   "scripts": {
     "dev": "npm run prisma:migrate && tsx watch src/server.ts",
-    "build": "tsc -p tsconfig.json",
+    "build": "tsc -p tsconfig.json && npm run admin:build",
     "start": "npm run prisma:migrate && node dist/server.js",
     "check": "tsc -p tsconfig.json --noEmit",
     "audit:production": "npm audit --omit=dev --audit-level=high",
     "prisma:generate": "prisma generate --schema prisma/schema.prisma",
-    "prisma:validate": "DATABASE_URL=${DATABASE_URL:-postgresql://stub:stub@127.0.0.1:5432/stub} prisma validate --schema prisma/schema.prisma",
-    "prisma:migrate": "DATABASE_URL=${DATABASE_URL:-postgresql://paradigm:paradigm@127.0.0.1:5432/paradigm} prisma migrate deploy --schema prisma/schema.prisma",
+    "prisma:validate": "prisma validate --schema prisma/schema.prisma",
+    "prisma:migrate": "prisma migrate deploy --schema prisma/schema.prisma",
     "secrets:rotate-kek": "node dist/deployment/rotate-secret-kek.js",
     "agent-config": "node dist/deployment/agent-config-cli.js",
     "silo:bootstrap": "node dist/deployment/bootstrap-silo-cli.js",
     "silo:restore-preflight": "node dist/deployment/restore-preflight.js",
     "deploy": "bash deploy/deploy_platform.sh",
     "test": "vitest run",
-    "test:watch": "vitest"
+    "test:watch": "vitest",
+    "admin:dev": "npm run dev --prefix admin-web",
+    "admin:build": "npm run build --prefix admin-web"
   }
 }

hub/prisma/migrations/20260714120000_drop_legacy_platform_role_assignment/migration.sql

@@ -0,0 +1,20 @@
+-- ADR-0023 rejected the legacy `PlatformRoleAssignment` / `PlatformRole`{ADMIN,TEACHER}
+-- model: the platform administration control plane is a separate identity/session/
+-- audit surface (see `Spec.System.PlatformAdministration`), intentionally not built
+-- in alpha (ADR-0025, `hub/deploy/README.md`). The legacy table has no runtime
+-- reader — no guard, route, or service queries it for an authorization decision —
+-- and ADR-0023 requires it to be migrated/replaced before the platform panel ships.
+-- Drop the table, the `User.platformRoles` relation, and the enum.
+
+-- DropForeignKey
+ALTER TABLE "PlatformRoleAssignment" DROP CONSTRAINT "PlatformRoleAssignment_userId_fkey";
+
+-- DropIndex
+DROP INDEX IF EXISTS "PlatformRoleAssignment_userId_revokedAt_idx";
+DROP INDEX IF EXISTS "PlatformRoleAssignment_role_revokedAt_idx";
+
+-- DropTable
+DROP TABLE IF EXISTS "PlatformRoleAssignment";
+
+-- DropEnum
+DROP TYPE IF EXISTS "PlatformRole";

hub/prisma/migrations/20260714130000_organization_capacity_policy/migration.sql

@@ -0,0 +1,18 @@
+-- ADR-0022 layered capacity policy. Org admins may set per-dimension lower
+-- `organizationLimit` overrides; platform ceilings come from deployment config
+-- (see `src/capacity/ceilings.ts`). `limits` is a JSON map of
+-- CapacityDimension → number (only the set dimensions); service enforces
+-- `LayeredLimit.Valid` (org limit ≤ platform ceiling).
+
+-- CreateTable
+CREATE TABLE "OrganizationCapacityPolicy" (
+    "organizationId" TEXT NOT NULL,
+    "limits" JSONB NOT NULL,
+    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updatedAt" TIMESTAMP(3) NOT NULL,
+
+    CONSTRAINT "OrganizationCapacityPolicy_pkey" PRIMARY KEY ("organizationId")
+);
+
+-- AddForeignKey
+ALTER TABLE "OrganizationCapacityPolicy" ADD CONSTRAINT "OrganizationCapacityPolicy_organizationId_fkey" FOREIGN KEY ("organizationId") REFERENCES "Organization"("id") ON DELETE CASCADE ON UPDATE CASCADE;

hub/prisma/schema.prisma

@@ -37,6 +37,7 @@ model Organization {
 
   memberships                  OrganizationMembership[]
   projectSettings              OrganizationProjectSettings?
+  capacityPolicy               OrganizationCapacityPolicy?
   folders                      Folder[]
   projects                     Project[]
   teams                        Team[]
@@ -58,8 +59,9 @@ enum OrganizationStatus {
   ARCHIVED
 }
 
-/// Org-scoped platform role. Distinct from project PermissionRole and from
-/// global PlatformRoleAssignment, which is reserved for SaaS/platform control.
+/// Org-scoped membership role. Distinct from project PermissionRole and from
+/// the platform administrator surface (ADR-0023 / Spec.System.PlatformAdministration),
+/// which is a separate control plane not modeled in alpha (ADR-0025).
 model OrganizationMembership {
   id             String                 @id @default(cuid())
   organizationId String
@@ -159,6 +161,20 @@ model OrganizationProjectSettings {
   organization Organization @relation(fields: [organizationId], references: [id], onDelete: Cascade)
 }
 
+/// ADR-0022 layered capacity policy. Org admins may set per-dimension lower
+/// limits; `limits` is a JSON map of CapacityDimension → number (only the set
+/// ones). Each set value must be ≤ the platform ceiling for that dimension
+/// (validated in service; spec `LayeredLimit.Valid`). Dimensions with no entry
+/// fall back to the platform ceiling (`LayeredLimit.effective`).
+model OrganizationCapacityPolicy {
+  organizationId String   @id
+  limits         Json
+  createdAt      DateTime @default(now())
+  updatedAt      DateTime @updatedAt
+
+  organization Organization @relation(fields: [organizationId], references: [id], onDelete: Cascade)
+}
+
 /// A person known to the Hub. `feishuOpenId` remains a legacy compatibility
 /// key; new customer-app identities live in FeishuUserIdentity and store a
 /// connection-scoped opaque USER principal here instead of a raw open_id.
@@ -170,7 +186,6 @@ model User {
   createdAt    DateTime @default(now())
   updatedAt    DateTime @updatedAt
 
-  platformRoles                PlatformRoleAssignment[]
   organizationMemberships      OrganizationMembership[]
   createdProjects              Project[]                            @relation("projectCreator")
   requestedRuns                AgentRun[]                           @relation("runRequester")
@@ -311,26 +326,6 @@ model ProviderCredentialVersion {
   @@index([createdByUserId])
 }
 
-/// Platform-level role (admin/teacher). Distinct from ADR-0004 PermissionRole.
-/// `admin` is the only override path for force-release (spec RequiresAdmin).
-model PlatformRoleAssignment {
-  id        String       @id @default(cuid())
-  userId    String
-  role      PlatformRole
-  createdAt DateTime     @default(now())
-  revokedAt DateTime?
-
-  user User @relation(fields: [userId], references: [id], onDelete: Cascade)
-
-  @@index([userId, revokedAt])
-  @@index([role, revokedAt])
-}
-
-enum PlatformRole {
-  ADMIN
-  TEACHER
-}
-
 /// ADR-0019: typed principals for permission grants and actor resolution.
 /// USER and Feishu external principals use connection-scoped opaque ids, never
 /// raw provider-local ids; TEAM uses Hub Team.id.
@@ -647,8 +642,9 @@ model ProjectAgentLock {
 // --- Permission grants & settings (ADR-0004) ----------------------------
 
 /// ADR-0004 PermissionRole: read ⊂ edit ⊂ manage (capability lattice).
-/// Distinct from PlatformRole. Force-release is admin-only, outside this
-/// lattice (spec RequiresAdmin).
+/// Force-release is platform-admin-only, outside this lattice (spec
+/// RequiresAdmin); platform admin is a separate control plane (ADR-0023),
+/// not modeled in alpha (ADR-0025).
 enum PermissionRole {
   READ
   EDIT

hub/scripts/dev-bootstrap-silo.ts

@@ -0,0 +1,76 @@
+/**
+ * Local dev bootstrap for an Alpha Silo on Windows / non-systemd hosts.
+ *
+ * The production bootstrap-silo CLI is Linux-only (requires root uid 0,
+ * systemctl, root-owned files). This script calls the same
+ * `bootstrapAlphaSilo` invariants directly, sourcing credentials from the
+ * local `.env` and the dev keyring. Idempotent: re-running is a no-op once
+ * the Silo Organization exists.
+ *
+ * Usage: npx tsx scripts/dev-bootstrap-silo.ts
+ */
+import "dotenv/config";
+import { PrismaClient } from "@prisma/client";
+import { bootstrapAlphaSilo } from "../src/deployment/bootstrap-silo.js";
+import { loadLocalSecretKeyring, LocalSecretEnvelope } from "../src/security/secretEnvelope.js";
+
+function requiredEnv(name: string): string {
+  const v = process.env[name]?.trim();
+  if (v === undefined || v === "") throw new Error(`missing required env: ${name}`);
+  return v;
+}
+
+async function main(): Promise<void> {
+  const databaseUrl = requiredEnv("DATABASE_URL");
+  const keyring = await loadLocalSecretKeyring();
+  const secrets = new LocalSecretEnvelope(keyring);
+  const prisma = new PrismaClient({ datasources: { db: { url: databaseUrl } }, log: [] });
+
+  const organizationId = requiredEnv("HUB_SILO_ORGANIZATION_ID");
+  const feishuAppId = requiredEnv("FEISHU_APP_ID");
+  const feishuAppSecret = requiredEnv("FEISHU_APP_SECRET");
+  const feishuBotOpenId = requiredEnv("FEISHU_BOT_OPEN_ID");
+  const providerAuthToken = requiredEnv("ANTHROPIC_AUTH_TOKEN");
+  const providerBaseUrl = process.env["ANTHROPIC_BASE_URL"]?.trim() || "https://openrouter.ai/api";
+  const anthropicApiKey = process.env["ANTHROPIC_API_KEY"]?.trim() || "";
+
+  try {
+    const result = await bootstrapAlphaSilo(
+      prisma,
+      secrets,
+      {
+        organization: {
+          id: organizationId,
+          slug: "local-dev",
+          name: "Local Dev Silo",
+        },
+        owner: {
+          openId: feishuBotOpenId,
+          displayName: "Local Dev Owner",
+        },
+        feishu: {
+          appId: feishuAppId,
+          appSecret: feishuAppSecret,
+          botOpenId: feishuBotOpenId,
+        },
+        provider: {
+          providerId: "openrouter",
+          baseUrl: providerBaseUrl,
+          authToken: providerAuthToken,
+          ...(anthropicApiKey !== "" ? { anthropicApiKey } : {}),
+        },
+      },
+      // Skip live network probes in local dev — Feishu/OpenRouter reachability
+      // is not required to seed the encrypted envelope rows.
+      { feishu: async () => {}, provider: async () => {} },
+    );
+    console.log("bootstrap result:", JSON.stringify(result, null, 2));
+  } finally {
+    await prisma.$disconnect();
+  }
+}
+
+main().catch((error: unknown) => {
+  console.error("[dev-bootstrap-silo] failed:", error instanceof Error ? error.message : String(error));
+  process.exitCode = 1;
+});

hub/scripts/dev-seed-connections.ts

@@ -0,0 +1,84 @@
+/**
+ * Local dev seed for an existing Organization that predates the ADR-0024
+ * secret-envelope plane (e.g. the legacy `org_default` from the tenant-root
+ * migration). Creates ACTIVE Feishu Application + Provider (BYOK openrouter)
+ * connections with encrypted envelopes, using the local dev keyring.
+ *
+ * Idempotent: re-running rotates a new secret version if the connection
+ * already exists.
+ *
+ * Usage: npx tsx scripts/dev-seed-connections.ts
+ */
+import "dotenv/config";
+import { PrismaClient } from "@prisma/client";
+import { FeishuApplicationConnectionService } from "../src/connections/feishuApplicationConnections.js";
+import { ProviderConnectionService } from "../src/connections/providerConnections.js";
+import { loadLocalSecretKeyring, LocalSecretEnvelope } from "../src/security/secretEnvelope.js";
+
+function requiredEnv(name: string): string {
+  const v = process.env[name]?.trim();
+  if (v === undefined || v === "") throw new Error(`missing required env: ${name}`);
+  return v;
+}
+
+async function main(): Promise<void> {
+  const databaseUrl = requiredEnv("DATABASE_URL");
+  const organizationId = requiredEnv("HUB_SILO_ORGANIZATION_ID");
+  const keyring = await loadLocalSecretKeyring();
+  const secrets = new LocalSecretEnvelope(keyring);
+  const prisma = new PrismaClient({ datasources: { db: { url: databaseUrl } }, log: [] });
+
+  const feishuAppId = requiredEnv("FEISHU_APP_ID");
+  const feishuAppSecret = requiredEnv("FEISHU_APP_SECRET");
+  const feishuBotOpenId = requiredEnv("FEISHU_BOT_OPEN_ID");
+  const providerAuthToken = requiredEnv("ANTHROPIC_AUTH_TOKEN");
+  const providerBaseUrl = process.env["ANTHROPIC_BASE_URL"]?.trim() || "https://openrouter.ai/api";
+  const anthropicApiKey = process.env["ANTHROPIC_API_KEY"]?.trim() || "";
+
+  // Pick an existing active OWNER/ADMIN as the actor for the audit rows.
+  const actor = await prisma.organizationMembership.findFirst({
+    where: { organizationId, role: { in: ["OWNER", "ADMIN"] }, revokedAt: null },
+    select: { userId: true },
+  });
+  if (actor === null) throw new Error(`no active OWNER/ADMIN membership on ${organizationId}; seed a member first`);
+  const actorUserId = actor.userId;
+  console.log("actor:", actorUserId);
+
+  try {
+    const feishuService = new FeishuApplicationConnectionService(
+      prisma,
+      secrets,
+      async () => {}, // skip live Feishu probe in local dev
+    );
+    const feishuResult = await feishuService.rotateCustomerApplication({
+      organizationId,
+      actorUserId,
+      appId: feishuAppId,
+      appSecret: feishuAppSecret,
+      botOpenId: feishuBotOpenId,
+    });
+    console.log("feishu connection:", JSON.stringify(feishuResult, null, 2));
+
+    const providerService = new ProviderConnectionService(
+      prisma,
+      secrets,
+      async () => {}, // skip live OpenRouter probe in local dev
+    );
+    const providerResult = await providerService.rotateByok({
+      organizationId,
+      actorUserId,
+      providerId: "openrouter",
+      baseUrl: providerBaseUrl,
+      authToken: providerAuthToken,
+      ...(anthropicApiKey !== "" ? { anthropicApiKey } : {}),
+    });
+    console.log("provider connection:", JSON.stringify(providerResult, null, 2));
+  } finally {
+    await prisma.$disconnect();
+  }
+}
+
+main().catch((error: unknown) => {
+  console.error("[dev-seed-connections] failed:", error instanceof Error ? error.message : String(error));
+  process.exitCode = 1;
+});

hub/src/admin/auth/guards.ts

@@ -10,8 +10,10 @@ import {
   verifySession,
   type SessionPayload,
 } from "./session.js";
+import { createPermissionAuthorizer, type AuthorizationAction } from "../../permissions/authorizer.js";
 
 export const ORG_ADMIN_ROLES: readonly OrganizationMemberRole[] = ["OWNER", "ADMIN"];
+const ANY_ORG_ROLE: readonly OrganizationMemberRole[] = ["OWNER", "ADMIN", "MEMBER"];
 
 export interface AuthContext {
   readonly session: SessionPayload;
@@ -175,3 +177,55 @@ export async function sendError(
 ): Promise<void> {
   await reply.status(statusCode).send({ error: { code, message } });
 }
+
+export interface ProjectAuthContext extends OrgAuthContext {
+  readonly projectId: string;
+}
+
+/**
+ * Resolve an org member (any role) viewing/mutating a project in their org, then
+ * enforce project-level permission via the PermissionGrant authorizer.
+ *
+ * `allowOrgAdminOversight=true` lets org OWNER/ADMIN through without a project
+ * grant — reserved for *read* oversight (listing/viewing). Mutations that the
+ * spec pins to project `manage` (e.g. `collaborator.manage`) must pass
+ * `allowOrgAdminOversight=false`: org role alone is not a project authorization
+ * root (spec `Permission.lean` / ADR-0004; the only out-of-role override is
+ * platform-admin force-release `RequiresAdmin`, not org admin).
+ */
+export async function requireProjectPermission(
+  request: FastifyRequest,
+  reply: FastifyReply,
+  deps: GuardDeps,
+  options: {
+    readonly orgSlug: string;
+    readonly projectId: string;
+    readonly action: AuthorizationAction;
+    readonly allowOrgAdminOversight: boolean;
+  },
+): Promise<ProjectAuthContext | null> {
+  const auth = await requireOrgRole(request, reply, deps, {
+    orgSlug: options.orgSlug,
+    roles: ANY_ORG_ROLE,
+  });
+  if (auth === null) return null;
+  await requireOrgProject(deps, auth.organization.id, options.projectId);
+  if (options.allowOrgAdminOversight && ORG_ADMIN_ROLES.includes(auth.membershipRole)) {
+    return { ...auth, projectId: options.projectId };
+  }
+  const decision = await createPermissionAuthorizer(deps.prisma).can({
+    actor: { feishuOpenId: auth.feishuOpenId },
+    action: options.action,
+    resource: { type: "PROJECT", id: options.projectId },
+  });
+  if (!decision.allowed) {
+    await sendError(
+      reply,
+      403,
+      "forbidden",
+      `project ${options.projectId} requires ${decision.requiredRole} (${options.action}): ${decision.reason}`,
+    );
+    return null;
+  }
+  return { ...auth, projectId: options.projectId };
+}

hub/src/admin/errors.ts

@@ -35,9 +35,11 @@ export async function handleRouteError(reply: FastifyReply, err: unknown): Promi
       await sendError(reply, mapped.statusCode, mapped.code, mapped.message);
       return;
     }
+    reply.log.error({ err }, "unmapped route error");
     await sendError(reply, 500, "internal_error", "internal error");
     return;
   }
+  reply.log.error({ err }, "unmapped route error");
   await sendError(reply, 500, "internal_error", "internal error");
 }
 
@@ -71,7 +73,8 @@ function mapDomainError(message: string): { statusCode: number; code: string; me
     lower.includes("is required") ||
     lower.includes("already") ||
     lower.includes("invalid") ||
-    lower.includes("accepts only")
+    lower.includes("accepts only") ||
+    lower.includes("must be")
   ) {
     return { statusCode: 400, code: "bad_request", message };
   }

hub/src/admin/plugin.ts

@@ -1,11 +1,12 @@
 /**
- * Registers org-admin HTTP surface: auth, org APIs, (later) static SPA.
+ * Registers org-admin HTTP surface: auth, org APIs, and the static SPA shell.
  */
 import cookie from "@fastify/cookie";
 import type { PrismaClient } from "@prisma/client";
 import type { FastifyInstance } from "fastify";
 import { registerAuthRoutes } from "./routes/authRoutes.js";
 import { registerOrgRoutes } from "./routes/orgRoutes.js";
+import { registerStaticSpa } from "./static.js";
 import type { LocalSecretEnvelope } from "../security/secretEnvelope.js";
 import type { ProviderReadinessProbe } from "../connections/providerReadiness.js";
 import type { FeishuReadinessProbe } from "../connections/feishuReadiness.js";
@@ -62,4 +63,7 @@ export async function registerAdminPlugin(
       ? { feishuConnectionReadinessProbe: config.feishuConnectionReadinessProbe }
       : {}),
   });
+
+  // After API + /admin/login so SPA fallback does not shadow auth routes.
+  await registerStaticSpa(app);
 }

hub/src/admin/routes/accessRoutes.ts

@@ -5,7 +5,7 @@ import {
   listProjectTeamAccess,
   revokeTeamProjectAccess,
 } from "../../permissions/projectTeamAccess.js";
-import { requireOrgProject, requireOrgRole, type GuardDeps } from "../auth/guards.js";
+import { requireProjectPermission, type GuardDeps } from "../auth/guards.js";
 import { handleRouteError } from "../errors.js";
 
 const ROLES: readonly PermissionRole[] = ["READ", "EDIT", "MANAGE"];
@@ -19,9 +19,13 @@ export async function registerAccessRoutes(
   app.get("/api/org/:orgSlug/projects/:projectId/team-access", async (request, reply) => {
     try {
       const { orgSlug, projectId } = request.params as { orgSlug: string; projectId: string };
-      const auth = await requireOrgRole(request, reply, guardDeps, { orgSlug });
+      const auth = await requireProjectPermission(request, reply, guardDeps, {
+        orgSlug,
+        projectId,
+        action: "project.read",
+        allowOrgAdminOversight: true,
+      });
       if (auth === null) return;
-      await requireOrgProject(guardDeps, auth.organization.id, projectId);
       return { access: await listProjectTeamAccess(config.prisma, projectId) };
     } catch (err) {
       return handleRouteError(reply, err);
@@ -31,9 +35,13 @@ export async function registerAccessRoutes(
   app.put("/api/org/:orgSlug/projects/:projectId/team-access", async (request, reply) => {
     try {
       const { orgSlug, projectId } = request.params as { orgSlug: string; projectId: string };
-      const auth = await requireOrgRole(request, reply, guardDeps, { orgSlug });
+      const auth = await requireProjectPermission(request, reply, guardDeps, {
+        orgSlug,
+        projectId,
+        action: "collaborator.manage",
+        allowOrgAdminOversight: false,
+      });
       if (auth === null) return;
-      await requireOrgProject(guardDeps, auth.organization.id, projectId);
       const body = request.body as {
         teamId?: unknown;
         teamSlug?: unknown;
@@ -67,9 +75,13 @@ export async function registerAccessRoutes(
           projectId: string;
           teamId: string;
         };
-        const auth = await requireOrgRole(request, reply, guardDeps, { orgSlug });
+        const auth = await requireProjectPermission(request, reply, guardDeps, {
+          orgSlug,
+          projectId,
+          action: "collaborator.manage",
+          allowOrgAdminOversight: false,
+        });
         if (auth === null) return;
-        await requireOrgProject(guardDeps, auth.organization.id, projectId);
         const count = await revokeTeamProjectAccess(config.prisma, { projectId, teamId });
         return { revoked: count };
       } catch (err) {

hub/src/admin/routes/capacityRoutes.ts

@@ -0,0 +1,64 @@
+/**
+ * Org-admin capacity policy routes (ADR-0022).
+ */
+import type { PrismaClient } from "@prisma/client";
+import type { FastifyInstance } from "fastify";
+import { getCapacityPolicy, setCapacityPolicy } from "../../org/capacityPolicy.js";
+import { isCapacityDimension } from "../../capacity/dimensions.js";
+import { requireOrgRole, type GuardDeps } from "../auth/guards.js";
+import { handleRouteError } from "../errors.js";
+
+export async function registerCapacityRoutes(
+  app: FastifyInstance,
+  config: { readonly prisma: PrismaClient; readonly sessionSecret: string },
+): Promise<void> {
+  const guardDeps: GuardDeps = { prisma: config.prisma, sessionSecret: config.sessionSecret };
+
+  app.get("/api/org/:orgSlug/capacity-policy", async (request, reply) => {
+    try {
+      const { orgSlug } = request.params as { orgSlug: string };
+      const auth = await requireOrgRole(request, reply, guardDeps, { orgSlug });
+      if (auth === null) return;
+      return await getCapacityPolicy(config.prisma, auth.organization.id);
+    } catch (err) {
+      return handleRouteError(reply, err);
+    }
+  });
+
+  app.put("/api/org/:orgSlug/capacity-policy", async (request, reply) => {
+    try {
+      const { orgSlug } = request.params as { orgSlug: string };
+      const auth = await requireOrgRole(request, reply, guardDeps, { orgSlug });
+      if (auth === null) return;
+      const body = request.body as { limits?: unknown };
+      if (body?.limits === null || typeof body.limits !== "object") {
+        return reply.status(400).send({
+          error: { code: "bad_request", message: "limits object is required" },
+        });
+      }
+      const limits: Record<string, number | null> = {};
+      for (const [key, value] of Object.entries(body.limits as Record<string, unknown>)) {
+        if (!isCapacityDimension(key)) {
+          return reply.status(400).send({
+            error: { code: "bad_request", message: `unknown capacity dimension: ${key}` },
+          });
+        }
+        if (value === null) {
+          limits[key] = null;
+        } else if (typeof value === "number" && Number.isFinite(value)) {
+          limits[key] = value;
+        } else {
+          return reply.status(400).send({
+            error: { code: "bad_request", message: `limit for ${key} must be a number or null` },
+          });
+        }
+      }
+      return await setCapacityPolicy(config.prisma, {
+        organizationId: auth.organization.id,
+        limits,
+      });
+    } catch (err) {
+      return handleRouteError(reply, err);
+    }
+  });
+}

hub/src/admin/routes/explorerRoutes.ts

@@ -10,13 +10,15 @@ import {
   createOrgFolder,
   createOrgProject,
   getOrgProjectDetail,
+  listMyProjects,
   listOrgExplorer,
   moveOrgProjectToFolder,
   renameFolder,
   renameProject,
 } from "../../org/explorer.js";
-import { requireOrgRole, type GuardDeps } from "../auth/guards.js";
+import { requireOrgRole, requireProjectPermission, ORG_ADMIN_ROLES, type GuardDeps } from "../auth/guards.js";
 import { handleRouteError } from "../errors.js";
+import { createPermissionAuthorizer } from "../../permissions/authorizer.js";
 
 export interface ExplorerRouteConfig {
   readonly prisma: PrismaClient;
@@ -41,6 +43,24 @@ export async function registerExplorerRoutes(
     }
   });
 
+  app.get("/api/org/:orgSlug/my-projects", async (request, reply) => {
+    try {
+      const { orgSlug } = request.params as { orgSlug: string };
+      const auth = await requireOrgRole(request, reply, guardDeps, {
+        orgSlug,
+        roles: ["OWNER", "ADMIN", "MEMBER"],
+      });
+      if (auth === null) return;
+      const projects = await listMyProjects(config.prisma, {
+        organizationId: auth.organization.id,
+        actorFeishuOpenId: auth.feishuOpenId,
+      });
+      return { projects };
+    } catch (err) {
+      return handleRouteError(reply, err);
+    }
+  });
+
   app.post("/api/org/:orgSlug/folders", async (request, reply) => {
     try {
       const { orgSlug } = request.params as { orgSlug: string };
@@ -144,12 +164,27 @@ export async function registerExplorerRoutes(
   app.get("/api/org/:orgSlug/projects/:projectId", async (request, reply) => {
     try {
       const { orgSlug, projectId } = request.params as { orgSlug: string; projectId: string };
-      const auth = await requireOrgRole(request, reply, guardDeps, { orgSlug });
+      const auth = await requireProjectPermission(request, reply, guardDeps, {
+        orgSlug,
+        projectId,
+        action: "project.read",
+        allowOrgAdminOversight: true,
+      });
       if (auth === null) return;
-      return await getOrgProjectDetail(config.prisma, {
+      const detail = await getOrgProjectDetail(config.prisma, {
         organizationId: auth.organization.id,
         projectId,
       });
+      const manageDecision = await createPermissionAuthorizer(config.prisma).can({
+        actor: { feishuOpenId: auth.feishuOpenId },
+        action: "collaborator.manage",
+        resource: { type: "PROJECT", id: projectId },
+      });
+      return {
+        ...detail,
+        actorIsOrgAdmin: ORG_ADMIN_ROLES.includes(auth.membershipRole),
+        actorCanManageProject: manageDecision.allowed,
+      };
     } catch (err) {
       return handleRouteError(reply, err);
     }

hub/src/admin/routes/orgRoutes.ts

@@ -15,6 +15,7 @@ import { registerMembersRoutes } from "./membersRoutes.js";
 import { registerSessionsAndUsageRoutes } from "./sessionsRoutes.js";
 import { registerTeamsRoutes } from "./teamsRoutes.js";
 import { registerProviderConnectionRoutes } from "./providerConnectionRoutes.js";
+import { registerCapacityRoutes } from "./capacityRoutes.js";
 import type { LocalSecretEnvelope } from "../../security/secretEnvelope.js";
 import type { ProviderReadinessProbe } from "../../connections/providerReadiness.js";
 import type { FeishuReadinessProbe } from "../../connections/feishuReadiness.js";
@@ -105,6 +106,10 @@ export async function registerOrgRoutes(app: FastifyInstance, config: OrgRouteCo
     prisma: config.prisma,
     sessionSecret: config.sessionSecret,
   });
+  await registerCapacityRoutes(app, {
+    prisma: config.prisma,
+    sessionSecret: config.sessionSecret,
+  });
   await registerSessionsAndUsageRoutes(app, {
     prisma: config.prisma,
     sessionSecret: config.sessionSecret,

hub/src/admin/routes/teamsRoutes.ts

@@ -18,10 +18,16 @@ export async function registerTeamsRoutes(
 ): Promise<void> {
   const guardDeps: GuardDeps = { prisma: config.prisma, sessionSecret: config.sessionSecret };
 
+  // Read-only listing is open to any active org member so project MANAGE
+  // holders can pick a team when granting TEAM→PROJECT access (ADR-0004).
+  // Mutations below stay org-admin only.
   app.get("/api/org/:orgSlug/teams", async (request, reply) => {
     try {
       const { orgSlug } = request.params as { orgSlug: string };
-      const auth = await requireOrgRole(request, reply, guardDeps, { orgSlug });
+      const auth = await requireOrgRole(request, reply, guardDeps, {
+        orgSlug,
+        roles: ["OWNER", "ADMIN", "MEMBER"],
+      });
       if (auth === null) return;
       return { teams: await listOrgTeams(config.prisma, auth.organization.id) };
     } catch (err) {
@@ -34,7 +40,7 @@ export async function registerTeamsRoutes(
       const { orgSlug } = request.params as { orgSlug: string };
       const auth = await requireOrgRole(request, reply, guardDeps, { orgSlug });
       if (auth === null) return;
-      const body = request.body as { slug?: unknown; name?: unknown; description?: unknown };
+      const body = (request.body ?? {}) as { slug?: unknown; name?: unknown; description?: unknown };
       if (typeof body.slug !== "string" || typeof body.name !== "string") {
         return reply.status(400).send({
           error: { code: "bad_request", message: "slug and name are required" },

hub/src/admin/static.ts

@@ -0,0 +1,82 @@
+/**
+ * Serves the org-admin SPA (built by SvelteKit via `admin-web/build/`) and
+ * the SPA index fallback for client-side routes under `/admin/*`.
+ *
+ * The SvelteKit project lives in `hub/admin-web/`. Run `npm run build` there
+ * to produce the static output in `admin-web/build/`. In development, use
+ * `npm run dev` in `admin-web/` which proxies `/api` and `/auth` to the Hub.
+ *
+ * Override the UI directory with `CPH_ADMIN_UI_DIR` env if needed.
+ */
+import { readFile } from "node:fs/promises";
+import { existsSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+import { dirname, extname, join, resolve as resolvePath } from "node:path";
+import type { FastifyInstance } from "fastify";
+
+const MIME: Record<string, string> = {
+  ".html": "text/html; charset=utf-8",
+  ".js": "text/javascript; charset=utf-8",
+  ".mjs": "text/javascript; charset=utf-8",
+  ".css": "text/css; charset=utf-8",
+  ".svg": "image/svg+xml",
+  ".ico": "image/x-icon",
+  ".png": "image/png",
+  ".jpg": "image/jpeg",
+  ".woff": "font/woff",
+  ".woff2": "font/woff2",
+  ".json": "application/json; charset=utf-8",
+  ".txt": "text/plain; charset=utf-8",
+};
+
+function resolveUiDir(): string {
+  const override = process.env["CPH_ADMIN_UI_DIR"];
+  if (override && override.trim() !== "") return resolvePath(override);
+  const here = dirname(fileURLToPath(import.meta.url));
+  return resolvePath(join(here, "..", "..", "admin-web", "build"));
+}
+
+export async function registerStaticSpa(app: FastifyInstance): Promise<void> {
+  const uiDir = resolveUiDir();
+  if (!existsSync(join(uiDir, "index.html"))) {
+    app.log.warn(
+      { uiDir },
+      "admin-web/build not found; SPA shell disabled. Run `npm run build` in admin-web/ to enable. Org admin APIs remain fully functional.",
+    );
+    return;
+  }
+  const indexHtml = await readFile(join(uiDir, "index.html"), "utf8");
+
+  // SvelteKit static assets (_app/*, favicon, etc.)
+  app.get("/_app/*", async (request, reply) => {
+    const rel = (request.params as { "*": string })["*"];
+    const safe = rel.split("/").filter((p) => p !== ".." && p !== "").join("/");
+    try {
+      const buf = await readFile(join(uiDir, "_app", safe));
+      const mime = MIME[extname(safe)] ?? "application/octet-stream";
+      return reply.type(mime).send(buf);
+    } catch {
+      return reply.status(404).send({ error: { code: "not_found", message: "asset not found" } });
+    }
+  });
+
+  // Other top-level static assets (favicon.svg, robots.txt, etc.)
+  app.get("/favicon.svg", async (_request, reply) => {
+    try {
+      const buf = await readFile(join(uiDir, "favicon.svg"));
+      return reply.type("image/svg+xml").send(buf);
+    } catch {
+      return reply.status(404).send();
+    }
+  });
+
+  // SPA client-side route fallback. Auth registers `/admin/login` first so it
+  // takes precedence; everything else under /admin/* serves the index so
+  // SvelteKit's client-side router can resolve the view.
+  app.get("/admin", async (_request, reply) => {
+    return reply.type("text/html; charset=utf-8").send(indexHtml);
+  });
+  app.get("/admin/*", async (_request, reply) => {
+    return reply.type("text/html; charset=utf-8").send(indexHtml);
+  });
+}

hub/src/capacity/ceilings.ts

@@ -0,0 +1,78 @@
+/**
+ * ADR-0022 platform ceilings (spec `LayeredLimit.platformCeiling`).
+ *
+ * Platform ceilings are the unbreakable upper bounds; org policy may only
+ * configure lower limits (see `LayeredLimit.Valid`). Exact numeric values are
+ * `OPEN` per spec and calibrated by capacity testing — this module is the
+ * single place to wire them.
+ *
+ * Seven dimensions are sourced from existing runtime env vars
+ * (`HUB_HTTP_BODY_LIMIT_BYTES`, `HUB_MAX_FILES_PER_MESSAGE`, `HUB_MAX_FILE_BYTES`,
+ * `HUB_HTTP_REQUESTS_PER_MINUTE`, `HUB_AGENT_MAX_CONCURRENT_RUNS`,
+ * `HUB_AGENT_MAX_RUN_SECONDS`, `HUB_AGENT_MAX_TURNS`). The remaining dimensions
+ * are sourced from `HUB_CEILING_<DIMENSION>` env vars; until those are set the
+ * dimension has no configured ceiling and the policy UI surfaces it as
+ * "未配置" (cannot enforce a limit without a ceiling).
+ */
+import type { CapacityDimension } from "./dimensions.js";
+
+function positiveIntEnv(name: string): number | undefined {
+  const raw = process.env[name];
+  if (raw === undefined || raw === "") return undefined;
+  const n = Number.parseInt(raw, 10);
+  return Number.isFinite(n) && n > 0 ? n : undefined;
+}
+
+const ENV_BACKED_CEILINGS: Partial<Record<CapacityDimension, string>> = {
+  requestBodySize: "HUB_HTTP_BODY_LIMIT_BYTES",
+  attachmentCount: "HUB_MAX_FILES_PER_MESSAGE",
+  fileSize: "HUB_MAX_FILE_BYTES",
+  requestRate: "HUB_HTTP_REQUESTS_PER_MINUTE",
+  agentConcurrency: "HUB_AGENT_MAX_CONCURRENT_RUNS",
+  runWallTime: "HUB_AGENT_MAX_RUN_SECONDS",
+  runTurns: "HUB_AGENT_MAX_TURNS",
+};
+
+const CEILING_DIMENSIONS: readonly CapacityDimension[] = [
+  "requestRate",
+  "requestBodySize",
+  "agentConcurrency",
+  "admissionQueueLength",
+  "admissionQueueWait",
+  "fileSize",
+  "attachmentCount",
+  "archiveExpansion",
+  "projectStorage",
+  "organizationStorage",
+  "memberCount",
+  "projectCount",
+  "teamCount",
+  "folderCount",
+  "sessionCount",
+  "runWallTime",
+  "runTurns",
+  "runToolCalls",
+  "toolWallTime",
+  "runOutputSize",
+  "processMemory",
+  "processCpu",
+  "processCount",
+];
+
+function envNameFor(dimension: CapacityDimension): string {
+  return ENV_BACKED_CEILINGS[dimension] ?? `HUB_CEILING_${dimension.toUpperCase()}`;
+}
+
+/**
+ * Returns the configured platform ceilings (only the dimensions currently
+ * wired via env). Unconfigured dimensions are absent — callers must surface
+ * them, not assume unlimited (spec `LayeredLimit` forbids unlimited ceilings).
+ */
+export function readPlatformCeilings(): Partial<Record<CapacityDimension, number>> {
+  const ceilings: Partial<Record<CapacityDimension, number>> = {};
+  for (const dimension of CEILING_DIMENSIONS) {
+    const value = positiveIntEnv(envNameFor(dimension));
+    if (value !== undefined) ceilings[dimension] = value;
+  }
+  return ceilings;
+}

hub/src/capacity/dimensions.ts

@@ -0,0 +1,63 @@
+/**
+ * ADR-0022 capacity dimensions (spec `Spec.System.Capacity.CapacityDimension`).
+ * The 23 PINNED dimensions; exact numeric ceilings are `OPEN` and calibrated by
+ * capacity testing. This module is the single source of the dimension set shared
+ * by the platform-ceiling config and the org capacity-policy service.
+ */
+export const CAPACITY_DIMENSIONS = [
+  "requestRate",
+  "requestBodySize",
+  "agentConcurrency",
+  "admissionQueueLength",
+  "admissionQueueWait",
+  "fileSize",
+  "attachmentCount",
+  "archiveExpansion",
+  "projectStorage",
+  "organizationStorage",
+  "memberCount",
+  "projectCount",
+  "teamCount",
+  "folderCount",
+  "sessionCount",
+  "runWallTime",
+  "runTurns",
+  "runToolCalls",
+  "toolWallTime",
+  "runOutputSize",
+  "processMemory",
+  "processCpu",
+  "processCount",
+] as const;
+
+export type CapacityDimension = (typeof CAPACITY_DIMENSIONS)[number];
+
+export const CAPACITY_DIMENSION_LABELS: Record<CapacityDimension, string> = {
+  requestRate: "HTTP 请求速率",
+  requestBodySize: "请求体大小",
+  agentConcurrency: "智能体并发",
+  admissionQueueLength: "接纳队列长度",
+  admissionQueueWait: "接纳队列等待",
+  fileSize: "单文件大小",
+  attachmentCount: "每消息附件数",
+  archiveExpansion: "归档展开",
+  projectStorage: "项目存储",
+  organizationStorage: "组织存储",
+  memberCount: "成员数",
+  projectCount: "项目数",
+  teamCount: "团队数",
+  folderCount: "文件夹数",
+  sessionCount: "会话数",
+  runWallTime: "单次运行墙钟",
+  runTurns: "单次运行轮次",
+  runToolCalls: "单次运行工具调用",
+  toolWallTime: "工具墙钟",
+  runOutputSize: "运行输出大小",
+  processMemory: "进程内存",
+  processCpu: "进程 CPU",
+  processCount: "进程数",
+};
+
+export function isCapacityDimension(value: string): value is CapacityDimension {
+  return (CAPACITY_DIMENSIONS as readonly string[]).includes(value);
+}

hub/src/feishu/projectConsole.ts

@@ -52,6 +52,65 @@ export async function browseFolderDestinations(
   };
 }
 
+export async function createFolderAndMoveProject(
+  prisma: PrismaClient,
+  input: {
+    readonly organizationId: string;
+    readonly projectId: string;
+    readonly parentFolderId: string | null;
+    readonly name: string;
+    readonly actorUserId?: string | undefined;
+  },
+): Promise<{ readonly folderId: string; readonly folderName: string }> {
+  const name = input.name.trim();
+  if (name === "") throw new Error("folder name is required");
+  if (name.length > 100) throw new Error("folder name must not exceed 100 characters");
+  return prisma.$transaction(async (tx) => {
+    await lockActiveProjectOrganization(tx, input.projectId);
+    const project = await tx.project.findFirst({
+      where: { id: input.projectId, organizationId: input.organizationId, archivedAt: null },
+      select: { id: true, folderId: true },
+    });
+    if (project === null) throw new Error("active project not found in Organization");
+    if (input.parentFolderId !== null) {
+      const parent = await tx.folder.findFirst({
+        where: {
+          id: input.parentFolderId,
+          organizationId: input.organizationId,
+          archivedAt: null,
+          kind: { not: "SYSTEM_INBOX" },
+        },
+        select: { id: true },
+      });
+      if (parent === null) throw new Error("active destination folder not found in Organization");
+    }
+    const folder = await tx.folder.create({
+      data: {
+        organizationId: input.organizationId,
+        parentId: input.parentFolderId,
+        name,
+      },
+      select: { id: true, name: true },
+    });
+    await tx.project.update({ where: { id: project.id }, data: { folderId: folder.id } });
+    await tx.auditEntry.create({
+      data: {
+        organizationId: input.organizationId,
+        projectId: project.id,
+        ...(input.actorUserId !== undefined ? { actorUserId: input.actorUserId } : {}),
+        action: "folder.created_and_project_moved_from_feishu",
+        metadata: {
+          folderId: folder.id,
+          parentFolderId: input.parentFolderId,
+          previousFolderId: project.folderId,
+          name: folder.name,
+        },
+      },
+    });
+    return { folderId: folder.id, folderName: folder.name };
+  });
+}
+
 export async function loadProjectConsole(
   prisma: PrismaClient,
   input: { readonly projectId: string; readonly chatId: string },

hub/src/feishu/projectOnboardingCard.ts

@@ -88,7 +88,6 @@ export function buildProjectManagementCard(params: {
     readonly sdkSessionReady: boolean;
   } | null | undefined;
   readonly canManageProject?: boolean | undefined;
-  readonly canCreateFolder?: boolean | undefined;
 }): Record<string, unknown> {
   const elements: unknown[] = [{
     tag: "markdown",
@@ -149,7 +148,6 @@ export function buildProjectManagementCard(params: {
       renameProjectForm(params),
     );
   }
-  if (params.canCreateFolder === true) elements.push(createFolderForm(params));
   return {
     config: { wide_screen_mode: true },
     header: {
@@ -202,6 +200,7 @@ export function buildMoveProjectCard(params: {
   readonly parentFolderId: string | null;
   readonly breadcrumb: string;
   readonly childFolders: readonly { readonly id: string; readonly name: string }[];
+  readonly canCreateFolder: boolean;
 }): Record<string, unknown> {
   const navigation: unknown[] = [];
   if (params.folderId !== null) {
@@ -232,6 +231,13 @@ export function buildMoveProjectCard(params: {
     project_id: params.projectId,
     ...(params.folderId !== null ? { folder_id: params.folderId } : {}),
   }, "primary")] });
+  if (params.canCreateFolder) {
+    elements.push(createFolderAndMoveForm({
+      organizationId: params.organizationId,
+      projectId: params.projectId,
+      parentFolderId: params.folderId,
+    }));
+  }
   return {
     config: { wide_screen_mode: true },
     header: { title: { tag: "plain_text", content: "移动项目" }, template: "blue" },
@@ -433,7 +439,11 @@ function renameProjectForm(params: {
   };
 }
 
-function createFolderForm(params: { readonly organizationId: string; readonly projectId: string }): unknown {
+function createFolderAndMoveForm(params: {
+  readonly organizationId: string;
+  readonly projectId: string;
+  readonly parentFolderId: string | null;
+}): unknown {
   return {
     tag: "form",
     name: "folder_create_form",
@@ -443,12 +453,12 @@ function createFolderForm(params: { readonly organizationId: string; readonly pr
         name: "folder_name",
         required: true,
         max_length: 100,
-        placeholder: { tag: "plain_text", content: "在当前目录下新建 Folder" },
+        placeholder: { tag: "plain_text", content: "在当前目标目录下新建 Folder" },
       },
       {
         tag: "button",
         name: "folder_create_submit",
-        text: { tag: "plain_text", content: "新建目录" },
+        text: { tag: "plain_text", content: "新建并移动" },
         type: "default",
         complex_interaction: true,
         action_type: "form_submit",
@@ -456,6 +466,7 @@ function createFolderForm(params: { readonly organizationId: string; readonly pr
           action: "create_folder",
           organization_id: params.organizationId,
           project_id: params.projectId,
+          ...(params.parentFolderId !== null ? { folder_id: params.parentFolderId } : {}),
         } },
       },
     ],

hub/src/feishu/trigger.ts

@@ -56,7 +56,6 @@ import { createSlashCommandRegistry, parseSlashInvocation } from "./slashCommand
 import { cphHubMcpToolsForRole, roleToolsAllow } from "../agent/roleTools.js";
 import {
   bindFeishuChatToProject,
-  createFolder,
   createProjectFromFeishuChat,
   ensureOrganizationProjectSettings,
   moveProjectToFolder,
@@ -75,6 +74,7 @@ import {
 import {
   archiveCurrentRoleSession,
   browseFolderDestinations,
+  createFolderAndMoveProject,
   listRoleSessionHistory,
   loadProjectConsole,
   resumeRoleSession,
@@ -221,7 +221,6 @@ export function makeTriggerHandler(deps: TriggerDeps): TriggerHandler {
       roles: visibleRoles,
       currentSession: state.currentSession,
       canManageProject: manageDecision.allowed || isOrgAdmin,
-      canCreateFolder: isOrgAdmin,
       ...(title !== undefined ? { title } : {}),
     });
   }
@@ -949,6 +948,7 @@ export function makeTriggerHandler(deps: TriggerDeps): TriggerHandler {
             organizationId: state.organizationId,
             projectId,
             projectName: state.projectName,
+            canCreateFolder: isOrgAdmin,
             ...page,
           }));
           return;
@@ -968,18 +968,20 @@ export function makeTriggerHandler(deps: TriggerDeps): TriggerHandler {
         if (!isOrgAdmin) throw new Error("creating an Organization folder requires OWNER or ADMIN");
         const folderName = event.action.form_value?.["folder_name"];
         if (typeof folderName !== "string") throw new Error("create folder form is missing folder_name");
-        const folder = await createFolder(deps.prisma, {
+        const folder = await createFolderAndMoveProject(deps.prisma, {
           organizationId: state.organizationId,
-          name: folderName.slice(0, 100),
-          ...(state.folderId !== null ? { parentId: state.folderId } : {}),
-        });
-        await writeAudit(deps.prisma, {
           projectId,
-          action: "folder.created_from_feishu",
-          metadata: { folderId: folder.id, parentId: state.folderId, name: folder.name },
+          parentFolderId: action.folder_id ?? null,
+          name: folderName.slice(0, 100),
+          ...(manageDecision.actorUserId !== undefined ? { actorUserId: manageDecision.actorUserId } : {}),
         });
         if (messageId === undefined) throw new Error("folder creation requires message id");
-        await patchCard(rt, messageId, await projectConsoleCard(projectId, chatId, operatorOpenId, "目录已创建"));
+        await patchCard(rt, messageId, await projectConsoleCard(
+          projectId,
+          chatId,
+          operatorOpenId,
+          `已新建目录“${folder.folderName}”并移动项目`,
+        ));
         return;
       }
       if (action.action === "rename_project") {
@@ -1359,6 +1361,15 @@ export function makeTriggerHandler(deps: TriggerDeps): TriggerHandler {
         return;
       }
       const key = messageBatchKey(chatId, senderOpenId, runContext.roleId);
+      for (const [pendingKey, pendingContext] of batchContexts) {
+        if (
+          pendingKey !== key &&
+          pendingContext.chatId === chatId &&
+          pendingContext.senderOpenId === senderOpenId
+        ) {
+          await messageBatcher.flushNow(pendingKey);
+        }
+      }
       if (!batchContexts.has(key)) {
         batchContexts.set(key, runContext);
       }

hub/src/org/capacityPolicy.ts

@@ -0,0 +1,102 @@
+/**
+ * Org capacity policy service (ADR-0022 / spec `Spec.System.Capacity`).
+ *
+ * Stores per-Organization lower `organizationLimit` overrides per
+ * `CapacityDimension`. Enforces `LayeredLimit.Valid`: a set limit must be ≤ the
+ * platform ceiling for that dimension. `LayeredLimit.effective` (min of the two)
+ * is the value capacity admission should use; dimensions with no org override
+ * fall back to the platform ceiling.
+ */
+import type { PrismaClient } from "@prisma/client";
+import { CAPACITY_DIMENSIONS, isCapacityDimension, type CapacityDimension } from "../capacity/dimensions.js";
+import { readPlatformCeilings } from "../capacity/ceilings.js";
+import { lockActiveOrganization } from "./status.js";
+
+export interface CapacityPolicyView {
+  /** Per-dimension: platform ceiling (absent if not configured) + org limit. */
+  readonly dimensions: ReadonlyArray<{
+    readonly dimension: CapacityDimension;
+    readonly platformCeiling: number | null;
+    readonly organizationLimit: number | null;
+    readonly effective: number | null;
+  }>;
+}
+
+export async function getCapacityPolicy(
+  prisma: PrismaClient,
+  organizationId: string,
+): Promise<CapacityPolicyView> {
+  const row = await prisma.organizationCapacityPolicy.findUnique({
+    where: { organizationId },
+    select: { limits: true },
+  });
+  const orgLimits = parseLimits(row?.limits);
+  const ceilings = readPlatformCeilings();
+  const dimensions = CAPACITY_DIMENSIONS.map((dimension) => {
+    const platformCeiling = ceilings[dimension] ?? null;
+    const organizationLimit = orgLimits[dimension] ?? null;
+    const effective = effectiveLimit(platformCeiling, organizationLimit);
+    return { dimension, platformCeiling, organizationLimit, effective };
+  });
+  return { dimensions };
+}
+
+export async function setCapacityPolicy(
+  prisma: PrismaClient,
+  input: {
+    readonly organizationId: string;
+    /** Partial map of dimension → limit. null/absent clears a dimension. */
+    readonly limits: Partial<Record<CapacityDimension, number | null>>;
+  },
+): Promise<CapacityPolicyView> {
+  const ceilings = readPlatformCeilings();
+  const cleaned: Record<string, number> = {};
+  for (const [dimension, value] of Object.entries(input.limits)) {
+    if (!isCapacityDimension(dimension)) {
+      throw new Error(`unknown capacity dimension: ${dimension}`);
+    }
+    if (value === null || value === undefined) continue;
+    if (!Number.isFinite(value) || value <= 0 || !Number.isInteger(value)) {
+      throw new Error(`limit for ${dimension} must be a positive integer`);
+    }
+    const ceiling = ceilings[dimension];
+    if (ceiling === undefined) {
+      throw new Error(
+        `platform ceiling for ${dimension} is not configured; cannot set an organization limit (spec LayeredLimit.Valid)`,
+      );
+    }
+    if (value > ceiling) {
+      throw new Error(
+        `organization limit ${value} for ${dimension} exceeds platform ceiling ${ceiling} (spec LayeredLimit.Valid)`,
+      );
+    }
+    cleaned[dimension] = value;
+  }
+
+  await prisma.$transaction(async (tx) => {
+    await lockActiveOrganization(tx, input.organizationId);
+    await tx.organizationCapacityPolicy.upsert({
+      where: { organizationId: input.organizationId },
+      create: { organizationId: input.organizationId, limits: cleaned },
+      update: { limits: cleaned },
+    });
+  });
+  return getCapacityPolicy(prisma, input.organizationId);
+}
+
+function effectiveLimit(platformCeiling: number | null, organizationLimit: number | null): number | null {
+  if (platformCeiling === null) return null;
+  if (organizationLimit === null) return platformCeiling;
+  return Math.min(platformCeiling, organizationLimit);
+}
+
+function parseLimits(raw: unknown): Partial<Record<CapacityDimension, number>> {
+  if (raw === null || typeof raw !== "object") return {};
+  const result: Partial<Record<CapacityDimension, number>> = {};
+  for (const [key, value] of Object.entries(raw as Record<string, unknown>)) {
+    if (isCapacityDimension(key) && typeof value === "number" && Number.isFinite(value)) {
+      result[key] = value;
+    }
+  }
+  return result;
+}

hub/src/org/explorer.ts

@@ -12,6 +12,7 @@ import {
   moveProjectToFolder,
 } from "../projectOnboarding.js";
 import { lockActiveOrganization } from "./status.js";
+import { PrismaPrincipalResolver } from "../permissions/principals.js";
 
 export interface ExplorerFolderNode {
   readonly id: string;
@@ -335,6 +336,64 @@ export async function archiveOrgProjectChatBinding(
   });
 }
 
+/**
+ * Projects an org member can see via their resolved principals' READ+ grants
+ * (spec `PermissionGrant` / ADR-0004). Used by the member-facing project list
+ * — org-admin oversight uses `listOrgExplorer` instead.
+ */
+export async function listMyProjects(
+  prisma: PrismaClient,
+  input: { readonly organizationId: string; readonly actorFeishuOpenId: string },
+): Promise<readonly ExplorerProjectNode[]> {
+  const resolver = new PrismaPrincipalResolver(prisma);
+  const resolution = await resolver.resolveActor(
+    { feishuOpenId: input.actorFeishuOpenId },
+    { organizationId: input.organizationId },
+  );
+  // Match exact (type, id) pairs — independent IN filters form a cartesian
+  // product and can attribute another principal's grants to this actor.
+  if (resolution.principals.length === 0) return [];
+  const grants = await prisma.permissionGrant.findMany({
+    where: {
+      resourceType: "PROJECT",
+      revokedAt: null,
+      OR: resolution.principals.map((p) => ({
+        principalType: p.type,
+        principalId: p.id,
+      })),
+    },
+    select: { resourceId: true },
+    distinct: ["resourceId"],
+  });
+  const projectIds = grants.map((g) => g.resourceId);
+  if (projectIds.length === 0) return [];
+  const projects = await prisma.project.findMany({
+    where: { id: { in: projectIds }, organizationId: input.organizationId, archivedAt: null },
+    select: {
+      id: true,
+      name: true,
+      folderId: true,
+      createdAt: true,
+      groupBindings: {
+        where: { archivedAt: null },
+        select: { chatId: true, createdAt: true },
+        take: 1,
+      },
+    },
+    orderBy: { name: "asc" },
+  });
+  return projects.map((p) => {
+    const binding = p.groupBindings[0];
+    return {
+      id: p.id,
+      name: p.name,
+      folderId: p.folderId,
+      createdAt: p.createdAt.toISOString(),
+      binding: binding === undefined ? null : { chatId: binding.chatId, createdAt: binding.createdAt.toISOString() },
+    };
+  });
+}
+
 async function requireActiveFolder(
   prisma: PrismaClient | Prisma.TransactionClient,
   folderId: string,

hub/src/org/teams.ts

@@ -1,8 +1,9 @@
 /**
  * Hub team lifecycle for org admin (ADR-0019 / ADR-0021).
  *
- * Archiving a team soft-archives the team row and revokes active TEAM→PROJECT
- * grants that use this team as principal (product pin).
+ * Archiving a team soft-archives the team row. Active TEAM→PROJECT grants and
+ * memberships are left in place as dead rows: principal resolution refuses
+ * archived teams (see `permissions/principals.ts`), so they confer no access.
  */
 import type { Prisma, PrismaClient } from "@prisma/client";
 import { lockActiveOrganization } from "./status.js";
@@ -125,37 +126,21 @@ export async function updateTeam(
 }
 
 /**
- * Soft-archive team and revoke its active project grants (TEAM principal).
+ * Soft-archive team. Active grants/memberships are not cascade-revoked; the
+ * archived flag alone makes the team's principal unresolvable (no access).
  */
 export async function archiveTeam(
   prisma: PrismaClient,
   input: { readonly organizationId: string; readonly teamId: string },
-): Promise<{ readonly archived: true; readonly teamId: string; readonly revokedGrants: number }> {
+): Promise<{ readonly archived: true; readonly teamId: string }> {
   return prisma.$transaction(async (tx) => {
     await lockActiveOrganization(tx, input.organizationId);
     const team = await requireActiveTeam(tx, input.teamId, input.organizationId);
-    const now = new Date();
     await tx.team.update({
       where: { id: team.id },
-      data: { archivedAt: now },
+      data: { archivedAt: new Date() },
     });
-    await tx.teamMembership.updateMany({
-      where: { teamId: team.id, revokedAt: null },
-      data: { revokedAt: now },
-    });
-    const grants = await tx.permissionGrant.updateMany({
-      where: {
-        principalType: "TEAM",
-        principalId: team.id,
-        revokedAt: null,
-      },
-      data: { revokedAt: now },
-    });
-    return {
-      archived: true as const,
-      teamId: team.id,
-      revokedGrants: grants.count,
-    };
+    return { archived: true as const, teamId: team.id };
   });
 }
 

hub/src/permissions/externalSync.ts

@@ -71,7 +71,6 @@ export async function syncExternalPrincipalMemberships(
         create: {
           feishuOpenId: item.feishuOpenId,
           displayName: item.displayName,
-          platformRoles: { create: { role: "TEACHER" } },
           organizationMemberships: { create: { organizationId: input.organizationId, role: "MEMBER" } },
         },
       });

hub/src/permissions/projectTeamAccess.ts

@@ -131,9 +131,8 @@ export async function listProjectTeamAccess(
     where: {
       organizationId: project.organizationId,
       id: { in: grants.map((grant) => grant.principalId) },
-      archivedAt: null,
     },
-    select: { id: true, slug: true, name: true },
+    select: { id: true, slug: true, name: true, archivedAt: true },
   });
   const teamsById = new Map(teams.map((team) => [team.id, team]));
   const missing = grants.filter((grant) => !teamsById.has(grant.principalId));
@@ -143,13 +142,15 @@ export async function listProjectTeamAccess(
     );
   }
 
-  return grants.map((grant) => entryFromGrant({
-    grantId: grant.id,
-    projectId: project.id,
-    organizationId: project.organizationId,
-    team: teamsById.get(grant.principalId)!,
-    role: grant.role,
-  }));
+  return grants
+    .filter((grant) => teamsById.get(grant.principalId)?.archivedAt === null)
+    .map((grant) => entryFromGrant({
+      grantId: grant.id,
+      projectId: project.id,
+      organizationId: project.organizationId,
+      team: teamsById.get(grant.principalId)!,
+      role: grant.role,
+    }));
 }
 
 type ProjectForAccess = {

hub/test/integration/admin-members-teams.test.ts

@@ -129,6 +129,18 @@ describe("admin members + teams API", () => {
         workspaceDir: "/tmp/p1",
       },
     });
+    // Team-access grant/revoke is gated to project MANAGE (no org-admin bypass).
+    // Seed the owner with a MANAGE grant on p1 so the org-owner flow still works.
+    await prisma.permissionGrant.create({
+      data: {
+        resourceType: "PROJECT",
+        resourceId: "p1",
+        principalType: "USER",
+        principalId: "ou_owner",
+        role: "MANAGE",
+        createdByUserId: "u-owner",
+      },
+    });
 
     const app = await buildApp();
     try {
@@ -176,7 +188,7 @@ describe("admin members + teams API", () => {
       });
       expect(archive.statusCode).toBe(200);
       expect(archive.json()).toEqual(
-        expect.objectContaining({ archived: true, revokedGrants: 1 }),
+        expect.objectContaining({ archived: true, teamId: team.id }),
       );
 
       const after = await app.inject({

hub/test/integration/helpers.ts

@@ -400,7 +400,6 @@ export async function seedProject(
       id: "u_" + projectId,
       feishuOpenId: principal,
       displayName: "Test User",
-      platformRoles: { create: { role: "TEACHER" } },
       organizationMemberships: { create: { organizationId: DEFAULT_ORG_ID, role: "MEMBER" } },
       permissionGrants: {
         create: {

hub/test/integration/trigger.test.ts

@@ -325,6 +325,52 @@ describe("trigger full lifecycle (integration)", () => {
     expect(cardHeaderTitle(rt.sentPatches.at(-1))).toBe("项目名称已更新");
   });
 
+  it("offers folder creation only inside move flow and atomically moves into the new folder", async () => {
+    await seedProject("project-folder-flow", "chat-folder-flow", { role: "MANAGE" });
+    await prisma.organizationMembership.updateMany({
+      where: { organizationId: DEFAULT_ORG_ID, userId: "u_project-folder-flow", revokedAt: null },
+      data: { role: "ADMIN" },
+    });
+    const parent = await prisma.folder.create({
+      data: { organizationId: DEFAULT_ORG_ID, name: "课程目录" },
+    });
+    const trigger = makeTriggerHandler({ prisma, settings, logger: silentLogger, runAgent });
+
+    await trigger(makeEvent("chat-folder-flow", "@_user_1 /project"), rt);
+    expect(JSON.stringify(rt.sentCards.at(-1))).not.toContain("folder_create_form");
+
+    await trigger.onCardAction(makeOnboardingEvent("chat-folder-flow", {
+      project_onboarding: {
+        action: "browse_move_destination",
+        organization_id: DEFAULT_ORG_ID,
+        project_id: "project-folder-flow",
+        folder_id: parent.id,
+      },
+    }, "ou_test_user"), rt);
+    const moveCard = JSON.stringify(rt.sentPatches.at(-1));
+    expect(moveCard).toContain("folder_create_form");
+    expect(moveCard).toContain("新建并移动");
+
+    await trigger.onCardAction(makeOnboardingEvent("chat-folder-flow", {
+      project_onboarding: {
+        action: "create_folder",
+        organization_id: DEFAULT_ORG_ID,
+        project_id: "project-folder-flow",
+        folder_id: parent.id,
+      },
+    }, "ou_test_user", { folder_name: "力学单元" }), rt);
+
+    const folder = await prisma.folder.findFirstOrThrow({
+      where: { organizationId: DEFAULT_ORG_ID, parentId: parent.id, name: "力学单元" },
+    });
+    await expect(prisma.project.findUniqueOrThrow({ where: { id: "project-folder-flow" } }))
+      .resolves.toMatchObject({ folderId: folder.id });
+    await expect(prisma.auditEntry.findFirstOrThrow({
+      where: { projectId: "project-folder-flow", action: "folder.created_and_project_moved_from_feishu" },
+    })).resolves.toMatchObject({ metadata: expect.objectContaining({ folderId: folder.id, parentFolderId: parent.id }) });
+    expect(cardHeaderTitle(rt.sentPatches.at(-1))).toContain("已新建目录");
+  });
+
   it("binds an existing manageable project from the unbound-chat onboarding card", async () => {
     await seedOnboardingUser("u-onboard-bind", "ou_onboard_bind", "MEMBER");
     await prisma.project.create({
@@ -660,11 +706,11 @@ describe("trigger full lifecycle (integration)", () => {
 
     await vi.waitFor(async () => {
       expect(await prisma.agentRun.count({ where: { projectId: "proj-batch-role", status: "COMPLETED" } })).toBe(2);
-    });
+    }, { timeout: 5_000 });
     const runs = await prisma.agentRun.findMany({ where: { projectId: "proj-batch-role" } });
     expect(runs.find((run) => run.prompt.includes("草稿消息"))?.metadata).toMatchObject({ roleId: "draft" });
     expect(runs.find((run) => run.prompt.includes("审校消息"))?.metadata).toMatchObject({ roleId: "review" });
-  });
+  }, 10_000);
 
   it("keeps the project session shared while labeling each sender in the prompt", async () => {
     await seedProject("proj-speaker", "chat-speaker");

spec/README.md

@@ -49,7 +49,7 @@ agent 不得用预训练先验脑补本领域(领域很新,无先验);prose 是
 
 ### 命名
 
-- **模块 / 命名空间**:PascalCase,对应分层,如 `Spec.System.Run`、`Spec.Courseware.Validity`。
+- **模块 / 命名空间**:PascalCase,对应分层,如 `Spec.System.Agent.Run`、`Spec.Courseware.Validity`。
 - **类型**:PascalCase。
 - **谓词 / `Prop`**:用意图清晰的命名,如 `Legal…`、`ValidTransition`、`Can…`。
 - **文件粒度**:原则上"一个带独立不变式的概念一个文件"。

spec/Spec/Courseware.lean

@@ -16,6 +16,6 @@ import Spec.Courseware.Open
 - **`Check`** —— checker 语义:`Severity` + 6 类诊断 + **合法 lesson = 无 error 级
   诊断**(模型外设施诊断以抽象谓词 + `Oracle` 表示);检查管线的 5 阶段、序、compile
   门控。
-- **`Open`** —— 留白骨架(核心关系 OPEN,已 surface 不臆造):题库 `QuestionBank`、
+- **`Open`** —— OPEN 骨架(核心关系 OPEN,已 surface):题库 `QuestionBank`、
   课程编排 `Course`。
 -/

spec/Spec/Courseware/Check/Diagnostic.lean

@@ -6,7 +6,7 @@ import Spec.Courseware.Export.Render
 
 产品里"站在 Lean 位置"的 rule-based checker,语义在此沉淀(ADR-0010,经 ADR-0012
 修订)。它对 lesson 提诊断,每条有**分类**(`DiagKind`)与**严重级别**(`Severity`)。
-本模块:钉级别类型(二分);钉 7 类诊断各自的含义与级别,并把"**合法 lesson = 无
+定级别类型(二分);定 7 类诊断各自的含义与级别,并把"**合法 lesson = 无
 error 级诊断**"建成判定(ADR-0005 deferred 的"完整合法判定"的回填);对**模型外设施**
 型诊断(typst 编过否、数据合 schema 否)用**抽象谓词 + `Oracle` 实现边界**表示——契约
 说"存在这条诊断、什么意思、什么级别",真值由实现提供,不在 Lean 内计算(不内嵌 typst
@@ -50,7 +50,7 @@ inductive DiagKind where
 
 /-- 每类诊断的**严重级别**(`PINNED`, ADR-0010)。六类 `error`(阻断);**唯
 `renderIgnored` 为 `warning`**——ADR-0005 种子规则"缺渲染 ⇒ warning,不阻断导出"。
-钉成全函数使"哪类阻断"成为可引用、可对齐的事实(实现侧 `DiagCode` 级别据此对齐)。 -/
+全函数使"哪类阻断"成为可引用、可对齐的事实(实现侧 `DiagCode` 级别据此对齐)。 -/
 def DiagKind.severity : DiagKind → Severity
   | .partPathMissing    => .error
   | .unknownKind        => .error

spec/Spec/Courseware/Check/Pipeline.lean

@@ -5,8 +5,8 @@ import Spec.Courseware.Check.Diagnostic
 
 checker 的 `check` 按**固定顺序**跑五个阶段,逐阶段收集诊断;`compile` 阶段有**门控**。
 顺序与门控是契约——它决定用户看到哪些诊断(藏在缺文件背后的语法错,在文件补齐前不
-显示,这是有意的)。每阶段的**算法**不进 Lean(宪法第 5 条深度上限):只钉**阶段、序、
-门控**。阶段对应上游模块:`load`←`cph-model`;`structural`←part 路径/未知 kind;
+显示,这是有意的)。每阶段的**算法**不进 Lean(深度上限:只定**阶段、序、
+门控**)。阶段对应上游模块:`load`←`cph-model`;`structural`←part 路径/未知 kind;
 `schema`←`cph-schema`;`compile`←`cph-typst`(模型外设施);`coverage`←`renderIgnored`。
 -/
 

spec/Spec/Courseware/Export/Artifact.lean

@@ -2,7 +2,7 @@
 # Artifact —— export target 的产物(ADR-0009 / 0011)
 
 ADR-0009:一个 export target 是**一次 build**,产出一个**有类型的产物**。ADR-0011
-钉死:产物是**带字段的 ADT**——"产物到底指什么"(单文件落在哪 / 一棵树产出哪些文件)
+固定:产物是**带字段的 ADT**——"产物到底指什么"(单文件落在哪 / 一棵树产出哪些文件)
 是不好猜的领域语义,必须写进字段 + doc,而非抹成两个空构造子。路径/glob 用 `String`
 承载并由 doc 赋义(它们就是文本),不复刻文件系统类型。
 -/

spec/Spec/Courseware/Export/Render.lean

@@ -4,7 +4,7 @@ import Spec.Courseware.Export.Artifact
 /-!
 # Render —— export target = artifact + 有序 typed steps(ADR-0009 / 0011)
 
-ADR-0009:export target 是一次 build,产出一个有类型的 `Artifact`。ADR-0011 钉死 build
+ADR-0009:export target 是一次 build,产出一个有类型的 `Artifact`。ADR-0011 固定 build
 的**形状**:一个 target 是 `artifact` + 一串**有序 typed step**。
 
 - `typstCompile template` —— 把**模板文件**(如 `exports/student.typ`)编译成产物。它是
@@ -20,7 +20,7 @@ ADR-0009:export target 是一次 build,产出一个有类型的 `Artifact`。ADR
 
 **shell step 的执行语义(ADR-0013)。** `shell` 不再只是占位:它**会被执行**,语义是把
 `run` 交给平台 shell、以**工程根为工作目录**运行,产物由被调外部工具自己写出(框架不装配
-内容)。三条边界是真分歧点,故钉契约:
+内容)。三条边界是真分歧点,故定为契约:
 1. **opt-in by construction** —— 任意命令执行只在用户**显式** build 一个 shell target 时发生,
    绝不在 `check` 里跑。`check` 只校验结构(lesson 是否合法),不执行外部工具、不验其产物。
 2. **失败归属** —— shell step 退出非零是一次 **build-过程失败**,不是 lesson 的合法性缺陷;
@@ -46,7 +46,7 @@ namespace Spec.Courseware
 variable (P : Primitives)
 
 /-- 一个 build **step**(`PINNED` typed, ADR-0011;可扩展)。MVP 仅一个 `typstCompile`;
-`steps` 是 list 因为 FileTree / 第三方 build 会需多步。刻意不把模板内部、shell 命令的
+`steps` 是 list 因为 FileTree / 第三方 build 会需多步。不把模板内部、shell 命令的
 解析结构写进来(实现细节, ADR-0011 OPEN)。 -/
 inductive Step where
   /-- 编译模板文件 `template`(相对工程根)成产物;框架注入 manifest。typed 的理由:

spec/Spec/Courseware/Model.lean

@@ -7,7 +7,7 @@ import Spec.Courseware.Model.Info
 /-!
 # Courseware.Model —— 工程文件的内容模型
 
-留白基元(`Primitives`)、富内容锚点(`RichContent`)、原子单位(`Element`)、单节课
+基元(`Primitives`)、富内容锚点(`RichContent`)、原子单位(`Element`)、单节课
 (`Lesson`)、课时元信息(`Info`:canonical author 为列表 vs `RawInfo` 撰写态)。
 决策出处 ADR-0005 / 0006 / 0008。
 -/

spec/Spec/Courseware/Model/Element.lean

@@ -3,7 +3,7 @@ import Spec.Courseware.Model.Primitives
 /-!
 # Element —— 课程内容的原子单位
 
-ADR-0005:element 实例 = 一个 kind 标签 + 符合该 kind schema 的数据。本模块把它编码成
+ADR-0005:element 实例 = 一个 kind 标签 + 符合该 kind schema 的数据。把它编码成
 依赖结构,使"数据必须匹配其 kind"成为类型层面的事实而非运行时校验。
 -/
 

spec/Spec/Courseware/Model/Info.lean

@@ -5,7 +5,7 @@
 基数**是一个真分歧点:一节课可由多人(教研组)署名,故 canonical 模型里 author 是一个
 **有序列表**,不是单值或可选单值。
 
-另有一条值得钉的模式:on-disk 的**撰写态**(用户实际填写的形态)是**语法糖**——单作者可写
+另一条模式:on-disk 的**撰写态**(用户实际填写的形态)是**语法糖**——单作者可写
 `author = "…"`,多作者写 `author = ["…", "…"]`——但这个"字符串或数组"的二态**只活在加载
 边界**:`RawInfo` 经归一化折叠成 canonical `Info`,其后不再出现。canonical 接收端始终是
 `List String`,raw 形式不泄漏进模型其余部分。这正是 `Info`(canonical)与 `RawInfo`
@@ -24,7 +24,7 @@ inductive RawAuthor where
   | many (names : List String)
 
 /-- raw 作者归一化为**有序作者列表**(`PINNED`, ADR-0008)。单作者 ⇒ 单元素列表;数组
-⇒ 原样。这条钉死"canonical 接收端始终是 `List String`"。 -/
+⇒ 原样。canonical 接收端始终是 `List String`。 -/
 def RawAuthor.normalize : RawAuthor → List String
   | .one n => [n]
   | .many ns => ns

spec/Spec/Courseware/Model/Primitives.lean

@@ -1,26 +1,26 @@
 /-!
-# Primitives —— Courseware 契约的留白基元
+# Primitives —— Courseware 契约的基元
 
 课程工程文件模型(ADR-0005)依赖一组基元:element kind 怎么标识、某 kind 的数据
 schema 是什么、export target 怎么标识。收口成载体 `Primitives`,让模型在其上参数化
 ——契约谈得了 element / lesson / 渲染**之间的关系**,而把每个基元的**内部表示**留给
-实现。注意:某基元语义已 PINNED(如 schema 形态由 ADR-0006 钉死)与其表示进 Lean
+实现。注意:某基元语义已 PINNED(如 schema 形态由 ADR-0006 固定)与其表示进 Lean
 是两回事——JSON Schema / typst 的内部结构属实现细节,不入 Lean,故基元在此仍以抽象
-类型承载。富内容的 prose 母本见 `Courseware.RichContent`。
+类型承载。富内容的母本见 `Courseware.RichContent`。
 -/
 
 namespace Spec.Courseware
 
 /-- Courseware 契约基元载体(关系 `PINNED`, ADR-0005;各基元表示留给实现, ADR-0006)。 -/
 structure Primitives where
-  /-- element kind 标识(`PINNED` **开放宇宙**, ADR-0005;表示 `OPEN`)。刻意用抽象
+  /-- element kind 标识(`PINNED` **开放宇宙**, ADR-0005;表示 `OPEN`)。用抽象
       类型而非 `inductive`:ADR-0005 决定 kind 是开放可扩展宇宙(stdlib + 第三方),
       封闭枚举会违背它——此处开放是**已决策的**(区别于 `RunState` 的"尚未封闭")。 -/
   KindId : Type
   /-- 某 kind 的合法数据类型(`PINNED` 依赖关系, ADR-0005;schema 形态 `PINNED`
       ADR-0006,表示仍抽象)。以 kind 为索引:`ElementData k` 即"符合 `k` schema 的
-      数据"。schema 形态(声明式 JSON Schema + `content` 叶子 = typst 源)是 ADR-0006
-      钉死的,但属 JSON/typst 内部结构、实现细节,不进 Lean;契约只锚定"数据符合
+      数据"。schema 形态(声明式 JSON Schema + `content` 叶子 = typst 源)由 ADR-0006
+      固定,但属 JSON/typst 内部结构、实现细节,不进 Lean;契约只锚定"数据符合
       kind schema"这条关系,故此处仍是抽象类型。 -/
   ElementData : KindId → Type
   /-- export target 标识(`PINNED` 角色, ADR-0005;表示 `OPEN`)。一个 target 是一次

spec/Spec/Courseware/Model/RichContent.lean

@@ -1,5 +1,5 @@
 /-!
-# RichContent —— 富内容(ADR-0006 的 prose 母本)
+# RichContent —— 富内容(ADR-0006 的母本)
 
 ADR-0006:element schema 的"叶子"可以是 `content` 类型,其值是一段**源文本**,
 按其 **format** 决定语义(ADR-0015)。两种 format:
@@ -13,7 +13,7 @@ ADR-0006:element schema 的"叶子"可以是 `content` 类型,其值是一段**
 的一等文件,坐落在一个**虚拟路径**上;相对 import 限本工程路径结构内 + `@package`(不跨工程)。markdown format
 的富内容不参与 typst 求值,但同样由一个虚拟路径定位(供 markdown 装配 step 按序读取,见 `Export/Render`)。
 
-本模块只立 prose 锚点 + 最小抽象签名:typst 的 `Content`/`Module` 内部结构、JSON Schema 形状、format 的
+只立锚点 + 最小抽象签名:typst 的 `Content`/`Module` 内部结构、JSON Schema 形状、format 的
 具体判别属实现细节,不进 Lean,只承诺"富内容由一个虚拟路径定位"+"叶子带 format"这两条关系。
 -/
 
@@ -33,8 +33,8 @@ inductive ContentFormat where
   | markdown
 
 /-- 对一段富内容的**引用**:它坐落在某个虚拟路径上(`PINNED` 关系, ADR-0006),并带一个
-**format**(`PINNED`, ADR-0015)。刻意**不**建模源文本、不建模求值出的 `Content`(那是实现侧的事);
-只钉"富内容经由一个 `VPath` 定位 + 带 format",作为 `Primitives.ElementData` 里 `content` 叶子的语义锚点。 -/
+**format**(`PINNED`, ADR-0015)。不建模源文本、不建模求值出的 `Content`(那是实现侧的事);
+"富内容经由一个 `VPath` 定位 + 带 format",作为 `Primitives.ElementData` 里 `content` 叶子的语义锚点。 -/
 structure RichContentRef where
   /-- 该富内容所在的虚拟路径(ADR-0006;落盘后为真实相对路径, ADR-0007)。 -/
   vpath : VPath

spec/Spec/Courseware/Open.lean

@@ -2,8 +2,8 @@ import Spec.Courseware.Open.QuestionBank
 import Spec.Courseware.Open.Course
 
 /-!
-# Courseware.Open —— 留白骨架(核心关系 OPEN)
+# Courseware.Open —— OPEN 骨架(核心关系)
 
 题库与 element 的关系(`QuestionBank`)、课程编排规则(`Course`)。两者均为已 surface
-但未决策的分歧点,按宪法第 2 条不臆造,待专门 ADR 落定。
+但未决策的 OPEN 分歧点,待专门 ADR 落定。
 -/

spec/Spec/Courseware/Open/Course.lean

@@ -5,6 +5,6 @@ ADR-0005:工程文件的粒度是**单节课**;course / 单元**不是**工程
 **编排**。但"编排"的具体规则未决策:有序列表还是带层级(单元 → 课)的树?lesson 被
 引用还是被包含?跨 lesson 有无约束(目标覆盖、前后置)?这些都是 `OPEN`。
 
-按宪法第 2 条本模块**不臆造**编排结构——不建 `Course := List Lesson`(那会偷偷承诺
+此处不替它选解——不建 `Course := List Lesson`(那会偷偷承诺
 "扁平有序、无层级")。只在此 surface:课程编排待专门 ADR。本文件当前不引入任何承诺性声明。
 -/

spec/Spec/Courseware/Open/QuestionBank.lean

@@ -5,6 +5,6 @@
 典型的可复用单元,lesson 会引用它。但**题库与 element 的关系尚未决策**,且用户明确
 指出"纯引用可能不够"——element 内联题目数据 / lesson 持指向题库条目的引用 / 两者并存?
 
-这是一个 `OPEN` 分歧点。按宪法第 2 条本模块**不替它选解**——不建 `QuestionRef` 也不建
+这是一个 `OPEN` 分歧点。此处不替它选解——不建 `QuestionRef` 也不建
 内联结构,只在此 surface。待专门 ADR 落定后再填。本文件当前不引入任何承诺性声明。
 -/

spec/Spec/Prelude.lean

@@ -1,10 +1,10 @@
 /-!
 # Prelude —— System 层共享标识符
 
-平台层反复引用一组标识符(项目、run、session、principal、chat、platform identity/audit)。其内部表示从未被决策
-(UUID / 复合键、principal 子类型学),也非分歧点,故收口成 opaque 载体
-`Identifiers`,System 各模块在其上参数化——契约谈得了"锁 owner 是哪个 run"这类
-**关系**,却不对标识符表示作承诺。
+平台层引用一组标识符(项目、run、session、principal、chat、platform identity/audit)。
+其内部表示从未被决策(UUID / 复合键、principal 子类型学),也非分歧点,故收口成 opaque
+载体 `Identifiers`,System 各模块在其上参数化——契约谈得了"锁 owner 是哪个 run"这类
+关系,却不对标识符表示作承诺。
 -/
 
 namespace Spec.System
@@ -15,12 +15,22 @@ structure Identifiers where
   ProjectId : Type
   /-- SaaS 租户/组织标识(`OPEN` 表示;ADR-0020 tenant root)。 -/
   OrganizationId : Type
+  /-- 租户层用户标识(`OPEN` 表示;独立实体,非飞书身份派生;见 `Hierarchy.User`)。 -/
+  UserId : Type
+  /-- 飞书用户 open_id(`OPEN` 表示;单应用作用域内唯一)。 -/
+  FeishuOpenId : Type
+  /-- 飞书 user_id(`OPEN` 表示;租户内唯一,换 app 不变)。 -/
+  FeishuUserId : Type
+  /-- 飞书企业应用 app_id(`OPEN` 表示)。 -/
+  FeishuAppId : Type
+  /-- 飞书 app_secret 信封引用(`OPEN` 表示;ADR-0024)。 -/
+  FeishuAppSecretRef : Type
   /-- Hub teacher team 标识(`OPEN` 表示;ADR-0020 org-scoped team)。 -/
   TeamId : Type
   /-- Project explorer folder 标识(`OPEN` 表示;ADR-0021 透明组织节点,非权限资源)。 -/
   FolderId : Type
   /-- 一次 agent 任务的标识(`OPEN` 表示;锁的 owner、审计主体,`AgentRun`。provider 无关,
-  ADR-0017;`@Claude` 仅为触发品牌,不承诺 provider)。 -/
+  ADR-0017;`@bot` 仅为触发品牌,不承诺 provider)。 -/
   RunId : Type
   /-- 长生命周期 agent 会话标识(`OPEN` 表示;**provider/model 绑定, ADR-0017**——一次
   session 不跨 provider/model;切 model 即新 session,跨 session 连续性由 ADR-0003 项目
@@ -30,11 +40,11 @@ structure Identifiers where
   不是 slash command 枚举。 -/
   AgentRoleId : Type
   /-- 权限主体标识(`OPEN` 表示及其子类型学;ADR-0004 的 user/chat/department/…
-      子类型学未定且非本层分歧点,纯 plumbing,故只留 opaque 键)。 -/
+      子类型学未定且非分歧点,故只留 opaque 键)。 -/
   Principal : Type
   /-- 飞书项目群 chat 标识(`OPEN` 表示;ADR-0001 协作空间、ADR-0003 锚点引用、
       ADR-0004 `feishu_chat` principal 三处共用同一实体。独立成载体而非 `Principal` 子
-      类型——principal 子类型学 OPEN 见上,本层不预设"chat 是 principal 的哪种子型")。 -/
+      类型——principal 子类型学 OPEN,这里不预设"chat 是 principal 的哪种子型")。 -/
   ChatId : Type
   /-- 平台管理员身份标识(`OPEN` 表示;ADR-0023,不复用客户 `User` 标识)。 -/
   PlatformIdentityId : Type

spec/Spec/System.lean

@@ -1,41 +1,49 @@
+import Spec.System.Hierarchy
 import Spec.System.ProjectGroup
 import Spec.System.Organization
+import Spec.System.User
+import Spec.System.Connections
 import Spec.System.ProjectWorkspace
 import Spec.System.Capacity
 import Spec.System.PlatformAdministration
-import Spec.System.Run
+import Spec.System.Agent.Run
+import Spec.System.Agent.AgentRole
+import Spec.System.Agent.Memory
+import Spec.System.Agent.AgentSurface
 import Spec.System.Lock
-import Spec.System.Memory
-import Spec.System.AgentSurface
 import Spec.System.Permission
 import Spec.System.PermissionGrant
 import Spec.System.Audit
 /-!
 # System —— Hub 平台层契约
 
-协作与执行的平台:项目、飞书群、AgentRun、锁、权限、审计、按需上下文。likec4
-(`docs/architecture/likec4/`)已画出这一层的**结构**;本层只补 likec4 画不出的
-**语义分歧点**:
+协作与执行的平台:项目、飞书群、AgentRun、锁、权限、审计、按需上下文。
+likec4 已画出结构;这里补语义:
 
+- `Hierarchy` —— 三层主体:平台 → 组织 → 用户。
+- `User` —— 用户创建路径(管理员直接创建;飞书注册 `OPEN`)。
+- `Connections` —— 外部连接:提供商枚举(当前仅飞书) + 绑定/信息类型。
 - `ProjectGroup` —— project↔飞书群 1:1 长生命周期绑定(ADR-0001);群是协作空间,不持锁。
-- `Organization` —— SaaS tenant root(ADR-0020);project/team 单归属,TEAM grant 不跨 org;
-  connection secret 使用本地主密钥信封与 fail-closed resolver(ADR-0024)。
+- `Organization` —— SaaS 租户(ADR-0020);project/team 单归属,TEAM grant 不跨 org;
+  connection secret 信封与 fail-closed resolver(ADR-0024);
+  owner/admin/member(`OrganizationRole`)及其管理规则(最后所有者保护)。
 - `ProjectWorkspace` —— org 后台 project explorer:folder 是透明组织节点,project 仍是权限边界
   (ADR-0021)。
 - `Capacity` —— platform ceiling 与 org policy 的分层限制、持久 admission request 状态和
   平台紧急工作负载制动(ADR-0022)。
 - `PlatformAdministration` —— 独立平台身份/会话、单一管理员角色、绑定邀请、最后管理员
   保护、fail-closed 平台审计与离线 emergency grant(ADR-0023)。
+- `AgentRole` —— org-scoped agent 角色配置 + 技能(ADR-0017/0018)。
 - `Run` —— AgentRun 状态与终止判定(状态集合完整性 OPEN)。
 - `Lock` —— 锁 owner=run(ADR-0002),及"持锁者必为非终止 run"的核心不变式。
-- `Memory` —— 按需上下文:锚点类别(ADR-0003)+ MCP 工具按 run/project 上下文授权的不变式。
+- `Memory` —— 按需上下文:锚点类别(ADR-0003)+ MCP 工具按 run/project 上下文授权。
 - `AgentSurface` —— agent 执行面被 run 的工作区所界定(ADR-0018);与 Lock 正交——
   Lock 限定并发,Surface 限定波及面。机制 OPEN。
-- `Permission` —— read⊂edit⊂manage 角色格、能力推导、单调性;force-release 在格外。
-- `PermissionGrant` —— grant(resource×principal×role)与 settings(六 policy 旋钮)结构
-  (ADR-0004);role-capability 与 settings-policy 的组合规则 OPEN。
-- `Audit` —— customer Project/Run 审计有意从简(内容多为 plumbing,OPEN);Platform
-  Audit 由 `PlatformAdministration` 独立钉死。
+- `Permission` —— read⊂edit⊂manage 角色体系、能力推导、单调性;force-release 在格外。
+- `PermissionGrant` —— grant(resource×principal×role)与 settings(六 policy 旋钮)
+  (ADR-0004);组合规则 OPEN。
+- `Audit` —— customer Project/Run 审计从简(内容 OPEN);Platform Audit 由
+  `PlatformAdministration` 独立承载。
 
 标识符见 `Spec.Prelude`。决策出处:ADR-0001..0004, 0018, 0020..0024。
 -/

spec/Spec/System/Agent/AgentRole.lean

@@ -0,0 +1,60 @@
+import Spec.Prelude
+
+/-!
+# AgentRole —— Agent 角色与技能配置 (ADR-0017, ADR-0018)
+
+AgentRole 是 org-scoped 运行时配置:system prompt、tool allowlist、default model
+和 skill 绑定。通过 CLI 管理,不需重启进程生效。
+
+Role 的执行面(model/prompt/tools/skill 内容)变更时,该 role 的 active sessions
+归档——下次 run 不能在旧指令下创建的 provider context 上恢复。
+仅 label/排序变更不影响会话连续性(ADR-0017)。
+
+Run 时只读加载 role 选中的 skill 不可变版本到 run-scoped 目录,
+run 结束后删除(ADR-0018)。Skill 管理是 org-scoped;存储机制 `OPEN`。
+-/
+
+namespace Spec.System
+
+variable (I : Identifiers)
+
+/-- Agent 角色(`PINNED`, org-scoped, ADR-0017)。 -/
+structure AgentRole where
+  /-- 所属组织(`PINNED`)。 -/
+  organization : I.OrganizationId
+  /-- 斜杠命令名(`OPEN` 表示;如 /draft)。 -/
+  roleId : String
+  /-- system prompt(`PINNED`)。 -/
+  systemPrompt : String
+  /-- tool allowlist(`PINNED`;tool 标识集合 `OPEN`)。 -/
+  tools : List String
+  /-- 默认 model(`PINNED`;model ID 表示 `OPEN`)。 -/
+  defaultModel : String
+
+/-- Agent 技能(`PINNED`, org-scoped, ADR-0017/0018)。 -/
+structure AgentSkill where
+  /-- 所属组织(`PINNED`)。 -/
+  organization : I.OrganizationId
+  /-- 名称(`PINNED`)。 -/
+  name : String
+  /-- 版本(`PINNED`)。 -/
+  version : String
+  /-- 内容摘要(`PINNED`;SHA-256 content-addressed)。 -/
+  contentDigest : String
+  /-- 描述(`OPEN`)。 -/
+  description : String
+
+/-- Role-Skill 绑定(`PINNED`, ADR-0017)。一个 role 可绑定零或多个 skill。 -/
+structure AgentRoleSkillBinding where
+  /-- 所属组织(`PINNED`)。 -/
+  organization : I.OrganizationId
+  /-- 绑定的 role(`PINNED`)。 -/
+  roleId : String
+  /-- skill 名称(`PINNED`)。 -/
+  skillName : String
+  /-- skill 版本(`PINNED`)。 -/
+  skillVersion : String
+  /-- 排序(`PINNED`)。 -/
+  sortOrder : Nat
+
+end Spec.System

spec/Spec/System/Agent/AgentSurface.lean

@@ -0,0 +1,40 @@
+import Spec.Prelude
+import Spec.System.Agent.Run
+
+/-!
+# AgentSurface —— Agent 执行面边界(ADR-0018)
+
+Agent 在一次 run 内发起的文件操作,其路径必须落在该 run 所属 project 的工作区目录内
+(ADR-0007)。逃逸即越权,拒绝。
+
+与 `Lock`(ADR-0002)正交:Lock 限定并发(谁在改),Surface 限定波及面(能改到哪)。
+二者都按 run × project 作用域。
+
+shell 面的边界(命令的文件效果同样不得逃逸工作区)是同一不变式的推论。机制
+——路径校验、OS 级沙箱、SDK 权限钩子,或其组合——`OPEN`(ADR-0018)。
+-/
+
+namespace Spec.System
+
+variable (I : Identifiers) (Path : Type)
+
+/-- Agent 在一次 run 内发起的文件操作(`PINNED` 关系, ADR-0018)。由某 run 发起、
+指向某路径;是否越权由下方 `Authorized` 约束。 -/
+structure AgentFileOp where
+  /-- 发起操作的 run(授权上下文主体, ADR-0018;与 `Lock` 同作用域 run × project)。 -/
+  run : I.RunId
+  /-- 操作目标路径(`PINNED`, ADR-0018)。 -/
+  path : Path
+
+
+/-- 工作区边界良构:run 的文件操作路径必须落在该 run 所属 project 的工作区目录内
+(`PINNED` 安全不变式, ADR-0018)。`runWorkspace` 与 `pathWithin` 由平台提供
+(表示 `OPEN`);本谓词约束"操作路径必须以 run 的工作区为根",杜绝 agent 越权读写
+宿主任意文件。 -/
+def AgentFileOp.Authorized
+    (op : AgentFileOp I Path)
+    (runWorkspace : I.RunId → Option Path)
+    (pathWithin : Path → Path → Prop) : Prop :=
+  ∃ w, runWorkspace op.run = some w ∧ pathWithin op.path w
+
+end Spec.System

spec/Spec/System/Agent/Memory.lean

@@ -3,13 +3,13 @@ import Spec.Prelude
 /-!
 # Memory —— 按需上下文:锚点与项目记忆(ADR-0003)
 
-ADR-0003:Hub **只存锚点与项目记忆**,不存全量飞书消息历史;Claude 需要更多上下文时经
-飞书 API 按需读取。本模块刻画所存锚点的**类别**(ADR 列定,枚举完整性 OPEN——ADR 是
-"例如"式列举,新增类别不违反契约),并钉死一条 likec4 画不出的安全不变式:**MCP 工具
-按 run/project 上下文授权,Claude 不得传任意 chat id**(ADR-0003 Consequences 末条)。
+ADR-0003:Hub 只存锚点与项目记忆,不存全量飞书消息历史;Claude 需要更多上下文时经
+飞书 API 按需读取。这里刻画所存锚点的类别(ADR 列定,枚举完整性 OPEN),并约束
+一条安全不变式:MCP 工具按 run/project 上下文授权,Claude 不得传任意 chat id
+(ADR-0003 Consequences 末条)。
 
 "chat id 与 project 绑定"这一锚点类别由 `ProjectGroup.GroupBinding`(ADR-0001)权威承载,
-本模块不重复声明,只覆盖其余飞书侧指针(触发消息、状态卡片、回复、线程)。
+这里只覆盖其余飞书侧指针(触发消息、状态卡片、回复、线程)。
 -/
 
 namespace Spec.System
@@ -17,9 +17,8 @@ namespace Spec.System
 variable (I : Identifiers)
 variable (MessageId CardId : Type)
 
-/-- 上下文锚点(`PINNED` 类别, ADR-0003 列定;**枚举完整性 `OPEN`**——ADR 是"例如"式
-列举,实现若需新类别须 surface,不得默认本枚举已穷尽)。承载 Hub 保留的飞书侧最小指针,
-而非消息正文。 -/
+/-- 上下文锚点(`PINNED` 类别, ADR-0003;枚举完整性 `OPEN`——ADR 是"例如"式列举,
+实现若需新类别须 surface)。承载 Hub 保留的飞书侧最小指针,而非消息正文。 -/
 inductive Anchor where
   /-- 触发某次 run 的消息(`PINNED` 类别, ADR-0003 "trigger message id")。 -/
   | triggerMessage : MessageId → Anchor
@@ -35,13 +34,11 @@ MCP tools to read … through Feishu APIs")。 -/
 structure McpReadRequest where
   /-- 发起请求的 run(授权上下文主体, ADR-0003)。 -/
   run : I.RunId
-  /-- 请求读取的 chat(是否允许越界由下方 `Authorized` 钉死:不允许)。 -/
+  /-- 请求读取的 chat(授权由下方 `Authorized` 约束:不允许越界)。 -/
   chat : I.ChatId
 
 /-- 请求获授权:其 chat 必须等于该 run 所属 project 的绑定群(`PINNED` 安全不变式,
-ADR-0003 Consequences "MCP tools must authorize by run/project context; Claude cannot
-pass arbitrary chat ids")。`runProject`/`boundChat` 由平台提供(表示 `OPEN`);本谓词只
-钉死"chat 必须匹配 run 的 project 绑定",杜绝 Claude 传任意 chat id 越权读取。 -/
+ADR-0003)。"chat 必须匹配 run 的 project 绑定",杜绝 Claude 传任意 chat id。 -/
 def McpReadRequest.Authorized
     (req : McpReadRequest I)
     (runProject : I.RunId → Option I.ProjectId)